@wildo-ai/saas-models 1.1.7 → 1.1.9

package/dist/esm/compliance/privacy/legal-holds.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legal-holds.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-holds.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,+GAA+G;AAC/G;;;;;;;;;;GAUG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;GAOG;AACH,oBAAY,eAAe;IACzB,uFAAuF;IACvF,YAAY,iBAAiB;IAC7B,yFAAyF;IACzF,wBAAwB,6BAA6B;IACrD,+GAA+G;IAC/G,gBAAgB,qBAAqB;CACtC;AAED;;;;GAIG;AACH,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,oBAAY,sBAAsB;IAChC,0DAA0D;IAC1D,YAAY,iBAAiB;IAC7B,wGAAwG;IACxG,QAAQ,aAAa;CACtB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gHAAgH;IAChH,iBAAiB,sBAAsB;IACvC,sHAAsH;IACtH,6BAA6B,kCAAkC;CAChE;AAED,sFAAsF;AACtF,oBAAY,qBAAqB;IAC/B,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,kIAAkI;AAClI,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAmE1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,kHAAkH;AAClH,eAAO,MAAM,2BAA2B;;;;;;;iBAQtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,6DAA6D;AAE7D,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAsBtF;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,8EAA8E;IAC9E,WAAW,gBAAgB;IAC3B,yHAAyH;IACzH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,kIAAkI;IAClI,cAAc,mBAAmB;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC;IAC/C,wGAAwG;IACxG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,iDAAiD;AACjD,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,QAAQ,GAAG,eAAe,GAAG,aAAa,CAAC,CAAC;AAEpJ,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAChD,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IACzD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAehC;AAwDD,uFAAuF;AACvF,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,eAAe,EAAE,CAGxF"}
+{"version":3,"file":"legal-holds.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-holds.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,+GAA+G;AAC/G;;;;;;;;;;GAUG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;CAC9B;AAED;;;;;;;GAOG;AACH,oBAAY,eAAe;IACzB,uFAAuF;IACvF,YAAY,iBAAiB;IAC7B,yFAAyF;IACzF,wBAAwB,6BAA6B;IACrD,+GAA+G;IAC/G,gBAAgB,qBAAqB;CACtC;AAED;;;;GAIG;AACH,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,oBAAY,sBAAsB;IAChC,0DAA0D;IAC1D,YAAY,iBAAiB;IAC7B,wGAAwG;IACxG,QAAQ,aAAa;CACtB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gHAAgH;IAChH,iBAAiB,sBAAsB;IACvC,sHAAsH;IACtH,6BAA6B,kCAAkC;CAChE;AAED,sFAAsF;AACtF,oBAAY,qBAAqB;IAC/B,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,kIAAkI;AAClI,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAmE1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,kHAAkH;AAClH,eAAO,MAAM,2BAA2B;;;;;;;iBAQtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,6DAA6D;AAE7D,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAsBtF;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,8EAA8E;IAC9E,WAAW,gBAAgB;IAC3B,yHAAyH;IACzH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,kIAAkI;IAClI,cAAc,mBAAmB;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC;IAC/C,wGAAwG;IACxG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,iDAAiD;AACjD,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,QAAQ,GAAG,eAAe,GAAG,aAAa,CAAC,CAAC;AAEpJ,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAChD,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IACzD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAehC;AAwDD,uFAAuF;AACvF,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,eAAe,EAAE,CAGxF"}

package/dist/esm/compliance/privacy/legal-holds.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"legal-holds.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-holds.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E,+GAA+G;AAC/G;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,qDAA+B,CAAA;IAC/B,mDAA6B,CAAA;AAC/B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,uFAAuF;IACvF,gDAA6B,CAAA;IAC7B,yFAAyF;IACzF,wEAAqD,CAAA;IACrD,+GAA+G;IAC/G,wDAAqC,CAAA;AACvC,CAAC,EAPW,eAAe,KAAf,eAAe,QAO1B;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,wCAAqB,CAAA;AACvB,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,0DAA0D;IAC1D,uDAA6B,CAAA;IAC7B,wGAAwG;IACxG,+CAAqB,CAAA;AACvB,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,gHAAgH;IAChH,6DAAuC,CAAA;IACvC,sHAAsH;IACtH,qFAA+D,CAAA;AACjE,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,sFAAsF;AACtF,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,wCAAe,CAAA;IACf,4CAAmB,CAAA;AACrB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,kIAAkI;AAClI,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,yFAAyF;IACzF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SAClC,UAAU,CAAC,oBAAoB,CAAC;SAChC,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,oDAAoD;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzF,yGAAyG;IACzG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEnH,sEAAsE;IACtE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;SACjC,UAAU,CAAC,iBAAiB,CAAC;SAC7B,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAEhH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;SAC1C,UAAU,CAAC,wBAAwB,CAAC;SACpC,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;SAC5B,UAAU,CAAC,iBAAiB,CAAC;SAC7B,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;SAC/B,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC1G,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE7F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvH;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAExI,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,kHAAkH;AAClH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IAC5I,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IAChI,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;SACjF,QAAQ,CAAC,2GAA2G,CAAC;IACxH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IAC7G,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;CACvG,CAAC,CAAC;AAEH,6DAA6D;AAE7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;CAC5F,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAA8B;IAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,QAAQ,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1B,KAAK,kBAAkB,CAAC,YAAY;YAClC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC9G,QAAQ,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;YAC1H,CAAC;YACD,MAAM;QACR,KAAK,kBAAkB,CAAC,aAAa;YACnC,IAAI,CAAC,OAAO,CAAC,YAAY;gBAAE,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YAClG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YACvG,MAAM;QACR,KAAK,kBAAkB,CAAC,YAAY;YAClC,IAAI,CAAC,OAAO,CAAC,aAAa;gBAAE,QAAQ,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YAC9G,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC9I,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,OAAO,CAAC,SAAS,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAcX;AAdD,WAAY,+BAA+B;IACzC,8EAA8E;IAC9E,8DAA2B,CAAA;IAC3B,yHAAyH;IACzH,8DAA2B,CAAA;IAC3B;;;;;OAKG;IACH,gEAA6B,CAAA;IAC7B,kIAAkI;IAClI,oEAAiC,CAAA;AACnC,CAAC,EAdW,+BAA+B,KAA/B,+BAA+B,QAc1C;AA2BD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAOrC;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,yBAAyB;YAC9E,CAAC,CAAC,SAAS,CAAC,EAAE;YACd,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC;gBAAE,SAAS;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAqB,EACrB,SAAgC,EAChC,iBAAqC,EACrC,KAAkD;IAElD,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,YAAY;YAClC,OAAO,iBAAiB,KAAK,IAAI,CAAC,cAAc,CAAC;QACnD,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,iBAAiB,KAAK,IAAI,CAAC,cAAc;mBAC3C,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBACxC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,KAAK,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YACrC,sGAAsG;YACtG,2GAA2G;YAC3G,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,IAAI,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;YAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC7C,IAAI,WAAW,CAAC,IAAI,KAAK,+BAA+B,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YACtF,IAAI,KAAK,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChE,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;gBACzB,KAAK,+BAA+B,CAAC,WAAW;oBAC9C,OAAO,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC;gBAClC,KAAK,+BAA+B,CAAC,WAAW;oBAC9C,OAAO,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC;gBAChH,KAAK,+BAA+B,CAAC,YAAY,CAAC,CAAC,CAAC;oBAClD,6EAA6E;oBAC7E,IAAI,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACxH,0GAA0G;oBAC1G,qGAAqG;oBACrG,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC;oBAC5D,+GAA+G;oBAC/G,kEAAkE;oBAClE,IAAI,iBAAiB,KAAK,SAAS;wBAAE,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;oBAC5F,gHAAgH;oBAChH,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,WAAW,GAAU,WAAW,CAAC,IAAI,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,2DAA2D;YAC3D,MAAM,WAAW,GAAU,IAAI,CAAC,SAAS,CAAC;YAC1C,KAAK,WAAW,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChF,CAAC","sourcesContent":["/**\n * Legal holds — a recorded decision that suspends DELETION of a defined scope until it is released (#1634).\n *\n * ## Why it exists\n *\n * Once data is deleted on a schedule (#1613's retention-class sweep), a firm under litigation, a\n * regulator's investigation or a client dispute must be able to stop that for a defined scope, and\n * keep proof that it did. A hold is that stop. It is a decision about a CASE, which is why it is not a\n * retention class: a statutory period is a property of a class of data (#1635); a hold names a scope\n * and a ground, and ends only when somebody releases it.\n *\n * ## What a hold suspends\n *\n * Every door that destroys data consults ONE predicate before destroying anything\n * ({@link matchLegalHoldsToRows}, evaluated over the active holds the backend reads in one query):\n *\n * | door | what a held row gets |\n * |---|---|\n * | the retention-class sweep | skipped and counted, never thrown |\n * | a subject erasure | left exactly as it is (neither deleted nor scrubbed), reported per row |\n * | the tenant purge | the whole tenant is skipped while ANY hold on it is active |\n * | a DELETE / DELETE_MANY, and an `onParentDelete` cascade | refused, 409 {@link LegalHoldErrorCode.LEGAL_HOLD_ACTIVE} |\n * | file bytes in object storage | not hard-deleted while the owning row is held |\n * | RAG chunk removal | chunks of a held row are kept |\n *\n * Impersonalization counts as destruction: a scrub removes exactly what a hold exists to preserve.\n *\n * ## What it does NOT do\n *\n * It does not restrict PROCESSING (reads, updates). A hold is a preservation duty, and a row that must\n * be preserved may still be corrected; restricting processing of kept data is #1635's statutory\n * restriction, a different obligation with a different trigger.\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/** @wildo_source:part:start saas.models.privacy.legal-holds facet:layer:shared facet:audience:app-developer */\n/**\n * WHAT a hold covers.\n *\n * - `ORGANIZATION` — every row the tenant owns, and the tenant itself (it is not purged).\n * - `RESOURCE_ROWS` — the rows of ONE resource type in the tenant: the listed `rowIds`, or every row of\n *   that type when none are listed. An explicit id list, not a query: a hold is evidence, and \"which rows\n *   were held\" must be answerable from the hold alone, without re-running a filter against data that\n *   has since changed.\n * - `DATA_SUBJECT` — every row the subject-export graph attributes to one user. What a claim concerning\n *   ONE person needs. See {@link LegalHoldSubjectAttributionKind} for how a row is attributed.\n */\nexport enum LegalHoldScopeKind {\n  ORGANIZATION = 'organization',\n  RESOURCE_ROWS = 'resource_rows',\n  DATA_SUBJECT = 'data_subject',\n}\n\n/**\n * WHY the data is held. Travels into every refusal and erasure report, because the ground is what a\n * data subject is owed when their erasure is not completed.\n *\n * GDPR Art. 17(3)(e) (establishment, exercise or defence of legal claims) and Art. 17(3)(b) (compliance\n * with a legal obligation) are the grounds under which a hold may also block an erasure.\n * spec-cite: Regulation (EU) 2016/679, Art. 17(3)(b) and (e). Not legal advice.\n */\nexport enum LegalHoldGround {\n  /** Litigation, a dispute or a claim that is reasonably anticipated — Art. 17(3)(e). */\n  LEGAL_CLAIMS = 'legal_claims',\n  /** A regulator's or authority's investigation that requires the data to be preserved. */\n  REGULATORY_INVESTIGATION = 'regulatory_investigation',\n  /** A legal obligation to keep the data, other than a statutory retention period of a class — Art. 17(3)(b). */\n  LEGAL_OBLIGATION = 'legal_obligation',\n}\n\n/**\n * A hold's lifecycle. Two states and one direction: a released hold is kept as evidence and never\n * reactivated — a new hold is a new row. There is no expiry state, deliberately: litigation ends by\n * decision, not by clock, and a hold that lapses on its own is exactly the failure it exists to prevent.\n */\nexport enum LegalHoldStatus {\n  ACTIVE = 'active',\n  RELEASED = 'released',\n}\n\n/**\n * WHO placed the hold, and therefore who may release it.\n *\n * A hold is released by the tier that placed it, and only by that tier. A tenant must not be able to\n * lift a preservation duty the operator placed on it (an investigation OF the tenant), and the operator\n * must not lift a tenant's own litigation hold on the tenant's behalf. Both tiers SEE every hold on the\n * tenant: the tenant is owed knowing why its data is not being deleted.\n */\nexport enum LegalHoldPlacementTier {\n  /** Placed by the tenant's own owner, for its own data. */\n  ORGANIZATION = 'organization',\n  /** Placed by an application super-administrator, crossing into the tenant through the declared door. */\n  PLATFORM = 'platform',\n}\n\n/**\n * Client-branchable codes carried as `context.code` on a refusal (allow-listed by the error sanitizer).