@krizaka/privacy 0.1.0 → 0.2.0

package/README.md

@@ -33,3 +33,28 @@ await privacy.purge(query);                               // from the product's
 - **Erasure** runs every contributor's `eraseFor` in ONE transaction, withdraws the live consents (a new row each, version `erasure` or the one you pass), records the request and an audit entry `privacy.erasure_completed` that names the request and the modules and **no one**. If a contributor fails, nothing is erased, the request is recorded as `failed` with a code, and the error is thrown (if recording the failure fails too, an `AggregateError` with the original first).
 - **Retention:** `privacySettings({ screening: { retentionDays: 365 } })` (`@krizaka/privacy/settings`, needs `@krizaka/settings` and `zod`) declares `privacy.retention.screeningDays` (`payment-history` → `paymentHistoryDays`). `purge` calls every contributor's `purgeExpired` for each purpose that has a retention.
 - The request table holds an id of the subject and no other personal data, so it can outlive the erasure it proves. `privacyStoreContract` (from `@krizaka/privacy/testkit`) is the contract every store runs.
+
+## Confidentiality incident register
+
+The register that the Act respecting the protection of personal information in the private sector ([CQLR c. P-39.1](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1), ss. 3.5 to 3.8) asks every enterprise to keep, with the content and retention set by the [Regulation respecting confidentiality incidents](https://www.legisquebec.gouv.qc.ca/en/document/cr/P-39.1,%20r.%203.1). In short, as we read it (not legal advice): on reason to believe an incident occurred, reduce the risk and prevent a new one; assess the risk of serious injury from the sensitivity of the information, the anticipated consequences and the likelihood of misuse; if the risk is serious, notify the Commission d'accès à l'information and the people concerned promptly; and keep a register of every incident, serious or not, for at least five years after becoming aware of it, handed to the Commission on request.
+
+```ts
+import { createIncidentRegister, registerToCsv, suggestSeriousInjury } from "@krizaka/privacy";
+
+emitMigration(privacySchema, 2, { tables: {} });            // privacy.incident (after version 1)
+const incidents = createIncidentRegister({ clock: { now: () => new Date() }, audit });
+const admin = { id: account.id, label: account.name };
+
+const { id } = await incidents.open(query, { scope: tenantId, kind: "access", description: "…", information: ["lease"], personsConcerned: 3 }, admin);
+await incidents.recordMeasure(query, tenantId, id, "Session revoked", admin);
+await incidents.assess(query, tenantId, id, { sensitivity: "high", consequences: "high", likelihood: "medium", seriousInjury: suggestSeriousInjury(factors), rationale: "…" }, admin);
+await incidents.recordNotice(query, tenantId, id, "cai", { channel: "form" }, admin);     // and "persons"
+await incidents.close(query, tenantId, id, admin);       // a serious injury closes once both notices are recorded
+registerToCsv((await incidents.exportRegister(query, tenantId)).entries);
+```
+
+- **Every call is by `scope`** (the tenant): an entry of another scope is never found, edited or exported. The store is the `IncidentStore` port (`memoryIncidentStore`, `dbIncidentStore`; `incidentStoreContract` from `@krizaka/privacy/testkit`); the clock is injected.
+- **The register holds no personal data of the people concerned**: how many, and the categories of information, never the information.
+- **Kept five years**: `retainUntil` is five years after `awareAt`; the database refuses to delete an entry before it, and refuses to edit a closed one. A drill is marked (`drill`) and stays in the register.
+- `suggestSeriousInjury` is a guide for the person in charge; the decision (`seriousInjury`) is theirs and is recorded with its rationale. An incident without serious injury owes no notice (`recordNotice` refuses).
+- With `audit`, each step is traced as `privacy.incident_*` without the description or any person.

package/dist/incident-DLXCVzpW.d.ts

@@ -0,0 +1,321 @@
+import { Query, Clock } from '@krizaka/db';
+
+/**
+ * The ports of « privacy » (Loi 25): consents by purpose, the person's data exported from every module that holds it, and erased
+ * from every module in one transaction. Generic: no product import, no database client (a `Query` comes in), no wall clock (a
+ * `Clock` comes in). What a module holds, and what erasing it means (blanking a row, deleting a file, keeping an invoice for six
+ * years), is the module's: it implements `PrivacyContributor`.
+ */
+
+/**
+ * Whose data it is. Usually an account (`{ kind: "account", id }`), but a product's data subject is not always an account: Akinaza's
+ * is a client file, Yomizaka's a tenant on an application. The `kind` says which.
+ */
+interface Subject {
+    /** What the id identifies: `account`, `client`, `application`. Lower-case letters, digits and `_`. */
+    kind: string;
+    /** The product's id for it (a UUID, a slug). */
+    id: string;
+}
+/** What a product records when a person agrees, or withdraws. */
+interface ConsentInput {
+    subject: Subject;
+    /** What the person agreed to (`marketing`, `screening`, `reminders`): one of the product's declared purposes. */
+    purpose: string;
+    /** The version of the notice shown to them: the proof of WHAT they agreed to. */
+    version: string;
+    granted: boolean;
+    /** How they said it (`checkbox`, `link`, `verbal`, `erasure`). */
+    means?: string | undefined;
+}
+/** A consent as written. It is never edited: a withdrawal is a new row. */
+interface ConsentRecord {
+    id: string;
+    subject: Subject;
+    purpose: string;
+    version: string;
+    granted: boolean;
+    means: string | null;
+    at: Date;
+}
+declare const REQUEST_KIND: {
+    readonly export: "export";
+    readonly erasure: "erasure";
+};
+type RequestKind = (typeof REQUEST_KIND)[keyof typeof REQUEST_KIND];
+declare const REQUEST_STATUS: {
+    readonly requested: "requested";
+    readonly completed: "completed";
+    readonly failed: "failed";
+};
+type RequestStatus = (typeof REQUEST_STATUS)[keyof typeof REQUEST_STATUS];
+/** An export or an erasure asked for, and where it stands. It holds an id of the subject and no other personal data. */
+interface PrivacyRequest {
+    id: string;
+    subject: Subject;
+    kind: RequestKind;
+    status: RequestStatus;
+    requestedAt: Date;
+    completedAt: Date | null;
+    /** A code, never a message that could carry data. */
+    failure: string | null;
+}
+/**
+ * A module that holds personal data. The product registers one per module and one for its own tables.
+ *
+ * - `exportFor` returns what the module holds about the subject, as JSON-able data.
+ * - `eraseFor` erases or anonymises it, through the transaction it is given, so the whole erasure commits or rolls back together.
+ *   A side effect outside the database (a file in storage) is not done here: append it to the outbox in the same transaction.
+ * - `purgeExpired` (optional) removes what the retention of a purpose says is past, for everyone.
+ */
+interface PrivacyContributor {
+    /** A stable name, the key of its part in the export (`audit`, `orders`). */
+    name: string;
+    exportFor(query: Query, subject: Subject): Promise<unknown>;
+    eraseFor(tx: Query, subject: Subject): Promise<void>;
+    purgeExpired?(tx: Query, input: {
+        purpose: string;
+        before: Date;
+    }): Promise<number>;
+}
+/** The whole export of a subject: one document, a part per contributor. */
+interface ExportDocument {
+    format: 1;
+    subject: Subject;
+    generatedAt: string;
+    modules: Record<string, unknown>;
+}
+/** Where consents and requests live. Every adapter runs `privacyStoreContract` (`@krizaka/privacy/testkit`). */
+interface PrivacyStore {
+    insertConsent(consent: ConsentRecord): Promise<void>;
+    /** The consent with the last word for this purpose, or null when the person never said anything. */
+    latestConsent(subject: Subject, purpose: string): Promise<ConsentRecord | null>;
+    /** Every consent of the subject, oldest first. */
+    consentHistory(subject: Subject): Promise<ConsentRecord[]>;
+    insertRequest(request: PrivacyRequest): Promise<void>;
+    getRequest(id: string): Promise<PrivacyRequest | null>;
+    finishRequest(id: string, outcome: {
+        status: "completed" | "failed";
+        at: Date;
+        failure?: string;
+    }): Promise<void>;
+    requestsOf(subject: Subject): Promise<PrivacyRequest[]>;
+}
+/** The structural slice of `@krizaka/audit` this package writes through, so it adds no dependency. */
+interface AuditPort {
+    record(query: Query, entry: {
+        actorId: string | null;
+        actorLabel: string;
+        action: string;
+        target?: {
+            type: string;
+            id: string;
+        } | null;
+        detail?: Record<string, unknown>;
+    }): Promise<unknown>;
+}
+/** The structural slice of `@krizaka/outbox` used for a large export. */
+interface OutboxPort {
+    append(tx: Query, message: {
+        topic: string;
+        type: string;
+        payload: unknown;
+        id?: string;
+    }): Promise<unknown>;
+}
+declare const PRIVACY_CODE: {
+    readonly badSubject: "PRIVACY_BAD_SUBJECT";
+    readonly badPurpose: "PRIVACY_BAD_PURPOSE";
+    readonly badConsent: "PRIVACY_BAD_CONSENT";
+    readonly unknownRequest: "PRIVACY_UNKNOWN_REQUEST";
+    readonly notAnExport: "PRIVACY_NOT_AN_EXPORT";
+    readonly alreadyDone: "PRIVACY_ALREADY_DONE";
+    readonly contributorFailed: "PRIVACY_CONTRIBUTOR_FAILED";
+    readonly noOutbox: "PRIVACY_NO_OUTBOX";
+};
+type PrivacyCode = (typeof PRIVACY_CODE)[keyof typeof PRIVACY_CODE];
+declare class PrivacyError extends Error {
+    readonly code: PrivacyCode;
+    constructor(code: PrivacyCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+
+/**
+ * The confidentiality incident register (Loi 25). Act respecting the protection of personal information in the private sector
+ * (CQLR c. P-39.1), ss. 3.5 to 3.8, and the Regulation respecting confidentiality incidents (CQLR c. P-39.1, r. 3.1): see the README
+ * for the links. The register holds the facts of an incident and NO personal data of the people concerned (only how many, and which
+ * categories of information).
