@wildo-ai/saas-models 1.1.9 → 1.1.10

package/dist/esm/compliance/privacy/legal-notice.shared.js

@@ -0,0 +1,112 @@
+import { z } from 'zod';
+import { legalNoticeOwed } from './legal-notice-obligation.shared.js';
+import { ApplicationOperatorComplianceIdentitySchema } from './operator-compliance-identity.shared.schemas.js';
+/**
+ * The particulars of a legal notice, and its runtime projection (#2588). Whether one is owed at all is decided in
+ * `legal-notice-obligation.shared.ts`, an import-free atom the marketing website's build reads too.
+ */
+/**
+ * The particulars a legal notice states, one per item of Art. 5(1) and § 5 Abs. 1 DDG, so a page, a launch list and
+ * an operator-facing check name the same things by the same names.
+ */
+export var LegalNoticeParticular;
+(function (LegalNoticeParticular) {
+    /** Art. 5(1)(a). */
+    LegalNoticeParticular["LEGAL_ENTITY_NAME"] = "legalEntityName";
+    /** Art. 5(1)(b): the geographic address of the establishment. */
+    LegalNoticeParticular["REGISTERED_ADDRESS"] = "registeredAddress";
+    /** Art. 5(1)(c): rapid, direct contact including e-mail. */
+    LegalNoticeParticular["GENERAL_CONTACT"] = "generalContact";
+    /** § 5 Abs. 1 Nr. 1 DDG, for a legal person. */
+    LegalNoticeParticular["LEGAL_FORM"] = "legalForm";
+    /** § 5 Abs. 1 Nr. 1 DDG, for a legal person. */
+    LegalNoticeParticular["AUTHORIZED_REPRESENTATIVES"] = "authorizedRepresentatives";
+    /** § 5 Abs. 1 Nr. 1 DDG, where the provider states its capital. */
+    LegalNoticeParticular["SHARE_CAPITAL"] = "shareCapital";
+    /** Art. 5(1)(d), where the operator is registered. */
+    LegalNoticeParticular["TRADE_REGISTER"] = "tradeRegister";
+    /** Art. 5(1)(g), where the activity is subject to VAT. */
+    LegalNoticeParticular["VAT_IDENTIFICATION_NUMBER"] = "vatIdentificationNumber";
+    /** § 5 Abs. 1 Nr. 6 DDG, where the operator has a Wirtschafts-Identifikationsnummer. */
+    LegalNoticeParticular["ECONOMIC_IDENTIFICATION_NUMBER"] = "economicIdentificationNumber";
+    /** Art. 5(1)(e), where the activity needs an authorisation. */
+    LegalNoticeParticular["SUPERVISORY_AUTHORITY"] = "supervisoryAuthority";
+    /** Art. 5(1)(f), where the service is provided in a regulated profession. */
+    LegalNoticeParticular["REGULATED_PROFESSION"] = "regulatedProfession";
+    /** § 5 Abs. 1 Nr. 7 DDG, for a company being wound up. */
+    LegalNoticeParticular["IN_LIQUIDATION"] = "inLiquidation";
+})(LegalNoticeParticular || (LegalNoticeParticular = {}));
+/**
+ * The particulars EVERY established provider owes: name, address, contact. The others apply only to some operators (a
+ * legal person, a registered one, one subject to VAT or to an authorisation), which nothing in the configuration can
+ * decide for the operator, so they are reported as `toConfirm` rather than as owed. The legal-notice page reads this
+ * list to decide which particulars it marks "not yet declared", so the page and the launch list cannot disagree.
+ */
+export const LEGAL_NOTICE_ALWAYS_OWED_PARTICULARS = Object.freeze([
+    LegalNoticeParticular.LEGAL_ENTITY_NAME,
+    LegalNoticeParticular.REGISTERED_ADDRESS,
+    LegalNoticeParticular.GENERAL_CONTACT,
+]);
+/**
+ * What a legal notice still lacks: `owed` (always required, undeclared) and `toConfirm` (required where it applies,
+ * undeclared). Both empty when the notice is not owed. A page renders an undeclared particular as MARKED, never omitted
+ * and never invented: the duty exists whether or not the operator has filled the field.
+ */
+export function outstandingLegalNoticeParticulars(identity) {
+    if (legalNoticeOwed(identity) !== true)
+        return { owed: [], toConfirm: [] };
+    const declared = (particular) => identity?.[particular] !== undefined;
+    const all = Object.values(LegalNoticeParticular);
+    return {
+        owed: LEGAL_NOTICE_ALWAYS_OWED_PARTICULARS.filter((particular) => !declared(particular)),
+        toConfirm: all.filter((particular) => !LEGAL_NOTICE_ALWAYS_OWED_PARTICULARS.includes(particular) && !declared(particular)),
+    };
+}
+/**
+ * Where `wildo config legal-notice` writes the projected notice in an application, and where `saas-config.backend.ts`
+ * imports it from. One constant for the generator, the validate domain and the launch list, which reports an owed
+ * notice whose module is absent: the running application would then say no notice is required.
+ */
+export const LEGAL_NOTICE_GENERATED_RELATIVE_PATH = 'backend-api/src/legal-notice.generated.ts';
+const identityShape = ApplicationOperatorComplianceIdentitySchema.shape;
+/**
+ * The legal notice an application SERVES, carried in its runtime configuration as `compliance.legalNotice` (#2588).
