@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js

@@ -0,0 +1,211 @@
+import { z } from 'zod';
+/**
+ * WHERE this application operates, as the one source every compliance surface reads (issue #229).
+ *
+ * ## The hole this closes
+ *
+ * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application
+ * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as
+ * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`
+ * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is
+ * unverifiable, it can differ between two runs of the same application, and nothing downstream could
+ * disagree with it.
+ *
+ * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it
+ *
+ * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason
+ * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be
+ * recorded until the lawful bases were settled with counsel. Where you sell is known long before why
+ * you may process — and issue #228 exists precisely because filling the entity must never block.
+ *
+ * Keeping them siblings means each is answerable the day it is known.
+ *
+ * ## Why an open slug and not an enum
+ *
+ * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum
+ * would have to be widened before an operator could state the truth about their own product. That is
+ * the "genuinely open app/provider/resource identifier" exemption in the semantic-literal rule, not a
+ * shortcut around it. The shape is constrained; the membership is not.
+ *
+ * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and
+ * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that
+ * consumes it. An application may always declare where it operates; Wildo says plainly where it has
+ * nothing to offer.
+ */
+const JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;
+const JURISDICTION_SLUG_SHAPE_MESSAGE = 'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as "eu", '
+    + 'optionally with a regime or subdivision suffix such as "us-ca" — lowercase, because a slug that '
+    + 'differs only by case is a second identifier for one place';
+/**
+ * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.
+ *
+ * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same
+ * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex
+ * and IDENTITY is answered here, by the same authority the publication validator already uses for
+ * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.
+ *
+ * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the
+ * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a
+ * second one covering every country on earth would rot with nobody watching. `Intl` ships the table
+ * with the runtime and updates with it.
+ *
+ * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises
+ * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is
+ * in this repository's own tests and prose.
+ */
+function canonicalRegionSubtag(subtag) {
+    const requested = `und-${subtag.toUpperCase()}`;
+    try {
+        const [canonical] = Intl.getCanonicalLocales(requested);
+        return canonical === undefined ? null : canonical.slice('und-'.length);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.
+ *
+ * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse
+ * — the governed-document publication validator and the `_core` compliance-document candidate
+ * validator both emit their own typed issue records, and routing them through a Zod error to recover
+ * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three
+ * readers.
+ */
+export function jurisdictionSlugProblem(slug) {
+    if (!JURISDICTION_SLUG_SHAPE.test(slug)) {
+        return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received "${slug}"`;
+    }
+    const [root] = slug.split('-');
+    const canonical = canonicalRegionSubtag(root);
+    if (canonical === null) {
+        return `"${root}" is not a well-formed region code`;
+    }
+    if (canonical.toLowerCase() !== root) {
+        return `"${root}" is an alias for "${canonical.toLowerCase()}" — use the canonical code, or two slugs are one place`;
+    }
+    return null;
+}
+export const JurisdictionSlugSchema = z
+    .string()
+    .trim()
+    .superRefine((slug, context) => {
+    const problem = jurisdictionSlugProblem(slug);
+    if (problem !== null) {
+        context.addIssue({ code: 'custom', message: problem });
+    }
+});
+/**
+ * The namespace every jurisdiction REFERENCE carries.
+ *
+ * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is
+ * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse
+ * outright — sit in a landed application specification beside that same application's configuration
+ * declaring `gb`.
+ */
+export const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';
+/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */
+export var JurisdictionRefProblemScope;
+(function (JurisdictionRefProblemScope) {
+    /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */
+    JurisdictionRefProblemScope["NAMESPACE"] = "NAMESPACE";
+    /** The namespace is right and the slug is not a jurisdiction. */
+    JurisdictionRefProblemScope["SLUG"] = "SLUG";
+})(JurisdictionRefProblemScope || (JurisdictionRefProblemScope = {}));
+/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */
+export function jurisdictionRefProblem(ref) {
+    if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {
+        return {
+            scope: JurisdictionRefProblemScope.NAMESPACE,
+            message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,
+        };
+    }
+    const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));
+    return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };
+}
+/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */
+export const JurisdictionRefSchema = z
+    .string()
+    .trim()
+    .superRefine((ref, context) => {
+    const problem = jurisdictionRefProblem(ref);
+    if (problem !== null) {
+        context.addIssue({ code: 'custom', message: problem.message });
+    }
+});
+/**
+ * One jurisdiction this application operates in, and why it reaches the product.
+ *
+ * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same
+ * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for
+ * `gatedProcessing` on a consent gate. "eu" alone does not say whether the operator is established
+ * there, sells there, or merely holds data about people there, and those imply different obligations.
