@wildo-ai/saas-models 1.1.8 → 1.1.10

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACpC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,UAAU,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,wBAAwB,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,4LAA4L;SACrQ,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACvF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACpF,gGAAgG;QAChG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,KAAK,CAAC,UAAU,+BAA+B,EAAE,CAAC,CAAC;YAC9I,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACrE;;;;;;;;;OASG;IACH,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;IAC5B,8GAA4E,CAAA;AAC9E,CAAC,EAPW,8BAA8B,KAA9B,8BAA8B,QAOzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7F,QAAQ,EAAE,kCAAkC,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS;KAC9I,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { ConsentPurpose } from './consent-purposes.shared';\nimport { LawfulBasisPurposeRefSchema } from './purpose-ref.shared.schemas';\n\n/**\n * GDPR Art. 6(1) — the six lawful bases, closed by the article.\n *\n * Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n *\n * spec-cite: GDPR Art. 6(1)(a)–(f).\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.\n */\nexport enum LawfulBasis {\n  /** Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. */\n  CONSENT = 'CONSENT',\n  /** Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. */\n  CONTRACT = 'CONTRACT',\n  /** Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. */\n  LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n  /** Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. */\n  VITAL_INTERESTS = 'VITAL_INTERESTS',\n  /** Art. 6(1)(e) — necessary for a task in the public interest or official authority. */\n  PUBLIC_TASK = 'PUBLIC_TASK',\n  /**\n   * Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n   * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n   * is refused below.\n   */\n  LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/** Whether the operator decides the purposes of a processing, carries them out for someone else, or both. */\nexport enum OperatorProcessingRole {\n  /** The operator determines the purposes and means. */\n  CONTROLLER = 'CONTROLLER',\n  /** The operator processes on a customer's documented instructions — the usual B2B posture for customer records. */\n  PROCESSOR = 'PROCESSOR',\n  /** The operator and another party jointly determine purposes and means, and must have an arrangement saying how. */\n  JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/**\n * ONE role, over ONE population of data.\n *\n * A single role field would be the wrong shape, and the produced notice said so before this existed:\n * *\"This notice therefore does not assign a single legal role to all data processed in a workspace.\"*\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n *\n * `dataScope` is prose the operator writes, deliberately: it names a POPULATION of data (\"customer records in a\n * workspace\"), not a processing purpose, so a lawful basis's `purposeRef` (#1709) is not what it would key to. No\n * structured population vocabulary exists yet, and a ref to nothing would be worse than prose.\n */\nexport const OperatorRoleAllocationSchema = z.strictObject({\n  /** Which data this role covers, in the operator's own words — \"customer records in a workspace\". */\n  dataScope: z.string().trim().min(1),\n  role: z.enum(OperatorProcessingRole),\n  /**\n   * The resource types this role covers — the TYPED half of `dataScope` (#1710), so a running erasure or export can\n   * say who owes the Art. 19 communication for the subject in front of it. Optional: an allocation in prose only is\n   * still a valid statement for a notice, and a subject whose resource type no allocation names is reported as\n   * ROLE UNDECLARED, never guessed. `dataScope` stays the words a notice uses.\n   */\n  resourceTypes: z.array(z.string().trim().min(1)).min(1).optional(),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/**\n * One processing purpose and the basis the operator relies on for it.\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.\n */\nexport const OperatorLawfulBasisSchema = z.strictObject({\n  /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */\n  purpose: z.string().trim().min(1),\n  /**\n   * A STABLE id for this purpose, which a provider's or a system of record's compliance choice names\n   * (`providerComplianceChoices.<ref>.purposeRefs`) to say which purpose sending it data serves (#1709).\n   *\n   * Separate from `purpose` because the prose is the notice's wording and changes when the operator rewords it, while\n   * a link to it must survive the rewording. OPTIONAL, like every other part of this identity (#225): a basis with no\n   * ref is still a basis, and a recipient cannot link to it — which the recipients report names as a purpose not\n   * linked, never as a recipient with no purpose.\n   */\n  purposeRef: LawfulBasisPurposeRefSchema.optional(),\n  basis: z.enum(LawfulBasis),\n  /**\n   * The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n   * that needs a balancing test — see the superRefine below.\n   */\n  assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n  /*\n   * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n   * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n   * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n   * conclusion nobody reached.\n   */\n  if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['assessmentNote'],\n      message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n    });\n  }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/**\n * What a person must agree to in order to USE the service at all (issue #139).\n *\n * ## The near-miss this exists because of\n *\n * `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n *\n * Correcting it left a real hole, which a produced notice then reported in its own words:\n * *\"There is no declared surface for recording a service-wide consent requirement distinct from\n * analytics consent.\"* This is that surface.\n *\n * ## Why the required set may be empty, and usually should be\n *\n * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A non-empty required set says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n *\n * An EMPTY set is therefore the honest answer for most applications: *nothing is gated on consent;\n * the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*\n * A field that pushed applications toward declaring consent would be worse than the gap it closes.\n *\n * ## This is the ENFORCED half of the identity (#453)\n *\n * Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is\n * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is\n * the exception. `wildo config service-consent` projects it into the running application's\n * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in\n * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,\n * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the\n * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),\n * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push\n * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an\n * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they\n * already started. Signing in, refreshing a session and signing out are not resource operations and stay\n * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count\n * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in\n * place of every signed-in route. A reader of\n * this schema must be able to tell the two apart without tracing the runtime, which is why it is said\n * here.\n *\n * ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n */\nexport const ServiceConsentRequirementSchema = z.strictObject({\n  /**\n   * The purposes a person must grant before they may use the service — a SET, never a level (#453).\n   *\n   * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a\n   * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is\n   * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.\n   *\n   * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that\n   * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.\n   */\n  requiredPurposes: z.array(z.enum(ConsentPurpose)),\n  /**\n   * What this gate actually controls, in the operator's own words.\n   *\n   * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody\n   * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n   * governs tells a person they must agree to something unnamed.\n   */\n  gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n  /*\n   * A required purpose with nothing described is the shape that satisfies the field and discloses\n   * nothing — the same defect as a revision recording no superseded rationale, and as a\n   * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n   * explanation is the half that makes it mean anything.\n   */\n  if (requirement.requiredPurposes.length > 0 && requirement.gatedProcessing === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['gatedProcessing'],\n      message: `requiring consent to ${requirement.requiredPurposes.join(', ')} gates something — say what, or declare no required purposes. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n    });\n  }\n  /*\n   * A purpose listed twice is not a stronger requirement, and a set that reads differently from how it\n   * compares is how two surfaces come to describe one gate differently.\n   */\n  if (new Set(requirement.requiredPurposes).size !== requirement.requiredPurposes.length) {\n    context.addIssue({\n      code: 'custom',\n      path: ['requiredPurposes'],\n      message: 'a required purpose is listed more than once — a set names each purpose once',\n    });\n  }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/**\n * WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n *\n * ## Why this exists, and why in configuration\n *\n * A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n *\n * That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n *\n * Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n *\n * ## What is deliberately NOT here\n *\n * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n *\n * ## Every part is independently declarable, and that is the point (issue #228)\n *\n * This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n *\n * Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n *\n * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a non-empty required purpose set still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n */\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n  /** The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. */\n  legalEntityName: z.string().trim().min(1).optional(),\n  /** Its registered address, as a reader would need it to serve a request. Absent means unanswered. */\n  registeredAddress: z.string().trim().min(1).optional(),\n  /**\n   * How a data subject reaches the operator about privacy — an address, an email, or a URL.\n   *\n   * Open string because all three are legitimate and the law names none: what matters is that a route\n   * exists and is stated, not what shape it takes.\n   */\n  privacyContact: z.string().trim().min(1).optional(),\n  /**\n   * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n   *\n   * Optional, because most operators are established where their subjects are and appointing one\n   * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n   * when declared.\n   */\n  representative: z.strictObject({\n    name: z.string().trim().min(1),\n    address: z.string().trim().min(1),\n  }).optional(),\n  /**\n   * The operator's role, per population of data. At least one.\n   *\n   * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n   */\n  roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n  /**\n   * The lawful basis relied on, per processing purpose. At least one.\n   *\n   * `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n   * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n   * complete answer.\n   */\n  lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).superRefine((bases, context) => {\n    // A purpose ref names ONE purpose, or a recipient linking to it would be linked to two (#1709).\n    const seen = new Set<string>();\n    bases.forEach((entry, index) => {\n      if (entry.purposeRef === undefined) return;\n      if (seen.has(entry.purposeRef)) {\n        context.addIssue({ code: 'custom', path: [index, 'purposeRef'], message: `purpose ref \"${entry.purposeRef}\" names more than one purpose` });\n      }\n      seen.add(entry.purposeRef);\n    });\n  }).optional(),\n  /**\n   * What a person must consent to in order to use the service at all (issue #139).\n   *\n   * OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this\n   * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while\n   * absence is nobody having been asked, and a notice must not render the second as the first.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n  /**\n   * How the operator confirms that a person exercising a data-subject right is that person, before acting.\n   *\n   * The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the\n   * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step\n   * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).\n   * Prose, because procedures differ — \"requests from a signed-in account are verified by that session;\n   * requests by email are answered at the account's address\". Absent means undecided, and the\n   * `rights-and-complaint-route` fact then answers nothing (#454).\n   */\n  subjectRequestIdentityVerification: z.string().trim().min(1).optional(),\n}).superRefine((identity, context) => {\n  /*\n   * A declaration with nothing in it is a no-op that reads as an answer.\n   *\n   * Every part is independently optional so an operator can record the half they know (#228), and the\n   * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n   * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n   * consumer already renders as outstanding, while an empty object would satisfy the field and\n   * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n   * with no assessment and a consent gate that names nothing.\n   */\n  if (Object.values(identity).every((part) => part === undefined)) {\n    context.addIssue({\n      code: 'custom',\n      path: [],\n      message:\n        'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n        + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n    });\n  }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/**\n * The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n *\n * A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n *\n * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n */\nexport enum OperatorComplianceIdentityPart {\n  LEGAL_ENTITY_NAME = 'legalEntityName',\n  REGISTERED_ADDRESS = 'registeredAddress',\n  PRIVACY_CONTACT = 'privacyContact',\n  ROLE_ALLOCATIONS = 'roleAllocations',\n  LAWFUL_BASES = 'lawfulBases',\n  SUBJECT_REQUEST_IDENTITY_VERIFICATION = 'subjectRequestIdentityVerification',\n}\n\n/**\n * Which parts of the identity are still owed, in declaration order.\n *\n * Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n */\nexport function outstandingOperatorComplianceIdentityParts(\n  identity: ApplicationOperatorComplianceIdentity | undefined,\n): readonly OperatorComplianceIdentityPart[] {\n  return [\n    identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n    identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n    identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n    identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n    identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n    identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,\n  ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/**\n * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n *\n * `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n */\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] | undefined {\n  if (identity.lawfulBases === undefined) return undefined;\n  const order = Object.values(LawfulBasis);\n  return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n    .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/**\n * True when the operator declares more than one role, so a notice must not assign a single one.\n *\n * `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean | undefined {\n  if (identity.roleAllocations === undefined) return undefined;\n  return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}
