@forklaunch/core 3.1.0 → 3.2.0

package/lib/http/middleware/request/enrichDetails.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enrichDetails.middleware.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/request/enrichDetails.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAS3D,OAAO,EAEL,sBAAsB,EACvB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,IAAI,EACJ,aAAa,EACb,mBAAmB,EACnB,MAAM,EACN,YAAY,EACZ,4BAA4B,EAC5B,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,aAAa,EACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAE7E;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,EAAE,SAAS,kBAAkB,EAC7B,cAAc,SAAS,MAAM,EAC7B,CAAC,SAAS,YAAY,CAAC,EAAE,CAAC,EAC1B,UAAU,SAAS,eAAe,CAAC,EAAE,CAAC,EACtC,OAAO,SAAS,IAAI,CAAC,EAAE,CAAC,EACxB,QAAQ,SAAS,WAAW,CAAC,EAAE,CAAC,EAChC,UAAU,SAAS,aAAa,CAAC,EAAE,CAAC,EACpC,UAAU,SAAS,aAAa,CAAC,EAAE,CAAC,EACpC,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,YAAY,SAAS,aAAa,CAAC,EAAE,EAAE,cAAc,CAAC,EACtD,aAAa,SAAS,aAAa,CAAC,EAAE,CAAC,EAEvC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,mBAAmB,CAAC,EAAE,CAAC,GAAG,4BAA4B,CAAC,EAAE,CAAC,EAC3E,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChD,eAAe,EACb,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACjE,sBAAsB,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,EAClE,aAAa,CAAC,EAAE,MAAM,wBAAwB,CAAC,EAAE,EAAE,aAAa,CAAC,GAAG,SAAS,GAC5E,wBAAwB,CACzB,EAAE,EACF,CAAC,EACD,UAAU,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EACV,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,EACb,OAAO,EACP,OAAO,EACP,sBAAsB,CACvB,CA4BA"}
+{"version":3,"file":"enrichDetails.middleware.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/request/enrichDetails.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAS3D,OAAO,EAEL,sBAAsB,EACvB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,IAAI,EACJ,aAAa,EACb,mBAAmB,EACnB,MAAM,EACN,YAAY,EACZ,4BAA4B,EAC5B,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,aAAa,EACd,MAAM,mCAAmC,CAAC;AAK3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAE7E;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,EAAE,SAAS,kBAAkB,EAC7B,cAAc,SAAS,MAAM,EAC7B,CAAC,SAAS,YAAY,CAAC,EAAE,CAAC,EAC1B,UAAU,SAAS,eAAe,CAAC,EAAE,CAAC,EACtC,OAAO,SAAS,IAAI,CAAC,EAAE,CAAC,EACxB,QAAQ,SAAS,WAAW,CAAC,EAAE,CAAC,EAChC,UAAU,SAAS,aAAa,CAAC,EAAE,CAAC,EACpC,UAAU,SAAS,aAAa,CAAC,EAAE,CAAC,EACpC,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,YAAY,SAAS,aAAa,CAAC,EAAE,EAAE,cAAc,CAAC,EACtD,aAAa,SAAS,aAAa,CAAC,EAAE,CAAC,EAEvC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,mBAAmB,CAAC,EAAE,CAAC,GAAG,4BAA4B,CAAC,EAAE,CAAC,EAC3E,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChD,eAAe,EACb,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACjE,sBAAsB,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,EAClE,aAAa,CAAC,EAAE,MAAM,wBAAwB,CAAC,EAAE,EAAE,aAAa,CAAC,GAAG,SAAS,GAC5E,wBAAwB,CACzB,EAAE,EACF,CAAC,EACD,UAAU,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EACV,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,EACb,OAAO,EACP,OAAO,EACP,sBAAsB,CACvB,CAqCA"}

package/lib/http/telemetry/auditLogger.d.ts

@@ -10,7 +10,11 @@ export type AuditEntry = {
     status: number;
     duration: number;
     redactedFields: string[];
-    eventType: 'http' | 'ws' | 'auth_failure' | 'rate_limit' | 'rbac_deny' | 'super_admin_bypass';
+    eventType: 'http' | 'ws' | 'auth_failure' | 'rate_limit' | 'rbac_deny' | 'super_admin_bypass'
+    /** A compliant field's plaintext was read (.deanon). */
+     | 'data_access'
+    /** A record holding sensitive fields was created, updated or deleted. */
+     | 'data_change';
 };
 export declare class AuditLogger {
     _otel: OpenTelemetryCollector<MetricsDefinition>;

package/lib/http/telemetry/auditLogger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditLogger.d.ts","sourceRoot":"","sources":["../../../src/http/telemetry/auditLogger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EACL,MAAM,GACN,IAAI,GACJ,cAAc,GACd,YAAY,GACZ,WAAW,GACX,oBAAoB,CAAC;CAC1B,CAAC;AAEF,qBAAa,WAAW;IACtB,KAAK,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IAEjD,YAAY,IAAI,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,EAE1D;IAED,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAsB9B;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAKhE;CACF"}
+{"version":3,"file":"auditLogger.d.ts","sourceRoot":"","sources":["../../../src/http/telemetry/auditLogger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EACL,MAAM,GACN,IAAI,GACJ,cAAc,GACd,YAAY,GACZ,WAAW,GACX,oBAAoB;IACtB,wDAAwD;OACtD,aAAa;IACf,yEAAyE;OACvE,aAAa,CAAC;CACnB,CAAC;AAEF,qBAAa,WAAW;IACtB,KAAK,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IAEjD,YAAY,IAAI,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,EAE1D;IAED,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAsB9B;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAKhE;CACF"}