\n */\nexport enum LegalHoldErrorCode {\n  /** A row the delete addresses is under an active legal hold. The caller is authorized; the state forbids it. */\n  LEGAL_HOLD_ACTIVE = 'legal_hold_active',\n  /** The active holds could not be read, so whether the rows are held is unknown. Deletion is refused (fail closed). */\n  LEGAL_HOLD_STATE_UNVERIFIABLE = 'legal_hold_state_unverifiable',\n}\n\n/** The custom verbs. No generic CREATE / UPDATE / DELETE is exposed to any client. */\nexport enum LegalHolds_Operations {\n  PLACE = 'place',\n  RELEASE = 'release',\n}\n\n/** The largest explicit row list one `RESOURCE_ROWS` hold may name. A larger set is several holds, or the whole resource type. */\nexport const LEGAL_HOLD_MAXIMUM_ROW_IDS = 1000;\n\nexport const LegalHoldSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** The held tenant. The primary scope anchor: the tenant sees every hold on its data. */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  scopeKind: z.enum(LegalHoldScopeKind)\n    .systemEnum('LegalHoldScopeKind')\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /** `RESOURCE_ROWS` only: the held resource type. */\n  resourceType: z.string().min(1).max(200).optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** `RESOURCE_ROWS` only: the held rows. Absent means every row of {@link resourceType} in the tenant. */\n  rowIds: z.array(z.string().min(1)).max(LEGAL_HOLD_MAXIMUM_ROW_IDS).optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** `DATA_SUBJECT` only: the person whose attributed rows are held. */\n  subjectUserId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  legalGround: z.enum(LegalHoldGround)\n    .systemEnum('LegalHoldGround')\n    .isSummaryField()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /**\n   * Why, in the placer's words: the matter, the case reference. REQUIRED.\n   *\n   * Not scrubbed on erasure, and that is a decision: a hold is the operator's defence evidence\n   * (Art. 17(3)(e)), and the matter it names is what the hold preserves. Not exported to SIEM by default\n   * either — free text is the surface most likely to name a third party.\n   */\n  justification: z.string().min(1).max(2000).excludeFromUpdate().dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  placementTier: z.enum(LegalHoldPlacementTier)\n    .systemEnum('LegalHoldPlacementTier')\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  status: z.enum(LegalHoldStatus)\n    .systemEnum('LegalHoldStatus')\n    .default(LegalHoldStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  placedByUserId: z.string().min(1).isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  placedAt: z.date().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  releasedByUserId: z.string().min(1).optional().isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The retention clock's closure field: a released hold is kept as `AUDIT_LOGS`-class evidence from this\n   * instant. Null while ACTIVE, so an active hold never expires. Server-owned — a caller-writable clock\n   * would be a caller-ordered delete of the evidence.\n   */\n  releasedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  releaseReason: z.string().max(2000).optional().excludeFromCreate().excludeFromUpdate().dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\n\nexport type LegalHold = z.infer<typeof LegalHoldSchema>;\n\n/** The `place` request. Coherence between `scopeKind` and the three optional selectors is checked server-side. */\nexport const LegalHoldPlaceRequestSchema = z.object({\n  scopeKind: z.enum(LegalHoldScopeKind).describe('What the hold covers: the whole organization, rows of one resource, or one person\\'s data.'),\n  resourceType: z.string().min(1).max(200).optional().describe('For a resource-rows hold: the resource type whose rows are held.'),\n  rowIds: z.array(z.string().min(1)).min(1).max(LEGAL_HOLD_MAXIMUM_ROW_IDS).optional()\n    .describe('For a resource-rows hold: the rows held. Omit to hold every row of the resource type in the organization.'),\n  subjectUserId: z.string().min(1).optional().describe('For a data-subject hold: the user whose data is held.'),\n  legalGround: z.enum(LegalHoldGround).describe('Why the data must be preserved.'),\n  justification: z.string().min(1).max(2000).describe('The matter or case the hold preserves data for.'),\n});\nexport type LegalHoldPlaceRequest = z.infer<typeof LegalHoldPlaceRequestSchema>;\n/** @wildo_source:part:end saas.models.privacy.legal-holds */\n\nexport const LegalHoldReleaseRequestSchema = z.object({\n  releaseReason: z.string().min(1).max(2000).describe('Why the preservation duty has ended.'),\n});\n\n/**\n * The scope-coherence rule for a `place` request, as one pure function the server and any client share.\n * Returns the problems; empty means coherent.\n */\nexport function validateLegalHoldPlaceRequest(request: LegalHoldPlaceRequest): string[] {\n  const problems: string[] = [];\n  switch (request.scopeKind) {\n    case LegalHoldScopeKind.ORGANIZATION:\n      if (request.resourceType !== undefined || request.rowIds !== undefined || request.subjectUserId !== undefined) {\n        problems.push('An organization hold covers the whole organization and takes no resourceType, rowIds or subjectUserId.');\n      }\n      break;\n    case LegalHoldScopeKind.RESOURCE_ROWS:\n      if (!request.resourceType) problems.push('A resource-rows hold names the resourceType it holds.');\n      if (request.subjectUserId !== undefined) problems.push('A resource-rows hold takes no subjectUserId.');\n      break;\n    case LegalHoldScopeKind.DATA_SUBJECT:\n      if (!request.subjectUserId) problems.push('A data-subject hold names the subjectUserId whose data it holds.');\n      if (request.resourceType !== undefined || request.rowIds !== undefined) problems.push('A data-subject hold takes no resourceType or rowIds.');\n      break;\n    default: {\n      const unknownKind: never = request.scopeKind;\n      problems.push(`Unknown legal hold scope kind '${String(unknownKind)}'.`);\n    }\n  }\n  return problems;\n}\n\n/**\n * How ONE resource type's rows are attributed to a data subject, for `DATA_SUBJECT` holds.\n *\n * Derived from the subject-export graph of `USERS` (Art. 15 access purpose), so \"the rows a hold on a\n * person covers\" and \"the rows an access request about that person discloses\" are the same set by\n * construction. Where a row cannot be attributed from its own fields, the answer is UNRESOLVABLE and the\n * row is HELD: over-preserving delays a deletion until release, under-preserving destroys evidence.\n */\nexport enum LegalHoldSubjectAttributionKind {\n  /** The row IS the person (`USERS`): attributed when its id is the subject. */\n  SUBJECT_ROW = 'subject_row',\n  /** The row carries a foreign key to `USERS` on an export edge: attributed when any of those fields names the subject. */\n  FOREIGN_KEY = 'foreign_key',\n  /**\n   * The resource is in the subject's export graph, but a row's attribution needs other rows (an owned\n   * descendant, or a key held on the `USERS` side). Any foreign-key field it carries still attributes it; beyond\n   * that, a row in the held tenant is held (conservative), a row outside any tenant is the person's only when its\n   * `userId` names them, and inside ANOTHER person's erasure it is that person's, not the held subject's.\n   */\n  UNRESOLVABLE = 'unresolvable',\n  /** Not in the subject's export graph (unrelated, or declared `exportSubject: FORBIDDEN`). A data-subject hold never covers it. */\n  NOT_ATTRIBUTED = 'not_attributed',\n}\n\nexport interface LegalHoldSubjectAttribution {\n  readonly kind: LegalHoldSubjectAttributionKind;\n  /** The row fields naming a user — the whole answer for FOREIGN_KEY, a first answer for UNRESOLVABLE. */\n  readonly foreignKeyFields?: readonly string[];\n}\n\n/** An active hold, as the predicate needs it. */\nexport type ActiveLegalHold = Pick<LegalHold, '_id' | 'organizationId' | 'scopeKind' | 'resourceType' | 'rowIds' | 'subjectUserId' | 'legalGround'>;\n\n/** One row a deletion path is about to destroy. */\nexport interface LegalHoldCandidateRow {\n  readonly id: string;\n  /** The tenant the row belongs to; absent for a row with no organization scope. */\n  readonly organizationId?: string;\n  /** The row's fields, for foreign-key attribution. */\n  readonly row?: Record<string, unknown>;\n}\n\n/** Why a row is held: the hold and its ground. */\nexport interface LegalHoldMatch {\n  readonly holdId: string;\n  readonly scopeKind: LegalHoldScopeKind;\n  readonly legalGround: LegalHoldGround;\n}\n\n/**\n * THE hold predicate — which of `rows` are under which of `holds`. Pure; the backend reads the active\n * holds once per call and hands them in.\n *\n * `erasureSubjectUserIds` is set only by a subject erasure: every row that erasure reaches in a resource\n * of the subject's export graph IS attributed to the person being erased, so a `DATA_SUBJECT` hold on that\n * person covers it whatever its own fields say.\n *\n * The ORGANIZATIONS row's tenant is its own id, so an `ORGANIZATION` hold also holds the tenant row.\n */\nexport function matchLegalHoldsToRows(input: {\n  readonly holds: readonly ActiveLegalHold[];\n  readonly resourceType: string;\n  readonly rows: readonly LegalHoldCandidateRow[];\n  readonly organizationsResourceType: string;\n  readonly subjectAttribution: LegalHoldSubjectAttribution;\n  readonly erasureSubjectUserIds?: readonly string[];\n}): Map<string, LegalHoldMatch[]> {\n  const held = new Map<string, LegalHoldMatch[]>();\n  if (input.holds.length === 0) return held;\n  for (const candidate of input.rows) {\n    const rowOrganizationId = input.resourceType === input.organizationsResourceType\n      ? candidate.id\n      : candidate.organizationId;\n    for (const hold of input.holds) {\n      if (!legalHoldCoversRow(hold, candidate, rowOrganizationId, input)) continue;\n      const matches = held.get(candidate.id) ?? [];\n      matches.push({ holdId: hold._id, scopeKind: hold.scopeKind, legalGround: hold.legalGround });\n      held.set(candidate.id, matches);\n    }\n  }\n  return held;\n}\n\nfunction legalHoldCoversRow(\n  hold: ActiveLegalHold,\n  candidate: LegalHoldCandidateRow,\n  rowOrganizationId: string | undefined,\n  input: Parameters<typeof matchLegalHoldsToRows>[0],\n): boolean {\n  switch (hold.scopeKind) {\n    case LegalHoldScopeKind.ORGANIZATION:\n      return rowOrganizationId === hold.organizationId;\n    case LegalHoldScopeKind.RESOURCE_ROWS:\n      return rowOrganizationId === hold.organizationId\n        && hold.resourceType === input.resourceType\n        && (hold.rowIds === undefined || hold.rowIds.includes(candidate.id));\n    case LegalHoldScopeKind.DATA_SUBJECT: {\n      // A person's rows outside any tenant (their user-scoped profile, preferences) are theirs wherever the\n      // claim arises, so a hold placed in one tenant covers them too. Rows of ANOTHER tenant are not this one's.\n      if (rowOrganizationId !== undefined && rowOrganizationId !== hold.organizationId) return false;\n      const subject = hold.subjectUserId;\n      if (!subject) return true; // incoherent hold: fail closed\n      const attribution = input.subjectAttribution;\n      if (attribution.kind === LegalHoldSubjectAttributionKind.NOT_ATTRIBUTED) return false;\n      if (input.erasureSubjectUserIds?.includes(subject)) return true;\n      switch (attribution.kind) {\n        case LegalHoldSubjectAttributionKind.SUBJECT_ROW:\n          return candidate.id === subject;\n        case LegalHoldSubjectAttributionKind.FOREIGN_KEY:\n          return (attribution.foreignKeyFields ?? []).some((field) => String(candidate.row?.[field] ?? '') === subject);\n        case LegalHoldSubjectAttributionKind.UNRESOLVABLE: {\n          // A foreign key on the row itself still names the person, when there is one.\n          if ((attribution.foreignKeyFields ?? []).some((field) => String(candidate.row?.[field] ?? '') === subject)) return true;\n          // Inside the erasure of SOMEONE ELSE, the walk has already attributed the row: it is the erased person's,\n          // not this subject's. Holding it would refuse their erasure on a ground belonging to another matter.\n          if (input.erasureSubjectUserIds !== undefined) return false;\n          // Outside any tenant, a row's owner is its `userId` (a USER_SELF row's primary scope), so a hold on one person\n          // never reaches every other person's rows across the application.\n          if (rowOrganizationId === undefined) return String(candidate.row?.userId ?? '') === subject;\n          // Inside the held tenant, the row's owner cannot be read from its own fields: held, the conservative direction.\n          return true;\n        }\n        default: {\n          const unknownKind: never = attribution.kind;\n          throw new Error(`Unknown legal hold subject attribution '${String(unknownKind)}'`);\n        }\n      }\n    }\n    default: {\n      // An unknown scope is not a reason to delete: fail closed.\n      const unknownKind: never = hold.scopeKind;\n      void unknownKind;\n      return true;\n    }\n  }\n}\n\n/** One row a subject erasure left untouched because a legal hold covers it (#1634). */\nexport interface SubjectErasureLegalHoldRetention {\n  resourceType: string;\n  rowId: string;\n  /** The grounds of every hold covering the row — what the data subject is told. */\n  legalGrounds: LegalHoldGround[];\n  holdIds: string[];\n}\n\n/**\n * The grounds of a set of matches, de-duplicated in vocabulary order — what a refusal or a report shows.\n */\nexport function legalHoldGroundsOf(matches: readonly LegalHoldMatch[]): LegalHoldGround[] {\n  const present = new Set(matches.map((match) => match.legalGround));\n  return Object.values(LegalHoldGround).filter((ground) => present.has(ground));\n}\n"]}
