npm - @wildo-ai/saas-models - Versions diffs - 1.1.0 → 1.1.2 - Mend

@wildo-ai/saas-models 1.1.0 → 1.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (292) hide show

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACrC,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,aAAa,KAAK,qBAAqB,CAAC,IAAI,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,+BAA+B,WAAW,CAAC,aAAa,4KAA4K;SAC9O,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,6DAA6D;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,4EAA4E;IAC5E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACtE,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { DataProcessingConsent } from './privacy.shared.schemas';\n\n/*\n GDPR Art. 6(1) — the six lawful bases, closed by the article.\n \n Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n \n spec-cite: GDPR Art. 6(1)(a)–(f).\n /\nexport enum LawfulBasis {\n /* Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. /\n CONSENT = 'CONSENT',\n /* Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. /\n CONTRACT = 'CONTRACT',\n /* Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. /\n LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n /* Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. /\n VITAL_INTERESTS = 'VITAL_INTERESTS',\n /* Art. 6(1)(e) — necessary for a task in the public interest or official authority. /\n PUBLIC_TASK = 'PUBLIC_TASK',\n /\n Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n * is refused below.\n /\n LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/* Whether the operator decides the purposes of a processing, carries them out for someone else, or both. /\nexport enum OperatorProcessingRole {\n /* The operator determines the purposes and means. /\n CONTROLLER = 'CONTROLLER',\n /* The operator processes on a customer's documented instructions — the usual B2B posture for customer records. /\n PROCESSOR = 'PROCESSOR',\n /* The operator and another party jointly determine purposes and means, and must have an arrangement saying how. /\n JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/\n ONE role, over ONE population of data.\n \n A single role field would be the wrong shape, and the produced notice said so before this existed:\n * \"This notice therefore does not assign a single legal role to all data processed in a workspace.\"\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n \n `dataScope` is prose the operator writes, deliberately. Nothing structured exists to key it to: the\n * processing purposes a notice states are derived from the application's vision and requirements as\n * PROSE, so a ref here would point at nothing.\n /\nexport const OperatorRoleAllocationSchema = z.strictObject({\n /* Which data this role covers, in the operator's own words — \"customer records in a workspace\". /\n dataScope: z.string().trim().min(1),\n role: z.enum(OperatorProcessingRole),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/* One processing purpose and the basis the operator relies on for it. /\nexport const OperatorLawfulBasisSchema = z.strictObject({\n /* The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. /\n purpose: z.string().trim().min(1),\n basis: z.enum(LawfulBasis),\n /\n The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n * that needs a balancing test — see the superRefine below.\n /\n assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n /\n * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n * conclusion nobody reached.\n /\n if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n context.addIssue({\n code: 'custom',\n path: ['assessmentNote'],\n message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n });\n }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/\n What a person must agree to in order to USE the service at all (issue #139).\n \n ## The near-miss this exists because of\n \n `analytics.requiredConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n \n Correcting it left a real hole, which a produced notice then reported in its own words:\n * \"There is no declared surface for recording a service-wide consent requirement distinct from\n analytics consent.\"* This is that surface.\n \n ## Why the floor may be NONE, and usually should be\n \n Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A required level above `NONE` says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n \n `NONE` is therefore both the default and the honest answer for most applications: nothing is\n gated on consent; the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.\n A field that pushed applications toward declaring consent would be worse than the gap it closes.\n \n ⚠️ Declaring a level here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n /\nexport const ServiceConsentRequirementSchema = z.strictObject({\n /\n The minimum consent a person must give to use the service.\n \n `NONE` means nothing is gated on consent — the common and usually correct answer. It is a\n * DECLARATION, not an absence: an application that says `NONE` has answered the question, which is\n * what separates it from one that has not been asked.\n /\n requiredLevel: z.enum(DataProcessingConsent),\n /\n What this gate actually controls, in the operator's own words.\n \n REQUIRED whenever the level is above `NONE`, because a gate nobody can describe is a gate nobody\n * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n * governs tells a person they must agree to something unnamed.\n /\n gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n /\n * A required level above NONE with nothing described is the shape that satisfies the field and\n * discloses nothing — the same defect as a revision recording no superseded rationale, and as a\n * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n * explanation is the half that makes it mean anything.\n /\n if (requirement.requiredLevel !== DataProcessingConsent.NONE && requirement.gatedProcessing === undefined) {\n context.addIssue({\n code: 'custom',\n path: ['gatedProcessing'],\n message: `a required consent level of ${requirement.requiredLevel} gates something — say what, or declare NONE. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n });\n }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/\n WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n \n ## Why this exists, and why in configuration\n \n A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n \n That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n \n Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n \n ## What is deliberately NOT here\n \n A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n /\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n /* The legal entity operating the service, as registered. /\n legalEntityName: z.string().trim().min(1),\n /* Its registered address, as a reader would need it to serve a request. /\n registeredAddress: z.string().trim().min(1),\n /\n How a data subject reaches the operator about privacy — an address, an email, or a URL.\n \n Open string because all three are legitimate and the law names none: what matters is that a route\n * exists and is stated, not what shape it takes.\n /\n privacyContact: z.string().trim().min(1),\n /\n An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n \n Optional, because most operators are established where their subjects are and appointing one\n * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n * when declared.\n /\n representative: z.strictObject({\n name: z.string().trim().min(1),\n address: z.string().trim().min(1),\n }).optional(),\n /\n The operator's role, per population of data. At least one.\n \n See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n /\n roleAllocations: z.array(OperatorRoleAllocationSchema).min(1),\n /\n The lawful basis relied on, per processing purpose. At least one.\n \n `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n * complete answer.\n /\n lawfulBases: z.array(OperatorLawfulBasisSchema).min(1),\n /\n What a person must consent to in order to use the service at all (issue #139).\n \n OPTIONAL, and absent means UNANSWERED rather than `NONE`. The distinction is the one this whole\n * lane turns on: a declared `NONE` is the operator saying nothing is gated on consent, while\n * absence is nobody having been asked, and a notice must not render the second as the first.\n /\n serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/\n The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n /\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] {\n const order = Object.values(LawfulBasis);\n return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/* True when the operator declares more than one role, so a notice must not assign a single one. */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean {\n return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}
1	+ {"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACrC,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,aAAa,KAAK,qBAAqB,CAAC,IAAI,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,+BAA+B,WAAW,CAAC,aAAa,4KAA4K;SAC9O,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACtE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;AAC9B,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KAC9F,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { DataProcessingConsent } from './privacy.shared.schemas';\n\n/*\n GDPR Art. 6(1) — the six lawful bases, closed by the article.\n \n Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n \n spec-cite: GDPR Art. 6(1)(a)–(f).\n /\nexport enum LawfulBasis {\n /* Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. /\n CONSENT = 'CONSENT',\n /* Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. /\n CONTRACT = 'CONTRACT',\n /* Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. /\n LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n /* Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. /\n VITAL_INTERESTS = 'VITAL_INTERESTS',\n /* Art. 6(1)(e) — necessary for a task in the public interest or official authority. /\n PUBLIC_TASK = 'PUBLIC_TASK',\n /\n Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n * is refused below.\n /\n LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/* Whether the operator decides the purposes of a processing, carries them out for someone else, or both. /\nexport enum OperatorProcessingRole {\n /* The operator determines the purposes and means. /\n CONTROLLER = 'CONTROLLER',\n /* The operator processes on a customer's documented instructions — the usual B2B posture for customer records. /\n PROCESSOR = 'PROCESSOR',\n /* The operator and another party jointly determine purposes and means, and must have an arrangement saying how. /\n JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/\n ONE role, over ONE population of data.\n \n A single role field would be the wrong shape, and the produced notice said so before this existed:\n * \"This notice therefore does not assign a single legal role to all data processed in a workspace.\"\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n \n `dataScope` is prose the operator writes, deliberately. Nothing structured exists to key it to: the\n * processing purposes a notice states are derived from the application's vision and requirements as\n * PROSE, so a ref here would point at nothing.\n /\nexport const OperatorRoleAllocationSchema = z.strictObject({\n /* Which data this role covers, in the operator's own words — \"customer records in a workspace\". /\n dataScope: z.string().trim().min(1),\n role: z.enum(OperatorProcessingRole),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/* One processing purpose and the basis the operator relies on for it. /\nexport const OperatorLawfulBasisSchema = z.strictObject({\n /* The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. /\n purpose: z.string().trim().min(1),\n basis: z.enum(LawfulBasis),\n /\n The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n * that needs a balancing test — see the superRefine below.\n /\n assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n /\n * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n * conclusion nobody reached.\n /\n if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n context.addIssue({\n code: 'custom',\n path: ['assessmentNote'],\n message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n });\n }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/\n What a person must agree to in order to USE the service at all (issue #139).\n \n ## The near-miss this exists because of\n \n `analytics.requiredConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n \n Correcting it left a real hole, which a produced notice then reported in its own words:\n * \"There is no declared surface for recording a service-wide consent requirement distinct from\n analytics consent.\"* This is that surface.\n \n ## Why the floor may be NONE, and usually should be\n \n Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A required level above `NONE` says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n \n `NONE` is therefore both the default and the honest answer for most applications: nothing is\n gated on consent; the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.\n A field that pushed applications toward declaring consent would be worse than the gap it closes.\n \n ⚠️ Declaring a level here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n /\nexport const ServiceConsentRequirementSchema = z.strictObject({\n /\n The minimum consent a person must give to use the service.\n \n `NONE` means nothing is gated on consent — the common and usually correct answer. It is a\n * DECLARATION, not an absence: an application that says `NONE` has answered the question, which is\n * what separates it from one that has not been asked.\n /\n requiredLevel: z.enum(DataProcessingConsent),\n /\n What this gate actually controls, in the operator's own words.\n \n REQUIRED whenever the level is above `NONE`, because a gate nobody can describe is a gate nobody\n * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n * governs tells a person they must agree to something unnamed.\n /\n gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n /\n * A required level above NONE with nothing described is the shape that satisfies the field and\n * discloses nothing — the same defect as a revision recording no superseded rationale, and as a\n * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n * explanation is the half that makes it mean anything.\n /\n if (requirement.requiredLevel !== DataProcessingConsent.NONE && requirement.gatedProcessing === undefined) {\n context.addIssue({\n code: 'custom',\n path: ['gatedProcessing'],\n message: `a required consent level of ${requirement.requiredLevel} gates something — say what, or declare NONE. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n });\n }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/\n WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n \n ## Why this exists, and why in configuration\n \n A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n \n That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n \n Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n \n ## What is deliberately NOT here\n \n A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n \n ## Every part is independently declarable, and that is the point (issue #228)\n \n This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n \n Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n \n What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a consent level above `NONE` still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n /\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n /* The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. /\n legalEntityName: z.string().trim().min(1).optional(),\n /* Its registered address, as a reader would need it to serve a request. Absent means unanswered. /\n registeredAddress: z.string().trim().min(1).optional(),\n /\n How a data subject reaches the operator about privacy — an address, an email, or a URL.\n \n Open string because all three are legitimate and the law names none: what matters is that a route\n * exists and is stated, not what shape it takes.\n /\n privacyContact: z.string().trim().min(1).optional(),\n /\n An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n \n Optional, because most operators are established where their subjects are and appointing one\n * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n * when declared.\n /\n representative: z.strictObject({\n name: z.string().trim().min(1),\n address: z.string().trim().min(1),\n }).optional(),\n /\n The operator's role, per population of data. At least one.\n \n See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n /\n roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n /\n The lawful basis relied on, per processing purpose. At least one.\n \n `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n * complete answer.\n /\n lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).optional(),\n /\n What a person must consent to in order to use the service at all (issue #139).\n \n OPTIONAL, and absent means UNANSWERED rather than `NONE`. The distinction is the one this whole\n * lane turns on: a declared `NONE` is the operator saying nothing is gated on consent, while\n * absence is nobody having been asked, and a notice must not render the second as the first.\n /\n serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n}).superRefine((identity, context) => {\n /\n * A declaration with nothing in it is a no-op that reads as an answer.\n \n Every part is independently optional so an operator can record the half they know (#228), and the\n * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n * consumer already renders as outstanding, while an empty object would satisfy the field and\n * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n * with no assessment and a consent gate that names nothing.\n /\n if (Object.values(identity).every((part) => part === undefined)) {\n context.addIssue({\n code: 'custom',\n path: [],\n message:\n 'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n });\n }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/\n The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n \n A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n \n `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredLevel = NONE`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n /\nexport enum OperatorComplianceIdentityPart {\n LEGAL_ENTITY_NAME = 'legalEntityName',\n REGISTERED_ADDRESS = 'registeredAddress',\n PRIVACY_CONTACT = 'privacyContact',\n ROLE_ALLOCATIONS = 'roleAllocations',\n LAWFUL_BASES = 'lawfulBases',\n}\n\n/\n Which parts of the identity are still owed, in declaration order.\n \n Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n /\nexport function outstandingOperatorComplianceIdentityParts(\n identity: ApplicationOperatorComplianceIdentity \| undefined,\n): readonly OperatorComplianceIdentityPart[] {\n return [\n identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/\n The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n \n `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n /\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] \| undefined {\n if (identity.lawfulBases === undefined) return undefined;\n const order = Object.values(LawfulBasis);\n return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/\n True when the operator declares more than one role, so a notice must not assign a single one.\n \n `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean \| undefined {\n if (identity.roleAllocations === undefined) return undefined;\n return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts CHANGED Viewed