package/lib/http/telemetry/requestAudit.d.ts

@@ -0,0 +1,30 @@
+import { MetricsDefinition } from '../types/openTelemetryCollector.types';
+import { AuditEntry } from './auditLogger';
+import { OpenTelemetryCollector } from './openTelemetryCollector';
+/**
+ * Default audit trail for every app built on ForkLaunch: one audit record per
+ * request (who, tenant, method, route, status, duration and a hash of the
+ * body, never its content) and one per read of a compliant field's plaintext.
+ * Records carry `log.type: audit` so the platform can keep them apart from
+ * application logs. On unless FORKLAUNCH_AUDIT=off.
+ */
+export declare function auditEnabled(): boolean;
+/** The audit event a response status stands for. */
+export declare function auditEventType(status: number): AuditEntry['eventType'];
+/** Append the audit record for one finished request. */
+export declare function recordRequestAudit(otel: OpenTelemetryCollector<MetricsDefinition> | undefined, req: {
+    method: string;
+    originalPath?: string;
+    path?: string;
+    session?: unknown;
+    body?: unknown;
+}, status: number, durationMs: number): void;
+/**
+ * Every `.deanon` read of a compliant field becomes an audit record (field,
+ * level, tenant), and every create/update/delete of a record holding sensitive
+ * fields a `data_change` record (entity#id, action, sensitive field names). It is emitted inside the request's trace, which ties it to
+ * the request's own audit record and so to the user. Registered once per
+ * process; returns a function that removes it.
+ */
+export declare function auditComplianceAccess(otel: OpenTelemetryCollector<MetricsDefinition>): () => void;
+//# sourceMappingURL=requestAudit.d.ts.map

package/lib/http/telemetry/requestAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAudit.d.ts","sourceRoot":"","sources":["../../../src/http/telemetry/requestAudit.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAe,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAYD,oDAAoD;AACpD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAKtE;AAeD,wDAAwD;AACxD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,GAAG,SAAS,EAC3D,GAAG,EAAE;IACH,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,EACD,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,IAAI,CAmBN;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,GAC9C,MAAM,IAAI,CAsCZ"}

package/lib/persistence/complianceChanges.d.ts

@@ -0,0 +1,30 @@
+import type { EntitySchema } from '@mikro-orm/core';
+import type { ComplianceLevel } from './complianceTypes';
+/**
+ * Emitted after a record of an entity holding pii, phi or pci fields is
+ * created, updated or deleted. Carries field names, never values.
+ */
+export interface ComplianceChangeEvent {
+    entity: string;
+    /** Primary key, colon-joined for composite keys. */
+    id: string;
+    action: 'create' | 'update' | 'delete';
+    /** Fields written (create: every field set; update: the changed ones). */
+    fields: string[];
+    /** The sensitive fields among them. */
+    sensitiveFields: string[];
+    tenantId: string | null;
+}
+export type ComplianceChangeListener = (event: ComplianceChangeEvent) => void;
+/**
+ * Register a listener for every change to a sensitive record, for audit
+ * trails. Returns a function that removes it.
+ */
+export declare function onComplianceChange(listener: ComplianceChangeListener): () => void;
+/**
+ * Attach create/update/delete hooks to an entity schema that holds sensitive
+ * fields, so every change to one of its records is reported without the app
+ * wiring anything.
+ */
+export declare function installComplianceChangeHooks(schema: EntitySchema, entityName: string, levels: Map<string, ComplianceLevel>): void;
+//# sourceMappingURL=complianceChanges.d.ts.map

package/lib/persistence/complianceChanges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complianceChanges.d.ts","sourceRoot":"","sources":["../../src/persistence/complianceChanges.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,iBAAiB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uCAAuC;IACvC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAO9E;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,wBAAwB,GACjC,MAAM,IAAI,CAGZ;AAaD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACnC,IAAI,CAgCN"}

package/lib/persistence/compliancePropertyBuilder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compliancePropertyBuilder.d.ts","sourceRoot":"","sources":["../../src/persistence/compliancePropertyBuilder.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA2QjE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,EAAE,EAAE,gBAsCK,CAAC"}
+{"version":3,"file":"compliancePropertyBuilder.d.ts","sourceRoot":"","sources":["../../src/persistence/compliancePropertyBuilder.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAgRjE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,EAAE,EAAE,gBAsCK,CAAC"}