+{"version":3,"file":"operator-compliance-identity.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAElF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,gGAAgG;IAChG,kCAAmB,CAAA;IACnB,iGAAiG;IACjG,oCAAqB,CAAA;IACrB,+FAA+F;IAC/F,oDAAqC,CAAA;IACrC,4FAA4F;IAC5F,kDAAmC,CAAA;IACnC,wFAAwF;IACxF,0CAA2B,CAAA;IAC3B;;;;OAIG;IACH,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,6GAA6G;AAC7G,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,sDAAsD;IACtD,mDAAyB,CAAA;IACzB,mHAAmH;IACnH,iDAAuB,CAAA;IACvB,oHAAoH;IACpH,+DAAqC,CAAA;AACvC,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACpC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,0GAA0G;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC;;;;;;;;OAQG;IACH,UAAU,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;;OAKG;IACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,oBAAoB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,YAAY,KAAK,CAAC,OAAO,iLAAiL;SACpN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACtC;;;;;OAKG;IACH,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,wBAAwB,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,4LAA4L;SACrQ,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACvF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,2HAA2H;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,qGAAqG;IACrG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACpF,gGAAgG;QAChG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO;YAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,KAAK,CAAC,UAAU,+BAA+B,EAAE,CAAC,CAAC;YAC9I,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,QAAQ,EAAE;IACb;;;;;;OAMG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACrE;;;;;;;;;OASG;IACH,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnE;;;;;;;;;;;;OAYG;IACH;;;;OAIG;IACH,yBAAyB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC5D,qFAAqF;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,gHAAgH;IAChH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9E;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC9D,CAAC,CAAC,QAAQ,EAAE;IACb;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC,QAAQ,EAAE;IACb,qHAAqH;IACrH,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7C,CAAC,CAAC,QAAQ,EAAE;IACb,0FAA0F;IAC1F,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,sIAAsI;IACtI,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,2FAA2F;IAC3F,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,CAAC,YAAY,CAAC;QAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5C,CAAC,CAAC,QAAQ,EAAE;IACb;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACnC;;;;;;;;;OASG;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,sGAAsG;kBACpG,mGAAmG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,uEAAqC,CAAA;IACrC,0EAAwC,CAAA;IACxC,oEAAkC,CAAA;IAClC,sEAAoC,CAAA;IACpC,8DAA4B,CAAA;IAC5B,8GAA4E,CAAA;IAC5E,kIAAkI;IAClI,oEAAkC,CAAA;AACpC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C,CACxD,QAA2D;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACzG,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACnG,QAAQ,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACrG,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC7F,QAAQ,EAAE,kCAAkC,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS;QAC7I,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;KACpG,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+C;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,QAA+C;IACjG,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AACzF,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { ConsentPurpose } from './consent-purposes.shared';\nimport { LawfulBasisPurposeRefSchema } from './purpose-ref.shared.schemas';\nimport { JurisdictionSlugSchema } from './operating-jurisdictions.shared.schemas';\n\n/**\n * GDPR Art. 6(1) — the six lawful bases, closed by the article.\n *\n * Enumerated individually rather than carried as prose because each carries a different obligation:\n * consent must be withdrawable, legitimate interests needs a balancing assessment, a legal obligation\n * must name the law. \"We have a lawful basis\" is not a disclosure; a notice must say WHICH.\n *\n * spec-cite: GDPR Art. 6(1)(a)–(f).\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — the closed set a processing purpose's ground is declared from.\n */\nexport enum LawfulBasis {\n  /** Art. 6(1)(a) — the subject consented to the processing for one or more specific purposes. */\n  CONSENT = 'CONSENT',\n  /** Art. 6(1)(b) — necessary to perform a contract with the subject, or pre-contractual steps. */\n  CONTRACT = 'CONTRACT',\n  /** Art. 6(1)(c) — necessary to comply with a legal obligation the controller is subject to. */\n  LEGAL_OBLIGATION = 'LEGAL_OBLIGATION',\n  /** Art. 6(1)(d) — necessary to protect vital interests of the subject or another person. */\n  VITAL_INTERESTS = 'VITAL_INTERESTS',\n  /** Art. 6(1)(e) — necessary for a task in the public interest or official authority. */\n  PUBLIC_TASK = 'PUBLIC_TASK',\n  /**\n   * Art. 6(1)(f) — necessary for legitimate interests, except where overridden by the subject's\n   * rights. The only basis requiring a balancing assessment, which is why declaring it without one\n   * is refused below.\n   */\n  LEGITIMATE_INTERESTS = 'LEGITIMATE_INTERESTS',\n}\n\n/** Whether the operator decides the purposes of a processing, carries them out for someone else, or both. */\nexport enum OperatorProcessingRole {\n  /** The operator determines the purposes and means. */\n  CONTROLLER = 'CONTROLLER',\n  /** The operator processes on a customer's documented instructions — the usual B2B posture for customer records. */\n  PROCESSOR = 'PROCESSOR',\n  /** The operator and another party jointly determine purposes and means, and must have an arrangement saying how. */\n  JOINT_CONTROLLER = 'JOINT_CONTROLLER',\n}\n\n/**\n * ONE role, over ONE population of data.\n *\n * A single role field would be the wrong shape, and the produced notice said so before this existed:\n * *\"This notice therefore does not assign a single legal role to all data processed in a workspace.\"*\n * A B2B SaaS is typically a PROCESSOR for the records its customers put in, and a CONTROLLER for the\n * account and billing data of the people who administer them — simultaneously, in one product.\n *\n * `dataScope` is prose the operator writes, deliberately: it names a POPULATION of data (\"customer records in a\n * workspace\"), not a processing purpose, so a lawful basis's `purposeRef` (#1709) is not what it would key to. No\n * structured population vocabulary exists yet, and a ref to nothing would be worse than prose.\n */\nexport const OperatorRoleAllocationSchema = z.strictObject({\n  /** Which data this role covers, in the operator's own words — \"customer records in a workspace\". */\n  dataScope: z.string().trim().min(1),\n  role: z.enum(OperatorProcessingRole),\n  /**\n   * The resource types this role covers — the TYPED half of `dataScope` (#1710), so a running erasure or export can\n   * say who owes the Art. 19 communication for the subject in front of it. Optional: an allocation in prose only is\n   * still a valid statement for a notice, and a subject whose resource type no allocation names is reported as\n   * ROLE UNDECLARED, never guessed. `dataScope` stays the words a notice uses.\n   */\n  resourceTypes: z.array(z.string().trim().min(1)).min(1).optional(),\n});\nexport type OperatorRoleAllocation = z.infer<typeof OperatorRoleAllocationSchema>;\n\n/**\n * One processing purpose and the basis the operator relies on for it.\n *\n * assurance-control: WILDO.PRIVACY.LAWFUL_BASIS — refuses a legitimate-interests basis that records no balancing assessment.\n */\nexport const OperatorLawfulBasisSchema = z.strictObject({\n  /** The purpose, in the operator's own words. Matches how the notice states purposes: prose, not a ref. */\n  purpose: z.string().trim().min(1),\n  /**\n   * A STABLE id for this purpose, which a provider's or a system of record's compliance choice names\n   * (`providerComplianceChoices.<ref>.purposeRefs`) to say which purpose sending it data serves (#1709).\n   *\n   * Separate from `purpose` because the prose is the notice's wording and changes when the operator rewords it, while\n   * a link to it must survive the rewording. OPTIONAL, like every other part of this identity (#225): a basis with no\n   * ref is still a basis, and a recipient cannot link to it — which the recipients report names as a purpose not\n   * linked, never as a recipient with no purpose.\n   */\n  purposeRef: LawfulBasisPurposeRefSchema.optional(),\n  basis: z.enum(LawfulBasis),\n  /**\n   * The assessment behind the basis. REQUIRED for `LEGITIMATE_INTERESTS`, which is the only basis\n   * that needs a balancing test — see the superRefine below.\n   */\n  assessmentNote: z.string().trim().min(1).optional(),\n}).superRefine((entry, context) => {\n  /*\n   * A legitimate-interests claim with no assessment is the shape that satisfies a field and discloses\n   * nothing — the same defect as a revision that records no superseded rationale. Art. 6(1)(f) is the\n   * only basis whose lawfulness depends on a balancing test, so a declaration without one asserts a\n   * conclusion nobody reached.\n   */\n  if (entry.basis === LawfulBasis.LEGITIMATE_INTERESTS && entry.assessmentNote === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['assessmentNote'],\n      message: `purpose \"${entry.purpose}\" relies on LEGITIMATE_INTERESTS and records no assessment — that basis is lawful only where the balancing test was actually done, so state it or choose the basis that applies`,\n    });\n  }\n});\nexport type OperatorLawfulBasis = z.infer<typeof OperatorLawfulBasisSchema>;\n\n/**\n * What a person must agree to in order to USE the service at all (issue #139).\n *\n * ## The near-miss this exists because of\n *\n * `analytics.requiresConsent` already exists and governs ANALYTICS alone. The compliance partial\n * described it as \"the minimum a person must give to use the service\" until 2026-08-30 — a much\n * larger claim about a much narrower field. A drafter following that wording would have published\n * that a person must consent to analytics in order to use the product: false, and false about the one\n * subject a reader is most likely to act on.\n *\n * Correcting it left a real hole, which a produced notice then reported in its own words:\n * *\"There is no declared surface for recording a service-wide consent requirement distinct from\n * analytics consent.\"* This is that surface.\n *\n * ## Why the required set may be empty, and usually should be\n *\n * Consent is ONE Art. 6(1) basis among six, and for most B2B SaaS the basis for core processing is\n * CONTRACT — a person uses the product because their employer signed for it, not because they\n * consented. A non-empty required set says the opposite, so declaring one is a claim about the\n * lawful basis and not merely a UI gate.\n *\n * An EMPTY set is therefore the honest answer for most applications: *nothing is gated on consent;\n * the lawful basis lives in {@link ApplicationOperatorComplianceIdentitySchema.lawfulBases}.*\n * A field that pushed applications toward declaring consent would be worse than the gap it closes.\n *\n * ## This is the ENFORCED half of the identity (#453)\n *\n * Everything else in {@link ApplicationOperatorComplianceIdentitySchema} is DECLARATION — it is\n * rendered into documents and checked for coherence, and nothing at runtime acts on it. This field is\n * the exception. `wildo config service-consent` projects it into the running application's\n * `compliance.serviceConsentRequirement`. Until the person has granted every purpose in\n * `requiredPurposes`, the backend refuses every operation they initiate — resource operations over REST,\n * MCP tools, queued operations, WebSocket rows and subscriptions, agent tool calls and retrieval, the\n * manual controllers (charts, analytics, features, flows-actors, provider operations and connections),\n * notification badge reads, reading or following an A2A task (its status, reply, artifacts and push\n * configuration), and every A2A or WebSocket conversational turn, whether started or resumed after an\n * approval — except their own context and preferences, where they grant it, and cancelling an A2A task they\n * already started. Signing in, refreshing a session and signing out are not resource operations and stay\n * open, so the person can always reach that decision. Updates the server pushes on its own (a badge count\n * changing) are not a person initiating anything and are not held back. The authenticated application shell shows the consent gate in\n * place of every signed-in route. A reader of\n * this schema must be able to tell the two apart without tracing the runtime, which is why it is said\n * here.\n *\n * ⚠️ Declaring purposes here does NOT make consent the lawful basis for anything. It states a gate.\n * The basis is declared per purpose, separately, and the two disagreeing is the shape a reviewer\n * needs to see rather than one the schema should quietly reconcile.\n */\nexport const ServiceConsentRequirementSchema = z.strictObject({\n  /**\n   * The purposes a person must grant before they may use the service — a SET, never a level (#453).\n   *\n   * EMPTY means nothing is gated on consent — the common and usually correct answer. It is a\n   * DECLARATION, not an absence: an application that declares `[]` has answered the question, which is\n   * what separates it from one whose `serviceConsentRequirement` is absent and was never asked.\n   *\n   * Replaces `requiredLevel`, which was typed on the ordered `DataProcessingConsent` and so claimed that\n   * requiring MARKETING also required ANALYTICS. A required set names exactly what it gates on.\n   */\n  requiredPurposes: z.array(z.enum(ConsentPurpose)),\n  /**\n   * What this gate actually controls, in the operator's own words.\n   *\n   * REQUIRED whenever any purpose is required, because a gate nobody can describe is a gate nobody\n   * can honour — enforced below. A notice stating \"consent is required\" without saying what it\n   * governs tells a person they must agree to something unnamed.\n   */\n  gatedProcessing: z.string().trim().min(1).optional(),\n}).superRefine((requirement, context) => {\n  /*\n   * A required purpose with nothing described is the shape that satisfies the field and discloses\n   * nothing — the same defect as a revision recording no superseded rationale, and as a\n   * legitimate-interests basis with no assessment. Each time, the value is the easy half and the\n   * explanation is the half that makes it mean anything.\n   */\n  if (requirement.requiredPurposes.length > 0 && requirement.gatedProcessing === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['gatedProcessing'],\n      message: `requiring consent to ${requirement.requiredPurposes.join(', ')} gates something — say what, or declare no required purposes. A notice stating that consent is required without naming what it governs tells a person they must agree to something unnamed`,\n    });\n  }\n  /*\n   * A purpose listed twice is not a stronger requirement, and a set that reads differently from how it\n   * compares is how two surfaces come to describe one gate differently.\n   */\n  if (new Set(requirement.requiredPurposes).size !== requirement.requiredPurposes.length) {\n    context.addIssue({\n      code: 'custom',\n      path: ['requiredPurposes'],\n      message: 'a required purpose is listed more than once — a set names each purpose once',\n    });\n  }\n});\nexport type ServiceConsentRequirement = z.infer<typeof ServiceConsentRequirementSchema>;\n\n/**\n * WHO is publishing this notice, under what legal role, on what basis — the operator's own compliance\n * identity (issue #131).\n *\n * ## Why this exists, and why in configuration\n *\n * A produced compliance document asked three questions the application had nowhere to answer:\n * who operates the service, in what role, and on what lawful basis. Measured 2026-08-30, the only\n * `legalEntityName` anywhere in the compliance model was the PROCESSOR's, from the register in issue\n * #88 — nothing described the operator.\n *\n * That is not merely an empty field. A landing REPLACES the produced document on every run, so an\n * operator who answered by editing the document lost the answer on the next regeneration:\n * `.claude/rules/one-source-of-truth.md`'s test failing in the direction that matters — delete and\n * re-run, and you lose TRUTH rather than TIME.\n *\n * Configuration rather than a governed document, and identity and basis together rather than split.\n * They are two halves of ONE clause a reader meets in the first paragraph, and separating them would\n * put those halves in two places with two lifecycles for no benefit a reader can perceive. The\n * ASSESSMENT behind a basis is reviewed work and lives in `assessmentNote`; the conclusion belongs\n * with the identity that publishes it.\n *\n * ## What is deliberately NOT here\n *\n * A DPO appointment record, a processing-activities register (Art. 30), a retention schedule\n * (`dataRetention`), a processor register (#88). This is the operator's identity and legal posture —\n * the answers a notice needs in its opening sections — not a compliance programme.\n *\n * ## Every part is independently declarable, and that is the point (issue #228)\n *\n * This schema was optional AS A WHOLE and all-or-nothing INSIDE until 2026-09-02: the entity name,\n * address, contact, role allocations and lawful bases were each required, so an operator who knew\n * the registered name but had not settled lawful bases with counsel could record NOTHING. They\n * answered by editing the produced document, and a landing REPLACES it — losing the answer on the\n * next regeneration, which is the exact failure this schema was created to end.\n *\n * Paul's decision (#225) is that filling the entity must never block, and that generation is\n * resilient to what is missing while saying plainly that the result is incomplete. So every part is\n * optional and {@link outstandingOperatorComplianceIdentityParts} names what is still owed.\n *\n * What did NOT weaken: every refinement guarding a STATED claim. A legitimate-interests basis still\n * requires its assessment, and a non-empty required purpose set still requires what it gates. Those\n * refuse an INCOHERENT answer, never an ABSENT one, and the distinction is the whole design — a\n * partial declaration is honest, a self-contradicting one is not.\n */\nexport const ApplicationOperatorComplianceIdentitySchema = z.strictObject({\n  /** The legal entity operating the service, as registered. Absent means unanswered — see the partial-filling note above. */\n  legalEntityName: z.string().trim().min(1).optional(),\n  /** Its registered address, as a reader would need it to serve a request. Absent means unanswered. */\n  registeredAddress: z.string().trim().min(1).optional(),\n  /**\n   * How a data subject reaches the operator about privacy — an address, an email, or a URL.\n   *\n   * Open string because all three are legitimate and the law names none: what matters is that a route\n   * exists and is stated, not what shape it takes.\n   */\n  privacyContact: z.string().trim().min(1).optional(),\n  /**\n   * An Art. 27 representative in the origin jurisdiction, where the operator is established outside it.\n   *\n   * Optional, because most operators are established where their subjects are and appointing one\n   * would be a fiction. Absent means \"not required\", never \"not considered\" — a notice states it only\n   * when declared.\n   */\n  representative: z.strictObject({\n    name: z.string().trim().min(1),\n    address: z.string().trim().min(1),\n  }).optional(),\n  /**\n   * The operator's role, per population of data. At least one.\n   *\n   * See {@link OperatorRoleAllocationSchema} for why this is a list rather than a field.\n   */\n  roleAllocations: z.array(OperatorRoleAllocationSchema).min(1).optional(),\n  /**\n   * The lawful basis relied on, per processing purpose. At least one.\n   *\n   * `min(1)` at the schema for the same reason the placement plan requires one decision: an identity\n   * declaring no basis at all is a refusal wearing a declaration's clothes, and it would land as a\n   * complete answer.\n   */\n  lawfulBases: z.array(OperatorLawfulBasisSchema).min(1).superRefine((bases, context) => {\n    // A purpose ref names ONE purpose, or a recipient linking to it would be linked to two (#1709).