@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/compliance/privacy/personal-data-declaration.shared.utils.js

@@ -0,0 +1,43 @@
+import { resolveResourcePersonalDataCategories } from './personal-data-category.shared.schemas.js';
+/** True when the resource declares at least one of the four — see {@link PersonalDataDeclarationSubject}. */
+export function resourceAnsweredThePersonalDataQuestion(configuration) {
+    if (configuration.retentionPolicy?.mode !== undefined)
+        return true;
+    if (configuration.dataSubjectPolicy?.kind !== undefined)
+        return true;
+    if (configuration.systemAccessPolicy?.exportSubject !== undefined)
+        return true;
+    return resolveResourcePersonalDataCategories(configuration.mainSchema).categories.length > 0;
+}
+/**
+ * The APPLICATION's own resources that have said nothing about personal data.
+ *
+ * `applicationResourceTypes` is supplied by the caller rather than derived here, and that is the
+ * whole reason this takes two arguments. The engine's ~85 resources declare their own posture and an
+ * app author cannot change them, so including them would put 26 permanent entries in front of every
+ * reader of a report about THEIR application — which is how a diagnostic channel stops being read.
+ * The backend registry already separates the two at composition time, so the split is made once,
+ * where the app and core factory maps are actually distinguishable, rather than re-derived here from
+ * a key set that would then be a second enumeration of the same population.
+ */
+export function collectApplicationResourcesWithNoPersonalDataDeclaration(params) {
+    const unanswered = [];
+    for (const resourceType of params.applicationResourceTypes) {
+        const configuration = params.resourceConfigurations[resourceType];
+        if (configuration === undefined)
+            continue;
+        if (resourceAnsweredThePersonalDataQuestion(configuration))
+            continue;
+        const shape = configuration.mainSchema?.shape;
+        unanswered.push({
+            resourceType,
+            fieldCount: shape === undefined ? 0 : Object.keys(shape).length,
+        });
+    }
+    return unanswered;
+}
+/** Narrow a materialized configuration to the fields this report reads. Structural, so any shape carrying them satisfies it. */
+export function asPersonalDataDeclarationSubject(configuration) {
+    return configuration;
+}
+//# sourceMappingURL=personal-data-declaration.shared.utils.js.map

package/dist/esm/compliance/privacy/personal-data-declaration.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personal-data-declaration.shared.utils.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qCAAqC,EAAE,MAAM,yCAAyC,CAAC;AAmDhG,6GAA6G;AAC7G,MAAM,UAAU,uCAAuC,CAAC,aAA6C;IACnG,IAAI,aAAa,CAAC,eAAe,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,aAAa,CAAC,iBAAiB,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,aAAa,CAAC,kBAAkB,EAAE,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,qCAAqC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/F,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wDAAwD,CAAC,MAGxE;IACC,MAAM,UAAU,GAAqC,EAAE,CAAC;IAExD,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,wBAAwB,EAAE,CAAC;QAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,aAAa,KAAK,SAAS;YAAE,SAAS;QAC1C,IAAI,uCAAuC,CAAC,aAAa,CAAC;YAAE,SAAS;QAErE,MAAM,KAAK,GAAI,aAAa,CAAC,UAA8D,EAAE,KAAK,CAAC;QACnG,UAAU,CAAC,IAAI,CAAC;YACd,YAAY;YACZ,UAAU,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,gCAAgC,CAAC,aAA6C;IAC5F,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import type { ResourceDataSubjectPolicy, ResourceRetentionPolicy, ResourceSystemAccessPolicy } from '../../resources/resources-config.shared.schemas';\nimport { resolveResourcePersonalDataCategories } from './personal-data-category.shared.schemas';\n\n/**\n * Has this resource said ANYTHING about whether its rows are about people?\n *\n * ## The decision behind this, and what it is deliberately NOT\n *\n * Issue #93 asked whether a resource holding personal data should be REQUIRED to declare it, and the\n * evidence for requiring it was strong: measured across two applications, a declaration gets made if\n * and only if the framework refuses to start without it. `exportSubject` is fail-closed at\n * registration and was declared on 10 of 12 resources; `retentionPolicy` and `.impersonalizeWith()`\n * are not enforced and were declared on 1 and 0.\n *\n * **Paul decided against refusing.** A hard constraint on every application author, for every\n * resource, forever, is too strict — and the framework's own directive says the system must work\n * first, with protection arriving later as a judge-style guard rather than as a refusal wired into\n * the mechanism (`.claude/rules/application-creation-directive.md`).\n *\n * So this is a REPORT, and the report exists to be read by a human at startup. It never refuses, it\n * never throws, and nothing downstream branches on it. The other half of the decision — the half\n * that actually produces declarations — is the framework knowledge that teaches an author to write\n * one while they are authoring the resource, which is where a declaration is cheap.