{
  "package": {
    "name": "notabenda",
    "version": "0.1.0"
  },
  "schemaVersion": 1,
  "kind": "notabenda-integration-reference",
  "requestedTargetIds": [
    "legal-pages",
    "authored-documents",
    "cookie-consent",
    "technology-functions",
    "embeds",
    "terms-agreement",
    "privacy-rights",
    "processing-opt-outs",
    "form-permissions",
    "consumer-contracts",
    "evidence",
    "localization",
    "regional-consent",
    "discovery"
  ],
  "boundaries": {
    "advisoryOnly": true,
    "writesFiles": false,
    "readsProject": false,
    "activatesFeatures": false,
    "legalReview": false
  },
  "configContract": {
    "schemaVersion": 1,
    "typeExport": "notabenda",
    "typeName": "SiteConfig",
    "schema": {
      "command": "notabenda schema [PATH] --json",
      "packageExport": "notabenda/config/schema.json",
      "website": "https://notabenda.org/site-config.schema.json",
      "purpose": "Generated authoring shape: exact known keys, required fields and allowed type values. Field lookup follows array items. Always run check for runtime and review rules; shape supplies no defaults or facts."
    },
    "validation": "notabenda check --config FILE --json",
    "jsonCli": true,
    "markdownMdx": "notabenda-authoring build API",
    "hostWorkIsNotConfig": true,
    "starterDefaultsAreNotFacts": true,
    "pathNotation": "Dot paths through inventory arrays refer to each item field, not literal JSON keys."
  },
  "assessment": {
    "command": "notabenda assess --selection FILE --config FILE --json",
    "optionalAnswers": "--answers FILE",
    "api": "notabenda/integration/assessment",
    "readOnly": true,
    "meaning": "Checks explicit config and practice answers against selected work. Declared fields are not verified facts; host work and review remain separate."
  },
  "selectionQuestions": [
    {
      "id": "documents",
      "targetId": "legal-pages",
      "question": "Do you want to add or update static privacy, cookie or terms documents?"
    },
    {
      "id": "authored-sources",
      "targetId": "authored-documents",
      "question": "Do you want to maintain documents as Markdown or trusted MDX with frontmatter?"
    },
    {
      "id": "optional-service-control",
      "targetId": "cookie-consent",
      "question": "Do you want visitors to control optional scripts or browser storage?"
    },
    {
      "id": "technology-notice",
      "targetId": "technology-functions",
      "question": "Do you want to disclose identification, location or profiling technology and explain its voluntary activation?"
    },
    {
      "id": "remote-media",
      "targetId": "embeds",
      "question": "Do you want remote media to stay unloaded until its service is permitted?"
    },
    {
      "id": "explicit-agreement",
      "targetId": "terms-agreement",
      "question": "Do you want an explicit acceptance action bound to an exact terms revision?"
    },
    {
      "id": "rights-entry",
      "targetId": "privacy-rights",
      "question": "Do you want a page linking visitors to your privacy request workflows?"
    },
    {
      "id": "processing-restrictions",
      "targetId": "processing-opt-outs",
      "question": "Do you want separate processing opt-outs or browser privacy signals connected to host restrictions?"
    },
    {
      "id": "form-permission",
      "targetId": "form-permissions",
      "question": "Do you want optional purpose/channel permission separate from submitting a form?"
    },
    {
      "id": "purchase-contract",
      "targetId": "consumer-contracts",
      "question": "Do you want consumer purchase or contract disclosures and action flows?"
    },
    {
      "id": "stored-evidence",
      "targetId": "evidence",
      "question": "Do you want durable records, retained archives or an operator backoffice?"
    },
    {
      "id": "translated-copy",
      "targetId": "localization",
      "question": "Do you want documents or controls in additional languages?"
    },
    {
      "id": "regional-timing",
      "targetId": "regional-consent",
      "question": "Do you want to assess and configure an explicit supported regional consent timing policy?"
    },
    {
      "id": "service-investigation",
      "targetId": "discovery",
      "question": "Do you want optional project scanning or review of authorized browser observations?"
