npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.6 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1399) hide show

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { z } from 'zod';
-import { DataProcessingConsent } from './privacy.shared.schemas.js';
+import { ConsentPurpose } from './consent-purposes.shared.js';
+import { LawfulBasisPurposeRefSchema } from './purpose-ref.shared.schemas.js';
 /**
  * GDPR Art. 6(1) — the six lawful bases, closed by the article.
  *
@@ -8,6 +9,8 @@ import { DataProcessingConsent } from './privacy.shared.schemas.js';
  * must name the law. "We have a lawful basis" is not a disclosure; a notice must say WHICH.
  *
  * spec-cite: GDPR Art. 6(1)(a)–(f).
+ *
+ * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.
  */
 export var LawfulBasis;
 (function (LawfulBasis) {
@@ -46,19 +49,40 @@ export var OperatorProcessingRole;
  * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the
  * account and billing data of the people who administer them — simultaneously, in one product.
  *
- * `dataScope` is prose the operator writes, deliberately. Nothing structured exists to key it to: the
- * processing purposes a notice states are derived from the application's vision and requirements as
- * PROSE, so a ref here would point at nothing.
+ * `dataScope` is prose the operator writes, deliberately: it names a POPULATION of data ("customer records in a
+ * workspace"), not a processing purpose, so a lawful basis's `purposeRef` (#1709) is not what it would key to. No
+ * structured population vocabulary exists yet, and a ref to nothing would be worse than prose.
  */
 export const OperatorRoleAllocationSchema = z.strictObject({
     /** Which data this role covers, in the operator's own words — "customer records in a workspace". */
     dataScope: z.string().trim().min(1),
     role: z.enum(OperatorProcessingRole),
+    /**
+     * The resource types this role covers — the TYPED half of `dataScope` (#1710), so a running erasure or export can
+     * say who owes the Art. 19 communication for the subject in front of it. Optional: an allocation in prose only is
+     * still a valid statement for a notice, and a subject whose resource type no allocation names is reported as
+     * ROLE UNDECLARED, never guessed. `dataScope` stays the words a notice uses.
+     */
+    resourceTypes: z.array(z.string().trim().min(1)).min(1).optional(),
 });
-/** One processing purpose and the basis the operator relies on for it. */
+/**
+ * One processing purpose and the basis the operator relies on for it.
+ *
+ * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.
+ */
 export const OperatorLawfulBasisSchema = z.strictObject({
     /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */
     purpose: z.string().trim().min(1),
+    /**
+     * A STABLE id for this purpose, which a provider's or a system of record's compliance choice names
+     * (`providerComplianceChoices.<ref>.purposeRefs`) to say which purpose sending it data serves (#1709).
+     *
+     * Separate from `purpose` because the prose is the notice's wording and changes when the operator rewords it, while
+     * a link to it must survive the rewording. OPTIONAL, like every other part of this identity (#225): a basis with no
+     * ref is still a basis, and a recipient cannot link to it — which the recipients report names as a purpose not
+     * linked, never as a recipient with no purpose.
+     */
+    purposeRef: LawfulBasisPurposeRefSchema.optional(),
     basis: z.enum(LawfulBasis),
     /**
      * The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis
@@ -85,7 +109,7 @@ export const OperatorLawfulBasisSchema = z.strictObject({
  *
  * ## The near-miss this exists because of
  *
- * `analytics.requiredConsent` already exists and governs ANALYTICS alone. The compliance partial
+ * `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial
  * described it as "the minimum a person must give to use the service" until 2026-08-30 — a much
  * larger claim about a much narrower field. A drafter following that wording would have published
  * that a person must consent to analytics in order to use the product: false, and false about the one
@@ -95,50 +119,83 @@ export const OperatorLawfulBasisSchema = z.strictObject({
  * *"There is no declared surface for recording a service-wide consent requirement distinct from
  * analytics consent."* This is that surface.
  *
- * ## Why the floor may be NONE, and usually should be
+ * ## Why the required set may be empty, and usually should be
  *
  * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is
  * CONTRACT — a person uses the product because their employer signed for it, not because they
- * consented. A required level above `NONE` says the opposite, so declaring one is a claim about the
+ * consented. A non-empty required set says the opposite, so declaring one is a claim about the
  * lawful basis and not merely a UI gate.
  *
- * `NONE` is therefore both the default and the honest answer for most applications: *nothing is
- * gated on consent; the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*
+ * An EMPTY set is therefore the honest answer for most applications: *nothing is gated on consent;
+ * the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*
  * A field that pushed applications toward declaring consent would be worse than the gap it closes.
  *
- * ⚠️ Declaring a level here does NOT make consent the lawful basis for anything. It states a gate.
