@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACrC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,wBAAwB,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,4LAA4L;SACrQ,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACvF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACrE;;;;;;;;;OASG;IACH,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;IAC5B,8GAA4E,CAAA;AAC9E,CAAC,EAPW,8BAA8B,KAA9B,8BAA8B,QAOzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7F,QAAQ,EAAE,kCAAkC,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS;KAC9I,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { ConsentPurpose } from './consent-purposes.shared';\n\n/**\n * GDPR Art. 6(1) — the six lawful bases, closed by the article.\n *\n * Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n *\n * spec-cite: GDPR Art. 6(1)(a)–(f).\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.\n */\nexport enum LawfulBasis {\n  /** Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. */\n  CONSENT = 'CONSENT',\n  /** Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. */\n  CONTRACT = 'CONTRACT',\n  /** Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. */\n  LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n  /** Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. */\n  VITAL_INTERESTS = 'VITAL_INTERESTS',\n  /** Art. 6(1)(e) — necessary for a task in the public interest or official authority. */\n  PUBLIC_TASK = 'PUBLIC_TASK',\n  /**\n   * Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n   * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n   * is refused below.\n   */\n  LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/** Whether the operator decides the purposes of a processing, carries them out for someone else, or both. */\nexport enum OperatorProcessingRole {\n  /** The operator determines the purposes and means. */\n  CONTROLLER = 'CONTROLLER',\n  /** The operator processes on a customer's documented instructions — the usual B2B posture for customer records. */\n  PROCESSOR = 'PROCESSOR',\n  /** The operator and another party jointly determine purposes and means, and must have an arrangement saying how. */\n  JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/**\n * ONE role, over ONE population of data.\n *\n * A single role field would be the wrong shape, and the produced notice said so before this existed:\n * *\"This notice therefore does not assign a single legal role to all data processed in a workspace.\"*\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n *\n * `dataScope` is prose the operator writes, deliberately. Nothing structured exists to key it to: the\n * processing purposes a notice states are derived from the application's vision and requirements as\n * PROSE, so a ref here would point at nothing.\n */\nexport const OperatorRoleAllocationSchema = z.strictObject({\n  /** Which data this role covers, in the operator's own words — \"customer records in a workspace\". */\n  dataScope: z.string().trim().min(1),\n  role: z.enum(OperatorProcessingRole),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/**\n * One processing purpose and the basis the operator relies on for it.\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.\n */\nexport const OperatorLawfulBasisSchema = z.strictObject({\n  /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */\n  purpose: z.string().trim().min(1),\n  basis: z.enum(LawfulBasis),\n  /**\n   * The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n   * that needs a balancing test — see the superRefine below.\n   */\n  assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n  /*\n   * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n   * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n   * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n   * conclusion nobody reached.\n   */\n  if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['assessmentNote'],\n      message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n    });\n  }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/**\n * What a person must agree to in order to USE the service at all (issue #139).\n *\n * ## The near-miss this exists because of\n *\n * `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n *\n * Correcting it left a real hole, which a produced notice then reported in its own words:\n * *\"There is no declared surface for recording a service-wide consent requirement distinct from\n * analytics consent.\"* This is that surface.\n *\n * ## Why the required set may be empty, and usually should be\n *\n * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A non-empty required set says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n *\n * An EMPTY set is therefore the honest answer for most applications: *nothing is gated on consent;\n * the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*\n * A field that pushed applications toward declaring consent would be worse than the gap it closes.\n *\n * ## This is the ENFORCED half of the identity (#453)\n *\n * Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is\n * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is\n * the exception. `wildo config service-consent` projects it into the running application's\n * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in\n * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,\n * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the\n * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),\n * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push\n * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an\n * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they\n * already started. Signing in, refreshing a session and signing out are not resource operations and stay\n * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count\n * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in\n * place of every signed-in route. A reader of\n * this schema must be able to tell the two apart without tracing the runtime, which is why it is said\n * here.\n *\n * ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n */\nexport const ServiceConsentRequirementSchema = z.strictObject({\n  /**\n   * The purposes a person must grant before they may use the service — a SET, never a level (#453).\n   *\n   * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a\n   * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is\n   * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.\n   *\n   * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that\n   * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.\n   */\n  requiredPurposes: z.array(z.enum(ConsentPurpose)),\n  /**\n   * What this gate actually controls, in the operator's own words.\n   *\n   * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody\n   * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n   * governs tells a person they must agree to something unnamed.\n   */\n  gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n  /*\n   * A required purpose with nothing described is the shape that satisfies the field and discloses\n   * nothing — the same defect as a revision recording no superseded rationale, and as a\n   * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n   * explanation is the half that makes it mean anything.\n   */\n  if (requirement.requiredPurposes.length > 0 && requirement.gatedProcessing === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['gatedProcessing'],\n      message: `requiring consent to ${requirement.requiredPurposes.join(', ')} gates something — say what, or declare no required purposes. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n    });\n  }\n  /*\n   * A purpose listed twice is not a stronger requirement, and a set that reads differently from how it\n   * compares is how two surfaces come to describe one gate differently.\n   */\n  if (new Set(requirement.requiredPurposes).size !== requirement.requiredPurposes.length) {\n    context.addIssue({\n      code: 'custom',\n      path: ['requiredPurposes'],\n      message: 'a required purpose is listed more than once — a set names each purpose once',\n    });\n  }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/**\n * WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n *\n * ## Why this exists, and why in configuration\n *\n * A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n *\n * That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n *\n * Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n *\n * ## What is deliberately NOT here\n *\n * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n *\n * ## Every part is independently declarable, and that is the point (issue #228)\n *\n * This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n *\n * Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n *\n * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a non-empty required purpose set still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n */\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n  /** The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. */\n  legalEntityName: z.string().trim().min(1).optional(),\n  /** Its registered address, as a reader would need it to serve a request. Absent means unanswered. */\n  registeredAddress: z.string().trim().min(1).optional(),\n  /**\n   * How a data subject reaches the operator about privacy — an address, an email, or a URL.