@@ -21,7 +21,27 @@ export declare enum RedactionType {
     /** Replace with a reversible ciphertext (key-dependent). */
     ENCRYPT = "encrypt",
     /** Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. */
-    KEEP = "keep"
+    KEEP = "keep",
+    /**
+     * Impersonalization only: reset the field to its OWN schema default.
+     *
+     * The treatment for a field that is non-nullable and carries a `.default()` — where neither of the
+     * other two reaches. `REMOVE` writes null, which fails the strict re-parse of the row erasure just
+     * wrote; `MASK` cannot express the value, because `maskValue` is typed `string` while these fields
+     * are arrays, records, numbers, dates and objects.
+     *
+     * That is not a rare shape. Measured 2026-08-31 across the engine schemas still owed an erasure
+     * posture, ELEVEN categorized fields were of it and NONE was scrubbable — behavioural counters,
+     * stage histories, notification preferences, regional settings carrying LOCATION. Those resources
+     * could declare no honest posture at all: `RETAIN_AND_IMPERSONALIZE` is refused when nothing would
+     * be scrubbed, and `RETAIN_ONLY` would assert they hold no personal data, which is false.
+     *
+     * The value comes from the schema rather than from the author, deliberately. A second copy of every
+     * default would drift from the first, and "what this field is when nobody has set it" is a question
+     * the schema already answers — for a person's settings and counters that is exactly what erasure
+     * should leave behind.
+     */
+    RESET = "reset"
 }
 export declare const RedationRulesSchema: z.ZodObject<{
     fieldPath: z.ZodString;

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;GAWG;AACH,oBAAY,aAAa;IACvB,mDAAmD;IACnD,IAAI,SAAS;IACb,qEAAqE;IACrE,MAAM,WAAW;IACjB,kDAAkD;IAClD,IAAI,SAAS;IACb,4DAA4D;IAC5D,OAAO,YAAY;IACnB,uGAAuG;IACvG,IAAI,SAAS;~~CACd~~;AAGD,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
1	+ {"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;GAWG;AACH,oBAAY,aAAa;IACvB,mDAAmD;IACnD,IAAI,SAAS;IACb,qEAAqE;IACrE,MAAM,WAAW;IACjB,kDAAkD;IAClD,IAAI,SAAS;IACb,4DAA4D;IAC5D,OAAO,YAAY;IACnB,uGAAuG;IACvG,IAAI,SAAS;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,UAAU;CAChB;AAGD,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/redaction.shared.schemas.js CHANGED Viewed