+ */
+/** What happened to the information (the Act speaks of unauthorised access, use, communication and loss). */
+declare const INCIDENT_KIND: {
+    readonly access: "access";
+    readonly use: "use";
+    readonly communication: "communication";
+    readonly loss: "loss";
+};
+type IncidentKind = (typeof INCIDENT_KIND)[keyof typeof INCIDENT_KIND];
+declare const INCIDENT_STATUS: {
+    readonly open: "open";
+    readonly assessed: "assessed";
+    readonly closed: "closed";
+};
+type IncidentStatus = (typeof INCIDENT_STATUS)[keyof typeof INCIDENT_STATUS];
+declare const LEVEL: {
+    readonly low: "low";
+    readonly medium: "medium";
+    readonly high: "high";
+};
+type Level = (typeof LEVEL)[keyof typeof LEVEL];
+declare const NOTICE_TARGET: {
+    readonly cai: "cai";
+    readonly persons: "persons";
+};
+type NoticeTarget = (typeof NOTICE_TARGET)[keyof typeof NOTICE_TARGET];
+/** The three factors of the risk assessment (s. 3.6) and the decision of the person in charge. */
+interface IncidentAssessment {
+    /** How sensitive the information is. */
+    sensitivity: Level;
+    /** How serious the anticipated consequences of its use are. */
+    consequences: Level;
+    /** How likely it is to be misused. */
+    likelihood: Level;
+    /** The decision: a risk of serious injury means notifying the Commission d'accès à l'information and the people concerned. */
+    seriousInjury: boolean;
+    rationale: string;
+    assessedAt: Date;
+    assessedBy: string;
+}
+/** A notice sent, to the Commission or to the people concerned. */
+interface IncidentNotice {
+    sentAt: Date;
+    /** How it was sent (`form`, `email`, `letter`, `public`). */
+    channel: string;
+    /** The Commission's acknowledgement, if any. */
+    reference: string | null;
+}
+interface IncidentMeasure {
+    at: Date;
+    text: string;
+}
+/** One register entry: an incident, from the day the enterprise became aware of it. */
+interface Incident {
+    id: string;
+    /** Whose register it is: a tenant, an organisation. Entries of another scope are never read. */
+    scope: string;
+    kind: IncidentKind;
+    /** When the enterprise became aware of it: the start of the retention. */
+    awareAt: Date;
+    occurredAt: Date | null;
+    description: string;
+    /** The categories of information concerned (`lease`, `pay stub`), never the information. */
+    information: string[];
+    /** How many people are concerned, null while unknown. */
+    personsConcerned: number | null;
+    measures: IncidentMeasure[];
+    status: IncidentStatus;
+    assessment: IncidentAssessment | null;
+    caiNotice: IncidentNotice | null;
+    personsNotice: IncidentNotice | null;
+    /** A fictitious incident, run to prove the procedure. It stays in the register, marked. */
+    drill: boolean;
+    openedBy: string;
+    openedAt: Date;
+    closedAt: Date | null;
+    /** The register entry cannot be deleted before this date: five years after `awareAt`. */
+    retainUntil: Date;
+}
+interface IncidentInput {
+    scope: string;
+    kind: IncidentKind;
+    awareAt?: Date | undefined;
+    occurredAt?: Date | undefined;
+    description: string;
+    information: readonly string[];
+    personsConcerned?: number | undefined;
+    drill?: boolean | undefined;
+}
+interface AssessmentInput {
+    sensitivity: Level;
+    consequences: Level;
+    likelihood: Level;
+    seriousInjury: boolean;
+    rationale: string;
+}
+/** Where the register lives. Every adapter runs `incidentStoreContract` (`@krizaka/privacy/testkit`). Every read is by scope. */
+interface IncidentStore {
+    insert(incident: Incident): Promise<void>;
+    /** Replaces an incident that is not closed. */
+    save(incident: Incident): Promise<void>;
+    /** `lock`: for the read-then-write of one incident (`FOR UPDATE`). */
+    get(scope: string, id: string, options?: {
+        lock?: boolean;
+    }): Promise<Incident | null>;
+    /** The whole register of the scope, oldest awareness first. */
+    list(scope: string): Promise<Incident[]>;
+}
+interface IncidentActor {
+    /** An opaque id (an admin account). */
+    id: string | null;
+    label: string;
+}
+interface IncidentDeps {
+    clock: Clock;
+    audit?: AuditPort;
+    storeFor?: (query: Query) => IncidentStore;
+    /** The Postgres schema, when the product renamed the module's. */
+    schema?: string;
+}
+/** The register as handed to the Commission on request: one document, the entries oldest first. */
+interface RegisterDocument {
+    format: 1;
+    scope: string;
+    generatedAt: string;
+    entries: Incident[];
+}
+interface IncidentRegister {
+    /** Opens an incident (s. 3.5: as soon as there is reason to believe one occurred). */
+    open(query: Query, input: IncidentInput, actor: IncidentActor): Promise<Incident>;
+    /** Writes the risk assessment (s. 3.6); it can be redone until the incident is closed. */
+    assess(query: Query, scope: string, id: string, input: AssessmentInput, actor: IncidentActor): Promise<Incident>;
+    /** Records a measure taken to reduce the risk and prevent a new incident (s. 3.5). */
+    recordMeasure(query: Query, scope: string, id: string, text: string, actor: IncidentActor): Promise<Incident>;
+    /** Records a notice sent. Only an incident assessed as a risk of serious injury is notified. */
+    recordNotice(query: Query, scope: string, id: string, target: NoticeTarget, notice: {
+        channel: string;
+        reference?: string | undefined;
+    }, actor: IncidentActor): Promise<Incident>;
+    /** Marks the incident as a drill (or not). */
+    markDrill(query: Query, scope: string, id: string, drill: boolean, actor: IncidentActor): Promise<Incident>;
+    /** Closes it: assessed, and both notices sent when the risk is serious. A closed entry is never edited again. */
+    close(query: Query, scope: string, id: string, actor: IncidentActor): Promise<Incident>;
+    get(query: Query, scope: string, id: string): Promise<Incident | null>;
+    /** The register of the scope. */
+    list(query: Query, scope: string): Promise<Incident[]>;
+    exportRegister(query: Query, scope: string): Promise<RegisterDocument>;
+}
+declare const INCIDENT_CODE: {
+    readonly badInput: "INCIDENT_BAD_INPUT";
+    readonly unknown: "INCIDENT_UNKNOWN";
+    readonly closed: "INCIDENT_CLOSED";
+    readonly notAssessed: "INCIDENT_NOT_ASSESSED";
+    readonly noNoticeDue: "INCIDENT_NO_NOTICE_DUE";
+    readonly noticesMissing: "INCIDENT_NOTICES_MISSING";
+};
+type IncidentCode = (typeof INCIDENT_CODE)[keyof typeof INCIDENT_CODE];
+declare class IncidentError extends Error {
+    readonly code: IncidentCode;
+    constructor(code: IncidentCode, message: string);
+}
+/**
+ * A guide for the person in charge, never the decision: the injury is serious when the information is sensitive and misuse is not
+ * unlikely, when the consequences are severe and misuse is likely, or when everything is at least medium and misuse is likely.
+ */
+declare function suggestSeriousInjury(factors: Pick<AssessmentInput, "sensitivity" | "consequences" | "likelihood">): boolean;
+/** Five years after the enterprise became aware of the incident (the Regulation's minimum for keeping the register). */
+declare function retainUntil(awareAt: Date): Date;
+declare const REGISTER_CSV_COLUMNS: readonly ["id", "kind", "aware_at", "occurred_at", "description", "information", "persons_concerned", "serious_injury", "assessed_at", "cai_notice_at", "persons_notice_at", "measures", "status", "drill", "closed_at", "retain_until"];
+/** The register as CSV (RFC 4180), cells that a spreadsheet would read as a formula are quoted with a leading apostrophe. */
+declare function registerToCsv(entries: readonly Incident[]): string;
+
+export { type AuditPort as A, type RegisterDocument as B, type ConsentInput as C, type RequestKind as D, type ExportDocument as E, type RequestStatus as F, registerToCsv as G, retainUntil as H, type IncidentStore as I, suggestSeriousInjury as J, LEVEL as L, NOTICE_TARGET as N, type OutboxPort as O, type PrivacyContributor as P, REGISTER_CSV_COLUMNS as R, type Subject as S, type IncidentDeps as a, type IncidentRegister as b, type PrivacyStore as c, type ConsentRecord as d, type PrivacyRequest as e, type AssessmentInput as f, INCIDENT_CODE as g, INCIDENT_KIND as h, INCIDENT_STATUS as i, type Incident as j, type IncidentActor as k, type IncidentAssessment as l, type IncidentCode as m, IncidentError as n, type IncidentInput as o, type IncidentKind as p, type IncidentMeasure as q, type IncidentNotice as r, type IncidentStatus as s, type Level as t, type NoticeTarget as u, PRIVACY_CODE as v, type PrivacyCode as w, PrivacyError as x, REQUEST_KIND as y, REQUEST_STATUS as z };

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import * as _krizaka_db from '@krizaka/db';
 import { Query, Clock } from '@krizaka/db';
 export { Clock, Query } from '@krizaka/db';
-import { P as PrivacyContributor, a as PrivacyStore, C as ConsentInput, b as ConsentRecord, S as Subject, E as ExportDocument, c as PrivacyRequest, A as AuditPort, O as OutboxPort } from './port-Ds9VVyC2.js';
-export { d as PRIVACY_CODE, e as PrivacyCode, f as PrivacyError, R as REQUEST_KIND, g as REQUEST_STATUS, h as RequestKind, i as RequestStatus } from './port-Ds9VVyC2.js';
+import { P as PrivacyContributor, I as IncidentStore, a as IncidentDeps, b as IncidentRegister, c as PrivacyStore, C as ConsentInput, d as ConsentRecord, S as Subject, E as ExportDocument, e as PrivacyRequest, A as AuditPort, O as OutboxPort } from './incident-DLXCVzpW.js';
+export { f as AssessmentInput, g as INCIDENT_CODE, h as INCIDENT_KIND, i as INCIDENT_STATUS, j as Incident, k as IncidentActor, l as IncidentAssessment, m as IncidentCode, n as IncidentError, o as IncidentInput, p as IncidentKind, q as IncidentMeasure, r as IncidentNotice, s as IncidentStatus, L as LEVEL, t as Level, N as NOTICE_TARGET, u as NoticeTarget, v as PRIVACY_CODE, w as PrivacyCode, x as PrivacyError, R as REGISTER_CSV_COLUMNS, y as REQUEST_KIND, z as REQUEST_STATUS, B as RegisterDocument, D as RequestKind, F as RequestStatus, G as registerToCsv, H as retainUntil, J as suggestSeriousInjury } from './incident-DLXCVzpW.js';
 
 /** The structural slice of `@krizaka/audit` that contributes: what the trail holds about an actor, and detaching them from it. */
 interface AuditTrail {
@@ -18,6 +18,18 @@ declare function auditContributor(audit: AuditTrail, options?: {
     kind?: string;
 }): PrivacyContributor;
 
+/** An in-memory incident store, for unit tests and demos (the contract kit runs on it and on the database's). */
+declare function memoryIncidentStore(): IncidentStore;
+
+/** The PostgreSQL incident store, over the `Query` it is given (the caller's transaction). `schema`: default `privacy`. */
+declare function dbIncidentStore(query: Query, schema?: string): IncidentStore;
+
+/**
+ * The confidentiality incident register of a product (Loi 25, ss. 3.5 to 3.8). Every call is by scope (the tenant), and a closed
+ * entry is never edited again; the database refuses to delete an entry before its retention ends.
