@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/compliance/privacy/privacy.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,wCAAe,CAAA;IACf,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,sCAAa,CAAA;AACf,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,6LAA6L,CAC9L;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,gLAAgL,CACjL;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,2FAA2F;IAC3F,EAAE;IACF,yFAAyF;IACzF,4FAA4F;IAC5F,yFAAyF;IACzF,6EAA6E;IAC7E,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,4SAA4S,CAC7S;SACA,eAAe,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;SAC9D,QAAQ,CAAC,4JAA4J,CAAC;SACtK,eAAe,EAAE;CACrB,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum DataProcessingConsent {\n  NONE = \"none\",\n  BASIC = \"basic\",\n  ANALYTICS = \"analytics\",\n  MARKETING = \"marketing\",\n  FULL = \"full\",\n}\n\nexport enum PrivacyLevel {\n  MINIMAL = \"minimal\", // Minimum data collection\n  STANDARD = \"standard\", // Standard data collection\n  ENHANCED = \"enhanced\", // Enhanced features with more data\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\n/**\n * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n *\n * Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n *\n * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n *\n * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\nexport const AnonymousUserPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n    .describe(\n      'The processing this anonymous visitor has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n    ),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n    .describe(\n      'The processing this lead has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n    ),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.\n  //\n  // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the\n  // collection scope — held as closed vocabularies, so recording their before/after values on\n  // `resource_operation_performed` is exactly the \"mark what decides authority, never what\n  // identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting value. Reached today by the\n  // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the\n  // same emission point, so no verb can change consent without a record.\n  dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n    .describe(\n      'The processing this person has agreed to. It is the subject\\'s own decision and only they (or an administrator acting for them) change it. The application decides what each level permits — the framework stores the decision and records every change, it does not attach a fixed meaning to the levels.',\n    )\n    .isAuditEvidence(),\n  privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD)\n    .describe('How much this person has agreed the application may collect about them, alongside the processing consent. The application decides what each level permits.')\n    .isAuditEvidence(),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}
+{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACzH,QAAQ,CACP,yBAAyB,OAAO,qJAAqJ,CACtL,CAAC;AAEJ,MAAM,qBAAqB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACnE,QAAQ,CACP,QAAQ,OAAO,oIAAoI,CACpJ,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACvH,QAAQ,CACP,2CAA2C,OAAO,sGAAsG,CACzJ,CAAC;AAEJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,iBAAiB,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;IACnE,eAAe,EAAE,oBAAoB,CAAC,wBAAwB,CAAC;IAC/D,gBAAgB,EAAE,qBAAqB,CAAC,wBAAwB,CAAC;CAClE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,iBAAiB,EAAE,sBAAsB,CAAC,WAAW,CAAC;IACtD,gBAAgB,EAAE,qBAAqB,CAAC,WAAW,CAAC;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,sGAAsG;IACtG,EAAE;IACF,sGAAsG;IACtG,qGAAqG;IACrG,wFAAwF;IACxF,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,oGAAoG;IACpG,4FAA4F;IAC5F,iBAAiB,EAAE,sBAAsB,CAAC,aAAa,CAAC;SACrD,eAAe,EAAE;IACpB,gBAAgB,EAAE,qBAAqB,CAAC,aAAa,CAAC;CACvD,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport \"@wildo-ai/zod-decorators\";\n\nimport { ConsentPurpose } from \"./consent-purposes.shared\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\n/**\n * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n *\n * Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n *\n * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n *\n * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\n/**\n * The purposes a person has granted, and whether they have decided at all — the two facts every\n * consent surface reads (#534).\n *\n * `consentedPurposes` defaults to the EMPTY set, and that default is the point. It used to be\n * `.default(DataProcessingConsent.BASIC)`: every record asserted a consent its subject never gave.\n * The empty set asserts nothing.\n *\n * `consentDecidedAt` is what separates \"declined everything\" from \"was never asked\" — the two are the\n * same empty set and must not be the same fact. Absent means undecided, so a consent surface asks; set\n * means the person made an affirmative choice at that instant, whatever they chose.\n */\n/*\n * `.systemEnum('ConsentPurpose')` names the ONE vocabulary a purpose is worded by, everywhere it is stored —\n * a person's preferences, an anonymous visitor, a lead — and on the application consent gate that asks for\n * it. A purpose is a legal statement to the person deciding, so it gets one wording, authored once under\n * `system_enums.ConsentPurpose.<value>`; the labelling planner plans it there and the frontend reads it\n * there, both because this field declares it (#966).\n */\nconst consentedPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes ${subject} has granted, each independently. A set, not a level: granting one purpose implies nothing about another. Empty means nothing optional was granted.`,\n  );\n\nconst consentDecidedAtField = (subject: string) => z.date().optional()\n  .describe(\n    `When ${subject} last made an affirmative consent choice. Absent means no choice was ever made, which is different from choosing to grant nothing.`,\n  );\n\n/**\n * The purposes a surface actually PUT IN FRONT of the person when they decided.