@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js

@@ -34,7 +34,7 @@ import { z } from 'zod';
  */
 const JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;
 const JURISDICTION_SLUG_SHAPE_MESSAGE = 'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as "eu", '
-    + 'optionally with a regime or subdivision suffix such as "us-ca" — lowercase, because a slug that '
+    + 'optionally with a SUBDIVISION suffix such as "us-ca" — lowercase, because a slug that '
     + 'differs only by case is a second identifier for one place';
 /**
  * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.
@@ -71,12 +71,33 @@ function canonicalRegionSubtag(subtag) {
  * validator both emit their own typed issue records, and routing them through a Zod error to recover
  * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three
  * readers.
+ *
+ * ## A suffix under an AGGREGATE root is refused, and that is the third check
+ *
+ * The suffix means ONE thing — a place INSIDE the root — because that is the only thing
+ * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source
+ * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`
+ * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the
+ * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only
+ * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that
+ * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in
+ * a landed publication variant).
+ *
+ * A regime is not expressible in this grammar and does not need to be: the places it covers each
+ * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with
+ * no second kind of suffix for a future reader to have to tell apart.
+ *
+ * The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that
+ * already declares "this root stands for other jurisdictions" and already carries the review trigger
+ * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a
+ * hand-kept list is the thing that rots. The forward reference is safe because the table is a module
+ * constant and this function is only ever called after module evaluation.
  */
 export function jurisdictionSlugProblem(slug) {
     if (!JURISDICTION_SLUG_SHAPE.test(slug)) {
         return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received "${slug}"`;
     }
-    const [root] = slug.split('-');
+    const [root, suffix] = slug.split('-');
     const canonical = canonicalRegionSubtag(root);
     if (canonical === null) {
         return `"${root}" is not a well-formed region code`;
@@ -84,6 +105,11 @@ export function jurisdictionSlugProblem(slug) {
     if (canonical.toLowerCase() !== root) {
         return `"${root}" is an alias for "${canonical.toLowerCase()}" — use the canonical code, or two slugs are one place`;
     }
+    if (suffix !== undefined && Object.hasOwn(JURISDICTION_CONTAINMENT, root)) {
+        return (`"${root}" stands for the jurisdictions it contains, so "${slug}" would be read as a place INSIDE `
+            + `"${root}" — and a suffix on an aggregate names a regime, which is normally wider than the aggregate `
+            + 'rather than narrower. Name the places explicitly instead (the EEA is "eu", "is", "li", "no")');
+    }
     return null;
 }
 export const JurisdictionSlugSchema = z
@@ -184,6 +210,12 @@ export const ApplicationOperatingJurisdictionsSchema = z
  * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and
  * that rule is applied in code rather than enumerated here.
  *
+ * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand
+ * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —
+ * because a suffix can only be read as a place inside its root, and on an aggregate that reading
+ * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the
+ * intended consequence: the places a regime covers each have their own code.
+ *
  * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a
  * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.
  * Nothing derives it, so a change is a deliberate edit here.
@@ -204,6 +236,8 @@ export function jurisdictionReachCovers(reach, declared) {
     if (reach === declared)
         return true;
     // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.
+    // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix
+    // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.
