@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/compliance/privacy/personal-data-category.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}
+{"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}

package/dist/esm/compliance/privacy/personal-data-declaration.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}
+{"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts

@@ -4,6 +4,8 @@
  * Privacy-related schemas and enums for user data management
  */
 import { z } from "zod";
+import "@wildo-ai/zod-decorators";
+import { ConsentPurpose } from "./consent-purposes.shared";
 /**
  * Profile Visibility Enum
  *
@@ -20,18 +22,6 @@ export declare enum OrganizationProfileVisibility {
     APPLICATION_INTERNAL = "application_internal",// Visible within application, for connected users only
     PRIVATE = "private"
 }
-export declare enum DataProcessingConsent {
-    NONE = "none",
-    BASIC = "basic",
-    ANALYTICS = "analytics",
-    MARKETING = "marketing",
-    FULL = "full"
-}
-export declare enum PrivacyLevel {
-    MINIMAL = "minimal",// Minimum data collection
-    STANDARD = "standard",// Standard data collection
-    ENHANCED = "enhanced"
-}
 /**
  * Whether — and with what lifetime — this application identifies the CLIENT INSTALL
  * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).
@@ -98,18 +88,20 @@ export declare enum ClientInstanceIdScope {
      */
     PERSISTENT = "persistent"
 }
-/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */
 export declare const AnonymousUserPrivacySchema: z.ZodObject<{
-    dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
+    consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+    offeredPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+    consentDecidedAt: z.ZodOptional<z.ZodDate>;
 }, z.core.$strip>;
 export type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;
 export declare const InboundContactPrivacySchema: z.ZodObject<{
-    dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
+    consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+    consentDecidedAt: z.ZodOptional<z.ZodDate>;
 }, z.core.$strip>;
 export type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;
 export declare const UserPrivacySchema: z.ZodObject<{
-    dataProcessingConsent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>>;
-    privacyLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof PrivacyLevel>>>;
+    consentedPurposes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>>;
+    consentDecidedAt: z.ZodOptional<z.ZodDate>;
 }, z.core.$strip>;
 export type UserPrivacy = z.infer<typeof UserPrivacySchema>;
 //# sourceMappingURL=privacy.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY,CAAE,0BAA0B;IAC/C,QAAQ,aAAa,CAAE,2BAA2B;IAClD,QAAQ,aAAa;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AACD,0EAA0E;AAE1E,eAAO,MAAM,0BAA0B;;iBAKrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;iBAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAuB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AAoED,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.js

@@ -4,6 +4,10 @@
  * Privacy-related schemas and enums for user data management
  */
 import { z } from "zod";
+// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —
+// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.
+import "@wildo-ai/zod-decorators";
+import { ConsentPurpose } from "./consent-purposes.shared.js";
 /**
  * Profile Visibility Enum
  *
@@ -22,20 +26,6 @@ export var OrganizationProfileVisibility;
     OrganizationProfileVisibility["APPLICATION_INTERNAL"] = "application_internal";
     OrganizationProfileVisibility["PRIVATE"] = "private";
 })(OrganizationProfileVisibility || (OrganizationProfileVisibility = {}));
-export var DataProcessingConsent;
-(function (DataProcessingConsent) {
-    DataProcessingConsent["NONE"] = "none";
-    DataProcessingConsent["BASIC"] = "basic";
-    DataProcessingConsent["ANALYTICS"] = "analytics";
-    DataProcessingConsent["MARKETING"] = "marketing";
-    DataProcessingConsent["FULL"] = "full";
-})(DataProcessingConsent || (DataProcessingConsent = {}));
-export var PrivacyLevel;
-(function (PrivacyLevel) {
-    PrivacyLevel["MINIMAL"] = "minimal";
-    PrivacyLevel["STANDARD"] = "standard";
-    PrivacyLevel["ENHANCED"] = "enhanced";
-})(PrivacyLevel || (PrivacyLevel = {}));
 /**
  * Whether — and with what lifetime — this application identifies the CLIENT INSTALL
  * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).
@@ -104,34 +94,87 @@ export var ClientInstanceIdScope;
     ClientInstanceIdScope["PERSISTENT"] = "persistent";
 })(ClientInstanceIdScope || (ClientInstanceIdScope = {}));
 /** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */
+/**
+ * The purposes a person has granted, and whether they have decided at all — the two facts every
+ * consent surface reads (#534).
