@wildo-ai/saas-models 1.1.9 → 1.1.10

package/dist/esm/compliance/privacy/subject-export.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-export.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAI/E,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,uDAA+B,CAAA;IAE/B;;;;OAIG;IACH,iEAAyC,CAAA;AAC3C,CAAC,EAdW,oBAAoB,KAApB,oBAAoB,QAc/B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,yBAqBX;AArBD,WAAY,yBAAyB;IACnC;;;OAGG;IACH,kEAAqC,CAAA;IAErC;;;;OAIG;IACH,kDAAqB,CAAA;IAErB;;;;;OAKG;IACH,gDAAmB,CAAA;AACrB,CAAC,EArBW,yBAAyB,KAAzB,yBAAyB,QAqBpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAN,IAAY,4BAuDX;AAvDD,WAAY,4BAA4B;IACtC;;;;OAIG;IACH,iEAAiC,CAAA;IAEjC;;;;;;;;;OASG;IACH,2FAA2D,CAAA;IAE3D;;;;OAIG;IACH,uFAAuD,CAAA;IAEvD;;;;;;;OAOG;IACH,+FAA+D,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,qFAAqD,CAAA;AACvD,CAAC,EAvDW,4BAA4B,KAA5B,4BAA4B,QAuDvC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sCAAsC,CACpD,WAAyC;IAEzC,OAAO,WAAW,KAAK,4BAA4B,CAAC,cAAc;WAC7D,WAAW,KAAK,4BAA4B,CAAC,2BAA2B,CAAC;AAChF,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,YAAkC,EAClC,OAA6B;IAE7B,MAAM,mBAAmB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACvE,MAAM,QAAQ,GAAG,CACf,WAAyC,EACzC,MAAc,EACmB,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAErF,6FAA6F;IAC7F,2CAA2C;IAC3C,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,4BAA4B,CAAC,cAAc,EAC3C,2FAA2F;cACvF,mCAAmC,CACxC,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACjG,MAAM,wBAAwB,GAAG,gBAAgB,KAAK,YAAY,CAAC,aAAa,CAAC;IAEjF,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,0BAA0B,cAAc,qDAAqD;cACzF,sFAAsF,CAC3F,CAAC;IACJ,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,2BAA2B,EACxD,0BAA0B,cAAc,8CAA8C;kBAClF,qFAAqF;kBACrF,sCAAsC,CAC3C,CAAC;QAEJ,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,QAAQ,CACb,4BAA4B,CAAC,6BAA6B,EAC1D,0BAA0B,cAAc,8CAA8C;kBAClF,sFAAsF;kBACtF,gFAAgF,CACrF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,wFAAwF;YACxF,yEAAyE;YACzE,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,iEAAiE;kBAC7D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAuBD;;;;;;;;GAQG;AACH,MAAM,UAAU,4CAA4C,CAC1D,mBAAiC,EACjC,aAA+C,EAC/C,OAA6B;IAE7B,MAAM,qBAAqB,GAAG;QAC5B,GAAG,aAAa,CAAC,kBAAkB;QACnC,GAAG,aAAa,CAAC,mBAAmB;QACpC,GAAG,aAAa,CAAC,iBAAiB;KACnC,CAAC;IACF,OAAO,qBAAqB;SACzB,GAAG,CAAC,CAAC,YAAY,EAAsC,EAAE;QACxD,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,CAAC,mBAAmB,CAAC,2BAA2B;kBAC/F,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,sBAAsB,GAAG,YAAY,CAAC,aAAa,KAAK,mBAAmB;YAC/E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,GAAG,YAAY;gBACf,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,YAAY,EAAE,YAAY,CAAC,YAAY;aACxC,CAAC;QACN,OAAO;YACL,YAAY;YACZ,sBAAsB;YACtB,cAAc,EAAE,gCAAgC,CAAC,sBAAsB,EAAE,OAAO,CAAC;SAClF,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE,qCAAqC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5I,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qCAAqC,CAAC,SAA6C;IACjG,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC;IACtD,OAAO;QACL,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,MAAM;QACnB,YAAY,CAAC,eAAe,IAAI,EAAE;QAClC,SAAS,CAAC,cAAc,CAAC,WAAW;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC,gDAAgD;IAChD,gDAAqB,CAAA;IAErB;;;OAGG;IACH,gEAAqC,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,oDAAyB,CAAA;AAC3B,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AAED,uFAAuF;AACvF,MAAM,UAAU,iCAAiC,CAAC,KAA8B;IAC9E,OAAO,KAAK,KAAK,uBAAuB,CAAC,UAAU,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAiD,EACjD,OAA6B;IAE7B,QAAQ,OAAO,EAAE,CAAC;QAChB,gGAAgG;QAChG,iFAAiF;QACjF,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,uFAAuF;YACvF,iDAAiD;YACjD,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,+DAA+D;kBAC3D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CACnC,UAAiD;IAEjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,uBAAuB,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,QAAQ,UAAU,EAAE,CAAC;QACnB,+FAA+F;QAC/F,+FAA+F;QAC/F,kBAAkB;QAClB,KAAK,yBAAyB,CAAC,gBAAgB,CAAC;QAChD,KAAK,yBAAyB,CAAC,QAAQ;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,yBAAyB,CAAC,OAAO;YACpC,OAAO,uBAAuB,CAAC,gBAAgB,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,MAAM,0BAA0B,GAAU,UAAU,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,yDAAyD;kBACrD,IAAI,MAAM,CAAC,0BAA0B,CAAC,GAAG,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAyB;IACxE,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,yFAAyF;IACzF,8DAA8D;IAC9D,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,sGAAsG;AACtG,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0CAA0C,CACxD,WAAyB,EACzB,yBAAgE,EAChE,YAAoB;IAEpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,IAAI,YAAY,4BAA4B,QAAQ,wCAAwC;cACxF,2BAA2B,CAAC,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;cAC5F,uFAAuF;cACvF,+CAA+C,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,QAAqC,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,0EAAuC,CAAA;IACvC,wEAAqC,CAAA;IACrC,wFAAqD,CAAA;IACrD,4DAAyB,CAAA;IACzB,8DAA2B,CAAA;AAC7B,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAWD,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,MAAe;IAC5E,IAAI,OAAO,GAAQ,MAAM,CAAC;IAC1B,KAAK,IAAI,WAAW,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,GAAG,8BAA8B,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC;QACpG,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,KAAgC,CAAC;QACxG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,MAAM,SAAS,GAAG,8CAA8C,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAiC,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,aAAqB,EAAE,KAAa,EAAQ,EAAE;QAC3F,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,SAAS,EAAE,CAAC;YAChD,IAAI,KAAK,IAAI,8BAA8B,EAAE,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,uBAAuB,CAAC,UAAU;oBACzC,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,WAAW;iBACnD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,gCAAgC,CAAC,WAA2B,CAAC,EAAE,CAAC;gBAClE,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,wBAAwB;iBAChE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,8CAA8C,CAAC,WAAW,CAAC,CAAC;YAChF,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAA2B,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,0CAA0C,CAAC,WAA2B,EAAE,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAC7H,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;gBAChE,UAAU,EAAE,UAAU,IAAI,IAAI;gBAC9B,KAAK,EAAE,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,+BAA+B,CAAC,iBAAiB;oBACnD,CAAC,CAAC,UAAU,KAAK,SAAS;wBACxB,CAAC,CAAC,+BAA+B,CAAC,gBAAgB;wBAClD,CAAC,CAAC,+BAA+B,CAAC,UAAU;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import type { z } from 'zod';\nimport { getPortabilityProvenance } from '@wildo-ai/zod-decorators';\nimport { isNonDisclosableFieldValue } from '../../resources/utils/field-value-disclosure.utils';\nimport {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\nimport type { SubjectDataRecipientsStatement } from './subject-data-recipients.shared.schemas';\n\nconst compareCanonicalText = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\n\n/**\n * WHICH data-subject right an export is answering.\n *\n * ## Why this is an enum and not a boolean flag on one bundle\n *\n * GDPR Art. 15 (right of access) and Art. 20 (right to data portability) are DIFFERENT rights over\n * DIFFERENT data, and conflating them is the defect this capability was built to correct: the four\n * routed export operations removed on 2026-08-01 declared themselves \"portability / GDPR\" while\n * their actual options (`includeActivityData`, `includeOrganizationData`) described an *access*\n * bundle. One output with a flag would reproduce that merge.\n *\n * - **Access** is a disclosure obligation: everything the controller holds *concerning* the subject,\n *   including data the controller itself derived about them, in any readable form.\n * - **Portability** is a transfer obligation: only the data the subject *provided* — actively, or by\n *   using the service — and it must be machine-readable and re-importable elsewhere. Data the\n *   controller inferred is deliberately OUT of scope; a competitor must not receive a rival's\n *   analytics through a subject's portability request.\n *\n * The two therefore diverge at BOTH levels this module classifies: per-edge (see\n * {@link classifySubjectExportDisposition}) and per-field (see\n * {@link resolveSubjectExportFieldScope}).\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n */\nexport enum SubjectExportPurpose {\n  /**\n   * Art. 15 — right of access. The broadest bundle: every row concerning the subject, whoever\n   * produced it, including rows the subject does not own (an audit log about them, a membership an\n   * administrator created).\n   */\n  ACCESS_ART_15 = 'access_art_15',\n\n  /**\n   * Art. 20 — right to data portability. Narrower on purpose: only data the subject supplied or\n   * generated by using the service, and only from rows the subject owns. Controller-derived data is\n   * excluded by {@link DataPortabilityProvenance.DERIVED}.\n   */\n  PORTABILITY_ART_20 = 'portability_art_20',\n}\n\n/**\n * WHERE one field's value came from — the axis that decides Art. 20 scope.\n *\n * ## Why three values and not `isSubjectProvided: boolean`\n *\n * EDPB/WP29 guidance splits \"provided by the data subject\" into data supplied *knowingly* and data\n * *observed* from the subject's use of the service, and puts BOTH in Art. 20 scope while excluding\n * data the controller *inferred*. A boolean forces `OBSERVED` to be mis-filed against whichever\n * side the author guesses — and it is the member most often got wrong, because \"the user did not\n * type it\" reads as \"the user did not provide it\", which is precisely the wrong conclusion.\n *\n * ## Why this is per-FIELD and not per-resource\n *\n * A single row routinely mixes the two: a user profile holds `firstName` (supplied) beside a\n * controller-computed status or score. A resource-level answer would have to round one way for the\n * whole row. The resource-level declaration exists only as a DEFAULT\n * (`portabilityPolicy.defaultProvenance`) so that annotating a resource stays a one-line cost; the\n * per-field decorator overrides it where a field differs.\n *\n * ⚠️ NOT a redaction or scrub concept. This says where a value CAME FROM, for a disclosure\n * decision. What happens to a value on ERASURE is `.impersonalizeWith()` / `RedactionType`, a\n * different axis entirely — a field can be `SUBJECT_PROVIDED` and also masked on erasure.\n */\nexport enum DataPortabilityProvenance {\n  /**\n   * The subject actively and knowingly supplied this value — form input, an uploaded file, a\n   * setting they chose. Unambiguously in scope for both rights.\n   */\n  SUBJECT_PROVIDED = 'subject_provided',\n\n  /**\n   * Generated by the subject's USE of the service rather than typed by them — activity timestamps,\n   * event history, usage counters, telemetry. **In scope for Art. 20**, which is the whole reason\n   * this member exists separately from {@link DERIVED}.\n   */\n  OBSERVED = 'observed',\n\n  /**\n   * Produced BY the controller about the subject — inferred classifications, computed scores,\n   * risk or segmentation labels, server-assigned lifecycle state. Disclosed under Art. 15 (the\n   * subject may see what we concluded about them) but **excluded from Art. 20** (a portability\n   * request is not a channel for exporting the controller's own analysis).\n   */\n  DERIVED = 'derived',\n}\n\n/**\n * What an export does with ONE child-direction edge of the subject.\n *\n * ## Why this is NOT `SubjectErasureDisposition`\n *\n * Erasure and export share a traversal and answer opposite questions — *what do I destroy?* versus\n * *what must I disclose?* — and they diverge on exactly the edges erasure calls `NOT_OWNED`.\n *\n * Erasure leaves audit logs, memberships and job executions alone, correctly: you do not delete an\n * audit log because a user exercised a right. But those same rows hold personal data CONCERNING the\n * subject, and Art. 15 covers \"all personal data concerning him or her\" — not \"rows he owns\".\n * Reusing erasure's vocabulary verbatim would have silently omitted the data an access request most\n * often targets. Hence {@link INCLUDED_REFERENCES_SUBJECT}, a case erasure has no use for.\n *\n * The two classifiers still read the SAME upstream authority for what an edge *says*\n * (`requireResolvedRelationshipSemantics`), so they can never disagree about ownership — only about\n * what to do with it.\n *\n * ## Why there is no blocking disposition here\n *\n * Erasure refuses up-front on `UNCLASSIFIED` / `UNSUPPORTED_DEFERRED` because it is about to\n * WRITE, cannot half-destroy a subject, and needs a teardown declaration nobody made. An export\n * writes nothing: ownership alone answers the edge question, a deferred teardown is irrelevant to a\n * read, and a cross-adapter dependent is merely a second query rather than a broken transaction.\n * The one genuine refusal in an export is field-level and Art. 20-only — see\n * {@link SubjectExportFieldScope.UNDECLARED}. Manufacturing an edge-level blocker for symmetry\n * would be false symmetry.\n */\nexport enum SubjectExportEdgeDisposition {\n  /**\n   * The subject OWNS this dependent (`lifecycleModelMode: DEPENDENT`), so its rows are the\n   * subject's own data. Included for both purposes — for Art. 20 the per-field provenance filter\n   * still applies to what comes back.\n   */\n  INCLUDED_OWNED = 'included_owned',\n\n  /**\n   * The subject does NOT own these rows, but they REFERENCE the subject — the far side carries a\n   * foreign key back to them (an audit log, an organization membership, a job execution).\n   *\n   * **Art. 15 only.** These are personal data concerning the subject, so an access request must\n   * disclose them. A portability request must not: the subject did not provide a row that a third\n   * party or the controller created about them, and shipping them would export the controller's\n   * operational records under a transfer right. For `PORTABILITY_ART_20` this same edge classifies\n   * as {@link EXCLUDED_NOT_SUBJECT_PROVIDED}.\n   */\n  INCLUDED_REFERENCES_SUBJECT = 'included_references_subject',\n\n  /**\n   * The edge carries no personal data of the subject at all: an independent or link-only\n   * relationship whose far side does not even reference them, or a disabled relationship that is\n   * not part of the live graph. Out of scope for both rights.\n   */\n  EXCLUDED_NOT_SUBJECT_DATA = 'excluded_not_subject_data',\n\n  /**\n   * In scope for access, but excluded from THIS export because the export is a portability request\n   * and the rows were not provided by the subject. Kept as its own member rather than collapsing\n   * into {@link EXCLUDED_NOT_SUBJECT_DATA}: a reviewer asking \"why is my audit trail missing from\n   * my portability export?\" needs \"because Art. 20 does not cover controller records\" and \"because\n   * that edge holds nothing about you\" to be different answers, and only the first is a legal\n   * position someone took.\n   */\n  EXCLUDED_NOT_SUBJECT_PROVIDED = 'excluded_not_subject_provided',\n\n  /**\n   * The rows ARE the subject's data and the right covers them, but the resource is declared\n   * `systemAccessPolicy.exportSubject = FORBIDDEN` — someone decided it must never reach a data\n   * subject (an authentication-credential store, a security audit trail).\n   *\n   * ## Why this excludes rather than refusing\n   *\n   * An UNDECLARED resource refuses the whole export, because nobody has decided yet and refusing is\n   * what forces the decision. A FORBIDDEN one is the opposite: the decision exists, and refusing\n   * would make it permanent sabotage — a `USERS` access export whose graph touches a credential\n   * store could then NEVER run, no matter how many other resources opted in. Honouring the\n   * declaration means leaving those rows out and saying so.\n   *\n   * ⚠️ This applies to EDGES only. A subject whose OWN resource is FORBIDDEN still refuses: there is\n   * no export of a person whose identity row may not be disclosed, and silently returning an\n   * edges-only bundle would be a disclosure that omits its own subject.\n   */\n  EXCLUDED_NOT_DISCLOSABLE = 'excluded_not_disclosable',\n}\n\n/** Whether an edge disposition puts the far side's rows INTO the bundle. */\nexport function isIncludedSubjectExportEdgeDisposition(\n  disposition: SubjectExportEdgeDisposition,\n): boolean {\n  return disposition === SubjectExportEdgeDisposition.INCLUDED_OWNED\n    || disposition === SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT;\n}\n\n/** The classification of ONE child-direction edge of an export subject. */\nexport interface SubjectExportEdgeClassification {\n  /** The related resource on the far side of the edge. */\n  relatedResourceType: ResourceType;\n  /** Whether, and why, this edge's rows join the bundle. */\n  disposition: SubjectExportEdgeDisposition;\n  /**\n   * Human-readable justification quoting the configuration that produced it. Surfaced in the export\n   * report so a data-protection reviewer never has to re-derive WHY a resource was included or\n   * left out — which, for a disclosure obligation, is the evidence that matters.\n   */\n  reason: string;\n}\n\n/**\n * Classify what an export must do with ONE child-direction edge — the disclose-vs-omit decision,\n * DERIVED FROM CONFIGURATION rather than a hardcoded list of resource types.\n *\n * ## Where the answer comes from\n *\n * Two declarations the author already makes, read through the same shared authorities the delete\n * cascade and the erasure orchestrator read, so the three can never disagree about what an edge is:\n *\n *  1. **`handling.lifecycleModelMode`** — does the subject own this related resource's lifecycle?\n *     `DEPENDENT` means the rows are the subject's own data.\n *  2. **Foreign-key topology** (`resolveForeignKeyHolderResourceType`, cardinality-only and\n *     therefore pure) — for a NON-owned edge, does the far side nonetheless carry a reference back\n *     to the subject? If it does, its rows are *about* the subject and Art. 15 must disclose them.\n *\n * ## The `purpose` parameter, and why it is a parameter\n *\n * Art. 15 and Art. 20 diverge on exactly one edge case — the referencing-but-not-owned edge — and\n * keeping that divergence in ONE switch here is what stops two near-identical classifiers from\n * drifting apart. Exposing `classifyForAccess` / `classifyForPortability` would duplicate the\n * ownership logic, and the day someone fixes a bug in one they would miss the other.\n *\n * ## Caller contract\n *\n * `relationship.resourceType2` MUST be the far side and `resourceType1` the subject — the same\n * child-direction normalization {@link classifySubjectErasureDisposition} requires. The caller\n * filters to child-direction edges before classifying.\n *\n * Pure and side-effect free — no registry lookups, no I/O, no row reads — so it is equally usable\n * from a runtime orchestrator and from a boot-time coherence guard.\n */\nexport function classifySubjectExportDisposition(\n  relationship: ResourceRelationship,\n  purpose: SubjectExportPurpose,\n): SubjectExportEdgeClassification {\n  const relatedResourceType = relationship.resourceType2 as ResourceType;\n  const classify = (\n    disposition: SubjectExportEdgeDisposition,\n    reason: string,\n  ): SubjectExportEdgeClassification => ({ relatedResourceType, disposition, reason });\n\n  // A disabled relationship is not part of the live graph — the runtime never traverses it, so\n  // there are no rows behind it to disclose.\n  if (relationship.isDisabled === true) {\n    return classify(\n      SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n      'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n    );\n  }\n\n  const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n  const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n  if (lifecycleModel === RelationshipLifecycleModel.DEPENDENT) {\n    return classify(\n      SubjectExportEdgeDisposition.INCLUDED_OWNED,\n      'lifecycleModelMode is DEPENDENT: the subject owns these rows, so they are the subject\\'s '\n        + 'own data and belong in the bundle',\n    );\n  }\n\n  // NOT owned from here on. The rows still count as personal data if they POINT AT the subject —\n  // which is the Art. 15 / Art. 20 fork.