@bergetai/odoo-cli 0.9.1 → 0.11.0

package/dist/commands/footprint.js

@@ -0,0 +1,843 @@
+import { ModelFields } from "../model.js";
+import { authenticatedClient } from "../resource.js";
+import { usageError } from "../errors.js";
+import { colorEnabled, printJson, verbose as logVerbose } from "../output.js";
+import { formatTable, humanCell } from "../table.js";
+/** Minimal inline accounting configs (from the removed erasure-base-commands
+ * plan §2.1–2.3): read-only modules. */
+export const accountMove = {
+    model: "account.move",
+    showCommand: "odoo invoices show",
+    defaultListFields: [
+        "id",
+        "name",
+        "invoice_date",
+        "state",
+        "move_type",
+        "partner_id",
+        "invoice_partner_display_name",
+    ],
+    showExtraFields: ["create_date", "write_date"],
+    resolutionHints: {},
+    priorityLabels: {},
+    pinnedDomain: [],
+    references: {},
+};
+export const saleOrder = {
+    model: "sale.order",
+    showCommand: "odoo orders show",
+    defaultListFields: [
+        "id",
+        "name",
+        "state",
+        "partner_id",
+        "partner_invoice_id",
+        "partner_shipping_id",
+        "date_order",
+    ],
+    showExtraFields: ["create_date", "write_date"],
+    resolutionHints: {},
+    priorityLabels: {},
+    pinnedDomain: [],
+    references: {},
+};
+export const accountPayment = {
+    model: "account.payment",
+    showCommand: "odoo payments show",
+    defaultListFields: [
+        "id",
+        "name",
+        "state",
+        "partner_id",
+        "amount",
+        "currency_id",
+        "date",
+    ],
+    showExtraFields: ["create_date", "write_date"],
+    resolutionHints: {},
+    priorityLabels: {},
+    pinnedDomain: [],
+    references: {},
+};
+/** Linked groups are actionable in this order — identity first (portal users
+ * block partner unlink: res_users.partner_id is ondelete=restrict), partner
+ * shells last. keep-groups (invoices/orders/payments) are reference surfaces,
+ * not steps, and are excluded. */
+export const RUN_ORDER = [
+    "users",
+    "leads",
+    "mailingContacts",
+    "mailingTraces",
+    "tickets",
+    "messages",
+    "attachments",
+    "partners",
+];
+/** Odoo OR-domain over clause groups: "|" c1 "|" c2 c3 (prefix notation).
+ * Implicit conjunction cannot nest under "|", so groups with more than one
+ * clause are wrapped in an explicit "&". An empty OR matches nothing. */
+function orGroups(groups) {
+    const wrap = (g) => (g.length > 1 ? ["&", ...g] : [...g]);
+    const present = groups.filter((g) => g.length > 0).map(wrap);
+    if (present.length === 0)
+        return [["id", "=", 0]];
+    let acc = [...present[present.length - 1]];
+    for (let i = present.length - 2; i >= 0; i--) {
+        acc = ["|", ...present[i], ...acc];
+    }
+    return acc;
+}
+function m2oId(value) {
+    const v = value;
+    return Array.isArray(v) && typeof v[0] === "number" ? v[0] : false;
+}
+function or(...groups) {
+    return orGroups(groups);
+}
+const GROUPS = [
+    {
+        group: "partners",
+        config: {
+            model: "res.partner",
+            showCommand: "odoo partners show",
+            defaultListFields: [],
+            showExtraFields: [],
+            resolutionHints: {},
+            priorityLabels: {},
+            pinnedDomain: [],
+            references: {},
+        },
+        fields: [
+            "id",
+            "name",
+            "email",
+            "parent_id",
+            "is_company",
+            "active",
+            // step-2/4 decision inputs: identities on the partner, member
+            // contacts (sole-member test), and the personnummer-derived vat
+            // that step 4 must blank on enskild-firma shells
+            "user_ids",
+            "child_ids",
+            "vat",
+        ],
+        reason: "",
+    },
+    {
+        group: "users",
+        config: {
+            model: "res.users",
+            showCommand: "odoo users show",
+            defaultListFields: [],
+            showExtraFields: [],
+            resolutionHints: {},
+            priorityLabels: {},
+            pinnedDomain: [],
+            references: {},
+        },
+        fields: ["id", "login", "email", "share", "active", "partner_id"],
+        reason: "",
+    },
+    {
+        group: "leads",
+        config: {
+            model: "crm.lead",
+            showCommand: "odoo crm records show",
+            defaultListFields: [],
+            showExtraFields: [],
+            resolutionHints: {},
+            priorityLabels: {},
+            pinnedDomain: [],
+            references: {},
+        },