    }
  ],
  "selectionTemplate": {
    "schemaVersion": 1,
    "answers": {
      "documents": "unknown",
      "authored-sources": "unknown",
      "optional-service-control": "unknown",
      "technology-notice": "unknown",
      "remote-media": "unknown",
      "explicit-agreement": "unknown",
      "rights-entry": "unknown",
      "processing-restrictions": "unknown",
      "form-permission": "unknown",
      "purchase-contract": "unknown",
      "stored-evidence": "unknown",
      "translated-copy": "unknown",
      "regional-timing": "unknown",
      "service-investigation": "unknown"
    }
  },
  "publicFactFields": [
    {
      "id": "siteName",
      "label": "Site name"
    },
    {
      "id": "siteId",
      "label": "Site ID (lowercase slug)"
    },
    {
      "id": "siteUrl",
      "label": "Public HTTPS site URL"
    },
    {
      "id": "controllerName",
      "label": "Public controller name"
    },
    {
      "id": "controllerEmail",
      "label": "Public privacy contact email"
    },
    {
      "id": "controllerAddress",
      "label": "Public controller postal address"
    }
  ],
  "relevantQuestionIds": [
    "personal-data",
    "transfers",
    "authored-content",
    "optional-storage",
    "children",
    "sensitive-data",
    "high-risk-profiling",
    "regulated-sector",
    "technology-functions",
    "embeds",
    "terms-agreement",
    "processing-opt-outs",
    "receipts",
    "consumer-payments",
    "consumer-distance-contracts",
    "consumer-continuing-contracts"
  ],
  "targets": [
    {
      "id": "legal-pages",
      "selection": "requested",
      "title": "Privacy, cookie and terms pages",
      "outcome": "Static documents or article fragments in the host layout.",
      "configPaths": [
        "site",
        "controller",
        "jurisdictions",
        "purposes",
        "services",
        "storage",
        "privacy",
        "terms",
        "documents"
      ],
      "hostWork": [
        "Choose routes and build integration; supply reviewed wording. Rendering a document does not collect agreement or gate services.",
        "The JSON CLI builds all three configured documents. Use renderer fragments when the host needs only selected documents."
      ],
      "questionIds": [
        "personal-data",
        "transfers"
      ],
      "factsNeeded": [
        "Public operator/contact facts",
        "Actual processing purposes, legal bases, categories, collection, retention, recipients and transfers",
        "Intended audience and service type",
        "Document routes, revisions and review state"
      ],
      "guides": [
        "https://notabenda.org/guide/package/index.md",
        "https://notabenda.org/guide/authoring/index.md"
      ],
      "prerequisites": [],
      "verify": [
        "Legal routes render without JavaScript.",
        "Public output excludes private fields.",
        "Production validation rejects unresolved facts and draft declarations."
      ]
    },
    {
      "id": "authored-documents",
      "selection": "requested",
      "title": "Markdown or MDX documents",
      "outcome": "Build-time authored documents with YAML frontmatter and retained revisions.",
      "configPaths": [
        "documents"
      ],
      "hostWork": [
        "Use notabenda-authoring compileAuthoredDocuments, not a Markdown CLI flag.",
        "Treat MDX imports/components as trusted build code; keep source archives private."
      ],
      "questionIds": [
        "authored-content"
      ],
      "factsNeeded": [
        "Trusted source files and component imports",
        "Stable section IDs, document version/effective date and actual review decision"
      ],
      "guides": [
        "https://notabenda.org/guide/authoring/index.md",
        "https://notabenda.org/guide/releases/index.md"
      ],
      "prerequisites": [
        "legal-pages"
      ],
      "verify": [
        "Compile the actual sources.",
        "Verify public HTML and private source archive separation.",
        "Pinned prior versions survive a clean build."
      ]
    },
    {
      "id": "cookie-consent",
      "selection": "requested",
      "requiredConfigPaths": [
        "consent",
        "consent.purposes",
        "consent.services"
      ],
      "title": "Cookie and optional-service controls",
      "outcome": "Optional loaders run only while their declared purpose/service permission is effective.",
      "configPaths": [
        "purposes",
        "services",
        "storage",
        "consent",
        "consent.purposes",
        "consent.services",
        "consent.information",
        "scopeGuards"
      ],
      "hostWork": [
        "Register actual start/cleanup lifecycles and remove parallel tags, hints or loaders.",
        "Choose vanilla, React or Astro controls around the same controller."
      ],
      "questionIds": [
        "optional-storage",
        "children",
        "sensitive-data",
        "high-risk-profiling",
        "regulated-sector"
      ],
      "factsNeeded": [
        "Actual optional loaders, storage names/types and cleanup targets",
        "Purpose/service IDs and deliberate material scope revisions",
        "Grant/refusal lifetimes and dismissal interval",
        "Scope assessments; present or unknown specialized processing remains gated"
      ],
      "guides": [
        "https://notabenda.org/guide/consent/index.md",
        "https://notabenda.org/guide/storage-cleanup/index.md",
        "https://notabenda.org/guide/scope-guards/index.md",
        "https://notabenda.org/guide/react/index.md",
        "https://notabenda.org/guide/astro/index.md"
      ],
      "prerequisites": [
        "legal-pages"
      ],
      "verify": [
        "No optional request on initial load or after rejection.",
        "Granular grants start only the selected work.",
        "Withdrawal stops owned work and clears declared markers.",
        "Reload, changed scopes and failure states retain restrictions."