+ */
+declare function createIncidentRegister(deps: IncidentDeps): IncidentRegister;
+
 /** An in-memory store, for unit tests and demos (the same behaviour as the database's: the contract kit runs on both). */
 declare function memoryPrivacyStore(): PrivacyStore;
 
@@ -102,4 +114,4 @@ declare function checkPurpose(purpose: string): void;
  */
 declare const privacySchema: _krizaka_db.ModuleSchema;
 
-export { AuditPort, type AuditTrail, ConsentInput, ConsentRecord, ExportDocument, OutboxPort, type Privacy, PrivacyContributor, type PrivacyDeps, PrivacyRequest, PrivacyStore, Subject, type Transaction, auditContributor, checkPurpose, checkSubject, createPrivacy, dbPrivacyStore, memoryPrivacyStore, privacySchema };
+export { AuditPort, type AuditTrail, ConsentInput, ConsentRecord, ExportDocument, IncidentDeps, IncidentRegister, IncidentStore, OutboxPort, type Privacy, PrivacyContributor, type PrivacyDeps, PrivacyRequest, PrivacyStore, Subject, type Transaction, auditContributor, checkPurpose, checkSubject, createIncidentRegister, createPrivacy, dbIncidentStore, dbPrivacyStore, memoryIncidentStore, memoryPrivacyStore, privacySchema };

package/dist/index.js

@@ -21,6 +21,245 @@ function auditContributor(audit, options = {}) {
   };
 }
 
+// src/incident.ts
+var INCIDENT_KIND = { access: "access", use: "use", communication: "communication", loss: "loss" };
+var INCIDENT_STATUS = { open: "open", assessed: "assessed", closed: "closed" };
+var LEVEL = { low: "low", medium: "medium", high: "high" };
+var NOTICE_TARGET = { cai: "cai", persons: "persons" };
+var INCIDENT_CODE = {
+  badInput: "INCIDENT_BAD_INPUT",
+  unknown: "INCIDENT_UNKNOWN",
+  closed: "INCIDENT_CLOSED",
+  notAssessed: "INCIDENT_NOT_ASSESSED",
+  noNoticeDue: "INCIDENT_NO_NOTICE_DUE",
+  noticesMissing: "INCIDENT_NOTICES_MISSING"
+};
+var IncidentError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "IncidentError";
+  }
+  code;
+};
+var RANK = { low: 0, medium: 1, high: 2 };
+function suggestSeriousInjury(factors) {
+  const { sensitivity, consequences, likelihood } = { sensitivity: RANK[factors.sensitivity], consequences: RANK[factors.consequences], likelihood: RANK[factors.likelihood] };
+  if (sensitivity === RANK.high && likelihood >= RANK.medium) return true;
+  if (consequences === RANK.high && likelihood === RANK.high) return true;
+  return sensitivity >= RANK.medium && consequences >= RANK.medium && likelihood === RANK.high;
+}
+function retainUntil(awareAt) {
+  const until = new Date(awareAt);
+  until.setUTCFullYear(until.getUTCFullYear() + 5);
+  return until;
+}
+var FORMULA = /^[=+\-@\t\r]/;
+var cell = (value) => {
+  const text = value === null || value === void 0 ? "" : value instanceof Date ? value.toISOString() : String(value);
+  const safe = FORMULA.test(text) ? `'${text}` : text;
+  return /[",\n\r]/.test(safe) ? `"${safe.replaceAll('"', '""')}"` : safe;
+};
+var REGISTER_CSV_COLUMNS = ["id", "kind", "aware_at", "occurred_at", "description", "information", "persons_concerned", "serious_injury", "assessed_at", "cai_notice_at", "persons_notice_at", "measures", "status", "drill", "closed_at", "retain_until"];
+function registerToCsv(entries) {
+  const rows = entries.map(
+    (e) => [e.id, e.kind, e.awareAt, e.occurredAt, e.description, e.information.join("; "), e.personsConcerned, e.assessment?.seriousInjury ?? "", e.assessment?.assessedAt ?? "", e.caiNotice?.sentAt ?? "", e.personsNotice?.sentAt ?? "", e.measures.map((m) => m.text).join("; "), e.status, e.drill, e.closedAt, e.retainUntil].map(cell).join(",")
+  );
+  return [REGISTER_CSV_COLUMNS.join(","), ...rows].join("\r\n") + "\r\n";
+}
+
+// src/incident-memory.ts
+function memoryIncidentStore() {
+  const rows = /* @__PURE__ */ new Map();
+  const key = (scope, id) => `${scope}\0${id}`;
+  return {
+    async insert(incident) {
+      rows.set(key(incident.scope, incident.id), structuredClone(incident));
+    },
+    async save(incident) {
+      const k = key(incident.scope, incident.id);
+      const current = rows.get(k);
+      if (!current) return;
+      if (current.status === INCIDENT_STATUS.closed) throw new Error("a closed incident is never edited");
+      rows.set(k, structuredClone(incident));
+    },
+    async get(scope, id) {
+      const found = rows.get(key(scope, id));
+      return found ? structuredClone(found) : null;
+    },
+    async list(scope) {
+      return [...rows.values()].filter((i) => i.scope === scope).sort((a, b) => a.awareAt.valueOf() - b.awareAt.valueOf() || a.id.localeCompare(b.id)).map((i) => structuredClone(i));
+    }
+  };
+}
+
+// src/incident-persistence.ts
+import { ident } from "@krizaka/db";
+var COLUMNS = "id, scope, kind, aware_at, occurred_at, description, information, persons_concerned, measures, status, assessment, cai_notice, persons_notice, drill, opened_by, opened_at, closed_at, retain_until";
+var optional = (stamp) => stamp === null ? null : new Date(stamp);
+var toNotice = (n) => n ? { sentAt: new Date(n.sentAt), channel: n.channel, reference: n.reference } : null;
+var toAssessment = (a) => a ? { ...a, assessedAt: new Date(a.assessedAt) } : null;
+var toIncident = (r) => ({
+  id: r.id,
+  scope: r.scope,
+  kind: r.kind,
+  awareAt: new Date(r.aware_at),
+  occurredAt: optional(r.occurred_at),
+  description: r.description,
+  information: r.information,
+  personsConcerned: r.persons_concerned,
+  measures: r.measures.map((m) => ({ at: new Date(m.at), text: m.text })),
+  status: r.status,
+  assessment: toAssessment(r.assessment),
+  caiNotice: toNotice(r.cai_notice),
+  personsNotice: toNotice(r.persons_notice),
+  drill: r.drill,
+  openedBy: r.opened_by,
+  openedAt: new Date(r.opened_at),
+  closedAt: optional(r.closed_at),
+  retainUntil: new Date(r.retain_until)
+});
+var json = (value) => value === null ? null : JSON.stringify(value);
+function dbIncidentStore(query, schema = "privacy") {
+  const table = `${ident(schema)}.incident`;
+  const values = (i) => [i.id, i.scope, i.kind, i.awareAt, i.occurredAt, i.description, i.information, i.personsConcerned, JSON.stringify(i.measures), i.status, json(i.assessment), json(i.caiNotice), json(i.personsNotice), i.drill, i.openedBy, i.openedAt, i.closedAt, i.retainUntil];
+  return {
+    async insert(i) {
+      await query(`INSERT INTO ${table} (${COLUMNS}) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::jsonb, $10, $11::jsonb, $12::jsonb, $13::jsonb, $14, $15, $16, $17, $18)`, values(i));
+    },
+    async save(i) {
+      await query(
+        `UPDATE ${table} SET kind = $3, aware_at = $4, occurred_at = $5, description = $6, information = $7, persons_concerned = $8, measures = $9::jsonb, status = $10, assessment = $11::jsonb, cai_notice = $12::jsonb, persons_notice = $13::jsonb, drill = $14, opened_by = $15, opened_at = $16, closed_at = $17, retain_until = $18 WHERE scope = $2 AND id = $1`,
+        values(i)
+      );
+    },
+    async get(scope, id, options) {
+      const [row] = await query(`SELECT ${COLUMNS} FROM ${table} WHERE scope = $1 AND id = $2${options?.lock ? " FOR UPDATE" : ""}`, [scope, id]);
+      return row ? toIncident(row) : null;
+    },
+    async list(scope) {
+      return (await query(`SELECT ${COLUMNS} FROM ${table} WHERE scope = $1 ORDER BY aware_at, id`, [scope])).map(toIncident);
+    }
+  };
+}
+
+// src/incidents.ts
+import { randomUUID } from "crypto";
+import { ident as ident2 } from "@krizaka/db";
+var bad = (message) => new IncidentError(INCIDENT_CODE.badInput, message);
+var within = (value, max, what) => {
+  if (value.trim().length < 1 || value.length > max) throw bad(`${what}: 1 to ${max} characters`);
+};
+var KINDS = Object.values(INCIDENT_KIND);
+var LEVELS = Object.values(LEVEL);
+function checkScope(scope) {
+  within(scope, 100, "scope");
+}
+function createIncidentRegister(deps) {
+  const schema = ident2(deps.schema ?? "privacy");
+  const storeFor = deps.storeFor ?? ((query) => dbIncidentStore(query, schema));
+  async function trace(query, actor, action, incident) {
+    await deps.audit?.record(query, { actorId: actor.id, actorLabel: actor.label, action: `privacy.incident_${action}`, target: { type: "incident", id: incident.id }, detail: { scope: incident.scope, drill: incident.drill } });
+  }
+  async function update(query, scope, id, action, actor, change) {
+    checkScope(scope);
+    const store = storeFor(query);
+    const incident = await store.get(scope, id, { lock: true });
+    if (!incident) throw new IncidentError(INCIDENT_CODE.unknown, "no such incident in this register");
+    if (incident.status === INCIDENT_STATUS.closed) throw new IncidentError(INCIDENT_CODE.closed, "a closed entry of the register is never edited");
+    change(incident);
+    await store.save(incident);
+    await trace(query, actor, action, incident);
+    return incident;
+  }
+  return {
+    async open(query, input, actor) {
+      checkScope(input.scope);
+      if (!KINDS.includes(input.kind)) throw bad(`kind \xAB ${input.kind} \xBB is not one of ${KINDS.join(", ")}`);
+      within(input.description, 2e3, "description");
+      if (input.information.length < 1 || input.information.length > 30) throw bad("information: 1 to 30 categories");
+      for (const category of input.information) within(category, 80, "information category");
+      if (input.personsConcerned !== void 0 && (!Number.isInteger(input.personsConcerned) || input.personsConcerned < 0)) throw bad("personsConcerned: a whole number, 0 or more");
+      const now = deps.clock.now();
+      const awareAt = input.awareAt ?? now;
+      if (awareAt.valueOf() > now.valueOf()) throw bad("awareAt cannot be in the future");
+      if (input.occurredAt && input.occurredAt.valueOf() > now.valueOf()) throw bad("occurredAt cannot be in the future");