+ * ## This is the ENFORCED half of the identity (#453)
+ *
+ * Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is
+ * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is
+ * the exception. `wildo config service-consent` projects it into the running application's
+ * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in
+ * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,
+ * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the
+ * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),
+ * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push
+ * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an
+ * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they
+ * already started. Signing in, refreshing a session and signing out are not resource operations and stay
+ * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count
+ * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in
+ * place of every signed-in route. A reader of
+ * this schema must be able to tell the two apart without tracing the runtime, which is why it is said
+ * here.
+ *
+ * ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.
  * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer
  * needs to see rather than one the schema should quietly reconcile.
  */
 export const ServiceConsentRequirementSchema = z.strictObject({
     /**
-     * The minimum consent a person must give to use the service.
+     * The purposes a person must grant before they may use the service — a SET, never a level (#453).
+     *
+     * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a
+     * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is
+     * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.
      *
-     * `NONE` means nothing is gated on consent — the common and usually correct answer. It is a
-     * DECLARATION, not an absence: an application that says `NONE` has answered the question, which is
-     * what separates it from one that has not been asked.
+     * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that
+     * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.
      */
-    requiredLevel: z.enum(DataProcessingConsent),
+    requiredPurposes: z.array(z.enum(ConsentPurpose)),
     /**
      * What this gate actually controls, in the operator's own words.
      *
-     * REQUIRED whenever the level is above `NONE`, because a gate nobody can describe is a gate nobody
+     * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody
      * can honour — enforced below. A notice stating "consent is required" without saying what it
      * governs tells a person they must agree to something unnamed.
      */
     gatedProcessing: z.string().trim().min(1).optional(),
 }).superRefine((requirement, context) => {
     /*
-     * A required level above NONE with nothing described is the shape that satisfies the field and
-     * discloses nothing — the same defect as a revision recording no superseded rationale, and as a
+     * A required purpose with nothing described is the shape that satisfies the field and discloses
+     * nothing — the same defect as a revision recording no superseded rationale, and as a
      * legitimate-interests basis with no assessment. Each time, the value is the easy half and the
      * explanation is the half that makes it mean anything.
      */
-    if (requirement.requiredLevel !== DataProcessingConsent.NONE && requirement.gatedProcessing === undefined) {
+    if (requirement.requiredPurposes.length > 0 && requirement.gatedProcessing === undefined) {
         context.addIssue({
             code: 'custom',
             path: ['gatedProcessing'],
-            message: `a required consent level of ${requirement.requiredLevel} gates something — say what, or declare NONE. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,
+            message: `requiring consent to ${requirement.requiredPurposes.join(', ')} gates something — say what, or declare no required purposes. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,
+        });
+    }
+    /*
+     * A purpose listed twice is not a stronger requirement, and a set that reads differently from how it
+     * compares is how two surfaces come to describe one gate differently.
+     */
+    if (new Set(requirement.requiredPurposes).size !== requirement.requiredPurposes.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['requiredPurposes'],
+            message: 'a required purpose is listed more than once — a set names each purpose once',
         });
     }
 });
@@ -183,7 +240,7 @@ export const ServiceConsentRequirementSchema = z.strictObject({
  * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.
  *
  * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still
- * requires its assessment, and a consent level above `NONE` still requires what it gates. Those
+ * requires its assessment, and a non-empty required purpose set still requires what it gates. Those
  * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a
  * partial declaration is honest, a self-contradicting one is not.
  */
@@ -223,15 +280,37 @@ export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
      * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a
      * complete answer.
      */
-    lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).optional(),
+    lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).superRefine((bases, context) => {
+        // A purpose ref names ONE purpose, or a recipient linking to it would be linked to two (#1709).
+        const seen = new Set();
+        bases.forEach((entry, index) => {
+            if (entry.purposeRef === undefined)
+                return;
+            if (seen.has(entry.purposeRef)) {
+                context.addIssue({ code: 'custom', path: [index, 'purposeRef'], message: `purpose ref "${entry.purposeRef}" names more than one purpose` });
+            }
+            seen.add(entry.purposeRef);
+        });
+    }).optional(),
     /**
      * What a person must consent to in order to use the service at all (issue #139).
      *
-     * OPTIONAL, and absent means UNANSWERED rather than `NONE`. The distinction is the one this whole
-     * lane turns on: a declared `NONE` is the operator saying nothing is gated on consent, while
+     * OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this
+     * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while
      * absence is nobody having been asked, and a notice must not render the second as the first.
      */
     serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),
+    /**
+     * How the operator confirms that a person exercising a data-subject right is that person, before acting.
+     *
+     * The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the
+     * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step
+     * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).
+     * Prose, because procedures differ — "requests from a signed-in account are verified by that session;
+     * requests by email are answered at the account's address". Absent means undecided, and the
+     * `rights-and-complaint-route` fact then answers nothing (#454).
+     */
+    subjectRequestIdentityVerification: z.string().trim().min(1).optional(),
 }).superRefine((identity, context) => {
     /*
      * A declaration with nothing in it is a no-op that reads as an answer.