+ *
+ * Exactly the particulars a notice states, taken from the identity's own field schemas so there is one definition of
+ * each, and nothing else: the lawful bases, role allocations and the rest of the identity are not a legal notice and do
+ * not reach the unauthenticated page. Every particular is optional, because an undeclared one is MARKED on the page as
+ * "not yet declared" rather than omitted: the duty exists whether or not the operator has filled the field.
+ *
+ * Written by `wildo config legal-notice` from `operatorComplianceIdentity`, only when the notice is owed
+ * (`legalNoticeOwed`); an application that owes none carries no `legalNotice`, and its page says so.
+ */
+export const LegalNoticeSchema = z.strictObject({
+    establishmentJurisdiction: identityShape.establishmentJurisdiction,
+    legalEntityName: identityShape.legalEntityName,
+    registeredAddress: identityShape.registeredAddress,
+    legalForm: identityShape.legalForm,
+    authorizedRepresentatives: identityShape.authorizedRepresentatives,
+    shareCapital: identityShape.shareCapital,
+    generalContact: identityShape.generalContact,
+    tradeRegister: identityShape.tradeRegister,
+    vatIdentificationNumber: identityShape.vatIdentificationNumber,
+    economicIdentificationNumber: identityShape.economicIdentificationNumber,
+    supervisoryAuthority: identityShape.supervisoryAuthority,
+    regulatedProfession: identityShape.regulatedProfession,
+    inLiquidation: identityShape.inLiquidation,
+});
+/**
+ * The legal notice to serve, projected from the operator's identity: `undefined` when none is owed (or when the
+ * establishment is undeclared, so it cannot be known to be owed), the declared particulars otherwise.
+ */
+export function projectLegalNotice(identity) {
+    if (identity === undefined || legalNoticeOwed(identity) !== true)
+        return undefined;
+    const notice = {};
+    for (const key of Object.keys(LegalNoticeSchema.shape)) {
+        if (identity[key] !== undefined)
+            notice[key] = identity[key];
+    }
+    return LegalNoticeSchema.parse(notice);
+}
+//# sourceMappingURL=legal-notice.shared.js.map

package/dist/esm/compliance/privacy/legal-notice.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-notice.shared.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/legal-notice.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,2CAA2C,EAA8C,MAAM,+CAA+C,CAAC;AAExJ;;;GAGG;AAEH;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAyBX;AAzBD,WAAY,qBAAqB;IAC/B,oBAAoB;IACpB,8DAAqC,CAAA;IACrC,iEAAiE;IACjE,iEAAwC,CAAA;IACxC,4DAA4D;IAC5D,2DAAkC,CAAA;IAClC,gDAAgD;IAChD,iDAAwB,CAAA;IACxB,gDAAgD;IAChD,iFAAwD,CAAA;IACxD,mEAAmE;IACnE,uDAA8B,CAAA;IAC9B,sDAAsD;IACtD,yDAAgC,CAAA;IAChC,0DAA0D;IAC1D,8EAAqD,CAAA;IACrD,wFAAwF;IACxF,wFAA+D,CAAA;IAC/D,+DAA+D;IAC/D,uEAA8C,CAAA;IAC9C,6EAA6E;IAC7E,qEAA4C,CAAA;IAC5C,0DAA0D;IAC1D,yDAAgC,CAAA;AAClC,CAAC,EAzBW,qBAAqB,KAArB,qBAAqB,QAyBhC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAqC,MAAM,CAAC,MAAM,CAAC;IAClG,qBAAqB,CAAC,iBAAiB;IACvC,qBAAqB,CAAC,kBAAkB;IACxC,qBAAqB,CAAC,eAAe;CACtC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,QAA2D;IAE3D,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,UAAiC,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,oCAAoC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxF,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,oCAAoC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;KAC3H,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,2CAA2C,CAAC;AAEhG,MAAM,aAAa,GAAG,2CAA2C,CAAC,KAAK,CAAC;AAExE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9C,yBAAyB,EAAE,aAAa,CAAC,yBAAyB;IAClE,eAAe,EAAE,aAAa,CAAC,eAAe;IAC9C,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;IAClD,SAAS,EAAE,aAAa,CAAC,SAAS;IAClC,yBAAyB,EAAE,aAAa,CAAC,yBAAyB;IAClE,YAAY,EAAE,aAAa,CAAC,YAAY;IACxC,cAAc,EAAE,aAAa,CAAC,cAAc;IAC5C,aAAa,EAAE,aAAa,CAAC,aAAa;IAC1C,uBAAuB,EAAE,aAAa,CAAC,uBAAuB;IAC9D,4BAA4B,EAAE,aAAa,CAAC,4BAA4B;IACxE,oBAAoB,EAAE,aAAa,CAAC,oBAAoB;IACxD,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;IACtD,aAAa,EAAE,aAAa,CAAC,aAAa;CAC3C,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA2D;IAC5F,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACnF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAA0B,EAAE,CAAC;QAChF,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { legalNoticeOwed } from './legal-notice-obligation.shared';\nimport { ApplicationOperatorComplianceIdentitySchema, type ApplicationOperatorComplianceIdentity } from './operator-compliance-identity.shared.schemas';\n\n/**\n * The particulars of a legal notice, and its runtime projection (#2588). Whether one is owed at all is decided in\n * `legal-notice-obligation.shared.ts`, an import-free atom the marketing website's build reads too.\n */\n\n/**\n * The particulars a legal notice states, one per item of Art. 5(1) and § 5 Abs. 1 DDG, so a page, a launch list and\n * an operator-facing check name the same things by the same names.