\n    const seen = new Set<string>();\n    bases.forEach((entry, index) => {\n      if (entry.purposeRef === undefined) return;\n      if (seen.has(entry.purposeRef)) {\n        context.addIssue({ code: 'custom', path: [index, 'purposeRef'], message: `purpose ref \"${entry.purposeRef}\" names more than one purpose` });\n      }\n      seen.add(entry.purposeRef);\n    });\n  }).optional(),\n  /**\n   * What a person must consent to in order to use the service at all (issue #139).\n   *\n   * OPTIONAL, and absent means UNANSWERED rather than an empty set. The distinction is the one this\n   * whole lane turns on: a declared `requiredPurposes: []` is the operator saying nothing is gated on consent, while\n   * absence is nobody having been asked, and a notice must not render the second as the first.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n  /**\n   * How the operator confirms that a person exercising a data-subject right is that person, before acting.\n   *\n   * The one part of the rights clause the law leaves to the operator: WHICH rights apply follows from the\n   * jurisdictions and the lawful bases, and the complaint route from the regime, but the verification step\n   * is a procedure the operator runs (GDPR Art. 12(6) lets a controller ask for what it reasonably needs).\n   * Prose, because procedures differ — \"requests from a signed-in account are verified by that session;\n   * requests by email are answered at the account's address\". Absent means undecided, and the\n   * `rights-and-complaint-route` fact then answers nothing (#454).\n   */\n  subjectRequestIdentityVerification: z.string().trim().min(1).optional(),\n  /**\n   * Where the operator's OWN infrastructure hosts and processes the application's data — \"France\", \"eu-west-3\",\n   * \"Germany (primary), Netherlands (backups)\". At least one when declared.\n   *\n   * ## Why it is here, and why nothing else answered it\n   *\n   * Every other region in the compliance model belongs to a THIRD party: `providerComplianceChoices.<ref>.processingRegion`\n   * and the processor register's `processingRegions` say where a vendor processes. Nothing said where the application\n   * itself runs (#2238), so a creation run could only carry it as a free-text interview answer (\"hosting provider and\n   * exact EU/EEA region: not yet decided\"), which no derivation can read and the launch list could not name. Where the\n   * operator hosts is the first thing an international-transfer statement needs, and it is the operator's decision about\n   * its own product, so it sits with the operator's identity.\n   *\n   * Free text per region, like the processor register's `processingRegions`: a cloud region id and a country are both\n   * answers a reader can act on, and the law names neither. A hosting company that processes on the operator's behalf is\n   * ALSO a processor and belongs in the processor register; this field says where the data is, not who holds it.\n   *\n   * ## Rejected: deriving it from `remoteProvider.region`\n   *\n   * Each remote environment's `wildo.infra.remote.config.ts` may carry `remoteProvider.region` (`WildoRemoteProviderSchema`).\n   * It is not this statement and is not read as one: it is absent at creation time (no environment exists yet), it is per\n   * ENVIRONMENT where a notice states one answer for the production data, it describes the cluster and its registry rather\n   * than everywhere the data lands (managed databases, object storage, backups), and it is deployment metadata nobody\n   * reviews as a statement to a data subject. Two declarations of \"where we run\" can disagree; this one is the one a notice\n   * quotes, and an operator who keeps both should keep them consistent.\n   *\n   * Absent means undecided, never \"hosted nowhere\".\n   */\n  hostingRegions: z.array(z.string().trim().min(1)).min(1).optional(),\n  /*\n   * ## The legal-notice (imprint) particulars (#2588)\n   *\n   * An information-society service provider ESTABLISHED in the EU or EEA must keep its identity \"easily, directly and\n   * permanently accessible\" (Directive 2000/31/EC Art. 5(1), transposed in every member state; the UK imposes the same\n   * particulars under SI 2002/2013 reg. 6(1), and Switzerland the core of them under UWG Art. 3 Abs. 1 Bst. s; Germany's § 5 Abs. 1 DDG\n   * adds the legal form and the person authorised to represent a legal person). Each field below answers one item of\n   * those lists, named after it, so the legal notice is a projection of declarations and never a drafted text.\n   * spec-cite: Directive 2000/31/EC Art. 2(c), Art. 5(1); § 5 Abs. 1 DDG; EEA Joint Committee Decision 091/2000; SI 2002/2013 reg. 6(1); UWG (SR 241) Art. 3 Abs. 1 Bst. s\n   *\n   * All optional, like every part above: absent means undeclared. Which are OWED is derived (`legal-notice-obligation.shared.ts` decides whether a notice is owed, `legal-notice.shared.ts` which particulars):\n   * only for an operator established where the duty applies, and the \"where applicable\" items only when they apply.\n   */\n  /**\n   * Where the operator is ESTABLISHED: the jurisdiction slug of the fixed establishment it pursues its activity from\n   * (`fr`, `de`, `us-ca`). Structured because `registeredAddress` is prose a function cannot read, and establishment,\n   * not the markets served, is what decides which country's information duty applies (§ 3 DDG, country of origin).\n   */\n  establishmentJurisdiction: JurisdictionSlugSchema.optional(),\n  /** The legal form of a legal person (`SAS`, `GmbH`, `Ltd`). § 5 Abs. 1 Nr. 1 DDG. */\n  legalForm: z.string().trim().min(1).optional(),\n  /** The persons authorised to represent a legal person (managing directors, président). § 5 Abs. 1 Nr. 1 DDG. */\n  authorizedRepresentatives: z.array(z.string().trim().min(1)).min(1).optional(),\n  /**\n   * The company's share capital, in the operator's own words (`25 000 EUR`), and the total of the cash contributions not\n   * yet paid in, when there are any. § 5 Abs. 1 Nr. 1 DDG asks for it only where the provider states its capital at all,\n   * so declare it only if you state it; absent means it is not stated.\n   */\n  shareCapital: z.strictObject({\n    amount: z.string().trim().min(1),\n    outstandingContributions: z.string().trim().min(1).optional(),\n  }).optional(),\n  /**\n   * How anyone reaches the operator rapidly and directly, including an e-mail address (Art. 5(1)(c)). Distinct from\n   * `privacyContact`, which is the route for data-subject matters and may be a form or a postal address.\n   */\n  generalContact: z.strictObject({\n    email: z.email(),\n    phone: z.string().trim().min(1).optional(),\n  }).optional(),\n  /** The trade register the operator is entered in and its number (Art. 5(1)(d)). Absent when it is not registered. */\n  tradeRegister: z.strictObject({\n    register: z.string().trim().min(1),\n    registrationNumber: z.string().trim().min(1),\n  }).optional(),\n  /** The VAT identification number, where the activity is subject to VAT (Art. 5(1)(g)). */\n  vatIdentificationNumber: z.string().trim().min(1).optional(),\n  /** Germany's economic identification number (Wirtschafts-Identifikationsnummer), where the operator has one. § 5 Abs. 1 Nr. 6 DDG. */\n  economicIdentificationNumber: z.string().trim().min(1).optional(),\n  /** The supervisory authority, where the activity needs an authorisation (Art. 5(1)(e)). */\n  supervisoryAuthority: z.string().trim().min(1).optional(),\n  /** The particulars of a regulated profession the service is provided in (Art. 5(1)(f)). */\n  regulatedProfession: z.strictObject({\n    professionalBody: z.string().trim().min(1),\n    professionalTitle: z.string().trim().min(1),\n    titleGrantedIn: z.string().trim().min(1),\n    professionalRules: z.string().trim().min(1),\n  }).optional(),\n  /**\n   * `true` while the company is being wound up (in Abwicklung or Liquidation). § 5 Abs. 1 Nr. 7 DDG requires a stock\n   * corporation, a KGaA or a GmbH in that state to say so. Only `true` is accepted: \"not in liquidation\" is the absence\n   * of this field, and a second spelling of it (`false`) would be a value that states nothing.\n   */\n  inLiquidation: z.literal(true).optional(),\n}).superRefine((identity, context) => {\n  /*\n   * A declaration with nothing in it is a no-op that reads as an answer.\n   *\n   * Every part is independently optional so an operator can record the half they know (#228), and the\n   * cost of that is a new shape the old schema could not express: `operatorComplianceIdentity: {}`.\n   * Absent and empty must not mean the same thing — absence is \"nobody was asked\", which every\n   * consumer already renders as outstanding, while an empty object would satisfy the field and\n   * disclose nothing. Same defect the file refuses twice already, for a legitimate-interests basis\n   * with no assessment and a consent gate that names nothing.\n   */\n  if (Object.values(identity).every((part) => part === undefined)) {\n    context.addIssue({\n      code: 'custom',\n      path: [],\n      message:\n        'an operator compliance identity that declares nothing is not a partial answer, it is an empty one — '\n        + 'record the part you know, or omit `operatorComplianceIdentity` entirely so it reads as unanswered',\n    });\n  }\n});\nexport type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;\n\n\n/**\n * The parts of an operator's compliance identity, so \"what is still owed\" has one named home.\n *\n * A closed vocabulary rather than free strings: every consumer that reports an incomplete identity —\n * a drafter's brief, a document's marked gap, an operator-facing check — must name the same parts by\n * the same names, or two surfaces tell an operator to fill two different things.\n *\n * `representative` and `serviceConsentRequirement` are deliberately absent from this list. Both are\n * legitimately unset on a COMPLETE identity: an operator established where its subjects are needs no\n * Art. 27 representative, and a declared absence of a consent gate is expressed by\n * `serviceConsentRequirement.requiredPurposes = []`, which is a value rather than an omission. Listing\n * them would report every correct identity as incomplete.\n */\nexport enum OperatorComplianceIdentityPart {\n  LEGAL_ENTITY_NAME = 'legalEntityName',\n  REGISTERED_ADDRESS = 'registeredAddress',\n  PRIVACY_CONTACT = 'privacyContact',\n  ROLE_ALLOCATIONS = 'roleAllocations',\n  LAWFUL_BASES = 'lawfulBases',\n  SUBJECT_REQUEST_IDENTITY_VERIFICATION = 'subjectRequestIdentityVerification',\n  /** Where the operator's own infrastructure hosts the data (#2238). Owed by every operator: an application is hosted somewhere. */\n  HOSTING_REGIONS = 'hostingRegions',\n}\n\n/**\n * Which parts of the identity are still owed, in declaration order.\n *\n * Empty means complete. An UNDECLARED identity is not this function's case — pass it and you get every\n * part back, which is correct but says less than the caller needs: \"nobody has been asked\" and \"four of\n * five parts are outstanding\" are different things to tell an operator, and the caller distinguishes\n * them by checking for the identity itself first.\n */\nexport function outstandingOperatorComplianceIdentityParts(\n  identity: ApplicationOperatorComplianceIdentity | undefined,\n): readonly OperatorComplianceIdentityPart[] {\n  return [\n    identity?.legalEntityName === undefined ? OperatorComplianceIdentityPart.LEGAL_ENTITY_NAME : undefined,\n    identity?.registeredAddress === undefined ? OperatorComplianceIdentityPart.REGISTERED_ADDRESS : undefined,\n    identity?.privacyContact === undefined ? OperatorComplianceIdentityPart.PRIVACY_CONTACT : undefined,\n    identity?.roleAllocations === undefined ? OperatorComplianceIdentityPart.ROLE_ALLOCATIONS : undefined,\n    identity?.lawfulBases === undefined ? OperatorComplianceIdentityPart.LAWFUL_BASES : undefined,\n    identity?.subjectRequestIdentityVerification === undefined ? OperatorComplianceIdentityPart.SUBJECT_REQUEST_IDENTITY_VERIFICATION : undefined,\n    identity?.hostingRegions === undefined ? OperatorComplianceIdentityPart.HOSTING_REGIONS : undefined,\n  ].filter((part): part is OperatorComplianceIdentityPart => part !== undefined);\n}\n\n/**\n * The lawful bases an operator declares, deduplicated — what a notice enumerates when it says which\n * bases the service relies on.\n *\n * `undefined` when none are declared, and NOT an empty array. A notice rendering an empty list would\n * say the service relies on no lawful basis, which is a claim nobody made and one no processing could\n * survive; the caller has to meet the absent case rather than fall into it.\n */\nexport function declaredLawfulBases(identity: ApplicationOperatorComplianceIdentity): readonly LawfulBasis[] | undefined {\n  if (identity.lawfulBases === undefined) return undefined;\n  const order = Object.values(LawfulBasis);\n  return [...new Set(identity.lawfulBases.map((entry) => entry.basis))]\n    .sort((left, right) => order.indexOf(left) - order.indexOf(right));\n}\n\n/**\n * True when the operator declares more than one role, so a notice must not assign a single one.\n *\n * `undefined` when no roles are declared — the question cannot be answered, and `false` would be read\n * as \"one role\", licensing exactly the collapse {@link OperatorRoleAllocationSchema} exists to prevent.\n */\nexport function operatorHoldsSeveralProcessingRoles(identity: ApplicationOperatorComplianceIdentity): boolean | undefined {\n  if (identity.roleAllocations === undefined) return undefined;\n  return new Set(identity.roleAllocations.map((allocation) => allocation.role)).size > 1;\n}\n"]}

package/dist/esm/compliance/privacy/personal-data-category.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}
+{"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}

package/dist/esm/compliance/privacy/personal-data-category.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"personal-data-category.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,UAAU,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,8CAA8C,EAAE,MAAM,iCAAiC,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAN,IAAY,oBA+DX;AA/DD,WAAY,oBAAoB;IAC9B,mFAAmF;IACnF,6CAAqB,CAAA;IACrB,kFAAkF;IAClF,2DAAmC,CAAA;IACnC;;;;;;OAMG;IACH,mDAA2B,CAAA;IAC3B,wFAAwF;IACxF,+CAAuB,CAAA;IACvB,mGAAmG;IACnG,uCAAe,CAAA;IACf,qFAAqF;IACrF,6CAAqB,CAAA;IACrB;;;;;;;OAOG;IACH,qDAA6B,CAAA;IAC7B,iGAAiG;IACjG,qDAA6B,CAAA;IAE7B,8FAA8F;IAC9F,8EAA8E;IAC9E,0CAA0C;IAC1C,6GAAqF,CAAA;IACrF,qCAAqC;IACrC,mGAA2E,CAAA;IAC3E,qDAAqD;IACrD,mIAA2G,CAAA;IAC3G,yCAAyC;IACzC,2GAAmF,CAAA;IACnF,+BAA+B;IAC/B,6EAAqD,CAAA;IACrD;;;;;OAKG;IACH,iFAAyD,CAAA;IACzD,yCAAyC;IACzC,2EAAmD,CAAA;IACnD,oFAAoF;IACpF,2HAAmG,CAAA;IAEnG;;;;;;OAMG;IACH,6DAAqC,CAAA;AACvC,CAAC,EA/DW,oBAAoB,KAApB,oBAAoB,QA+D/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,0BAA0B,GAA2C,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAE/G;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAsC,IAAI,GAAG,CACjG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CACnG,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAA8B;IAC1E,OAAO,yCAAyC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,MAAM,UAAU,6BAA6B,CAAC,QAA2B;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,sBASX;AATD,WAAY,sBAAsB;IAChC,8CAA8C;IAC9C,+CAAqB,CAAA;IACrB,6GAA6G;IAC7G,iEAAuC,CAAA;IACvC,gGAAgG;IAChG,yDAA+B,CAAA;IAC/B,0GAA0G;IAC1G,2EAAiD,CAAA;AACnD,CAAC,EATW,sBAAsB,KAAtB,sBAAsB,QASjC;AA0BD,MAAM,cAAc,GAAoC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAE5F;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAA0C;IACnF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACtH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qCAAqC,CAAC,UAAmB;IACvE,MAAM,KAAK,GAAG,8CAA8C,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,cAAc,GAAkC,EAAE,CAAC;IACzD,MAAM,2BAA2B,GAAkC,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE9C,KAAK,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,WAAW,GAAG,cAA8B,CAAC;QACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEhD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,0BAA0B,CAAC,QAA2C,CAAC,CAAC;YAC3F,cAAc,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YACvF,KAAK,MAAM,QAAQ,IAAI,UAAU;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QAED,IAAI,eAAe,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;YACnG,2FAA2F;YAC3F,8FAA8F;YAC9F,4EAA4E;YAC5E,cAAc,CAAC,IAAI,CAAC;gBAClB,SAAS;gBACT,KAAK,EAAE,sBAAsB,CAAC,iBAAiB;gBAC/C,UAAU,EAAE,CAAC,oBAAoB,CAAC,WAAW,CAAC;aAC/C,CAAC,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,yBAAyB,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,2BAA2B,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QAED,IAAI,wBAAwB,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACxD,2BAA2B,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC,sBAAsB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IAED,OAAO;QACL,cAAc;QACd,2BAA2B;QAC3B,UAAU,EAAE,0BAA0B,CAAC,KAAK,CAAC;KAC9C,CAAC;AACJ,CAAC","sourcesContent":["import { getDataCategories, getImpersonalizeTreatment, getPortabilityProvenance, isOtpField, isPasswordField, isWriteOnlySecretField } from '@wildo-ai/zod-decorators';\nimport { z } from 'zod';\n\nimport { resolveSubjectExportObjectShapeThroughWrappers } from './subject-export.shared.schemas';\n\n/**\n * What KIND of personal data a field holds — the vocabulary a privacy notice enumerates when it\n * answers \"which categories of personal data do you process\".\n *\n * ⚠️ NOT `Compliance_DataClassification`, and the near-miss is why this exists. That enum is a\n * four-level SENSITIVITY ladder (public / internal / confidential / restricted) applied to\n * flows-actors configuration: it answers \"how protected must this be\", not \"what kind of personal\n * data is this\". Using it as a category vocabulary produces a notice describing protection levels\n * where a reader expects data types.\n *\n * ⚠️ NOT a sensitivity, a retention class, a provenance, or a scrub treatment. A single field is\n * routinely all five at once — `CONTACT_DETAILS`, retained for 30 days, subject-provided, masked on\n * erasure. Each axis has its own declaration and they are deliberately not merged.\n *\n * **The ordinary members are coarse on purpose; the special ones are not.** Ordinary categories are\n * a framework's judgement about a useful grouping, and a granularity nobody maintains produces an\n * inventory that is precise and wrong. The special-category members are the LAW's own list, closed\n * by GDPR Art. 9(1), and they are enumerated individually because \"special category data\" alone is\n * not a disclosure — a reader is entitled to know it is health data rather than political opinion,\n * and each carries its own Art. 9(2) condition.\n *\n * @example\n * // The common case: one category, on the field that holds it.