package/lib/persistence/compliantField.d.ts

@@ -63,6 +63,24 @@ export declare class LegacyCiphertextError extends Error {
 export declare class CompliantQueryError extends Error {
     readonly name: 'CompliantQueryError';
 }
+/**
+ * Thrown when a compliant field is read or written while a tenant other than
+ * the one that owns it is bound.
+ *
+ * A field belongs to the tenant it was loaded under (or, for a value assigned
+ * in-process, the tenant bound when it was assigned), and `.deanon` decrypts
+ * with that tenant's key whatever context is bound at read time. A different
+ * bound tenant means the value is about to cross into another tenant's
+ * request, so it is refused rather than revealed or re-sealed.
+ */
+export declare class TenantMismatchError extends Error {
+    readonly path: string;
+    readonly operation: string;
+    readonly ownerTenantId: string;
+    readonly boundTenantId: string;
+    readonly name: 'TenantMismatchError';
+    constructor(path: string, operation: string, ownerTenantId: string, boundTenantId: string);
+}
 /**
  * A de-identified value, produced only by a compliant field's `.anon`.
  * Anything that must never carry protected data (a message to a provider
@@ -88,8 +106,12 @@ export declare function defaultAnonStrategy(elementRuntimeType: string, isArray:
  * `[object Object]` and serializing it prints `{}`, so nothing leaks by
  * accident and every read is explicit.
  *
- * Plaintext is decrypted lazily, on the first `.deanon`, in the caller's
- * encryption context.
+ * Plaintext is decrypted lazily, on the first `.deanon`, with the key of the
+ * tenant the field was loaded (or assigned) under. That tenant is captured
+ * when the row is hydrated, so `.deanon` works after the call that loaded it
+ * has returned (building a DTO outside the tenant-bound entity manager) and
+ * can never decrypt under a different tenant: if another tenant is bound at
+ * read time it throws {@link TenantMismatchError}.
  *
  * Assigning a plain value to the property (directly, through `em.create` or
  * through `em.assign`) wraps it; `where: { property: value }` works for
@@ -108,12 +130,17 @@ export declare class CompliantField<V = unknown, L extends EncryptedComplianceLe
     readonly __level?: L;
     private constructor();
     /**
-     * @internal Wrap a plaintext value for `spec`. Applications assign plain
-     * values to the entity property instead.
+     * @internal Wrap a plaintext value for `spec`, owned by `tenant` (the one
+     * bound where it was assigned, if any). Applications assign plain values to
+     * the entity property instead.
      */
-    static fromPlain<V>(value: V, spec: CompliantFieldSpec): CompliantField<V>;
-    /** @internal Wrap a stored value (any envelope, or legacy plaintext). */
-    static fromStored<V>(stored: string, spec: CompliantFieldSpec, index?: string | null): CompliantField<V>;
+    static fromPlain<V>(value: V, spec: CompliantFieldSpec, tenant: string | undefined): CompliantField<V>;
+    /**
+     * @internal Wrap a stored value (any envelope, or legacy plaintext) loaded
+     * under `tenant`: the tenant bound during hydration, which is the loading
+     * entity manager's.
+     */
+    static fromStored<V>(stored: string, spec: CompliantFieldSpec, index: string | null | undefined, tenant: string | undefined): CompliantField<V>;
     /** @internal A queryable field whose ciphertext column was not selected. */
     static fromIndexOnly<V>(index: string | null, spec: CompliantFieldSpec): CompliantField<V>;
     /** The field's classification. */
@@ -129,7 +156,7 @@ export declare function isCompliantField(value: unknown): value is CompliantFiel
 export declare function sealedValueOf(field: CompliantField): string | undefined;
 /** @internal Normalize an already-serialized value for indexing. */
 export declare function normalizeSerializedForIndex(serialized: string, spec: CompliantFieldSpec): string;
-/** @internal Blind index of a raw query value. */
+/** @internal Blind index of a raw query value, under the bound tenant. */
 export declare function blindIndexOfValue(value: unknown, spec: CompliantFieldSpec): string;
 /** @internal The blind index for a field, computing it when missing. */
 export declare function blindIndexOf(field: CompliantField): string | null;
@@ -140,6 +167,12 @@ export interface PendingIndex {
 }
 export declare function isPendingIndex(value: unknown): value is PendingIndex;
 export declare function pendingIndexValue(value: PendingIndex): string | null;
+/**
+ * @internal The `runtimeType` of a compliant property: what it holds in
+ * memory. Deliberately not one of MikroORM's scalar names, which it checks
+ * assigned values against.
+ */
+export declare const COMPLIANT_RUNTIME_TYPE = "CompliantField";
 declare abstract class CompliantTypeBase extends Type<unknown, string | null> {
     readonly spec: CompliantFieldSpec;
     constructor(spec: CompliantFieldSpec);