      ]
    },
    {
      "id": "technology-functions",
      "selection": "requested",
      "requiredConfigPaths": [
        "scopeGuards"
      ],
      "title": "Technology collection notices",
      "outcome": "A static, versioned disclosure of identification, location or profiling functions and their activation method.",
      "configPaths": [
        "purposes",
        "services",
        "consent.services.scope",
        "scopeGuards",
        "documents.privacy"
      ],
      "hostWork": [
        "Use the optional build-only notabenda/technology API; supply reviewed function/activation copy and assign technologyCollectionScope(settings) before compiling.",
        "Place the notice before every activation opportunity, including global choices; use existing gated lifecycles and on-demand native controls when appropriate.",
        "Retain the exact descriptor separately from its legal artifact. Ordinary consent receipts do not automatically archive this supplemental notice."
      ],
      "questionIds": [
        "technology-functions"
      ],
      "factsNeeded": [
        "Actual covered technology, provider and all collection purposes",
        "Necessity, applicable scope and specialized processing assessment",
        "Public function declarations, activation instructions, complete host-language labels and review",
        "Fresh service material scope and actual cleanup"
      ],
      "guides": [
        "https://notabenda.org/guide/technology-collection/index.md",
        "https://notabenda.org/guide/consent/index.md",
        "https://notabenda.org/guide/scope-guards/index.md"
      ],
      "prerequisites": [
        "cookie-consent"
      ],
      "verify": [
        "The disclosure and activation instructions render without JavaScript.",
        "Opening the controls does not activate the function.",
        "Old generic grants cannot start the new function.",
        "Actual service starts, withdrawal, receipt failure and processing restrictions retain the existing gates."
      ]
    },
    {
      "id": "embeds",
      "selection": "requested",
      "title": "Gated media",
      "outcome": "Remote media stays inert until its service is permitted.",
      "configPaths": [
        "services.resourceOrigins"
      ],
      "hostWork": [
        "Use inert placeholders and consent-gated resource mounting; audit initial markup and resource hints."
      ],
      "questionIds": [
        "embeds"
      ],
      "factsNeeded": [
        "Initial resource origins",
        "Actual media elements and their owning service"
      ],
      "guides": [
        "https://notabenda.org/guide/embeds/index.md"
      ],
      "prerequisites": [
        "cookie-consent"
      ],
      "verify": [
        "No remote src/hint before permission.",
        "Withdrawal restores the placeholder without granting a new choice."
      ]
    },
    {
      "id": "terms-agreement",
      "selection": "requested",
      "title": "Explicit agreement to terms",
      "outcome": "An unchecked action bound to an exact terms revision with an acknowledged receipt.",
      "configPaths": [
        "documents.terms"
      ],
      "hostWork": [
        "Create/register the exact offer; bind a host context and transport to the agreement control.",
        "A terms page alone is not an agreement flow. Keep cookie preferences separate."
      ],
      "questionIds": [
        "terms-agreement"
      ],
      "factsNeeded": [
        "Action requiring agreement",
        "Exact terms version and action wording",
        "Host context identity, receipt admission and failure/retry behavior"
      ],
      "guides": [
        "https://notabenda.org/guide/terms/index.md"
      ],
      "prerequisites": [
        "legal-pages"
      ],
      "verify": [
        "Initially unchecked.",
        "Displayed document matches the offer revision.",
        "Failure cannot appear acknowledged; successful receipt remains inspectable."
      ]
    },
    {
      "id": "privacy-rights",
      "selection": "requested",
      "requiredConfigPaths": [
        "rightsCenter"
      ],
      "title": "Privacy request entry points",
      "outcome": "A static page leading to the host’s real request workflows.",
      "configPaths": [
        "privacy",
        "rightsCenter"
      ],
      "hostWork": [
        "Supply real routes/contact fallback and implement request intake and fulfillment."
      ],
      "questionIds": [
        "personal-data"
      ],
      "factsNeeded": [
        "Available rights and action scope",
        "Actual destinations, contact and next steps"
      ],
      "guides": [
        "https://notabenda.org/guide/rights/index.md"
      ],
      "prerequisites": [
        "legal-pages"
      ],
      "verify": [
        "The page works without JavaScript.",
        "Every action reaches the intended host workflow."