\n */\nexport enum LegalNoticeParticular {\n  /** Art. 5(1)(a). */\n  LEGAL_ENTITY_NAME = 'legalEntityName',\n  /** Art. 5(1)(b): the geographic address of the establishment. */\n  REGISTERED_ADDRESS = 'registeredAddress',\n  /** Art. 5(1)(c): rapid, direct contact including e-mail. */\n  GENERAL_CONTACT = 'generalContact',\n  /** § 5 Abs. 1 Nr. 1 DDG, for a legal person. */\n  LEGAL_FORM = 'legalForm',\n  /** § 5 Abs. 1 Nr. 1 DDG, for a legal person. */\n  AUTHORIZED_REPRESENTATIVES = 'authorizedRepresentatives',\n  /** § 5 Abs. 1 Nr. 1 DDG, where the provider states its capital. */\n  SHARE_CAPITAL = 'shareCapital',\n  /** Art. 5(1)(d), where the operator is registered. */\n  TRADE_REGISTER = 'tradeRegister',\n  /** Art. 5(1)(g), where the activity is subject to VAT. */\n  VAT_IDENTIFICATION_NUMBER = 'vatIdentificationNumber',\n  /** § 5 Abs. 1 Nr. 6 DDG, where the operator has a Wirtschafts-Identifikationsnummer. */\n  ECONOMIC_IDENTIFICATION_NUMBER = 'economicIdentificationNumber',\n  /** Art. 5(1)(e), where the activity needs an authorisation. */\n  SUPERVISORY_AUTHORITY = 'supervisoryAuthority',\n  /** Art. 5(1)(f), where the service is provided in a regulated profession. */\n  REGULATED_PROFESSION = 'regulatedProfession',\n  /** § 5 Abs. 1 Nr. 7 DDG, for a company being wound up. */\n  IN_LIQUIDATION = 'inLiquidation',\n}\n\n/**\n * The particulars EVERY established provider owes: name, address, contact. The others apply only to some operators (a\n * legal person, a registered one, one subject to VAT or to an authorisation), which nothing in the configuration can\n * decide for the operator, so they are reported as `toConfirm` rather than as owed. The legal-notice page reads this\n * list to decide which particulars it marks \"not yet declared\", so the page and the launch list cannot disagree.\n */\nexport const LEGAL_NOTICE_ALWAYS_OWED_PARTICULARS: readonly LegalNoticeParticular[] = Object.freeze([\n  LegalNoticeParticular.LEGAL_ENTITY_NAME,\n  LegalNoticeParticular.REGISTERED_ADDRESS,\n  LegalNoticeParticular.GENERAL_CONTACT,\n]);\n\n/**\n * What a legal notice still lacks: `owed` (always required, undeclared) and `toConfirm` (required where it applies,\n * undeclared). Both empty when the notice is not owed. A page renders an undeclared particular as MARKED, never omitted\n * and never invented: the duty exists whether or not the operator has filled the field.\n */\nexport function outstandingLegalNoticeParticulars(\n  identity: ApplicationOperatorComplianceIdentity | undefined,\n): { readonly owed: readonly LegalNoticeParticular[]; readonly toConfirm: readonly LegalNoticeParticular[] } {\n  if (legalNoticeOwed(identity) !== true) return { owed: [], toConfirm: [] };\n  const declared = (particular: LegalNoticeParticular) => identity?.[particular] !== undefined;\n  const all = Object.values(LegalNoticeParticular);\n  return {\n    owed: LEGAL_NOTICE_ALWAYS_OWED_PARTICULARS.filter((particular) => !declared(particular)),\n    toConfirm: all.filter((particular) => !LEGAL_NOTICE_ALWAYS_OWED_PARTICULARS.includes(particular) && !declared(particular)),\n  };\n}\n\n/**\n * Where `wildo config legal-notice` writes the projected notice in an application, and where `saas-config.backend.ts`\n * imports it from. One constant for the generator, the validate domain and the launch list, which reports an owed\n * notice whose module is absent: the running application would then say no notice is required.\n */\nexport const LEGAL_NOTICE_GENERATED_RELATIVE_PATH = 'backend-api/src/legal-notice.generated.ts';\n\nconst identityShape = ApplicationOperatorComplianceIdentitySchema.shape;\n\n/**\n * The legal notice an application SERVES, carried in its runtime configuration as `compliance.legalNotice` (#2588).\n *\n * Exactly the particulars a notice states, taken from the identity's own field schemas so there is one definition of\n * each, and nothing else: the lawful bases, role allocations and the rest of the identity are not a legal notice and do\n * not reach the unauthenticated page. Every particular is optional, because an undeclared one is MARKED on the page as\n * \"not yet declared\" rather than omitted: the duty exists whether or not the operator has filled the field.\n *\n * Written by `wildo config legal-notice` from `operatorComplianceIdentity`, only when the notice is owed\n * (`legalNoticeOwed`); an application that owes none carries no `legalNotice`, and its page says so.\n */\nexport const LegalNoticeSchema = z.strictObject({\n  establishmentJurisdiction: identityShape.establishmentJurisdiction,\n  legalEntityName: identityShape.legalEntityName,\n  registeredAddress: identityShape.registeredAddress,\n  legalForm: identityShape.legalForm,\n  authorizedRepresentatives: identityShape.authorizedRepresentatives,\n  shareCapital: identityShape.shareCapital,\n  generalContact: identityShape.generalContact,\n  tradeRegister: identityShape.tradeRegister,\n  vatIdentificationNumber: identityShape.vatIdentificationNumber,\n  economicIdentificationNumber: identityShape.economicIdentificationNumber,\n  supervisoryAuthority: identityShape.supervisoryAuthority,\n  regulatedProfession: identityShape.regulatedProfession,\n  inLiquidation: identityShape.inLiquidation,\n});\nexport type LegalNotice = z.infer<typeof LegalNoticeSchema>;\n\n/**\n * The legal notice to serve, projected from the operator's identity: `undefined` when none is owed (or when the\n * establishment is undeclared, so it cannot be known to be owed), the declared particulars otherwise.\n */\nexport function projectLegalNotice(identity: ApplicationOperatorComplianceIdentity | undefined): LegalNotice | undefined {\n  if (identity === undefined || legalNoticeOwed(identity) !== true) return undefined;\n  const notice: Record<string, unknown> = {};\n  for (const key of Object.keys(LegalNoticeSchema.shape) as (keyof LegalNotice)[]) {\n    if (identity[key] !== undefined) notice[key] = identity[key];\n  }\n  return LegalNoticeSchema.parse(notice);\n}\n\n"]}

