@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/config/app-configuration-shared.shared.schemas.d.ts

@@ -11,8 +11,12 @@
  */
 import { AvailableLanguage } from '@wildo-ai/presets-components-models';
 import { z } from 'zod';
+import '@wildo-ai/zod-decorators';
 import { AllSharedApplicationTypes } from '../applications/applications.shared.schemas';
-import { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';
+import { ClientInstanceIdScope, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';
+import { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';
+import { GovernedDocumentApprovalGate } from '../compliance/documents/governed-document-interactions.shared.schemas';
+import { GovernedDocumentAcceptanceMode } from '../compliance/documents/governed-documents.shared.schemas';
 import { AuthMethod } from '../security/authentications/authentication.shared.schemas';
 import { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';
 /**
@@ -48,6 +52,13 @@ export declare const PasswordPolicyViolationCode: {
     readonly LOWERCASE: "policyLowercase";
     readonly NUMBER: "policyNumber";
     readonly SPECIAL_CHAR: "policySpecialChar";
+    /**
+     * The password is a known common guess, the application's own name, or the user's own email local
+     * part. The check that NIST SP 800-63B-4 §3.1.1.2 asks for in place of the composition rules above
+     * — which the same section forbids, and which is why `UPPERCASE`, `LOWERCASE`, `NUMBER` and
+     * `SPECIAL_CHAR` now default to unenforced while this one always runs.
+     */
+    readonly BLOCKLISTED: "policyBlocklisted";
 };
 export type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];
 /**
@@ -79,6 +90,100 @@ export declare const AppConfiguration_Shared_ComplianceSchema: z.ZodObject<{
     userProfileVisibility: z.ZodDefault<z.ZodEnum<typeof UserProfileVisibility>>;
     organizationProfileVisibility: z.ZodDefault<z.ZodEnum<typeof OrganizationProfileVisibility>>;
     clientInstanceIdScope: z.ZodDefault<z.ZodEnum<typeof ClientInstanceIdScope>>;
+    governedDocumentReleases: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        identity: z.ZodObject<{
+            document: z.ZodObject<{
+                documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                documentVersion: z.ZodNumber;
+            }, z.core.$strict>;
+            releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            releaseVersion: z.ZodNumber;
+        }, z.core.$strict>;
+        documentClass: z.ZodEnum<typeof import("..").GovernedDocumentClass>;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof import("..").GovernedDocumentInteractionKind>>;
+        approvalState: z.ZodEnum<typeof import("..").GovernedDocumentReleaseApprovalState>;
+        effectiveAt: z.ZodISODateTime;
+        expiresAt: z.ZodOptional<z.ZodISODateTime>;
+        renewedInteractionKinds: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").GovernedDocumentInteractionKind>>>;
+    }, z.core.$strict>>>;
+    publicDocuments: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        kind: z.ZodLiteral<import("..").GovernedDocumentPublicDocumentKind.RELEASED>;
+        release: z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            identity: z.ZodObject<{
+                document: z.ZodObject<{
+                    documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    documentVersion: z.ZodNumber;
+                }, z.core.$strict>;
+                releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                releaseVersion: z.ZodNumber;
+            }, z.core.$strict>;
+            definition: z.ZodObject<{
+                definitionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                definitionVersion: z.ZodNumber;
+            }, z.core.$strict>;
+            documentClass: z.ZodEnum<typeof import("..").GovernedDocumentClass>;
+            locale: z.ZodString;
+            jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+            contentMediaType: z.ZodLiteral<"application/vnd.wildo.governed-document.public+json;version=1">;
+            issuedAt: z.ZodISODateTime;
+            effectiveAt: z.ZodISODateTime;
+            expiresAt: z.ZodOptional<z.ZodISODateTime>;
+            allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof import("..").GovernedDocumentInteractionKind>>;
+        }, z.core.$strict>;
+        content: z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            title: z.ZodString;
+            locale: z.ZodString;
+            jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+            sections: z.ZodArray<z.ZodObject<{
+                sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                order: z.ZodNumber;
+                title: z.ZodString;
+                clauses: z.ZodArray<z.ZodObject<{
+                    clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    order: z.ZodNumber;
+                    bodyMarkdown: z.ZodString;
+                    standing: z.ZodEnum<typeof import("..").GovernedDocumentPublicClauseStanding>;
+                    missingInformation: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        approvalState: z.ZodEnum<typeof import("..").GovernedDocumentReleaseApprovalState>;
+    }, z.core.$strict>, z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        kind: z.ZodLiteral<import("..").GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT>;
