@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/compliance/privacy/consent-purposes.shared.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Consent purposes — the optional processing a person may independently agree to.
+ *
+ * ## A SET, not a ladder (decided by Paul, 2026-09-09 — #534 / #453)
+ *
+ * This replaces `DataProcessingConsent` (`NONE · BASIC · ANALYTICS · MARKETING · FULL`), which was an
+ * ORDERED level. The order was a claim nobody decided and the law does not make: agreeing to
+ * marketing is not "more than" agreeing to analytics, and a ladder made consenting to one imply
+ * consenting to the ones "below" it. The only thing that ever enforced the order was a module-private
+ * `CONSENT_ORDER` inside the frontend analytics provider.
+ *
+ * So each member is a PURPOSE, granted or not on its own, and a person's consent is the set of
+ * purposes they granted. The old members map without loss of meaning:
+ *
+ * - `NONE`  → the empty set.
+ * - `BASIC` → not a purpose at all. It stood for processing the service needs in order to exist,
+ *   which is never consent-based (it rests on contract or legitimate interest), so it has no member.
+ * - `FULL`  → every member.
+ *
+ * ## Why this file imports nothing
+ *
+ * It is carved onto `@wildo-ai/saas-models/public-runtime` (K-2), because the visitor-tier
+ * `WebsiteConsentGate` in the browser bundle reads the same vocabulary the application stores. One
+ * vocabulary, one file: the original privacy schema imports it from here.
+ *
+ * Adding a member is a product decision with legal weight — every surface that asks a person for
+ * consent renders the whole set, and every application's consent-gated processing must name which
+ * member it rests on.
+ */
+export declare enum ConsentPurpose {
+    /** Measuring how the service is used — product analytics, usage tracking. */
+    ANALYTICS = "analytics",
+    /** Contacting the person or tailoring outreach to them for promotional reasons. */
+    MARKETING = "marketing"
+}
+/**
+ * The browser storage key under which a Wildo marketing website keeps a VISITOR's consent decision.
+ *
+ * The visitor tier has no account to store a decision on, so it lives in the visitor's own browser, on
+ * the website's origin — which is also why it does not follow them into the signed-in application, whose
+ * decision is `privacy.consentedPurposes` on the person's preferences. Named once here so the website's
+ * storage adapter and the cookie table (`ENGINE_CLIENT_STORAGE_ENTRIES`) cannot name different keys.
+ */
+export declare const WEBSITE_VISITOR_CONSENT_STORAGE_KEY = "__wildo_website_consent";
+/**
+ * The route a VISITOR's consent decision is recorded through — `ANONYMOUS_USERS.record_consent`.
+ *
+ * Named here for the same reason as the storage key above: the marketing website must not depend on
+ * `saas-models`' resource layer (bundle discipline keeps it to `public-runtime` atoms), so without a
+ * shared constant the website would hard-code a path string and the engine would build one, with
+ * nothing joining them. `/inbound-contacts` is hard-coded that way today, which is the drift this
+ * avoids.
+ *
+ * It is not asserted by hand: `consent-purposes.shared.test.ts` derives it from the operation's own
+ * identifier through `ResourcesConfigNamingUtils.toKebabCase` — the same transform the URL builder
+ * uses — so renaming the resource or the operation reddens rather than 404s at runtime.
+ */
+export declare const ANONYMOUS_CONSENT_RECORD_PATH = "/anonymous-users/record-consent";
+/**
+ * The HTTP METHOD that route answers — `PUT`, not `POST`.
+ *
+ * ## Why this constant had to exist
+ *
+ * The sibling above named the PATH and stopped there, and its own note predicted the consequence of a
+ * drift precisely: *"the failure is a 404 at runtime, on a public path nobody monitors."* That is what
+ * happened, to the half it did not cover. `RECORD_CONSENT` declares
+ * `resourceOperationLike: UPDATE_MANY`, and `getDefaultHttpVerbForOperation` maps every UPDATE verb to
+ * `PUT` — but nothing said so where a client could read it, so two independent clients assumed POST and
+ * both 404'd: the marketing website's recorder, whose failure is deliberately (and correctly) silent,
+ * and the application's pre-auth recorder written against it.
+ *
+ * A path without its method is half an address. Naming both here is what lets a client be right by
+ * reading rather than by guessing, and `consent-purposes.shared.test.ts` derives this from the built
+ * operation's own `httpVerb` — the value the router registers — so changing the operation's shape
+ * reddens instead of silently moving the door.
+ */
+export declare const ANONYMOUS_CONSENT_RECORD_METHOD = "PUT";
+/** Every purpose, in declaration order — the order a consent surface lists them in. */
+export declare const CONSENT_PURPOSES: readonly ConsentPurpose[];
+/**
+ * The purposes in `required` that `granted` does not contain. Empty when every required purpose was
+ * granted — including when nothing is required.
+ *
+ * Membership, never rank: there is no purpose whose grant satisfies another.
+ */
+export declare function missingConsentPurposes(granted: readonly ConsentPurpose[] | undefined, required: readonly ConsentPurpose[]): ConsentPurpose[];
+/** Whether every purpose in `required` was granted. */
+export declare function hasGrantedConsentPurposes(granted: readonly ConsentPurpose[] | undefined, required: readonly ConsentPurpose[]): boolean;
+/**
+ * Every purpose THIS APPLICATION would put to a person — what its own consent surface asks.
+ *
+ * Two readers needed this and would otherwise have derived it twice: the application's consent gate,
+ * deciding what to render, and the anonymous-consent carry, deciding whether a visitor was shown
+ * enough for their decision to count as complete. Two derivations of "what do we ask" drift, and the
+ * drift is invisible — the gate would prompt for a purpose the carry had already recorded as
+ * decided, or the reverse.
+ *
+ * Takes PRIMITIVES rather than the config objects, so this file keeps the import-free property that
+ * lets it be carved onto `public-runtime` for the website bundle.
+ *
+ * Total over what the configuration STATES A USE FOR, never over the enum: asking for a purpose
+ * nothing processes collects a consent that means nothing. A required purpose is asked by
+ * definition; ANALYTICS is asked when analytics runs and rests on consent; and — since #1462 — a
+ * purpose at least one resource operation's `consentGate` names is asked too, because a capability
+ * that may refuse over a purpose is a capability that must have somewhere to grant it. This function
+ * does not, and cannot, distinguish WHEN each purpose should be asked (a required purpose, ANALYTICS
+ * and a `consentGate` purpose may each want different `ConsentGateTiming`); it only says WHETHER the
+ * one generic prompt surface that exists today should offer it.
+ */
+export declare function applicationAskedConsentPurposes(input: {
+    readonly requiredPurposes?: readonly string[];
+    readonly analyticsEnabled: boolean;
+    readonly analyticsRequiresConsent: boolean;
+    /** Every purpose declared by at least one resource operation's `consentGate` (#1462) — `compliance.capabilityDeclaredConsentPurposes`. */
+    readonly capabilityDeclaredPurposes?: readonly string[];
+}): ConsentPurpose[];
+/**
+ * A purpose list in its canonical form: de-duplicated, restricted to known members, in declaration
+ * order.
+ *
+ * Stored consent is compared by the audit trail's before/after evidence, so two lists naming the same
+ * purposes in a different order must not read as a change of decision.