\n  const foreignKeyHolder = Resources_SharedUtils.resolveForeignKeyHolderResourceType(relationship);\n  const farSideReferencesSubject = foreignKeyHolder === relationship.resourceType2;\n\n  if (!farSideReferencesSubject) {\n    return classify(\n      SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n      `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT) and the far side does not hold a `\n        + 'foreign key to the subject, so these rows are neither owned by nor about the subject',\n    );\n  }\n\n  switch (purpose) {\n    case SubjectExportPurpose.ACCESS_ART_15:\n      return classify(\n        SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT,\n        `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT), but the far side holds a `\n          + 'foreign key to the subject, so these rows are personal data CONCERNING the subject '\n          + 'and Art. 15 requires disclosing them',\n      );\n\n    case SubjectExportPurpose.PORTABILITY_ART_20:\n      return classify(\n        SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_PROVIDED,\n        `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): these rows reference the `\n          + 'subject but were created by the controller or a third party rather than provided by '\n          + 'the subject, so Art. 20 does not cover them (they ARE disclosed under Art. 15)',\n      );\n\n    default: {\n      // Compile-time exhaustiveness: a new SubjectExportPurpose without an arm here is a TYPE\n      // error, not a silent runtime discovery on someone's disclosure request.\n      const _exhaustivePurposeCheck: never = purpose;\n      throw new Error(\n        `classifySubjectExportDisposition has no arm for export purpose `\n          + `'${String(_exhaustivePurposeCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * The three relationship buckets exposed by a compiled resource configuration.\n *\n * Kept structural here so the privacy compiler does not import resource configuration schemas:\n * those schemas already import this module for {@link DataPortabilityProvenance}.\n */\nexport interface SubjectExportRelationshipBuckets {\n  readonly parentRelationships: readonly ResourceRelationship[];\n  readonly childRelationships: readonly ResourceRelationship[];\n  readonly selfRelationships: readonly ResourceRelationship[];\n}\n\n/** One graph edge normalized so the export subject is always `resourceType1`. */\nexport interface SubjectExportRelationshipTraversal {\n  /** Original compiled relationship; runtime adapters use it to resolve the real FK field. */\n  readonly relationship: ResourceRelationship;\n  /** Direction-normalized relationship consumed by the shared legal-scope classifier. */\n  readonly normalizedRelationship: ResourceRelationship;\n  readonly classification: SubjectExportEdgeClassification;\n}\n\n/**\n * Enumerate every edge touching one export subject, including child-first reference declarations.\n *\n * Resource configurations deliberately preserve parent/child/self buckets. Subject disclosure is\n * different: personal data can point *to* the subject from either authored orientation. This helper\n * joins both directional buckets, includes self edges once, and swaps only the positional topology\n * needed by {@link classifySubjectExportDisposition}. It preserves the original compiled edge for\n * FK resolution and never collapses multiple foreign keys between the same resource pair.\n */\nexport function enumerateSubjectExportRelationshipTraversals(\n  subjectResourceType: ResourceType,\n  relationships: SubjectExportRelationshipBuckets,\n  purpose: SubjectExportPurpose,\n): SubjectExportRelationshipTraversal[] {\n  const touchingRelationships = [\n    ...relationships.childRelationships,\n    ...relationships.parentRelationships,\n    ...relationships.selfRelationships,\n  ];\n  return touchingRelationships\n    .map((relationship): SubjectExportRelationshipTraversal => {\n      if (relationship.resourceType1 !== subjectResourceType && relationship.resourceType2 !== subjectResourceType) {\n        throw new Error(\n          `Subject-export relationship traversal for ${String(subjectResourceType)} received unrelated edge `\n            + `${String(relationship.resourceType1)} -> ${String(relationship.resourceType2)}.`,\n        );\n      }\n      const normalizedRelationship = relationship.resourceType1 === subjectResourceType\n        ? relationship\n        : {\n            ...relationship,\n            resourceType1: relationship.resourceType2,\n            resourceType2: relationship.resourceType1,\n            cardinality1: relationship.cardinality2,\n            cardinality2: relationship.cardinality1,\n          };\n      return {\n        relationship,\n        normalizedRelationship,\n        classification: classifySubjectExportDisposition(normalizedRelationship, purpose),\n      };\n    })\n    .sort((left, right) => compareCanonicalText(subjectExportRelationshipTraversalKey(left), subjectExportRelationshipTraversalKey(right)));\n}\n\n/** Stable identity retaining distinct foreign keys between otherwise identical resource pairs. */\nexport function subjectExportRelationshipTraversalKey(traversal: SubjectExportRelationshipTraversal): string {\n  const relationship = traversal.normalizedRelationship;\n  return [\n    relationship.resourceType1,\n    relationship.resourceType2,\n    relationship.cardinality1,\n    relationship.cardinality2,\n    relationship.nature,\n    relationship.foreignKeyField ?? '',\n    traversal.classification.disposition,\n  ].join('\\0');\n}\n\n/**\n * Whether ONE field's value joins the bundle, for a given purpose.\n *\n * Separate from {@link SubjectExportEdgeDisposition} because the two answer different questions at\n * different granularities: an edge decides whether a RESOURCE's rows are in scope at all, a field\n * scope decides which COLUMNS of an in-scope row survive the Art. 20 narrowing.\n */\nexport enum SubjectExportFieldScope {\n  /** The field's value belongs in this bundle. */\n  INCLUDED = 'included',\n\n  /**\n   * Excluded because the value is controller-DERIVED and this is a portability request. Never\n   * reached for `ACCESS_ART_15`, which discloses derived data.\n   */\n  EXCLUDED_DERIVED = 'excluded_derived',\n\n  /**\n   * ⛔ NO ANSWER — the field carries no provenance declaration and none is inherited from its\n   * resource, while the export is a portability request that needs one.\n   *\n   * The export REFUSES rather than guessing, because both guesses are harmful and neither is the\n   * conservative one: excluding an undeclared field UNDER-DELIVERS a legal right the subject is\n   * owed, and including it OVER-SHARES data the controller derived. There is no safe default to\n   * fall back on, which is exactly the condition that justifies failing loud — the same reasoning\n   * that makes `SubjectErasureDisposition.UNCLASSIFIED` refuse an erasure.\n   *\n   * `ACCESS_ART_15` never produces this: access includes every field regardless of provenance, so\n   * an application can serve access requests before annotating anything.\n   */\n  UNDECLARED = 'undeclared',\n}\n\n/** Whether a field scope must ABORT the export rather than merely omitting a value. */\nexport function isBlockingSubjectExportFieldScope(scope: SubjectExportFieldScope): boolean {\n  return scope === SubjectExportFieldScope.UNDECLARED;\n}\n\n/**\n * Decide whether one field's value belongs in the bundle.\n *\n * `provenance` is the field's EFFECTIVE provenance — its own `.portabilityProvenance()` declaration\n * if it carries one, otherwise the resource's `portabilityPolicy.defaultProvenance`, otherwise\n * `undefined`. Resolving that fallback chain is the factory's job (Phase 0B); this function only\n * judges the resolved value, which keeps it pure and independently testable.\n */\nexport function resolveSubjectExportFieldScope(\n  provenance: DataPortabilityProvenance | undefined,\n  purpose: SubjectExportPurpose,\n): SubjectExportFieldScope {\n  switch (purpose) {\n    // Access discloses everything concerning the subject, so provenance is simply not a question it\n    // asks — an unannotated application can still answer an Art. 15 request in full.\n    case SubjectExportPurpose.ACCESS_ART_15:\n      return SubjectExportFieldScope.INCLUDED;\n\n    case SubjectExportPurpose.PORTABILITY_ART_20:\n      return resolvePortabilityFieldScope(provenance);\n\n    default: {\n      // Compile-time exhaustiveness on the PURPOSE axis too. Without this arm a third right added\n      // to the enum would silently inherit the portability narrowing — a disclosure boundary\n      // decided by fall-through rather than by anyone.\n      const _exhaustivePurposeCheck: never = purpose;\n      throw new Error(\n        `resolveSubjectExportFieldScope has no arm for export purpose `\n          + `'${String(_exhaustivePurposeCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * The Art. 20 narrowing, split out so {@link resolveSubjectExportFieldScope} can switch\n * exhaustively on `purpose` while this switches exhaustively on `provenance`. Module-private: the\n * purpose gate is not optional, and a caller reaching this directly would bypass it.\n */\nfunction resolvePortabilityFieldScope(\n  provenance: DataPortabilityProvenance | undefined,\n): SubjectExportFieldScope {\n  if (provenance === undefined) {\n    return SubjectExportFieldScope.UNDECLARED;\n  }\n\n  switch (provenance) {\n    // Both are \"provided by the data subject\" in the Art. 20 sense — OBSERVED is data generated by\n    // the subject's USE of the service, which the guidance places in scope even though the subject\n    // never typed it.\n    case DataPortabilityProvenance.SUBJECT_PROVIDED:\n    case DataPortabilityProvenance.OBSERVED:\n      return SubjectExportFieldScope.INCLUDED;\n\n    case DataPortabilityProvenance.DERIVED:\n      return SubjectExportFieldScope.EXCLUDED_DERIVED;\n\n    default: {\n      // Compile-time exhaustiveness: a new provenance member without an arm is a TYPE error here.\n      const _exhaustiveProvenanceCheck: never = provenance;\n      throw new Error(\n        `resolvePortabilityFieldScope has no arm for provenance `\n          + `'${String(_exhaustiveProvenanceCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * Is this field withheld from EVERY subject export, whatever right is being answered?\n *\n * ## Why this exists at all — the layering trap it closes\n *\n * The export orchestrator collects rows at the REPOSITORY layer, which sits BELOW the service-layer\n * DTO projection that normally strips `.isBackendOnly()` fields on their way to a client. Without an\n * explicit check here, a subject export would disclose exactly the values that projection exists to\n * hide — `passwordHash` and `backupCodesHashed` on `USER_CREDENTIALS` are the motivating case, and\n * the config change that exposed them would have looked entirely routine.\n *\n * ## Why it is deliberately CONSERVATIVE\n *\n * This withholds every backend-only field, not only the secrets. Some backend-only fields are\n * genuinely disclosable under Art. 15 (`passwordChangedAt`, `firstMfaPromptAt` — facts about the\n * subject they may ask for), so this errs toward withholding.\n *\n * That asymmetry is intentional. Under-disclosing produces a complaint that is answerable and\n * fixable; disclosing an authentication secret is neither, and it degrades the security of\n * processing the framework is separately obliged to maintain (GDPR Art. 32). Between an\n * over-cautious bundle and a leaked credential, only one is recoverable.\n *\n * The withheld fields are REPORTED (`SubjectExportReport.fieldsWithheldAsNonDisclosable`) so the\n * caution is visible rather than silent. When a resource needs a specific backend-only field\n * disclosed, the expressible extension is a per-field opt-in on this predicate — NOT loosening it\n * wholesale.\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n */\nexport function isFieldWithheldFromSubjectExport(fieldSchema: z.ZodTypeAny): boolean {\n  // Delegated to the ONE field-value disclosure rule rather than restated. The reasoning that used\n  // to sit here — that `isWriteOnlySecret` is checked explicitly rather than assumed to imply\n  // backend-only, because they are separate decorators and a future authoring form may set one\n  // without the other — moved WITH the rule, and is now the shared module's own justification.\n  //\n  // This function keeps its own name and its own assurance marker deliberately: subject export is a\n  // distinct obligation from model disclosure, its own docstring anticipates a per-field opt-in that\n  // would apply HERE and nowhere else, and merging the two names would make that extension\n  // unexpressible. What is shared is the rule, not the concept.\n  return isNonDisclosableFieldValue(fieldSchema);\n}\n\n/** Every legal {@link DataPortabilityProvenance} value, for validating an opaque decorator string. */\nconst KNOWN_PORTABILITY_PROVENANCES: ReadonlySet<string> = new Set(\n  Object.values(DataPortabilityProvenance),\n);\n\n/**\n * Resolve ONE field's EFFECTIVE provenance by joining the two declaration levels.\n *\n * ## The fallback chain, and why it has exactly two rungs\n *\n * 1. the field's own `.portabilityProvenance()` declaration, if it carries one;\n * 2. otherwise the resource's `portabilityPolicy.defaultProvenance`;\n * 3. otherwise `undefined` — which {@link resolveSubjectExportFieldScope} turns into a REFUSAL for\n *    an Art. 20 export and ignores entirely for Art. 15.\n *\n * Two rungs is what makes the fail-loud rule adoptable: without the resource default, every field of\n * every resource would need a decorator before a single portability request could be answered, and a\n * capability that expensive to adopt does not get adopted. With it, annotating a resource is one\n * line and only the exceptions carry a decorator.\n *\n * ## Why the enum check lives HERE\n *\n * `zod-decorators` sits below this package and cannot import {@link DataPortabilityProvenance}, so\n * it stores whatever non-empty string it was given — it can reject a BLANK but not a WRONG value.\n * This is the first layer that knows the vocabulary, so it is where a typo'd `'subject-provided'`\n * (hyphen, not underscore) must fail rather than silently resolving to `undefined` and turning a\n * declared field into a refusal — or worse, into a silent omission if the caller treats unknown as\n * derived. Mirrors how `RedactionType` validity is checked in this layer for `.impersonalizeWith()`.\n *\n * @param fieldSchema the field's Zod schema; the reader walks wrapper types, so a declaration made\n *   before or after `.optional()` / `.nullish()` / `.default()` is observed either way.\n * @param resourceDefaultProvenance the owning resource's `portabilityPolicy.defaultProvenance`.\n *   Taken as a bare value rather than the policy object so this module stays free of the\n *   resource-config import (which imports THIS module for the enum).\n * @param fieldLocator `resourceType.fieldName`, used only to make a rejection actionable.\n */\nexport function resolveEffectiveFieldPortabilityProvenance(\n  fieldSchema: z.ZodTypeAny,\n  resourceDefaultProvenance: DataPortabilityProvenance | undefined,\n  fieldLocator: string,\n): DataPortabilityProvenance | undefined {\n  const declared = getPortabilityProvenance(fieldSchema);\n\n  if (declared === undefined) {\n    return resourceDefaultProvenance;\n  }\n\n  if (!KNOWN_PORTABILITY_PROVENANCES.has(declared)) {\n    throw new Error(\n      `[${fieldLocator}] portabilityProvenance('${declared}') is not a DataPortabilityProvenance `\n        + `value. Expected one of: ${[...KNOWN_PORTABILITY_PROVENANCES].join(', ')}. An unrecognised `\n        + `value would resolve as UNDECLARED and make an Art. 20 export refuse, hiding the typo `\n        + `behind what looks like a deliberate omission.`,\n    );\n  }\n\n  return declared as DataPortabilityProvenance;\n}\n\n/** Why a compiled leaf-field decision has its effective export meaning. */\nexport enum SubjectExportFieldDecisionBasis {\n  FIELD_DECLARATION = 'field_declaration',\n  RESOURCE_DEFAULT = 'resource_default',\n  WITHHELD_NON_DISCLOSABLE = 'withheld_non_disclosable',\n  UNDECLARED = 'undeclared',\n  DEPTH_LIMIT = 'depth_limit',\n}\n\n/** Canonical, runtime-effective decision for one leaf path in one export purpose. */\nexport interface SubjectExportFieldDecision {\n  readonly locator: string;\n  readonly purpose: SubjectExportPurpose;\n  readonly scope: SubjectExportFieldScope | null;\n  readonly provenance: DataPortabilityProvenance | null;\n  readonly basis: SubjectExportFieldDecisionBasis;\n}\n\nconst SUBJECT_EXPORT_FIELD_MAX_DEPTH = 10;\n\n/**\n * Resolve an object shape through the same bounded wrapper protocol used by subject export.\n * Returning `undefined` means the value is a leaf. Reaching the bound is handled fail-closed by\n * {@link compileSubjectExportFieldDecisions}, never as an implicit leaf inclusion.\n */\nexport function resolveSubjectExportObjectShapeThroughWrappers(schema: unknown): Record<string, unknown> | undefined {\n  let current: any = schema;\n  for (let unwrapDepth = 0; current && unwrapDepth < SUBJECT_EXPORT_FIELD_MAX_DEPTH; unwrapDepth += 1) {\n    if (current.shape && typeof current.shape === 'object') return current.shape as Record<string, unknown>;\n    const inner = current.def?.innerType ?? current._def?.innerType;\n    if (!inner) return undefined;\n    current = inner;\n  }\n  return undefined;\n}\n\n/**\n * Compile every runtime-effective leaf-field decision for one resource and right.\n *\n * Both the backend executor and application authority proof consume this function. A field-level\n * decorator, inherited default, withheld marker, wrapper layout or depth refusal therefore changes\n * one shared decision inventory instead of two independently maintained interpretations.\n */\nexport function compileSubjectExportFieldDecisions(input: {\n  readonly resourceType: ResourceType;\n  readonly mainSchema: unknown;\n  readonly defaultProvenance: DataPortabilityProvenance | undefined;\n  readonly purpose: SubjectExportPurpose;\n}): SubjectExportFieldDecision[] {\n  const rootShape = resolveSubjectExportObjectShapeThroughWrappers(input.mainSchema);\n  if (!rootShape) return [];\n  const decisions: SubjectExportFieldDecision[] = [];\n\n  const visit = (shape: Record<string, unknown>, locatorPrefix: string, depth: number): void => {\n    for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n      const locator = `${locatorPrefix}.${fieldName}`;\n      if (depth >= SUBJECT_EXPORT_FIELD_MAX_DEPTH) {\n        decisions.push({\n          locator,\n          purpose: input.purpose,\n          scope: SubjectExportFieldScope.UNDECLARED,\n          provenance: null,\n          basis: SubjectExportFieldDecisionBasis.DEPTH_LIMIT,\n        });\n        continue;\n      }\n      if (isFieldWithheldFromSubjectExport(fieldSchema as z.ZodTypeAny)) {\n        decisions.push({\n          locator,\n          purpose: input.purpose,\n          scope: null,\n          provenance: null,\n          basis: SubjectExportFieldDecisionBasis.WITHHELD_NON_DISCLOSABLE,\n        });\n        continue;\n      }\n      const nestedShape = resolveSubjectExportObjectShapeThroughWrappers(fieldSchema);\n      if (nestedShape) {\n        visit(nestedShape, locator, depth + 1);\n        continue;\n      }\n      const declared = getPortabilityProvenance(fieldSchema as z.ZodTypeAny);\n      const provenance = resolveEffectiveFieldPortabilityProvenance(fieldSchema as z.ZodTypeAny, input.defaultProvenance, locator);\n      decisions.push({\n        locator,\n        purpose: input.purpose,\n        scope: resolveSubjectExportFieldScope(provenance, input.purpose),\n        provenance: provenance ?? null,\n        basis: declared !== undefined\n          ? SubjectExportFieldDecisionBasis.FIELD_DECLARATION\n          : provenance !== undefined\n            ? SubjectExportFieldDecisionBasis.RESOURCE_DEFAULT\n            : SubjectExportFieldDecisionBasis.UNDECLARED,\n      });\n    }\n  };\n\n  visit(rootShape, String(input.resourceType), 0);\n  return decisions.sort((left, right) => compareCanonicalText(left.locator, right.locator));\n}\n\n/** Per-edge outcome of an executed export — the classification plus what actually happened. */\nexport interface SubjectExportEdgeOutcome extends SubjectExportEdgeClassification {\n  /**\n   * `true` when the export actually queried this edge. Note this reports that the read RAN, not\n   * that rows existed — an included edge with no rows for this subject is a legitimate empty\n   * result, and {@link recordCount} distinguishes the two.\n   */\n  collected: boolean;\n  /** How many rows this edge contributed. `0` on an included edge means the subject had none. */\n  recordCount: number;\n}\n\n/**\n * What one subject export produced — the compliance artifact of an Art. 15 or Art. 20 request.