+ *
+ * `consentedPurposes` defaults to the EMPTY set, and that default is the point. It used to be
+ * `.default(DataProcessingConsent.BASIC)`: every record asserted a consent its subject never gave.
+ * The empty set asserts nothing.
+ *
+ * `consentDecidedAt` is what separates "declined everything" from "was never asked" — the two are the
+ * same empty set and must not be the same fact. Absent means undecided, so a consent surface asks; set
+ * means the person made an affirmative choice at that instant, whatever they chose.
+ */
+/*
+ * `.systemEnum('ConsentPurpose')` names the ONE vocabulary a purpose is worded by, everywhere it is stored —
+ * a person's preferences, an anonymous visitor, a lead — and on the application consent gate that asks for
+ * it. A purpose is a legal statement to the person deciding, so it gets one wording, authored once under
+ * `system_enums.ConsentPurpose.<value>`; the labelling planner plans it there and the frontend reads it
+ * there, both because this field declares it (#966).
+ */
+const consentedPurposesField = (subject) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])
+    .describe(`The optional purposes ${subject} has granted, each independently. A set, not a level: granting one purpose implies nothing about another. Empty means nothing optional was granted.`);
+const consentDecidedAtField = (subject) => z.date().optional()
+    .describe(`When ${subject} last made an affirmative consent choice. Absent means no choice was ever made, which is different from choosing to grant nothing.`);
+/**
+ * The purposes a surface actually PUT IN FRONT of the person when they decided.
+ *
+ * ## Why a decision is not describable by its grants alone
+ *
+ * A grant set says what was agreed to. It cannot say what was ASKED, and the two differ by surface:
+ * a website panel offers `purposesInUse`, derived from that site's own live providers, while the
+ * application's gate offers `optionalPurposes`, derived from that application's configuration. A
+ * marketing site running analytics and an application that also does marketing legitimately ask
+ * different questions.
+ *
+ * Without this field, carrying a visitor's decision to their new account records
+ * `consentDecidedAt` — which every consent surface reads as *"this person was asked and answered"* —
+ * for purposes they were never shown. The application then stops prompting, and a purpose nobody
+ * displayed is stored as declined. The existing surfaces already avoid this internally (*"Purposes
+ * the panel does not offer keep their stored grant"*); only the CARRY crossed a surface boundary, and
+ * it needed to know where the boundary was.
+ *
+ * So a decision is `(granted ⊆ offered, at an instant)`, and the carry adopts grants for offered
+ * purposes while leaving an unoffered one genuinely undecided.
+ *
+ * ## Why only the anonymous holder declares it
+ *
+ * It is the only holder whose decision is taken on one surface and read on another. A member's
+ * preferences are written and read by the same application, and a lead's opt-in is never carried
+ * anywhere — adding the field there would be a second thing to keep true with no reader.
+ *
+ * Defaults to the EMPTY set, which is the honest value for every row written before this existed and
+ * for a session that has been initialized but never asked: an empty offered set means no question was
+ * put, so a carry from it carries nothing, which is the same outcome those rows have today.
+ */
+const offeredPurposesField = (subject) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])
+    .describe(`The optional purposes actually shown to ${subject} by the surface they decided on. What is NOT here was never asked, and must not be read as declined.`);
 export const AnonymousUserPrivacySchema = z.object({
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)
-        .describe('The processing this anonymous visitor has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.'),
+    consentedPurposes: consentedPurposesField('this anonymous visitor'),
+    offeredPurposes: offeredPurposesField('this anonymous visitor'),
+    consentDecidedAt: consentDecidedAtField('this anonymous visitor'),
 });
 export const InboundContactPrivacySchema = z.object({
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)
-        .describe('The processing this lead has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.'),
+    consentedPurposes: consentedPurposesField('this lead'),
+    consentDecidedAt: consentDecidedAtField('this lead'),
 });
 export const UserPrivacySchema = z.object({
-    // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.
+    // `.isAuditEvidence()` on the granted purposes, and deliberately NOT on the block that contains them.