+        documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+        content: z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            title: z.ZodString;
+            locale: z.ZodString;
+            jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+            sections: z.ZodArray<z.ZodObject<{
+                sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                order: z.ZodNumber;
+                title: z.ZodString;
+                clauses: z.ZodArray<z.ZodObject<{
+                    clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    order: z.ZodNumber;
+                    bodyMarkdown: z.ZodString;
+                    standing: z.ZodEnum<typeof import("..").GovernedDocumentPublicClauseStanding>;
+                    missingInformation: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "kind">>>;
+    governedDocumentAcceptanceMode: z.ZodDefault<z.ZodEnum<typeof GovernedDocumentAcceptanceMode>>;
+    governedDocumentApprovalGate: z.ZodDefault<z.ZodEnum<typeof GovernedDocumentApprovalGate>>;
+    serviceConsentRequirement: z.ZodOptional<z.ZodObject<{
+        requiredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+        gatedProcessing: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    capabilityDeclaredConsentPurposes: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>>;
 }, z.core.$strip>;
 export declare const AppConfiguration_Shared_AppIdentity_Schema: z.ZodObject<{
     appName: z.ZodString;
@@ -132,7 +237,7 @@ export declare const AnalyticsConfigSchema: z.ZodObject<{
         providerType: z.ZodEnum<typeof AnalyticsProviderType>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strip>>>;
-    requiredConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
+    requiresConsent: z.ZodDefault<z.ZodBoolean>;
     valueMoments: z.ZodOptional<z.ZodArray<z.ZodObject<{
         identifier: z.ZodString;
         role: z.ZodEnum<typeof import("./analytics-value-moments.shared.schemas").ValueMomentRole>;
@@ -200,11 +305,11 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
         applicationId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     brandAssets: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        composition: z.ZodEnum<typeof import("./brand-assets.shared.schemas").BrandAssetComposition>;
-        theme: z.ZodEnum<typeof import("./brand-assets.shared.schemas").BrandAssetTheme>;
-        purpose: z.ZodEnum<typeof import("./brand-assets.shared.schemas").BrandAssetPurpose>;
+        composition: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./brand-assets.shared.schemas").BrandAssetComposition>>;
+        theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./brand-assets.shared.schemas").BrandAssetTheme>>;
+        purpose: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./brand-assets.shared.schemas").BrandAssetPurpose>>;
         url: z.ZodString;
-        format: z.ZodEnum<typeof import("./brand-assets.shared.schemas").BrandAssetFormat>;
+        format: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./brand-assets.shared.schemas").BrandAssetFormat>>;
         width: z.ZodOptional<z.ZodNumber>;
         height: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>>;
@@ -245,6 +350,7 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
                 enabled: z.ZodBoolean;
             }, z.core.$strip>]>>>;
             mfaPolicy: z.ZodDefault<z.ZodObject<{
+                externalAssuranceEnforcement: z.ZodOptional<z.ZodEnum<typeof import("..").ExternalAssuranceEnforcement>>;
                 requireMFA: z.ZodDefault<z.ZodBoolean>;
                 requireStrongMFA: z.ZodDefault<z.ZodBoolean>;
                 acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
@@ -256,6 +362,18 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
                 allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
                 emailVerification: z.ZodDefault<z.ZodEnum<typeof import("./entity-identity-config.shared.schemas").EmailVerificationMode>>;
                 blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
+                allowedEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                additionalProfileQuestions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    id: z.ZodString;
+                    ref: z.ZodOptional<z.ZodString>;
+                    type: z.ZodEnum<typeof import("..").OnboardingSurveyQuestionType>;
+                    options: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        ref: z.ZodString;
+                    }, z.core.$strip>>>;
+                    required: z.ZodDefault<z.ZodBoolean>;
+                    bindToField: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>>;
+                profileNamesCollectedAt: z.ZodOptional<z.ZodEnum<typeof import("./entity-identity-config.shared.schemas").ProfileNamesCollectionMoment>>;
             }, z.core.$strict>;
             passwordPolicy: z.ZodDefault<z.ZodObject<{
                 minLength: z.ZodDefault<z.ZodNumber>;
@@ -288,7 +406,6 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
             oneOffSessionAllowed: z.ZodOptional<z.ZodBoolean>;
             oneOffSessionMaxDurationMinutes: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>;
-        uniqueIdentifier: z.ZodDefault<z.ZodString>;
         defaultAppRoles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("..").CORE_APP_ROLES>, z.ZodString]>>>;