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.d.ts

@@ -11,7 +11,7 @@ import { z } from 'zod';
  * ## A suffix under an AGGREGATE root is refused, and that is the third check
  *
  * The suffix means ONE thing — a place INSIDE the root — because that is the only thing
- * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source
+ * `jurisdictionReachCovers` (`jurisdiction-containment.shared.ts`) can read it as: `declared.startsWith(`${reach}-`)` says a source
  * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`
  * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the
  * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only
@@ -92,30 +92,4 @@ export declare const ApplicationOperatingJurisdictionsSchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;
-/**
- * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.
- *
- * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source
- * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the
- * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and
- * that rule is applied in code rather than enumerated here.
- *
- * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand
- * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —
- * because a suffix can only be read as a place inside its root, and on an aggregate that reading
- * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the
- * intended consequence: the places a regime covers each have their own code.
- *
- * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a
- * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.
- * Nothing derives it, so a change is a deliberate edit here.
- */
-export declare const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>>;
-/**
- * Does a source addressing `reach` answer for an application operating in `declared`?
- *
- * Three ways, and the order is deliberate — exact first, because it is the common case and the other
- * two are refinements of it.
- */
-export declare function jurisdictionReachCovers(reach: string, declared: string): boolean;
 //# sourceMappingURL=operating-jurisdictions.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operating-jurisdictions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBnE;AAED,eAAO,MAAM,sBAAsB,aAQ/B,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAE1D,gHAAgH;AAChH,oBAAY,2BAA2B;IACrC,+GAA+G;IAC/G,SAAS,cAAc;IACvB,iEAAiE;IACjE,IAAI,SAAS;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CASjF;AAED,uGAAuG;AACvG,eAAO,MAAM,qBAAqB,aAQ9B,CAAC;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;IAEtC,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC;;;QAhBlD,+GAA+G;;;kBAgC7G,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAK/E,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAShF"}
+{"version":3,"file":"operating-jurisdictions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBnE;AAED,eAAO,MAAM,sBAAsB,aAQ/B,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAE1D,gHAAgH;AAChH,oBAAY,2BAA2B;IACrC,+GAA+G;IAC/G,SAAS,cAAc;IACvB,iEAAiE;IACjE,IAAI,SAAS;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CASjF;AAED,uGAAuG;AACvG,eAAO,MAAM,qBAAqB,aAQ9B,CAAC;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;IAEtC,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC;;;QAhBlD,+GAA+G;;;kBAgC7G,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC"}

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { JURISDICTION_CONTAINMENT } from './jurisdiction-containment.shared.js';
 /**
  * WHERE this application operates, as the one source every compliance surface reads (issue #229).
  *
@@ -75,7 +76,7 @@ function canonicalRegionSubtag(subtag) {
  * ## A suffix under an AGGREGATE root is refused, and that is the third check
  *
  * The suffix means ONE thing — a place INSIDE the root — because that is the only thing
- * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source
+ * `jurisdictionReachCovers` (`jurisdiction-containment.shared.ts`) can read it as: `declared.startsWith(`${reach}-`)` says a source
  * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`
  * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the
  * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only
@@ -202,44 +203,4 @@ export const ApplicationOperatingJurisdictionsSchema = z
         });
     }
 });
-/**
- * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.
- *
- * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source
- * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the
- * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and
- * that rule is applied in code rather than enumerated here.
- *
- * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand
- * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —
- * because a suffix can only be read as a place inside its root, and on an aggregate that reading
- * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the
- * intended consequence: the places a regime covers each have their own code.
- *
- * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a
- * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.
- * Nothing derives it, so a change is a deliberate edit here.
- */
-export const JURISDICTION_CONTAINMENT = Object.freeze({
-    eu: Object.freeze([
-        'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',
-        'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',
-    ]),
-});
-/**
- * Does a source addressing `reach` answer for an application operating in `declared`?