+{"version":3,"file":"legal-holds.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/legal-holds.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E,+GAA+G;AAC/G;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,qDAA+B,CAAA;IAC/B,mDAA6B,CAAA;AAC/B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,uFAAuF;IACvF,gDAA6B,CAAA;IAC7B,yFAAyF;IACzF,wEAAqD,CAAA;IACrD,+GAA+G;IAC/G,wDAAqC,CAAA;AACvC,CAAC,EAPW,eAAe,KAAf,eAAe,QAO1B;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,oCAAiB,CAAA;IACjB,wCAAqB,CAAA;AACvB,CAAC,EAHW,eAAe,KAAf,eAAe,QAG1B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,0DAA0D;IAC1D,uDAA6B,CAAA;IAC7B,wGAAwG;IACxG,+CAAqB,CAAA;AACvB,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,gHAAgH;IAChH,6DAAuC,CAAA;IACvC,sHAAsH;IACtH,qFAA+D,CAAA;AACjE,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,sFAAsF;AACtF,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,wCAAe,CAAA;IACf,4CAAmB,CAAA;AACrB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,kIAAkI;AAClI,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,yFAAyF;IACzF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;SAClC,UAAU,CAAC,oBAAoB,CAAC;SAChC,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,oDAAoD;IACpD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzF,yGAAyG;IACzG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEnH,sEAAsE;IACtE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;SACjC,UAAU,CAAC,iBAAiB,CAAC;SAC7B,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAEhH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;SAC1C,UAAU,CAAC,wBAAwB,CAAC;SACpC,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;SAC5B,UAAU,CAAC,iBAAiB,CAAC;SAC7B,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;SAC/B,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAC1G,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE7F,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvH;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAExI,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,kHAAkH;AAClH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IAC5I,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;IAChI,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;SACjF,QAAQ,CAAC,2GAA2G,CAAC;IACxH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IAC7G,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAChF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;CACvG,CAAC,CAAC;AAEH,6DAA6D;AAE7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;CAC5F,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAA8B;IAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,QAAQ,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1B,KAAK,kBAAkB,CAAC,YAAY;YAClC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC9G,QAAQ,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;YAC1H,CAAC;YACD,MAAM;QACR,KAAK,kBAAkB,CAAC,aAAa;YACnC,IAAI,CAAC,OAAO,CAAC,YAAY;gBAAE,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;YAClG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YACvG,MAAM;QACR,KAAK,kBAAkB,CAAC,YAAY;YAClC,IAAI,CAAC,OAAO,CAAC,aAAa;gBAAE,QAAQ,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YAC9G,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC9I,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,OAAO,CAAC,SAAS,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAcX;AAdD,WAAY,+BAA+B;IACzC,8EAA8E;IAC9E,8DAA2B,CAAA;IAC3B,yHAAyH;IACzH,8DAA2B,CAAA;IAC3B;;;;;OAKG;IACH,gEAA6B,CAAA;IAC7B,kIAAkI;IAClI,oEAAiC,CAAA;AACnC,CAAC,EAdW,+BAA+B,KAA/B,+BAA+B,QAc1C;AA2BD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAOrC;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,yBAAyB;YAC9E,CAAC,CAAC,SAAS,CAAC,EAAE;YACd,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC;gBAAE,SAAS;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAqB,EACrB,SAAgC,EAChC,iBAAqC,EACrC,KAAkD;IAElD,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,KAAK,kBAAkB,CAAC,YAAY;YAClC,OAAO,iBAAiB,KAAK,IAAI,CAAC,cAAc,CAAC;QACnD,KAAK,kBAAkB,CAAC,aAAa;YACnC,OAAO,iBAAiB,KAAK,IAAI,CAAC,cAAc;mBAC3C,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBACxC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,KAAK,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;YACrC,sGAAsG;YACtG,2GAA2G;YAC3G,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,IAAI,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;YAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,CAAC;YAC7C,IAAI,WAAW,CAAC,IAAI,KAAK,+BAA+B,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YACtF,IAAI,KAAK,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChE,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;gBACzB,KAAK,+BAA+B,CAAC,WAAW;oBAC9C,OAAO,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC;gBAClC,KAAK,+BAA+B,CAAC,WAAW;oBAC9C,OAAO,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC;gBAChH,KAAK,+BAA+B,CAAC,YAAY,CAAC,CAAC,CAAC;oBAClD,6EAA6E;oBAC7E,IAAI,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACxH,0GAA0G;oBAC1G,qGAAqG;oBACrG,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC;oBAC5D,+GAA+G;oBAC/G,kEAAkE;oBAClE,IAAI,iBAAiB,KAAK,SAAS;wBAAE,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;oBAC5F,gHAAgH;oBAChH,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,WAAW,GAAU,WAAW,CAAC,IAAI,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,2DAA2D;YAC3D,MAAM,WAAW,GAAU,IAAI,CAAC,SAAS,CAAC;YAC1C,KAAK,WAAW,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAWD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChF,CAAC","sourcesContent":["/**\n * Legal holds — a recorded decision that suspends DELETION of a defined scope until it is released (#1634).\n *\n * ## Why it exists\n *\n * Once data is deleted on a schedule (#1613's retention-class sweep), a firm under litigation, a\n * regulator's investigation or a client dispute must be able to stop that for a defined scope, and\n * keep proof that it did. A hold is that stop. It is a decision about a CASE, which is why it is not a\n * retention class: a statutory period is a property of a class of data (#1635); a hold names a scope\n * and a ground, and ends only when somebody releases it.\n *\n * ## What a hold suspends\n *\n * Every door that destroys data consults ONE predicate before destroying anything\n * ({@link matchLegalHoldsToRows}, evaluated over the active holds the backend reads in one query):\n *\n * | door | what a held row gets |\n * |---|---|\n * | the retention-class sweep | skipped and counted, never thrown |\n * | a subject erasure | left exactly as it is (neither deleted nor scrubbed), reported per row |\n * | the tenant purge | the whole tenant is skipped while ANY hold on it is active |\n * | a DELETE / DELETE_MANY, and an `onParentDelete` cascade | refused, 409 {@link LegalHoldErrorCode.LEGAL_HOLD_ACTIVE} |\n * | file bytes in object storage | not hard-deleted while the owning row is held |\n * | RAG chunk removal | chunks of a held row are kept |\n *\n * Impersonalization counts as destruction: a scrub removes exactly what a hold exists to preserve.\n *\n * ## What it does NOT do\n *\n * It does not restrict PROCESSING (reads, updates). A hold is a preservation duty, and a row that must\n * be preserved may still be corrected; restricting processing of kept data is #1635's statutory\n * restriction, a different obligation with a different trigger.\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — deletion suspended under a recorded legal hold.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/** @wildo_source:part:start saas.models.privacy.legal-holds facet:layer:shared facet:audience:app-developer */\n/**\n * WHAT a hold covers.\n *\n * - `ORGANIZATION` — every row the tenant owns, and the tenant itself (it is not purged).\n * - `RESOURCE_ROWS` — the rows of ONE resource type in the tenant: the listed `rowIds`, or every row of\n *   that type when none are listed. An explicit id list, not a query: a hold is evidence, and \"which rows\n *   were held\" must be answerable from the hold alone, without re-running a filter against data that\n *   has since changed.\n * - `DATA_SUBJECT` — every row the subject-export graph attributes to one user. What a claim concerning\n *   ONE person needs. See {@link LegalHoldSubjectAttributionKind} for how a row is attributed.\n */\nexport enum LegalHoldScopeKind {\n  ORGANIZATION = 'organization',\n  RESOURCE_ROWS = 'resource_rows',\n  DATA_SUBJECT = 'data_subject',\n}\n\n/**\n * WHY the data is held. Travels into every refusal and erasure report, because the ground is what a\n * data subject is owed when their erasure is not completed.\n *\n * GDPR Art. 17(3)(e) (establishment, exercise or defence of legal claims) and Art. 17(3)(b) (compliance\n * with a legal obligation) are the grounds under which a hold may also block an erasure.\n * spec-cite: Regulation (EU) 2016/679, Art. 17(3)(b) and (e). Not legal advice.\n */\nexport enum LegalHoldGround {\n  /** Litigation, a dispute or a claim that is reasonably anticipated — Art. 17(3)(e). */\n  LEGAL_CLAIMS = 'legal_claims',\n  /** A regulator's or authority's investigation that requires the data to be preserved. */\n  REGULATORY_INVESTIGATION = 'regulatory_investigation',\n  /** A legal obligation to keep the data, other than a statutory retention period of a class — Art. 17(3)(b). */\n  LEGAL_OBLIGATION = 'legal_obligation',\n}\n\n/**\n * A hold's lifecycle. Two states and one direction: a released hold is kept as evidence and never\n * reactivated — a new hold is a new row. There is no expiry state, deliberately: litigation ends by\n * decision, not by clock, and a hold that lapses on its own is exactly the failure it exists to prevent.\n */\nexport enum LegalHoldStatus {\n  ACTIVE = 'active',\n  RELEASED = 'released',\n}\n\n/**\n * WHO placed the hold, and therefore who may release it.\n *\n * A hold is released by the tier that placed it, and only by that tier. A tenant must not be able to\n * lift a preservation duty the operator placed on it (an investigation OF the tenant), and the operator\n * must not lift a tenant's own litigation hold on the tenant's behalf. Both tiers SEE every hold on the\n * tenant: the tenant is owed knowing why its data is not being deleted.\n */\nexport enum LegalHoldPlacementTier {\n  /** Placed by the tenant's own owner, for its own data. */\n  ORGANIZATION = 'organization',\n  /** Placed by an application super-administrator, crossing into the tenant through the declared door. */\n  PLATFORM = 'platform',\n}\n\n/**\n * Client-branchable codes carried as `context.code` on a refusal (allow-listed by the error sanitizer).\n */\nexport enum LegalHoldErrorCode {\n  /** A row the delete addresses is under an active legal hold. The caller is authorized; the state forbids it. */\n  LEGAL_HOLD_ACTIVE = 'legal_hold_active',\n  /** The active holds could not be read, so whether the rows are held is unknown. Deletion is refused (fail closed). */\n  LEGAL_HOLD_STATE_UNVERIFIABLE = 'legal_hold_state_unverifiable',\n}\n\n/** The custom verbs. No generic CREATE / UPDATE / DELETE is exposed to any client. */\nexport enum LegalHolds_Operations {\n  PLACE = 'place',\n  RELEASE = 'release',\n}\n\n/** The largest explicit row list one `RESOURCE_ROWS` hold may name. A larger set is several holds, or the whole resource type. */\nexport const LEGAL_HOLD_MAXIMUM_ROW_IDS = 1000;\n\nexport const LegalHoldSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** The held tenant. The primary scope anchor: the tenant sees every hold on its data. */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  scopeKind: z.enum(LegalHoldScopeKind)\n    .systemEnum('LegalHoldScopeKind')\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /** `RESOURCE_ROWS` only: the held resource type. */\n  resourceType: z.string().min(1).max(200).optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** `RESOURCE_ROWS` only: the held rows. Absent means every row of {@link resourceType} in the tenant. */\n  rowIds: z.array(z.string().min(1)).max(LEGAL_HOLD_MAXIMUM_ROW_IDS).optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** `DATA_SUBJECT` only: the person whose attributed rows are held. */\n  subjectUserId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  legalGround: z.enum(LegalHoldGround)\n    .systemEnum('LegalHoldGround')\n    .isSummaryField()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /**\n   * Why, in the placer's words: the matter, the case reference. REQUIRED.\n   *\n   * Not scrubbed on erasure, and that is a decision: a hold is the operator's defence evidence\n   * (Art. 17(3)(e)), and the matter it names is what the hold preserves. Not exported to SIEM by default\n   * either — free text is the surface most likely to name a third party.\n   */\n  justification: z.string().min(1).max(2000).excludeFromUpdate().dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  placementTier: z.enum(LegalHoldPlacementTier)\n    .systemEnum('LegalHoldPlacementTier')\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  status: z.enum(LegalHoldStatus)\n    .systemEnum('LegalHoldStatus')\n    .default(LegalHoldStatus.ACTIVE)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  placedByUserId: z.string().min(1).isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  placedAt: z.date().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  releasedByUserId: z.string().min(1).optional().isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  /**\n   * The retention clock's closure field: a released hold is kept as `AUDIT_LOGS`-class evidence from this\n   * instant. Null while ACTIVE, so an active hold never expires. Server-owned — a caller-writable clock\n   * would be a caller-ordered delete of the evidence.