+      const incident = {
+        id: randomUUID(),
+        scope: input.scope,
+        kind: input.kind,
+        awareAt,
+        occurredAt: input.occurredAt ?? null,
+        description: input.description,
+        information: [...input.information],
+        personsConcerned: input.personsConcerned ?? null,
+        measures: [],
+        status: INCIDENT_STATUS.open,
+        assessment: null,
+        caiNotice: null,
+        personsNotice: null,
+        drill: input.drill ?? false,
+        openedBy: actor.label,
+        openedAt: now,
+        closedAt: null,
+        retainUntil: retainUntil(awareAt)
+      };
+      await storeFor(query).insert(incident);
+      await trace(query, actor, "opened", incident);
+      return incident;
+    },
+    assess(query, scope, id, input, actor) {
+      for (const level of [input.sensitivity, input.consequences, input.likelihood]) if (!LEVELS.includes(level)) throw bad(`level \xAB ${level} \xBB is not one of ${LEVELS.join(", ")}`);
+      within(input.rationale, 2e3, "rationale");
+      return update(query, scope, id, "assessed", actor, (incident) => {
+        incident.assessment = { ...input, assessedAt: deps.clock.now(), assessedBy: actor.label };
+        incident.status = INCIDENT_STATUS.assessed;
+      });
+    },
+    recordMeasure(query, scope, id, text, actor) {
+      within(text, 1e3, "measure");
+      return update(query, scope, id, "measure_recorded", actor, (incident) => {
+        incident.measures.push({ at: deps.clock.now(), text });
+      });
+    },
+    recordNotice(query, scope, id, target, notice, actor) {
+      within(notice.channel, 40, "channel");
+      return update(query, scope, id, `notice_${target}`, actor, (incident) => {
+        if (!incident.assessment) throw new IncidentError(INCIDENT_CODE.notAssessed, "assess the risk before notifying");
+        if (!incident.assessment.seriousInjury) throw new IncidentError(INCIDENT_CODE.noNoticeDue, "no notice is due: the assessment found no risk of serious injury");
+        const sent = { sentAt: deps.clock.now(), channel: notice.channel, reference: notice.reference ?? null };
+        if (target === NOTICE_TARGET.cai) incident.caiNotice = sent;
+        else incident.personsNotice = sent;
+      });
+    },
+    markDrill(query, scope, id, drill, actor) {
+      return update(query, scope, id, "drill_marked", actor, (incident) => {
+        incident.drill = drill;
+      });
+    },
+    close(query, scope, id, actor) {
+      return update(query, scope, id, "closed", actor, (incident) => {
+        if (!incident.assessment) throw new IncidentError(INCIDENT_CODE.notAssessed, "assess the risk before closing");
+        if (incident.assessment.seriousInjury && (!incident.caiNotice || !incident.personsNotice)) throw new IncidentError(INCIDENT_CODE.noticesMissing, "a risk of serious injury is closed once the Commission and the people concerned are notified");
+        incident.status = INCIDENT_STATUS.closed;
+        incident.closedAt = deps.clock.now();
+      });
+    },
+    async get(query, scope, id) {
+      checkScope(scope);
+      return storeFor(query).get(scope, id);
+    },
+    async list(query, scope) {
+      checkScope(scope);
+      return storeFor(query).list(scope);
+    },
+    async exportRegister(query, scope) {
+      checkScope(scope);
+      return { format: 1, scope, generatedAt: deps.clock.now().toISOString(), entries: await storeFor(query).list(scope) };
+    }
+  };
+}
+
 // src/memory.ts
 var sameSubject = (a, b) => a.kind === b.kind && a.id === b.id;
 function memoryPrivacyStore() {
@@ -55,14 +294,14 @@ function memoryPrivacyStore() {
 }
 
 // src/persistence.ts
-import { ident } from "@krizaka/db";
+import { ident as ident3 } from "@krizaka/db";
 var toConsent = (r) => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, purpose: r.purpose, version: r.version, granted: r.granted, means: r.means, at: new Date(r.at) });
 var toRequest = (r) => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, kind: r.kind, status: r.status, requestedAt: new Date(r.requested_at), completedAt: r.completed_at === null ? null : new Date(r.completed_at), failure: r.failure });
 var CONSENT_COLUMNS = "id, subject_kind, subject_id, purpose, version, granted, means, at";
 var REQUEST_COLUMNS = "id, subject_kind, subject_id, kind, status, requested_at, completed_at, failure";
 function dbPrivacyStore(query, schema = "privacy") {
-  const consent = `${ident(schema)}.consent`;
-  const request = `${ident(schema)}.request`;
+  const consent = `${ident3(schema)}.consent`;
+  const request = `${ident3(schema)}.request`;
   const same = (subject) => [subject.kind, subject.id];
   return {
     async insertConsent(c) {
@@ -92,13 +331,13 @@ function dbPrivacyStore(query, schema = "privacy") {
 }
 
 // src/privacy.ts
-import { randomUUID } from "crypto";
-import { ident as ident2 } from "@krizaka/db";
+import { randomUUID as randomUUID2 } from "crypto";
+import { ident as ident4 } from "@krizaka/db";
 import { subHours } from "@krizaka/time";
 var FAILURE_CODE = "CONTRIBUTOR_FAILED";
 var ERASURE_VERSION = "erasure";
 function createPrivacy(deps) {
-  const schema = ident2(deps.schema ?? "privacy");
+  const schema = ident4(deps.schema ?? "privacy");
   const storeFor = deps.storeFor ?? ((query) => dbPrivacyStore(query, schema));
   for (const purpose of deps.purposes) checkPurpose(purpose);
   const names = deps.contributors.map((c) => c.name);
@@ -115,13 +354,13 @@ function createPrivacy(deps) {
     }
     return { format: 1, subject, generatedAt: deps.clock.now().toISOString(), modules };
   }
-  const newRequest = (subject, kind) => ({ id: randomUUID(), subject, kind, status: REQUEST_STATUS.requested, requestedAt: deps.clock.now(), completedAt: null, failure: null });
+  const newRequest = (subject, kind) => ({ id: randomUUID2(), subject, kind, status: REQUEST_STATUS.requested, requestedAt: deps.clock.now(), completedAt: null, failure: null });
   async function recordConsent(query, input) {
     checkSubject(input.subject);
     checkPurpose(input.purpose);
     if (!known.has(input.purpose)) throw new PrivacyError(PRIVACY_CODE.badPurpose, `purpose \xAB ${input.purpose} \xBB is not one the product declared`);
     if (input.version.length < 1 || input.version.length > 100) throw new PrivacyError(PRIVACY_CODE.badConsent, "the notice version is 1 to 100 characters");
-    const record = { id: randomUUID(), subject: input.subject, purpose: input.purpose, version: input.version, granted: input.granted, means: input.means ?? null, at: deps.clock.now() };
+    const record = { id: randomUUID2(), subject: input.subject, purpose: input.purpose, version: input.version, granted: input.granted, means: input.means ?? null, at: deps.clock.now() };
     await storeFor(query).insertConsent(record);
     return record;
   }
@@ -261,20 +500,77 @@ CREATE TABLE ${c.schema}.request (
   failure      text CHECK (failure IS NULL OR char_length(failure) <= 100)
 );
 CREATE INDEX request_subject ON ${c.schema}.request (subject_kind, subject_id, requested_at DESC);`
+    },
+    {
+      version: 2,
+      name: "confidentiality incident register",
+      sql: (c) => `
+CREATE TABLE ${c.schema}.incident (
+  id                uuid PRIMARY KEY,
+  scope             text NOT NULL CHECK (char_length(scope) BETWEEN 1 AND 100),
+  kind              text NOT NULL CHECK (kind IN ('access', 'use', 'communication', 'loss')),
+  aware_at          timestamptz NOT NULL,
+  occurred_at       timestamptz,
+  description       text NOT NULL CHECK (char_length(description) BETWEEN 1 AND 2000),
+  information       text[] NOT NULL CHECK (cardinality(information) BETWEEN 1 AND 30),
+  persons_concerned integer CHECK (persons_concerned IS NULL OR persons_concerned >= 0),
+  measures          jsonb NOT NULL DEFAULT '[]',
+  status            text NOT NULL CHECK (status IN ('open', 'assessed', 'closed')),
+  assessment        jsonb,
+  cai_notice        jsonb,
+  persons_notice    jsonb,
+  drill             boolean NOT NULL DEFAULT false,
+  opened_by         text NOT NULL,
+  opened_at         timestamptz NOT NULL,
+  closed_at         timestamptz,
+  retain_until      timestamptz NOT NULL
+);
+CREATE INDEX incident_scope ON ${c.schema}.incident (scope, aware_at, id);
+CREATE FUNCTION ${c.schema}.incident_guard() RETURNS trigger LANGUAGE plpgsql AS $fn$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    IF OLD.retain_until > now() THEN
+      RAISE EXCEPTION 'an incident stays in the register until its retention ends' USING ERRCODE = 'restrict_violation';
+    END IF;
+    RETURN OLD;
+  END IF;
+  IF OLD.status = 'closed' THEN
+    RAISE EXCEPTION 'a closed entry of the register is never edited' USING ERRCODE = 'restrict_violation';
+  END IF;
+  IF NEW.id <> OLD.id OR NEW.scope <> OLD.scope THEN
+    RAISE EXCEPTION 'an incident never changes register' USING ERRCODE = 'restrict_violation';
+  END IF;
+  RETURN NEW;
+END;
+$fn$;
+CREATE TRIGGER incident_guard BEFORE UPDATE OR DELETE ON ${c.schema}.incident FOR EACH ROW EXECUTE FUNCTION ${c.schema}.incident_guard();`
     }
   ]
 });
 export {
+  INCIDENT_CODE,
+  INCIDENT_KIND,
+  INCIDENT_STATUS,
+  IncidentError,
+  LEVEL,
+  NOTICE_TARGET,
   PRIVACY_CODE,
   PrivacyError,
+  REGISTER_CSV_COLUMNS,
   REQUEST_KIND,
   REQUEST_STATUS,
   auditContributor,
   checkPurpose,
   checkSubject,
+  createIncidentRegister,
   createPrivacy,
+  dbIncidentStore,
   dbPrivacyStore,
+  memoryIncidentStore,
   memoryPrivacyStore,
-  privacySchema
+  privacySchema,
+  registerToCsv,
+  retainUntil,
+  suggestSeriousInjury