@@ -24,6 +24,26 @@ export var RedactionType;
     RedactionType["ENCRYPT"] = "encrypt";
     /** Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. */
     RedactionType["KEEP"] = "keep";
+    /**
+     * Impersonalization only: reset the field to its OWN schema default.
+     *
+     * The treatment for a field that is non-nullable and carries a `.default()` — where neither of the
+     * other two reaches. `REMOVE` writes null, which fails the strict re-parse of the row erasure just
+     * wrote; `MASK` cannot express the value, because `maskValue` is typed `string` while these fields
+     * are arrays, records, numbers, dates and objects.
+     *
+     * That is not a rare shape. Measured 2026-08-31 across the engine schemas still owed an erasure
+     * posture, ELEVEN categorized fields were of it and NONE was scrubbable — behavioural counters,
+     * stage histories, notification preferences, regional settings carrying LOCATION. Those resources
+     * could declare no honest posture at all: `RETAIN_AND_IMPERSONALIZE` is refused when nothing would
+     * be scrubbed, and `RETAIN_ONLY` would assert they hold no personal data, which is false.
+     *
+     * The value comes from the schema rather than from the author, deliberately. A second copy of every
+     * default would drift from the first, and "what this field is when nobody has set it" is a question
+     * the schema already answers — for a person's settings and counters that is exactly what erasure
+     * should leave behind.
+     */
+    RedactionType["RESET"] = "reset";
 })(RedactionType || (RedactionType = {}));
 export const RedationRulesSchema = z.object({
     fieldPath: z.string(),

package/dist/esm/compliance/privacy/redaction.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,~~aAWX~~;~~AAXD~~,WAAY,aAAa;IACvB,mDAAmD;IACnD,8BAAa,CAAA;IACb,qEAAqE;IACrE,kCAAiB,CAAA;IACjB,kDAAkD;IAClD,8BAAa,CAAA;IACb,4DAA4D;IAC5D,oCAAmB,CAAA;IACnB,uGAAuG;IACvG,8BAAa,CAAA;~~AACf~~,CAAC,~~EAXW~~,aAAa,KAAb,aAAa,~~QAWxB~~;AAGD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n Field-treatment vocabulary, shared by two consumers (D9 — \"one authority axis\"):\n * - flow-actors `redactionRules` (log / response redaction), and\n * - the impersonalization `.impersonalizeWith()` per-field treatment (erasure scrub —\n * scrub a person out of a record that must be retained).\n \n Adding members is additive for both consumers (no exhaustive switches read it).\n * `KEEP` is meaningful only for impersonalization (never scrub this field) — the\n * never-scrub scope-FK floor relies on it. Reversible tokenization is intentionally\n * NOT in v1 (D6 = irreversible); `ENCRYPT` remains the existing reversible option, and a\n * dedicated `TOKENIZE` member can be added additively if a vault-backed mode ships later.\n /\nexport enum RedactionType {\n /* Replace with a fixed mask (e.g. `••••••••`). /\n MASK = 'mask',\n /* Remove / null the value. Impersonalization: the default scrub. /\n REMOVE = 'remove',\n /* Replace with a one-way hash — irreversible. /\n HASH = 'hash',\n /* Replace with a reversible ciphertext (key-dependent). /\n ENCRYPT = 'encrypt',\n /* Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. */\n KEEP = 'keep',\n}\n\n\nexport const RedationRulesSchema = z.object({\n fieldPath: z.string(),\n isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n redactionType: z.enum(RedactionType),\n forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}
1	+ {"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,aA+BX;AA/BD,WAAY,aAAa;IACvB,mDAAmD;IACnD,8BAAa,CAAA;IACb,qEAAqE;IACrE,kCAAiB,CAAA;IACjB,kDAAkD;IAClD,8BAAa,CAAA;IACb,4DAA4D;IAC5D,oCAAmB,CAAA;IACnB,uGAAuG;IACvG,8BAAa,CAAA;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAAe,CAAA;AACjB,CAAC,EA/BW,aAAa,KAAb,aAAa,QA+BxB;AAGD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n Field-treatment vocabulary, shared by two consumers (D9 — \"one authority axis\"):\n * - flow-actors `redactionRules` (log / response redaction), and\n * - the impersonalization `.impersonalizeWith()` per-field treatment (erasure scrub —\n * scrub a person out of a record that must be retained).\n \n Adding members is additive for both consumers (no exhaustive switches read it).\n * `KEEP` is meaningful only for impersonalization (never scrub this field) — the\n * never-scrub scope-FK floor relies on it. Reversible tokenization is intentionally\n * NOT in v1 (D6 = irreversible); `ENCRYPT` remains the existing reversible option, and a\n * dedicated `TOKENIZE` member can be added additively if a vault-backed mode ships later.\n /\nexport enum RedactionType {\n /* Replace with a fixed mask (e.g. `••••••••`). /\n MASK = 'mask',\n /* Remove / null the value. Impersonalization: the default scrub. /\n REMOVE = 'remove',\n /* Replace with a one-way hash — irreversible. /\n HASH = 'hash',\n /* Replace with a reversible ciphertext (key-dependent). /\n ENCRYPT = 'encrypt',\n /* Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. /\n KEEP = 'keep',\n /\n Impersonalization only: reset the field to its OWN schema default.\n \n The treatment for a field that is non-nullable and carries a `.default()` — where neither of the\n * other two reaches. `REMOVE` writes null, which fails the strict re-parse of the row erasure just\n * wrote; `MASK` cannot express the value, because `maskValue` is typed `string` while these fields\n * are arrays, records, numbers, dates and objects.\n \n That is not a rare shape. Measured 2026-08-31 across the engine schemas still owed an erasure\n * posture, ELEVEN categorized fields were of it and NONE was scrubbable — behavioural counters,\n * stage histories, notification preferences, regional settings carrying LOCATION. Those resources\n * could declare no honest posture at all: `RETAIN_AND_IMPERSONALIZE` is refused when nothing would\n * be scrubbed, and `RETAIN_ONLY` would assert they hold no personal data, which is false.\n \n The value comes from the schema rather than from the author, deliberately. A second copy of every\n * default would drift from the first, and \"what this field is when nobody has set it\" is a question\n * the schema already answers — for a person's settings and counters that is exactly what erasure\n * should leave behind.\n */\n RESET = 'reset',\n}\n\n\nexport const RedationRulesSchema = z.object({\n fieldPath: z.string(),\n isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n redactionType: z.enum(RedactionType),\n forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}

package/dist/esm/config/app-configuration-shared.shared.schemas.d.ts CHANGED Viewed

@@ -85,6 +85,7 @@ export declare const AppConfiguration_Shared_AppIdentity_Schema: z.ZodObject<{
     displayName: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodString>;
     version: z.ZodString;
+    applicationId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const AppConfiguration_Shared_AppPreferencesLanguage_Schema: z.ZodObject<{
     defaultLanguage: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof AvailableLanguage>>>;
@@ -196,6 +197,7 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
         displayName: z.ZodOptional<z.ZodString>;
         description: z.ZodOptional<z.ZodString>;
         version: z.ZodString;
+        applicationId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     brandAssets: z.ZodOptional<z.ZodArray<z.ZodObject<{
         composition: z.ZodEnum<typeof import("./brand-assets.shared.schemas").BrandAssetComposition>;

package/dist/esm/config/app-configuration-shared.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration-shared.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAmC,MAAM,6CAA6C,CAAC;AAGzH,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAKlK,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AAEvF,OAAO,EAIL,mBAAmB,EACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,yBAAyB;;;;;;;;iBAgBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;CAO9B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAIzH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAsC7C,CAAC;AAKH,eAAO,MAAM,wCAAwC;;;;iBAmBnD,CAAC;AAIH,eAAO,MAAM,0CAA0C~~;;;;;iBAQrD~~,CAAC;AAGH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAGH,eAAO,MAAM,4CAA4C,GAAI,CAAC,SAAS,yBAAyB,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;;;;;iBAO5H,CAAA;AAED,eAAO,MAAM,qCAAqC;;;;;iBAAgF,CAAC;AAQnI,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAED,iHAAiH;AACjH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAe1C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6ChC,CAAC;AAOH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoEzC,CAAC;AAGH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC7G,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACnI,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
1	+ {"version":3,"file":"app-configuration-shared.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAmC,MAAM,6CAA6C,CAAC;AAGzH,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAKlK,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AAEvF,OAAO,EAIL,mBAAmB,EACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,yBAAyB;;;;;;;;iBAgBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;CAO9B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAIzH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAsC7C,CAAC;AAKH,eAAO,MAAM,wCAAwC;;;;iBAmBnD,CAAC;AAIH,eAAO,MAAM,0CAA0C;;;;;;iBAqCrD,CAAC;AAGH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAGH,eAAO,MAAM,4CAA4C,GAAI,CAAC,SAAS,yBAAyB,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;;;;;iBAO5H,CAAA;AAED,eAAO,MAAM,qCAAqC;;;;;iBAAgF,CAAC;AAQnI,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAED,iHAAiH;AACjH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAe1C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6ChC,CAAC;AAOH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoEzC,CAAC;AAGH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC7G,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACnI,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/esm/config/app-configuration-shared.shared.schemas.js CHANGED Viewed