      ]
    },
    {
      "id": "processing-opt-outs",
      "selection": "requested",
      "title": "Processing opt-outs and browser signals",
      "outcome": "Separate restrictions on declared processing activities.",
      "configPaths": [
        "services.processingActivities",
        "privacySignals"
      ],
      "hostWork": [
        "Connect GPC and any recorded opt-out workflow to downstream/account restrictions; cookie acceptance cannot lift them."
      ],
      "questionIds": [
        "processing-opt-outs"
      ],
      "factsNeeded": [
        "Actual sale/sharing/targeted-advertising flows",
        "Explicit applicability assessment and public explanation",
        "Host identity, durable restriction handling and downstream effects"
      ],
      "guides": [
        "https://notabenda.org/guide/privacy-signals/index.md",
        "https://notabenda.org/guide/processing-choices/index.md"
      ],
      "prerequisites": [
        "legal-pages"
      ],
      "verify": [
        "Applicable signals restrict the declared processing.",
        "Cookie acceptance does not remove a separate opt-out.",
        "Confirm downstream effects, beyond the browser indicator."
      ]
    },
    {
      "id": "form-permissions",
      "selection": "requested",
      "title": "Separate form permissions",
      "outcome": "Optional purpose/channel permission independent of submitting the surrounding form.",
      "configPaths": [
        "purposes"
      ],
      "hostWork": [
        "Create the exact permission offer and implement host context, transport, receipt and withdrawal."
      ],
      "questionIds": [
        "personal-data",
        "receipts"
      ],
      "factsNeeded": [
        "Purpose, channel and optional wording",
        "Action/context identity and durable acknowledgement policy"
      ],
      "guides": [
        "https://notabenda.org/guide/form-permissions/index.md"
      ],
      "prerequisites": [
        "legal-pages"
      ],
      "verify": [
        "Form submission never silently grants permission.",
        "Unchecked/failure states remain off.",
        "Independent withdrawal and reload recovery work."
      ]
    },
    {
      "id": "consumer-contracts",
      "selection": "requested",
      "title": "Consumer purchase and contract flows",
      "outcome": "Selected reviewed pre-purchase disclosures, payment action, confirmations or contract declaration flows.",
      "configPaths": [
        "terms.audience",
        "terms.serviceType",
        "documents.terms"
      ],
      "hostWork": [
        "Review each applicable flow separately: host quotes, payment/fulfillment, confirmations, withdrawal/cancellation, guarantees and delivery jobs are distinct."
      ],
      "questionIds": [
        "consumer-payments",
        "consumer-distance-contracts",
        "consumer-continuing-contracts",
        "receipts"
      ],
      "factsNeeded": [
        "Actual goods/services/digital content and consumer audience",
        "How/where a contract forms, price/renewal obligations and applicable exclusions/windows",
        "Required customer documents, delivery destination and independent host jobs"
      ],
      "guides": [
        "https://notabenda.org/guide/paid-orders/index.md",
        "https://notabenda.org/guide/order-confirmations/index.md",
        "https://notabenda.org/guide/contract-actions/index.md",
        "https://notabenda.org/guide/contract-dispatch/index.md",
        "https://notabenda.org/guide/guarantees/index.md",
        "https://notabenda.org/guide/guarantee-labels/index.md"
      ],
      "prerequisites": [
        "legal-pages"
      ],
      "verify": [
        "Final price/commitment and action match the host’s exact offer.",
        "Receipt/storage is not presented as payment, recipient delivery or contract fulfillment.",
        "Test each selected flow and its host handoff separately."
      ]
    },
    {
      "id": "evidence",
      "selection": "requested",
      "title": "Durable evidence and backoffice",
      "outcome": "Host-authorized archives and inspection of retained records.",
      "configPaths": [],
      "hostWork": [
        "Optional notabenda-cf storage/admin, or the host’s compatible recording integration.",
        "Implement authorization, fixed site/object scope, recording admission, identity, activation, retention, holds/erasure and private source/export grants."
      ],
      "questionIds": [
        "receipts"
      ],
      "factsNeeded": [
        "Which records must be retained and why",
        "Host authorization/identity and storage architecture",
        "Retention, access and operational policy"
      ],
      "guides": [
        "https://notabenda.org/guide/cloudflare-starter/index.md",
        "https://notabenda.org/guide/cloudflare/index.md",
        "https://notabenda.org/guide/consent-evidence/index.md",
        "https://notabenda.org/guide/releases/index.md",
        "https://notabenda.org/guide/evidence-lifecycle/index.md"
      ],
      "prerequisites": [
        "legal-pages"
      ],
      "verify": [
        "Unauthorized access is denied before storage access.",
        "Records bind exact retained releases.",
        "Private source/export needs separately granted authority.",
        "Restart, retry and retention behavior match the host policy."