+        fields: ["id", "name", "email_from", "partner_id", "active"],
+        reason: "CRM lead for the requesting person (no retention exception)",
+        hint: (_r, id) => `odoo crm records delete ${id} --dry-run`,
+    },
+    {
+        group: "mailingContacts",
+        config: {
+            model: "mailing.contact",
+            showCommand: "odoo marketing contacts show",
+            defaultListFields: [],
+            showExtraFields: [],
+            resolutionHints: {},
+            priorityLabels: {},
+            pinnedDomain: [],
+            references: {},
+        },
+        fields: ["id", "email", "name"],
+        reason: "marketing contact — strict delete (TDD decision #7)",
+        hint: (_r, id) => `odoo marketing contacts delete ${id} --dry-run`,
+    },
+    {
+        group: "mailingTraces",
+        config: {
+            model: "mailing.trace",
+            showCommand: "odoo marketing traces show",
+            defaultListFields: [],
+            showExtraFields: [],
+            resolutionHints: {},
+            priorityLabels: {},
+            pinnedDomain: [],
+            references: {},
+        },
+        fields: ["id", "email", "model", "res_id", "trace_status"],
+        reason: "send trace with denormalized email — no cascade from contact deletion (invariant 4)",
+        hint: (_r, id) => `odoo marketing traces delete ${id} --dry-run`,
+    },
+    {
+        group: "tickets",
+        config: {
+            model: "helpdesk.ticket",
+            showCommand: "odoo helpdesk tickets show",
+            defaultListFields: [],
+            showExtraFields: [],
+            resolutionHints: {},
+            priorityLabels: {},
+            pinnedDomain: [],
+            references: {},
+        },
+        fields: ["id", "name", "partner_id", "partner_email", "team_id", "active"],
+        reason: "delete unless an active legal claim exists (Flow A step 6)",
+        hint: (_r, id) => `odoo helpdesk tickets delete ${id} --dry-run`,
+    },
+    {
+        group: "messages",
+        config: {
+            model: "mail.message",
+            showCommand: "odoo crm records message-delete",
+            defaultListFields: [],
+            showExtraFields: [],
+            resolutionHints: {},
+            priorityLabels: {},
+            pinnedDomain: [],
+            references: {},
+        },
+        fields: [
+            "id",
+            "model",
+            "res_id",
+            "author_id",
+            "email_from",
+            "date",
+            "body",
+        ],
+        tableExcludeFields: ["body"],
+        reason: "correspondence on a to-be-deleted record",
+    },
+    {
+        group: "attachments",
+        config: {
+            model: "ir.attachment",
+            showCommand: "odoo attachments show",
+            defaultListFields: [],
+            showExtraFields: [],
+            resolutionHints: {},
+            priorityLabels: {},
+            pinnedDomain: [],
+            references: {},
+        },
+        fields: ["id", "name", "res_model", "res_id"],
+        reason: "",
+        hint: (_r, id) => `odoo attachments delete ${id} --dry-run`,
+    },
+    {
+        group: "invoices",
+        config: accountMove,
+        fields: [
+            "id",
+            "name",
+            "invoice_date",
+            "state",
+            "move_type",
+            "partner_id",
+            "invoice_partner_display_name",
+        ],
+        reason: "accounting record — bokföringslagen 7 kap. 2 § (7 years)",
+    },
+    {
+        group: "orders",
+        config: saleOrder,
+        fields: [
+            "id",
+            "name",
+            "state",
+            "partner_id",
+            "partner_invoice_id",
+            "partner_shipping_id",
+            "date_order",
+        ],
+        reason: "accounting/order documentation — RESTRICT reference surface (§6.2.4)",
+    },
+    {
+        group: "payments",
+        config: accountPayment,
+        fields: ["id", "name", "state", "partner_id", "amount", "date"],
+        reason: "accounting record — bokföringslagen 7 kap. 2 § (7 years)",
+    },
+];
+/** search_read + search_count in one round trip (same context, so the count
+ * reflects the same rule/active filtering). The count drives truncation
+ * flags: a group can silently cap (server-side limit or record rules) and
+ * the request register needs exact footprint counts (TDD step 1). */
+async function searchRowsWithCount(client, model, domain, fields, limit, includeArchived) {
+    // fields_get doubles as the module-installed check; curated fields
+    // intersect with the schema so edition-dependent fields degrade
+    // gracefully (helpdesk.ticket.ticket_type_id precedent).
