@krizaka/privacy 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,35 @@
-# Temporary Holding Version
+# @krizaka/privacy
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Privacy for every Krizaka product (Loi 25): **consents by purpose**, the person's data **exported** from every module that holds it, **erased** from every module in one transaction, and **retention** per purpose set by the admin. Six products had a partial copy (Yomizaka's consents, export and delete; Akinaza's `recordConsent` and `eraseClient`; Yasakia's async export; Orochia's and Kachizaka's admin exports; Yororis' consent columns). This is the one version.
+
+```ts
+import { transaction } from "@krizaka/db";
+import { auditContributor, createPrivacy, privacySchema } from "@krizaka/privacy";
+import { privacySettings, retentionFromSettings } from "@krizaka/privacy/settings";
+
+emitMigration(privacySchema, 1, { tables: {} }); // commit the SQL once, in your migrations: privacy.consent and privacy.request
+
+const privacy = createPrivacy({
+  clock: { now: () => new Date() },
+  purposes: ["marketing", "screening"],                 // the purposes the product declares
+  contributors: [auditContributor(audit), ordersContributor, filesContributor], // every module that holds personal data
+  transaction: (work) => transaction(connect, work),
+  retentionDays: retentionFromSettings((key) => settings.get(key)), // privacy.retention.<purpose>Days
+  audit, outbox,                                         // optional: the erasure is recorded; a large export goes through the outbox
+});
+
+const eric = { kind: "account", id: account.id };         // a subject is a kind and an id: an account, a client file, an application
+await privacy.recordConsent(query, { subject: eric, purpose: "marketing", version: "2026-10-01", granted: true, means: "checkbox" });
+await privacy.hasConsent(query, eric, "marketing");       // the consent with the last word; never having said anything is a no
+const document = await privacy.exportSubject(query, eric); // { format: 1, subject, generatedAt, modules: { audit, orders, files } }
+await privacy.eraseSubject(eric);                         // every contributor, one transaction, consents withdrawn, a record without personal data
+await privacy.purge(query);                               // from the product's job: what is past each purpose's retention
+```
+
+- **A subject is a kind and an id**, not necessarily an account: Akinaza's data subject is a client file, Yomizaka's a tenant on an application.
+- **`privacy.consent` is written once**: a trigger refuses every update; a withdrawal is a new row; the row with the last `seq` wins. Each consent holds the **version of the notice shown**, the means and the instant: the proof of what the person agreed to.
+- **`PrivacyContributor`** is the port every module implements: `exportFor(query, subject)`, `eraseFor(tx, subject)` (erase or anonymise through the transaction it is given: a module that keeps an invoice for six years blanks the name and keeps the row), and optionally `purgeExpired(tx, { purpose, before })`. The product registers one for its own tables. `auditContributor(audit)` is provided for `@krizaka/audit` (the export lists the actor's entries; the erasure detaches them and keeps the facts). A side effect outside the database (a file in storage) is not done in `eraseFor`: append it to the outbox in the same transaction.
+- **Export** assembles one JSON document with a part per contributor; a contributor that fails fails the export, naming it (a silent omission would be a lie). **A large export** is asked in the caller's transaction with `requestExport(tx, subject)` (it appends `evt.privacy.export_requested.v1` to the outbox, holding the request id only) and a worker calls `fulfilExport(query, requestId, deliver)`: Yasakia's asynchronous mode.
+- **Erasure** runs every contributor's `eraseFor` in ONE transaction, withdraws the live consents (a new row each, version `erasure` or the one you pass), records the request and an audit entry `privacy.erasure_completed` that names the request and the modules and **no one**. If a contributor fails, nothing is erased, the request is recorded as `failed` with a code, and the error is thrown (if recording the failure fails too, an `AggregateError` with the original first).
+- **Retention:** `privacySettings({ screening: { retentionDays: 365 } })` (`@krizaka/privacy/settings`, needs `@krizaka/settings` and `zod`) declares `privacy.retention.screeningDays` (`payment-history` → `paymentHistoryDays`). `purge` calls every contributor's `purgeExpired` for each purpose that has a retention.
+- The request table holds an id of the subject and no other personal data, so it can outlive the erasure it proves. `privacyStoreContract` (from `@krizaka/privacy/testkit`) is the contract every store runs.

package/dist/chunk-PMXEX2LW.js

@@ -0,0 +1,43 @@
+// src/port.ts
+var REQUEST_KIND = { export: "export", erasure: "erasure" };
+var REQUEST_STATUS = { requested: "requested", completed: "completed", failed: "failed" };
+var PRIVACY_CODE = {
+  badSubject: "PRIVACY_BAD_SUBJECT",
+  badPurpose: "PRIVACY_BAD_PURPOSE",
+  badConsent: "PRIVACY_BAD_CONSENT",
+  unknownRequest: "PRIVACY_UNKNOWN_REQUEST",
+  notAnExport: "PRIVACY_NOT_AN_EXPORT",
+  alreadyDone: "PRIVACY_ALREADY_DONE",
+  contributorFailed: "PRIVACY_CONTRIBUTOR_FAILED",
+  noOutbox: "PRIVACY_NO_OUTBOX"
+};
+var PrivacyError = class extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = "PrivacyError";
+  }
+  code;
+};
+
+// src/rules.ts
+var KIND = /^[a-z][a-z0-9_]{0,39}$/;
+var PURPOSE = /^[a-z][a-z0-9_-]{0,39}$/;
+var MAX_ID = 200;
+function checkSubject(subject) {
+  if (!KIND.test(subject.kind)) throw new PrivacyError(PRIVACY_CODE.badSubject, `subject kind \xAB ${subject.kind} \xBB: lower-case letters, digits and _, starting with a letter`);
+  if (subject.id.length < 1 || subject.id.length > MAX_ID) throw new PrivacyError(PRIVACY_CODE.badSubject, `subject id: 1 to ${MAX_ID} characters`);
+}
+function checkPurpose(purpose) {
+  if (!PURPOSE.test(purpose)) throw new PrivacyError(PRIVACY_CODE.badPurpose, `purpose \xAB ${purpose} \xBB: lower-case letters, digits, _ and -, starting with a letter, at most 40 characters`);
+}
+
+export {
+  REQUEST_KIND,
+  REQUEST_STATUS,
+  PRIVACY_CODE,
+  PrivacyError,
+  checkSubject,
+  checkPurpose
+};
+//# sourceMappingURL=chunk-PMXEX2LW.js.map