\n * email: z.email().dataCategories(PersonalDataCategory.CONTACT_DETAILS)\n * @example\n * // A field that genuinely spans two. An array never forces the author to pick a lie.\n * dietaryNotes: z.string().dataCategories([PersonalDataCategory.USER_CONTENT, PersonalDataCategory.SPECIAL_CATEGORY_HEALTH])\n *\n * @wildo_source:part:start zod.decorators.data-categories facet:layer:shared facet:family:decorator facet:kind:api facet:audience:app-developer\n */\nexport enum PersonalDataCategory {\n  /** Who the person is: name, username, display name, account identifier, avatar. */\n  IDENTITY = 'identity',\n  /** How the person is reached: email address, telephone number, postal address. */\n  CONTACT_DETAILS = 'contact-details',\n  /**\n   * What proves the person is who they claim: passwords, MFA secrets, API keys, session tokens.\n   *\n   * Rarely authored by hand — the fact producer DERIVES this category from `.isPassword()`,\n   * `.isOtp()` and `.isWriteOnlySecret()`, which are declarations the application already makes.\n   * Declare it explicitly only for a credential those markers do not cover.\n   */\n  CREDENTIALS = 'credentials',\n  /** Money: payment-method references, invoices, billing details, transaction history. */\n  FINANCIAL = 'financial',\n  /** What the person did in the product: activity records, timestamps, device and telemetry data. */\n  USAGE = 'usage',\n  /** Where the person is or was: coordinates, derived region, IP-inferred location. */\n  LOCATION = 'location',\n  /**\n   * What the person wrote or uploaded: free text, notes, attachments.\n   *\n   * ⚠️ Free text is the category that can silently contain any other one — a \"notes\" field may hold\n   * health information nobody declared. Declaring `USER_CONTENT` states what the field is FOR; it\n   * does not certify what it will contain, and no schema can. Where a free-text field is\n   * FORESEEABLY used for a special category, declare that member alongside.\n   */\n  USER_CONTENT = 'user-content',\n  /** The person's working life: employer, job title, professional relationship to the operator. */\n  PROFESSIONAL = 'professional',\n\n  // ── GDPR Art. 9(1), verbatim and closed. Processing needs an Art. 9(2) condition of its own,\n  //    over and above the Art. 6 lawful basis every other member already needs.\n  /** Art. 9(1): racial or ethnic origin. */\n  SPECIAL_CATEGORY_RACIAL_OR_ETHNIC_ORIGIN = 'special-category:racial-or-ethnic-origin',\n  /** Art. 9(1): political opinions. */\n  SPECIAL_CATEGORY_POLITICAL_OPINIONS = 'special-category:political-opinions',\n  /** Art. 9(1): religious or philosophical beliefs. */\n  SPECIAL_CATEGORY_RELIGIOUS_OR_PHILOSOPHICAL_BELIEFS = 'special-category:religious-or-philosophical-beliefs',\n  /** Art. 9(1): trade union membership. */\n  SPECIAL_CATEGORY_TRADE_UNION_MEMBERSHIP = 'special-category:trade-union-membership',\n  /** Art. 9(1): genetic data. */\n  SPECIAL_CATEGORY_GENETIC = 'special-category:genetic',\n  /**\n   * Art. 9(1): biometric data processed FOR THE PURPOSE OF uniquely identifying a natural person.\n   *\n   * The purpose qualifier is part of the law's definition, not a footnote: a photograph is ordinary\n   * `IDENTITY` data until it is put through facial recognition, at which point it becomes this.\n   */\n  SPECIAL_CATEGORY_BIOMETRIC = 'special-category:biometric',\n  /** Art. 9(1): data concerning health. */\n  SPECIAL_CATEGORY_HEALTH = 'special-category:health',\n  /** Art. 9(1): data concerning a natural person's sex life or sexual orientation. */\n  SPECIAL_CATEGORY_SEX_LIFE_OR_SEXUAL_ORIENTATION = 'special-category:sex-life-or-sexual-orientation',\n\n  /**\n   * GDPR Art. 10: criminal convictions and offences.\n   *\n   * Deliberately NOT a member of {@link SPECIAL_CATEGORY_PERSONAL_DATA_CATEGORIES}. Art. 10 is a\n   * separate article with a different condition — processing requires official authority or a\n   * Member State law — so folding it into the Art. 9 set would attach the wrong legal test to it.\n   */\n  CRIMINAL_OFFENCE = 'criminal-offence',\n}\n\n/**\n * What the ENGINE deliberately does NOT declare, so its silence reads as a decision.\n *\n * Measured 2026-08-30: 48 of the 85 engine resource configurations declare at least one category. The rest are silent on\n * purpose, in four groups:\n *\n * - **System machinery is not personal data, even when the row carries a `userId`.** A queue\n *   execution, an entitlement limit, an unread counter, a token-budget counter — each exists so the\n *   platform can do its work, and the person's identifier on it is the LINK, not the datum. This\n *   group is the one that is easiest to get wrong, because such rows legitimately appear in a\n *   subject export: `systemAccessPolicy.exportSubject` means *rows here relate to a subject and\n *   belong in their bundle*, which is true by linkage alone. It does not mean the row holds a datum\n *   about them, and reading it that way once put `jobExecutions` in this inventory.\n *\n * - **A legal person is not a data subject.** `organizations`, `organizationUnits`,\n *   `organizationProfiles`, `organizationPreferences` and their siblings describe a COMPANY. GDPR\n *   Recital 14 excludes the processing of data concerning legal persons, so declaring\n *   `CONTACT_DETAILS` on an organization's switchboard number would make every notice claim the\n *   operator holds an individual's contact details that it does not. A small company's number is\n *   often a person's — that is a fact about the customer's data, not about this field's meaning.\n * - **Configuration is not data about anyone.** SSO/SCIM/webhook configuration, API keys and OAuth\n *   clients owned by an organization, products, prices, promotions, ETL cursors. An organization's\n *   API key is a bearer secret whose subject is the organization; the person who minted it is not\n *   recorded on the row.\n * - **A foreign key is LINKAGE, not a category.** `userId` on a usage row is what makes that usage\n *   personal; the category of the row's CONTENT is what a notice enumerates. Declaring `IDENTITY`\n *   on every owner FK would put \"identity data\" against resources holding no name, and tell a\n *   reader nothing the linkage does not already imply. The machinery group above is this same rule\n *   applied one level up, at the row rather than the field.\n *\n * The line between the first group and a real answer is not always obvious, and one pair is worth\n * keeping side by side: a metered USAGE RECORD is declared while a TOKEN-BUDGET counter is not.\n * Both count something a person consumed. The usage record is a per-event history with a timestamp —\n * a record of what they did, which an Art. 15 copy must contain. The budget counter is a single\n * mutable number that exists so a limiter can refuse the next call; nothing about the person\n * survives in it. Ask what the row is FOR, not what it counts.\n *\n * Recorded here because absence is invisible. A future reader finding `organizationProfiles`\n * undeclared should be able to see that it was considered, not assume it was missed — the same\n * discipline a justified `N/A` serves in a verification matrix.\n */\n\n/** Zod form of {@link PersonalDataCategory}. */\nexport const PersonalDataCategorySchema: z.ZodEnum<typeof PersonalDataCategory> = z.enum(PersonalDataCategory);\n\n/**\n * The GDPR Art. 9(1) members, as a set — the one place the Art. 9 line is drawn.\n *\n * Derived by PREFIX rather than hand-listed: every Art. 9 member's wire value begins\n * `special-category:`, so a member added to the enum joins this set automatically. A hand-written\n * list would be a second enumeration of a closed vocabulary, and the failure mode is silent — a new\n * Art. 9 member omitted from it reads as ordinary personal data.\n */\nexport const SPECIAL_CATEGORY_PERSONAL_DATA_CATEGORIES: ReadonlySet<PersonalDataCategory> = new Set(\n  Object.values(PersonalDataCategory).filter((category) => category.startsWith('special-category:')),\n);\n\n/**\n * Does this category carry the GDPR Art. 9 condition?\n *\n * `false` for {@link PersonalDataCategory.CRIMINAL_OFFENCE} — see that member's note. Callers that\n * need \"needs a condition beyond Art. 6\" must test both.\n */\nexport function isSpecialCategoryPersonalData(category: PersonalDataCategory): boolean {\n  return SPECIAL_CATEGORY_PERSONAL_DATA_CATEGORIES.has(category);\n}\n/** @wildo_source:part:end zod.decorators.data-categories */\n\n/** Every declared value that is not a {@link PersonalDataCategory} member. */\nexport function unknownPersonalDataCategories(declared: readonly string[]): readonly string[] {\n  const members = new Set<string>(Object.values(PersonalDataCategory));\n  return declared.filter((value) => !members.has(value));\n}\n\n/**\n * Why the fact producer believes a field holds personal data, when the field itself declares no\n * category. Each basis is a declaration the application ALREADY made for another purpose — never an\n * inference from the field's name.\n */\nexport enum PersonalDataFieldBasis {\n  /** The field declares a category outright. */\n  DECLARED = 'declared',\n  /** `.isPassword()` / `.isOtp()` / `.isWriteOnlySecret()` — a credential by the application's own marking. */\n  CREDENTIAL_MARKER = 'credential-marker',\n  /** `.impersonalizeWith()` — the application declared this value must be scrubbed on erasure. */\n  ERASURE_SCRUB = 'erasure-scrub',\n  /** `.portabilityProvenance()` — the application declared where this value about the subject came from. */\n  PORTABILITY_PROVENANCE = 'portability-provenance',\n}\n\n/** One field's category answer within a resource. */\nexport interface PersonalDataFieldCategories {\n  readonly fieldName: string;\n  readonly basis: PersonalDataFieldBasis;\n  /** Empty exactly when `basis` is not `DECLARED` and no category could be derived. */\n  readonly categories: readonly PersonalDataCategory[];\n}\n\n/** What one resource's main schema says about the categories of personal data it holds. */\nexport interface ResourcePersonalDataCategoryProfile {\n  /** Fields carrying an explicit `.dataCategories()` declaration. */\n  readonly declaredFields: readonly PersonalDataFieldCategories[];\n  /**\n   * Fields the application has ALREADY declared to be personal — through a credential marker, an\n   * erasure scrub treatment, or a portability provenance — that carry no category.\n   *\n   * This is the actionable gap: the omission is provably an omission rather than a judgement that\n   * the field is not personal, because the application said it was personal by another door.\n   */\n  readonly uncategorizedPersonalFields: readonly PersonalDataFieldCategories[];\n  /** The union of every category the resource declares, derived credentials included. */\n  readonly categories: readonly PersonalDataCategory[];\n}\n\nconst CATEGORY_ORDER: readonly PersonalDataCategory[] = Object.values(PersonalDataCategory);\n\n/**\n * Dedupe and order categories by the enum's own declaration order.\n *\n * Exported because every consumer that unions categories — across fields, across resources, across\n * an application — needs the same order, and a document that reorders its own category list between\n * runs reads as if the answer changed. One authority for the order, rather than each caller sorting\n * alphabetically (which would interleave the Art. 9 members through the ordinary ones) or by first\n * appearance (which depends on resource iteration order).\n */\nexport function sortPersonalDataCategories(categories: Iterable<PersonalDataCategory>): readonly PersonalDataCategory[] {\n  return [...new Set(categories)].sort((left, right) => CATEGORY_ORDER.indexOf(left) - CATEGORY_ORDER.indexOf(right));\n}\n\n/**\n * Read a resource's declared data categories off its main schema, and report the fields the\n * application has already admitted are personal but has not categorized.\n *\n * **TOP-LEVEL fields only**, which is a real limit and is stated rather than hidden: the walk uses\n * the same shape resolver the subject-export compiler uses, and that resolver merges union options\n * without descending into a nested `ZodObject`. A category declared on `billingContact.email` is\n * therefore invisible here — exactly as an `.impersonalizeWith()` declared there is invisible to\n * the scrub writer, which is why the retention guard makes a nested treatment a BOOT ERROR. A\n * nested category is not a boot error (it breaks nothing at runtime); it simply does not reach a\n * notice, so declare categories at the top level.\n *\n * **Derivation is from DECLARATIONS, never from names.** `CREDENTIALS` is inferred from\n * `.isPassword()` / `.isOtp()` / `.isWriteOnlySecret()` because those are markers the author wrote.\n * Nothing here looks at a field being called `email`, `phone` or `dateOfBirth` — a category list\n * assembled by pattern-matching identifiers is a guess presented as an inventory, and whatever the\n * guess misses is simply not disclosed.\n */\nexport function resolveResourcePersonalDataCategories(mainSchema: unknown): ResourcePersonalDataCategoryProfile {\n  const shape = resolveSubjectExportObjectShapeThroughWrappers(mainSchema);\n  const declaredFields: PersonalDataFieldCategories[] = [];\n  const uncategorizedPersonalFields: PersonalDataFieldCategories[] = [];\n  const union = new Set<PersonalDataCategory>();\n\n  for (const [fieldName, rawFieldSchema] of Object.entries(shape ?? {})) {\n    const fieldSchema = rawFieldSchema as z.ZodTypeAny;\n    const declared = getDataCategories(fieldSchema);\n\n    if (declared !== undefined && declared.length > 0) {\n      const categories = sortPersonalDataCategories(declared as readonly PersonalDataCategory[]);\n      declaredFields.push({ fieldName, basis: PersonalDataFieldBasis.DECLARED, categories });\n      for (const category of categories) union.add(category);\n      continue;\n    }\n\n    if (isPasswordField(fieldSchema) || isOtpField(fieldSchema) || isWriteOnlySecretField(fieldSchema)) {\n      // Derived, not guessed: the author marked this a credential. It is reported as a DECLARED-\n      // equivalent answer rather than a gap, because asking for `.dataCategories(CREDENTIALS)` on a\n      // field already marked `.isPassword()` is a second declaration of one fact.\n      declaredFields.push({\n        fieldName,\n        basis: PersonalDataFieldBasis.CREDENTIAL_MARKER,\n        categories: [PersonalDataCategory.CREDENTIALS],\n      });\n      union.add(PersonalDataCategory.CREDENTIALS);\n      continue;\n    }\n\n    if (getImpersonalizeTreatment(fieldSchema) !== undefined) {\n      uncategorizedPersonalFields.push({ fieldName, basis: PersonalDataFieldBasis.ERASURE_SCRUB, categories: [] });\n      continue;\n    }\n\n    if (getPortabilityProvenance(fieldSchema) !== undefined) {\n      uncategorizedPersonalFields.push({ fieldName, basis: PersonalDataFieldBasis.PORTABILITY_PROVENANCE, categories: [] });\n    }\n  }\n\n  return {\n    declaredFields,\n    uncategorizedPersonalFields,\n    categories: sortPersonalDataCategories(union),\n  };\n}\n"]}
+{"version":3,"file":"personal-data-category.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,UAAU,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,8CAA8C,EAAE,MAAM,iCAAiC,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAN,IAAY,oBA+DX;AA/DD,WAAY,oBAAoB;IAC9B,mFAAmF;IACnF,6CAAqB,CAAA;IACrB,kFAAkF;IAClF,2DAAmC,CAAA;IACnC;;;;;;OAMG;IACH,mDAA2B,CAAA;IAC3B,wFAAwF;IACxF,+CAAuB,CAAA;IACvB,mGAAmG;IACnG,uCAAe,CAAA;IACf,qFAAqF;IACrF,6CAAqB,CAAA;IACrB;;;;;;;OAOG;IACH,qDAA6B,CAAA;IAC7B,iGAAiG;IACjG,qDAA6B,CAAA;IAE7B,8FAA8F;IAC9F,8EAA8E;IAC9E,0CAA0C;IAC1C,6GAAqF,CAAA;IACrF,qCAAqC;IACrC,mGAA2E,CAAA;IAC3E,qDAAqD;IACrD,mIAA2G,CAAA;IAC3G,yCAAyC;IACzC,2GAAmF,CAAA;IACnF,+BAA+B;IAC/B,6EAAqD,CAAA;IACrD;;;;;OAKG;IACH,iFAAyD,CAAA;IACzD,yCAAyC;IACzC,2EAAmD,CAAA;IACnD,oFAAoF;IACpF,2HAAmG,CAAA;IAEnG;;;;;;OAMG;IACH,6DAAqC,CAAA;AACvC,CAAC,EA/DW,oBAAoB,KAApB,oBAAoB,QA+D/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,0BAA0B,GAA2C,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAE/G;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAsC,IAAI,GAAG,CACjG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CACnG,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAA8B;IAC1E,OAAO,yCAAyC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,MAAM,UAAU,6BAA6B,CAAC,QAA2B;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,sBASX;AATD,WAAY,sBAAsB;IAChC,8CAA8C;IAC9C,+CAAqB,CAAA;IACrB,6GAA6G;IAC7G,iEAAuC,CAAA;IACvC,gGAAgG;IAChG,yDAA+B,CAAA;IAC/B,0GAA0G;IAC1G,2EAAiD,CAAA;AACnD,CAAC,EATW,sBAAsB,KAAtB,sBAAsB,QASjC;AA0BD,MAAM,cAAc,GAAoC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAE5F;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAA0C;IACnF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACtH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qCAAqC,CAAC,UAAmB;IACvE,MAAM,KAAK,GAAG,8CAA8C,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,cAAc,GAAkC,EAAE,CAAC;IACzD,MAAM,2BAA2B,GAAkC,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE9C,KAAK,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,WAAW,GAAG,cAA8B,CAAC;QACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEhD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,UAAU,GAAG,0BAA0B,CAAC,QAA2C,CAAC,CAAC;YAC3F,cAAc,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YACvF,KAAK,MAAM,QAAQ,IAAI,UAAU;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QAED,IAAI,eAAe,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;YACnG,2FAA2F;YAC3F,8FAA8F;YAC9F,4EAA4E;YAC5E,cAAc,CAAC,IAAI,CAAC;gBAClB,SAAS;gBACT,KAAK,EAAE,sBAAsB,CAAC,iBAAiB;gBAC/C,UAAU,EAAE,CAAC,oBAAoB,CAAC,WAAW,CAAC;aAC/C,CAAC,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,yBAAyB,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,2BAA2B,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7G,SAAS;QACX,CAAC;QAED,IAAI,wBAAwB,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACxD,2BAA2B,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC,sBAAsB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IAED,OAAO;QACL,cAAc;QACd,2BAA2B;QAC3B,UAAU,EAAE,0BAA0B,CAAC,KAAK,CAAC;KAC9C,CAAC;AACJ,CAAC","sourcesContent":["import { getDataCategories, getImpersonalizeTreatment, getPortabilityProvenance, isOtpField, isPasswordField, isWriteOnlySecretField } from '@wildo-ai/zod-decorators';\nimport { z } from 'zod';\n\nimport { resolveSubjectExportObjectShapeThroughWrappers } from './subject-export.shared.schemas';\n\n/**\n * What KIND of personal data a field holds — the vocabulary a privacy notice enumerates when it\n * answers \"which categories of personal data do you process\".