\n *\n * Returned to the caller (rather than only logged) so the flow fronting the request can record or\n * surface it: every edge of the subject appears exactly once with the disposition applied and the\n * configuration that justified it. For a disclosure obligation, the record of what was DELIBERATELY\n * LEFT OUT — and on what legal basis — matters as much as the data returned.\n */\nexport interface SubjectExportReport {\n  /** Which right this export answered. */\n  purpose: SubjectExportPurpose;\n  /** The exported subject's resource type. */\n  subjectResourceType: ResourceType;\n  /** The exported subject rows. */\n  subjectIds: string[];\n  /** Every child-direction edge of the subject, classified, in registry order. */\n  edges: SubjectExportEdgeOutcome[];\n  /**\n   * Fields omitted from the bundle as controller-DERIVED, as `resourceType.fieldName`. Populated\n   * only for `PORTABILITY_ART_20`. Recorded rather than silently dropped so the subject can see\n   * that derived data exists and request it under Art. 15 instead.\n   */\n  fieldsExcludedAsDerived: string[];\n  /**\n   * Fields withheld as NON-DISCLOSABLE regardless of purpose — see\n   * {@link isFieldWithheldFromSubjectExport}. Populated for BOTH rights, because a password hash is\n   * no more disclosable under Art. 15 than under Art. 20.\n   *\n   * Recorded rather than silently dropped for the same reason as the derived list, and one more: a\n   * reviewer auditing why an export looks thin needs to see that the framework withheld something\n   * deliberately, not that a resource was missed.\n   */\n  fieldsWithheldAsNonDisclosable: string[];\n  /** Total rows across every collected edge, including the subject's own row(s). */\n  totalRecordCount: number;\n  /**\n   * The recipients this subject's personal data has been or will be disclosed to (Art. 15(1)(c), #1710): each with\n   * the legal identity the operator's register adopted and the categories its declared flow carries, selected by\n   * `selectSubjectDataRecipients` for the resources this export read. A recipient whose flow is not fully declared is\n   * listed as MAY_HAVE_RECEIVED, never left out; an application with no recipient declaration reads NOT_DECLARED.\n   * Vendor facts only — no personal data.\n   */\n  recipients: SubjectDataRecipientsStatement;\n}\n\n/** One resource's contribution to an export bundle. */\nexport interface SubjectExportResourceSlice {\n  resourceType: ResourceType;\n  /**\n   * The rows, already narrowed to the fields in scope for the export's purpose. For\n   * `PORTABILITY_ART_20` the controller-derived columns are gone; for `ACCESS_ART_15` every column\n   * the subject is entitled to see is present.\n   */\n  rows: Record<string, unknown>[];\n}\n\n/**\n * What an export ACTUALLY produced — the data, paired with the report that justifies its shape.\n *\n * ## Why the data and the report are one return value but two types\n *\n * {@link SubjectExportReport} is the compliance artifact: it survives the request, is safe to log\n * and persist, and contains NO personal data — only per-edge dispositions and counts. The slices\n * are the personal data itself, which must NOT be logged and whose lifetime ends when the artifact\n * is written.\n *\n * Returning them together keeps the caller from having to correlate two results, while the type\n * split keeps \"safe to record\" and \"must be handled carefully\" visibly distinct — a caller writing\n * `logger.info({ report })` is correct, and the same line with `bundle` would be a leak. Fusing\n * them into one flat object would erase exactly that distinction.\n */\nexport interface SubjectExportBundle {\n  report: SubjectExportReport;\n  slices: SubjectExportResourceSlice[];\n}\n"]}
+{"version":3,"file":"subject-export.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAI/E,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,uDAA+B,CAAA;IAE/B;;;;OAIG;IACH,iEAAyC,CAAA;AAC3C,CAAC,EAdW,oBAAoB,KAApB,oBAAoB,QAc/B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,yBAqBX;AArBD,WAAY,yBAAyB;IACnC;;;OAGG;IACH,kEAAqC,CAAA;IAErC;;;;OAIG;IACH,kDAAqB,CAAA;IAErB;;;;;OAKG;IACH,gDAAmB,CAAA;AACrB,CAAC,EArBW,yBAAyB,KAAzB,yBAAyB,QAqBpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAN,IAAY,4BAuDX;AAvDD,WAAY,4BAA4B;IACtC;;;;OAIG;IACH,iEAAiC,CAAA;IAEjC;;;;;;;;;OASG;IACH,2FAA2D,CAAA;IAE3D;;;;OAIG;IACH,uFAAuD,CAAA;IAEvD;;;;;;;OAOG;IACH,+FAA+D,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,qFAAqD,CAAA;AACvD,CAAC,EAvDW,4BAA4B,KAA5B,4BAA4B,QAuDvC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sCAAsC,CACpD,WAAyC;IAEzC,OAAO,WAAW,KAAK,4BAA4B,CAAC,cAAc;WAC7D,WAAW,KAAK,4BAA4B,CAAC,2BAA2B,CAAC;AAChF,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,YAAkC,EAClC,OAA6B;IAE7B,MAAM,mBAAmB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACvE,MAAM,QAAQ,GAAG,CACf,WAAyC,EACzC,MAAc,EACmB,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAErF,6FAA6F;IAC7F,2CAA2C;IAC3C,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,4BAA4B,CAAC,cAAc,EAC3C,2FAA2F;cACvF,mCAAmC,CACxC,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACjG,MAAM,wBAAwB,GAAG,gBAAgB,KAAK,YAAY,CAAC,aAAa,CAAC;IAEjF,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,0BAA0B,cAAc,qDAAqD;cACzF,sFAAsF,CAC3F,CAAC;IACJ,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,2BAA2B,EACxD,0BAA0B,cAAc,8CAA8C;kBAClF,qFAAqF;kBACrF,sCAAsC,CAC3C,CAAC;QAEJ,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,QAAQ,CACb,4BAA4B,CAAC,6BAA6B,EAC1D,0BAA0B,cAAc,8CAA8C;kBAClF,sFAAsF;kBACtF,gFAAgF,CACrF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,wFAAwF;YACxF,yEAAyE;YACzE,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,iEAAiE;kBAC7D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAuBD;;;;;;;;GAQG;AACH,MAAM,UAAU,4CAA4C,CAC1D,mBAAiC,EACjC,aAA+C,EAC/C,OAA6B;IAE7B,MAAM,qBAAqB,GAAG;QAC5B,GAAG,aAAa,CAAC,kBAAkB;QACnC,GAAG,aAAa,CAAC,mBAAmB;QACpC,GAAG,aAAa,CAAC,iBAAiB;KACnC,CAAC;IACF,OAAO,qBAAqB;SACzB,GAAG,CAAC,CAAC,YAAY,EAAsC,EAAE;QACxD,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,CAAC,mBAAmB,CAAC,2BAA2B;kBAC/F,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,sBAAsB,GAAG,YAAY,CAAC,aAAa,KAAK,mBAAmB;YAC/E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,GAAG,YAAY;gBACf,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,YAAY,EAAE,YAAY,CAAC,YAAY;aACxC,CAAC;QACN,OAAO;YACL,YAAY;YACZ,sBAAsB;YACtB,cAAc,EAAE,gCAAgC,CAAC,sBAAsB,EAAE,OAAO,CAAC;SAClF,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE,qCAAqC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5I,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qCAAqC,CAAC,SAA6C;IACjG,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC;IACtD,OAAO;QACL,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,MAAM;QACnB,YAAY,CAAC,eAAe,IAAI,EAAE;QAClC,SAAS,CAAC,cAAc,CAAC,WAAW;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC,gDAAgD;IAChD,gDAAqB,CAAA;IAErB;;;OAGG;IACH,gEAAqC,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,oDAAyB,CAAA;AAC3B,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AAED,uFAAuF;AACvF,MAAM,UAAU,iCAAiC,CAAC,KAA8B;IAC9E,OAAO,KAAK,KAAK,uBAAuB,CAAC,UAAU,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAiD,EACjD,OAA6B;IAE7B,QAAQ,OAAO,EAAE,CAAC;QAChB,gGAAgG;QAChG,iFAAiF;QACjF,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,uFAAuF;YACvF,iDAAiD;YACjD,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,+DAA+D;kBAC3D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CACnC,UAAiD;IAEjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,uBAAuB,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,QAAQ,UAAU,EAAE,CAAC;QACnB,+FAA+F;QAC/F,+FAA+F;QAC/F,kBAAkB;QAClB,KAAK,yBAAyB,CAAC,gBAAgB,CAAC;QAChD,KAAK,yBAAyB,CAAC,QAAQ;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,yBAAyB,CAAC,OAAO;YACpC,OAAO,uBAAuB,CAAC,gBAAgB,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,MAAM,0BAA0B,GAAU,UAAU,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,yDAAyD;kBACrD,IAAI,MAAM,CAAC,0BAA0B,CAAC,GAAG,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAyB;IACxE,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,yFAAyF;IACzF,8DAA8D;IAC9D,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,sGAAsG;AACtG,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0CAA0C,CACxD,WAAyB,EACzB,yBAAgE,EAChE,YAAoB;IAEpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,IAAI,YAAY,4BAA4B,QAAQ,wCAAwC;cACxF,2BAA2B,CAAC,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;cAC5F,uFAAuF;cACvF,+CAA+C,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,QAAqC,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,0EAAuC,CAAA;IACvC,wEAAqC,CAAA;IACrC,wFAAqD,CAAA;IACrD,4DAAyB,CAAA;IACzB,8DAA2B,CAAA;AAC7B,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAWD,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,MAAe;IAC5E,IAAI,OAAO,GAAQ,MAAM,CAAC;IAC1B,KAAK,IAAI,WAAW,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,GAAG,8BAA8B,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC;QACpG,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,KAAgC,CAAC;QACxG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,MAAM,SAAS,GAAG,8CAA8C,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAiC,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,aAAqB,EAAE,KAAa,EAAQ,EAAE;QAC3F,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,SAAS,EAAE,CAAC;YAChD,IAAI,KAAK,IAAI,8BAA8B,EAAE,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,uBAAuB,CAAC,UAAU;oBACzC,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,WAAW;iBACnD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,gCAAgC,CAAC,WAA2B,CAAC,EAAE,CAAC;gBAClE,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,wBAAwB;iBAChE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,8CAA8C,CAAC,WAAW,CAAC,CAAC;YAChF,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAA2B,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,0CAA0C,CAAC,WAA2B,EAAE,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAC7H,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;gBAChE,UAAU,EAAE,UAAU,IAAI,IAAI;gBAC9B,KAAK,EAAE,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,+BAA+B,CAAC,iBAAiB;oBACnD,CAAC,CAAC,UAAU,KAAK,SAAS;wBACxB,CAAC,CAAC,+BAA+B,CAAC,gBAAgB;wBAClD,CAAC,CAAC,+BAA+B,CAAC,UAAU;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import type { z } from 'zod';\nimport { getPortabilityProvenance } from '@wildo-ai/zod-decorators';\nimport { isNonDisclosableFieldValue } from '../../resources/utils/field-value-disclosure.utils';\nimport {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\nimport type { SubjectDataRecipientsStatement } from './subject-data-recipients.shared.schemas';\n\nconst compareCanonicalText = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\n\n/**\n * WHICH data-subject right an export is answering.\n *\n * ## Why this is an enum and not a boolean flag on one bundle\n *\n * GDPR Art. 15 (right of access) and Art. 20 (right to data portability) are DIFFERENT rights over\n * DIFFERENT data, and conflating them is the defect this capability was built to correct: the four\n * routed export operations removed on 2026-08-01 declared themselves \"portability / GDPR\" while\n * their actual options (`includeActivityData`, `includeOrganizationData`) described an *access*\n * bundle. One output with a flag would reproduce that merge.\n *\n * - **Access** is a disclosure obligation: everything the controller holds *concerning* the subject,\n *   including data the controller itself derived about them, in any readable form.\n * - **Portability** is a transfer obligation: only the data the subject *provided* — actively, or by\n *   using the service — and it must be machine-readable and re-importable elsewhere. Data the\n *   controller inferred is deliberately OUT of scope; a competitor must not receive a rival's\n *   analytics through a subject's portability request.\n *\n * The two therefore diverge at BOTH levels this module classifies: per-edge (see\n * {@link classifySubjectExportDisposition}) and per-field (see\n * {@link resolveSubjectExportFieldScope}).\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n */\nexport enum SubjectExportPurpose {\n  /**\n   * Art. 15 — right of access. The broadest bundle: every row concerning the subject, whoever\n   * produced it, including rows the subject does not own (an audit log about them, a membership an\n   * administrator created).\n   */\n  ACCESS_ART_15 = 'access_art_15',\n\n  /**\n   * Art. 20 — right to data portability. Narrower on purpose: only data the subject supplied or\n   * generated by using the service, and only from rows the subject owns. Controller-derived data is\n   * excluded by {@link DataPortabilityProvenance.DERIVED}.\n   */\n  PORTABILITY_ART_20 = 'portability_art_20',\n}\n\n/**\n * WHERE one field's value came from — the axis that decides Art. 20 scope.\n *\n * ## Why three values and not `isSubjectProvided: boolean`\n *\n * EDPB/WP29 guidance splits \"provided by the data subject\" into data supplied *knowingly* and data\n * *observed* from the subject's use of the service, and puts BOTH in Art. 20 scope while excluding\n * data the controller *inferred*. A boolean forces `OBSERVED` to be mis-filed against whichever\n * side the author guesses — and it is the member most often got wrong, because \"the user did not\n * type it\" reads as \"the user did not provide it\", which is precisely the wrong conclusion.\n *\n * ## Why this is per-FIELD and not per-resource\n *\n * A single row routinely mixes the two: a user profile holds `firstName` (supplied) beside a\n * controller-computed status or score. A resource-level answer would have to round one way for the\n * whole row. The resource-level declaration exists only as a DEFAULT\n * (`portabilityPolicy.defaultProvenance`) so that annotating a resource stays a one-line cost; the\n * per-field decorator overrides it where a field differs.\n *\n * ⚠️ NOT a redaction or scrub concept. This says where a value CAME FROM, for a disclosure\n * decision. What happens to a value on ERASURE is `.impersonalizeWith()` / `RedactionType`, a\n * different axis entirely — a field can be `SUBJECT_PROVIDED` and also masked on erasure.\n */\nexport enum DataPortabilityProvenance {\n  /**\n   * The subject actively and knowingly supplied this value — form input, an uploaded file, a\n   * setting they chose. Unambiguously in scope for both rights.\n   */\n  SUBJECT_PROVIDED = 'subject_provided',\n\n  /**\n   * Generated by the subject's USE of the service rather than typed by them — activity timestamps,\n   * event history, usage counters, telemetry. **In scope for Art. 20**, which is the whole reason\n   * this member exists separately from {@link DERIVED}.\n   */\n  OBSERVED = 'observed',\n\n  /**\n   * Produced BY the controller about the subject — inferred classifications, computed scores,\n   * risk or segmentation labels, server-assigned lifecycle state. Disclosed under Art. 15 (the\n   * subject may see what we concluded about them) but **excluded from Art. 20** (a portability\n   * request is not a channel for exporting the controller's own analysis).\n   */\n  DERIVED = 'derived',\n}\n\n/**\n * What an export does with ONE child-direction edge of the subject.\n *\n * ## Why this is NOT `SubjectErasureDisposition`\n *\n * Erasure and export share a traversal and answer opposite questions — *what do I destroy?* versus\n * *what must I disclose?* — and they diverge on exactly the edges erasure calls `NOT_OWNED`.\n *\n * Erasure leaves audit logs, memberships and job executions alone, correctly: you do not delete an\n * audit log because a user exercised a right. But those same rows hold personal data CONCERNING the\n * subject, and Art. 15 covers \"all personal data concerning him or her\" — not \"rows he owns\".\n * Reusing erasure's vocabulary verbatim would have silently omitted the data an access request most\n * often targets. Hence {@link INCLUDED_REFERENCES_SUBJECT}, a case erasure has no use for.\n *\n * The two classifiers still read the SAME upstream authority for what an edge *says*\n * (`requireResolvedRelationshipSemantics`), so they can never disagree about ownership — only about\n * what to do with it.\n *\n * ## Why there is no blocking disposition here\n *\n * Erasure refuses up-front on `UNCLASSIFIED` / `UNSUPPORTED_DEFERRED` because it is about to\n * WRITE, cannot half-destroy a subject, and needs a teardown declaration nobody made. An export\n * writes nothing: ownership alone answers the edge question, a deferred teardown is irrelevant to a\n * read, and a cross-adapter dependent is merely a second query rather than a broken transaction.\n * The one genuine refusal in an export is field-level and Art. 20-only — see\n * {@link SubjectExportFieldScope.UNDECLARED}. Manufacturing an edge-level blocker for symmetry\n * would be false symmetry.\n */\nexport enum SubjectExportEdgeDisposition {\n  /**\n   * The subject OWNS this dependent (`lifecycleModelMode: DEPENDENT`), so its rows are the\n   * subject's own data. Included for both purposes — for Art. 20 the per-field provenance filter\n   * still applies to what comes back.\n   */\n  INCLUDED_OWNED = 'included_owned',\n\n  /**\n   * The subject does NOT own these rows, but they REFERENCE the subject — the far side carries a\n   * foreign key back to them (an audit log, an organization membership, a job execution).\n   *\n   * **Art. 15 only.** These are personal data concerning the subject, so an access request must\n   * disclose them. A portability request must not: the subject did not provide a row that a third\n   * party or the controller created about them, and shipping them would export the controller's\n   * operational records under a transfer right. For `PORTABILITY_ART_20` this same edge classifies\n   * as {@link EXCLUDED_NOT_SUBJECT_PROVIDED}.\n   */\n  INCLUDED_REFERENCES_SUBJECT = 'included_references_subject',\n\n  /**\n   * The edge carries no personal data of the subject at all: an independent or link-only\n   * relationship whose far side does not even reference them, or a disabled relationship that is\n   * not part of the live graph. Out of scope for both rights.\n   */\n  EXCLUDED_NOT_SUBJECT_DATA = 'excluded_not_subject_data',\n\n  /**\n   * In scope for access, but excluded from THIS export because the export is a portability request\n   * and the rows were not provided by the subject. Kept as its own member rather than collapsing\n   * into {@link EXCLUDED_NOT_SUBJECT_DATA}: a reviewer asking \"why is my audit trail missing from\n   * my portability export?\" needs \"because Art. 20 does not cover controller records\" and \"because\n   * that edge holds nothing about you\" to be different answers, and only the first is a legal\n   * position someone took.\n   */\n  EXCLUDED_NOT_SUBJECT_PROVIDED = 'excluded_not_subject_provided',\n\n  /**\n   * The rows ARE the subject's data and the right covers them, but the resource is declared\n   * `systemAccessPolicy.exportSubject = FORBIDDEN` — someone decided it must never reach a data\n   * subject (an authentication-credential store, a security audit trail).\n   *\n   * ## Why this excludes rather than refusing\n   *\n   * An UNDECLARED resource refuses the whole export, because nobody has decided yet and refusing is\n   * what forces the decision. A FORBIDDEN one is the opposite: the decision exists, and refusing\n   * would make it permanent sabotage — a `USERS` access export whose graph touches a credential\n   * store could then NEVER run, no matter how many other resources opted in. Honouring the\n   * declaration means leaving those rows out and saying so.\n   *\n   * ⚠️ This applies to EDGES only. A subject whose OWN resource is FORBIDDEN still refuses: there is\n   * no export of a person whose identity row may not be disclosed, and silently returning an\n   * edges-only bundle would be a disclosure that omits its own subject.\n   */\n  EXCLUDED_NOT_DISCLOSABLE = 'excluded_not_disclosable',\n}\n\n/** Whether an edge disposition puts the far side's rows INTO the bundle. */\nexport function isIncludedSubjectExportEdgeDisposition(\n  disposition: SubjectExportEdgeDisposition,\n): boolean {\n  return disposition === SubjectExportEdgeDisposition.INCLUDED_OWNED\n    || disposition === SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT;\n}\n\n/** The classification of ONE child-direction edge of an export subject. */\nexport interface SubjectExportEdgeClassification {\n  /** The related resource on the far side of the edge. */\n  relatedResourceType: ResourceType;\n  /** Whether, and why, this edge's rows join the bundle. */\n  disposition: SubjectExportEdgeDisposition;\n  /**\n   * Human-readable justification quoting the configuration that produced it. Surfaced in the export\n   * report so a data-protection reviewer never has to re-derive WHY a resource was included or\n   * left out — which, for a disclosure obligation, is the evidence that matters.