@@ -130,6 +130,35 @@ export const AppConfiguration_Shared_AppIdentity_Schema = z.object({
     /** Short description of the application */
     description: z.string().optional(),
     version: z.string().min(1, { error: 'Version is required' }),
+    /**
+     * The application's own id — the scope an APPLICATION-scoped resource's WebSocket room is keyed on.
+     *
+     * ## Why the client needs it, measured rather than argued
+     *
+     * `deriveResourceScopeRoomQualifiers` yields the `app` room only when `applicationId` is present in
+     * the context it is handed, and a read's context is built from the URL's contextual parameters —
+     * which never carry one, because an application id is AMBIENT rather than addressed. Nothing else
+     * published it either: the access token's claims carry `userId` and no `applicationId`, and this
+     * very object carried only `appName`/`displayName`/`version`.
+     *
+     * The consequence was silent. On 2026-09-03 the workbench subscribed to `org` and `user` for an
+     * APPLICATION-scoped resource and was confirmed in both, while the companion published that
+     * resource's changes to the `app` room. Correct producer, confirmed subscriber, different rooms,
+     * zero frames delivered (issue #283).
+     *
+     * ## Why it is safe to publish here
+     *
+     * It is an IDENTIFIER, not a credential: it names which application this deployment is, it grants
+     * nothing, and every authenticated request already acts within it. The room name a client must
+     * compute is derived from it, so a client that may subscribe at all must be able to name it —
+     * authorization for that room is decided server-side against the SUBSCRIBED RESOURCE, never
+     * against possession of this value (issue #247).
+     *
+     * OPTIONAL because a deployment that predates this field must keep loading. A consumer that does
+     * not find it degrades to the previous behaviour — it derives whatever rooms its parameters imply
+     * and does not hear the application-room push — rather than failing.
+     */
+    applicationId: z.string().min(1).optional(),
 });
 export const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({
     defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),