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/contributors.ts","../src/memory.ts","../src/persistence.ts","../src/privacy.ts","../src/schema.ts"],"sourcesContent":["import type { Query } from \"@krizaka/db\";\n\nimport type { PrivacyContributor } from \"./port\";\n\n/** The structural slice of `@krizaka/audit` that contributes: what the trail holds about an actor, and detaching them from it. */\nexport interface AuditTrail {\n  exportFor(query: Query, actorId: string): Promise<unknown>;\n  redactActor(query: Query, actorId: string): Promise<number>;\n}\n\n/**\n * `@krizaka/audit` as a contributor: an export lists the actor's entries; an erasure detaches the person (id and address removed, the\n * label « erased ») and keeps the facts. It applies to a subject of the kind the product's actors are (default `account`).\n * @param audit the product's audit (`createAudit(...)`)\n */\nexport function auditContributor(audit: AuditTrail, options: { kind?: string } = {}): PrivacyContributor {\n  const kind = options.kind ?? \"account\";\n  return {\n    name: \"audit\",\n    async exportFor(query, subject) {\n      return subject.kind === kind ? audit.exportFor(query, subject.id) : [];\n    },\n    async eraseFor(tx, subject) {\n      if (subject.kind === kind) await audit.redactActor(tx, subject.id);\n    },\n  };\n}\n","import type { ConsentRecord, PrivacyRequest, PrivacyStore, Subject } from \"./port\";\n\nconst sameSubject = (a: Subject, b: Subject) => a.kind === b.kind && a.id === b.id;\n\n/** An in-memory store, for unit tests and demos (the same behaviour as the database's: the contract kit runs on both). */\nexport function memoryPrivacyStore(): PrivacyStore {\n  const consents: ConsentRecord[] = [];\n  const requests = new Map<string, PrivacyRequest>();\n  return {\n    async insertConsent(c) {\n      consents.push(structuredClone(c));\n    },\n    async latestConsent(subject, purpose) {\n      const found = consents.filter((c) => sameSubject(c.subject, subject) && c.purpose === purpose).at(-1);\n      return found ? structuredClone(found) : null;\n    },\n    async consentHistory(subject) {\n      return consents.filter((c) => sameSubject(c.subject, subject)).map((c) => structuredClone(c));\n    },\n    async insertRequest(r) {\n      requests.set(r.id, structuredClone(r));\n    },\n    async getRequest(id) {\n      const found = requests.get(id);\n      return found ? structuredClone(found) : null;\n    },\n    async finishRequest(id, outcome) {\n      const found = requests.get(id);\n      if (found) Object.assign(found, { status: outcome.status, completedAt: outcome.at, failure: outcome.failure ?? null });\n    },\n    async requestsOf(subject) {\n      return [...requests.values()].filter((r) => sameSubject(r.subject, subject)).sort((a, b) => b.requestedAt.valueOf() - a.requestedAt.valueOf()).map((r) => structuredClone(r));\n    },\n  };\n}\n","import { ident, type Query } from \"@krizaka/db\";\n\nimport type { ConsentRecord, PrivacyRequest, PrivacyStore, RequestKind, RequestStatus, Subject } from \"./port\";\n\ninterface ConsentRow {\n  id: string;\n  subject_kind: string;\n  subject_id: string;\n  purpose: string;\n  version: string;\n  granted: boolean;\n  means: string | null;\n  at: Date | string;\n}\ninterface RequestRow {\n  id: string;\n  subject_kind: string;\n  subject_id: string;\n  kind: RequestKind;\n  status: RequestStatus;\n  requested_at: Date | string;\n  completed_at: Date | string | null;\n  failure: string | null;\n}\n\nconst toConsent = (r: ConsentRow): ConsentRecord => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, purpose: r.purpose, version: r.version, granted: r.granted, means: r.means, at: new Date(r.at) });\nconst toRequest = (r: RequestRow): PrivacyRequest => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, kind: r.kind, status: r.status, requestedAt: new Date(r.requested_at), completedAt: r.completed_at === null ? null : new Date(r.completed_at), failure: r.failure });\n\nconst CONSENT_COLUMNS = \"id, subject_kind, subject_id, purpose, version, granted, means, at\";\nconst REQUEST_COLUMNS = \"id, subject_kind, subject_id, kind, status, requested_at, completed_at, failure\";\n\n/**\n * The PostgreSQL store of « privacy », over the `Query` it is given (the caller's transaction, to join its unit of work).\n * @param schema the Postgres schema of the module, default `privacy`\n */\nexport function dbPrivacyStore(query: Query, schema = \"privacy\"): PrivacyStore {\n  const consent = `${ident(schema)}.consent`;\n  const request = `${ident(schema)}.request`;\n  const same = (subject: Subject) => [subject.kind, subject.id];\n  return {\n    async insertConsent(c) {\n      await query(`INSERT INTO ${consent} (id, subject_kind, subject_id, purpose, version, granted, means, at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [c.id, c.subject.kind, c.subject.id, c.purpose, c.version, c.granted, c.means, c.at]);\n    },\n    async latestConsent(subject, purpose) {\n      const [row] = await query<ConsentRow>(`SELECT ${CONSENT_COLUMNS} FROM ${consent} WHERE subject_kind = $1 AND subject_id = $2 AND purpose = $3 ORDER BY seq DESC LIMIT 1`, [...same(subject), purpose]);\n      return row ? toConsent(row) : null;\n    },\n    async consentHistory(subject) {\n      return (await query<ConsentRow>(`SELECT ${CONSENT_COLUMNS} FROM ${consent} WHERE subject_kind = $1 AND subject_id = $2 ORDER BY seq`, same(subject))).map(toConsent);\n    },\n    async insertRequest(r) {\n      await query(`INSERT INTO ${request} (id, subject_kind, subject_id, kind, status, requested_at, completed_at, failure) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [r.id, r.subject.kind, r.subject.id, r.kind, r.status, r.requestedAt, r.completedAt, r.failure]);\n    },\n    async getRequest(id) {\n      const [row] = await query<RequestRow>(`SELECT ${REQUEST_COLUMNS} FROM ${request} WHERE id = $1`, [id]);\n      return row ? toRequest(row) : null;\n    },\n    async finishRequest(id, outcome) {\n      await query(`UPDATE ${request} SET status = $2, completed_at = $3, failure = $4 WHERE id = $1`, [id, outcome.status, outcome.at, outcome.failure ?? null]);\n    },\n    async requestsOf(subject) {\n      return (await query<RequestRow>(`SELECT ${REQUEST_COLUMNS} FROM ${request} WHERE subject_kind = $1 AND subject_id = $2 ORDER BY requested_at DESC, id`, same(subject))).map(toRequest);\n    },\n  };\n}\n","import { randomUUID } from \"node:crypto\";\n\nimport { ident } from \"@krizaka/db\";\nimport { subHours } from \"@krizaka/time\";\n\nimport { dbPrivacyStore } from \"./persistence\";\nimport {\n  type AuditPort,\n  type Clock,\n  type ConsentInput,\n  type ConsentRecord,\n  type ExportDocument,\n  type OutboxPort,\n  PRIVACY_CODE,\n  type PrivacyContributor,\n  PrivacyError,\n  type PrivacyRequest,\n  type PrivacyStore,\n  type Query,\n  REQUEST_KIND,\n  REQUEST_STATUS,\n  type Subject,\n} from \"./port\";\nimport { checkPurpose, checkSubject } from \"./rules\";\n\n/** The product's unit of work: runs `work` on one connection, commits when it resolves, rolls back when it throws (`transaction` of `@krizaka/db`). */\nexport type Transaction = <T>(work: (tx: Query) => Promise<T>) => Promise<T>;\n\nexport interface PrivacyDeps {\n  clock: Clock;\n  /** Every module that holds personal data, and the product's own. Their names are the keys of the export. */\n  contributors: readonly PrivacyContributor[];\n  /** The purposes the product declares (`screening`, `marketing`). A consent for another is refused. */\n  purposes: readonly string[];\n  /** The product's transaction, for the erasure. */\n  transaction: Transaction;\n  /** How many days a purpose is kept: the settings `privacy.retention.<purpose>Days` (`retentionFromSettings`). `undefined` = no retention for it. */\n  retentionDays?: (purpose: string) => number | undefined | Promise<number | undefined>;\n  /** The audit trail: an erasure is recorded there without personal data. */\n  audit?: AuditPort;\n  /** The outbox: required for the asynchronous export of a large account (`requestExport`). */\n  outbox?: OutboxPort;\n  /** The store over a query. Default: the PostgreSQL store on schema `privacy`. */\n  storeFor?: (query: Query) => PrivacyStore;\n  /** The Postgres schema, when the product renamed the module's (used by the default store). */\n  schema?: string;\n}\n\nexport interface Privacy {\n  /** Writes a consent or a withdrawal. Never edits one. */\n  recordConsent(query: Query, input: ConsentInput): Promise<ConsentRecord>;\n  /** Whether the consent with the last word for this purpose is a yes. A person who never said anything has not consented. */\n  hasConsent(query: Query, subject: Subject, purpose: string): Promise<boolean>;\n  /** Every consent and withdrawal of the subject, oldest first. */\n  consentHistory(query: Query, subject: Subject): Promise<ConsentRecord[]>;\n  /** The export, at once: one document with a part per contributor. The request is recorded. */\n  exportSubject(query: Query, subject: Subject): Promise<ExportDocument>;\n  /**\n   * The export of a large account, asynchronously: records the request and appends a message to the outbox IN THE CALLER'S\n   * TRANSACTION (`tx`). A worker then calls `fulfilExport(requestId, deliver)`. The message holds the request id only.\n   */\n  requestExport(tx: Query, subject: Subject): Promise<{ requestId: string }>;\n  /** Assembles the export of a recorded request and hands it to `deliver` (store the file, mail a link); the request is completed after `deliver` returns. */\n  fulfilExport(query: Query, requestId: string, deliver: (document: ExportDocument, request: PrivacyRequest) => Promise<void>): Promise<void>;\n  /**\n   * Erases the subject from every contributor in ONE transaction, withdraws their live consents, and records the request and an\n   * audit entry that names no one. If a contributor fails nothing is erased, the request is recorded as failed, and the error is thrown.