\n *\n * ## What counts as having answered\n *\n * ANY of four declarations, because they are four different questions and answering any one of them\n * means the author considered the subject:\n *\n * | declaration | the question it answers |\n * |---|---|\n * | `retentionPolicy.mode` | does an erasure keep this row, and are its fields scrubbed? |\n * | `dataSubjectPolicy.kind` | whose session does erasing this row end? |\n * | `systemAccessPolicy.exportSubject` | do these rows belong in a subject's export bundle? |\n * | a field carrying `.dataCategories()` | what KIND of personal data is held? |\n *\n * A resource declaring NONE of them has never been asked, and that is the only state this reports.\n * It is emphatically NOT a claim that the resource holds personal data — most resources do not, and\n * the report says \"unanswered\", never \"undeclared personal data\".\n *\n * ⚠️ `RETAIN_ONLY` counts as an ANSWER, and that is the point of admitting `retentionPolicy` at all:\n * its documented meaning is \"this resource holds no personal data of its own\", enforced by the\n * factory, which refuses a scrub treatment beside it. A resource that says so has answered the\n * question in the negative, deliberately, and must never appear in a gap list.\n */\nexport interface PersonalDataDeclarationSubject {\n  readonly retentionPolicy?: ResourceRetentionPolicy;\n  readonly dataSubjectPolicy?: ResourceDataSubjectPolicy;\n  readonly systemAccessPolicy?: ResourceSystemAccessPolicy;\n  readonly mainSchema?: unknown;\n}\n\n/** True when the resource declares at least one of the four — see {@link PersonalDataDeclarationSubject}. */\nexport function resourceAnsweredThePersonalDataQuestion(configuration: PersonalDataDeclarationSubject): boolean {\n  if (configuration.retentionPolicy?.mode !== undefined) return true;\n  if (configuration.dataSubjectPolicy?.kind !== undefined) return true;\n  if (configuration.systemAccessPolicy?.exportSubject !== undefined) return true;\n  return resolveResourcePersonalDataCategories(configuration.mainSchema).categories.length > 0;\n}\n\n/** One resource that has said nothing, with the size of what it holds so a reader can triage. */\nexport interface UnansweredPersonalDataResource {\n  readonly resourceType: string;\n  /** Top-level field count, purely to help a reader judge which to look at first. */\n  readonly fieldCount: number;\n}\n\n/**\n * The APPLICATION's own resources that have said nothing about personal data.\n *\n * `applicationResourceTypes` is supplied by the caller rather than derived here, and that is the\n * whole reason this takes two arguments. The engine's ~85 resources declare their own posture and an\n * app author cannot change them, so including them would put 26 permanent entries in front of every\n * reader of a report about THEIR application — which is how a diagnostic channel stops being read.\n * The backend registry already separates the two at composition time, so the split is made once,\n * where the app and core factory maps are actually distinguishable, rather than re-derived here from\n * a key set that would then be a second enumeration of the same population.\n */\nexport function collectApplicationResourcesWithNoPersonalDataDeclaration(params: {\n  readonly resourceConfigurations: Readonly<Record<string, PersonalDataDeclarationSubject>>;\n  readonly applicationResourceTypes: readonly string[];\n}): readonly UnansweredPersonalDataResource[] {\n  const unanswered: UnansweredPersonalDataResource[] = [];\n\n  for (const resourceType of params.applicationResourceTypes) {\n    const configuration = params.resourceConfigurations[resourceType];\n    if (configuration === undefined) continue;\n    if (resourceAnsweredThePersonalDataQuestion(configuration)) continue;\n\n    const shape = (configuration.mainSchema as { shape?: Record<string, unknown> } | undefined)?.shape;\n    unanswered.push({\n      resourceType,\n      fieldCount: shape === undefined ? 0 : Object.keys(shape).length,\n    });\n  }\n\n  return unanswered;\n}\n\n/** Narrow a materialized configuration to the fields this report reads. Structural, so any shape carrying them satisfies it. */\nexport function asPersonalDataDeclarationSubject(configuration: PersonalDataDeclarationSubject): PersonalDataDeclarationSubject {\n  return configuration;\n}\n"]}

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts

@@ -3,7 +3,7 @@
  *
  * Privacy-related schemas and enums for user data management
  */
-import { z } from 'zod';
+import { z } from "zod";
 /**
  * Profile Visibility Enum
  *
@@ -32,54 +32,67 @@ export declare enum PrivacyLevel {
     STANDARD = "standard",// Standard data collection
     ENHANCED = "enhanced"
 }
-export declare const LegalDocumentApprovalSchema: z.ZodObject<{
-    accepted: z.ZodDefault<z.ZodBoolean>;
-    acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-    acceptedVersion: z.ZodOptional<z.ZodString>;
-    ipAddress: z.ZodOptional<z.ZodIPv4>;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export type LegalDocumentApproval = z.infer<typeof LegalDocumentApprovalSchema>;
+/**
+ * Whether — and with what lifetime — this application identifies the CLIENT INSTALL
+ * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).