\n *\n * ⚠️ NOT `Compliance_DataClassification`, and the near-miss is why this exists. That enum is a\n * four-level SENSITIVITY ladder (public / internal / confidential / restricted) applied to\n * flows-actors configuration: it answers \"how protected must this be\", not \"what kind of personal\n * data is this\". Using it as a category vocabulary produces a notice describing protection levels\n * where a reader expects data types.\n *\n * ⚠️ NOT a sensitivity, a retention class, a provenance, or a scrub treatment. A single field is\n * routinely all five at once — `CONTACT_DETAILS`, retained for 30 days, subject-provided, masked on\n * erasure. Each axis has its own declaration and they are deliberately not merged.\n *\n * **The ordinary members are coarse on purpose; the special ones are not.** Ordinary categories are\n * a framework's judgement about a useful grouping, and a granularity nobody maintains produces an\n * inventory that is precise and wrong. The special-category members are the LAW's own list, closed\n * by GDPR Art. 9(1), and they are enumerated individually because \"special category data\" alone is\n * not a disclosure — a reader is entitled to know it is health data rather than political opinion,\n * and each carries its own Art. 9(2) condition.\n *\n * @example\n * // The common case: one category, on the field that holds it.\n * email: z.email().dataCategories(PersonalDataCategory.CONTACT_DETAILS)\n * @example\n * // A field that genuinely spans two. An array never forces the author to pick a lie.\n * dietaryNotes: z.string().dataCategories([PersonalDataCategory.USER_CONTENT, PersonalDataCategory.SPECIAL_CATEGORY_HEALTH])\n *\n * @wildo_source:part:start zod.decorators.data-categories facet:layer:shared facet:family:decorator facet:kind:api facet:audience:app-developer\n */\nexport enum PersonalDataCategory {\n  /** Who the person is: name, username, display name, account identifier, avatar. */\n  IDENTITY = 'identity',\n  /** How the person is reached: email address, telephone number, postal address. */\n  CONTACT_DETAILS = 'contact-details',\n  /**\n   * What proves the person is who they claim: passwords, MFA secrets, API keys, session tokens.\n   *\n   * Rarely authored by hand — the fact producer DERIVES this category from `.isPassword()`,\n   * `.isOtp()` and `.isWriteOnlySecret()`, which are declarations the application already makes.\n   * Declare it explicitly only for a credential those markers do not cover.\n   */\n  CREDENTIALS = 'credentials',\n  /** Money: payment-method references, invoices, billing details, transaction history. */\n  FINANCIAL = 'financial',\n  /** What the person did in the product: activity records, timestamps, device and telemetry data. */\n  USAGE = 'usage',\n  /** Where the person is or was: coordinates, derived region, IP-inferred location. */\n  LOCATION = 'location',\n  /**\n   * What the person wrote or uploaded: free text, notes, attachments.\n   *\n   * ⚠️ Free text is the category that can silently contain any other one — a \"notes\" field may hold\n   * health information nobody declared. Declaring `USER_CONTENT` states what the field is FOR; it\n   * does not certify what it will contain, and no schema can. Where a free-text field is\n   * FORESEEABLY used for a special category, declare that member alongside.\n   */\n  USER_CONTENT = 'user-content',\n  /** The person's working life: employer, job title, professional relationship to the operator. */\n  PROFESSIONAL = 'professional',\n\n  // ── GDPR Art. 9(1), verbatim and closed. Processing needs an Art. 9(2) condition of its own,\n  //    over and above the Art. 6 lawful basis every other member already needs.\n  /** Art. 9(1): racial or ethnic origin. */\n  SPECIAL_CATEGORY_RACIAL_OR_ETHNIC_ORIGIN = 'special-category:racial-or-ethnic-origin',\n  /** Art. 9(1): political opinions. */\n  SPECIAL_CATEGORY_POLITICAL_OPINIONS = 'special-category:political-opinions',\n  /** Art. 9(1): religious or philosophical beliefs. */\n  SPECIAL_CATEGORY_RELIGIOUS_OR_PHILOSOPHICAL_BELIEFS = 'special-category:religious-or-philosophical-beliefs',\n  /** Art. 9(1): trade union membership. */\n  SPECIAL_CATEGORY_TRADE_UNION_MEMBERSHIP = 'special-category:trade-union-membership',\n  /** Art. 9(1): genetic data. */\n  SPECIAL_CATEGORY_GENETIC = 'special-category:genetic',\n  /**\n   * Art. 9(1): biometric data processed FOR THE PURPOSE OF uniquely identifying a natural person.\n   *\n   * The purpose qualifier is part of the law's definition, not a footnote: a photograph is ordinary\n   * `IDENTITY` data until it is put through facial recognition, at which point it becomes this.\n   */\n  SPECIAL_CATEGORY_BIOMETRIC = 'special-category:biometric',\n  /** Art. 9(1): data concerning health. */\n  SPECIAL_CATEGORY_HEALTH = 'special-category:health',\n  /** Art. 9(1): data concerning a natural person's sex life or sexual orientation. */\n  SPECIAL_CATEGORY_SEX_LIFE_OR_SEXUAL_ORIENTATION = 'special-category:sex-life-or-sexual-orientation',\n\n  /**\n   * GDPR Art. 10: criminal convictions and offences.\n   *\n   * Deliberately NOT a member of {@link SPECIAL_CATEGORY_PERSONAL_DATA_CATEGORIES}. Art. 10 is a\n   * separate article with a different condition — processing requires official authority or a\n   * Member State law — so folding it into the Art. 9 set would attach the wrong legal test to it.\n   */\n  CRIMINAL_OFFENCE = 'criminal-offence',\n}\n\n/**\n * What the ENGINE deliberately does NOT declare, so its silence reads as a decision.\n *\n * Measured 2026-08-30: 48 of the 85 engine resource configurations declare at least one category. The rest are silent on\n * purpose, in four groups:\n *\n * - **System machinery is not personal data, even when the row carries a `userId`.** A queue\n *   execution, an entitlement limit, an unread counter, a token-budget counter — each exists so the\n *   platform can do its work, and the person's identifier on it is the LINK, not the datum. This\n *   group is the one that is easiest to get wrong, because such rows legitimately appear in a\n *   subject export: `systemAccessPolicy.exportSubject` means *rows here relate to a subject and\n *   belong in their bundle*, which is true by linkage alone. It does not mean the row holds a datum\n *   about them, and reading it that way once put `jobExecutions` in this inventory.\n *\n * - **A legal person is not a data subject.** `organizations`, `organizationUnits`,\n *   `organizationProfiles`, `organizationPreferences` and their siblings describe a COMPANY. GDPR\n *   Recital 14 excludes the processing of data concerning legal persons, so declaring\n *   `CONTACT_DETAILS` on an organization's switchboard number would make every notice claim the\n *   operator holds an individual's contact details that it does not. A small company's number is\n *   often a person's — that is a fact about the customer's data, not about this field's meaning.\n * - **Configuration is not data about anyone.** SSO/SCIM/webhook configuration, API keys and OAuth\n *   clients owned by an organization, products, prices, promotions, ETL cursors. An organization's\n *   API key is a bearer secret whose subject is the organization; the person who minted it is not\n *   recorded on the row.\n * - **A foreign key is LINKAGE, not a category.** `userId` on a usage row is what makes that usage\n *   personal; the category of the row's CONTENT is what a notice enumerates. Declaring `IDENTITY`\n *   on every owner FK would put \"identity data\" against resources holding no name, and tell a\n *   reader nothing the linkage does not already imply. The machinery group above is this same rule\n *   applied one level up, at the row rather than the field.\n *\n * The line between the first group and a real answer is not always obvious, and one pair is worth\n * keeping side by side: a metered USAGE RECORD is declared while a TOKEN-BUDGET counter is not.\n * Both count something a person consumed. The usage record is a per-event history with a timestamp —\n * a record of what they did, which an Art. 15 copy must contain. The budget counter is a single\n * mutable number that exists so a limiter can refuse the next call; nothing about the person\n * survives in it. Ask what the row is FOR, not what it counts.\n *\n * Recorded here because absence is invisible. A future reader finding `organizationProfiles`\n * undeclared should be able to see that it was considered, not assume it was missed — the same\n * discipline a justified `N/A` serves in a verification matrix.\n */\n\n/** Zod form of {@link PersonalDataCategory}. */\nexport const PersonalDataCategorySchema: z.ZodEnum<typeof PersonalDataCategory> = z.enum(PersonalDataCategory);\n\n/**\n * The GDPR Art. 9(1) members, as a set — the one place the Art. 9 line is drawn.\n *\n * Derived by PREFIX rather than hand-listed: every Art. 9 member's wire value begins\n * `special-category:`, so a member added to the enum joins this set automatically. A hand-written\n * list would be a second enumeration of a closed vocabulary, and the failure mode is silent — a new\n * Art. 9 member omitted from it reads as ordinary personal data.\n */\nexport const SPECIAL_CATEGORY_PERSONAL_DATA_CATEGORIES: ReadonlySet<PersonalDataCategory> = new Set(\n  Object.values(PersonalDataCategory).filter((category) => category.startsWith('special-category:')),\n);\n\n/**\n * Does this category carry the GDPR Art. 9 condition?\n *\n * `false` for {@link PersonalDataCategory.CRIMINAL_OFFENCE} — see that member's note. Callers that\n * need \"needs a condition beyond Art. 6\" must test both.\n */\nexport function isSpecialCategoryPersonalData(category: PersonalDataCategory): boolean {\n  return SPECIAL_CATEGORY_PERSONAL_DATA_CATEGORIES.has(category);\n}\n/** @wildo_source:part:end zod.decorators.data-categories */\n\n/** Every declared value that is not a {@link PersonalDataCategory} member. */\nexport function unknownPersonalDataCategories(declared: readonly string[]): readonly string[] {\n  const members = new Set<string>(Object.values(PersonalDataCategory));\n  return declared.filter((value) => !members.has(value));\n}\n\n/**\n * Why the fact producer believes a field holds personal data, when the field itself declares no\n * category. Each basis is a declaration the application ALREADY made for another purpose — never an\n * inference from the field's name.\n */\nexport enum PersonalDataFieldBasis {\n  /** The field declares a category outright. */\n  DECLARED = 'declared',\n  /** `.isPassword()` / `.isOtp()` / `.isWriteOnlySecret()` — a credential by the application's own marking. */\n  CREDENTIAL_MARKER = 'credential-marker',\n  /** `.impersonalizeWith()` — the application declared this value must be scrubbed on erasure. */\n  ERASURE_SCRUB = 'erasure-scrub',\n  /** `.portabilityProvenance()` — the application declared where this value about the subject came from. */\n  PORTABILITY_PROVENANCE = 'portability-provenance',\n}\n\n/** One field's category answer within a resource. */\nexport interface PersonalDataFieldCategories {\n  readonly fieldName: string;\n  readonly basis: PersonalDataFieldBasis;\n  /** Empty exactly when `basis` is not `DECLARED` and no category could be derived. */\n  readonly categories: readonly PersonalDataCategory[];\n}\n\n/** What one resource's main schema says about the categories of personal data it holds. */\nexport interface ResourcePersonalDataCategoryProfile {\n  /** Fields carrying an explicit `.dataCategories()` declaration. */\n  readonly declaredFields: readonly PersonalDataFieldCategories[];\n  /**\n   * Fields the application has ALREADY declared to be personal — through a credential marker, an\n   * erasure scrub treatment, or a portability provenance — that carry no category.\n   *\n   * This is the actionable gap: the omission is provably an omission rather than a judgement that\n   * the field is not personal, because the application said it was personal by another door.\n   */\n  readonly uncategorizedPersonalFields: readonly PersonalDataFieldCategories[];\n  /** The union of every category the resource declares, derived credentials included. */\n  readonly categories: readonly PersonalDataCategory[];\n}\n\nconst CATEGORY_ORDER: readonly PersonalDataCategory[] = Object.values(PersonalDataCategory);\n\n/**\n * Dedupe and order categories by the enum's own declaration order.\n *\n * Exported because every consumer that unions categories — across fields, across resources, across\n * an application — needs the same order, and a document that reorders its own category list between\n * runs reads as if the answer changed. One authority for the order, rather than each caller sorting\n * alphabetically (which would interleave the Art. 9 members through the ordinary ones) or by first\n * appearance (which depends on resource iteration order).\n */\nexport function sortPersonalDataCategories(categories: Iterable<PersonalDataCategory>): readonly PersonalDataCategory[] {\n  return [...new Set(categories)].sort((left, right) => CATEGORY_ORDER.indexOf(left) - CATEGORY_ORDER.indexOf(right));\n}\n\n/**\n * Read a resource's declared data categories off its main schema, and report the fields the\n * application has already admitted are personal but has not categorized.\n *\n * **TOP-LEVEL fields only**, which is a real limit and is stated rather than hidden: the walk uses\n * the same shape resolver the subject-export compiler uses, and that resolver merges union options\n * without descending into a nested `ZodObject`. A category declared on `billingContact.email` is\n * therefore invisible here — exactly as an `.impersonalizeWith()` declared there is invisible to\n * the scrub writer, which is why the retention guard makes a nested treatment a BOOT ERROR. A\n * nested category is not a boot error (it breaks nothing at runtime); it simply does not reach a\n * notice, so declare categories at the top level.\n *\n * **Derivation is from DECLARATIONS, never from names.** `CREDENTIALS` is inferred from\n * `.isPassword()` / `.isOtp()` / `.isWriteOnlySecret()` because those are markers the author wrote.\n * Nothing here looks at a field being called `email`, `phone` or `dateOfBirth` — a category list\n * assembled by pattern-matching identifiers is a guess presented as an inventory, and whatever the\n * guess misses is simply not disclosed.\n */\nexport function resolveResourcePersonalDataCategories(mainSchema: unknown): ResourcePersonalDataCategoryProfile {\n  const shape = resolveSubjectExportObjectShapeThroughWrappers(mainSchema);\n  const declaredFields: PersonalDataFieldCategories[] = [];\n  const uncategorizedPersonalFields: PersonalDataFieldCategories[] = [];\n  const union = new Set<PersonalDataCategory>();\n\n  for (const [fieldName, rawFieldSchema] of Object.entries(shape ?? {})) {\n    const fieldSchema = rawFieldSchema as z.ZodTypeAny;\n    const declared = getDataCategories(fieldSchema);\n\n    if (declared !== undefined && declared.length > 0) {\n      const categories = sortPersonalDataCategories(declared as readonly PersonalDataCategory[]);\n      declaredFields.push({ fieldName, basis: PersonalDataFieldBasis.DECLARED, categories });\n      for (const category of categories) union.add(category);\n      continue;\n    }\n\n    if (isPasswordField(fieldSchema) || isOtpField(fieldSchema) || isWriteOnlySecretField(fieldSchema)) {\n      // Derived, not guessed: the author marked this a credential. It is reported as a DECLARED-\n      // equivalent answer rather than a gap, because asking for `.dataCategories(CREDENTIALS)` on a\n      // field already marked `.isPassword()` is a second declaration of one fact.\n      declaredFields.push({\n        fieldName,\n        basis: PersonalDataFieldBasis.CREDENTIAL_MARKER,\n        categories: [PersonalDataCategory.CREDENTIALS],\n      });\n      union.add(PersonalDataCategory.CREDENTIALS);\n      continue;\n    }\n\n    if (getImpersonalizeTreatment(fieldSchema) !== undefined) {\n      uncategorizedPersonalFields.push({ fieldName, basis: PersonalDataFieldBasis.ERASURE_SCRUB, categories: [] });\n      continue;\n    }\n\n    if (getPortabilityProvenance(fieldSchema) !== undefined) {\n      uncategorizedPersonalFields.push({ fieldName, basis: PersonalDataFieldBasis.PORTABILITY_PROVENANCE, categories: [] });\n    }\n  }\n\n  return {\n    declaredFields,\n    uncategorizedPersonalFields,\n    categories: sortPersonalDataCategories(union),\n  };\n}\n"]}

package/dist/esm/compliance/privacy/personal-data-declaration.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}
+{"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}