\n   */\n  eraseSubject(subject: Subject, options?: { noticeVersion?: string }): Promise<PrivacyRequest>;\n  /** Removes, for each purpose with a retention, what the contributors hold past it. Returns how many rows each purpose removed. */\n  purge(query: Query): Promise<Record<string, number>>;\n  /** The subject's requests, newest first. */\n  requests(query: Query, subject: Subject): Promise<PrivacyRequest[]>;\n}\n\nconst FAILURE_CODE = \"CONTRIBUTOR_FAILED\";\nconst ERASURE_VERSION = \"erasure\";\n\n/**\n * Privacy for a product (Loi 25).\n * @param deps the contributors, the purposes, the product's transaction and the clock\n * @throws PrivacyError for a purpose or a contributor name that is not well formed or appears twice\n */\nexport function createPrivacy(deps: PrivacyDeps): Privacy {\n  const schema = ident(deps.schema ?? \"privacy\");\n  const storeFor = deps.storeFor ?? ((query: Query) => dbPrivacyStore(query, schema));\n  for (const purpose of deps.purposes) checkPurpose(purpose);\n  const names = deps.contributors.map((c) => c.name);\n  if (new Set(names).size !== names.length) throw new PrivacyError(PRIVACY_CODE.contributorFailed, `two contributors have the same name: ${names.join(\", \")}`);\n  const known = new Set(deps.purposes);\n\n  async function assemble(query: Query, subject: Subject): Promise<ExportDocument> {\n    const modules: Record<string, unknown> = {};\n    for (const contributor of deps.contributors) {\n      try {\n        modules[contributor.name] = await contributor.exportFor(query, subject);\n      } catch (cause) {\n        throw new PrivacyError(PRIVACY_CODE.contributorFailed, `the export of « ${contributor.name} » failed`, { cause });\n      }\n    }\n    return { format: 1, subject, generatedAt: deps.clock.now().toISOString(), modules };\n  }\n\n  const newRequest = (subject: Subject, kind: PrivacyRequest[\"kind\"]): PrivacyRequest => ({ id: randomUUID(), subject, kind, status: REQUEST_STATUS.requested, requestedAt: deps.clock.now(), completedAt: null, failure: null });\n\n  async function recordConsent(query: Query, input: ConsentInput): Promise<ConsentRecord> {\n    checkSubject(input.subject);\n    checkPurpose(input.purpose);\n    if (!known.has(input.purpose)) throw new PrivacyError(PRIVACY_CODE.badPurpose, `purpose « ${input.purpose} » is not one the product declared`);\n    if (input.version.length < 1 || input.version.length > 100) throw new PrivacyError(PRIVACY_CODE.badConsent, \"the notice version is 1 to 100 characters\");\n    const record: ConsentRecord = { id: randomUUID(), subject: input.subject, purpose: input.purpose, version: input.version, granted: input.granted, means: input.means ?? null, at: deps.clock.now() };\n    await storeFor(query).insertConsent(record);\n    return record;\n  }\n\n  return {\n    recordConsent,\n    async hasConsent(query, subject, purpose) {\n      checkSubject(subject);\n      checkPurpose(purpose);\n      return (await storeFor(query).latestConsent(subject, purpose))?.granted === true;\n    },\n    async consentHistory(query, subject) {\n      checkSubject(subject);\n      return storeFor(query).consentHistory(subject);\n    },\n    async exportSubject(query, subject) {\n      checkSubject(subject);\n      const store = storeFor(query);\n      const request = newRequest(subject, REQUEST_KIND.export);\n      await store.insertRequest(request);\n      try {\n        const document = await assemble(query, subject);\n        await store.finishRequest(request.id, { status: REQUEST_STATUS.completed, at: deps.clock.now() });\n        return document;\n      } catch (error) {\n        await store.finishRequest(request.id, { status: REQUEST_STATUS.failed, at: deps.clock.now(), failure: FAILURE_CODE });\n        throw error;\n      }\n    },\n    async requestExport(tx, subject) {\n      checkSubject(subject);\n      if (!deps.outbox) throw new PrivacyError(PRIVACY_CODE.noOutbox, \"an asynchronous export needs the outbox\");\n      const request = newRequest(subject, REQUEST_KIND.export);\n      await storeFor(tx).insertRequest(request);\n      await deps.outbox.append(tx, { topic: \"privacy\", type: \"evt.privacy.export_requested.v1\", payload: { requestId: request.id }, id: request.id });\n      return { requestId: request.id };\n    },\n    async fulfilExport(query, requestId, deliver) {\n      const store = storeFor(query);\n      const request = await store.getRequest(requestId);\n      if (!request) throw new PrivacyError(PRIVACY_CODE.unknownRequest, `no request ${requestId}`);\n      if (request.kind !== REQUEST_KIND.export) throw new PrivacyError(PRIVACY_CODE.notAnExport, `request ${requestId} is not an export`);\n      if (request.status === REQUEST_STATUS.completed) throw new PrivacyError(PRIVACY_CODE.alreadyDone, `request ${requestId} is already completed`);\n      try {\n        await deliver(await assemble(query, request.subject), request);\n      } catch (error) {\n        await store.finishRequest(requestId, { status: REQUEST_STATUS.failed, at: deps.clock.now(), failure: FAILURE_CODE });\n        throw error;\n      }\n      await store.finishRequest(requestId, { status: REQUEST_STATUS.completed, at: deps.clock.now() });\n    },\n    async eraseSubject(subject, options = {}) {\n      checkSubject(subject);\n      const request = newRequest(subject, REQUEST_KIND.erasure);\n      try {\n        return await deps.transaction(async (tx) => {\n          const store = storeFor(tx);\n          await store.insertRequest(request);\n          for (const contributor of deps.contributors) {\n            try {\n              await contributor.eraseFor(tx, subject);\n            } catch (cause) {\n              throw new PrivacyError(PRIVACY_CODE.contributorFailed, `the erasure of « ${contributor.name} » failed`, { cause });\n            }\n          }\n          for (const purpose of deps.purposes) {\n            if ((await store.latestConsent(subject, purpose))?.granted) await recordConsent(tx, { subject, purpose, version: options.noticeVersion ?? ERASURE_VERSION, granted: false, means: ERASURE_VERSION });\n          }\n          const completedAt = deps.clock.now();\n          await store.finishRequest(request.id, { status: REQUEST_STATUS.completed, at: completedAt });\n          // the entry names the request and the modules, never the person\n          await deps.audit?.record(tx, { actorId: null, actorLabel: \"privacy\", action: \"privacy.erasure_completed\", target: { type: \"privacy_request\", id: request.id }, detail: { contributors: names } });\n          return { ...request, status: REQUEST_STATUS.completed, completedAt };\n        });\n      } catch (error) {\n        // the transaction rolled back, request row included: record the failure beside it, and never mask the original error\n        try {\n          await deps.transaction((tx) => storeFor(tx).insertRequest({ ...request, status: REQUEST_STATUS.failed, completedAt: deps.clock.now(), failure: FAILURE_CODE }));\n        } catch (recordFailure) {\n          throw new AggregateError([error, recordFailure], \"the erasure failed, and so did recording its failure\", { cause: recordFailure });\n        }\n        throw error;\n      }\n    },\n    async purge(query) {\n      const removed: Record<string, number> = {};\n      for (const purpose of deps.purposes) {\n        const days = await deps.retentionDays?.(purpose);\n        if (days === undefined) continue;\n        if (!Number.isInteger(days) || days < 1) throw new RangeError(`the retention of « ${purpose} » must be a whole number of days from 1, got ${days}`);\n        const before = subHours(deps.clock.now(), days * 24);\n        let total = 0;\n        for (const contributor of deps.contributors) total += (await contributor.purgeExpired?.(query, { purpose, before })) ?? 0;\n        removed[purpose] = total;\n      }\n      return removed;\n    },\n    async requests(query, subject) {\n      checkSubject(subject);\n      return storeFor(query).requestsOf(subject);\n    },\n  };\n}\n","import { defineModule } from \"@krizaka/db\";\n\n/**\n * The tables of « privacy », in their own Postgres schema (ADR-001 §3). They reference no product table: a subject is a kind and an\n * id the product chooses (an account, a client file, an application).\n *\n * - `consent` is WRITTEN ONCE: a trigger refuses any update. A withdrawal is a new row; the consent with the last word (highest `seq`) wins.\n * - `request` is the record of an export or an erasure: when, of what kind, how it ended. It holds an id and no other personal data,\n *   so it can outlive the erasure it proves.\n *\n * Version 1 is frozen once released: a change is version 2.