package/lib/persistence/compliantField.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compliantField.d.ts","sourceRoot":"","sources":["../../src/persistence/compliantField.ts"],"names":[],"mappings":"AACA,OAAO,EACL,IAAI,EACJ,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAkBlE;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1E,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;CAC5C;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,wBAAwB,CAAC;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,GAAG,WAAW,CAAC;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAChC,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;CACd;AAMD,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,wBAAwB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAO9E;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,wBAAwB,GACjC,MAAM,IAAI,CAGZ;AAMD;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;CAClD;AAED,+EAA+E;AAC/E,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;CAChD;AASD;;;;;GAKG;AACH,qBAAa,IAAI;IACf,QAAQ,CAAC,KAAK,EAAG,MAAM,CAAC;IAExB,gBAAgB;IAChB,YAAY,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAOrC;CACF;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAMpD;AA0BD,gBAAgB;AAChB,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAwB1E;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CACjC,kBAAkB,EAAE,MAAM,EAC1B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,GACf,YAAY,CAKd;AAkCD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,cAAc,CACzB,CAAC,GAAG,OAAO,EACX,CAAC,SAAS,wBAAwB,GAAG,wBAAwB,EAC7D,CAAC,SAAS,OAAO,GAAG,OAAO;IAI3B,gBAAgB;IAChB,SAAiB,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,gBAAgB;IAChB,SAAiB,KAAK,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB;IAChB,SAAiB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtD,iFAAiF;IACjF,SAAiB,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/D,gDAAgD;IAChD,SAAiB,OAAO,CAAC,EAAE,CAAC,CAAC;IAE7B,OAAO,eAIN;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,GAAG,cAAc,CAAC,CAAC,CAAC,CAiBzE;IAED,yEAAyE;IACzE,MAAM,CAAC,UAAU,CAAC,CAAC,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,EACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,cAAc,CAAC,CAAC,CAAC,CAsBnB;IAED,4EAA4E;IAC5E,MAAM,CAAC,aAAa,CAAC,CAAC,EACpB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,EAAE,kBAAkB,GACvB,cAAc,CAAC,CAAC,CAAC,CAEnB;IAED,kCAAkC;IAClC,IAAI,KAAK,IAAI,CAAC,CAEb;IAED,6EAA6E;IAC7E,IAAI,IAAI,IAAI,IAAI,CAWf;IAED,iEAAiE;IACjE,IAAI,MAAM,IAAI,CAAC,CAEd;CACF;AAmCD,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAMxE;AAgBD,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAwBvE;AAED,oEAAoE;AACpE,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,kBAAkB,GACvB,MAAM,CAIR;AAMD,kDAAkD;AAClD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,kBAAkB,GACvB,MAAM,CAKR;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAajE;AAMD,QAAA,MAAM,OAAO,eAA8C,CAAC;AAE5D,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED,uBAAe,iBAAkB,SAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,kBAAkB;IAA7C,YAAqB,IAAI,EAAE,kBAAkB,EAE5C;IAEQ,aAAa,IAAI,MAAM,CAE/B;IAED,IAAa,WAAW,IAAI,MAAM,CAEjC;IAEQ,gBAAgB,IAAI,OAAO,CAEnC;IAEQ,aAAa,IAAI,MAAM,CAE/B;CACF;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,iBAAiB;IACzC,sBAAsB,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,IAAI,CAUf;IAEQ,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAIvD;CACF;AAID;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IAC9C,sBAAsB,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,IAAI,CAkBf;IAEQ,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAGvD;CACF;AAED,uCAAuC;AACvC,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,GACZ,IAAI,IAAI,aAAa,GAAG,kBAAkB,CAE5C;AAMD,2DAA2D;AAC3D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAqFD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,wBAAwB,EAAE,GAC5C,IAAI,CA8BN;AA4CD,iFAAiF;AACjF,MAAM,MAAM,MAAM,CAAC,CAAC,IAClB,CAAC,SAAS,cAAc,CAAC,MAAM,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE/E,2EAA2E;AAC3E,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAOnE"}
+{"version":3,"file":"compliantField.d.ts","sourceRoot":"","sources":["../../src/persistence/compliantField.ts"],"names":[],"mappings":"AACA,OAAO,EACL,IAAI,EACJ,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAkBlE;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1E,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;CAC5C;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,wBAAwB,CAAC;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,GAAG,WAAW,CAAC;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAChC,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;CACd;AAMD,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,wBAAwB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAO9E;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,wBAAwB,GACjC,MAAM,IAAI,CAGZ;AAMD;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;CAClD;AAED,+EAA+E;AAC/E,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;CAChD;AAED;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM;IALhC,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;IAC/C,YACW,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,EAO/B;CACF;AASD;;;;;GAKG;AACH,qBAAa,IAAI;IACf,QAAQ,CAAC,KAAK,EAAG,MAAM,CAAC;IAExB,gBAAgB;IAChB,YAAY,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAOrC;CACF;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAMpD;AA0BD,gBAAgB;AAChB,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAwB1E;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CACjC,kBAAkB,EAAE,MAAM,EAC1B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,GACf,YAAY,CAKd;AAwCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,cAAc,CACzB,CAAC,GAAG,OAAO,EACX,CAAC,SAAS,wBAAwB,GAAG,wBAAwB,EAC7D,CAAC,SAAS,OAAO,GAAG,OAAO;IAI3B,gBAAgB;IAChB,SAAiB,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,gBAAgB;IAChB,SAAiB,KAAK,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB;IAChB,SAAiB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtD,iFAAiF;IACjF,SAAiB,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/D,gDAAgD;IAChD,SAAiB,OAAO,CAAC,EAAE,CAAC,CAAC;IAE7B,OAAO,eAIN;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAS,CAAC,CAAC,EAChB,KAAK,EAAE,CAAC,EACR,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,cAAc,CAAC,CAAC,CAAC,CAkBnB;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,CAAC,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,cAAc,CAAC,CAAC,CAAC,CAwBnB;IAED,4EAA4E;IAC5E,MAAM,CAAC,aAAa,CAAC,CAAC,EACpB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,EAAE,kBAAkB,GACvB,cAAc,CAAC,CAAC,CAAC,CAEnB;IAED,kCAAkC;IAClC,IAAI,KAAK,IAAI,CAAC,CAEb;IAED,6EAA6E;IAC7E,IAAI,IAAI,IAAI,IAAI,CAWf;IAED,iEAAiE;IACjE,IAAI,MAAM,IAAI,CAAC,CAEd;CACF;AA0DD,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAMxE;AAgBD,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CA8BvE;AAED,oEAAoE;AACpE,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,kBAAkB,GACvB,MAAM,CAIR;AAMD,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,kBAAkB,GACvB,MAAM,CAER;AAaD,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAajE;AAMD,QAAA,MAAM,OAAO,eAA8C,CAAC;AAE5D,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,uBAAe,iBAAkB,SAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,kBAAkB;IAA7C,YAAqB,IAAI,EAAE,kBAAkB,EAE5C;IAEQ,aAAa,IAAI,MAAM,CAE/B;IAED,IAAa,WAAW,IAAI,MAAM,CAEjC;IAEQ,gBAAgB,IAAI,OAAO,CAEnC;IAEQ,aAAa,IAAI,MAAM,CAE/B;CACF;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,iBAAiB;IACzC,sBAAsB,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,IAAI,CAcf;IAEQ,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAWvD;CACF;AAID;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IAC9C,sBAAsB,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,GAAG,IAAI,CAkBf;IAEQ,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAGvD;CACF;AAED,uCAAuC;AACvC,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,GACZ,IAAI,IAAI,aAAa,GAAG,kBAAkB,CAE5C;AAMD,2DAA2D;AAC3D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAqID;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,wBAAwB,EAAE,GAC5C,IAAI,CAgCN;AA4CD,iFAAiF;AACjF,MAAM,MAAM,MAAM,CAAC,CAAC,IAClB,CAAC,SAAS,cAAc,CAAC,MAAM,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE/E,2EAA2E;AAC3E,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAOnE"}

