@wildo-ai/saas-models 1.1.2 → 1.1.4

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.d.ts

@@ -1,39 +1,61 @@
 import { z } from 'zod';
 /**
- * WHERE this application operates, as the one source every compliance surface reads (issue #229).
+ * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.
  *
- * ## The hole this closes
+ * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse
+ * — the governed-document publication validator and the `_core` compliance-document candidate
+ * validator both emit their own typed issue records, and routing them through a Zod error to recover
+ * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three
+ * readers.
  *
- * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application
- * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as
- * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`
- * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is
- * unverifiable, it can differ between two runs of the same application, and nothing downstream could
- * disagree with it.
+ * ## A suffix under an AGGREGATE root is refused, and that is the third check
  *
- * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it
+ * The suffix means ONE thing — a place INSIDE the root — because that is the only thing
+ * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source
+ * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`
+ * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the
+ * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only
+ * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that
+ * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in
+ * a landed publication variant).
  *
- * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason
- * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be
- * recorded until the lawful bases were settled with counsel. Where you sell is known long before why
- * you may process — and issue #228 exists precisely because filling the entity must never block.
+ * A regime is not expressible in this grammar and does not need to be: the places it covers each
+ * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with
+ * no second kind of suffix for a future reader to have to tell apart.
  *
- * Keeping them siblings means each is answerable the day it is known.
- *
- * ## Why an open slug and not an enum
- *
- * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum
- * would have to be widened before an operator could state the truth about their own product. That is
- * the "genuinely open app/provider/resource identifier" exemption in the semantic-literal rule, not a
- * shortcut around it. The shape is constrained; the membership is not.
- *
- * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and
- * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that
- * consumes it. An application may always declare where it operates; Wildo says plainly where it has
- * nothing to offer.
+ * The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that
+ * already declares "this root stands for other jurisdictions" and already carries the review trigger
+ * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a
+ * hand-kept list is the thing that rots. The forward reference is safe because the table is a module
+ * constant and this function is only ever called after module evaluation.
  */
+export declare function jurisdictionSlugProblem(slug: string): string | null;
 export declare const JurisdictionSlugSchema: z.ZodString;
 export type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;
+/**
+ * The namespace every jurisdiction REFERENCE carries.
+ *
+ * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is
+ * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse
+ * outright — sit in a landed application specification beside that same application's configuration
+ * declaring `gb`.
+ */
+export declare const JURISDICTION_REF_NAMESPACE = "jurisdiction:";
+/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */
+export declare enum JurisdictionRefProblemScope {
+    /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */
+    NAMESPACE = "NAMESPACE",
+    /** The namespace is right and the slug is not a jurisdiction. */
+    SLUG = "SLUG"
+}
+export interface JurisdictionRefProblem {
+    readonly scope: JurisdictionRefProblemScope;
+    readonly message: string;
+}
+/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */
+export declare function jurisdictionRefProblem(ref: string): JurisdictionRefProblem | null;
+/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */
+export declare const JurisdictionRefSchema: z.ZodString;
 /**
  * One jurisdiction this application operates in, and why it reaches the product.
  *
@@ -78,6 +100,12 @@ export type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperat
  * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and
  * that rule is applied in code rather than enumerated here.
  *
+ * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand
+ * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —
+ * because a suffix can only be read as a place inside its root, and on an aggregate that reading
+ * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the
+ * intended consequence: the places a regime covers each have their own code.
+ *
  * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a
  * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.
  * Nothing derives it, so a change is a deliberate edit here.

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operating-jurisdictions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,sBAAsB,aAQhC,CAAC;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;IAEtC,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC;;;QAhBlD,+GAA+G;;;kBAgC7G,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAK/E,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAOhF"}
+{"version":3,"file":"operating-jurisdictions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBnE;AAED,eAAO,MAAM,sBAAsB,aAQ/B,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAE1D,gHAAgH;AAChH,oBAAY,2BAA2B;IACrC,+GAA+G;IAC/G,SAAS,cAAc;IACvB,iEAAiE;IACjE,IAAI,SAAS;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CASjF;AAED,uGAAuG;AACvG,eAAO,MAAM,qBAAqB,aAQ9B,CAAC;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;IAEtC,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC;;;QAhBlD,+GAA+G;;;kBAgC7G,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAK/E,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAShF"}