     //
-    // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the
-    // collection scope — held as closed vocabularies, so recording their before/after values on
-    // `resource_operation_performed` is exactly the "mark what decides authority, never what
-    // identifies a person" rule that governs the same decorator on `UserSchema`.
+    // The granted set is the subject's own privacy DECISION held as a closed vocabulary, so recording its
+    // before/after values on `resource_operation_performed` is exactly the "mark what decides authority,
+    // never what identifies a person" rule that governs the same decorator on `UserSchema`.
     //
     // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document
     // interactions are separate immutable release-bound records and are never embedded in preferences.
     //
     // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant
-    // decision and must leave a trail naming the previous and resulting value. Reached today by the
-    // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the
-    // same emission point, so no verb can change consent without a record.
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)
-        .describe('The processing this person has agreed to. It is the subject\'s own decision and only they (or an administrator acting for them) change it. The application decides what each level permits — the framework stores the decision and records every change, it does not attach a fixed meaning to the levels.')
-        .isAuditEvidence(),
-    privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD)
-        .describe('How much this person has agreed the application may collect about them, alongside the processing consent. The application decides what each level permits.')
+    // decision and must leave a trail naming the previous and resulting set. Reached by the consent
+    // gate and prompt, the self-service preferences RESET and self/admin UPDATE. UPDATE explicitly opts
+    // into audit emission below the risk floor; only marked decision leaves enter the evidence.
+    consentedPurposes: consentedPurposesField('this person')
         .isAuditEvidence(),
+    consentDecidedAt: consentDecidedAtField('this person'),
 });
 //# sourceMappingURL=privacy.shared.schemas.js.map

package/dist/esm/compliance/privacy/privacy.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,wCAAe,CAAA;IACf,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,sCAAa,CAAA;AACf,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,6LAA6L,CAC9L;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,gLAAgL,CACjL;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,2FAA2F;IAC3F,EAAE;IACF,yFAAyF;IACzF,4FAA4F;IAC5F,yFAAyF;IACzF,6EAA6E;IAC7E,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,4SAA4S,CAC7S;SACA,eAAe,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;SAC9D,QAAQ,CAAC,4JAA4J,CAAC;SACtK,eAAe,EAAE;CACrB,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum DataProcessingConsent {\n  NONE = \"none\",\n  BASIC = \"basic\",\n  ANALYTICS = \"analytics\",\n  MARKETING = \"marketing\",\n  FULL = \"full\",\n}\n\nexport enum PrivacyLevel {\n  MINIMAL = \"minimal\", // Minimum data collection\n  STANDARD = \"standard\", // Standard data collection\n  ENHANCED = \"enhanced\", // Enhanced features with more data\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\n/**\n * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n *\n * Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n *\n * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n *\n * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\nexport const AnonymousUserPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n    .describe(\n      'The processing this anonymous visitor has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n    ),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n    .describe(\n      'The processing this lead has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n    ),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.\n  //\n  // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the\n  // collection scope — held as closed vocabularies, so recording their before/after values on\n  // `resource_operation_performed` is exactly the \"mark what decides authority, never what\n  // identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting value. Reached today by the\n  // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the\n  // same emission point, so no verb can change consent without a record.\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n    .describe(\n      'The processing this person has agreed to. It is the subject\\'s own decision and only they (or an administrator acting for them) change it. The application decides what each level permits — the framework stores the decision and records every change, it does not attach a fixed meaning to the levels.',\n    )\n    .isAuditEvidence(),\n  privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD)\n    .describe('How much this person has agreed the application may collect about them, alongside the processing consent. The application decides what each level permits.')\n    .isAuditEvidence(),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}