         requiresOrgMembership: z.ZodOptional<z.ZodObject<{
             orgTypes: z.ZodArray<z.ZodString>;
@@ -311,6 +428,7 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
                 enabled: z.ZodBoolean;
             }, z.core.$strip>]>>>;
             mfaPolicy: z.ZodOptional<z.ZodObject<{
+                externalAssuranceEnforcement: z.ZodOptional<z.ZodOptional<z.ZodEnum<typeof import("..").ExternalAssuranceEnforcement>>>;
                 requireMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
                 requireStrongMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
                 acceptableMFAMethods: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
@@ -334,18 +452,112 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
         }, z.core.$strip>>;
         scimProvisioning: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
-            syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
         creationPolicy: z.ZodOptional<z.ZodObject<{
             createOnUserTypeRegistration: z.ZodArray<z.ZodString>;
             orgNameSource: z.ZodEnum<typeof import("./entity-identity-config.shared.schemas").OrganizationNameSource>;
             defaultOwnerRole: z.ZodDefault<z.ZodString>;
         }, z.core.$strip>>;
+        ownsApplication: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strip>>>;
     compliance: z.ZodObject<{
         userProfileVisibility: z.ZodDefault<z.ZodEnum<typeof UserProfileVisibility>>;
         organizationProfileVisibility: z.ZodDefault<z.ZodEnum<typeof OrganizationProfileVisibility>>;
         clientInstanceIdScope: z.ZodDefault<z.ZodEnum<typeof ClientInstanceIdScope>>;
+        governedDocumentReleases: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            identity: z.ZodObject<{
+                document: z.ZodObject<{
+                    documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    documentVersion: z.ZodNumber;
+                }, z.core.$strict>;
+                releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                releaseVersion: z.ZodNumber;
+            }, z.core.$strict>;
+            documentClass: z.ZodEnum<typeof import("..").GovernedDocumentClass>;
+            locale: z.ZodString;
+            jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+            allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof import("..").GovernedDocumentInteractionKind>>;
+            approvalState: z.ZodEnum<typeof import("..").GovernedDocumentReleaseApprovalState>;
+            effectiveAt: z.ZodISODateTime;
+            expiresAt: z.ZodOptional<z.ZodISODateTime>;
+            renewedInteractionKinds: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").GovernedDocumentInteractionKind>>>;
+        }, z.core.$strict>>>;
+        publicDocuments: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            kind: z.ZodLiteral<import("..").GovernedDocumentPublicDocumentKind.RELEASED>;
+            release: z.ZodObject<{
+                schemaVersion: z.ZodLiteral<1>;
+                identity: z.ZodObject<{
+                    document: z.ZodObject<{
+                        documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                        documentVersion: z.ZodNumber;
+                    }, z.core.$strict>;
+                    releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    releaseVersion: z.ZodNumber;
+                }, z.core.$strict>;
+                definition: z.ZodObject<{
+                    definitionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    definitionVersion: z.ZodNumber;
+                }, z.core.$strict>;
+                documentClass: z.ZodEnum<typeof import("..").GovernedDocumentClass>;
+                locale: z.ZodString;
+                jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+                contentMediaType: z.ZodLiteral<"application/vnd.wildo.governed-document.public+json;version=1">;
+                issuedAt: z.ZodISODateTime;
+                effectiveAt: z.ZodISODateTime;
+                expiresAt: z.ZodOptional<z.ZodISODateTime>;
+                allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof import("..").GovernedDocumentInteractionKind>>;
+            }, z.core.$strict>;
+            content: z.ZodObject<{
+                schemaVersion: z.ZodLiteral<1>;
+                title: z.ZodString;
+                locale: z.ZodString;
+                jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+                sections: z.ZodArray<z.ZodObject<{
+                    sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    order: z.ZodNumber;
+                    title: z.ZodString;
+                    clauses: z.ZodArray<z.ZodObject<{
+                        clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                        order: z.ZodNumber;
+                        bodyMarkdown: z.ZodString;
+                        standing: z.ZodEnum<typeof import("..").GovernedDocumentPublicClauseStanding>;
+                        missingInformation: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            approvalState: z.ZodEnum<typeof import("..").GovernedDocumentReleaseApprovalState>;
+        }, z.core.$strict>, z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            kind: z.ZodLiteral<import("..").GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT>;
+            documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            content: z.ZodObject<{
