npm - @wildo-ai/saas-models - Versions diffs - 1.1.5 → 1.1.7 - Mend

@wildo-ai/saas-models 1.1.5 → 1.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1295) hide show

package/dist/esm/compliance/documents/governed-documents.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"governed-documents.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/documents/governed-documents.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,2CAA2C,GAAG,+DAA+D,CAAC;AAE3H,MAAM,0BAA0B,GAAG,oEAAoE,CAAC;AACxG,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH,MAAM,eAAe,GAAG,CAAC,MAAyB,EAAW,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;AACvG,MAAM,wBAAwB,GAAG,CAAC,MAAyB,EAAW,EAAE,CACtE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtG,MAAM,oBAAoB,GAAG,CAAC,MAAyB,EAAE,OAAwB,EAAE,IAAmB,EAAE,KAAa,EAAQ,EAAE;IAC7H,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAyB,CAAC;AAG5H,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAClF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAElH,qIAAqI;AACrI,MAAM,CAAN,IAAY,qBAUX;AAVD,WAAY,qBAAqB;IAC/B,wDAA+B,CAAA;IAC/B,gEAAuC,CAAA;IACvC,gEAAuC,CAAA;IACvC,sEAA6C,CAAA;IAC7C,sCAAa,CAAA;IACb,8CAAqB,CAAA;IACrB,gFAAuD,CAAA;IACvD,sEAA6C,CAAA;IAC7C,gEAAuC,CAAA;AACzC,CAAC,EAVW,qBAAqB,KAArB,qBAAqB,QAUhC;AAED,qIAAqI;AACrI,MAAM,CAAN,IAAY,qCAKX;AALD,WAAY,qCAAqC;IAC/C,0EAAiC,CAAA;IACjC,sFAA6C,CAAA;IAC7C,oFAA2C,CAAA;IAC3C,wFAA+C,CAAA;AACjD,CAAC,EALW,qCAAqC,KAArC,qCAAqC,QAKhD;AAED,MAAM,CAAN,IAAY,4BAQX;AARD,WAAY,4BAA4B;IACtC,iEAAiC,CAAA;IACjC,uEAAuC,CAAA;IACvC,qDAAqB,CAAA;IACrB,qEAAqC,CAAA;IACrC,uDAAuB,CAAA;IACvB,6EAA6C,CAAA;IAC7C,yEAAyC,CAAA;AAC3C,CAAC,EARW,4BAA4B,KAA5B,4BAA4B,QAQvC;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,gEAAyB,CAAA;IACzB,wEAAiC,CAAA;IACjC,4DAAqB,CAAA;AACvB,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,MAAM,CAAN,IAAY,oCAMX;AAND,WAAY,oCAAoC;IAC9C,uDAAe,CAAA;IACf,2DAAmB,CAAA;IACnB,mEAA2B,CAAA;IAC3B,uDAAe,CAAA;IACf,yEAAiC,CAAA;AACnC,CAAC,EANW,oCAAoC,KAApC,oCAAoC,QAM/C;AAED,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,kDAAe,CAAA;IACf,sDAAmB,CAAA;IACnB,wEAAqC,CAAA;IACrC,4DAAyB,CAAA;AAC3B,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAED,MAAM,CAAN,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,iDAAmB,CAAA;IACnB,qDAAuB,CAAA;IACvB,iDAAmB,CAAA;IACnB,mDAAqB,CAAA;IACrB,6CAAe,CAAA;IACf,mDAAqB,CAAA;IACrB,+EAAiD,CAAA;AACnD,CAAC,EARW,0BAA0B,KAA1B,0BAA0B,QAQrC;AAED,MAAM,CAAN,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAC5C,2DAAqB,CAAA;IACrB,2EAAqC,CAAA;IACrC,2DAAqB,CAAA;IACrB,2DAAqB,CAAA;AACvB,CAAC,EALW,kCAAkC,KAAlC,kCAAkC,QAK7C;AAED,MAAM,CAAN,IAAY,sCAMX;AAND,WAAY,sCAAsC;IAChD,mEAAyB,CAAA;IACzB,iFAAuC,CAAA;IACvC,+EAAqC,CAAA;IACrC,6EAAmC,CAAA;IACnC,yFAA+C,CAAA;AACjD,CAAC,EANW,sCAAsC,KAAtC,sCAAsC,QAMjD;AAED,MAAM,CAAN,IAAY,oCAGX;AAHD,WAAY,oCAAoC;IAC9C,+DAAuB,CAAA;IACvB,+DAAuB,CAAA;AACzB,CAAC,EAHW,oCAAoC,KAApC,oCAAoC,QAG/C;AAED,0HAA0H;AAC1H,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,wEAAqC,CAAA;IACrC,8EAA2C,CAAA;IAC3C,0EAAuC,CAAA;IACvC,kEAA+B,CAAA;IAC/B,0EAAuC,CAAA;AACzC,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAED,6HAA6H;AAC7H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAN,IAAY,8BAoCX;AApCD,WAAY,8BAA8B;IACxC;;;;;;;;;OASG;IACH,mFAAiD,CAAA;IACjD;;;;;;;;;OASG;IACH,yEAAuC,CAAA;IACvC;;;;;;;;;;;OAWG;IACH,mFAAiD,CAAA;AACnD,CAAC,EApCW,8BAA8B,KAA9B,8BAA8B,QAoCzC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,IAAoC,EAAW,EAAE,CAC7G,IAAI,KAAK,8BAA8B,CAAC,sBAAsB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,IAAoC,EAAW,EAAE,CACzG,IAAI,KAAK,8BAA8B,CAAC,sBAAsB,CAAC;AACjE,2EAA2E;AAE3E,MAAM,CAAN,IAAY,4BASX;AATD,WAAY,4BAA4B;IACtC,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uDAAuB,CAAA;IACvB,iDAAiB,CAAA;IACjB,uFAAuD,CAAA;IACvD,6EAA6C,CAAA;IAC7C,qDAAqB,CAAA;IACrB,+FAA+D,CAAA;AACjE,CAAC,EATW,4BAA4B,KAA5B,4BAA4B,QASvC;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,YAAY,CAAC;IACrE,aAAa,EAAE,yBAAyB;IACxC,iBAAiB,EAAE,yCAAyC;CAC7D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,WAAW,EAAE,yBAAyB;IACtC,eAAe,EAAE,yCAAyC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,QAAQ,EAAE,8BAA8B;IACxC,SAAS,EAAE,yBAAyB;IACpC,cAAc,EAAE,yCAAyC;CAC1D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,QAAyC,EAAU,EAAE,CACtG,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;AAE3H,iIAAiI;AACjI,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3E,WAAW,EAAE,yBAAyB;IACtC,eAAe,EAAE,yCAAyC;CAC3D,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,oCAUX;AAVD,WAAY,oCAAoC;IAC9C,qGAAqG;IACrG,6DAAqB,CAAA;IACrB;;;;;OAKG;IACH,iEAAyB,CAAA;AAC3B,CAAC,EAVW,oCAAoC,KAApC,oCAAoC,QAU/C;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC;KAC/D,YAAY,CAAC;IACZ,WAAW,EAAE,yBAAyB;IACtC,eAAe,EAAE,yCAAyC;IAC1D,eAAe,EAAE,qCAAqC;IACtD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;CAC3E,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,oBAAoB,CAAC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,CAAC;AAC7H,CAAC,CAAC,CAAC;AAGL,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5E,YAAY,EAAE,yBAAyB;IACvC,gBAAgB,EAAE,yCAAyC;CAC5D,CAAC,CAAC;AAGH,8IAA8I;AAC9I,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/E,YAAY,EAAE,yBAAyB;IACvC,gBAAgB,EAAE,yCAAyC;CAC5D,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,YAAY,CAAC;IACZ,uFAAuF;IACvF,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,UAAU,CAAC,uCAAuC,CAAC;IAC9G,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,yBAAyB;IACnC,YAAY,EAAE,yCAAyC;IACvD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACnD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CACvD,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,oBAAoB,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC7F,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtG,IAAI,KAAK,CAAC,WAAW,KAAK,qCAAqC,CAAC,qBAAqB,EAAE,CAAC;QACtF,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qEAAqE,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4DAA4D,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,+FAA+F;YACxG,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,oCAGX;AAHD,WAAY,oCAAoC;IAC9C,mEAA2B,CAAA;IAC3B,mFAA2C,CAAA;AAC7C,CAAC,EAHW,oCAAoC,KAApC,oCAAoC,QAG/C;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,YAAY,CAAC;IACZ,SAAS,EAAE,yBAAyB;IACpC,KAAK,EAAE,yCAAyC;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IACtD;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,oCAAoC,CAAC,mBAAmB,CAAC;IAC5F,IAAI,MAAM,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+DAA+D,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wDAAwD,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,UAAU,EAAE,yBAAyB;IACrC,KAAK,EAAE,yCAAyC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5D,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kDAAkD,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,uEAAuE;gBAChF,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9D,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mDAAmD,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wEAAwE;gBACjF,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,QAAQ,EAAE,qCAAqC;IAC/C,UAAU,EAAE,wCAAwC;IACpD,eAAe,EAAE,qCAAqC;IACtD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,QAAQ,EAAE,iCAAiC;IAC3C,WAAW,EAAE,iCAAiC;IAC9C,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACvD;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,8CAA8C,CAAC;IAC1E,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IAC3D,eAAe,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACjE,mBAAmB,EAAE,iDAAiD,CAAC,QAAQ,EAAE;CAClF,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;IACzF,oBAAoB,CAAC,OAAO,CAAC,uBAAuB,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACvH,oBAAoB,CAAC,OAAO,CAAC,uBAAuB,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACvH,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClG,oBAAoB,CAClB,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC,EAClG,OAAO,EACP,CAAC,mBAAmB,CAAC,EACrB,mBAAmB,CACpB,CAAC;IACF;;;;OAIG;IACH,IAAI,OAAO,CAAC,aAAa,KAAK,oCAAoC,CAAC,QAAQ,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gEAAgE,EAAE,IAAI,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,oCAAoC,CAAC,UAAU,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wDAAwD,EAAE,IAAI,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,IACE,OAAO,CAAC,eAAe;QACvB,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;QACtF,OAAO,CAAC,eAAe,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS;QAChE,OAAO,CAAC,eAAe,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAC1E,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0EAA0E,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACvJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS,CAAC,EAAE,CAAC;QAC5F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sFAAsF;YAC/F,IAAI,EAAE,CAAC,qBAAqB,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,CAAC,eAAe;QACvB,OAAO,CAAC,mBAAmB;QAC3B,kCAAkC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,kCAAkC,CAAC,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAC/I,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iEAAiE;YAC1E,IAAI,EAAE,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAChJ,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,6EAA6E;YACtF,IAAI,EAAE,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mCAAmC,CAAC,UAAU,CAAC;IAC1F,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,mCAAmC;IAC5C;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC;CACzE,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChG,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,sDAAsD,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;IACzD,cAAc,EAAE,gCAAgC;IAChD,aAAa,EAAE,+BAA+B;CACtC,CAAC,CAAC;AAGZ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,MAAM,CAAC,MAAM,CAAC;IACZ,CAAC,6BAA6B,CAAC,cAAc,CAAC,EAAE,UAAU;IAC1D,CAAC,6BAA6B,CAAC,aAAa,CAAC,EAAE,QAAQ;CACxD,CAAC,CAAC;AAEL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,WAAmB,EAAsB,EAAE,CAC/F,oCAA2E,CAAC,WAAW,CAAC,CAAC;AAE5F,oFAAoF;AACpF,MAAM,CAAN,IAAY,sCAGX;AAHD,WAAY,sCAAsC;IAChD,6DAAmB,CAAA;IACnB,mEAAyB,CAAA;AAC3B,CAAC,EAHW,sCAAsC,KAAtC,sCAAsC,QAGjD;AAED,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,OAAO,CAAC;IAC/D,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,uCAAuC,CAAC;CAC9G,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC;IAClE,SAAS,EAAE,yBAAyB;CACrC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnF,2CAA2C;IAC3C,8CAA8C;CAC/C,CAAC,CAAC;AAGH,MAAM,4CAA4C,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,qCAAqC;IAC9C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IACvD,UAAU,EAAE,iCAAiC;IAC7C,kBAAkB,EAAE,wCAAwC;CAC7D,CAAC,CAAC;AAEH,MAAM,0CAA0C,GAAG,CACjD,KAAqI,EACrI,OAAwB,EAClB,EAAE;IACR,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,CAAC,KAAK,CAAC,kBAAkB;QAAE,OAAO;IACtC,MAAM,cAAc,GAClB,KAAK,CAAC,OAAO,KAAK,sCAAsC,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,sCAAsC,CAAC,iBAAiB,CAAC;IACpJ,IAAI,cAAc,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,sCAAsC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,iEAAiE;YACjJ,IAAI,EAAE,CAAC,oBAAoB,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG,4CAA4C,CAAC,MAAM,CAAC;IACtG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,SAAS,CAAC;IACpE;;;;;;;OAOG;CACJ,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAG3D,MAAM,CAAC,MAAM,oCAAoC,GAAG,4CAA4C,CAAC,MAAM,CAAC;IACtG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,SAAS,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3C,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAG3D,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IACtF,oCAAoC;IACpC,oCAAoC;CACrC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC;KAC3D,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,qCAAqC;IAC/C,UAAU,EAAE,wCAAwC;IACpD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC;IACxE,QAAQ,EAAE,iCAAiC;IAC3C,WAAW,EAAE,iCAAiC;IAC9C,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACvD;;;;;;OAMG;IACH,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;CAC1E,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,gGAAgG;AAChG,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,YAAqC,EAA2C,EAAE;IACrI,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClE,OAAO,6CAA6C,CAAC,KAAK,CAAC;QACzD,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;KACzD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,kCAWX;AAXD,WAAY,kCAAkC;IAC5C,4DAA4D;IAC5D,2DAAqB,CAAA;IACrB;;;;;;OAMG;IACH,2EAAqC,CAAA;AACvC,CAAC,EAXW,kCAAkC,KAAlC,kCAAkC,QAW7C;AAED,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC;KAC1D,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,QAAQ,CAAC;IAC5D,OAAO,EAAE,6CAA6C;IACtD,OAAO,EAAE,mCAAmC;IAC5C;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;CAC5D,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,4DAA4D;YACrE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC9E,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mEAAmE;YAC5E,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,uEAAuE;AACvE,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,YAAY,CAAC;IAChF,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,gBAAgB,CAAC;IACpE,yDAAyD;IACzD,WAAW,EAAE,yBAAyB;IACtC,OAAO,EAAE,mCAAmC;CAC7C,CAAC,CAAC;AAGH,iHAAiH;AACjH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/E,4CAA4C;IAC5C,mDAAmD;CACpD,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport \"@wildo-ai/zod-decorators\";\n\n/*\n What a GOVERNED DOCUMENT is: its classes, audiences, review and publication vocabulary, its\n * identities, its governance scope, its public content, and the release and publication events that\n * record it being issued and withdrawn.\n \n ## What this file used to also be, and why that half is gone (2026-08-28)\n \n Until this revision the same file carried a complete SEALED DELIVERY MACHINE beside the\n * vocabulary: public-release and deployment BUNDLES with self-referential digests, deployment\n * OBSERVATIONS carrying canonical bytes plus a detached backend signature and a rotated-key\n * `notAfter` window, publication PROOF digests, interaction RECEIPTS, byte-exact retrieval queries,\n * and a dozen `canonicalizeDigestBasis` functions feeding them. Around it sat a backend registry\n that revalidated every digest at boot, two controllers, a CLI artifact-sync writing immutable\n * receipts, and a generated module the application loaded at startup.\n \n All of it is removed under `.claude/rules/one-source-of-truth.md` Rule 0 — nothing that is not\n branchable on git. A digest chain cannot merge: two branches that publish different content\n produce a merged tree whose digests belong to neither. What the machine protected — that a\n * published document is exactly the bytes somebody approved — is what git and the forge already\n * provide, per commit, mergeably, to a reviewer reading a diff.\n \n Two facts made the removal cheap rather than risky, and both were measured rather than assumed:\n * no application had ever produced a bundle (`.wildo-saas/generated/compliance/` was empty in\n * both example applications), and every read path was built on the seal, so there was no\n * non-sealed serving to preserve.\n \n ## What replaces it\n \n A read over committed files, not a custody protocol. A governed document is a FILE in the\n * application's specifications package, and a release is a record the application commits — since\n * 2026-09-12 carrying the text it publishes (`GovernedDocumentReleaseSchema.content`, #968), so the\n * commit that introduced the record is what binds a release to its words. What a public page serves\n * is `GovernedDocumentPublicDocument`: a release with its text, or the latest draft of a document\n * never released, chosen by `resolveInForcePublicDocument`. No digest, no bundle, no receipt.\n /\n\n/* Exact media type of the canonical browser-safe governed-document JSON bytes. /\nexport const GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE = \"application/vnd.wildo.governed-document.public+json;version=1\";\n\nconst governedDocumentRefPattern = /^[a-z][a-z0-9](?:[.-][a-z0-9]+)(?::[A-Za-z0-9][A-Za-z0-9._-])+$/;\nconst compareCanonicalText = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\nconst valuesAreUnique = (values: readonly string[]): boolean => new Set(values).size === values.length;\nconst valuesAreLexicallySorted = (values: readonly string[]): boolean =>\n values.every((value, index) => index === 0 \|\| compareCanonicalText(values[index - 1]!, value) <= 0);\n\nconst addUniqueSortedIssue = (values: readonly string[], context: z.RefinementCtx, path: PropertyKey[], label: string): void => {\n if (!valuesAreUnique(values) \|\| !valuesAreLexicallySorted(values)) {\n context.addIssue({ code: \"custom\", message: `${label} must be unique and lexically sorted`, path });\n }\n};\n\nexport const GovernedDocumentRefSchema = z.string().trim().regex(governedDocumentRefPattern).brand<\"GovernedDocumentRef\">();\nexport type GovernedDocumentRef = z.infer<typeof GovernedDocumentRefSchema>;\n\nexport const GovernedDocumentIsoDateTimeSchema = z.iso.datetime({ offset: true });\nexport const GovernedDocumentIsoDateSchema = z.iso.date();\n/** One runtime source for every governed-document version/order identity. /\nexport const GovernedDocumentPositiveSafeIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\n\n/* Semantic class of governed content. The class controls review, release and interaction rules; a public label never changes it. /\nexport enum GovernedDocumentClass {\n PUBLIC_NOTICE = \"PUBLIC_NOTICE\",\n CONTRACTUAL_TERMS = \"CONTRACTUAL_TERMS\",\n GOVERNANCE_POLICY = \"GOVERNANCE_POLICY\",\n PROCEDURE_OR_RUNBOOK = \"PROCEDURE_OR_RUNBOOK\",\n PLAN = \"PLAN\",\n REGISTER = \"REGISTER\",\n REVIEW_OR_DECISION_RECORD = \"REVIEW_OR_DECISION_RECORD\",\n ASSESSMENT_OR_REPORT = \"ASSESSMENT_OR_REPORT\",\n EVIDENCE_ARTIFACT = \"EVIDENCE_ARTIFACT\",\n}\n\n/* Whose facts and authority a document may speak for. Shared responsibility is explicit rather than a flattened synthetic owner. /\nexport enum GovernedDocumentGovernanceSubjectKind {\n WILDO_PROVIDER = \"WILDO_PROVIDER\",\n APPLICATION_OPERATOR = \"APPLICATION_OPERATOR\",\n TENANT_ORGANIZATION = \"TENANT_ORGANIZATION\",\n SHARED_RESPONSIBILITY = \"SHARED_RESPONSIBILITY\",\n}\n\nexport enum GovernedDocumentAudienceKind {\n PUBLIC_GENERAL = \"PUBLIC_GENERAL\",\n BUSINESS_CUSTOMER = \"BUSINESS_CUSTOMER\",\n CONSUMER = \"CONSUMER\",\n APPLICATION_USER = \"APPLICATION_USER\",\n WORKFORCE = \"WORKFORCE\",\n TENANT_ADMINISTRATOR = \"TENANT_ADMINISTRATOR\",\n QUALIFIED_REVIEWER = \"QUALIFIED_REVIEWER\",\n}\n\nexport enum GovernedDocumentApplicabilityStatus {\n APPLICABLE = \"APPLICABLE\",\n NOT_APPLICABLE = \"NOT_APPLICABLE\",\n DEFERRED = \"DEFERRED\",\n}\n\nexport enum GovernedDocumentFactResolutionStatus {\n KNOWN = \"KNOWN\",\n MISSING = \"MISSING\",\n CONFLICTING = \"CONFLICTING\",\n STALE = \"STALE\",\n NOT_APPLICABLE = \"NOT_APPLICABLE\",\n}\n\nexport enum GovernedDocumentCandidateStatus {\n DRAFT = \"DRAFT\",\n BLOCKED = \"BLOCKED\",\n READY_FOR_REVIEW = \"READY_FOR_REVIEW\",\n SUPERSEDED = \"SUPERSEDED\",\n}\n\nexport enum GovernedDocumentReviewKind {\n CONTENT = \"CONTENT\",\n TECHNICAL = \"TECHNICAL\",\n PRIVACY = \"PRIVACY\",\n SECURITY = \"SECURITY\",\n LEGAL = \"LEGAL\",\n BUSINESS = \"BUSINESS\",\n INDEPENDENT_ASSESSMENT = \"INDEPENDENT_ASSESSMENT\",\n}\n\nexport enum GovernedDocumentReviewDecisionKind {\n APPROVED = \"APPROVED\",\n CHANGES_REQUIRED = \"CHANGES_REQUIRED\",\n REJECTED = \"REJECTED\",\n CONFLICT = \"CONFLICT\",\n}\n\nexport enum GovernedDocumentPublicationChannelKind {\n PUBLIC_WEB = \"PUBLIC_WEB\",\n AUTHENTICATED_WEB = \"AUTHENTICATED_WEB\",\n DURABLE_DOWNLOAD = \"DURABLE_DOWNLOAD\",\n DIRECT_DELIVERY = \"DIRECT_DELIVERY\",\n GOVERNANCE_REPOSITORY = \"GOVERNANCE_REPOSITORY\",\n}\n\nexport enum GovernedDocumentPublicationEventKind {\n PUBLISHED = \"PUBLISHED\",\n WITHDRAWN = \"WITHDRAWN\",\n}\n\n/* Distinct legal/user interactions. A notice interaction, contract acceptance and consent decision are never aliases. /\nexport enum GovernedDocumentInteractionKind {\n NOTICE_DELIVERED = \"NOTICE_DELIVERED\",\n NOTICE_ACKNOWLEDGED = \"NOTICE_ACKNOWLEDGED\",\n CONTRACT_ACCEPTED = \"CONTRACT_ACCEPTED\",\n CONSENT_GIVEN = \"CONSENT_GIVEN\",\n CONSENT_WITHDRAWN = \"CONSENT_WITHDRAWN\",\n}\n\n/* @wildo_source:part:start saas.models.governed-document-acceptance-mode facet:layer:shared facet:audience:app-developer /\n/\n HOW an application asks a registrant to accept the documents it requires accepting — the three\n * shapes courts actually distinguish, declared once per application (#1258).\n \n Declared on `compliance.governedDocumentAcceptanceMode` in the application's own\n * `backend-api/src/saas-config.backend.ts`, beside `governedDocumentReleases` and `publicDocuments`.\n \n It is a RENDERING posture, not a server-side gate. The backend records whichever accepted release\n * ids a registration carries and does not know which mode produced them, so a client that does not\n * use the form is bound by none of the three. That is the honest scope: what the mode decides is how\n * strong a notice a person is given and what the form withholds until they act — the things a\n * registration screen can actually control.