      ]
    },
    {
      "id": "localization",
      "selection": "requested",
      "requiredConfigPaths": [
        "localization"
      ],
      "title": "Localized wording",
      "outcome": "Explicit host-supplied document/control wording and formatting.",
      "configPaths": [
        "site.locale",
        "localization"
      ],
      "hostWork": [
        "Supply complete reviewed message dictionaries and revision bindings; test direction and layout."
      ],
      "questionIds": [],
      "factsNeeded": [
        "Languages, complete wording and translation review",
        "Message/disclosure revisions and any terms statement"
      ],
      "guides": [
        "https://notabenda.org/guide/localization/index.md"
      ],
      "prerequisites": [
        "legal-pages"
      ],
      "verify": [
        "No unintended language fallback.",
        "Keyboard, long text and writing direction remain usable.",
        "Language selection does not activate regional policies."
      ]
    },
    {
      "id": "regional-consent",
      "selection": "requested",
      "title": "Explicit regional consent timing",
      "outcome": "Individually reviewed opt-in timing policies within documented coverage.",
      "configPaths": [
        "jurisdictions",
        "consent.promptPolicy",
        "consent.grantExpiryPolicy",
        "consent.grantLifetimeDays",
        "consent.refusalLifetimeDays"
      ],
      "hostWork": [
        "Assess applicability and each supported requirement; select only the policy actually needed."
      ],
      "questionIds": [
        "optional-storage"
      ],
      "factsNeeded": [
        "Actual jurisdiction/applicability decision",
        "Separate grant expiry, refusal memory and repeat-prompt requirements",
        "Material processing revisions and any supported change explanation"
      ],
      "guides": [
        "https://notabenda.org/guide/regional-prompts/index.md",
        "https://notabenda.org/guide/requirements/index.md"
      ],
      "prerequisites": [
        "cookie-consent"
      ],
      "verify": [
        "Policy selection is explicit.",
        "Boundary/return-visit behavior follows the selected policy.",
        "Permission expiry, repeat solicitation and evidence retention use separate clocks."
      ]
    },
    {
      "id": "discovery",
      "selection": "requested",
      "title": "Optional service discovery",
      "outcome": "Private candidates and coverage limits for operator review.",
      "configPaths": [],
      "hostWork": [
        "Deliberately select project scanning and/or authorized browser observations."
      ],
      "questionIds": [],
      "factsNeeded": [
        "Directory/scenario authorized for inspection",
        "Actual use and provider facts for each accepted candidate"
      ],
      "guides": [
        "https://notabenda.org/guide/discovery/index.md",
        "https://notabenda.org/guide/service-catalog/index.md"
      ],
      "prerequisites": [],
      "verify": [
        "No project modules/scripts or vendor probes execute.",
        "Findings do not alter inventory or permissions.",
        "Review skipped channels and files; an empty report proves no absence."
      ]
    }
  ],
  "questions": [
    {
      "id": "personal-data",
      "title": "Do you process personal data?",
      "detail": "Include contact forms, accounts, IP addresses in hosting logs, support and third-party tools.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "purposes",
        "services",
        "privacy",
        "rightsCenter"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-EU-NOTICE",
        "REQ-NZ-NOTICE",
        "REQ-PRODUCT-COLLECTION-NOTICE",
        "REQ-PRODUCT-RIGHTS-CENTER"
      ],
      "guide": "https://notabenda.org/guide/collection/index.md"
    },
    {
      "id": "optional-storage",
      "title": "Do optional tools store or read browser information?",
      "detail": "Include analytics, advertising, personalization, pixels and local/session storage. An “essential” label needs a specific justification.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "storage",
        "consent"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-EU-DEVICE",
        "REQ-PRODUCT-CONSENT-RUNTIME",
        "REQ-PRODUCT-STORAGE-CLEANUP"
      ],
      "guide": "https://notabenda.org/guide/storage-cleanup/index.md"
    },
    {
      "id": "technology-functions",
      "title": "Do technologies identify, locate or profile people?",
      "detail": "Include recognition, location-based features and interest profiles. Distinguish ordinary profiling from biometrics, high-risk processing and entirely automated decisions.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "purposes",
        "services",
        "consent.services.scope",
        "scopeGuards"