+                schemaVersion: z.ZodLiteral<1>;
+                title: z.ZodString;
+                locale: z.ZodString;
+                jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+                sections: z.ZodArray<z.ZodObject<{
+                    sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    order: z.ZodNumber;
+                    title: z.ZodString;
+                    clauses: z.ZodArray<z.ZodObject<{
+                        clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                        order: z.ZodNumber;
+                        bodyMarkdown: z.ZodString;
+                        standing: z.ZodEnum<typeof import("..").GovernedDocumentPublicClauseStanding>;
+                        missingInformation: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "kind">>>;
+        governedDocumentAcceptanceMode: z.ZodDefault<z.ZodEnum<typeof GovernedDocumentAcceptanceMode>>;
+        governedDocumentApprovalGate: z.ZodDefault<z.ZodEnum<typeof GovernedDocumentApprovalGate>>;
+        serviceConsentRequirement: z.ZodOptional<z.ZodObject<{
+            requiredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
+            gatedProcessing: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        capabilityDeclaredConsentPurposes: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>>;
     }, z.core.$strip>;
     billing: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -378,7 +590,7 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
             providerType: z.ZodEnum<typeof AnalyticsProviderType>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>>>;
-        requiredConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
+        requiresConsent: z.ZodDefault<z.ZodBoolean>;
         valueMoments: z.ZodOptional<z.ZodArray<z.ZodObject<{
             identifier: z.ZodString;
             role: z.ZodEnum<typeof import("./analytics-value-moments.shared.schemas").ValueMomentRole>;
@@ -470,6 +682,7 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
         runRetentionDays: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     auditTrail: z.ZodOptional<z.ZodObject<{
+        applicationReadAccess: z.ZodOptional<z.ZodEnum<typeof import("..").AuditApplicationReadAccess>>;
         archiveAfterDays: z.ZodOptional<z.ZodNumber>;
         allowPrivateNetworkSiemCollectors: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;

package/dist/esm/config/app-configuration-shared.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-configuration-shared.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAmC,MAAM,6CAA6C,CAAC;AAGzH,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAKlK,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AAEvF,OAAO,EAIL,mBAAmB,EACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,yBAAyB;;;;;;;;iBAgBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;CAO9B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAIzH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAsC7C,CAAC;AAKH,eAAO,MAAM,wCAAwC;;;;iBAmBnD,CAAC;AAIH,eAAO,MAAM,0CAA0C;;;;;;iBAqCrD,CAAC;AAGH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAGH,eAAO,MAAM,4CAA4C,GAAI,CAAC,SAAS,yBAAyB,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;;;;;iBAO5H,CAAA;AAED,eAAO,MAAM,qCAAqC;;;;;iBAAgF,CAAC;AAQnI,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAED,iHAAiH;AACjH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAe1C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6ChC,CAAC;AAOH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoEzC,CAAC;AAGH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC7G,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACnI,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"app-configuration-shared.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAmC,MAAM,6CAA6C,CAAC;AAGzH,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC3I,OAAO,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,EAAE,4BAA4B,EAA4C,MAAM,uEAAuE,CAAC;AAC/J,OAAO,EAAE,8BAA8B,EAAwC,MAAM,2DAA2D,CAAC;AAEjJ,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AAEvF,OAAO,EAIL,mBAAmB,EACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,yBAAyB;;;;;;;;iBA+BpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;IAOtC;;;;;OAKG;;CAEK,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAIzH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAmD7C,CAAC;AAKH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4LnD,CAAC;AAIH,eAAO,MAAM,0CAA0C;;;;;;iBAqCrD,CAAC;AAGH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAGH,eAAO,MAAM,4CAA4C,GAAI,CAAC,SAAS,yBAAyB,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;;;;;iBAO5H,CAAA;AAED,eAAO,MAAM,qCAAqC;;;;;iBAAgF,CAAC;AAQnI,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAED,iHAAiH;AACjH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAe1C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuDhC,CAAC;AAOH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4EzC,CAAC;AAGH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC7G,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACnI,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/esm/config/app-configuration-shared.shared.schemas.js

@@ -11,13 +11,20 @@
  */
 import { AvailableLanguage } from '@wildo-ai/presets-components-models';
 import { z } from 'zod';
+// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —
+// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.