\n *\n * ## Why a decision is not describable by its grants alone\n *\n * A grant set says what was agreed to. It cannot say what was ASKED, and the two differ by surface:\n * a website panel offers `purposesInUse`, derived from that site's own live providers, while the\n * application's gate offers `optionalPurposes`, derived from that application's configuration. A\n * marketing site running analytics and an application that also does marketing legitimately ask\n * different questions.\n *\n * Without this field, carrying a visitor's decision to their new account records\n * `consentDecidedAt` — which every consent surface reads as *\"this person was asked and answered\"* —\n * for purposes they were never shown. The application then stops prompting, and a purpose nobody\n * displayed is stored as declined. The existing surfaces already avoid this internally (*\"Purposes\n * the panel does not offer keep their stored grant\"*); only the CARRY crossed a surface boundary, and\n * it needed to know where the boundary was.\n *\n * So a decision is `(granted ⊆ offered, at an instant)`, and the carry adopts grants for offered\n * purposes while leaving an unoffered one genuinely undecided.\n *\n * ## Why only the anonymous holder declares it\n *\n * It is the only holder whose decision is taken on one surface and read on another. A member's\n * preferences are written and read by the same application, and a lead's opt-in is never carried\n * anywhere — adding the field there would be a second thing to keep true with no reader.\n *\n * Defaults to the EMPTY set, which is the honest value for every row written before this existed and\n * for a session that has been initialized but never asked: an empty offered set means no question was\n * put, so a carry from it carries nothing, which is the same outcome those rows have today.\n */\nconst offeredPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes actually shown to ${subject} by the surface they decided on. What is NOT here was never asked, and must not be read as declined.`,\n  );\n\nexport const AnonymousUserPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this anonymous visitor'),\n  offeredPurposes: offeredPurposesField('this anonymous visitor'),\n  consentDecidedAt: consentDecidedAtField('this anonymous visitor'),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this lead'),\n  consentDecidedAt: consentDecidedAtField('this lead'),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on the granted purposes, and deliberately NOT on the block that contains them.\n  //\n  // The granted set is the subject's own privacy DECISION held as a closed vocabulary, so recording its\n  // before/after values on `resource_operation_performed` is exactly the \"mark what decides authority,\n  // never what identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting set. Reached by the consent\n  // gate and prompt, the self-service preferences RESET and self/admin UPDATE. UPDATE explicitly opts\n  // into audit emission below the risk floor; only marked decision leaves enter the evidence.\n  consentedPurposes: consentedPurposesField('this person')\n    .isAuditEvidence(),\n  consentDecidedAt: consentDecidedAtField('this person'),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.d.ts

@@ -0,0 +1,52 @@
+import { type BuiltinProviderCapability } from '../../external-providers/provider-capability.shared.schemas';
+import { PersonalDataCategory } from './personal-data-category.shared.schemas';
+/**
+ * WHICH categories of personal data the ENGINE sends to a provider that serves a capability (#1709).
+ *
+ * ## Why a table the engine owns
+ *
+ * A record of processing lists the categories of personal data and the categories of recipients (GDPR Art. 30(1)(c),
+ * (d)); saying which categories reach which recipient is the practice that keeps the two lists consistent. For a
+ * provider reached through a CAPABILITY, the application writes no
+ * field map: the ENGINE composes the request — the recipient address of an email, the customer of a billing call,
+ * the prompt of a model call. So the categories are a fact about the engine's own behaviour, the same for every
+ * application, and the engine states it here rather than asking each operator to narrate it
+ * (`.claude/rules/derive-before-you-ask.md`).
+ *
+ * The provider compliance profile's header rejects restating this on each provider module, as "a second authority
+ * for one fact": the capability is the authority, and this is where it speaks.
+ *
+ * ## Total over the provider-capability vocabulary
+ *
+ * A `Record` over every {@link BuiltinProviderCapability}, so a capability added tomorrow is a compile error here
+ * until someone states what it sends. `null` is an ANSWER: the capability sends no personal data of the application's
+ * users to the vendor (a build-time coding agent works on source code).
+ *
+ * ## Read it as a FLOOR of what reaches the vendor, never a ceiling
+ *
+ * `USER_CONTENT` is listed wherever free text a person wrote rides the call (a prompt, a message body, a search
+ * query), and free text can carry ANY other category — see {@link PersonalDataCategory.USER_CONTENT}. A notice
+ * states the listed categories and must not conclude that nothing else ever reaches the vendor.
+ *
+ * @wildo_source:part:start saas.models.privacy.provider-capability-disclosure facet:layer:shared facet:audience:app-developer
+ */
+export interface ProviderCapabilityDisclosure {
+    /** The categories the engine sends when it calls a provider for this capability. */
+    readonly categories: readonly PersonalDataCategory[];
+    /** What in the call carries them — so a reader can check the claim against the engine's behaviour. */
+    readonly carriedBy: string;
+}
+export declare const PROVIDER_CAPABILITY_DISCLOSURES: Readonly<Record<BuiltinProviderCapability, ProviderCapabilityDisclosure | null>>;
+/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */
+/**
+ * The categories disclosed through a set of capabilities, as the population's data paths name them — provider
+ * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).