     if (declared.startsWith(`${reach}-`))
         return true;
     return (JURISDICTION_CONTAINMENT[reach] ?? []).some((member) => member === declared || declared.startsWith(`${member}-`));

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,kGAAkG;MAClG,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHERE this application operates, as the one source every compliance surface reads (issue #229).\n *\n * ## The hole this closes\n *\n * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n *\n * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n *\n * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n *\n * Keeping them siblings means each is answerable the day it is known.\n *\n * ## Why an open slug and not an enum\n *\n * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n *\n * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n */\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n  'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n  + 'optionally with a regime or subdivision suffix such as \"us-ca\" — lowercase, because a slug that '\n  + 'differs only by case is a second identifier for one place';\n\n/**\n * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n *\n * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n *\n * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n *\n * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n */\nfunction canonicalRegionSubtag(subtag: string): string | null {\n  const requested = `und-${subtag.toUpperCase()}`;\n  try {\n    const [canonical] = Intl.getCanonicalLocales(requested);\n    return canonical === undefined ? null : canonical.slice('und-'.length);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n *\n * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n */\nexport function jurisdictionSlugProblem(slug: string): string | null {\n  if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n    return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n  }\n  const [root] = slug.split('-');\n  const canonical = canonicalRegionSubtag(root!);\n  if (canonical === null) {\n    return `\"${root}\" is not a well-formed region code`;\n  }\n  if (canonical.toLowerCase() !== root) {\n    return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n  }\n  return null;\n}\n\nexport const JurisdictionSlugSchema = z\n  .string()\n  .trim()\n  .superRefine((slug, context) => {\n    const problem = jurisdictionSlugProblem(slug);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem });\n    }\n  });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/**\n * The namespace every jurisdiction REFERENCE carries.\n *\n * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n */\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */\nexport enum JurisdictionRefProblemScope {\n  /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */\n  NAMESPACE = 'NAMESPACE',\n  /** The namespace is right and the slug is not a jurisdiction. */\n  SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n  readonly scope: JurisdictionRefProblemScope;\n  readonly message: string;\n}\n\n/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem | null {\n  if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n    return {\n      scope: JurisdictionRefProblemScope.NAMESPACE,\n      message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n    };\n  }\n  const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n  return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */\nexport const JurisdictionRefSchema = z\n  .string()\n  .trim()\n  .superRefine((ref, context) => {\n    const problem = jurisdictionRefProblem(ref);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem.message });\n    }\n  });\n\n/**\n * One jurisdiction this application operates in, and why it reaches the product.\n *\n * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n *\n * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n */\nexport const OperatingJurisdictionSchema = z.strictObject({\n  jurisdictionSlug: JurisdictionSlugSchema,\n  /** Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". */\n  basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/**\n * The jurisdictions this application operates in.\n *\n * ## Absent is UNDECLARED, and an empty list is not offered\n *\n * The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n */\nexport const ApplicationOperatingJurisdictionsSchema = z\n  .strictObject({\n    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n  })\n  .superRefine((declaration, context) => {\n    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n    if (duplicates.length > 0) {\n      context.addIssue({\n        code: 'custom',\n        path: ['jurisdictions'],\n        message:\n          `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n          + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n      });\n    }\n  });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/**\n * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n *\n * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n *\n * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n */\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  eu: Object.freeze([\n    'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n    'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n  ]),\n});\n\n/**\n * Does a source addressing `reach` answer for an application operating in `declared`?\n *\n * Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n  if (reach === declared) return true;\n  // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n  if (declared.startsWith(`${reach}-`)) return true;\n  return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n    (member) => member === declared || declared.startsWith(`${member}-`),\n  );\n}\n"]}
+{"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,wFAAwF;MACxF,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,CACL,IAAI,IAAI,mDAAmD,IAAI,oCAAoC;cACjG,IAAI,IAAI,8FAA8F;cACtG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,gHAAgH;IAChH,oHAAoH;IACpH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHERE this application operates, as the one source every compliance surface reads (issue #229).\n *\n * ## The hole this closes\n *\n * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n *\n * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n *\n * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n *\n * Keeping them siblings means each is answerable the day it is known.