+import '@wildo-ai/zod-decorators';
 import { AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas.js';
 import { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas.js';
 import { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas.js';
-import { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas.js';
+import { ClientInstanceIdScope, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas.js';
+import { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared.js';
+import { ServiceConsentRequirementSchema } from '../compliance/privacy/operator-compliance-identity.shared.schemas.js';
 import { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas.js';
 import { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas.js';
 import { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas.js';
+import { GovernedDocumentApprovalGate, GovernedDocumentInteractionSurfaceSchema } from '../compliance/documents/governed-document-interactions.shared.schemas.js';
+import { GovernedDocumentAcceptanceMode, GovernedDocumentPublicDocumentSchema } from '../compliance/documents/governed-documents.shared.schemas.js';
 import { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas.js';
 import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
 import { ValueMomentSchema } from './analytics-value-moments.shared.schemas.js';
@@ -34,11 +41,26 @@ import { UserTypesConfigSchema, FrontendServicesConfigSchema, OrganizationTypesC
  * - Password policy indicator in reset/registration forms
  */
 export const PasswordPolicyRulesSchema = z.object({
-    minLength: z.number().min(6).max(128).default(8),
+    /**
+     * The shortest password an application may REQUIRE, and the shortest it may ACCEPT.
+     *
+     * The floor is 8, not 6, because the standard states it as an obligation on the verifier:
+     * "Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length."
+     * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).
+     * A schema that admitted 6 let an application declare a policy the standard forbids — quietly,
+     * since nothing downstream re-checked the declared value.
+     *
+     * The DEFAULT is 15 because the same section continues: "Verifiers and CSPs SHOULD require
+     * passwords to be a minimum of 15 characters in length."
+     * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).
+     * A framework's default is the answer every application that expresses no opinion receives, so it
+     * takes the SHOULD; the floor only has to stop an application going below the SHALL.
+     */
+    minLength: z.number().min(8).max(128).default(15),
     maxLength: z.number().min(8).max(256).default(128),
-    requireUppercase: z.boolean().default(true),
-    requireLowercase: z.boolean().default(true),
-    requireNumbers: z.boolean().default(true),
+    requireUppercase: z.boolean().default(false),
+    requireLowercase: z.boolean().default(false),
+    requireNumbers: z.boolean().default(false),
     requireSpecialChars: z.boolean().default(false),
     /**
      * R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),
@@ -62,6 +84,13 @@ export const PasswordPolicyViolationCode = {
     LOWERCASE: 'policyLowercase',
     NUMBER: 'policyNumber',
     SPECIAL_CHAR: 'policySpecialChar',
+    /**
+     * The password is a known common guess, the application's own name, or the user's own email local
+     * part. The check that NIST SP 800-63B-4 §3.1.1.2 asks for in place of the composition rules above
+     * — which the same section forbids, and which is why `UPPERCASE`, `LOWERCASE`, `NUMBER` and
+     * `SPECIAL_CHAR` now default to unenforced while this one always runs.
+     */
+    BLOCKLISTED: 'policyBlocklisted',
 };
 /**
  * Global Auth Config — infrastructure + app-level only.
@@ -99,7 +128,20 @@ export const AppConfiguration_Shared_AuthSchema = z.object({
     /** E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. */
     expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),
     /** E-4, D-2: Can a user authenticated via Org A SSO access Org B? */
-    crossOrgSSOAccess: z.boolean().default(true),
+    /**
+     * May a user who authenticated through ONE organization's identity provider reach ANOTHER
+     * organization through SSO?
+     *
+     * Defaults to `false` (#1223). It defaulted to `true`, and both readers tested for an explicit
+     * `false`, so an application silently permitted cross-tenant SSO reach unless it knew to write the
+     * flag — a tenancy boundary decided by an omission. Neither dogfood application wrote it.
+     *
+     * `false` is the fail-closed answer and the one a multi-tenant application almost always wants: an
+     * identity proven to Acme's provider says nothing about whether that person belongs at Globex. An
+     * application that genuinely wants the reach — a group of organizations sharing one directory —
+     * writes `true`, which is a statement a reviewer can find.