\n   */\n  reason: string;\n}\n\n/**\n * Classify what an export must do with ONE child-direction edge — the disclose-vs-omit decision,\n * DERIVED FROM CONFIGURATION rather than a hardcoded list of resource types.\n *\n * ## Where the answer comes from\n *\n * Two declarations the author already makes, read through the same shared authorities the delete\n * cascade and the erasure orchestrator read, so the three can never disagree about what an edge is:\n *\n *  1. **`handling.lifecycleModelMode`** — does the subject own this related resource's lifecycle?\n *     `DEPENDENT` means the rows are the subject's own data.\n *  2. **Foreign-key topology** (`resolveForeignKeyHolderResourceType`, cardinality-only and\n *     therefore pure) — for a NON-owned edge, does the far side nonetheless carry a reference back\n *     to the subject? If it does, its rows are *about* the subject and Art. 15 must disclose them.\n *\n * ## The `purpose` parameter, and why it is a parameter\n *\n * Art. 15 and Art. 20 diverge on exactly one edge case — the referencing-but-not-owned edge — and\n * keeping that divergence in ONE switch here is what stops two near-identical classifiers from\n * drifting apart. Exposing `classifyForAccess` / `classifyForPortability` would duplicate the\n * ownership logic, and the day someone fixes a bug in one they would miss the other.\n *\n * ## Caller contract\n *\n * `relationship.resourceType2` MUST be the far side and `resourceType1` the subject — the same\n * child-direction normalization {@link classifySubjectErasureDisposition} requires. The caller\n * filters to child-direction edges before classifying.\n *\n * Pure and side-effect free — no registry lookups, no I/O, no row reads — so it is equally usable\n * from a runtime orchestrator and from a boot-time coherence guard.\n */\nexport function classifySubjectExportDisposition(\n  relationship: ResourceRelationship,\n  purpose: SubjectExportPurpose,\n): SubjectExportEdgeClassification {\n  const relatedResourceType = relationship.resourceType2 as ResourceType;\n  const classify = (\n    disposition: SubjectExportEdgeDisposition,\n    reason: string,\n  ): SubjectExportEdgeClassification => ({ relatedResourceType, disposition, reason });\n\n  // A disabled relationship is not part of the live graph — the runtime never traverses it, so\n  // there are no rows behind it to disclose.\n  if (relationship.isDisabled === true) {\n    return classify(\n      SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n      'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n    );\n  }\n\n  const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n  const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n  if (lifecycleModel === RelationshipLifecycleModel.DEPENDENT) {\n    return classify(\n      SubjectExportEdgeDisposition.INCLUDED_OWNED,\n      'lifecycleModelMode is DEPENDENT: the subject owns these rows, so they are the subject\\'s '\n        + 'own data and belong in the bundle',\n    );\n  }\n\n  // NOT owned from here on. The rows still count as personal data if they POINT AT the subject —\n  // which is the Art. 15 / Art. 20 fork.\n  const foreignKeyHolder = Resources_SharedUtils.resolveForeignKeyHolderResourceType(relationship);\n  const farSideReferencesSubject = foreignKeyHolder === relationship.resourceType2;\n\n  if (!farSideReferencesSubject) {\n    return classify(\n      SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n      `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT) and the far side does not hold a `\n        + 'foreign key to the subject, so these rows are neither owned by nor about the subject',\n    );\n  }\n\n  switch (purpose) {\n    case SubjectExportPurpose.ACCESS_ART_15:\n      return classify(\n        SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT,\n        `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT), but the far side holds a `\n          + 'foreign key to the subject, so these rows are personal data CONCERNING the subject '\n          + 'and Art. 15 requires disclosing them',\n      );\n\n    case SubjectExportPurpose.PORTABILITY_ART_20:\n      return classify(\n        SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_PROVIDED,\n        `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): these rows reference the `\n          + 'subject but were created by the controller or a third party rather than provided by '\n          + 'the subject, so Art. 20 does not cover them (they ARE disclosed under Art. 15)',\n      );\n\n    default: {\n      // Compile-time exhaustiveness: a new SubjectExportPurpose without an arm here is a TYPE\n      // error, not a silent runtime discovery on someone's disclosure request.\n      const _exhaustivePurposeCheck: never = purpose;\n      throw new Error(\n        `classifySubjectExportDisposition has no arm for export purpose `\n          + `'${String(_exhaustivePurposeCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * The three relationship buckets exposed by a compiled resource configuration.\n *\n * Kept structural here so the privacy compiler does not import resource configuration schemas:\n * those schemas already import this module for {@link DataPortabilityProvenance}.\n */\nexport interface SubjectExportRelationshipBuckets {\n  readonly parentRelationships: readonly ResourceRelationship[];\n  readonly childRelationships: readonly ResourceRelationship[];\n  readonly selfRelationships: readonly ResourceRelationship[];\n}\n\n/** One graph edge normalized so the export subject is always `resourceType1`. */\nexport interface SubjectExportRelationshipTraversal {\n  /** Original compiled relationship; runtime adapters use it to resolve the real FK field. */\n  readonly relationship: ResourceRelationship;\n  /** Direction-normalized relationship consumed by the shared legal-scope classifier. */\n  readonly normalizedRelationship: ResourceRelationship;\n  readonly classification: SubjectExportEdgeClassification;\n}\n\n/**\n * Enumerate every edge touching one export subject, including child-first reference declarations.\n *\n * Resource configurations deliberately preserve parent/child/self buckets. Subject disclosure is\n * different: personal data can point *to* the subject from either authored orientation. This helper\n * joins both directional buckets, includes self edges once, and swaps only the positional topology\n * needed by {@link classifySubjectExportDisposition}. It preserves the original compiled edge for\n * FK resolution and never collapses multiple foreign keys between the same resource pair.\n */\nexport function enumerateSubjectExportRelationshipTraversals(\n  subjectResourceType: ResourceType,\n  relationships: SubjectExportRelationshipBuckets,\n  purpose: SubjectExportPurpose,\n): SubjectExportRelationshipTraversal[] {\n  const touchingRelationships = [\n    ...relationships.childRelationships,\n    ...relationships.parentRelationships,\n    ...relationships.selfRelationships,\n  ];\n  return touchingRelationships\n    .map((relationship): SubjectExportRelationshipTraversal => {\n      if (relationship.resourceType1 !== subjectResourceType && relationship.resourceType2 !== subjectResourceType) {\n        throw new Error(\n          `Subject-export relationship traversal for ${String(subjectResourceType)} received unrelated edge `\n            + `${String(relationship.resourceType1)} -> ${String(relationship.resourceType2)}.`,\n        );\n      }\n      const normalizedRelationship = relationship.resourceType1 === subjectResourceType\n        ? relationship\n        : {\n            ...relationship,\n            resourceType1: relationship.resourceType2,\n            resourceType2: relationship.resourceType1,\n            cardinality1: relationship.cardinality2,\n            cardinality2: relationship.cardinality1,\n          };\n      return {\n        relationship,\n        normalizedRelationship,\n        classification: classifySubjectExportDisposition(normalizedRelationship, purpose),\n      };\n    })\n    .sort((left, right) => compareCanonicalText(subjectExportRelationshipTraversalKey(left), subjectExportRelationshipTraversalKey(right)));\n}\n\n/** Stable identity retaining distinct foreign keys between otherwise identical resource pairs. */\nexport function subjectExportRelationshipTraversalKey(traversal: SubjectExportRelationshipTraversal): string {\n  const relationship = traversal.normalizedRelationship;\n  return [\n    relationship.resourceType1,\n    relationship.resourceType2,\n    relationship.cardinality1,\n    relationship.cardinality2,\n    relationship.nature,\n    relationship.foreignKeyField ?? '',\n    traversal.classification.disposition,\n  ].join('\\0');\n}\n\n/**\n * Whether ONE field's value joins the bundle, for a given purpose.\n *\n * Separate from {@link SubjectExportEdgeDisposition} because the two answer different questions at\n * different granularities: an edge decides whether a RESOURCE's rows are in scope at all, a field\n * scope decides which COLUMNS of an in-scope row survive the Art. 20 narrowing.\n */\nexport enum SubjectExportFieldScope {\n  /** The field's value belongs in this bundle. */\n  INCLUDED = 'included',\n\n  /**\n   * Excluded because the value is controller-DERIVED and this is a portability request. Never\n   * reached for `ACCESS_ART_15`, which discloses derived data.\n   */\n  EXCLUDED_DERIVED = 'excluded_derived',\n\n  /**\n   * ⛔ NO ANSWER — the field carries no provenance declaration and none is inherited from its\n   * resource, while the export is a portability request that needs one.\n   *\n   * The export REFUSES rather than guessing, because both guesses are harmful and neither is the\n   * conservative one: excluding an undeclared field UNDER-DELIVERS a legal right the subject is\n   * owed, and including it OVER-SHARES data the controller derived. There is no safe default to\n   * fall back on, which is exactly the condition that justifies failing loud — the same reasoning\n   * that makes `SubjectErasureDisposition.UNCLASSIFIED` refuse an erasure.\n   *\n   * `ACCESS_ART_15` never produces this: access includes every field regardless of provenance, so\n   * an application can serve access requests before annotating anything.\n   */\n  UNDECLARED = 'undeclared',\n}\n\n/** Whether a field scope must ABORT the export rather than merely omitting a value. */\nexport function isBlockingSubjectExportFieldScope(scope: SubjectExportFieldScope): boolean {\n  return scope === SubjectExportFieldScope.UNDECLARED;\n}\n\n/**\n * Decide whether one field's value belongs in the bundle.\n *\n * `provenance` is the field's EFFECTIVE provenance — its own `.portabilityProvenance()` declaration\n * if it carries one, otherwise the resource's `portabilityPolicy.defaultProvenance`, otherwise\n * `undefined`. Resolving that fallback chain is the factory's job (Phase 0B); this function only\n * judges the resolved value, which keeps it pure and independently testable.\n */\nexport function resolveSubjectExportFieldScope(\n  provenance: DataPortabilityProvenance | undefined,\n  purpose: SubjectExportPurpose,\n): SubjectExportFieldScope {\n  switch (purpose) {\n    // Access discloses everything concerning the subject, so provenance is simply not a question it\n    // asks — an unannotated application can still answer an Art. 15 request in full.\n    case SubjectExportPurpose.ACCESS_ART_15:\n      return SubjectExportFieldScope.INCLUDED;\n\n    case SubjectExportPurpose.PORTABILITY_ART_20:\n      return resolvePortabilityFieldScope(provenance);\n\n    default: {\n      // Compile-time exhaustiveness on the PURPOSE axis too. Without this arm a third right added\n      // to the enum would silently inherit the portability narrowing — a disclosure boundary\n      // decided by fall-through rather than by anyone.\n      const _exhaustivePurposeCheck: never = purpose;\n      throw new Error(\n        `resolveSubjectExportFieldScope has no arm for export purpose `\n          + `'${String(_exhaustivePurposeCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * The Art. 20 narrowing, split out so {@link resolveSubjectExportFieldScope} can switch\n * exhaustively on `purpose` while this switches exhaustively on `provenance`. Module-private: the\n * purpose gate is not optional, and a caller reaching this directly would bypass it.\n */\nfunction resolvePortabilityFieldScope(\n  provenance: DataPortabilityProvenance | undefined,\n): SubjectExportFieldScope {\n  if (provenance === undefined) {\n    return SubjectExportFieldScope.UNDECLARED;\n  }\n\n  switch (provenance) {\n    // Both are \"provided by the data subject\" in the Art. 20 sense — OBSERVED is data generated by\n    // the subject's USE of the service, which the guidance places in scope even though the subject\n    // never typed it.\n    case DataPortabilityProvenance.SUBJECT_PROVIDED:\n    case DataPortabilityProvenance.OBSERVED:\n      return SubjectExportFieldScope.INCLUDED;\n\n    case DataPortabilityProvenance.DERIVED:\n      return SubjectExportFieldScope.EXCLUDED_DERIVED;\n\n    default: {\n      // Compile-time exhaustiveness: a new provenance member without an arm is a TYPE error here.\n      const _exhaustiveProvenanceCheck: never = provenance;\n      throw new Error(\n        `resolvePortabilityFieldScope has no arm for provenance `\n          + `'${String(_exhaustiveProvenanceCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * Is this field withheld from EVERY subject export, whatever right is being answered?\n *\n * ## Why this exists at all — the layering trap it closes\n *\n * The export orchestrator collects rows at the REPOSITORY layer, which sits BELOW the service-layer\n * DTO projection that normally strips `.isBackendOnly()` fields on their way to a client. Without an\n * explicit check here, a subject export would disclose exactly the values that projection exists to\n * hide — `passwordHash` and `backupCodesHashed` on `USER_CREDENTIALS` are the motivating case, and\n * the config change that exposed them would have looked entirely routine.\n *\n * ## Why it is deliberately CONSERVATIVE\n *\n * This withholds every backend-only field, not only the secrets. Some backend-only fields are\n * genuinely disclosable under Art. 15 (`passwordChangedAt`, `firstMfaPromptAt` — facts about the\n * subject they may ask for), so this errs toward withholding.\n *\n * That asymmetry is intentional. Under-disclosing produces a complaint that is answerable and\n * fixable; disclosing an authentication secret is neither, and it degrades the security of\n * processing the framework is separately obliged to maintain (GDPR Art. 32). Between an\n * over-cautious bundle and a leaked credential, only one is recoverable.\n *\n * The withheld fields are REPORTED (`SubjectExportReport.fieldsWithheldAsNonDisclosable`) so the\n * caution is visible rather than silent. When a resource needs a specific backend-only field\n * disclosed, the expressible extension is a per-field opt-in on this predicate — NOT loosening it\n * wholesale.\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n */\nexport function isFieldWithheldFromSubjectExport(fieldSchema: z.ZodTypeAny): boolean {\n  // Delegated to the ONE field-value disclosure rule rather than restated. The reasoning that used\n  // to sit here — that `isWriteOnlySecret` is checked explicitly rather than assumed to imply\n  // backend-only, because they are separate decorators and a future authoring form may set one\n  // without the other — moved WITH the rule, and is now the shared module's own justification.\n  //\n  // This function keeps its own name and its own assurance marker deliberately: subject export is a\n  // distinct obligation from model disclosure, its own docstring anticipates a per-field opt-in that\n  // would apply HERE and nowhere else, and merging the two names would make that extension\n  // unexpressible. What is shared is the rule, not the concept.\n  return isNonDisclosableFieldValue(fieldSchema);\n}\n\n/** Every legal {@link DataPortabilityProvenance} value, for validating an opaque decorator string. */\nconst KNOWN_PORTABILITY_PROVENANCES: ReadonlySet<string> = new Set(\n  Object.values(DataPortabilityProvenance),\n);\n\n/**\n * Resolve ONE field's EFFECTIVE provenance by joining the two declaration levels.\n *\n * ## The fallback chain, and why it has exactly two rungs\n *\n * 1. the field's own `.portabilityProvenance()` declaration, if it carries one;\n * 2. otherwise the resource's `portabilityPolicy.defaultProvenance`;\n * 3. otherwise `undefined` — which {@link resolveSubjectExportFieldScope} turns into a REFUSAL for\n *    an Art. 20 export and ignores entirely for Art. 15.\n *\n * Two rungs is what makes the fail-loud rule adoptable: without the resource default, every field of\n * every resource would need a decorator before a single portability request could be answered, and a\n * capability that expensive to adopt does not get adopted. With it, annotating a resource is one\n * line and only the exceptions carry a decorator.\n *\n * ## Why the enum check lives HERE\n *\n * `zod-decorators` sits below this package and cannot import {@link DataPortabilityProvenance}, so\n * it stores whatever non-empty string it was given — it can reject a BLANK but not a WRONG value.\n * This is the first layer that knows the vocabulary, so it is where a typo'd `'subject-provided'`\n * (hyphen, not underscore) must fail rather than silently resolving to `undefined` and turning a\n * declared field into a refusal — or worse, into a silent omission if the caller treats unknown as\n * derived. Mirrors how `RedactionType` validity is checked in this layer for `.impersonalizeWith()`.\n *\n * @param fieldSchema the field's Zod schema; the reader walks wrapper types, so a declaration made\n *   before or after `.optional()` / `.nullish()` / `.default()` is observed either way.\n * @param resourceDefaultProvenance the owning resource's `portabilityPolicy.defaultProvenance`.\n *   Taken as a bare value rather than the policy object so this module stays free of the\n *   resource-config import (which imports THIS module for the enum).\n * @param fieldLocator `resourceType.fieldName`, used only to make a rejection actionable.\n */\nexport function resolveEffectiveFieldPortabilityProvenance(\n  fieldSchema: z.ZodTypeAny,\n  resourceDefaultProvenance: DataPortabilityProvenance | undefined,\n  fieldLocator: string,\n): DataPortabilityProvenance | undefined {\n  const declared = getPortabilityProvenance(fieldSchema);\n\n  if (declared === undefined) {\n    return resourceDefaultProvenance;\n  }\n\n  if (!KNOWN_PORTABILITY_PROVENANCES.has(declared)) {\n    throw new Error(\n      `[${fieldLocator}] portabilityProvenance('${declared}') is not a DataPortabilityProvenance `\n        + `value. Expected one of: ${[...KNOWN_PORTABILITY_PROVENANCES].join(', ')}. An unrecognised `\n        + `value would resolve as UNDECLARED and make an Art. 20 export refuse, hiding the typo `\n        + `behind what looks like a deliberate omission.`,\n    );\n  }\n\n  return declared as DataPortabilityProvenance;\n}\n\n/** Why a compiled leaf-field decision has its effective export meaning. */\nexport enum SubjectExportFieldDecisionBasis {\n  FIELD_DECLARATION = 'field_declaration',\n  RESOURCE_DEFAULT = 'resource_default',\n  WITHHELD_NON_DISCLOSABLE = 'withheld_non_disclosable',\n  UNDECLARED = 'undeclared',\n  DEPTH_LIMIT = 'depth_limit',\n}\n\n/** Canonical, runtime-effective decision for one leaf path in one export purpose. */\nexport interface SubjectExportFieldDecision {\n  readonly locator: string;\n  readonly purpose: SubjectExportPurpose;\n  readonly scope: SubjectExportFieldScope | null;\n  readonly provenance: DataPortabilityProvenance | null;\n  readonly basis: SubjectExportFieldDecisionBasis;\n}\n\nconst SUBJECT_EXPORT_FIELD_MAX_DEPTH = 10;\n\n/**\n * Resolve an object shape through the same bounded wrapper protocol used by subject export.\n * Returning `undefined` means the value is a leaf. Reaching the bound is handled fail-closed by\n * {@link compileSubjectExportFieldDecisions}, never as an implicit leaf inclusion.\n */\nexport function resolveSubjectExportObjectShapeThroughWrappers(schema: unknown): Record<string, unknown> | undefined {\n  let current: any = schema;\n  for (let unwrapDepth = 0; current && unwrapDepth < SUBJECT_EXPORT_FIELD_MAX_DEPTH; unwrapDepth += 1) {\n    if (current.shape && typeof current.shape === 'object') return current.shape as Record<string, unknown>;\n    const inner = current.def?.innerType ?? current._def?.innerType;\n    if (!inner) return undefined;\n    current = inner;\n  }\n  return undefined;\n}\n\n/**\n * Compile every runtime-effective leaf-field decision for one resource and right.