\n   *\n   * Open string because all three are legitimate and the law names none: what matters is that a route\n   * exists and is stated, not what shape it takes.\n   */\n  privacyContact: z.string().trim().min(1).optional(),\n  /**\n   * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n   *\n   * Optional, because most operators are established where their subjects are and appointing one\n   * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n   * when declared.\n   */\n  representative: z.strictObject({\n    name: z.string().trim().min(1),\n    address: z.string().trim().min(1),\n  }).optional(),\n  /**\n   * The operator's role, per population of data. At least one.\n   *\n   * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n   */\n  roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n  /**\n   * The lawful basis relied on, per processing purpose. At least one.\n   *\n   * `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n   * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n   * complete answer.\n   */\n  lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).optional(),\n  /**\n   * What a person must consent to in order to use the service at all (issue #139).\n   *\n   * OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this\n   * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while\n   * absence is nobody having been asked, and a notice must not render the second as the first.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n  /**\n   * How the operator confirms that a person exercising a data-subject right is that person, before acting.\n   *\n   * The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the\n   * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step\n   * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).\n   * Prose, because procedures differ — \"requests from a signed-in account are verified by that session;\n   * requests by email are answered at the account's address\". Absent means undecided, and the\n   * `rights-and-complaint-route` fact then answers nothing (#454).\n   */\n  subjectRequestIdentityVerification: z.string().trim().min(1).optional(),\n}).superRefine((identity, context) => {\n  /*\n   * A declaration with nothing in it is a no-op that reads as an answer.\n   *\n   * Every part is independently optional so an operator can record the half they know (#228), and the\n   * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n   * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n   * consumer already renders as outstanding, while an empty object would satisfy the field and\n   * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n   * with no assessment and a consent gate that names nothing.\n   */\n  if (Object.values(identity).every((part) => part === undefined)) {\n    context.addIssue({\n      code: 'custom',\n      path: [],\n      message:\n        'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n        + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n    });\n  }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/**\n * The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n *\n * A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n *\n * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n */\nexport enum OperatorComplianceIdentityPart {\n  LEGAL_ENTITY_NAME = 'legalEntityName',\n  REGISTERED_ADDRESS = 'registeredAddress',\n  PRIVACY_CONTACT = 'privacyContact',\n  ROLE_ALLOCATIONS = 'roleAllocations',\n  LAWFUL_BASES = 'lawfulBases',\n  SUBJECT_REQUEST_IDENTITY_VERIFICATION = 'subjectRequestIdentityVerification',\n}\n\n/**\n * Which parts of the identity are still owed, in declaration order.\n *\n * Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n */\nexport function outstandingOperatorComplianceIdentityParts(\n  identity: ApplicationOperatorComplianceIdentity | undefined,\n): readonly OperatorComplianceIdentityPart[] {\n  return [\n    identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n    identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n    identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n    identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n    identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n    identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,\n  ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/**\n * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n *\n * `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n */\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] | undefined {\n  if (identity.lawfulBases === undefined) return undefined;\n  const order = Object.values(LawfulBasis);\n  return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n    .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/**\n * True when the operator declares more than one role, so a notice must not assign a single one.\n *\n * `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean | undefined {\n  if (identity.roleAllocations === undefined) return undefined;\n  return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}
+{"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACpC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,UAAU,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,wBAAwB,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,4LAA4L;SACrQ,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACvF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACpF,gGAAgG;QAChG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,KAAK,CAAC,UAAU,+BAA+B,EAAE,CAAC,CAAC;YAC9I,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACrE;;;;;;;;;OASG;IACH,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;IAC5B,8GAA4E,CAAA;AAC9E,CAAC,EAPW,8BAA8B,KAA9B,8BAA8B,QAOzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7F,QAAQ,EAAE,kCAAkC,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS;KAC9I,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { ConsentPurpose } from './consent-purposes.shared';\nimport { LawfulBasisPurposeRefSchema } from './purpose-ref.shared.schemas';\n\n/**\n * GDPR Art. 6(1) — the six lawful bases, closed by the article.\n *\n * Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n *\n * spec-cite: GDPR Art. 6(1)(a)–(f).\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.\n */\nexport enum LawfulBasis {\n  /** Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. */\n  CONSENT = 'CONSENT',\n  /** Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. */\n  CONTRACT = 'CONTRACT',\n  /** Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. */\n  LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n  /** Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. */\n  VITAL_INTERESTS = 'VITAL_INTERESTS',\n  /** Art. 6(1)(e) — necessary for a task in the public interest or official authority. */\n  PUBLIC_TASK = 'PUBLIC_TASK',\n  /**\n   * Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n   * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n   * is refused below.\n   */\n  LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/** Whether the operator decides the purposes of a processing, carries them out for someone else, or both. */\nexport enum OperatorProcessingRole {\n  /** The operator determines the purposes and means. */\n  CONTROLLER = 'CONTROLLER',\n  /** The operator processes on a customer's documented instructions — the usual B2B posture for customer records. */\n  PROCESSOR = 'PROCESSOR',\n  /** The operator and another party jointly determine purposes and means, and must have an arrangement saying how. */\n  JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/**\n * ONE role, over ONE population of data.\n *\n * A single role field would be the wrong shape, and the produced notice said so before this existed:\n * *\"This notice therefore does not assign a single legal role to all data processed in a workspace.\"*\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n *\n * `dataScope` is prose the operator writes, deliberately: it names a POPULATION of data (\"customer records in a\n * workspace\"), not a processing purpose, so a lawful basis's `purposeRef` (#1709) is not what it would key to. No\n * structured population vocabulary exists yet, and a ref to nothing would be worse than prose.\n */\nexport const OperatorRoleAllocationSchema = z.strictObject({\n  /** Which data this role covers, in the operator's own words — \"customer records in a workspace\". */\n  dataScope: z.string().trim().min(1),\n  role: z.enum(OperatorProcessingRole),\n  /**\n   * The resource types this role covers — the TYPED half of `dataScope` (#1710), so a running erasure or export can\n   * say who owes the Art. 19 communication for the subject in front of it. Optional: an allocation in prose only is\n   * still a valid statement for a notice, and a subject whose resource type no allocation names is reported as\n   * ROLE UNDECLARED, never guessed. `dataScope` stays the words a notice uses.\n   */\n  resourceTypes: z.array(z.string().trim().min(1)).min(1).optional(),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/**\n * One processing purpose and the basis the operator relies on for it.\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.