+ */
+export declare function normalizeConsentPurposes(purposes: readonly string[] | undefined): ConsentPurpose[];
+//# sourceMappingURL=consent-purposes.shared.d.ts.map

package/dist/esm/compliance/privacy/consent-purposes.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-purposes.shared.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/consent-purposes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,oBAAY,cAAc;IACxB,6EAA6E;IAC7E,SAAS,cAAc;IACvB,mFAAmF;IACnF,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,4BAA4B,CAAC;AAE7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,oCAAoC,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,+BAA+B,QAAQ,CAAC;AAErD,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAiD,CAAC;AAExG;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,EAC9C,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,cAAc,EAAE,CAGlB;AAED,uDAAuD;AACvD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,EAC9C,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,0IAA0I;IAC1I,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzD,GAAG,cAAc,EAAE,CAQnB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,cAAc,EAAE,CAGlG"}

package/dist/esm/compliance/privacy/consent-purposes.shared.js

@@ -0,0 +1,136 @@
+/**
+ * Consent purposes — the optional processing a person may independently agree to.
+ *
+ * ## A SET, not a ladder (decided by Paul, 2026-09-09 — #534 / #453)
+ *
+ * This replaces `DataProcessingConsent` (`NONE · BASIC · ANALYTICS · MARKETING · FULL`), which was an
+ * ORDERED level. The order was a claim nobody decided and the law does not make: agreeing to
+ * marketing is not "more than" agreeing to analytics, and a ladder made consenting to one imply
+ * consenting to the ones "below" it. The only thing that ever enforced the order was a module-private
+ * `CONSENT_ORDER` inside the frontend analytics provider.
+ *
+ * So each member is a PURPOSE, granted or not on its own, and a person's consent is the set of
+ * purposes they granted. The old members map without loss of meaning:
+ *
+ * - `NONE`  → the empty set.
+ * - `BASIC` → not a purpose at all. It stood for processing the service needs in order to exist,
+ *   which is never consent-based (it rests on contract or legitimate interest), so it has no member.
+ * - `FULL`  → every member.
+ *
+ * ## Why this file imports nothing
+ *
+ * It is carved onto `@wildo-ai/saas-models/public-runtime` (K-2), because the visitor-tier
+ * `WebsiteConsentGate` in the browser bundle reads the same vocabulary the application stores. One
+ * vocabulary, one file: the original privacy schema imports it from here.
+ *
+ * Adding a member is a product decision with legal weight — every surface that asks a person for
+ * consent renders the whole set, and every application's consent-gated processing must name which
+ * member it rests on.
+ */
+export var ConsentPurpose;
+(function (ConsentPurpose) {
+    /** Measuring how the service is used — product analytics, usage tracking. */
+    ConsentPurpose["ANALYTICS"] = "analytics";
+    /** Contacting the person or tailoring outreach to them for promotional reasons. */
+    ConsentPurpose["MARKETING"] = "marketing";
+})(ConsentPurpose || (ConsentPurpose = {}));
+/**
+ * The browser storage key under which a Wildo marketing website keeps a VISITOR's consent decision.
+ *
+ * The visitor tier has no account to store a decision on, so it lives in the visitor's own browser, on
+ * the website's origin — which is also why it does not follow them into the signed-in application, whose
+ * decision is `privacy.consentedPurposes` on the person's preferences. Named once here so the website's
+ * storage adapter and the cookie table (`ENGINE_CLIENT_STORAGE_ENTRIES`) cannot name different keys.
+ */
+export const WEBSITE_VISITOR_CONSENT_STORAGE_KEY = '__wildo_website_consent';
+/**
+ * The route a VISITOR's consent decision is recorded through — `ANONYMOUS_USERS.record_consent`.
+ *
+ * Named here for the same reason as the storage key above: the marketing website must not depend on
+ * `saas-models`' resource layer (bundle discipline keeps it to `public-runtime` atoms), so without a
+ * shared constant the website would hard-code a path string and the engine would build one, with
+ * nothing joining them. `/inbound-contacts` is hard-coded that way today, which is the drift this
+ * avoids.
+ *
+ * It is not asserted by hand: `consent-purposes.shared.test.ts` derives it from the operation's own
+ * identifier through `ResourcesConfigNamingUtils.toKebabCase` — the same transform the URL builder
+ * uses — so renaming the resource or the operation reddens rather than 404s at runtime.
+ */
+export const ANONYMOUS_CONSENT_RECORD_PATH = '/anonymous-users/record-consent';
+/**
+ * The HTTP METHOD that route answers — `PUT`, not `POST`.
+ *
+ * ## Why this constant had to exist
+ *
+ * The sibling above named the PATH and stopped there, and its own note predicted the consequence of a
+ * drift precisely: *"the failure is a 404 at runtime, on a public path nobody monitors."* That is what
+ * happened, to the half it did not cover. `RECORD_CONSENT` declares
+ * `resourceOperationLike: UPDATE_MANY`, and `getDefaultHttpVerbForOperation` maps every UPDATE verb to
+ * `PUT` — but nothing said so where a client could read it, so two independent clients assumed POST and
+ * both 404'd: the marketing website's recorder, whose failure is deliberately (and correctly) silent,
+ * and the application's pre-auth recorder written against it.
+ *
+ * A path without its method is half an address. Naming both here is what lets a client be right by
+ * reading rather than by guessing, and `consent-purposes.shared.test.ts` derives this from the built
+ * operation's own `httpVerb` — the value the router registers — so changing the operation's shape
+ * reddens instead of silently moving the door.
+ */
+export const ANONYMOUS_CONSENT_RECORD_METHOD = 'PUT';
+/** Every purpose, in declaration order — the order a consent surface lists them in. */
+export const CONSENT_PURPOSES = Object.freeze(Object.values(ConsentPurpose));
+/**
+ * The purposes in `required` that `granted` does not contain. Empty when every required purpose was
+ * granted — including when nothing is required.
+ *
+ * Membership, never rank: there is no purpose whose grant satisfies another.
+ */
+export function missingConsentPurposes(granted, required) {
+    const grantedSet = new Set(granted ?? []);
+    return CONSENT_PURPOSES.filter((purpose) => required.includes(purpose) && !grantedSet.has(purpose));
+}
+/** Whether every purpose in `required` was granted. */
+export function hasGrantedConsentPurposes(granted, required) {
+    return missingConsentPurposes(granted, required).length === 0;
+}
+/**
+ * Every purpose THIS APPLICATION would put to a person — what its own consent surface asks.
+ *
+ * Two readers needed this and would otherwise have derived it twice: the application's consent gate,
+ * deciding what to render, and the anonymous-consent carry, deciding whether a visitor was shown
+ * enough for their decision to count as complete. Two derivations of "what do we ask" drift, and the
+ * drift is invisible — the gate would prompt for a purpose the carry had already recorded as
+ * decided, or the reverse.
+ *
+ * Takes PRIMITIVES rather than the config objects, so this file keeps the import-free property that
+ * lets it be carved onto `public-runtime` for the website bundle.