\n \n ## Why this is a declared CHOICE rather than one shipped behaviour\n \n Registration shipped with exactly one shape — an unticked box gating the submit button — and no\n * way to ask for another. That is the strongest of the three and it is the right DEFAULT, but it is\n * not the right answer for every application: a product whose terms are a one-paragraph acceptable-use\n * statement and a product whose terms carry an arbitration clause are not asking the same thing of the\n * same person, and the framework should let each say which it is asking.\n \n ## The enforceability ladder, which is what the members are ordered by\n \n Enforceability turns on whether the person had REASONABLE NOTICE of the terms and took an action\n * MANIFESTING ASSENT to them. Clickwrap — an affirmative act aimed at the terms themselves — is the\n * shape courts uphold most consistently; sign-in-wrap, where the act is the registration and the\n * notice sits beside it, is upheld when the notice is conspicuous and fails when it is buried;\n * browsewrap, where nothing but a footer link exists, is the shape that routinely fails. This\n * vocabulary offers the first two and does NOT offer the third, because an application that asks for\n * nothing is already representable by declaring no release that permits `CONTRACT_ACCEPTED`.\n \n (Drawn from the settled shape of US and EU practice on online contract formation, not from a single\n * cited authority. Not legal advice — an operator's counsel decides which their terms warrant.)\n \n ## Every member DOES something, deliberately\n \n Each one changes what the registration form renders and what it refuses. A member that only named a\n * posture without changing behaviour is the defect removed from this lane one commit earlier, when a\n * stored privacy-level field was deleted for meaning nothing at any call site.\n /\nexport enum GovernedDocumentAcceptanceMode {\n /\n SIGN-IN-WRAP — \"by registering you agree to our terms and privacy policy\", beside the button.\n \n No checkbox and no separate act: submitting the registration IS the act of assent, so the\n * accepted release ids still travel with it and the interaction is still recorded. What changes is\n * that nothing is withheld — the button is available from the first keystroke.\n \n The notice is rendered immediately above the submit control rather than in a footer, because\n * conspicuousness is the whole of what distinguishes this from the browsewrap shape that fails.\n /\n IMPLIED_BY_REGISTERING = \"IMPLIED_BY_REGISTERING\",\n /\n CLICKWRAP — an unticked box the person ticks, with the submit control unavailable until they do.\n \n The DEFAULT, and the framework default may not silently weaken: an application that declared\n * nothing shipped this behaviour before the vocabulary existed, and must keep shipping it.\n \n The box is never pre-ticked. A pre-ticked box is not an affirmative act, so it undermines the one\n * property this mode exists to provide — the same reason the consent gate's own optional purposes\n * start unticked.\n /\n EXPLICIT_CHECKBOX = \"EXPLICIT_CHECKBOX\",\n /\n CLICKWRAP WITH A READING GATE — the document is shown, and the box cannot be ticked until the\n * reader has scrolled to the end of it.\n \n The strongest available notice: the terms are not merely linked, they are placed in front of the\n * person and the affirmative act is unavailable until they have passed over all of them.\n \n Two things it deliberately does NOT claim. It does not claim the person READ the document — no\n * mechanism can — only that the text was presented in full and the act came after. And it does not\n * replace the public document page: the pane shows the same content that page serves, and links to\n * it, because the page is where the document is rendered with its own typography.\n /\n EXPLICIT_AFTER_READING = \"EXPLICIT_AFTER_READING\",\n}\n\n/\n Does this mode require a SEPARATE affirmative act before the registration may be submitted?\n \n Two readers, one answer: the form disables its submit control on it, and the same form decides on\n * it whether the accepted release ids travel with the request. Those had to agree — a submit the\n * person could press without the ids being sent records nothing while reporting success — so the\n * predicate is named once here rather than spelled twice at the two call sites.\n \n Written as \"anything but implied\" deliberately: a fourth mode added tomorrow is treated as needing\n * the act until somebody says otherwise, which is the direction that fails safe. The inverse spelling\n * ({@link GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX} or `EXPLICIT_AFTER_READING`) would let a\n * new member fall through to \"registering is enough\" silently.\n /\nexport const governedDocumentAcceptanceRequiresExplicitAct = (mode: GovernedDocumentAcceptanceMode): boolean =>\n mode !== GovernedDocumentAcceptanceMode.IMPLIED_BY_REGISTERING;\n\n/\n Must the document be placed in front of the reader, and the affirmative act withheld until they\n * have passed over all of it?\n \n Named rather than compared inline for the same reason as its sibling, and spelled the other way\n * round for the same fail-safe reason read in the other direction: a new mode does NOT acquire a\n * reading gate nobody asked for.\n /\nexport const governedDocumentAcceptanceRequiresReading = (mode: GovernedDocumentAcceptanceMode): boolean =>\n mode === GovernedDocumentAcceptanceMode.EXPLICIT_AFTER_READING;\n/* @wildo_source:part:end saas.models.governed-document-acceptance-mode /\n\nexport enum GovernedDocumentChangeAction {\n NO_PUBLIC_ACTION = \"NO_PUBLIC_ACTION\",\n REVISE_CANDIDATE = \"REVISE_CANDIDATE\",\n REPUBLISH = \"REPUBLISH\",\n NOTIFY = \"NOTIFY\",\n REQUEST_REACKNOWLEDGEMENT = \"REQUEST_REACKNOWLEDGEMENT\",\n REQUEST_REACCEPTANCE = \"REQUEST_REACCEPTANCE\",\n WITHDRAW = \"WITHDRAW\",\n ESCALATE_FOR_QUALIFIED_REVIEW = \"ESCALATE_FOR_QUALIFIED_REVIEW\",\n}\n\nexport const GovernedDocumentDefinitionIdentitySchema = z.strictObject({\n definitionRef: GovernedDocumentRefSchema,\n definitionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentDefinitionIdentity = z.infer<typeof GovernedDocumentDefinitionIdentitySchema>;\n\nexport const GovernedDocumentIdentitySchema = z.strictObject({\n documentRef: GovernedDocumentRefSchema,\n documentVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentIdentity = z.infer<typeof GovernedDocumentIdentitySchema>;\n\nexport const GovernedDocumentReleaseIdentitySchema = z.strictObject({\n document: GovernedDocumentIdentitySchema,\n releaseId: GovernedDocumentRefSchema,\n releaseVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentReleaseIdentity = z.infer<typeof GovernedDocumentReleaseIdentitySchema>;\n\nexport const governedDocumentReleaseIdentityKey = (identity: GovernedDocumentReleaseIdentity): string =>\n `${identity.document.documentRef}@${identity.document.documentVersion}:${identity.releaseId}@${identity.releaseVersion}`;\n\n/* Exact immutable approval-decision identity retained by an issued release without exposing private review content publicly. /\nexport const GovernedDocumentApprovalDecisionIdentitySchema = z.strictObject({\n decisionRef: GovernedDocumentRefSchema,\n decisionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentApprovalDecisionIdentity = z.infer<typeof GovernedDocumentApprovalDecisionIdentitySchema>;\n\n/\n Whether a release has been APPROVED yet — and it is a MARK, never a gate on producing one.\n \n Wildo is agent-first: the mechanism composes the artifact and says what is true about it. Approval\n * is a workflow act that happens at the END, so requiring it in order to compose a release would put\n * a compliance workflow in front of the application-creation mechanism — which is the one thing that\n * must never block. `approvalDecisions` was `.min(1)` until 2026-09-11, and that single constraint\n * meant an unapproved release could not be REPRESENTED at all: an application either forged an\n * approval identity or had no release, and the honest third answer did not exist.\n \n What replaces the refusal is this field. A release always exists and always states its own\n * standing, so nothing downstream has to infer it and nothing can mistake a draft for a published\n * document. Arming the gate that actually withholds an UNAPPROVED release from a real reader belongs\n * to Gate 3 (\"an application may face a real user\"), per `one-source-of-truth.md` D5: critical gate\n * points stay MARKED in every mechanism so they can be switched on when the posture changes.\n /\nexport enum GovernedDocumentReleaseApprovalState {\n /* At least one approval decision is retained. The release may be served as a published document. /\n APPROVED = \"APPROVED\",\n /\n Composed, coherent, and NOT approved.\n \n A true record of a real draft — not a defect and not a placeholder. It is what an application\n * holds between drafting and approval, which for most of its life is where it is.\n /\n UNAPPROVED = \"UNAPPROVED\",\n}\n\n/\n Exact private materiality-decision identity retained when one release\n * replaces another. The full decision and authority evidence remain in\n * application-creation custody; this identity makes the replacement and any\n * required renewed interaction causally auditable without exposing the\n * decision publicly.\n /\nexport const GovernedDocumentMaterialityDecisionIdentitySchema = z\n .strictObject({\n decisionRef: GovernedDocumentRefSchema,\n decisionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n previousRelease: GovernedDocumentReleaseIdentitySchema,\n requiredInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),\n })\n .superRefine((decision, context) => {\n addUniqueSortedIssue(decision.requiredInteractionKinds, context, [\"requiredInteractionKinds\"], \"requiredInteractionKinds\");\n });\nexport type GovernedDocumentMaterialityDecisionIdentity = z.infer<typeof GovernedDocumentMaterialityDecisionIdentitySchema>;\n\n/* Exact immutable reviewer-authority grant selected by a review decision. /\nexport const GovernedDocumentReviewerAuthorityIdentitySchema = z.strictObject({\n authorityRef: GovernedDocumentRefSchema,\n authorityVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentReviewerAuthorityIdentity = z.infer<typeof GovernedDocumentReviewerAuthorityIdentitySchema>;\n\n/* Exact immutable authority identity selected for a document materiality decision; never interchangeable with candidate-review authority. /\nexport const GovernedDocumentMaterialityAuthorityIdentitySchema = z.strictObject({\n authorityRef: GovernedDocumentRefSchema,\n authorityVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentMaterialityAuthorityIdentity = z.infer<typeof GovernedDocumentMaterialityAuthorityIdentitySchema>;\n\n/\n Exact ownership boundary for one governed document.\n \n Shared-responsibility output must retain at least two attributed parties and an explicit precedence rule. A single-subject output must not carry those shared-only\n * fields, preventing provider, operator and tenant statements from being silently flattened into one voice.\n /\nexport const GovernedDocumentGovernanceScopeSchema = z\n .strictObject({\n // Declared so any surface wording this scope reads the one authored vocabulary (#966).\n subjectKind: z.enum(GovernedDocumentGovernanceSubjectKind).systemEnum(\"GovernedDocumentGovernanceSubjectKind\"),\n subjectRef: GovernedDocumentRefSchema,\n scopeRef: GovernedDocumentRefSchema,\n scopeVersion: GovernedDocumentPositiveSafeIntegerSchema,\n participantRefs: z.array(GovernedDocumentRefSchema),\n precedenceRuleRefs: z.array(GovernedDocumentRefSchema),\n })\n .superRefine((scope, context) => {\n addUniqueSortedIssue(scope.participantRefs, context, [\"participantRefs\"], \"participantRefs\");\n addUniqueSortedIssue(scope.precedenceRuleRefs, context, [\"precedenceRuleRefs\"], \"precedenceRuleRefs\");\n if (scope.subjectKind === GovernedDocumentGovernanceSubjectKind.SHARED_RESPONSIBILITY) {\n if (scope.participantRefs.length < 2) {\n context.addIssue({ code: \"custom\", message: \"shared responsibility requires at least two attributed participants\", path: [\"participantRefs\"] });\n }\n if (scope.precedenceRuleRefs.length === 0) {\n context.addIssue({ code: \"custom\", message: \"shared responsibility requires an explicit precedence rule\", path: [\"precedenceRuleRefs\"] });\n }\n } else if (scope.participantRefs.length > 0 \|\| scope.precedenceRuleRefs.length > 0) {\n context.addIssue({\n code: \"custom\",\n message: \"single-subject governance cannot carry shared-responsibility participants or precedence rules\",\n path: [\"participantRefs\"],\n });\n }\n });\nexport type GovernedDocumentGovernanceScope = z.infer<typeof GovernedDocumentGovernanceScopeSchema>;\n\n/\n Whether a published clause states something the application has ESTABLISHED — the one fact about a\n * draft's completeness a READER is owed.\n \n It is the public projection of the candidate's `ComplianceStatementCompleteness`\n * (`@wildo-ai/saas-specifications`): `DERIVED` becomes `ESTABLISHED`, and each of the three `NEEDS_`\n members becomes `NOT_YET_ESTABLISHED`. Coarser ON PURPOSE, the way the public release projection\n * withholds `governanceScope`: which party closes a gap (a framework change, an operator decision, an\n * application configuration) and how (`closedBy` — issue refs, owners) is the publisher's custody.\n * What a person reading the document is owed is that this statement is not yet established, and what\n * is missing.\n \n Decided 2026-09-12 (wildo-ai/wildo-ai#968): an unestablished clause is MARKED on the page. Omitting it\n * would narrow the document (#454 rejects that), and refusing the whole document would put a workflow\n * fact in front of the page. Projecting it as plain text would state as settled what the drafter wrote\n * down as unsettled.\n /\nexport enum GovernedDocumentPublicClauseStanding {\n ESTABLISHED = \"ESTABLISHED\",\n NOT_YET_ESTABLISHED = \"NOT_YET_ESTABLISHED\",\n}\n\n/\n Browser-safe public projection of governed document content.\n \n Internal fact, authority, source-policy and review evidence stays in the\n * candidate/release records. Public routes render this exact projection as\n * text; `bodyMarkdown` is never trusted as raw HTML.\n \n Carried `clauseVersion` (and its section `sectionVersion`) until 2026-09-12 (#968). Nothing read\n * either, no draft carries one, and a clause's revision history is the commits that changed it — so a\n * required integer here could only be stamped, which would assert a history nothing tracks.\n /\nexport const GovernedDocumentPublicClauseSchema = z\n .strictObject({\n clauseRef: GovernedDocumentRefSchema,\n order: GovernedDocumentPositiveSafeIntegerSchema,\n bodyMarkdown: z.string().trim().min(1),\n standing: z.enum(GovernedDocumentPublicClauseStanding),\n /\n What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the\n * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader\n * nothing they can use, and an established clause carrying one would contradict itself.\n /\n missingInformation: z.string().trim().min(1).optional(),\n })\n .superRefine((clause, context) => {\n const marked = clause.standing === GovernedDocumentPublicClauseStanding.NOT_YET_ESTABLISHED;\n if (marked && clause.missingInformation === undefined) {\n context.addIssue({ code: \"custom\", message: \"a clause that is not yet established must say what is missing\", path: [\"missingInformation\"] });\n }\n if (!marked && clause.missingInformation !== undefined) {\n context.addIssue({ code: \"custom\", message: \"an established clause cannot carry missing information\", path: [\"missingInformation\"] });\n }\n });\nexport type GovernedDocumentPublicClause = z.infer<typeof GovernedDocumentPublicClauseSchema>;\n\nexport const GovernedDocumentPublicSectionSchema = z\n .strictObject({\n sectionRef: GovernedDocumentRefSchema,\n order: GovernedDocumentPositiveSafeIntegerSchema,\n title: z.string().trim().min(1),\n clauses: z.array(GovernedDocumentPublicClauseSchema).min(1),\n })\n .superRefine((section, context) => {\n if (!valuesAreUnique(section.clauses.map((clause) => clause.clauseRef))) {\n context.addIssue({ code: \"custom\", message: \"public document clause references must be unique\", path: [\"clauses\"] });\n }\n section.clauses.forEach((clause, index) => {\n if (clause.order !== index + 1) {\n context.addIssue({\n code: \"custom\",\n message: \"public document clause order must be contiguous and match array order\",\n path: [\"clauses\", index, \"order\"],\n });\n }\n });\n });\nexport type GovernedDocumentPublicSection = z.infer<typeof GovernedDocumentPublicSectionSchema>;\n\nexport const GovernedDocumentPublicContentSchema = z\n .strictObject({\n schemaVersion: z.literal(1),\n title: z.string().trim().min(1),\n locale: z.string().trim().min(2),\n jurisdictionRefs: z.array(GovernedDocumentRefSchema),\n sections: z.array(GovernedDocumentPublicSectionSchema).min(1),\n })\n .superRefine((content, context) => {\n addUniqueSortedIssue(content.jurisdictionRefs, context, [\"jurisdictionRefs\"], \"jurisdictionRefs\");\n if (!valuesAreUnique(content.sections.map((section) => section.sectionRef))) {\n context.addIssue({ code: \"custom\", message: \"public document section references must be unique\", path: [\"sections\"] });\n }\n content.sections.forEach((section, index) => {\n if (section.order !== index + 1) {\n context.addIssue({\n code: \"custom\",\n message: \"public document section order must be contiguous and match array order\",\n path: [\"sections\", index, \"order\"],\n });\n }\n });\n });\nexport type GovernedDocumentPublicContent = z.infer<typeof GovernedDocumentPublicContentSchema>;\n\n/\n Content-branch-neutral immutable release metadata.\n \n Historical public releases and current internal structured releases add\n * their own explicit schema/content discriminators to this shared invariant\n * basis. Consumers must select one complete branch rather than accepting this\n * common shape directly.\n /\nexport const GovernedDocumentReleaseCommonSchema = z\n .strictObject({\n identity: GovernedDocumentReleaseIdentitySchema,\n definition: GovernedDocumentDefinitionIdentitySchema,\n governanceScope: GovernedDocumentGovernanceScopeSchema,\n documentClass: z.enum(GovernedDocumentClass),\n audienceKinds: z.array(z.enum(GovernedDocumentAudienceKind)).min(1),\n publicationChannelKinds: z.array(z.enum(GovernedDocumentPublicationChannelKind)).min(1),\n allowedInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),\n locale: z.string().trim().min(2),\n jurisdictionRefs: z.array(GovernedDocumentRefSchema),\n /\n * The content's MEDIA TYPE. The content itself is carried by `GovernedDocumentReleaseSchema.content`.\n \n It carried `candidateDigest`, `contentDigest` and `contentArtifactRef` until 2026-08-28 — a\n * seal binding the release to exact bytes in a content-addressed store. The store and the\n * verifier are gone with the rest of the digest machinery and are not coming back: since\n * 2026-09-12 (#968) the release holds its published text directly, and the commit that\n * introduced the release record is what a reader audits.\n /\n contentMediaType: z.string().trim().min(1),\n issuedAt: GovernedDocumentIsoDateTimeSchema,\n effectiveAt: GovernedDocumentIsoDateTimeSchema,\n expiresAt: GovernedDocumentIsoDateTimeSchema.optional(),\n /\n NOT `.min(1)`: see {@link GovernedDocumentReleaseApprovalState}. An unapproved release carries\n * none, and says so in `approvalState` rather than being unrepresentable.\n /\n approvalDecisions: z.array(GovernedDocumentApprovalDecisionIdentitySchema),\n approvalState: z.enum(GovernedDocumentReleaseApprovalState),\n replacesRelease: GovernedDocumentReleaseIdentitySchema.optional(),\n materialityDecision: GovernedDocumentMaterialityDecisionIdentitySchema.optional(),\n })\n .superRefine((release, context) => {\n addUniqueSortedIssue(release.audienceKinds, context, [\"audienceKinds\"], \"audienceKinds\");\n addUniqueSortedIssue(release.publicationChannelKinds, context, [\"publicationChannelKinds\"], \"publicationChannelKinds\");\n addUniqueSortedIssue(release.allowedInteractionKinds, context, [\"allowedInteractionKinds\"], \"allowedInteractionKinds\");\n addUniqueSortedIssue(release.jurisdictionRefs, context, [\"jurisdictionRefs\"], \"jurisdictionRefs\");\n addUniqueSortedIssue(\n release.approvalDecisions.map((decision) => `${decision.decisionRef}@${decision.decisionVersion}`),\n context,\n [\"approvalDecisions\"],\n \"approvalDecisions\",\n );\n /\n * The state and the evidence must agree. APPROVED with nothing retained would be a claim with no\n * basis; UNAPPROVED while holding decisions would hide an approval that happened. Neither is a\n * workflow gate — both are the record contradicting itself.