\n *\n * ## Why an open slug and not an enum\n *\n * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n *\n * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n */\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n  'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n  + 'optionally with a SUBDIVISION suffix such as \"us-ca\" — lowercase, because a slug that '\n  + 'differs only by case is a second identifier for one place';\n\n/**\n * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n *\n * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n *\n * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n *\n * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n */\nfunction canonicalRegionSubtag(subtag: string): string | null {\n  const requested = `und-${subtag.toUpperCase()}`;\n  try {\n    const [canonical] = Intl.getCanonicalLocales(requested);\n    return canonical === undefined ? null : canonical.slice('und-'.length);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n *\n * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n *\n * ## A suffix under an AGGREGATE root is refused, and that is the third check\n *\n * The suffix means ONE thing — a place INSIDE the root — because that is the only thing\n * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source\n * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`\n * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the\n * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only\n * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that\n * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in\n * a landed publication variant).\n *\n * A regime is not expressible in this grammar and does not need to be: the places it covers each\n * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with\n * no second kind of suffix for a future reader to have to tell apart.\n *\n * The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that\n * already declares \"this root stands for other jurisdictions\" and already carries the review trigger\n * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a\n * hand-kept list is the thing that rots. The forward reference is safe because the table is a module\n * constant and this function is only ever called after module evaluation.\n */\nexport function jurisdictionSlugProblem(slug: string): string | null {\n  if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n    return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n  }\n  const [root, suffix] = slug.split('-');\n  const canonical = canonicalRegionSubtag(root!);\n  if (canonical === null) {\n    return `\"${root}\" is not a well-formed region code`;\n  }\n  if (canonical.toLowerCase() !== root) {\n    return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n  }\n  if (suffix !== undefined && Object.hasOwn(JURISDICTION_CONTAINMENT, root!)) {\n    return (\n      `\"${root}\" stands for the jurisdictions it contains, so \"${slug}\" would be read as a place INSIDE `\n      + `\"${root}\" — and a suffix on an aggregate names a regime, which is normally wider than the aggregate `\n      + 'rather than narrower. Name the places explicitly instead (the EEA is \"eu\", \"is\", \"li\", \"no\")'\n    );\n  }\n  return null;\n}\n\nexport const JurisdictionSlugSchema = z\n  .string()\n  .trim()\n  .superRefine((slug, context) => {\n    const problem = jurisdictionSlugProblem(slug);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem });\n    }\n  });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/**\n * The namespace every jurisdiction REFERENCE carries.\n *\n * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n */\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */\nexport enum JurisdictionRefProblemScope {\n  /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */\n  NAMESPACE = 'NAMESPACE',\n  /** The namespace is right and the slug is not a jurisdiction. */\n  SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n  readonly scope: JurisdictionRefProblemScope;\n  readonly message: string;\n}\n\n/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem | null {\n  if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n    return {\n      scope: JurisdictionRefProblemScope.NAMESPACE,\n      message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n    };\n  }\n  const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n  return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */\nexport const JurisdictionRefSchema = z\n  .string()\n  .trim()\n  .superRefine((ref, context) => {\n    const problem = jurisdictionRefProblem(ref);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem.message });\n    }\n  });\n\n/**\n * One jurisdiction this application operates in, and why it reaches the product.\n *\n * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n *\n * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n */\nexport const OperatingJurisdictionSchema = z.strictObject({\n  jurisdictionSlug: JurisdictionSlugSchema,\n  /** Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". */\n  basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/**\n * The jurisdictions this application operates in.\n *\n * ## Absent is UNDECLARED, and an empty list is not offered\n *\n * The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n */\nexport const ApplicationOperatingJurisdictionsSchema = z\n  .strictObject({\n    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n  })\n  .superRefine((declaration, context) => {\n    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n    if (duplicates.length > 0) {\n      context.addIssue({\n        code: 'custom',\n        path: ['jurisdictions'],\n        message:\n          `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n          + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n      });\n    }\n  });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/**\n * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n *\n * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n *\n * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand\n * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —\n * because a suffix can only be read as a place inside its root, and on an aggregate that reading\n * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the\n * intended consequence: the places a regime covers each have their own code.\n *\n * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n */\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  eu: Object.freeze([\n    'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n    'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n  ]),\n});\n\n/**\n * Does a source addressing `reach` answer for an application operating in `declared`?\n *\n * Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n  if (reach === declared) return true;\n  // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n  // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix\n  // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.\n  if (declared.startsWith(`${reach}-`)) return true;\n  return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n    (member) => member === declared || declared.startsWith(`${member}-`),\n  );\n}\n"]}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { DataProcessingConsent } from './privacy.shared.schemas';
+import { ConsentPurpose } from './consent-purposes.shared';
 /**
  * GDPR Art. 6(1) — the six lawful bases, closed by the article.