\n   */\n  releasedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  releaseReason: z.string().max(2000).optional().excludeFromCreate().excludeFromUpdate().dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\n\nexport type LegalHold = z.infer<typeof LegalHoldSchema>;\n\n/** The `place` request. Coherence between `scopeKind` and the three optional selectors is checked server-side. */\nexport const LegalHoldPlaceRequestSchema = z.object({\n  scopeKind: z.enum(LegalHoldScopeKind).describe('What the hold covers: the whole organization, rows of one resource, or one person\\'s data.'),\n  resourceType: z.string().min(1).max(200).optional().describe('For a resource-rows hold: the resource type whose rows are held.'),\n  rowIds: z.array(z.string().min(1)).min(1).max(LEGAL_HOLD_MAXIMUM_ROW_IDS).optional()\n    .describe('For a resource-rows hold: the rows held. Omit to hold every row of the resource type in the organization.'),\n  subjectUserId: z.string().min(1).optional().describe('For a data-subject hold: the user whose data is held.'),\n  legalGround: z.enum(LegalHoldGround).describe('Why the data must be preserved.'),\n  justification: z.string().min(1).max(2000).describe('The matter or case the hold preserves data for.'),\n});\nexport type LegalHoldPlaceRequest = z.infer<typeof LegalHoldPlaceRequestSchema>;\n/** @wildo_source:part:end saas.models.privacy.legal-holds */\n\nexport const LegalHoldReleaseRequestSchema = z.object({\n  releaseReason: z.string().min(1).max(2000).describe('Why the preservation duty has ended.'),\n});\n\n/**\n * The scope-coherence rule for a `place` request, as one pure function the server and any client share.\n * Returns the problems; empty means coherent.\n */\nexport function validateLegalHoldPlaceRequest(request: LegalHoldPlaceRequest): string[] {\n  const problems: string[] = [];\n  switch (request.scopeKind) {\n    case LegalHoldScopeKind.ORGANIZATION:\n      if (request.resourceType !== undefined || request.rowIds !== undefined || request.subjectUserId !== undefined) {\n        problems.push('An organization hold covers the whole organization and takes no resourceType, rowIds or subjectUserId.');\n      }\n      break;\n    case LegalHoldScopeKind.RESOURCE_ROWS:\n      if (!request.resourceType) problems.push('A resource-rows hold names the resourceType it holds.');\n      if (request.subjectUserId !== undefined) problems.push('A resource-rows hold takes no subjectUserId.');\n      break;\n    case LegalHoldScopeKind.DATA_SUBJECT:\n      if (!request.subjectUserId) problems.push('A data-subject hold names the subjectUserId whose data it holds.');\n      if (request.resourceType !== undefined || request.rowIds !== undefined) problems.push('A data-subject hold takes no resourceType or rowIds.');\n      break;\n    default: {\n      const unknownKind: never = request.scopeKind;\n      problems.push(`Unknown legal hold scope kind '${String(unknownKind)}'.`);\n    }\n  }\n  return problems;\n}\n\n/**\n * How ONE resource type's rows are attributed to a data subject, for `DATA_SUBJECT` holds.\n *\n * Derived from the subject-export graph of `USERS` (Art. 15 access purpose), so \"the rows a hold on a\n * person covers\" and \"the rows an access request about that person discloses\" are the same set by\n * construction. Where a row cannot be attributed from its own fields, the answer is UNRESOLVABLE and the\n * row is HELD: over-preserving delays a deletion until release, under-preserving destroys evidence.\n */\nexport enum LegalHoldSubjectAttributionKind {\n  /** The row IS the person (`USERS`): attributed when its id is the subject. */\n  SUBJECT_ROW = 'subject_row',\n  /** The row carries a foreign key to `USERS` on an export edge: attributed when any of those fields names the subject. */\n  FOREIGN_KEY = 'foreign_key',\n  /**\n   * The resource is in the subject's export graph, but a row's attribution needs other rows (an owned\n   * descendant, or a key held on the `USERS` side). Any foreign-key field it carries still attributes it; beyond\n   * that, a row in the held tenant is held (conservative), a row outside any tenant is the person's only when its\n   * `userId` names them, and inside ANOTHER person's erasure it is that person's, not the held subject's.\n   */\n  UNRESOLVABLE = 'unresolvable',\n  /** Not in the subject's export graph (unrelated, or declared `exportSubject: FORBIDDEN`). A data-subject hold never covers it. */\n  NOT_ATTRIBUTED = 'not_attributed',\n}\n\nexport interface LegalHoldSubjectAttribution {\n  readonly kind: LegalHoldSubjectAttributionKind;\n  /** The row fields naming a user — the whole answer for FOREIGN_KEY, a first answer for UNRESOLVABLE. */\n  readonly foreignKeyFields?: readonly string[];\n}\n\n/** An active hold, as the predicate needs it. */\nexport type ActiveLegalHold = Pick<LegalHold, '_id' | 'organizationId' | 'scopeKind' | 'resourceType' | 'rowIds' | 'subjectUserId' | 'legalGround'>;\n\n/** One row a deletion path is about to destroy. */\nexport interface LegalHoldCandidateRow {\n  readonly id: string;\n  /** The tenant the row belongs to; absent for a row with no organization scope. */\n  readonly organizationId?: string;\n  /** The row's fields, for foreign-key attribution. */\n  readonly row?: Record<string, unknown>;\n}\n\n/** Why a row is held: the hold and its ground. */\nexport interface LegalHoldMatch {\n  readonly holdId: string;\n  readonly scopeKind: LegalHoldScopeKind;\n  readonly legalGround: LegalHoldGround;\n}\n\n/**\n * THE hold predicate — which of `rows` are under which of `holds`. Pure; the backend reads the active\n * holds once per call and hands them in.\n *\n * `erasureSubjectUserIds` is set only by a subject erasure: every row that erasure reaches in a resource\n * of the subject's export graph IS attributed to the person being erased, so a `DATA_SUBJECT` hold on that\n * person covers it whatever its own fields say.\n *\n * The ORGANIZATIONS row's tenant is its own id, so an `ORGANIZATION` hold also holds the tenant row.\n */\nexport function matchLegalHoldsToRows(input: {\n  readonly holds: readonly ActiveLegalHold[];\n  readonly resourceType: string;\n  readonly rows: readonly LegalHoldCandidateRow[];\n  readonly organizationsResourceType: string;\n  readonly subjectAttribution: LegalHoldSubjectAttribution;\n  readonly erasureSubjectUserIds?: readonly string[];\n}): Map<string, LegalHoldMatch[]> {\n  const held = new Map<string, LegalHoldMatch[]>();\n  if (input.holds.length === 0) return held;\n  for (const candidate of input.rows) {\n    const rowOrganizationId = input.resourceType === input.organizationsResourceType\n      ? candidate.id\n      : candidate.organizationId;\n    for (const hold of input.holds) {\n      if (!legalHoldCoversRow(hold, candidate, rowOrganizationId, input)) continue;\n      const matches = held.get(candidate.id) ?? [];\n      matches.push({ holdId: hold._id, scopeKind: hold.scopeKind, legalGround: hold.legalGround });\n      held.set(candidate.id, matches);\n    }\n  }\n  return held;\n}\n\nfunction legalHoldCoversRow(\n  hold: ActiveLegalHold,\n  candidate: LegalHoldCandidateRow,\n  rowOrganizationId: string | undefined,\n  input: Parameters<typeof matchLegalHoldsToRows>[0],\n): boolean {\n  switch (hold.scopeKind) {\n    case LegalHoldScopeKind.ORGANIZATION:\n      return rowOrganizationId === hold.organizationId;\n    case LegalHoldScopeKind.RESOURCE_ROWS:\n      return rowOrganizationId === hold.organizationId\n        && hold.resourceType === input.resourceType\n        && (hold.rowIds === undefined || hold.rowIds.includes(candidate.id));\n    case LegalHoldScopeKind.DATA_SUBJECT: {\n      // A person's rows outside any tenant (their user-scoped profile, preferences) are theirs wherever the\n      // claim arises, so a hold placed in one tenant covers them too. Rows of ANOTHER tenant are not this one's.\n      if (rowOrganizationId !== undefined && rowOrganizationId !== hold.organizationId) return false;\n      const subject = hold.subjectUserId;\n      if (!subject) return true; // incoherent hold: fail closed\n      const attribution = input.subjectAttribution;\n      if (attribution.kind === LegalHoldSubjectAttributionKind.NOT_ATTRIBUTED) return false;\n      if (input.erasureSubjectUserIds?.includes(subject)) return true;\n      switch (attribution.kind) {\n        case LegalHoldSubjectAttributionKind.SUBJECT_ROW:\n          return candidate.id === subject;\n        case LegalHoldSubjectAttributionKind.FOREIGN_KEY:\n          return (attribution.foreignKeyFields ?? []).some((field) => String(candidate.row?.[field] ?? '') === subject);\n        case LegalHoldSubjectAttributionKind.UNRESOLVABLE: {\n          // A foreign key on the row itself still names the person, when there is one.\n          if ((attribution.foreignKeyFields ?? []).some((field) => String(candidate.row?.[field] ?? '') === subject)) return true;\n          // Inside the erasure of SOMEONE ELSE, the walk has already attributed the row: it is the erased person's,\n          // not this subject's. Holding it would refuse their erasure on a ground belonging to another matter.\n          if (input.erasureSubjectUserIds !== undefined) return false;\n          // Outside any tenant, a row's owner is its `userId` (a USER_SELF row's primary scope), so a hold on one person\n          // never reaches every other person's rows across the application.\n          if (rowOrganizationId === undefined) return String(candidate.row?.userId ?? '') === subject;\n          // Inside the held tenant, the row's owner cannot be read from its own fields: held, the conservative direction.\n          return true;\n        }\n        default: {\n          const unknownKind: never = attribution.kind;\n          throw new Error(`Unknown legal hold subject attribution '${String(unknownKind)}'`);\n        }\n      }\n    }\n    default: {\n      // An unknown scope is not a reason to delete: fail closed.\n      const unknownKind: never = hold.scopeKind;\n      void unknownKind;\n      return true;\n    }\n  }\n}\n\n/** One row a subject erasure left untouched because a legal hold covers it (#1634). */\nexport interface SubjectErasureLegalHoldRetention {\n  resourceType: string;\n  rowId: string;\n  /** The grounds of every hold covering the row — what the data subject is told. */\n  legalGrounds: LegalHoldGround[];\n  holdIds: string[];\n}\n\n/**\n * The grounds of a set of matches, de-duplicated in vocabulary order — what a refusal or a report shows.\n */\nexport function legalHoldGroundsOf(matches: readonly LegalHoldMatch[]): LegalHoldGround[] {\n  const present = new Set(matches.map((match) => match.legalGround));\n  return Object.values(LegalHoldGround).filter((ground) => present.has(ground));\n}\n"]}

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operating-jurisdictions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBnE;AAED,eAAO,MAAM,sBAAsB,aAQ/B,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAE1D,gHAAgH;AAChH,oBAAY,2BAA2B;IACrC,+GAA+G;IAC/G,SAAS,cAAc;IACvB,iEAAiE;IACjE,IAAI,SAAS;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CASjF;AAED,uGAAuG;AACvG,eAAO,MAAM,qBAAqB,aAQ9B,CAAC;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;IAEtC,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC;;;QAhBlD,+GAA+G;;;kBAgC7G,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAK/E,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAShF"}
+{"version":3,"file":"operating-jurisdictions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBnE;AAED,eAAO,MAAM,sBAAsB,aAQ/B,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAE1D,gHAAgH;AAChH,oBAAY,2BAA2B;IACrC,+GAA+G;IAC/G,SAAS,cAAc;IACvB,iEAAiE;IACjE,IAAI,SAAS;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CASjF;AAED,uGAAuG;AACvG,eAAO,MAAM,qBAAqB,aAQ9B,CAAC;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;IAEtC,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC;;;QAhBlD,+GAA+G;;;kBAgC7G,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAK/E,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAShF"}

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,wFAAwF;MACxF,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,CACL,IAAI,IAAI,mDAAmD,IAAI,oCAAoC;cACjG,IAAI,IAAI,8FAA8F;cACtG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,gHAAgH;IAChH,oHAAoH;IACpH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHERE this application operates, as the one source every compliance surface reads (issue #229).\n *\n * ## The hole this closes\n *\n * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n *\n * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n *\n * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n *\n * Keeping them siblings means each is answerable the day it is known.\n *\n * ## Why an open slug and not an enum\n *\n * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n *\n * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n */\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n  'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n  + 'optionally with a SUBDIVISION suffix such as \"us-ca\" — lowercase, because a slug that '\n  + 'differs only by case is a second identifier for one place';\n\n/**\n * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n *\n * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n *\n * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n *\n * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n */\nfunction canonicalRegionSubtag(subtag: string): string | null {\n  const requested = `und-${subtag.toUpperCase()}`;\n  try {\n    const [canonical] = Intl.getCanonicalLocales(requested);\n    return canonical === undefined ? null : canonical.slice('und-'.length);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n *\n * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n *\n * ## A suffix under an AGGREGATE root is refused, and that is the third check\n *\n * The suffix means ONE thing — a place INSIDE the root — because that is the only thing\n * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source\n * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`\n * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the\n * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only\n * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that\n * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in\n * a landed publication variant).