package/lib/persistence/defineComplianceEntity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defineComplianceEntity.d.ts","sourceRoot":"","sources":["../../src/persistence/defineComplianceEntity.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AA6E3B,KAAK,kBAAkB,CAAC,CAAC,IAAI;KAC1B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAChB;QAAE,UAAU,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;SAAE,CAAA;KAAE,GAClD,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,GAC/B,CAAC,CAAC,CAAC,CAAC,GACJ;QAAE,UAAU,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;SAAE,CAAA;KAAE;CACvD,CAAC;AAQF,wBAAgB,sBAAsB,CACpC,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,UAAU,SAAS,MAAM,EAC/B,KAAK,CAAC,WAAW,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjD,KAAK,CAAC,GAAG,SAAS,CAAC,MAAM,WAAW,CAAC,EAAE,GAAG,SAAS,GAAG,SAAS,EAC/D,KAAK,CAAC,KAAK,GAAG,KAAK,EACnB,KAAK,CAAC,WAAW,GAAG,KAAK,EACzB,KAAK,CAAC,YAAY,SAAS,OAAO,GAAG,KAAK,EAE1C,IAAI,EAAE,4BAA4B,CAChC,KAAK,EACL,UAAU,EACV,WAAW,GAAG,kBAAkB,CAAC,WAAW,CAAC,EAC7C,GAAG,EACH,KAAK,EACL,WAAW,EACX,YAAY,CACb,GAAG;IAAE,SAAS,CAAC,EAAE,eAAe,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD,oBAAoB,CACrB,KAAK,EACL,UAAU,EACV,yBAAyB,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,EAC7E,KAAK,EACL,WAAW,CACZ,CAwFA"}
+{"version":3,"file":"defineComplianceEntity.d.ts","sourceRoot":"","sources":["../../src/persistence/defineComplianceEntity.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AA8E3B,KAAK,kBAAkB,CAAC,CAAC,IAAI;KAC1B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAChB;QAAE,UAAU,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;SAAE,CAAA;KAAE,GAClD,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,GAC/B,CAAC,CAAC,CAAC,CAAC,GACJ;QAAE,UAAU,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;SAAE,CAAA;KAAE;CACvD,CAAC;AAQF,wBAAgB,sBAAsB,CACpC,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,UAAU,SAAS,MAAM,EAC/B,KAAK,CAAC,WAAW,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjD,KAAK,CAAC,GAAG,SAAS,CAAC,MAAM,WAAW,CAAC,EAAE,GAAG,SAAS,GAAG,SAAS,EAC/D,KAAK,CAAC,KAAK,GAAG,KAAK,EACnB,KAAK,CAAC,WAAW,GAAG,KAAK,EACzB,KAAK,CAAC,YAAY,SAAS,OAAO,GAAG,KAAK,EAE1C,IAAI,EAAE,4BAA4B,CAChC,KAAK,EACL,UAAU,EACV,WAAW,GAAG,kBAAkB,CAAC,WAAW,CAAC,EAC7C,GAAG,EACH,KAAK,EACL,WAAW,EACX,YAAY,CACb,GAAG;IAAE,SAAS,CAAC,EAAE,eAAe,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD,oBAAoB,CACrB,KAAK,EACL,UAAU,EACV,yBAAyB,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,EAC7E,KAAK,EACL,WAAW,CACZ,CA+FA"}