package/dist/chunk-PMXEX2LW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port.ts","../src/rules.ts"],"sourcesContent":["/**\n * The ports of « privacy » (Loi 25): consents by purpose, the person's data exported from every module that holds it, and erased\n * from every module in one transaction. Generic: no product import, no database client (a `Query` comes in), no wall clock (a\n * `Clock` comes in). What a module holds, and what erasing it means (blanking a row, deleting a file, keeping an invoice for six\n * years), is the module's: it implements `PrivacyContributor`.\n */\nexport type { Clock, Query } from \"@krizaka/db\";\nimport type { Query } from \"@krizaka/db\";\n\n/**\n * Whose data it is. Usually an account (`{ kind: \"account\", id }`), but a product's data subject is not always an account: Akinaza's\n * is a client file, Yomizaka's a tenant on an application. The `kind` says which.\n */\nexport interface Subject {\n  /** What the id identifies: `account`, `client`, `application`. Lower-case letters, digits and `_`. */\n  kind: string;\n  /** The product's id for it (a UUID, a slug). */\n  id: string;\n}\n\n/** What a product records when a person agrees, or withdraws. */\nexport interface ConsentInput {\n  subject: Subject;\n  /** What the person agreed to (`marketing`, `screening`, `reminders`): one of the product's declared purposes. */\n  purpose: string;\n  /** The version of the notice shown to them: the proof of WHAT they agreed to. */\n  version: string;\n  granted: boolean;\n  /** How they said it (`checkbox`, `link`, `verbal`, `erasure`). */\n  means?: string | undefined;\n}\n\n/** A consent as written. It is never edited: a withdrawal is a new row. */\nexport interface ConsentRecord {\n  id: string;\n  subject: Subject;\n  purpose: string;\n  version: string;\n  granted: boolean;\n  means: string | null;\n  at: Date;\n}\n\nexport const REQUEST_KIND = { export: \"export\", erasure: \"erasure\" } as const;\nexport type RequestKind = (typeof REQUEST_KIND)[keyof typeof REQUEST_KIND];\nexport const REQUEST_STATUS = { requested: \"requested\", completed: \"completed\", failed: \"failed\" } as const;\nexport type RequestStatus = (typeof REQUEST_STATUS)[keyof typeof REQUEST_STATUS];\n\n/** An export or an erasure asked for, and where it stands. It holds an id of the subject and no other personal data. */\nexport interface PrivacyRequest {\n  id: string;\n  subject: Subject;\n  kind: RequestKind;\n  status: RequestStatus;\n  requestedAt: Date;\n  completedAt: Date | null;\n  /** A code, never a message that could carry data. */\n  failure: string | null;\n}\n\n/**\n * A module that holds personal data. The product registers one per module and one for its own tables.\n *\n * - `exportFor` returns what the module holds about the subject, as JSON-able data.\n * - `eraseFor` erases or anonymises it, through the transaction it is given, so the whole erasure commits or rolls back together.\n *   A side effect outside the database (a file in storage) is not done here: append it to the outbox in the same transaction.\n * - `purgeExpired` (optional) removes what the retention of a purpose says is past, for everyone.\n */\nexport interface PrivacyContributor {\n  /** A stable name, the key of its part in the export (`audit`, `orders`). */\n  name: string;\n  exportFor(query: Query, subject: Subject): Promise<unknown>;\n  eraseFor(tx: Query, subject: Subject): Promise<void>;\n  purgeExpired?(tx: Query, input: { purpose: string; before: Date }): Promise<number>;\n}\n\n/** The whole export of a subject: one document, a part per contributor. */\nexport interface ExportDocument {\n  format: 1;\n  subject: Subject;\n  generatedAt: string;\n  modules: Record<string, unknown>;\n}\n\n/** Where consents and requests live. Every adapter runs `privacyStoreContract` (`@krizaka/privacy/testkit`). */\nexport interface PrivacyStore {\n  insertConsent(consent: ConsentRecord): Promise<void>;\n  /** The consent with the last word for this purpose, or null when the person never said anything. */\n  latestConsent(subject: Subject, purpose: string): Promise<ConsentRecord | null>;\n  /** Every consent of the subject, oldest first. */\n  consentHistory(subject: Subject): Promise<ConsentRecord[]>;\n  insertRequest(request: PrivacyRequest): Promise<void>;\n  getRequest(id: string): Promise<PrivacyRequest | null>;\n  finishRequest(id: string, outcome: { status: \"completed\" | \"failed\"; at: Date; failure?: string }): Promise<void>;\n  requestsOf(subject: Subject): Promise<PrivacyRequest[]>;\n}\n\n/** The structural slice of `@krizaka/audit` this package writes through, so it adds no dependency. */\nexport interface AuditPort {\n  record(query: Query, entry: { actorId: string | null; actorLabel: string; action: string; target?: { type: string; id: string } | null; detail?: Record<string, unknown> }): Promise<unknown>;\n}\n\n/** The structural slice of `@krizaka/outbox` used for a large export. */\nexport interface OutboxPort {\n  append(tx: Query, message: { topic: string; type: string; payload: unknown; id?: string }): Promise<unknown>;\n}\n\nexport const PRIVACY_CODE = {\n  badSubject: \"PRIVACY_BAD_SUBJECT\",\n  badPurpose: \"PRIVACY_BAD_PURPOSE\",\n  badConsent: \"PRIVACY_BAD_CONSENT\",\n  unknownRequest: \"PRIVACY_UNKNOWN_REQUEST\",\n  notAnExport: \"PRIVACY_NOT_AN_EXPORT\",\n  alreadyDone: \"PRIVACY_ALREADY_DONE\",\n  contributorFailed: \"PRIVACY_CONTRIBUTOR_FAILED\",\n  noOutbox: \"PRIVACY_NO_OUTBOX\",\n} as const;\nexport type PrivacyCode = (typeof PRIVACY_CODE)[keyof typeof PRIVACY_CODE];\n\nexport class PrivacyError extends Error {\n  constructor(\n    readonly code: PrivacyCode,\n    message: string,\n    options?: { cause?: unknown },\n  ) {\n    super(message, options);\n    this.name = \"PrivacyError\";\n  }\n}\n","import { PRIVACY_CODE, PrivacyError, type Subject } from \"./port\";\n\nconst KIND = /^[a-z][a-z0-9_]{0,39}$/;\nconst PURPOSE = /^[a-z][a-z0-9_-]{0,39}$/;\nconst MAX_ID = 200;\n\n/** @throws PrivacyError for a subject whose kind or id is not well formed */\nexport function checkSubject(subject: Subject): void {\n  if (!KIND.test(subject.kind)) throw new PrivacyError(PRIVACY_CODE.badSubject, `subject kind « ${subject.kind} »: lower-case letters, digits and _, starting with a letter`);\n  if (subject.id.length < 1 || subject.id.length > MAX_ID) throw new PrivacyError(PRIVACY_CODE.badSubject, `subject id: 1 to ${MAX_ID} characters`);\n}\n\n/** @throws PrivacyError for a purpose that is not lower-case letters, digits, `_` and `-`, starting with a letter */\nexport function checkPurpose(purpose: string): void {\n  if (!PURPOSE.test(purpose)) throw new PrivacyError(PRIVACY_CODE.badPurpose, `purpose « ${purpose} »: lower-case letters, digits, _ and -, starting with a letter, at most 40 characters`);\n}\n"],"mappings":";AA2CO,IAAM,eAAe,EAAE,QAAQ,UAAU,SAAS,UAAU;AAE5D,IAAM,iBAAiB,EAAE,WAAW,aAAa,WAAW,aAAa,QAAQ,SAAS;AA8D1F,IAAM,eAAe;AAAA,EAC1B,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,UAAU;AACZ;AAGO,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YACW,MACT,SACA,SACA;AACA,UAAM,SAAS,OAAO;AAJb;AAKT,SAAK,OAAO;AAAA,EACd;AAAA,EANW;AAOb;;;AC9HA,IAAM,OAAO;AACb,IAAM,UAAU;AAChB,IAAM,SAAS;AAGR,SAAS,aAAa,SAAwB;AACnD,MAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAG,OAAM,IAAI,aAAa,aAAa,YAAY,qBAAkB,QAAQ,IAAI,iEAA8D;AAC1K,MAAI,QAAQ,GAAG,SAAS,KAAK,QAAQ,GAAG,SAAS,OAAQ,OAAM,IAAI,aAAa,aAAa,YAAY,oBAAoB,MAAM,aAAa;AAClJ;AAGO,SAAS,aAAa,SAAuB;AAClD,MAAI,CAAC,QAAQ,KAAK,OAAO,EAAG,OAAM,IAAI,aAAa,aAAa,YAAY,gBAAa,OAAO,2FAAwF;AAC1L;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,105 @@
+import * as _krizaka_db from '@krizaka/db';
+import { Query, Clock } from '@krizaka/db';
+export { Clock, Query } from '@krizaka/db';
+import { P as PrivacyContributor, a as PrivacyStore, C as ConsentInput, b as ConsentRecord, S as Subject, E as ExportDocument, c as PrivacyRequest, A as AuditPort, O as OutboxPort } from './port-Ds9VVyC2.js';
+export { d as PRIVACY_CODE, e as PrivacyCode, f as PrivacyError, R as REQUEST_KIND, g as REQUEST_STATUS, h as RequestKind, i as RequestStatus } from './port-Ds9VVyC2.js';
+
+/** The structural slice of `@krizaka/audit` that contributes: what the trail holds about an actor, and detaching them from it. */
+interface AuditTrail {
+    exportFor(query: Query, actorId: string): Promise<unknown>;
+    redactActor(query: Query, actorId: string): Promise<number>;
+}
+/**
+ * `@krizaka/audit` as a contributor: an export lists the actor's entries; an erasure detaches the person (id and address removed, the
+ * label « erased ») and keeps the facts. It applies to a subject of the kind the product's actors are (default `account`).
+ * @param audit the product's audit (`createAudit(...)`)
+ */
+declare function auditContributor(audit: AuditTrail, options?: {
+    kind?: string;
+}): PrivacyContributor;
+
+/** An in-memory store, for unit tests and demos (the same behaviour as the database's: the contract kit runs on both). */
+declare function memoryPrivacyStore(): PrivacyStore;
+
+/**
+ * The PostgreSQL store of « privacy », over the `Query` it is given (the caller's transaction, to join its unit of work).
+ * @param schema the Postgres schema of the module, default `privacy`
+ */
+declare function dbPrivacyStore(query: Query, schema?: string): PrivacyStore;
+
+/** The product's unit of work: runs `work` on one connection, commits when it resolves, rolls back when it throws (`transaction` of `@krizaka/db`). */
+type Transaction = <T>(work: (tx: Query) => Promise<T>) => Promise<T>;
+interface PrivacyDeps {
+    clock: Clock;
+    /** Every module that holds personal data, and the product's own. Their names are the keys of the export. */
+    contributors: readonly PrivacyContributor[];
+    /** The purposes the product declares (`screening`, `marketing`). A consent for another is refused. */
+    purposes: readonly string[];
+    /** The product's transaction, for the erasure. */
+    transaction: Transaction;
+    /** How many days a purpose is kept: the settings `privacy.retention.<purpose>Days` (`retentionFromSettings`). `undefined` = no retention for it. */
+    retentionDays?: (purpose: string) => number | undefined | Promise<number | undefined>;
+    /** The audit trail: an erasure is recorded there without personal data. */
+    audit?: AuditPort;
+    /** The outbox: required for the asynchronous export of a large account (`requestExport`). */
+    outbox?: OutboxPort;
+    /** The store over a query. Default: the PostgreSQL store on schema `privacy`. */
+    storeFor?: (query: Query) => PrivacyStore;
+    /** The Postgres schema, when the product renamed the module's (used by the default store). */
+    schema?: string;
+}
+interface Privacy {
+    /** Writes a consent or a withdrawal. Never edits one. */
+    recordConsent(query: Query, input: ConsentInput): Promise<ConsentRecord>;
+    /** Whether the consent with the last word for this purpose is a yes. A person who never said anything has not consented. */
+    hasConsent(query: Query, subject: Subject, purpose: string): Promise<boolean>;
+    /** Every consent and withdrawal of the subject, oldest first. */
+    consentHistory(query: Query, subject: Subject): Promise<ConsentRecord[]>;
+    /** The export, at once: one document with a part per contributor. The request is recorded. */
+    exportSubject(query: Query, subject: Subject): Promise<ExportDocument>;
+    /**
+     * The export of a large account, asynchronously: records the request and appends a message to the outbox IN THE CALLER'S
+     * TRANSACTION (`tx`). A worker then calls `fulfilExport(requestId, deliver)`. The message holds the request id only.
+     */
+    requestExport(tx: Query, subject: Subject): Promise<{
+        requestId: string;
+    }>;
+    /** Assembles the export of a recorded request and hands it to `deliver` (store the file, mail a link); the request is completed after `deliver` returns. */
+    fulfilExport(query: Query, requestId: string, deliver: (document: ExportDocument, request: PrivacyRequest) => Promise<void>): Promise<void>;
+    /**
+     * Erases the subject from every contributor in ONE transaction, withdraws their live consents, and records the request and an
+     * audit entry that names no one. If a contributor fails nothing is erased, the request is recorded as failed, and the error is thrown.
+     */
+    eraseSubject(subject: Subject, options?: {
+        noticeVersion?: string;
+    }): Promise<PrivacyRequest>;
+    /** Removes, for each purpose with a retention, what the contributors hold past it. Returns how many rows each purpose removed. */
+    purge(query: Query): Promise<Record<string, number>>;
+    /** The subject's requests, newest first. */
+    requests(query: Query, subject: Subject): Promise<PrivacyRequest[]>;
+}
+/**
+ * Privacy for a product (Loi 25).
+ * @param deps the contributors, the purposes, the product's transaction and the clock
+ * @throws PrivacyError for a purpose or a contributor name that is not well formed or appears twice
+ */
+declare function createPrivacy(deps: PrivacyDeps): Privacy;
+
+/** @throws PrivacyError for a subject whose kind or id is not well formed */
+declare function checkSubject(subject: Subject): void;
+/** @throws PrivacyError for a purpose that is not lower-case letters, digits, `_` and `-`, starting with a letter */
+declare function checkPurpose(purpose: string): void;
+
+/**
+ * The tables of « privacy », in their own Postgres schema (ADR-001 §3). They reference no product table: a subject is a kind and an
+ * id the product chooses (an account, a client file, an application).
+ *
+ * - `consent` is WRITTEN ONCE: a trigger refuses any update. A withdrawal is a new row; the consent with the last word (highest `seq`) wins.
+ * - `request` is the record of an export or an erasure: when, of what kind, how it ended. It holds an id and no other personal data,
+ *   so it can outlive the erasure it proves.
+ *
+ * Version 1 is frozen once released: a change is version 2.
+ */
+declare const privacySchema: _krizaka_db.ModuleSchema;
+
+export { AuditPort, type AuditTrail, ConsentInput, ConsentRecord, ExportDocument, OutboxPort, type Privacy, PrivacyContributor, type PrivacyDeps, PrivacyRequest, PrivacyStore, Subject, type Transaction, auditContributor, checkPurpose, checkSubject, createPrivacy, dbPrivacyStore, memoryPrivacyStore, privacySchema };