+    const meta = await ModelFields.load(client, model);
+    const select = fields.filter((f) => f === "id" || meta.get(f));
+    // Archived rows are still personal data (TDD decision #10): search with
+    // active_test disabled unless --active-only asks for the UI's view.
+    const context = includeArchived ? { context: { active_test: false } } : {};
+    const [rows, total] = (await Promise.all([
+        client.executeKw(model, "search_read", [domain], {
+            fields: select.length > 0 ? select : undefined,
+            limit,
+            ...context,
+        }),
+        client.executeKw(model, "search_count", [domain], context),
+    ]));
+    return { rows, total };
+}
+function parseCount(raw, flag) {
+    if (!/^\d+$/.test(raw)) {
+        throw usageError(`invalid ${flag} value ${JSON.stringify(raw)}`, "expected a non-negative integer");
+    }
+    return Number(raw);
+}
+const GROUP_ORDER = GROUPS.map((g) => g.group);
+export async function footprintCommand(emailArg, opts, globals) {
+    const email = emailArg.trim();
+    if (email === "") {
+        throw usageError("email must not be empty");
+    }
+    const limit = parseCount(opts.limit ?? "500", "--limit");
+    const includeArchived = !opts.activeOnly;
+    const client = await authenticatedClient(globals);
+    const groupErrors = [];
+    const rows = new Map();
+    const groupTotals = {};
+    async function runGroup(group, model, fn) {
+        try {
+            const result = await fn();
+            rows.set(group, result.rows);
+            groupTotals[group] = result.total;
+        }
+        catch (error) {
+            groupErrors.push({
+                group,
+                model,
+                message: error.message,
+            });
+            rows.set(group, []);
+        }
+    }
+    // Phase A: email-keyed enumeration (independent of each other).
+    await Promise.all([
+        runGroup("partners", "res.partner", () => searchRowsWithCount(client, "res.partner", [["email", "ilike", email]], [
+            "id",
+            "name",
+            "email",
+            "parent_id",
+            "is_company",
+            "active",
+            "user_ids",
+            "child_ids",
+            "vat",
+        ], limit, includeArchived)),
+        runGroup("mailingContacts", "mailing.contact", () => searchRowsWithCount(client, "mailing.contact", or([["email", "ilike", email]], [["name", "ilike", email]]), ["id", "email", "name"], limit, includeArchived)),
+        runGroup("mailingTraces", "mailing.trace", () => searchRowsWithCount(client, "mailing.trace", [["email", "ilike", email]], ["id", "email", "model", "res_id", "trace_status"], limit, includeArchived)),
+    ]);
+    // Phase B: users (direct login/email, and partner_id of found partners).
+    const partnerRows = rows.get("partners") ?? [];
+    const phase1PartnerIds = partnerRows.map((r) => r.id);
+    await runGroup("users", "res.users", () => searchRowsWithCount(client, "res.users", or([["login", "ilike", email]], [["email", "ilike", email]], phase1PartnerIds.length > 0
+        ? [["partner_id", "in", phase1PartnerIds]]
+        : []), ["id", "login", "email", "share", "active", "partner_id"], limit, includeArchived));
+    // Correlation set: every partner id the person touches (their contacts,
+    // plus partners referenced directly by sign-in identities — the
+    // root-attached-portal-user pattern from TDD step 2 needs this).
+    const userRows = rows.get("users") ?? [];
+    const partnerIds = [
+        ...new Set([
+            ...phase1PartnerIds,
+            ...userRows
+                .map((r) => m2oId(r.partner_id))
+                .filter((v) => v !== false),
+        ]),
+    ];
+    // Phase C: partner-keyed stores. Leads join here (not phase A) so the
+    // OR branch can correlate on partner_id — a lead may carry the person's
+    // partner instead of their email.