+ *
+ * A `clientInstanceId` answers "which browser/device install issued this request?", which the
+ * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`
+ * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a
+ * hostile actor's requests across sessions and logins — genuine security value, and exactly why it
+ * needs a policy rather than a default.
+ *
+ * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as
+ * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`
+ * state; one enum makes "off" and "how long it lives" a single, always-coherent decision.
+ *
+ * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the
+ * user's terminal equipment engages ePrivacy Directive Art 5(3), whose "strictly necessary"
+ * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a
+ * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and
+ * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not
+ * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)
+ * affirmatively want this correlation capability for audit review. Those pull in opposite
+ * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism
+ * OFF and each application decides, with counsel, which member it may lawfully select.
+ *
+ * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis
+ * and the compliance obligations that attach to each non-`DISABLED` member.
+ */
+export declare enum ClientInstanceIdScope {
+    /**
+     * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend
+     * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured
+     * client cannot start populating a pseudonymous identifier in an application's retained audit
+     * trail without that application ever opting in).
+     */
+    DISABLED = "disabled",
+    /**
+     * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a
+     * restart, so it cannot follow a user across visits. The proportionate choice when the goal is
+     * correlating one session's activity; the easiest to justify as strictly necessary.
+     */
+    SESSION = "session",
+    /**
+     * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and
+     * account switch. The strongest investigative signal (it links pre- and post-authentication
+     * activity, and two accounts used from one machine) and correspondingly the most likely to require
+     * consent. Select only with a recorded legitimate-interest assessment and, where required,
+     * consent-gating.
+     */
+    PERSISTENT = "persistent"
+}
 export declare const AnonymousUserPrivacySchema: z.ZodObject<{
     dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
-    dataProcessingAgreementApproval: z.ZodDefault<z.ZodObject<{
-        accepted: z.ZodDefault<z.ZodBoolean>;
-        acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-        acceptedVersion: z.ZodOptional<z.ZodString>;
-        ipAddress: z.ZodOptional<z.ZodIPv4>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;
 export declare const InboundContactPrivacySchema: z.ZodObject<{
     dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
-    dataProcessingAgreementApproval: z.ZodDefault<z.ZodObject<{
-        accepted: z.ZodDefault<z.ZodBoolean>;
-        acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-        acceptedVersion: z.ZodOptional<z.ZodString>;
-        ipAddress: z.ZodOptional<z.ZodIPv4>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;
 export declare const UserPrivacySchema: z.ZodObject<{
-    dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
-    privacyLevel: z.ZodDefault<z.ZodEnum<typeof PrivacyLevel>>;
-    termsOfUseApproval: z.ZodDefault<z.ZodObject<{
-        accepted: z.ZodDefault<z.ZodBoolean>;
-        acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-        acceptedVersion: z.ZodOptional<z.ZodString>;
-        ipAddress: z.ZodOptional<z.ZodIPv4>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-    privacyPolicyApproval: z.ZodDefault<z.ZodObject<{
-        accepted: z.ZodDefault<z.ZodBoolean>;
-        acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-        acceptedVersion: z.ZodOptional<z.ZodString>;
-        ipAddress: z.ZodOptional<z.ZodIPv4>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-    dataProcessingAgreementApproval: z.ZodDefault<z.ZodObject<{
-        accepted: z.ZodDefault<z.ZodBoolean>;