+ *
+ * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed
+ * vocabulary of reasons would be a legal taxonomy nobody reviewed.
+ */
+export const OperatingJurisdictionSchema = z.strictObject({
+    jurisdictionSlug: JurisdictionSlugSchema,
+    /** Why this jurisdiction reaches the product — "customers established here", "data subjects resident here". */
+    basis: z.string().trim().min(1),
+});
+/**
+ * The jurisdictions this application operates in.
+ *
+ * ## Absent is UNDECLARED, and an empty list is not offered
+ *
+ * The sibling `clientStorage` inventory distinguishes absent ("not inventoried") from an empty array
+ * ("this surface sets nothing"), because there both are meaningful. Here only one is: every product
+ * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses
+ * it, and the whole declaration stays optional at the configuration level — absence is the honest
+ * "nobody has answered", and every consumer must render it as that rather than as "nowhere".
+ */
+export const ApplicationOperatingJurisdictionsSchema = z
+    .strictObject({
+    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),
+})
+    .superRefine((declaration, context) => {
+    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);
+    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);
+    if (duplicates.length > 0) {
+        context.addIssue({
+            code: 'custom',
+            path: ['jurisdictions'],
+            message: `jurisdiction ${[...new Set(duplicates)].map((slug) => `"${slug}"`).join(', ')} is declared more than once — `
+                + 'one place has one basis, and two entries would let a document cite whichever suits the clause',
+        });
+    }
+});
+/**
+ * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.
+ *
+ * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source
+ * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the
+ * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and
+ * that rule is applied in code rather than enumerated here.
+ *
+ * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a
+ * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.
+ * Nothing derives it, so a change is a deliberate edit here.
+ */
+export const JURISDICTION_CONTAINMENT = Object.freeze({
+    eu: Object.freeze([
+        'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',
+        'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',
+    ]),
+});
+/**
+ * Does a source addressing `reach` answer for an application operating in `declared`?
+ *
+ * Three ways, and the order is deliberate — exact first, because it is the common case and the other
+ * two are refinements of it.
+ */
+export function jurisdictionReachCovers(reach, declared) {
+    if (reach === declared)
+        return true;
+    // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.
+    if (declared.startsWith(`${reach}-`))
+        return true;
+    return (JURISDICTION_CONTAINMENT[reach] ?? []).some((member) => member === declared || declared.startsWith(`${member}-`));
+}
+//# sourceMappingURL=operating-jurisdictions.shared.schemas.js.map

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,kGAAkG;MAClG,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHERE this application operates, as the one source every compliance surface reads (issue #229).\n *\n * ## The hole this closes\n *\n * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n *\n * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n *\n * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n *\n * Keeping them siblings means each is answerable the day it is known.\n *\n * ## Why an open slug and not an enum\n *\n * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n *\n * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n */\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n  'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n  + 'optionally with a regime or subdivision suffix such as \"us-ca\" — lowercase, because a slug that '\n  + 'differs only by case is a second identifier for one place';\n\n/**\n * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n *\n * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n *\n * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n *\n * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n */\nfunction canonicalRegionSubtag(subtag: string): string | null {\n  const requested = `und-${subtag.toUpperCase()}`;\n  try {\n    const [canonical] = Intl.getCanonicalLocales(requested);\n    return canonical === undefined ? null : canonical.slice('und-'.length);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n *\n * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n */\nexport function jurisdictionSlugProblem(slug: string): string | null {\n  if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n    return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n  }\n  const [root] = slug.split('-');\n  const canonical = canonicalRegionSubtag(root!);\n  if (canonical === null) {\n    return `\"${root}\" is not a well-formed region code`;\n  }\n  if (canonical.toLowerCase() !== root) {\n    return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n  }\n  return null;\n}\n\nexport const JurisdictionSlugSchema = z\n  .string()\n  .trim()\n  .superRefine((slug, context) => {\n    const problem = jurisdictionSlugProblem(slug);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem });\n    }\n  });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/**\n * The namespace every jurisdiction REFERENCE carries.\n *\n * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n */\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */\nexport enum JurisdictionRefProblemScope {\n  /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */\n  NAMESPACE = 'NAMESPACE',\n  /** The namespace is right and the slug is not a jurisdiction. */\n  SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n  readonly scope: JurisdictionRefProblemScope;\n  readonly message: string;\n}\n\n/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem | null {\n  if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n    return {\n      scope: JurisdictionRefProblemScope.NAMESPACE,\n      message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n    };\n  }\n  const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n  return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */\nexport const JurisdictionRefSchema = z\n  .string()\n  .trim()\n  .superRefine((ref, context) => {\n    const problem = jurisdictionRefProblem(ref);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem.message });\n    }\n  });\n\n/**\n * One jurisdiction this application operates in, and why it reaches the product.