+    await Promise.all([
+        runGroup("leads", "crm.lead", () => searchRowsWithCount(client, "crm.lead", or([["email_from", "ilike", email]], partnerIds.length > 0 ? [["partner_id", "in", partnerIds]] : []), ["id", "name", "email_from", "partner_id", "active"], limit, includeArchived)),
+        runGroup("tickets", "helpdesk.ticket", () => searchRowsWithCount(client, "helpdesk.ticket", or(partnerIds.length > 0 ? [["partner_id", "in", partnerIds]] : [], [
+            ["partner_email", "ilike", email],
+        ]), ["id", "name", "partner_id", "partner_email", "team_id", "active"], limit, includeArchived)),
+        runGroup("invoices", "account.move", () => searchRowsWithCount(client, "account.move", partnerIds.length > 0
+            ? [["partner_id", "in", partnerIds]]
+            : [["id", "=", -1]], [
+            "id",
+            "name",
+            "invoice_date",
+            "state",
+            "move_type",
+            "partner_id",
+            "invoice_partner_display_name",
+        ], limit, includeArchived)),
+        runGroup("orders", "sale.order", () => searchRowsWithCount(client, "sale.order", or(partnerIds.length > 0 ? [["partner_id", "in", partnerIds]] : [], partnerIds.length > 0
+            ? [["partner_invoice_id", "in", partnerIds]]
+            : [], partnerIds.length > 0
+            ? [["partner_shipping_id", "in", partnerIds]]
+            : []), [
+            "id",
+            "name",
+            "state",
+            "partner_id",
+            "partner_invoice_id",
+            "partner_shipping_id",
+            "date_order",
+        ], limit, includeArchived)),
+        runGroup("payments", "account.payment", () => searchRowsWithCount(client, "account.payment", partnerIds.length > 0
+            ? [["partner_id", "in", partnerIds]]
+            : [["id", "=", -1]], ["id", "name", "state", "partner_id", "amount", "date"], limit, includeArchived)),
+    ]);
+    // Phase C2: contact verdicts — the §6.2.4 pre-flight on the RESTRICT
+    // surfaces. Computed per contact: posted account.move, any
+    // account.payment, or a confirmed/done sale.order referencing the
+    // partner through any of its three reference fields → anonymize,
+    // never unlink (invariant 1).
+    const invoiceRows = rows.get("invoices") ?? [];
+    const orderRows = rows.get("orders") ?? [];
+    const paymentRows = rows.get("payments") ?? [];
+    const referencedBy = [
+        [
+            "posted invoice (account.move)",
+            refPartnerIds(invoiceRows.filter((r) => r.state === "posted"), ["partner_id"]),
+        ],
+        ["payment (account.payment)", refPartnerIds(paymentRows, ["partner_id"])],
+        [
+            "confirmed order (sale.order)",
+            refPartnerIds(orderRows.filter((r) => r.state === "sale" || r.state === "done"), ["partner_id", "partner_invoice_id", "partner_shipping_id"]),
+        ],
+    ];
+    const referenceGroupsErrored = groupErrors.some((g) => ["invoices", "orders", "payments"].includes(g.group));
+    // Phase D: messages on/around the found records.
+    const ticketRows = rows.get("tickets") ?? [];
+    const leadRows = rows.get("leads") ?? [];
+    const ticketIds = ticketRows.map((r) => r.id);
+    const leadIds = leadRows.map((r) => r.id);
+    const authorIds = partnerIds;
+    await runGroup("messages", "mail.message", () => searchRowsWithCount(client, "mail.message", or([["email_from", "ilike", email]], authorIds.length > 0 ? [["author_id", "in", authorIds]] : [], ticketIds.length > 0
+        ? [
+            ["model", "=", "helpdesk.ticket"],
+            ["res_id", "in", ticketIds],
+        ]
+        : [], leadIds.length > 0
+        ? [
+            ["model", "=", "crm.lead"],
+            ["res_id", "in", leadIds],
+        ]
+        : [], 
+    // notes ON the partners themselves — the database audit found
+    // provisioning notes ("Portal Access Granted (<email>)")
+    // authored by the service account on the partner record, which
+    // no email/author/parent branch reaches
+    partnerIds.length > 0
+        ? [
+            ["model", "=", "res.partner"],
+            ["res_id", "in", partnerIds],
+        ]
+        : []), ["id", "model", "res_id", "author_id", "email_from", "date", "body"], limit, includeArchived));
+    // Phase E: attachments — by name, and by (res_model, res_id) pairs on
+    // the parents found above (invariant 4: nothing cascades) — including
+    // the partners themselves: avatars are stored as ir.attachment rows on
+    // res.partner and are never removed by partner deletion.