package/dist/index.js

@@ -0,0 +1,280 @@
+import {
+  PRIVACY_CODE,
+  PrivacyError,
+  REQUEST_KIND,
+  REQUEST_STATUS,
+  checkPurpose,
+  checkSubject
+} from "./chunk-PMXEX2LW.js";
+
+// src/contributors.ts
+function auditContributor(audit, options = {}) {
+  const kind = options.kind ?? "account";
+  return {
+    name: "audit",
+    async exportFor(query, subject) {
+      return subject.kind === kind ? audit.exportFor(query, subject.id) : [];
+    },
+    async eraseFor(tx, subject) {
+      if (subject.kind === kind) await audit.redactActor(tx, subject.id);
+    }
+  };
+}
+
+// src/memory.ts
+var sameSubject = (a, b) => a.kind === b.kind && a.id === b.id;
+function memoryPrivacyStore() {
+  const consents = [];
+  const requests = /* @__PURE__ */ new Map();
+  return {
+    async insertConsent(c) {
+      consents.push(structuredClone(c));
+    },
+    async latestConsent(subject, purpose) {
+      const found = consents.filter((c) => sameSubject(c.subject, subject) && c.purpose === purpose).at(-1);
+      return found ? structuredClone(found) : null;
+    },
+    async consentHistory(subject) {
+      return consents.filter((c) => sameSubject(c.subject, subject)).map((c) => structuredClone(c));
+    },
+    async insertRequest(r) {
+      requests.set(r.id, structuredClone(r));
+    },
+    async getRequest(id) {
+      const found = requests.get(id);
+      return found ? structuredClone(found) : null;
+    },
+    async finishRequest(id, outcome) {
+      const found = requests.get(id);
+      if (found) Object.assign(found, { status: outcome.status, completedAt: outcome.at, failure: outcome.failure ?? null });
+    },
+    async requestsOf(subject) {
+      return [...requests.values()].filter((r) => sameSubject(r.subject, subject)).sort((a, b) => b.requestedAt.valueOf() - a.requestedAt.valueOf()).map((r) => structuredClone(r));
+    }
+  };
+}
+
+// src/persistence.ts
+import { ident } from "@krizaka/db";
+var toConsent = (r) => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, purpose: r.purpose, version: r.version, granted: r.granted, means: r.means, at: new Date(r.at) });
+var toRequest = (r) => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, kind: r.kind, status: r.status, requestedAt: new Date(r.requested_at), completedAt: r.completed_at === null ? null : new Date(r.completed_at), failure: r.failure });
+var CONSENT_COLUMNS = "id, subject_kind, subject_id, purpose, version, granted, means, at";
+var REQUEST_COLUMNS = "id, subject_kind, subject_id, kind, status, requested_at, completed_at, failure";
+function dbPrivacyStore(query, schema = "privacy") {
+  const consent = `${ident(schema)}.consent`;
+  const request = `${ident(schema)}.request`;
+  const same = (subject) => [subject.kind, subject.id];
+  return {
+    async insertConsent(c) {
+      await query(`INSERT INTO ${consent} (id, subject_kind, subject_id, purpose, version, granted, means, at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [c.id, c.subject.kind, c.subject.id, c.purpose, c.version, c.granted, c.means, c.at]);
+    },
+    async latestConsent(subject, purpose) {
+      const [row] = await query(`SELECT ${CONSENT_COLUMNS} FROM ${consent} WHERE subject_kind = $1 AND subject_id = $2 AND purpose = $3 ORDER BY seq DESC LIMIT 1`, [...same(subject), purpose]);
+      return row ? toConsent(row) : null;
+    },
+    async consentHistory(subject) {
+      return (await query(`SELECT ${CONSENT_COLUMNS} FROM ${consent} WHERE subject_kind = $1 AND subject_id = $2 ORDER BY seq`, same(subject))).map(toConsent);
+    },
+    async insertRequest(r) {
+      await query(`INSERT INTO ${request} (id, subject_kind, subject_id, kind, status, requested_at, completed_at, failure) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [r.id, r.subject.kind, r.subject.id, r.kind, r.status, r.requestedAt, r.completedAt, r.failure]);
+    },
+    async getRequest(id) {
+      const [row] = await query(`SELECT ${REQUEST_COLUMNS} FROM ${request} WHERE id = $1`, [id]);
+      return row ? toRequest(row) : null;
+    },
+    async finishRequest(id, outcome) {
+      await query(`UPDATE ${request} SET status = $2, completed_at = $3, failure = $4 WHERE id = $1`, [id, outcome.status, outcome.at, outcome.failure ?? null]);
+    },
+    async requestsOf(subject) {
+      return (await query(`SELECT ${REQUEST_COLUMNS} FROM ${request} WHERE subject_kind = $1 AND subject_id = $2 ORDER BY requested_at DESC, id`, same(subject))).map(toRequest);
+    }
+  };
+}
+
+// src/privacy.ts
+import { randomUUID } from "crypto";
+import { ident as ident2 } from "@krizaka/db";
+import { subHours } from "@krizaka/time";
+var FAILURE_CODE = "CONTRIBUTOR_FAILED";
+var ERASURE_VERSION = "erasure";
+function createPrivacy(deps) {
+  const schema = ident2(deps.schema ?? "privacy");
+  const storeFor = deps.storeFor ?? ((query) => dbPrivacyStore(query, schema));
+  for (const purpose of deps.purposes) checkPurpose(purpose);
+  const names = deps.contributors.map((c) => c.name);
+  if (new Set(names).size !== names.length) throw new PrivacyError(PRIVACY_CODE.contributorFailed, `two contributors have the same name: ${names.join(", ")}`);
+  const known = new Set(deps.purposes);
+  async function assemble(query, subject) {
+    const modules = {};
+    for (const contributor of deps.contributors) {
+      try {
+        modules[contributor.name] = await contributor.exportFor(query, subject);
+      } catch (cause) {
+        throw new PrivacyError(PRIVACY_CODE.contributorFailed, `the export of \xAB ${contributor.name} \xBB failed`, { cause });
+      }
+    }
+    return { format: 1, subject, generatedAt: deps.clock.now().toISOString(), modules };
+  }
+  const newRequest = (subject, kind) => ({ id: randomUUID(), subject, kind, status: REQUEST_STATUS.requested, requestedAt: deps.clock.now(), completedAt: null, failure: null });
+  async function recordConsent(query, input) {
+    checkSubject(input.subject);
+    checkPurpose(input.purpose);
+    if (!known.has(input.purpose)) throw new PrivacyError(PRIVACY_CODE.badPurpose, `purpose \xAB ${input.purpose} \xBB is not one the product declared`);
+    if (input.version.length < 1 || input.version.length > 100) throw new PrivacyError(PRIVACY_CODE.badConsent, "the notice version is 1 to 100 characters");
+    const record = { id: randomUUID(), subject: input.subject, purpose: input.purpose, version: input.version, granted: input.granted, means: input.means ?? null, at: deps.clock.now() };
+    await storeFor(query).insertConsent(record);
+    return record;
+  }
+  return {
+    recordConsent,
+    async hasConsent(query, subject, purpose) {
+      checkSubject(subject);
+      checkPurpose(purpose);
+      return (await storeFor(query).latestConsent(subject, purpose))?.granted === true;
+    },
+    async consentHistory(query, subject) {
+      checkSubject(subject);
+      return storeFor(query).consentHistory(subject);
+    },
+    async exportSubject(query, subject) {
+      checkSubject(subject);
+      const store = storeFor(query);
+      const request = newRequest(subject, REQUEST_KIND.export);
+      await store.insertRequest(request);
+      try {
+        const document = await assemble(query, subject);
+        await store.finishRequest(request.id, { status: REQUEST_STATUS.completed, at: deps.clock.now() });
+        return document;
+      } catch (error) {
+        await store.finishRequest(request.id, { status: REQUEST_STATUS.failed, at: deps.clock.now(), failure: FAILURE_CODE });
+        throw error;
+      }
+    },
+    async requestExport(tx, subject) {
+      checkSubject(subject);
+      if (!deps.outbox) throw new PrivacyError(PRIVACY_CODE.noOutbox, "an asynchronous export needs the outbox");
+      const request = newRequest(subject, REQUEST_KIND.export);
+      await storeFor(tx).insertRequest(request);
+      await deps.outbox.append(tx, { topic: "privacy", type: "evt.privacy.export_requested.v1", payload: { requestId: request.id }, id: request.id });
+      return { requestId: request.id };
+    },
+    async fulfilExport(query, requestId, deliver) {
+      const store = storeFor(query);
+      const request = await store.getRequest(requestId);
+      if (!request) throw new PrivacyError(PRIVACY_CODE.unknownRequest, `no request ${requestId}`);
+      if (request.kind !== REQUEST_KIND.export) throw new PrivacyError(PRIVACY_CODE.notAnExport, `request ${requestId} is not an export`);
+      if (request.status === REQUEST_STATUS.completed) throw new PrivacyError(PRIVACY_CODE.alreadyDone, `request ${requestId} is already completed`);
+      try {
+        await deliver(await assemble(query, request.subject), request);
+      } catch (error) {
+        await store.finishRequest(requestId, { status: REQUEST_STATUS.failed, at: deps.clock.now(), failure: FAILURE_CODE });
+        throw error;
+      }
+      await store.finishRequest(requestId, { status: REQUEST_STATUS.completed, at: deps.clock.now() });
+    },
+    async eraseSubject(subject, options = {}) {
+      checkSubject(subject);
+      const request = newRequest(subject, REQUEST_KIND.erasure);
+      try {
+        return await deps.transaction(async (tx) => {
+          const store = storeFor(tx);
+          await store.insertRequest(request);
+          for (const contributor of deps.contributors) {
+            try {
+              await contributor.eraseFor(tx, subject);
+            } catch (cause) {
+              throw new PrivacyError(PRIVACY_CODE.contributorFailed, `the erasure of \xAB ${contributor.name} \xBB failed`, { cause });
+            }
+          }
+          for (const purpose of deps.purposes) {
+            if ((await store.latestConsent(subject, purpose))?.granted) await recordConsent(tx, { subject, purpose, version: options.noticeVersion ?? ERASURE_VERSION, granted: false, means: ERASURE_VERSION });
+          }
+          const completedAt = deps.clock.now();
+          await store.finishRequest(request.id, { status: REQUEST_STATUS.completed, at: completedAt });
+          await deps.audit?.record(tx, { actorId: null, actorLabel: "privacy", action: "privacy.erasure_completed", target: { type: "privacy_request", id: request.id }, detail: { contributors: names } });
+          return { ...request, status: REQUEST_STATUS.completed, completedAt };
+        });
+      } catch (error) {
+        try {
+          await deps.transaction((tx) => storeFor(tx).insertRequest({ ...request, status: REQUEST_STATUS.failed, completedAt: deps.clock.now(), failure: FAILURE_CODE }));
+        } catch (recordFailure) {
+          throw new AggregateError([error, recordFailure], "the erasure failed, and so did recording its failure", { cause: recordFailure });
+        }