+ *
+ * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the
+ * {@link PersonalDataCategory} enum order, so one application produces one sentence.
+ */
+export declare function personalDataDisclosedThroughCapabilities(tokens: readonly string[]): {
+    readonly categories: readonly PersonalDataCategory[];
+    readonly undeclared: readonly string[];
+};
+//# sourceMappingURL=provider-capability-disclosure.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-capability-disclosure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,4BAA4B;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,GAAG,IAAI,CAAC,CAmF5H,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG;IACnF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAkBA"}

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.js

@@ -0,0 +1,116 @@
+import { BUILTIN_PROVIDER_CAPABILITY, } from '../../external-providers/provider-capability.shared.schemas.js';
+import { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY } from '../../external-providers/engine-capabilities.shared.schemas.js';
+import { PersonalDataCategory } from './personal-data-category.shared.schemas.js';
+export const PROVIDER_CAPABILITY_DISCLOSURES = {
+    [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY, PersonalDataCategory.CREDENTIALS, PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the recipient address, the recipient name the templates address, the rendered message body, and the magic-link, verification and password-reset tokens the engine\'s own mails carry',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY],
+        carriedBy: 'the subscriber address and name synchronised to the audience',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the sender and recipient addresses, and the message bodies and attachments the vendor receives and holds',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.SMS]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.CREDENTIALS],
+        carriedBy: 'the telephone number, and the one-time verification code the message carries',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.BILLING]: {
+        categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.FINANCIAL],
+        carriedBy: 'the customer name and email address, and the payment, subscription and invoice records',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.SSO_OAUTH2]: {
+        categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],
+        carriedBy: 'the sign-in request, which may name the account (login hint), and the identity the vendor asserts back',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.SSO_SAML]: {
+        categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],
+        carriedBy: 'the authentication request and the asserted subject',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the prompt and the context the application assembles into it',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the text of every field a resource marks as a retrieval source, sent to be embedded',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the bytes of every uploaded document sent for text extraction',
+    },
+    // Build-time tooling: a coding run sends the application's SOURCE CODE and specifications, not a user's data.
+    [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: null,
+    [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the image prompt',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: {
+        categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],
+        carriedBy: 'the error event with its device, browser and page context, and the signed-in user identifier when the application attaches it',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: {
+        categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],
+        carriedBy: 'the product events and the identifier the application identifies the person by',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_SEARCH]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the search query the person types',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_FILE_PICKER]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the files the person picks from their own account at the vendor',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA]: {
+        categories: [PersonalDataCategory.USAGE],
+        carriedBy: 'the interaction and device signals the challenge scores',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ADDRESS_LOOKUP]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.LOCATION],
+        carriedBy: 'the address text the person types and the place it resolves to',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: {
+        categories: [PersonalDataCategory.USER_CONTENT, PersonalDataCategory.USAGE],
+        carriedBy: 'the traced generation — its prompt and output — and the call metadata',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: {
+        categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],
+        carriedBy: 'the traces, metrics and logs of requests, which carry request metadata and the acting user\'s identifier on each span',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: {
+        categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.USAGE],
+        carriedBy: 'every audit event: the acting user, the subject, and what was done',
+    },
+};
+/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */
+/**
+ * The categories disclosed through a set of capabilities, as the population's data paths name them — provider
+ * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).
+ *
+ * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the
+ * {@link PersonalDataCategory} enum order, so one application produces one sentence.
+ */
+export function personalDataDisclosedThroughCapabilities(tokens) {
+    const found = new Set();
+    const undeclared = [];
+    const disclosuresByProviderCapability = PROVIDER_CAPABILITY_DISCLOSURES;
+    for (const token of tokens) {
+        const providerCapabilities = token in disclosuresByProviderCapability
+            ? [token]
+            : Object.entries(PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY).filter(([, engineCapability]) => engineCapability === token).map(([providerCapability]) => providerCapability);
+        if (providerCapabilities.length === 0) {
+            undeclared.push(token);
+            continue;
+        }
+        for (const providerCapability of providerCapabilities) {
+            for (const category of disclosuresByProviderCapability[providerCapability]?.categories ?? [])
+                found.add(category);
+        }
+    }
+    const order = Object.values(PersonalDataCategory);
+    return { categories: order.filter((category) => found.has(category)), undeclared: [...new Set(undeclared)].sort() };
+}
+//# sourceMappingURL=provider-capability-disclosure.shared.schemas.js.map