\n *\n * A regime is not expressible in this grammar and does not need to be: the places it covers each\n * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with\n * no second kind of suffix for a future reader to have to tell apart.\n *\n * The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that\n * already declares \"this root stands for other jurisdictions\" and already carries the review trigger\n * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a\n * hand-kept list is the thing that rots. The forward reference is safe because the table is a module\n * constant and this function is only ever called after module evaluation.\n */\nexport function jurisdictionSlugProblem(slug: string): string | null {\n  if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n    return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n  }\n  const [root, suffix] = slug.split('-');\n  const canonical = canonicalRegionSubtag(root!);\n  if (canonical === null) {\n    return `\"${root}\" is not a well-formed region code`;\n  }\n  if (canonical.toLowerCase() !== root) {\n    return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n  }\n  if (suffix !== undefined && Object.hasOwn(JURISDICTION_CONTAINMENT, root!)) {\n    return (\n      `\"${root}\" stands for the jurisdictions it contains, so \"${slug}\" would be read as a place INSIDE `\n      + `\"${root}\" — and a suffix on an aggregate names a regime, which is normally wider than the aggregate `\n      + 'rather than narrower. Name the places explicitly instead (the EEA is \"eu\", \"is\", \"li\", \"no\")'\n    );\n  }\n  return null;\n}\n\nexport const JurisdictionSlugSchema = z\n  .string()\n  .trim()\n  .superRefine((slug, context) => {\n    const problem = jurisdictionSlugProblem(slug);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem });\n    }\n  });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/**\n * The namespace every jurisdiction REFERENCE carries.\n *\n * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n */\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */\nexport enum JurisdictionRefProblemScope {\n  /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */\n  NAMESPACE = 'NAMESPACE',\n  /** The namespace is right and the slug is not a jurisdiction. */\n  SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n  readonly scope: JurisdictionRefProblemScope;\n  readonly message: string;\n}\n\n/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem | null {\n  if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n    return {\n      scope: JurisdictionRefProblemScope.NAMESPACE,\n      message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n    };\n  }\n  const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n  return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */\nexport const JurisdictionRefSchema = z\n  .string()\n  .trim()\n  .superRefine((ref, context) => {\n    const problem = jurisdictionRefProblem(ref);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem.message });\n    }\n  });\n\n/**\n * One jurisdiction this application operates in, and why it reaches the product.\n *\n * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n *\n * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n */\nexport const OperatingJurisdictionSchema = z.strictObject({\n  jurisdictionSlug: JurisdictionSlugSchema,\n  /** Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". */\n  basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/**\n * The jurisdictions this application operates in.\n *\n * ## Absent is UNDECLARED, and an empty list is not offered\n *\n * The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n */\nexport const ApplicationOperatingJurisdictionsSchema = z\n  .strictObject({\n    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n  })\n  .superRefine((declaration, context) => {\n    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n    if (duplicates.length > 0) {\n      context.addIssue({\n        code: 'custom',\n        path: ['jurisdictions'],\n        message:\n          `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n          + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n      });\n    }\n  });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/**\n * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n *\n * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n *\n * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand\n * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —\n * because a suffix can only be read as a place inside its root, and on an aggregate that reading\n * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the\n * intended consequence: the places a regime covers each have their own code.\n *\n * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n */\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  eu: Object.freeze([\n    'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n    'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n  ]),\n});\n\n/**\n * Does a source addressing `reach` answer for an application operating in `declared`?\n *\n * Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n  if (reach === declared) return true;\n  // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n  // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix\n  // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.\n  if (declared.startsWith(`${reach}-`)) return true;\n  return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n    (member) => member === declared || declared.startsWith(`${member}-`),\n  );\n}\n"]}
+{"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,wFAAwF;MACxF,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,CACL,IAAI,IAAI,mDAAmD,IAAI,oCAAoC;cACjG,IAAI,IAAI,8FAA8F;cACtG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,gHAAgH;IAChH,oHAAoH;IACpH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHERE this application operates, as the one source every compliance surface reads (issue #229).\n *\n * ## The hole this closes\n *\n * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n *\n * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n *\n * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n *\n * Keeping them siblings means each is answerable the day it is known.\n *\n * ## Why an open slug and not an enum\n *\n * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n *\n * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n */\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n  'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n  + 'optionally with a SUBDIVISION suffix such as \"us-ca\" — lowercase, because a slug that '\n  + 'differs only by case is a second identifier for one place';\n\n/**\n * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n *\n * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n *\n * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n *\n * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n */\nfunction canonicalRegionSubtag(subtag: string): string | null {\n  const requested = `und-${subtag.toUpperCase()}`;\n  try {\n    const [canonical] = Intl.getCanonicalLocales(requested);\n    return canonical === undefined ? null : canonical.slice('und-'.length);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n *\n * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n *\n * ## A suffix under an AGGREGATE root is refused, and that is the third check\n *\n * The suffix means ONE thing — a place INSIDE the root — because that is the only thing\n * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source\n * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`\n * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the\n * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only\n * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that\n * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in\n * a landed publication variant).\n *\n * A regime is not expressible in this grammar and does not need to be: the places it covers each\n * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with\n * no second kind of suffix for a future reader to have to tell apart.\n *\n * The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that\n * already declares \"this root stands for other jurisdictions\" and already carries the review trigger\n * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a\n * hand-kept list is the thing that rots. The forward reference is safe because the table is a module\n * constant and this function is only ever called after module evaluation.\n */\nexport function jurisdictionSlugProblem(slug: string): string | null {\n  if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n    return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n  }\n  const [root, suffix] = slug.split('-');\n  const canonical = canonicalRegionSubtag(root!);\n  if (canonical === null) {\n    return `\"${root}\" is not a well-formed region code`;\n  }\n  if (canonical.toLowerCase() !== root) {\n    return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n  }\n  if (suffix !== undefined && Object.hasOwn(JURISDICTION_CONTAINMENT, root!)) {\n    return (\n      `\"${root}\" stands for the jurisdictions it contains, so \"${slug}\" would be read as a place INSIDE `\n      + `\"${root}\" — and a suffix on an aggregate names a regime, which is normally wider than the aggregate `\n      + 'rather than narrower. Name the places explicitly instead (the EEA is \"eu\", \"is\", \"li\", \"no\")'\n    );\n  }\n  return null;\n}\n\nexport const JurisdictionSlugSchema = z\n  .string()\n  .trim()\n  .superRefine((slug, context) => {\n    const problem = jurisdictionSlugProblem(slug);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem });\n    }\n  });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/**\n * The namespace every jurisdiction REFERENCE carries.\n *\n * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n */\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */\nexport enum JurisdictionRefProblemScope {\n  /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */\n  NAMESPACE = 'NAMESPACE',\n  /** The namespace is right and the slug is not a jurisdiction. */\n  SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n  readonly scope: JurisdictionRefProblemScope;\n  readonly message: string;\n}\n\n/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem | null {\n  if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n    return {\n      scope: JurisdictionRefProblemScope.NAMESPACE,\n      message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n    };\n  }\n  const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n  return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */\nexport const JurisdictionRefSchema = z\n  .string()\n  .trim()\n  .superRefine((ref, context) => {\n    const problem = jurisdictionRefProblem(ref);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem.message });\n    }\n  });\n\n/**\n * One jurisdiction this application operates in, and why it reaches the product.\n *\n * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n *\n * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n */\nexport const OperatingJurisdictionSchema = z.strictObject({\n  jurisdictionSlug: JurisdictionSlugSchema,\n  /** Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". */\n  basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/**\n * The jurisdictions this application operates in.\n *\n * ## Absent is UNDECLARED, and an empty list is not offered\n *\n * The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n */\nexport const ApplicationOperatingJurisdictionsSchema = z\n  .strictObject({\n    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n  })\n  .superRefine((declaration, context) => {\n    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n    if (duplicates.length > 0) {\n      context.addIssue({\n        code: 'custom',\n        path: ['jurisdictions'],\n        message:\n          `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n          + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n      });\n    }\n  });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/**\n * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n *\n * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n *\n * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand\n * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —\n * because a suffix can only be read as a place inside its root, and on an aggregate that reading\n * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the\n * intended consequence: the places a regime covers each have their own code.\n *\n * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n */\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  eu: Object.freeze([\n    'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n    'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n  ]),\n});\n\n/**\n * Does a source addressing `reach` answer for an application operating in `declared`?\n *\n * Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n  if (reach === declared) return true;\n  // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n  // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix\n  // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.\n  if (declared.startsWith(`${reach}-`)) return true;\n  return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n    (member) => member === declared || declared.startsWith(`${member}-`),\n  );\n}\n"]}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts

@@ -311,6 +311,35 @@ export declare const ApplicationOperatorComplianceIdentitySchema: z.ZodObject<{
      * `rights-and-complaint-route` fact then answers nothing (#454).