\n /\n if (release.approvalState === GovernedDocumentReleaseApprovalState.APPROVED && release.approvalDecisions.length === 0) {\n context.addIssue({ code: \"custom\", message: \"an APPROVED release must retain at least one approval decision\", path: [\"approvalDecisions\"] });\n }\n if (release.approvalState === GovernedDocumentReleaseApprovalState.UNAPPROVED && release.approvalDecisions.length > 0) {\n context.addIssue({ code: \"custom\", message: \"an UNAPPROVED release must retain no approval decision\", path: [\"approvalDecisions\"] });\n }\n if (Date.parse(release.effectiveAt) < Date.parse(release.issuedAt)) {\n context.addIssue({ code: \"custom\", message: \"effectiveAt cannot precede issuedAt\", path: [\"effectiveAt\"] });\n }\n if (release.expiresAt && Date.parse(release.expiresAt) <= Date.parse(release.effectiveAt)) {\n context.addIssue({ code: \"custom\", message: \"expiresAt must follow effectiveAt\", path: [\"expiresAt\"] });\n }\n if (\n release.replacesRelease &&\n release.replacesRelease.document.documentRef === release.identity.document.documentRef &&\n release.replacesRelease.releaseId === release.identity.releaseId &&\n release.replacesRelease.releaseVersion === release.identity.releaseVersion\n ) {\n context.addIssue({ code: \"custom\", message: \"a release cannot replace itself\", path: [\"replacesRelease\"] });\n }\n if (release.replacesRelease && release.replacesRelease.document.documentRef !== release.identity.document.documentRef) {\n context.addIssue({ code: \"custom\", message: \"a release can replace only a prior release of the same governed document\", path: [\"replacesRelease\"] });\n }\n if ((release.replacesRelease === undefined) !== (release.materialityDecision === undefined)) {\n context.addIssue({\n code: \"custom\",\n message: \"replacement release identity and exact materiality decision must be present together\",\n path: [\"materialityDecision\"],\n });\n }\n if (\n release.replacesRelease &&\n release.materialityDecision &&\n governedDocumentReleaseIdentityKey(release.replacesRelease) !== governedDocumentReleaseIdentityKey(release.materialityDecision.previousRelease)\n ) {\n context.addIssue({\n code: \"custom\",\n message: \"materiality decision must bind the exact release being replaced\",\n path: [\"materialityDecision\", \"previousRelease\"],\n });\n }\n if (release.materialityDecision?.requiredInteractionKinds.some((interactionKind) => !release.allowedInteractionKinds.includes(interactionKind))) {\n context.addIssue({\n code: \"custom\",\n message: \"required renewed interactions must be authorized by the replacement release\",\n path: [\"materialityDecision\", \"requiredInteractionKinds\"],\n });\n }\n });\n\n/\n An issued release — and, since 2026-09-12, the TEXT it publishes (wildo-ai/wildo-ai#968).\n \n ## Why the release carries its content\n \n A release says which drafted content takes effect, and until #968 it could not say WHICH text: the\n * sealed content binding went with the digest machinery on 2026-08-28, leaving only \"the commit that\n * introduced both the release and its content file\". But a draft keeps changing after it is released,\n * so pairing a release with \"the draft of the same document\" at read time shows every release — the\n * one in force, the one it superseded, the one scheduled next — the SAME, current text. Two releases\n * of one document could not differ at all.\n \n So the release holds its own published text, captured when it is composed. Retrieving \"release N of\n * a document\" is one read. Intermediate drafts are NOT kept here — their history is the commits that\n * changed the draft — and neither is anything the public projection withholds: `content` is already\n * the browser-safe shape (no fact refs, no source policies, no `closedBy`).\n \n ## The text is only frozen if the RECORD is\n \n This field makes the binding representable; committing the record as data is what keeps it. An\n * application that recomposes its releases from the live draft on every import would carry today's\n * draft in every release, which is the defect above one layer later.\n \n ## What it refuses\n \n Content in a language or for jurisdictions the release does not name: publishing `fr-FR` text under\n * an `en-GB` release is a false legal statement, the same lie `GovernedDocumentPublicDocumentSchema`\n * refuses.\n /\nexport const GovernedDocumentReleaseSchema = GovernedDocumentReleaseCommonSchema.safeExtend({\n schemaVersion: z.literal(1),\n content: GovernedDocumentPublicContentSchema,\n /\n * Pinned, because it now names the shape of `content` rather than an external rendering: a release\n * whose text is the structured public JSON and whose media type said `text/html` would contradict\n * itself, and the public projection already accepts nothing else.\n /\n contentMediaType: z.literal(GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE),\n}).superRefine((release, context) => {\n if (release.content.locale !== release.locale) {\n context.addIssue({ code: \"custom\", message: \"release content locale must match the release\", path: [\"content\", \"locale\"] });\n }\n if (release.content.jurisdictionRefs.join(\"\\u0000\") !== release.jurisdictionRefs.join(\"\\u0000\")) {\n context.addIssue({ code: \"custom\", message: \"release content jurisdictions must match the release\", path: [\"content\", \"jurisdictionRefs\"] });\n }\n});\nexport type GovernedDocumentRelease = z.infer<typeof GovernedDocumentReleaseSchema>;\n\n/\n The governed documents an application SERVES as public pages, named once for every layer.\n \n These two live HERE, in the shared wire layer, and not with their four governance siblings in\n * `saas-specifications/_core/compliance-documents` — because these are the only two a BROWSER has\n * to name. `AppRouter` mounts `/privacy` and `/terms` and must say which document each serves, and\n * `saas-frontend-lib` neither depends on `saas-specifications` nor should: that is the design-time\n * layer. The alternative was a second copy of two strings in the router, which is exactly the\n * closed-vocabulary-with-no-named-source shape `CLAUDE.md` refuses.\n \n `required-document-set.schemas.ts` imports them rather than re-declaring them, so the composer\n * and the page agree about which document they are talking about by construction.\n /\nexport const PUBLIC_GOVERNED_DOCUMENT_REFS = Object.freeze({\n PRIVACY_NOTICE: \"document:public.privacy-notice\",\n SERVICE_TERMS: \"document:public.service-terms\",\n} as const);\nexport type PublicGovernedDocumentRefName = keyof typeof PUBLIC_GOVERNED_DOCUMENT_REFS;\n\n/\n Which public page serves which governed document — the pairing every surface that links to one needs.\n \n TOTAL over {@link PUBLIC_GOVERNED_DOCUMENT_REFS} by its type, so a third public document added to\n * that vocabulary is a compile error here rather than a document with no page. A hand-kept list of\n * pairings is the thing that rots; a total over the vocabulary is the thing that cannot.\n \n ## Why the PATH lives here and not with the frontend's other routes\n \n The same reason the refs beside it do, and it took a SECOND reader to make it obvious. `AppRouter`\n * MOUNTS these paths; the consent panel LINKS to the privacy notice from `presets-components`, and\n * the registration form links to each required document from `saas-frontend-lib`. Only the router can\n * reach that package's internal route module, so the panel would have hard-coded a copy — the\n * closed-vocabulary-with-no-named-source shape `CLAUDE.md` refuses, and a copy nothing renders is the\n * one that drifts. `CommonRoutePaths.privacy` / `.terms` are derived from this, so the router still\n * spells its routes in one place and that place agrees with the links.\n \n A MARKETING WEBSITE is deliberately NOT one of the readers, although an earlier version of this\n * note claimed it was. `saas-website` may import only `@wildo-ai/saas-models/public-runtime` under\n * bundle discipline, and this is not exported there — so the claim named a reader that could not\n * reach it. If a website ever needs these paths, carve them into `public-runtime` through the K-2\n * protocol rather than restoring the sentence.\n /\nexport const PUBLIC_GOVERNED_DOCUMENT_ROUTE_PATHS: Readonly<Record<(typeof PUBLIC_GOVERNED_DOCUMENT_REFS)[PublicGovernedDocumentRefName], string>> =\n Object.freeze({\n [PUBLIC_GOVERNED_DOCUMENT_REFS.PRIVACY_NOTICE]: \"/privacy\",\n [PUBLIC_GOVERNED_DOCUMENT_REFS.SERVICE_TERMS]: \"/terms\",\n });\n\n/\n The page serving this document, or `undefined` when it has none.\n \n A governed document an application requires acceptance of need NOT be one of the two public pages\n * — an application may require a data-processing agreement served elsewhere entirely — so a caller\n * gets `undefined` and omits the link rather than being handed a route that leads nowhere.\n /\nexport const resolvePublicGovernedDocumentRoutePath = (documentRef: string): string \| undefined =>\n (PUBLIC_GOVERNED_DOCUMENT_ROUTE_PATHS as Record<string, string \| undefined>)[documentRef];\n\n/* Locator kind is explicit so a channel cannot reinterpret an arbitrary string. /\nexport enum GovernedDocumentPublicationLocatorKind {\n WEB_URL = \"WEB_URL\",\n RECORD_REF = \"RECORD_REF\",\n}\n\nexport const GovernedDocumentPublicationWebLocatorSchema = z.strictObject({\n kind: z.literal(GovernedDocumentPublicationLocatorKind.WEB_URL),\n url: z.url().refine((value) => new URL(value).protocol === \"https:\", \"published web locations require HTTPS\"),\n});\nexport const GovernedDocumentPublicationRecordLocatorSchema = z.strictObject({\n kind: z.literal(GovernedDocumentPublicationLocatorKind.RECORD_REF),\n recordRef: GovernedDocumentRefSchema,\n});\nexport const GovernedDocumentPublicationLocatorSchema = z.discriminatedUnion(\"kind\", [\n GovernedDocumentPublicationWebLocatorSchema,\n GovernedDocumentPublicationRecordLocatorSchema,\n]);\nexport type GovernedDocumentPublicationLocator = z.infer<typeof GovernedDocumentPublicationLocatorSchema>;\n\nconst GovernedDocumentPublicationEventCommonSchema = z.strictObject({\n schemaVersion: z.literal(1),\n eventRef: GovernedDocumentRefSchema,\n release: GovernedDocumentReleaseIdentitySchema,\n channel: z.enum(GovernedDocumentPublicationChannelKind),\n occurredAt: GovernedDocumentIsoDateTimeSchema,\n publicationLocator: GovernedDocumentPublicationLocatorSchema,\n});\n\nconst addGovernedDocumentPublicationLocatorIssue = (\n event: { readonly channel: GovernedDocumentPublicationChannelKind; readonly publicationLocator?: GovernedDocumentPublicationLocator },\n context: z.RefinementCtx,\n): void => {\n // Zod invokes refinements over its input shape, where a required nested\n // object may still be absent before the base object reports that issue.\n // Leave requiredness to the property schema and validate channel semantics\n // only once a locator has successfully parsed.\n if (!event.publicationLocator) return;\n const requiresWebUrl =\n event.channel === GovernedDocumentPublicationChannelKind.PUBLIC_WEB \|\| event.channel === GovernedDocumentPublicationChannelKind.AUTHENTICATED_WEB;\n if (requiresWebUrl !== (event.publicationLocator.kind === GovernedDocumentPublicationLocatorKind.WEB_URL)) {\n context.addIssue({\n code: \"custom\",\n message: requiresWebUrl ? \"web publication channels require an HTTPS locator\" : \"non-web publication channels require a durable record reference\",\n path: [\"publicationLocator\"],\n });\n }\n};\n\nexport const GovernedDocumentPublishedEventSchema = GovernedDocumentPublicationEventCommonSchema.extend({\n eventKind: z.literal(GovernedDocumentPublicationEventKind.PUBLISHED),\n /\n * It carried `servedContentDigest`, `exactByteProofDigest` and an optional `deploymentObservation`\n * — the latter a signed record of bytes read back from a deployed bundle — until 2026-08-28. The\n * event's own JSDoc called the observation the difference between \"evidence of deployed bytes\" and\n * \"a self-assertion over custody\", which was a fair description of a machine that had never once\n * run. A publication is now what it says it is: this release, on this channel, at this locator, at\n * this time — recorded in a file, in a commit, which a reviewer can read.\n /\n}).superRefine(addGovernedDocumentPublicationLocatorIssue);\nexport type GovernedDocumentPublishedEvent = z.infer<typeof GovernedDocumentPublishedEventSchema>;\n\nexport const GovernedDocumentWithdrawnEventSchema = GovernedDocumentPublicationEventCommonSchema.extend({\n eventKind: z.literal(GovernedDocumentPublicationEventKind.WITHDRAWN),\n withdrawalReason: z.string().trim().min(1),\n}).superRefine(addGovernedDocumentPublicationLocatorIssue);\nexport type GovernedDocumentWithdrawnEvent = z.infer<typeof GovernedDocumentWithdrawnEventSchema>;\n\nexport const GovernedDocumentPublicationEventSchema = z.discriminatedUnion(\"eventKind\", [\n GovernedDocumentPublishedEventSchema,\n GovernedDocumentWithdrawnEventSchema,\n]);\nexport type GovernedDocumentPublicationEvent = z.infer<typeof GovernedDocumentPublicationEventSchema>;\n\n/\n Browser-safe immutable release projection.\n \n Governance scope, candidate digest, approval-decision identities and the\n * internal content-artifact ref remain in the retained release/bundle custody\n * boundary. Public consumers receive only the fields needed to route, display\n * and independently verify the published bytes and effective interval.\n /\nexport const GovernedDocumentPublicReleaseProjectionSchema = z\n .strictObject({\n schemaVersion: z.literal(1),\n identity: GovernedDocumentReleaseIdentitySchema,\n definition: GovernedDocumentDefinitionIdentitySchema,\n documentClass: z.enum(GovernedDocumentClass),\n locale: z.string().trim().min(2),\n jurisdictionRefs: z.array(GovernedDocumentRefSchema),\n contentMediaType: z.literal(GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE),\n issuedAt: GovernedDocumentIsoDateTimeSchema,\n effectiveAt: GovernedDocumentIsoDateTimeSchema,\n expiresAt: GovernedDocumentIsoDateTimeSchema.optional(),\n /\n What a person may DO with this release — carried onto the public projection so the serving\n * surface can tell whether recording a `NOTICE_DELIVERED` (#1258 Step 5) is something the\n * release actually permits, without a second, wider read of the release's own custody record.\n * Not new authority: `composeGovernedDocumentInteraction` already refuses an interaction kind a\n * release does not permit, so a reader without this field could only guess.\n /\n allowedInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),\n })\n .superRefine((release, context) => {\n addUniqueSortedIssue(release.jurisdictionRefs, context, [\"jurisdictionRefs\"], \"jurisdictionRefs\");\n if (Date.parse(release.effectiveAt) < Date.parse(release.issuedAt)) {\n context.addIssue({ code: \"custom\", message: \"effectiveAt cannot precede issuance\", path: [\"effectiveAt\"] });\n }\n if (release.expiresAt && Date.parse(release.expiresAt) <= Date.parse(release.effectiveAt)) {\n context.addIssue({ code: \"custom\", message: \"expiresAt must follow effectiveAt\", path: [\"expiresAt\"] });\n }\n });\nexport type GovernedDocumentPublicReleaseProjection = z.infer<typeof GovernedDocumentPublicReleaseProjectionSchema>;\n\n/* Explicit allow-list projection from retained internal release to public release metadata. /\nexport const projectGovernedDocumentPublicRelease = (releaseInput: GovernedDocumentRelease): GovernedDocumentPublicReleaseProjection => {\n const release = GovernedDocumentReleaseSchema.parse(releaseInput);\n return GovernedDocumentPublicReleaseProjectionSchema.parse({\n schemaVersion: 1,\n identity: release.identity,\n definition: release.definition,\n documentClass: release.documentClass,\n locale: release.locale,\n jurisdictionRefs: release.jurisdictionRefs,\n contentMediaType: release.contentMediaType,\n issuedAt: release.issuedAt,\n effectiveAt: release.effectiveAt,\n ...(release.expiresAt ? { expiresAt: release.expiresAt } : {}),\n allowedInteractionKinds: release.allowedInteractionKinds,\n });\n};\n\n/\n A governed document AS A PUBLIC PAGE CAN HOLD IT — the release metadata a reader is entitled to,\n * paired with the exact content bytes it names. Issue #168.\n \n ## Why this pair, and why it is one record\n \n The two halves already existed and had never been joined. `GovernedDocumentPublicReleaseProjection`\n * answers which release is this, in what language, for which jurisdictions, in force when —\n * deliberately narrower than the internal release, withholding `governanceScope` and\n * `approvalDecisions` as custody detail. `GovernedDocumentPublicContent` answers what does it say.\n * A page needs both and must not be able to show one release's date above another release's prose,\n * so they travel together and their agreement is checked here rather than at each reader.\n \n ## What the guard refuses, and what it deliberately does not\n \n It refuses a record that would be a LIE: content whose `locale` or `jurisdictionRefs` disagree\n * with the release naming it, and a media type the release does not declare. Serving an `en-GB`\n * notice under a release that says `fr-FR` is a false legal statement, and that is the one thing a\n * public document may never be.\n \n It does NOT refuse an UNAPPROVED release, and that is the directive'''s own instruction rather than\n * an oversight: \"Composing a release harms nobody; serving an unapproved one to a real reader is a\n legally-binding statement leaving the system. So the filter lives on the READ, defaults to off,\n * and says at its own site that it is the gate point.\"* The approval gate is\n * {@link resolveInForcePublicDocument}'''s `requireApproved`, MARKED there and armed at Gate 3.\n * Refusing here would make an application unable to REPRESENT a draft notice at all, which is the\n * shape `.claude/rules/application-creation-directive.md` records as the reference defect.\n \n The release'''s own `approvalState` is not carried, because this projection deliberately withholds\n * it (a reader is not told about internal custody). The approval decision is made where the document\n * is SELECTED, from the authored release, before it reaches a browser.\n /\nexport enum GovernedDocumentPublicDocumentKind {\n /* A composed release and the text that release carries. /\n RELEASED = \"RELEASED\",\n /\n The latest draft of a document the application has NEVER released (wildo-ai/wildo-ai#968 decision 5).\n \n It exists so that neither a missing approval nor a missing release leaves a page with nothing. It\n * carries no release projection and no approval state because neither exists — inventing either\n * would claim a release nobody composed — and a page showing one must SAY it is a draft.\n /\n UNRELEASED_DRAFT = \"UNRELEASED_DRAFT\",\n}\n\nexport const GovernedDocumentReleasedPublicDocumentSchema = z\n .strictObject({\n schemaVersion: z.literal(1),\n kind: z.literal(GovernedDocumentPublicDocumentKind.RELEASED),\n release: GovernedDocumentPublicReleaseProjectionSchema,\n content: GovernedDocumentPublicContentSchema,\n /\n Whether the release this content belongs to has been approved.\n \n Carried HERE rather than on the release projection because it is a fact about the PUBLISHER'''s\n * process, not about the document, and the projection is the shape a reader receives. A serving\n * surface needs it to decide whether it may render at all; it is never displayed.\n /\n approvalState: z.enum(GovernedDocumentReleaseApprovalState),\n })\n .superRefine((document, context) => {\n if (document.content.locale !== document.release.locale) {\n context.addIssue({\n code: \"custom\",\n message: \"public content locale must match the release that names it\",\n path: [\"content\", \"locale\"],\n });\n }\n const releaseJurisdictions = document.release.jurisdictionRefs.join(\"\\u0000\");\n if (document.content.jurisdictionRefs.join(\"\\u0000\") !== releaseJurisdictions) {\n context.addIssue({\n code: \"custom\",\n message: \"public content jurisdictions must match the release that names it\",\n path: [\"content\", \"jurisdictionRefs\"],\n });\n }\n });\nexport type GovernedDocumentReleasedPublicDocument = z.infer<typeof GovernedDocumentReleasedPublicDocumentSchema>;\n\n/* See {@link GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT}. /\nexport const GovernedDocumentUnreleasedDraftPublicDocumentSchema = z.strictObject({\n schemaVersion: z.literal(1),\n kind: z.literal(GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT),\n /* The governed document this is the latest draft of. /\n documentRef: GovernedDocumentRefSchema,\n content: GovernedDocumentPublicContentSchema,\n});\nexport type GovernedDocumentUnreleasedDraftPublicDocument = z.infer<typeof GovernedDocumentUnreleasedDraftPublicDocumentSchema>;\n\n/* A document a public page may render: a composed release, or the latest draft of a never-released document. */\nexport const GovernedDocumentPublicDocumentSchema = z.discriminatedUnion(\"kind\", [\n GovernedDocumentReleasedPublicDocumentSchema,\n GovernedDocumentUnreleasedDraftPublicDocumentSchema,\n]);\nexport type GovernedDocumentPublicDocument = z.infer<typeof GovernedDocumentPublicDocumentSchema>;\n\n"]}