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-capability-disclosure.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAE5B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AACvH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAuC/E,MAAM,CAAC,MAAM,+BAA+B,GAAqF;IAC/H,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE;QACjD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACtJ,SAAS,EAAE,sLAAsL;KAClM;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE;QAC3C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACrF,SAAS,EAAE,0GAA0G;KACtH;IACD,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE;QACjC,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,WAAW,CAAC;QACpF,SAAS,EAAE,8EAA8E;KAC1F;IACD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE;QACrC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,SAAS,CAAC;QACjH,SAAS,EAAE,wFAAwF;KACpG;IACD,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE;QACxC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,wGAAwG;KACpH;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,qDAAqD;KACjE;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE;QAC5C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,qFAAqF;KACjG;IACD,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE;QACtD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,+DAA+D;KAC3E;IACD,8GAA8G;IAC9G,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,IAAI;IAChD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,kBAAkB;KAC9B;IACD,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE;QACvD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,+HAA+H;KAC3I;IACD,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE;QACxD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,gFAAgF;KAC5F;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,mCAAmC;KAC/C;IACD,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,EAAE;QAClD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,iEAAiE;KAC7E;IACD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC;QACxC,SAAS,EAAE,yDAAyD;KACrE;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,gEAAgE;KAC5E;IACD,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE;QAC/C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC;QAC3E,SAAS,EAAE,uEAAuE;KACnF;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,uHAAuH;KACnI;IACD,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE;QACpD,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACvE,SAAS,EAAE,oEAAoE;KAChF;CACF,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAAyB;IAIhF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,+BAA+B,GAAG,+BAAgG,CAAC;IACzI,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,oBAAoB,GAAG,KAAK,IAAI,+BAA+B;YACnE,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC5K,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,kBAAkB,IAAI,oBAAoB,EAAE,CAAC;YACtD,KAAK,MAAM,QAAQ,IAAI,+BAA+B,CAAC,kBAAkB,CAAC,EAAE,UAAU,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACtH,CAAC","sourcesContent":["import {\n  BUILTIN_PROVIDER_CAPABILITY,\n  type BuiltinProviderCapability,\n} from '../../external-providers/provider-capability.shared.schemas';\nimport { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY } from '../../external-providers/engine-capabilities.shared.schemas';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/**\n * WHICH categories of personal data the ENGINE sends to a provider that serves a capability (#1709).\n *\n * ## Why a table the engine owns\n *\n * A record of processing lists the categories of personal data and the categories of recipients (GDPR Art. 30(1)(c),\n * (d)); saying which categories reach which recipient is the practice that keeps the two lists consistent. For a\n * provider reached through a CAPABILITY, the application writes no\n * field map: the ENGINE composes the request — the recipient address of an email, the customer of a billing call,\n * the prompt of a model call. So the categories are a fact about the engine's own behaviour, the same for every\n * application, and the engine states it here rather than asking each operator to narrate it\n * (`.claude/rules/derive-before-you-ask.md`).\n *\n * The provider compliance profile's header rejects restating this on each provider module, as \"a second authority\n * for one fact\": the capability is the authority, and this is where it speaks.\n *\n * ## Total over the provider-capability vocabulary\n *\n * A `Record` over every {@link BuiltinProviderCapability}, so a capability added tomorrow is a compile error here\n * until someone states what it sends. `null` is an ANSWER: the capability sends no personal data of the application's\n * users to the vendor (a build-time coding agent works on source code).\n *\n * ## Read it as a FLOOR of what reaches the vendor, never a ceiling\n *\n * `USER_CONTENT` is listed wherever free text a person wrote rides the call (a prompt, a message body, a search\n * query), and free text can carry ANY other category — see {@link PersonalDataCategory.USER_CONTENT}. A notice\n * states the listed categories and must not conclude that nothing else ever reaches the vendor.\n *\n * @wildo_source:part:start saas.models.privacy.provider-capability-disclosure facet:layer:shared facet:audience:app-developer\n */\nexport interface ProviderCapabilityDisclosure {\n  /** The categories the engine sends when it calls a provider for this capability. */\n  readonly categories: readonly PersonalDataCategory[];\n  /** What in the call carries them — so a reader can check the claim against the engine's behaviour. */\n  readonly carriedBy: string;\n}\n\nexport const PROVIDER_CAPABILITY_DISCLOSURES: Readonly<Record<BuiltinProviderCapability, ProviderCapabilityDisclosure | null>> = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY, PersonalDataCategory.CREDENTIALS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the recipient address, the recipient name the templates address, the rendered message body, and the magic-link, verification and password-reset tokens the engine\\'s own mails carry',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the subscriber address and name synchronised to the audience',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the sender and recipient addresses, and the message bodies and attachments the vendor receives and holds',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.CREDENTIALS],\n    carriedBy: 'the telephone number, and the one-time verification code the message carries',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.FINANCIAL],\n    carriedBy: 'the customer name and email address, and the payment, subscription and invoice records',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_OAUTH2]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the sign-in request, which may name the account (login hint), and the identity the vendor asserts back',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_SAML]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the authentication request and the asserted subject',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the prompt and the context the application assembles into it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the text of every field a resource marks as a retrieval source, sent to be embedded',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the bytes of every uploaded document sent for text extraction',\n  },\n  // Build-time tooling: a coding run sends the application's SOURCE CODE and specifications, not a user's data.