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js

@@ -32,12 +32,133 @@ import { z } from 'zod';
  * consumes it. An application may always declare where it operates; Wildo says plainly where it has
  * nothing to offer.
  */
+const JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;
+const JURISDICTION_SLUG_SHAPE_MESSAGE = 'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as "eu", '
+    + 'optionally with a SUBDIVISION suffix such as "us-ca" — lowercase, because a slug that '
+    + 'differs only by case is a second identifier for one place';
+/**
+ * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.
+ *
+ * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same
+ * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex
+ * and IDENTITY is answered here, by the same authority the publication validator already uses for
+ * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.
+ *
+ * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the
+ * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a
+ * second one covering every country on earth would rot with nobody watching. `Intl` ships the table
+ * with the runtime and updates with it.
+ *
+ * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises
+ * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is
+ * in this repository's own tests and prose.
+ */
+function canonicalRegionSubtag(subtag) {
+    const requested = `und-${subtag.toUpperCase()}`;
+    try {
+        const [canonical] = Intl.getCanonicalLocales(requested);
+        return canonical === undefined ? null : canonical.slice('und-'.length);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.
+ *
+ * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse
+ * — the governed-document publication validator and the `_core` compliance-document candidate
+ * validator both emit their own typed issue records, and routing them through a Zod error to recover
+ * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three
+ * readers.
+ *
+ * ## A suffix under an AGGREGATE root is refused, and that is the third check
+ *
+ * The suffix means ONE thing — a place INSIDE the root — because that is the only thing
+ * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source
+ * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`
+ * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the
+ * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only
+ * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that
+ * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in
+ * a landed publication variant).
+ *
+ * A regime is not expressible in this grammar and does not need to be: the places it covers each
+ * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with
+ * no second kind of suffix for a future reader to have to tell apart.
+ *
+ * The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that
+ * already declares "this root stands for other jurisdictions" and already carries the review trigger
+ * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a
+ * hand-kept list is the thing that rots. The forward reference is safe because the table is a module
+ * constant and this function is only ever called after module evaluation.
+ */
+export function jurisdictionSlugProblem(slug) {
+    if (!JURISDICTION_SLUG_SHAPE.test(slug)) {
+        return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received "${slug}"`;
+    }
+    const [root, suffix] = slug.split('-');
+    const canonical = canonicalRegionSubtag(root);
+    if (canonical === null) {
+        return `"${root}" is not a well-formed region code`;
+    }
+    if (canonical.toLowerCase() !== root) {
+        return `"${root}" is an alias for "${canonical.toLowerCase()}" — use the canonical code, or two slugs are one place`;
+    }
+    if (suffix !== undefined && Object.hasOwn(JURISDICTION_CONTAINMENT, root)) {
+        return (`"${root}" stands for the jurisdictions it contains, so "${slug}" would be read as a place INSIDE `
+            + `"${root}" — and a suffix on an aggregate names a regime, which is normally wider than the aggregate `
+            + 'rather than narrower. Name the places explicitly instead (the EEA is "eu", "is", "li", "no")');
+    }
+    return null;
+}
 export const JurisdictionSlugSchema = z
     .string()
     .trim()
-    .regex(/^[a-z]{2}(-[a-z0-9]{1,8})?$/u, 'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as "eu", '
-    + 'optionally with a subdivision suffix such as "us-ca" — lowercase, because a slug that differs '
-    + 'only by case is a second identifier for one place');
+    .superRefine((slug, context) => {
+    const problem = jurisdictionSlugProblem(slug);
+    if (problem !== null) {
+        context.addIssue({ code: 'custom', message: problem });
+    }
+});
+/**
+ * The namespace every jurisdiction REFERENCE carries.
+ *
+ * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is
+ * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse
+ * outright — sit in a landed application specification beside that same application's configuration
+ * declaring `gb`.
+ */
+export const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';
+/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */
+export var JurisdictionRefProblemScope;
+(function (JurisdictionRefProblemScope) {
+    /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */
+    JurisdictionRefProblemScope["NAMESPACE"] = "NAMESPACE";
+    /** The namespace is right and the slug is not a jurisdiction. */
+    JurisdictionRefProblemScope["SLUG"] = "SLUG";
+})(JurisdictionRefProblemScope || (JurisdictionRefProblemScope = {}));
+/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */
+export function jurisdictionRefProblem(ref) {
+    if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {
+        return {
+            scope: JurisdictionRefProblemScope.NAMESPACE,
+            message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,
+        };
+    }
+    const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));
+    return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };
+}
+/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */
+export const JurisdictionRefSchema = z
+    .string()
+    .trim()
+    .superRefine((ref, context) => {
+    const problem = jurisdictionRefProblem(ref);
+    if (problem !== null) {
+        context.addIssue({ code: 'custom', message: problem.message });
+    }
+});
 /**
  * One jurisdiction this application operates in, and why it reaches the product.
  *
@@ -89,6 +210,12 @@ export const ApplicationOperatingJurisdictionsSchema = z
  * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and
  * that rule is applied in code rather than enumerated here.
  *
+ * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand
+ * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —
+ * because a suffix can only be read as a place inside its root, and on an aggregate that reading
+ * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the
+ * intended consequence: the places a regime covers each have their own code.
+ *
  * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a
  * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.
  * Nothing derives it, so a change is a deliberate edit here.
@@ -109,6 +236,8 @@ export function jurisdictionReachCovers(reach, declared) {
     if (reach === declared)
         return true;
     // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.
+    // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix
+    // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.
     if (declared.startsWith(`${reach}-`))
         return true;
     return (JURISDICTION_CONTAINMENT[reach] ?? []).some((member) => member === declared || declared.startsWith(`${member}-`));