  *
@@ -8,6 +8,8 @@ import { DataProcessingConsent } from './privacy.shared.schemas';
  * must name the law. "We have a lawful basis" is not a disclosure; a notice must say WHICH.
  *
  * spec-cite: GDPR Art. 6(1)(a)–(f).
+ *
+ * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.
  */
 export declare enum LawfulBasis {
     /** Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. */
@@ -54,7 +56,11 @@ export declare const OperatorRoleAllocationSchema: z.ZodObject<{
     role: z.ZodEnum<typeof OperatorProcessingRole>;
 }, z.core.$strict>;
 export type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;
-/** One processing purpose and the basis the operator relies on for it. */
+/**
+ * One processing purpose and the basis the operator relies on for it.
+ *
+ * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.
+ */
 export declare const OperatorLawfulBasisSchema: z.ZodObject<{
     /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */
     purpose: z.ZodString;
@@ -71,7 +77,7 @@ export type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;
  *
  * ## The near-miss this exists because of
  *
- * `analytics.requiredConsent` already exists and governs ANALYTICS alone. The compliance partial
+ * `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial
  * described it as "the minimum a person must give to use the service" until 2026-08-30 — a much
  * larger claim about a much narrower field. A drafter following that wording would have published
  * that a person must consent to analytics in order to use the product: false, and false about the one
@@ -81,34 +87,56 @@ export type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;
  * *"There is no declared surface for recording a service-wide consent requirement distinct from
  * analytics consent."* This is that surface.
  *
- * ## Why the floor may be NONE, and usually should be
+ * ## Why the required set may be empty, and usually should be
  *
  * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is
  * CONTRACT — a person uses the product because their employer signed for it, not because they
- * consented. A required level above `NONE` says the opposite, so declaring one is a claim about the
+ * consented. A non-empty required set says the opposite, so declaring one is a claim about the
  * lawful basis and not merely a UI gate.
  *
- * `NONE` is therefore both the default and the honest answer for most applications: *nothing is
- * gated on consent; the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*
+ * An EMPTY set is therefore the honest answer for most applications: *nothing is gated on consent;
+ * the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*
  * A field that pushed applications toward declaring consent would be worse than the gap it closes.
  *
- * ⚠️ Declaring a level here does NOT make consent the lawful basis for anything. It states a gate.
+ * ## This is the ENFORCED half of the identity (#453)
+ *
+ * Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is
+ * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is
+ * the exception. `wildo config service-consent` projects it into the running application's
+ * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in
+ * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,
+ * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the
+ * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),
+ * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push
+ * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an
+ * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they
+ * already started. Signing in, refreshing a session and signing out are not resource operations and stay
+ * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count
+ * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in
+ * place of every signed-in route. A reader of
+ * this schema must be able to tell the two apart without tracing the runtime, which is why it is said
+ * here.
+ *
+ * ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.
  * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer
  * needs to see rather than one the schema should quietly reconcile.
  */
 export declare const ServiceConsentRequirementSchema: z.ZodObject<{
     /**
-     * The minimum consent a person must give to use the service.
+     * The purposes a person must grant before they may use the service — a SET, never a level (#453).
      *
-     * `NONE` means nothing is gated on consent — the common and usually correct answer. It is a
-     * DECLARATION, not an absence: an application that says `NONE` has answered the question, which is
-     * what separates it from one that has not been asked.
+     * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a
+     * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is
+     * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.
+     *
+     * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that
+     * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.
      */
-    requiredLevel: z.ZodEnum<typeof DataProcessingConsent>;
+    requiredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
     /**
      * What this gate actually controls, in the operator's own words.
      *
-     * REQUIRED whenever the level is above `NONE`, because a gate nobody can describe is a gate nobody
+     * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody
      * can honour — enforced below. A notice stating "consent is required" without saying what it
      * governs tells a person they must agree to something unnamed.
      */
@@ -156,7 +184,7 @@ export type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirement
  * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.
  *
  * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still
- * requires its assessment, and a consent level above `NONE` still requires what it gates. Those
+ * requires its assessment, and a non-empty required purpose set still requires what it gates. Those
  * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a
  * partial declaration is honest, a self-contradicting one is not.