1	+ {"version":3,"file":"governed-documents.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/documents/governed-documents.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,2CAA2C,GAAG,+DAA+D,CAAC;AAE3H,MAAM,0BAA0B,GAAG,oEAAoE,CAAC;AACxG,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH,MAAM,eAAe,GAAG,CAAC,MAAyB,EAAW,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;AACvG,MAAM,wBAAwB,GAAG,CAAC,MAAyB,EAAW,EAAE,CACtE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtG,MAAM,oBAAoB,GAAG,CAAC,MAAyB,EAAE,OAAwB,EAAE,IAAmB,EAAE,KAAa,EAAQ,EAAE;IAC7H,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAyB,CAAC;AAG5H,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAClF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAElH,qIAAqI;AACrI,MAAM,CAAN,IAAY,qBAUX;AAVD,WAAY,qBAAqB;IAC/B,wDAA+B,CAAA;IAC/B,gEAAuC,CAAA;IACvC,gEAAuC,CAAA;IACvC,sEAA6C,CAAA;IAC7C,sCAAa,CAAA;IACb,8CAAqB,CAAA;IACrB,gFAAuD,CAAA;IACvD,sEAA6C,CAAA;IAC7C,gEAAuC,CAAA;AACzC,CAAC,EAVW,qBAAqB,KAArB,qBAAqB,QAUhC;AAED,qIAAqI;AACrI,MAAM,CAAN,IAAY,qCAKX;AALD,WAAY,qCAAqC;IAC/C,0EAAiC,CAAA;IACjC,sFAA6C,CAAA;IAC7C,oFAA2C,CAAA;IAC3C,wFAA+C,CAAA;AACjD,CAAC,EALW,qCAAqC,KAArC,qCAAqC,QAKhD;AAED,MAAM,CAAN,IAAY,4BAQX;AARD,WAAY,4BAA4B;IACtC,iEAAiC,CAAA;IACjC,uEAAuC,CAAA;IACvC,qDAAqB,CAAA;IACrB,qEAAqC,CAAA;IACrC,uDAAuB,CAAA;IACvB,6EAA6C,CAAA;IAC7C,yEAAyC,CAAA;AAC3C,CAAC,EARW,4BAA4B,KAA5B,4BAA4B,QAQvC;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,gEAAyB,CAAA;IACzB,wEAAiC,CAAA;IACjC,4DAAqB,CAAA;AACvB,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,MAAM,CAAN,IAAY,oCAMX;AAND,WAAY,oCAAoC;IAC9C,uDAAe,CAAA;IACf,2DAAmB,CAAA;IACnB,mEAA2B,CAAA;IAC3B,uDAAe,CAAA;IACf,yEAAiC,CAAA;AACnC,CAAC,EANW,oCAAoC,KAApC,oCAAoC,QAM/C;AAED,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,kDAAe,CAAA;IACf,sDAAmB,CAAA;IACnB,wEAAqC,CAAA;IACrC,4DAAyB,CAAA;AAC3B,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAED,MAAM,CAAN,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,iDAAmB,CAAA;IACnB,qDAAuB,CAAA;IACvB,iDAAmB,CAAA;IACnB,mDAAqB,CAAA;IACrB,6CAAe,CAAA;IACf,mDAAqB,CAAA;IACrB,+EAAiD,CAAA;AACnD,CAAC,EARW,0BAA0B,KAA1B,0BAA0B,QAQrC;AAED,MAAM,CAAN,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAC5C,2DAAqB,CAAA;IACrB,2EAAqC,CAAA;IACrC,2DAAqB,CAAA;IACrB,2DAAqB,CAAA;AACvB,CAAC,EALW,kCAAkC,KAAlC,kCAAkC,QAK7C;AAED,MAAM,CAAN,IAAY,sCAMX;AAND,WAAY,sCAAsC;IAChD,mEAAyB,CAAA;IACzB,iFAAuC,CAAA;IACvC,+EAAqC,CAAA;IACrC,6EAAmC,CAAA;IACnC,yFAA+C,CAAA;AACjD,CAAC,EANW,sCAAsC,KAAtC,sCAAsC,QAMjD;AAED,MAAM,CAAN,IAAY,oCAGX;AAHD,WAAY,oCAAoC;IAC9C,+DAAuB,CAAA;IACvB,+DAAuB,CAAA;AACzB,CAAC,EAHW,oCAAoC,KAApC,oCAAoC,QAG/C;AAED,0HAA0H;AAC1H,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,wEAAqC,CAAA;IACrC,8EAA2C,CAAA;IAC3C,0EAAuC,CAAA;IACvC,kEAA+B,CAAA;IAC/B,0EAAuC,CAAA;AACzC,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAED,6HAA6H;AAC7H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAN,IAAY,8BAoCX;AApCD,WAAY,8BAA8B;IACxC;;;;;;;;;OASG;IACH,mFAAiD,CAAA;IACjD;;;;;;;;;OASG;IACH,yEAAuC,CAAA;IACvC;;;;;;;;;;;OAWG;IACH,mFAAiD,CAAA;AACnD,CAAC,EApCW,8BAA8B,KAA9B,8BAA8B,QAoCzC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,IAAoC,EAAW,EAAE,CAC7G,IAAI,KAAK,8BAA8B,CAAC,sBAAsB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,IAAoC,EAAW,EAAE,CACzG,IAAI,KAAK,8BAA8B,CAAC,sBAAsB,CAAC;AACjE,2EAA2E;AAE3E,MAAM,CAAN,IAAY,4BASX;AATD,WAAY,4BAA4B;IACtC,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uDAAuB,CAAA;IACvB,iDAAiB,CAAA;IACjB,uFAAuD,CAAA;IACvD,6EAA6C,CAAA;IAC7C,qDAAqB,CAAA;IACrB,+FAA+D,CAAA;AACjE,CAAC,EATW,4BAA4B,KAA5B,4BAA4B,QASvC;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,YAAY,CAAC;IACrE,aAAa,EAAE,yBAAyB;IACxC,iBAAiB,EAAE,yCAAyC;CAC7D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,WAAW,EAAE,yBAAyB;IACtC,eAAe,EAAE,yCAAyC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,QAAQ,EAAE,8BAA8B;IACxC,SAAS,EAAE,yBAAyB;IACpC,cAAc,EAAE,yCAAyC;CAC1D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,QAAyC,EAAU,EAAE,CACtG,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;AAE3H,iIAAiI;AACjI,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3E,WAAW,EAAE,yBAAyB;IACtC,eAAe,EAAE,yCAAyC;CAC3D,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,oCAUX;AAVD,WAAY,oCAAoC;IAC9C,qGAAqG;IACrG,6DAAqB,CAAA;IACrB;;;;;OAKG;IACH,iEAAyB,CAAA;AAC3B,CAAC,EAVW,oCAAoC,KAApC,oCAAoC,QAU/C;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC;KAC/D,YAAY,CAAC;IACZ,WAAW,EAAE,yBAAyB;IACtC,eAAe,EAAE,yCAAyC;IAC1D,eAAe,EAAE,qCAAqC;IACtD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;CAC3E,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,oBAAoB,CAAC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,CAAC;AAC7H,CAAC,CAAC,CAAC;AAGL,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5E,YAAY,EAAE,yBAAyB;IACvC,gBAAgB,EAAE,yCAAyC;CAC5D,CAAC,CAAC;AAGH,8IAA8I;AAC9I,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/E,YAAY,EAAE,yBAAyB;IACvC,gBAAgB,EAAE,yCAAyC;CAC5D,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,YAAY,CAAC;IACZ,uFAAuF;IACvF,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,UAAU,CAAC,uCAAuC,CAAC;IAC9G,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,yBAAyB;IACnC,YAAY,EAAE,yCAAyC;IACvD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACnD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CACvD,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,oBAAoB,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC7F,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtG,IAAI,KAAK,CAAC,WAAW,KAAK,qCAAqC,CAAC,qBAAqB,EAAE,CAAC;QACtF,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qEAAqE,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4DAA4D,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,+FAA+F;YACxG,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,oCAGX;AAHD,WAAY,oCAAoC;IAC9C,mEAA2B,CAAA;IAC3B,mFAA2C,CAAA;AAC7C,CAAC,EAHW,oCAAoC,KAApC,oCAAoC,QAG/C;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,YAAY,CAAC;IACZ,SAAS,EAAE,yBAAyB;IACpC,KAAK,EAAE,yCAAyC;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IACtD;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,oCAAoC,CAAC,mBAAmB,CAAC;IAC5F,IAAI,MAAM,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+DAA+D,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wDAAwD,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,UAAU,EAAE,yBAAyB;IACrC,KAAK,EAAE,yCAAyC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5D,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kDAAkD,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,uEAAuE;gBAChF,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9D,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mDAAmD,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wEAAwE;gBACjF,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,QAAQ,EAAE,qCAAqC;IAC/C,UAAU,EAAE,wCAAwC;IACpD,eAAe,EAAE,qCAAqC;IACtD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,QAAQ,EAAE,iCAAiC;IAC3C,WAAW,EAAE,iCAAiC;IAC9C,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACvD;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,8CAA8C,CAAC;IAC1E,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IAC3D,eAAe,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACjE,mBAAmB,EAAE,iDAAiD,CAAC,QAAQ,EAAE;CAClF,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;IACzF,oBAAoB,CAAC,OAAO,CAAC,uBAAuB,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACvH,oBAAoB,CAAC,OAAO,CAAC,uBAAuB,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACvH,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClG,oBAAoB,CAClB,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC,EAClG,OAAO,EACP,CAAC,mBAAmB,CAAC,EACrB,mBAAmB,CACpB,CAAC;IACF;;;;OAIG;IACH,IAAI,OAAO,CAAC,aAAa,KAAK,oCAAoC,CAAC,QAAQ,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gEAAgE,EAAE,IAAI,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,oCAAoC,CAAC,UAAU,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wDAAwD,EAAE,IAAI,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,IACE,OAAO,CAAC,eAAe;QACvB,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;QACtF,OAAO,CAAC,eAAe,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS;QAChE,OAAO,CAAC,eAAe,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAC1E,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0EAA0E,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACvJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS,CAAC,EAAE,CAAC;QAC5F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sFAAsF;YAC/F,IAAI,EAAE,CAAC,qBAAqB,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,CAAC,eAAe;QACvB,OAAO,CAAC,mBAAmB;QAC3B,kCAAkC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,kCAAkC,CAAC,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAC/I,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iEAAiE;YAC1E,IAAI,EAAE,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAChJ,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,6EAA6E;YACtF,IAAI,EAAE,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mCAAmC,CAAC,UAAU,CAAC;IAC1F,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,mCAAmC;IAC5C;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC;CACzE,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChG,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,sDAAsD,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;IACzD,cAAc,EAAE,gCAAgC;IAChD,aAAa,EAAE,+BAA+B;CACtC,CAAC,CAAC;AAGZ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,MAAM,CAAC,MAAM,CAAC;IACZ,CAAC,6BAA6B,CAAC,cAAc,CAAC,EAAE,UAAU;IAC1D,CAAC,6BAA6B,CAAC,aAAa,CAAC,EAAE,QAAQ;CACxD,CAAC,CAAC;AAEL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,WAAmB,EAAsB,EAAE,CAC/F,oCAA2E,CAAC,WAAW,CAAC,CAAC;AAE5F,oFAAoF;AACpF,MAAM,CAAN,IAAY,sCAGX;AAHD,WAAY,sCAAsC;IAChD,6DAAmB,CAAA;IACnB,mEAAyB,CAAA;AAC3B,CAAC,EAHW,sCAAsC,KAAtC,sCAAsC,QAGjD;AAED,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,OAAO,CAAC;IAC/D,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,uCAAuC,CAAC;CAC9G,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC;IAClE,SAAS,EAAE,yBAAyB;CACrC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnF,2CAA2C;IAC3C,8CAA8C;CAC/C,CAAC,CAAC;AAGH,MAAM,4CAA4C,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,qCAAqC;IAC9C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IACvD,UAAU,EAAE,iCAAiC;IAC7C,kBAAkB,EAAE,wCAAwC;CAC7D,CAAC,CAAC;AAEH,MAAM,0CAA0C,GAAG,CACjD,KAAqI,EACrI,OAAwB,EAClB,EAAE;IACR,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,CAAC,KAAK,CAAC,kBAAkB;QAAE,OAAO;IACtC,MAAM,cAAc,GAClB,KAAK,CAAC,OAAO,KAAK,sCAAsC,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,sCAAsC,CAAC,iBAAiB,CAAC;IACpJ,IAAI,cAAc,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,sCAAsC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,iEAAiE;YACjJ,IAAI,EAAE,CAAC,oBAAoB,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG,4CAA4C,CAAC,MAAM,CAAC;IACtG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,SAAS,CAAC;IACpE;;;;;;;OAOG;CACJ,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAG3D,MAAM,CAAC,MAAM,oCAAoC,GAAG,4CAA4C,CAAC,MAAM,CAAC;IACtG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,SAAS,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3C,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAG3D,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IACtF,oCAAoC;IACpC,oCAAoC;CACrC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC;KAC3D,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,qCAAqC;IAC/C,UAAU,EAAE,wCAAwC;IACpD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC;IACxE,QAAQ,EAAE,iCAAiC;IAC3C,WAAW,EAAE,iCAAiC;IAC9C,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACvD;;;;;;OAMG;IACH,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;CAC1E,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,gGAAgG;AAChG,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,YAAqC,EAA2C,EAAE;IACrI,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClE,OAAO,6CAA6C,CAAC,KAAK,CAAC;QACzD,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;KACzD,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,kCAWX;AAXD,WAAY,kCAAkC;IAC5C,4DAA4D;IAC5D,2DAAqB,CAAA;IACrB;;;;;;OAMG;IACH,2EAAqC,CAAA;AACvC,CAAC,EAXW,kCAAkC,KAAlC,kCAAkC,QAW7C;AAED,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC;KAC1D,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,QAAQ,CAAC;IAC5D,OAAO,EAAE,6CAA6C;IACtD,OAAO,EAAE,mCAAmC;IAC5C;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;CAC5D,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,4DAA4D;YACrE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC9E,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mEAAmE;YAC5E,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,uEAAuE;AACvE,MAAM,CAAC,MAAM,mDAAmD,GAAG,CAAC,CAAC,YAAY,CAAC;IAChF,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,gBAAgB,CAAC;IACpE,yDAAyD;IACzD,WAAW,EAAE,yBAAyB;IACtC,OAAO,EAAE,mCAAmC;CAC7C,CAAC,CAAC;AAGH,iHAAiH;AACjH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/E,4CAA4C;IAC5C,mDAAmD;CACpD,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport \"@wildo-ai/zod-decorators\";\n\n/*\n What a GOVERNED DOCUMENT is: its classes, audiences, review and publication vocabulary, its\n * identities, its governance scope, its public content, and the release and publication events that\n * record it being issued and withdrawn.\n \n ## What this file used to also be, and why that half is gone (2026-08-28)\n \n Until this revision the same file carried a complete SEALED DELIVERY MACHINE beside the\n * vocabulary: public-release and deployment BUNDLES with self-referential digests, deployment\n * OBSERVATIONS carrying canonical bytes plus a detached backend signature and a rotated-key\n * `notAfter` window, publication PROOF digests, interaction RECEIPTS, byte-exact retrieval queries,\n * and a dozen `canonicalizeDigestBasis` functions feeding them. Around it sat a backend registry\n that revalidated every digest at boot, two controllers, a CLI artifact-sync writing immutable\n * receipts, and a generated module the application loaded at startup.\n \n All of it is removed under `.claude/rules/one-source-of-truth.md` Rule 0 — nothing that is not\n branchable on git. A digest chain cannot merge: two branches that publish different content\n produce a merged tree whose digests belong to neither. What the machine protected — that a\n * published document is exactly the bytes somebody approved — is what git and the forge already\n * provide, per commit, mergeably, to a reviewer reading a diff.\n \n Two facts made the removal cheap rather than risky, and both were measured rather than assumed:\n * no application had ever produced a bundle (`.wildo-saas/generated/compliance/` was empty in\n * both example applications), and every read path was built on the seal, so there was no\n * non-sealed serving to preserve.\n \n ## What replaces it\n \n A read over committed files, not a custody protocol. A governed document is a FILE in the\n * application's specifications package, and a release is a record the application commits — since\n * 2026-09-12 carrying the text it publishes (`GovernedDocumentReleaseSchema.content`, #968), so the\n * commit that introduced the record is what binds a release to its words. What a public page serves\n * is `GovernedDocumentPublicDocument`: a release with its text, or the latest draft of a document\n * never released, chosen by `resolveInForcePublicDocument`. No digest, no bundle, no receipt.\n /\n\n/* Exact media type of the canonical browser-safe governed-document JSON bytes. /\nexport const GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE = \"application/vnd.wildo.governed-document.public+json;version=1\";\n\nconst governedDocumentRefPattern = /^[a-z][a-z0-9](?:[.-][a-z0-9]+)(?::[A-Za-z0-9][A-Za-z0-9._-])+$/;\nconst compareCanonicalText = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\nconst valuesAreUnique = (values: readonly string[]): boolean => new Set(values).size === values.length;\nconst valuesAreLexicallySorted = (values: readonly string[]): boolean =>\n values.every((value, index) => index === 0 \|\| compareCanonicalText(values[index - 1]!, value) <= 0);\n\nconst addUniqueSortedIssue = (values: readonly string[], context: z.RefinementCtx, path: PropertyKey[], label: string): void => {\n if (!valuesAreUnique(values) \|\| !valuesAreLexicallySorted(values)) {\n context.addIssue({ code: \"custom\", message: `${label} must be unique and lexically sorted`, path });\n }\n};\n\nexport const GovernedDocumentRefSchema = z.string().trim().regex(governedDocumentRefPattern).brand<\"GovernedDocumentRef\">();\nexport type GovernedDocumentRef = z.infer<typeof GovernedDocumentRefSchema>;\n\nexport const GovernedDocumentIsoDateTimeSchema = z.iso.datetime({ offset: true });\nexport const GovernedDocumentIsoDateSchema = z.iso.date();\n/** One runtime source for every governed-document version/order identity. /\nexport const GovernedDocumentPositiveSafeIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\n\n/* Semantic class of governed content. The class controls review, release and interaction rules; a public label never changes it. /\nexport enum GovernedDocumentClass {\n PUBLIC_NOTICE = \"PUBLIC_NOTICE\",\n CONTRACTUAL_TERMS = \"CONTRACTUAL_TERMS\",\n GOVERNANCE_POLICY = \"GOVERNANCE_POLICY\",\n PROCEDURE_OR_RUNBOOK = \"PROCEDURE_OR_RUNBOOK\",\n PLAN = \"PLAN\",\n REGISTER = \"REGISTER\",\n REVIEW_OR_DECISION_RECORD = \"REVIEW_OR_DECISION_RECORD\",\n ASSESSMENT_OR_REPORT = \"ASSESSMENT_OR_REPORT\",\n EVIDENCE_ARTIFACT = \"EVIDENCE_ARTIFACT\",\n}\n\n/* Whose facts and authority a document may speak for. Shared responsibility is explicit rather than a flattened synthetic owner. /\nexport enum GovernedDocumentGovernanceSubjectKind {\n WILDO_PROVIDER = \"WILDO_PROVIDER\",\n APPLICATION_OPERATOR = \"APPLICATION_OPERATOR\",\n TENANT_ORGANIZATION = \"TENANT_ORGANIZATION\",\n SHARED_RESPONSIBILITY = \"SHARED_RESPONSIBILITY\",\n}\n\nexport enum GovernedDocumentAudienceKind {\n PUBLIC_GENERAL = \"PUBLIC_GENERAL\",\n BUSINESS_CUSTOMER = \"BUSINESS_CUSTOMER\",\n CONSUMER = \"CONSUMER\",\n APPLICATION_USER = \"APPLICATION_USER\",\n WORKFORCE = \"WORKFORCE\",\n TENANT_ADMINISTRATOR = \"TENANT_ADMINISTRATOR\",\n QUALIFIED_REVIEWER = \"QUALIFIED_REVIEWER\",\n}\n\nexport enum GovernedDocumentApplicabilityStatus {\n APPLICABLE = \"APPLICABLE\",\n NOT_APPLICABLE = \"NOT_APPLICABLE\",\n DEFERRED = \"DEFERRED\",\n}\n\nexport enum GovernedDocumentFactResolutionStatus {\n KNOWN = \"KNOWN\",\n MISSING = \"MISSING\",\n CONFLICTING = \"CONFLICTING\",\n STALE = \"STALE\",\n NOT_APPLICABLE = \"NOT_APPLICABLE\",\n}\n\nexport enum GovernedDocumentCandidateStatus {\n DRAFT = \"DRAFT\",\n BLOCKED = \"BLOCKED\",\n READY_FOR_REVIEW = \"READY_FOR_REVIEW\",\n SUPERSEDED = \"SUPERSEDED\",\n}\n\nexport enum GovernedDocumentReviewKind {\n CONTENT = \"CONTENT\",\n TECHNICAL = \"TECHNICAL\",\n PRIVACY = \"PRIVACY\",\n SECURITY = \"SECURITY\",\n LEGAL = \"LEGAL\",\n BUSINESS = \"BUSINESS\",\n INDEPENDENT_ASSESSMENT = \"INDEPENDENT_ASSESSMENT\",\n}\n\nexport enum GovernedDocumentReviewDecisionKind {\n APPROVED = \"APPROVED\",\n CHANGES_REQUIRED = \"CHANGES_REQUIRED\",\n REJECTED = \"REJECTED\",\n CONFLICT = \"CONFLICT\",\n}\n\nexport enum GovernedDocumentPublicationChannelKind {\n PUBLIC_WEB = \"PUBLIC_WEB\",\n AUTHENTICATED_WEB = \"AUTHENTICATED_WEB\",\n DURABLE_DOWNLOAD = \"DURABLE_DOWNLOAD\",\n DIRECT_DELIVERY = \"DIRECT_DELIVERY\",\n GOVERNANCE_REPOSITORY = \"GOVERNANCE_REPOSITORY\",\n}\n\nexport enum GovernedDocumentPublicationEventKind {\n PUBLISHED = \"PUBLISHED\",\n WITHDRAWN = \"WITHDRAWN\",\n}\n\n/* Distinct legal/user interactions. A notice interaction, contract acceptance and consent decision are never aliases. /\nexport enum GovernedDocumentInteractionKind {\n NOTICE_DELIVERED = \"NOTICE_DELIVERED\",\n NOTICE_ACKNOWLEDGED = \"NOTICE_ACKNOWLEDGED\",\n CONTRACT_ACCEPTED = \"CONTRACT_ACCEPTED\",\n CONSENT_GIVEN = \"CONSENT_GIVEN\",\n CONSENT_WITHDRAWN = \"CONSENT_WITHDRAWN\",\n}\n\n/* @wildo_source:part:start saas.models.governed-document-acceptance-mode facet:layer:shared facet:audience:app-developer /\n/\n HOW an application asks a registrant to accept the documents it requires accepting — the three\n * shapes courts actually distinguish, declared once per application (#1258).\n \n Declared on `compliance.governedDocumentAcceptanceMode` in the application's own\n * `backend-api/src/saas-config.backend.ts`, beside `governedDocumentReleases` and `publicDocuments`.\n \n It is a RENDERING posture, not a server-side gate. The backend records whichever accepted release\n * ids a registration carries and does not know which mode produced them, so a client that does not\n * use the form is bound by none of the three. That is the honest scope: what the mode decides is how\n * strong a notice a person is given and what the form withholds until they act — the things a\n * registration screen can actually control.\n \n ## Why this is a declared CHOICE rather than one shipped behaviour\n \n Registration shipped with exactly one shape — an unticked box gating the submit button — and no\n * way to ask for another. That is the strongest of the three and it is the right DEFAULT, but it is\n * not the right answer for every application: a product whose terms are a one-paragraph acceptable-use\n * statement and a product whose terms carry an arbitration clause are not asking the same thing of the\n * same person, and the framework should let each say which it is asking.