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CACJ,8BAA8B,EAC9B,gGAAgG;MAC5F,gGAAgG;MAChG,mDAAmD,CACxD,CAAC;AAGJ;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHERE this application operates, as the one source every compliance surface reads (issue #229).\n *\n * ## The hole this closes\n *\n * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n *\n * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n *\n * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n *\n * Keeping them siblings means each is answerable the day it is known.\n *\n * ## Why an open slug and not an enum\n *\n * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n *\n * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n */\nexport const JurisdictionSlugSchema = z\n  .string()\n  .trim()\n  .regex(\n    /^[a-z]{2}(-[a-z0-9]{1,8})?$/u,\n    'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n      + 'optionally with a subdivision suffix such as \"us-ca\" — lowercase, because a slug that differs '\n      + 'only by case is a second identifier for one place',\n  );\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/**\n * One jurisdiction this application operates in, and why it reaches the product.\n *\n * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n *\n * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n */\nexport const OperatingJurisdictionSchema = z.strictObject({\n  jurisdictionSlug: JurisdictionSlugSchema,\n  /** Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". */\n  basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/**\n * The jurisdictions this application operates in.\n *\n * ## Absent is UNDECLARED, and an empty list is not offered\n *\n * The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n */\nexport const ApplicationOperatingJurisdictionsSchema = z\n  .strictObject({\n    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n  })\n  .superRefine((declaration, context) => {\n    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n    if (duplicates.length > 0) {\n      context.addIssue({\n        code: 'custom',\n        path: ['jurisdictions'],\n        message:\n          `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n          + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n      });\n    }\n  });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/**\n * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n *\n * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n *\n * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n */\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  eu: Object.freeze([\n    'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n    'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n  ]),\n});\n\n/**\n * Does a source addressing `reach` answer for an application operating in `declared`?\n *\n * Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n  if (reach === declared) return true;\n  // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n  if (declared.startsWith(`${reach}-`)) return true;\n  return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n    (member) => member === declared || declared.startsWith(`${member}-`),\n  );\n}\n"]}
+{"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,wFAAwF;MACxF,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,CACL,IAAI,IAAI,mDAAmD,IAAI,oCAAoC;cACjG,IAAI,IAAI,8FAA8F;cACtG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,gHAAgH;IAChH,oHAAoH;IACpH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHERE this application operates, as the one source every compliance surface reads (issue #229).\n *\n * ## The hole this closes\n *\n * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n *\n * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n *\n * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n *\n * Keeping them siblings means each is answerable the day it is known.\n *\n * ## Why an open slug and not an enum\n *\n * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n *\n * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n */\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n  'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n  + 'optionally with a SUBDIVISION suffix such as \"us-ca\" — lowercase, because a slug that '\n  + 'differs only by case is a second identifier for one place';\n\n/**\n * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n *\n * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n *\n * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n *\n * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n */\nfunction canonicalRegionSubtag(subtag: string): string | null {\n  const requested = `und-${subtag.toUpperCase()}`;\n  try {\n    const [canonical] = Intl.getCanonicalLocales(requested);\n    return canonical === undefined ? null : canonical.slice('und-'.length);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n *\n * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n *\n * ## A suffix under an AGGREGATE root is refused, and that is the third check\n *\n * The suffix means ONE thing — a place INSIDE the root — because that is the only thing\n * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source\n * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`\n * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the\n * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only\n * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that\n * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in\n * a landed publication variant).\n *\n * A regime is not expressible in this grammar and does not need to be: the places it covers each\n * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with\n * no second kind of suffix for a future reader to have to tell apart.\n *\n * The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that\n * already declares \"this root stands for other jurisdictions\" and already carries the review trigger\n * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a\n * hand-kept list is the thing that rots. The forward reference is safe because the table is a module\n * constant and this function is only ever called after module evaluation.