  */
@@ -213,28 +241,42 @@ export declare const ApplicationOperatorComplianceIdentitySchema: z.ZodObject<{
     /**
      * What a person must consent to in order to use the service at all (issue #139).
      *
-     * OPTIONAL, and absent means UNANSWERED rather than `NONE`. The distinction is the one this whole
-     * lane turns on: a declared `NONE` is the operator saying nothing is gated on consent, while
+     * OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this
+     * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while
      * absence is nobody having been asked, and a notice must not render the second as the first.
      */
     serviceConsentRequirement: z.ZodOptional<z.ZodObject<{
         /**
-         * The minimum consent a person must give to use the service.
+         * The purposes a person must grant before they may use the service — a SET, never a level (#453).
+         *
+         * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a
+         * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is
+         * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.
          *
-         * `NONE` means nothing is gated on consent — the common and usually correct answer. It is a
-         * DECLARATION, not an absence: an application that says `NONE` has answered the question, which is
-         * what separates it from one that has not been asked.
+         * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that
+         * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.
          */
-        requiredLevel: z.ZodEnum<typeof DataProcessingConsent>;
+        requiredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
         /**
          * What this gate actually controls, in the operator's own words.
          *
-         * REQUIRED whenever the level is above `NONE`, because a gate nobody can describe is a gate nobody
+         * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody
          * can honour — enforced below. A notice stating "consent is required" without saying what it
          * governs tells a person they must agree to something unnamed.
          */
         gatedProcessing: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    /**
+     * How the operator confirms that a person exercising a data-subject right is that person, before acting.
+     *
+     * The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the
+     * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step
+     * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).
+     * Prose, because procedures differ — "requests from a signed-in account are verified by that session;
+     * requests by email are answered at the account's address". Absent means undecided, and the
+     * `rights-and-complaint-route` fact then answers nothing (#454).
+     */
+    subjectRequestIdentityVerification: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;
 /**
@@ -247,7 +289,7 @@ export type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOp
  * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are
  * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no
  * Art. 27 representative, and a declared absence of a consent gate is expressed by
- * `serviceConsentRequirement.requiredLevel = NONE`, which is a value rather than an omission. Listing
+ * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing
  * them would report every correct identity as incomplete.
  */
 export declare enum OperatorComplianceIdentityPart {
@@ -255,7 +297,8 @@ export declare enum OperatorComplianceIdentityPart {
     REGISTERED_ADDRESS = "registeredAddress",
     PRIVACY_CONTACT = "privacyContact",
     ROLE_ALLOCATIONS = "roleAllocations",
-    LAWFUL_BASES = "lawfulBases"
+    LAWFUL_BASES = "lawfulBases",
+    SUBJECT_REQUEST_IDENTITY_VERIFICATION = "subjectRequestIdentityVerification"
 }
 /**
  * Which parts of the identity are still owed, in declaration order.

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;kBAGpG,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;;IAG1G;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;OAMG;;IAEH;;;;;;OAMG;;kBAgBH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QAzKH,oGAAoG;;;;IA2KpG;;;;;;OAMG;;QAzKH,0GAA0G;;;QAG1G;;;WAGG;;;IAqKH;;;;;;OAMG;;QAzHH;;;;;;WAMG;;QAEH;;;;;;WAMG;;;kBAiIH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAQ3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}
+{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;kBAGpG,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;;IAG1G;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;;;;OASG;;IAEH;;;;;;OAMG;;kBA2BH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QA9MH,oGAAoG;;;;IAgNpG;;;;;;OAMG;;QA1MH,0GAA0G;;;QAG1G;;;WAGG;;;IAsMH;;;;;;OAMG;;QAvIH;;;;;;;;;WASG;;QAEH;;;;;;WAMG;;;IAwHH;;;;;;;;;OASG;;kBAsBH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;IAC5B,qCAAqC,uCAAuC;CAC7E;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAS3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { DataProcessingConsent } from './privacy.shared.schemas.js';
+import { ConsentPurpose } from './consent-purposes.shared.js';
 /**
  * GDPR Art. 6(1) — the six lawful bases, closed by the article.