\n */\nexport const privacySchema = defineModule({\n  module: \"privacy\",\n  migrations: [\n    {\n      version: 1,\n      name: \"consents and requests\",\n      sql: (c) => `\nCREATE TABLE ${c.schema}.consent (\n  seq          bigserial UNIQUE,\n  id           uuid PRIMARY KEY,\n  subject_kind text NOT NULL CHECK (subject_kind ~ '^[a-z][a-z0-9_]{0,39}$'),\n  subject_id   text NOT NULL CHECK (char_length(subject_id) BETWEEN 1 AND 200),\n  purpose      text NOT NULL CHECK (purpose ~ '^[a-z][a-z0-9_-]{0,39}$'),\n  version      text NOT NULL CHECK (char_length(version) BETWEEN 1 AND 100),\n  granted      boolean NOT NULL,\n  means        text CHECK (means IS NULL OR char_length(means) <= 40),\n  at           timestamptz NOT NULL\n);\nCREATE INDEX consent_subject ON ${c.schema}.consent (subject_kind, subject_id, purpose, seq DESC);\nCREATE FUNCTION ${c.schema}.consent_written_once() RETURNS trigger LANGUAGE plpgsql AS $fn$\nBEGIN\n  RAISE EXCEPTION 'a consent is written once: a withdrawal is a new row' USING ERRCODE = 'restrict_violation';\nEND;\n$fn$;\nCREATE TRIGGER consent_written_once BEFORE UPDATE ON ${c.schema}.consent FOR EACH ROW EXECUTE FUNCTION ${c.schema}.consent_written_once();\nCREATE TABLE ${c.schema}.request (\n  id           uuid PRIMARY KEY,\n  subject_kind text NOT NULL CHECK (subject_kind ~ '^[a-z][a-z0-9_]{0,39}$'),\n  subject_id   text NOT NULL CHECK (char_length(subject_id) BETWEEN 1 AND 200),\n  kind         text NOT NULL CHECK (kind IN ('export', 'erasure')),\n  status       text NOT NULL CHECK (status IN ('requested', 'completed', 'failed')),\n  requested_at timestamptz NOT NULL,\n  completed_at timestamptz,\n  failure      text CHECK (failure IS NULL OR char_length(failure) <= 100)\n);\nCREATE INDEX request_subject ON ${c.schema}.request (subject_kind, subject_id, requested_at DESC);`,\n    },\n  ],\n});\n"],"mappings":";;;;;;;;;;AAeO,SAAS,iBAAiB,OAAmB,UAA6B,CAAC,GAAuB;AACvG,QAAM,OAAO,QAAQ,QAAQ;AAC7B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,UAAU,OAAO,SAAS;AAC9B,aAAO,QAAQ,SAAS,OAAO,MAAM,UAAU,OAAO,QAAQ,EAAE,IAAI,CAAC;AAAA,IACvE;AAAA,IACA,MAAM,SAAS,IAAI,SAAS;AAC1B,UAAI,QAAQ,SAAS,KAAM,OAAM,MAAM,YAAY,IAAI,QAAQ,EAAE;AAAA,IACnE;AAAA,EACF;AACF;;;ACxBA,IAAM,cAAc,CAAC,GAAY,MAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;AAGzE,SAAS,qBAAmC;AACjD,QAAM,WAA4B,CAAC;AACnC,QAAM,WAAW,oBAAI,IAA4B;AACjD,SAAO;AAAA,IACL,MAAM,cAAc,GAAG;AACrB,eAAS,KAAK,gBAAgB,CAAC,CAAC;AAAA,IAClC;AAAA,IACA,MAAM,cAAc,SAAS,SAAS;AACpC,YAAM,QAAQ,SAAS,OAAO,CAAC,MAAM,YAAY,EAAE,SAAS,OAAO,KAAK,EAAE,YAAY,OAAO,EAAE,GAAG,EAAE;AACpG,aAAO,QAAQ,gBAAgB,KAAK,IAAI;AAAA,IAC1C;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,aAAO,SAAS,OAAO,CAAC,MAAM,YAAY,EAAE,SAAS,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAAA,IAC9F;AAAA,IACA,MAAM,cAAc,GAAG;AACrB,eAAS,IAAI,EAAE,IAAI,gBAAgB,CAAC,CAAC;AAAA,IACvC;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,QAAQ,SAAS,IAAI,EAAE;AAC7B,aAAO,QAAQ,gBAAgB,KAAK,IAAI;AAAA,IAC1C;AAAA,IACA,MAAM,cAAc,IAAI,SAAS;AAC/B,YAAM,QAAQ,SAAS,IAAI,EAAE;AAC7B,UAAI,MAAO,QAAO,OAAO,OAAO,EAAE,QAAQ,QAAQ,QAAQ,aAAa,QAAQ,IAAI,SAAS,QAAQ,WAAW,KAAK,CAAC;AAAA,IACvH;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,aAAO,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,YAAY,EAAE,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,QAAQ,IAAI,EAAE,YAAY,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAAA,IAC9K;AAAA,EACF;AACF;;;AClCA,SAAS,aAAyB;AAyBlC,IAAM,YAAY,CAAC,OAAkC,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,MAAM,EAAE,cAAc,IAAI,EAAE,WAAW,GAAG,SAAS,EAAE,SAAS,SAAS,EAAE,SAAS,SAAS,EAAE,SAAS,OAAO,EAAE,OAAO,IAAI,IAAI,KAAK,EAAE,EAAE,EAAE;AACrN,IAAM,YAAY,CAAC,OAAmC,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,MAAM,EAAE,cAAc,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,aAAa,IAAI,KAAK,EAAE,YAAY,GAAG,aAAa,EAAE,iBAAiB,OAAO,OAAO,IAAI,KAAK,EAAE,YAAY,GAAG,SAAS,EAAE,QAAQ;AAEzR,IAAM,kBAAkB;AACxB,IAAM,kBAAkB;AAMjB,SAAS,eAAe,OAAc,SAAS,WAAyB;AAC7E,QAAM,UAAU,GAAG,MAAM,MAAM,CAAC;AAChC,QAAM,UAAU,GAAG,MAAM,MAAM,CAAC;AAChC,QAAM,OAAO,CAAC,YAAqB,CAAC,QAAQ,MAAM,QAAQ,EAAE;AAC5D,SAAO;AAAA,IACL,MAAM,cAAc,GAAG;AACrB,YAAM,MAAM,eAAe,OAAO,iHAAiH,CAAC,EAAE,IAAI,EAAE,QAAQ,MAAM,EAAE,QAAQ,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;AAAA,IACzO;AAAA,IACA,MAAM,cAAc,SAAS,SAAS;AACpC,YAAM,CAAC,GAAG,IAAI,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,2FAA2F,CAAC,GAAG,KAAK,OAAO,GAAG,OAAO,CAAC;AACrM,aAAO,MAAM,UAAU,GAAG,IAAI;AAAA,IAChC;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,cAAQ,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,6DAA6D,KAAK,OAAO,CAAC,GAAG,IAAI,SAAS;AAAA,IACrK;AAAA,IACA,MAAM,cAAc,GAAG;AACrB,YAAM,MAAM,eAAe,OAAO,8HAA8H,CAAC,EAAE,IAAI,EAAE,QAAQ,MAAM,EAAE,QAAQ,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC;AAAA,IACjQ;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,CAAC,GAAG,IAAI,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,kBAAkB,CAAC,EAAE,CAAC;AACrG,aAAO,MAAM,UAAU,GAAG,IAAI;AAAA,IAChC;AAAA,IACA,MAAM,cAAc,IAAI,SAAS;AAC/B,YAAM,MAAM,UAAU,OAAO,mEAAmE,CAAC,IAAI,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,WAAW,IAAI,CAAC;AAAA,IAC3J;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,cAAQ,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,+EAA+E,KAAK,OAAO,CAAC,GAAG,IAAI,SAAS;AAAA,IACvL;AAAA,EACF;AACF;;;AChEA,SAAS,kBAAkB;AAE3B,SAAS,SAAAA,cAAa;AACtB,SAAS,gBAAgB;AAwEzB,IAAM,eAAe;AACrB,IAAM,kBAAkB;AAOjB,SAAS,cAAc,MAA4B;AACxD,QAAM,SAASC,OAAM,KAAK,UAAU,SAAS;AAC7C,QAAM,WAAW,KAAK,aAAa,CAAC,UAAiB,eAAe,OAAO,MAAM;AACjF,aAAW,WAAW,KAAK,SAAU,cAAa,OAAO;AACzD,QAAM,QAAQ,KAAK,aAAa,IAAI,CAAC,MAAM,EAAE,IAAI;AACjD,MAAI,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,OAAQ,OAAM,IAAI,aAAa,aAAa,mBAAmB,wCAAwC,MAAM,KAAK,IAAI,CAAC,EAAE;AAC3J,QAAM,QAAQ,IAAI,IAAI,KAAK,QAAQ;AAEnC,iBAAe,SAAS,OAAc,SAA2C;AAC/E,UAAM,UAAmC,CAAC;AAC1C,eAAW,eAAe,KAAK,cAAc;AAC3C,UAAI;AACF,gBAAQ,YAAY,IAAI,IAAI,MAAM,YAAY,UAAU,OAAO,OAAO;AAAA,MACxE,SAAS,OAAO;AACd,cAAM,IAAI,aAAa,aAAa,mBAAmB,sBAAmB,YAAY,IAAI,gBAAa,EAAE,MAAM,CAAC;AAAA,MAClH;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,GAAG,SAAS,aAAa,KAAK,MAAM,IAAI,EAAE,YAAY,GAAG,QAAQ;AAAA,EACpF;AAEA,QAAM,aAAa,CAAC,SAAkB,UAAkD,EAAE,IAAI,WAAW,GAAG,SAAS,MAAM,QAAQ,eAAe,WAAW,aAAa,KAAK,MAAM,IAAI,GAAG,aAAa,MAAM,SAAS,KAAK;AAE7N,iBAAe,cAAc,OAAc,OAA6C;AACtF,iBAAa,MAAM,OAAO;AAC1B,iBAAa,MAAM,OAAO;AAC1B,QAAI,CAAC,MAAM,IAAI,MAAM,OAAO,EAAG,OAAM,IAAI,aAAa,aAAa,YAAY,gBAAa,MAAM,OAAO,uCAAoC;AAC7I,QAAI,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,SAAS,IAAK,OAAM,IAAI,aAAa,aAAa,YAAY,2CAA2C;AACvJ,UAAM,SAAwB,EAAE,IAAI,WAAW,GAAG,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,MAAM,SAAS,MAAM,IAAI,KAAK,MAAM,IAAI,EAAE;AACnM,UAAM,SAAS,KAAK,EAAE,cAAc,MAAM;AAC1C,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,WAAW,OAAO,SAAS,SAAS;AACxC,mBAAa,OAAO;AACpB,mBAAa,OAAO;AACpB,cAAQ,MAAM,SAAS,KAAK,EAAE,cAAc,SAAS,OAAO,IAAI,YAAY;AAAA,IAC9E;AAAA,IACA,MAAM,eAAe,OAAO,SAAS;AACnC,mBAAa,OAAO;AACpB,aAAO,SAAS,KAAK,EAAE,eAAe,OAAO;AAAA,IAC/C;AAAA,IACA,MAAM,cAAc,OAAO,SAAS;AAClC,mBAAa,OAAO;AACpB,YAAM,QAAQ,SAAS,KAAK;AAC5B,YAAM,UAAU,WAAW,SAAS,aAAa,MAAM;AACvD,YAAM,MAAM,cAAc,OAAO;AACjC,UAAI;AACF,cAAM,WAAW,MAAM,SAAS,OAAO,OAAO;AAC9C,cAAM,MAAM,cAAc,QAAQ,IAAI,EAAE,QAAQ,eAAe,WAAW,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC;AAChG,eAAO;AAAA,MACT,SAAS,OAAO;AACd,cAAM,MAAM,cAAc,QAAQ,IAAI,EAAE,QAAQ,eAAe,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,aAAa,CAAC;AACpH,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,cAAc,IAAI,SAAS;AAC/B,mBAAa,OAAO;AACpB,UAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,aAAa,aAAa,UAAU,yCAAyC;AACzG,YAAM,UAAU,WAAW,SAAS,aAAa,MAAM;AACvD,YAAM,SAAS,EAAE,EAAE,cAAc,OAAO;AACxC,YAAM,KAAK,OAAO,OAAO,IAAI,EAAE,OAAO,WAAW,MAAM,mCAAmC,SAAS,EAAE,WAAW,QAAQ,GAAG,GAAG,IAAI,QAAQ,GAAG,CAAC;AAC9I,aAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,aAAa,OAAO,WAAW,SAAS;AAC5C,YAAM,QAAQ,SAAS,KAAK;AAC5B,YAAM,UAAU,MAAM,MAAM,WAAW,SAAS;AAChD,UAAI,CAAC,QAAS,OAAM,IAAI,aAAa,aAAa,gBAAgB,cAAc,SAAS,EAAE;AAC3F,UAAI,QAAQ,SAAS,aAAa,OAAQ,OAAM,IAAI,aAAa,aAAa,aAAa,WAAW,SAAS,mBAAmB;AAClI,UAAI,QAAQ,WAAW,eAAe,UAAW,OAAM,IAAI,aAAa,aAAa,aAAa,WAAW,SAAS,uBAAuB;AAC7I,UAAI;AACF,cAAM,QAAQ,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG,OAAO;AAAA,MAC/D,SAAS,OAAO;AACd,cAAM,MAAM,cAAc,WAAW,EAAE,QAAQ,eAAe,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,aAAa,CAAC;AACnH,cAAM;AAAA,MACR;AACA,YAAM,MAAM,cAAc,WAAW,EAAE,QAAQ,eAAe,WAAW,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACjG;AAAA,IACA,MAAM,aAAa,SAAS,UAAU,CAAC,GAAG;AACxC,mBAAa,OAAO;AACpB,YAAM,UAAU,WAAW,SAAS,aAAa,OAAO;AACxD,UAAI;AACF,eAAO,MAAM,KAAK,YAAY,OAAO,OAAO;AAC1C,gBAAM,QAAQ,SAAS,EAAE;AACzB,gBAAM,MAAM,cAAc,OAAO;AACjC,qBAAW,eAAe,KAAK,cAAc;AAC3C,gBAAI;AACF,oBAAM,YAAY,SAAS,IAAI,OAAO;AAAA,YACxC,SAAS,OAAO;AACd,oBAAM,IAAI,aAAa,aAAa,mBAAmB,uBAAoB,YAAY,IAAI,gBAAa,EAAE,MAAM,CAAC;AAAA,YACnH;AAAA,UACF;AACA,qBAAW,WAAW,KAAK,UAAU;AACnC,iBAAK,MAAM,MAAM,cAAc,SAAS,OAAO,IAAI,QAAS,OAAM,cAAc,IAAI,EAAE,SAAS,SAAS,SAAS,QAAQ,iBAAiB,iBAAiB,SAAS,OAAO,OAAO,gBAAgB,CAAC;AAAA,UACrM;AACA,gBAAM,cAAc,KAAK,MAAM,IAAI;AACnC,gBAAM,MAAM,cAAc,QAAQ,IAAI,EAAE,QAAQ,eAAe,WAAW,IAAI,YAAY,CAAC;AAE3F,gBAAM,KAAK,OAAO,OAAO,IAAI,EAAE,SAAS,MAAM,YAAY,WAAW,QAAQ,6BAA6B,QAAQ,EAAE,MAAM,mBAAmB,IAAI,QAAQ,GAAG,GAAG,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC;AAChM,iBAAO,EAAE,GAAG,SAAS,QAAQ,eAAe,WAAW,YAAY;AAAA,QACrE,CAAC;AAAA,MACH,SAAS,OAAO;AAEd,YAAI;AACF,gBAAM,KAAK,YAAY,CAAC,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,GAAG,SAAS,QAAQ,eAAe,QAAQ,aAAa,KAAK,MAAM,IAAI,GAAG,SAAS,aAAa,CAAC,CAAC;AAAA,QAChK,SAAS,eAAe;AACtB,gBAAM,IAAI,eAAe,CAAC,OAAO,aAAa,GAAG,wDAAwD,EAAE,OAAO,cAAc,CAAC;AAAA,QACnI;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,MAAM,OAAO;AACjB,YAAM,UAAkC,CAAC;AACzC,iBAAW,WAAW,KAAK,UAAU;AACnC,cAAM,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAC/C,YAAI,SAAS,OAAW;AACxB,YAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,EAAG,OAAM,IAAI,WAAW,yBAAsB,OAAO,oDAAiD,IAAI,EAAE;AAClJ,cAAM,SAAS,SAAS,KAAK,MAAM,IAAI,GAAG,OAAO,EAAE;AACnD,YAAI,QAAQ;AACZ,mBAAW,eAAe,KAAK,aAAc,UAAU,MAAM,YAAY,eAAe,OAAO,EAAE,SAAS,OAAO,CAAC,KAAM;AACxH,gBAAQ,OAAO,IAAI;AAAA,MACrB;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,SAAS,OAAO,SAAS;AAC7B,mBAAa,OAAO;AACpB,aAAO,SAAS,KAAK,EAAE,WAAW,OAAO;AAAA,IAC3C;AAAA,EACF;AACF;;;ACrNA,SAAS,oBAAoB;AAYtB,IAAM,gBAAgB,aAAa;AAAA,EACxC,QAAQ;AAAA,EACR,YAAY;AAAA,IACV;AAAA,MACE,SAAS;AAAA,MACT,MAAM;AAAA,MACN,KAAK,CAAC,MAAM;AAAA,eACH,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAWW,EAAE,MAAM;AAAA,kBACxB,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,uDAK6B,EAAE,MAAM,0CAA0C,EAAE,MAAM;AAAA,eAClG,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAUW,EAAE,MAAM;AAAA,IACtC;AAAA,EACF;AACF,CAAC;","names":["ident","ident"]}