\n */\nexport function jurisdictionSlugProblem(slug: string): string | null {\n  if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n    return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n  }\n  const [root, suffix] = slug.split('-');\n  const canonical = canonicalRegionSubtag(root!);\n  if (canonical === null) {\n    return `\"${root}\" is not a well-formed region code`;\n  }\n  if (canonical.toLowerCase() !== root) {\n    return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n  }\n  if (suffix !== undefined && Object.hasOwn(JURISDICTION_CONTAINMENT, root!)) {\n    return (\n      `\"${root}\" stands for the jurisdictions it contains, so \"${slug}\" would be read as a place INSIDE `\n      + `\"${root}\" — and a suffix on an aggregate names a regime, which is normally wider than the aggregate `\n      + 'rather than narrower. Name the places explicitly instead (the EEA is \"eu\", \"is\", \"li\", \"no\")'\n    );\n  }\n  return null;\n}\n\nexport const JurisdictionSlugSchema = z\n  .string()\n  .trim()\n  .superRefine((slug, context) => {\n    const problem = jurisdictionSlugProblem(slug);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem });\n    }\n  });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/**\n * The namespace every jurisdiction REFERENCE carries.\n *\n * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n */\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */\nexport enum JurisdictionRefProblemScope {\n  /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */\n  NAMESPACE = 'NAMESPACE',\n  /** The namespace is right and the slug is not a jurisdiction. */\n  SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n  readonly scope: JurisdictionRefProblemScope;\n  readonly message: string;\n}\n\n/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem | null {\n  if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n    return {\n      scope: JurisdictionRefProblemScope.NAMESPACE,\n      message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n    };\n  }\n  const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n  return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */\nexport const JurisdictionRefSchema = z\n  .string()\n  .trim()\n  .superRefine((ref, context) => {\n    const problem = jurisdictionRefProblem(ref);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem.message });\n    }\n  });\n\n/**\n * One jurisdiction this application operates in, and why it reaches the product.\n *\n * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n *\n * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n */\nexport const OperatingJurisdictionSchema = z.strictObject({\n  jurisdictionSlug: JurisdictionSlugSchema,\n  /** Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". */\n  basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/**\n * The jurisdictions this application operates in.\n *\n * ## Absent is UNDECLARED, and an empty list is not offered\n *\n * The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n */\nexport const ApplicationOperatingJurisdictionsSchema = z\n  .strictObject({\n    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n  })\n  .superRefine((declaration, context) => {\n    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n    if (duplicates.length > 0) {\n      context.addIssue({\n        code: 'custom',\n        path: ['jurisdictions'],\n        message:\n          `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n          + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n      });\n    }\n  });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/**\n * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n *\n * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n *\n * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand\n * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —\n * because a suffix can only be read as a place inside its root, and on an aggregate that reading\n * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the\n * intended consequence: the places a regime covers each have their own code.\n *\n * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n */\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  eu: Object.freeze([\n    'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n    'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n  ]),\n});\n\n/**\n * Does a source addressing `reach` answer for an application operating in `declared`?\n *\n * Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n  if (reach === declared) return true;\n  // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n  // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix\n  // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.\n  if (declared.startsWith(`${reach}-`)) return true;\n  return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n    (member) => member === declared || declared.startsWith(`${member}-`),\n  );\n}\n"]}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;kBAGpG,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;;IAG1G;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;OAMG;;IAEH;;;;;;OAMG;;kBAgBH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QAzKH,oGAAoG;;;;IA2KpG;;;;;;OAMG;;QAzKH,0GAA0G;;;QAG1G;;;WAGG;;;IAqKH;;;;;;OAMG;;QAzHH;;;;;;WAMG;;QAEH;;;;;;WAMG;;;kBAiIH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAQ3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}
+{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;kBAGpG,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;;IAG1G;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;OAMG;;IAEH;;;;;;OAMG;;kBAgBH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QAzKH,oGAAoG;;;;IA2KpG;;;;;;OAMG;;QAzKH,0GAA0G;;;QAG1G;;;WAGG;;;IAqKH;;;;;;OAMG;;QAzHH;;;;;;WAMG;;QAEH;;;;;;WAMG;;;kBAiIH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAQ3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}