\n *\n * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n *\n * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n */\nexport const OperatingJurisdictionSchema = z.strictObject({\n  jurisdictionSlug: JurisdictionSlugSchema,\n  /** Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". */\n  basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/**\n * The jurisdictions this application operates in.\n *\n * ## Absent is UNDECLARED, and an empty list is not offered\n *\n * The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n */\nexport const ApplicationOperatingJurisdictionsSchema = z\n  .strictObject({\n    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n  })\n  .superRefine((declaration, context) => {\n    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n    if (duplicates.length > 0) {\n      context.addIssue({\n        code: 'custom',\n        path: ['jurisdictions'],\n        message:\n          `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n          + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n      });\n    }\n  });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/**\n * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n *\n * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n *\n * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n */\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  eu: Object.freeze([\n    'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n    'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n  ]),\n});\n\n/**\n * Does a source addressing `reach` answer for an application operating in `declared`?\n *\n * Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n  if (reach === declared) return true;\n  // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n  if (declared.startsWith(`${reach}-`)) return true;\n  return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n    (member) => member === declared || declared.startsWith(`${member}-`),\n  );\n}\n"]}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts

@@ -142,19 +142,36 @@ export type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirement
  * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule
  * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —
  * the answers a notice needs in its opening sections — not a compliance programme.
+ *
+ * ## Every part is independently declarable, and that is the point (issue #228)
+ *
+ * This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,
+ * address, contact, role allocations and lawful bases were each required, so an operator who knew
+ * the registered name but had not settled lawful bases with counsel could record NOTHING. They
+ * answered by editing the produced document, and a landing REPLACES it — losing the answer on the
+ * next regeneration, which is the exact failure this schema was created to end.
+ *
+ * Paul's decision (#225) is that filling the entity must never block, and that generation is
+ * resilient to what is missing while saying plainly that the result is incomplete. So every part is
+ * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.
+ *
+ * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still
+ * requires its assessment, and a consent level above `NONE` still requires what it gates. Those
+ * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a
+ * partial declaration is honest, a self-contradicting one is not.
  */
 export declare const ApplicationOperatorComplianceIdentitySchema: z.ZodObject<{
-    /** The legal entity operating the service, as registered. */
-    legalEntityName: z.ZodString;
-    /** Its registered address, as a reader would need it to serve a request. */
-    registeredAddress: z.ZodString;
+    /** The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. */
+    legalEntityName: z.ZodOptional<z.ZodString>;
+    /** Its registered address, as a reader would need it to serve a request. Absent means unanswered. */
+    registeredAddress: z.ZodOptional<z.ZodString>;
     /**
      * How a data subject reaches the operator about privacy — an address, an email, or a URL.
      *
      * Open string because all three are legitimate and the law names none: what matters is that a route
      * exists and is stated, not what shape it takes.
      */
-    privacyContact: z.ZodString;
+    privacyContact: z.ZodOptional<z.ZodString>;
     /**
      * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.
      *
@@ -171,11 +188,11 @@ export declare const ApplicationOperatorComplianceIdentitySchema: z.ZodObject<{
      *
      * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.
      */
-    roleAllocations: z.ZodArray<z.ZodObject<{
+    roleAllocations: z.ZodOptional<z.ZodArray<z.ZodObject<{
         /** Which data this role covers, in the operator's own words — "customer records in a workspace". */
         dataScope: z.ZodString;
         role: z.ZodEnum<typeof OperatorProcessingRole>;
-    }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     /**
      * The lawful basis relied on, per processing purpose. At least one.
      *
@@ -183,7 +200,7 @@ export declare const ApplicationOperatorComplianceIdentitySchema: z.ZodObject<{
      * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a
      * complete answer.
      */
-    lawfulBases: z.ZodArray<z.ZodObject<{
+    lawfulBases: z.ZodOptional<z.ZodArray<z.ZodObject<{
         /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */
         purpose: z.ZodString;
         basis: z.ZodEnum<typeof LawfulBasis>;
@@ -192,7 +209,7 @@ export declare const ApplicationOperatorComplianceIdentitySchema: z.ZodObject<{
          * that needs a balancing test — see the superRefine below.
          */
         assessmentNote: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     /**
      * What a person must consent to in order to use the service at all (issue #139).
      *
@@ -220,11 +237,49 @@ export declare const ApplicationOperatorComplianceIdentitySchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;
+/**
+ * The parts of an operator's compliance identity, so "what is still owed" has one named home.
+ *
+ * A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —
+ * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by
+ * the same names, or two surfaces tell an operator to fill two different things.