+{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACzH,QAAQ,CACP,yBAAyB,OAAO,qJAAqJ,CACtL,CAAC;AAEJ,MAAM,qBAAqB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACnE,QAAQ,CACP,QAAQ,OAAO,oIAAoI,CACpJ,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACvH,QAAQ,CACP,2CAA2C,OAAO,sGAAsG,CACzJ,CAAC;AAEJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,iBAAiB,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;IACnE,eAAe,EAAE,oBAAoB,CAAC,wBAAwB,CAAC;IAC/D,gBAAgB,EAAE,qBAAqB,CAAC,wBAAwB,CAAC;CAClE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,iBAAiB,EAAE,sBAAsB,CAAC,WAAW,CAAC;IACtD,gBAAgB,EAAE,qBAAqB,CAAC,WAAW,CAAC;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,sGAAsG;IACtG,EAAE;IACF,sGAAsG;IACtG,qGAAqG;IACrG,wFAAwF;IACxF,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,oGAAoG;IACpG,4FAA4F;IAC5F,iBAAiB,EAAE,sBAAsB,CAAC,aAAa,CAAC;SACrD,eAAe,EAAE;IACpB,gBAAgB,EAAE,qBAAqB,CAAC,aAAa,CAAC;CACvD,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport \"@wildo-ai/zod-decorators\";\n\nimport { ConsentPurpose } from \"./consent-purposes.shared\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\n/**\n * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n *\n * Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n *\n * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n *\n * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\n/**\n * The purposes a person has granted, and whether they have decided at all — the two facts every\n * consent surface reads (#534).\n *\n * `consentedPurposes` defaults to the EMPTY set, and that default is the point. It used to be\n * `.default(DataProcessingConsent.BASIC)`: every record asserted a consent its subject never gave.\n * The empty set asserts nothing.\n *\n * `consentDecidedAt` is what separates \"declined everything\" from \"was never asked\" — the two are the\n * same empty set and must not be the same fact. Absent means undecided, so a consent surface asks; set\n * means the person made an affirmative choice at that instant, whatever they chose.\n */\n/*\n * `.systemEnum('ConsentPurpose')` names the ONE vocabulary a purpose is worded by, everywhere it is stored —\n * a person's preferences, an anonymous visitor, a lead — and on the application consent gate that asks for\n * it. A purpose is a legal statement to the person deciding, so it gets one wording, authored once under\n * `system_enums.ConsentPurpose.<value>`; the labelling planner plans it there and the frontend reads it\n * there, both because this field declares it (#966).\n */\nconst consentedPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes ${subject} has granted, each independently. A set, not a level: granting one purpose implies nothing about another. Empty means nothing optional was granted.`,\n  );\n\nconst consentDecidedAtField = (subject: string) => z.date().optional()\n  .describe(\n    `When ${subject} last made an affirmative consent choice. Absent means no choice was ever made, which is different from choosing to grant nothing.`,\n  );\n\n/**\n * The purposes a surface actually PUT IN FRONT of the person when they decided.\n *\n * ## Why a decision is not describable by its grants alone\n *\n * A grant set says what was agreed to. It cannot say what was ASKED, and the two differ by surface:\n * a website panel offers `purposesInUse`, derived from that site's own live providers, while the\n * application's gate offers `optionalPurposes`, derived from that application's configuration. A\n * marketing site running analytics and an application that also does marketing legitimately ask\n * different questions.\n *\n * Without this field, carrying a visitor's decision to their new account records\n * `consentDecidedAt` — which every consent surface reads as *\"this person was asked and answered\"* —\n * for purposes they were never shown. The application then stops prompting, and a purpose nobody\n * displayed is stored as declined. The existing surfaces already avoid this internally (*\"Purposes\n * the panel does not offer keep their stored grant\"*); only the CARRY crossed a surface boundary, and\n * it needed to know where the boundary was.\n *\n * So a decision is `(granted ⊆ offered, at an instant)`, and the carry adopts grants for offered\n * purposes while leaving an unoffered one genuinely undecided.\n *\n * ## Why only the anonymous holder declares it\n *\n * It is the only holder whose decision is taken on one surface and read on another. A member's\n * preferences are written and read by the same application, and a lead's opt-in is never carried\n * anywhere — adding the field there would be a second thing to keep true with no reader.\n *\n * Defaults to the EMPTY set, which is the honest value for every row written before this existed and\n * for a session that has been initialized but never asked: an empty offered set means no question was\n * put, so a carry from it carries nothing, which is the same outcome those rows have today.\n */\nconst offeredPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes actually shown to ${subject} by the surface they decided on. What is NOT here was never asked, and must not be read as declined.`,\n  );\n\nexport const AnonymousUserPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this anonymous visitor'),\n  offeredPurposes: offeredPurposesField('this anonymous visitor'),\n  consentDecidedAt: consentDecidedAtField('this anonymous visitor'),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this lead'),\n  consentDecidedAt: consentDecidedAtField('this lead'),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on the granted purposes, and deliberately NOT on the block that contains them.\n  //\n  // The granted set is the subject's own privacy DECISION held as a closed vocabulary, so recording its\n  // before/after values on `resource_operation_performed` is exactly the \"mark what decides authority,\n  // never what identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting set. Reached by the consent\n  // gate and prompt, the self-service preferences RESET and self/admin UPDATE. UPDATE explicitly opts\n  // into audit emission below the risk floor; only marked decision leaves enter the evidence.\n  consentedPurposes: consentedPurposesField('this person')\n    .isAuditEvidence(),\n  consentDecidedAt: consentDecidedAtField('this person'),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/redaction.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n * MAINTAINER NOTE — not part of the anchored, application-facing block below.