package/lib/persistence/index.d.ts

@@ -1,10 +1,11 @@
 export { ComplianceLevel, type ComplianceLevel as ComplianceLevelType, getComplianceMetadata, getEntityComplianceFields, entityHasEncryptedFields, RetentionAction, type RetentionAction as RetentionActionType, type RetentionPolicy, RetentionDuration, parseDuration, subtractDuration, type ParsedDuration, getEntityRetention, getAllRetentionPolicies, getEntityUserIdField, getAllUserIdFields, type CompliantValue, type EncryptedComplianceLevel, type EncryptedKeysOf, type RequiresEncryptionContext, type SelectionAvoidsEncryptedColumns } from './complianceTypes';
 export { wrapEmWithForgivingDecryption, type ForgivingDecryptionLogger } from './forgivingDecryptionEm';
 export { asEncryptionSafe, type ContextFreeKeysOfSchema, type ContextFreeReadOptions, type DecryptingReadOptions, type EncryptedKeysOfSchema, type EncryptionAwareReadOptions, type EncryptionSafeEntityManager, type HydratingReadMethod, type PropertiesOfSchema, type SchemaRequiresEncryptionContext } from './encryptionSafeEm';
-export { Anon, CompliantField, CompliantIndexType, CompliantQueryError, CompliantType, LegacyCiphertextError, deanon, isAnon, isCompliantField, onComplianceAccess, type AnonStrategy, type ComplianceAccessEvent, type ComplianceAccessListener, type ComplianceOptions, type Deanon, type Deanonymized } from './compliantField';
+export { Anon, CompliantField, CompliantIndexType, CompliantQueryError, TenantMismatchError, CompliantType, LegacyCiphertextError, deanon, isAnon, isCompliantField, onComplianceAccess, type AnonStrategy, type ComplianceAccessEvent, type ComplianceAccessListener, type ComplianceOptions, type Deanon, type Deanonymized } from './compliantField';
 export { fp } from './compliancePropertyBuilder';
 export { defineComplianceEntity } from './defineComplianceEntity';
 export { wrapEmWithNativeQueryBlocking } from './complianceEventSubscriber';
+export { onComplianceChange, type ComplianceChangeEvent, type ComplianceChangeListener } from './complianceChanges';
 export { EncryptedType, registerEncryptor, setEncryptionTenantId, withEncryptionContext, getCurrentTenantId, getBoundTenantId, assertBindableTenantId, EmptyTenantError, UnboundTenantError } from './encryptedType';
 export { FieldEncryptor, MissingEncryptionKeyError, DecryptionError, EncryptionRequiredError, parseEncryptionKeyList, encryptionKeyId, stampedKeyId, stampedPrefix, isEncryptedCiphertext, sealedAnon, BLIND_INDEX_PREFIX, ENCRYPTED_PREFIXES, ENCRYPTION_FORMAT_ENV, ENCRYPTION_KEY_ENV, LEGACY_ENCRYPTION_KEYS_ENV, LEGACY_ENCRYPTION_KEY_ENV, type FieldEncryptorOptions, type OpenedCiphertext, type CiphertextFormat } from './fieldEncryptor';
 export { reencryptEncryptedColumns, classifyEncryptedValue, collectFallbackTenantIds, defaultTenantIdsFor, entityMetadataList, rotationTotals, countValuesByKeyId, isEncryptedValue, type ReencryptOptions, type RotationOutcome, type RotationTableReport, type SqlExecute, type EntityMetadataLike } from './keyRotation';

package/lib/persistence/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/persistence/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EAExB,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,eAAe,EACpB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACrC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,6BAA6B,EAC7B,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACrC,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,IAAI,EACJ,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,MAAM,EACN,MAAM,EACN,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAGjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAG5E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAErE,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/persistence/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EAExB,eAAe,EACf,KAAK,eAAe,IAAI,mBAAmB,EAC3C,KAAK,eAAe,EACpB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACrC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,6BAA6B,EAC7B,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACrC,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,IAAI,EACJ,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,MAAM,EACN,MAAM,EACN,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAGjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAErE,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC"}