@@ -262,7 +341,7 @@ export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
  * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are
  * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no
  * Art. 27 representative, and a declared absence of a consent gate is expressed by
- * `serviceConsentRequirement.requiredLevel = NONE`, which is a value rather than an omission. Listing
+ * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing
  * them would report every correct identity as incomplete.
  */
 export var OperatorComplianceIdentityPart;
@@ -272,6 +351,7 @@ export var OperatorComplianceIdentityPart;
     OperatorComplianceIdentityPart["PRIVACY_CONTACT"] = "privacyContact";
     OperatorComplianceIdentityPart["ROLE_ALLOCATIONS"] = "roleAllocations";
     OperatorComplianceIdentityPart["LAWFUL_BASES"] = "lawfulBases";
+    OperatorComplianceIdentityPart["SUBJECT_REQUEST_IDENTITY_VERIFICATION"] = "subjectRequestIdentityVerification";
 })(OperatorComplianceIdentityPart || (OperatorComplianceIdentityPart = {}));
 /**
  * Which parts of the identity are still owed, in declaration order.
@@ -288,6 +368,7 @@ export function outstandingOperatorComplianceIdentityParts(identity) {
         identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,
         identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,
         identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,
+        identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,
     ].filter((part) => part !== undefined);
 }
 /**

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACrC,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,aAAa,KAAK,qBAAqB,CAAC,IAAI,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,+BAA+B,WAAW,CAAC,aAAa,4KAA4K;SAC9O,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACtE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;AAC9B,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KAC9F,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { DataProcessingConsent } from './privacy.shared.schemas';\n\n/*\n GDPR Art. 6(1) — the six lawful bases, closed by the article.\n \n Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n \n spec-cite: GDPR Art. 6(1)(a)–(f).\n /\nexport enum LawfulBasis {\n /* Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. /\n CONSENT = 'CONSENT',\n /* Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. /\n CONTRACT = 'CONTRACT',\n /* Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. /\n LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n /* Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. /\n VITAL_INTERESTS = 'VITAL_INTERESTS',\n /* Art. 6(1)(e) — necessary for a task in the public interest or official authority. /\n PUBLIC_TASK = 'PUBLIC_TASK',\n /\n Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n * is refused below.\n /\n LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/* Whether the operator decides the purposes of a processing, carries them out for someone else, or both. /\nexport enum OperatorProcessingRole {\n /* The operator determines the purposes and means. /\n CONTROLLER = 'CONTROLLER',\n /* The operator processes on a customer's documented instructions — the usual B2B posture for customer records. /\n PROCESSOR = 'PROCESSOR',\n /* The operator and another party jointly determine purposes and means, and must have an arrangement saying how. /\n JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/\n ONE role, over ONE population of data.\n \n A single role field would be the wrong shape, and the produced notice said so before this existed:\n * \"This notice therefore does not assign a single legal role to all data processed in a workspace.\"\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n \n `dataScope` is prose the operator writes, deliberately. Nothing structured exists to key it to: the\n * processing purposes a notice states are derived from the application's vision and requirements as\n * PROSE, so a ref here would point at nothing.\n /\nexport const OperatorRoleAllocationSchema = z.strictObject({\n /* Which data this role covers, in the operator's own words — \"customer records in a workspace\". /\n dataScope: z.string().trim().min(1),\n role: z.enum(OperatorProcessingRole),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/* One processing purpose and the basis the operator relies on for it. /\nexport const OperatorLawfulBasisSchema = z.strictObject({\n /* The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. /\n purpose: z.string().trim().min(1),\n basis: z.enum(LawfulBasis),\n /\n The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n * that needs a balancing test — see the superRefine below.\n /\n assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n /\n * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n * conclusion nobody reached.\n /\n if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n context.addIssue({\n code: 'custom',\n path: ['assessmentNote'],\n message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n });\n }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/\n What a person must agree to in order to USE the service at all (issue #139).\n \n ## The near-miss this exists because of\n \n `analytics.requiredConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n \n Correcting it left a real hole, which a produced notice then reported in its own words:\n * \"There is no declared surface for recording a service-wide consent requirement distinct from\n analytics consent.\"* This is that surface.\n \n ## Why the floor may be NONE, and usually should be\n \n Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A required level above `NONE` says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n \n `NONE` is therefore both the default and the honest answer for most applications: nothing is\n gated on consent; the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.\n A field that pushed applications toward declaring consent would be worse than the gap it closes.\n \n ⚠️ Declaring a level here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n /\nexport const ServiceConsentRequirementSchema = z.strictObject({\n /\n The minimum consent a person must give to use the service.\n \n `NONE` means nothing is gated on consent — the common and usually correct answer. It is a\n * DECLARATION, not an absence: an application that says `NONE` has answered the question, which is\n * what separates it from one that has not been asked.\n /\n requiredLevel: z.enum(DataProcessingConsent),\n /\n What this gate actually controls, in the operator's own words.\n \n REQUIRED whenever the level is above `NONE`, because a gate nobody can describe is a gate nobody\n * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n * governs tells a person they must agree to something unnamed.\n /\n gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n /\n * A required level above NONE with nothing described is the shape that satisfies the field and\n * discloses nothing — the same defect as a revision recording no superseded rationale, and as a\n * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n * explanation is the half that makes it mean anything.\n /\n if (requirement.requiredLevel !