\n */\nexport const OperatorLawfulBasisSchema = z.strictObject({\n  /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */\n  purpose: z.string().trim().min(1),\n  /**\n   * A STABLE id for this purpose, which a provider's or a system of record's compliance choice names\n   * (`providerComplianceChoices.<ref>.purposeRefs`) to say which purpose sending it data serves (#1709).\n   *\n   * Separate from `purpose` because the prose is the notice's wording and changes when the operator rewords it, while\n   * a link to it must survive the rewording. OPTIONAL, like every other part of this identity (#225): a basis with no\n   * ref is still a basis, and a recipient cannot link to it — which the recipients report names as a purpose not\n   * linked, never as a recipient with no purpose.\n   */\n  purposeRef: LawfulBasisPurposeRefSchema.optional(),\n  basis: z.enum(LawfulBasis),\n  /**\n   * The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n   * that needs a balancing test — see the superRefine below.\n   */\n  assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n  /*\n   * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n   * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n   * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n   * conclusion nobody reached.\n   */\n  if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['assessmentNote'],\n      message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n    });\n  }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/**\n * What a person must agree to in order to USE the service at all (issue #139).\n *\n * ## The near-miss this exists because of\n *\n * `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n *\n * Correcting it left a real hole, which a produced notice then reported in its own words:\n * *\"There is no declared surface for recording a service-wide consent requirement distinct from\n * analytics consent.\"* This is that surface.\n *\n * ## Why the required set may be empty, and usually should be\n *\n * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A non-empty required set says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n *\n * An EMPTY set is therefore the honest answer for most applications: *nothing is gated on consent;\n * the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*\n * A field that pushed applications toward declaring consent would be worse than the gap it closes.\n *\n * ## This is the ENFORCED half of the identity (#453)\n *\n * Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is\n * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is\n * the exception. `wildo config service-consent` projects it into the running application's\n * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in\n * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,\n * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the\n * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),\n * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push\n * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an\n * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they\n * already started. Signing in, refreshing a session and signing out are not resource operations and stay\n * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count\n * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in\n * place of every signed-in route. A reader of\n * this schema must be able to tell the two apart without tracing the runtime, which is why it is said\n * here.\n *\n * ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n */\nexport const ServiceConsentRequirementSchema = z.strictObject({\n  /**\n   * The purposes a person must grant before they may use the service — a SET, never a level (#453).\n   *\n   * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a\n   * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is\n   * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.\n   *\n   * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that\n   * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.\n   */\n  requiredPurposes: z.array(z.enum(ConsentPurpose)),\n  /**\n   * What this gate actually controls, in the operator's own words.\n   *\n   * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody\n   * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n   * governs tells a person they must agree to something unnamed.\n   */\n  gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n  /*\n   * A required purpose with nothing described is the shape that satisfies the field and discloses\n   * nothing — the same defect as a revision recording no superseded rationale, and as a\n   * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n   * explanation is the half that makes it mean anything.\n   */\n  if (requirement.requiredPurposes.length > 0 && requirement.gatedProcessing === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['gatedProcessing'],\n      message: `requiring consent to ${requirement.requiredPurposes.join(', ')} gates something — say what, or declare no required purposes. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n    });\n  }\n  /*\n   * A purpose listed twice is not a stronger requirement, and a set that reads differently from how it\n   * compares is how two surfaces come to describe one gate differently.\n   */\n  if (new Set(requirement.requiredPurposes).size !== requirement.requiredPurposes.length) {\n    context.addIssue({\n      code: 'custom',\n      path: ['requiredPurposes'],\n      message: 'a required purpose is listed more than once — a set names each purpose once',\n    });\n  }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/**\n * WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n *\n * ## Why this exists, and why in configuration\n *\n * A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n *\n * That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n *\n * Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n *\n * ## What is deliberately NOT here\n *\n * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n *\n * ## Every part is independently declarable, and that is the point (issue #228)\n *\n * This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n *\n * Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n *\n * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a non-empty required purpose set still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n */\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n  /** The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. */\n  legalEntityName: z.string().trim().min(1).optional(),\n  /** Its registered address, as a reader would need it to serve a request. Absent means unanswered. */\n  registeredAddress: z.string().trim().min(1).optional(),\n  /**\n   * How a data subject reaches the operator about privacy — an address, an email, or a URL.\n   *\n   * Open string because all three are legitimate and the law names none: what matters is that a route\n   * exists and is stated, not what shape it takes.\n   */\n  privacyContact: z.string().trim().min(1).optional(),\n  /**\n   * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n   *\n   * Optional, because most operators are established where their subjects are and appointing one\n   * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n   * when declared.\n   */\n  representative: z.strictObject({\n    name: z.string().trim().min(1),\n    address: z.string().trim().min(1),\n  }).optional(),\n  /**\n   * The operator's role, per population of data. At least one.\n   *\n   * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n   */\n  roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n  /**\n   * The lawful basis relied on, per processing purpose. At least one.\n   *\n   * `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n   * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n   * complete answer.\n   */\n  lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).superRefine((bases, context) => {\n    // A purpose ref names ONE purpose, or a recipient linking to it would be linked to two (#1709).\n    const seen = new Set<string>();\n    bases.forEach((entry, index) => {\n      if (entry.purposeRef === undefined) return;\n      if (seen.has(entry.purposeRef)) {\n        context.addIssue({ code: 'custom', path: [index, 'purposeRef'], message: `purpose ref \"${entry.purposeRef}\" names more than one purpose` });\n      }\n      seen.add(entry.purposeRef);\n    });\n  }).optional(),\n  /**\n   * What a person must consent to in order to use the service at all (issue #139).\n   *\n   * OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this\n   * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while\n   * absence is nobody having been asked, and a notice must not render the second as the first.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n  /**\n   * How the operator confirms that a person exercising a data-subject right is that person, before acting.\n   *\n   * The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the\n   * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step\n   * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).