+     */
+    crossOrgSSOAccess: z.boolean().default(false),
     // W6.8: All per-user-type auth policy fields REMOVED.
     // Use userTypes[t].auth.* instead (see entity-identity-config.shared.schemas.ts).
     // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).
@@ -121,6 +163,169 @@ export const AppConfiguration_Shared_ComplianceSchema = z.object({
      * obligations attached to each non-`DISABLED` member.
      */
     clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),
+    /**
+     * The governed-document releases in force for this application — **empty unless authored**.
+     *
+     * ## What this closes
+     *
+     * The compliance lane could COMPOSE a release (`composeGovernedDocumentRelease`) and had nowhere
+     * to put it that the running application could see. Measured 2026-09-12: no package in either
+     * example app depends on its own `specifications` package, whose only exports are `.` and
+     * `./companion` — so a composed release reached the companion and the repository and never the
+     * runtime. Issue #54 asks for a record of which terms release a user accepted; nothing could
+     * resolve which release that was.
+     *
+     * ## Why HERE, on the shared payload
+     *
+     * The same reason as {@link ClientInstanceIdScope} above: both halves of the mechanism must obey
+     * ONE authored value. The frontend decides whether to render a consent control and what it is
+     * consenting to; the backend independently decides what may be recorded and composes the record.
+     * Two gates, one source.
+     *
+     * ## Why the SURFACE and not the release
+     *
+     * This payload reaches an unauthenticated browser. A full release additionally carries
+     * `governanceScope` and `approvalDecisions` — internal custody detail
+     * `projectGovernedDocumentPublicRelease` already withholds from public consumers. It happens that
+     * `composeGovernedDocumentInteraction` reads neither, so the browser-safe slice is exactly the
+     * slice the mechanism needs; see {@link GovernedDocumentInteractionSurfaceSchema}. Author it with
+     * `projectGovernedDocumentInteractionSurface(release)` so the release file stays the one source.
+     *
+     * `.default([])` rather than required, and that is not politeness: this schema parses a PERSISTED
+     * application-config document, and a required field would refuse every document written before
+     * today — the 2026-08-27 failure recorded in `staleness-presents-as-a-logic-defect.md`.
+     */
+    governedDocumentReleases: z.array(GovernedDocumentInteractionSurfaceSchema).default([]),
+    /**
+     * The governed documents this application SERVES as public pages — `/privacy`, `/terms`. Issue #168.
+     * Each entry is either a RELEASED document (a recorded release's public projection, carrying the text
+     * it was recorded with) or, for a public document that has never been released, its latest
+     * UNRELEASED_DRAFT, which the page marks as a draft. Issue #968.
+     *
+     * ## Why this is separate from `governedDocumentReleases`
+     *
+     * They answer different questions about the same underlying release, and the schemas already say
+     * so: the interaction surface is what a CONSENT control needs (`approvalState`, plus
+     * `allowedInteractionKinds` for what MAY be accepted), while a public page needs to ROUTE and
+     * DISPLAY (title, sections, clauses, effective date, version) AND, since #1258 Step 5, know
+     * whether it may record a `NOTICE_DELIVERED` for the release it is showing — which is what
+     * `allowedInteractionKinds` also answers here, for a different verb. Merging the two payloads
+     * would put document PROSE into the payload every registration form receives, which is what this
+     * split exists to prevent; a field two surfaces both need for their own reasons is not that,
+     * and it appears on each projection on its own terms rather than one borrowing the other's copy.
+     * Neither is typed by hand: `wildo config document-releases` writes both into the application's
+     * `governed-document-releases.generated.ts` from its recorded releases (and, for this one, its
+     * landed drafts), so the release stays the one source.
+     *
+     * ## Why the prose is safe to put in an unauthenticated payload
+     *
+     * Because it is what the page exists to show. Both halves are the deliberately-narrow public
+     * projections — `governanceScope` and `approvalDecisions` never appear, and `bodyMarkdown` is
+     * rendered as TEXT, never as raw HTML. The surface carries no internal custody detail at all.
+     *
+     * `.default([])` for the same reason as its neighbour: this parses a PERSISTED configuration
+     * document, and a required field would refuse every document written before today.
+     */
+    publicDocuments: z.array(GovernedDocumentPublicDocumentSchema).default([]),
+    /**
+     * How the registration form asks a person to accept the documents above (#1258).