-        acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-        acceptedVersion: z.ZodOptional<z.ZodString>;
-        ipAddress: z.ZodOptional<z.ZodIPv4>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    dataProcessingConsent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>>;
+    privacyLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof PrivacyLevel>>>;
+}, z.core.$strip>;
 export type UserPrivacy = z.infer<typeof UserPrivacySchema>;
 //# sourceMappingURL=privacy.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAU,sBAAsB;IACjD,oBAAoB,yBAAyB,CAAM,uDAAuD;IAC1G,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAU,sBAAsB;IACjD,oBAAoB,yBAAyB,CAAM,uDAAuD;IAC1G,OAAO,YAAY;CACpB;AAED,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY,CAAQ,0BAA0B;IACrD,QAAQ,aAAa,CAAM,2BAA2B;IACtD,QAAQ,aAAa;CACtB;AAGD,eAAO,MAAM,2BAA2B;;;;;uCAKtC,CAAC;AAGH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,0BAA0B;;;;;;;;uCAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;;;;;;uCAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;uCAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY,CAAE,0BAA0B;IAC/C,QAAQ,aAAa,CAAE,2BAA2B;IAClD,QAAQ,aAAa;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.js

@@ -3,7 +3,7 @@
  *
  * Privacy-related schemas and enums for user data management
  */
-import { z } from 'zod';
+import { z } from "zod";
 /**
  * Profile Visibility Enum
  *
@@ -14,13 +14,13 @@ export var UserProfileVisibility;
     UserProfileVisibility["PUBLIC"] = "public";
     UserProfileVisibility["APPLICATION_INTERNAL"] = "application_internal";
     UserProfileVisibility["ORGANIZATION"] = "organization";
-    UserProfileVisibility["PRIVATE"] = "private"; // Visible to user only
+    UserProfileVisibility["PRIVATE"] = "private";
 })(UserProfileVisibility || (UserProfileVisibility = {}));
 export var OrganizationProfileVisibility;
 (function (OrganizationProfileVisibility) {
     OrganizationProfileVisibility["PUBLIC"] = "public";
     OrganizationProfileVisibility["APPLICATION_INTERNAL"] = "application_internal";
-    OrganizationProfileVisibility["PRIVATE"] = "private"; // Visible to user only
+    OrganizationProfileVisibility["PRIVATE"] = "private";
 })(OrganizationProfileVisibility || (OrganizationProfileVisibility = {}));
 export var DataProcessingConsent;
 (function (DataProcessingConsent) {
@@ -34,27 +34,81 @@ export var PrivacyLevel;
 (function (PrivacyLevel) {
     PrivacyLevel["MINIMAL"] = "minimal";
     PrivacyLevel["STANDARD"] = "standard";
-    PrivacyLevel["ENHANCED"] = "enhanced"; // Enhanced features with more data
+    PrivacyLevel["ENHANCED"] = "enhanced";
 })(PrivacyLevel || (PrivacyLevel = {}));
-export const LegalDocumentApprovalSchema = z.object({
-    accepted: z.boolean().default(false),
-    acceptedAt: z.iso.datetime().optional(),
-    acceptedVersion: z.string().optional(),
-    ipAddress: z.ipv4().optional()
-});
+/**
+ * Whether — and with what lifetime — this application identifies the CLIENT INSTALL
+ * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).
+ *
+ * A `clientInstanceId` answers "which browser/device install issued this request?", which the
+ * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`
+ * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a
+ * hostile actor's requests across sessions and logins — genuine security value, and exactly why it
+ * needs a policy rather than a default.
+ *
+ * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as
+ * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`
+ * state; one enum makes "off" and "how long it lives" a single, always-coherent decision.
+ *
+ * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the
+ * user's terminal equipment engages ePrivacy Directive Art 5(3), whose "strictly necessary"
+ * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a
+ * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and
+ * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not
+ * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)
+ * affirmatively want this correlation capability for audit review. Those pull in opposite
+ * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism
+ * OFF and each application decides, with counsel, which member it may lawfully select.