+ *
+ * Total over what the configuration STATES A USE FOR, never over the enum: asking for a purpose
+ * nothing processes collects a consent that means nothing. A required purpose is asked by
+ * definition; ANALYTICS is asked when analytics runs and rests on consent; and — since #1462 — a
+ * purpose at least one resource operation's `consentGate` names is asked too, because a capability
+ * that may refuse over a purpose is a capability that must have somewhere to grant it. This function
+ * does not, and cannot, distinguish WHEN each purpose should be asked (a required purpose, ANALYTICS
+ * and a `consentGate` purpose may each want different `ConsentGateTiming`); it only says WHETHER the
+ * one generic prompt surface that exists today should offer it.
+ */
+export function applicationAskedConsentPurposes(input) {
+    const required = normalizeConsentPurposes(input.requiredPurposes);
+    const capabilityDeclared = normalizeConsentPurposes(input.capabilityDeclaredPurposes);
+    const asked = new Set([...required, ...capabilityDeclared]);
+    if (input.analyticsEnabled && input.analyticsRequiresConsent) {
+        asked.add(ConsentPurpose.ANALYTICS);
+    }
+    return CONSENT_PURPOSES.filter((purpose) => asked.has(purpose));
+}
+/**
+ * A purpose list in its canonical form: de-duplicated, restricted to known members, in declaration
+ * order.
+ *
+ * Stored consent is compared by the audit trail's before/after evidence, so two lists naming the same
+ * purposes in a different order must not read as a change of decision.
+ */
+export function normalizeConsentPurposes(purposes) {
+    const given = new Set(purposes ?? []);
+    return CONSENT_PURPOSES.filter((purpose) => given.has(purpose));
+}
+//# sourceMappingURL=consent-purposes.shared.js.map

package/dist/esm/compliance/privacy/consent-purposes.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-purposes.shared.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/consent-purposes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,6EAA6E;IAC7E,yCAAuB,CAAA;IACvB,mFAAmF;IACnF,yCAAuB,CAAA;AACzB,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;AAE7E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,iCAAiC,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAErD,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAExG;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA8C,EAC9C,QAAmC;IAEnC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CACvC,OAA8C,EAC9C,QAAmC;IAEnC,OAAO,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAM/C;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAiB,CAAC,GAAG,QAAQ,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAC7D,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAuC;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAClE,CAAC","sourcesContent":["/**\n * Consent purposes — the optional processing a person may independently agree to.\n *\n * ## A SET, not a ladder (decided by Paul, 2026-09-09 — #534 / #453)\n *\n * This replaces `DataProcessingConsent` (`NONE · BASIC · ANALYTICS · MARKETING · FULL`), which was an\n * ORDERED level. The order was a claim nobody decided and the law does not make: agreeing to\n * marketing is not \"more than\" agreeing to analytics, and a ladder made consenting to one imply\n * consenting to the ones \"below\" it. The only thing that ever enforced the order was a module-private\n * `CONSENT_ORDER` inside the frontend analytics provider.\n *\n * So each member is a PURPOSE, granted or not on its own, and a person's consent is the set of\n * purposes they granted. The old members map without loss of meaning:\n *\n * - `NONE`  → the empty set.\n * - `BASIC` → not a purpose at all. It stood for processing the service needs in order to exist,\n *   which is never consent-based (it rests on contract or legitimate interest), so it has no member.\n * - `FULL`  → every member.\n *\n * ## Why this file imports nothing\n *\n * It is carved onto `@wildo-ai/saas-models/public-runtime` (K-2), because the visitor-tier\n * `WebsiteConsentGate` in the browser bundle reads the same vocabulary the application stores. One\n * vocabulary, one file: the original privacy schema imports it from here.\n *\n * Adding a member is a product decision with legal weight — every surface that asks a person for\n * consent renders the whole set, and every application's consent-gated processing must name which\n * member it rests on.\n */\nexport enum ConsentPurpose {\n  /** Measuring how the service is used — product analytics, usage tracking. */\n  ANALYTICS = 'analytics',\n  /** Contacting the person or tailoring outreach to them for promotional reasons. */\n  MARKETING = 'marketing',\n}\n\n/**\n * The browser storage key under which a Wildo marketing website keeps a VISITOR's consent decision.\n *\n * The visitor tier has no account to store a decision on, so it lives in the visitor's own browser, on\n * the website's origin — which is also why it does not follow them into the signed-in application, whose\n * decision is `privacy.consentedPurposes` on the person's preferences. Named once here so the website's\n * storage adapter and the cookie table (`ENGINE_CLIENT_STORAGE_ENTRIES`) cannot name different keys.\n */\nexport const WEBSITE_VISITOR_CONSENT_STORAGE_KEY = '__wildo_website_consent';\n\n/**\n * The route a VISITOR's consent decision is recorded through — `ANONYMOUS_USERS.record_consent`.\n *\n * Named here for the same reason as the storage key above: the marketing website must not depend on\n * `saas-models`' resource layer (bundle discipline keeps it to `public-runtime` atoms), so without a\n * shared constant the website would hard-code a path string and the engine would build one, with\n * nothing joining them. `/inbound-contacts` is hard-coded that way today, which is the drift this\n * avoids.\n *\n * It is not asserted by hand: `consent-purposes.shared.test.ts` derives it from the operation's own\n * identifier through `ResourcesConfigNamingUtils.toKebabCase` — the same transform the URL builder\n * uses — so renaming the resource or the operation reddens rather than 404s at runtime.\n */\nexport const ANONYMOUS_CONSENT_RECORD_PATH = '/anonymous-users/record-consent';\n\n/**\n * The HTTP METHOD that route answers — `PUT`, not `POST`.\n *\n * ## Why this constant had to exist\n *\n * The sibling above named the PATH and stopped there, and its own note predicted the consequence of a\n * drift precisely: *\"the failure is a 404 at runtime, on a public path nobody monitors.\"* That is what\n * happened, to the half it did not cover. `RECORD_CONSENT` declares\n * `resourceOperationLike: UPDATE_MANY`, and `getDefaultHttpVerbForOperation` maps every UPDATE verb to\n * `PUT` — but nothing said so where a client could read it, so two independent clients assumed POST and\n * both 404'd: the marketing website's recorder, whose failure is deliberately (and correctly) silent,\n * and the application's pre-auth recorder written against it.\n *\n * A path without its method is half an address. Naming both here is what lets a client be right by\n * reading rather than by guessing, and `consent-purposes.shared.test.ts` derives this from the built\n * operation's own `httpVerb` — the value the router registers — so changing the operation's shape\n * reddens instead of silently moving the door.