\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: null,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the image prompt',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the error event with its device, browser and page context, and the signed-in user identifier when the application attaches it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the product events and the identifier the application identifies the person by',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_SEARCH]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the search query the person types',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_FILE_PICKER]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the files the person picks from their own account at the vendor',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA]: {\n    categories: [PersonalDataCategory.USAGE],\n    carriedBy: 'the interaction and device signals the challenge scores',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ADDRESS_LOOKUP]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.LOCATION],\n    carriedBy: 'the address text the person types and the place it resolves to',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: {\n    categories: [PersonalDataCategory.USER_CONTENT, PersonalDataCategory.USAGE],\n    carriedBy: 'the traced generation — its prompt and output — and the call metadata',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the traces, metrics and logs of requests, which carry request metadata and the acting user\\'s identifier on each span',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.USAGE],\n    carriedBy: 'every audit event: the acting user, the subject, and what was done',\n  },\n};\n/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */\n\n/**\n * The categories disclosed through a set of capabilities, as the population's data paths name them — provider\n * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).\n *\n * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the\n * {@link PersonalDataCategory} enum order, so one application produces one sentence.\n */\nexport function personalDataDisclosedThroughCapabilities(tokens: readonly string[]): {\n  readonly categories: readonly PersonalDataCategory[];\n  readonly undeclared: readonly string[];\n} {\n  const found = new Set<PersonalDataCategory>();\n  const undeclared: string[] = [];\n  const disclosuresByProviderCapability = PROVIDER_CAPABILITY_DISCLOSURES as Readonly<Record<string, ProviderCapabilityDisclosure | null>>;\n  for (const token of tokens) {\n    const providerCapabilities = token in disclosuresByProviderCapability\n      ? [token]\n      : Object.entries(PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY).filter(([, engineCapability]) => engineCapability === token).map(([providerCapability]) => providerCapability);\n    if (providerCapabilities.length === 0) {\n      undeclared.push(token);\n      continue;\n    }\n    for (const providerCapability of providerCapabilities) {\n      for (const category of disclosuresByProviderCapability[providerCapability]?.categories ?? []) found.add(category);\n    }\n  }\n  const order = Object.values(PersonalDataCategory);\n  return { categories: order.filter((category) => found.has(category)), undeclared: [...new Set(undeclared)].sort() };\n}\n"]}

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+/**
+ * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.
+ *
+ * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that
+ * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the
+ * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator
+ * identity's module graph with it.
+ */
+export declare const LawfulBasisPurposeRefSchema: z.ZodString;
+//# sourceMappingURL=purpose-ref.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purpose-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAAoG,CAAC"}

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.js

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+/**
+ * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.
+ *
+ * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that
+ * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the
+ * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator
+ * identity's module graph with it.
+ */
+export const LawfulBasisPurposeRefSchema = z.string().trim().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'a purpose ref is a lower-case kebab slug');
+//# sourceMappingURL=purpose-ref.shared.schemas.js.map

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purpose-ref.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE,0CAA0C,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.\n *\n * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that\n * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the\n * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator\n * identity's module graph with it.\n */\nexport const LawfulBasisPurposeRefSchema = z.string().trim().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'a purpose ref is a lower-case kebab slug');\n"]}

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/redaction.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n * MAINTAINER NOTE — not part of the anchored, application-facing block below.\n *\n * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n *\n * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n */\n\n/**\n * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n *\n * How one field's value is replaced when it is redacted or scrubbed.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Two consumers, and only one of them accepts every member\n *\n * | consumer | what it does | accepts |\n * |---|---|---|\n * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |\n * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |\n *\n * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n *\n * ## Choosing a treatment for an erasure scrub\n *\n * | the field | treatment |\n * |---|---|\n * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |\n * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |\n * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |\n * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |\n *\n * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n *\n * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n *\n * ## The never-scrub floor\n *\n * A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n *\n * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n *\n * @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n *\n * const contactSchema = z.object({\n *   // nullable → REMOVE\n *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n *   // constrained string → MASK with a value the field's own schema accepts\n *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n *   // non-nullable with a default → RESET\n *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n *     .impersonalizeWith(RedactionType.RESET),\n *   // no treatment → survives the erasure, deliberately\n *   invoicedAmount: z.number(),\n * });\n * ```\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */\n  MASK = 'mask',\n  /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */\n  ENCRYPT = 'encrypt',\n  /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */\n  KEEP = 'keep',\n  /**\n   * Erasure scrub only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n   * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n   * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n   * and objects.\n   *\n   * The value is read from the schema rather than authored a second time, so it cannot drift from\n   * the default the field already declares — and for a person's counters and settings, \"what this is\n   * when nobody has set it\" is exactly what an erasure should leave behind.\n   *\n   * Refused when the field declares no `.default()`, and refused when that default reads the clock.\n   */\n  RESET = 'reset',\n}\n/** @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}