+ *
+ * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis
+ * and the compliance obligations that attach to each non-`DISABLED` member.
+ */
+export var ClientInstanceIdScope;
+(function (ClientInstanceIdScope) {
+    /**
+     * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend
+     * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured
+     * client cannot start populating a pseudonymous identifier in an application's retained audit
+     * trail without that application ever opting in).
+     */
+    ClientInstanceIdScope["DISABLED"] = "disabled";
+    /**
+     * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a
+     * restart, so it cannot follow a user across visits. The proportionate choice when the goal is
+     * correlating one session's activity; the easiest to justify as strictly necessary.
+     */
+    ClientInstanceIdScope["SESSION"] = "session";
+    /**
+     * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and
+     * account switch. The strongest investigative signal (it links pre- and post-authentication
+     * activity, and two accounts used from one machine) and correspondingly the most likely to require
+     * consent. Select only with a recorded legitimate-interest assessment and, where required,
+     * consent-gating.
+     */
+    ClientInstanceIdScope["PERSISTENT"] = "persistent";
+})(ClientInstanceIdScope || (ClientInstanceIdScope = {}));
 export const AnonymousUserPrivacySchema = z.object({
     dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC),
-    dataProcessingAgreementApproval: LegalDocumentApprovalSchema.default({ accepted: false })
 });
 export const InboundContactPrivacySchema = z.object({
     dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC),
-    dataProcessingAgreementApproval: LegalDocumentApprovalSchema.default({ accepted: false })
 });
 export const UserPrivacySchema = z.object({
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC),
-    privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD),
-    termsOfUseApproval: LegalDocumentApprovalSchema.default({ accepted: false }),
-    privacyPolicyApproval: LegalDocumentApprovalSchema.default({ accepted: false }),
-    dataProcessingAgreementApproval: LegalDocumentApprovalSchema.default({ accepted: false })
+    // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.
+    //
+    // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the
+    // collection scope — held as closed vocabularies, so recording their before/after values on
+    // `resource_operation_performed` is exactly the "mark what decides authority, never what
+    // identifies a person" rule that governs the same decorator on `UserSchema`.
+    //
+    // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document
+    // interactions are separate immutable release-bound records and are never embedded in preferences.
+    //
+    // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant
+    // decision and must leave a trail naming the previous and resulting value. Reached today by the
+    // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the
+    // same emission point, so no verb can change consent without a record.
+    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC).isAuditEvidence(),
+    privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD).isAuditEvidence(),
 });
-//# sourceMappingURL=privacy.shared.schemas.js.map
+//# sourceMappingURL=privacy.shared.schemas.js.map

package/dist/esm/compliance/privacy/privacy.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA,CAAQ,uBAAuB;AACpD,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA,CAAQ,uBAAuB;AACpD,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,wCAAe,CAAA;IACf,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,sCAAa,CAAA;AACf,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA,CAAM,mCAAmC;AAChE,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAGD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;IACzF,+BAA+B,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;CAC1F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;IACzF,+BAA+B,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;CAC1F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;IACzF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;IACjE,kBAAkB,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5E,qBAAqB,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/E,+BAA+B,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;CAC1F,CAAC,CAAC"}
+{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,wCAAe,CAAA;IACf,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,sCAAa,CAAA;AACf,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;CAC1F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;CAC1F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,2FAA2F;IAC3F,EAAE;IACF,yFAAyF;IACzF,4FAA4F;IAC5F,yFAAyF;IACzF,6EAA6E;IAC7E,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAC3G,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE;CACpF,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum DataProcessingConsent {\n  NONE = \"none\",\n  BASIC = \"basic\",\n  ANALYTICS = \"analytics\",\n  MARKETING = \"marketing\",\n  FULL = \"full\",\n}\n\nexport enum PrivacyLevel {\n  MINIMAL = \"minimal\", // Minimum data collection\n  STANDARD = \"standard\", // Standard data collection\n  ENHANCED = \"enhanced\", // Enhanced features with more data\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n\nexport const AnonymousUserPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.\n  //\n  // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the\n  // collection scope — held as closed vocabularies, so recording their before/after values on\n  // `resource_operation_performed` is exactly the \"mark what decides authority, never what\n  // identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting value. Reached today by the\n  // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the\n  // same emission point, so no verb can change consent without a record.\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC).isAuditEvidence(),\n  privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD).isAuditEvidence(),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts

@@ -1,15 +1,33 @@
 import { z } from "zod";
+/**
+ * Field-treatment vocabulary, shared by two consumers (D9 — "one authority axis"):
+ *  - flow-actors `redactionRules` (log / response redaction), and
+ *  - the impersonalization `.impersonalizeWith()` per-field treatment (erasure scrub —
+ *    scrub a person out of a record that must be retained).