\n   * Prose, because procedures differ — \"requests from a signed-in account are verified by that session;\n   * requests by email are answered at the account's address\". Absent means undecided, and the\n   * `rights-and-complaint-route` fact then answers nothing (#454).\n   */\n  subjectRequestIdentityVerification: z.string().trim().min(1).optional(),\n}).superRefine((identity, context) => {\n  /*\n   * A declaration with nothing in it is a no-op that reads as an answer.\n   *\n   * Every part is independently optional so an operator can record the half they know (#228), and the\n   * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n   * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n   * consumer already renders as outstanding, while an empty object would satisfy the field and\n   * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n   * with no assessment and a consent gate that names nothing.\n   */\n  if (Object.values(identity).every((part) => part === undefined)) {\n    context.addIssue({\n      code: 'custom',\n      path: [],\n      message:\n        'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n        + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n    });\n  }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/**\n * The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n *\n * A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n *\n * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n */\nexport enum OperatorComplianceIdentityPart {\n  LEGAL_ENTITY_NAME = 'legalEntityName',\n  REGISTERED_ADDRESS = 'registeredAddress',\n  PRIVACY_CONTACT = 'privacyContact',\n  ROLE_ALLOCATIONS = 'roleAllocations',\n  LAWFUL_BASES = 'lawfulBases',\n  SUBJECT_REQUEST_IDENTITY_VERIFICATION = 'subjectRequestIdentityVerification',\n}\n\n/**\n * Which parts of the identity are still owed, in declaration order.\n *\n * Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n */\nexport function outstandingOperatorComplianceIdentityParts(\n  identity: ApplicationOperatorComplianceIdentity | undefined,\n): readonly OperatorComplianceIdentityPart[] {\n  return [\n    identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n    identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n    identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n    identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n    identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n    identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,\n  ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/**\n * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n *\n * `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n */\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] | undefined {\n  if (identity.lawfulBases === undefined) return undefined;\n  const order = Object.values(LawfulBasis);\n  return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n    .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/**\n * True when the operator declares more than one role, so a notice must not assign a single one.\n *\n * `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean | undefined {\n  if (identity.roleAllocations === undefined) return undefined;\n  return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.d.ts

@@ -0,0 +1,52 @@
+import { type BuiltinProviderCapability } from '../../external-providers/provider-capability.shared.schemas';
+import { PersonalDataCategory } from './personal-data-category.shared.schemas';
+/**
+ * WHICH categories of personal data the ENGINE sends to a provider that serves a capability (#1709).
+ *
+ * ## Why a table the engine owns
+ *
+ * A record of processing lists the categories of personal data and the categories of recipients (GDPR Art. 30(1)(c),
+ * (d)); saying which categories reach which recipient is the practice that keeps the two lists consistent. For a
+ * provider reached through a CAPABILITY, the application writes no
+ * field map: the ENGINE composes the request — the recipient address of an email, the customer of a billing call,
+ * the prompt of a model call. So the categories are a fact about the engine's own behaviour, the same for every
+ * application, and the engine states it here rather than asking each operator to narrate it
+ * (`.claude/rules/derive-before-you-ask.md`).
+ *
+ * The provider compliance profile's header rejects restating this on each provider module, as "a second authority
+ * for one fact": the capability is the authority, and this is where it speaks.
+ *
+ * ## Total over the provider-capability vocabulary
+ *
+ * A `Record` over every {@link BuiltinProviderCapability}, so a capability added tomorrow is a compile error here
+ * until someone states what it sends. `null` is an ANSWER: the capability sends no personal data of the application's
+ * users to the vendor (a build-time coding agent works on source code).
+ *
+ * ## Read it as a FLOOR of what reaches the vendor, never a ceiling
+ *
+ * `USER_CONTENT` is listed wherever free text a person wrote rides the call (a prompt, a message body, a search
+ * query), and free text can carry ANY other category — see {@link PersonalDataCategory.USER_CONTENT}. A notice
+ * states the listed categories and must not conclude that nothing else ever reaches the vendor.
+ *
+ * @wildo_source:part:start saas.models.privacy.provider-capability-disclosure facet:layer:shared facet:audience:app-developer
+ */
+export interface ProviderCapabilityDisclosure {
+    /** The categories the engine sends when it calls a provider for this capability. */
+    readonly categories: readonly PersonalDataCategory[];
+    /** What in the call carries them — so a reader can check the claim against the engine's behaviour. */
+    readonly carriedBy: string;
+}
+export declare const PROVIDER_CAPABILITY_DISCLOSURES: Readonly<Record<BuiltinProviderCapability, ProviderCapabilityDisclosure | null>>;
+/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */
+/**
+ * The categories disclosed through a set of capabilities, as the population's data paths name them — provider
+ * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).
+ *
+ * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the
+ * {@link PersonalDataCategory} enum order, so one application produces one sentence.
+ */
+export declare function personalDataDisclosedThroughCapabilities(tokens: readonly string[]): {
+    readonly categories: readonly PersonalDataCategory[];
+    readonly undeclared: readonly string[];
+};
+//# sourceMappingURL=provider-capability-disclosure.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-capability-disclosure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,4BAA4B;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,GAAG,IAAI,CAAC,CAmF5H,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG;IACnF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAkBA"}

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.js

@@ -0,0 +1,116 @@
+import { BUILTIN_PROVIDER_CAPABILITY, } from '../../external-providers/provider-capability.shared.schemas.js';
+import { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY } from '../../external-providers/engine-capabilities.shared.schemas.js';
+import { PersonalDataCategory } from './personal-data-category.shared.schemas.js';
+export const PROVIDER_CAPABILITY_DISCLOSURES = {
+    [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY, PersonalDataCategory.CREDENTIALS, PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the recipient address, the recipient name the templates address, the rendered message body, and the magic-link, verification and password-reset tokens the engine\'s own mails carry',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY],
+        carriedBy: 'the subscriber address and name synchronised to the audience',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the sender and recipient addresses, and the message bodies and attachments the vendor receives and holds',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.SMS]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.CREDENTIALS],
+        carriedBy: 'the telephone number, and the one-time verification code the message carries',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.BILLING]: {
+        categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.FINANCIAL],
+        carriedBy: 'the customer name and email address, and the payment, subscription and invoice records',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.SSO_OAUTH2]: {
+        categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],
+        carriedBy: 'the sign-in request, which may name the account (login hint), and the identity the vendor asserts back',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.SSO_SAML]: {
+        categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],
+        carriedBy: 'the authentication request and the asserted subject',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the prompt and the context the application assembles into it',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the text of every field a resource marks as a retrieval source, sent to be embedded',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the bytes of every uploaded document sent for text extraction',
+    },
+    // Build-time tooling: a coding run sends the application's SOURCE CODE and specifications, not a user's data.