\n *\n * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n *\n * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n */\n\n/**\n * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n *\n * How one field's value is replaced when it is redacted or scrubbed.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Two consumers, and only one of them accepts every member\n *\n * | consumer | what it does | accepts |\n * |---|---|---|\n * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |\n * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |\n *\n * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n *\n * ## Choosing a treatment for an erasure scrub\n *\n * | the field | treatment |\n * |---|---|\n * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |\n * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |\n * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |\n * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |\n *\n * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n *\n * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n *\n * ## The never-scrub floor\n *\n * A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n *\n * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n *\n * @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n *\n * const contactSchema = z.object({\n *   // nullable → REMOVE\n *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n *   // constrained string → MASK with a value the field's own schema accepts\n *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n *   // non-nullable with a default → RESET\n *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n *     .impersonalizeWith(RedactionType.RESET),\n *   // no treatment → survives the erasure, deliberately\n *   invoicedAmount: z.number(),\n * });\n * ```\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */\n  MASK = 'mask',\n  /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */\n  ENCRYPT = 'encrypt',\n  /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */\n  KEEP = 'keep',\n  /**\n   * Erasure scrub only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n   * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n   * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n   * and objects.\n   *\n   * The value is read from the schema rather than authored a second time, so it cannot drift from\n   * the default the field already declares — and for a person's counters and settings, \"what this is\n   * when nobody has set it\" is exactly what an erasure should leave behind.\n   *\n   * Refused when the field declares no `.default()`, and refused when that default reads the clock.\n   */\n  RESET = 'reset',\n}\n/** @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}
+{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n * MAINTAINER NOTE — not part of the anchored, application-facing block below.\n *\n * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n *\n * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n */\n\n/**\n * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n *\n * How one field's value is replaced when it is redacted or scrubbed.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Two consumers, and only one of them accepts every member\n *\n * | consumer | what it does | accepts |\n * |---|---|---|\n * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |\n * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |\n *\n * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n *\n * ## Choosing a treatment for an erasure scrub\n *\n * | the field | treatment |\n * |---|---|\n * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |\n * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |\n * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |\n * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |\n *\n * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n *\n * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n *\n * ## The never-scrub floor\n *\n * A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n *\n * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n *\n * @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n *\n * const contactSchema = z.object({\n *   // nullable → REMOVE\n *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n *   // constrained string → MASK with a value the field's own schema accepts\n *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n *   // non-nullable with a default → RESET\n *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n *     .impersonalizeWith(RedactionType.RESET),\n *   // no treatment → survives the erasure, deliberately\n *   invoicedAmount: z.number(),\n * });\n * ```\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */\n  MASK = 'mask',\n  /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */\n  ENCRYPT = 'encrypt',\n  /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */\n  KEEP = 'keep',\n  /**\n   * Erasure scrub only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n   * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n   * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n   * and objects.\n   *\n   * The value is read from the schema rather than authored a second time, so it cannot drift from\n   * the default the field already declares — and for a person's counters and settings, \"what this is\n   * when nobody has set it\" is exactly what an erasure should leave behind.\n   *\n   * Refused when the field declares no `.default()`, and refused when that default reads the clock.\n   */\n  RESET = 'reset',\n}\n/** @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}
+{"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.d.ts

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+/**
+ * # The subject-erasure lane, summarized for an evidence reader
+ *
+ * assurance-control: WILDO.PRIVACY.SUBJECT_ERASURE — the request lane's intake, withdrawal and
+ * execution are answerable without reading any subject's row.