  *
@@ -8,6 +8,8 @@ import { DataProcessingConsent } from './privacy.shared.schemas.js';
  * must name the law. "We have a lawful basis" is not a disclosure; a notice must say WHICH.
  *
  * spec-cite: GDPR Art. 6(1)(a)–(f).
+ *
+ * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.
  */
 export var LawfulBasis;
 (function (LawfulBasis) {
@@ -55,7 +57,11 @@ export const OperatorRoleAllocationSchema = z.strictObject({
     dataScope: z.string().trim().min(1),
     role: z.enum(OperatorProcessingRole),
 });
-/** One processing purpose and the basis the operator relies on for it. */
+/**
+ * One processing purpose and the basis the operator relies on for it.
+ *
+ * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.
+ */
 export const OperatorLawfulBasisSchema = z.strictObject({
     /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */
     purpose: z.string().trim().min(1),
@@ -85,7 +91,7 @@ export const OperatorLawfulBasisSchema = z.strictObject({
  *
  * ## The near-miss this exists because of
  *
- * `analytics.requiredConsent` already exists and governs ANALYTICS alone. The compliance partial
+ * `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial
  * described it as "the minimum a person must give to use the service" until 2026-08-30 — a much
  * larger claim about a much narrower field. A drafter following that wording would have published
  * that a person must consent to analytics in order to use the product: false, and false about the one
@@ -95,50 +101,83 @@ export const OperatorLawfulBasisSchema = z.strictObject({
  * *"There is no declared surface for recording a service-wide consent requirement distinct from
  * analytics consent."* This is that surface.
  *
- * ## Why the floor may be NONE, and usually should be
+ * ## Why the required set may be empty, and usually should be
  *
  * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is
  * CONTRACT — a person uses the product because their employer signed for it, not because they
- * consented. A required level above `NONE` says the opposite, so declaring one is a claim about the
+ * consented. A non-empty required set says the opposite, so declaring one is a claim about the
  * lawful basis and not merely a UI gate.
  *
- * `NONE` is therefore both the default and the honest answer for most applications: *nothing is
- * gated on consent; the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*
+ * An EMPTY set is therefore the honest answer for most applications: *nothing is gated on consent;
+ * the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*
  * A field that pushed applications toward declaring consent would be worse than the gap it closes.
  *
- * ⚠️ Declaring a level here does NOT make consent the lawful basis for anything. It states a gate.
+ * ## This is the ENFORCED half of the identity (#453)
+ *
+ * Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is
+ * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is
+ * the exception. `wildo config service-consent` projects it into the running application's
+ * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in
+ * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,
+ * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the
+ * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),
+ * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push
+ * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an
+ * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they
+ * already started. Signing in, refreshing a session and signing out are not resource operations and stay
+ * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count
+ * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in
+ * place of every signed-in route. A reader of
+ * this schema must be able to tell the two apart without tracing the runtime, which is why it is said
+ * here.
+ *
+ * ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.
  * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer
  * needs to see rather than one the schema should quietly reconcile.
  */
 export const ServiceConsentRequirementSchema = z.strictObject({
     /**
-     * The minimum consent a person must give to use the service.
+     * The purposes a person must grant before they may use the service — a SET, never a level (#453).
      *
-     * `NONE` means nothing is gated on consent — the common and usually correct answer. It is a
-     * DECLARATION, not an absence: an application that says `NONE` has answered the question, which is
-     * what separates it from one that has not been asked.
+     * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a
+     * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is
+     * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.
+     *
+     * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that
+     * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.
      */
-    requiredLevel: z.enum(DataProcessingConsent),
+    requiredPurposes: z.array(z.enum(ConsentPurpose)),
     /**
      * What this gate actually controls, in the operator's own words.
      *
-     * REQUIRED whenever the level is above `NONE`, because a gate nobody can describe is a gate nobody
+     * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody
      * can honour — enforced below. A notice stating "consent is required" without saying what it
      * governs tells a person they must agree to something unnamed.