+    [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: null,
+    [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the image prompt',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: {
+        categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],
+        carriedBy: 'the error event with its device, browser and page context, and the signed-in user identifier when the application attaches it',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: {
+        categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],
+        carriedBy: 'the product events and the identifier the application identifies the person by',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_SEARCH]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the search query the person types',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_FILE_PICKER]: {
+        categories: [PersonalDataCategory.USER_CONTENT],
+        carriedBy: 'the files the person picks from their own account at the vendor',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA]: {
+        categories: [PersonalDataCategory.USAGE],
+        carriedBy: 'the interaction and device signals the challenge scores',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ADDRESS_LOOKUP]: {
+        categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.LOCATION],
+        carriedBy: 'the address text the person types and the place it resolves to',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: {
+        categories: [PersonalDataCategory.USER_CONTENT, PersonalDataCategory.USAGE],
+        carriedBy: 'the traced generation — its prompt and output — and the call metadata',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: {
+        categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],
+        carriedBy: 'the traces, metrics and logs of requests, which carry request metadata and the acting user\'s identifier on each span',
+    },
+    [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: {
+        categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.USAGE],
+        carriedBy: 'every audit event: the acting user, the subject, and what was done',
+    },
+};
+/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */
+/**
+ * The categories disclosed through a set of capabilities, as the population's data paths name them — provider
+ * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).
+ *
+ * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the
+ * {@link PersonalDataCategory} enum order, so one application produces one sentence.
+ */
+export function personalDataDisclosedThroughCapabilities(tokens) {
+    const found = new Set();
+    const undeclared = [];
+    const disclosuresByProviderCapability = PROVIDER_CAPABILITY_DISCLOSURES;
+    for (const token of tokens) {
+        const providerCapabilities = token in disclosuresByProviderCapability
+            ? [token]
+            : Object.entries(PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY).filter(([, engineCapability]) => engineCapability === token).map(([providerCapability]) => providerCapability);
+        if (providerCapabilities.length === 0) {
+            undeclared.push(token);
+            continue;
+        }
+        for (const providerCapability of providerCapabilities) {
+            for (const category of disclosuresByProviderCapability[providerCapability]?.categories ?? [])
+                found.add(category);
+        }
+    }
+    const order = Object.values(PersonalDataCategory);
+    return { categories: order.filter((category) => found.has(category)), undeclared: [...new Set(undeclared)].sort() };
+}
+//# sourceMappingURL=provider-capability-disclosure.shared.schemas.js.map

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-capability-disclosure.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAE5B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AACvH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAuC/E,MAAM,CAAC,MAAM,+BAA+B,GAAqF;IAC/H,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE;QACjD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACtJ,SAAS,EAAE,sLAAsL;KAClM;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE;QAC3C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACrF,SAAS,EAAE,0GAA0G;KACtH;IACD,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE;QACjC,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,WAAW,CAAC;QACpF,SAAS,EAAE,8EAA8E;KAC1F;IACD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE;QACrC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,SAAS,CAAC;QACjH,SAAS,EAAE,wFAAwF;KACpG;IACD,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE;QACxC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,wGAAwG;KACpH;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,qDAAqD;KACjE;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE;QAC5C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,qFAAqF;KACjG;IACD,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE;QACtD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,+DAA+D;KAC3E;IACD,8GAA8G;IAC9G,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,IAAI;IAChD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,kBAAkB;KAC9B;IACD,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE;QACvD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,+HAA+H;KAC3I;IACD,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE;QACxD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,gFAAgF;KAC5F;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,mCAAmC;KAC/C;IACD,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,EAAE;QAClD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,iEAAiE;KAC7E;IACD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC;QACxC,SAAS,EAAE,yDAAyD;KACrE;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,gEAAgE;KAC5E;IACD,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE;QAC/C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC;QAC3E,SAAS,EAAE,uEAAuE;KACnF;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,uHAAuH;KACnI;IACD,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE;QACpD,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACvE,SAAS,EAAE,oEAAoE;KAChF;CACF,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAAyB;IAIhF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,+BAA+B,GAAG,+BAAgG,CAAC;IACzI,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,oBAAoB,GAAG,KAAK,IAAI,+BAA+B;YACnE,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC5K,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,kBAAkB,IAAI,oBAAoB,EAAE,CAAC;YACtD,KAAK,MAAM,QAAQ,IAAI,+BAA+B,CAAC,kBAAkB,CAAC,EAAE,UAAU,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACtH,CAAC","sourcesContent":["import {\n  BUILTIN_PROVIDER_CAPABILITY,\n  type BuiltinProviderCapability,\n} from '../../external-providers/provider-capability.shared.schemas';\nimport { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY } from '../../external-providers/engine-capabilities.shared.schemas';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/**\n * WHICH categories of personal data the ENGINE sends to a provider that serves a capability (#1709).\n *\n * ## Why a table the engine owns\n *\n * A record of processing lists the categories of personal data and the categories of recipients (GDPR Art. 30(1)(c),\n * (d)); saying which categories reach which recipient is the practice that keeps the two lists consistent. For a\n * provider reached through a CAPABILITY, the application writes no\n * field map: the ENGINE composes the request — the recipient address of an email, the customer of a billing call,\n * the prompt of a model call. So the categories are a fact about the engine's own behaviour, the same for every\n * application, and the engine states it here rather than asking each operator to narrate it\n * (`.claude/rules/derive-before-you-ask.md`).\n *\n * The provider compliance profile's header rejects restating this on each provider module, as \"a second authority\n * for one fact\": the capability is the authority, and this is where it speaks.\n *\n * ## Total over the provider-capability vocabulary\n *\n * A `Record` over every {@link BuiltinProviderCapability}, so a capability added tomorrow is a compile error here\n * until someone states what it sends. `null` is an ANSWER: the capability sends no personal data of the application's\n * users to the vendor (a build-time coding agent works on source code).\n *\n * ## Read it as a FLOOR of what reaches the vendor, never a ceiling\n *\n * `USER_CONTENT` is listed wherever free text a person wrote rides the call (a prompt, a message body, a search\n * query), and free text can carry ANY other category — see {@link PersonalDataCategory.USER_CONTENT}. A notice\n * states the listed categories and must not conclude that nothing else ever reaches the vendor.