\n \n ## The enforceability ladder, which is what the members are ordered by\n \n Enforceability turns on whether the person had REASONABLE NOTICE of the terms and took an action\n * MANIFESTING ASSENT to them. Clickwrap — an affirmative act aimed at the terms themselves — is the\n * shape courts uphold most consistently; sign-in-wrap, where the act is the registration and the\n * notice sits beside it, is upheld when the notice is conspicuous and fails when it is buried;\n * browsewrap, where nothing but a footer link exists, is the shape that routinely fails. This\n * vocabulary offers the first two and does NOT offer the third, because an application that asks for\n * nothing is already representable by declaring no release that permits `CONTRACT_ACCEPTED`.\n \n (Drawn from the settled shape of US and EU practice on online contract formation, not from a single\n * cited authority. Not legal advice — an operator's counsel decides which their terms warrant.)\n \n ## Every member DOES something, deliberately\n \n Each one changes what the registration form renders and what it refuses. A member that only named a\n * posture without changing behaviour is the defect removed from this lane one commit earlier, when a\n * stored privacy-level field was deleted for meaning nothing at any call site.\n /\nexport enum GovernedDocumentAcceptanceMode {\n /\n SIGN-IN-WRAP — \"by registering you agree to our terms and privacy policy\", beside the button.\n \n No checkbox and no separate act: submitting the registration IS the act of assent, so the\n * accepted release ids still travel with it and the interaction is still recorded. What changes is\n * that nothing is withheld — the button is available from the first keystroke.\n \n The notice is rendered immediately above the submit control rather than in a footer, because\n * conspicuousness is the whole of what distinguishes this from the browsewrap shape that fails.\n /\n IMPLIED_BY_REGISTERING = \"IMPLIED_BY_REGISTERING\",\n /\n CLICKWRAP — an unticked box the person ticks, with the submit control unavailable until they do.\n \n The DEFAULT, and the framework default may not silently weaken: an application that declared\n * nothing shipped this behaviour before the vocabulary existed, and must keep shipping it.\n \n The box is never pre-ticked. A pre-ticked box is not an affirmative act, so it undermines the one\n * property this mode exists to provide — the same reason the consent gate's own optional purposes\n * start unticked.\n /\n EXPLICIT_CHECKBOX = \"EXPLICIT_CHECKBOX\",\n /\n CLICKWRAP WITH A READING GATE — the document is shown, and the box cannot be ticked until the\n * reader has scrolled to the end of it.\n \n The strongest available notice: the terms are not merely linked, they are placed in front of the\n * person and the affirmative act is unavailable until they have passed over all of them.\n \n Two things it deliberately does NOT claim. It does not claim the person READ the document — no\n * mechanism can — only that the text was presented in full and the act came after. And it does not\n * replace the public document page: the pane shows the same content that page serves, and links to\n * it, because the page is where the document is rendered with its own typography.\n /\n EXPLICIT_AFTER_READING = \"EXPLICIT_AFTER_READING\",\n}\n\n/\n Does this mode require a SEPARATE affirmative act before the registration may be submitted?\n \n Two readers, one answer: the form disables its submit control on it, and the same form decides on\n * it whether the accepted release ids travel with the request. Those had to agree — a submit the\n * person could press without the ids being sent records nothing while reporting success — so the\n * predicate is named once here rather than spelled twice at the two call sites.\n \n Written as \"anything but implied\" deliberately: a fourth mode added tomorrow is treated as needing\n * the act until somebody says otherwise, which is the direction that fails safe. The inverse spelling\n * ({@link GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX} or `EXPLICIT_AFTER_READING`) would let a\n * new member fall through to \"registering is enough\" silently.\n /\nexport const governedDocumentAcceptanceRequiresExplicitAct = (mode: GovernedDocumentAcceptanceMode): boolean =>\n mode !== GovernedDocumentAcceptanceMode.IMPLIED_BY_REGISTERING;\n\n/\n Must the document be placed in front of the reader, and the affirmative act withheld until they\n * have passed over all of it?\n \n Named rather than compared inline for the same reason as its sibling, and spelled the other way\n * round for the same fail-safe reason read in the other direction: a new mode does NOT acquire a\n * reading gate nobody asked for.\n /\nexport const governedDocumentAcceptanceRequiresReading = (mode: GovernedDocumentAcceptanceMode): boolean =>\n mode === GovernedDocumentAcceptanceMode.EXPLICIT_AFTER_READING;\n/* @wildo_source:part:end saas.models.governed-document-acceptance-mode /\n\nexport enum GovernedDocumentChangeAction {\n NO_PUBLIC_ACTION = \"NO_PUBLIC_ACTION\",\n REVISE_CANDIDATE = \"REVISE_CANDIDATE\",\n REPUBLISH = \"REPUBLISH\",\n NOTIFY = \"NOTIFY\",\n REQUEST_REACKNOWLEDGEMENT = \"REQUEST_REACKNOWLEDGEMENT\",\n REQUEST_REACCEPTANCE = \"REQUEST_REACCEPTANCE\",\n WITHDRAW = \"WITHDRAW\",\n ESCALATE_FOR_QUALIFIED_REVIEW = \"ESCALATE_FOR_QUALIFIED_REVIEW\",\n}\n\nexport const GovernedDocumentDefinitionIdentitySchema = z.strictObject({\n definitionRef: GovernedDocumentRefSchema,\n definitionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentDefinitionIdentity = z.infer<typeof GovernedDocumentDefinitionIdentitySchema>;\n\nexport const GovernedDocumentIdentitySchema = z.strictObject({\n documentRef: GovernedDocumentRefSchema,\n documentVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentIdentity = z.infer<typeof GovernedDocumentIdentitySchema>;\n\nexport const GovernedDocumentReleaseIdentitySchema = z.strictObject({\n document: GovernedDocumentIdentitySchema,\n releaseId: GovernedDocumentRefSchema,\n releaseVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentReleaseIdentity = z.infer<typeof GovernedDocumentReleaseIdentitySchema>;\n\nexport const governedDocumentReleaseIdentityKey = (identity: GovernedDocumentReleaseIdentity): string =>\n `${identity.document.documentRef}@${identity.document.documentVersion}:${identity.releaseId}@${identity.releaseVersion}`;\n\n/* Exact immutable approval-decision identity retained by an issued release without exposing private review content publicly. /\nexport const GovernedDocumentApprovalDecisionIdentitySchema = z.strictObject({\n decisionRef: GovernedDocumentRefSchema,\n decisionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentApprovalDecisionIdentity = z.infer<typeof GovernedDocumentApprovalDecisionIdentitySchema>;\n\n/\n Whether a release has been APPROVED yet — and it is a MARK, never a gate on producing one.\n \n Wildo is agent-first: the mechanism composes the artifact and says what is true about it. Approval\n * is a workflow act that happens at the END, so requiring it in order to compose a release would put\n * a compliance workflow in front of the application-creation mechanism — which is the one thing that\n * must never block. `approvalDecisions` was `.min(1)` until 2026-09-11, and that single constraint\n * meant an unapproved release could not be REPRESENTED at all: an application either forged an\n * approval identity or had no release, and the honest third answer did not exist.\n \n What replaces the refusal is this field. A release always exists and always states its own\n * standing, so nothing downstream has to infer it and nothing can mistake a draft for a published\n * document. Arming the gate that actually withholds an UNAPPROVED release from a real reader belongs\n * to Gate 3 (\"an application may face a real user\"), per `one-source-of-truth.md` D5: critical gate\n * points stay MARKED in every mechanism so they can be switched on when the posture changes.\n /\nexport enum GovernedDocumentReleaseApprovalState {\n /* At least one approval decision is retained. The release may be served as a published document. /\n APPROVED = \"APPROVED\",\n /\n Composed, coherent, and NOT approved.\n \n A true record of a real draft — not a defect and not a placeholder. It is what an application\n * holds between drafting and approval, which for most of its life is where it is.\n /\n UNAPPROVED = \"UNAPPROVED\",\n}\n\n/\n Exact private materiality-decision identity retained when one release\n * replaces another. The full decision and authority evidence remain in\n * application-creation custody; this identity makes the replacement and any\n * required renewed interaction causally auditable without exposing the\n * decision publicly.\n /\nexport const GovernedDocumentMaterialityDecisionIdentitySchema = z\n .strictObject({\n decisionRef: GovernedDocumentRefSchema,\n decisionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n previousRelease: GovernedDocumentReleaseIdentitySchema,\n requiredInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),\n })\n .superRefine((decision, context) => {\n addUniqueSortedIssue(decision.requiredInteractionKinds, context, [\"requiredInteractionKinds\"], \"requiredInteractionKinds\");\n });\nexport type GovernedDocumentMaterialityDecisionIdentity = z.infer<typeof GovernedDocumentMaterialityDecisionIdentitySchema>;\n\n/* Exact immutable reviewer-authority grant selected by a review decision. /\nexport const GovernedDocumentReviewerAuthorityIdentitySchema = z.strictObject({\n authorityRef: GovernedDocumentRefSchema,\n authorityVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentReviewerAuthorityIdentity = z.infer<typeof GovernedDocumentReviewerAuthorityIdentitySchema>;\n\n/* Exact immutable authority identity selected for a document materiality decision; never interchangeable with candidate-review authority. /\nexport const GovernedDocumentMaterialityAuthorityIdentitySchema = z.strictObject({\n authorityRef: GovernedDocumentRefSchema,\n authorityVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentMaterialityAuthorityIdentity = z.infer<typeof GovernedDocumentMaterialityAuthorityIdentitySchema>;\n\n/\n Exact ownership boundary for one governed document.\n \n Shared-responsibility output must retain at least two attributed parties and an explicit precedence rule. A single-subject output must not carry those shared-only\n * fields, preventing provider, operator and tenant statements from being silently flattened into one voice.\n /\nexport const GovernedDocumentGovernanceScopeSchema = z\n .strictObject({\n // Declared so any surface wording this scope reads the one authored vocabulary (#966).\n subjectKind: z.enum(GovernedDocumentGovernanceSubjectKind).systemEnum(\"GovernedDocumentGovernanceSubjectKind\"),\n subjectRef: GovernedDocumentRefSchema,\n scopeRef: GovernedDocumentRefSchema,\n scopeVersion: GovernedDocumentPositiveSafeIntegerSchema,\n participantRefs: z.array(GovernedDocumentRefSchema),\n precedenceRuleRefs: z.array(GovernedDocumentRefSchema),\n })\n .superRefine((scope, context) => {\n addUniqueSortedIssue(scope.participantRefs, context, [\"participantRefs\"], \"participantRefs\");\n addUniqueSortedIssue(scope.precedenceRuleRefs, context, [\"precedenceRuleRefs\"], \"precedenceRuleRefs\");\n if (scope.subjectKind === GovernedDocumentGovernanceSubjectKind.SHARED_RESPONSIBILITY) {\n if (scope.participantRefs.length < 2) {\n context.addIssue({ code: \"custom\", message: \"shared responsibility requires at least two attributed participants\", path: [\"participantRefs\"] });\n }\n if (scope.precedenceRuleRefs.length === 0) {\n context.addIssue({ code: \"custom\", message: \"shared responsibility requires an explicit precedence rule\", path: [\"precedenceRuleRefs\"] });\n }\n } else if (scope.participantRefs.length > 0 \|\| scope.precedenceRuleRefs.length > 0) {\n context.addIssue({\n code: \"custom\",\n message: \"single-subject governance cannot carry shared-responsibility participants or precedence rules\",\n path: [\"participantRefs\"],\n });\n }\n });\nexport type GovernedDocumentGovernanceScope = z.infer<typeof GovernedDocumentGovernanceScopeSchema>;\n\n/\n Whether a published clause states something the application has ESTABLISHED — the one fact about a\n * draft's completeness a READER is owed.\n \n It is the public projection of the candidate's `ComplianceStatementCompleteness`\n * (`@wildo-ai/saas-specifications`): `DERIVED` becomes `ESTABLISHED`, and each of the three `NEEDS_`\n members becomes `NOT_YET_ESTABLISHED`. Coarser ON PURPOSE, the way the public release projection\n * withholds `governanceScope`: which party closes a gap (a framework change, an operator decision, an\n * application configuration) and how (`closedBy` — issue refs, owners) is the publisher's custody.\n * What a person reading the document is owed is that this statement is not yet established, and what\n * is missing.\n \n Decided 2026-09-12 (wildo-ai/wildo-ai#968): an unestablished clause is MARKED on the page. Omitting it\n * would narrow the document (#454 rejects that), and refusing the whole document would put a workflow\n * fact in front of the page. Projecting it as plain text would state as settled what the drafter wrote\n * down as unsettled.\n /\nexport enum GovernedDocumentPublicClauseStanding {\n ESTABLISHED = \"ESTABLISHED\",\n NOT_YET_ESTABLISHED = \"NOT_YET_ESTABLISHED\",\n}\n\n/\n Browser-safe public projection of governed document content.\n \n Internal fact, authority, source-policy and review evidence stays in the\n * candidate/release records. Public routes render this exact projection as\n * text; `bodyMarkdown` is never trusted as raw HTML.\n \n Carried `clauseVersion` (and its section `sectionVersion`) until 2026-09-12 (#968). Nothing read\n * either, no draft carries one, and a clause's revision history is the commits that changed it — so a\n * required integer here could only be stamped, which would assert a history nothing tracks.\n /\nexport const GovernedDocumentPublicClauseSchema = z\n .strictObject({\n clauseRef: GovernedDocumentRefSchema,\n order: GovernedDocumentPositiveSafeIntegerSchema,\n bodyMarkdown: z.string().trim().min(1),\n standing: z.enum(GovernedDocumentPublicClauseStanding),\n /\n What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the\n * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader\n * nothing they can use, and an established clause carrying one would contradict itself.\n /\n missingInformation: z.string().trim().min(1).optional(),\n })\n .superRefine((clause, context) => {\n const marked = clause.standing === GovernedDocumentPublicClauseStanding.NOT_YET_ESTABLISHED;\n if (marked && clause.missingInformation === undefined) {\n context.addIssue({ code: \"custom\", message: \"a clause that is not yet established must say what is missing\", path: [\"missingInformation\"] });\n }\n if (!marked && clause.missingInformation !== undefined) {\n context.addIssue({ code: \"custom\", message: \"an established clause cannot carry missing information\", path: [\"missingInformation\"] });\n }\n });\nexport type GovernedDocumentPublicClause = z.infer<typeof GovernedDocumentPublicClauseSchema>;\n\nexport const GovernedDocumentPublicSectionSchema = z\n .strictObject({\n sectionRef: GovernedDocumentRefSchema,\n order: GovernedDocumentPositiveSafeIntegerSchema,\n title: z.string().trim().min(1),\n clauses: z.array(GovernedDocumentPublicClauseSchema).min(1),\n })\n .superRefine((section, context) => {\n if (!valuesAreUnique(section.clauses.map((clause) => clause.clauseRef))) {\n context.addIssue({ code: \"custom\", message: \"public document clause references must be unique\", path: [\"clauses\"] });\n }\n section.clauses.forEach((clause, index) => {\n if (clause.order !== index + 1) {\n context.addIssue({\n code: \"custom\",\n message: \"public document clause order must be contiguous and match array order\",\n path: [\"clauses\", index, \"order\"],\n });\n }\n });\n });\nexport type GovernedDocumentPublicSection = z.infer<typeof GovernedDocumentPublicSectionSchema>;\n\nexport const GovernedDocumentPublicContentSchema = z\n .strictObject({\n schemaVersion: z.literal(1),\n title: z.string().trim().min(1),\n locale: z.string().trim().min(2),\n jurisdictionRefs: z.array(GovernedDocumentRefSchema),\n sections: z.array(GovernedDocumentPublicSectionSchema).min(1),\n })\n .superRefine((content, context) => {\n addUniqueSortedIssue(content.jurisdictionRefs, context, [\"jurisdictionRefs\"], \"jurisdictionRefs\");\n if (!valuesAreUnique(content.sections.map((section) => section.sectionRef))) {\n context.addIssue({ code: \"custom\", message: \"public document section references must be unique\", path: [\"sections\"] });\n }\n content.sections.forEach((section, index) => {\n if (section.order !== index + 1) {\n context.addIssue({\n code: \"custom\",\n message: \"public document section order must be contiguous and match array order\",\n path: [\"sections\", index, \"order\"],\n });\n }\n });\n });\nexport type GovernedDocumentPublicContent = z.infer<typeof GovernedDocumentPublicContentSchema>;\n\n/\n Content-branch-neutral immutable release metadata.\n \n Historical public releases and current internal structured releases add\n * their own explicit schema/content discriminators to this shared invariant\n * basis. Consumers must select one complete branch rather than accepting this\n * common shape directly.\n /\nexport const GovernedDocumentReleaseCommonSchema = z\n .strictObject({\n identity: GovernedDocumentReleaseIdentitySchema,\n definition: GovernedDocumentDefinitionIdentitySchema,\n governanceScope: GovernedDocumentGovernanceScopeSchema,\n documentClass: z.enum(GovernedDocumentClass),\n audienceKinds: z.array(z.enum(GovernedDocumentAudienceKind)).min(1),\n publicationChannelKinds: z.array(z.enum(GovernedDocumentPublicationChannelKind)).min(1),\n allowedInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),\n locale: z.string().trim().min(2),\n jurisdictionRefs: z.array(GovernedDocumentRefSchema),\n /\n * The content's MEDIA TYPE. The content itself is carried by `GovernedDocumentReleaseSchema.content`.\n \n It carried `candidateDigest`, `contentDigest` and `contentArtifactRef` until 2026-08-28 — a\n * seal binding the release to exact bytes in a content-addressed store. The store and the\n * verifier are gone with the rest of the digest machinery and are not coming back: since\n * 2026-09-12 (#968) the release holds its published text directly, and the commit that\n * introduced the release record is what a reader audits.\n /\n contentMediaType: z.string().trim().min(1),\n issuedAt: GovernedDocumentIsoDateTimeSchema,\n effectiveAt: GovernedDocumentIsoDateTimeSchema,\n expiresAt: GovernedDocumentIsoDateTimeSchema.optional(),\n /\n NOT `.min(1)`: see {@link GovernedDocumentReleaseApprovalState}. An unapproved release carries\n * none, and says so in `approvalState` rather than being unrepresentable.\n /\n approvalDecisions: z.array(GovernedDocumentApprovalDecisionIdentitySchema),\n approvalState: z.enum(GovernedDocumentReleaseApprovalState),\n replacesRelease: GovernedDocumentReleaseIdentitySchema.optional(),\n materialityDecision: GovernedDocumentMaterialityDecisionIdentitySchema.optional(),\n })\n .superRefine((release, context) => {\n addUniqueSortedIssue(release.audienceKinds, context, [\"audienceKinds\"], \"audienceKinds\");\n addUniqueSortedIssue(release.publicationChannelKinds, context, [\"publicationChannelKinds\"], \"publicationChannelKinds\");\n addUniqueSortedIssue(release.allowedInteractionKinds, context, [\"allowedInteractionKinds\"], \"allowedInteractionKinds\");\n addUniqueSortedIssue(release.jurisdictionRefs, context, [\"jurisdictionRefs\"], \"jurisdictionRefs\");\n addUniqueSortedIssue(\n release.approvalDecisions.map((decision) => `${decision.decisionRef}@${decision.decisionVersion}`),\n context,\n [\"approvalDecisions\"],\n \"approvalDecisions\",\n );\n /\n * The state and the evidence must agree. APPROVED with nothing retained would be a claim with no\n * basis; UNAPPROVED while holding decisions would hide an approval that happened. Neither is a\n * workflow gate — both are the record contradicting itself.\n /\n if (release.approvalState === GovernedDocumentReleaseApprovalState.APPROVED && release.approvalDecisions.length === 0) {\n context.addIssue({ code: \"custom\", message: \"an APPROVED release must retain at least one approval decision\", path: [\"approvalDecisions\"] });\n }\n if (release.approvalState === GovernedDocumentReleaseApprovalState.UNAPPROVED && release.approvalDecisions.length > 0) {\n context.addIssue({ code: \"custom\", message: \"an UNAPPROVED release must retain no approval decision\", path: [\"approvalDecisions\"] });\n }\n if (Date.parse(release.effectiveAt) < Date.parse(release.issuedAt)) {\n context.addIssue({ code: \"custom\", message: \"effectiveAt cannot precede issuedAt\", path: [\"effectiveAt\"] });\n }\n if (release.expiresAt && Date.parse(release.expiresAt) <= Date.parse(release.effectiveAt)) {\n context.addIssue({ code: \"custom\", message: \"expiresAt must follow effectiveAt\", path: [\"expiresAt\"] });\n }\n if (\n release.replacesRelease &&\n release.replacesRelease.document.documentRef === release.identity.document.documentRef &&\n release.replacesRelease.releaseId === release.identity.releaseId &&\n release.replacesRelease.releaseVersion === release.identity.releaseVersion\n ) {\n context.addIssue({ code: \"custom\", message: \"a release cannot replace itself\", path: [\"replacesRelease\"] });\n }\n if (release.replacesRelease && release.replacesRelease.document.documentRef !