+ *
+ * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are
+ * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no
+ * Art. 27 representative, and a declared absence of a consent gate is expressed by
+ * `serviceConsentRequirement.requiredLevel = NONE`, which is a value rather than an omission. Listing
+ * them would report every correct identity as incomplete.
+ */
+export declare enum OperatorComplianceIdentityPart {
+    LEGAL_ENTITY_NAME = "legalEntityName",
+    REGISTERED_ADDRESS = "registeredAddress",
+    PRIVACY_CONTACT = "privacyContact",
+    ROLE_ALLOCATIONS = "roleAllocations",
+    LAWFUL_BASES = "lawfulBases"
+}
+/**
+ * Which parts of the identity are still owed, in declaration order.
+ *
+ * Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every
+ * part back, which is correct but says less than the caller needs: "nobody has been asked" and "four of
+ * five parts are outstanding" are different things to tell an operator, and the caller distinguishes
+ * them by checking for the identity itself first.
+ */
+export declare function outstandingOperatorComplianceIdentityParts(identity: ApplicationOperatorComplianceIdentity | undefined): readonly OperatorComplianceIdentityPart[];
 /**
  * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which
  * bases the service relies on.
+ *
+ * `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would
+ * say the service relies on no lawful basis, which is a claim nobody made and one no processing could
+ * survive; the caller has to meet the absent case rather than fall into it.
+ */
+export declare function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] | undefined;
+/**
+ * True when the operator declares more than one role, so a notice must not assign a single one.
+ *
+ * `undefined` when no roles are declared — the question cannot be answered, and `false` would be read
+ * as "one role", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.
  */
-export declare function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[];
-/** True when the operator declares more than one role, so a notice must not assign a single one. */
-export declare function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean;
+export declare function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean | undefined;
 //# sourceMappingURL=operator-compliance-identity.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;kBAGpG,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;;IAG1G;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;OAMG;;IAEH;;;;;;OAMG;;kBAgBH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2CAA2C;IACtD,6DAA6D;;IAE7D,4EAA4E;;IAE5E;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QAxJH,oGAAoG;;;;IA0JpG;;;;;;OAMG;;QAxJH,0GAA0G;;;QAG1G;;;WAGG;;;IAoJH;;;;;;OAMG;;QAxGH;;;;;;WAMG;;QAEH;;;;;;WAMG;;;kBA4FH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,CAI3G;AAED,oGAAoG;AACpG,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,CAE5G"}
+{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;kBAGpG,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;;IAG1G;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;OAMG;;IAEH;;;;;;OAMG;;kBAgBH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QAzKH,oGAAoG;;;;IA2KpG;;;;;;OAMG;;QAzKH,0GAA0G;;;QAG1G;;;WAGG;;;IAqKH;;;;;;OAMG;;QAzHH;;;;;;WAMG;;QAEH;;;;;;WAMG;;;kBAiIH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAQ3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js

@@ -169,19 +169,36 @@ export const ServiceConsentRequirementSchema = z.strictObject({
  * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule
  * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —
  * the answers a notice needs in its opening sections — not a compliance programme.
+ *
+ * ## Every part is independently declarable, and that is the point (issue #228)
+ *
+ * This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,
+ * address, contact, role allocations and lawful bases were each required, so an operator who knew
+ * the registered name but had not settled lawful bases with counsel could record NOTHING. They
+ * answered by editing the produced document, and a landing REPLACES it — losing the answer on the
+ * next regeneration, which is the exact failure this schema was created to end.
+ *
+ * Paul's decision (#225) is that filling the entity must never block, and that generation is
+ * resilient to what is missing while saying plainly that the result is incomplete. So every part is
+ * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.
+ *
+ * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still
+ * requires its assessment, and a consent level above `NONE` still requires what it gates. Those
+ * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a
+ * partial declaration is honest, a self-contradicting one is not.
  */
 export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
-    /** The legal entity operating the service, as registered. */
-    legalEntityName: z.string().trim().min(1),
-    /** Its registered address, as a reader would need it to serve a request. */
-    registeredAddress: z.string().trim().min(1),
+    /** The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. */
+    legalEntityName: z.string().trim().min(1).optional(),
+    /** Its registered address, as a reader would need it to serve a request. Absent means unanswered. */
+    registeredAddress: z.string().trim().min(1).optional(),
     /**
      * How a data subject reaches the operator about privacy — an address, an email, or a URL.
      *
      * Open string because all three are legitimate and the law names none: what matters is that a route
      * exists and is stated, not what shape it takes.
      */
-    privacyContact: z.string().trim().min(1),
+    privacyContact: z.string().trim().min(1).optional(),
     /**
      * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.