package/dist/esm/compliance/privacy/personal-data-declaration.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"personal-data-declaration.shared.utils.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qCAAqC,EAAE,MAAM,yCAAyC,CAAC;AAmDhG,6GAA6G;AAC7G,MAAM,UAAU,uCAAuC,CAAC,aAA6C;IACnG,IAAI,aAAa,CAAC,eAAe,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,aAAa,CAAC,iBAAiB,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,aAAa,CAAC,kBAAkB,EAAE,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,qCAAqC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/F,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wDAAwD,CAAC,MAGxE;IACC,MAAM,UAAU,GAAqC,EAAE,CAAC;IAExD,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,wBAAwB,EAAE,CAAC;QAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,aAAa,KAAK,SAAS;YAAE,SAAS;QAC1C,IAAI,uCAAuC,CAAC,aAAa,CAAC;YAAE,SAAS;QAErE,MAAM,KAAK,GAAI,aAAa,CAAC,UAA8D,EAAE,KAAK,CAAC;QACnG,UAAU,CAAC,IAAI,CAAC;YACd,YAAY;YACZ,UAAU,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,gCAAgC,CAAC,aAA6C;IAC5F,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import type { ResourceDataSubjectPolicy, ResourceRetentionPolicy, ResourceSystemAccessPolicy } from '../../resources/resources-config.shared.schemas';\nimport { resolveResourcePersonalDataCategories } from './personal-data-category.shared.schemas';\n\n/**\n * Has this resource said ANYTHING about whether its rows are about people?\n *\n * ## The decision behind this, and what it is deliberately NOT\n *\n * Issue #93 asked whether a resource holding personal data should be REQUIRED to declare it, and the\n * evidence for requiring it was strong: measured across two applications, a declaration gets made if\n * and only if the framework refuses to start without it. `exportSubject` is fail-closed at\n * registration and was declared on 10 of 12 resources; `retentionPolicy` and `.impersonalizeWith()`\n * are not enforced and were declared on 1 and 0.\n *\n * **Paul decided against refusing.** A hard constraint on every application author, for every\n * resource, forever, is too strict — and the framework's own directive says the system must work\n * first, with protection arriving later as a judge-style guard rather than as a refusal wired into\n * the mechanism (`.claude/rules/application-creation-directive.md`).\n *\n * So this is a REPORT, and the report exists to be read by a human at startup. It never refuses, it\n * never throws, and nothing downstream branches on it. The other half of the decision — the half\n * that actually produces declarations — is the framework knowledge that teaches an author to write\n * one while they are authoring the resource, which is where a declaration is cheap.\n *\n * ## What counts as having answered\n *\n * ANY of four declarations, because they are four different questions and answering any one of them\n * means the author considered the subject:\n *\n * | declaration | the question it answers |\n * |---|---|\n * | `retentionPolicy.mode` | does an erasure keep this row, and are its fields scrubbed? |\n * | `dataSubjectPolicy.kind` | whose session does erasing this row end? |\n * | `systemAccessPolicy.exportSubject` | do these rows belong in a subject's export bundle? |\n * | a field carrying `.dataCategories()` | what KIND of personal data is held? |\n *\n * A resource declaring NONE of them has never been asked, and that is the only state this reports.\n * It is emphatically NOT a claim that the resource holds personal data — most resources do not, and\n * the report says \"unanswered\", never \"undeclared personal data\".\n *\n * ⚠️ `RETAIN_ONLY` counts as an ANSWER, and that is the point of admitting `retentionPolicy` at all:\n * its documented meaning is \"this resource holds no personal data of its own\", enforced by the\n * factory, which refuses a scrub treatment beside it. A resource that says so has answered the\n * question in the negative, deliberately, and must never appear in a gap list.\n */\nexport interface PersonalDataDeclarationSubject {\n  readonly retentionPolicy?: ResourceRetentionPolicy;\n  readonly dataSubjectPolicy?: ResourceDataSubjectPolicy;\n  readonly systemAccessPolicy?: ResourceSystemAccessPolicy;\n  readonly mainSchema?: unknown;\n}\n\n/** True when the resource declares at least one of the four — see {@link PersonalDataDeclarationSubject}. */\nexport function resourceAnsweredThePersonalDataQuestion(configuration: PersonalDataDeclarationSubject): boolean {\n  if (configuration.retentionPolicy?.mode !== undefined) return true;\n  if (configuration.dataSubjectPolicy?.kind !== undefined) return true;\n  if (configuration.systemAccessPolicy?.exportSubject !== undefined) return true;\n  return resolveResourcePersonalDataCategories(configuration.mainSchema).categories.length > 0;\n}\n\n/** One resource that has said nothing, with the size of what it holds so a reader can triage. */\nexport interface UnansweredPersonalDataResource {\n  readonly resourceType: string;\n  /** Top-level field count, purely to help a reader judge which to look at first. */\n  readonly fieldCount: number;\n}\n\n/**\n * The APPLICATION's own resources that have said nothing about personal data.\n *\n * `applicationResourceTypes` is supplied by the caller rather than derived here, and that is the\n * whole reason this takes two arguments. The engine's ~85 resources declare their own posture and an\n * app author cannot change them, so including them would put 26 permanent entries in front of every\n * reader of a report about THEIR application — which is how a diagnostic channel stops being read.\n * The backend registry already separates the two at composition time, so the split is made once,\n * where the app and core factory maps are actually distinguishable, rather than re-derived here from\n * a key set that would then be a second enumeration of the same population.\n */\nexport function collectApplicationResourcesWithNoPersonalDataDeclaration(params: {\n  readonly resourceConfigurations: Readonly<Record<string, PersonalDataDeclarationSubject>>;\n  readonly applicationResourceTypes: readonly string[];\n}): readonly UnansweredPersonalDataResource[] {\n  const unanswered: UnansweredPersonalDataResource[] = [];\n\n  for (const resourceType of params.applicationResourceTypes) {\n    const configuration = params.resourceConfigurations[resourceType];\n    if (configuration === undefined) continue;\n    if (resourceAnsweredThePersonalDataQuestion(configuration)) continue;\n\n    const shape = (configuration.mainSchema as { shape?: Record<string, unknown> } | undefined)?.shape;\n    unanswered.push({\n      resourceType,\n      fieldCount: shape === undefined ? 0 : Object.keys(shape).length,\n    });\n  }\n\n  return unanswered;\n}\n\n/** Narrow a materialized configuration to the fields this report reads. Structural, so any shape carrying them satisfies it. */\nexport function asPersonalDataDeclarationSubject(configuration: PersonalDataDeclarationSubject): PersonalDataDeclarationSubject {\n  return configuration;\n}\n"]}
+{"version":3,"file":"personal-data-declaration.shared.utils.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qCAAqC,EAAE,MAAM,yCAAyC,CAAC;AAmDhG,6GAA6G;AAC7G,MAAM,UAAU,uCAAuC,CAAC,aAA6C;IACnG,IAAI,aAAa,CAAC,eAAe,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,aAAa,CAAC,iBAAiB,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,aAAa,CAAC,kBAAkB,EAAE,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,qCAAqC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/F,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wDAAwD,CAAC,MAGxE;IACC,MAAM,UAAU,GAAqC,EAAE,CAAC;IAExD,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,wBAAwB,EAAE,CAAC;QAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,aAAa,KAAK,SAAS;YAAE,SAAS;QAC1C,IAAI,uCAAuC,CAAC,aAAa,CAAC;YAAE,SAAS;QAErE,MAAM,KAAK,GAAI,aAAa,CAAC,UAA8D,EAAE,KAAK,CAAC;QACnG,UAAU,CAAC,IAAI,CAAC;YACd,YAAY;YACZ,UAAU,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;SAChE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,gCAAgC,CAAC,aAA6C;IAC5F,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import type { ResourceDataSubjectPolicy, ResourceRetentionPolicy, ResourceSystemAccessPolicy } from '../../resources/resources-config.shared.schemas';\nimport { resolveResourcePersonalDataCategories } from './personal-data-category.shared.schemas';\n\n/**\n * Has this resource said ANYTHING about whether its rows are about people?\n *\n * ## The decision behind this, and what it is deliberately NOT\n *\n * Issue #93 asked whether a resource holding personal data should be REQUIRED to declare it, and the\n * evidence for requiring it was strong: measured across two applications, a declaration gets made if\n * and only if the framework refuses to start without it. `exportSubject` is fail-closed at\n * registration and was declared on 10 of 12 resources; `retentionPolicy` and `.impersonalizeWith()`\n * are not enforced and were declared on 1 and 0.\n *\n * **Paul decided against refusing.** A hard constraint on every application author, for every\n * resource, forever, is too strict — and the framework's own directive says the system must work\n * first, with protection arriving later as a judge-style guard rather than as a refusal wired into\n * the mechanism (`.claude/rules/application-creation-directive.md`).\n *\n * So this is a REPORT, and the report exists to be read by a human at startup. It never refuses, it\n * never throws, and nothing downstream branches on it. The other half of the decision — the half\n * that actually produces declarations — is the framework knowledge that teaches an author to write\n * one while they are authoring the resource, which is where a declaration is cheap.\n *\n * ## What counts as having answered\n *\n * ANY of four declarations, because they are four different questions and answering any one of them\n * means the author considered the subject:\n *\n * | declaration | the question it answers |\n * |---|---|\n * | `retentionPolicy.mode` | does an erasure keep this row, and are its fields scrubbed? |\n * | `dataSubjectPolicy.kind` | whose session does erasing this row end? |\n * | `systemAccessPolicy.exportSubject` | do these rows belong in a subject's export bundle? |\n * | a field carrying `.dataCategories()` | what KIND of personal data is held? |\n *\n * A resource declaring NONE of them has never been asked, and that is the only state this reports.\n * It is emphatically NOT a claim that the resource holds personal data — most resources do not, and\n * the report says \"unanswered\", never \"undeclared personal data\".\n *\n * ⚠️ `RETAIN_ONLY` counts as an ANSWER, and that is the point of admitting `retentionPolicy` at all:\n * its documented meaning is \"this resource holds no personal data of its own\", enforced by the\n * factory, which refuses a scrub treatment beside it. A resource that says so has answered the\n * question in the negative, deliberately, and must never appear in a gap list.\n */\nexport interface PersonalDataDeclarationSubject {\n  readonly retentionPolicy?: ResourceRetentionPolicy;\n  readonly dataSubjectPolicy?: ResourceDataSubjectPolicy;\n  readonly systemAccessPolicy?: ResourceSystemAccessPolicy;\n  readonly mainSchema?: unknown;\n}\n\n/** True when the resource declares at least one of the four — see {@link PersonalDataDeclarationSubject}. */\nexport function resourceAnsweredThePersonalDataQuestion(configuration: PersonalDataDeclarationSubject): boolean {\n  if (configuration.retentionPolicy?.mode !== undefined) return true;\n  if (configuration.dataSubjectPolicy?.kind !== undefined) return true;\n  if (configuration.systemAccessPolicy?.exportSubject !== undefined) return true;\n  return resolveResourcePersonalDataCategories(configuration.mainSchema).categories.length > 0;\n}\n\n/** One resource that has said nothing, with the size of what it holds so a reader can triage. */\nexport interface UnansweredPersonalDataResource {\n  readonly resourceType: string;\n  /** Top-level field count, purely to help a reader judge which to look at first. */\n  readonly fieldCount: number;\n}\n\n/**\n * The APPLICATION's own resources that have said nothing about personal data.\n *\n * `applicationResourceTypes` is supplied by the caller rather than derived here, and that is the\n * whole reason this takes two arguments. The engine's ~85 resources declare their own posture and an\n * app author cannot change them, so including them would put 26 permanent entries in front of every\n * reader of a report about THEIR application — which is how a diagnostic channel stops being read.\n * The backend registry already separates the two at composition time, so the split is made once,\n * where the app and core factory maps are actually distinguishable, rather than re-derived here from\n * a key set that would then be a second enumeration of the same population.\n */\nexport function collectApplicationResourcesWithNoPersonalDataDeclaration(params: {\n  readonly resourceConfigurations: Readonly<Record<string, PersonalDataDeclarationSubject>>;\n  readonly applicationResourceTypes: readonly string[];\n}): readonly UnansweredPersonalDataResource[] {\n  const unanswered: UnansweredPersonalDataResource[] = [];\n\n  for (const resourceType of params.applicationResourceTypes) {\n    const configuration = params.resourceConfigurations[resourceType];\n    if (configuration === undefined) continue;\n    if (resourceAnsweredThePersonalDataQuestion(configuration)) continue;\n\n    const shape = (configuration.mainSchema as { shape?: Record<string, unknown> } | undefined)?.shape;\n    unanswered.push({\n      resourceType,\n      fieldCount: shape === undefined ? 0 : Object.keys(shape).length,\n    });\n  }\n\n  return unanswered;\n}\n\n/** Narrow a materialized configuration to the fields this report reads. Structural, so any shape carrying them satisfies it. */\nexport function asPersonalDataDeclarationSubject(configuration: PersonalDataDeclarationSubject): PersonalDataDeclarationSubject {\n  return configuration;\n}\n"]}

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AAoED,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AAoED,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACzH,QAAQ,CACP,yBAAyB,OAAO,qJAAqJ,CACtL,CAAC;AAEJ,MAAM,qBAAqB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACnE,QAAQ,CACP,QAAQ,OAAO,oIAAoI,CACpJ,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACvH,QAAQ,CACP,2CAA2C,OAAO,sGAAsG,CACzJ,CAAC;AAEJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,iBAAiB,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;IACnE,eAAe,EAAE,oBAAoB,CAAC,wBAAwB,CAAC;IAC/D,gBAAgB,EAAE,qBAAqB,CAAC,wBAAwB,CAAC;CAClE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,iBAAiB,EAAE,sBAAsB,CAAC,WAAW,CAAC;IACtD,gBAAgB,EAAE,qBAAqB,CAAC,WAAW,CAAC;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,sGAAsG;IACtG,EAAE;IACF,sGAAsG;IACtG,qGAAqG;IACrG,wFAAwF;IACxF,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,oGAAoG;IACpG,4FAA4F;IAC5F,iBAAiB,EAAE,sBAAsB,CAAC,aAAa,CAAC;SACrD,eAAe,EAAE;IACpB,gBAAgB,EAAE,qBAAqB,CAAC,aAAa,CAAC;CACvD,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport \"@wildo-ai/zod-decorators\";\n\nimport { ConsentPurpose } from \"./consent-purposes.shared\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\n/**\n * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n *\n * Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n *\n * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n *\n * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\n/**\n * The purposes a person has granted, and whether they have decided at all — the two facts every\n * consent surface reads (#534).\n *\n * `consentedPurposes` defaults to the EMPTY set, and that default is the point. It used to be\n * `.default(DataProcessingConsent.BASIC)`: every record asserted a consent its subject never gave.\n * The empty set asserts nothing.\n *\n * `consentDecidedAt` is what separates \"declined everything\" from \"was never asked\" — the two are the\n * same empty set and must not be the same fact. Absent means undecided, so a consent surface asks; set\n * means the person made an affirmative choice at that instant, whatever they chose.\n */\n/*\n * `.systemEnum('ConsentPurpose')` names the ONE vocabulary a purpose is worded by, everywhere it is stored —\n * a person's preferences, an anonymous visitor, a lead — and on the application consent gate that asks for\n * it. A purpose is a legal statement to the person deciding, so it gets one wording, authored once under\n * `system_enums.ConsentPurpose.<value>`; the labelling planner plans it there and the frontend reads it\n * there, both because this field declares it (#966).\n */\nconst consentedPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes ${subject} has granted, each independently. A set, not a level: granting one purpose implies nothing about another. Empty means nothing optional was granted.`,\n  );\n\nconst consentDecidedAtField = (subject: string) => z.date().optional()\n  .describe(\n    `When ${subject} last made an affirmative consent choice. Absent means no choice was ever made, which is different from choosing to grant nothing.`,\n  );\n\n/**\n * The purposes a surface actually PUT IN FRONT of the person when they decided.\n *\n * ## Why a decision is not describable by its grants alone\n *\n * A grant set says what was agreed to. It cannot say what was ASKED, and the two differ by surface:\n * a website panel offers `purposesInUse`, derived from that site's own live providers, while the\n * application's gate offers `optionalPurposes`, derived from that application's configuration. A\n * marketing site running analytics and an application that also does marketing legitimately ask\n * different questions.\n *\n * Without this field, carrying a visitor's decision to their new account records\n * `consentDecidedAt` — which every consent surface reads as *\"this person was asked and answered\"* —\n * for purposes they were never shown. The application then stops prompting, and a purpose nobody\n * displayed is stored as declined. The existing surfaces already avoid this internally (*\"Purposes\n * the panel does not offer keep their stored grant\"*); only the CARRY crossed a surface boundary, and\n * it needed to know where the boundary was.\n *\n * So a decision is `(granted ⊆ offered, at an instant)`, and the carry adopts grants for offered\n * purposes while leaving an unoffered one genuinely undecided.\n *\n * ## Why only the anonymous holder declares it\n *\n * It is the only holder whose decision is taken on one surface and read on another. A member's\n * preferences are written and read by the same application, and a lead's opt-in is never carried\n * anywhere — adding the field there would be a second thing to keep true with no reader.\n *\n * Defaults to the EMPTY set, which is the honest value for every row written before this existed and\n * for a session that has been initialized but never asked: an empty offered set means no question was\n * put, so a carry from it carries nothing, which is the same outcome those rows have today.\n */\nconst offeredPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes actually shown to ${subject} by the surface they decided on. What is NOT here was never asked, and must not be read as declined.`,\n  );\n\nexport const AnonymousUserPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this anonymous visitor'),\n  offeredPurposes: offeredPurposesField('this anonymous visitor'),\n  consentDecidedAt: consentDecidedAtField('this anonymous visitor'),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this lead'),\n  consentDecidedAt: consentDecidedAtField('this lead'),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on the granted purposes, and deliberately NOT on the block that contains them.\n  //\n  // The granted set is the subject's own privacy DECISION held as a closed vocabulary, so recording its\n  // before/after values on `resource_operation_performed` is exactly the \"mark what decides authority,\n  // never what identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting set. Reached by the consent\n  // gate and prompt, the self-service preferences RESET and self/admin UPDATE. UPDATE explicitly opts\n  // into audit emission below the risk floor; only marked decision leaves enter the evidence.\n  consentedPurposes: consentedPurposesField('this person')\n    .isAuditEvidence(),\n  consentDecidedAt: consentDecidedAtField('this person'),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}