== DataProcessingConsent.NONE && requirement.gatedProcessing === undefined) {\n context.addIssue({\n code: 'custom',\n path: ['gatedProcessing'],\n message: `a required consent level of ${requirement.requiredLevel} gates something — say what, or declare NONE. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n });\n }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/\n WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n \n ## Why this exists, and why in configuration\n \n A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n \n That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n \n Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n \n ## What is deliberately NOT here\n \n A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n \n ## Every part is independently declarable, and that is the point (issue #228)\n \n This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n \n Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n \n What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a consent level above `NONE` still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n /\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n /* The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. /\n legalEntityName: z.string().trim().min(1).optional(),\n /* Its registered address, as a reader would need it to serve a request. Absent means unanswered. /\n registeredAddress: z.string().trim().min(1).optional(),\n /\n How a data subject reaches the operator about privacy — an address, an email, or a URL.\n \n Open string because all three are legitimate and the law names none: what matters is that a route\n * exists and is stated, not what shape it takes.\n /\n privacyContact: z.string().trim().min(1).optional(),\n /\n An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n \n Optional, because most operators are established where their subjects are and appointing one\n * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n * when declared.\n /\n representative: z.strictObject({\n name: z.string().trim().min(1),\n address: z.string().trim().min(1),\n }).optional(),\n /\n The operator's role, per population of data. At least one.\n \n See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n /\n roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n /\n The lawful basis relied on, per processing purpose. At least one.\n \n `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n * complete answer.\n /\n lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).optional(),\n /\n What a person must consent to in order to use the service at all (issue #139).\n \n OPTIONAL, and absent means UNANSWERED rather than `NONE`. The distinction is the one this whole\n * lane turns on: a declared `NONE` is the operator saying nothing is gated on consent, while\n * absence is nobody having been asked, and a notice must not render the second as the first.\n /\n serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n}).superRefine((identity, context) => {\n /\n * A declaration with nothing in it is a no-op that reads as an answer.\n \n Every part is independently optional so an operator can record the half they know (#228), and the\n * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n * consumer already renders as outstanding, while an empty object would satisfy the field and\n * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n * with no assessment and a consent gate that names nothing.\n /\n if (Object.values(identity).every((part) => part === undefined)) {\n context.addIssue({\n code: 'custom',\n path: [],\n message:\n 'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n });\n }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/\n The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n \n A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n \n `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredLevel = NONE`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n /\nexport enum OperatorComplianceIdentityPart {\n LEGAL_ENTITY_NAME = 'legalEntityName',\n REGISTERED_ADDRESS = 'registeredAddress',\n PRIVACY_CONTACT = 'privacyContact',\n ROLE_ALLOCATIONS = 'roleAllocations',\n LAWFUL_BASES = 'lawfulBases',\n}\n\n/\n Which parts of the identity are still owed, in declaration order.\n \n Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n /\nexport function outstandingOperatorComplianceIdentityParts(\n identity: ApplicationOperatorComplianceIdentity \| undefined,\n): readonly OperatorComplianceIdentityPart[] {\n return [\n identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/\n The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n \n `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n /\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] \| undefined {\n if (identity.lawfulBases === undefined) return undefined;\n const order = Object.values(LawfulBasis);\n return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/\n True when the operator declares more than one role, so a notice must not assign a single one.\n \n `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean \| undefined {\n if (identity.roleAllocations === undefined) return undefined;\n return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}
1	+ {"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACpC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,UAAU,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,wBAAwB,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,4LAA4L;SACrQ,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACvF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACpF,gGAAgG;QAChG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,KAAK,CAAC,UAAU,+BAA+B,EAAE,CAAC,CAAC;YAC9I,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACrE;;;;;;;;;OASG;IACH,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;IAC5B,8GAA4E,CAAA;AAC9E,CAAC,EAPW,8BAA8B,KAA9B,8BAA8B,QAOzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7F,QAAQ,EAAE,kCAAkC,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS;KAC9I,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { ConsentPurpose } from './consent-purposes.shared';\nimport { LawfulBasisPurposeRefSchema } from './purpose-ref.shared.schemas';\n\n/*\n GDPR Art. 6(1) — the six lawful bases, closed by the article.\n \n Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n \n spec-cite: GDPR Art. 6(1)(a)–(f).\n \n assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.\n /\nexport enum LawfulBasis {\n /* Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. /\n CONSENT = 'CONSENT',\n /* Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. /\n CONTRACT = 'CONTRACT',\n /* Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. /\n LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n /* Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. /\n VITAL_INTERESTS = 'VITAL_INTERESTS',\n /* Art. 6(1)(e) — necessary for a task in the public interest or official authority. /\n PUBLIC_TASK = 'PUBLIC_TASK',\n /\n Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n * is refused below.\n /\n LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/* Whether the operator decides the purposes of a processing, carries them out for someone else, or both. /\nexport enum OperatorProcessingRole {\n /* The operator determines the purposes and means. /\n CONTROLLER = 'CONTROLLER',\n /* The operator processes on a customer's documented instructions — the usual B2B posture for customer records. /\n PROCESSOR = 'PROCESSOR',\n /* The operator and another party jointly determine purposes and means, and must have an arrangement saying how. /\n JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/\n ONE role, over ONE population of data.