\n */\nexport const ANONYMOUS_CONSENT_RECORD_METHOD = 'PUT';\n\n/** Every purpose, in declaration order — the order a consent surface lists them in. */\nexport const CONSENT_PURPOSES: readonly ConsentPurpose[] = Object.freeze(Object.values(ConsentPurpose));\n\n/**\n * The purposes in `required` that `granted` does not contain. Empty when every required purpose was\n * granted — including when nothing is required.\n *\n * Membership, never rank: there is no purpose whose grant satisfies another.\n */\nexport function missingConsentPurposes(\n  granted: readonly ConsentPurpose[] | undefined,\n  required: readonly ConsentPurpose[],\n): ConsentPurpose[] {\n  const grantedSet = new Set(granted ?? []);\n  return CONSENT_PURPOSES.filter((purpose) => required.includes(purpose) && !grantedSet.has(purpose));\n}\n\n/** Whether every purpose in `required` was granted. */\nexport function hasGrantedConsentPurposes(\n  granted: readonly ConsentPurpose[] | undefined,\n  required: readonly ConsentPurpose[],\n): boolean {\n  return missingConsentPurposes(granted, required).length === 0;\n}\n\n/**\n * Every purpose THIS APPLICATION would put to a person — what its own consent surface asks.\n *\n * Two readers needed this and would otherwise have derived it twice: the application's consent gate,\n * deciding what to render, and the anonymous-consent carry, deciding whether a visitor was shown\n * enough for their decision to count as complete. Two derivations of \"what do we ask\" drift, and the\n * drift is invisible — the gate would prompt for a purpose the carry had already recorded as\n * decided, or the reverse.\n *\n * Takes PRIMITIVES rather than the config objects, so this file keeps the import-free property that\n * lets it be carved onto `public-runtime` for the website bundle.\n *\n * Total over what the configuration STATES A USE FOR, never over the enum: asking for a purpose\n * nothing processes collects a consent that means nothing. A required purpose is asked by\n * definition; ANALYTICS is asked when analytics runs and rests on consent; and — since #1462 — a\n * purpose at least one resource operation's `consentGate` names is asked too, because a capability\n * that may refuse over a purpose is a capability that must have somewhere to grant it. This function\n * does not, and cannot, distinguish WHEN each purpose should be asked (a required purpose, ANALYTICS\n * and a `consentGate` purpose may each want different `ConsentGateTiming`); it only says WHETHER the\n * one generic prompt surface that exists today should offer it.\n */\nexport function applicationAskedConsentPurposes(input: {\n  readonly requiredPurposes?: readonly string[];\n  readonly analyticsEnabled: boolean;\n  readonly analyticsRequiresConsent: boolean;\n  /** Every purpose declared by at least one resource operation's `consentGate` (#1462) — `compliance.capabilityDeclaredConsentPurposes`. */\n  readonly capabilityDeclaredPurposes?: readonly string[];\n}): ConsentPurpose[] {\n  const required = normalizeConsentPurposes(input.requiredPurposes);\n  const capabilityDeclared = normalizeConsentPurposes(input.capabilityDeclaredPurposes);\n  const asked = new Set<ConsentPurpose>([...required, ...capabilityDeclared]);\n  if (input.analyticsEnabled && input.analyticsRequiresConsent) {\n    asked.add(ConsentPurpose.ANALYTICS);\n  }\n  return CONSENT_PURPOSES.filter((purpose) => asked.has(purpose));\n}\n\n/**\n * A purpose list in its canonical form: de-duplicated, restricted to known members, in declaration\n * order.\n *\n * Stored consent is compared by the audit trail's before/after evidence, so two lists naming the same\n * purposes in a different order must not read as a change of decision.\n */\nexport function normalizeConsentPurposes(purposes: readonly string[] | undefined): ConsentPurpose[] {\n  const given = new Set(purposes ?? []);\n  return CONSENT_PURPOSES.filter((purpose) => given.has(purpose));\n}\n"]}

package/dist/esm/compliance/privacy/data-retention.shared.schemas.d.ts

@@ -1,8 +0,0 @@
-import { z } from "zod";
-export declare const DataRetentionPolicySchema: z.ZodObject<{
-    retentionDays: z.ZodNumber;
-    autoDelete: z.ZodDefault<z.ZodBoolean>;
-    archiveAfterDays: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
-export type DataRetentionPolicy = z.infer<typeof DataRetentionPolicySchema>;
-//# sourceMappingURL=data-retention.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/data-retention.shared.schemas.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"data-retention.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/data-retention.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/data-retention.shared.schemas.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"data-retention.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/data-retention.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n\nexport const DataRetentionPolicySchema = z.object({\n  retentionDays: z.number().positive(),\n  autoDelete: z.boolean().default(true),\n  archiveAfterDays: z.number().positive().optional(),\n});\n\nexport type DataRetentionPolicy = z.infer<typeof DataRetentionPolicySchema>;\n"]}

package/dist/esm/compliance/privacy/data-subject-rights.shared.schemas.d.ts

@@ -0,0 +1,100 @@
+import { LawfulBasis, OperatorProcessingRole } from './operator-compliance-identity.shared.schemas';
+/**
+ * **Which data-subject rights a privacy notice must state, derived from where the application operates and
+ * the lawful bases it declares.**
+ *
+ * A notice must tell a person which rights they have (GDPR Art. 13(2)(b)–(d)). Which ones apply is not the
+ * operator's choice: the law attaches them, several of them conditionally on the lawful basis of the
+ * processing. So nobody is asked to type this list. It is a function of two declarations the application
+ * already makes — `operatingJurisdictions` and `operatorComplianceIdentity.lawfulBases` — and of the law
+ * of the regime a jurisdiction falls under, which is written down here once.
+ *
+ * spec-cite: GDPR Art. 13(2)(b)–(d), Art. 15–18, Art. 20(1), Art. 21(1), Art. 7(3), Art. 77(1).
+ * spec-cite: UK GDPR Art. 7(3), 15–18, 20, 21 (legislation.gov.uk, read 2026-09-25); Data Protection Act 2018
+ * s.164A and s.165(2) as amended by the Data (Use and Access) Act 2025 s.103, in force 19 June 2026.
+ *
+ * ## Only the regimes written here are known, and an unknown one is named rather than guessed
+ *
+ * Two regimes: the EU GDPR, reaching every EU member state through {@link jurisdictionReachCovers}, and the
+ * United Kingdom's. They are written separately although the rights match article for article, because the
+ * complaint route does not: from 19 June 2026 UK GDPR Art. 77 is omitted, a person may complain to the
+ * controller itself (DPA 2018 s.164A — acknowledged within 30 days) and to the Information Commissioner
+ * (s.165(2)). A notice that borrowed the EU wording would name a route UK law no longer has. A declared
+ * jurisdiction outside every known regime gets NO rights list and the caller names it as owed. Adding a
+ * regime is a deliberate edit to {@link DATA_PROTECTION_REGIME_REACH}, {@link rightsUnderRegime} and
+ * {@link complaintRouteUnderRegime}, with its own citations.