\n *\n * Both the backend executor and application authority proof consume this function. A field-level\n * decorator, inherited default, withheld marker, wrapper layout or depth refusal therefore changes\n * one shared decision inventory instead of two independently maintained interpretations.\n */\nexport function compileSubjectExportFieldDecisions(input: {\n  readonly resourceType: ResourceType;\n  readonly mainSchema: unknown;\n  readonly defaultProvenance: DataPortabilityProvenance | undefined;\n  readonly purpose: SubjectExportPurpose;\n}): SubjectExportFieldDecision[] {\n  const rootShape = resolveSubjectExportObjectShapeThroughWrappers(input.mainSchema);\n  if (!rootShape) return [];\n  const decisions: SubjectExportFieldDecision[] = [];\n\n  const visit = (shape: Record<string, unknown>, locatorPrefix: string, depth: number): void => {\n    for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n      const locator = `${locatorPrefix}.${fieldName}`;\n      if (depth >= SUBJECT_EXPORT_FIELD_MAX_DEPTH) {\n        decisions.push({\n          locator,\n          purpose: input.purpose,\n          scope: SubjectExportFieldScope.UNDECLARED,\n          provenance: null,\n          basis: SubjectExportFieldDecisionBasis.DEPTH_LIMIT,\n        });\n        continue;\n      }\n      if (isFieldWithheldFromSubjectExport(fieldSchema as z.ZodTypeAny)) {\n        decisions.push({\n          locator,\n          purpose: input.purpose,\n          scope: null,\n          provenance: null,\n          basis: SubjectExportFieldDecisionBasis.WITHHELD_NON_DISCLOSABLE,\n        });\n        continue;\n      }\n      const nestedShape = resolveSubjectExportObjectShapeThroughWrappers(fieldSchema);\n      if (nestedShape) {\n        visit(nestedShape, locator, depth + 1);\n        continue;\n      }\n      const declared = getPortabilityProvenance(fieldSchema as z.ZodTypeAny);\n      const provenance = resolveEffectiveFieldPortabilityProvenance(fieldSchema as z.ZodTypeAny, input.defaultProvenance, locator);\n      decisions.push({\n        locator,\n        purpose: input.purpose,\n        scope: resolveSubjectExportFieldScope(provenance, input.purpose),\n        provenance: provenance ?? null,\n        basis: declared !== undefined\n          ? SubjectExportFieldDecisionBasis.FIELD_DECLARATION\n          : provenance !== undefined\n            ? SubjectExportFieldDecisionBasis.RESOURCE_DEFAULT\n            : SubjectExportFieldDecisionBasis.UNDECLARED,\n      });\n    }\n  };\n\n  visit(rootShape, String(input.resourceType), 0);\n  return decisions.sort((left, right) => compareCanonicalText(left.locator, right.locator));\n}\n\n/** Per-edge outcome of an executed export — the classification plus what actually happened. */\nexport interface SubjectExportEdgeOutcome extends SubjectExportEdgeClassification {\n  /**\n   * `true` when the export actually queried this edge. Note this reports that the read RAN, not\n   * that rows existed — an included edge with no rows for this subject is a legitimate empty\n   * result, and {@link recordCount} distinguishes the two.\n   */\n  collected: boolean;\n  /** How many rows this edge contributed. `0` on an included edge means the subject had none. */\n  recordCount: number;\n}\n\n/**\n * What one subject export produced — the compliance artifact of an Art. 15 or Art. 20 request.\n *\n * Returned to the caller (rather than only logged) so the flow fronting the request can record or\n * surface it: every edge of the subject appears exactly once with the disposition applied and the\n * configuration that justified it. For a disclosure obligation, the record of what was DELIBERATELY\n * LEFT OUT — and on what legal basis — matters as much as the data returned.\n */\nexport interface SubjectExportReport {\n  /** Which right this export answered. */\n  purpose: SubjectExportPurpose;\n  /** The exported subject's resource type. */\n  subjectResourceType: ResourceType;\n  /** The exported subject rows. */\n  subjectIds: string[];\n  /** Every child-direction edge of the subject, classified, in registry order. */\n  edges: SubjectExportEdgeOutcome[];\n  /**\n   * Fields omitted from the bundle as controller-DERIVED, as `resourceType.fieldName`. Populated\n   * only for `PORTABILITY_ART_20`. Recorded rather than silently dropped so the subject can see\n   * that derived data exists and request it under Art. 15 instead.\n   */\n  fieldsExcludedAsDerived: string[];\n  /**\n   * Fields withheld as NON-DISCLOSABLE regardless of purpose — see\n   * {@link isFieldWithheldFromSubjectExport}. Populated for BOTH rights, because a password hash is\n   * no more disclosable under Art. 15 than under Art. 20.\n   *\n   * Recorded rather than silently dropped for the same reason as the derived list, and one more: a\n   * reviewer auditing why an export looks thin needs to see that the framework withheld something\n   * deliberately, not that a resource was missed.\n   */\n  fieldsWithheldAsNonDisclosable: string[];\n  /** Total rows across every collected edge, including the subject's own row(s). */\n  totalRecordCount: number;\n  /**\n   * The recipients this subject's personal data has been or will be disclosed to (Art. 15(1)(c), #1710): each with\n   * the legal identity the operator's register adopted and the categories its declared flow carries, selected by\n   * `selectSubjectDataRecipients` for the resources this export read. A recipient whose flow is not fully declared is\n   * listed as MAY_HAVE_RECEIVED, never left out; an application with no recipient declaration reads NOT_DECLARED.\n   * Vendor facts only — no personal data.\n   */\n  recipients: SubjectDataRecipientsStatement;\n}\n\n/** One resource's contribution to an export bundle. */\nexport interface SubjectExportResourceSlice {\n  resourceType: ResourceType;\n  /**\n   * The rows, already narrowed to the fields in scope for the export's purpose. For\n   * `PORTABILITY_ART_20` the controller-derived columns are gone; for `ACCESS_ART_15` every column\n   * the subject is entitled to see is present.\n   */\n  rows: Record<string, unknown>[];\n}\n\n/**\n * What an export ACTUALLY produced — the data, paired with the report that justifies its shape.\n *\n * ## Why the data and the report are one return value but two types\n *\n * {@link SubjectExportReport} is the compliance artifact: it survives the request, is safe to log\n * and persist, and contains NO personal data — only per-edge dispositions and counts. The slices\n * are the personal data itself, which must NOT be logged and whose lifetime ends when the artifact\n * is written.\n *\n * Returning them together keeps the caller from having to correlate two results, while the type\n * split keeps \"safe to record\" and \"must be handled carefully\" visibly distinct — a caller writing\n * `logger.info({ report })` is correct, and the same line with `bundle` would be a leak. Fusing\n * them into one flat object would erase exactly that distinction.\n */\nexport interface SubjectExportBundle {\n  report: SubjectExportReport;\n  slices: SubjectExportResourceSlice[];\n}\n"]}

package/dist/esm/compliance/review-cadence.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-cadence.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/review-cadence.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,aAAa;IACvB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,+GAA+G;IAC/G,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAMhE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAMlG"}
+{"version":3,"file":"review-cadence.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/compliance/review-cadence.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,aAAa;IACvB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,+GAA+G;IAC/G,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAMhE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAMlG"}

package/dist/esm/compliance/review-cadence.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"review-cadence.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/review-cadence.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,aAOX;AAPD,WAAY,aAAa;IACvB,kCAAiB,CAAA;IACjB,oCAAmB,CAAA;IACnB,wCAAuB,CAAA;IACvB,kCAAiB,CAAA;IACjB,+GAA+G;IAC/G,wCAAuB,CAAA;AACzB,CAAC,EAPW,aAAa,KAAb,aAAa,QAOxB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAkC;IACnE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IACzB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE;IAC3B,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE;IAC7B,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,GAAG;IAC3B,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,iBAAiB;CACpD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAsB;IAC5E,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC","sourcesContent":["/**\n * How often something is re-reviewed, and the date that cadence schedules.\n *\n * ## Why it lives HERE\n *\n * Moved from `@wildo-ai/saas-specifications` `_core/market/market-authored-metadata.schemas` on\n * 2026-09-11, and re-exported from there so its six existing importers are untouched. It had to move\n * because it gained a consumer on the other side of a package boundary: an application declares\n * `assuranceReviewCadence` in `wildo.saas.config.ts`, which is validated by\n * `@wildo-ai/platform-config-lib` — a contracts-only package that does not depend on\n * `saas-specifications` and should not start depending on it for one enum. `saas-models` is where the\n * application-declared compliance vocabularies already live (`DataRetentionClass`, `LawfulBasis`,\n * `PersonalDataCategory`, `OperatorProcessingRole`), and both packages already depend on it.\n *\n * The alternative — a second, purpose-named cadence enum beside this one — was rejected. It would\n * have carried four identical members and differed only by excluding `AS_NEEDED`, which is a\n * CONSUMER's constraint rather than a different vocabulary. CLAUDE.md: a closed vocabulary has one\n * named runtime source.\n */\nexport enum ReviewCadence {\n  WEEKLY = 'WEEKLY',\n  MONTHLY = 'MONTHLY',\n  QUARTERLY = 'QUARTERLY',\n  YEARLY = 'YEARLY',\n  /** A real answer meaning \"no schedule\" — never a default, and never a date. See {@link deriveNextReviewOn}. */\n  AS_NEEDED = 'AS_NEEDED',\n}\n\n/**\n * How many days one {@link ReviewCadence} member means.\n *\n * ONE home, promoted 2026-09-11 from two byte-identical module-local copies —\n * `roadmap-snapshot-validation.ts` and `brand-snapshot-validation.ts`, the second of which said so in\n * its own comment: *\"module-local there too — a shared promotion is part of the deferred\n * authored-metadata generalization\"*. A third consumer is what made the deferral stop paying.\n *\n * `Record<ReviewCadence, number>` and not a partial: a member added to the enum is a compile error\n * here rather than a silent `undefined` that reads as \"no cadence\" at every call site.\n *\n * `AS_NEEDED` is `POSITIVE_INFINITY` deliberately, so every consumer must decide what \"no schedule\"\n * means for it rather than receiving a number that quietly schedules something. `Number.isFinite` is\n * the guard each one uses.\n */\nexport const REVIEW_CADENCE_TO_DAYS: Record<ReviewCadence, number> = {\n  [ReviewCadence.WEEKLY]: 7,\n  [ReviewCadence.MONTHLY]: 31,\n  [ReviewCadence.QUARTERLY]: 92,\n  [ReviewCadence.YEARLY]: 366,\n  [ReviewCadence.AS_NEEDED]: Number.POSITIVE_INFINITY,\n};\n\n/**\n * The next review date a cadence schedules from a given instant, or `undefined` when it schedules none.\n *\n * `undefined` for `AS_NEEDED` is the whole contract. A caller that needs a DATE must treat the absence\n * as the answer — \"this application has not committed to a review schedule\" — and say so, rather than\n * inventing one. Returning a far-future date instead would turn \"no commitment\" into a commitment\n * nobody made, which is exactly the shape `.claude/rules/derive-before-you-ask.md` describes when a\n * date stands in for a decision.\n *\n * Returns a plain ISO date (`YYYY-MM-DD`): a review is scheduled on a day, not at an instant.\n */\nexport function deriveNextReviewOn(fromInstant: string, cadence: ReviewCadence): string | undefined {\n  const days = REVIEW_CADENCE_TO_DAYS[cadence];\n  if (!Number.isFinite(days)) return undefined;\n  const from = new Date(fromInstant);\n  if (Number.isNaN(from.getTime())) return undefined;\n  return new Date(from.getTime() + days * 24 * 60 * 60 * 1000).toISOString().slice(0, 10);\n}\n"]}
+{"version":3,"file":"review-cadence.shared.schemas.js","sourceRoot":"","sources":["../../../src/compliance/review-cadence.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,aAOX;AAPD,WAAY,aAAa;IACvB,kCAAiB,CAAA;IACjB,oCAAmB,CAAA;IACnB,wCAAuB,CAAA;IACvB,kCAAiB,CAAA;IACjB,+GAA+G;IAC/G,wCAAuB,CAAA;AACzB,CAAC,EAPW,aAAa,KAAb,aAAa,QAOxB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAkC;IACnE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IACzB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE;IAC3B,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE;IAC7B,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,GAAG;IAC3B,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,iBAAiB;CACpD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAsB;IAC5E,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC","sourcesContent":["/**\n * How often something is re-reviewed, and the date that cadence schedules.\n *\n * ## Why it lives HERE\n *\n * Moved from `@wildo-ai/saas-specifications` `_core/market/market-authored-metadata.schemas` on\n * 2026-09-11, and re-exported from there so its six existing importers are untouched. It had to move\n * because it gained a consumer on the other side of a package boundary: an application declares\n * `assuranceReviewCadence` in `wildo.saas.config.ts`, which is validated by\n * `@wildo-ai/platform-config-lib` — a contracts-only package that does not depend on\n * `saas-specifications` and should not start depending on it for one enum. `saas-models` is where the\n * application-declared compliance vocabularies already live (`DataRetentionClass`, `LawfulBasis`,\n * `PersonalDataCategory`, `OperatorProcessingRole`), and both packages already depend on it.\n *\n * The alternative — a second, purpose-named cadence enum beside this one — was rejected. It would\n * have carried four identical members and differed only by excluding `AS_NEEDED`, which is a\n * CONSUMER's constraint rather than a different vocabulary. CLAUDE.md: a closed vocabulary has one\n * named runtime source.\n */\nexport enum ReviewCadence {\n  WEEKLY = 'WEEKLY',\n  MONTHLY = 'MONTHLY',\n  QUARTERLY = 'QUARTERLY',\n  YEARLY = 'YEARLY',\n  /** A real answer meaning \"no schedule\" — never a default, and never a date. See {@link deriveNextReviewOn}. */\n  AS_NEEDED = 'AS_NEEDED',\n}\n\n/**\n * How many days one {@link ReviewCadence} member means.\n *\n * ONE home, promoted 2026-09-11 from two byte-identical module-local copies —\n * `roadmap-snapshot-validation.ts` and `brand-snapshot-validation.ts`, the second of which said so in\n * its own comment: *\"module-local there too — a shared promotion is part of the deferred\n * authored-metadata generalization\"*. A third consumer is what made the deferral stop paying.\n *\n * `Record<ReviewCadence, number>` and not a partial: a member added to the enum is a compile error\n * here rather than a silent `undefined` that reads as \"no cadence\" at every call site.\n *\n * `AS_NEEDED` is `POSITIVE_INFINITY` deliberately, so every consumer must decide what \"no schedule\"\n * means for it rather than receiving a number that quietly schedules something. `Number.isFinite` is\n * the guard each one uses.\n */\nexport const REVIEW_CADENCE_TO_DAYS: Record<ReviewCadence, number> = {\n  [ReviewCadence.WEEKLY]: 7,\n  [ReviewCadence.MONTHLY]: 31,\n  [ReviewCadence.QUARTERLY]: 92,\n  [ReviewCadence.YEARLY]: 366,\n  [ReviewCadence.AS_NEEDED]: Number.POSITIVE_INFINITY,\n};\n\n/**\n * The next review date a cadence schedules from a given instant, or `undefined` when it schedules none.\n *\n * `undefined` for `AS_NEEDED` is the whole contract. A caller that needs a DATE must treat the absence\n * as the answer — \"this application has not committed to a review schedule\" — and say so, rather than\n * inventing one. Returning a far-future date instead would turn \"no commitment\" into a commitment\n * nobody made, which is exactly the shape `.claude/rules/derive-before-you-ask.md` describes when a\n * date stands in for a decision.\n *\n * Returns a plain ISO date (`YYYY-MM-DD`): a review is scheduled on a day, not at an instant.\n */\nexport function deriveNextReviewOn(fromInstant: string, cadence: ReviewCadence): string | undefined {\n  const days = REVIEW_CADENCE_TO_DAYS[cadence];\n  if (!Number.isFinite(days)) return undefined;\n  const from = new Date(fromInstant);\n  if (Number.isNaN(from.getTime())) return undefined;\n  return new Date(from.getTime() + days * 24 * 60 * 60 * 1000).toISOString().slice(0, 10);\n}\n"]}

package/dist/esm/compliance/risk-posture.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"risk-posture.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/risk-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,wBAAwB;IAClC,oGAAoG;IACpG,kBAAkB,mCAAmC;IACrD,kFAAkF;IAClF,qBAAqB,sCAAsC;IAC3D,qFAAqF;IACrF,gBAAgB,iCAAiC;IACjD,oHAAoH;IACpH,uBAAuB,wCAAwC;IAC/D,0EAA0E;IAC1E,6BAA6B,8CAA8C;IAC3E,0DAA0D;IAC1D,qBAAqB,sCAAsC;IAC3D;;;;OAIG;IACH,6BAA6B,8CAA8C;CAC5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,OAAO,YAAY;IACnB,yEAAyE;IACzE,OAAO,YAAY;IACnB;;;;;;;OAOG;IACH,kBAAkB,uBAAuB;IACzC,kDAAkD;IAClD,QAAQ,aAAa;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iCAAiC;;;kBAO5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,4BAA4B;;;mBAGxC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAAG,SAAS,GAC1C,SAAS,wBAAwB,EAAE,CAErC;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,2BAA2B,GAAG,SAAS,GAAG,OAAO,CAEvG"}
+{"version":3,"file":"risk-posture.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/compliance/risk-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,wBAAwB;IAClC,oGAAoG;IACpG,kBAAkB,mCAAmC;IACrD,kFAAkF;IAClF,qBAAqB,sCAAsC;IAC3D,qFAAqF;IACrF,gBAAgB,iCAAiC;IACjD,oHAAoH;IACpH,uBAAuB,wCAAwC;IAC/D,0EAA0E;IAC1E,6BAA6B,8CAA8C;IAC3E,0DAA0D;IAC1D,qBAAqB,sCAAsC;IAC3D;;;;OAIG;IACH,6BAA6B,8CAA8C;CAC5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,OAAO,YAAY;IACnB,yEAAyE;IACzE,OAAO,YAAY;IACnB;;;;;;;OAOG;IACH,kBAAkB,uBAAuB;IACzC,kDAAkD;IAClD,QAAQ,aAAa;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iCAAiC;;;kBAO5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,4BAA4B;;;mBAGxC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAAG,SAAS,GAC1C,SAAS,wBAAwB,EAAE,CAErC;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,2BAA2B,GAAG,SAAS,GAAG,OAAO,CAEvG"}