      */
     subjectRequestIdentityVerification: z.ZodOptional<z.ZodString>;
+    /**
+     * Where the operator's OWN infrastructure hosts and processes the application's data — "France", "eu-west-3",
+     * "Germany (primary), Netherlands (backups)". At least one when declared.
+     *
+     * ## Why it is here, and why nothing else answered it
+     *
+     * Every other region in the compliance model belongs to a THIRD party: `providerComplianceChoices.<ref>.processingRegion`
+     * and the processor register's `processingRegions` say where a vendor processes. Nothing said where the application
+     * itself runs (#2238), so a creation run could only carry it as a free-text interview answer ("hosting provider and
+     * exact EU/EEA region: not yet decided"), which no derivation can read and the launch list could not name. Where the
+     * operator hosts is the first thing an international-transfer statement needs, and it is the operator's decision about
+     * its own product, so it sits with the operator's identity.
+     *
+     * Free text per region, like the processor register's `processingRegions`: a cloud region id and a country are both
+     * answers a reader can act on, and the law names neither. A hosting company that processes on the operator's behalf is
+     * ALSO a processor and belongs in the processor register; this field says where the data is, not who holds it.
+     *
+     * ## Rejected: deriving it from `remoteProvider.region`
+     *
+     * Each remote environment's `wildo.infra.remote.config.ts` may carry `remoteProvider.region` (`WildoRemoteProviderSchema`).
+     * It is not this statement and is not read as one: it is absent at creation time (no environment exists yet), it is per
+     * ENVIRONMENT where a notice states one answer for the production data, it describes the cluster and its registry rather
+     * than everywhere the data lands (managed databases, object storage, backups), and it is deployment metadata nobody
+     * reviews as a statement to a data subject. Two declarations of "where we run" can disagree; this one is the one a notice
+     * quotes, and an operator who keeps both should keep them consistent.
+     *
+     * Absent means undecided, never "hosted nowhere".
+     */
+    hostingRegions: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 export type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;
 /**
@@ -332,7 +361,9 @@ export declare enum OperatorComplianceIdentityPart {
     PRIVACY_CONTACT = "privacyContact",
     ROLE_ALLOCATIONS = "roleAllocations",
     LAWFUL_BASES = "lawfulBases",
-    SUBJECT_REQUEST_IDENTITY_VERIFICATION = "subjectRequestIdentityVerification"
+    SUBJECT_REQUEST_IDENTITY_VERIFICATION = "subjectRequestIdentityVerification",
+    /** Where the operator's own infrastructure hosts the data (#2238). Owed by every operator: an application is hosted somewhere. */
+    HOSTING_REGIONS = "hostingRegions"
 }
 /**
  * Which parts of the identity are still owed, in declaration order.

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAG3D;;;;;;;;;;GAUG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;IAGpG;;;;;OAKG;;kBAEH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;IAE1G;;;;;;;;OAQG;;;IAGH;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;;;;OASG;;IAEH;;;;;;OAMG;;kBA2BH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QA/NH,oGAAoG;;;QAGpG;;;;;WAKG;;;IAyNH;;;;;;OAMG;;QApNH,0GAA0G;;QAE1G;;;;;;;;WAQG;;;QAGH;;;WAGG;;;IAgNH;;;;;;OAMG;;QAjJH;;;;;;;;;WASG;;QAEH;;;;;;WAMG;;;IAkIH;;;;;;;;;OASG;;kBAsBH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;IAC5B,qCAAqC,uCAAuC;CAC7E;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAS3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}
+{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAG3D;;;;;;;;;;GAUG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;IAGpG;;;;;OAKG;;kBAEH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;IAE1G;;;;;;;;OAQG;;;IAGH;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;;;;OASG;;IAEH;;;;;;OAMG;;kBA2BH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QA/NH,oGAAoG;;;QAGpG;;;;;WAKG;;;IAyNH;;;;;;OAMG;;QApNH,0GAA0G;;QAE1G;;;;;;;;WAQG;;;QAGH;;;WAGG;;;IAgNH;;;;;;OAMG;;QAjJH;;;;;;;;;WASG;;QAEH;;;;;;WAMG;;;IAkIH;;;;;;;;;OASG;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;;kBAsBH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;IAC5B,qCAAqC,uCAAuC;IAC5E,kIAAkI;IAClI,eAAe,mBAAmB;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAU3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js

@@ -311,6 +311,35 @@ export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
      * `rights-and-complaint-route` fact then answers nothing (#454).
      */
     subjectRequestIdentityVerification: z.string().trim().min(1).optional(),
+    /**
+     * Where the operator's OWN infrastructure hosts and processes the application's data — "France", "eu-west-3",
+     * "Germany (primary), Netherlands (backups)". At least one when declared.
+     *
+     * ## Why it is here, and why nothing else answered it
+     *
+     * Every other region in the compliance model belongs to a THIRD party: `providerComplianceChoices.<ref>.processingRegion`
+     * and the processor register's `processingRegions` say where a vendor processes. Nothing said where the application
+     * itself runs (#2238), so a creation run could only carry it as a free-text interview answer ("hosting provider and
+     * exact EU/EEA region: not yet decided"), which no derivation can read and the launch list could not name. Where the
+     * operator hosts is the first thing an international-transfer statement needs, and it is the operator's decision about
+     * its own product, so it sits with the operator's identity.
+     *
+     * Free text per region, like the processor register's `processingRegions`: a cloud region id and a country are both
+     * answers a reader can act on, and the law names neither. A hosting company that processes on the operator's behalf is
+     * ALSO a processor and belongs in the processor register; this field says where the data is, not who holds it.
+     *
+     * ## Rejected: deriving it from `remoteProvider.region`
+     *
+     * Each remote environment's `wildo.infra.remote.config.ts` may carry `remoteProvider.region` (`WildoRemoteProviderSchema`).
+     * It is not this statement and is not read as one: it is absent at creation time (no environment exists yet), it is per
+     * ENVIRONMENT where a notice states one answer for the production data, it describes the cluster and its registry rather
+     * than everywhere the data lands (managed databases, object storage, backups), and it is deployment metadata nobody
+     * reviews as a statement to a data subject. Two declarations of "where we run" can disagree; this one is the one a notice
+     * quotes, and an operator who keeps both should keep them consistent.
+     *
+     * Absent means undecided, never "hosted nowhere".
+     */
+    hostingRegions: z.array(z.string().trim().min(1)).min(1).optional(),
 }).superRefine((identity, context) => {
     /*
      * A declaration with nothing in it is a no-op that reads as an answer.
@@ -352,6 +381,8 @@ export var OperatorComplianceIdentityPart;
     OperatorComplianceIdentityPart["ROLE_ALLOCATIONS"] = "roleAllocations";
     OperatorComplianceIdentityPart["LAWFUL_BASES"] = "lawfulBases";
     OperatorComplianceIdentityPart["SUBJECT_REQUEST_IDENTITY_VERIFICATION"] = "subjectRequestIdentityVerification";
+    /** Where the operator's own infrastructure hosts the data (#2238). Owed by every operator: an application is hosted somewhere. */
+    OperatorComplianceIdentityPart["HOSTING_REGIONS"] = "hostingRegions";
 })(OperatorComplianceIdentityPart || (OperatorComplianceIdentityPart = {}));
 /**
  * Which parts of the identity are still owed, in declaration order.