+ */
+/** A data-protection regime whose rights this module can state. */
+export declare enum DataProtectionRegime {
+    /** Regulation (EU) 2016/679, for every EU member state. */
+    EU_GDPR = "EU_GDPR",
+    /** The UK GDPR with the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. */
+    UK_GDPR = "UK_GDPR"
+}
+/** A right a data subject holds against a controller. */
+export declare enum DataSubjectRight {
+    /** Art. 15 — access to their data and information about its processing. */
+    ACCESS = "ACCESS",
+    /** Art. 16 — rectification of inaccurate data. */
+    RECTIFICATION = "RECTIFICATION",
+    /** Art. 17 — erasure, subject to the Art. 17(3) exceptions. */
+    ERASURE = "ERASURE",
+    /** Art. 18 — restriction of processing. */
+    RESTRICTION = "RESTRICTION",
+    /** Art. 20 — portability of data the subject provided, where processing rests on consent or contract and is automated. */
+    PORTABILITY = "PORTABILITY",
+    /** Art. 21(1) — objection to processing resting on public task or legitimate interests. */
+    OBJECTION = "OBJECTION",
+    /** Art. 7(3) — withdrawal of consent at any time, where processing rests on consent. */
+    WITHDRAW_CONSENT = "WITHDRAW_CONSENT",
+    /** A complaint to the supervisory authority — GDPR Art. 77(1); in the UK, the Information Commissioner (DPA 2018 s.165(2)). */
+    LODGE_COMPLAINT = "LODGE_COMPLAINT",
+    /** UK only — a complaint to the controller itself, which must acknowledge it within 30 days (DPA 2018 s.164A). */
+    COMPLAIN_TO_CONTROLLER = "COMPLAIN_TO_CONTROLLER"
+}
+/** One right as it applies to this application: the provision, and the declared purposes it covers. */
+export interface ApplicableDataSubjectRight {
+    readonly right: DataSubjectRight;
+    readonly provision: string;
+    /** The declared processing purposes the right attaches to. Every purpose for an unconditional right. */
+    readonly purposes: readonly string[];
+}
+/** The regime a declared jurisdiction falls under, or `undefined` when no known regime reaches it. */
+export declare function dataProtectionRegimeOf(jurisdictionSlug: string): DataProtectionRegime | undefined;
+/**
+ * The rights a regime grants for the declared purposes and their bases.
+ *
+ * A conditional right is listed only when at least one declared purpose meets its condition, and then only
+ * for those purposes: stating a right to object to processing that rests on contract would tell a person
+ * they may stop the service they signed up for. The complaint route is always listed — Art. 13(2)(d) requires
+ * it whatever the basis.
+ */
+export declare function rightsUnderRegime(regime: DataProtectionRegime, lawfulBases: readonly {
+    readonly purpose: string;
+    readonly basis: LawfulBasis;
+}[]): readonly ApplicableDataSubjectRight[];
+/**
+ * Where a person may complain under a regime, as a notice states it.
+ *
+ * The regime fixes the route; the operator chooses nothing here, which is why no authority is NAMED. Under
+ * the GDPR a person may complain to the authority of their own member state (Art. 77(1)) whichever authority
+ * leads for the operator, so naming only the operator's lead authority would understate the route.
+ */
+export declare function complaintRouteUnderRegime(regime: DataProtectionRegime): string;
+/** Who answers a data-subject request about one population of data. */
+export declare enum SubjectRequestResponder {
+    /** The operator is the controller of this data and answers the request itself. */
+    OPERATOR = "OPERATOR",
+    /**
+     * The operator is a PROCESSOR here: the customer that controls the data answers, and the operator forwards the
+     * request and assists (GDPR Art. 28(3)(e)). A notice saying the operator will answer would promise a decision
+     * the operator has no authority to make over its customer's records.
+     */
+    CUSTOMER_CONTROLLER = "CUSTOMER_CONTROLLER"
+}
+/**
+ * Who answers, for a role the operator holds over a population. `undefined` for a joint controllership, whose
+ * arrangement decides it and is not declared anywhere a function can read.
+ */
+export declare function subjectRequestResponderFor(role: OperatorProcessingRole): SubjectRequestResponder | undefined;
+//# sourceMappingURL=data-subject-rights.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/data-subject-rights.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-subject-rights.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/data-subject-rights.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAGpG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,mEAAmE;AACnE,oBAAY,oBAAoB;IAC9B,2DAA2D;IAC3D,OAAO,YAAY;IACnB,uGAAuG;IACvG,OAAO,YAAY;CACpB;AAQD,yDAAyD;AACzD,oBAAY,gBAAgB;IAC1B,2EAA2E;IAC3E,MAAM,WAAW;IACjB,kDAAkD;IAClD,aAAa,kBAAkB;IAC/B,+DAA+D;IAC/D,OAAO,YAAY;IACnB,2CAA2C;IAC3C,WAAW,gBAAgB;IAC3B,0HAA0H;IAC1H,WAAW,gBAAgB;IAC3B,2FAA2F;IAC3F,SAAS,cAAc;IACvB,wFAAwF;IACxF,gBAAgB,qBAAqB;IACrC,+HAA+H;IAC/H,eAAe,oBAAoB;IACnC,kHAAkH;IAClH,sBAAsB,2BAA2B;CAClD;AAED,uGAAuG;AACvG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wGAAwG;IACxG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,sGAAsG;AACtG,wBAAgB,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,oBAAoB,EAC5B,WAAW,EAAE,SAAS;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;CAAE,EAAE,GAChF,SAAS,0BAA0B,EAAE,CAiBvC;AAeD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAO9E;AAED,uEAAuE;AACvE,oBAAY,uBAAuB;IACjC,kFAAkF;IAClF,QAAQ,aAAa;IACrB;;;;OAIG;IACH,mBAAmB,wBAAwB;CAC5C;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,sBAAsB,GAAG,uBAAuB,GAAG,SAAS,CAS5G"}

package/dist/esm/compliance/privacy/data-subject-rights.shared.schemas.js

@@ -0,0 +1,146 @@
+import { LawfulBasis, OperatorProcessingRole } from './operator-compliance-identity.shared.schemas.js';
+import { jurisdictionReachCovers } from './operating-jurisdictions.shared.schemas.js';
+/**
+ * **Which data-subject rights a privacy notice must state, derived from where the application operates and
+ * the lawful bases it declares.**
+ *
+ * A notice must tell a person which rights they have (GDPR Art. 13(2)(b)–(d)). Which ones apply is not the
+ * operator's choice: the law attaches them, several of them conditionally on the lawful basis of the
+ * processing. So nobody is asked to type this list. It is a function of two declarations the application
+ * already makes — `operatingJurisdictions` and `operatorComplianceIdentity.lawfulBases` — and of the law
+ * of the regime a jurisdiction falls under, which is written down here once.
+ *
+ * spec-cite: GDPR Art. 13(2)(b)–(d), Art. 15–18, Art. 20(1), Art. 21(1), Art. 7(3), Art. 77(1).
+ * spec-cite: UK GDPR Art. 7(3), 15–18, 20, 21 (legislation.gov.uk, read 2026-09-25); Data Protection Act 2018
+ * s.164A and s.165(2) as amended by the Data (Use and Access) Act 2025 s.103, in force 19 June 2026.
+ *
+ * ## Only the regimes written here are known, and an unknown one is named rather than guessed
+ *
+ * Two regimes: the EU GDPR, reaching every EU member state through {@link jurisdictionReachCovers}, and the
+ * United Kingdom's. They are written separately although the rights match article for article, because the
+ * complaint route does not: from 19 June 2026 UK GDPR Art. 77 is omitted, a person may complain to the
+ * controller itself (DPA 2018 s.164A — acknowledged within 30 days) and to the Information Commissioner
+ * (s.165(2)). A notice that borrowed the EU wording would name a route UK law no longer has. A declared
+ * jurisdiction outside every known regime gets NO rights list and the caller names it as owed. Adding a
+ * regime is a deliberate edit to {@link DATA_PROTECTION_REGIME_REACH}, {@link rightsUnderRegime} and
+ * {@link complaintRouteUnderRegime}, with its own citations.