== release.identity.document.documentRef) {\n context.addIssue({ code: \"custom\", message: \"a release can replace only a prior release of the same governed document\", path: [\"replacesRelease\"] });\n }\n if ((release.replacesRelease === undefined) !== (release.materialityDecision === undefined)) {\n context.addIssue({\n code: \"custom\",\n message: \"replacement release identity and exact materiality decision must be present together\",\n path: [\"materialityDecision\"],\n });\n }\n if (\n release.replacesRelease &&\n release.materialityDecision &&\n governedDocumentReleaseIdentityKey(release.replacesRelease) !== governedDocumentReleaseIdentityKey(release.materialityDecision.previousRelease)\n ) {\n context.addIssue({\n code: \"custom\",\n message: \"materiality decision must bind the exact release being replaced\",\n path: [\"materialityDecision\", \"previousRelease\"],\n });\n }\n if (release.materialityDecision?.requiredInteractionKinds.some((interactionKind) => !release.allowedInteractionKinds.includes(interactionKind))) {\n context.addIssue({\n code: \"custom\",\n message: \"required renewed interactions must be authorized by the replacement release\",\n path: [\"materialityDecision\", \"requiredInteractionKinds\"],\n });\n }\n });\n\n/\n An issued release — and, since 2026-09-12, the TEXT it publishes (wildo-ai/wildo-ai#968).\n \n ## Why the release carries its content\n \n A release says which drafted content takes effect, and until #968 it could not say WHICH text: the\n * sealed content binding went with the digest machinery on 2026-08-28, leaving only \"the commit that\n * introduced both the release and its content file\". But a draft keeps changing after it is released,\n * so pairing a release with \"the draft of the same document\" at read time shows every release — the\n * one in force, the one it superseded, the one scheduled next — the SAME, current text. Two releases\n * of one document could not differ at all.\n \n So the release holds its own published text, captured when it is composed. Retrieving \"release N of\n * a document\" is one read. Intermediate drafts are NOT kept here — their history is the commits that\n * changed the draft — and neither is anything the public projection withholds: `content` is already\n * the browser-safe shape (no fact refs, no source policies, no `closedBy`).\n \n ## The text is only frozen if the RECORD is\n \n This field makes the binding representable; committing the record as data is what keeps it. An\n * application that recomposes its releases from the live draft on every import would carry today's\n * draft in every release, which is the defect above one layer later.\n \n ## What it refuses\n \n Content in a language or for jurisdictions the release does not name: publishing `fr-FR` text under\n * an `en-GB` release is a false legal statement, the same lie `GovernedDocumentPublicDocumentSchema`\n * refuses.\n /\nexport const GovernedDocumentReleaseSchema = GovernedDocumentReleaseCommonSchema.safeExtend({\n schemaVersion: z.literal(1),\n content: GovernedDocumentPublicContentSchema,\n /\n * Pinned, because it now names the shape of `content` rather than an external rendering: a release\n * whose text is the structured public JSON and whose media type said `text/html` would contradict\n * itself, and the public projection already accepts nothing else.\n /\n contentMediaType: z.literal(GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE),\n}).superRefine((release, context) => {\n if (release.content.locale !== release.locale) {\n context.addIssue({ code: \"custom\", message: \"release content locale must match the release\", path: [\"content\", \"locale\"] });\n }\n if (release.content.jurisdictionRefs.join(\"\\u0000\") !== release.jurisdictionRefs.join(\"\\u0000\")) {\n context.addIssue({ code: \"custom\", message: \"release content jurisdictions must match the release\", path: [\"content\", \"jurisdictionRefs\"] });\n }\n});\nexport type GovernedDocumentRelease = z.infer<typeof GovernedDocumentReleaseSchema>;\n\n/\n The governed documents an application SERVES as public pages, named once for every layer.\n \n These two live HERE, in the shared wire layer, and not with their four governance siblings in\n * `saas-specifications/_core/compliance-documents` — because these are the only two a BROWSER has\n * to name. `AppRouter` mounts `/privacy` and `/terms` and must say which document each serves, and\n * `saas-frontend-lib` neither depends on `saas-specifications` nor should: that is the design-time\n * layer. The alternative was a second copy of two strings in the router, which is exactly the\n * closed-vocabulary-with-no-named-source shape `CLAUDE.md` refuses.\n \n `required-document-set.schemas.ts` imports them rather than re-declaring them, so the composer\n * and the page agree about which document they are talking about by construction.\n /\nexport const PUBLIC_GOVERNED_DOCUMENT_REFS = Object.freeze({\n PRIVACY_NOTICE: \"document:public.privacy-notice\",\n SERVICE_TERMS: \"document:public.service-terms\",\n} as const);\nexport type PublicGovernedDocumentRefName = keyof typeof PUBLIC_GOVERNED_DOCUMENT_REFS;\n\n/\n Which public page serves which governed document — the pairing every surface that links to one needs.\n \n TOTAL over {@link PUBLIC_GOVERNED_DOCUMENT_REFS} by its type, so a third public document added to\n * that vocabulary is a compile error here rather than a document with no page. A hand-kept list of\n * pairings is the thing that rots; a total over the vocabulary is the thing that cannot.\n \n ## Why the PATH lives here and not with the frontend's other routes\n \n The same reason the refs beside it do, and it took a SECOND reader to make it obvious. `AppRouter`\n * MOUNTS these paths; the consent panel LINKS to the privacy notice from `presets-components`, and\n * the registration form links to each required document from `saas-frontend-lib`. Only the router can\n * reach that package's internal route module, so the panel would have hard-coded a copy — the\n * closed-vocabulary-with-no-named-source shape `CLAUDE.md` refuses, and a copy nothing renders is the\n * one that drifts. `CommonRoutePaths.privacy` / `.terms` are derived from this, so the router still\n * spells its routes in one place and that place agrees with the links.\n \n A MARKETING WEBSITE is deliberately NOT one of the readers, although an earlier version of this\n * note claimed it was. `saas-website` may import only `@wildo-ai/saas-models/public-runtime` under\n * bundle discipline, and this is not exported there — so the claim named a reader that could not\n * reach it. If a website ever needs these paths, carve them into `public-runtime` through the K-2\n * protocol rather than restoring the sentence.\n /\nexport const PUBLIC_GOVERNED_DOCUMENT_ROUTE_PATHS: Readonly<Record<(typeof PUBLIC_GOVERNED_DOCUMENT_REFS)[PublicGovernedDocumentRefName], string>> =\n Object.freeze({\n [PUBLIC_GOVERNED_DOCUMENT_REFS.PRIVACY_NOTICE]: \"/privacy\",\n [PUBLIC_GOVERNED_DOCUMENT_REFS.SERVICE_TERMS]: \"/terms\",\n });\n\n/\n The page serving this document, or `undefined` when it has none.\n \n A governed document an application requires acceptance of need NOT be one of the two public pages\n * — an application may require a data-processing agreement served elsewhere entirely — so a caller\n * gets `undefined` and omits the link rather than being handed a route that leads nowhere.\n /\nexport const resolvePublicGovernedDocumentRoutePath = (documentRef: string): string \| undefined =>\n (PUBLIC_GOVERNED_DOCUMENT_ROUTE_PATHS as Record<string, string \| undefined>)[documentRef];\n\n/* Locator kind is explicit so a channel cannot reinterpret an arbitrary string. /\nexport enum GovernedDocumentPublicationLocatorKind {\n WEB_URL = \"WEB_URL\",\n RECORD_REF = \"RECORD_REF\",\n}\n\nexport const GovernedDocumentPublicationWebLocatorSchema = z.strictObject({\n kind: z.literal(GovernedDocumentPublicationLocatorKind.WEB_URL),\n url: z.url().refine((value) => new URL(value).protocol === \"https:\", \"published web locations require HTTPS\"),\n});\nexport const GovernedDocumentPublicationRecordLocatorSchema = z.strictObject({\n kind: z.literal(GovernedDocumentPublicationLocatorKind.RECORD_REF),\n recordRef: GovernedDocumentRefSchema,\n});\nexport const GovernedDocumentPublicationLocatorSchema = z.discriminatedUnion(\"kind\", [\n GovernedDocumentPublicationWebLocatorSchema,\n GovernedDocumentPublicationRecordLocatorSchema,\n]);\nexport type GovernedDocumentPublicationLocator = z.infer<typeof GovernedDocumentPublicationLocatorSchema>;\n\nconst GovernedDocumentPublicationEventCommonSchema = z.strictObject({\n schemaVersion: z.literal(1),\n eventRef: GovernedDocumentRefSchema,\n release: GovernedDocumentReleaseIdentitySchema,\n channel: z.enum(GovernedDocumentPublicationChannelKind),\n occurredAt: GovernedDocumentIsoDateTimeSchema,\n publicationLocator: GovernedDocumentPublicationLocatorSchema,\n});\n\nconst addGovernedDocumentPublicationLocatorIssue = (\n event: { readonly channel: GovernedDocumentPublicationChannelKind; readonly publicationLocator?: GovernedDocumentPublicationLocator },\n context: z.RefinementCtx,\n): void => {\n // Zod invokes refinements over its input shape, where a required nested\n // object may still be absent before the base object reports that issue.\n // Leave requiredness to the property schema and validate channel semantics\n // only once a locator has successfully parsed.\n if (!event.publicationLocator) return;\n const requiresWebUrl =\n event.channel === GovernedDocumentPublicationChannelKind.PUBLIC_WEB \|\| event.channel === GovernedDocumentPublicationChannelKind.AUTHENTICATED_WEB;\n if (requiresWebUrl !== (event.publicationLocator.kind === GovernedDocumentPublicationLocatorKind.WEB_URL)) {\n context.addIssue({\n code: \"custom\",\n message: requiresWebUrl ? \"web publication channels require an HTTPS locator\" : \"non-web publication channels require a durable record reference\",\n path: [\"publicationLocator\"],\n });\n }\n};\n\nexport const GovernedDocumentPublishedEventSchema = GovernedDocumentPublicationEventCommonSchema.extend({\n eventKind: z.literal(GovernedDocumentPublicationEventKind.PUBLISHED),\n /\n * It carried `servedContentDigest`, `exactByteProofDigest` and an optional `deploymentObservation`\n * — the latter a signed record of bytes read back from a deployed bundle — until 2026-08-28. The\n * event's own JSDoc called the observation the difference between \"evidence of deployed bytes\" and\n * \"a self-assertion over custody\", which was a fair description of a machine that had never once\n * run. A publication is now what it says it is: this release, on this channel, at this locator, at\n * this time — recorded in a file, in a commit, which a reviewer can read.\n /\n}).superRefine(addGovernedDocumentPublicationLocatorIssue);\nexport type GovernedDocumentPublishedEvent = z.infer<typeof GovernedDocumentPublishedEventSchema>;\n\nexport const GovernedDocumentWithdrawnEventSchema = GovernedDocumentPublicationEventCommonSchema.extend({\n eventKind: z.literal(GovernedDocumentPublicationEventKind.WITHDRAWN),\n withdrawalReason: z.string().trim().min(1),\n}).superRefine(addGovernedDocumentPublicationLocatorIssue);\nexport type GovernedDocumentWithdrawnEvent = z.infer<typeof GovernedDocumentWithdrawnEventSchema>;\n\nexport const GovernedDocumentPublicationEventSchema = z.discriminatedUnion(\"eventKind\", [\n GovernedDocumentPublishedEventSchema,\n GovernedDocumentWithdrawnEventSchema,\n]);\nexport type GovernedDocumentPublicationEvent = z.infer<typeof GovernedDocumentPublicationEventSchema>;\n\n/\n Browser-safe immutable release projection.\n \n Governance scope, candidate digest, approval-decision identities and the\n * internal content-artifact ref remain in the retained release/bundle custody\n * boundary. Public consumers receive only the fields needed to route, display\n * and independently verify the published bytes and effective interval.\n /\nexport const GovernedDocumentPublicReleaseProjectionSchema = z\n .strictObject({\n schemaVersion: z.literal(1),\n identity: GovernedDocumentReleaseIdentitySchema,\n definition: GovernedDocumentDefinitionIdentitySchema,\n documentClass: z.enum(GovernedDocumentClass),\n locale: z.string().trim().min(2),\n jurisdictionRefs: z.array(GovernedDocumentRefSchema),\n contentMediaType: z.literal(GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE),\n issuedAt: GovernedDocumentIsoDateTimeSchema,\n effectiveAt: GovernedDocumentIsoDateTimeSchema,\n expiresAt: GovernedDocumentIsoDateTimeSchema.optional(),\n /\n What a person may DO with this release — carried onto the public projection so the serving\n * surface can tell whether recording a `NOTICE_DELIVERED` (#1258 Step 5) is something the\n * release actually permits, without a second, wider read of the release's own custody record.\n * Not new authority: `composeGovernedDocumentInteraction` already refuses an interaction kind a\n * release does not permit, so a reader without this field could only guess.\n /\n allowedInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),\n })\n .superRefine((release, context) => {\n addUniqueSortedIssue(release.jurisdictionRefs, context, [\"jurisdictionRefs\"], \"jurisdictionRefs\");\n if (Date.parse(release.effectiveAt) < Date.parse(release.issuedAt)) {\n context.addIssue({ code: \"custom\", message: \"effectiveAt cannot precede issuance\", path: [\"effectiveAt\"] });\n }\n if (release.expiresAt && Date.parse(release.expiresAt) <= Date.parse(release.effectiveAt)) {\n context.addIssue({ code: \"custom\", message: \"expiresAt must follow effectiveAt\", path: [\"expiresAt\"] });\n }\n });\nexport type GovernedDocumentPublicReleaseProjection = z.infer<typeof GovernedDocumentPublicReleaseProjectionSchema>;\n\n/* Explicit allow-list projection from retained internal release to public release metadata. /\nexport const projectGovernedDocumentPublicRelease = (releaseInput: GovernedDocumentRelease): GovernedDocumentPublicReleaseProjection => {\n const release = GovernedDocumentReleaseSchema.parse(releaseInput);\n return GovernedDocumentPublicReleaseProjectionSchema.parse({\n schemaVersion: 1,\n identity: release.identity,\n definition: release.definition,\n documentClass: release.documentClass,\n locale: release.locale,\n jurisdictionRefs: release.jurisdictionRefs,\n contentMediaType: release.contentMediaType,\n issuedAt: release.issuedAt,\n effectiveAt: release.effectiveAt,\n ...(release.expiresAt ? { expiresAt: release.expiresAt } : {}),\n allowedInteractionKinds: release.allowedInteractionKinds,\n });\n};\n\n/\n A governed document AS A PUBLIC PAGE CAN HOLD IT — the release metadata a reader is entitled to,\n * paired with the exact content bytes it names. Issue #168.\n \n ## Why this pair, and why it is one record\n \n The two halves already existed and had never been joined. `GovernedDocumentPublicReleaseProjection`\n * answers which release is this, in what language, for which jurisdictions, in force when —\n * deliberately narrower than the internal release, withholding `governanceScope` and\n * `approvalDecisions` as custody detail. `GovernedDocumentPublicContent` answers what does it say.\n * A page needs both and must not be able to show one release's date above another release's prose,\n * so they travel together and their agreement is checked here rather than at each reader.\n \n ## What the guard refuses, and what it deliberately does not\n \n It refuses a record that would be a LIE: content whose `locale` or `jurisdictionRefs` disagree\n * with the release naming it, and a media type the release does not declare. Serving an `en-GB`\n * notice under a release that says `fr-FR` is a false legal statement, and that is the one thing a\n * public document may never be.\n \n It does NOT refuse an UNAPPROVED release, and that is the directive'''s own instruction rather than\n * an oversight: \"Composing a release harms nobody; serving an unapproved one to a real reader is a\n legally-binding statement leaving the system. So the filter lives on the READ, defaults to off,\n * and says at its own site that it is the gate point.\"* The approval gate is\n * {@link resolveInForcePublicDocument}'''s `requireApproved`, MARKED there and armed at Gate 3.\n * Refusing here would make an application unable to REPRESENT a draft notice at all, which is the\n * shape `.claude/rules/application-creation-directive.md` records as the reference defect.\n \n The release'''s own `approvalState` is not carried, because this projection deliberately withholds\n * it (a reader is not told about internal custody). The approval decision is made where the document\n * is SELECTED, from the authored release, before it reaches a browser.\n /\nexport enum GovernedDocumentPublicDocumentKind {\n /* A composed release and the text that release carries. /\n RELEASED = \"RELEASED\",\n /\n The latest draft of a document the application has NEVER released (wildo-ai/wildo-ai#968 decision 5).\n \n It exists so that neither a missing approval nor a missing release leaves a page with nothing. It\n * carries no release projection and no approval state because neither exists — inventing either\n * would claim a release nobody composed — and a page showing one must SAY it is a draft.\n /\n UNRELEASED_DRAFT = \"UNRELEASED_DRAFT\",\n}\n\nexport const GovernedDocumentReleasedPublicDocumentSchema = z\n .strictObject({\n schemaVersion: z.literal(1),\n kind: z.literal(GovernedDocumentPublicDocumentKind.RELEASED),\n release: GovernedDocumentPublicReleaseProjectionSchema,\n content: GovernedDocumentPublicContentSchema,\n /\n Whether the release this content belongs to has been approved.\n \n Carried HERE rather than on the release projection because it is a fact about the PUBLISHER'''s\n * process, not about the document, and the projection is the shape a reader receives. A serving\n * surface needs it to decide whether it may render at all; it is never displayed.\n /\n approvalState: z.enum(GovernedDocumentReleaseApprovalState),\n })\n .superRefine((document, context) => {\n if (document.content.locale !== document.release.locale) {\n context.addIssue({\n code: \"custom\",\n message: \"public content locale must match the release that names it\",\n path: [\"content\", \"locale\"],\n });\n }\n const releaseJurisdictions = document.release.jurisdictionRefs.join(\"\\u0000\");\n if (document.content.jurisdictionRefs.join(\"\\u0000\") !== releaseJurisdictions) {\n context.addIssue({\n code: \"custom\",\n message: \"public content jurisdictions must match the release that names it\",\n path: [\"content\", \"jurisdictionRefs\"],\n });\n }\n });\nexport type GovernedDocumentReleasedPublicDocument = z.infer<typeof GovernedDocumentReleasedPublicDocumentSchema>;\n\n/* See {@link GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT}. /\nexport const GovernedDocumentUnreleasedDraftPublicDocumentSchema = z.strictObject({\n schemaVersion: z.literal(1),\n kind: z.literal(GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT),\n /* The governed document this is the latest draft of. /\n documentRef: GovernedDocumentRefSchema,\n content: GovernedDocumentPublicContentSchema,\n});\nexport type GovernedDocumentUnreleasedDraftPublicDocument = z.infer<typeof GovernedDocumentUnreleasedDraftPublicDocumentSchema>;\n\n/* A document a public page may render: a composed release, or the latest draft of a never-released document. */\nexport const GovernedDocumentPublicDocumentSchema = z.discriminatedUnion(\"kind\", [\n GovernedDocumentReleasedPublicDocumentSchema,\n GovernedDocumentUnreleasedDraftPublicDocumentSchema,\n]);\nexport type GovernedDocumentPublicDocument = z.infer<typeof GovernedDocumentPublicDocumentSchema>;\n\n"]}

package/dist/esm/compliance/documents/user-governed-document-acceptances.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-governed-document-acceptances.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/documents/user-governed-document-acceptances.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAI1I,eAAO,MAAM,0EAA0E,GACrF,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;kCA4E9C,CAAC"}
1	+ {"version":3,"file":"user-governed-document-acceptances.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/documents/user-governed-document-acceptances.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAI1I,eAAO,MAAM,0EAA0E,GACrF,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;kCA4E9C,CAAC"}