package/dist/esm/config/app-configuration-shared.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAClK,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE5C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAEnH;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC;CAE7F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAC7D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,2EAA2E;IAC3E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAEvF;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C,qEAAqE;IACrE,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,yCAAyC;IACzC,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAErD,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE/C,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAE9C,CAAC,CAAC","sourcesContent":["/*\n Frontend Application Configuration Schemas\n \n Pure frontend configuration schemas that define what configuration\n * the frontend applications expect to receive from backend endpoints.\n \n NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol\n * defined at the provider level in external-connectors, just like REST_API\n * and HOOKS protocols. This configuration only enables/disables which\n * external providers are available for SSO authentication.\n /\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport { z } from 'zod';\nimport { AllSharedApplicationTypes, AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas';\nimport { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas';\nimport { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas';\nimport { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';\nimport { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas';\nimport { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas';\nimport { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas';\nimport { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { ValueMomentSchema } from './analytics-value-moments.shared.schemas';\nimport {\n UserTypesConfigSchema,\n FrontendServicesConfigSchema,\n OrganizationTypesConfigSchema,\n OrgAuthMethodPolicy,\n} from './entity-identity-config.shared.schemas';\n\n\n\n/\n Shared Password Policy Rules Schema\n \n Contains ONLY the validation rules that both frontend and backend need.\n * The backend extends these rules with hashing config (argon2 params)\n * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.\n \n Frontend uses these rules for:\n * - Real-time password strength validation as user types\n * - Password policy indicator in reset/registration forms\n /\n\n\nexport const PasswordPolicyRulesSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /\n R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),\n * NOT used in the client-side password pre-check — but it IS a field of this shared schema and\n * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).\n * Non-secret. (Corrected from the prior \"Backend-only\" which wrongly implied it is never serialized.)\n * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema\n * — the invitation response `.parse()` silently strips any field present there but absent here.\n /\n expiryDays: z.number().min(0).default(0),\n});\n\nexport type PasswordPolicyRules = z.infer<typeof PasswordPolicyRulesSchema>;\n\n/\n I18n label keys for password policy violations.\n * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.\n * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.\n /\nexport const PasswordPolicyViolationCode = {\n MIN_LENGTH: 'policyMinLength',\n MAX_LENGTH: 'policyMaxLength',\n UPPERCASE: 'policyUppercase',\n LOWERCASE: 'policyLowercase',\n NUMBER: 'policyNumber',\n SPECIAL_CHAR: 'policySpecialChar',\n} as const;\n\nexport type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];\n\n\n\n/\n Global Auth Config — infrastructure + app-level only.\n \n Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,\n * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,\n * methodManagement) is now per-user-type on UserTypeAuthPolicySchema\n * in entity-identity-config.shared.schemas.ts.\n \n This section retains only infrastructure and app-level settings that apply\n * equally regardless of user type.\n \n /\nexport const AppConfiguration_Shared_AuthSchema = z.object({\n\n // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────\n\n passkeyConfig: z.object({\n rpName: z.string().min(1),\n rpId: z.string().min(1),\n maxPasskeysPerUser: z.number().min(1).max(50).default(10),\n }),\n\n /*\n Minimal frontend-facing social OAuth2 projection.\n \n Backend runtime still owns the full backend-private\n * `auth.socialOAuth2Providers` authoring shape\n * (enabled flags, scopes, allowed domains, secrets-related semantics). The\n * shared `/application-config` payload only needs the enabled public provider\n * refs plus an optional app-authored display-name override.\n /\n socialOAuth2Providers: z.record(\n z.string(),\n z.object({\n displayName: z.string().optional(),\n })).default({}),\n\n /* E-10, D-15: How much orgs can override user-type auth methods. /\n orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),\n\n /* E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. /\n expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),\n\n /* E-4, D-2: Can a user authenticated via Org A SSO access Org B? /\n crossOrgSSOAccess: z.boolean().default(true),\n\n // W6.8: All per-user-type auth policy fields REMOVED.\n // Use userTypes[t].auth. instead (see entity-identity-config.shared.schemas.ts).\n // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).\n\n});\n\n\n\n\nexport const AppConfiguration_Shared_ComplianceSchema = z.object({\n userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),\n organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),\n\n /*\n Client-install identification policy (`clientInstanceId`) — OFF unless authored.\n \n Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on\n * the SHARED config because both halves of the mechanism must obey ONE authored value: the\n * frontend decides whether to mint/store/send the id, and the backend independently decides\n * whether to ingest and record it. Two gates, one source — an application that never opts in is\n * protected even if some client sends the header anyway.\n \n Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one\n * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the\n * obligations attached to each non-`DISABLED` member.\n /\n clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),\n\n});\n\n\n\nexport const AppConfiguration_Shared_AppIdentity_Schema = z.object({\n /* Technical app name — used as fallback when displayName is absent /\n appName: z.string().min(1, { error: 'Application name is required' }),\n /* Human-readable display name shown in UI and emails /\n displayName: z.string().optional(),\n /* Short description of the application /\n description: z.string().optional(),\n version: z.string().min(1, { error: 'Version is required' }),\n});\n\n\nexport const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({\n defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),\n fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n autoDetectFromBrowser: z.boolean().default(true),\n allowUserOverride: z.boolean().default(true),\n allowOrganizationOverride: z.boolean().default(true),\n enableLanguageSwitcher: z.boolean().default(true)\n});\n\n\nexport const appConfiguration_Shared_RuntimeSchemaBuilder = <T extends AllSharedApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n return z.object({\n endPoints: z.record(z.string(), z.object({\n publicUrl: z.string().optional(),\n internalUrl: z.string().optional(),\n })),\n })\n}\n\nexport const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);\n\n\n\n// =====================================================\n// Analytics Configuration\n// =====================================================\n\nexport enum AnalyticsProviderType {\n CONSOLE = 'console',\n BACKEND_PROXY = 'backend_proxy',\n}\n\n/* Uses providerType (not \"type\") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. /\nexport const AnalyticsProviderConfigSchema = z.object({\n providerType: z.enum(AnalyticsProviderType),\n config: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const AutoInstrumentationConfigSchema = z.object({\n /* Track page views (NAVIGATION_PANE_CHANGED events) /\n pageViews: z.boolean().default(true),\n /* Track resource operations (NOTIFY_RESOURCE_SUCCESS events) /\n resourceOperations: z.boolean().default(true),\n /* Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. /\n trackErrors: z.boolean().default(true),\n /* Track feature gate hits (shown/blocked) — debounced per feature per session /\n featureGate: z.boolean().default(true),\n /* Track user lifecycle events (login, logout, status changes) /\n userLifecycle: z.boolean().default(true),\n /* Track notification events (NOTIFY_CUSTOM_* events) /\n notifications: z.boolean().default(false),\n /* Track hotkey usage /\n hotkeys: z.boolean().default(false),\n});\n\nexport const AnalyticsConfigSchema = z.object({\n /* Master switch — false = no analytics at all, regardless of user consent /\n enabled: z.boolean().default(false),\n\n /* Registered analytics providers /\n providers: z.array(AnalyticsProviderConfigSchema).default([]),\n\n /* Minimum consent level required for analytics (defaults to ANALYTICS) /\n requiredConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.ANALYTICS),\n\n /\n SINGLE DECLARATION SURFACE for all value moments.\n * TTFV, aha moments, activation stages, and anti-patterns are all here,\n * distinguished by their `role` field.\n /\n valueMoments: z.array(ValueMomentSchema).optional(),\n\n /* Persistence and evaluation configuration /\n persistence: z.object({\n /* Persist achieved moments to localStorage (default: true) /\n localStorage: z.boolean().default(true),\n /* Sync achieved moments to backend (default: true) /\n backendSync: z.boolean().default(true),\n /\n Backend evaluates RESOURCE_STATE signals + cronjob-originated events.\n * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).\n * When false, frontend does optimistic cached count queries.\n /\n backendEvaluation: z.boolean().default(true),\n }).default({\n localStorage: true,\n backendSync: true,\n backendEvaluation: true,\n }),\n\n /* Auto-instrumentation configuration /\n autoInstrumentation: AutoInstrumentationConfigSchema.default({\n pageViews: true,\n resourceOperations: true,\n trackErrors: true,\n featureGate: true,\n userLifecycle: true,\n notifications: false,\n hotkeys: false,\n }),\n});\n\n\n// =====================================================\n// Main Shared App Configuration\n// =====================================================\n\nexport const AppConfiguration_Shared_Schema = z.object({\n\n appIdentity: AppConfiguration_Shared_AppIdentity_Schema,\n\n /\n The generated brand assets — the runtime projection of the brand identity\n * an app's build-time logo step produces. THE single source of truth every\n * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`\n * (by composition × theme × purpose). Empty/absent until a brand is\n * generated; consumers fall back to a placeholder.\n \n MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,\n * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a\n * `backend-api/src/brand-assets.generated.ts` the backend config composes),\n * NOT platform-declaration identity. `appIdentity` is\n * platform-declaration-materialized and boundary-blocked for backend\n * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the\n * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is\n * required. This top-level `brandAssets` is that slot — it is present on both\n * the frontend shared payload (here) and the backend-authored managed config\n * (`_AppConfiguration_AppManagedConfiguration_Schema`).\n /\n brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n appPreferences: z.object({\n languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n }),\n apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),\n\n runtime: AppConfiguration_Shared_RuntimeSchema,\n auth: AppConfiguration_Shared_AuthSchema,\n /* User types — required. No implicit defaults. /\n userTypes: UserTypesConfigSchema,\n /* Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. /\n frontendServices: FrontendServicesConfigSchema,\n /* Org typing. Optional — only for apps with typed organizations. */\n organizationTypes: OrganizationTypesConfigSchema.optional(),\n compliance: AppConfiguration_Shared_ComplianceSchema,\n\n // Billing Configuration (optional: billing disabled by default)\n billing: BillingConfigurationSchema.optional(),\n\n // Analytics Configuration (optional: analytics disabled by default)\n analytics: AnalyticsConfigSchema.optional(),\n\n // Lifecycle Configuration (optional: lifecycle disabled by default)\n lifecycle: LifecycleConfigSchema.optional(),\n\n // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a\n // working 30-day retention window purged nightly). Holds the operator-tunable retention window,\n // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.\n // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER\n // lifecycle and is disabled by default).\n tenantTeardown: TenantTeardownConfigSchema.optional(),\n\n // Data-Seeding Configuration (optional: when omitted, the engine-owned\n // `data-seeding:scheduled-rerun` batch uses the manifest's built-in\n // minute-tick default cron — see DataSeedingConfigSchema for the full\n // rationale on why operators rarely need to override this).\n dataSeeding: DataSeedingConfigSchema.optional(),\n\n // Audit-Trail Configuration (optional: when omitted, NO archival runs and\n // audit records are retained in the primary AUDIT_LOGS store indefinitely).\n // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed\n // by the engine-owned `compliance:audit-logs-archive` batch. Records are\n // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.\n auditTrail: AuditTrailConfigSchema.optional(),\n\n});\n\n\nexport type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;\nexport type AppConfiguration_Shared_AppIdentity = z.infer<typeof AppConfiguration_Shared_AppIdentity_Schema>;\nexport type AppConfiguration_Shared_AppPreferencesLanguage = z.infer<typeof AppConfiguration_Shared_AppPreferencesLanguage_Schema>;\nexport type AnalyticsProviderConfig = z.infer<typeof AnalyticsProviderConfigSchema>;\nexport type AppConfiguration_Shared_Runtime = z.infer<typeof AppConfiguration_Shared_RuntimeSchema>;\nexport type AutoInstrumentationConfig = z.infer<typeof AutoInstrumentationConfigSchema>;\nexport type AnalyticsConfig = z.infer<typeof AnalyticsConfigSchema>;\nexport type AppConfiguration_Shared_Auth = z.infer<typeof AppConfiguration_Shared_AuthSchema>;\nexport type AppConfiguration_Shared = z.infer<typeof AppConfiguration_Shared_Schema>;\n"]}