+{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n * MAINTAINER NOTE — not part of the anchored, application-facing block below.\n *\n * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n *\n * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n */\n\n/**\n * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n *\n * How one field's value is replaced when it is redacted or scrubbed.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Two consumers, and only one of them accepts every member\n *\n * | consumer | what it does | accepts |\n * |---|---|---|\n * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |\n * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |\n *\n * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n *\n * ## Choosing a treatment for an erasure scrub\n *\n * | the field | treatment |\n * |---|---|\n * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |\n * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |\n * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |\n * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |\n *\n * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n *\n * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n *\n * ## The never-scrub floor\n *\n * A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n *\n * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n *\n * @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n *\n * const contactSchema = z.object({\n *   // nullable → REMOVE\n *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n *   // constrained string → MASK with a value the field's own schema accepts\n *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n *   // non-nullable with a default → RESET\n *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n *     .impersonalizeWith(RedactionType.RESET),\n *   // no treatment → survives the erasure, deliberately\n *   invoicedAmount: z.number(),\n * });\n * ```\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */\n  MASK = 'mask',\n  /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */\n  ENCRYPT = 'encrypt',\n  /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */\n  KEEP = 'keep',\n  /**\n   * Erasure scrub only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n   * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n   * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n   * and objects.\n   *\n   * The value is read from the schema rather than authored a second time, so it cannot drift from\n   * the default the field already declares — and for a person's counters and settings, \"what this is\n   * when nobody has set it\" is exactly what an erasure should leave behind.\n   *\n   * Refused when the field declares no `.default()`, and refused when that default reads the clock.\n   */\n  RESET = 'reset',\n}\n/** @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}

package/dist/esm/compliance/privacy/retention-binding.shared.utils.d.ts

@@ -0,0 +1,93 @@
+import type { z } from 'zod';
+import { type ApplicationRetentionSchedule, type ResourceRetentionBinding } from './retention-schedule.shared.schemas';
+/** The infrastructure-owned creation instant both adapters maintain. */
+export declare const RETENTION_CREATED_AT_FIELD_NAME = "createdAt";
+/** The infrastructure-owned last-update instant both adapters maintain. */
+export declare const RETENTION_UPDATED_AT_FIELD_NAME = "updatedAt";
+/**
+ * The field whose value is a bound row's retention start instant (or, for
+ * {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}, the instant the start is derived from).
+ *
+ * Throws for a {@link RetentionStartPoint.CLOSURE_EVENT} binding with no `closureFieldName`: the factory
+ * refuses that configuration, so reaching it here means a binding bypassed the factory, and guessing a
+ * field would delete rows by the wrong clock.
+ */
+export declare function resolveRetentionStartFieldName(binding: ResourceRetentionBinding): string;
+/**
+ * The rows a bound resource must delete at `now`: those whose {@link BoundRetentionCutoff.fieldName} is
+ * STRICTLY before {@link BoundRetentionCutoff.before}.
+ *
+ * A row is deleted only AFTER `start + retentionDays`, never at it: a row whose start is exactly
+ * `now − retentionDays` has reached the end of its period and not passed it, so it survives this run.
+ *
+ * For {@link RetentionStartPoint.END_OF_CALENDAR_YEAR} the comparison is still on `createdAt`, rewritten
+ * so no per-row arithmetic is needed: `endOfYear(createdAt) + days < now` holds exactly when `createdAt`
+ * falls in a year BEFORE the year of `now − days`, i.e. `createdAt < 1 January (UTC) of year(now − days)`.
+ */
+export interface BoundRetentionCutoff {
+    readonly fieldName: string;
+    readonly before: Date;
+}
+export declare function resolveBoundRetentionCutoff(binding: ResourceRetentionBinding, retentionDays: number, now: Date): BoundRetentionCutoff;
+/**
+ * When `row`'s retention clock started, or `undefined` while its start point has not occurred (an open
+ * CLOSURE_EVENT row, a SCOPE_DELETED row whose organization still exists).
+ */
+export declare function resolveRetentionStartedAt(row: Record<string, unknown>, binding: ResourceRetentionBinding): Date | undefined;
+/**
+ * The instant after which `row` is deleted under the CURRENT schedule, or `undefined` when its start
+ * point has not occurred or its class declares no period (undeclared is "not decided", never "now").
+ */
+export declare function resolveRetentionExpiresAt(row: Record<string, unknown>, binding: ResourceRetentionBinding, schedule: ApplicationRetentionSchedule | undefined): Date | undefined;
+/**
+ * A declared `.ttl()` ROW-EXPIRY policy: rows expire `expireAfterSeconds` after `fieldName`'s value.
+ *
+ * `expireAfterSeconds: 0` means the field IS the absolute expiry instant (`jobPayloadStorage.expiresAt`);
+ * a positive value is a window measured from the field (`jobExecutions.createdAt`). These are MongoDB's
+ * `expireAfterSeconds` semantics verbatim, so one declaration cannot mean two things per adapter.
+ *
+ * Distinct from a {@link ResourceRetentionBinding} on purpose: `.ttl()` is a fixed number of seconds on a
+ * field, for framework plumbing that holds no business or personal data, and MongoDB honours it NATIVELY
+ * with no application code running. A resource holding such data binds a class instead, and a resource
+ * may not declare both (one row, one retention authority).
+ */
+export interface RowTtlPolicy {
+    readonly fieldName: string;
+    readonly expireAfterSeconds: number;
+}
+/**
+ * Every `.ttl()` declaration on a resource's main schema — ONE authority, read by the SQL planner, the
+ * `.ttl()` sweep, the startup refusals and the resource factory.