      *
@@ -198,7 +215,7 @@ export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
      *
      * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.
      */
-    roleAllocations: z.array(OperatorRoleAllocationSchema).min(1),
+    roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),
     /**
      * The lawful basis relied on, per processing purpose. At least one.
      *
@@ -206,7 +223,7 @@ export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
      * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a
      * complete answer.
      */
-    lawfulBases: z.array(OperatorLawfulBasisSchema).min(1),
+    lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).optional(),
     /**
      * What a person must consent to in order to use the service at all (issue #139).
      *
@@ -215,18 +232,88 @@ export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
      * absence is nobody having been asked, and a notice must not render the second as the first.
      */
     serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),
+}).superRefine((identity, context) => {
+    /*
+     * A declaration with nothing in it is a no-op that reads as an answer.
+     *
+     * Every part is independently optional so an operator can record the half they know (#228), and the
+     * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.
+     * Absent and empty must not mean the same thing — absence is "nobody was asked", which every
+     * consumer already renders as outstanding, while an empty object would satisfy the field and
+     * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis
+     * with no assessment and a consent gate that names nothing.
+     */
+    if (Object.values(identity).every((part) => part === undefined)) {
+        context.addIssue({
+            code: 'custom',
+            path: [],
+            message: 'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '
+                + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',
+        });
+    }
 });
+/**
+ * The parts of an operator's compliance identity, so "what is still owed" has one named home.
+ *
+ * A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —
+ * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by
+ * the same names, or two surfaces tell an operator to fill two different things.
+ *
+ * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are
+ * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no
+ * Art. 27 representative, and a declared absence of a consent gate is expressed by
+ * `serviceConsentRequirement.requiredLevel = NONE`, which is a value rather than an omission. Listing
+ * them would report every correct identity as incomplete.
+ */
+export var OperatorComplianceIdentityPart;
+(function (OperatorComplianceIdentityPart) {
+    OperatorComplianceIdentityPart["LEGAL_ENTITY_NAME"] = "legalEntityName";
+    OperatorComplianceIdentityPart["REGISTERED_ADDRESS"] = "registeredAddress";
+    OperatorComplianceIdentityPart["PRIVACY_CONTACT"] = "privacyContact";
+    OperatorComplianceIdentityPart["ROLE_ALLOCATIONS"] = "roleAllocations";
+    OperatorComplianceIdentityPart["LAWFUL_BASES"] = "lawfulBases";
+})(OperatorComplianceIdentityPart || (OperatorComplianceIdentityPart = {}));
+/**
+ * Which parts of the identity are still owed, in declaration order.
+ *
+ * Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every
+ * part back, which is correct but says less than the caller needs: "nobody has been asked" and "four of
+ * five parts are outstanding" are different things to tell an operator, and the caller distinguishes
+ * them by checking for the identity itself first.
+ */
+export function outstandingOperatorComplianceIdentityParts(identity) {
+    return [
+        identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,
+        identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,
+        identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,
+        identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,
+        identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,
+    ].filter((part) => part !== undefined);
+}
 /**
  * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which
  * bases the service relies on.
+ *
+ * `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would
+ * say the service relies on no lawful basis, which is a claim nobody made and one no processing could
+ * survive; the caller has to meet the absent case rather than fall into it.
  */
 export function declaredLawfulBases(identity) {
+    if (identity.lawfulBases === undefined)
+        return undefined;
     const order = Object.values(LawfulBasis);
     return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]
         .sort((left, right) => order.indexOf(left) - order.indexOf(right));
 }
-/** True when the operator declares more than one role, so a notice must not assign a single one. */
+/**
+ * True when the operator declares more than one role, so a notice must not assign a single one.
+ *
+ * `undefined` when no roles are declared — the question cannot be answered, and `false` would be read
+ * as "one role", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.