1	+ {"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAClK,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE5C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAEnH;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC;CAE7F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,2EAA2E;IAC3E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAEvF;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C,qEAAqE;IACrE,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,yCAAyC;IACzC,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAErD,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE/C,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAE9C,CAAC,CAAC","sourcesContent":["/*\n Frontend Application Configuration Schemas\n \n Pure frontend configuration schemas that define what configuration\n * the frontend applications expect to receive from backend endpoints.\n \n NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol\n * defined at the provider level in external-connectors, just like REST_API\n * and HOOKS protocols. This configuration only enables/disables which\n * external providers are available for SSO authentication.\n /\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport { z } from 'zod';\nimport { AllSharedApplicationTypes, AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas';\nimport { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas';\nimport { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas';\nimport { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';\nimport { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas';\nimport { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas';\nimport { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas';\nimport { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { ValueMomentSchema } from './analytics-value-moments.shared.schemas';\nimport {\n UserTypesConfigSchema,\n FrontendServicesConfigSchema,\n OrganizationTypesConfigSchema,\n OrgAuthMethodPolicy,\n} from './entity-identity-config.shared.schemas';\n\n\n\n/\n Shared Password Policy Rules Schema\n \n Contains ONLY the validation rules that both frontend and backend need.\n * The backend extends these rules with hashing config (argon2 params)\n * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.\n \n Frontend uses these rules for:\n * - Real-time password strength validation as user types\n * - Password policy indicator in reset/registration forms\n /\n\n\nexport const PasswordPolicyRulesSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /\n R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),\n * NOT used in the client-side password pre-check — but it IS a field of this shared schema and\n * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).\n * Non-secret. (Corrected from the prior \"Backend-only\" which wrongly implied it is never serialized.)\n * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema\n * — the invitation response `.parse()` silently strips any field present there but absent here.\n /\n expiryDays: z.number().min(0).default(0),\n});\n\nexport type PasswordPolicyRules = z.infer<typeof PasswordPolicyRulesSchema>;\n\n/\n I18n label keys for password policy violations.\n * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.\n * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.\n /\nexport const PasswordPolicyViolationCode = {\n MIN_LENGTH: 'policyMinLength',\n MAX_LENGTH: 'policyMaxLength',\n UPPERCASE: 'policyUppercase',\n LOWERCASE: 'policyLowercase',\n NUMBER: 'policyNumber',\n SPECIAL_CHAR: 'policySpecialChar',\n} as const;\n\nexport type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];\n\n\n\n/\n Global Auth Config — infrastructure + app-level only.\n \n Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,\n * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,\n * methodManagement) is now per-user-type on UserTypeAuthPolicySchema\n * in entity-identity-config.shared.schemas.ts.\n \n This section retains only infrastructure and app-level settings that apply\n * equally regardless of user type.\n \n /\nexport const AppConfiguration_Shared_AuthSchema = z.object({\n\n // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────\n\n passkeyConfig: z.object({\n rpName: z.string().min(1),\n rpId: z.string().min(1),\n maxPasskeysPerUser: z.number().min(1).max(50).default(10),\n }),\n\n /*\n Minimal frontend-facing social OAuth2 projection.\n \n Backend runtime still owns the full backend-private\n * `auth.socialOAuth2Providers` authoring shape\n * (enabled flags, scopes, allowed domains, secrets-related semantics). The\n * shared `/application-config` payload only needs the enabled public provider\n * refs plus an optional app-authored display-name override.\n /\n socialOAuth2Providers: z.record(\n z.string(),\n z.object({\n displayName: z.string().optional(),\n })).default({}),\n\n /* E-10, D-15: How much orgs can override user-type auth methods. /\n orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),\n\n /* E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. /\n expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),\n\n /* E-4, D-2: Can a user authenticated via Org A SSO access Org B? /\n crossOrgSSOAccess: z.boolean().default(true),\n\n // W6.8: All per-user-type auth policy fields REMOVED.\n // Use userTypes[t].auth. instead (see entity-identity-config.shared.schemas.ts).\n // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).\n\n});\n\n\n\n\nexport const AppConfiguration_Shared_ComplianceSchema = z.object({\n userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),\n organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),\n\n /*\n Client-install identification policy (`clientInstanceId`) — OFF unless authored.\n \n Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on\n * the SHARED config because both halves of the mechanism must obey ONE authored value: the\n * frontend decides whether to mint/store/send the id, and the backend independently decides\n * whether to ingest and record it. Two gates, one source — an application that never opts in is\n * protected even if some client sends the header anyway.\n \n Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one\n * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the\n * obligations attached to each non-`DISABLED` member.\n /\n clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),\n\n});\n\n\n\nexport const AppConfiguration_Shared_AppIdentity_Schema = z.object({\n /* Technical app name — used as fallback when displayName is absent /\n appName: z.string().min(1, { error: 'Application name is required' }),\n /* Human-readable display name shown in UI and emails /\n displayName: z.string().optional(),\n /* Short description of the application /\n description: z.string().optional(),\n version: z.string().min(1, { error: 'Version is required' }),\n /\n The application's own id — the scope an APPLICATION-scoped resource's WebSocket room is keyed on.\n \n ## Why the client needs it, measured rather than argued\n \n `deriveResourceScopeRoomQualifiers` yields the `app` room only when `applicationId` is present in\n * the context it is handed, and a read's context is built from the URL's contextual parameters —\n * which never carry one, because an application id is AMBIENT rather than addressed. Nothing else\n * published it either: the access token's claims carry `userId` and no `applicationId`, and this\n * very object carried only `appName`/`displayName`/`version`.\n \n The consequence was silent. On 2026-09-03 the workbench subscribed to `org` and `user` for an\n * APPLICATION-scoped resource and was confirmed in both, while the companion published that\n * resource's changes to the `app` room. Correct producer, confirmed subscriber, different rooms,\n * zero frames delivered (issue #283).\n \n ## Why it is safe to publish here\n \n It is an IDENTIFIER, not a credential: it names which application this deployment is, it grants\n * nothing, and every authenticated request already acts within it. The room name a client must\n * compute is derived from it, so a client that may subscribe at all must be able to name it —\n * authorization for that room is decided server-side against the SUBSCRIBED RESOURCE, never\n * against possession of this value (issue #247).\n \n OPTIONAL because a deployment that predates this field must keep loading. A consumer that does\n * not find it degrades to the previous behaviour — it derives whatever rooms its parameters imply\n * and does not hear the application-room push — rather than failing.\n /\n applicationId: z.string().min(1).optional(),\n});\n\n\nexport const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({\n defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),\n fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n autoDetectFromBrowser: z.boolean().default(true),\n allowUserOverride: z.boolean().default(true),\n allowOrganizationOverride: z.boolean().default(true),\n enableLanguageSwitcher: z.boolean().default(true)\n});\n\n\nexport const appConfiguration_Shared_RuntimeSchemaBuilder = <T extends AllSharedApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n return z.object({\n endPoints: z.record(z.string(), z.object({\n publicUrl: z.string().optional(),\n internalUrl: z.string().optional(),\n })),\n })\n}\n\nexport const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);\n\n\n\n// =====================================================\n// Analytics Configuration\n// =====================================================\n\nexport enum AnalyticsProviderType {\n CONSOLE = 'console',\n BACKEND_PROXY = 'backend_proxy',\n}\n\n/* Uses providerType (not \"type\") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. /\nexport const AnalyticsProviderConfigSchema = z.object({\n providerType: z.enum(AnalyticsProviderType),\n config: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const AutoInstrumentationConfigSchema = z.object({\n /* Track page views (NAVIGATION_PANE_CHANGED events) /\n pageViews: z.boolean().default(true),\n /* Track resource operations (NOTIFY_RESOURCE_SUCCESS events) /\n resourceOperations: z.boolean().default(true),\n /* Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. /\n trackErrors: z.boolean().default(true),\n /* Track feature gate hits (shown/blocked) — debounced per feature per session /\n featureGate: z.boolean().default(true),\n /* Track user lifecycle events (login, logout, status changes) /\n userLifecycle: z.boolean().default(true),\n /* Track notification events (NOTIFY_CUSTOM_* events) /\n notifications: z.boolean().default(false),\n /* Track hotkey usage /\n hotkeys: z.boolean().default(false),\n});\n\nexport const AnalyticsConfigSchema = z.object({\n /* Master switch — false = no analytics at all, regardless of user consent /\n enabled: z.boolean().default(false),\n\n /* Registered analytics providers /\n providers: z.array(AnalyticsProviderConfigSchema).default([]),\n\n /* Minimum consent level required for analytics (defaults to ANALYTICS) /\n requiredConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.ANALYTICS),\n\n /\n SINGLE DECLARATION SURFACE for all value moments.\n * TTFV, aha moments, activation stages, and anti-patterns are all here,\n * distinguished by their `role` field.\n /\n valueMoments: z.array(ValueMomentSchema).optional(),\n\n /* Persistence and evaluation configuration /\n persistence: z.object({\n /* Persist achieved moments to localStorage (default: true) /\n localStorage: z.boolean().default(true),\n /* Sync achieved moments to backend (default: true) /\n backendSync: z.boolean().default(true),\n /\n Backend evaluates RESOURCE_STATE signals + cronjob-originated events.\n * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).\n * When false, frontend does optimistic cached count queries.\n /\n backendEvaluation: z.boolean().default(true),\n }).default({\n localStorage: true,\n backendSync: true,\n backendEvaluation: true,\n }),\n\n /* Auto-instrumentation configuration /\n autoInstrumentation: AutoInstrumentationConfigSchema.default({\n pageViews: true,\n resourceOperations: true,\n trackErrors: true,\n featureGate: true,\n userLifecycle: true,\n notifications: false,\n hotkeys: false,\n }),\n});\n\n\n// =====================================================\n// Main Shared App Configuration\n// =====================================================\n\nexport const AppConfiguration_Shared_Schema = z.object({\n\n appIdentity: AppConfiguration_Shared_AppIdentity_Schema,\n\n /\n The generated brand assets — the runtime projection of the brand identity\n * an app's build-time logo step produces. THE single source of truth every\n * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`\n * (by composition × theme × purpose). Empty/absent until a brand is\n * generated; consumers fall back to a placeholder.\n \n MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,\n * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a\n * `backend-api/src/brand-assets.generated.ts` the backend config composes),\n * NOT platform-declaration identity. `appIdentity` is\n * platform-declaration-materialized and boundary-blocked for backend\n * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the\n * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is\n * required. This top-level `brandAssets` is that slot — it is present on both\n * the frontend shared payload (here) and the backend-authored managed config\n * (`_AppConfiguration_AppManagedConfiguration_Schema`).\n /\n brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n appPreferences: z.object({\n languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n }),\n apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),\n\n runtime: AppConfiguration_Shared_RuntimeSchema,\n auth: AppConfiguration_Shared_AuthSchema,\n /* User types — required. No implicit defaults. /\n userTypes: UserTypesConfigSchema,\n /* Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. /\n frontendServices: FrontendServicesConfigSchema,\n /* Org typing. Optional — only for apps with typed organizations. */\n organizationTypes: OrganizationTypesConfigSchema.optional(),\n compliance: AppConfiguration_Shared_ComplianceSchema,\n\n // Billing Configuration (optional: billing disabled by default)\n billing: BillingConfigurationSchema.optional(),\n\n // Analytics Configuration (optional: analytics disabled by default)\n analytics: AnalyticsConfigSchema.optional(),\n\n // Lifecycle Configuration (optional: lifecycle disabled by default)\n lifecycle: LifecycleConfigSchema.optional(),\n\n // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a\n // working 30-day retention window purged nightly). Holds the operator-tunable retention window,\n // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.\n // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER\n // lifecycle and is disabled by default).\n tenantTeardown: TenantTeardownConfigSchema.optional(),\n\n // Data-Seeding Configuration (optional: when omitted, the engine-owned\n // `data-seeding:scheduled-rerun` batch uses the manifest's built-in\n // minute-tick default cron — see DataSeedingConfigSchema for the full\n // rationale on why operators rarely need to override this).\n dataSeeding: DataSeedingConfigSchema.optional(),\n\n // Audit-Trail Configuration (optional: when omitted, NO archival runs and\n // audit records are retained in the primary AUDIT_LOGS store indefinitely).\n // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed\n // by the engine-owned `compliance:audit-logs-archive` batch. Records are\n // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.\n auditTrail: AuditTrailConfigSchema.optional(),\n\n});\n\n\nexport type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;\nexport type AppConfiguration_Shared_AppIdentity = z.infer<typeof AppConfiguration_Shared_AppIdentity_Schema>;\nexport type AppConfiguration_Shared_AppPreferencesLanguage = z.infer<typeof AppConfiguration_Shared_AppPreferencesLanguage_Schema>;\nexport type AnalyticsProviderConfig = z.infer<typeof AnalyticsProviderConfigSchema>;\nexport type AppConfiguration_Shared_Runtime = z.infer<typeof AppConfiguration_Shared_RuntimeSchema>;\nexport type AutoInstrumentationConfig = z.infer<typeof AutoInstrumentationConfigSchema>;\nexport type AnalyticsConfig = z.infer<typeof AnalyticsConfigSchema>;\nexport type AppConfiguration_Shared_Auth = z.infer<typeof AppConfiguration_Shared_AuthSchema>;\nexport type AppConfiguration_Shared = z.infer<typeof AppConfiguration_Shared_Schema>;\n"]}