package/dist/esm/compliance/documents/user-governed-document-acceptances.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-governed-document-acceptances.shared.resources-config.schemas.js","sourceRoot":"","sources":["~~../../../../../~~src/compliance/documents/user-governed-document-acceptances.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAE3G,MAAM,CAAC,MAAM,0EAA0E,GAAG,CACxF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,kCAAkC;IACvE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,kCAAkC,CAAC;IAChH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF;;;;;;OAMG;IAEH,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n User Governed-Document Acceptances — resource configuration (internal-only).\n \n No HTTP surface: every variant is INTERNAL_CALL. The ONE writer is\n * `recordGovernedDocumentAcceptances` (saas-backend-lib), which writes this row and the audit\n * interaction for the same act, so the queryable state and the evidence cannot disagree. Readers go\n * through the system door too — a person meets their own acceptance state through the prompt that\n * asks them for what is owed, never by browsing rows.\n \n APPEND-ONLY by construction: there is no UPDATE and no DELETE. An acceptance is a thing that\n * happened; a later acceptance is a new row, never an edit of an old one.\n /\nimport { DataPortabilityProvenance } from '../privacy/subject-export.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { UserGovernedDocumentAcceptanceSchema } from './user-governed-document-acceptances.shared.schemas';\n\nexport const userGovernedDocumentAcceptancesResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<undefined,\n CoreResourceOperation.READ \| CoreResourceOperation.LIST \| CoreResourceOperation.CREATE,\n typeof UserGovernedDocumentAcceptanceSchema\n>({\n mainSchema: UserGovernedDocumentAcceptanceSchema,\n resourceIdentifier: CoreResourceType.USER_GOVERNED_DOCUMENT_ACCEPTANCES,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_GOVERNED_DOCUMENT_ACCEPTANCES],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n * The writer runs on a request-context-less execution context — during registration, and on the\n * return leg of a federated sign-up — so the client-shaped CREATE DTO would strip `userId` by name.\n * The system door re-attaches it from the schema allowlist. `read` / `list` serve the owed-acceptance\n * derivation, which runs for the person but not as a resource request of theirs.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n * The person performed the act — ticked the box, pressed the button beside the notice, scrolled the\n * document and accepted. That is a value they supplied, not one observed about them or derived.\n * Exported with the rest of their data: what someone agreed to is squarely theirs to see (Art. 15).\n /\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n /\n * No `dataSubjectPolicy`, deliberately. That declaration describes a resource that can itself be\n * an ERASURE SUBJECT, and the factory refuses it without a `retentionPolicy`, because\n * `eraseSubjectAsSystem` would refuse such a subject anyway. An acceptance is never erased as a\n * subject: it is KEPT by its `USERS →` edge (`onParentDelete` disabled). Declaring a subject kind\n * here would describe an erasure that cannot happen.\n */\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n },\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"user-governed-document-acceptances.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/documents/user-governed-document-acceptances.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAE3G,MAAM,CAAC,MAAM,0EAA0E,GAAG,CACxF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,kCAAkC;IACvE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,kCAAkC,CAAC;IAChH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IAED;;;;OAIG;IACH,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF;;;;;;OAMG;IAEH,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n User Governed-Document Acceptances — resource configuration (internal-only).\n \n No HTTP surface: every variant is INTERNAL_CALL. The ONE writer is\n * `recordGovernedDocumentAcceptances` (saas-backend-lib), which writes this row and the audit\n * interaction for the same act, so the queryable state and the evidence cannot disagree. Readers go\n * through the system door too — a person meets their own acceptance state through the prompt that\n * asks them for what is owed, never by browsing rows.\n \n APPEND-ONLY by construction: there is no UPDATE and no DELETE. An acceptance is a thing that\n * happened; a later acceptance is a new row, never an edit of an old one.\n /\nimport { DataPortabilityProvenance } from '../privacy/subject-export.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { UserGovernedDocumentAcceptanceSchema } from './user-governed-document-acceptances.shared.schemas';\n\nexport const userGovernedDocumentAcceptancesResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<undefined,\n CoreResourceOperation.READ \| CoreResourceOperation.LIST \| CoreResourceOperation.CREATE,\n typeof UserGovernedDocumentAcceptanceSchema\n>({\n mainSchema: UserGovernedDocumentAcceptanceSchema,\n resourceIdentifier: CoreResourceType.USER_GOVERNED_DOCUMENT_ACCEPTANCES,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_GOVERNED_DOCUMENT_ACCEPTANCES],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /\n * The writer runs on a request-context-less execution context — during registration, and on the\n * return leg of a federated sign-up — so the client-shaped CREATE DTO would strip `userId` by name.\n * The system door re-attaches it from the schema allowlist. `read` / `list` serve the owed-acceptance\n * derivation, which runs for the person but not as a resource request of theirs.\n /\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n\n /\n * The person performed the act — ticked the box, pressed the button beside the notice, scrolled the\n * document and accepted. That is a value they supplied, not one observed about them or derived.\n * Exported with the rest of their data: what someone agreed to is squarely theirs to see (Art. 15).\n /\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n /\n * No `dataSubjectPolicy`, deliberately. That declaration describes a resource that can itself be\n * an ERASURE SUBJECT, and the factory refuses it without a `retentionPolicy`, because\n * `eraseSubjectAsSystem` would refuse such a subject anyway. An acceptance is never erased as a\n * subject: it is KEPT by its `USERS →` edge (`onParentDelete` disabled). Declaring a subject kind\n * here would describe an erasure that cannot happen.\n */\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n },\n ],\n },\n },\n});\n"]}

package/dist/esm/compliance/documents/user-governed-document-acceptances.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-governed-document-acceptances.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/documents/user-governed-document-acceptances.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,oCAAoC,EACrC,MAAM,qCAAqC,CAAC;AAE7C,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;kBAgD/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}
1	+ {"version":3,"file":"user-governed-document-acceptances.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/documents/user-governed-document-acceptances.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,oCAAoC,EACrC,MAAM,qCAAqC,CAAC;AAE7C,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;kBAgD/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/esm/compliance/documents/user-governed-document-acceptances.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-governed-document-acceptances.shared.schemas.js","sourceRoot":"","sources":["~~../../../../../~~src/compliance/documents/user-governed-document-acceptances.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,oCAAoC,GACrC,MAAM,qCAAqC,CAAC;AAE7C,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,4CAA4C;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IAEhE,kGAAkG;IAClG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAEhF,mFAAmF;IACnF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,iBAAiB,EAAE;IAChE,uGAAuG;IACvG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;IAC7C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,iBAAiB,EAAE;IAErE;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IACrF,oFAAoF;IACpF,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,iBAAiB,EAAE;IAEtF;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAEvE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC,cAAc,CAAC;IAChB;;;;OAIG;IACH,QAAQ;IACR,WAAW;IACX,gBAAgB;CACjB,CAAC,CAAC","sourcesContent":["/*\n Which governed-document releases a person has ACCEPTED — the queryable state that makes\n * re-acceptance possible at all (#1258, Step 2 / R6).\n \n ## Why a resource, when every acceptance is already an audit event\n \n `GOVERNED_DOCUMENT_INTERACTION_RECORDED` is the EVIDENCE of an act, written once into a trail built\n * to be appended to and never queried in the ordinary run of a request. \"Has this person accepted the\n * terms now in force?\" is asked on every first session, so answering it by reading the trail would put\n * the audit store on the hot path and make the trail's retention decide the product's behaviour. So the\n * two are separate records of one act, written by ONE function (`recordGovernedDocumentAcceptances`) so\n * they cannot disagree about which acts happened.\n \n ## One row per accepted RELEASE, and the release identity is copied rather than joined\n \n The same reason `GovernedDocumentInteractionSchema` gives: a record must stay readable when the\n * release file moves on, which is the whole point of binding an acceptance to a version. Locale and\n * jurisdictions are copied as EVIDENCE of which variant was met — never as part of what \"accepted\"\n * means. Accepting the French terms is accepting the terms; see `governedDocumentAcceptancesOwed`.\n \n ## It holds no personal data of its own\n \n Every value here describes the ACCOUNT's contractual standing — which document, which release, when,\n * how it was asked — with the person as a foreign key. That is the criterion\n * `.claude/context/privacy-erasure-retention.md` gives for a row that is not itself personal data, so\n * no field carries `dataCategories` and nothing is scrubbed. How the row survives an erasure is decided\n * on the `USERS →` edge, not here.\n /\nimport { z } from 'zod';\n\nimport {\n GovernedDocumentAcceptanceMode,\n GovernedDocumentClass,\n GovernedDocumentReleaseApprovalState,\n} from './governed-documents.shared.schemas';\n\nexport const UserGovernedDocumentAcceptanceSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* FK → USERS — the person who accepted. /\n userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n /\n The DOCUMENT accepted, independent of variant. This is the axis \"has this person accepted the\n * terms?\" is answered on, which is why it is indexed on its own.\n /\n documentRef: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),\n documentVersion: z.number().int().positive().excludeFromUpdate(),\n\n /* The exact RELEASE accepted — a locale + jurisdiction variant of the document, at a version. /\n releaseId: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),\n releaseVersion: z.number().int().positive().isSummaryField().excludeFromUpdate(),\n\n /* Copied from the release, as evidence of what kind of document was agreed to. /\n documentClass: z.enum(GovernedDocumentClass).excludeFromUpdate(),\n /* The variant the person met. Evidence only — never part of whether a document counts as accepted. /\n locale: z.string().min(2).excludeFromUpdate(),\n jurisdictionRefs: z.array(z.string()).default([]).excludeFromUpdate(),\n\n /\n How the application asked, when its surface declared a mode (#1382). Absent means the surface did\n * not say — the interaction record carries the advisory that marks it.\n /\n acceptanceMode: z.enum(GovernedDocumentAcceptanceMode).optional().excludeFromUpdate(),\n /* The release's standing AT THE MOMENT it was accepted. Not re-derivable later. /\n releaseApprovalState: z.enum(GovernedDocumentReleaseApprovalState).excludeFromUpdate(),\n\n /\n When the person accepted — the SAME instant the interaction record carries, supplied by the one\n * writer, never read from the clock separately. `governedDocumentAcceptancesOwed` compares it against\n * a release's `effectiveAt` to decide whether an acceptance predates a change that requires a new one.\n /\n acceptedAt: z.date().isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n /\n * One row per person per RELEASE AT A VERSION. Accepting the same release twice — a re-submitted\n * form, a retried request — is one fact, and a unique key is what makes the writer idempotent rather\n * than a check-then-insert that two concurrent submissions both pass.\n */\n 'userId',\n 'releaseId',\n 'releaseVersion',\n]);\nexport type UserGovernedDocumentAcceptance = z.infer<typeof UserGovernedDocumentAcceptanceSchema>;\n"]}
1	+ {"version":3,"file":"user-governed-document-acceptances.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/documents/user-governed-document-acceptances.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,oCAAoC,GACrC,MAAM,qCAAqC,CAAC;AAE7C,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,4CAA4C;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACjF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IAEhE,kGAAkG;IAClG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC/E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAEhF,mFAAmF;IACnF,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,iBAAiB,EAAE;IAChE,uGAAuG;IACvG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;IAC7C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,iBAAiB,EAAE;IAErE;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IACrF,oFAAoF;IACpF,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,iBAAiB,EAAE;IAEtF;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAEvE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC,cAAc,CAAC;IAChB;;;;OAIG;IACH,QAAQ;IACR,WAAW;IACX,gBAAgB;CACjB,CAAC,CAAC","sourcesContent":["/*\n Which governed-document releases a person has ACCEPTED — the queryable state that makes\n * re-acceptance possible at all (#1258, Step 2 / R6).\n \n ## Why a resource, when every acceptance is already an audit event\n \n `GOVERNED_DOCUMENT_INTERACTION_RECORDED` is the EVIDENCE of an act, written once into a trail built\n * to be appended to and never queried in the ordinary run of a request. \"Has this person accepted the\n * terms now in force?\" is asked on every first session, so answering it by reading the trail would put\n * the audit store on the hot path and make the trail's retention decide the product's behaviour. So the\n * two are separate records of one act, written by ONE function (`recordGovernedDocumentAcceptances`) so\n * they cannot disagree about which acts happened.\n \n ## One row per accepted RELEASE, and the release identity is copied rather than joined\n \n The same reason `GovernedDocumentInteractionSchema` gives: a record must stay readable when the\n * release file moves on, which is the whole point of binding an acceptance to a version. Locale and\n * jurisdictions are copied as EVIDENCE of which variant was met — never as part of what \"accepted\"\n * means. Accepting the French terms is accepting the terms; see `governedDocumentAcceptancesOwed`.\n \n ## It holds no personal data of its own\n \n Every value here describes the ACCOUNT's contractual standing — which document, which release, when,\n * how it was asked — with the person as a foreign key. That is the criterion\n * `.claude/context/privacy-erasure-retention.md` gives for a row that is not itself personal data, so\n * no field carries `dataCategories` and nothing is scrubbed. How the row survives an erasure is decided\n * on the `USERS →` edge, not here.\n /\nimport { z } from 'zod';\n\nimport {\n GovernedDocumentAcceptanceMode,\n GovernedDocumentClass,\n GovernedDocumentReleaseApprovalState,\n} from './governed-documents.shared.schemas';\n\nexport const UserGovernedDocumentAcceptanceSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* FK → USERS — the person who accepted. /\n userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n /\n The DOCUMENT accepted, independent of variant. This is the axis \"has this person accepted the\n * terms?\" is answered on, which is why it is indexed on its own.\n /\n documentRef: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),\n documentVersion: z.number().int().positive().excludeFromUpdate(),\n\n /* The exact RELEASE accepted — a locale + jurisdiction variant of the document, at a version. /\n releaseId: z.string().min(1).isDBIndexed().isSummaryField().excludeFromUpdate(),\n releaseVersion: z.number().int().positive().isSummaryField().excludeFromUpdate(),\n\n /* Copied from the release, as evidence of what kind of document was agreed to. /\n documentClass: z.enum(GovernedDocumentClass).excludeFromUpdate(),\n /* The variant the person met. Evidence only — never part of whether a document counts as accepted. /\n locale: z.string().min(2).excludeFromUpdate(),\n jurisdictionRefs: z.array(z.string()).default([]).excludeFromUpdate(),\n\n /\n How the application asked, when its surface declared a mode (#1382). Absent means the surface did\n * not say — the interaction record carries the advisory that marks it.\n /\n acceptanceMode: z.enum(GovernedDocumentAcceptanceMode).optional().excludeFromUpdate(),\n /* The release's standing AT THE MOMENT it was accepted. Not re-derivable later. /\n releaseApprovalState: z.enum(GovernedDocumentReleaseApprovalState).excludeFromUpdate(),\n\n /\n When the person accepted — the SAME instant the interaction record carries, supplied by the one\n * writer, never read from the clock separately. `governedDocumentAcceptancesOwed` compares it against\n * a release's `effectiveAt` to decide whether an acceptance predates a change that requires a new one.\n /\n acceptedAt: z.date().isDBIndexed().isSummaryField().excludeFromUpdate(),\n\n createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n /\n * One row per person per RELEASE AT A VERSION. Accepting the same release twice — a re-submitted\n * form, a retried request — is one fact, and a unique key is what makes the writer idempotent rather\n * than a check-then-insert that two concurrent submissions both pass.\n */\n 'userId',\n 'releaseId',\n 'releaseVersion',\n]);\nexport type UserGovernedDocumentAcceptance = z.infer<typeof UserGovernedDocumentAcceptanceSchema>;\n"]}

package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.d.ts CHANGED Viewed

@@ -126,6 +126,8 @@ export declare const AI_ENGINE_CAPABILITIES_IN_THE_CONTRACTED_SERVICE: readonly
 /**
  * Enabled AI capabilities with no declared posture — what a document must report as outstanding.
  *
+ * assurance-control: WILDO.AI.THIRD_PARTY_COMPONENTS — an enabled AI capability with no declared use is named, never assumed harmless.
+ *
  * Takes the ENABLED set as an argument: a capability the application has not enabled raises no
  * question, and reporting it would fill a notice with AI the application does not use.
  */

package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ai-use-posture.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/ai-use-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,qBAAqB;IAC/B;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IACjD,+FAA+F;IAC/F,oBAAoB,yBAAyB;CAC9C;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB;;IAG3B;;;;;;OAMG;;IAEH;;;;;;;OAOG;;kBAqBH,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;IAhDtC;;;;;;OAMG;;IAEH;;;;;;;OAOG;;mBAiCmG,CAAC;AAC3G,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,gBAAgB,EAqB5D,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gDAAgD,EAAE,SAAS,gBAAgB,EAEvF,CAAC;AAEF~~;;;;;GAKG~~;AACH,wBAAgB,2BAA2B,CACzC,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,uBAAuB,GAAG,SAAS,GAC3C,SAAS,gBAAgB,EAAE,CAK7B"}
1	+ {"version":3,"file":"ai-use-posture.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/ai-use-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,qBAAqB;IAC/B;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;IACjD,+FAA+F;IAC/F,oBAAoB,yBAAyB;CAC9C;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB;;IAG3B;;;;;;OAMG;;IAEH;;;;;;;OAOG;;kBAqBH,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;IAhDtC;;;;;;OAMG;;IAEH;;;;;;;OAOG;;mBAiCmG,CAAC;AAC3G,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,gBAAgB,EAqB5D,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gDAAgD,EAAE,SAAS,gBAAgB,EAEvF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,uBAAuB,GAAG,SAAS,GAC3C,SAAS,gBAAgB,EAAE,CAK7B"}

package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.js CHANGED Viewed

@@ -148,6 +148,8 @@ export const AI_ENGINE_CAPABILITIES_IN_THE_CONTRACTED_SERVICE = Object.freeze(AI
 /**
  * Enabled AI capabilities with no declared posture — what a document must report as outstanding.
  *
+ * assurance-control: WILDO.AI.THIRD_PARTY_COMPONENTS — an enabled AI capability with no declared use is named, never assumed harmless.
+ *
  * Takes the ENABLED set as an argument: a capability the application has not enabled raises no
  * question, and reporting it would fill a notice with AI the application does not use.