+{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACzH,QAAQ,CACP,yBAAyB,OAAO,qJAAqJ,CACtL,CAAC;AAEJ,MAAM,qBAAqB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACnE,QAAQ,CACP,QAAQ,OAAO,oIAAoI,CACpJ,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACvH,QAAQ,CACP,2CAA2C,OAAO,sGAAsG,CACzJ,CAAC;AAEJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,iBAAiB,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;IACnE,eAAe,EAAE,oBAAoB,CAAC,wBAAwB,CAAC;IAC/D,gBAAgB,EAAE,qBAAqB,CAAC,wBAAwB,CAAC;CAClE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,iBAAiB,EAAE,sBAAsB,CAAC,WAAW,CAAC;IACtD,gBAAgB,EAAE,qBAAqB,CAAC,WAAW,CAAC;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,sGAAsG;IACtG,EAAE;IACF,sGAAsG;IACtG,qGAAqG;IACrG,wFAAwF;IACxF,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,oGAAoG;IACpG,4FAA4F;IAC5F,iBAAiB,EAAE,sBAAsB,CAAC,aAAa,CAAC;SACrD,eAAe,EAAE;IACpB,gBAAgB,EAAE,qBAAqB,CAAC,aAAa,CAAC;CACvD,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport \"@wildo-ai/zod-decorators\";\n\nimport { ConsentPurpose } from \"./consent-purposes.shared\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\n/**\n * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n *\n * Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n *\n * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n *\n * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\n/**\n * The purposes a person has granted, and whether they have decided at all — the two facts every\n * consent surface reads (#534).\n *\n * `consentedPurposes` defaults to the EMPTY set, and that default is the point. It used to be\n * `.default(DataProcessingConsent.BASIC)`: every record asserted a consent its subject never gave.\n * The empty set asserts nothing.\n *\n * `consentDecidedAt` is what separates \"declined everything\" from \"was never asked\" — the two are the\n * same empty set and must not be the same fact. Absent means undecided, so a consent surface asks; set\n * means the person made an affirmative choice at that instant, whatever they chose.\n */\n/*\n * `.systemEnum('ConsentPurpose')` names the ONE vocabulary a purpose is worded by, everywhere it is stored —\n * a person's preferences, an anonymous visitor, a lead — and on the application consent gate that asks for\n * it. A purpose is a legal statement to the person deciding, so it gets one wording, authored once under\n * `system_enums.ConsentPurpose.<value>`; the labelling planner plans it there and the frontend reads it\n * there, both because this field declares it (#966).\n */\nconst consentedPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes ${subject} has granted, each independently. A set, not a level: granting one purpose implies nothing about another. Empty means nothing optional was granted.`,\n  );\n\nconst consentDecidedAtField = (subject: string) => z.date().optional()\n  .describe(\n    `When ${subject} last made an affirmative consent choice. Absent means no choice was ever made, which is different from choosing to grant nothing.`,\n  );\n\n/**\n * The purposes a surface actually PUT IN FRONT of the person when they decided.\n *\n * ## Why a decision is not describable by its grants alone\n *\n * A grant set says what was agreed to. It cannot say what was ASKED, and the two differ by surface:\n * a website panel offers `purposesInUse`, derived from that site's own live providers, while the\n * application's gate offers `optionalPurposes`, derived from that application's configuration. A\n * marketing site running analytics and an application that also does marketing legitimately ask\n * different questions.\n *\n * Without this field, carrying a visitor's decision to their new account records\n * `consentDecidedAt` — which every consent surface reads as *\"this person was asked and answered\"* —\n * for purposes they were never shown. The application then stops prompting, and a purpose nobody\n * displayed is stored as declined. The existing surfaces already avoid this internally (*\"Purposes\n * the panel does not offer keep their stored grant\"*); only the CARRY crossed a surface boundary, and\n * it needed to know where the boundary was.\n *\n * So a decision is `(granted ⊆ offered, at an instant)`, and the carry adopts grants for offered\n * purposes while leaving an unoffered one genuinely undecided.\n *\n * ## Why only the anonymous holder declares it\n *\n * It is the only holder whose decision is taken on one surface and read on another. A member's\n * preferences are written and read by the same application, and a lead's opt-in is never carried\n * anywhere — adding the field there would be a second thing to keep true with no reader.\n *\n * Defaults to the EMPTY set, which is the honest value for every row written before this existed and\n * for a session that has been initialized but never asked: an empty offered set means no question was\n * put, so a carry from it carries nothing, which is the same outcome those rows have today.\n */\nconst offeredPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes actually shown to ${subject} by the surface they decided on. What is NOT here was never asked, and must not be read as declined.`,\n  );\n\nexport const AnonymousUserPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this anonymous visitor'),\n  offeredPurposes: offeredPurposesField('this anonymous visitor'),\n  consentDecidedAt: consentDecidedAtField('this anonymous visitor'),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this lead'),\n  consentDecidedAt: consentDecidedAtField('this lead'),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on the granted purposes, and deliberately NOT on the block that contains them.\n  //\n  // The granted set is the subject's own privacy DECISION held as a closed vocabulary, so recording its\n  // before/after values on `resource_operation_performed` is exactly the \"mark what decides authority,\n  // never what identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting set. Reached by the consent\n  // gate and prompt, the self-service preferences RESET and self/admin UPDATE. UPDATE explicitly opts\n  // into audit emission below the risk floor; only marked decision leaves enter the evidence.\n  consentedPurposes: consentedPurposesField('this person')\n    .isAuditEvidence(),\n  consentDecidedAt: consentDecidedAtField('this person'),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-capability-disclosure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,4BAA4B;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,GAAG,IAAI,CAAC,CAmF5H,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG;IACnF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAkBA"}
+{"version":3,"file":"provider-capability-disclosure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,4BAA4B;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,GAAG,IAAI,CAAC,CAmF5H,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG;IACnF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAkBA"}

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-capability-disclosure.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAE5B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AACvH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAuC/E,MAAM,CAAC,MAAM,+BAA+B,GAAqF;IAC/H,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE;QACjD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACtJ,SAAS,EAAE,sLAAsL;KAClM;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE;QAC3C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACrF,SAAS,EAAE,0GAA0G;KACtH;IACD,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE;QACjC,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,WAAW,CAAC;QACpF,SAAS,EAAE,8EAA8E;KAC1F;IACD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE;QACrC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,SAAS,CAAC;QACjH,SAAS,EAAE,wFAAwF;KACpG;IACD,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE;QACxC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,wGAAwG;KACpH;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,qDAAqD;KACjE;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE;QAC5C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,qFAAqF;KACjG;IACD,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE;QACtD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,+DAA+D;KAC3E;IACD,8GAA8G;IAC9G,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,IAAI;IAChD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,kBAAkB;KAC9B;IACD,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE;QACvD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,+HAA+H;KAC3I;IACD,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE;QACxD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,gFAAgF;KAC5F;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,mCAAmC;KAC/C;IACD,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,EAAE;QAClD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,iEAAiE;KAC7E;IACD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC;QACxC,SAAS,EAAE,yDAAyD;KACrE;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,gEAAgE;KAC5E;IACD,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE;QAC/C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC;QAC3E,SAAS,EAAE,uEAAuE;KACnF;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,uHAAuH;KACnI;IACD,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE;QACpD,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACvE,SAAS,EAAE,oEAAoE;KAChF;CACF,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAAyB;IAIhF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,+BAA+B,GAAG,+BAAgG,CAAC;IACzI,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,oBAAoB,GAAG,KAAK,IAAI,+BAA+B;YACnE,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC5K,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,kBAAkB,IAAI,oBAAoB,EAAE,CAAC;YACtD,KAAK,MAAM,QAAQ,IAAI,+BAA+B,CAAC,kBAAkB,CAAC,EAAE,UAAU,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACtH,CAAC","sourcesContent":["import {\n  BUILTIN_PROVIDER_CAPABILITY,\n  type BuiltinProviderCapability,\n} from '../../external-providers/provider-capability.shared.schemas';\nimport { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY } from '../../external-providers/engine-capabilities.shared.schemas';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/**\n * WHICH categories of personal data the ENGINE sends to a provider that serves a capability (#1709).\n *\n * ## Why a table the engine owns\n *\n * A record of processing lists the categories of personal data and the categories of recipients (GDPR Art. 30(1)(c),\n * (d)); saying which categories reach which recipient is the practice that keeps the two lists consistent. For a\n * provider reached through a CAPABILITY, the application writes no\n * field map: the ENGINE composes the request — the recipient address of an email, the customer of a billing call,\n * the prompt of a model call. So the categories are a fact about the engine's own behaviour, the same for every\n * application, and the engine states it here rather than asking each operator to narrate it\n * (`.claude/rules/derive-before-you-ask.md`).\n *\n * The provider compliance profile's header rejects restating this on each provider module, as \"a second authority\n * for one fact\": the capability is the authority, and this is where it speaks.\n *\n * ## Total over the provider-capability vocabulary\n *\n * A `Record` over every {@link BuiltinProviderCapability}, so a capability added tomorrow is a compile error here\n * until someone states what it sends. `null` is an ANSWER: the capability sends no personal data of the application's\n * users to the vendor (a build-time coding agent works on source code).\n *\n * ## Read it as a FLOOR of what reaches the vendor, never a ceiling\n *\n * `USER_CONTENT` is listed wherever free text a person wrote rides the call (a prompt, a message body, a search\n * query), and free text can carry ANY other category — see {@link PersonalDataCategory.USER_CONTENT}. A notice\n * states the listed categories and must not conclude that nothing else ever reaches the vendor.\n *\n * @wildo_source:part:start saas.models.privacy.provider-capability-disclosure facet:layer:shared facet:audience:app-developer\n */\nexport interface ProviderCapabilityDisclosure {\n  /** The categories the engine sends when it calls a provider for this capability. */\n  readonly categories: readonly PersonalDataCategory[];\n  /** What in the call carries them — so a reader can check the claim against the engine's behaviour. */\n  readonly carriedBy: string;\n}\n\nexport const PROVIDER_CAPABILITY_DISCLOSURES: Readonly<Record<BuiltinProviderCapability, ProviderCapabilityDisclosure | null>> = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY, PersonalDataCategory.CREDENTIALS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the recipient address, the recipient name the templates address, the rendered message body, and the magic-link, verification and password-reset tokens the engine\\'s own mails carry',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the subscriber address and name synchronised to the audience',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the sender and recipient addresses, and the message bodies and attachments the vendor receives and holds',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.CREDENTIALS],\n    carriedBy: 'the telephone number, and the one-time verification code the message carries',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.FINANCIAL],\n    carriedBy: 'the customer name and email address, and the payment, subscription and invoice records',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_OAUTH2]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the sign-in request, which may name the account (login hint), and the identity the vendor asserts back',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_SAML]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the authentication request and the asserted subject',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the prompt and the context the application assembles into it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the text of every field a resource marks as a retrieval source, sent to be embedded',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the bytes of every uploaded document sent for text extraction',\n  },\n  // Build-time tooling: a coding run sends the application's SOURCE CODE and specifications, not a user's data.\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: null,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the image prompt',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the error event with its device, browser and page context, and the signed-in user identifier when the application attaches it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the product events and the identifier the application identifies the person by',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_SEARCH]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the search query the person types',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_FILE_PICKER]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the files the person picks from their own account at the vendor',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA]: {\n    categories: [PersonalDataCategory.USAGE],\n    carriedBy: 'the interaction and device signals the challenge scores',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ADDRESS_LOOKUP]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.LOCATION],\n    carriedBy: 'the address text the person types and the place it resolves to',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: {\n    categories: [PersonalDataCategory.USER_CONTENT, PersonalDataCategory.USAGE],\n    carriedBy: 'the traced generation — its prompt and output — and the call metadata',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the traces, metrics and logs of requests, which carry request metadata and the acting user\\'s identifier on each span',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.USAGE],\n    carriedBy: 'every audit event: the acting user, the subject, and what was done',\n  },\n};\n/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */\n\n/**\n * The categories disclosed through a set of capabilities, as the population's data paths name them — provider\n * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).\n *\n * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the\n * {@link PersonalDataCategory} enum order, so one application produces one sentence.\n */\nexport function personalDataDisclosedThroughCapabilities(tokens: readonly string[]): {\n  readonly categories: readonly PersonalDataCategory[];\n  readonly undeclared: readonly string[];\n} {\n  const found = new Set<PersonalDataCategory>();\n  const undeclared: string[] = [];\n  const disclosuresByProviderCapability = PROVIDER_CAPABILITY_DISCLOSURES as Readonly<Record<string, ProviderCapabilityDisclosure | null>>;\n  for (const token of tokens) {\n    const providerCapabilities = token in disclosuresByProviderCapability\n      ? [token]\n      : Object.entries(PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY).filter(([, engineCapability]) => engineCapability === token).map(([providerCapability]) => providerCapability);\n    if (providerCapabilities.length === 0) {\n      undeclared.push(token);\n      continue;\n    }\n    for (const providerCapability of providerCapabilities) {\n      for (const category of disclosuresByProviderCapability[providerCapability]?.categories ?? []) found.add(category);\n    }\n  }\n  const order = Object.values(PersonalDataCategory);\n  return { categories: order.filter((category) => found.has(category)), undeclared: [...new Set(undeclared)].sort() };\n}\n"]}