+    const messageRows = rows.get("messages") ?? [];
+    const parentPairs = new Map();
+    for (const [model, groupRows] of [
+        ["helpdesk.ticket", ticketRows],
+        ["mail.message", messageRows],
+        ["crm.lead", leadRows],
+        ["res.partner", partnerRows],
+    ]) {
+        const ids = new Set(groupRows.map((r) => r.id));
+        if (ids.size > 0)
+            parentPairs.set(model, ids);
+    }
+    await runGroup("attachments", "ir.attachment", () => searchRowsWithCount(client, "ir.attachment", or([["name", "ilike", email]], ...[...parentPairs.entries()].map(([model, ids]) => [
+        ["res_model", "=", model],
+        ["res_id", "in", [...ids]],
+    ])), ["id", "name", "res_model", "res_id"], limit, includeArchived));
+    const attachmentRows = rows.get("attachments") ?? [];
+    // Phase F: resolve out-of-scope parents INLINE for `review` records so
+    // the output names the thing instead of pointing at it (bounded — see
+    // DETAIL_FETCH_CAP). a parent's name answers "what is this?" without a
+    // follow-up command; beyond the cap, records keep their inspectHint.
+    const detailRefs = new Map();
+    const refFor = (row) => [
+        (row.model ?? row.res_model),
+        (row.res_id ?? row.id),
+    ];
+    for (const row of messageRows) {
+        const [parentModel, parentId] = refFor(row);
+        const onTicket = parentModel === "helpdesk.ticket" && ticketIds.includes(parentId);
+        const onLead = parentModel === "crm.lead" && leadIds.includes(parentId);
+        const onPartner = parentModel === "res.partner" && partnerIds.includes(parentId);
+        if (!onTicket && !onLead && !onPartner && parentModel && parentId) {
+            const set = detailRefs.get(parentModel) ?? new Set();
+            set.add(parentId);
+            detailRefs.set(parentModel, set);
+        }
+    }
+    for (const row of attachmentRows) {
+        if (row.res_model !== "account.move" &&
+            !parentPairs.get(row.res_model)?.has(row.res_id)) {
+            const set = detailRefs.get(row.res_model) ?? new Set();
+            set.add(row.res_id);
+            detailRefs.set(row.res_model, set);
+        }
+    }
+    const DETAIL_FETCH_CAP = 25;
+    const detailNames = new Map(); // "model#id" → display name
+    const overCap = [...detailRefs.entries()].filter(([, ids]) => ids.size > DETAIL_FETCH_CAP);
+    if (overCap.length > 0) {
+        logVerbose(`skipping inline detail resolution for ${overCap.length} over-cap model(s)`, globals.verbose);
+    }
+    for (const [model, ids] of [...detailRefs.entries()].filter(([, ids]) => ids.size <= DETAIL_FETCH_CAP)) {
+        try {
+            // display_name is computed and safe; name may be absent on
+            // some models — intersect with fields_get
+            const meta = await ModelFields.load(client, model);
+            const fields = ["name", "display_name"].filter((f) => meta.get(f));
+            const parents = (await client.executeKw(model, "read", [[...ids]], fields.length > 0 ? { fields } : {}));
+            for (const p of parents) {
+                detailNames.set(`${model}#${p.id}`, String(p.display_name ?? p.name ?? `#${p.id}`));
+            }
+        }
+        catch {
+            // unreadable parent (record rules / missing module):
+            // records keep their inspectHint
+        }
+    }
+    // Assemble records with dispositions.
+    const records = [];
+    const summary = {};
+    const specByGroup = new Map(GROUPS.map((g) => [g.group, g]));
+    function push(group, row, disposition, reason, hint, inspectHint) {
+        const spec = specByGroup.get(group);
+        records.push({
+            group,
+            model: spec?.config.model ?? "",
+            id: row.id,
+            disposition,
+            reason,
+            fields: row,
+            ...(hint ? { commandHint: hint } : {}),
+            ...(inspectHint ? { inspectHint } : {}),
+        });
+    }
+    // partners — verdict computed (anonymize vs delete), roots always review.