package/lib/persistence/index.js

@@ -53,6 +53,7 @@ __export(persistence_exports, {
   RetentionDuration: () => RetentionDuration,
   RlsEventSubscriber: () => RlsEventSubscriber,
   TENANT_FILTER_NAME: () => TENANT_FILTER_NAME,
+  TenantMismatchError: () => TenantMismatchError,
   UnboundTenantError: () => UnboundTenantError,
   asEncryptionSafe: () => asEncryptionSafe,
   assertBindableTenantId: () => assertBindableTenantId,
@@ -81,6 +82,7 @@ __export(persistence_exports, {
   isEncryptedCiphertext: () => isEncryptedCiphertext,
   isEncryptedValue: () => isEncryptedValue,
   onComplianceAccess: () => onComplianceAccess,
+  onComplianceChange: () => onComplianceChange,
   parseDuration: () => parseDuration,
   parseEncryptionKeyList: () => parseEncryptionKeyList,
   reencryptEncryptedColumns: () => reencryptEncryptedColumns,
@@ -827,6 +829,22 @@ var LegacyCiphertextError = class extends Error {
 var CompliantQueryError = class extends Error {
   name = "CompliantQueryError";
 };
+var TenantMismatchError = class extends Error {
+  constructor(path, operation, ownerTenantId, boundTenantId) {
+    super(
+      `Cannot ${operation} ${path || "a compliant field"} under tenant '${boundTenantId}': it belongs to tenant '${ownerTenantId}', the tenant it was loaded or assigned under. Read it outside any encryption context, or inside the owning tenant's.`
+    );
+    this.path = path;
+    this.operation = operation;
+    this.ownerTenantId = ownerTenantId;
+    this.boundTenantId = boundTenantId;
+  }
+  path;
+  operation;
+  ownerTenantId;
+  boundTenantId;
+  name = "TenantMismatchError";
+};
 var MINT = /* @__PURE__ */ Symbol.for("forklaunch.compliance.mint");
 var ANON_BRAND = /* @__PURE__ */ Symbol.for("forklaunch.compliance.anon");
 var Anon = class {
@@ -907,10 +925,11 @@ var CompliantField = class _CompliantField {
     Object.freeze(this);
   }
   /**
-   * @internal Wrap a plaintext value for `spec`. Applications assign plain
-   * values to the entity property instead.
+   * @internal Wrap a plaintext value for `spec`, owned by `tenant` (the one
+   * bound where it was assigned, if any). Applications assign plain values to
+   * the entity property instead.
    */
-  static fromPlain(value, spec) {
+  static fromPlain(value, spec, tenant) {
     if (spec.enumValues) {
       const values = spec.isArray && Array.isArray(value) ? value : [value];
       for (const v of values) {
@@ -923,16 +942,22 @@ var CompliantField = class _CompliantField {
     }
     return new _CompliantField({
       spec,
+      tenant,
       hasPlain: true,
       plain: value,
       anon: computeAnon(spec.anon, value)
     });
   }
-  /** @internal Wrap a stored value (any envelope, or legacy plaintext). */
-  static fromStored(stored, spec, index) {
+  /**
+   * @internal Wrap a stored value (any envelope, or legacy plaintext) loaded
+   * under `tenant`: the tenant bound during hydration, which is the loading
+   * entity manager's.
+   */
+  static fromStored(stored, spec, index, tenant) {
     if (!isEncryptedCiphertext(stored)) {
       return new _CompliantField({
         spec,
+        tenant,
         hasPlain: true,
         plain: deserializeFromEncryption(
           stored,
@@ -944,6 +969,7 @@ var CompliantField = class _CompliantField {
     }
     return new _CompliantField({
       spec,
+      tenant,
       hasPlain: false,
       sealed: stored,
       anon: sealedAnon(stored) ?? void 0,
@@ -976,11 +1002,24 @@ var CompliantField = class _CompliantField {
     return readPlaintext(this, true);
   }
 };
+function tenantOf(state, operation) {
+  const bound = getBoundTenantId();
+  if (state.tenant === void 0) return requireBoundTenantId(operation);
+  if (bound !== void 0 && bound !== state.tenant) {
+    throw new TenantMismatchError(
+      state.spec.path,
+      operation,
+      state.tenant,
+      bound
+    );
+  }
+  return state.tenant;
+}
 function readPlaintext(field, report) {
   const state = stateOf(field);
   let tenantId = "";
   if (!state.hasPlain) {
-    tenantId = requireBoundTenantId("read");
+    tenantId = tenantOf(state, "read");
     if (state.sealed === void 0) {
       throw new Error(
         `${state.spec.path} was not loaded: its ciphertext column was left out of the selection`
@@ -999,6 +1038,8 @@ function readPlaintext(field, report) {
       state.spec.isArray
     );
     state.hasPlain = true;
+  } else if (state.tenant !== void 0) {
+    tenantId = tenantOf(state, "read");
   }
   if (report) {
     tenantId ||= getBoundTenantId() ?? "";
@@ -1026,10 +1067,11 @@ function sealedValueOf(field) {
     return state.sealed;
   }
   if (!state.hasPlain) return state.sealed;
-  const tenantId = requireBoundTenantId("write");
-  if (state.sealed !== void 0 && state.sealedTenant === tenantId) {
+  if (state.sealed !== void 0 && state.sealedTenant === state.tenant) {
     return state.sealed;
   }
+  const tenantId = tenantOf(state, "write");
+  state.tenant = tenantId;
   if (state.anon === void 0) {
     state.anon = computeAnon(state.spec.anon, state.plain);
   }
@@ -1048,9 +1090,12 @@ function normalizedForIndex(value, spec) {
   return normalizeSerializedForIndex(serializeForEncryption(value), spec);
 }
 function blindIndexOfValue(value, spec) {
+  return blindIndexUnder(value, spec, requireBoundTenantId("query"));
+}
+function blindIndexUnder(value, spec, tenantId) {
   return requireEncryptor(spec.path).blindIndex(
     normalizedForIndex(value, spec),
-    requireBoundTenantId("query")
+    tenantId
   );
 }
 function blindIndexOf(field) {
@@ -1059,7 +1104,7 @@ function blindIndexOf(field) {
   if (!state.hasPlain && state.sealed === void 0) return state.index ?? null;
   try {
     const plain = state.hasPlain ? state.plain : readPlaintext(field, false);
-    state.index = blindIndexOfValue(plain, state.spec);
+    state.index = blindIndexUnder(plain, state.spec, tenantOf(state, "index"));
   } catch {
     return state.index ?? null;
   }
@@ -1072,6 +1117,7 @@ function isPendingIndex(value) {
 function pendingIndexValue(value) {
   return value[PENDING];
 }
+var COMPLIANT_RUNTIME_TYPE = "CompliantField";
 var CompliantTypeBase = class extends import_core2.Type {
   constructor(spec) {
     super();
@@ -1082,7 +1128,7 @@ var CompliantTypeBase = class extends import_core2.Type {
     return "text";
   }
   get runtimeType() {
-    return "string";
+    return COMPLIANT_RUNTIME_TYPE;
   }
   ensureComparable() {
     return false;
@@ -1101,12 +1147,19 @@ var CompliantType = class extends CompliantTypeBase {
     if (value === null || value === void 0) return null;
     if (isCompliantField(value)) return sealedValueOf(value) ?? null;
     if (isEncryptedCiphertext(value)) return value;
-    return sealedValueOf(CompliantField.fromPlain(value, this.spec)) ?? null;
+    return sealedValueOf(
+      CompliantField.fromPlain(value, this.spec, getBoundTenantId())
+    ) ?? null;
   }
   convertToJSValue(value) {
     if (value === null || value === void 0) return value;
     if (isCompliantField(value)) return value;
-    return CompliantField.fromStored(String(value), this.spec);
+    return CompliantField.fromStored(
+      String(value),
+      this.spec,
+      void 0,
+      getBoundTenantId()
+    );
   }
 };
 var EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["$eq", "$ne", "$in", "$nin"]);
@@ -1135,6 +1188,18 @@ function isCompliantType(type) {
   return type instanceof CompliantType || type instanceof CompliantIndexType;
 }
 var SLOTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.slots")] ??= /* @__PURE__ */ new WeakMap();
+var LOADED_TENANTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.loadedTenants")] ??= /* @__PURE__ */ new WeakMap();
+function loadedTenantOf(entity, binding) {
+  return LOADED_TENANTS.get(entity)?.[binding.property];
+}
+function recordLoadedTenant(entity, binding) {
+  let tenants = LOADED_TENANTS.get(entity);
+  if (!tenants) {
+    tenants = {};
+    LOADED_TENANTS.set(entity, tenants);
+  }
+  tenants[binding.property] = getBoundTenantId();
+}
 function slotsOf(entity) {
   let slots = SLOTS.get(entity);
   if (!slots) {
@@ -1150,12 +1215,22 @@ function readProperty(entity, binding) {
     const stored = slots[binding.sibling];
     if (isPendingIndex(value)) {
       const index = pendingIndexValue(value);
-      const field = typeof stored === "string" ? CompliantField.fromStored(stored, binding.spec, index) : CompliantField.fromIndexOnly(index, binding.spec);
+      const field = typeof stored === "string" ? CompliantField.fromStored(
+        stored,
+        binding.spec,
+        index,
+        loadedTenantOf(entity, binding)
+      ) : CompliantField.fromIndexOnly(index, binding.spec);
       slots[binding.property] = field;
       return field;
     }
     if (value == null && typeof stored === "string") {
-      const field = CompliantField.fromStored(stored, binding.spec, null);
+      const field = CompliantField.fromStored(
+        stored,
+        binding.spec,
+        null,
+        loadedTenantOf(entity, binding)
+      );
       slots[binding.property] = field;
       return field;
     }
@@ -1177,10 +1252,18 @@ function writeProperty(entity, binding, value) {
     return;
   }
   if (isCompliantField(value)) {
-    slots[binding.property] = sameRules(stateOf(value).spec, binding.spec) ? value : CompliantField.fromPlain(readPlaintext(value, false), binding.spec);
+    slots[binding.property] = sameRules(stateOf(value).spec, binding.spec) ? value : CompliantField.fromPlain(
+      readPlaintext(value, false),
+      binding.spec,
+      stateOf(value).tenant ?? getBoundTenantId()
+    );
     return;
   }
-  slots[binding.property] = CompliantField.fromPlain(value, binding.spec);
+  slots[binding.property] = CompliantField.fromPlain(
+    value,
+    binding.spec,
+    getBoundTenantId()
+  );
 }
 function installCompliantAccessors(prototype, bindings) {
   installInspect(prototype, bindings);
@@ -1207,6 +1290,7 @@ function installCompliantAccessors(prototype, bindings) {
           return sealedValueOf(field) ?? stored;
         },
         set(value) {
+          recordLoadedTenant(this, binding);
           slotsOf(this)[sibling] = value;
         }
       });
@@ -1315,7 +1399,7 @@ function wrapClassified(builder, level, complianceOptions) {
       };
       options.type = spec.queryable ? new CompliantIndexType(spec) : new CompliantType(spec);
       options.columnType = "text";
-      options.runtimeType = "string";
+      options.runtimeType = COMPLIANT_RUNTIME_TYPE;
       options.accessor = true;
     }
   }
@@ -1419,6 +1503,47 @@ var fp = new Proxy(import_core3.p, {
 