      ],
      "hostWorkRefs": [
        "host.technologyNotice"
      ],
      "requirementIds": [
        "REQ-QC-PROFILING"
      ],
      "guide": "https://notabenda.org/guide/technology-collection/index.md"
    },
    {
      "id": "embeds",
      "title": "Do you load third-party embeds or remote media?",
      "detail": "Include video, maps, social content, frames and pixels. Investigate vendor requests and storage before selecting exemptions.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "services.resourceOrigins"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-PRODUCT-EMBEDS",
        "REQ-EU-DEVICE"
      ],
      "guide": "https://notabenda.org/guide/embeds/index.md"
    },
    {
      "id": "processing-opt-outs",
      "title": "Could data be sold, shared for cross-context advertising, or used for targeted advertising?",
      "detail": "Assess actual data flows and legal definitions; vendor labels and a cookie category alone do not resolve this.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "services.processingActivities",
        "privacySignals"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-US-CA-CHOICES",
        "REQ-US-CA-GPC",
        "REQ-US-CO-GPC",
        "REQ-US-CT-GPC",
        "REQ-PRODUCT-PROCESSING-CHOICES"
      ],
      "guide": "https://notabenda.org/guide/processing-choices/index.md"
    },
    {
      "id": "terms-agreement",
      "title": "Do users explicitly agree to terms during a workflow?",
      "detail": "For example signup or an application action. A privacy notice acknowledgment is a separate question.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "documents.terms"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-PRODUCT-TERMS-ACCEPTANCE"
      ],
      "guide": "https://notabenda.org/guide/terms/index.md"
    },
    {
      "id": "consumer-payments",
      "title": "Do consumers buy, subscribe or enter paid contracts online?",
      "detail": "Assess audience, product/service, renewal, payment and cancellation practices. Generic terms do not implement checkout or cancellation rights.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "terms.audience",
        "terms.serviceType"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-EU-TERMS",
        "REQ-EU-ORDER-ACTION",
        "REQ-PRODUCT-CONTRACT-ACTIONS"
      ],
      "guide": "https://notabenda.org/guide/paid-orders/index.md"
    },
    {
      "id": "consumer-distance-contracts",
      "title": "Can consumers enter a contract here without meeting you in person?",
      "detail": "Include online purchases, subscriptions and services supplied in exchange for personal data. Describe where and how the contract is formed; a price alone does not decide withdrawal rights.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "terms.audience",
        "terms.serviceType"
      ],
      "hostWorkRefs": [
        "host.contractActions"
      ],
      "requirementIds": [
        "REQ-PRODUCT-CONTRACT-ACTIONS",
        "REQ-EU-WITHDRAWAL",
        "REQ-DE-WITHDRAWAL",
        "REQ-BR-CONTRACT"
      ],
      "guide": "https://notabenda.org/guide/contract-actions/index.md"
    },
    {
      "id": "consumer-continuing-contracts",
      "title": "Can consumers start a paid subscription or continuing service online?",
      "detail": "Describe the ongoing paid service, who can enter the contract, and the online signup route. Do not infer an exception from a subscription or sector label.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "terms.audience",
        "terms.serviceType"
      ],
      "hostWorkRefs": [
        "host.contractActions"
      ],
      "requirementIds": [
        "REQ-PRODUCT-CONTRACT-ACTIONS",
        "REQ-DE-CANCEL"
      ],
      "guide": "https://notabenda.org/guide/contract-actions/index.md"
    },
    {
      "id": "children",
      "title": "Is the service directed to children, or do you knowingly process children’s data?",
      "detail": "Record intended/actual audience and how this is assessed. Do not infer age from tracking or collect dates of birth just to answer this questionnaire.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "scopeGuards.site.children"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-US-COPPA-SCOPE"
      ],
      "guide": "https://notabenda.org/guide/scope-guards/index.md"
    },
    {
      "id": "sensitive-data",
      "title": "Does the processing involve sensitive personal information?",
      "detail": "Assess actual purposes and context, including health, biometrics, precise location or other locally defined sensitive categories. Do not derive the answer from a vendor label.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "scopeGuards.site.sensitiveData"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-US-VA-RIGHTS",
        "REQ-AU-PIXELS",