\n *\n * @wildo_source:part:start saas.models.privacy.provider-capability-disclosure facet:layer:shared facet:audience:app-developer\n */\nexport interface ProviderCapabilityDisclosure {\n  /** The categories the engine sends when it calls a provider for this capability. */\n  readonly categories: readonly PersonalDataCategory[];\n  /** What in the call carries them — so a reader can check the claim against the engine's behaviour. */\n  readonly carriedBy: string;\n}\n\nexport const PROVIDER_CAPABILITY_DISCLOSURES: Readonly<Record<BuiltinProviderCapability, ProviderCapabilityDisclosure | null>> = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY, PersonalDataCategory.CREDENTIALS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the recipient address, the recipient name the templates address, the rendered message body, and the magic-link, verification and password-reset tokens the engine\\'s own mails carry',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the subscriber address and name synchronised to the audience',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the sender and recipient addresses, and the message bodies and attachments the vendor receives and holds',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.CREDENTIALS],\n    carriedBy: 'the telephone number, and the one-time verification code the message carries',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.FINANCIAL],\n    carriedBy: 'the customer name and email address, and the payment, subscription and invoice records',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_OAUTH2]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the sign-in request, which may name the account (login hint), and the identity the vendor asserts back',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_SAML]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the authentication request and the asserted subject',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the prompt and the context the application assembles into it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the text of every field a resource marks as a retrieval source, sent to be embedded',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the bytes of every uploaded document sent for text extraction',\n  },\n  // Build-time tooling: a coding run sends the application's SOURCE CODE and specifications, not a user's data.\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: null,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the image prompt',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the error event with its device, browser and page context, and the signed-in user identifier when the application attaches it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the product events and the identifier the application identifies the person by',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_SEARCH]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the search query the person types',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_FILE_PICKER]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the files the person picks from their own account at the vendor',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA]: {\n    categories: [PersonalDataCategory.USAGE],\n    carriedBy: 'the interaction and device signals the challenge scores',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ADDRESS_LOOKUP]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.LOCATION],\n    carriedBy: 'the address text the person types and the place it resolves to',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: {\n    categories: [PersonalDataCategory.USER_CONTENT, PersonalDataCategory.USAGE],\n    carriedBy: 'the traced generation — its prompt and output — and the call metadata',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the traces, metrics and logs of requests, which carry request metadata and the acting user\\'s identifier on each span',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.USAGE],\n    carriedBy: 'every audit event: the acting user, the subject, and what was done',\n  },\n};\n/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */\n\n/**\n * The categories disclosed through a set of capabilities, as the population's data paths name them — provider\n * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).\n *\n * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the\n * {@link PersonalDataCategory} enum order, so one application produces one sentence.\n */\nexport function personalDataDisclosedThroughCapabilities(tokens: readonly string[]): {\n  readonly categories: readonly PersonalDataCategory[];\n  readonly undeclared: readonly string[];\n} {\n  const found = new Set<PersonalDataCategory>();\n  const undeclared: string[] = [];\n  const disclosuresByProviderCapability = PROVIDER_CAPABILITY_DISCLOSURES as Readonly<Record<string, ProviderCapabilityDisclosure | null>>;\n  for (const token of tokens) {\n    const providerCapabilities = token in disclosuresByProviderCapability\n      ? [token]\n      : Object.entries(PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY).filter(([, engineCapability]) => engineCapability === token).map(([providerCapability]) => providerCapability);\n    if (providerCapabilities.length === 0) {\n      undeclared.push(token);\n      continue;\n    }\n    for (const providerCapability of providerCapabilities) {\n      for (const category of disclosuresByProviderCapability[providerCapability]?.categories ?? []) found.add(category);\n    }\n  }\n  const order = Object.values(PersonalDataCategory);\n  return { categories: order.filter((category) => found.has(category)), undeclared: [...new Set(undeclared)].sort() };\n}\n"]}

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+/**
+ * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.
+ *
+ * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that
+ * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the
+ * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator
+ * identity's module graph with it.
+ */
+export declare const LawfulBasisPurposeRefSchema: z.ZodString;
+//# sourceMappingURL=purpose-ref.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purpose-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAAoG,CAAC"}

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.js

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+/**
+ * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.
+ *
+ * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that
+ * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the
+ * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator
+ * identity's module graph with it.
+ */
+export const LawfulBasisPurposeRefSchema = z.string().trim().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'a purpose ref is a lower-case kebab slug');
+//# sourceMappingURL=purpose-ref.shared.schemas.js.map

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purpose-ref.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE,0CAA0C,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.\n *\n * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that\n * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the\n * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator\n * identity's module graph with it.\n */\nexport const LawfulBasisPurposeRefSchema = z.string().trim().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'a purpose ref is a lower-case kebab slug');\n"]}

package/dist/esm/compliance/privacy/retention-binding.shared.utils.d.ts

@@ -0,0 +1,93 @@
+import type { z } from 'zod';
+import { type ApplicationRetentionSchedule, type ResourceRetentionBinding } from './retention-schedule.shared.schemas';
+/** The infrastructure-owned creation instant both adapters maintain. */
+export declare const RETENTION_CREATED_AT_FIELD_NAME = "createdAt";
+/** The infrastructure-owned last-update instant both adapters maintain. */
+export declare const RETENTION_UPDATED_AT_FIELD_NAME = "updatedAt";
+/**
+ * The field whose value is a bound row's retention start instant (or, for
+ * {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}, the instant the start is derived from).
+ *
+ * Throws for a {@link RetentionStartPoint.CLOSURE_EVENT} binding with no `closureFieldName`: the factory
+ * refuses that configuration, so reaching it here means a binding bypassed the factory, and guessing a
+ * field would delete rows by the wrong clock.
+ */
+export declare function resolveRetentionStartFieldName(binding: ResourceRetentionBinding): string;
+/**
+ * The rows a bound resource must delete at `now`: those whose {@link BoundRetentionCutoff.fieldName} is
+ * STRICTLY before {@link BoundRetentionCutoff.before}.
+ *
+ * A row is deleted only AFTER `start + retentionDays`, never at it: a row whose start is exactly
+ * `now − retentionDays` has reached the end of its period and not passed it, so it survives this run.