+ *
+ * ## Why this shape, and not the rows
+ *
+ * `evidence-requirement:subject-erasure-execution-record` asks three things of an application that
+ * owns an erasure lane: that a request is recorded on intake carrying WHO raised it, that a pending
+ * request can be withdrawn by its subject, and that it is executed on the declared schedule with an
+ * outcome. Every one of those is a statement about the lane, and none of them needs an identity.
+ *
+ * So the answer is a count, computed where the rows live. Handing an evidence reader the rows in
+ * order to count them would disclose every data subject who has ever asked to be erased — to prove
+ * that erasure works, which is the exact inversion this surface exists to avoid.
+ *
+ * ## Read the zeroes carefully, which is why `laneDeclared` is separate
+ *
+ * A lane with no activity and an application with no lane produce the same zeroes in a row store,
+ * and the requirement's own limits say so. `laneDeclared: false` is therefore a distinct answer
+ * carrying no counts at all — a judge records `not_applicable_as_configured` from it rather than a
+ * nonconformity — while `laneDeclared: true` with zero requests says the lane exists and was quiet.
+ */
+export declare const SubjectErasureLaneEvidenceSchema: z.ZodObject<{
+    laneDeclared: z.ZodBoolean;
+    resourceType: z.ZodNullable<z.ZodString>;
+    window: z.ZodObject<{
+        from: z.ZodISODateTime;
+        to: z.ZodISODateTime;
+    }, z.core.$strip>;
+    raisedBySubject: z.ZodNumber;
+    raisedByController: z.ZodNumber;
+    controllerRaisedWithRequester: z.ZodNumber;
+    controllerRaisedWithJustification: z.ZodNumber;
+    terminal: z.ZodNumber;
+    terminalWithOutcome: z.ZodNumber;
+    notTerminal: z.ZodNumber;
+    withdrawn: z.ZodNullable<z.ZodNumber>;
+    withdrawalOperationIdentifier: z.ZodNullable<z.ZodString>;
+    withdrawalReachableToSubject: z.ZodBoolean;
+    executionOperationIdentifier: z.ZodNullable<z.ZodString>;
+    executionSchedule: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type SubjectErasureLaneEvidence = z.infer<typeof SubjectErasureLaneEvidenceSchema>;
+//# sourceMappingURL=subject-erasure-lane-evidence.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-erasure-lane-evidence.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;iBAuE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.js

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+/**
+ * # The subject-erasure lane, summarized for an evidence reader
+ *
+ * assurance-control: WILDO.PRIVACY.SUBJECT_ERASURE — the request lane's intake, withdrawal and
+ * execution are answerable without reading any subject's row.
+ *
+ * ## Why this shape, and not the rows
+ *
+ * `evidence-requirement:subject-erasure-execution-record` asks three things of an application that
+ * owns an erasure lane: that a request is recorded on intake carrying WHO raised it, that a pending
+ * request can be withdrawn by its subject, and that it is executed on the declared schedule with an
+ * outcome. Every one of those is a statement about the lane, and none of them needs an identity.
+ *
+ * So the answer is a count, computed where the rows live. Handing an evidence reader the rows in
+ * order to count them would disclose every data subject who has ever asked to be erased — to prove
+ * that erasure works, which is the exact inversion this surface exists to avoid.
+ *
+ * ## Read the zeroes carefully, which is why `laneDeclared` is separate
+ *
+ * A lane with no activity and an application with no lane produce the same zeroes in a row store,
+ * and the requirement's own limits say so. `laneDeclared: false` is therefore a distinct answer
+ * carrying no counts at all — a judge records `not_applicable_as_configured` from it rather than a
+ * nonconformity — while `laneDeclared: true` with zero requests says the lane exists and was quiet.
+ */
+export const SubjectErasureLaneEvidenceSchema = z.object({
+    /**
+     * Does any resource in this application declare a `subjectErasureLane`?
+     *
+     * FALSE is an answer, not an absence: an application that never built an erasure lane has failed
+     * no control, and every count below is omitted rather than reported as zero.