+{"version":3,"file":"provider-capability-disclosure.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAE5B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AACvH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAuC/E,MAAM,CAAC,MAAM,+BAA+B,GAAqF;IAC/H,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE;QACjD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACtJ,SAAS,EAAE,sLAAsL;KAClM;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE;QAC3C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACrF,SAAS,EAAE,0GAA0G;KACtH;IACD,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE;QACjC,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,WAAW,CAAC;QACpF,SAAS,EAAE,8EAA8E;KAC1F;IACD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE;QACrC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,SAAS,CAAC;QACjH,SAAS,EAAE,wFAAwF;KACpG;IACD,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE;QACxC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,wGAAwG;KACpH;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,qDAAqD;KACjE;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE;QAC5C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,qFAAqF;KACjG;IACD,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE;QACtD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,+DAA+D;KAC3E;IACD,8GAA8G;IAC9G,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,IAAI;IAChD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,kBAAkB;KAC9B;IACD,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE;QACvD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,+HAA+H;KAC3I;IACD,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE;QACxD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,gFAAgF;KAC5F;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,mCAAmC;KAC/C;IACD,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,EAAE;QAClD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,iEAAiE;KAC7E;IACD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC;QACxC,SAAS,EAAE,yDAAyD;KACrE;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,gEAAgE;KAC5E;IACD,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE;QAC/C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC;QAC3E,SAAS,EAAE,uEAAuE;KACnF;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,uHAAuH;KACnI;IACD,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE;QACpD,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACvE,SAAS,EAAE,oEAAoE;KAChF;CACF,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAAyB;IAIhF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,+BAA+B,GAAG,+BAAgG,CAAC;IACzI,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,oBAAoB,GAAG,KAAK,IAAI,+BAA+B;YACnE,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC5K,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,kBAAkB,IAAI,oBAAoB,EAAE,CAAC;YACtD,KAAK,MAAM,QAAQ,IAAI,+BAA+B,CAAC,kBAAkB,CAAC,EAAE,UAAU,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACtH,CAAC","sourcesContent":["import {\n  BUILTIN_PROVIDER_CAPABILITY,\n  type BuiltinProviderCapability,\n} from '../../external-providers/provider-capability.shared.schemas';\nimport { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY } from '../../external-providers/engine-capabilities.shared.schemas';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/**\n * WHICH categories of personal data the ENGINE sends to a provider that serves a capability (#1709).\n *\n * ## Why a table the engine owns\n *\n * A record of processing lists the categories of personal data and the categories of recipients (GDPR Art. 30(1)(c),\n * (d)); saying which categories reach which recipient is the practice that keeps the two lists consistent. For a\n * provider reached through a CAPABILITY, the application writes no\n * field map: the ENGINE composes the request — the recipient address of an email, the customer of a billing call,\n * the prompt of a model call. So the categories are a fact about the engine's own behaviour, the same for every\n * application, and the engine states it here rather than asking each operator to narrate it\n * (`.claude/rules/derive-before-you-ask.md`).\n *\n * The provider compliance profile's header rejects restating this on each provider module, as \"a second authority\n * for one fact\": the capability is the authority, and this is where it speaks.\n *\n * ## Total over the provider-capability vocabulary\n *\n * A `Record` over every {@link BuiltinProviderCapability}, so a capability added tomorrow is a compile error here\n * until someone states what it sends. `null` is an ANSWER: the capability sends no personal data of the application's\n * users to the vendor (a build-time coding agent works on source code).\n *\n * ## Read it as a FLOOR of what reaches the vendor, never a ceiling\n *\n * `USER_CONTENT` is listed wherever free text a person wrote rides the call (a prompt, a message body, a search\n * query), and free text can carry ANY other category — see {@link PersonalDataCategory.USER_CONTENT}. A notice\n * states the listed categories and must not conclude that nothing else ever reaches the vendor.\n *\n * @wildo_source:part:start saas.models.privacy.provider-capability-disclosure facet:layer:shared facet:audience:app-developer\n */\nexport interface ProviderCapabilityDisclosure {\n  /** The categories the engine sends when it calls a provider for this capability. */\n  readonly categories: readonly PersonalDataCategory[];\n  /** What in the call carries them — so a reader can check the claim against the engine's behaviour. */\n  readonly carriedBy: string;\n}\n\nexport const PROVIDER_CAPABILITY_DISCLOSURES: Readonly<Record<BuiltinProviderCapability, ProviderCapabilityDisclosure | null>> = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY, PersonalDataCategory.CREDENTIALS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the recipient address, the recipient name the templates address, the rendered message body, and the magic-link, verification and password-reset tokens the engine\\'s own mails carry',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the subscriber address and name synchronised to the audience',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the sender and recipient addresses, and the message bodies and attachments the vendor receives and holds',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.CREDENTIALS],\n    carriedBy: 'the telephone number, and the one-time verification code the message carries',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.FINANCIAL],\n    carriedBy: 'the customer name and email address, and the payment, subscription and invoice records',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_OAUTH2]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the sign-in request, which may name the account (login hint), and the identity the vendor asserts back',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_SAML]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the authentication request and the asserted subject',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the prompt and the context the application assembles into it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the text of every field a resource marks as a retrieval source, sent to be embedded',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the bytes of every uploaded document sent for text extraction',\n  },\n  // Build-time tooling: a coding run sends the application's SOURCE CODE and specifications, not a user's data.\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: null,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the image prompt',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the error event with its device, browser and page context, and the signed-in user identifier when the application attaches it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the product events and the identifier the application identifies the person by',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_SEARCH]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the search query the person types',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_FILE_PICKER]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the files the person picks from their own account at the vendor',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA]: {\n    categories: [PersonalDataCategory.USAGE],\n    carriedBy: 'the interaction and device signals the challenge scores',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ADDRESS_LOOKUP]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.LOCATION],\n    carriedBy: 'the address text the person types and the place it resolves to',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: {\n    categories: [PersonalDataCategory.USER_CONTENT, PersonalDataCategory.USAGE],\n    carriedBy: 'the traced generation — its prompt and output — and the call metadata',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the traces, metrics and logs of requests, which carry request metadata and the acting user\\'s identifier on each span',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.USAGE],\n    carriedBy: 'every audit event: the acting user, the subject, and what was done',\n  },\n};\n/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */\n\n/**\n * The categories disclosed through a set of capabilities, as the population's data paths name them — provider\n * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).\n *\n * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the\n * {@link PersonalDataCategory} enum order, so one application produces one sentence.\n */\nexport function personalDataDisclosedThroughCapabilities(tokens: readonly string[]): {\n  readonly categories: readonly PersonalDataCategory[];\n  readonly undeclared: readonly string[];\n} {\n  const found = new Set<PersonalDataCategory>();\n  const undeclared: string[] = [];\n  const disclosuresByProviderCapability = PROVIDER_CAPABILITY_DISCLOSURES as Readonly<Record<string, ProviderCapabilityDisclosure | null>>;\n  for (const token of tokens) {\n    const providerCapabilities = token in disclosuresByProviderCapability\n      ? [token]\n      : Object.entries(PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY).filter(([, engineCapability]) => engineCapability === token).map(([providerCapability]) => providerCapability);\n    if (providerCapabilities.length === 0) {\n      undeclared.push(token);\n      continue;\n    }\n    for (const providerCapability of providerCapabilities) {\n      for (const category of disclosuresByProviderCapability[providerCapability]?.categories ?? []) found.add(category);\n    }\n  }\n  const order = Object.values(PersonalDataCategory);\n  return { categories: order.filter((category) => found.has(category)), undeclared: [...new Set(undeclared)].sort() };\n}\n"]}

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"purpose-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAAoG,CAAC"}
+{"version":3,"file":"purpose-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAAoG,CAAC"}

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"purpose-ref.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE,0CAA0C,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.\n *\n * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that\n * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the\n * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator\n * identity's module graph with it.\n */\nexport const LawfulBasisPurposeRefSchema = z.string().trim().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'a purpose ref is a lower-case kebab slug');\n"]}
+{"version":3,"file":"purpose-ref.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE,0CAA0C,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.\n *\n * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that\n * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the\n * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator\n * identity's module graph with it.\n */\nexport const LawfulBasisPurposeRefSchema = z.string().trim().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'a purpose ref is a lower-case kebab slug');\n"]}

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/redaction.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n * MAINTAINER NOTE — not part of the anchored, application-facing block below.\n *\n * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n *\n * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n */\n\n/**\n * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n *\n * How one field's value is replaced when it is redacted or scrubbed.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Two consumers, and only one of them accepts every member\n *\n * | consumer | what it does | accepts |\n * |---|---|---|\n * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |\n * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |\n *\n * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n *\n * ## Choosing a treatment for an erasure scrub\n *\n * | the field | treatment |\n * |---|---|\n * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |\n * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |\n * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |\n * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |\n *\n * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n *\n * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n *\n * ## The never-scrub floor\n *\n * A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n *\n * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n *\n * @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n *\n * const contactSchema = z.object({\n *   // nullable → REMOVE\n *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n *   // constrained string → MASK with a value the field's own schema accepts\n *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n *   // non-nullable with a default → RESET\n *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n *     .impersonalizeWith(RedactionType.RESET),\n *   // no treatment → survives the erasure, deliberately\n *   invoicedAmount: z.number(),\n * });\n * ```\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */\n  MASK = 'mask',\n  /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */\n  ENCRYPT = 'encrypt',\n  /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */\n  KEEP = 'keep',\n  /**\n   * Erasure scrub only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n   * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n   * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n   * and objects.\n   *\n   * The value is read from the schema rather than authored a second time, so it cannot drift from\n   * the default the field already declares — and for a person's counters and settings, \"what this is\n   * when nobody has set it\" is exactly what an erasure should leave behind.\n   *\n   * Refused when the field declares no `.default()`, and refused when that default reads the clock.\n   */\n  RESET = 'reset',\n}\n/** @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}
+{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n * MAINTAINER NOTE — not part of the anchored, application-facing block below.\n *\n * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n *\n * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n */\n\n/**\n * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n *\n * How one field's value is replaced when it is redacted or scrubbed.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Two consumers, and only one of them accepts every member\n *\n * | consumer | what it does | accepts |\n * |---|---|---|\n * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |\n * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |\n *\n * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n *\n * ## Choosing a treatment for an erasure scrub\n *\n * | the field | treatment |\n * |---|---|\n * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |\n * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |\n * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |\n * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |\n *\n * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n *\n * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n *\n * ## The never-scrub floor\n *\n * A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n *\n * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n *\n * @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n *\n * const contactSchema = z.object({\n *   // nullable → REMOVE\n *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n *   // constrained string → MASK with a value the field's own schema accepts\n *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n *   // non-nullable with a default → RESET\n *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n *     .impersonalizeWith(RedactionType.RESET),\n *   // no treatment → survives the erasure, deliberately\n *   invoicedAmount: z.number(),\n * });\n * ```\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */\n  MASK = 'mask',\n  /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */\n  ENCRYPT = 'encrypt',\n  /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */\n  KEEP = 'keep',\n  /**\n   * Erasure scrub only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n   * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n   * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n   * and objects.\n   *\n   * The value is read from the schema rather than authored a second time, so it cannot drift from\n   * the default the field already declares — and for a person's counters and settings, \"what this is\n   * when nobody has set it\" is exactly what an erasure should leave behind.\n   *\n   * Refused when the field declares no `.default()`, and refused when that default reads the clock.\n   */\n  RESET = 'reset',\n}\n/** @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}

package/dist/esm/compliance/privacy/retention-binding.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-binding.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-binding.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC9B,MAAM,qCAAqC,CAAC;AAsB7C,wEAAwE;AACxE,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAC3D,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAE3D;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAexF;AAYD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,wBAAwB,EACjC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,IAAI,GACR,oBAAoB,CAOtB;AASD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,GAChC,IAAI,GAAG,SAAS,CAIlB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,IAAI,GAAG,SAAS,CAKlB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,YAAY,EAAE,CAgB9E;AAMD,qHAAqH;AACrH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAE9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAAG,SAAS,MAAM,EAAE,CAO1G"}
+{"version":3,"file":"retention-binding.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-binding.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC9B,MAAM,qCAAqC,CAAC;AAsB7C,wEAAwE;AACxE,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAC3D,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAE3D;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAexF;AAYD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,wBAAwB,EACjC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,IAAI,GACR,oBAAoB,CAOtB;AASD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,GAChC,IAAI,GAAG,SAAS,CAIlB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,IAAI,GAAG,SAAS,CAKlB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,YAAY,EAAE,CAgB9E;AAMD,qHAAqH;AACrH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAE9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAAG,SAAS,MAAM,EAAE,CAO1G"}