+ *
+ * Adding members is additive for both consumers (no exhaustive switches read it).
+ * `KEEP` is meaningful only for impersonalization (never scrub this field) — the
+ * never-scrub scope-FK floor relies on it. Reversible tokenization is intentionally
+ * NOT in v1 (D6 = irreversible); `ENCRYPT` remains the existing reversible option, and a
+ * dedicated `TOKENIZE` member can be added additively if a vault-backed mode ships later.
+ */
 export declare enum RedactionType {
+    /** Replace with a fixed mask (e.g. `••••••••`). */
     MASK = "mask",
+    /** Remove / null the value. Impersonalization: the default scrub. */
     REMOVE = "remove",
+    /** Replace with a one-way hash — irreversible. */
     HASH = "hash",
-    ENCRYPT = "encrypt"
+    /** Replace with a reversible ciphertext (key-dependent). */
+    ENCRYPT = "encrypt",
+    /** Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. */
+    KEEP = "keep"
 }
 export declare const RedationRulesSchema: z.ZodObject<{
     fieldPath: z.ZodString;
     isRecursive: z.ZodDefault<z.ZodBoolean>;
     redactionType: z.ZodEnum<typeof RedactionType>;
-    forRoles: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../../index.js").CORE_APP_ROLES>, z.ZodEnum<typeof import("../../index.js").CORE_ORG_ROLES>, z.ZodString]>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    forRoles: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>;
+}, z.core.$strip>;
 export type RedationRules = z.infer<typeof RedationRulesSchema>;
 //# sourceMappingURL=redaction.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,oBAAY,aAAa;IACvB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAGD,eAAO,MAAM,mBAAmB;;;;;uCAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;GAWG;AACH,oBAAY,aAAa;IACvB,mDAAmD;IACnD,IAAI,SAAS;IACb,qEAAqE;IACrE,MAAM,WAAW;IACjB,kDAAkD;IAClD,IAAI,SAAS;IACb,4DAA4D;IAC5D,OAAO,YAAY;IACnB,uGAAuG;IACvG,IAAI,SAAS;CACd;AAGD,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/redaction.shared.schemas.js

@@ -1,11 +1,29 @@
 import { z } from "zod";
 import { RolesSchema } from "../../security/authorizations/roles.shared.schemas.js";
+/**
+ * Field-treatment vocabulary, shared by two consumers (D9 — "one authority axis"):
+ *  - flow-actors `redactionRules` (log / response redaction), and
+ *  - the impersonalization `.impersonalizeWith()` per-field treatment (erasure scrub —
+ *    scrub a person out of a record that must be retained).
+ *
+ * Adding members is additive for both consumers (no exhaustive switches read it).
+ * `KEEP` is meaningful only for impersonalization (never scrub this field) — the
+ * never-scrub scope-FK floor relies on it. Reversible tokenization is intentionally
+ * NOT in v1 (D6 = irreversible); `ENCRYPT` remains the existing reversible option, and a
+ * dedicated `TOKENIZE` member can be added additively if a vault-backed mode ships later.