\n \n A single role field would be the wrong shape, and the produced notice said so before this existed:\n * \"This notice therefore does not assign a single legal role to all data processed in a workspace.\"\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n \n `dataScope` is prose the operator writes, deliberately: it names a POPULATION of data (\"customer records in a\n * workspace\"), not a processing purpose, so a lawful basis's `purposeRef` (#1709) is not what it would key to. No\n * structured population vocabulary exists yet, and a ref to nothing would be worse than prose.\n /\nexport const OperatorRoleAllocationSchema = z.strictObject({\n /* Which data this role covers, in the operator's own words — \"customer records in a workspace\". /\n dataScope: z.string().trim().min(1),\n role: z.enum(OperatorProcessingRole),\n /\n The resource types this role covers — the TYPED half of `dataScope` (#1710), so a running erasure or export can\n * say who owes the Art. 19 communication for the subject in front of it. Optional: an allocation in prose only is\n * still a valid statement for a notice, and a subject whose resource type no allocation names is reported as\n * ROLE UNDECLARED, never guessed. `dataScope` stays the words a notice uses.\n /\n resourceTypes: z.array(z.string().trim().min(1)).min(1).optional(),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/\n One processing purpose and the basis the operator relies on for it.\n \n assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.\n /\nexport const OperatorLawfulBasisSchema = z.strictObject({\n /* The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. /\n purpose: z.string().trim().min(1),\n /\n A STABLE id for this purpose, which a provider's or a system of record's compliance choice names\n * (`providerComplianceChoices.<ref>.purposeRefs`) to say which purpose sending it data serves (#1709).\n \n Separate from `purpose` because the prose is the notice's wording and changes when the operator rewords it, while\n * a link to it must survive the rewording. OPTIONAL, like every other part of this identity (#225): a basis with no\n * ref is still a basis, and a recipient cannot link to it — which the recipients report names as a purpose not\n * linked, never as a recipient with no purpose.\n /\n purposeRef: LawfulBasisPurposeRefSchema.optional(),\n basis: z.enum(LawfulBasis),\n /\n The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n * that needs a balancing test — see the superRefine below.\n /\n assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n /\n * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n * conclusion nobody reached.\n /\n if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n context.addIssue({\n code: 'custom',\n path: ['assessmentNote'],\n message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n });\n }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/\n What a person must agree to in order to USE the service at all (issue #139).\n \n ## The near-miss this exists because of\n \n `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n \n Correcting it left a real hole, which a produced notice then reported in its own words:\n * \"There is no declared surface for recording a service-wide consent requirement distinct from\n analytics consent.\"* This is that surface.\n \n ## Why the required set may be empty, and usually should be\n \n Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A non-empty required set says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n \n An EMPTY set is therefore the honest answer for most applications: nothing is gated on consent;\n the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.\n A field that pushed applications toward declaring consent would be worse than the gap it closes.\n \n ## This is the ENFORCED half of the identity (#453)\n \n Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is\n * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is\n * the exception. `wildo config service-consent` projects it into the running application's\n * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in\n * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,\n * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the\n * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),\n * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push\n * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an\n * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they\n * already started. Signing in, refreshing a session and signing out are not resource operations and stay\n * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count\n * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in\n * place of every signed-in route. A reader of\n * this schema must be able to tell the two apart without tracing the runtime, which is why it is said\n * here.\n \n ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n /\nexport const ServiceConsentRequirementSchema = z.strictObject({\n /\n The purposes a person must grant before they may use the service — a SET, never a level (#453).\n \n EMPTY means nothing is gated on consent — the common and usually correct answer. It is a\n * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is\n * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.\n \n Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that\n * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.\n /\n requiredPurposes: z.array(z.enum(ConsentPurpose)),\n /\n What this gate actually controls, in the operator's own words.\n \n REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody\n * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n * governs tells a person they must agree to something unnamed.\n /\n gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n /\n * A required purpose with nothing described is the shape that satisfies the field and discloses\n * nothing — the same defect as a revision recording no superseded rationale, and as a\n * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n * explanation is the half that makes it mean anything.\n /\n if (requirement.requiredPurposes.length > 0 && requirement.gatedProcessing === undefined) {\n context.addIssue({\n code: 'custom',\n path: ['gatedProcessing'],\n message: `requiring consent to ${requirement.requiredPurposes.join(', ')} gates something — say what, or declare no required purposes. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n });\n }\n /\n * A purpose listed twice is not a stronger requirement, and a set that reads differently from how it\n * compares is how two surfaces come to describe one gate differently.\n /\n if (new Set(requirement.requiredPurposes).size !