+     */
+    laneDeclared: z.boolean(),
+    /** The resource whose rows were counted, present only when a lane is declared. */
+    resourceType: z.string().nullable(),
+    /** The closed window the counts cover, as the caller asked for it. */
+    window: z.object({ from: z.iso.datetime(), to: z.iso.datetime() }),
+    /**
+     * Requests created in the window, split by WHO raised them.
+     *
+     * The split is read through the lane's own declaration — the field it named and the value it
+     * declared as meaning "the subject themselves" — so an application that models the distinction as
+     * a channel enum, a boolean or anything else is counted correctly without this schema asserting
+     * its vocabulary.
+     */
+    raisedBySubject: z.number().int().nonnegative(),
+    raisedByController: z.number().int().nonnegative(),
+    /**
+     * Controller-raised requests that DO carry the requester and the justification the clause asks for.
+     *
+     * Counted, never derived by subtracting from {@link raisedByController}. A difference would assume
+     * containment, and the clause's severity guidance turns exactly that mismatch into an OBSERVATION a
+     * judge is meant to see — so both halves are reported and the comparison is left to the reader.
+     */
+    controllerRaisedWithRequester: z.number().int().nonnegative(),
+    controllerRaisedWithJustification: z.number().int().nonnegative(),
+    /**
+     * Requests carrying the lane's terminal instant, and how many of those also carry an outcome.
+     *
+     * Two measured numbers for the same reason as above: a terminal request whose record of what
+     * happened is empty is the clause's other OBSERVATION case, and it is visible here only because
+     * neither number is derived from the other.
+     */
+    terminal: z.number().int().nonnegative(),
+    terminalWithOutcome: z.number().int().nonnegative(),
+    /**
+     * Requests in the window carrying no terminal instant — still pending, or withdrawn.
+     *
+     * A difference against the counted population rather than a status read, because the statuses are
+     * the application's and this contract must not assert them. {@link withdrawn} is what separates the
+     * two, when the lane declares how.
+     */
+    notTerminal: z.number().int().nonnegative(),
+    /**
+     * Withdrawn requests, and whether the withdrawal door is reachable to a subject at all.
+     *
+     * An EMPTY withdrawal set is explicitly not a deficiency — nobody may have changed their mind — so
+     * the evidence that matters is `withdrawalReachableToSubject`, derived from the declared
+     * withdrawal operation's own variant rather than from whether anyone used it.
+     *
+     * `withdrawn` is NULL, never zero, when the lane declares no `withdrawnMarker`: an application may
+     * not model withdrawal as a value at all, and a zero there would read as "nobody withdrew anything"
+     * when the truth is that nobody can tell.
+     */
+    withdrawn: z.number().int().nonnegative().nullable(),
+    withdrawalOperationIdentifier: z.string().nullable(),
+    withdrawalReachableToSubject: z.boolean(),
+    /**
+     * The schedule that drives execution, read from the declared execution operation.
+     *
+     * The clause asks for execution "on the declared schedule", and an outcome alone cannot be judged
+     * against a schedule nobody stated. `null` means the declared operation carries no cadence, which
+     * is itself the finding.