+ *
+ * Tolerates a non-object schema (it declares no fields, so no TTL): this is called while enumerating
+ * EVERY registered resource, and one exotic schema must not take the enumeration down.
+ */
+export declare function collectRowTtlPolicies(mainSchema: z.ZodTypeAny): RowTtlPolicy[];
+/** The part of a resource configuration the gap report reads. Structural, so it takes a registry's configs as-is. */
+export interface RetentionBindingGapInput {
+    readonly resourceIdentifier: string;
+    readonly retentionBinding?: ResourceRetentionBinding;
+    readonly mainSchema?: unknown;
+}
+/**
+ * THE rule for "kept until erased": a resource no retention mechanism ever deletes has no class binding
+ * and no `.ttl()`. One predicate, so the startup report (which reads schemas) and the RETENTION_RULES
+ * document fact (which receives `declaresRowTtl` across a JSON boundary) cannot disagree about who is in
+ * the list.
+ */
+export declare function isKeptUntilErased(resource: {
+    readonly retentionBinding?: unknown;
+    readonly declaresRowTtl: boolean;
+}): boolean;
+/**
+ * The resources whose rows no retention mechanism ever deletes: no class binding and no `.ttl()`.
+ *
+ * Kept until erased. That is today's behaviour for every unbound resource and is not wrong in itself —
+ * it is UNDECIDED, and this report is what keeps it visible next to `undeclaredRetentionClasses`, in the
+ * compliance documents and in the startup log. Rejected: defaulting every unbound resource to
+ * `RESOURCE_DATA`. That would silently delete data nobody decided about.
+ *
+ * Sorted, so two runs over the same registry produce the same list.
+ */
+export declare function unboundRetentionResources(resources: Iterable<RetentionBindingGapInput>): readonly string[];
+//# sourceMappingURL=retention-binding.shared.utils.d.ts.map

package/dist/esm/compliance/privacy/retention-binding.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention-binding.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-binding.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC9B,MAAM,qCAAqC,CAAC;AAsB7C,wEAAwE;AACxE,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAC3D,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAE3D;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAexF;AAYD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,wBAAwB,EACjC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,IAAI,GACR,oBAAoB,CAOtB;AASD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,GAChC,IAAI,GAAG,SAAS,CAIlB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,IAAI,GAAG,SAAS,CAKlB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,YAAY,EAAE,CAgB9E;AAMD,qHAAqH;AACrH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAE9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAAG,SAAS,MAAM,EAAE,CAO1G"}

package/dist/esm/compliance/privacy/retention-binding.shared.utils.js

@@ -0,0 +1,149 @@
+import { getTtlParams, getZodObjectShape, hasTtl } from '@wildo-ai/zod-decorators';
+import { RETENTION_STARTED_AT_FIELD_NAME, RetentionStartPoint, } from './retention-schedule.shared.schemas.js';
+/**
+ * # Retention binding derivations — one authority for "when does a bound row expire"
+ *
+ * Every consumer of a retention binding asks one of four questions, and each is answered here once:
+ *
+ * | question | function | consumers |
+ * |---|---|---|
+ * | which field carries the start instant? | {@link resolveRetentionStartFieldName} | the sweep's query, the factory's field checks |
+ * | which rows are past their period now? | {@link resolveBoundRetentionCutoff} | the sweep, the startup past-expiry report |
+ * | when did THIS row's clock start / when does it end? | {@link resolveRetentionStartedAt} / {@link resolveRetentionExpiresAt} | subject erasure's `retainedUntil` (#1635), deletion evidence (#1636) |
+ * | which resources hold data nobody bound? | {@link unboundRetentionResources} | compliance documents, the startup report |
+ *
+ * Pure and adapter-neutral: the cutoff is a single `field < instant` comparison, which MongoDB and both
+ * PostgreSQL filter compilers evaluate identically — and a NULL start instant matches neither, which is
+ * exactly "a row whose start point has not occurred never expires" (#1613 invariant 2), by construction
+ * rather than by a guard somebody could forget.
+ */
+const MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;
+/** The infrastructure-owned creation instant both adapters maintain. */
+export const RETENTION_CREATED_AT_FIELD_NAME = 'createdAt';
+/** The infrastructure-owned last-update instant both adapters maintain. */
+export const RETENTION_UPDATED_AT_FIELD_NAME = 'updatedAt';
+/**
+ * The field whose value is a bound row's retention start instant (or, for
+ * {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}, the instant the start is derived from).
+ *
+ * Throws for a {@link RetentionStartPoint.CLOSURE_EVENT} binding with no `closureFieldName`: the factory
+ * refuses that configuration, so reaching it here means a binding bypassed the factory, and guessing a
+ * field would delete rows by the wrong clock.