== requirement.requiredPurposes.length) {\n context.addIssue({\n code: 'custom',\n path: ['requiredPurposes'],\n message: 'a required purpose is listed more than once — a set names each purpose once',\n });\n }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/\n WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n \n ## Why this exists, and why in configuration\n \n A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n \n That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n \n Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n \n ## What is deliberately NOT here\n \n A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n \n ## Every part is independently declarable, and that is the point (issue #228)\n \n This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n \n Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n \n What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a non-empty required purpose set still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n /\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n /* The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. /\n legalEntityName: z.string().trim().min(1).optional(),\n /* Its registered address, as a reader would need it to serve a request. Absent means unanswered. /\n registeredAddress: z.string().trim().min(1).optional(),\n /\n How a data subject reaches the operator about privacy — an address, an email, or a URL.\n \n Open string because all three are legitimate and the law names none: what matters is that a route\n * exists and is stated, not what shape it takes.\n /\n privacyContact: z.string().trim().min(1).optional(),\n /\n An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n \n Optional, because most operators are established where their subjects are and appointing one\n * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n * when declared.\n /\n representative: z.strictObject({\n name: z.string().trim().min(1),\n address: z.string().trim().min(1),\n }).optional(),\n /\n The operator's role, per population of data. At least one.\n \n See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n /\n roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n /\n The lawful basis relied on, per processing purpose. At least one.\n \n `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n * complete answer.\n /\n lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).superRefine((bases, context) => {\n // A purpose ref names ONE purpose, or a recipient linking to it would be linked to two (#1709).\n const seen = new Set<string>();\n bases.forEach((entry, index) => {\n if (entry.purposeRef === undefined) return;\n if (seen.has(entry.purposeRef)) {\n context.addIssue({ code: 'custom', path: [index, 'purposeRef'], message: `purpose ref \"${entry.purposeRef}\" names more than one purpose` });\n }\n seen.add(entry.purposeRef);\n });\n }).optional(),\n /\n What a person must consent to in order to use the service at all (issue #139).\n \n OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this\n * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while\n * absence is nobody having been asked, and a notice must not render the second as the first.\n /\n serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n /\n How the operator confirms that a person exercising a data-subject right is that person, before acting.\n \n The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the\n * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step\n * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).\n * Prose, because procedures differ — \"requests from a signed-in account are verified by that session;\n * requests by email are answered at the account's address\". Absent means undecided, and the\n * `rights-and-complaint-route` fact then answers nothing (#454).\n /\n subjectRequestIdentityVerification: z.string().trim().min(1).optional(),\n}).superRefine((identity, context) => {\n /\n * A declaration with nothing in it is a no-op that reads as an answer.\n \n Every part is independently optional so an operator can record the half they know (#228), and the\n * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n * consumer already renders as outstanding, while an empty object would satisfy the field and\n * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n * with no assessment and a consent gate that names nothing.\n /\n if (Object.values(identity).every((part) => part === undefined)) {\n context.addIssue({\n code: 'custom',\n path: [],\n message:\n 'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n });\n }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/\n The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n \n A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n \n `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n /\nexport enum OperatorComplianceIdentityPart {\n LEGAL_ENTITY_NAME = 'legalEntityName',\n REGISTERED_ADDRESS = 'registeredAddress',\n PRIVACY_CONTACT = 'privacyContact',\n ROLE_ALLOCATIONS = 'roleAllocations',\n LAWFUL_BASES = 'lawfulBases',\n SUBJECT_REQUEST_IDENTITY_VERIFICATION = 'subjectRequestIdentityVerification',\n}\n\n/\n Which parts of the identity are still owed, in declaration order.\n \n Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n /\nexport function outstandingOperatorComplianceIdentityParts(\n identity: ApplicationOperatorComplianceIdentity \| undefined,\n): readonly OperatorComplianceIdentityPart[] {\n return [\n identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,\n ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/\n The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n \n `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n /\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] \| undefined {\n if (identity.lawfulBases === undefined) return undefined;\n const order = Object.values(LawfulBasis);\n return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/\n True when the operator declares more than one role, so a notice must not assign a single one.\n \n `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean \| undefined {\n if (identity.roleAllocations === undefined) return undefined;\n return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}

package/dist/esm/compliance/privacy/personal-data-category.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}
1	+ {"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}

package/dist/esm/compliance/privacy/personal-data-declaration.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["~~../../../../~~src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}
1	+ {"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts CHANGED Viewed

@@ -4,6 +4,8 @@
  * Privacy-related schemas and enums for user data management
  */
 import { z } from "zod";
+import "@wildo-ai/zod-decorators";
+import { ConsentPurpose } from "./consent-purposes.shared";
 /**
  * Profile Visibility Enum
  *
@@ -20,18 +22,6 @@ export declare enum OrganizationProfileVisibility {
     APPLICATION_INTERNAL = "application_internal",// Visible within application, for connected users only
     PRIVATE = "private"
 }
-export declare enum DataProcessingConsent {
-    NONE = "none",
-    BASIC = "basic",
-    ANALYTICS = "analytics",
-    MARKETING = "marketing",
-    FULL = "full"
-}
-export declare enum PrivacyLevel {
-    MINIMAL = "minimal",// Minimum data collection
-    STANDARD = "standard",// Standard data collection
-    ENHANCED = "enhanced"
-}
 /**
  * Whether — and with what lifetime — this application identifies the CLIENT INSTALL
  * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).