+     */
+    executionOperationIdentifier: z.string().nullable(),
+    executionSchedule: z.string().nullable(),
+});
+//# sourceMappingURL=subject-erasure-lane-evidence.shared.schemas.js.map

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-erasure-lane-evidence.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,sEAAsE;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD;;;;;;OAMG;IACH,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7D,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjE;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnD;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C;;;;;;;;;;OAUG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpD,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE;IACzC;;;;;;OAMG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * # The subject-erasure lane, summarized for an evidence reader\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_ERASURE — the request lane's intake, withdrawal and\n * execution are answerable without reading any subject's row.\n *\n * ## Why this shape, and not the rows\n *\n * `evidence-requirement:subject-erasure-execution-record` asks three things of an application that\n * owns an erasure lane: that a request is recorded on intake carrying WHO raised it, that a pending\n * request can be withdrawn by its subject, and that it is executed on the declared schedule with an\n * outcome. Every one of those is a statement about the lane, and none of them needs an identity.\n *\n * So the answer is a count, computed where the rows live. Handing an evidence reader the rows in\n * order to count them would disclose every data subject who has ever asked to be erased — to prove\n * that erasure works, which is the exact inversion this surface exists to avoid.\n *\n * ## Read the zeroes carefully, which is why `laneDeclared` is separate\n *\n * A lane with no activity and an application with no lane produce the same zeroes in a row store,\n * and the requirement's own limits say so. `laneDeclared: false` is therefore a distinct answer\n * carrying no counts at all — a judge records `not_applicable_as_configured` from it rather than a\n * nonconformity — while `laneDeclared: true` with zero requests says the lane exists and was quiet.\n */\nexport const SubjectErasureLaneEvidenceSchema = z.object({\n  /**\n   * Does any resource in this application declare a `subjectErasureLane`?\n   *\n   * FALSE is an answer, not an absence: an application that never built an erasure lane has failed\n   * no control, and every count below is omitted rather than reported as zero.\n   */\n  laneDeclared: z.boolean(),\n  /** The resource whose rows were counted, present only when a lane is declared. */\n  resourceType: z.string().nullable(),\n  /** The closed window the counts cover, as the caller asked for it. */\n  window: z.object({ from: z.iso.datetime(), to: z.iso.datetime() }),\n  /**\n   * Requests created in the window, split by WHO raised them.\n   *\n   * The split is read through the lane's own declaration — the field it named and the value it\n   * declared as meaning \"the subject themselves\" — so an application that models the distinction as\n   * a channel enum, a boolean or anything else is counted correctly without this schema asserting\n   * its vocabulary.\n   */\n  raisedBySubject: z.number().int().nonnegative(),\n  raisedByController: z.number().int().nonnegative(),\n  /**\n   * Controller-raised requests that DO carry the requester and the justification the clause asks for.\n   *\n   * Counted, never derived by subtracting from {@link raisedByController}. A difference would assume\n   * containment, and the clause's severity guidance turns exactly that mismatch into an OBSERVATION a\n   * judge is meant to see — so both halves are reported and the comparison is left to the reader.\n   */\n  controllerRaisedWithRequester: z.number().int().nonnegative(),\n  controllerRaisedWithJustification: z.number().int().nonnegative(),\n  /**\n   * Requests carrying the lane's terminal instant, and how many of those also carry an outcome.\n   *\n   * Two measured numbers for the same reason as above: a terminal request whose record of what\n   * happened is empty is the clause's other OBSERVATION case, and it is visible here only because\n   * neither number is derived from the other.\n   */\n  terminal: z.number().int().nonnegative(),\n  terminalWithOutcome: z.number().int().nonnegative(),\n  /**\n   * Requests in the window carrying no terminal instant — still pending, or withdrawn.\n   *\n   * A difference against the counted population rather than a status read, because the statuses are\n   * the application's and this contract must not assert them. {@link withdrawn} is what separates the\n   * two, when the lane declares how.\n   */\n  notTerminal: z.number().int().nonnegative(),\n  /**\n   * Withdrawn requests, and whether the withdrawal door is reachable to a subject at all.\n   *\n   * An EMPTY withdrawal set is explicitly not a deficiency — nobody may have changed their mind — so\n   * the evidence that matters is `withdrawalReachableToSubject`, derived from the declared\n   * withdrawal operation's own variant rather than from whether anyone used it.\n   *\n   * `withdrawn` is NULL, never zero, when the lane declares no `withdrawnMarker`: an application may\n   * not model withdrawal as a value at all, and a zero there would read as \"nobody withdrew anything\"\n   * when the truth is that nobody can tell.\n   */\n  withdrawn: z.number().int().nonnegative().nullable(),\n  withdrawalOperationIdentifier: z.string().nullable(),\n  withdrawalReachableToSubject: z.boolean(),\n  /**\n   * The schedule that drives execution, read from the declared execution operation.\n   *\n   * The clause asks for execution \"on the declared schedule\", and an outcome alone cannot be judged\n   * against a schedule nobody stated. `null` means the declared operation carries no cadence, which\n   * is itself the finding.\n   */\n  executionOperationIdentifier: z.string().nullable(),\n  executionSchedule: z.string().nullable(),\n});\n\nexport type SubjectErasureLaneEvidence = z.infer<typeof SubjectErasureLaneEvidenceSchema>;\n"]}