package/dist/esm/compliance/risk-posture.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"risk-posture.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/risk-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,wBAmBX;AAnBD,WAAY,wBAAwB;IAClC,oGAAoG;IACpG,iFAAqD,CAAA;IACrD,kFAAkF;IAClF,uFAA2D,CAAA;IAC3D,qFAAqF;IACrF,6EAAiD,CAAA;IACjD,oHAAoH;IACpH,2FAA+D,CAAA;IAC/D,0EAA0E;IAC1E,uGAA2E,CAAA;IAC3E,0DAA0D;IAC1D,uFAA2D,CAAA;IAC3D;;;;OAIG;IACH,uGAA2E,CAAA;AAC7E,CAAC,EAnBW,wBAAwB,KAAxB,wBAAwB,QAmBnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAN,IAAY,oBAoBX;AApBD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,2CAAmB,CAAA;IACnB,yEAAyE;IACzE,2CAAmB,CAAA;IACnB;;;;;;;OAOG;IACH,iEAAyC,CAAA;IACzC,kDAAkD;IAClD,6CAAqB,CAAA;AACvB,CAAC,EApBW,oBAAoB,KAApB,oBAAoB,QAoB/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IACtG,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,kHAAkH,CAAC;CAChI,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,aAAa,CACzD,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAChC,iCAAiC,CAClC,CAAC;AAIF;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA2C;IAE3C,OAAO,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC;AAC3G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAA8C;IAC5F,OAAO,KAAK,EAAE,OAAO,KAAK,oBAAoB,CAAC,OAAO,CAAC;AACzD,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * The risk signals an APPLICATION may take a posture on (#300 Layer 2).\n *\n * ## Why only the application-evaluation signals\n *\n * `report-risk-signals.mjs` derives signals in two homes, and the split is load-bearing rather than\n * organisational. FRAMEWORK_BUILD_TIME signals — marker density across the objective catalogue,\n * objectives with no marker, objectives marked only outside production — are facts about the ENGINE\n * and are identical for every application. An application cannot change them and does not choose\n * them, so a declared posture about one would be an operator accepting somebody else's exposure.\n * They inform; they are not accepted.\n *\n * APPLICATION_EVALUATION_TIME signals are facts about one application's own declarations, and every\n * one of them is downstream of a choice its operator made. Those are the ones a posture is about.\n *\n * ## This enum is the SOURCE, and the derivation is held to it\n *\n * The refs were string literals inside the report. A second list here, free to drift from the one the\n * script emits, is exactly the transcription defect the assurance anchoring rule exists to stop — so\n * the report now parses this enum and refuses when the set it emits and the set declared here\n * disagree, in EITHER direction. A signal added to the report with no member here fails; a member\n * here that no signal emits fails too, because an application could otherwise declare a posture\n * about an exposure nothing measures.\n */\nexport enum ApplicationRiskSignalRef {\n  /** Which engine capabilities are enabled, and therefore which exposures are structurally absent. */\n  CAPABILITY_SURFACE = 'application:capability-surface',\n  /** Whether every retention class the vocabulary carries has a declared period. */\n  RETENTION_DECLARATION = 'application:retention-declaration',\n  /** How many configured providers are vendor-hosted, each a third-party processor. */\n  PROVIDER_HOSTING = 'application:provider-hosting',\n  /** Which personal-data categories this application's own resources declare, and whether any is special category. */\n  PERSONAL_DATA_INVENTORY = 'application:personal-data-inventory',\n  /** Resources that have not answered the personal-data question at all. */\n  PERSONAL_DATA_DECLARATION_GAP = 'application:personal-data-declaration-gap',\n  /** Operations reachable by an external agent over MCP. */\n  EXTERNAL_EXPOSURE_MCP = 'application:external-exposure-mcp',\n  /**\n   * Where the brand's chosen NAME stands against its minimal trademark screening: cleared, screened\n   * incomplete, kept despite a live conflicting mark or named competitor, or never screened. A fact about the\n   * application's own declarations (its brand and its screening), downstream of a choice its creator made.\n   */\n  BRAND_NAME_TRADEMARK_STANDING = 'application:brand-name-trademark-standing',\n}\n\n/**\n * What an operator has DECIDED to do about an exposure.\n *\n * NIST SP 800-39 names the risk responses as accepting, avoiding, mitigating, sharing or\n * transferring risk, and that set is what this enum takes — the options, not the spelling.\n * spec-cite: NIST SP 800-39 / CSRC glossary, \"risk response\" — paraphrased from the published\n * definition, not quoted.\n *\n * ## Only NIST is NAMED here, and that is a licensing line rather than a preference\n *\n * Other risk-management standards describe the same options and are LICENSED documents. Naming one\n * in engine source would put a paid standard's identity into shipped code, which is why this\n * repository's boundary rule keeps external framework names to rights-classified mapping and report\n * surfaces. NIST publications are US government works, so citing one here costs nothing — and the\n * practice is already settled: NIST is named in 34 engine and platform files.\n *\n * The options are borrowed either way. Being INSPIRED by a standard and NAMING it are different\n * acts, and only the second carries a licence.\n *\n * ## No band, no score, no number — and that is inherited rather than chosen here\n *\n * Layer 1 emits signals carrying NO score, weight, level or severity, and asserts that prohibition\n * structurally. A posture that arrived as a 1–5 appetite rating would put a number underneath a layer\n * that refuses to produce one, and the number is what a reader trusts without checking. What an\n * operator can honestly say about an exposure is which of these four they chose and why, so that is\n * what the declaration carries.\n *\n * assurance-control: WILDO.RISK.TREATMENT_DECLARED — an operator's chosen treatment per exposure,\n * with the reasoning, in a form a measurement can contradict.\n *\n * ## `AVOIDED` is the member that makes this layer worth having\n *\n * The other three are consistent with any measurement: an application that REDUCED, SHARED or\n * ACCEPTED an exposure still has it, so the signal and the posture agree whatever the signal says.\n * `AVOIDED` claims the exposure is not taken at all, which a Layer 1 signal can CONTRADICT — declare\n * that vendor-hosted processing is avoided while two of three configured providers are vendor-hosted,\n * and the two statements cannot both be true.\n *\n * That is the difference between this and a questionnaire answer. A free-text \"describe your risk\n * appetite\" is unfalsifiable by construction; a typed posture beside a derived signal is a claim the\n * product itself can disagree with.\n */\nexport enum RiskTreatmentPosture {\n  /**\n   * The application does not take this exposure at all.\n   *\n   * The only FALSIFIABLE posture — a signal reporting the exposure present contradicts it directly.\n   */\n  AVOIDED = 'AVOIDED',\n  /** Taken, with controls that lower its likelihood or its consequence. */\n  REDUCED = 'REDUCED',\n  /**\n   * Taken, with the consequence placed on another party by CONTRACT — an Art. 28 processor agreement\n   * being the case this framework can actually evidence.\n   *\n   * Narrower than \"share or transfer\" on purpose. Insurance-style transfer is a legitimate treatment\n   * and nothing in the product can attest it, so modelling it here would add a member no derivation\n   * could ever check. Naming the contractual case precisely is a smaller claim and a true one.\n   */\n  SHARED_BY_CONTRACT = 'SHARED_BY_CONTRACT',\n  /** Taken, and the exposure retained knowingly. */\n  ACCEPTED = 'ACCEPTED',\n}\n\n/**\n * One signal's posture, and why.\n *\n * `rationale` is REQUIRED, for the same reason `dataRetention` requires one: a posture with no reason\n * is a token, and the thing a reviewer needs is the sentence, not the enum member. \"We accept it\" is\n * what the member already says.\n *\n * ## What is deliberately NOT here\n *\n * **No `decidedBy` and no `decidedAt`.** Acceptance is a COMMIT — `one-source-of-truth.md` rule 7 and\n * D5 — so the author and the instant are already recorded, mergeably and by a history everyone\n * audits. Fields restating them would be a second authority that can disagree with git, and they are\n * exactly the shape that made an earlier compliance record unproducible without forging an identity.\n *\n * **No review date.** `derive-before-you-ask.md` settles this: a date is a PROXY for \"an input may\n * have changed\", every input is in git and enumerable, so the trigger is computable and the date is\n * an output rather than something to type.\n */\nexport const ApplicationRiskPostureEntrySchema = z.strictObject({\n  posture: z.enum(RiskTreatmentPosture).describe('What the operator decided to do about this exposure.'),\n  rationale: z\n    .string()\n    .trim()\n    .min(1)\n    .describe('Why this posture, in the operator\\'s own words — the sentence a reviewer reads, not a restatement of the member.'),\n});\n\nexport type ApplicationRiskPostureEntry = z.infer<typeof ApplicationRiskPostureEntrySchema>;\n\n/**\n * An application's declared posture per risk signal — PARTIAL by construction.\n *\n * Every entry is optional and the whole declaration may be omitted. That is not laxity: a compliance\n * workflow may never stand in front of the mechanism (`application-creation-directive.md`), and a\n * required posture would make an application UNBUILDABLE until somebody decided something about\n * every signal the framework happens to derive. The undeclared set is REPORTED instead, by\n * {@link undeclaredRiskSignals}, which is the \"mark it, do not block\" shape that rule asks for.\n *\n * So absence is representable and means one thing — nobody has decided yet — and it is\n * distinguishable from `ACCEPTED`, which means somebody decided to live with it.\n *\n * `z.partialRecord`, NOT `z.record`: in Zod 4 a record keyed by an enum is EXHAUSTIVE — every member is\n * required, at parse and in the inferred type. That contradicted this contract silently while every\n * application declared every signal, and broke the day a signal was added\n * (`BRAND_NAME_TRADEMARK_STANDING`): Wonder Todos' six-entry posture stopped parsing. A new signal must\n * read as UNDECLARED in every existing application, never refuse it. Collapsing those two\n * is the failure this layer exists to avoid: silence is not acceptance.\n */\nexport const ApplicationRiskPostureSchema = z.partialRecord(\n  z.enum(ApplicationRiskSignalRef),\n  ApplicationRiskPostureEntrySchema,\n);\n\nexport type ApplicationRiskPosture = z.infer<typeof ApplicationRiskPostureSchema>;\n\n/**\n * The signals an application has declared NO posture for — what a register must mark as owed.\n *\n * Derived rather than stored, and total over the enum, so a signal added to the vocabulary tomorrow\n * is reported as undeclared by every existing application rather than silently omitted from the\n * answer. Deliberately the same shape as `undeclaredRetentionClasses`, because it is the same\n * question one layer over.\n */\nexport function undeclaredRiskSignals(\n  posture: ApplicationRiskPosture | undefined,\n): readonly ApplicationRiskSignalRef[] {\n  return Object.values(ApplicationRiskSignalRef).filter((signalRef) => posture?.[signalRef] === undefined);\n}\n\n/**\n * Postures that CLAIM AN EXPOSURE IS NOT TAKEN — the ones a measurement can contradict.\n *\n * Exported rather than inlined at the one call site, so the report and any later consumer ask the\n * same question. Today it is `AVOIDED` alone; if a future member is also falsifiable it joins here\n * and every consumer follows, which is the whole reason this is a function and not a comparison.\n */\nexport function riskPostureClaimsExposureAbsent(entry: ApplicationRiskPostureEntry | undefined): boolean {\n  return entry?.posture === RiskTreatmentPosture.AVOIDED;\n}\n"]}
+{"version":3,"file":"risk-posture.shared.schemas.js","sourceRoot":"","sources":["../../../src/compliance/risk-posture.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,wBAmBX;AAnBD,WAAY,wBAAwB;IAClC,oGAAoG;IACpG,iFAAqD,CAAA;IACrD,kFAAkF;IAClF,uFAA2D,CAAA;IAC3D,qFAAqF;IACrF,6EAAiD,CAAA;IACjD,oHAAoH;IACpH,2FAA+D,CAAA;IAC/D,0EAA0E;IAC1E,uGAA2E,CAAA;IAC3E,0DAA0D;IAC1D,uFAA2D,CAAA;IAC3D;;;;OAIG;IACH,uGAA2E,CAAA;AAC7E,CAAC,EAnBW,wBAAwB,KAAxB,wBAAwB,QAmBnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAN,IAAY,oBAoBX;AApBD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,2CAAmB,CAAA;IACnB,yEAAyE;IACzE,2CAAmB,CAAA;IACnB;;;;;;;OAOG;IACH,iEAAyC,CAAA;IACzC,kDAAkD;IAClD,6CAAqB,CAAA;AACvB,CAAC,EApBW,oBAAoB,KAApB,oBAAoB,QAoB/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IACtG,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,kHAAkH,CAAC;CAChI,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,aAAa,CACzD,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAChC,iCAAiC,CAClC,CAAC;AAIF;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA2C;IAE3C,OAAO,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC;AAC3G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAA8C;IAC5F,OAAO,KAAK,EAAE,OAAO,KAAK,oBAAoB,CAAC,OAAO,CAAC;AACzD,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * The risk signals an APPLICATION may take a posture on (#300 Layer 2).\n *\n * ## Why only the application-evaluation signals\n *\n * `report-risk-signals.mjs` derives signals in two homes, and the split is load-bearing rather than\n * organisational. FRAMEWORK_BUILD_TIME signals — marker density across the objective catalogue,\n * objectives with no marker, objectives marked only outside production — are facts about the ENGINE\n * and are identical for every application. An application cannot change them and does not choose\n * them, so a declared posture about one would be an operator accepting somebody else's exposure.\n * They inform; they are not accepted.\n *\n * APPLICATION_EVALUATION_TIME signals are facts about one application's own declarations, and every\n * one of them is downstream of a choice its operator made. Those are the ones a posture is about.\n *\n * ## This enum is the SOURCE, and the derivation is held to it\n *\n * The refs were string literals inside the report. A second list here, free to drift from the one the\n * script emits, is exactly the transcription defect the assurance anchoring rule exists to stop — so\n * the report now parses this enum and refuses when the set it emits and the set declared here\n * disagree, in EITHER direction. A signal added to the report with no member here fails; a member\n * here that no signal emits fails too, because an application could otherwise declare a posture\n * about an exposure nothing measures.\n */\nexport enum ApplicationRiskSignalRef {\n  /** Which engine capabilities are enabled, and therefore which exposures are structurally absent. */\n  CAPABILITY_SURFACE = 'application:capability-surface',\n  /** Whether every retention class the vocabulary carries has a declared period. */\n  RETENTION_DECLARATION = 'application:retention-declaration',\n  /** How many configured providers are vendor-hosted, each a third-party processor. */\n  PROVIDER_HOSTING = 'application:provider-hosting',\n  /** Which personal-data categories this application's own resources declare, and whether any is special category. */\n  PERSONAL_DATA_INVENTORY = 'application:personal-data-inventory',\n  /** Resources that have not answered the personal-data question at all. */\n  PERSONAL_DATA_DECLARATION_GAP = 'application:personal-data-declaration-gap',\n  /** Operations reachable by an external agent over MCP. */\n  EXTERNAL_EXPOSURE_MCP = 'application:external-exposure-mcp',\n  /**\n   * Where the brand's chosen NAME stands against its minimal trademark screening: cleared, screened\n   * incomplete, kept despite a live conflicting mark or named competitor, or never screened. A fact about the\n   * application's own declarations (its brand and its screening), downstream of a choice its creator made.\n   */\n  BRAND_NAME_TRADEMARK_STANDING = 'application:brand-name-trademark-standing',\n}\n\n/**\n * What an operator has DECIDED to do about an exposure.\n *\n * NIST SP 800-39 names the risk responses as accepting, avoiding, mitigating, sharing or\n * transferring risk, and that set is what this enum takes — the options, not the spelling.\n * spec-cite: NIST SP 800-39 / CSRC glossary, \"risk response\" — paraphrased from the published\n * definition, not quoted.\n *\n * ## Only NIST is NAMED here, and that is a licensing line rather than a preference\n *\n * Other risk-management standards describe the same options and are LICENSED documents. Naming one\n * in engine source would put a paid standard's identity into shipped code, which is why this\n * repository's boundary rule keeps external framework names to rights-classified mapping and report\n * surfaces. NIST publications are US government works, so citing one here costs nothing — and the\n * practice is already settled: NIST is named in 34 engine and platform files.\n *\n * The options are borrowed either way. Being INSPIRED by a standard and NAMING it are different\n * acts, and only the second carries a licence.\n *\n * ## No band, no score, no number — and that is inherited rather than chosen here\n *\n * Layer 1 emits signals carrying NO score, weight, level or severity, and asserts that prohibition\n * structurally. A posture that arrived as a 1–5 appetite rating would put a number underneath a layer\n * that refuses to produce one, and the number is what a reader trusts without checking. What an\n * operator can honestly say about an exposure is which of these four they chose and why, so that is\n * what the declaration carries.\n *\n * assurance-control: WILDO.RISK.TREATMENT_DECLARED — an operator's chosen treatment per exposure,\n * with the reasoning, in a form a measurement can contradict.\n *\n * ## `AVOIDED` is the member that makes this layer worth having\n *\n * The other three are consistent with any measurement: an application that REDUCED, SHARED or\n * ACCEPTED an exposure still has it, so the signal and the posture agree whatever the signal says.\n * `AVOIDED` claims the exposure is not taken at all, which a Layer 1 signal can CONTRADICT — declare\n * that vendor-hosted processing is avoided while two of three configured providers are vendor-hosted,\n * and the two statements cannot both be true.\n *\n * That is the difference between this and a questionnaire answer. A free-text \"describe your risk\n * appetite\" is unfalsifiable by construction; a typed posture beside a derived signal is a claim the\n * product itself can disagree with.\n */\nexport enum RiskTreatmentPosture {\n  /**\n   * The application does not take this exposure at all.\n   *\n   * The only FALSIFIABLE posture — a signal reporting the exposure present contradicts it directly.\n   */\n  AVOIDED = 'AVOIDED',\n  /** Taken, with controls that lower its likelihood or its consequence. */\n  REDUCED = 'REDUCED',\n  /**\n   * Taken, with the consequence placed on another party by CONTRACT — an Art. 28 processor agreement\n   * being the case this framework can actually evidence.\n   *\n   * Narrower than \"share or transfer\" on purpose. Insurance-style transfer is a legitimate treatment\n   * and nothing in the product can attest it, so modelling it here would add a member no derivation\n   * could ever check. Naming the contractual case precisely is a smaller claim and a true one.\n   */\n  SHARED_BY_CONTRACT = 'SHARED_BY_CONTRACT',\n  /** Taken, and the exposure retained knowingly. */\n  ACCEPTED = 'ACCEPTED',\n}\n\n/**\n * One signal's posture, and why.\n *\n * `rationale` is REQUIRED, for the same reason `dataRetention` requires one: a posture with no reason\n * is a token, and the thing a reviewer needs is the sentence, not the enum member. \"We accept it\" is\n * what the member already says.\n *\n * ## What is deliberately NOT here\n *\n * **No `decidedBy` and no `decidedAt`.** Acceptance is a COMMIT — `one-source-of-truth.md` rule 7 and\n * D5 — so the author and the instant are already recorded, mergeably and by a history everyone\n * audits. Fields restating them would be a second authority that can disagree with git, and they are\n * exactly the shape that made an earlier compliance record unproducible without forging an identity.\n *\n * **No review date.** `derive-before-you-ask.md` settles this: a date is a PROXY for \"an input may\n * have changed\", every input is in git and enumerable, so the trigger is computable and the date is\n * an output rather than something to type.\n */\nexport const ApplicationRiskPostureEntrySchema = z.strictObject({\n  posture: z.enum(RiskTreatmentPosture).describe('What the operator decided to do about this exposure.'),\n  rationale: z\n    .string()\n    .trim()\n    .min(1)\n    .describe('Why this posture, in the operator\\'s own words — the sentence a reviewer reads, not a restatement of the member.'),\n});\n\nexport type ApplicationRiskPostureEntry = z.infer<typeof ApplicationRiskPostureEntrySchema>;\n\n/**\n * An application's declared posture per risk signal — PARTIAL by construction.\n *\n * Every entry is optional and the whole declaration may be omitted. That is not laxity: a compliance\n * workflow may never stand in front of the mechanism (`application-creation-directive.md`), and a\n * required posture would make an application UNBUILDABLE until somebody decided something about\n * every signal the framework happens to derive. The undeclared set is REPORTED instead, by\n * {@link undeclaredRiskSignals}, which is the \"mark it, do not block\" shape that rule asks for.\n *\n * So absence is representable and means one thing — nobody has decided yet — and it is\n * distinguishable from `ACCEPTED`, which means somebody decided to live with it.\n *\n * `z.partialRecord`, NOT `z.record`: in Zod 4 a record keyed by an enum is EXHAUSTIVE — every member is\n * required, at parse and in the inferred type. That contradicted this contract silently while every\n * application declared every signal, and broke the day a signal was added\n * (`BRAND_NAME_TRADEMARK_STANDING`): Wonder Todos' six-entry posture stopped parsing. A new signal must\n * read as UNDECLARED in every existing application, never refuse it. Collapsing those two\n * is the failure this layer exists to avoid: silence is not acceptance.\n */\nexport const ApplicationRiskPostureSchema = z.partialRecord(\n  z.enum(ApplicationRiskSignalRef),\n  ApplicationRiskPostureEntrySchema,\n);\n\nexport type ApplicationRiskPosture = z.infer<typeof ApplicationRiskPostureSchema>;\n\n/**\n * The signals an application has declared NO posture for — what a register must mark as owed.\n *\n * Derived rather than stored, and total over the enum, so a signal added to the vocabulary tomorrow\n * is reported as undeclared by every existing application rather than silently omitted from the\n * answer. Deliberately the same shape as `undeclaredRetentionClasses`, because it is the same\n * question one layer over.\n */\nexport function undeclaredRiskSignals(\n  posture: ApplicationRiskPosture | undefined,\n): readonly ApplicationRiskSignalRef[] {\n  return Object.values(ApplicationRiskSignalRef).filter((signalRef) => posture?.[signalRef] === undefined);\n}\n\n/**\n * Postures that CLAIM AN EXPOSURE IS NOT TAKEN — the ones a measurement can contradict.\n *\n * Exported rather than inlined at the one call site, so the report and any later consumer ask the\n * same question. Today it is `AVOIDED` alone; if a future member is also falsifiable it joins here\n * and every consumer follows, which is the whole reason this is a function and not a comparison.\n */\nexport function riskPostureClaimsExposureAbsent(entry: ApplicationRiskPostureEntry | undefined): boolean {\n  return entry?.posture === RiskTreatmentPosture.AVOIDED;\n}\n"]}