+    const partnerDispById = new Map();
+    for (const row of partnerRows) {
+        const id = row.id;
+        let disposition;
+        let reason;
+        if (m2oId(row.parent_id) === false) {
+            disposition = "review";
+            reason =
+                "account root — sole-member/enskild-firma handling (Flow A step 4)";
+        }
+        else if (referenceGroupsErrored) {
+            disposition = "review";
+            reason =
+                "reference check unavailable (accounting group error) — run the §6.2.4 pre-flight before deleting";
+        }
+        else if (referencedBy.some(([, ids]) => ids.has(id))) {
+            disposition = "anonymize";
+            const sources = referencedBy
+                .filter(([, ids]) => ids.has(id))
+                .map(([label]) => label);
+            reason = `referenced by ${sources.join(", ")} — anonymize, never unlink (invariant 1)`;
+        }
+        else {
+            disposition = "delete";
+            reason =
+                "no RESTRICT references found — confirm with the §6.2.4 pre-flight before unlink";
+        }
+        const hint = disposition === "delete"
+            ? `odoo partners delete ${id} --dry-run`
+            : disposition === "anonymize"
+                ? `odoo partners update ${id} --set name='Raderad kontaktperson (ID ${id})' --set email=null --set phone=null --set function=null`
+                : undefined;
+        // step-4 decision inputs (child_ids/user_ids/vat) are fetched on the
+        // partners group itself, so the root review needs no follow-up command
+        partnerDispById.set(id, disposition);
+        push("partners", row, disposition, reason, hint);
+    }
+    // users — portal deletion is the SOP step 2; internal users are listed
+    // but never removable via the CLI.
+    for (const row of userRows) {
+        if (row.share === false) {
+            push("users", row, "review", "internal user (share=false) — never removed via the CLI");
+        }
+        else {
+            push("users", row, "delete", "portal sign-in identity — delete before partner unlink (res_users.partner_id is ondelete=restrict)", `odoo users delete ${row.id} --dry-run`);
+        }
+    }
+    for (const row of leadRows) {
+        push("leads", row, "delete", specByGroup.get("leads").reason, `odoo crm records delete ${row.id} --dry-run`);
+    }
+    for (const row of rows.get("mailingContacts") ?? []) {
+        push("mailingContacts", row, "delete", specByGroup.get("mailingContacts").reason, `odoo marketing contacts delete ${row.id} --dry-run`);
+    }
+    for (const row of rows.get("mailingTraces") ?? []) {
+        push("mailingTraces", row, "delete", specByGroup.get("mailingTraces").reason, `odoo marketing traces delete ${row.id} --dry-run`);
+    }
+    for (const row of ticketRows) {
+        push("tickets", row, "delete", specByGroup.get("tickets").reason, `odoo helpdesk tickets delete ${row.id} --dry-run`);
+    }
+    for (const row of messageRows) {
+        const parentModel = row.model;
+        const parentId = row.res_id;
+        const onTicket = parentModel === "helpdesk.ticket" && ticketIds.includes(parentId);
+        const onLead = parentModel === "crm.lead" && leadIds.includes(parentId);
+        if (onTicket) {
+            push("messages", row, "delete", `correspondence on to-be-deleted ticket #${parentId}`, 
+            // ticket unlink removes its thread messages; the next runnable
+            // command is the parent's, not a per-message delete
+            `odoo helpdesk tickets delete ${parentId} --dry-run`);
+        }
+        else if (onLead) {
+            push("messages", row, "delete", `correspondence on to-be-deleted lead #${parentId}`, `odoo crm records delete ${parentId} --dry-run`);
+        }
+        else if (parentModel === "res.partner" && partnerIds.includes(parentId)) {
+            // provisioning/system notes ON the partner record itself — found
+            // in prod ("Portal Access Granted (<email>)"), authored by the
+            // service account, carrying the email. On a to-be-deleted partner
+            // the note dies with the unlink; on a kept shell (anonymize /
+            // review) it must be deleted explicitly.
+            const pd = partnerDispById.get(parentId);
+            if (pd === "delete") {
+                push("messages", row, "delete", `system note on to-be-deleted partner #${parentId}`, `odoo partners delete ${parentId} --dry-run`);
+            }
+            else {
+                push("messages", row, "delete", `system note on kept partner #${parentId} (shell/active) — carries the email; delete explicitly (partner unlink won't remove it)`);
+            }
+        }
+        else {
+            // e.g. project.task / calendar.event / mailing.mailing — parents
+            // outside the Flow A deletion set are never deleted by the SOP;
+            // deleting stray messages there is a human judgment call.