+ */
+/** A data-protection regime whose rights this module can state. */
+export var DataProtectionRegime;
+(function (DataProtectionRegime) {
+    /** Regulation (EU) 2016/679, for every EU member state. */
+    DataProtectionRegime["EU_GDPR"] = "EU_GDPR";
+    /** The UK GDPR with the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. */
+    DataProtectionRegime["UK_GDPR"] = "UK_GDPR";
+})(DataProtectionRegime || (DataProtectionRegime = {}));
+/** The jurisdiction each regime reaches, in the `operatingJurisdictions` slug vocabulary. */
+const DATA_PROTECTION_REGIME_REACH = {
+    [DataProtectionRegime.EU_GDPR]: 'eu',
+    [DataProtectionRegime.UK_GDPR]: 'gb',
+};
+/** A right a data subject holds against a controller. */
+export var DataSubjectRight;
+(function (DataSubjectRight) {
+    /** Art. 15 — access to their data and information about its processing. */
+    DataSubjectRight["ACCESS"] = "ACCESS";
+    /** Art. 16 — rectification of inaccurate data. */
+    DataSubjectRight["RECTIFICATION"] = "RECTIFICATION";
+    /** Art. 17 — erasure, subject to the Art. 17(3) exceptions. */
+    DataSubjectRight["ERASURE"] = "ERASURE";
+    /** Art. 18 — restriction of processing. */
+    DataSubjectRight["RESTRICTION"] = "RESTRICTION";
+    /** Art. 20 — portability of data the subject provided, where processing rests on consent or contract and is automated. */
+    DataSubjectRight["PORTABILITY"] = "PORTABILITY";
+    /** Art. 21(1) — objection to processing resting on public task or legitimate interests. */
+    DataSubjectRight["OBJECTION"] = "OBJECTION";
+    /** Art. 7(3) — withdrawal of consent at any time, where processing rests on consent. */
+    DataSubjectRight["WITHDRAW_CONSENT"] = "WITHDRAW_CONSENT";
+    /** A complaint to the supervisory authority — GDPR Art. 77(1); in the UK, the Information Commissioner (DPA 2018 s.165(2)). */
+    DataSubjectRight["LODGE_COMPLAINT"] = "LODGE_COMPLAINT";
+    /** UK only — a complaint to the controller itself, which must acknowledge it within 30 days (DPA 2018 s.164A). */
+    DataSubjectRight["COMPLAIN_TO_CONTROLLER"] = "COMPLAIN_TO_CONTROLLER";
+})(DataSubjectRight || (DataSubjectRight = {}));
+/** The regime a declared jurisdiction falls under, or `undefined` when no known regime reaches it. */
+export function dataProtectionRegimeOf(jurisdictionSlug) {
+    return Object.values(DataProtectionRegime).find((regime) => jurisdictionReachCovers(DATA_PROTECTION_REGIME_REACH[regime], jurisdictionSlug));
+}
+/**
+ * The rights a regime grants for the declared purposes and their bases.
+ *
+ * A conditional right is listed only when at least one declared purpose meets its condition, and then only
+ * for those purposes: stating a right to object to processing that rests on contract would tell a person
+ * they may stop the service they signed up for. The complaint route is always listed — Art. 13(2)(d) requires
+ * it whatever the basis.
+ */
+export function rightsUnderRegime(regime, lawfulBases) {
+    const every = lawfulBases.map((entry) => entry.purpose);
+    const where = (bases) => lawfulBases.filter((entry) => bases.includes(entry.basis)).map((entry) => entry.purpose);
+    // The UK kept the GDPR's rights articles, so one table serves both regimes; only the statute's name and the
+    // complaint provisions differ.
+    const law = regime === DataProtectionRegime.EU_GDPR ? 'GDPR' : 'UK GDPR';
+    const rights = [
+        { right: DataSubjectRight.ACCESS, provision: `${law} Art. 15`, purposes: every },
+        { right: DataSubjectRight.RECTIFICATION, provision: `${law} Art. 16`, purposes: every },
+        { right: DataSubjectRight.ERASURE, provision: `${law} Art. 17`, purposes: every },
+        { right: DataSubjectRight.RESTRICTION, provision: `${law} Art. 18`, purposes: every },
+        { right: DataSubjectRight.PORTABILITY, provision: `${law} Art. 20(1)`, purposes: where([LawfulBasis.CONSENT, LawfulBasis.CONTRACT]) },
+        { right: DataSubjectRight.OBJECTION, provision: `${law} Art. 21(1)`, purposes: where([LawfulBasis.PUBLIC_TASK, LawfulBasis.LEGITIMATE_INTERESTS]) },
+        { right: DataSubjectRight.WITHDRAW_CONSENT, provision: `${law} Art. 7(3)`, purposes: where([LawfulBasis.CONSENT]) },
+        ...complaintRights(regime, every),
+    ];
+    return rights.filter((entry) => entry.purposes.length > 0);
+}
+/** The complaint rights a regime grants — where it differs from its neighbour, which is why it is its own switch. */
+function complaintRights(regime, every) {
+    switch (regime) {
+        case DataProtectionRegime.EU_GDPR:
+            return [{ right: DataSubjectRight.LODGE_COMPLAINT, provision: 'GDPR Art. 77(1)', purposes: every }];
+        case DataProtectionRegime.UK_GDPR:
+            return [
+                { right: DataSubjectRight.COMPLAIN_TO_CONTROLLER, provision: 'Data Protection Act 2018 s.164A', purposes: every },
+                { right: DataSubjectRight.LODGE_COMPLAINT, provision: 'Data Protection Act 2018 s.165(2)', purposes: every },
+            ];
+    }
+}
+/**
+ * Where a person may complain under a regime, as a notice states it.
+ *
+ * The regime fixes the route; the operator chooses nothing here, which is why no authority is NAMED. Under
+ * the GDPR a person may complain to the authority of their own member state (Art. 77(1)) whichever authority
+ * leads for the operator, so naming only the operator's lead authority would understate the route.
+ */
+export function complaintRouteUnderRegime(regime) {
+    switch (regime) {
+        case DataProtectionRegime.EU_GDPR:
+            return 'a supervisory authority, in particular in the member state of habitual residence, place of work or place of the alleged infringement (GDPR Art. 77(1))';
+        case DataProtectionRegime.UK_GDPR:
+            return 'the operator itself, which must acknowledge the complaint within 30 days and tell you its outcome (Data Protection Act 2018 s.164A), and the Information Commissioner (s.165(2))';
+    }
+}
+/** Who answers a data-subject request about one population of data. */
+export var SubjectRequestResponder;
+(function (SubjectRequestResponder) {
+    /** The operator is the controller of this data and answers the request itself. */
+    SubjectRequestResponder["OPERATOR"] = "OPERATOR";
+    /**
+     * The operator is a PROCESSOR here: the customer that controls the data answers, and the operator forwards the
+     * request and assists (GDPR Art. 28(3)(e)). A notice saying the operator will answer would promise a decision
+     * the operator has no authority to make over its customer's records.
+     */
+    SubjectRequestResponder["CUSTOMER_CONTROLLER"] = "CUSTOMER_CONTROLLER";
+})(SubjectRequestResponder || (SubjectRequestResponder = {}));
+/**
+ * Who answers, for a role the operator holds over a population. `undefined` for a joint controllership, whose
+ * arrangement decides it and is not declared anywhere a function can read.