package/dist/esm/compliance/privacy/personal-data-category.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}
+{"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}

package/dist/esm/compliance/privacy/personal-data-declaration.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}
+{"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts

@@ -59,6 +59,22 @@ export declare enum PrivacyLevel {
  * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis
  * and the compliance obligations that attach to each non-`DISABLED` member.
  */
+/**
+ * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer
+ *
+ * Whether the application identifies a browser INSTALL across visits, declared as
+ * `compliance.clientInstanceIdScope`.
+ *
+ * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY
+ * decision, and on the SHARED config because both halves must obey one authored value: the frontend
+ * decides whether to mint, store and send the id, and the backend independently decides whether to
+ * ingest and record it. Two gates, one source — so an application that never opts in is protected
+ * even if some client sends the header anyway.
+ *
+ * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.
+ * Choosing another member is choosing an obligation, not just a signal: start-up prints the
+ * obligations each opt-in creates.
+ */
 export declare enum ClientInstanceIdScope {
     /**
      * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend
@@ -82,6 +98,7 @@ export declare enum ClientInstanceIdScope {
      */
     PERSISTENT = "persistent"
 }
+/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */
 export declare const AnonymousUserPrivacySchema: z.ZodObject<{
     dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
 }, z.core.$strip>;

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY,CAAE,0BAA0B;IAC/C,QAAQ,aAAa,CAAE,2BAA2B;IAClD,QAAQ,aAAa;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY,CAAE,0BAA0B;IAC/C,QAAQ,aAAa,CAAE,2BAA2B;IAClD,QAAQ,aAAa;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AACD,0EAA0E;AAE1E,eAAO,MAAM,0BAA0B;;iBAKrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;iBAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAuB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.js

@@ -63,6 +63,22 @@ export var PrivacyLevel;
  * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis
  * and the compliance obligations that attach to each non-`DISABLED` member.
  */
+/**
+ * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer
+ *
+ * Whether the application identifies a browser INSTALL across visits, declared as
+ * `compliance.clientInstanceIdScope`.
+ *
+ * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY
+ * decision, and on the SHARED config because both halves must obey one authored value: the frontend
+ * decides whether to mint, store and send the id, and the backend independently decides whether to
+ * ingest and record it. Two gates, one source — so an application that never opts in is protected
+ * even if some client sends the header anyway.
+ *
+ * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.
+ * Choosing another member is choosing an obligation, not just a signal: start-up prints the
+ * obligations each opt-in creates.
+ */
 export var ClientInstanceIdScope;
 (function (ClientInstanceIdScope) {
     /**
@@ -87,11 +103,14 @@ export var ClientInstanceIdScope;
      */
     ClientInstanceIdScope["PERSISTENT"] = "persistent";
 })(ClientInstanceIdScope || (ClientInstanceIdScope = {}));
+/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */
 export const AnonymousUserPrivacySchema = z.object({
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC),
+    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)
+        .describe('The processing this anonymous visitor has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.'),
 });
 export const InboundContactPrivacySchema = z.object({
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC),
+    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)
+        .describe('The processing this lead has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.'),
 });
 export const UserPrivacySchema = z.object({
     // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.
@@ -108,7 +127,11 @@ export const UserPrivacySchema = z.object({
     // decision and must leave a trail naming the previous and resulting value. Reached today by the
     // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the
     // same emission point, so no verb can change consent without a record.
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC).isAuditEvidence(),
-    privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD).isAuditEvidence(),
+    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)
+        .describe('The processing this person has agreed to. It is the subject\'s own decision and only they (or an administrator acting for them) change it. The application decides what each level permits — the framework stores the decision and records every change, it does not attach a fixed meaning to the levels.')
+        .isAuditEvidence(),
+    privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD)
+        .describe('How much this person has agreed the application may collect about them, alongside the processing consent. The application decides what each level permits.')
+        .isAuditEvidence(),
 });
 //# sourceMappingURL=privacy.shared.schemas.js.map