- *
- * Three ways, and the order is deliberate — exact first, because it is the common case and the other
- * two are refinements of it.
- */
-export function jurisdictionReachCovers(reach, declared) {
-    if (reach === declared)
-        return true;
-    // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.
-    // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix
-    // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.
-    if (declared.startsWith(`${reach}-`))
-        return true;
-    return (JURISDICTION_CONTAINMENT[reach] ?? []).some((member) => member === declared || declared.startsWith(`${member}-`));
-}
 //# sourceMappingURL=operating-jurisdictions.shared.schemas.js.map

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,wFAAwF;MACxF,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,CACL,IAAI,IAAI,mDAAmD,IAAI,oCAAoC;cACjG,IAAI,IAAI,8FAA8F;cACtG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,gHAAgH;IAChH,oHAAoH;IACpH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHERE this application operates, as the one source every compliance surface reads (issue #229).\n *\n * ## The hole this closes\n *\n * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n *\n * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n *\n * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n *\n * Keeping them siblings means each is answerable the day it is known.\n *\n * ## Why an open slug and not an enum\n *\n * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n *\n * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n */\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n  'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n  + 'optionally with a SUBDIVISION suffix such as \"us-ca\" — lowercase, because a slug that '\n  + 'differs only by case is a second identifier for one place';\n\n/**\n * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n *\n * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n *\n * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n *\n * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n */\nfunction canonicalRegionSubtag(subtag: string): string | null {\n  const requested = `und-${subtag.toUpperCase()}`;\n  try {\n    const [canonical] = Intl.getCanonicalLocales(requested);\n    return canonical === undefined ? null : canonical.slice('und-'.length);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n *\n * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n *\n * ## A suffix under an AGGREGATE root is refused, and that is the third check\n *\n * The suffix means ONE thing — a place INSIDE the root — because that is the only thing\n * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source\n * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`\n * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the\n * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only\n * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that\n * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in\n * a landed publication variant).\n *\n * A regime is not expressible in this grammar and does not need to be: the places it covers each\n * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with\n * no second kind of suffix for a future reader to have to tell apart.\n *\n * The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that\n * already declares \"this root stands for other jurisdictions\" and already carries the review trigger\n * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a\n * hand-kept list is the thing that rots. The forward reference is safe because the table is a module\n * constant and this function is only ever called after module evaluation.\n */\nexport function jurisdictionSlugProblem(slug: string): string | null {\n  if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n    return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n  }\n  const [root, suffix] = slug.split('-');\n  const canonical = canonicalRegionSubtag(root!);\n  if (canonical === null) {\n    return `\"${root}\" is not a well-formed region code`;\n  }\n  if (canonical.toLowerCase() !== root) {\n    return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n  }\n  if (suffix !== undefined && Object.hasOwn(JURISDICTION_CONTAINMENT, root!)) {\n    return (\n      `\"${root}\" stands for the jurisdictions it contains, so \"${slug}\" would be read as a place INSIDE `\n      + `\"${root}\" — and a suffix on an aggregate names a regime, which is normally wider than the aggregate `\n      + 'rather than narrower. Name the places explicitly instead (the EEA is \"eu\", \"is\", \"li\", \"no\")'\n    );\n  }\n  return null;\n}\n\nexport const JurisdictionSlugSchema = z\n  .string()\n  .trim()\n  .superRefine((slug, context) => {\n    const problem = jurisdictionSlugProblem(slug);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem });\n    }\n  });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/**\n * The namespace every jurisdiction REFERENCE carries.\n *\n * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n */\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */\nexport enum JurisdictionRefProblemScope {\n  /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */\n  NAMESPACE = 'NAMESPACE',\n  /** The namespace is right and the slug is not a jurisdiction. */\n  SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n  readonly scope: JurisdictionRefProblemScope;\n  readonly message: string;\n}\n\n/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem | null {\n  if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n    return {\n      scope: JurisdictionRefProblemScope.NAMESPACE,\n      message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n    };\n  }\n  const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n  return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */\nexport const JurisdictionRefSchema = z\n  .string()\n  .trim()\n  .superRefine((ref, context) => {\n    const problem = jurisdictionRefProblem(ref);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem.message });\n    }\n  });\n\n/**\n * One jurisdiction this application operates in, and why it reaches the product.\n *\n * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n *\n * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n */\nexport const OperatingJurisdictionSchema = z.strictObject({\n  jurisdictionSlug: JurisdictionSlugSchema,\n  /** Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". */\n  basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/**\n * The jurisdictions this application operates in.\n *\n * ## Absent is UNDECLARED, and an empty list is not offered\n *\n * The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n */\nexport const ApplicationOperatingJurisdictionsSchema = z\n  .strictObject({\n    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n  })\n  .superRefine((declaration, context) => {\n    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n    if (duplicates.length > 0) {\n      context.addIssue({\n        code: 'custom',\n        path: ['jurisdictions'],\n        message:\n          `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n          + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n      });\n    }\n  });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/**\n * Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n *\n * Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n *\n * This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand\n * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —\n * because a suffix can only be read as a place inside its root, and on an aggregate that reading\n * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the\n * intended consequence: the places a regime covers each have their own code.\n *\n * ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n */\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  eu: Object.freeze([\n    'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n    'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n  ]),\n});\n\n/**\n * Does a source addressing `reach` answer for an application operating in `declared`?\n *\n * Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n  if (reach === declared) return true;\n  // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n  // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix\n  // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.\n  if (declared.startsWith(`${reach}-`)) return true;\n  return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n    (member) => member === declared || declared.startsWith(`${member}-`),\n  );\n}\n"]}