+        throw error;
+      }
+    },
+    async purge(query) {
+      const removed = {};
+      for (const purpose of deps.purposes) {
+        const days = await deps.retentionDays?.(purpose);
+        if (days === void 0) continue;
+        if (!Number.isInteger(days) || days < 1) throw new RangeError(`the retention of \xAB ${purpose} \xBB must be a whole number of days from 1, got ${days}`);
+        const before = subHours(deps.clock.now(), days * 24);
+        let total = 0;
+        for (const contributor of deps.contributors) total += await contributor.purgeExpired?.(query, { purpose, before }) ?? 0;
+        removed[purpose] = total;
+      }
+      return removed;
+    },
+    async requests(query, subject) {
+      checkSubject(subject);
+      return storeFor(query).requestsOf(subject);
+    }
+  };
+}
+
+// src/schema.ts
+import { defineModule } from "@krizaka/db";
+var privacySchema = defineModule({
+  module: "privacy",
+  migrations: [
+    {
+      version: 1,
+      name: "consents and requests",
+      sql: (c) => `
+CREATE TABLE ${c.schema}.consent (
+  seq          bigserial UNIQUE,
+  id           uuid PRIMARY KEY,
+  subject_kind text NOT NULL CHECK (subject_kind ~ '^[a-z][a-z0-9_]{0,39}$'),
+  subject_id   text NOT NULL CHECK (char_length(subject_id) BETWEEN 1 AND 200),
+  purpose      text NOT NULL CHECK (purpose ~ '^[a-z][a-z0-9_-]{0,39}$'),
+  version      text NOT NULL CHECK (char_length(version) BETWEEN 1 AND 100),
+  granted      boolean NOT NULL,
+  means        text CHECK (means IS NULL OR char_length(means) <= 40),
+  at           timestamptz NOT NULL
+);
+CREATE INDEX consent_subject ON ${c.schema}.consent (subject_kind, subject_id, purpose, seq DESC);
+CREATE FUNCTION ${c.schema}.consent_written_once() RETURNS trigger LANGUAGE plpgsql AS $fn$
+BEGIN
+  RAISE EXCEPTION 'a consent is written once: a withdrawal is a new row' USING ERRCODE = 'restrict_violation';
+END;
+$fn$;
+CREATE TRIGGER consent_written_once BEFORE UPDATE ON ${c.schema}.consent FOR EACH ROW EXECUTE FUNCTION ${c.schema}.consent_written_once();
+CREATE TABLE ${c.schema}.request (
+  id           uuid PRIMARY KEY,
+  subject_kind text NOT NULL CHECK (subject_kind ~ '^[a-z][a-z0-9_]{0,39}$'),
+  subject_id   text NOT NULL CHECK (char_length(subject_id) BETWEEN 1 AND 200),
+  kind         text NOT NULL CHECK (kind IN ('export', 'erasure')),
+  status       text NOT NULL CHECK (status IN ('requested', 'completed', 'failed')),
+  requested_at timestamptz NOT NULL,
+  completed_at timestamptz,
+  failure      text CHECK (failure IS NULL OR char_length(failure) <= 100)
+);
+CREATE INDEX request_subject ON ${c.schema}.request (subject_kind, subject_id, requested_at DESC);`
+    }
+  ]
+});
+export {
+  PRIVACY_CODE,
+  PrivacyError,
+  REQUEST_KIND,
+  REQUEST_STATUS,
+  auditContributor,
+  checkPurpose,
+  checkSubject,
+  createPrivacy,
+  dbPrivacyStore,
+  memoryPrivacyStore,
+  privacySchema
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contributors.ts","../src/memory.ts","../src/persistence.ts","../src/privacy.ts","../src/schema.ts"],"sourcesContent":["import type { Query } from \"@krizaka/db\";\n\nimport type { PrivacyContributor } from \"./port\";\n\n/** The structural slice of `@krizaka/audit` that contributes: what the trail holds about an actor, and detaching them from it. */\nexport interface AuditTrail {\n  exportFor(query: Query, actorId: string): Promise<unknown>;\n  redactActor(query: Query, actorId: string): Promise<number>;\n}\n\n/**\n * `@krizaka/audit` as a contributor: an export lists the actor's entries; an erasure detaches the person (id and address removed, the\n * label « erased ») and keeps the facts. It applies to a subject of the kind the product's actors are (default `account`).\n * @param audit the product's audit (`createAudit(...)`)\n */\nexport function auditContributor(audit: AuditTrail, options: { kind?: string } = {}): PrivacyContributor {\n  const kind = options.kind ?? \"account\";\n  return {\n    name: \"audit\",\n    async exportFor(query, subject) {\n      return subject.kind === kind ? audit.exportFor(query, subject.id) : [];\n    },\n    async eraseFor(tx, subject) {\n      if (subject.kind === kind) await audit.redactActor(tx, subject.id);\n    },\n  };\n}\n","import type { ConsentRecord, PrivacyRequest, PrivacyStore, Subject } from \"./port\";\n\nconst sameSubject = (a: Subject, b: Subject) => a.kind === b.kind && a.id === b.id;\n\n/** An in-memory store, for unit tests and demos (the same behaviour as the database's: the contract kit runs on both). */\nexport function memoryPrivacyStore(): PrivacyStore {\n  const consents: ConsentRecord[] = [];\n  const requests = new Map<string, PrivacyRequest>();\n  return {\n    async insertConsent(c) {\n      consents.push(structuredClone(c));\n    },\n    async latestConsent(subject, purpose) {\n      const found = consents.filter((c) => sameSubject(c.subject, subject) && c.purpose === purpose).at(-1);\n      return found ? structuredClone(found) : null;\n    },\n    async consentHistory(subject) {\n      return consents.filter((c) => sameSubject(c.subject, subject)).map((c) => structuredClone(c));\n    },\n    async insertRequest(r) {\n      requests.set(r.id, structuredClone(r));\n    },\n    async getRequest(id) {\n      const found = requests.get(id);\n      return found ? structuredClone(found) : null;\n    },\n    async finishRequest(id, outcome) {\n      const found = requests.get(id);\n      if (found) Object.assign(found, { status: outcome.status, completedAt: outcome.at, failure: outcome.failure ?? null });\n    },\n    async requestsOf(subject) {\n      return [...requests.values()].filter((r) => sameSubject(r.subject, subject)).sort((a, b) => b.requestedAt.valueOf() - a.requestedAt.valueOf()).map((r) => structuredClone(r));\n    },\n  };\n}\n","import { ident, type Query } from \"@krizaka/db\";\n\nimport type { ConsentRecord, PrivacyRequest, PrivacyStore, RequestKind, RequestStatus, Subject } from \"./port\";\n\ninterface ConsentRow {\n  id: string;\n  subject_kind: string;\n  subject_id: string;\n  purpose: string;\n  version: string;\n  granted: boolean;\n  means: string | null;\n  at: Date | string;\n}\ninterface RequestRow {\n  id: string;\n  subject_kind: string;\n  subject_id: string;\n  kind: RequestKind;\n  status: RequestStatus;\n  requested_at: Date | string;\n  completed_at: Date | string | null;\n  failure: string | null;\n}\n\nconst toConsent = (r: ConsentRow): ConsentRecord => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, purpose: r.purpose, version: r.version, granted: r.granted, means: r.means, at: new Date(r.at) });\nconst toRequest = (r: RequestRow): PrivacyRequest => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, kind: r.kind, status: r.status, requestedAt: new Date(r.requested_at), completedAt: r.completed_at === null ? null : new Date(r.completed_at), failure: r.failure });\n\nconst CONSENT_COLUMNS = \"id, subject_kind, subject_id, purpose, version, granted, means, at\";\nconst REQUEST_COLUMNS = \"id, subject_kind, subject_id, kind, status, requested_at, completed_at, failure\";\n\n/**\n * The PostgreSQL store of « privacy », over the `Query` it is given (the caller's transaction, to join its unit of work).\n * @param schema the Postgres schema of the module, default `privacy`\n */\nexport function dbPrivacyStore(query: Query, schema = \"privacy\"): PrivacyStore {\n  const consent = `${ident(schema)}.consent`;\n  const request = `${ident(schema)}.request`;\n  const same = (subject: Subject) => [subject.kind, subject.id];\n  return {\n    async insertConsent(c) {\n      await query(`INSERT INTO ${consent} (id, subject_kind, subject_id, purpose, version, granted, means, at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [c.id, c.subject.kind, c.subject.id, c.purpose, c.version, c.granted, c.means, c.at]);\n    },\n    async latestConsent(subject, purpose) {\n      const [row] = await query<ConsentRow>(`SELECT ${CONSENT_COLUMNS} FROM ${consent} WHERE subject_kind = $1 AND subject_id = $2 AND purpose = $3 ORDER BY seq DESC LIMIT 1`, [...same(subject), purpose]);\n      return row ? toConsent(row) : null;\n    },\n    async consentHistory(subject) {\n      return (await query<ConsentRow>(`SELECT ${CONSENT_COLUMNS} FROM ${consent} WHERE subject_kind = $1 AND subject_id = $2 ORDER BY seq`, same(subject))).map(toConsent);\n    },\n    async insertRequest(r) {\n      await query(`INSERT INTO ${request} (id, subject_kind, subject_id, kind, status, requested_at, completed_at, failure) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [r.id, r.subject.kind, r.subject.id, r.kind, r.status, r.requestedAt, r.completedAt, r.failure]);\n    },\n    async getRequest(id) {\n      const [row] = await query<RequestRow>(`SELECT ${REQUEST_COLUMNS} FROM ${request} WHERE id = $1`, [id]);\n      return row ? toRequest(row) : null;\n    },\n    async finishRequest(id, outcome) {\n      await query(`UPDATE ${request} SET status = $2, completed_at = $3, failure = $4 WHERE id = $1`, [id, outcome.status, outcome.at, outcome.failure ?? null]);\n    },\n    async requestsOf(subject) {\n      return (await query<RequestRow>(`SELECT ${REQUEST_COLUMNS} FROM ${request} WHERE subject_kind = $1 AND subject_id = $2 ORDER BY requested_at DESC, id`, same(subject))).map(toRequest);\n    },\n  };\n}\n","import { randomUUID } from \"node:crypto\";\n\nimport { ident } from \"@krizaka/db\";\nimport { subHours } from \"@krizaka/time\";\n\nimport { dbPrivacyStore } from \"./persistence\";\nimport {\n  type AuditPort,\n  type Clock,\n  type ConsentInput,\n  type ConsentRecord,\n  type ExportDocument,\n  type OutboxPort,\n  PRIVACY_CODE,\n  type PrivacyContributor,\n  PrivacyError,\n  type PrivacyRequest,\n  type PrivacyStore,\n  type Query,\n  REQUEST_KIND,\n  REQUEST_STATUS,\n  type Subject,\n} from \"./port\";\nimport { checkPurpose, checkSubject } from \"./rules\";\n\n/** The product's unit of work: runs `work` on one connection, commits when it resolves, rolls back when it throws (`transaction` of `@krizaka/db`). */\nexport type Transaction = <T>(work: (tx: Query) => Promise<T>) => Promise<T>;\n\nexport interface PrivacyDeps {\n  clock: Clock;\n  /** Every module that holds personal data, and the product's own. Their names are the keys of the export. */\n  contributors: readonly PrivacyContributor[];\n  /** The purposes the product declares (`screening`, `marketing`). A consent for another is refused. */\n  purposes: readonly string[];\n  /** The product's transaction, for the erasure. */\n  transaction: Transaction;\n  /** How many days a purpose is kept: the settings `privacy.retention.