+ */
+export function subjectRequestResponderFor(role) {
+    switch (role) {
+        case OperatorProcessingRole.CONTROLLER:
+            return SubjectRequestResponder.OPERATOR;
+        case OperatorProcessingRole.PROCESSOR:
+            return SubjectRequestResponder.CUSTOMER_CONTROLLER;
+        case OperatorProcessingRole.JOINT_CONTROLLER:
+            return undefined;
+    }
+}
+//# sourceMappingURL=data-subject-rights.shared.schemas.js.map

package/dist/esm/compliance/privacy/data-subject-rights.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-subject-rights.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/data-subject-rights.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,mEAAmE;AACnE,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,2DAA2D;IAC3D,2CAAmB,CAAA;IACnB,uGAAuG;IACvG,2CAAmB,CAAA;AACrB,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,6FAA6F;AAC7F,MAAM,4BAA4B,GAAmD;IACnF,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI;IACpC,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI;CACrC,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAN,IAAY,gBAmBX;AAnBD,WAAY,gBAAgB;IAC1B,2EAA2E;IAC3E,qCAAiB,CAAA;IACjB,kDAAkD;IAClD,mDAA+B,CAAA;IAC/B,+DAA+D;IAC/D,uCAAmB,CAAA;IACnB,2CAA2C;IAC3C,+CAA2B,CAAA;IAC3B,0HAA0H;IAC1H,+CAA2B,CAAA;IAC3B,2FAA2F;IAC3F,2CAAuB,CAAA;IACvB,wFAAwF;IACxF,yDAAqC,CAAA;IACrC,+HAA+H;IAC/H,uDAAmC,CAAA;IACnC,kHAAkH;IAClH,qEAAiD,CAAA;AACnD,CAAC,EAnBW,gBAAgB,KAAhB,gBAAgB,QAmB3B;AAUD,sGAAsG;AACtG,MAAM,UAAU,sBAAsB,CAAC,gBAAwB;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAC/I,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA4B,EAC5B,WAAiF;IAEjF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,KAA6B,EAAY,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpJ,4GAA4G;IAC5G,+BAA+B;IAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,MAAM,GAAiC;QAC3C,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE;QAChF,EAAE,KAAK,EAAE,gBAAgB,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvF,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE;QACjF,EAAE,KAAK,EAAE,gBAAgB,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE;QACrF,EAAE,KAAK,EAAE,gBAAgB,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE;QACrI,EAAE,KAAK,EAAE,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,oBAAoB,CAAC,CAAC,EAAE;QACnJ,EAAE,KAAK,EAAE,gBAAgB,CAAC,gBAAgB,EAAE,SAAS,EAAE,GAAG,GAAG,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE;QACnH,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;KAClC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,qHAAqH;AACrH,SAAS,eAAe,CAAC,MAA4B,EAAE,KAAe;IACpE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB,CAAC,OAAO;YAC/B,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACtG,KAAK,oBAAoB,CAAC,OAAO;YAC/B,OAAO;gBACL,EAAE,KAAK,EAAE,gBAAgB,CAAC,sBAAsB,EAAE,SAAS,EAAE,iCAAiC,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACjH,EAAE,KAAK,EAAE,gBAAgB,CAAC,eAAe,EAAE,SAAS,EAAE,mCAAmC,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC7G,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAA4B;IACpE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB,CAAC,OAAO;YAC/B,OAAO,wJAAwJ,CAAC;QAClK,KAAK,oBAAoB,CAAC,OAAO;YAC/B,OAAO,kLAAkL,CAAC;IAC9L,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,kFAAkF;IAClF,gDAAqB,CAAA;IACrB;;;;OAIG;IACH,sEAA2C,CAAA;AAC7C,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA4B;IACrE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB,CAAC,UAAU;YACpC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAC1C,KAAK,sBAAsB,CAAC,SAAS;YACnC,OAAO,uBAAuB,CAAC,mBAAmB,CAAC;QACrD,KAAK,sBAAsB,CAAC,gBAAgB;YAC1C,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["import { LawfulBasis, OperatorProcessingRole } from './operator-compliance-identity.shared.schemas';\nimport { jurisdictionReachCovers } from './operating-jurisdictions.shared.schemas';\n\n/**\n * **Which data-subject rights a privacy notice must state, derived from where the application operates and\n * the lawful bases it declares.**\n *\n * A notice must tell a person which rights they have (GDPR Art. 13(2)(b)–(d)). Which ones apply is not the\n * operator's choice: the law attaches them, several of them conditionally on the lawful basis of the\n * processing. So nobody is asked to type this list. It is a function of two declarations the application\n * already makes — `operatingJurisdictions` and `operatorComplianceIdentity.lawfulBases` — and of the law\n * of the regime a jurisdiction falls under, which is written down here once.\n *\n * spec-cite: GDPR Art. 13(2)(b)–(d), Art. 15–18, Art. 20(1), Art. 21(1), Art. 7(3), Art. 77(1).\n * spec-cite: UK GDPR Art. 7(3), 15–18, 20, 21 (legislation.gov.uk, read 2026-09-25); Data Protection Act 2018\n * s.164A and s.165(2) as amended by the Data (Use and Access) Act 2025 s.103, in force 19 June 2026.\n *\n * ## Only the regimes written here are known, and an unknown one is named rather than guessed\n *\n * Two regimes: the EU GDPR, reaching every EU member state through {@link jurisdictionReachCovers}, and the\n * United Kingdom's. They are written separately although the rights match article for article, because the\n * complaint route does not: from 19 June 2026 UK GDPR Art. 77 is omitted, a person may complain to the\n * controller itself (DPA 2018 s.164A — acknowledged within 30 days) and to the Information Commissioner\n * (s.165(2)). A notice that borrowed the EU wording would name a route UK law no longer has. A declared\n * jurisdiction outside every known regime gets NO rights list and the caller names it as owed. Adding a\n * regime is a deliberate edit to {@link DATA_PROTECTION_REGIME_REACH}, {@link rightsUnderRegime} and\n * {@link complaintRouteUnderRegime}, with its own citations.\n */\n\n/** A data-protection regime whose rights this module can state. */\nexport enum DataProtectionRegime {\n  /** Regulation (EU) 2016/679, for every EU member state. */\n  EU_GDPR = 'EU_GDPR',\n  /** The UK GDPR with the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. */\n  UK_GDPR = 'UK_GDPR',\n}\n\n/** The jurisdiction each regime reaches, in the `operatingJurisdictions` slug vocabulary. */\nconst DATA_PROTECTION_REGIME_REACH: Readonly<Record<DataProtectionRegime, string>> = {\n  [DataProtectionRegime.EU_GDPR]: 'eu',\n  [DataProtectionRegime.UK_GDPR]: 'gb',\n};\n\n/** A right a data subject holds against a controller. */\nexport enum DataSubjectRight {\n  /** Art. 15 — access to their data and information about its processing. */\n  ACCESS = 'ACCESS',\n  /** Art. 16 — rectification of inaccurate data. */\n  RECTIFICATION = 'RECTIFICATION',\n  /** Art. 17 — erasure, subject to the Art. 17(3) exceptions. */\n  ERASURE = 'ERASURE',\n  /** Art. 18 — restriction of processing. */\n  RESTRICTION = 'RESTRICTION',\n  /** Art. 20 — portability of data the subject provided, where processing rests on consent or contract and is automated. */\n  PORTABILITY = 'PORTABILITY',\n  /** Art. 21(1) — objection to processing resting on public task or legitimate