+ */
+export function resolveRetentionStartFieldName(binding) {
+    switch (binding.startPoint) {
+        case RetentionStartPoint.CREATED:
+        case RetentionStartPoint.END_OF_CALENDAR_YEAR:
+            return RETENTION_CREATED_AT_FIELD_NAME;
+        case RetentionStartPoint.LAST_UPDATED:
+            return RETENTION_UPDATED_AT_FIELD_NAME;
+        case RetentionStartPoint.SCOPE_DELETED:
+            return RETENTION_STARTED_AT_FIELD_NAME;
+        case RetentionStartPoint.CLOSURE_EVENT:
+            if (!binding.closureFieldName) {
+                throw new Error('A CLOSURE_EVENT retention binding must name its closureFieldName.');
+            }
+            return binding.closureFieldName;
+    }
+}
+/** The instant 00:00:00.000 UTC on 1 January of `instant`'s UTC year. */
+function startOfUtcYear(instant) {
+    return new Date(Date.UTC(instant.getUTCFullYear(), 0, 1));
+}
+/** The last millisecond of `instant`'s UTC year: 31 December 23:59:59.999 UTC. */
+function endOfUtcYear(instant) {
+    return new Date(Date.UTC(instant.getUTCFullYear() + 1, 0, 1) - 1);
+}
+export function resolveBoundRetentionCutoff(binding, retentionDays, now) {
+    const fieldName = resolveRetentionStartFieldName(binding);
+    const periodStartedBefore = new Date(now.getTime() - retentionDays * MILLISECONDS_PER_DAY);
+    if (binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR) {
+        return { fieldName, before: startOfUtcYear(periodStartedBefore) };
+    }
+    return { fieldName, before: periodStartedBefore };
+}
+function readInstant(row, fieldName) {
+    const value = row[fieldName];
+    if (value === null || value === undefined)
+        return undefined;
+    const instant = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(instant.getTime()) ? undefined : instant;
+}
+/**
+ * When `row`'s retention clock started, or `undefined` while its start point has not occurred (an open
+ * CLOSURE_EVENT row, a SCOPE_DELETED row whose organization still exists).
+ */
+export function resolveRetentionStartedAt(row, binding) {
+    const instant = readInstant(row, resolveRetentionStartFieldName(binding));
+    if (!instant)
+        return undefined;
+    return binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR ? endOfUtcYear(instant) : instant;
+}
+/**
+ * The instant after which `row` is deleted under the CURRENT schedule, or `undefined` when its start
+ * point has not occurred or its class declares no period (undeclared is "not decided", never "now").
+ */
+export function resolveRetentionExpiresAt(row, binding, schedule) {
+    const period = schedule?.[binding.retentionClass];
+    const startedAt = resolveRetentionStartedAt(row, binding);
+    if (!period || !startedAt)
+        return undefined;
+    return new Date(startedAt.getTime() + period.retentionDays * MILLISECONDS_PER_DAY);
+}
+/**
+ * Every `.ttl()` declaration on a resource's main schema — ONE authority, read by the SQL planner, the
+ * `.ttl()` sweep, the startup refusals and the resource factory.
+ *
+ * Tolerates a non-object schema (it declares no fields, so no TTL): this is called while enumerating
+ * EVERY registered resource, and one exotic schema must not take the enumeration down.
+ */
+export function collectRowTtlPolicies(mainSchema) {
+    let shape;
+    try {
+        shape = getZodObjectShape(mainSchema);
+    }
+    catch {
+        return [];
+    }
+    if (!shape)
+        return [];
+    const policies = [];
+    for (const [fieldName, fieldSchema] of Object.entries(shape)) {
+        if (!fieldSchema || !hasTtl(fieldSchema))
+            continue;
+        const params = getTtlParams(fieldSchema);
+        if (!params)
+            continue;
+        policies.push({ fieldName, expireAfterSeconds: params.expireAfterSeconds });
+    }
+    return policies;
+}
+/**
+ * THE rule for "kept until erased": a resource no retention mechanism ever deletes has no class binding
+ * and no `.ttl()`. One predicate, so the startup report (which reads schemas) and the RETENTION_RULES
+ * document fact (which receives `declaresRowTtl` across a JSON boundary) cannot disagree about who is in
+ * the list.
+ */
+export function isKeptUntilErased(resource) {
+    return !resource.retentionBinding && !resource.declaresRowTtl;
+}
+/**
+ * The resources whose rows no retention mechanism ever deletes: no class binding and no `.ttl()`.
+ *
+ * Kept until erased. That is today's behaviour for every unbound resource and is not wrong in itself —
+ * it is UNDECIDED, and this report is what keeps it visible next to `undeclaredRetentionClasses`, in the
+ * compliance documents and in the startup log. Rejected: defaulting every unbound resource to
+ * `RESOURCE_DATA`. That would silently delete data nobody decided about.
+ *
+ * Sorted, so two runs over the same registry produce the same list.
+ */
+export function unboundRetentionResources(resources) {
+    const unbound = [];
+    for (const resource of resources) {
+        const declaresRowTtl = Boolean(resource.mainSchema) && collectRowTtlPolicies(resource.mainSchema).length > 0;
+        if (isKeptUntilErased({ retentionBinding: resource.retentionBinding, declaresRowTtl }))
+            unbound.push(resource.resourceIdentifier);
+    }
+    return unbound.sort();
+}
+//# sourceMappingURL=retention-binding.shared.utils.js.map