+ *
+ * For {@link RetentionStartPoint.END_OF_CALENDAR_YEAR} the comparison is still on `createdAt`, rewritten
+ * so no per-row arithmetic is needed: `endOfYear(createdAt) + days < now` holds exactly when `createdAt`
+ * falls in a year BEFORE the year of `now − days`, i.e. `createdAt < 1 January (UTC) of year(now − days)`.
+ */
+export interface BoundRetentionCutoff {
+    readonly fieldName: string;
+    readonly before: Date;
+}
+export declare function resolveBoundRetentionCutoff(binding: ResourceRetentionBinding, retentionDays: number, now: Date): BoundRetentionCutoff;
+/**
+ * When `row`'s retention clock started, or `undefined` while its start point has not occurred (an open
+ * CLOSURE_EVENT row, a SCOPE_DELETED row whose organization still exists).
+ */
+export declare function resolveRetentionStartedAt(row: Record<string, unknown>, binding: ResourceRetentionBinding): Date | undefined;
+/**
+ * The instant after which `row` is deleted under the CURRENT schedule, or `undefined` when its start
+ * point has not occurred or its class declares no period (undeclared is "not decided", never "now").
+ */
+export declare function resolveRetentionExpiresAt(row: Record<string, unknown>, binding: ResourceRetentionBinding, schedule: ApplicationRetentionSchedule | undefined): Date | undefined;
+/**
+ * A declared `.ttl()` ROW-EXPIRY policy: rows expire `expireAfterSeconds` after `fieldName`'s value.
+ *
+ * `expireAfterSeconds: 0` means the field IS the absolute expiry instant (`jobPayloadStorage.expiresAt`);
+ * a positive value is a window measured from the field (`jobExecutions.createdAt`). These are MongoDB's
+ * `expireAfterSeconds` semantics verbatim, so one declaration cannot mean two things per adapter.
+ *
+ * Distinct from a {@link ResourceRetentionBinding} on purpose: `.ttl()` is a fixed number of seconds on a
+ * field, for framework plumbing that holds no business or personal data, and MongoDB honours it NATIVELY
+ * with no application code running. A resource holding such data binds a class instead, and a resource
+ * may not declare both (one row, one retention authority).
+ */
+export interface RowTtlPolicy {
+    readonly fieldName: string;
+    readonly expireAfterSeconds: number;
+}
+/**
+ * Every `.ttl()` declaration on a resource's main schema — ONE authority, read by the SQL planner, the
+ * `.ttl()` sweep, the startup refusals and the resource factory.
+ *
+ * Tolerates a non-object schema (it declares no fields, so no TTL): this is called while enumerating
+ * EVERY registered resource, and one exotic schema must not take the enumeration down.
+ */
+export declare function collectRowTtlPolicies(mainSchema: z.ZodTypeAny): RowTtlPolicy[];
+/** The part of a resource configuration the gap report reads. Structural, so it takes a registry's configs as-is. */
+export interface RetentionBindingGapInput {
+    readonly resourceIdentifier: string;
+    readonly retentionBinding?: ResourceRetentionBinding;
+    readonly mainSchema?: unknown;
+}
+/**
+ * THE rule for "kept until erased": a resource no retention mechanism ever deletes has no class binding
+ * and no `.ttl()`. One predicate, so the startup report (which reads schemas) and the RETENTION_RULES
+ * document fact (which receives `declaresRowTtl` across a JSON boundary) cannot disagree about who is in
+ * the list.
+ */
+export declare function isKeptUntilErased(resource: {
+    readonly retentionBinding?: unknown;
+    readonly declaresRowTtl: boolean;
+}): boolean;
+/**
+ * The resources whose rows no retention mechanism ever deletes: no class binding and no `.ttl()`.
+ *
+ * Kept until erased. That is today's behaviour for every unbound resource and is not wrong in itself —
+ * it is UNDECIDED, and this report is what keeps it visible next to `undeclaredRetentionClasses`, in the
+ * compliance documents and in the startup log. Rejected: defaulting every unbound resource to
+ * `RESOURCE_DATA`. That would silently delete data nobody decided about.
+ *
+ * Sorted, so two runs over the same registry produce the same list.
+ */
+export declare function unboundRetentionResources(resources: Iterable<RetentionBindingGapInput>): readonly string[];
+//# sourceMappingURL=retention-binding.shared.utils.d.ts.map

package/dist/esm/compliance/privacy/retention-binding.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention-binding.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-binding.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC9B,MAAM,qCAAqC,CAAC;AAsB7C,wEAAwE;AACxE,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAC3D,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAE3D;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAexF;AAYD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,wBAAwB,EACjC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,IAAI,GACR,oBAAoB,CAOtB;AASD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,GAChC,IAAI,GAAG,SAAS,CAIlB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,IAAI,GAAG,SAAS,CAKlB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,YAAY,EAAE,CAgB9E;AAMD,qHAAqH;AACrH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAE9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAAG,SAAS,MAAM,EAAE,CAO1G"}

package/dist/esm/compliance/privacy/retention-binding.shared.utils.js

@@ -0,0 +1,149 @@
+import { getTtlParams, getZodObjectShape, hasTtl } from '@wildo-ai/zod-decorators';
+import { RETENTION_STARTED_AT_FIELD_NAME, RetentionStartPoint, } from './retention-schedule.shared.schemas.js';
+/**
+ * # Retention binding derivations — one authority for "when does a bound row expire"
+ *
+ * Every consumer of a retention binding asks one of four questions, and each is answered here once:
+ *
+ * | question | function | consumers |
+ * |---|---|---|
+ * | which field carries the start instant? | {@link resolveRetentionStartFieldName} | the sweep's query, the factory's field checks |
+ * | which rows are past their period now? | {@link resolveBoundRetentionCutoff} | the sweep, the startup past-expiry report |
+ * | when did THIS row's clock start / when does it end? | {@link resolveRetentionStartedAt} / {@link resolveRetentionExpiresAt} | subject erasure's `retainedUntil` (#1635), deletion evidence (#1636) |
+ * | which resources hold data nobody bound? | {@link unboundRetentionResources} | compliance documents, the startup report |
+ *
+ * Pure and adapter-neutral: the cutoff is a single `field < instant` comparison, which MongoDB and both
+ * PostgreSQL filter compilers evaluate identically — and a NULL start instant matches neither, which is
+ * exactly "a row whose start point has not occurred never expires" (#1613 invariant 2), by construction
+ * rather than by a guard somebody could forget.