      */
     gatedProcessing: z.string().trim().min(1).optional(),
 }).superRefine((requirement, context) => {
     /*
-     * A required level above NONE with nothing described is the shape that satisfies the field and
-     * discloses nothing — the same defect as a revision recording no superseded rationale, and as a
+     * A required purpose with nothing described is the shape that satisfies the field and discloses
+     * nothing — the same defect as a revision recording no superseded rationale, and as a
      * legitimate-interests basis with no assessment. Each time, the value is the easy half and the
      * explanation is the half that makes it mean anything.
      */
-    if (requirement.requiredLevel !== DataProcessingConsent.NONE && requirement.gatedProcessing === undefined) {
+    if (requirement.requiredPurposes.length > 0 && requirement.gatedProcessing === undefined) {
         context.addIssue({
             code: 'custom',
             path: ['gatedProcessing'],
-            message: `a required consent level of ${requirement.requiredLevel} gates something — say what, or declare NONE. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,
+            message: `requiring consent to ${requirement.requiredPurposes.join(', ')} gates something — say what, or declare no required purposes. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,
+        });
+    }
+    /*
+     * A purpose listed twice is not a stronger requirement, and a set that reads differently from how it
+     * compares is how two surfaces come to describe one gate differently.
+     */
+    if (new Set(requirement.requiredPurposes).size !== requirement.requiredPurposes.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['requiredPurposes'],
+            message: 'a required purpose is listed more than once — a set names each purpose once',
         });
     }
 });
@@ -183,7 +222,7 @@ export const ServiceConsentRequirementSchema = z.strictObject({
  * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.
  *
  * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still
- * requires its assessment, and a consent level above `NONE` still requires what it gates. Those
+ * requires its assessment, and a non-empty required purpose set still requires what it gates. Those
  * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a
  * partial declaration is honest, a self-contradicting one is not.
  */
@@ -227,11 +266,22 @@ export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
     /**
      * What a person must consent to in order to use the service at all (issue #139).
      *
-     * OPTIONAL, and absent means UNANSWERED rather than `NONE`. The distinction is the one this whole
-     * lane turns on: a declared `NONE` is the operator saying nothing is gated on consent, while
+     * OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this
+     * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while
      * absence is nobody having been asked, and a notice must not render the second as the first.
      */
     serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),
+    /**
+     * How the operator confirms that a person exercising a data-subject right is that person, before acting.
+     *
+     * The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the
+     * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step
+     * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).
+     * Prose, because procedures differ — "requests from a signed-in account are verified by that session;
+     * requests by email are answered at the account's address". Absent means undecided, and the
+     * `rights-and-complaint-route` fact then answers nothing (#454).
+     */
+    subjectRequestIdentityVerification: z.string().trim().min(1).optional(),
 }).superRefine((identity, context) => {
     /*
      * A declaration with nothing in it is a no-op that reads as an answer.
@@ -262,7 +312,7 @@ export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
  * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are
  * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no
  * Art. 27 representative, and a declared absence of a consent gate is expressed by
- * `serviceConsentRequirement.requiredLevel = NONE`, which is a value rather than an omission. Listing
+ * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing
  * them would report every correct identity as incomplete.
  */
 export var OperatorComplianceIdentityPart;
@@ -272,6 +322,7 @@ export var OperatorComplianceIdentityPart;
     OperatorComplianceIdentityPart["PRIVACY_CONTACT"] = "privacyContact";
     OperatorComplianceIdentityPart["ROLE_ALLOCATIONS"] = "roleAllocations";
     OperatorComplianceIdentityPart["LAWFUL_BASES"] = "lawfulBases";
+    OperatorComplianceIdentityPart["SUBJECT_REQUEST_IDENTITY_VERIFICATION"] = "subjectRequestIdentityVerification";
 })(OperatorComplianceIdentityPart || (OperatorComplianceIdentityPart = {}));
 /**
  * Which parts of the identity are still owed, in declaration order.
@@ -288,6 +339,7 @@ export function outstandingOperatorComplianceIdentityParts(identity) {
         identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,
         identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,
         identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,
+        identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,
     ].filter((part) => part !== undefined);
 }
 /**