interests. */\n  OBJECTION = 'OBJECTION',\n  /** Art. 7(3) — withdrawal of consent at any time, where processing rests on consent. */\n  WITHDRAW_CONSENT = 'WITHDRAW_CONSENT',\n  /** A complaint to the supervisory authority — GDPR Art. 77(1); in the UK, the Information Commissioner (DPA 2018 s.165(2)). */\n  LODGE_COMPLAINT = 'LODGE_COMPLAINT',\n  /** UK only — a complaint to the controller itself, which must acknowledge it within 30 days (DPA 2018 s.164A). */\n  COMPLAIN_TO_CONTROLLER = 'COMPLAIN_TO_CONTROLLER',\n}\n\n/** One right as it applies to this application: the provision, and the declared purposes it covers. */\nexport interface ApplicableDataSubjectRight {\n  readonly right: DataSubjectRight;\n  readonly provision: string;\n  /** The declared processing purposes the right attaches to. Every purpose for an unconditional right. */\n  readonly purposes: readonly string[];\n}\n\n/** The regime a declared jurisdiction falls under, or `undefined` when no known regime reaches it. */\nexport function dataProtectionRegimeOf(jurisdictionSlug: string): DataProtectionRegime | undefined {\n  return Object.values(DataProtectionRegime).find((regime) => jurisdictionReachCovers(DATA_PROTECTION_REGIME_REACH[regime], jurisdictionSlug));\n}\n\n/**\n * The rights a regime grants for the declared purposes and their bases.\n *\n * A conditional right is listed only when at least one declared purpose meets its condition, and then only\n * for those purposes: stating a right to object to processing that rests on contract would tell a person\n * they may stop the service they signed up for. The complaint route is always listed — Art. 13(2)(d) requires\n * it whatever the basis.\n */\nexport function rightsUnderRegime(\n  regime: DataProtectionRegime,\n  lawfulBases: readonly { readonly purpose: string; readonly basis: LawfulBasis }[],\n): readonly ApplicableDataSubjectRight[] {\n  const every = lawfulBases.map((entry) => entry.purpose);\n  const where = (bases: readonly LawfulBasis[]): string[] => lawfulBases.filter((entry) => bases.includes(entry.basis)).map((entry) => entry.purpose);\n  // The UK kept the GDPR's rights articles, so one table serves both regimes; only the statute's name and the\n  // complaint provisions differ.\n  const law = regime === DataProtectionRegime.EU_GDPR ? 'GDPR' : 'UK GDPR';\n  const rights: ApplicableDataSubjectRight[] = [\n    { right: DataSubjectRight.ACCESS, provision: `${law} Art. 15`, purposes: every },\n    { right: DataSubjectRight.RECTIFICATION, provision: `${law} Art. 16`, purposes: every },\n    { right: DataSubjectRight.ERASURE, provision: `${law} Art. 17`, purposes: every },\n    { right: DataSubjectRight.RESTRICTION, provision: `${law} Art. 18`, purposes: every },\n    { right: DataSubjectRight.PORTABILITY, provision: `${law} Art. 20(1)`, purposes: where([LawfulBasis.CONSENT, LawfulBasis.CONTRACT]) },\n    { right: DataSubjectRight.OBJECTION, provision: `${law} Art. 21(1)`, purposes: where([LawfulBasis.PUBLIC_TASK, LawfulBasis.LEGITIMATE_INTERESTS]) },\n    { right: DataSubjectRight.WITHDRAW_CONSENT, provision: `${law} Art. 7(3)`, purposes: where([LawfulBasis.CONSENT]) },\n    ...complaintRights(regime, every),\n  ];\n  return rights.filter((entry) => entry.purposes.length > 0);\n}\n\n/** The complaint rights a regime grants — where it differs from its neighbour, which is why it is its own switch. */\nfunction complaintRights(regime: DataProtectionRegime, every: string[]): ApplicableDataSubjectRight[] {\n  switch (regime) {\n    case DataProtectionRegime.EU_GDPR:\n      return [{ right: DataSubjectRight.LODGE_COMPLAINT, provision: 'GDPR Art. 77(1)', purposes: every }];\n    case DataProtectionRegime.UK_GDPR:\n      return [\n        { right: DataSubjectRight.COMPLAIN_TO_CONTROLLER, provision: 'Data Protection Act 2018 s.164A', purposes: every },\n        { right: DataSubjectRight.LODGE_COMPLAINT, provision: 'Data Protection Act 2018 s.165(2)', purposes: every },\n      ];\n  }\n}\n\n/**\n * Where a person may complain under a regime, as a notice states it.\n *\n * The regime fixes the route; the operator chooses nothing here, which is why no authority is NAMED. Under\n * the GDPR a person may complain to the authority of their own member state (Art. 77(1)) whichever authority\n * leads for the operator, so naming only the operator's lead authority would understate the route.\n */\nexport function complaintRouteUnderRegime(regime: DataProtectionRegime): string {\n  switch (regime) {\n    case DataProtectionRegime.EU_GDPR:\n      return 'a supervisory authority, in particular in the member state of habitual residence, place of work or place of the alleged infringement (GDPR Art. 77(1))';\n    case DataProtectionRegime.UK_GDPR:\n      return 'the operator itself, which must acknowledge the complaint within 30 days and tell you its outcome (Data Protection Act 2018 s.164A), and the Information Commissioner (s.165(2))';\n  }\n}\n\n/** Who answers a data-subject request about one population of data. */\nexport enum SubjectRequestResponder {\n  /** The operator is the controller of this data and answers the request itself. */\n  OPERATOR = 'OPERATOR',\n  /**\n   * The operator is a PROCESSOR here: the customer that controls the data answers, and the operator forwards the\n   * request and assists (GDPR Art. 28(3)(e)). A notice saying the operator will answer would promise a decision\n   * the operator has no authority to make over its customer's records.\n   */\n  CUSTOMER_CONTROLLER = 'CUSTOMER_CONTROLLER',\n}\n\n/**\n * Who answers, for a role the operator holds over a population. `undefined` for a joint controllership, whose\n * arrangement decides it and is not declared anywhere a function can read.\n */\nexport function subjectRequestResponderFor(role: OperatorProcessingRole): SubjectRequestResponder | undefined {\n  switch (role) {\n    case OperatorProcessingRole.CONTROLLER:\n      return SubjectRequestResponder.OPERATOR;\n    case OperatorProcessingRole.PROCESSOR:\n      return SubjectRequestResponder.CUSTOMER_CONTROLLER;\n    case OperatorProcessingRole.JOINT_CONTROLLER:\n      return undefined;\n  }\n}\n"]}

package/dist/esm/compliance/privacy/impersonalization-scrub.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impersonalization-scrub.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/impersonalization-scrub.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,qDAAa,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAoEpG;AAED,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,SAAS,MAAM,EAAE,CAS7F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8C9F"}
+{"version":3,"file":"impersonalization-scrub.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/impersonalization-scrub.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,qDAAa,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAoEpG;AAED,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,SAAS,MAAM,EAAE,CAS7F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8C9F"}