        "REQ-CA-OBA"
      ],
      "guide": "https://notabenda.org/guide/scope-guards/index.md"
    },
    {
      "id": "high-risk-profiling",
      "title": "Could the processing involve high-risk profiling?",
      "detail": "Assess combined data, cross-site linkage, inferences and consequences with appropriate expertise. This question does not decide a jurisdiction’s legal definition.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "scopeGuards.site.highRiskProfiling"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-CH-PROFILING"
      ],
      "guide": "https://notabenda.org/guide/scope-guards/index.md"
    },
    {
      "id": "regulated-sector",
      "title": "Does this context need a specialized sector workflow?",
      "detail": "For example, a sector-specific health or financial-data process. This incomplete prompt is a support-boundary question, not a legal sector classifier.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "scopeGuards.site.regulatedSector"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-PRODUCT-CONFIG"
      ],
      "guide": "https://notabenda.org/guide/scope-guards/index.md"
    },
    {
      "id": "transfers",
      "title": "Do providers process data in other countries?",
      "detail": "Check hosting, support access, subprocessors, backups and recipient locations.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "services.location",
        "privacy.transfers"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-EU-NOTICE"
      ],
      "guide": "https://notabenda.org/guide/regulatory/index.md"
    },
    {
      "id": "receipts",
      "title": "Do you need durable records of choices, agreements or contract declarations?",
      "detail": "Consider the evidence needed, host identity binding, access controls, retention and erasure. Browser preferences alone are not durable receipts.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [],
      "hostWorkRefs": [
        "host.evidence"
      ],
      "requirementIds": [
        "REQ-PRODUCT-CONSENT-EVIDENCE",
        "REQ-PRODUCT-CF-ADMIN",
        "REQ-PRODUCT-CF-HISTORY",
        "REQ-PRODUCT-CONTRACT-ACTIONS"
      ],
      "guide": "https://notabenda.org/guide/cloudflare/index.md"
    },
    {
      "id": "authored-content",
      "title": "Will you maintain reviewed policies in Markdown or MDX?",
      "detail": "MDX components execute as trusted build-time code; choose plain Markdown when components are unnecessary.",
      "choices": [
        "yes",
        "no",
        "unknown"
      ],
      "configPaths": [
        "documents"
      ],
      "hostWorkRefs": [],
      "requirementIds": [
        "REQ-PRODUCT-AUTHORING",
        "REQ-PRODUCT-RETAINED-RELEASES"
      ],
      "guide": "https://notabenda.org/guide/authoring/index.md"
    }
  ],
  "markets": [
    {
      "id": "EU-EEA",
      "label": "EU / EEA",
      "requirements": [
        "REQ-EU-NOTICE",
        "REQ-EU-DEVICE",
        "REQ-EU-CONSENT",
        "REQ-EU-TERMS",
        "REQ-EU-WITHDRAWAL",
        "REQ-EU-ORDER-ACTION"
      ]
    },
    {
      "id": "DE",
      "label": "Germany",
      "requirements": [
        "REQ-DE-DEVICE",
        "REQ-DE-CANCEL",
        "REQ-DE-WITHDRAWAL"
      ]
    },
    {
      "id": "FR",
      "label": "France",
      "requirements": [
        "REQ-FR-SCOPE"
      ]
    },
    {
      "id": "IE",
      "label": "Ireland",
      "requirements": [
        "REQ-IE-DEVICE",
        "REQ-IE-CONSENT-DURATION"
      ]
    },
    {
      "id": "IT",
      "label": "Italy",
      "requirements": [
        "REQ-IT-REPROMPT"
      ]
    },
    {
      "id": "ES",
      "label": "Spain",
      "requirements": [
        "REQ-ES-CHOICE"
      ]
    },
    {
      "id": "UK",
      "label": "United Kingdom",
      "requirements": [
        "REQ-UK-EXCEPTIONS"
      ]
    },
    {
      "id": "CH",
      "label": "Switzerland",
      "requirements": [
        "REQ-CH-PROFILING"
      ]
    },
    {
      "id": "BR",
      "label": "Brazil",
      "requirements": [
        "REQ-BR-COOKIE-UI",
        "REQ-BR-CONTRACT"
      ]
    },
    {
      "id": "CA-FED",
      "label": "Canada",
      "requirements": [
        "REQ-CA-MEANINGFUL",
        "REQ-CA-OBA"
      ]
    },
    {
      "id": "CA-QC",
      "label": "Québec",
      "requirements": [
        "REQ-QC-PROFILING"
      ]
    },
    {
      "id": "AU",
      "label": "Australia",
      "requirements": [
        "REQ-AU-PIXELS"
      ]
    },
    {
      "id": "NZ",
      "label": "New Zealand",
      "requirements": [
        "REQ-NZ-NOTICE",
        "REQ-NZ-INDIRECT"
      ]
    },
    {
      "id": "ZA",
      "label": "South Africa",
      "requirements": [
        "REQ-ZA-MARKETING"
      ]
    },
    {
      "id": "US-CA",
      "label": "California",
      "requirements": [