package/dist/esm/config/analytics-value-moments.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics-value-moments.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/analytics-value-moments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;IACzC,KAAK,UAAU;IACf,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,mBAAmB,wBAAwB;IAC3C,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;CACtC;AAED,mHAAmH;AACnH,eAAO,MAAM,yBAAyB,EAAG,cAAuB,CAAC;AAEjE,6DAA6D;AAC7D,eAAO,MAAM,iCAAiC,EAAG,eAAwB,CAAC;AAE1E,2DAA2D;AAC3D,oBAAY,sBAAsB;IAChC,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,0DAA0D;AAC1D,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,qCAAqC,EAAG,2BAAoC,CAAC;AAI1F,oBAAY,eAAe;IACzB,kBAAkB,uBAAuB;IACzC,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAID;;;GAGG;AACH,eAAO,MAAM,wBAAwB,oGAGpC,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAuD1E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,eAAe;IACzB,4DAA4D;IAC5D,GAAG,QAAQ;IACX,+CAA+C;IAC/C,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,eAAe;IACzB,qFAAqF;IACrF,IAAI,SAAS;IACb,sDAAsD;IACtD,UAAU,eAAe;IACzB,+CAA+C;IAC/C,UAAU,eAAe;IACzB,uEAAuE;IACvE,YAAY,iBAAiB;CAC9B;AAED;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,sCAAsC;IACtC,IAAI,SAAS;IACb,oCAAoC;IACpC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,yBAAyB;;;iBAWpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAI5E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiD5B,CAAC;AACH,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"analytics-value-moments.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/analytics-value-moments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;IACzC,KAAK,UAAU;IACf,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,mBAAmB,wBAAwB;IAC3C,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;CACtC;AAED,mHAAmH;AACnH,eAAO,MAAM,yBAAyB,EAAG,cAAuB,CAAC;AAEjE,6DAA6D;AAC7D,eAAO,MAAM,iCAAiC,EAAG,eAAwB,CAAC;AAE1E,2DAA2D;AAC3D,oBAAY,sBAAsB;IAChC,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,0DAA0D;AAC1D,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,qCAAqC,EAAG,2BAAoC,CAAC;AAI1F,oBAAY,eAAe;IACzB,kBAAkB,uBAAuB;IACzC,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAID;;;GAGG;AACH,eAAO,MAAM,wBAAwB,oGAGpC,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAuD1E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,eAAe;IACzB,4DAA4D;IAC5D,GAAG,QAAQ;IACX,+CAA+C;IAC/C,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,eAAe;IACzB,qFAAqF;IACrF,IAAI,SAAS;IACb,sDAAsD;IACtD,UAAU,eAAe;IACzB,+CAA+C;IAC/C,UAAU,eAAe;IACzB,uEAAuE;IACvE,YAAY,iBAAiB;CAC9B;AAED;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,sCAAsC;IACtC,IAAI,SAAS;IACb,oCAAoC;IACpC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,yBAAyB;;;iBAWpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAI5E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiD5B,CAAC;AACH,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/config/analytics-value-moments.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"analytics-value-moments.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/analytics-value-moments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+IAA+I;AAC/I,MAAM,wBAAwB,GAAG;IAC/B,oBAAoB;IACpB,gBAAgB;IAChB,YAAY;IACZ,kBAAkB;IAClB,mBAAmB;IACnB,QAAQ;CACA,CAAC;AAEX,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAUX;AAVD,WAAY,kBAAkB;IAC5B,6CAAuB,CAAA;IACvB,+DAAyC,CAAA;IACzC,qCAAe,CAAA;IACf,+CAAyB,CAAA;IACzB,iDAA2B,CAAA;IAC3B,iEAA2C,CAAA;IAC3C,mDAA6B,CAAA;IAC7B,iDAA2B,CAAA;IAC3B,2DAAqC,CAAA;AACvC,CAAC,EAVW,kBAAkB,KAAlB,kBAAkB,QAU7B;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAuB,CAAC;AAEjE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,eAAwB,CAAC;AAE1E,2DAA2D;AAC3D,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,+CAAqB,CAAA;IACrB,6CAAmB,CAAA;AACrB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED,0DAA0D;AAC1D,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,uDAAiC,CAAA;IACjC,qDAA+B,CAAA;IAC/B,uDAAiC,CAAA;IACjC,uDAAiC,CAAA;AACnC,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,qCAAqC,GAAG,2BAAoC,CAAC;AAE1F,mEAAmE;AAEnE,MAAM,CAAN,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,4DAAyC,CAAA;IACzC,oDAAiC,CAAA;IACjC,4CAAyB,CAAA;IACzB,oDAAiC,CAAA;IACjC,gDAA6B,CAAA;AAC/B,CAAC,EANW,eAAe,KAAf,eAAe,QAM1B;AAED,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACzD,CAAC;AAGF,2GAA2G;AAE3G,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC;IACzD,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;IACrD,6BAA6B;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gCAAgC;IAChC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C,oDAAoD;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC;IACjD,iEAAiE;IACjE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC7C,mFAAmF;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;IACrD,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC;IACnD,qFAAqF;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE;IAClE,mCAAmC;IACnC,+BAA+B;IAC/B,2BAA2B;IAC3B,+BAA+B;IAC/B,6BAA6B;CAC9B,CAAC,CAAC;AAGH,mEAAmE;AAEnE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,4DAA4D;IAC5D,8BAAW,CAAA;IACX,+CAA+C;IAC/C,8BAAW,CAAA;AACb,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,qFAAqF;IACrF,gCAAa,CAAA;IACb,sDAAsD;IACtD,4CAAyB,CAAA;IACzB,+CAA+C;IAC/C,4CAAyB,CAAA;IACzB,uEAAuE;IACvE,gDAA6B,CAAA;AAC/B,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,sCAAsC;IACtC,iCAAa,CAAA;IACb,oCAAoC;IACpC,iDAA6B,CAAA;AAC/B,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,mEAAmE;AAEnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,mEAAmE;AAEnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IAE7B;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC;IAE9D,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,4EAA4E;IAC5E,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC;IAE1D;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC","sourcesContent":["/**\n * Analytics Value Moment Schemas\n * \n * Defines value signals and value moments for the analytics system.\n * Value moments represent meaningful milestones in a user's journey\n * (TTFV, aha moments, activation stages, anti-patterns).\n */\n\nimport { z } from 'zod';\n\n/** Navigation content type values for VIEW_VISIT signals. Inlined here — canonical enum lives in saas-frontend-lib (navigation-v3.schemas). */\nconst NAVIGATION_CONTENT_TYPES = [\n  'resource_operation',\n  'composite_view',\n  'chart_view',\n  'full_custom_view',\n  'flows_actors_view',\n  'custom',\n] as const;\n\n// ─── Analytics Event Names (auto-instrumentation) ───────────────\n\n/**\n * Built-in analytics track event names used by auto-instrumentation.\n * App-custom events use arbitrary strings via track(name, properties).\n */\nexport enum AnalyticsEventName {\n  PAGE_VIEW = 'page_view',\n  RESOURCE_OPERATION = 'resource_operation',\n  ERROR = 'error',\n  USER_LOGIN = 'user_login',\n  USER_LOGOUT = 'user_logout',\n  USER_STATUS_CHANGED = 'user_status_changed',\n  NOTIFICATION = 'notification',\n  HOTKEY_USED = 'hotkey_used',\n  FEATURE_ACCESSED = 'feature_accessed',\n}\n\n/** Event name prefix for value moments (TTFV, aha, activation). Anti-pattern uses ValueMomentRole.ANTI_PATTERN. */\nexport const VALUE_MOMENT_EVENT_PREFIX = 'value_moment' as const;\n\n/** Signal type value when ALL mode signals are completed. */\nexport const VALUE_MOMENT_SIGNAL_ALL_COMPLETED = 'all_completed' as const;\n\n/** Trigger source for ANALYTICS_MOMENT_ACHIEVED events. */\nexport enum AnalyticsTriggerSource {\n  FRONTEND = 'frontend',\n  BACKEND = 'backend',\n}\n\n/** Hotkey key values for HOTKEY_USED analytics events. */\nexport enum AnalyticsHotkeyKey {\n  COMMAND_MENU = 'command_menu',\n  SIDEBAR_TOGGLE = 'sidebar_toggle',\n  NOTIFICATIONS = 'notifications',\n  QUICK_SWITCHER = 'quick_switcher',\n  SHORTCUTS_HELP = 'shortcuts_help',\n}\n\n/** Storage key prefix for achieved moments (suffixed with userId). */\nexport const ANALYTICS_ACHIEVED_STORAGE_KEY_PREFIX = 'wildo_analytics_achieved_' as const;\n\n// ─── Signal Types ───────────────────────────────────────────────\n\nexport enum ValueSignalType {\n  RESOURCE_OPERATION = 'resource_operation',\n  RESOURCE_STATE = 'resource_state',\n  VIEW_VISIT = 'view_visit',\n  FEATURE_ACCESS = 'feature_access',\n  CUSTOM_EVENT = 'custom_event',\n}\n\n// ─── Primitive filter (shallow equality matching only) ──────────\n\n/**\n * Only primitive values supported — no nested objects or arrays.\n * The engine evaluates: Object.entries(filter).every(([k, v]) => resource[k] === v)\n */\nexport const ValueSignal_FilterSchema = z.record(\n  z.string(),\n  z.union([z.string(), z.number(), z.boolean(), z.null()])\n);\nexport type ValueSignal_Filter = z.infer<typeof ValueSignal_FilterSchema>;\n\n// ─── Signal variant schemas (discriminated union on `signalType` — avoids Mongoose reserved `type`) ─────\n\nconst ValueSignal_ResourceOperationSchema = z.object({\n  signalType: z.literal(ValueSignalType.RESOURCE_OPERATION),\n  /** Resource type identifier (e.g., 'PROJECTS', 'REPORTS') */\n  resourceType: z.string().min(1),\n  /** Operation identifier (e.g., CoreResourceOperation.CREATE) */\n  operation: z.string().min(1),\n  /**\n   * Optional resource field filter. Only operations on resources matching this\n   * filter count. Filter evaluation requires the NOTIFY_RESOURCE_SUCCESS event\n   * to carry a `resultSummary` field.\n   */\n  filter: ValueSignal_FilterSchema.optional(),\n  /**\n   * Minimum occurrence count required. When omitted (or 1), the first matching event fires.\n   * When > 1, the engine counts matching events and fires at the N-th occurrence.\n   */\n  threshold: z.number().min(1).optional(),\n});\n\nconst ValueSignal_ResourceStateSchema = z.object({\n  signalType: z.literal(ValueSignalType.RESOURCE_STATE),\n  /** Resource type to count */\n  resourceType: z.string().min(1),\n  /** Field filter for counting */\n  filter: ValueSignal_FilterSchema.optional(),\n  /** Minimum count required to satisfy this signal */\n  threshold: z.number().min(1),\n});\n\nconst ValueSignal_ViewVisitSchema = z.object({\n  signalType: z.literal(ValueSignalType.VIEW_VISIT),\n  /** Navigation content type (e.g., COMPOSITE_VIEW, CHART_VIEW) */\n  contentType: z.enum(NAVIGATION_CONTENT_TYPES),\n  /** Specific view reference. If omitted, any view of this contentType qualifies. */\n  viewRef: z.string().optional(),\n});\n\nconst ValueSignal_FeatureAccessSchema = z.object({\n  signalType: z.literal(ValueSignalType.FEATURE_ACCESS),\n  /** Feature identifier from FeatureDefinition */\n  featureId: z.string().min(1),\n});\n\nconst ValueSignal_CustomEventSchema = z.object({\n  signalType: z.literal(ValueSignalType.CUSTOM_EVENT),\n  /** Custom event name (tracked via useAnalytics().track() or backend emitSignal()) */\n  eventName: z.string().min(1),\n  /** Threshold: number of occurrences before the signal fires. Default: 1 */\n  threshold: z.number().min(1).optional(),\n});\n\nexport const ValueSignalSchema = z.discriminatedUnion('signalType', [\n  ValueSignal_ResourceOperationSchema,\n  ValueSignal_ResourceStateSchema,\n  ValueSignal_ViewVisitSchema,\n  ValueSignal_FeatureAccessSchema,\n  ValueSignal_CustomEventSchema,\n]);\nexport type ValueSignal = z.infer<typeof ValueSignalSchema>;\n\n// ─── Value Moment Enums ─────────────────────────────────────────\n\n/**\n * @wildo_source:part:start saas.models.analytics.value-moments facet:layer:shared facet:audience:app-developer\n *\n * A VALUE MOMENT is something meaningful happening in a person's journey — first value reached, an\n * aha moment, an activation stage, or an anti-pattern worth noticing. An application declares them\n * as `analytics.valueMoments`, and reads `achievedMoments` from the analytics context to drive an\n * onboarding surface.\n *\n * ⚠️ **They need the ANALYTICS capability enabled.** `analytics.enabled` is a master switch —\n * `false` means no analytics at all, whatever a user consented to — so a declared value moment with\n * analytics off is evaluated by nothing and the surface reading `achievedMoments` renders empty.\n * Enabling analytics with an EMPTY provider list is how an application gets the internal progression\n * plane without telemetry leaving it.\n *\n * The `role` is the load-bearing field, because it changes three things at once — event naming,\n * whether the moment PERSISTS once achieved, and how the engine evaluates it. In particular\n * `ANTI_PATTERN` is deliberately NOT persisted and uses `cooldownMs` to allow repeated notices\n * while the behaviour continues. `beforeStage` is a general inverse prerequisite for every role:\n * once any listed moment is achieved, evaluation is suppressed. It is especially useful for\n * stopping an anti-pattern after the person reaches the stage that makes it moot.\n */\nexport enum ValueMomentMode {\n  /** ANY signal in the list triggers the moment (OR logic) */\n  ANY = 'ANY',\n  /** ALL signals must be achieved (AND logic) */\n  ALL = 'ALL',\n}\n\n/**\n * Semantic role of a value moment.\n * Determines event naming, persistence behavior, and how the system treats the moment.\n */\nexport enum ValueMomentRole {\n  /** Time to First Value — the primary metric. Exactly 0 or 1 per scope per config. */\n  TTFV = 'ttfv',\n  /** Aha moment — behavior correlated with retention */\n  AHA_MOMENT = 'aha_moment',\n  /** Activation stage — progression milestone */\n  ACTIVATION = 'activation',\n  /** Anti-pattern — negative signal correlated with churn/frustration */\n  ANTI_PATTERN = 'anti_pattern',\n}\n\n/**\n * Scope entity for the value moment.\n * Determines whose journey is being measured and where achieved state is persisted.\n */\nexport enum ValueMomentScope {\n  /** Per-user value moment (default) */\n  USER = 'user',\n  /** Per-organization value moment */\n  ORGANIZATION = 'organization',\n}\n\n// ─── Value Moment Callback ──────────────────────────────────────\n\nexport const ValueMomentCallbackSchema = z.object({\n  /**\n   * Frontend: when true, emits FrontendEvents.ANALYTICS_MOMENT_ACHIEVED on achievement.\n   * App-custom code subscribes and filters by momentIdentifier for custom reactions.\n   */\n  frontendEvent: z.boolean().default(false),\n  /**\n   * Backend: Registered handler identifier to invoke when achieved.\n   * Handler resolved from a registry (similar to resource custom service implementations).\n   */\n  backendHandler: z.string().optional(),\n});\nexport type ValueMomentCallback = z.infer<typeof ValueMomentCallbackSchema>;\n\n// ─── Value Moment Definition ────────────────────────────────────\n\nexport const ValueMomentSchema = z.object({\n  /** Unique identifier (used as analytics event name prefix + persistence key) */\n  identifier: z.string().min(1),\n\n  /**\n   * Semantic role. Determines:\n   * - Event naming: TTFV/AHA_MOMENT/ACTIVATION emit 'value_moment.{id}', ANTI_PATTERN emits 'anti_pattern.{id}'\n   * - Persistence: TTFV/AHA_MOMENT/ACTIVATION are persisted once achieved. ANTI_PATTERN is NOT persisted.\n   * - Engine behavior: ANTI_PATTERN uses cooldownMs + beforeStage.\n   */\n  role: z.enum(ValueMomentRole),\n\n  /**\n   * Scope entity. Determines whose journey is measured.\n   * USER: per-user (default). ORGANIZATION: per-org.\n   */\n  scope: z.enum(ValueMomentScope).default(ValueMomentScope.USER),\n\n  /** Signals that compose this value moment */\n  signals: z.array(ValueSignalSchema).min(1),\n\n  /** Composition mode: ANY = first signal wins, ALL = all signals required */\n  mode: z.enum(ValueMomentMode).default(ValueMomentMode.ANY),\n\n  /**\n   * Prerequisite moment identifiers. This moment only starts evaluating\n   * AFTER all prerequisite moments have been achieved.\n   */\n  requires: z.array(z.string()).optional(),\n\n  /**\n   * Inverse prerequisite: this moment only evaluates BEFORE the specified\n   * stage(s) have been achieved. Once any beforeStage moment is achieved,\n   * this moment is permanently suppressed. Primarily used for ANTI_PATTERN role.\n   */\n  beforeStage: z.array(z.string()).optional(),\n\n  /**\n   * Cooldown in milliseconds between re-firings (only meaningful for ANTI_PATTERN role).\n   * Default: 300_000 (5 minutes) for ANTI_PATTERN, ignored for other roles.\n   */\n  cooldownMs: z.number().min(0).optional(),\n\n  /**\n   * Callback hooks triggered when the moment is achieved.\n   * - frontendEvent: emits ANALYTICS_MOMENT_ACHIEVED on the EventBus\n   * - backendHandler: invokes a registered handler\n   */\n  onAchieved: ValueMomentCallbackSchema.optional(),\n});\n/** @wildo_source:part:end saas.models.analytics.value-moments */\nexport type ValueMoment = z.infer<typeof ValueMomentSchema>;\n"]}