+{"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,wFAAwF;MACxF,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,CACL,IAAI,IAAI,mDAAmD,IAAI,oCAAoC;cACjG,IAAI,IAAI,8FAA8F;cACtG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { JURISDICTION_CONTAINMENT } from './jurisdiction-containment.shared';\n\n/**\n * WHERE this application operates, as the one source every compliance surface reads (issue #229).\n *\n * ## The hole this closes\n *\n * Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n *\n * ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n *\n * Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n *\n * Keeping them siblings means each is answerable the day it is known.\n *\n * ## Why an open slug and not an enum\n *\n * A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n *\n * The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n */\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n  'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n  + 'optionally with a SUBDIVISION suffix such as \"us-ca\" — lowercase, because a slug that '\n  + 'differs only by case is a second identifier for one place';\n\n/**\n * The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n *\n * Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n *\n * A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n *\n * What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n */\nfunction canonicalRegionSubtag(subtag: string): string | null {\n  const requested = `und-${subtag.toUpperCase()}`;\n  try {\n    const [canonical] = Intl.getCanonicalLocales(requested);\n    return canonical === undefined ? null : canonical.slice('und-'.length);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n *\n * Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n *\n * ## A suffix under an AGGREGATE root is refused, and that is the third check\n *\n * The suffix means ONE thing — a place INSIDE the root — because that is the only thing\n * `jurisdictionReachCovers` (`jurisdiction-containment.shared.ts`) can read it as: `declared.startsWith(`${reach}-`)` says a source\n * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`\n * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the\n * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only\n * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that\n * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in\n * a landed publication variant).\n *\n * A regime is not expressible in this grammar and does not need to be: the places it covers each\n * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with\n * no second kind of suffix for a future reader to have to tell apart.\n *\n * The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that\n * already declares \"this root stands for other jurisdictions\" and already carries the review trigger\n * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a\n * hand-kept list is the thing that rots. The forward reference is safe because the table is a module\n * constant and this function is only ever called after module evaluation.\n */\nexport function jurisdictionSlugProblem(slug: string): string | null {\n  if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n    return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n  }\n  const [root, suffix] = slug.split('-');\n  const canonical = canonicalRegionSubtag(root!);\n  if (canonical === null) {\n    return `\"${root}\" is not a well-formed region code`;\n  }\n  if (canonical.toLowerCase() !== root) {\n    return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n  }\n  if (suffix !== undefined && Object.hasOwn(JURISDICTION_CONTAINMENT, root!)) {\n    return (\n      `\"${root}\" stands for the jurisdictions it contains, so \"${slug}\" would be read as a place INSIDE `\n      + `\"${root}\" — and a suffix on an aggregate names a regime, which is normally wider than the aggregate `\n      + 'rather than narrower. Name the places explicitly instead (the EEA is \"eu\", \"is\", \"li\", \"no\")'\n    );\n  }\n  return null;\n}\n\nexport const JurisdictionSlugSchema = z\n  .string()\n  .trim()\n  .superRefine((slug, context) => {\n    const problem = jurisdictionSlugProblem(slug);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem });\n    }\n  });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/**\n * The namespace every jurisdiction REFERENCE carries.\n *\n * A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n */\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/** Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. */\nexport enum JurisdictionRefProblemScope {\n  /** The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. */\n  NAMESPACE = 'NAMESPACE',\n  /** The namespace is right and the slug is not a jurisdiction. */\n  SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n  readonly scope: JurisdictionRefProblemScope;\n  readonly message: string;\n}\n\n/** What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. */\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem | null {\n  if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n    return {\n      scope: JurisdictionRefProblemScope.NAMESPACE,\n      message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n    };\n  }\n  const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n  return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/** `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. */\nexport const JurisdictionRefSchema = z\n  .string()\n  .trim()\n  .superRefine((ref, context) => {\n    const problem = jurisdictionRefProblem(ref);\n    if (problem !== null) {\n      context.addIssue({ code: 'custom', message: problem.message });\n    }\n  });\n\n/**\n * One jurisdiction this application operates in, and why it reaches the product.\n *\n * `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n *\n * It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n */\nexport const OperatingJurisdictionSchema = z.strictObject({\n  jurisdictionSlug: JurisdictionSlugSchema,\n  /** Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". */\n  basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/**\n * The jurisdictions this application operates in.\n *\n * ## Absent is UNDECLARED, and an empty list is not offered\n *\n * The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n */\nexport const ApplicationOperatingJurisdictionsSchema = z\n  .strictObject({\n    jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n  })\n  .superRefine((declaration, context) => {\n    const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n    const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n    if (duplicates.length > 0) {\n      context.addIssue({\n        code: 'custom',\n        path: ['jurisdictions'],\n        message:\n          `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n          + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n      });\n    }\n  });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n"]}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts

@@ -340,6 +340,57 @@ export declare const ApplicationOperatorComplianceIdentitySchema: z.ZodObject<{
      * Absent means undecided, never "hosted nowhere".