  */

package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ai-use-posture.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/ai-use-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qCAAqC,EAAE,MAAM,2DAA2D,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,qBAoBX;AApBD,WAAY,qBAAqB;IAC/B;;;;;;OAMG;IACH,oDAA2B,CAAA;IAC3B;;;;;;;OAOG;IACH,0EAAiD,CAAA;IACjD,+FAA+F;IAC/F,sEAA6C,CAAA;AAC/C,CAAC,EApBW,qBAAqB,KAArB,qBAAqB,QAoBhC;AAED,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,YAAY,CAAC;IACZ,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC1C;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,IAAI,OAAO,CAAC,WAAW,KAAK,qBAAqB,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,OAAO,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;gBAChC,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,0EAA0E;SAC5G,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAG3G;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgC,MAAM,CAAC,MAAM,CAAC;IAC/E,gBAAgB,CAAC,MAAM;IACvB,gBAAgB,CAAC,aAAa;IAC9B,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,eAAe;IAChC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,mBAAmB;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAgC,MAAM,CAAC,MAAM,CACxG,sBAAsB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,qCAAqC,CAAC,UAAU,CAAC,CAAC,CACjG,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,mBAAsC,EACtC,OAA4C;IAE5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,OAAO,gDAAgD,CAAC,MAAM,CAC5D,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { engineCapabilityReachesRuntimeService } from '../../external-providers/engine-capability-surface.shared';\nimport { EngineCapability } from \"../../external-providers/engine-capabilities.shared.schemas\";\n\n/*\n Whether an AI use DECIDES something about a person, and who reviews it if so.\n \n ## What the capability already says, and what it cannot\n \n `AI_LLM`, `AI_EMBEDDINGS`, `AI_DOCUMENT_EXTRACTION` and `AI_CODING_AGENT` establish that AI is in use\n * and for what FUNCTION. They cannot establish the two things that carry legal weight (issue #92):\n * whether any of it produces a decision with a legal or similarly significant effect on a person, and\n * whether a human reviews such a decision.\n \n Neither is inferable from a capability being enabled — the same `AI_LLM` backs a summarisation\n * feature that decides nothing and a screening feature that decides a great deal.\n \n ## Why silence here is worse than silence elsewhere\n \n Automated decision-making with significant effects attracts specific obligations: information about\n * the logic involved, and a right to obtain human intervention. A notice that describes AI use and says\n * nothing about consequence does not read as \"unknown\" — it reads as \"nothing significant happens\n * here\", which silently claims the exemption. That is why the posture is declared rather than\n * defaulted, and why an undeclared capability is reported as undeclared rather than assumed harmless.\n /\nexport enum AiDecisionConsequence {\n /\n The AI produces no decision about a person — it summarises, drafts, classifies content, or assists\n * a task whose outcome affects nobody's rights.\n \n A real and common answer, and the one that must be DECLARED rather than assumed: it is exactly the\n * claim a silent notice makes for free.\n /\n NO_DECISION = \"NO_DECISION\",\n /\n The AI informs a decision a HUMAN takes. The human is the decision-maker and can disregard it.\n \n Distinct from {@link NO_DECISION} because a person is affected, and distinct from\n * {@link DECIDES_AUTONOMOUSLY} because the obligation attaches to solely-automated decisions. Where\n * the human merely rubber-stamps, this is the wrong answer — the review must be capable of changing\n * the outcome.\n /\n ASSISTS_HUMAN_DECISION = \"ASSISTS_HUMAN_DECISION\",\n /* The AI's output IS the decision, with no human able to change it before it takes effect. /\n DECIDES_AUTONOMOUSLY = \"DECIDES_AUTONOMOUSLY\",\n}\n\n/* One AI capability's declared posture. /\nexport const AiUsePostureSchema = z\n .strictObject({\n consequence: z.enum(AiDecisionConsequence),\n /\n What the AI is used FOR, in the operator's words.\n \n Required, and it is what makes the posture checkable: \"summarising a contact's interaction\n * history\" and \"scoring a lead's creditworthiness\" are the same capability and different postures,\n * so a consequence with no stated use cannot be reviewed by anyone.\n /\n purpose: z.string().trim().min(1),\n /\n How a person obtains human intervention — REQUIRED unless the posture is\n * {@link AiDecisionConsequence.NO_DECISION}.\n \n The pairing is enforced below rather than left to a reviewer: an application declaring that AI\n * decides something about a person, and saying nothing about review, has described the obligation\n * without answering it.\n /\n humanReviewArrangement: z.string().trim().min(1).nullable(),\n })\n .superRefine((posture, context) => {\n if (posture.consequence === AiDecisionConsequence.NO_DECISION) {\n if (posture.humanReviewArrangement !== null) {\n context.addIssue({\n code: \"custom\",\n path: [\"humanReviewArrangement\"],\n message: \"a use that decides nothing has no human-review arrangement to describe\",\n });\n }\n return;\n }\n if (posture.humanReviewArrangement === null) {\n context.addIssue({\n code: \"custom\",\n path: [\"humanReviewArrangement\"],\n message: `a ${posture.consequence} use affects a person, so it must say how human intervention is obtained`,\n });\n }\n });\nexport type AiUsePosture = z.infer<typeof AiUsePostureSchema>;\n\n/\n The application's declared AI postures, keyed by the capability they describe.\n \n Keyed by CAPABILITY rather than by feature, deliberately. The issue suggested \"an AI use\", and a\n * feature-level posture is more precise — and it is a granularity nobody maintains, the same trade\n * that settled the retention schedule and the processor register. A capability is the unit the\n * application already declares, there are at most four, and an operator whose single `AI_LLM` capability\n * backs two features with different consequences declares the STRONGER one, which is the safe direction.\n /\nexport const ApplicationAiUsePostureSchema = z.partialRecord(z.enum(EngineCapability), AiUsePostureSchema);\nexport type ApplicationAiUsePosture = z.infer<typeof ApplicationAiUsePostureSchema>;\n\n/\n The AI capabilities a document must ask about.\n \n Named here rather than derived from a prefix: `AI_` is a spelling, and a capability added tomorrow\n * whose name happens to start with it would silently join the set — while one that processes personal\n * data under a different name would silently stay out.\n /\nexport const AI_ENGINE_CAPABILITIES: readonly EngineCapability[] = Object.freeze([\n EngineCapability.AI_LLM,\n EngineCapability.AI_EMBEDDINGS,\n EngineCapability.AI_DOCUMENT_EXTRACTION,\n EngineCapability.AI_CODING_AGENT,\n /\n * ADDED 2026-09-12, and its absence was a hole rather than a judgement.\n \n Generating an image from a person's prompt, or from their content, is AI processing by any\n * reading a notice has to survive — and because this list is what a document ASKS about, omitting\n * it meant an application offering image generation to its users was asked NOTHING about AI. The\n * omission was silent in the direction that matters: the notice reads complete.\n \n It was noticed while adding the surface axis and deliberately not slipped into that change,\n * because widening this vocabulary changes what an application must declare. Measured before\n * landing: Wonder Todos enables the capability and its only provider offering it sits in the\n * COMPANION scope (the brand/logo generator), so the scope resolution keeps it outside the\n * contracted service and its notice is unchanged. An application that binds an image provider to\n * a RUNTIME scope is now asked for a posture, which is the whole point.\n /\n EngineCapability.AI_IMAGE_GENERATION,\n]);\n\n/\n The AI capabilities a document about the CONTRACTED SERVICE must ask about.\n \n The set above, minus the capabilities that never run while the application serves a user. This is\n * the set a privacy notice, a record of processing and an Article 22 automated-decision statement\n * are about, and the distinction is not cosmetic: `AI_CODING_AGENT` is a build-time tool that writes\n * the application's SOURCE. It decides nothing about a data subject and processes none of their\n * data, so asking an operator to declare its \"posture\" toward people, or listing it as OUTSTANDING\n * in a notice, invents an AI question the service does not raise.\n \n That is not hypothetical. Wonder CRM enables `AI_CODING_AGENT` and no other AI capability. Under\n * the unfiltered set the drafter is pushed into the per-capability AI branch — the branch that asks\n * \"whether it DECIDES something about a person\" — for an application whose contracted service\n * performs no AI at all, and whose own declared fact says exactly that.\n \n DERIVED rather than listed, and total over the set above, so an AI capability added tomorrow lands\n * on the right side of this line by its DECLARED SURFACE rather than by anyone remembering to add it\n * here. The surface map is itself exhaustive over `EngineCapability`, so there is no default to fall\n * through.\n /\nexport const AI_ENGINE_CAPABILITIES_IN_THE_CONTRACTED_SERVICE: readonly EngineCapability[] = Object.freeze(\n AI_ENGINE_CAPABILITIES.filter((capability) => engineCapabilityReachesRuntimeService(capability)),\n);\n\n/\n Enabled AI capabilities with no declared posture — what a document must report as outstanding.\n \n Takes the ENABLED set as an argument: a capability the application has not enabled raises no\n * question, and reporting it would fill a notice with AI the application does not use.\n */\nexport function undeclaredAiUseCapabilities(\n enabledCapabilities: readonly string[],\n posture: ApplicationAiUsePosture \| undefined,\n): readonly EngineCapability[] {\n const enabled = new Set(enabledCapabilities);\n return AI_ENGINE_CAPABILITIES_IN_THE_CONTRACTED_SERVICE.filter(\n (capability) => enabled.has(capability) && posture?.[capability] === undefined,\n );\n}\n"]}
1	+ {"version":3,"file":"ai-use-posture.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/ai-use-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qCAAqC,EAAE,MAAM,2DAA2D,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,qBAoBX;AApBD,WAAY,qBAAqB;IAC/B;;;;;;OAMG;IACH,oDAA2B,CAAA;IAC3B;;;;;;;OAOG;IACH,0EAAiD,CAAA;IACjD,+FAA+F;IAC/F,sEAA6C,CAAA;AAC/C,CAAC,EApBW,qBAAqB,KAArB,qBAAqB,QAoBhC;AAED,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,YAAY,CAAC;IACZ,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC1C;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,IAAI,OAAO,CAAC,WAAW,KAAK,qBAAqB,CAAC,WAAW,EAAE,CAAC;QAC9D,IAAI,OAAO,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;gBAChC,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,0EAA0E;SAC5G,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAG3G;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgC,MAAM,CAAC,MAAM,CAAC;IAC/E,gBAAgB,CAAC,MAAM;IACvB,gBAAgB,CAAC,aAAa;IAC9B,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,eAAe;IAChC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,mBAAmB;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAgC,MAAM,CAAC,MAAM,CACxG,sBAAsB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,qCAAqC,CAAC,UAAU,CAAC,CAAC,CACjG,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,mBAAsC,EACtC,OAA4C;IAE5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,OAAO,gDAAgD,CAAC,MAAM,CAC5D,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS,CAC/E,CAAC;AACJ,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { engineCapabilityReachesRuntimeService } from '../../external-providers/engine-capability-surface.shared';\nimport { EngineCapability } from \"../../external-providers/engine-capabilities.shared.schemas\";\n\n/*\n Whether an AI use DECIDES something about a person, and who reviews it if so.\n \n ## What the capability already says, and what it cannot\n \n `AI_LLM`, `AI_EMBEDDINGS`, `AI_DOCUMENT_EXTRACTION` and `AI_CODING_AGENT` establish that AI is in use\n * and for what FUNCTION. They cannot establish the two things that carry legal weight (issue #92):\n * whether any of it produces a decision with a legal or similarly significant effect on a person, and\n * whether a human reviews such a decision.\n \n Neither is inferable from a capability being enabled — the same `AI_LLM` backs a summarisation\n * feature that decides nothing and a screening feature that decides a great deal.\n \n ## Why silence here is worse than silence elsewhere\n \n Automated decision-making with significant effects attracts specific obligations: information about\n * the logic involved, and a right to obtain human intervention. A notice that describes AI use and says\n * nothing about consequence does not read as \"unknown\" — it reads as \"nothing significant happens\n * here\", which silently claims the exemption. That is why the posture is declared rather than\n * defaulted, and why an undeclared capability is reported as undeclared rather than assumed harmless.\n /\nexport enum AiDecisionConsequence {\n /\n The AI produces no decision about a person — it summarises, drafts, classifies content, or assists\n * a task whose outcome affects nobody's rights.\n \n A real and common answer, and the one that must be DECLARED rather than assumed: it is exactly the\n * claim a silent notice makes for free.\n /\n NO_DECISION = \"NO_DECISION\",\n /\n The AI informs a decision a HUMAN takes. The human is the decision-maker and can disregard it.\n \n Distinct from {@link NO_DECISION} because a person is affected, and distinct from\n * {@link DECIDES_AUTONOMOUSLY} because the obligation attaches to solely-automated decisions. Where\n * the human merely rubber-stamps, this is the wrong answer — the review must be capable of changing\n * the outcome.\n /\n ASSISTS_HUMAN_DECISION = \"ASSISTS_HUMAN_DECISION\",\n /* The AI's output IS the decision, with no human able to change it before it takes effect. /\n DECIDES_AUTONOMOUSLY = \"DECIDES_AUTONOMOUSLY\",\n}\n\n/* One AI capability's declared posture. /\nexport const AiUsePostureSchema = z\n .strictObject({\n consequence: z.enum(AiDecisionConsequence),\n /\n What the AI is used FOR, in the operator's words.\n \n Required, and it is what makes the posture checkable: \"summarising a contact's interaction\n * history\" and \"scoring a lead's creditworthiness\" are the same capability and different postures,\n * so a consequence with no stated use cannot be reviewed by anyone.\n /\n purpose: z.string().trim().min(1),\n /\n How a person obtains human intervention — REQUIRED unless the posture is\n * {@link AiDecisionConsequence.NO_DECISION}.\n \n The pairing is enforced below rather than left to a reviewer: an application declaring that AI\n * decides something about a person, and saying nothing about review, has described the obligation\n * without answering it.\n /\n humanReviewArrangement: z.string().trim().min(1).nullable(),\n })\n .superRefine((posture, context) => {\n if (posture.consequence === AiDecisionConsequence.NO_DECISION) {\n if (posture.humanReviewArrangement !== null) {\n context.addIssue({\n code: \"custom\",\n path: [\"humanReviewArrangement\"],\n message: \"a use that decides nothing has no human-review arrangement to describe\",\n });\n }\n return;\n }\n if (posture.humanReviewArrangement === null) {\n context.addIssue({\n code: \"custom\",\n path: [\"humanReviewArrangement\"],\n message: `a ${posture.consequence} use affects a person, so it must say how human intervention is obtained`,\n });\n }\n });\nexport type AiUsePosture = z.infer<typeof AiUsePostureSchema>;\n\n/\n The application's declared AI postures, keyed by the capability they describe.\n \n Keyed by CAPABILITY rather than by feature, deliberately. The issue suggested \"an AI use\", and a\n * feature-level posture is more precise — and it is a granularity nobody maintains, the same trade\n * that settled the retention schedule and the processor register. A capability is the unit the\n * application already declares, there are at most four, and an operator whose single `AI_LLM` capability\n * backs two features with different consequences declares the STRONGER one, which is the safe direction.\n /\nexport const ApplicationAiUsePostureSchema = z.partialRecord(z.enum(EngineCapability), AiUsePostureSchema);\nexport type ApplicationAiUsePosture = z.infer<typeof ApplicationAiUsePostureSchema>;\n\n/\n The AI capabilities a document must ask about.\n \n Named here rather than derived from a prefix: `AI_` is a spelling, and a capability added tomorrow\n * whose name happens to start with it would silently join the set — while one that processes personal\n * data under a different name would silently stay out.\n /\nexport const AI_ENGINE_CAPABILITIES: readonly EngineCapability[] = Object.freeze([\n EngineCapability.AI_LLM,\n EngineCapability.AI_EMBEDDINGS,\n EngineCapability.AI_DOCUMENT_EXTRACTION,\n EngineCapability.AI_CODING_AGENT,\n /\n * ADDED 2026-09-12, and its absence was a hole rather than a judgement.\n \n Generating an image from a person's prompt, or from their content, is AI processing by any\n * reading a notice has to survive — and because this list is what a document ASKS about, omitting\n * it meant an application offering image generation to its users was asked NOTHING about AI. The\n * omission was silent in the direction that matters: the notice reads complete.\n \n It was noticed while adding the surface axis and deliberately not slipped into that change,\n * because widening this vocabulary changes what an application must declare. Measured before\n * landing: Wonder Todos enables the capability and its only provider offering it sits in the\n * COMPANION scope (the brand/logo generator), so the scope resolution keeps it outside the\n * contracted service and its notice is unchanged. An application that binds an image provider to\n * a RUNTIME scope is now asked for a posture, which is the whole point.\n /\n EngineCapability.AI_IMAGE_GENERATION,\n]);\n\n/\n The AI capabilities a document about the CONTRACTED SERVICE must ask about.\n \n The set above, minus the capabilities that never run while the application serves a user. This is\n * the set a privacy notice, a record of processing and an Article 22 automated-decision statement\n * are about, and the distinction is not cosmetic: `AI_CODING_AGENT` is a build-time tool that writes\n * the application's SOURCE. It decides nothing about a data subject and processes none of their\n * data, so asking an operator to declare its \"posture\" toward people, or listing it as OUTSTANDING\n * in a notice, invents an AI question the service does not raise.\n \n That is not hypothetical. Wonder CRM enables `AI_CODING_AGENT` and no other AI capability. Under\n * the unfiltered set the drafter is pushed into the per-capability AI branch — the branch that asks\n * \"whether it DECIDES something about a person\" — for an application whose contracted service\n * performs no AI at all, and whose own declared fact says exactly that.\n \n DERIVED rather than listed, and total over the set above, so an AI capability added tomorrow lands\n * on the right side of this line by its DECLARED SURFACE rather than by anyone remembering to add it\n * here. The surface map is itself exhaustive over `EngineCapability`, so there is no default to fall\n * through.\n /\nexport const AI_ENGINE_CAPABILITIES_IN_THE_CONTRACTED_SERVICE: readonly EngineCapability[] = Object.freeze(\n AI_ENGINE_CAPABILITIES.filter((capability) => engineCapabilityReachesRuntimeService(capability)),\n);\n\n/\n Enabled AI capabilities with no declared posture — what a document must report as outstanding.\n \n assurance-control: WILDO.AI.THIRD_PARTY_COMPONENTS — an enabled AI capability with no declared use is named, never assumed harmless.\n \n Takes the ENABLED set as an argument: a capability the application has not enabled raises no\n * question, and reporting it would fill a notice with AI the application does not use.\n */\nexport function undeclaredAiUseCapabilities(\n enabledCapabilities: readonly string[],\n posture: ApplicationAiUsePosture \| undefined,\n): readonly EngineCapability[] {\n const enabled = new Set(enabledCapabilities);\n return AI_ENGINE_CAPABILITIES_IN_THE_CONTRACTED_SERVICE.filter(\n (capability) => enabled.has(capability) && posture?.[capability] === undefined,\n );\n}\n"]}

package/dist/esm/compliance/privacy/capability-consent-purposes.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"capability-consent-purposes.shared.utils.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/capability-consent-purposes.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,0CAA0C,CAAC;AAExG;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,uCAAuC,CAAA;KAAE,EAAE,CAAC;CACpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wCAAwC,CACtD,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC,GAC7E,cAAc,EAAE,CASlB"}
1	+ {"version":3,"file":"capability-consent-purposes.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/capability-consent-purposes.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,0CAA0C,CAAC;AAExG;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,uCAAuC,CAAA;KAAE,EAAE,CAAC;CACpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wCAAwC,CACtD,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC,GAC7E,cAAc,EAAE,CASlB"}

package/dist/esm/compliance/privacy/capability-consent-purposes.shared.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"capability-consent-purposes.shared.utils.js","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/capability-consent-purposes.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAkB,MAAM,2BAA2B,CAAC;AAc7E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wCAAwC,CACtD,sBAA8E;IAE9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC;YAC/C,IAAI,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC","sourcesContent":["import { CONSENT_PURPOSES, ConsentPurpose } from './consent-purposes.shared';\nimport type { ResourceOperationConsentGateDeclaration } from './consent-gate-vocabulary.shared.schemas';\n\n/*\n The narrow slice of a resolved resource configuration this derivation reads: every operation, each\n * possibly carrying a `consentGate`. Structural, so `ResourcesRegistry['resourceConfigurations']`\n * values satisfy it without a cast at the call site — the operation record is a discriminated union\n * with no shared `consentGate` member (mirroring how `assertServiceConsentRequirementMet` reads the\n * same field off `executionContext.operation`), so each element is narrowed the same way here.\n /\nexport interface CapabilityConsentGateSubject {\n readonly operations: readonly { readonly consentGate?: ResourceOperationConsentGateDeclaration }[];\n}\n\n/\n Every `ConsentPurpose` declared by at least one operation across every resource in the registry\n * (#1462, following #1258 Step 3).\n \n Total over the REGISTRY, not over one application's own resources: an engine capability could\n * declare a `consentGate` as validly as an app-authored one, and the person facing a refusal from\n * either needs the same PROMPT surface to grant it from — there is no reader this derivation exists\n * to protect from engine noise the way `collectApplicationResourcesWithNoPersonalDataDeclaration`\n * protects a startup log from ~85 engine resources that never answer a question nobody asked them.\n * This is a SET, not a per-resource report: only the union of what was declared is useful downstream.\n \n Pure and import-light on purpose, mirroring `applicationAskedConsentPurposes` in the same\n * directory: the one call site that matters (`ResourcesRegistryBackendService.initialize()`) hands\n * this the live registry and the result travels onward as plain data\n * (`compliance.capabilityDeclaredConsentPurposes`), never as a reason to import registry types where\n * they do not otherwise belong.\n */\nexport function collectCapabilityDeclaredConsentPurposes(\n resourceConfigurations: Readonly<Record<string, CapabilityConsentGateSubject>>,\n): ConsentPurpose[] {\n const declared = new Set<ConsentPurpose>();\n for (const configuration of Object.values(resourceConfigurations)) {\n for (const operation of configuration.operations) {\n const purpose = operation.consentGate?.purpose;\n if (purpose !== undefined) declared.add(purpose);\n }\n }\n return CONSENT_PURPOSES.filter((purpose) => declared.has(purpose));\n}\n"]}
1	+ {"version":3,"file":"capability-consent-purposes.shared.utils.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/capability-consent-purposes.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAkB,MAAM,2BAA2B,CAAC;AAc7E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wCAAwC,CACtD,sBAA8E;IAE9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC;YAC/C,IAAI,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC","sourcesContent":["import { CONSENT_PURPOSES, ConsentPurpose } from './consent-purposes.shared';\nimport type { ResourceOperationConsentGateDeclaration } from './consent-gate-vocabulary.shared.schemas';\n\n/*\n The narrow slice of a resolved resource configuration this derivation reads: every operation, each\n * possibly carrying a `consentGate`. Structural, so `ResourcesRegistry['resourceConfigurations']`\n * values satisfy it without a cast at the call site — the operation record is a discriminated union\n * with no shared `consentGate` member (mirroring how `assertServiceConsentRequirementMet` reads the\n * same field off `executionContext.operation`), so each element is narrowed the same way here.\n /\nexport interface CapabilityConsentGateSubject {\n readonly operations: readonly { readonly consentGate?: ResourceOperationConsentGateDeclaration }[];\n}\n\n/\n Every `ConsentPurpose` declared by at least one operation across every resource in the registry\n * (#1462, following #1258 Step 3).\n \n Total over the REGISTRY, not over one application's own resources: an engine capability could\n * declare a `consentGate` as validly as an app-authored one, and the person facing a refusal from\n * either needs the same PROMPT surface to grant it from — there is no reader this derivation exists\n * to protect from engine noise the way `collectApplicationResourcesWithNoPersonalDataDeclaration`\n * protects a startup log from ~85 engine resources that never answer a question nobody asked them.\n * This is a SET, not a per-resource report: only the union of what was declared is useful downstream.\n \n Pure and import-light on purpose, mirroring `applicationAskedConsentPurposes` in the same\n * directory: the one call site that matters (`ResourcesRegistryBackendService.initialize()`) hands\n * this the live registry and the result travels onward as plain data\n * (`compliance.capabilityDeclaredConsentPurposes`), never as a reason to import registry types where\n * they do not otherwise belong.\n */\nexport function collectCapabilityDeclaredConsentPurposes(\n resourceConfigurations: Readonly<Record<string, CapabilityConsentGateSubject>>,\n): ConsentPurpose[] {\n const declared = new Set<ConsentPurpose>();\n for (const configuration of Object.values(resourceConfigurations)) {\n for (const operation of configuration.operations) {\n const purpose = operation.consentGate?.purpose;\n if (purpose !== undefined) declared.add(purpose);\n }\n }\n return CONSENT_PURPOSES.filter((purpose) => declared.has(purpose));\n}\n"]}

package/dist/esm/compliance/privacy/client-storage.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client-storage.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/client-storage.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,sHAAsH;AACtH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,aAAa,kBAAkB;IAC/B,eAAe,oBAAoB;CACpC;AAED;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC,sGAAsG;IACtG,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,aAAa,kBAAkB;CAChC;AAED,qEAAqE;AACrE,eAAO,MAAM,wBAAwB;IACnC,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAyBrE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC;IA5ElD,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;oBA0DJ,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,SAAS,EAAE,iCAAiC,GAAG,SAAS,GACvD,SAAS,MAAM,EAAE,CAEnB"}
1	+ {"version":3,"file":"client-storage.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/client-storage.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,sHAAsH;AACtH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,aAAa,kBAAkB;IAC/B,eAAe,oBAAoB;CACpC;AAED;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC,sGAAsG;IACtG,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,aAAa,kBAAkB;CAChC;AAED,qEAAqE;AACrE,eAAO,MAAM,wBAAwB;IACnC,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAyBrE,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,uCAAuC;IA5ElD,kGAAkG;;;IAGlG,mGAAmG;;;IAGnG;;;;;;;OAOG;;IAEH;;;;;;OAMG;;oBA0DJ,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,SAAS,EAAE,iCAAiC,GAAG,SAAS,GACvD,SAAS,MAAM,EAAE,CAEnB"}