+ */
 export function operatorHoldsSeveralProcessingRoles(identity) {
+    if (identity.roleAllocations === undefined)
+        return undefined;
     return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;
 }
 //# sourceMappingURL=operator-compliance-identity.shared.schemas.js.map

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACrC,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,aAAa,KAAK,qBAAqB,CAAC,IAAI,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,+BAA+B,WAAW,CAAC,aAAa,4KAA4K;SAC9O,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,6DAA6D;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,4EAA4E;IAC5E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACtE,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { DataProcessingConsent } from './privacy.shared.schemas';\n\n/**\n * GDPR Art. 6(1) — the six lawful bases, closed by the article.\n *\n * Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n *\n * spec-cite: GDPR Art. 6(1)(a)–(f).\n */\nexport enum LawfulBasis {\n  /** Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. */\n  CONSENT = 'CONSENT',\n  /** Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. */\n  CONTRACT = 'CONTRACT',\n  /** Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. */\n  LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n  /** Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. */\n  VITAL_INTERESTS = 'VITAL_INTERESTS',\n  /** Art. 6(1)(e) — necessary for a task in the public interest or official authority. */\n  PUBLIC_TASK = 'PUBLIC_TASK',\n  /**\n   * Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n   * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n   * is refused below.\n   */\n  LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/** Whether the operator decides the purposes of a processing, carries them out for someone else, or both. */\nexport enum OperatorProcessingRole {\n  /** The operator determines the purposes and means. */\n  CONTROLLER = 'CONTROLLER',\n  /** The operator processes on a customer's documented instructions — the usual B2B posture for customer records. */\n  PROCESSOR = 'PROCESSOR',\n  /** The operator and another party jointly determine purposes and means, and must have an arrangement saying how. */\n  JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/**\n * ONE role, over ONE population of data.\n *\n * A single role field would be the wrong shape, and the produced notice said so before this existed:\n * *\"This notice therefore does not assign a single legal role to all data processed in a workspace.\"*\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n *\n * `dataScope` is prose the operator writes, deliberately. Nothing structured exists to key it to: the\n * processing purposes a notice states are derived from the application's vision and requirements as\n * PROSE, so a ref here would point at nothing.\n */\nexport const OperatorRoleAllocationSchema = z.strictObject({\n  /** Which data this role covers, in the operator's own words — \"customer records in a workspace\". */\n  dataScope: z.string().trim().min(1),\n  role: z.enum(OperatorProcessingRole),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/** One processing purpose and the basis the operator relies on for it. */\nexport const OperatorLawfulBasisSchema = z.strictObject({\n  /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */\n  purpose: z.string().trim().min(1),\n  basis: z.enum(LawfulBasis),\n  /**\n   * The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n   * that needs a balancing test — see the superRefine below.\n   */\n  assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n  /*\n   * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n   * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n   * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n   * conclusion nobody reached.\n   */\n  if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['assessmentNote'],\n      message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n    });\n  }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/**\n * What a person must agree to in order to USE the service at all (issue #139).\n *\n * ## The near-miss this exists because of\n *\n * `analytics.requiredConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n *\n * Correcting it left a real hole, which a produced notice then reported in its own words:\n * *\"There is no declared surface for recording a service-wide consent requirement distinct from\n * analytics consent.\"* This is that surface.\n *\n * ## Why the floor may be NONE, and usually should be\n *\n * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A required level above `NONE` says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n *\n * `NONE` is therefore both the default and the honest answer for most applications: *nothing is\n * gated on consent; the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*\n * A field that pushed applications toward declaring consent would be worse than the gap it closes.\n *\n * ⚠️ Declaring a level here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n */\nexport const ServiceConsentRequirementSchema = z.strictObject({\n  /**\n   * The minimum consent a person must give to use the service.\n   *\n   * `NONE` means nothing is gated on consent — the common and usually correct answer. It is a\n   * DECLARATION, not an absence: an application that says `NONE` has answered the question, which is\n   * what separates it from one that has not been asked.\n   */\n  requiredLevel: z.enum(DataProcessingConsent),\n  /**\n   * What this gate actually controls, in the operator's own words.\n   *\n   * REQUIRED whenever the level is above `NONE`, because a gate nobody can describe is a gate nobody\n   * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n   * governs tells a person they must agree to something unnamed.\n   */\n  gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n  /*\n   * A required level above NONE with nothing described is the shape that satisfies the field and\n   * discloses nothing — the same defect as a revision recording no superseded rationale, and as a\n   * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n   * explanation is the half that makes it mean anything.\n   */\n  if (requirement.requiredLevel !== DataProcessingConsent.NONE && requirement.gatedProcessing === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['gatedProcessing'],\n      message: `a required consent level of ${requirement.requiredLevel} gates something — say what, or declare NONE. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n    });\n  }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/**\n * WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n *\n * ## Why this exists, and why in configuration\n *\n * A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n *\n * That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n *\n * Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n *\n * ## What is deliberately NOT here\n *\n * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n */\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n  /** The legal entity operating the service, as registered. */\n  legalEntityName: z.string().trim().min(1),\n  /** Its registered address, as a reader would need it to serve a request. */\n  registeredAddress: z.string().trim().min(1),\n  /**\n   * How a data subject reaches the operator about privacy — an address, an email, or a URL.