<purpose>Days` (`retentionFromSettings`). `undefined` = no retention for it. */\n  retentionDays?: (purpose: string) => number | undefined | Promise<number | undefined>;\n  /** The audit trail: an erasure is recorded there without personal data. */\n  audit?: AuditPort;\n  /** The outbox: required for the asynchronous export of a large account (`requestExport`). */\n  outbox?: OutboxPort;\n  /** The store over a query. Default: the PostgreSQL store on schema `privacy`. */\n  storeFor?: (query: Query) => PrivacyStore;\n  /** The Postgres schema, when the product renamed the module's (used by the default store). */\n  schema?: string;\n}\n\nexport interface Privacy {\n  /** Writes a consent or a withdrawal. Never edits one. */\n  recordConsent(query: Query, input: ConsentInput): Promise<ConsentRecord>;\n  /** Whether the consent with the last word for this purpose is a yes. A person who never said anything has not consented. */\n  hasConsent(query: Query, subject: Subject, purpose: string): Promise<boolean>;\n  /** Every consent and withdrawal of the subject, oldest first. */\n  consentHistory(query: Query, subject: Subject): Promise<ConsentRecord[]>;\n  /** The export, at once: one document with a part per contributor. The request is recorded. */\n  exportSubject(query: Query, subject: Subject): Promise<ExportDocument>;\n  /**\n   * The export of a large account, asynchronously: records the request and appends a message to the outbox IN THE CALLER'S\n   * TRANSACTION (`tx`). A worker then calls `fulfilExport(requestId, deliver)`. The message holds the request id only.\n   */\n  requestExport(tx: Query, subject: Subject): Promise<{ requestId: string }>;\n  /** Assembles the export of a recorded request and hands it to `deliver` (store the file, mail a link); the request is completed after `deliver` returns. */\n  fulfilExport(query: Query, requestId: string, deliver: (document: ExportDocument, request: PrivacyRequest) => Promise<void>): Promise<void>;\n  /**\n   * Erases the subject from every contributor in ONE transaction, withdraws their live consents, and records the request and an\n   * audit entry that names no one. If a contributor fails nothing is erased, the request is recorded as failed, and the error is thrown.\n   */\n  eraseSubject(subject: Subject, options?: { noticeVersion?: string }): Promise<PrivacyRequest>;\n  /** Removes, for each purpose with a retention, what the contributors hold past it. Returns how many rows each purpose removed. */\n  purge(query: Query): Promise<Record<string, number>>;\n  /** The subject's requests, newest first. */\n  requests(query: Query, subject: Subject): Promise<PrivacyRequest[]>;\n}\n\nconst FAILURE_CODE = \"CONTRIBUTOR_FAILED\";\nconst ERASURE_VERSION = \"erasure\";\n\n/**\n * Privacy for a product (Loi 25).\n * @param deps the contributors, the purposes, the product's transaction and the clock\n * @throws PrivacyError for a purpose or a contributor name that is not well formed or appears twice\n */\nexport function createPrivacy(deps: PrivacyDeps): Privacy {\n  const schema = ident(deps.schema ?? \"privacy\");\n  const storeFor = deps.storeFor ?? ((query: Query) => dbPrivacyStore(query, schema));\n  for (const purpose of deps.purposes) checkPurpose(purpose);\n  const names = deps.contributors.map((c) => c.name);\n  if (new Set(names).size !== names.length) throw new PrivacyError(PRIVACY_CODE.contributorFailed, `two contributors have the same name: ${names.join(\", \")}`);\n  const known = new Set(deps.purposes);\n\n  async function assemble(query: Query, subject: Subject): Promise<ExportDocument> {\n    const modules: Record<string, unknown> = {};\n    for (const contributor of deps.contributors) {\n      try {\n        modules[contributor.name] = await contributor.exportFor(query, subject);\n      } catch (cause) {\n        throw new PrivacyError(PRIVACY_CODE.contributorFailed, `the export of « ${contributor.name} » failed`, { cause });\n      }\n    }\n    return { format: 1, subject, generatedAt: deps.clock.now().toISOString(), modules };\n  }\n\n  const newRequest = (subject: Subject, kind: PrivacyRequest[\"kind\"]): PrivacyRequest => ({ id: randomUUID(), subject, kind, status: REQUEST_STATUS.requested, requestedAt: deps.clock.now(), completedAt: null, failure: null });\n\n  async function recordConsent(query: Query, input: ConsentInput): Promise<ConsentRecord> {\n    checkSubject(input.subject);\n    checkPurpose(input.purpose);\n    if (!known.has(input.purpose)) throw new PrivacyError(PRIVACY_CODE.badPurpose, `purpose « ${input.purpose} » is not one the product declared`);\n    if (input.version.length < 1 || input.version.length > 100) throw new PrivacyError(PRIVACY_CODE.badConsent, \"the notice version is 1 to 100 characters\");\n    const record: ConsentRecord = { id: randomUUID(), subject: input.subject, purpose: input.purpose, version: input.version, granted: input.granted, means: input.means ?? null, at: deps.clock.now() };\n    await storeFor(query).insertConsent(record);\n    return record;\n  }\n\n  return {\n    recordConsent,\n    async hasConsent(query, subject, purpose) {\n      checkSubject(subject);\n      checkPurpose(purpose);\n      return (await storeFor(query).latestConsent(subject, purpose))?.granted === true;\n    },\n    async consentHistory(query, subject) {\n      checkSubject(subject);\n      return storeFor(query).consentHistory(subject);\n    },\n    async exportSubject(query, subject) {\n      checkSubject(subject);\n      const store = storeFor(query);\n      const request = newRequest(subject, REQUEST_KIND.export);\n      await store.insertRequest(request);\n      try {\n        const document = await assemble(query, subject);\n        await store.finishRequest(request.id, { status: REQUEST_STATUS.completed, at: deps.clock.now() });\n        return document;\n      } catch (error) {\n        await store.finishRequest(request.id, { status: REQUEST_STATUS.failed, at: deps.clock.now(), failure: FAILURE_CODE });\n        throw error;\n      }\n    },\n    async requestExport(tx, subject) {\n      checkSubject(subject);\n      if (!deps.outbox) throw new PrivacyError(PRIVACY_CODE.noOutbox, \"an asynchronous export needs the outbox\");\n      const request = newRequest(subject, REQUEST_KIND.export);\n      await storeFor(tx).insertRequest(request);\n      await deps.outbox.append(tx, { topic: \"privacy\", type: \"evt.privacy.export_requested.v1\", payload: { requestId: request.id }, id: request.id });\n      return { requestId: request.id };\n    },\n    async fulfilExport(query, requestId, deliver) {\n      const store = storeFor(query);\n      const request = await store.getRequest(requestId);\n      if (!request) throw new PrivacyError(PRIVACY_CODE.unknownRequest, `no request ${requestId}`);\n      if (request.kind !== REQUEST_KIND.export) throw new PrivacyError(PRIVACY_CODE.notAnExport, `request ${requestId} is not an export`);\n      if (request.status === REQUEST_STATUS.completed) throw new PrivacyError(PRIVACY_CODE.alreadyDone, `request ${requestId} is already completed`);\n      try {\n        await deliver(await assemble(query, request.subject), request);\n      } catch (error) {\n        await store.finishRequest(requestId, { status: REQUEST_STATUS.failed, at: deps.clock.now(), failure: FAILURE_CODE });\n        throw error;\n      }\n      await store.finishRequest(requestId, { status: REQUEST_STATUS.completed, at: deps.clock.now() });\n    },\n    async eraseSubject(subject, options = {}) {\n      checkSubject(subject);\n      const request = newRequest(subject, REQUEST_KIND.erasure);\n      try {\n        return await deps.transaction(async (tx) => {\n          const store = storeFor(tx);\n          await store.insertRequest(request);\n          for (const contributor of deps.contributors) {\n            try {\n              await contributor.eraseFor(tx, subject);\n            } catch (cause) {\n              throw new PrivacyError(PRIVACY_CODE.contributorFailed, `the erasure of « ${contributor.name} » failed`, { cause });\n            }\n          }\n          for (const purpose of deps.purposes) {\n            if ((await store.latestConsent(subject, purpose))?.granted) await recordConsent(tx, { subject, purpose, version: options.noticeVersion ?? ERASURE_VERSION, granted: false, means: ERASURE_VERSION });\n          }\n          const completedAt = deps.clock.now();\n          await store.finishRequest(request.id, { status: REQUEST_STATUS.completed, at: completedAt });\n          // the entry names the request and the modules, never the person\n          await deps.audit?.record(tx, { actorId: null, actorLabel: \"privacy\", action: \"privacy.erasure_completed\", target: { type: \"privacy_request\", id: request.id }, detail: { contributors: names } });\n          return { ...request, status: REQUEST_STATUS.completed, completedAt };\n        });\n      } catch (error) {\n        // the transaction rolled back, request row included: record the failure beside it, and never mask the original error\n        try {\n          await deps.transaction((tx) => storeFor(tx).insertRequest({ ...request, status: REQUEST_STATUS.failed, completedAt: deps.clock.now(), failure: FAILURE_CODE }));\n        } catch (recordFailure) {\n          throw new AggregateError([error, recordFailure], \"the erasure failed, and so did recording its failure\", { cause: recordFailure });\n        }\n        throw error;\n      }\n    },\n    async purge(query) {\n      const removed: Record<string, number> = {};\n      for (const purpose of deps.purposes) {\n        const days = await deps.retentionDays?.(purpose);\n        if (days === undefined) continue;\n        if (!Number.isInteger(days) || days < 1) throw new RangeError(`the retention of « ${purpose} » must be a whole number of days from 1, got ${days}`);\n        const before = subHours(deps.clock.now(), days * 24);\n        let total = 0;\n        for (const contributor of deps.contributors) total += (await contributor.purgeExpired?.(query, { purpose, before })) ?? 0;\n        removed[purpose] = total;\n      }\n      return removed;\n    },\n    async requests(query, subject) {\n      checkSubject(subject);\n      return storeFor(query).requestsOf(subject);\n    },\n  };\n}\n","import { defineModule } from \"@krizaka/db\";\n\n/**\n * The tables of « privacy », in their own Postgres schema (ADR-001 §3). They reference no product table: a subject is a kind and an\n * id the product chooses (an account, a client file, an application).\n *\n * - `consent` is WRITTEN ONCE: a trigger refuses any update. A withdrawal is a new row; the consent with the last word (highest `seq`) wins.\n * - `request` is the record of an export or an erasure: when, of what kind, how it ended. It holds an id and no other personal data,\n *   so it can outlive the erasure it proves.