+ */
 export var RedactionType;
 (function (RedactionType) {
+    /** Replace with a fixed mask (e.g. `••••••••`). */
     RedactionType["MASK"] = "mask";
+    /** Remove / null the value. Impersonalization: the default scrub. */
     RedactionType["REMOVE"] = "remove";
+    /** Replace with a one-way hash — irreversible. */
     RedactionType["HASH"] = "hash";
+    /** Replace with a reversible ciphertext (key-dependent). */
     RedactionType["ENCRYPT"] = "encrypt";
+    /** Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. */
+    RedactionType["KEEP"] = "keep";
 })(RedactionType || (RedactionType = {}));
 export const RedationRulesSchema = z.object({
     fieldPath: z.string(),
@@ -13,4 +31,4 @@ export const RedationRulesSchema = z.object({
     redactionType: z.enum(RedactionType),
     forRoles: z.array(RolesSchema).optional(),
 });
-//# sourceMappingURL=redaction.shared.schemas.js.map
+//# sourceMappingURL=redaction.shared.schemas.js.map

package/dist/esm/compliance/privacy/redaction.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,kCAAiB,CAAA;IACjB,8BAAa,CAAA;IACb,oCAAmB,CAAA;AACrB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAGD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC"}
+{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,aAWX;AAXD,WAAY,aAAa;IACvB,mDAAmD;IACnD,8BAAa,CAAA;IACb,qEAAqE;IACrE,kCAAiB,CAAA;IACjB,kDAAkD;IAClD,8BAAa,CAAA;IACb,4DAA4D;IAC5D,oCAAmB,CAAA;IACnB,uGAAuG;IACvG,8BAAa,CAAA;AACf,CAAC,EAXW,aAAa,KAAb,aAAa,QAWxB;AAGD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/**\n * Field-treatment vocabulary, shared by two consumers (D9 — \"one authority axis\"):\n *  - flow-actors `redactionRules` (log / response redaction), and\n *  - the impersonalization `.impersonalizeWith()` per-field treatment (erasure scrub —\n *    scrub a person out of a record that must be retained).\n *\n * Adding members is additive for both consumers (no exhaustive switches read it).\n * `KEEP` is meaningful only for impersonalization (never scrub this field) — the\n * never-scrub scope-FK floor relies on it. Reversible tokenization is intentionally\n * NOT in v1 (D6 = irreversible); `ENCRYPT` remains the existing reversible option, and a\n * dedicated `TOKENIZE` member can be added additively if a vault-backed mode ships later.\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask (e.g. `••••••••`). */\n  MASK = 'mask',\n  /** Remove / null the value. Impersonalization: the default scrub. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash — irreversible. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext (key-dependent). */\n  ENCRYPT = 'encrypt',\n  /** Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. */\n  KEEP = 'keep',\n}\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.d.ts

@@ -0,0 +1,124 @@
+import { z } from "zod";
+/**
+ * **The four data classes an application declares a retention period for.**
+ *
+ * ## Why four, and not one per resource
+ *
+ * `retentionPolicy.mode` on a resource says WHAT erasure does to a row. Nothing said HOW LONG a row
+ * is kept, and a privacy notice cannot be written without that number: a confident paragraph about
+ * impersonalization READS to a reader as an answer about retention, so the derivable half made the
+ * missing half harder to see rather than easier (issue #89).
+ *
+ * The first design put a duration on every resource. It was rejected as false precision: an operator
+ * decides "customer data three years, logs ninety days, audit seven years", not twelve numbers, and
+ * twelve numbers are twelve things to keep true. What an operator actually decides is a schedule over
+ * DATA CLASSES — and those classes are the ones that already differ in law, in storage and in who
+ * asks for them.
+ *
+ * ## The classes are the STORES, and that is deliberate
+ *
+ * Each member maps to a distinct backing service, so one declaration answers two questions that have
+ * always been asked separately: what a privacy notice must state, and what a backup-and-restore
+ * inventory must protect and for how long (issue #8, which today has no inventory of any kind).
+ *
+ * | class | where it lives |
+ * |---|---|
+ * | {@link RESOURCE_DATA} | MongoDB / PostgreSQL |
+ * | {@link FILES} | MinIO / S3 |
+ * | {@link AUDIT_LOGS} | immudb — the tamper-evident ledger |
+ * | {@link OPERATIONAL_LOGS} | the logging pipeline |
+ *
+ * Splitting further is available later and is not free: every additional class is another period an
+ * operator must decide and defend, and an undecided period is worse than a coarse one.
+ */
+export declare enum DataRetentionClass {
+    /**
+     * The application's own records — every resource row in its primary datastore.
+     *
+     * The class a privacy notice's retention paragraph is mostly about, because it is where the data a
+     * customer gave the application lives.
+     */
+    RESOURCE_DATA = "RESOURCE_DATA",
+    /** Uploaded file BYTES in object storage. Separate because their lawful window rarely matches the row that references them, and because losing them is a different incident from losing a row. */
+    FILES = "FILES",
+    /**
+     * The audit trail.