@@ -98,18 +88,20 @@ export declare enum ClientInstanceIdScope {
      */
     PERSISTENT = "persistent"
 }
-/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */
 export declare const AnonymousUserPrivacySchema: z.ZodObject<{
-    dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
+    consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+    offeredPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+    consentDecidedAt: z.ZodOptional<z.ZodDate>;
 }, z.core.$strip>;
 export type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;
 export declare const InboundContactPrivacySchema: z.ZodObject<{
-    dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>;
+    consentedPurposes: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>;
+    consentDecidedAt: z.ZodOptional<z.ZodDate>;
 }, z.core.$strip>;
 export type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;
 export declare const UserPrivacySchema: z.ZodObject<{
-    dataProcessingConsent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof DataProcessingConsent>>>;
-    privacyLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof PrivacyLevel>>>;
+    consentedPurposes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ConsentPurpose>>>>>;
+    consentDecidedAt: z.ZodOptional<z.ZodDate>;
 }, z.core.$strip>;
 export type UserPrivacy = z.infer<typeof UserPrivacySchema>;
 //# sourceMappingURL=privacy.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAExB~~;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED~~,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY,CAAE,0BAA0B;IAC/C,QAAQ,aAAa,CAAE,2BAA2B;IAClD,QAAQ,aAAa;CACtB;AAED~~;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;~~AACD~~,~~0EAA0E;AAE1E,~~eAAO,MAAM,0BAA0B~~;;iBAKrC~~,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B~~;;iBAKtC~~,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;~~iBAuB5B~~,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
1	+ {"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AAoED,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.js CHANGED Viewed

@@ -4,6 +4,10 @@
  * Privacy-related schemas and enums for user data management
  */
 import { z } from "zod";
+// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —
+// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.
+import "@wildo-ai/zod-decorators";
+import { ConsentPurpose } from "./consent-purposes.shared.js";
 /**
  * Profile Visibility Enum
  *
@@ -22,20 +26,6 @@ export var OrganizationProfileVisibility;
     OrganizationProfileVisibility["APPLICATION_INTERNAL"] = "application_internal";
     OrganizationProfileVisibility["PRIVATE"] = "private";
 })(OrganizationProfileVisibility || (OrganizationProfileVisibility = {}));
-export var DataProcessingConsent;
-(function (DataProcessingConsent) {
-    DataProcessingConsent["NONE"] = "none";
-    DataProcessingConsent["BASIC"] = "basic";
-    DataProcessingConsent["ANALYTICS"] = "analytics";
-    DataProcessingConsent["MARKETING"] = "marketing";
-    DataProcessingConsent["FULL"] = "full";
-})(DataProcessingConsent || (DataProcessingConsent = {}));
-export var PrivacyLevel;
-(function (PrivacyLevel) {
-    PrivacyLevel["MINIMAL"] = "minimal";
-    PrivacyLevel["STANDARD"] = "standard";
-    PrivacyLevel["ENHANCED"] = "enhanced";
-})(PrivacyLevel || (PrivacyLevel = {}));
 /**
  * Whether — and with what lifetime — this application identifies the CLIENT INSTALL
  * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).
@@ -104,34 +94,87 @@ export var ClientInstanceIdScope;
     ClientInstanceIdScope["PERSISTENT"] = "persistent";
 })(ClientInstanceIdScope || (ClientInstanceIdScope = {}));
 /** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */
+/**
+ * The purposes a person has granted, and whether they have decided at all — the two facts every
+ * consent surface reads (#534).
+ *
+ * `consentedPurposes` defaults to the EMPTY set, and that default is the point. It used to be
+ * `.default(DataProcessingConsent.BASIC)`: every record asserted a consent its subject never gave.
+ * The empty set asserts nothing.
+ *
+ * `consentDecidedAt` is what separates "declined everything" from "was never asked" — the two are the
+ * same empty set and must not be the same fact. Absent means undecided, so a consent surface asks; set
+ * means the person made an affirmative choice at that instant, whatever they chose.