+            const detailKey = `${parentModel}#${parentId}`;
+            const name = detailNames.get(detailKey);
+            push("messages", row, "review", name
+                ? `correspondence on ${parentModel} #${parentId} (“${name}”) — parent is outside the erasure scope; verify before deleting`
+                : `correspondence on ${parentModel} #${parentId} — parent is outside the erasure scope; verify before deleting`, undefined, 
+            // when the parent resolved inline the question is answered;
+            // only unfetched parents keep an inspect hint
+            name
+                ? undefined
+                : `odoo models read ${parentModel} --ids ${parentId} --json`);
+        }
+    }
+    for (const row of attachmentRows) {
+        const parentKey = `${row.res_model}#${row.res_id}`;
+        if (row.res_model === "account.move") {
+            push("attachments", row, "keep", "linked to account.move — bokföringsunderlag (7 years)");
+        }
+        else if (row.res_model === "res.partner") {
+            // partner avatars are personal data and NEVER cascade with the
+            // partner (invariant 4) — explicit delete whether the partner is
+            // being deleted or kept as an anonymized shell (step 4)
+            const pd = partnerDispById.get(row.res_id);
+            push("attachments", row, "delete", pd === "delete"
+                ? `attached to to-be-deleted partner #${row.res_id} — explicit delete (attachments never cascade)`
+                : `attached to kept partner #${row.res_id} (shell/active) — avatar is personal data; explicit delete (step 4)`, `odoo attachments delete ${row.id} --dry-run`);
+        }
+        else if (parentPairs.get(row.res_model)?.has(row.res_id)) {
+            push("attachments", row, "delete", `attached to ${row.res_model} #${row.res_id} — deletes with its parent`, `odoo attachments delete ${row.id} --dry-run`);
+        }
+        else {
+            const name = detailNames.get(parentKey);
+            push("attachments", row, "review", name
+                ? `name matches the email, parent (${parentKey}, “${name}”) is not in the footprint — verify ownership`
+                : `name matches the email, but parent (${parentKey}) is not in the footprint — verify ownership`, undefined, name ? undefined : `odoo attachments show ${row.id} --json`);
+        }
+    }
+    for (const [group, groupRows] of [
+        ["invoices", invoiceRows],
+        ["orders", orderRows],
+        ["payments", paymentRows],
+    ]) {
+        const reason = specByGroup.get(group)?.reason ?? "";
+        for (const row of groupRows) {
+            push(group, row, "keep", reason);
+        }
+    }
+    records.sort((a, b) => GROUP_ORDER.indexOf(a.group) - GROUP_ORDER.indexOf(b.group) ||
+        a.id - b.id);
+    for (const g of GROUP_ORDER) {
+        summary[g] = records.filter((r) => r.group === g).length;
+    }
+    summary.total = records.length;
+    for (const g of GROUP_ORDER) {
+        if (groupTotals[g] === undefined || groupErrors.some((e) => e.group === g))
+            continue;
+        groupTotals[g] = Math.max(groupTotals[g], summary[g] ?? 0);
+    }
+    // search_count reflects the record-rule/active filter too; a gap vs the
+    // returned rows means truncation (--limit or a server-side cap)
+    const truncatedGroups = GROUP_ORDER.filter((g) => !groupErrors.some((e) => e.group === g) &&
+        groupTotals[g] > (summary[g] ?? 0));
+    if (globals.json) {
+        printJson(toJsonReport({
+            email,
+            generatedAt: new Date().toISOString(),
+            summary,
+            groupTotals,
+            truncatedGroups,
+            records,
+            groupErrors,
+        }));
+        return;
+    }
+    printFootprintTable({
+        email,
+        generatedAt: new Date().toISOString(),
+        summary,
+        groupTotals,
+        truncatedGroups,
+        records,
+        groupErrors,
+    }, globals);
+}
+function refPartnerIds(groupRows, fields) {
+    const out = new Set();
+    for (const row of groupRows) {
+        for (const field of fields) {
+            const id = m2oId(row[field]);
+            if (id !== false)
+                out.add(id);
+        }
+    }
+    return out;
+}
+/** Normalize one Odoo-native value for the structured JSON payload. */
+function normalizeFieldValue(value) {
+    if (Array.isArray(value) &&
+        value.length === 2 &&