@@ -369,6 +400,7 @@ export function outstandingOperatorComplianceIdentityParts(identity) {
         identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,
         identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,
         identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,
+        identity?.hostingRegions === undefined ? OperatorComplianceIdentityPart.HOSTING_REGIONS : undefined,
     ].filter((part) => part !== undefined);
 }
 /**

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACpC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,UAAU,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,wBAAwB,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,4LAA4L;SACrQ,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACvF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACpF,gGAAgG;QAChG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,KAAK,CAAC,UAAU,+BAA+B,EAAE,CAAC,CAAC;YAC9I,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACrE;;;;;;;;;OASG;IACH,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;IAC5B,8GAA4E,CAAA;AAC9E,CAAC,EAPW,8BAA8B,KAA9B,8BAA8B,QAOzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7F,QAAQ,EAAE,kCAAkC,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS;KAC9I,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { ConsentPurpose } from './consent-purposes.shared';\nimport { LawfulBasisPurposeRefSchema } from './purpose-ref.shared.schemas';\n\n/**\n * GDPR Art. 6(1) — the six lawful bases, closed by the article.\n *\n * Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n *\n * spec-cite: GDPR Art. 6(1)(a)–(f).\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.\n */\nexport enum LawfulBasis {\n  /** Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. */\n  CONSENT = 'CONSENT',\n  /** Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. */\n  CONTRACT = 'CONTRACT',\n  /** Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. */\n  LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n  /** Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. */\n  VITAL_INTERESTS = 'VITAL_INTERESTS',\n  /** Art. 6(1)(e) — necessary for a task in the public interest or official authority. */\n  PUBLIC_TASK = 'PUBLIC_TASK',\n  /**\n   * Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n   * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n   * is refused below.\n   */\n  LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/** Whether the operator decides the purposes of a processing, carries them out for someone else, or both. */\nexport enum OperatorProcessingRole {\n  /** The operator determines the purposes and means. */\n  CONTROLLER = 'CONTROLLER',\n  /** The operator processes on a customer's documented instructions — the usual B2B posture for customer records. */\n  PROCESSOR = 'PROCESSOR',\n  /** The operator and another party jointly determine purposes and means, and must have an arrangement saying how. */\n  JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/**\n * ONE role, over ONE population of data.\n *\n * A single role field would be the wrong shape, and the produced notice said so before this existed:\n * *\"This notice therefore does not assign a single legal role to all data processed in a workspace.\"*\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n *\n * `dataScope` is prose the operator writes, deliberately: it names a POPULATION of data (\"customer records in a\n * workspace\"), not a processing purpose, so a lawful basis's `purposeRef` (#1709) is not what it would key to. No\n * structured population vocabulary exists yet, and a ref to nothing would be worse than prose.\n */\nexport const OperatorRoleAllocationSchema = z.strictObject({\n  /** Which data this role covers, in the operator's own words — \"customer records in a workspace\". */\n  dataScope: z.string().trim().min(1),\n  role: z.enum(OperatorProcessingRole),\n  /**\n   * The resource types this role covers — the TYPED half of `dataScope` (#1710), so a running erasure or export can\n   * say who owes the Art. 19 communication for the subject in front of it. Optional: an allocation in prose only is\n   * still a valid statement for a notice, and a subject whose resource type no allocation names is reported as\n   * ROLE UNDECLARED, never guessed. `dataScope` stays the words a notice uses.\n   */\n  resourceTypes: z.array(z.string().trim().min(1)).min(1).optional(),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/**\n * One processing purpose and the basis the operator relies on for it.\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.\n */\nexport const OperatorLawfulBasisSchema = z.strictObject({\n  /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */\n  purpose: z.string().trim().min(1),\n  /**\n   * A STABLE id for this purpose, which a provider's or a system of record's compliance choice names\n   * (`providerComplianceChoices.<ref>.purposeRefs`) to say which purpose sending it data serves (#1709).\n   *\n   * Separate from `purpose` because the prose is the notice's wording and changes when the operator rewords it, while\n   * a link to it must survive the rewording. OPTIONAL, like every other part of this identity (#225): a basis with no\n   * ref is still a basis, and a recipient cannot link to it — which the recipients report names as a purpose not\n   * linked, never as a recipient with no purpose.\n   */\n  purposeRef: LawfulBasisPurposeRefSchema.optional(),\n  basis: z.enum(LawfulBasis),\n  /**\n   * The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n   * that needs a balancing test — see the superRefine below.\n   */\n  assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n  /*\n   * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n   * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n   * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n   * conclusion nobody reached.\n   */\n  if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['assessmentNote'],\n      message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n    });\n  }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/**\n * What a person must agree to in order to USE the service at all (issue #139).\n *\n * ## The near-miss this exists because of\n *\n * `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n *\n * Correcting it left a real hole, which a produced notice then reported in its own words:\n * *\"There is no declared surface for recording a service-wide consent requirement distinct from\n * analytics consent.\"* This is that surface.\n *\n * ## Why the required set may be empty, and usually should be\n *\n * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A non-empty required set says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n *\n * An EMPTY set is therefore the honest answer for most applications: *nothing is gated on consent;\n * the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*\n * A field that pushed applications toward declaring consent would be worse than the gap it closes.\n *\n * ## This is the ENFORCED half of the identity (#453)\n *\n * Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is\n * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is\n * the exception. `wildo config service-consent` projects it into the running application's\n * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in\n * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,\n * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the\n * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),\n * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push\n * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an\n * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they\n * already started. Signing in, refreshing a session and signing out are not resource operations and stay\n * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count\n * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in\n * place of every signed-in route. A reader of\n * this schema must be able to tell the two apart without tracing the runtime, which is why it is said\n * here.\n *\n * ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n */\nexport const ServiceConsentRequirementSchema = z.strictObject({\n  /**\n   * The purposes a person must grant before they may use the service — a SET, never a level (#453).\n   *\n   * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a\n   * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is\n   * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.\n   *\n   * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that\n   * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.\n   */\n  requiredPurposes: z.array(z.enum(ConsentPurpose)),\n  /**\n   * What this gate actually controls, in the operator's own words.\n   *\n   * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody\n   * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n   * governs tells a person they must agree to something unnamed.\n   */\n  gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n  /*\n   * A required purpose with nothing described is the shape that satisfies the field and discloses\n   * nothing — the same defect as a revision recording no superseded rationale, and as a\n   * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n   * explanation is the half that makes it mean anything.\n   */\n  if (requirement.requiredPurposes.length > 0 && requirement.gatedProcessing === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['gatedProcessing'],\n      message: `requiring consent to ${requirement.requiredPurposes.join(', ')} gates something — say what, or declare no required purposes. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n    });\n  }\n  /*\n   * A purpose listed twice is not a stronger requirement, and a set that reads differently from how it\n   * compares is how two surfaces come to describe one gate differently.\n   */\n  if (new Set(requirement.requiredPurposes).size !== requirement.requiredPurposes.length) {\n    context.addIssue({\n      code: 'custom',\n      path: ['requiredPurposes'],\n      message: 'a required purpose is listed more than once — a set names each purpose once',\n    });\n  }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/**\n * WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n *\n * ## Why this exists, and why in configuration\n *\n * A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n *\n * That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n *\n * Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n *\n * ## What is deliberately NOT here\n *\n * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n *\n * ## Every part is independently declarable, and that is the point (issue #228)\n *\n * This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n *\n * Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n *\n * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a non-empty required purpose set still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n */\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n  /** The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. */\n  legalEntityName: z.string().trim().min(1).optional(),\n  /** Its registered address, as a reader would need it to serve a request. Absent means unanswered. */\n  registeredAddress: z.string().trim().min(1).optional(),\n  /**\n   * How a data subject reaches the operator about privacy — an address, an email, or a URL.\n   *\n   * Open string because all three are legitimate and the law names none: what matters is that a route\n   * exists and is stated, not what shape it takes.\n   */\n  privacyContact: z.string().trim().min(1).optional(),\n  /**\n   * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n   *\n   * Optional, because most operators are established where their subjects are and appointing one\n   * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n   * when declared.\n   */\n  representative: z.strictObject({\n    name: z.string().trim().min(1),\n    address: z.string().trim().min(1),\n  }).optional(),\n  /**\n   * The operator's role, per population of data. At least one.\n   *\n   * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n   */\n  roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n  /**\n   * The lawful basis relied on, per processing purpose. At least one.\n   *\n   * `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n   * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n   * complete answer.\n   */\n  lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).superRefine((bases, context) => {\n    // A purpose ref names ONE purpose, or a recipient linking to it would be linked to two (#1709).\n    const seen = new Set<string>();\n    bases.forEach((entry, index) => {\n      if (entry.purposeRef === undefined) return;\n      if (seen.has(entry.purposeRef)) {\n        context.addIssue({ code: 'custom', path: [index, 'purposeRef'], message: `purpose ref \"${entry.purposeRef}\" names more than one purpose` });\n      }\n      seen.add(entry.purposeRef);\n    });\n  }).optional(),\n  /**\n   * What a person must consent to in order to use the service at all (issue #139).\n   *\n   * OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this\n   * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while\n   * absence is nobody having been asked, and a notice must not render the second as the first.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n  /**\n   * How the operator confirms that a person exercising a data-subject right is that person, before acting.\n   *\n   * The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the\n   * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step\n   * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).\n   * Prose, because procedures differ — \"requests from a signed-in account are verified by that session;\n   * requests by email are answered at the account's address\". Absent means undecided, and the\n   * `rights-and-complaint-route` fact then answers nothing (#454).\n   */\n  subjectRequestIdentityVerification: z.string().trim().min(1).optional(),\n}).superRefine((identity, context) => {\n  /*\n   * A declaration with nothing in it is a no-op that reads as an answer.\n   *\n   * Every part is independently optional so an operator can record the half they know (#228), and the\n   * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n   * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n   * consumer already renders as outstanding, while an empty object would satisfy the field and\n   * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n   * with no assessment and a consent gate that names nothing.\n   */\n  if (Object.values(identity).every((part) => part === undefined)) {\n    context.addIssue({\n      code: 'custom',\n      path: [],\n      message:\n        'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n        + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n    });\n  }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/**\n * The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n *\n * A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n *\n * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n */\nexport enum OperatorComplianceIdentityPart {\n  LEGAL_ENTITY_NAME = 'legalEntityName',\n  REGISTERED_ADDRESS = 'registeredAddress',\n  PRIVACY_CONTACT = 'privacyContact',\n  ROLE_ALLOCATIONS = 'roleAllocations',\n  LAWFUL_BASES = 'lawfulBases',\n  SUBJECT_REQUEST_IDENTITY_VERIFICATION = 'subjectRequestIdentityVerification',\n}\n\n/**\n * Which parts of the identity are still owed, in declaration order.\n *\n * Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n */\nexport function outstandingOperatorComplianceIdentityParts(\n  identity: ApplicationOperatorComplianceIdentity | undefined,\n): readonly OperatorComplianceIdentityPart[] {\n  return [\n    identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n    identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n    identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n    identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n    identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n    identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,\n  ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/**\n * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n *\n * `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n */\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] | undefined {\n  if (identity.lawfulBases === undefined) return undefined;\n  const order = Object.values(LawfulBasis);\n  return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n    .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/**\n * True when the operator declares more than one role, so a notice must not assign a single one.\n *\n * `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean | undefined {\n  if (identity.roleAllocations === undefined) return undefined;\n  return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}