package/dist/esm/config/frontend/navigation.shared.schemas.d.ts CHANGED Viewed

@@ -37,6 +37,8 @@ import { CoreResourceOperation } from '../../resources/resources.shared.core.def
  * `push` behavior depends on the zone's `contentModel`:
  * - In `single` zones: stack-based (new content on top, back pops)
  * - In `tabbed` zones: opens a new tab (or activates existing for same resource)
+ *
+ * @wildo_source:part:start saas.models.navigation.transition-vocabulary facet:layer:shared facet:family:navigation-config
  */
 export declare enum NavigationTransition {
     /**
@@ -124,6 +126,7 @@ export declare enum NavigationTransition {
      */
     PROMOTE = "promote"
 }
+/** @wildo_source:part:end saas.models.navigation.transition-vocabulary */
 /**
  * Named layout zones — configurable structural areas WHERE content lives.
  *
@@ -136,6 +139,8 @@ export declare enum NavigationTransition {
  * Note: `overlay` is NOT a named zone — it's an implicit layer always available.
  * Overlay is a runtime destination, not a configurable zone. See `NavigationZone`
  * in the frontend runtime types for the full set including overlay.
+ *
+ * @wildo_source:part:start saas.models.navigation.surface-vocabulary facet:layer:shared facet:family:navigation-config
  */
 export declare enum NavigationZoneName {
     /** Main content area. Lists, root-level reads, primary workspace. Always exists. */
@@ -198,7 +203,10 @@ export declare enum ResponsiveCollapseMode {
      */
     OVERLAY = "overlay"
 }
+/** @wildo_source:part:end saas.models.navigation.surface-vocabulary */
 /**
+ * @wildo_source:part:start saas.models.navigation.zone-declaration facet:layer:shared facet:family:navigation-config
+ *
  * What happens when a zone's last content is dismissed.
  * Only meaningful for secondary and companion zones (primary never empties,
  * overlay auto-dismisses by definition).
@@ -217,7 +225,10 @@ export declare enum ZoneEmptyBehavior {
      */
     EMPTY_STATE = "emptyState"
 }
+/** @wildo_source:part:end saas.models.navigation.zone-declaration */
 /**
+ * @wildo_source:part:start saas.models.navigation.surface-vocabulary facet:layer:shared facet:family:navigation-config
+ *
  * Visual presentation for overlay transitions.
  * Determines how floating content renders above the layout.
  */
@@ -259,6 +270,7 @@ export declare enum SplitAppearance {
      */
     DRAWER = "drawer"
 }
+/** @wildo_source:part:end saas.models.navigation.surface-vocabulary */
 /**
  * A value that is either a plain `T` (applies at all viewports) or a
  * viewport-keyed partial record for per-breakpoint control.
@@ -375,6 +387,26 @@ export declare const ZoneAppearanceSchema: z.ZodObject<{
     overlay: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<typeof OverlayAppearance>, z.ZodRecord<z.ZodEnum<typeof ViewportBreakpoint> & z.core.$partial, z.ZodEnum<typeof OverlayAppearance>>]>>;
 }, z.core.$strip>;
 export type ZoneAppearance = z.infer<typeof ZoneAppearanceSchema>;
+/**
+ * @wildo_source:part:start saas.models.navigation.zone-declaration facet:layer:shared facet:family:navigation-config
+ *
+ * How much of its zone a DESTINATION's content occupies.
+ *
+ * The primary zone caps and centres its content at `var(--content-max-width, 80rem)` and gives it no
+ * definite-height ancestor. That is correct for almost everything a zone hosts — a form, a list, a
+ * settings page stretched across a 2560px monitor is unreadable — and wrong for content whose whole
+ * value is the space it occupies. Until this enum existed there was no way to tell the two apart, so
+ * a canvas had to hand-roll a viewport fraction (`h-[70vh]`), which sizes against the WINDOW rather
+ * than the container and therefore ignores whatever chrome sits above it.
+ *
+ * Declared per DESTINATION rather than per zone: the same primary zone hosts a list that wants the
+ * cap, a detail page that caps itself, and a graph that wants neither.
+ *
+ * Width and height are separable on purpose. A wide data table wants the cap gone and its natural
+ * height; collapsing both into one boolean would merge two meanings, and two independent booleans
+ * would make "full height, still capped at 80rem" representable — a combination nothing wants and
+ * someone would eventually author by accident.
+ */
 /**
  * Full zone configuration.
  *
@@ -409,6 +441,7 @@ export declare const ZoneConfigSchema: z.ZodObject<{
     responsiveCollapse: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<typeof ResponsiveCollapseMode>, z.ZodRecord<z.ZodEnum<typeof ViewportBreakpoint> & z.core.$partial, z.ZodEnum<typeof ResponsiveCollapseMode>>]>>;
 }, z.core.$strip>;
 export type ZoneConfig = z.infer<typeof ZoneConfigSchema>;
+/** @wildo_source:part:end saas.models.navigation.zone-declaration */
 /**
  * App-level navigation configuration: from OUTSIDE the zone system.
  *