+ */
+const MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;
+/** The infrastructure-owned creation instant both adapters maintain. */
+export const RETENTION_CREATED_AT_FIELD_NAME = 'createdAt';
+/** The infrastructure-owned last-update instant both adapters maintain. */
+export const RETENTION_UPDATED_AT_FIELD_NAME = 'updatedAt';
+/**
+ * The field whose value is a bound row's retention start instant (or, for
+ * {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}, the instant the start is derived from).
+ *
+ * Throws for a {@link RetentionStartPoint.CLOSURE_EVENT} binding with no `closureFieldName`: the factory
+ * refuses that configuration, so reaching it here means a binding bypassed the factory, and guessing a
+ * field would delete rows by the wrong clock.
+ */
+export function resolveRetentionStartFieldName(binding) {
+    switch (binding.startPoint) {
+        case RetentionStartPoint.CREATED:
+        case RetentionStartPoint.END_OF_CALENDAR_YEAR:
+            return RETENTION_CREATED_AT_FIELD_NAME;
+        case RetentionStartPoint.LAST_UPDATED:
+            return RETENTION_UPDATED_AT_FIELD_NAME;
+        case RetentionStartPoint.SCOPE_DELETED:
+            return RETENTION_STARTED_AT_FIELD_NAME;
+        case RetentionStartPoint.CLOSURE_EVENT:
+            if (!binding.closureFieldName) {
+                throw new Error('A CLOSURE_EVENT retention binding must name its closureFieldName.');
+            }
+            return binding.closureFieldName;
+    }
+}
+/** The instant 00:00:00.000 UTC on 1 January of `instant`'s UTC year. */
+function startOfUtcYear(instant) {
+    return new Date(Date.UTC(instant.getUTCFullYear(), 0, 1));
+}
+/** The last millisecond of `instant`'s UTC year: 31 December 23:59:59.999 UTC. */
+function endOfUtcYear(instant) {
+    return new Date(Date.UTC(instant.getUTCFullYear() + 1, 0, 1) - 1);
+}
+export function resolveBoundRetentionCutoff(binding, retentionDays, now) {
+    const fieldName = resolveRetentionStartFieldName(binding);
+    const periodStartedBefore = new Date(now.getTime() - retentionDays * MILLISECONDS_PER_DAY);
+    if (binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR) {
+        return { fieldName, before: startOfUtcYear(periodStartedBefore) };
+    }
+    return { fieldName, before: periodStartedBefore };
+}
+function readInstant(row, fieldName) {
+    const value = row[fieldName];
+    if (value === null || value === undefined)
+        return undefined;
+    const instant = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(instant.getTime()) ? undefined : instant;
+}
+/**
+ * When `row`'s retention clock started, or `undefined` while its start point has not occurred (an open
+ * CLOSURE_EVENT row, a SCOPE_DELETED row whose organization still exists).
+ */
+export function resolveRetentionStartedAt(row, binding) {
+    const instant = readInstant(row, resolveRetentionStartFieldName(binding));
+    if (!instant)
+        return undefined;
+    return binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR ? endOfUtcYear(instant) : instant;
+}
+/**
+ * The instant after which `row` is deleted under the CURRENT schedule, or `undefined` when its start
+ * point has not occurred or its class declares no period (undeclared is "not decided", never "now").
+ */
+export function resolveRetentionExpiresAt(row, binding, schedule) {
+    const period = schedule?.[binding.retentionClass];
+    const startedAt = resolveRetentionStartedAt(row, binding);
+    if (!period || !startedAt)
+        return undefined;
+    return new Date(startedAt.getTime() + period.retentionDays * MILLISECONDS_PER_DAY);
+}
+/**
+ * Every `.ttl()` declaration on a resource's main schema — ONE authority, read by the SQL planner, the
+ * `.ttl()` sweep, the startup refusals and the resource factory.
+ *
+ * Tolerates a non-object schema (it declares no fields, so no TTL): this is called while enumerating
+ * EVERY registered resource, and one exotic schema must not take the enumeration down.
+ */
+export function collectRowTtlPolicies(mainSchema) {
+    let shape;
+    try {
+        shape = getZodObjectShape(mainSchema);
+    }
+    catch {
+        return [];
+    }
+    if (!shape)
+        return [];
+    const policies = [];
+    for (const [fieldName, fieldSchema] of Object.entries(shape)) {
+        if (!fieldSchema || !hasTtl(fieldSchema))
+            continue;
+        const params = getTtlParams(fieldSchema);
+        if (!params)
+            continue;
+        policies.push({ fieldName, expireAfterSeconds: params.expireAfterSeconds });
+    }
+    return policies;
+}
+/**
+ * THE rule for "kept until erased": a resource no retention mechanism ever deletes has no class binding
+ * and no `.ttl()`. One predicate, so the startup report (which reads schemas) and the RETENTION_RULES
+ * document fact (which receives `declaresRowTtl` across a JSON boundary) cannot disagree about who is in
+ * the list.
+ */
+export function isKeptUntilErased(resource) {
+    return !resource.retentionBinding && !resource.declaresRowTtl;
+}
+/**
+ * The resources whose rows no retention mechanism ever deletes: no class binding and no `.ttl()`.
+ *
+ * Kept until erased. That is today's behaviour for every unbound resource and is not wrong in itself —
+ * it is UNDECIDED, and this report is what keeps it visible next to `undeclaredRetentionClasses`, in the
+ * compliance documents and in the startup log. Rejected: defaulting every unbound resource to
+ * `RESOURCE_DATA`. That would silently delete data nobody decided about.
+ *
+ * Sorted, so two runs over the same registry produce the same list.
+ */
+export function unboundRetentionResources(resources) {
+    const unbound = [];
+    for (const resource of resources) {
+        const declaresRowTtl = Boolean(resource.mainSchema) && collectRowTtlPolicies(resource.mainSchema).length > 0;
+        if (isKeptUntilErased({ retentionBinding: resource.retentionBinding, declaresRowTtl }))
+            unbound.push(resource.resourceIdentifier);
+    }
+    return unbound.sort();
+}
+//# sourceMappingURL=retention-binding.shared.utils.js.map