        "REQ-US-CA-CHOICES",
        "REQ-US-CA-GPC",
        "REQ-US-CA-UI"
      ]
    },
    {
      "id": "US-CO",
      "label": "Colorado",
      "requirements": [
        "REQ-US-CO-GPC"
      ]
    },
    {
      "id": "US-CT",
      "label": "Connecticut",
      "requirements": [
        "REQ-US-CT-GPC"
      ]
    },
    {
      "id": "US-VA",
      "label": "Virginia",
      "requirements": [
        "REQ-US-VA-RIGHTS"
      ]
    },
    {
      "id": "TR",
      "label": "Türkiye",
      "requirements": [
        "REQ-TR-BASIS"
      ]
    },
    {
      "id": "other",
      "label": "Other / not sure",
      "requirements": []
    }
  ],
  "answersTemplate": {
    "schemaVersion": 1,
    "publicFacts": {},
    "markets": [],
    "answers": {
      "personal-data": {
        "choice": "unknown",
        "justification": ""
      },
      "optional-storage": {
        "choice": "unknown",
        "justification": ""
      },
      "technology-functions": {
        "choice": "unknown",
        "justification": ""
      },
      "embeds": {
        "choice": "unknown",
        "justification": ""
      },
      "processing-opt-outs": {
        "choice": "unknown",
        "justification": ""
      },
      "terms-agreement": {
        "choice": "unknown",
        "justification": ""
      },
      "consumer-payments": {
        "choice": "unknown",
        "justification": ""
      },
      "consumer-distance-contracts": {
        "choice": "unknown",
        "justification": ""
      },
      "consumer-continuing-contracts": {
        "choice": "unknown",
        "justification": ""
      },
      "children": {
        "choice": "unknown",
        "justification": ""
      },
      "sensitive-data": {
        "choice": "unknown",
        "justification": ""
      },
      "high-risk-profiling": {
        "choice": "unknown",
        "justification": ""
      },
      "regulated-sector": {
        "choice": "unknown",
        "justification": ""
      },
      "transfers": {
        "choice": "unknown",
        "justification": ""
      },
      "receipts": {
        "choice": "unknown",
        "justification": ""
      },
      "authored-content": {
        "choice": "unknown",
        "justification": ""
      }
    },
    "storageJustifications": {}
  },
  "targetAnswersTemplate": {
    "schemaVersion": 1,
    "publicFacts": {},
    "markets": [],
    "answers": {
      "personal-data": {
        "choice": "unknown",
        "justification": ""
      },
      "transfers": {
        "choice": "unknown",
        "justification": ""
      },
      "authored-content": {
        "choice": "unknown",
        "justification": ""
      },
      "optional-storage": {
        "choice": "unknown",
        "justification": ""
      },
      "children": {
        "choice": "unknown",
        "justification": ""
      },
      "sensitive-data": {
        "choice": "unknown",
        "justification": ""
      },
      "high-risk-profiling": {
        "choice": "unknown",
        "justification": ""
      },
      "regulated-sector": {
        "choice": "unknown",
        "justification": ""
      },
      "technology-functions": {
        "choice": "unknown",
        "justification": ""
      },
      "embeds": {
        "choice": "unknown",
        "justification": ""
      },
      "terms-agreement": {
        "choice": "unknown",
        "justification": ""
      },
      "processing-opt-outs": {
        "choice": "unknown",
        "justification": ""
      },
      "receipts": {
        "choice": "unknown",
        "justification": ""
      },
      "consumer-payments": {
        "choice": "unknown",
        "justification": ""
      },
      "consumer-distance-contracts": {
        "choice": "unknown",
        "justification": ""
      },
      "consumer-continuing-contracts": {
        "choice": "unknown",
        "justification": ""
      }
    },
    "storageJustifications": {}
  },
  "workflow": [
    "Record requested outcomes and existing integration points.",
    "Separate confirmed facts, project evidence, unknowns and legal review decisions.",
    "Read target guides and the installed SiteConfig type; host work is not a JSON config field.",
    "Complete explicit answers and run wizard --answers FILE, adding --config FILE for an existing inventory.",
    "Compare the exported draft against the original; apply only reviewed changes.",
    "Run check/build in preview, integration scenarios, and production validation when review is complete."
  ],
  "handoffFields": [
    "requested outcomes",
    "selected target IDs",
    "existing integration",
    "confirmed facts and provenance",
    "unknown facts and consequences",
    "exact config changes",
    "host/build/runtime work",
    "review and deployment status",
    "verification results"
  ]
}