+ */
+/*
+ * `.systemEnum('ConsentPurpose')` names the ONE vocabulary a purpose is worded by, everywhere it is stored —
+ * a person's preferences, an anonymous visitor, a lead — and on the application consent gate that asks for
+ * it. A purpose is a legal statement to the person deciding, so it gets one wording, authored once under
+ * `system_enums.ConsentPurpose.<value>`; the labelling planner plans it there and the frontend reads it
+ * there, both because this field declares it (#966).
+ */
+const consentedPurposesField = (subject) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])
+    .describe(`The optional purposes ${subject} has granted, each independently. A set, not a level: granting one purpose implies nothing about another. Empty means nothing optional was granted.`);
+const consentDecidedAtField = (subject) => z.date().optional()
+    .describe(`When ${subject} last made an affirmative consent choice. Absent means no choice was ever made, which is different from choosing to grant nothing.`);
+/**
+ * The purposes a surface actually PUT IN FRONT of the person when they decided.
+ *
+ * ## Why a decision is not describable by its grants alone
+ *
+ * A grant set says what was agreed to. It cannot say what was ASKED, and the two differ by surface:
+ * a website panel offers `purposesInUse`, derived from that site's own live providers, while the
+ * application's gate offers `optionalPurposes`, derived from that application's configuration. A
+ * marketing site running analytics and an application that also does marketing legitimately ask
+ * different questions.
+ *
+ * Without this field, carrying a visitor's decision to their new account records
+ * `consentDecidedAt` — which every consent surface reads as *"this person was asked and answered"* —
+ * for purposes they were never shown. The application then stops prompting, and a purpose nobody
+ * displayed is stored as declined. The existing surfaces already avoid this internally (*"Purposes
+ * the panel does not offer keep their stored grant"*); only the CARRY crossed a surface boundary, and
+ * it needed to know where the boundary was.
+ *
+ * So a decision is `(granted ⊆ offered, at an instant)`, and the carry adopts grants for offered
+ * purposes while leaving an unoffered one genuinely undecided.
+ *
+ * ## Why only the anonymous holder declares it
+ *
+ * It is the only holder whose decision is taken on one surface and read on another. A member's
+ * preferences are written and read by the same application, and a lead's opt-in is never carried
+ * anywhere — adding the field there would be a second thing to keep true with no reader.
+ *
+ * Defaults to the EMPTY set, which is the honest value for every row written before this existed and
+ * for a session that has been initialized but never asked: an empty offered set means no question was
+ * put, so a carry from it carries nothing, which is the same outcome those rows have today.
+ */
+const offeredPurposesField = (subject) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])
+    .describe(`The optional purposes actually shown to ${subject} by the surface they decided on. What is NOT here was never asked, and must not be read as declined.`);
 export const AnonymousUserPrivacySchema = z.object({
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)
-        .describe('The processing this anonymous visitor has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.'),
+    consentedPurposes: consentedPurposesField('this anonymous visitor'),
+    offeredPurposes: offeredPurposesField('this anonymous visitor'),
+    consentDecidedAt: consentDecidedAtField('this anonymous visitor'),
 });
 export const InboundContactPrivacySchema = z.object({
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)
-        .describe('The processing this lead has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.'),
+    consentedPurposes: consentedPurposesField('this lead'),
+    consentDecidedAt: consentDecidedAtField('this lead'),
 });
 export const UserPrivacySchema = z.object({
-    // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.
+    // `.isAuditEvidence()` on the granted purposes, and deliberately NOT on the block that contains them.
     //
-    // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the
-    // collection scope — held as closed vocabularies, so recording their before/after values on
-    // `resource_operation_performed` is exactly the "mark what decides authority, never what
-    // identifies a person" rule that governs the same decorator on `UserSchema`.
+    // The granted set is the subject's own privacy DECISION held as a closed vocabulary, so recording its
+    // before/after values on `resource_operation_performed` is exactly the "mark what decides authority,
+    // never what identifies a person" rule that governs the same decorator on `UserSchema`.
     //
     // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document
     // interactions are separate immutable release-bound records and are never embedded in preferences.
     //
     // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant
-    // decision and must leave a trail naming the previous and resulting value. Reached today by the
-    // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the
-    // same emission point, so no verb can change consent without a record.
-    dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)
-        .describe('The processing this person has agreed to. It is the subject\'s own decision and only they (or an administrator acting for them) change it. The application decides what each level permits — the framework stores the decision and records every change, it does not attach a fixed meaning to the levels.')
-        .isAuditEvidence(),
-    privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD)
-        .describe('How much this person has agreed the application may collect about them, alongside the processing consent. The application decides what each level permits.')
+    // decision and must leave a trail naming the previous and resulting set. Reached by the consent
+    // gate and prompt, the self-service preferences RESET and self/admin UPDATE. UPDATE explicitly opts
+    // into audit emission below the risk floor; only marked decision leaves enter the evidence.
+    consentedPurposes: consentedPurposesField('this person')
         .isAuditEvidence(),
+    consentDecidedAt: consentDecidedAtField('this person'),
 });
 //# sourceMappingURL=privacy.shared.schemas.js.map