\n   *\n   * Open string because all three are legitimate and the law names none: what matters is that a route\n   * exists and is stated, not what shape it takes.\n   */\n  privacyContact: z.string().trim().min(1),\n  /**\n   * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n   *\n   * Optional, because most operators are established where their subjects are and appointing one\n   * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n   * when declared.\n   */\n  representative: z.strictObject({\n    name: z.string().trim().min(1),\n    address: z.string().trim().min(1),\n  }).optional(),\n  /**\n   * The operator's role, per population of data. At least one.\n   *\n   * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n   */\n  roleAllocations: z.array(OperatorRoleAllocationSchema).min(1),\n  /**\n   * The lawful basis relied on, per processing purpose. At least one.\n   *\n   * `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n   * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n   * complete answer.\n   */\n  lawfulBases: z.array(OperatorLawfulBasisSchema).min(1),\n  /**\n   * What a person must consent to in order to use the service at all (issue #139).\n   *\n   * OPTIONAL, and absent means UNANSWERED rather than `NONE`. The distinction is the one this whole\n   * lane turns on: a declared `NONE` is the operator saying nothing is gated on consent, while\n   * absence is nobody having been asked, and a notice must not render the second as the first.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/**\n * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n */\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] {\n  const order = Object.values(LawfulBasis);\n  return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n    .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/** True when the operator declares more than one role, so a notice must not assign a single one. */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean {\n  return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}
+{"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACrC,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,aAAa,KAAK,qBAAqB,CAAC,IAAI,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,+BAA+B,WAAW,CAAC,aAAa,4KAA4K;SAC9O,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACtE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;AAC9B,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KAC9F,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { DataProcessingConsent } from './privacy.shared.schemas';\n\n/**\n * GDPR Art. 6(1) — the six lawful bases, closed by the article.\n *\n * Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n *\n * spec-cite: GDPR Art. 6(1)(a)–(f).\n */\nexport enum LawfulBasis {\n  /** Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. */\n  CONSENT = 'CONSENT',\n  /** Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. */\n  CONTRACT = 'CONTRACT',\n  /** Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. */\n  LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n  /** Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. */\n  VITAL_INTERESTS = 'VITAL_INTERESTS',\n  /** Art. 6(1)(e) — necessary for a task in the public interest or official authority. */\n  PUBLIC_TASK = 'PUBLIC_TASK',\n  /**\n   * Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n   * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n   * is refused below.\n   */\n  LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/** Whether the operator decides the purposes of a processing, carries them out for someone else, or both. */\nexport enum OperatorProcessingRole {\n  /** The operator determines the purposes and means. */\n  CONTROLLER = 'CONTROLLER',\n  /** The operator processes on a customer's documented instructions — the usual B2B posture for customer records. */\n  PROCESSOR = 'PROCESSOR',\n  /** The operator and another party jointly determine purposes and means, and must have an arrangement saying how. */\n  JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/**\n * ONE role, over ONE population of data.\n *\n * A single role field would be the wrong shape, and the produced notice said so before this existed:\n * *\"This notice therefore does not assign a single legal role to all data processed in a workspace.\"*\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n *\n * `dataScope` is prose the operator writes, deliberately. Nothing structured exists to key it to: the\n * processing purposes a notice states are derived from the application's vision and requirements as\n * PROSE, so a ref here would point at nothing.\n */\nexport const OperatorRoleAllocationSchema = z.strictObject({\n  /** Which data this role covers, in the operator's own words — \"customer records in a workspace\". */\n  dataScope: z.string().trim().min(1),\n  role: z.enum(OperatorProcessingRole),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/** One processing purpose and the basis the operator relies on for it. */\nexport const OperatorLawfulBasisSchema = z.strictObject({\n  /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */\n  purpose: z.string().trim().min(1),\n  basis: z.enum(LawfulBasis),\n  /**\n   * The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n   * that needs a balancing test — see the superRefine below.\n   */\n  assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n  /*\n   * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n   * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n   * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n   * conclusion nobody reached.\n   */\n  if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['assessmentNote'],\n      message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n    });\n  }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/**\n * What a person must agree to in order to USE the service at all (issue #139).\n *\n * ## The near-miss this exists because of\n *\n * `analytics.requiredConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n *\n * Correcting it left a real hole, which a produced notice then reported in its own words:\n * *\"There is no declared surface for recording a service-wide consent requirement distinct from\n * analytics consent.\"* This is that surface.\n *\n * ## Why the floor may be NONE, and usually should be\n *\n * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A required level above `NONE` says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n *\n * `NONE` is therefore both the default and the honest answer for most applications: *nothing is\n * gated on consent; the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*\n * A field that pushed applications toward declaring consent would be worse than the gap it closes.