      */
     hostingRegions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * Where the operator is ESTABLISHED: the jurisdiction slug of the fixed establishment it pursues its activity from
+     * (`fr`, `de`, `us-ca`). Structured because `registeredAddress` is prose a function cannot read, and establishment,
+     * not the markets served, is what decides which country's information duty applies (§ 3 DDG, country of origin).
+     */
+    establishmentJurisdiction: z.ZodOptional<z.ZodString>;
+    /** The legal form of a legal person (`SAS`, `GmbH`, `Ltd`). § 5 Abs. 1 Nr. 1 DDG. */
+    legalForm: z.ZodOptional<z.ZodString>;
+    /** The persons authorised to represent a legal person (managing directors, président). § 5 Abs. 1 Nr. 1 DDG. */
+    authorizedRepresentatives: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * The company's share capital, in the operator's own words (`25 000 EUR`), and the total of the cash contributions not
+     * yet paid in, when there are any. § 5 Abs. 1 Nr. 1 DDG asks for it only where the provider states its capital at all,
+     * so declare it only if you state it; absent means it is not stated.
+     */
+    shareCapital: z.ZodOptional<z.ZodObject<{
+        amount: z.ZodString;
+        outstandingContributions: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    /**
+     * How anyone reaches the operator rapidly and directly, including an e-mail address (Art. 5(1)(c)). Distinct from
+     * `privacyContact`, which is the route for data-subject matters and may be a form or a postal address.
+     */
+    generalContact: z.ZodOptional<z.ZodObject<{
+        email: z.ZodEmail;
+        phone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    /** The trade register the operator is entered in and its number (Art. 5(1)(d)). Absent when it is not registered. */
+    tradeRegister: z.ZodOptional<z.ZodObject<{
+        register: z.ZodString;
+        registrationNumber: z.ZodString;
+    }, z.core.$strict>>;
+    /** The VAT identification number, where the activity is subject to VAT (Art. 5(1)(g)). */
+    vatIdentificationNumber: z.ZodOptional<z.ZodString>;
+    /** Germany's economic identification number (Wirtschafts-Identifikationsnummer), where the operator has one. § 5 Abs. 1 Nr. 6 DDG. */
+    economicIdentificationNumber: z.ZodOptional<z.ZodString>;
+    /** The supervisory authority, where the activity needs an authorisation (Art. 5(1)(e)). */
+    supervisoryAuthority: z.ZodOptional<z.ZodString>;
+    /** The particulars of a regulated profession the service is provided in (Art. 5(1)(f)). */
+    regulatedProfession: z.ZodOptional<z.ZodObject<{
+        professionalBody: z.ZodString;
+        professionalTitle: z.ZodString;
+        titleGrantedIn: z.ZodString;
+        professionalRules: z.ZodString;
+    }, z.core.$strict>>;
+    /**
+     * `true` while the company is being wound up (in Abwicklung or Liquidation). § 5 Abs. 1 Nr. 7 DDG requires a stock
+     * corporation, a KGaA or a GmbH in that state to say so. Only `true` is accepted: "not in liquidation" is the absence
+     * of this field, and a second spelling of it (`false`) would be a value that states nothing.
+     */
+    inLiquidation: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 export type ApplicationOperatorComplianceIdentity = z.infer<typeof ApplicationOperatorComplianceIdentitySchema>;
 /**

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAG3D;;;;;;;;;;GAUG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;IAGpG;;;;;OAKG;;kBAEH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;IAE1G;;;;;;;;OAQG;;;IAGH;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;;;;OASG;;IAEH;;;;;;OAMG;;kBA2BH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QA/NH,oGAAoG;;;QAGpG;;;;;WAKG;;;IAyNH;;;;;;OAMG;;QApNH,0GAA0G;;QAE1G;;;;;;;;WAQG;;;QAGH;;;WAGG;;;IAgNH;;;;;;OAMG;;QAjJH;;;;;;;;;WASG;;QAEH;;;;;;WAMG;;;IAkIH;;;;;;;;;OASG;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;;kBAsBH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;IAC5B,qCAAqC,uCAAuC;IAC5E,kIAAkI;IAClI,eAAe,mBAAmB;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAU3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}
+{"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAI3D;;;;;;;;;;GAUG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;IAGpG;;;;;OAKG;;kBAEH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;IAE1G;;;;;;;;OAQG;;;IAGH;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;;;;OASG;;IAEH;;;;;;OAMG;;kBA2BH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QA/NH,oGAAoG;;;QAGpG;;;;;WAKG;;;IAyNH;;;;;;OAMG;;QApNH,0GAA0G;;QAE1G;;;;;;;;WAQG;;;QAGH;;;WAGG;;;IAgNH;;;;;;OAMG;;QAjJH;;;;;;;;;WASG;;QAEH;;;;;;WAMG;;;IAkIH;;;;;;;;;OASG;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;;IAeH;;;;OAIG;;IAEH,qFAAqF;;IAErF,gHAAgH;;IAEhH;;;;OAIG;;;;;IAKH;;;OAGG;;;;;IAKH,qHAAqH;;;;;IAKrH,0FAA0F;;IAE1F,sIAAsI;;IAEtI,2FAA2F;;IAE3F,2FAA2F;;;;;;;IAO3F;;;;OAIG;;kBAsBH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;IAC5B,qCAAqC,uCAAuC;IAC5E,kIAAkI;IAClI,eAAe,mBAAmB;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAU3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { ConsentPurpose } from './consent-purposes.shared.js';
 import { LawfulBasisPurposeRefSchema } from './purpose-ref.shared.schemas.js';
+import { JurisdictionSlugSchema } from './operating-jurisdictions.shared.schemas.js';
 /**
  * GDPR Art. 6(1) — the six lawful bases, closed by the article.