+{"version":3,"file":"analytics-value-moments.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/analytics-value-moments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+IAA+I;AAC/I,MAAM,wBAAwB,GAAG;IAC/B,oBAAoB;IACpB,gBAAgB;IAChB,YAAY;IACZ,kBAAkB;IAClB,mBAAmB;IACnB,QAAQ;CACA,CAAC;AAEX,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAUX;AAVD,WAAY,kBAAkB;IAC5B,6CAAuB,CAAA;IACvB,+DAAyC,CAAA;IACzC,qCAAe,CAAA;IACf,+CAAyB,CAAA;IACzB,iDAA2B,CAAA;IAC3B,iEAA2C,CAAA;IAC3C,mDAA6B,CAAA;IAC7B,iDAA2B,CAAA;IAC3B,2DAAqC,CAAA;AACvC,CAAC,EAVW,kBAAkB,KAAlB,kBAAkB,QAU7B;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAuB,CAAC;AAEjE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,eAAwB,CAAC;AAE1E,2DAA2D;AAC3D,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,+CAAqB,CAAA;IACrB,6CAAmB,CAAA;AACrB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED,0DAA0D;AAC1D,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,uDAAiC,CAAA;IACjC,qDAA+B,CAAA;IAC/B,uDAAiC,CAAA;IACjC,uDAAiC,CAAA;AACnC,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,qCAAqC,GAAG,2BAAoC,CAAC;AAE1F,mEAAmE;AAEnE,MAAM,CAAN,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,4DAAyC,CAAA;IACzC,oDAAiC,CAAA;IACjC,4CAAyB,CAAA;IACzB,oDAAiC,CAAA;IACjC,gDAA6B,CAAA;AAC/B,CAAC,EANW,eAAe,KAAf,eAAe,QAM1B;AAED,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACzD,CAAC;AAGF,2GAA2G;AAE3G,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC;IACzD,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;IACrD,6BAA6B;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gCAAgC;IAChC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C,oDAAoD;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC;IACjD,iEAAiE;IACjE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC7C,mFAAmF;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;IACrD,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC;IACnD,qFAAqF;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE;IAClE,mCAAmC;IACnC,+BAA+B;IAC/B,2BAA2B;IAC3B,+BAA+B;IAC/B,6BAA6B;CAC9B,CAAC,CAAC;AAGH,mEAAmE;AAEnE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,4DAA4D;IAC5D,8BAAW,CAAA;IACX,+CAA+C;IAC/C,8BAAW,CAAA;AACb,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,qFAAqF;IACrF,gCAAa,CAAA;IACb,sDAAsD;IACtD,4CAAyB,CAAA;IACzB,+CAA+C;IAC/C,4CAAyB,CAAA;IACzB,uEAAuE;IACvE,gDAA6B,CAAA;AAC/B,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,sCAAsC;IACtC,iCAAa,CAAA;IACb,oCAAoC;IACpC,iDAA6B,CAAA;AAC/B,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,mEAAmE;AAEnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,mEAAmE;AAEnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IAE7B;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC;IAE9D,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,4EAA4E;IAC5E,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC;IAE1D;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC","sourcesContent":["/**\n * Analytics Value Moment Schemas\n * \n * Defines value signals and value moments for the analytics system.\n * Value moments represent meaningful milestones in a user's journey\n * (TTFV, aha moments, activation stages, anti-patterns).\n */\n\nimport { z } from 'zod';\n\n/** Navigation content type values for VIEW_VISIT signals. Inlined here — canonical enum lives in saas-frontend-lib (navigation-v3.schemas). */\nconst NAVIGATION_CONTENT_TYPES = [\n  'resource_operation',\n  'composite_view',\n  'chart_view',\n  'full_custom_view',\n  'flows_actors_view',\n  'custom',\n] as const;\n\n// ─── Analytics Event Names (auto-instrumentation) ───────────────\n\n/**\n * Built-in analytics track event names used by auto-instrumentation.\n * App-custom events use arbitrary strings via track(name, properties).\n */\nexport enum AnalyticsEventName {\n  PAGE_VIEW = 'page_view',\n  RESOURCE_OPERATION = 'resource_operation',\n  ERROR = 'error',\n  USER_LOGIN = 'user_login',\n  USER_LOGOUT = 'user_logout',\n  USER_STATUS_CHANGED = 'user_status_changed',\n  NOTIFICATION = 'notification',\n  HOTKEY_USED = 'hotkey_used',\n  FEATURE_ACCESSED = 'feature_accessed',\n}\n\n/** Event name prefix for value moments (TTFV, aha, activation). Anti-pattern uses ValueMomentRole.ANTI_PATTERN. */\nexport const VALUE_MOMENT_EVENT_PREFIX = 'value_moment' as const;\n\n/** Signal type value when ALL mode signals are completed. */\nexport const VALUE_MOMENT_SIGNAL_ALL_COMPLETED = 'all_completed' as const;\n\n/** Trigger source for ANALYTICS_MOMENT_ACHIEVED events. */\nexport enum AnalyticsTriggerSource {\n  FRONTEND = 'frontend',\n  BACKEND = 'backend',\n}\n\n/** Hotkey key values for HOTKEY_USED analytics events. */\nexport enum AnalyticsHotkeyKey {\n  COMMAND_MENU = 'command_menu',\n  SIDEBAR_TOGGLE = 'sidebar_toggle',\n  NOTIFICATIONS = 'notifications',\n  QUICK_SWITCHER = 'quick_switcher',\n  SHORTCUTS_HELP = 'shortcuts_help',\n}\n\n/** Storage key prefix for achieved moments (suffixed with userId). */\nexport const ANALYTICS_ACHIEVED_STORAGE_KEY_PREFIX = 'wildo_analytics_achieved_' as const;\n\n// ─── Signal Types ───────────────────────────────────────────────\n\nexport enum ValueSignalType {\n  RESOURCE_OPERATION = 'resource_operation',\n  RESOURCE_STATE = 'resource_state',\n  VIEW_VISIT = 'view_visit',\n  FEATURE_ACCESS = 'feature_access',\n  CUSTOM_EVENT = 'custom_event',\n}\n\n// ─── Primitive filter (shallow equality matching only) ──────────\n\n/**\n * Only primitive values supported — no nested objects or arrays.\n * The engine evaluates: Object.entries(filter).every(([k, v]) => resource[k] === v)\n */\nexport const ValueSignal_FilterSchema = z.record(\n  z.string(),\n  z.union([z.string(), z.number(), z.boolean(), z.null()])\n);\nexport type ValueSignal_Filter = z.infer<typeof ValueSignal_FilterSchema>;\n\n// ─── Signal variant schemas (discriminated union on `signalType` — avoids Mongoose reserved `type`) ─────\n\nconst ValueSignal_ResourceOperationSchema = z.object({\n  signalType: z.literal(ValueSignalType.RESOURCE_OPERATION),\n  /** Resource type identifier (e.g., 'PROJECTS', 'REPORTS') */\n  resourceType: z.string().min(1),\n  /** Operation identifier (e.g., CoreResourceOperation.CREATE) */\n  operation: z.string().min(1),\n  /**\n   * Optional resource field filter. Only operations on resources matching this\n   * filter count. Filter evaluation requires the NOTIFY_RESOURCE_SUCCESS event\n   * to carry a `resultSummary` field.\n   */\n  filter: ValueSignal_FilterSchema.optional(),\n  /**\n   * Minimum occurrence count required. When omitted (or 1), the first matching event fires.\n   * When > 1, the engine counts matching events and fires at the N-th occurrence.\n   */\n  threshold: z.number().min(1).optional(),\n});\n\nconst ValueSignal_ResourceStateSchema = z.object({\n  signalType: z.literal(ValueSignalType.RESOURCE_STATE),\n  /** Resource type to count */\n  resourceType: z.string().min(1),\n  /** Field filter for counting */\n  filter: ValueSignal_FilterSchema.optional(),\n  /** Minimum count required to satisfy this signal */\n  threshold: z.number().min(1),\n});\n\nconst ValueSignal_ViewVisitSchema = z.object({\n  signalType: z.literal(ValueSignalType.VIEW_VISIT),\n  /** Navigation content type (e.g., COMPOSITE_VIEW, CHART_VIEW) */\n  contentType: z.enum(NAVIGATION_CONTENT_TYPES),\n  /** Specific view reference. If omitted, any view of this contentType qualifies. */\n  viewRef: z.string().optional(),\n});\n\nconst ValueSignal_FeatureAccessSchema = z.object({\n  signalType: z.literal(ValueSignalType.FEATURE_ACCESS),\n  /** Feature identifier from FeatureDefinition */\n  featureId: z.string().min(1),\n});\n\nconst ValueSignal_CustomEventSchema = z.object({\n  signalType: z.literal(ValueSignalType.CUSTOM_EVENT),\n  /** Custom event name (tracked via useAnalytics().track() or backend emitSignal()) */\n  eventName: z.string().min(1),\n  /** Threshold: number of occurrences before the signal fires. Default: 1 */\n  threshold: z.number().min(1).optional(),\n});\n\nexport const ValueSignalSchema = z.discriminatedUnion('signalType', [\n  ValueSignal_ResourceOperationSchema,\n  ValueSignal_ResourceStateSchema,\n  ValueSignal_ViewVisitSchema,\n  ValueSignal_FeatureAccessSchema,\n  ValueSignal_CustomEventSchema,\n]);\nexport type ValueSignal = z.infer<typeof ValueSignalSchema>;\n\n// ─── Value Moment Enums ─────────────────────────────────────────\n\n/**\n * @wildo_source:part:start saas.models.analytics.value-moments facet:layer:shared facet:audience:app-developer\n *\n * A VALUE MOMENT is something meaningful happening in a person's journey — first value reached, an\n * aha moment, an activation stage, or an anti-pattern worth noticing. An application declares them\n * as `analytics.valueMoments`, and reads `achievedMoments` from the analytics context to drive an\n * onboarding surface.\n *\n * ⚠️ **They need the ANALYTICS capability enabled.** `analytics.enabled` is a master switch —\n * `false` means no analytics at all, whatever a user consented to — so a declared value moment with\n * analytics off is evaluated by nothing and the surface reading `achievedMoments` renders empty.\n * Enabling analytics with an EMPTY provider list is how an application gets the internal progression\n * plane without telemetry leaving it.\n *\n * The `role` is the load-bearing field, because it changes three things at once — event naming,\n * whether the moment PERSISTS once achieved, and how the engine evaluates it. In particular\n * `ANTI_PATTERN` is deliberately NOT persisted and uses `cooldownMs` to allow repeated notices\n * while the behaviour continues. `beforeStage` is a general inverse prerequisite for every role:\n * once any listed moment is achieved, evaluation is suppressed. It is especially useful for\n * stopping an anti-pattern after the person reaches the stage that makes it moot.\n */\nexport enum ValueMomentMode {\n  /** ANY signal in the list triggers the moment (OR logic) */\n  ANY = 'ANY',\n  /** ALL signals must be achieved (AND logic) */\n  ALL = 'ALL',\n}\n\n/**\n * Semantic role of a value moment.\n * Determines event naming, persistence behavior, and how the system treats the moment.\n */\nexport enum ValueMomentRole {\n  /** Time to First Value — the primary metric. Exactly 0 or 1 per scope per config. */\n  TTFV = 'ttfv',\n  /** Aha moment — behavior correlated with retention */\n  AHA_MOMENT = 'aha_moment',\n  /** Activation stage — progression milestone */\n  ACTIVATION = 'activation',\n  /** Anti-pattern — negative signal correlated with churn/frustration */\n  ANTI_PATTERN = 'anti_pattern',\n}\n\n/**\n * Scope entity for the value moment.\n * Determines whose journey is being measured and where achieved state is persisted.\n */\nexport enum ValueMomentScope {\n  /** Per-user value moment (default) */\n  USER = 'user',\n  /** Per-organization value moment */\n  ORGANIZATION = 'organization',\n}\n\n// ─── Value Moment Callback ──────────────────────────────────────\n\nexport const ValueMomentCallbackSchema = z.object({\n  /**\n   * Frontend: when true, emits FrontendEvents.ANALYTICS_MOMENT_ACHIEVED on achievement.\n   * App-custom code subscribes and filters by momentIdentifier for custom reactions.\n   */\n  frontendEvent: z.boolean().default(false),\n  /**\n   * Backend: Registered handler identifier to invoke when achieved.\n   * Handler resolved from a registry (similar to resource custom service implementations).\n   */\n  backendHandler: z.string().optional(),\n});\nexport type ValueMomentCallback = z.infer<typeof ValueMomentCallbackSchema>;\n\n// ─── Value Moment Definition ────────────────────────────────────\n\nexport const ValueMomentSchema = z.object({\n  /** Unique identifier (used as analytics event name prefix + persistence key) */\n  identifier: z.string().min(1),\n\n  /**\n   * Semantic role. Determines:\n   * - Event naming: TTFV/AHA_MOMENT/ACTIVATION emit 'value_moment.{id}', ANTI_PATTERN emits 'anti_pattern.{id}'\n   * - Persistence: TTFV/AHA_MOMENT/ACTIVATION are persisted once achieved. ANTI_PATTERN is NOT persisted.\n   * - Engine behavior: ANTI_PATTERN uses cooldownMs + beforeStage.\n   */\n  role: z.enum(ValueMomentRole),\n\n  /**\n   * Scope entity. Determines whose journey is measured.\n   * USER: per-user (default). ORGANIZATION: per-org.\n   */\n  scope: z.enum(ValueMomentScope).default(ValueMomentScope.USER),\n\n  /** Signals that compose this value moment */\n  signals: z.array(ValueSignalSchema).min(1),\n\n  /** Composition mode: ANY = first signal wins, ALL = all signals required */\n  mode: z.enum(ValueMomentMode).default(ValueMomentMode.ANY),\n\n  /**\n   * Prerequisite moment identifiers. This moment only starts evaluating\n   * AFTER all prerequisite moments have been achieved.\n   */\n  requires: z.array(z.string()).optional(),\n\n  /**\n   * Inverse prerequisite: this moment only evaluates BEFORE the specified\n   * stage(s) have been achieved. Once any beforeStage moment is achieved,\n   * this moment is permanently suppressed. Primarily used for ANTI_PATTERN role.\n   */\n  beforeStage: z.array(z.string()).optional(),\n\n  /**\n   * Cooldown in milliseconds between re-firings (only meaningful for ANTI_PATTERN role).\n   * Default: 300_000 (5 minutes) for ANTI_PATTERN, ignored for other roles.\n   */\n  cooldownMs: z.number().min(0).optional(),\n\n  /**\n   * Callback hooks triggered when the moment is achieved.\n   * - frontendEvent: emits ANALYTICS_MOMENT_ACHIEVED on the EventBus\n   * - backendHandler: invokes a registered handler\n   */\n  onAchieved: ValueMomentCallbackSchema.optional(),\n});\n/** @wildo_source:part:end saas.models.analytics.value-moments */\nexport type ValueMoment = z.infer<typeof ValueMomentSchema>;\n"]}

package/dist/esm/config/app-configuration-shared.shared.schemas.d.ts

@@ -183,6 +183,35 @@ export declare const AppConfiguration_Shared_ComplianceSchema: z.ZodObject<{
         requiredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
         gatedProcessing: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    legalNotice: z.ZodOptional<z.ZodObject<{
+        establishmentJurisdiction: z.ZodOptional<z.ZodString>;
+        legalEntityName: z.ZodOptional<z.ZodString>;
+        registeredAddress: z.ZodOptional<z.ZodString>;
+        legalForm: z.ZodOptional<z.ZodString>;
+        authorizedRepresentatives: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        shareCapital: z.ZodOptional<z.ZodObject<{
+            amount: z.ZodString;
+            outstandingContributions: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        generalContact: z.ZodOptional<z.ZodObject<{
+            email: z.ZodEmail;
+            phone: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        tradeRegister: z.ZodOptional<z.ZodObject<{
+            register: z.ZodString;
+            registrationNumber: z.ZodString;
+        }, z.core.$strict>>;
+        vatIdentificationNumber: z.ZodOptional<z.ZodString>;
+        economicIdentificationNumber: z.ZodOptional<z.ZodString>;
+        supervisoryAuthority: z.ZodOptional<z.ZodString>;
+        regulatedProfession: z.ZodOptional<z.ZodObject<{
+            professionalBody: z.ZodString;
+            professionalTitle: z.ZodString;
+            titleGrantedIn: z.ZodString;
+            professionalRules: z.ZodString;
+        }, z.core.$strict>>;
+        inLiquidation: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>>;
     capabilityDeclaredConsentPurposes: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>>;
     dataRetention: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof import("..").DataRetentionClass> & z.core.$partial, z.ZodObject<{
         retentionDays: z.ZodNumber;
@@ -610,6 +639,35 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
             requiredPurposes: z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>;
             gatedProcessing: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
+        legalNotice: z.ZodOptional<z.ZodObject<{
+            establishmentJurisdiction: z.ZodOptional<z.ZodString>;
+            legalEntityName: z.ZodOptional<z.ZodString>;
+            registeredAddress: z.ZodOptional<z.ZodString>;
+            legalForm: z.ZodOptional<z.ZodString>;
+            authorizedRepresentatives: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            shareCapital: z.ZodOptional<z.ZodObject<{
+                amount: z.ZodString;
+                outstandingContributions: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            generalContact: z.ZodOptional<z.ZodObject<{
+                email: z.ZodEmail;
+                phone: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            tradeRegister: z.ZodOptional<z.ZodObject<{
+                register: z.ZodString;
+                registrationNumber: z.ZodString;
+            }, z.core.$strict>>;
+            vatIdentificationNumber: z.ZodOptional<z.ZodString>;
+            economicIdentificationNumber: z.ZodOptional<z.ZodString>;
+            supervisoryAuthority: z.ZodOptional<z.ZodString>;
+            regulatedProfession: z.ZodOptional<z.ZodObject<{
+                professionalBody: z.ZodString;
+                professionalTitle: z.ZodString;
+                titleGrantedIn: z.ZodString;
+                professionalRules: z.ZodString;
+            }, z.core.$strict>>;
+            inLiquidation: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strict>>;
         capabilityDeclaredConsentPurposes: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof ConsentPurpose>>>;
         dataRetention: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof import("..").DataRetentionClass> & z.core.$partial, z.ZodObject<{
             retentionDays: z.ZodNumber;
@@ -752,8 +810,8 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         activationCriteria: z.ZodOptional<z.ZodObject<{
             mode: z.ZodDefault<z.ZodEnum<{
-                ALL: "ALL";
                 ANY: "ANY";
+                ALL: "ALL";
             }>>;
             criteria: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
                 criterionType: z.ZodLiteral<import("..").ActivationCriterionType.MILESTONE>;
@@ -793,6 +851,10 @@ export declare const AppConfiguration_Shared_Schema: z.ZodObject<{
         applicationReadAccess: z.ZodOptional<z.ZodEnum<typeof import("..").AuditApplicationReadAccess>>;
         archiveAfterDays: z.ZodOptional<z.ZodNumber>;
         allowPrivateNetworkSiemCollectors: z.ZodOptional<z.ZodBoolean>;
+        applicationEventTypes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            category: z.ZodEnum<typeof import("..").AuditEventCategory>;
+            severity: z.ZodEnum<typeof import("..").AuditEventSeverity>;
+        }, z.core.$strict>>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;

package/dist/esm/config/app-configuration-shared.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-configuration-shared.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAmC,MAAM,6CAA6C,CAAC;AAGzH,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC3I,OAAO,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAM/E,OAAO,EAAE,4BAA4B,EAA4C,MAAM,uEAAuE,CAAC;AAC/J,OAAO,EAAE,8BAA8B,EAAwC,MAAM,2DAA2D,CAAC;AAIjJ,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AAEvF,OAAO,EAIL,mBAAmB,EACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,yBAAyB;;;;;;;;iBA+BpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;IAOtC;;;;;OAKG;;CAEK,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAIzH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAmD7C,CAAC;AAKH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+NnD,CAAC;AAIH,eAAO,MAAM,0CAA0C;;;;;;iBAqCrD,CAAC;AAGH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAGH,eAAO,MAAM,4CAA4C,GAAI,CAAC,SAAS,yBAAyB,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;;;;;iBAO5H,CAAA;AAED,eAAO,MAAM,qCAAqC;;;;;iBAAgF,CAAC;AAQnI,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAED,iHAAiH;AACjH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAe1C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuDhC,CAAC;AAOH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkGzC,CAAC;AAGH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC7G,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACnI,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"app-configuration-shared.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAmC,MAAM,6CAA6C,CAAC;AAGzH,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC3I,OAAO,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAO/E,OAAO,EAAE,4BAA4B,EAA4C,MAAM,uEAAuE,CAAC;AAC/J,OAAO,EAAE,8BAA8B,EAAwC,MAAM,2DAA2D,CAAC;AAIjJ,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AAEvF,OAAO,EAIL,mBAAmB,EACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,yBAAyB;;;;;;;;iBA+BpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;IAOtC;;;;;OAKG;;CAEK,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAIzH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAmD7C,CAAC;AAKH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0OnD,CAAC;AAIH,eAAO,MAAM,0CAA0C;;;;;;iBAqCrD,CAAC;AAGH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAGH,eAAO,MAAM,4CAA4C,GAAI,CAAC,SAAS,yBAAyB,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;;;;;iBAO5H,CAAA;AAED,eAAO,MAAM,qCAAqC;;;;;iBAAgF,CAAC;AAQnI,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAED,iHAAiH;AACjH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAe1C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuDhC,CAAC;AAOH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkGzC,CAAC;AAGH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC7G,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACnI,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/esm/config/app-configuration-shared.shared.schemas.js

@@ -20,6 +20,7 @@ import { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas.js';
 import { ClientInstanceIdScope, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas.js';
 import { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared.js';
 import { ServiceConsentRequirementSchema } from '../compliance/privacy/operator-compliance-identity.shared.schemas.js';
+import { LegalNoticeSchema } from '../compliance/privacy/legal-notice.shared.js';
 import { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas.js';
 import { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas.js';
 import { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas.js';
@@ -302,6 +303,16 @@ export const AppConfiguration_Shared_ComplianceSchema = z.object({
      * the declaration and the documents composed from it.
      */
     serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),
+    /**
+     * The legal notice (imprint) the application serves at `/legal-notice` (#2588): the operator's declared identity
+     * particulars, present only when the operator is established where a legal notice is owed (the EU and EEA under
+     * Directive 2000/31/EC Art. 5, the UK under SI 2002/2013 reg. 6, Switzerland under UWG Art. 3 Abs. 1 Bst. s; see `legalNoticeOwed`). Written by `wildo config legal-notice` from `operatorComplianceIdentity`, like
+     * `serviceConsentRequirement` above, so the page renders the declaration rather than a hand-kept copy.
+     * spec-cite: Directive 2000/31/EC Art. 5(1); SI 2002/2013 reg. 6(1); UWG (SR 241) Art. 3 Abs. 1 Bst. s
+     *
+     * Optional: absent means no notice is owed (or the establishment is undeclared), and the page says so.
+     */
+    legalNotice: LegalNoticeSchema.optional(),
     /**
      * Every purpose declared by at least one resource operation's `consentGate` (#1462, following
      * #1258 Step 3), so the application-tier consent-gate PROMPT can offer to grant it.