\n *\n * Version 1 is frozen once released: a change is version 2.\n */\nexport const privacySchema = defineModule({\n  module: \"privacy\",\n  migrations: [\n    {\n      version: 1,\n      name: \"consents and requests\",\n      sql: (c) => `\nCREATE TABLE ${c.schema}.consent (\n  seq          bigserial UNIQUE,\n  id           uuid PRIMARY KEY,\n  subject_kind text NOT NULL CHECK (subject_kind ~ '^[a-z][a-z0-9_]{0,39}$'),\n  subject_id   text NOT NULL CHECK (char_length(subject_id) BETWEEN 1 AND 200),\n  purpose      text NOT NULL CHECK (purpose ~ '^[a-z][a-z0-9_-]{0,39}$'),\n  version      text NOT NULL CHECK (char_length(version) BETWEEN 1 AND 100),\n  granted      boolean NOT NULL,\n  means        text CHECK (means IS NULL OR char_length(means) <= 40),\n  at           timestamptz NOT NULL\n);\nCREATE INDEX consent_subject ON ${c.schema}.consent (subject_kind, subject_id, purpose, seq DESC);\nCREATE FUNCTION ${c.schema}.consent_written_once() RETURNS trigger LANGUAGE plpgsql AS $fn$\nBEGIN\n  RAISE EXCEPTION 'a consent is written once: a withdrawal is a new row' USING ERRCODE = 'restrict_violation';\nEND;\n$fn$;\nCREATE TRIGGER consent_written_once BEFORE UPDATE ON ${c.schema}.consent FOR EACH ROW EXECUTE FUNCTION ${c.schema}.consent_written_once();\nCREATE TABLE ${c.schema}.request (\n  id           uuid PRIMARY KEY,\n  subject_kind text NOT NULL CHECK (subject_kind ~ '^[a-z][a-z0-9_]{0,39}$'),\n  subject_id   text NOT NULL CHECK (char_length(subject_id) BETWEEN 1 AND 200),\n  kind         text NOT NULL CHECK (kind IN ('export', 'erasure')),\n  status       text NOT NULL CHECK (status IN ('requested', 'completed', 'failed')),\n  requested_at timestamptz NOT NULL,\n  completed_at timestamptz,\n  failure      text CHECK (failure IS NULL OR char_length(failure) <= 100)\n);\nCREATE INDEX request_subject ON ${c.schema}.request (subject_kind, subject_id, requested_at DESC);`,\n    },\n  ],\n});\n"],"mappings":";;;;;;;;;;AAeO,SAAS,iBAAiB,OAAmB,UAA6B,CAAC,GAAuB;AACvG,QAAM,OAAO,QAAQ,QAAQ;AAC7B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,UAAU,OAAO,SAAS;AAC9B,aAAO,QAAQ,SAAS,OAAO,MAAM,UAAU,OAAO,QAAQ,EAAE,IAAI,CAAC;AAAA,IACvE;AAAA,IACA,MAAM,SAAS,IAAI,SAAS;AAC1B,UAAI,QAAQ,SAAS,KAAM,OAAM,MAAM,YAAY,IAAI,QAAQ,EAAE;AAAA,IACnE;AAAA,EACF;AACF;;;ACxBA,IAAM,cAAc,CAAC,GAAY,MAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;AAGzE,SAAS,qBAAmC;AACjD,QAAM,WAA4B,CAAC;AACnC,QAAM,WAAW,oBAAI,IAA4B;AACjD,SAAO;AAAA,IACL,MAAM,cAAc,GAAG;AACrB,eAAS,KAAK,gBAAgB,CAAC,CAAC;AAAA,IAClC;AAAA,IACA,MAAM,cAAc,SAAS,SAAS;AACpC,YAAM,QAAQ,SAAS,OAAO,CAAC,MAAM,YAAY,EAAE,SAAS,OAAO,KAAK,EAAE,YAAY,OAAO,EAAE,GAAG,EAAE;AACpG,aAAO,QAAQ,gBAAgB,KAAK,IAAI;AAAA,IAC1C;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,aAAO,SAAS,OAAO,CAAC,MAAM,YAAY,EAAE,SAAS,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAAA,IAC9F;AAAA,IACA,MAAM,cAAc,GAAG;AACrB,eAAS,IAAI,EAAE,IAAI,gBAAgB,CAAC,CAAC;AAAA,IACvC;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,QAAQ,SAAS,IAAI,EAAE;AAC7B,aAAO,QAAQ,gBAAgB,KAAK,IAAI;AAAA,IAC1C;AAAA,IACA,MAAM,cAAc,IAAI,SAAS;AAC/B,YAAM,QAAQ,SAAS,IAAI,EAAE;AAC7B,UAAI,MAAO,QAAO,OAAO,OAAO,EAAE,QAAQ,QAAQ,QAAQ,aAAa,QAAQ,IAAI,SAAS,QAAQ,WAAW,KAAK,CAAC;AAAA,IACvH;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,aAAO,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,YAAY,EAAE,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,QAAQ,IAAI,EAAE,YAAY,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAAA,IAC9K;AAAA,EACF;AACF;;;AClCA,SAAS,aAAyB;AAyBlC,IAAM,YAAY,CAAC,OAAkC,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,MAAM,EAAE,cAAc,IAAI,EAAE,WAAW,GAAG,SAAS,EAAE,SAAS,SAAS,EAAE,SAAS,SAAS,EAAE,SAAS,OAAO,EAAE,OAAO,IAAI,IAAI,KAAK,EAAE,EAAE,EAAE;AACrN,IAAM,YAAY,CAAC,OAAmC,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,MAAM,EAAE,cAAc,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,aAAa,IAAI,KAAK,EAAE,YAAY,GAAG,aAAa,EAAE,iBAAiB,OAAO,OAAO,IAAI,KAAK,EAAE,YAAY,GAAG,SAAS,EAAE,QAAQ;AAEzR,IAAM,kBAAkB;AACxB,IAAM,kBAAkB;AAMjB,SAAS,eAAe,OAAc,SAAS,WAAyB;AAC7E,QAAM,UAAU,GAAG,MAAM,MAAM,CAAC;AAChC,QAAM,UAAU,GAAG,MAAM,MAAM,CAAC;AAChC,QAAM,OAAO,CAAC,YAAqB,CAAC,QAAQ,MAAM,QAAQ,EAAE;AAC5D,SAAO;AAAA,IACL,MAAM,cAAc,GAAG;AACrB,YAAM,MAAM,eAAe,OAAO,iHAAiH,CAAC,EAAE,IAAI,EAAE,QAAQ,MAAM,EAAE,QAAQ,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;AAAA,IACzO;AAAA,IACA,MAAM,cAAc,SAAS,SAAS;AACpC,YAAM,CAAC,GAAG,IAAI,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,2FAA2F,CAAC,GAAG,KAAK,OAAO,GAAG,OAAO,CAAC;AACrM,aAAO,MAAM,UAAU,GAAG,IAAI;AAAA,IAChC;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,cAAQ,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,6DAA6D,KAAK,OAAO,CAAC,GAAG,IAAI,SAAS;AAAA,IACrK;AAAA,IACA,MAAM,cAAc,GAAG;AACrB,YAAM,MAAM,eAAe,OAAO,8HAA8H,CAAC,EAAE,IAAI,EAAE,QAAQ,MAAM,EAAE,QAAQ,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC;AAAA,IACjQ;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,CAAC,GAAG,IAAI,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,kBAAkB,CAAC,EAAE,CAAC;AACrG,aAAO,MAAM,UAAU,GAAG,IAAI;AAAA,IAChC;AAAA,IACA,MAAM,cAAc,IAAI,SAAS;AAC/B,YAAM,MAAM,UAAU,OAAO,mEAAmE,CAAC,IAAI,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,WAAW,IAAI,CAAC;AAAA,IAC3J;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,cAAQ,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,+EAA+E,KAAK,OAAO,CAAC,GAAG,IAAI,SAAS;AAAA,IACvL;AAAA,EACF;AACF;;;AChEA,SAAS,kBAAkB;AAE3B,SAAS,SAAAA,cAAa;AACtB,SAAS,gBAAgB;AAwEzB,IAAM,eAAe;AACrB,IAAM,kBAAkB;AAOjB,SAAS,cAAc,MAA4B;AACxD,QAAM,SAASC,OAAM,KAAK,UAAU,SAAS;AAC7C,QAAM,WAAW,KAAK,aAAa,CAAC,UAAiB,eAAe,OAAO,MAAM;AACjF,aAAW,WAAW,KAAK,SAAU,cAAa,OAAO;AACzD,QAAM,QAAQ,KAAK,aAAa,IAAI,CAAC,MAAM,EAAE,IAAI;AACjD,MAAI,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,OAAQ,OAAM,IAAI,aAAa,aAAa,mBAAmB,wCAAwC,MAAM,KAAK,IAAI,CAAC,EAAE;AAC3J,QAAM,QAAQ,IAAI,IAAI,KAAK,QAAQ;AAEnC,iBAAe,SAAS,OAAc,SAA2C;AAC/E,UAAM,UAAmC,CAAC;AAC1C,eAAW,eAAe,KAAK,cAAc;AAC3C,UAAI;AACF,gBAAQ,YAAY,IAAI,IAAI,MAAM,YAAY,UAAU,OAAO,OAAO;AAAA,MACxE,SAAS,OAAO;AACd,cAAM,IAAI,aAAa,aAAa,mBAAmB,sBAAmB,YAAY,IAAI,gBAAa,EAAE,MAAM,CAAC;AAAA,MAClH;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,GAAG,SAAS,aAAa,KAAK,MAAM,IAAI,EAAE,YAAY,GAAG,QAAQ;AAAA,EACpF;AAEA,QAAM,aAAa,CAAC,SAAkB,UAAkD,EAAE,IAAI,WAAW,GAAG,SAAS,MAAM,QAAQ,eAAe,WAAW,aAAa,KAAK,MAAM,IAAI,GAAG,aAAa,MAAM,SAAS,KAAK;AAE7N,iBAAe,cAAc,OAAc,OAA6C;AACtF,iBAAa,MAAM,OAAO;AAC1B,iBAAa,MAAM,OAAO;AAC1B,QAAI,CAAC,MAAM,IAAI,MAAM,OAAO,EAAG,OAAM,IAAI,aAAa,aAAa,YAAY,gBAAa,MAAM,OAAO,uCAAoC;AAC7I,QAAI,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,SAAS,IAAK,OAAM,IAAI,aAAa,aAAa,YAAY,2CAA2C;AACvJ,UAAM,SAAwB,EAAE,IAAI,WAAW,GAAG,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,MAAM,SAAS,MAAM,IAAI,KAAK,MAAM,IAAI,EAAE;AACnM,UAAM,SAAS,KAAK,EAAE,cAAc,MAAM;AAC1C,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,WAAW,OAAO,SAAS,SAAS;AACxC,mBAAa,OAAO;AACpB,mBAAa,OAAO;AACpB,cAAQ,MAAM,SAAS,KAAK,EAAE,cAAc,SAAS,OAAO,IAAI,YAAY;AAAA,IAC9E;AAAA,IACA,MAAM,eAAe,OAAO,SAAS;AACnC,mBAAa,OAAO;AACpB,aAAO,SAAS,KAAK,EAAE,eAAe,OAAO;AAAA,IAC/C;AAAA,IACA,MAAM,cAAc,OAAO,SAAS;AAClC,mBAAa,OAAO;AACpB,YAAM,QAAQ,SAAS,KAAK;AAC5B,YAAM,UAAU,WAAW,SAAS,aAAa,MAAM;AACvD,YAAM,MAAM,cAAc,OAAO;AACjC,UAAI;AACF,cAAM,WAAW,MAAM,SAAS,OAAO,OAAO;AAC9C,cAAM,MAAM,cAAc,QAAQ,IAAI,EAAE,QAAQ,eAAe,WAAW,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC;AAChG,eAAO;AAAA,MACT,SAAS,OAAO;AACd,cAAM,MAAM,cAAc,QAAQ,IAAI,EAAE,QAAQ,eAAe,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,aAAa,CAAC;AACpH,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,cAAc,IAAI,SAAS;AAC/B,mBAAa,OAAO;AACpB,UAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,aAAa,aAAa,UAAU,yCAAyC;AACzG,YAAM,UAAU,WAAW,SAAS,aAAa,MAAM;AACvD,YAAM,SAAS,EAAE,EAAE,cAAc,OAAO;AACxC,YAAM,KAAK,OAAO,OAAO,IAAI,EAAE,OAAO,WAAW,MAAM,mCAAmC,SAAS,EAAE,WAAW,QAAQ,GAAG,GAAG,IAAI,QAAQ,GAAG,CAAC;AAC9I,aAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,aAAa,OAAO,WAAW,SAAS;AAC5C,YAAM,QAAQ,SAAS,KAAK;AAC5B,YAAM,UAAU,MAAM,MAAM,WAAW,SAAS;AAChD,UAAI,CAAC,QAAS,OAAM,IAAI,aAAa,aAAa,gBAAgB,cAAc,SAAS,EAAE;AAC3F,UAAI,QAAQ,SAAS,aAAa,OAAQ,OAAM,IAAI,aAAa,aAAa,aAAa,WAAW,SAAS,mBAAmB;AAClI,UAAI,QAAQ,WAAW,eAAe,UAAW,OAAM,IAAI,aAAa,aAAa,aAAa,WAAW,SAAS,uBAAuB;AAC7I,UAAI;AACF,cAAM,QAAQ,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG,OAAO;AAAA,MAC/D,SAAS,OAAO;AACd,cAAM,MAAM,cAAc,WAAW,EAAE,QAAQ,eAAe,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,aAAa,CAAC;AACnH,cAAM;AAAA,MACR;AACA,YAAM,MAAM,cAAc,WAAW,EAAE,QAAQ,eAAe,WAAW,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACjG;AAAA,IACA,MAAM,aAAa,SAAS,UAAU,CAAC,GAAG;AACxC,mBAAa,OAAO;AACpB,YAAM,UAAU,WAAW,SAAS,aAAa,OAAO;AACxD,UAAI;AACF,eAAO,MAAM,KAAK,YAAY,OAAO,OAAO;AAC1C,gBAAM,QAAQ,SAAS,EAAE;AACzB,gBAAM,MAAM,cAAc,OAAO;AACjC,qBAAW,eAAe,KAAK,cAAc;AAC3C,gBAAI;AACF,oBAAM,YAAY,SAAS,IAAI,OAAO;AAAA,YACxC,SAAS,OAAO;AACd,oBAAM,IAAI,aAAa,aAAa,mBAAmB,uBAAoB,YAAY,IAAI,gBAAa,EAAE,MAAM,CAAC;AAAA,YACnH;AAAA,UACF;AACA,qBAAW,WAAW,KAAK,UAAU;AACnC,iBAAK,MAAM,MAAM,cAAc,SAAS,OAAO,IAAI,QAAS,OAAM,cAAc,IAAI,EAAE,SAAS,SAAS,SAAS,QAAQ,iBAAiB,iBAAiB,SAAS,OAAO,OAAO,gBAAgB,CAAC;AAAA,UACrM;AACA,gBAAM,cAAc,KAAK,MAAM,IAAI;AACnC,gBAAM,MAAM,cAAc,QAAQ,IAAI,EAAE,QAAQ,eAAe,WAAW,IAAI,YAAY,CAAC;AAE3F,gBAAM,KAAK,OAAO,OAAO,IAAI,EAAE,SAAS,MAAM,YAAY,WAAW,QAAQ,6BAA6B,QAAQ,EAAE,MAAM,mBAAmB,IAAI,QAAQ,GAAG,GAAG,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC;AAChM,iBAAO,EAAE,GAAG,SAAS,QAAQ,eAAe,WAAW,YAAY;AAAA,QACrE,CAAC;AAAA,MACH,SAAS,OAAO;AAEd,YAAI;AACF,gBAAM,KAAK,YAAY,CAAC,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,GAAG,SAAS,QAAQ,eAAe,QAAQ,aAAa,KAAK,MAAM,IAAI,GAAG,SAAS,aAAa,CAAC,CAAC;AAAA,QAChK,SAAS,eAAe;AACtB,gBAAM,IAAI,eAAe,CAAC,OAAO,aAAa,GAAG,wDAAwD,EAAE,OAAO,cAAc,CAAC;AAAA,QACnI;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,MAAM,OAAO;AACjB,YAAM,UAAkC,CAAC;AACzC,iBAAW,WAAW,KAAK,UAAU;AACnC,cAAM,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAC/C,YAAI,SAAS,OAAW;AACxB,YAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,EAAG,OAAM,IAAI,WAAW,yBAAsB,OAAO,oDAAiD,IAAI,EAAE;AAClJ,cAAM,SAAS,SAAS,KAAK,MAAM,IAAI,GAAG,OAAO,EAAE;AACnD,YAAI,QAAQ;AACZ,mBAAW,eAAe,KAAK,aAAc,UAAU,MAAM,YAAY,eAAe,OAAO,EAAE,SAAS,OAAO,CAAC,KAAM;AACxH,gBAAQ,OAAO,IAAI;AAAA,MACrB;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,SAAS,OAAO,SAAS;AAC7B,mBAAa,OAAO;AACpB,aAAO,SAAS,KAAK,EAAE,WAAW,OAAO;AAAA,IAC3C;AAAA,EACF;AACF;;;ACrNA,SAAS,oBAAoB;AAYtB,IAAM,gBAAgB,aAAa;AAAA,EACxC,QAAQ;AAAA,EACR,YAAY;AAAA,IACV;AAAA,MACE,SAAS;AAAA,MACT,MAAM;AAAA,MACN,KAAK,CAAC,MAAM;AAAA,eACH,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAWW,EAAE,MAAM;AAAA,kBACxB,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,uDAK6B,EAAE,MAAM,0CAA0C,EAAE,MAAM;AAAA,eAClG,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAUW,EAAE,MAAM;AAAA,IACtC;AAAA,EACF;AACF,CAAC;","names":["ident","ident"]}