  *
@@ -340,6 +341,70 @@ export const ApplicationOperatorComplianceIdentitySchema = z.strictObject({
      * Absent means undecided, never "hosted nowhere".
      */
     hostingRegions: z.array(z.string().trim().min(1)).min(1).optional(),
+    /*
+     * ## The legal-notice (imprint) particulars (#2588)
+     *
+     * An information-society service provider ESTABLISHED in the EU or EEA must keep its identity "easily, directly and
+     * permanently accessible" (Directive 2000/31/EC Art. 5(1), transposed in every member state; the UK imposes the same
+     * particulars under SI 2002/2013 reg. 6(1), and Switzerland the core of them under UWG Art. 3 Abs. 1 Bst. s; Germany's § 5 Abs. 1 DDG
+     * adds the legal form and the person authorised to represent a legal person). Each field below answers one item of
+     * those lists, named after it, so the legal notice is a projection of declarations and never a drafted text.
+     * spec-cite: Directive 2000/31/EC Art. 2(c), Art. 5(1); § 5 Abs. 1 DDG; EEA Joint Committee Decision 091/2000; SI 2002/2013 reg. 6(1); UWG (SR 241) Art. 3 Abs. 1 Bst. s
+     *
+     * All optional, like every part above: absent means undeclared. Which are OWED is derived (`legal-notice-obligation.shared.ts` decides whether a notice is owed, `legal-notice.shared.ts` which particulars):
+     * only for an operator established where the duty applies, and the "where applicable" items only when they apply.
+     */
+    /**
+     * Where the operator is ESTABLISHED: the jurisdiction slug of the fixed establishment it pursues its activity from
+     * (`fr`, `de`, `us-ca`). Structured because `registeredAddress` is prose a function cannot read, and establishment,
+     * not the markets served, is what decides which country's information duty applies (§ 3 DDG, country of origin).
+     */
+    establishmentJurisdiction: JurisdictionSlugSchema.optional(),
+    /** The legal form of a legal person (`SAS`, `GmbH`, `Ltd`). § 5 Abs. 1 Nr. 1 DDG. */
+    legalForm: z.string().trim().min(1).optional(),
+    /** The persons authorised to represent a legal person (managing directors, président). § 5 Abs. 1 Nr. 1 DDG. */
+    authorizedRepresentatives: z.array(z.string().trim().min(1)).min(1).optional(),
+    /**
+     * The company's share capital, in the operator's own words (`25 000 EUR`), and the total of the cash contributions not
+     * yet paid in, when there are any. § 5 Abs. 1 Nr. 1 DDG asks for it only where the provider states its capital at all,
+     * so declare it only if you state it; absent means it is not stated.
+     */
+    shareCapital: z.strictObject({
+        amount: z.string().trim().min(1),
+        outstandingContributions: z.string().trim().min(1).optional(),
+    }).optional(),
+    /**
+     * How anyone reaches the operator rapidly and directly, including an e-mail address (Art. 5(1)(c)). Distinct from
+     * `privacyContact`, which is the route for data-subject matters and may be a form or a postal address.
+     */
+    generalContact: z.strictObject({
+        email: z.email(),
+        phone: z.string().trim().min(1).optional(),
+    }).optional(),
+    /** The trade register the operator is entered in and its number (Art. 5(1)(d)). Absent when it is not registered. */
+    tradeRegister: z.strictObject({
+        register: z.string().trim().min(1),
+        registrationNumber: z.string().trim().min(1),
+    }).optional(),
+    /** The VAT identification number, where the activity is subject to VAT (Art. 5(1)(g)). */
+    vatIdentificationNumber: z.string().trim().min(1).optional(),
+    /** Germany's economic identification number (Wirtschafts-Identifikationsnummer), where the operator has one. § 5 Abs. 1 Nr. 6 DDG. */
+    economicIdentificationNumber: z.string().trim().min(1).optional(),
+    /** The supervisory authority, where the activity needs an authorisation (Art. 5(1)(e)). */
+    supervisoryAuthority: z.string().trim().min(1).optional(),
+    /** The particulars of a regulated profession the service is provided in (Art. 5(1)(f)). */
+    regulatedProfession: z.strictObject({
+        professionalBody: z.string().trim().min(1),
+        professionalTitle: z.string().trim().min(1),
+        titleGrantedIn: z.string().trim().min(1),
+        professionalRules: z.string().trim().min(1),
+    }).optional(),
+    /**
+     * `true` while the company is being wound up (in Abwicklung or Liquidation). § 5 Abs. 1 Nr. 7 DDG requires a stock
+     * corporation, a KGaA or a GmbH in that state to say so. Only `true` is accepted: "not in liquidation" is the absence
+     * of this field, and a second spelling of it (`false`) would be a value that states nothing.
+     */
+    inLiquidation: z.literal(true).optional(),
 }).superRefine((identity, context) => {
     /*
      * A declaration with nothing in it is a no-op that reads as an answer.