+     *
+     * Kept longest, and for a reason no other class shares: it is the record an operator needs to
+     * DEFEND itself, which is exactly the GDPR Art. 17(3) ground on which erasure may lawfully be
+     * refused. Never fold this into {@link RESOURCE_DATA} — doing so would let a shorter customer-data
+     * period silently shorten the evidence an operator may need years later.
+     */
+    AUDIT_LOGS = "AUDIT_LOGS",
+    /** Operational and diagnostic logs. Usually the shortest period, and the one most often left undeclared because nobody thinks of it as personal data — it routinely carries IP addresses and user identifiers. */
+    OPERATIONAL_LOGS = "OPERATIONAL_LOGS"
+}
+/**
+ * One declared retention period.
+ *
+ * `retentionDays` is REQUIRED when a class is declared at all: the whole point is the number. A class
+ * an application has not decided is OMITTED from the schedule, which is a different answer and stays
+ * a different answer — see {@link ApplicationRetentionScheduleSchema}.
+ */
+export declare const DataRetentionPeriodSchema: z.ZodObject<{
+    /**
+     * How long a record of this class is kept, counted from the point the application stops needing it
+     * for the purpose it was collected for.
+     *
+     * Days rather than a duration string because it is the unit every downstream consumer needs — a
+     * notice renders it, a backup schedule compares it, and a sweep would subtract it. A free-text
+     * period ("as long as necessary") is the placeholder this field exists to make impossible.
+     */
+    retentionDays: z.ZodNumber;
+    /**
+     * WHY this period, in the operator's words — the lawful basis, the contractual term, the statutory
+     * minimum.
+     *
+     * Required, and it is the field that keeps the number honest: a period with no stated reason is a
+     * guess that will be published as a commitment. A notice may render it; a reviewer certainly reads it.
+     */
+    rationale: z.ZodString;
+}, z.core.$strict>;
+export type DataRetentionPeriod = z.infer<typeof DataRetentionPeriodSchema>;
+/**
+ * The application's declared retention schedule — a period per {@link DataRetentionClass}.
+ *
+ * ## Partial ON PURPOSE, and absence is never read as "kept forever"
+ *
+ * Every class is optional, and an omitted class means *the operator has not decided this yet* — not
+ * that nothing is kept, and not that it is kept indefinitely. Both of those would be a statement, and
+ * neither is one anybody made.
+ *
+ * That is what makes this safe to ship before an operator has answered: a compliance document states
+ * the classes that ARE declared and marks the rest as needing a decision, naming who supplies it. The
+ * alternative — requiring all four — would block a document on a number nobody has yet, which is
+ * exactly the gate this whole capability exists to remove. **Never default a period.**
+ */
+export declare const ApplicationRetentionScheduleSchema: z.ZodRecord<z.ZodEnum<typeof DataRetentionClass> & z.core.$partial, z.ZodObject<{
+    /**
+     * How long a record of this class is kept, counted from the point the application stops needing it
+     * for the purpose it was collected for.
+     *
+     * Days rather than a duration string because it is the unit every downstream consumer needs — a
+     * notice renders it, a backup schedule compares it, and a sweep would subtract it. A free-text
+     * period ("as long as necessary") is the placeholder this field exists to make impossible.
+     */
+    retentionDays: z.ZodNumber;
+    /**
+     * WHY this period, in the operator's words — the lawful basis, the contractual term, the statutory
+     * minimum.
+     *
+     * Required, and it is the field that keeps the number honest: a period with no stated reason is a
+     * guess that will be published as a commitment. A notice may render it; a reviewer certainly reads it.
+     */
+    rationale: z.ZodString;
+}, z.core.$strict>>;
+export type ApplicationRetentionSchedule = z.infer<typeof ApplicationRetentionScheduleSchema>;
+/**
+ * The classes an application has NOT declared a period for — what a document must mark as owed.
+ *
+ * Derived rather than stored, and total over the enum, so a class added to the vocabulary tomorrow is
+ * reported as undeclared by every existing application rather than silently omitted from the answer.
+ */
+export declare function undeclaredRetentionClasses(schedule: ApplicationRetentionSchedule | undefined): readonly DataRetentionClass[];
+//# sourceMappingURL=retention-schedule.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}