\n *\n * ⚠️ Declaring a level here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n */\nexport const ServiceConsentRequirementSchema = z.strictObject({\n  /**\n   * The minimum consent a person must give to use the service.\n   *\n   * `NONE` means nothing is gated on consent — the common and usually correct answer. It is a\n   * DECLARATION, not an absence: an application that says `NONE` has answered the question, which is\n   * what separates it from one that has not been asked.\n   */\n  requiredLevel: z.enum(DataProcessingConsent),\n  /**\n   * What this gate actually controls, in the operator's own words.\n   *\n   * REQUIRED whenever the level is above `NONE`, because a gate nobody can describe is a gate nobody\n   * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n   * governs tells a person they must agree to something unnamed.\n   */\n  gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n  /*\n   * A required level above NONE with nothing described is the shape that satisfies the field and\n   * discloses nothing — the same defect as a revision recording no superseded rationale, and as a\n   * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n   * explanation is the half that makes it mean anything.\n   */\n  if (requirement.requiredLevel !== DataProcessingConsent.NONE && requirement.gatedProcessing === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['gatedProcessing'],\n      message: `a required consent level of ${requirement.requiredLevel} gates something — say what, or declare NONE. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n    });\n  }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/**\n * WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n *\n * ## Why this exists, and why in configuration\n *\n * A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n *\n * That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n *\n * Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n *\n * ## What is deliberately NOT here\n *\n * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n *\n * ## Every part is independently declarable, and that is the point (issue #228)\n *\n * This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n *\n * Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n *\n * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a consent level above `NONE` still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n */\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n  /** The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. */\n  legalEntityName: z.string().trim().min(1).optional(),\n  /** Its registered address, as a reader would need it to serve a request. Absent means unanswered. */\n  registeredAddress: z.string().trim().min(1).optional(),\n  /**\n   * How a data subject reaches the operator about privacy — an address, an email, or a URL.\n   *\n   * Open string because all three are legitimate and the law names none: what matters is that a route\n   * exists and is stated, not what shape it takes.\n   */\n  privacyContact: z.string().trim().min(1).optional(),\n  /**\n   * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n   *\n   * Optional, because most operators are established where their subjects are and appointing one\n   * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n   * when declared.\n   */\n  representative: z.strictObject({\n    name: z.string().trim().min(1),\n    address: z.string().trim().min(1),\n  }).optional(),\n  /**\n   * The operator's role, per population of data. At least one.\n   *\n   * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n   */\n  roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n  /**\n   * The lawful basis relied on, per processing purpose. At least one.\n   *\n   * `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n   * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n   * complete answer.\n   */\n  lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).optional(),\n  /**\n   * What a person must consent to in order to use the service at all (issue #139).\n   *\n   * OPTIONAL, and absent means UNANSWERED rather than `NONE`. The distinction is the one this whole\n   * lane turns on: a declared `NONE` is the operator saying nothing is gated on consent, while\n   * absence is nobody having been asked, and a notice must not render the second as the first.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n}).superRefine((identity, context) => {\n  /*\n   * A declaration with nothing in it is a no-op that reads as an answer.\n   *\n   * Every part is independently optional so an operator can record the half they know (#228), and the\n   * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n   * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n   * consumer already renders as outstanding, while an empty object would satisfy the field and\n   * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n   * with no assessment and a consent gate that names nothing.\n   */\n  if (Object.values(identity).every((part) => part === undefined)) {\n    context.addIssue({\n      code: 'custom',\n      path: [],\n      message:\n        'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n        + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n    });\n  }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/**\n * The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n *\n * A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n *\n * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredLevel = NONE`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n */\nexport enum OperatorComplianceIdentityPart {\n  LEGAL_ENTITY_NAME = 'legalEntityName',\n  REGISTERED_ADDRESS = 'registeredAddress',\n  PRIVACY_CONTACT = 'privacyContact',\n  ROLE_ALLOCATIONS = 'roleAllocations',\n  LAWFUL_BASES = 'lawfulBases',\n}\n\n/**\n * Which parts of the identity are still owed, in declaration order.\n *\n * Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n */\nexport function outstandingOperatorComplianceIdentityParts(\n  identity: ApplicationOperatorComplianceIdentity | undefined,\n): readonly OperatorComplianceIdentityPart[] {\n  return [\n    identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n    identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n    identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n    identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n    identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n  ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/**\n * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n *\n * `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n */\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] | undefined {\n  if (identity.lawfulBases === undefined) return undefined;\n  const order = Object.values(LawfulBasis);\n  return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n    .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/**\n * True when the operator declares more than one role, so a notice must not assign a single one.\n *\n * `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean | undefined {\n  if (identity.roleAllocations === undefined) return undefined;\n  return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}