package/dist/port-Ds9VVyC2.d.ts

@@ -0,0 +1,144 @@
+import { Query } from '@krizaka/db';
+
+/**
+ * The ports of « privacy » (Loi 25): consents by purpose, the person's data exported from every module that holds it, and erased
+ * from every module in one transaction. Generic: no product import, no database client (a `Query` comes in), no wall clock (a
+ * `Clock` comes in). What a module holds, and what erasing it means (blanking a row, deleting a file, keeping an invoice for six
+ * years), is the module's: it implements `PrivacyContributor`.
+ */
+
+/**
+ * Whose data it is. Usually an account (`{ kind: "account", id }`), but a product's data subject is not always an account: Akinaza's
+ * is a client file, Yomizaka's a tenant on an application. The `kind` says which.
+ */
+interface Subject {
+    /** What the id identifies: `account`, `client`, `application`. Lower-case letters, digits and `_`. */
+    kind: string;
+    /** The product's id for it (a UUID, a slug). */
+    id: string;
+}
+/** What a product records when a person agrees, or withdraws. */
+interface ConsentInput {
+    subject: Subject;
+    /** What the person agreed to (`marketing`, `screening`, `reminders`): one of the product's declared purposes. */
+    purpose: string;
+    /** The version of the notice shown to them: the proof of WHAT they agreed to. */
+    version: string;
+    granted: boolean;
+    /** How they said it (`checkbox`, `link`, `verbal`, `erasure`). */
+    means?: string | undefined;
+}
+/** A consent as written. It is never edited: a withdrawal is a new row. */
+interface ConsentRecord {
+    id: string;
+    subject: Subject;
+    purpose: string;
+    version: string;
+    granted: boolean;
+    means: string | null;
+    at: Date;
+}
+declare const REQUEST_KIND: {
+    readonly export: "export";
+    readonly erasure: "erasure";
+};
+type RequestKind = (typeof REQUEST_KIND)[keyof typeof REQUEST_KIND];
+declare const REQUEST_STATUS: {
+    readonly requested: "requested";
+    readonly completed: "completed";
+    readonly failed: "failed";
+};
+type RequestStatus = (typeof REQUEST_STATUS)[keyof typeof REQUEST_STATUS];
+/** An export or an erasure asked for, and where it stands. It holds an id of the subject and no other personal data. */
+interface PrivacyRequest {
+    id: string;
+    subject: Subject;
+    kind: RequestKind;
+    status: RequestStatus;
+    requestedAt: Date;
+    completedAt: Date | null;
+    /** A code, never a message that could carry data. */
+    failure: string | null;
+}
+/**
+ * A module that holds personal data. The product registers one per module and one for its own tables.
+ *
+ * - `exportFor` returns what the module holds about the subject, as JSON-able data.
+ * - `eraseFor` erases or anonymises it, through the transaction it is given, so the whole erasure commits or rolls back together.
+ *   A side effect outside the database (a file in storage) is not done here: append it to the outbox in the same transaction.
+ * - `purgeExpired` (optional) removes what the retention of a purpose says is past, for everyone.
+ */
+interface PrivacyContributor {
+    /** A stable name, the key of its part in the export (`audit`, `orders`). */
+    name: string;
+    exportFor(query: Query, subject: Subject): Promise<unknown>;
+    eraseFor(tx: Query, subject: Subject): Promise<void>;
+    purgeExpired?(tx: Query, input: {
+        purpose: string;
+        before: Date;
+    }): Promise<number>;
+}
+/** The whole export of a subject: one document, a part per contributor. */
+interface ExportDocument {
+    format: 1;
+    subject: Subject;
+    generatedAt: string;
+    modules: Record<string, unknown>;
+}
+/** Where consents and requests live. Every adapter runs `privacyStoreContract` (`@krizaka/privacy/testkit`). */
+interface PrivacyStore {
+    insertConsent(consent: ConsentRecord): Promise<void>;
+    /** The consent with the last word for this purpose, or null when the person never said anything. */
+    latestConsent(subject: Subject, purpose: string): Promise<ConsentRecord | null>;
+    /** Every consent of the subject, oldest first. */
+    consentHistory(subject: Subject): Promise<ConsentRecord[]>;
+    insertRequest(request: PrivacyRequest): Promise<void>;
+    getRequest(id: string): Promise<PrivacyRequest | null>;
+    finishRequest(id: string, outcome: {
+        status: "completed" | "failed";
+        at: Date;
+        failure?: string;
+    }): Promise<void>;
+    requestsOf(subject: Subject): Promise<PrivacyRequest[]>;
+}
+/** The structural slice of `@krizaka/audit` this package writes through, so it adds no dependency. */
+interface AuditPort {
+    record(query: Query, entry: {
+        actorId: string | null;
+        actorLabel: string;
+        action: string;
+        target?: {
+            type: string;
+            id: string;
+        } | null;
+        detail?: Record<string, unknown>;
+    }): Promise<unknown>;
+}
+/** The structural slice of `@krizaka/outbox` used for a large export. */
+interface OutboxPort {
+    append(tx: Query, message: {
+        topic: string;
+        type: string;
+        payload: unknown;
+        id?: string;
+    }): Promise<unknown>;
+}
+declare const PRIVACY_CODE: {
+    readonly badSubject: "PRIVACY_BAD_SUBJECT";
+    readonly badPurpose: "PRIVACY_BAD_PURPOSE";
+    readonly badConsent: "PRIVACY_BAD_CONSENT";
+    readonly unknownRequest: "PRIVACY_UNKNOWN_REQUEST";
+    readonly notAnExport: "PRIVACY_NOT_AN_EXPORT";
+    readonly alreadyDone: "PRIVACY_ALREADY_DONE";
+    readonly contributorFailed: "PRIVACY_CONTRIBUTOR_FAILED";
+    readonly noOutbox: "PRIVACY_NO_OUTBOX";
+};
+type PrivacyCode = (typeof PRIVACY_CODE)[keyof typeof PRIVACY_CODE];
+declare class PrivacyError extends Error {
+    readonly code: PrivacyCode;
+    constructor(code: PrivacyCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+
+export { type AuditPort as A, type ConsentInput as C, type ExportDocument as E, type OutboxPort as O, type PrivacyContributor as P, REQUEST_KIND as R, type Subject as S, type PrivacyStore as a, type ConsentRecord as b, type PrivacyRequest as c, PRIVACY_CODE as d, type PrivacyCode as e, PrivacyError as f, REQUEST_STATUS as g, type RequestKind as h, type RequestStatus as i };

package/dist/settings.d.ts

@@ -0,0 +1,17 @@
+import { Registry } from '@krizaka/settings';
+
+/** The settings key of a purpose's retention: `payment-history` → `privacy.retention.paymentHistoryDays` (a key holds letters and digits only). */
+declare const retentionKey: (purpose: string) => string;
+/**
+ * The registry fragment of the retention: `privacy.retention.<purpose>Days` for each purpose the product declares, an integer with the
+ * product's default. Global scope. The admin sets how long what a purpose collected is kept; the product's job calls `purge`.
+ * @param purposes the product's purposes (`screening`, `payment-history`), with their default retention in days
+ * @throws PrivacyError for a purpose id that is not well formed, or two that give the same key
+ */
+declare function privacySettings(purposes: Readonly<Record<string, {
+    retentionDays: number;
+}>>): Registry;
+/** The retention of a purpose as `createPrivacy` takes it, from the product's accessor (`(key) => service.get(key, ctx)`). */
+declare function retentionFromSettings(read: (key: string) => number | undefined | Promise<number | undefined>): (purpose: string) => Promise<number | undefined>;
+
+export { privacySettings, retentionFromSettings, retentionKey };

package/dist/settings.js

@@ -0,0 +1,26 @@
+import {
+  checkPurpose
+} from "./chunk-PMXEX2LW.js";
+
+// src/settings.ts
+import { integer } from "@krizaka/settings";
+var retentionKey = (purpose) => `privacy.retention.${purpose.replace(/[-_]([a-z0-9])/g, (_, c) => c.toUpperCase())}Days`;
+function privacySettings(purposes) {
+  const fragment = {};
+  for (const [purpose, { retentionDays }] of Object.entries(purposes)) {
+    checkPurpose(purpose);
+    const key = retentionKey(purpose);
+    if (key in fragment) throw new RangeError(`privacy purposes give the same settings key: ${key}`);
+    fragment[key] = integer("privacy", retentionDays, { min: 1, max: 3650, unit: "days" });
+  }
+  return fragment;
+}
+function retentionFromSettings(read) {
+  return async (purpose) => read(retentionKey(purpose));
+}
+export {
+  privacySettings,
+  retentionFromSettings,
+  retentionKey
+};
+//# sourceMappingURL=settings.js.map

package/dist/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/settings.ts"],"sourcesContent":["import { integer, type Registry } from \"@krizaka/settings\";\n\nimport { checkPurpose } from \"./rules\";\n\n/** The settings key of a purpose's retention: `payment-history` → `privacy.retention.paymentHistoryDays` (a key holds letters and digits only). */\nexport const retentionKey = (purpose: string): string => `privacy.retention.${purpose.replace(/[-_]([a-z0-9])/g, (_, c: string) => c.toUpperCase())}Days`;\n\n/**\n * The registry fragment of the retention: `privacy.retention.<purpose>Days` for each purpose the product declares, an integer with the\n * product's default. Global scope. The admin sets how long what a purpose collected is kept; the product's job calls `purge`.\n * @param purposes the product's purposes (`screening`, `payment-history`), with their default retention in days\n * @throws PrivacyError for a purpose id that is not well formed, or two that give the same key\n */\nexport function privacySettings(purposes: Readonly<Record<string, { retentionDays: number }>>): Registry {\n  const fragment: Registry = {};\n  for (const [purpose, { retentionDays }] of Object.entries(purposes)) {\n    checkPurpose(purpose);\n    const key = retentionKey(purpose);\n    if (key in fragment) throw new RangeError(`privacy purposes give the same settings key: ${key}`);\n    // @fixed: a purpose is kept from a day to ten years; the default is the product's\n    fragment[key] = integer(\"privacy\", retentionDays, { min: 1, max: 3650, unit: \"days\" });\n  }\n  return fragment;\n}\n\n/** The retention of a purpose as `createPrivacy` takes it, from the product's accessor (`(key) => service.get(key, ctx)`). */\nexport function retentionFromSettings(read: (key: string) => number | undefined | Promise<number | undefined>): (purpose: string) => Promise<number | undefined> {\n  return async (purpose) => read(retentionKey(purpose));\n}\n"],"mappings":";;;;;AAAA,SAAS,eAA8B;AAKhC,IAAM,eAAe,CAAC,YAA4B,qBAAqB,QAAQ,QAAQ,mBAAmB,CAAC,GAAG,MAAc,EAAE,YAAY,CAAC,CAAC;AAQ5I,SAAS,gBAAgB,UAAyE;AACvG,QAAM,WAAqB,CAAC;AAC5B,aAAW,CAAC,SAAS,EAAE,cAAc,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnE,iBAAa,OAAO;AACpB,UAAM,MAAM,aAAa,OAAO;AAChC,QAAI,OAAO,SAAU,OAAM,IAAI,WAAW,gDAAgD,GAAG,EAAE;AAE/F,aAAS,GAAG,IAAI,QAAQ,WAAW,eAAe,EAAE,KAAK,GAAG,KAAK,MAAM,MAAM,OAAO,CAAC;AAAA,EACvF;AACA,SAAO;AACT;AAGO,SAAS,sBAAsB,MAA2H;AAC/J,SAAO,OAAO,YAAY,KAAK,aAAa,OAAO,CAAC;AACtD;","names":[]}

package/dist/testkit.d.ts

@@ -0,0 +1,7 @@
+import { a as PrivacyStore } from './port-Ds9VVyC2.js';
+import '@krizaka/db';
+
+/** What every `PrivacyStore` adapter must do: the same behaviour behind the same port. `make` gives an empty store. */
+declare function privacyStoreContract(name: string, make: () => PrivacyStore | Promise<PrivacyStore>): void;
+
+export { privacyStoreContract };

package/dist/testkit.js

@@ -0,0 +1,63 @@
+// src/testkit.ts
+import { randomUUID } from "crypto";
+import { expect, it } from "vitest";
+var T0 = /* @__PURE__ */ new Date("2026-10-26T12:00:00.000Z");
+var at = (seconds) => new Date(T0.valueOf() + seconds * 1e3);
+var ERIC = { kind: "account", id: "11111111-1111-4111-8111-111111111111" };
+var CLIENT = { kind: "client", id: "c-42" };
+var consent = (subject, purpose, granted, seconds) => ({ id: randomUUID(), subject, purpose, version: "2026-10-01", granted, means: "checkbox", at: at(seconds) });
+var request = (subject, kind, seconds) => ({ id: randomUUID(), subject, kind, status: "requested", requestedAt: at(seconds), completedAt: null, failure: null });
+function privacyStoreContract(name, make) {
+  it(`${name}: knows nothing about a person who never said anything`, async () => {
+    const store = await make();
+    expect(await store.latestConsent(ERIC, "marketing")).toBeNull();
+    expect(await store.consentHistory(ERIC)).toEqual([]);
+  });
+  it(`${name}: the consent with the last word wins, and the history keeps every one in order`, async () => {
+    const store = await make();
+    const first = consent(ERIC, "marketing", true, 0);
+    const second = consent(ERIC, "marketing", false, 10);
+    const third = consent(ERIC, "marketing", true, 20);
+    for (const c of [first, second, third]) await store.insertConsent(c);
+    expect(await store.latestConsent(ERIC, "marketing")).toEqual(third);
+    expect((await store.consentHistory(ERIC)).map((c) => c.id)).toEqual([first.id, second.id, third.id]);
+  });
+  it(`${name}: keeps purposes and subjects apart, whatever the kind of subject`, async () => {
+    const store = await make();
+    await store.insertConsent(consent(ERIC, "marketing", true, 0));
+    await store.insertConsent(consent(ERIC, "screening", false, 1));
+    await store.insertConsent(consent(CLIENT, "marketing", false, 2));
+    expect((await store.latestConsent(ERIC, "marketing"))?.granted).toBe(true);
+    expect((await store.latestConsent(ERIC, "screening"))?.granted).toBe(false);
+    expect((await store.latestConsent(CLIENT, "marketing"))?.granted).toBe(false);
+    expect(await store.consentHistory(CLIENT)).toHaveLength(1);
+    expect(await store.latestConsent({ kind: "client", id: ERIC.id }, "marketing")).toBeNull();
+  });
+  it(`${name}: records the proof: the notice version, the means and the instant`, async () => {
+    const store = await make();
+    const c = { ...consent(ERIC, "marketing", true, 5), version: "v7", means: "link" };
+    await store.insertConsent(c);
+    const found = await store.latestConsent(ERIC, "marketing");
+    expect(found).toMatchObject({ version: "v7", means: "link", granted: true });
+    expect(found.at.toISOString()).toBe(at(5).toISOString());
+  });
+  it(`${name}: follows a request from asked to completed, or failed with a code`, async () => {
+    const store = await make();
+    const done = request(ERIC, "export", 0);
+    const broke = request(ERIC, "erasure", 10);
+    await store.insertRequest(done);
+    await store.insertRequest(broke);
+    await store.finishRequest(done.id, { status: "completed", at: at(3) });
+    await store.finishRequest(broke.id, { status: "failed", at: at(11), failure: "CONTRIBUTOR_FAILED" });
+    expect(await store.getRequest(done.id)).toMatchObject({ kind: "export", status: "completed", failure: null });
+    expect((await store.getRequest(done.id)).completedAt.toISOString()).toBe(at(3).toISOString());
+    expect(await store.getRequest(broke.id)).toMatchObject({ kind: "erasure", status: "failed", failure: "CONTRIBUTOR_FAILED" });
+    expect(await store.getRequest(randomUUID())).toBeNull();
+    expect((await store.requestsOf(ERIC)).map((r) => r.id)).toEqual([broke.id, done.id]);
+    expect(await store.requestsOf(CLIENT)).toEqual([]);
+  });
+}
+export {
+  privacyStoreContract
+};
+//# sourceMappingURL=testkit.js.map