+{"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACpC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,UAAU,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,wBAAwB,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,4LAA4L;SACrQ,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACvF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACpF,gGAAgG;QAChG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,KAAK,CAAC,UAAU,+BAA+B,EAAE,CAAC,CAAC;YAC9I,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACrE;;;;;;;;;OASG;IACH,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;IAC5B,8GAA4E,CAAA;IAC5E,kIAAkI;IAClI,oEAAkC,CAAA;AACpC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7F,QAAQ,EAAE,kCAAkC,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS;QAC7I,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;KACpG,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { ConsentPurpose } from './consent-purposes.shared';\nimport { LawfulBasisPurposeRefSchema } from './purpose-ref.shared.schemas';\n\n/**\n * GDPR Art. 6(1) — the six lawful bases, closed by the article.\n *\n * Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n *\n * spec-cite: GDPR Art. 6(1)(a)–(f).\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.\n */\nexport enum LawfulBasis {\n  /** Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. */\n  CONSENT = 'CONSENT',\n  /** Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. */\n  CONTRACT = 'CONTRACT',\n  /** Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. */\n  LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n  /** Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. */\n  VITAL_INTERESTS = 'VITAL_INTERESTS',\n  /** Art. 6(1)(e) — necessary for a task in the public interest or official authority. */\n  PUBLIC_TASK = 'PUBLIC_TASK',\n  /**\n   * Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n   * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n   * is refused below.\n   */\n  LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/** Whether the operator decides the purposes of a processing, carries them out for someone else, or both. */\nexport enum OperatorProcessingRole {\n  /** The operator determines the purposes and means. */\n  CONTROLLER = 'CONTROLLER',\n  /** The operator processes on a customer's documented instructions — the usual B2B posture for customer records. */\n  PROCESSOR = 'PROCESSOR',\n  /** The operator and another party jointly determine purposes and means, and must have an arrangement saying how. */\n  JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/**\n * ONE role, over ONE population of data.\n *\n * A single role field would be the wrong shape, and the produced notice said so before this existed:\n * *\"This notice therefore does not assign a single legal role to all data processed in a workspace.\"*\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n *\n * `dataScope` is prose the operator writes, deliberately: it names a POPULATION of data (\"customer records in a\n * workspace\"), not a processing purpose, so a lawful basis's `purposeRef` (#1709) is not what it would key to. No\n * structured population vocabulary exists yet, and a ref to nothing would be worse than prose.\n */\nexport const OperatorRoleAllocationSchema = z.strictObject({\n  /** Which data this role covers, in the operator's own words — \"customer records in a workspace\". */\n  dataScope: z.string().trim().min(1),\n  role: z.enum(OperatorProcessingRole),\n  /**\n   * The resource types this role covers — the TYPED half of `dataScope` (#1710), so a running erasure or export can\n   * say who owes the Art. 19 communication for the subject in front of it. Optional: an allocation in prose only is\n   * still a valid statement for a notice, and a subject whose resource type no allocation names is reported as\n   * ROLE UNDECLARED, never guessed. `dataScope` stays the words a notice uses.\n   */\n  resourceTypes: z.array(z.string().trim().min(1)).min(1).optional(),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/**\n * One processing purpose and the basis the operator relies on for it.\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.\n */\nexport const OperatorLawfulBasisSchema = z.strictObject({\n  /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */\n  purpose: z.string().trim().min(1),\n  /**\n   * A STABLE id for this purpose, which a provider's or a system of record's compliance choice names\n   * (`providerComplianceChoices.<ref>.purposeRefs`) to say which purpose sending it data serves (#1709).\n   *\n   * Separate from `purpose` because the prose is the notice's wording and changes when the operator rewords it, while\n   * a link to it must survive the rewording. OPTIONAL, like every other part of this identity (#225): a basis with no\n   * ref is still a basis, and a recipient cannot link to it — which the recipients report names as a purpose not\n   * linked, never as a recipient with no purpose.\n   */\n  purposeRef: LawfulBasisPurposeRefSchema.optional(),\n  basis: z.enum(LawfulBasis),\n  /**\n   * The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n   * that needs a balancing test — see the superRefine below.\n   */\n  assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n  /*\n   * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n   * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n   * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n   * conclusion nobody reached.\n   */\n  if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['assessmentNote'],\n      message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n    });\n  }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/**\n * What a person must agree to in order to USE the service at all (issue #139).\n *\n * ## The near-miss this exists because of\n *\n * `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n *\n * Correcting it left a real hole, which a produced notice then reported in its own words:\n * *\"There is no declared surface for recording a service-wide consent requirement distinct from\n * analytics consent.\"* This is that surface.\n *\n * ## Why the required set may be empty, and usually should be\n *\n * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A non-empty required set says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n *\n * An EMPTY set is therefore the honest answer for most applications: *nothing is gated on consent;\n * the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*\n * A field that pushed applications toward declaring consent would be worse than the gap it closes.\n *\n * ## This is the ENFORCED half of the identity (#453)\n *\n * Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is\n * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is\n * the exception. `wildo config service-consent` projects it into the running application's\n * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in\n * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,\n * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the\n * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),\n * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push\n * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an\n * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they\n * already started. Signing in, refreshing a session and signing out are not resource operations and stay\n * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count\n * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in\n * place of every signed-in route. A reader of\n * this schema must be able to tell the two apart without tracing the runtime, which is why it is said\n * here.\n *\n * ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n */\nexport const ServiceConsentRequirementSchema = z.strictObject({\n  /**\n   * The purposes a person must grant before they may use the service — a SET, never a level (#453).\n   *\n   * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a\n   * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is\n   * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.\n   *\n   * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that\n   * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.\n   */\n  requiredPurposes: z.array(z.enum(ConsentPurpose)),\n  /**\n   * What this gate actually controls, in the operator's own words.\n   *\n   * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody\n   * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n   * governs tells a person they must agree to something unnamed.\n   */\n  gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n  /*\n   * A required purpose with nothing described is the shape that satisfies the field and discloses\n   * nothing — the same defect as a revision recording no superseded rationale, and as a\n   * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n   * explanation is the half that makes it mean anything.\n   */\n  if (requirement.requiredPurposes.length > 0 && requirement.gatedProcessing === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['gatedProcessing'],\n      message: `requiring consent to ${requirement.requiredPurposes.join(', ')} gates something — say what, or declare no required purposes. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n    });\n  }\n  /*\n   * A purpose listed twice is not a stronger requirement, and a set that reads differently from how it\n   * compares is how two surfaces come to describe one gate differently.\n   */\n  if (new Set(requirement.requiredPurposes).size !== requirement.requiredPurposes.length) {\n    context.addIssue({\n      code: 'custom',\n      path: ['requiredPurposes'],\n      message: 'a required purpose is listed more than once — a set names each purpose once',\n    });\n  }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/**\n * WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n *\n * ## Why this exists, and why in configuration\n *\n * A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n *\n * That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n *\n * Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n *\n * ## What is deliberately NOT here\n *\n * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n *\n * ## Every part is independently declarable, and that is the point (issue #228)\n *\n * This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n *\n * Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n *\n * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a non-empty required purpose set still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n */\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n  /** The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. */\n  legalEntityName: z.string().trim().min(1).optional(),\n  /** Its registered address, as a reader would need it to serve a request. Absent means unanswered. */\n  registeredAddress: z.string().trim().min(1).optional(),\n  /**\n   * How a data subject reaches the operator about privacy — an address, an email, or a URL.\n   *\n   * Open string because all three are legitimate and the law names none: what matters is that a route\n   * exists and is stated, not what shape it takes.\n   */\n  privacyContact: z.string().trim().min(1).optional(),\n  /**\n   * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n   *\n   * Optional, because most operators are established where their subjects are and appointing one\n   * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n   * when declared.\n   */\n  representative: z.strictObject({\n    name: z.string().trim().min(1),\n    address: z.string().trim().min(1),\n  }).optional(),\n  /**\n   * The operator's role, per population of data. At least one.\n   *\n   * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n   */\n  roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n  /**\n   * The lawful basis relied on, per processing purpose. At least one.\n   *\n   * `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n   * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n   * complete answer.\n   */\n  lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).superRefine((bases, context) => {\n    // A purpose ref names ONE purpose, or a recipient linking to it would be linked to two (#1709).\n    const seen = new Set<string>();\n    bases.forEach((entry, index) => {\n      if (entry.purposeRef === undefined) return;\n      if (seen.has(entry.purposeRef)) {\n        context.addIssue({ code: 'custom', path: [index, 'purposeRef'], message: `purpose ref \"${entry.purposeRef}\" names more than one purpose` });\n      }\n      seen.add(entry.purposeRef);\n    });\n  }).optional(),\n  /**\n   * What a person must consent to in order to use the service at all (issue #139).\n   *\n   * OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this\n   * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while\n   * absence is nobody having been asked, and a notice must not render the second as the first.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n  /**\n   * How the operator confirms that a person exercising a data-subject right is that person, before acting.\n   *\n   * The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the\n   * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step\n   * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).\n   * Prose, because procedures differ — \"requests from a signed-in account are verified by that session;\n   * requests by email are answered at the account's address\". Absent means undecided, and the\n   * `rights-and-complaint-route` fact then answers nothing (#454).\n   */\n  subjectRequestIdentityVerification: z.string().trim().min(1).optional(),\n  /**\n   * Where the operator's OWN infrastructure hosts and processes the application's data — \"France\", \"eu-west-3\",\n   * \"Germany (primary), Netherlands (backups)\". At least one when declared.\n   *\n   * ## Why it is here, and why nothing else answered it\n   *\n   * Every other region in the compliance model belongs to a THIRD party: `providerComplianceChoices.<ref>.processingRegion`\n   * and the processor register's `processingRegions` say where a vendor processes. Nothing said where the application\n   * itself runs (#2238), so a creation run could only carry it as a free-text interview answer (\"hosting provider and\n   * exact EU/EEA region: not yet decided\"), which no derivation can read and the launch list could not name. Where the\n   * operator hosts is the first thing an international-transfer statement needs, and it is the operator's decision about\n   * its own product, so it sits with the operator's identity.\n   *\n   * Free text per region, like the processor register's `processingRegions`: a cloud region id and a country are both\n   * answers a reader can act on, and the law names neither. A hosting company that processes on the operator's behalf is\n   * ALSO a processor and belongs in the processor register; this field says where the data is, not who holds it.\n   *\n   * ## Rejected: deriving it from `remoteProvider.region`\n   *\n   * Each remote environment's `wildo.infra.remote.config.ts` may carry `remoteProvider.region` (`WildoRemoteProviderSchema`).\n   * It is not this statement and is not read as one: it is absent at creation time (no environment exists yet), it is per\n   * ENVIRONMENT where a notice states one answer for the production data, it describes the cluster and its registry rather\n   * than everywhere the data lands (managed databases, object storage, backups), and it is deployment metadata nobody\n   * reviews as a statement to a data subject. Two declarations of \"where we run\" can disagree; this one is the one a notice\n   * quotes, and an operator who keeps both should keep them consistent.\n   *\n   * Absent means undecided, never \"hosted nowhere\".\n   */\n  hostingRegions: z.array(z.string().trim().min(1)).min(1).optional(),\n}).superRefine((identity, context) => {\n  /*\n   * A declaration with nothing in it is a no-op that reads as an answer.\n   *\n   * Every part is independently optional so an operator can record the half they know (#228), and the\n   * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n   * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n   * consumer already renders as outstanding, while an empty object would satisfy the field and\n   * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n   * with no assessment and a consent gate that names nothing.\n   */\n  if (Object.values(identity).every((part) => part === undefined)) {\n    context.addIssue({\n      code: 'custom',\n      path: [],\n      message:\n        'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n        + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n    });\n  }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/**\n * The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n *\n * A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n *\n * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n */\nexport enum OperatorComplianceIdentityPart {\n  LEGAL_ENTITY_NAME = 'legalEntityName',\n  REGISTERED_ADDRESS = 'registeredAddress',\n  PRIVACY_CONTACT = 'privacyContact',\n  ROLE_ALLOCATIONS = 'roleAllocations',\n  LAWFUL_BASES = 'lawfulBases',\n  SUBJECT_REQUEST_IDENTITY_VERIFICATION = 'subjectRequestIdentityVerification',\n  /** Where the operator's own infrastructure hosts the data (#2238). Owed by every operator: an application is hosted somewhere. */\n  HOSTING_REGIONS = 'hostingRegions',\n}\n\n/**\n * Which parts of the identity are still owed, in declaration order.\n *\n * Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n */\nexport function outstandingOperatorComplianceIdentityParts(\n  identity: ApplicationOperatorComplianceIdentity | undefined,\n): readonly OperatorComplianceIdentityPart[] {\n  return [\n    identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n    identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n    identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n    identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n    identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n    identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,\n    identity?.hostingRegions === undefined ? OperatorComplianceIdentityPart.HOSTING_REGIONS : undefined,\n  ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/**\n * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n *\n * `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n */\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] | undefined {\n  if (identity.lawfulBases === undefined) return undefined;\n  const order = Object.values(LawfulBasis);\n  return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n    .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/**\n * True when the operator declares more than one role, so a notice must not assign a single one.\n *\n * `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean | undefined {\n  if (identity.roleAllocations === undefined) return undefined;\n  return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}

package/dist/esm/compliance/privacy/personal-data-category.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}
+{"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}