 // src/persistence/defineComplianceEntity.ts
 var import_core4 = require("@mikro-orm/core");
+
+// src/persistence/complianceChanges.ts
+var LISTENERS2 = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.changeListeners")] ??= /* @__PURE__ */ new Set();
+function onComplianceChange(listener) {
+  LISTENERS2.add(listener);
+  return () => LISTENERS2.delete(listener);
+}
+function emit(event) {
+  for (const listener of LISTENERS2) {
+    try {
+      listener(event);
+    } catch (error) {
+      console.error("Compliance change listener failed:", error);
+    }
+  }
+}
+function installComplianceChangeHooks(schema, entityName, levels) {
+  const sensitive = new Set(
+    [...levels].filter(([, level]) => level !== "none").map(([name]) => name)
+  );
+  if (!sensitive.size) return;
+  const report = (action) => (args) => {
+    if (!LISTENERS2.size) return;
+    const entity = args.entity;
+    const keys = args.meta?.primaryKeys ?? ["id"];
+    const fields = action === "update" ? Object.keys(args.changeSet?.payload ?? {}) : action === "create" ? [...levels.keys()].filter((name) => entity[name] !== void 0) : [];
+    emit({
+      entity: entityName,
+      id: keys.map((key) => String(entity[key] ?? "")).join(":"),
+      action,
+      fields,
+      sensitiveFields: action === "delete" ? [...sensitive] : fields.filter((name) => sensitive.has(name)),
+      tenantId: getBoundTenantId() ?? null
+    });
+  };
+  schema.addHook("afterCreate", report("create"));
+  schema.addHook("afterUpdate", report("update"));
+  schema.addHook("afterDelete", report("delete"));
+}
+
+// src/persistence/defineComplianceEntity.ts
 var naming = new import_core4.UnderscoreNamingStrategy();
 function wireCompliantProperties(entityName, properties) {
   const wired = {};
@@ -1498,6 +1623,11 @@ function defineComplianceEntity(meta) {
     ...meta,
     properties: wired.properties
   });
+  installComplianceChangeHooks(
+    schema,
+    entityName,
+    complianceFields
+  );
   if (wired.bindings.length > 0) {
     const entityClass = schema.meta.class;
     if (entityClass)
@@ -2080,6 +2210,7 @@ function rebind(result, target, proxy) {
   RetentionDuration,
   RlsEventSubscriber,
   TENANT_FILTER_NAME,
+  TenantMismatchError,
   UnboundTenantError,
   asEncryptionSafe,
   assertBindableTenantId,
@@ -2108,6 +2239,7 @@ function rebind(result, target, proxy) {
   isEncryptedCiphertext,
   isEncryptedValue,
   onComplianceAccess,
+  onComplianceChange,
   parseDuration,
   parseEncryptionKeyList,
   reencryptEncryptedColumns,