package/dist/esm/config/frontend/navigation.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"navigation.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/config/frontend/navigation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAO1F~~;;;;;;;;;;;;;GAaG~~;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,IAAI,SAAS;IACb;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;OAKG;IACH,KAAK,UAAU;IACf;;;;;OAKG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,YAAY;CACpB;~~AAED;;;;;;;;;;;;GAYG~~;AACH,oBAAY,kBAAkB;IAC5B,oFAAoF;IACpF,OAAO,YAAY;IACnB;;;;OAIG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;GAMG;AACH,oBAAY,0BAA0B;IACpC;;;;;OAKG;IACH,MAAM,WAAW;IACjB;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC;;;;OAIG;IACH,IAAI,SAAS;IACb;;;;OAIG;IACH,OAAO,YAAY;CACpB;~~AAED;;;;GAIG~~;AACH,oBAAY,iBAAiB;IAC3B;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,WAAW,eAAe;CAC3B;~~AAED;;;GAGG~~;AACH,oBAAY,iBAAiB;IAC3B;;;;OAIG;IACH,MAAM,WAAW;IACjB;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;OAIG;IACH,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,eAAe;IACzB;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;OAIG;IACH,MAAM,WAAW;CAClB;~~AAMD~~;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,oGAQ9E;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB;;;;iBA0BlC,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;mBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,+HAA+H;AAC/H,eAAO,MAAM,qBAAqB,EAGlB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;iBA0D3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;~~AAO1D~~;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAOxE;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;iBAqBrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA+B5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH;;;;;;;;;;;;;;GAcG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;;OAKG;IACH,KAAK,UAAU;IACf;;;;;OAKG;IACH,IAAI,SAAS;CACd;AAED,qGAAqG;AACrG,eAAO,MAAM,wCAAwC,EAAE,6BAAqE,CAAC;AAE7H;;;GAGG;AACH,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,OAAO,CAG7G;AAED,yEAAyE;AACzE,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,OAAO,CAG/G;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,2DAA2D"}
1	+ {"version":3,"file":"navigation.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/config/frontend/navigation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAO1F;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,IAAI,SAAS;IACb;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;OAKG;IACH,KAAK,UAAU;IACf;;;;;OAKG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,YAAY;CACpB;AACD,0EAA0E;AAE1E;;;;;;;;;;;;;;GAcG;AACH,oBAAY,kBAAkB;IAC5B,oFAAoF;IACpF,OAAO,YAAY;IACnB;;;;OAIG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;GAMG;AACH,oBAAY,0BAA0B;IACpC;;;;;OAKG;IACH,MAAM,WAAW;IACjB;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC;;;;OAIG;IACH,IAAI,SAAS;IACb;;;;OAIG;IACH,OAAO,YAAY;CACpB;AACD,uEAAuE;AAEvE;;;;;;GAMG;AACH,oBAAY,iBAAiB;IAC3B;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,WAAW,eAAe;CAC3B;AACD,qEAAqE;AAErE;;;;;GAKG;AACH,oBAAY,iBAAiB;IAC3B;;;;OAIG;IACH,MAAM,WAAW;IACjB;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;OAIG;IACH,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,eAAe;IACzB;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;OAIG;IACH,MAAM,WAAW;CAClB;AACD,uEAAuE;AAMvE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,oGAQ9E;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB;;;;iBA0BlC,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;mBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,+HAA+H;AAC/H,eAAO,MAAM,qBAAqB,EAGlB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;iBA0D3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,qEAAqE;AAOrE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAOxE;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;iBAqBrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA+B5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH;;;;;;;;;;;;;;GAcG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;;OAKG;IACH,KAAK,UAAU;IACf;;;;;OAKG;IACH,IAAI,SAAS;CACd;AAED,qGAAqG;AACrG,eAAO,MAAM,wCAAwC,EAAE,6BAAqE,CAAC;AAE7H;;;GAGG;AACH,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,OAAO,CAG7G;AAED,yEAAyE;AACzE,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,OAAO,CAG/G;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,2DAA2D"}

package/dist/esm/config/frontend/navigation.shared.schemas.js CHANGED Viewed

@@ -40,6 +40,8 @@ import { CoreResourceOperation } from '../../resources/resources.shared.core.def
  * `push` behavior depends on the zone's `contentModel`:
  * - In `single` zones: stack-based (new content on top, back pops)
  * - In `tabbed` zones: opens a new tab (or activates existing for same resource)
+ *
+ * @wildo_source:part:start saas.models.navigation.transition-vocabulary facet:layer:shared facet:family:navigation-config
  */
 export var NavigationTransition;
 (function (NavigationTransition) {
@@ -128,6 +130,7 @@ export var NavigationTransition;
      */
     NavigationTransition["PROMOTE"] = "promote";
 })(NavigationTransition || (NavigationTransition = {}));
+/** @wildo_source:part:end saas.models.navigation.transition-vocabulary */
 /**
  * Named layout zones — configurable structural areas WHERE content lives.
  *
@@ -140,6 +143,8 @@ export var NavigationTransition;
  * Note: `overlay` is NOT a named zone — it's an implicit layer always available.
  * Overlay is a runtime destination, not a configurable zone. See `NavigationZone`
  * in the frontend runtime types for the full set including overlay.
+ *
+ * @wildo_source:part:start saas.models.navigation.surface-vocabulary facet:layer:shared facet:family:navigation-config
  */
 export var NavigationZoneName;
 (function (NavigationZoneName) {
@@ -205,7 +210,10 @@ export var ResponsiveCollapseMode;
      */
     ResponsiveCollapseMode["OVERLAY"] = "overlay";
 })(ResponsiveCollapseMode || (ResponsiveCollapseMode = {}));
+/** @wildo_source:part:end saas.models.navigation.surface-vocabulary */
 /**
+ * @wildo_source:part:start saas.models.navigation.zone-declaration facet:layer:shared facet:family:navigation-config
+ *
  * What happens when a zone's last content is dismissed.
  * Only meaningful for secondary and companion zones (primary never empties,
  * overlay auto-dismisses by definition).
@@ -225,7 +233,10 @@ export var ZoneEmptyBehavior;
      */
     ZoneEmptyBehavior["EMPTY_STATE"] = "emptyState";
 })(ZoneEmptyBehavior || (ZoneEmptyBehavior = {}));
+/** @wildo_source:part:end saas.models.navigation.zone-declaration */
 /**
+ * @wildo_source:part:start saas.models.navigation.surface-vocabulary facet:layer:shared facet:family:navigation-config
+ *
  * Visual presentation for overlay transitions.
  * Determines how floating content renders above the layout.
  */
@@ -397,6 +408,26 @@ export const ZoneAppearanceSchema = z.object({
     /** How overlay content renders. Default: `OverlayAppearance.DIALOG` (centered modal). */
     overlay: viewportDiscriminatedSchema(z.enum(OverlayAppearance)).optional(),
 });
+/**
+ * @wildo_source:part:start saas.models.navigation.zone-declaration facet:layer:shared facet:family:navigation-config
+ *
+ * How much of its zone a DESTINATION's content occupies.
+ *
+ * The primary zone caps and centres its content at `var(--content-max-width, 80rem)` and gives it no
+ * definite-height ancestor. That is correct for almost everything a zone hosts — a form, a list, a
+ * settings page stretched across a 2560px monitor is unreadable — and wrong for content whose whole
+ * value is the space it occupies. Until this enum existed there was no way to tell the two apart, so
+ * a canvas had to hand-roll a viewport fraction (`h-[70vh]`), which sizes against the WINDOW rather
+ * than the container and therefore ignores whatever chrome sits above it.
+ *
+ * Declared per DESTINATION rather than per zone: the same primary zone hosts a list that wants the
+ * cap, a detail page that caps itself, and a graph that wants neither.
+ *
+ * Width and height are separable on purpose. A wide data table wants the cap gone and its natural
+ * height; collapsing both into one boolean would merge two meanings, and two independent booleans
+ * would make "full height, still capped at 80rem" representable — a combination nothing wants and
+ * someone would eventually author by accident.
+ */
 /**
  * Full zone configuration.
  *
@@ -461,6 +492,7 @@ export const ZoneConfigSchema = z.object({
      */
     responsiveCollapse: viewportDiscriminatedSchema(z.enum(ResponsiveCollapseMode)).optional(),
 });
+/** @wildo_source:part:end saas.models.navigation.zone-declaration */
 // ════════════════════════════════════════════════════════════════
 // App-Level & From-Overlay Configuration
 // ════════════════════════════════════════════════════════════════