+        typeof value[0] === "number" &&
+        typeof value[1] === "string") {
+        return { id: value[0], name: value[1] };
+    }
+    // many2many: arrays of [id, name] tuples → arrays of {id, name}
+    if (Array.isArray(value) &&
+        value.length > 0 &&
+        value.every((v) => Array.isArray(v) &&
+            v.length === 2 &&
+            typeof v[0] === "number" &&
+            typeof v[1] === "string")) {
+        return value.map((v) => ({ id: v[0], name: v[1] }));
+    }
+    return value;
+}
+/** Build the structured per-group JSON payload from the flat assembly. */
+function toJsonReport(flat) {
+    const groups = {};
+    for (const group of GROUP_ORDER) {
+        const spec = specByGroupLocal(group);
+        const error = flat.groupErrors.find((e) => e.group === group);
+        const groupRecords = flat.records.filter((r) => r.group === group);
+        const total = error
+            ? null
+            : Math.max(flat.groupTotals[group] ?? 0, groupRecords.length);
+        const truncated = !error && total !== null && total > groupRecords.length;
+        const dispositions = {
+            delete: 0,
+            anonymize: 0,
+            keep: 0,
+            review: 0,
+        };
+        for (const r of groupRecords)
+            dispositions[r.disposition]++;
+        groups[group] = {
+            model: spec.config.model,
+            found: groupRecords.length,
+            total,
+            truncated,
+            dispositions,
+            ...(error ? { error: error.message } : {}),
+            records: groupRecords.map((r) => {
+                const fields = {};
+                for (const [k, v] of Object.entries(r.fields)) {
+                    fields[k] = normalizeFieldValue(v);
+                }
+                return {
+                    id: r.id,
+                    disposition: r.disposition,
+                    reason: r.reason,
+                    ...(r.commandHint ? { commandHint: r.commandHint } : {}),
+                    ...(r.inspectHint ? { inspectHint: r.inspectHint } : {}),
+                    fields,
+                };
+            }),
+        };
+    }
+    return {
+        email: flat.email,
+        generatedAt: flat.generatedAt,
+        totalRecords: flat.records.length,
+        truncatedGroups: GROUP_ORDER.filter((g) => groups[g].truncated),
+        runOrder: [...RUN_ORDER],
+        groups,
+    };
+}
+function printFootprintTable(report, globals) {
+    const out = process.stdout;
+    out.write(`Footprint for ${report.email} — ${report.summary.total} record(s)\n`);
+    out.write(`Suggested order: ${RUN_ORDER.join(" → ")} (keep-groups: verified, not run)\n`);
+    if (report.summary.total === 0 && report.groupErrors.length === 0) {
+        return;
+    }
+    for (const group of GROUP_ORDER) {
+        const spec = specByGroupLocal(group);
+        const groupRecords = report.records.filter((r) => r.group === group);
+        const groupError = report.groupErrors.find((g) => g.group === group);
+        out.write(`\n${group} (${spec.config.model})`);
+        if (groupError) {
+            out.write(` — ERROR: ${groupError.message}\n`);
+            continue;
+        }
+        if (report.truncatedGroups.includes(group)) {
+            out.write(` — TRUNCATED: showing ${groupRecords.length} of ${report.groupTotals[group]} (raise --limit)`);
+        }
+        out.write(`\n`);
+        if (groupRecords.length === 0)
+            continue;
+        const meta = groupRecords[0].fields;
+        const keys = Object.keys(meta).filter((k) => !(spec.tableExcludeFields ?? []).includes(k));
+        const headers = [...keys, "Disposition"];
+        const body = groupRecords.map((r) => [
+            ...keys.map((k) => humanCell(r.fields[k])),
+            r.disposition,
+        ]);
+        out.write(formatTable(headers, body, colorEnabled(globals.noColor)) + "\n");
+        for (const r of groupRecords) {
+            out.write(`  #${r.id} ${r.disposition}: ${r.reason}\n`);
+            if (r.commandHint) {
+                out.write(`    → ${r.commandHint}\n`);
+            }
+            if (r.inspectHint) {
+                out.write(`    → (inspect) ${r.inspectHint}\n`);
+            }
+        }
+    }
+}
+function specByGroupLocal(group) {
+    const spec = GROUPS.find((g) => g.group === group);
+    if (!spec)
+        throw new Error(`unknown group ${group}`);
+    return spec;
+}