+     *
+     * See {@link GovernedDocumentAcceptanceMode} for what each member changes and the enforceability
+     * position it takes. It is read by `Auth_Register`, which is why it is on the SHARED payload: the
+     * decision is the application's and the form is the only thing that can carry it out.
+     *
+     * ## Why it defaults to the STRONGEST shape rather than the one this rule's prose leads with
+     *
+     * `EXPLICIT_CHECKBOX` is what registration already did before this field existed, and a default is
+     * what every application that declares nothing receives — so any other default would silently move
+     * shipped applications to a weaker acceptance posture on an engine upgrade, without anyone deciding
+     * to. An operator who wants the lighter "by registering you agree" shape says so, once, here.
+     *
+     * ## Why it is declared rather than derived
+     *
+     * `derive-before-you-ask.md` asks what already decides this, and nothing does: the release declares
+     * WHAT may be accepted (`allowedInteractionKinds`) and the public document declares what it SAYS,
+     * but neither carries how hard the operator wants to be asked. It is a liability posture — the one
+     * class `settled-questions-are-not-decisions.md` keeps with the operator — so it is a typed,
+     * committed, diffable declaration rather than a question or a guess.
+     *
+     * `.default(...)` rather than optional or required, for the reason its two neighbours give: this
+     * schema parses a PERSISTED application-config document, and a required field would refuse every
+     * document written before today.
+     */
+    governedDocumentAcceptanceMode: z.enum(GovernedDocumentAcceptanceMode).default(GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX),
+    /**
+     * Whether this application shows, and asks people to accept, governed documents nobody has
+     * approved (#1565). See {@link GovernedDocumentApprovalGate} for what each member changes.
+     *
+     * ONE member rather than an option on each surface, because the public page and the acceptance
+     * surfaces must never be armed separately: armed on the page alone, `/terms` answers "unavailable"
+     * while sign-up asks people to accept those same terms. Every surface reads it through
+     * `requiresApprovedGovernedDocuments`.
+     *
+     * Defaults to UNARMED, the posture while an application is being built
+     * (`.claude/rules/one-source-of-truth.md` D5). Arming it is part of Gate 3's membership test.
+     *
+     * `.default(...)` for the reason its neighbours give: this schema parses a PERSISTED
+     * application-config document, and a required field would refuse every document written before
+     * today.
+     */
+    governedDocumentApprovalGate: z.enum(GovernedDocumentApprovalGate).default(GovernedDocumentApprovalGate.UNARMED),
+    /**
+     * The purposes a signed-in person must grant before the application renders any of its routes —
+     * the RUNTIME half of `operatorComplianceIdentity.serviceConsentRequirement` (#453).
+     *
+     * Declared once, in `wildo.saas.config.ts`, and projected here by `wildo config service-consent`
+     * into `backend-api/src/service-consent-requirement.generated.ts`, which `saas-config.backend.ts`
+     * composes — the `governedDocumentReleases` precedent, so there is never a second hand-copied source.
+     *
+     * Enforced on BOTH tiers. The backend refuses every user-initiated operation except the person's own
+     * context and preferences until every required purpose is granted — one gate,
+     * `AuthorizationsBackendService.assertServiceConsentRequirementMet`, reached from each entry point a person
+     * can initiate work through: `authorizeInController` (REST, MCP tools, queued operations, WebSocket rows,
+     * agent tool calls), `authorizeInProgrammaticSurface` (retrieval), `authorizeOperationRolesOnly` (WebSocket
+     * scope subscriptions), the manual-controller context (charts, analytics, features, flows-actors, provider
+     * operations and connections), the WebSocket badge reads, the A2A task reads (`tasks/get`, `ListTasks`,
+     * `tasks/resubscribe`, `tasks/pushNotificationConfig/*`), and every A2A or WebSocket conversational turn,
+     * started or resumed after an approval. Authentication endpoints are not resource operations and stay open,
+     * as does cancelling an A2A task the person already started; updates the server pushes on its own are not
+     * held back. `AppLayout_AuthenticatedRoute` shows the consent gate where the
+     * person grants them. On the SHARED config because the frontend reads it. It carries no personal data and no
+     * lawful-basis detail, so it is safe in the payload every signed-in browser receives.
+     *
+     * OPTIONAL, and absent means the application declared nothing — nothing is gated. That is the same
+     * observable behaviour as a declared empty set, and deliberately so: a runtime must never block a
+     * person on a requirement nobody stated. The DISTINCTION between the two lives where it matters, in
+     * the declaration and the documents composed from it.