package/dist/esm/compliance/privacy/privacy.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,wCAAe,CAAA;IACf,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,sCAAa,CAAA;AACf,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;CAC1F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;CAC1F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,2FAA2F;IAC3F,EAAE;IACF,yFAAyF;IACzF,4FAA4F;IAC5F,yFAAyF;IACzF,6EAA6E;IAC7E,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAC3G,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE;CACpF,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum DataProcessingConsent {\n  NONE = \"none\",\n  BASIC = \"basic\",\n  ANALYTICS = \"analytics\",\n  MARKETING = \"marketing\",\n  FULL = \"full\",\n}\n\nexport enum PrivacyLevel {\n  MINIMAL = \"minimal\", // Minimum data collection\n  STANDARD = \"standard\", // Standard data collection\n  ENHANCED = \"enhanced\", // Enhanced features with more data\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n\nexport const AnonymousUserPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.\n  //\n  // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the\n  // collection scope — held as closed vocabularies, so recording their before/after values on\n  // `resource_operation_performed` is exactly the \"mark what decides authority, never what\n  // identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting value. Reached today by the\n  // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the\n  // same emission point, so no verb can change consent without a record.\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC).isAuditEvidence(),\n  privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD).isAuditEvidence(),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}
+{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,wCAAe,CAAA;IACf,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,sCAAa,CAAA;AACf,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,6LAA6L,CAC9L;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,gLAAgL,CACjL;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,2FAA2F;IAC3F,EAAE;IACF,yFAAyF;IACzF,4FAA4F;IAC5F,yFAAyF;IACzF,6EAA6E;IAC7E,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,4SAA4S,CAC7S;SACA,eAAe,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;SAC9D,QAAQ,CAAC,4JAA4J,CAAC;SACtK,eAAe,EAAE;CACrB,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum DataProcessingConsent {\n  NONE = \"none\",\n  BASIC = \"basic\",\n  ANALYTICS = \"analytics\",\n  MARKETING = \"marketing\",\n  FULL = \"full\",\n}\n\nexport enum PrivacyLevel {\n  MINIMAL = \"minimal\", // Minimum data collection\n  STANDARD = \"standard\", // Standard data collection\n  ENHANCED = \"enhanced\", // Enhanced features with more data\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\n/**\n * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n *\n * Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n *\n * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n *\n * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\nexport const AnonymousUserPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n    .describe(\n      'The processing this anonymous visitor has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n    ),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n    .describe(\n      'The processing this lead has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n    ),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.\n  //\n  // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the\n  // collection scope — held as closed vocabularies, so recording their before/after values on\n  // `resource_operation_performed` is exactly the \"mark what decides authority, never what\n  // identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting value. Reached today by the\n  // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the\n  // same emission point, so no verb can change consent without a record.\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n    .describe(\n      'The processing this person has agreed to. It is the subject\\'s own decision and only they (or an administrator acting for them) change it. The application decides what each level permits — the framework stores the decision and records every change, it does not attach a fixed meaning to the levels.',\n    )\n    .isAuditEvidence(),\n  privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD)\n    .describe('How much this person has agreed the application may collect about them, alongside the processing consent. The application decides what each level permits.')\n    .isAuditEvidence(),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}