package/dist/testkit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/testkit.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\n\nimport { expect, it } from \"vitest\";\n\nimport type { ConsentRecord, PrivacyRequest, PrivacyStore, Subject } from \"./port\";\n\nconst T0 = new Date(\"2026-10-26T12:00:00.000Z\");\nconst at = (seconds: number) => new Date(T0.valueOf() + seconds * 1000);\nconst ERIC: Subject = { kind: \"account\", id: \"11111111-1111-4111-8111-111111111111\" };\nconst CLIENT: Subject = { kind: \"client\", id: \"c-42\" };\n\nconst consent = (subject: Subject, purpose: string, granted: boolean, seconds: number): ConsentRecord => ({ id: randomUUID(), subject, purpose, version: \"2026-10-01\", granted, means: \"checkbox\", at: at(seconds) });\nconst request = (subject: Subject, kind: PrivacyRequest[\"kind\"], seconds: number): PrivacyRequest => ({ id: randomUUID(), subject, kind, status: \"requested\", requestedAt: at(seconds), completedAt: null, failure: null });\n\n/** What every `PrivacyStore` adapter must do: the same behaviour behind the same port. `make` gives an empty store. */\nexport function privacyStoreContract(name: string, make: () => PrivacyStore | Promise<PrivacyStore>) {\n  it(`${name}: knows nothing about a person who never said anything`, async () => {\n    const store = await make();\n    expect(await store.latestConsent(ERIC, \"marketing\")).toBeNull();\n    expect(await store.consentHistory(ERIC)).toEqual([]);\n  });\n\n  it(`${name}: the consent with the last word wins, and the history keeps every one in order`, async () => {\n    const store = await make();\n    const first = consent(ERIC, \"marketing\", true, 0);\n    const second = consent(ERIC, \"marketing\", false, 10);\n    const third = consent(ERIC, \"marketing\", true, 20);\n    for (const c of [first, second, third]) await store.insertConsent(c);\n    expect(await store.latestConsent(ERIC, \"marketing\")).toEqual(third);\n    expect((await store.consentHistory(ERIC)).map((c) => c.id)).toEqual([first.id, second.id, third.id]);\n  });\n\n  it(`${name}: keeps purposes and subjects apart, whatever the kind of subject`, async () => {\n    const store = await make();\n    await store.insertConsent(consent(ERIC, \"marketing\", true, 0));\n    await store.insertConsent(consent(ERIC, \"screening\", false, 1));\n    await store.insertConsent(consent(CLIENT, \"marketing\", false, 2));\n    expect((await store.latestConsent(ERIC, \"marketing\"))?.granted).toBe(true);\n    expect((await store.latestConsent(ERIC, \"screening\"))?.granted).toBe(false);\n    expect((await store.latestConsent(CLIENT, \"marketing\"))?.granted).toBe(false);\n    expect(await store.consentHistory(CLIENT)).toHaveLength(1);\n    expect(await store.latestConsent({ kind: \"client\", id: ERIC.id }, \"marketing\")).toBeNull(); // same id, another kind\n  });\n\n  it(`${name}: records the proof: the notice version, the means and the instant`, async () => {\n    const store = await make();\n    const c = { ...consent(ERIC, \"marketing\", true, 5), version: \"v7\", means: \"link\" };\n    await store.insertConsent(c);\n    const found = await store.latestConsent(ERIC, \"marketing\");\n    expect(found).toMatchObject({ version: \"v7\", means: \"link\", granted: true });\n    expect(found!.at.toISOString()).toBe(at(5).toISOString());\n  });\n\n  it(`${name}: follows a request from asked to completed, or failed with a code`, async () => {\n    const store = await make();\n    const done = request(ERIC, \"export\", 0);\n    const broke = request(ERIC, \"erasure\", 10);\n    await store.insertRequest(done);\n    await store.insertRequest(broke);\n    await store.finishRequest(done.id, { status: \"completed\", at: at(3) });\n    await store.finishRequest(broke.id, { status: \"failed\", at: at(11), failure: \"CONTRIBUTOR_FAILED\" });\n    expect(await store.getRequest(done.id)).toMatchObject({ kind: \"export\", status: \"completed\", failure: null });\n    expect((await store.getRequest(done.id))!.completedAt!.toISOString()).toBe(at(3).toISOString());\n    expect(await store.getRequest(broke.id)).toMatchObject({ kind: \"erasure\", status: \"failed\", failure: \"CONTRIBUTOR_FAILED\" });\n    expect(await store.getRequest(randomUUID())).toBeNull();\n    expect((await store.requestsOf(ERIC)).map((r) => r.id)).toEqual([broke.id, done.id]); // newest first\n    expect(await store.requestsOf(CLIENT)).toEqual([]);\n  });\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAE3B,SAAS,QAAQ,UAAU;AAI3B,IAAM,KAAK,oBAAI,KAAK,0BAA0B;AAC9C,IAAM,KAAK,CAAC,YAAoB,IAAI,KAAK,GAAG,QAAQ,IAAI,UAAU,GAAI;AACtE,IAAM,OAAgB,EAAE,MAAM,WAAW,IAAI,uCAAuC;AACpF,IAAM,SAAkB,EAAE,MAAM,UAAU,IAAI,OAAO;AAErD,IAAM,UAAU,CAAC,SAAkB,SAAiB,SAAkB,aAAoC,EAAE,IAAI,WAAW,GAAG,SAAS,SAAS,SAAS,cAAc,SAAS,OAAO,YAAY,IAAI,GAAG,OAAO,EAAE;AACnN,IAAM,UAAU,CAAC,SAAkB,MAA8B,aAAqC,EAAE,IAAI,WAAW,GAAG,SAAS,MAAM,QAAQ,aAAa,aAAa,GAAG,OAAO,GAAG,aAAa,MAAM,SAAS,KAAK;AAGlN,SAAS,qBAAqB,MAAc,MAAkD;AACnG,KAAG,GAAG,IAAI,0DAA0D,YAAY;AAC9E,UAAM,QAAQ,MAAM,KAAK;AACzB,WAAO,MAAM,MAAM,cAAc,MAAM,WAAW,CAAC,EAAE,SAAS;AAC9D,WAAO,MAAM,MAAM,eAAe,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACrD,CAAC;AAED,KAAG,GAAG,IAAI,mFAAmF,YAAY;AACvG,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,QAAQ,QAAQ,MAAM,aAAa,MAAM,CAAC;AAChD,UAAM,SAAS,QAAQ,MAAM,aAAa,OAAO,EAAE;AACnD,UAAM,QAAQ,QAAQ,MAAM,aAAa,MAAM,EAAE;AACjD,eAAW,KAAK,CAAC,OAAO,QAAQ,KAAK,EAAG,OAAM,MAAM,cAAc,CAAC;AACnE,WAAO,MAAM,MAAM,cAAc,MAAM,WAAW,CAAC,EAAE,QAAQ,KAAK;AAClE,YAAQ,MAAM,MAAM,eAAe,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;AAAA,EACrG,CAAC;AAED,KAAG,GAAG,IAAI,qEAAqE,YAAY;AACzF,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,MAAM,cAAc,QAAQ,MAAM,aAAa,MAAM,CAAC,CAAC;AAC7D,UAAM,MAAM,cAAc,QAAQ,MAAM,aAAa,OAAO,CAAC,CAAC;AAC9D,UAAM,MAAM,cAAc,QAAQ,QAAQ,aAAa,OAAO,CAAC,CAAC;AAChE,YAAQ,MAAM,MAAM,cAAc,MAAM,WAAW,IAAI,OAAO,EAAE,KAAK,IAAI;AACzE,YAAQ,MAAM,MAAM,cAAc,MAAM,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK;AAC1E,YAAQ,MAAM,MAAM,cAAc,QAAQ,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK;AAC5E,WAAO,MAAM,MAAM,eAAe,MAAM,CAAC,EAAE,aAAa,CAAC;AACzD,WAAO,MAAM,MAAM,cAAc,EAAE,MAAM,UAAU,IAAI,KAAK,GAAG,GAAG,WAAW,CAAC,EAAE,SAAS;AAAA,EAC3F,CAAC;AAED,KAAG,GAAG,IAAI,sEAAsE,YAAY;AAC1F,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,IAAI,EAAE,GAAG,QAAQ,MAAM,aAAa,MAAM,CAAC,GAAG,SAAS,MAAM,OAAO,OAAO;AACjF,UAAM,MAAM,cAAc,CAAC;AAC3B,UAAM,QAAQ,MAAM,MAAM,cAAc,MAAM,WAAW;AACzD,WAAO,KAAK,EAAE,cAAc,EAAE,SAAS,MAAM,OAAO,QAAQ,SAAS,KAAK,CAAC;AAC3E,WAAO,MAAO,GAAG,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,CAAC;AAAA,EAC1D,CAAC;AAED,KAAG,GAAG,IAAI,sEAAsE,YAAY;AAC1F,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,OAAO,QAAQ,MAAM,UAAU,CAAC;AACtC,UAAM,QAAQ,QAAQ,MAAM,WAAW,EAAE;AACzC,UAAM,MAAM,cAAc,IAAI;AAC9B,UAAM,MAAM,cAAc,KAAK;AAC/B,UAAM,MAAM,cAAc,KAAK,IAAI,EAAE,QAAQ,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;AACrE,UAAM,MAAM,cAAc,MAAM,IAAI,EAAE,QAAQ,UAAU,IAAI,GAAG,EAAE,GAAG,SAAS,qBAAqB,CAAC;AACnG,WAAO,MAAM,MAAM,WAAW,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,UAAU,QAAQ,aAAa,SAAS,KAAK,CAAC;AAC5G,YAAQ,MAAM,MAAM,WAAW,KAAK,EAAE,GAAI,YAAa,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,CAAC;AAC9F,WAAO,MAAM,MAAM,WAAW,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,WAAW,QAAQ,UAAU,SAAS,qBAAqB,CAAC;AAC3H,WAAO,MAAM,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,SAAS;AACtD,YAAQ,MAAM,MAAM,WAAW,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;AACnF,WAAO,MAAM,MAAM,WAAW,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACnD,CAAC;AACH;","names":[]}

package/package.json

@@ -1,6 +1,87 @@
 {
   "name": "@krizaka/privacy",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Privacy for every Krizaka product (Loi 25): consents by purpose written once with the notice version shown, an export assembled from every module that holds the person's data, an erasure that runs in one transaction and leaves a record without personal data, and retention per purpose set by the admin. A port each module implements; no database client, no wall clock.",
+  "keywords": [
+    "krizaka",
+    "privacy",
+    "consent",
+    "loi-25",
+    "gdpr",
+    "export",
+    "erasure",
+    "postgresql"
+  ],
+  "homepage": "https://github.com/krizaka/krizaka-ts/tree/main/packages/privacy",
+  "bugs": "https://github.com/krizaka/krizaka-ts/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/krizaka/krizaka-ts.git",
+    "directory": "packages/privacy"
+  },
+  "license": "Apache-2.0",
+  "author": "Krizaka (https://www.krizaka.com)",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./settings": {
+      "types": "./dist/settings.d.ts",
+      "import": "./dist/settings.js"
+    },
+    "./testkit": {
+      "types": "./dist/testkit.d.ts",
+      "import": "./dist/testkit.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "@types/pg": "^8.23.1",
+    "eslint": "^9.39.0",
+    "pg": "^8.23.1",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.11",
+    "zod": "^4.6.7",
+    "@krizaka/config": "^0.8.1"
+  },
+  "dependencies": {
+    "@krizaka/db": "^0.2.0",
+    "@krizaka/settings": "^0.4.0",
+    "@krizaka/time": "^0.1.0"
+  },
+  "peerDependencies": {
+    "vitest": ">=4",
+    "zod": ">=3.23"
+  },
+  "peerDependenciesMeta": {
+    "vitest": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsup",
+    "lint": "eslint . --max-warnings 0 && tsc --noEmit",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "check": "pnpm run lint && pnpm run test && pnpm run build"
+  }
 }