+     */
+    serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),
+    /**
+     * Every purpose declared by at least one resource operation's `consentGate` (#1462, following
+     * #1258 Step 3), so the application-tier consent-gate PROMPT can offer to grant it.
+     *
+     * DERIVED, never authored — this is not a declaration site. A resource operation declares
+     * `consentGate: { purpose, refusal?, timing? }` in its OWN `*.resources-config.ts`
+     * (`ResourceOperationConsentGateDeclaration`), which is where the decision belongs: a capability's
+     * consent posture is expressed beside the capability, not restated a second time here for the
+     * frontend to read. This field is the engine scanning every resource's every operation once, at
+     * boot, and recording the SET of purposes at least one of them named — `wildo config`-generated
+     * fields read `wildo.saas.config.ts`, which does not see per-operation declarations scattered
+     * across the app, so that pattern does not fit here; this is populated by
+     * `ResourcesRegistryBackendService.initialize()` calling back into `AppConfigurationService` the
+     * moment the registry — and therefore every operation's declared purpose — is fully built.
+     *
+     * `applicationAskedConsentPurposes` unions this with `requiredPurposes` and the analytics purpose
+     * to decide `optionalPurposes` on `ConsentGateState` — the same generic PROMPT that already offers
+     * ANALYTICS, now also offering whatever a capability declared. It does not distinguish `timing`
+     * (`ON_USE` / `FIRST_SESSION` / …): no per-capability or per-session prompt surface exists yet to
+     * honour those distinctly, so every declared purpose is offered by the one surface that does exist,
+     * which is strictly better than the alternative — refusing a capability with no way at all to grant
+     * what it asks for.
+     *
+     * OPTIONAL and defaults to the empty array on any config resolved before this field existed, which
+     * is the same observable behaviour as declaring no `consentGate` anywhere (R12).
+     */
+    capabilityDeclaredConsentPurposes: z.enum(ConsentPurpose).array().default([]),
 });
 export const AppConfiguration_Shared_AppIdentity_Schema = z.object({
     /** Technical app name — used as fallback when displayName is absent */
@@ -212,8 +417,18 @@ export const AnalyticsConfigSchema = z.object({
     enabled: z.boolean().default(false),
     /** Registered analytics providers */
     providers: z.array(AnalyticsProviderConfigSchema).default([]),
-    /** Minimum consent level required for analytics (defaults to ANALYTICS) */
-    requiredConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.ANALYTICS),
+    /**
+     * Whether analytics rests on the person's consent to `ConsentPurpose.ANALYTICS` (default `true`).
+     *
+     * A boolean rather than a purpose, because analytics has exactly one purpose by definition. `false`
+     * is a claim that analytics here is not consent-based — anonymised measurement under a documented
+     * legitimate interest — and the lawful basis for that belongs in `operatorComplianceIdentity`.
+     *
+     * Replaces `requiredConsent: DataProcessingConsent`, a minimum LEVEL on an ordered scale that
+     * implied a person who agreed to marketing had agreed to analytics (#534). `requiredConsent: NONE`
+     * is `requiresConsent: false`; every other value is `true`.
+     */
+    requiresConsent: z.boolean().default(true),
     /**
      * SINGLE DECLARATION SURFACE for all value moments.
      * TTFV, aha moments, activation stages, and anti-patterns are all here,
@@ -282,7 +497,15 @@ export const AppConfiguration_Shared_Schema = z.object({
     userTypes: UserTypesConfigSchema,
     /** Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. */
     frontendServices: FrontendServicesConfigSchema,
-    /** Org typing. Optional — only for apps with typed organizations. */
+    /**
+     * Org typing. MANDATORY for a running application, optional in this schema (#1032, 2026-09-14).
+     *
+     * Every organization carries a type naming an entry here, and a member of an organization whose type
+     * resolves to nothing cannot sign in, so an application with none is refused at startup. The schema
+     * stays optional because it also parses configuration that predates the field, and the door that
+     * writes the field has to be able to read that configuration first. It used to say "only for apps with
+     * typed organizations"; every application has organizations.
+     */
     organizationTypes: OrganizationTypesConfigSchema.optional(),
     compliance: AppConfiguration_Shared_ComplianceSchema,
     // Billing Configuration (optional: billing disabled by default)