+{"version":3,"sources":["../src/contributors.ts","../src/incident.ts","../src/incident-memory.ts","../src/incident-persistence.ts","../src/incidents.ts","../src/memory.ts","../src/persistence.ts","../src/privacy.ts","../src/schema.ts"],"sourcesContent":["import type { Query } from \"@krizaka/db\";\n\nimport type { PrivacyContributor } from \"./port\";\n\n/** The structural slice of `@krizaka/audit` that contributes: what the trail holds about an actor, and detaching them from it. */\nexport interface AuditTrail {\n  exportFor(query: Query, actorId: string): Promise<unknown>;\n  redactActor(query: Query, actorId: string): Promise<number>;\n}\n\n/**\n * `@krizaka/audit` as a contributor: an export lists the actor's entries; an erasure detaches the person (id and address removed, the\n * label « erased ») and keeps the facts. It applies to a subject of the kind the product's actors are (default `account`).\n * @param audit the product's audit (`createAudit(...)`)\n */\nexport function auditContributor(audit: AuditTrail, options: { kind?: string } = {}): PrivacyContributor {\n  const kind = options.kind ?? \"account\";\n  return {\n    name: \"audit\",\n    async exportFor(query, subject) {\n      return subject.kind === kind ? audit.exportFor(query, subject.id) : [];\n    },\n    async eraseFor(tx, subject) {\n      if (subject.kind === kind) await audit.redactActor(tx, subject.id);\n    },\n  };\n}\n","import type { AuditPort, Clock, Query } from \"./port\";\n\n/**\n * The confidentiality incident register (Loi 25). Act respecting the protection of personal information in the private sector\n * (CQLR c. P-39.1), ss. 3.5 to 3.8, and the Regulation respecting confidentiality incidents (CQLR c. P-39.1, r. 3.1): see the README\n * for the links. The register holds the facts of an incident and NO personal data of the people concerned (only how many, and which\n * categories of information).\n */\n\n/** What happened to the information (the Act speaks of unauthorised access, use, communication and loss). */\nexport const INCIDENT_KIND = { access: \"access\", use: \"use\", communication: \"communication\", loss: \"loss\" } as const;\nexport type IncidentKind = (typeof INCIDENT_KIND)[keyof typeof INCIDENT_KIND];\n\nexport const INCIDENT_STATUS = { open: \"open\", assessed: \"assessed\", closed: \"closed\" } as const;\nexport type IncidentStatus = (typeof INCIDENT_STATUS)[keyof typeof INCIDENT_STATUS];\n\nexport const LEVEL = { low: \"low\", medium: \"medium\", high: \"high\" } as const;\nexport type Level = (typeof LEVEL)[keyof typeof LEVEL];\n\nexport const NOTICE_TARGET = { cai: \"cai\", persons: \"persons\" } as const;\nexport type NoticeTarget = (typeof NOTICE_TARGET)[keyof typeof NOTICE_TARGET];\n\n/** The three factors of the risk assessment (s. 3.6) and the decision of the person in charge. */\nexport interface IncidentAssessment {\n  /** How sensitive the information is. */\n  sensitivity: Level;\n  /** How serious the anticipated consequences of its use are. */\n  consequences: Level;\n  /** How likely it is to be misused. */\n  likelihood: Level;\n  /** The decision: a risk of serious injury means notifying the Commission d'accès à l'information and the people concerned. */\n  seriousInjury: boolean;\n  rationale: string;\n  assessedAt: Date;\n  assessedBy: string;\n}\n\n/** A notice sent, to the Commission or to the people concerned. */\nexport interface IncidentNotice {\n  sentAt: Date;\n  /** How it was sent (`form`, `email`, `letter`, `public`). */\n  channel: string;\n  /** The Commission's acknowledgement, if any. */\n  reference: string | null;\n}\n\nexport interface IncidentMeasure {\n  at: Date;\n  text: string;\n}\n\n/** One register entry: an incident, from the day the enterprise became aware of it. */\nexport interface Incident {\n  id: string;\n  /** Whose register it is: a tenant, an organisation. Entries of another scope are never read. */\n  scope: string;\n  kind: IncidentKind;\n  /** When the enterprise became aware of it: the start of the retention. */\n  awareAt: Date;\n  occurredAt: Date | null;\n  description: string;\n  /** The categories of information concerned (`lease`, `pay stub`), never the information. */\n  information: string[];\n  /** How many people are concerned, null while unknown. */\n  personsConcerned: number | null;\n  measures: IncidentMeasure[];\n  status: IncidentStatus;\n  assessment: IncidentAssessment | null;\n  caiNotice: IncidentNotice | null;\n  personsNotice: IncidentNotice | null;\n  /** A fictitious incident, run to prove the procedure. It stays in the register, marked. */\n  drill: boolean;\n  openedBy: string;\n  openedAt: Date;\n  closedAt: Date | null;\n  /** The register entry cannot be deleted before this date: five years after `awareAt`. */\n  retainUntil: Date;\n}\n\nexport interface IncidentInput {\n  scope: string;\n  kind: IncidentKind;\n  awareAt?: Date | undefined;\n  occurredAt?: Date | undefined;\n  description: string;\n  information: readonly string[];\n  personsConcerned?: number | undefined;\n  drill?: boolean | undefined;\n}\n\nexport interface AssessmentInput {\n  sensitivity: Level;\n  consequences: Level;\n  likelihood: Level;\n  seriousInjury: boolean;\n  rationale: string;\n}\n\n/** Where the register lives. Every adapter runs `incidentStoreContract` (`@krizaka/privacy/testkit`). Every read is by scope. */\nexport interface IncidentStore {\n  insert(incident: Incident): Promise<void>;\n  /** Replaces an incident that is not closed. */\n  save(incident: Incident): Promise<void>;\n  /** `lock`: for the read-then-write of one incident (`FOR UPDATE`). */\n  get(scope: string, id: string, options?: { lock?: boolean }): Promise<Incident | null>;\n  /** The whole register of the scope, oldest awareness first. */\n  list(scope: string): Promise<Incident[]>;\n}\n\nexport interface IncidentActor {\n  /** An opaque id (an admin account). */\n  id: string | null;\n  label: string;\n}\n\nexport interface IncidentDeps {\n  clock: Clock;\n  audit?: AuditPort;\n  storeFor?: (query: Query) => IncidentStore;\n  /** The Postgres schema, when the product renamed the module's. */\n  schema?: string;\n}\n\n/** The register as handed to the Commission on request: one document, the entries oldest first. */\nexport interface RegisterDocument {\n  format: 1;\n  scope: string;\n  generatedAt: string;\n  entries: Incident[];\n}\n\nexport interface IncidentRegister {\n  /** Opens an incident (s. 3.5: as soon as there is reason to believe one occurred). */\n  open(query: Query, input: IncidentInput, actor: IncidentActor): Promise<Incident>;\n  /** Writes the risk assessment (s. 3.6); it can be redone until the incident is closed. */\n  assess(query: Query, scope: string, id: string, input: AssessmentInput, actor: IncidentActor): Promise<Incident>;\n  /** Records a measure taken to reduce the risk and prevent a new incident (s. 3.5). */\n  recordMeasure(query: Query, scope: string, id: string, text: string, actor: IncidentActor): Promise<Incident>;\n  /** Records a notice sent. Only an incident assessed as a risk of serious injury is notified. */\n  recordNotice(query: Query, scope: string, id: string, target: NoticeTarget, notice: { channel: string; reference?: string | undefined }, actor: IncidentActor): Promise<Incident>;\n  /** Marks the incident as a drill (or not). */\n  markDrill(query: Query, scope: string, id: string, drill: boolean, actor: IncidentActor): Promise<Incident>;\n  /** Closes it: assessed, and both notices sent when the risk is serious. A closed entry is never edited again. */\n  close(query: Query, scope: string, id: string, actor: IncidentActor): Promise<Incident>;\n  get(query: Query, scope: string, id: string): Promise<Incident | null>;\n  /** The register of the scope. */\n  list(query: Query, scope: string): Promise<Incident[]>;\n  exportRegister(query: Query, scope: string): Promise<RegisterDocument>;\n}\n\nexport const INCIDENT_CODE = {\n  badInput: \"INCIDENT_BAD_INPUT\",\n  unknown: \"INCIDENT_UNKNOWN\",\n  closed: \"INCIDENT_CLOSED\",\n  notAssessed: \"INCIDENT_NOT_ASSESSED\",\n  noNoticeDue: \"INCIDENT_NO_NOTICE_DUE\",\n  noticesMissing: \"INCIDENT_NOTICES_MISSING\",\n} as const;\nexport type IncidentCode = (typeof INCIDENT_CODE)[keyof typeof INCIDENT_CODE];\n\nexport class IncidentError extends Error {\n  constructor(\n    readonly code: IncidentCode,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"IncidentError\";\n  }\n}\n\nconst RANK: Record<Level, number> = { low: 0, medium: 1, high: 2 };\n\n/**\n * A guide for the person in charge, never the decision: the injury is serious when the information is sensitive and misuse is not\n * unlikely, when the consequences are severe and misuse is likely, or when everything is at least medium and misuse is likely.\n */\nexport function suggestSeriousInjury(factors: Pick<AssessmentInput, \"sensitivity\" | \"consequences\" | \"likelihood\">): boolean {\n  const { sensitivity, consequences, likelihood } = { sensitivity: RANK[factors.sensitivity], consequences: RANK[factors.consequences], likelihood: RANK[factors.likelihood] };\n  if (sensitivity === RANK.high && likelihood >= RANK.medium) return true;\n  if (consequences === RANK.high && likelihood === RANK.high) return true;\n  return sensitivity >= RANK.medium && consequences >= RANK.medium && likelihood === RANK.high;\n}\n\n/** Five years after the enterprise became aware of the incident (the Regulation's minimum for keeping the register). */\nexport function retainUntil(awareAt: Date): Date {\n  const until = new Date(awareAt);\n  until.setUTCFullYear(until.getUTCFullYear() + 5);\n  return until;\n}\n\nconst FORMULA = /^[=+\\-@\\t\\r]/;\nconst cell = (value: unknown): string => {\n  const text = value === null || value === undefined ? \"\" : value instanceof Date ? value.toISOString() : String(value);\n  const safe = FORMULA.test(text) ? `'${text}` : text;\n  return /[\",\\n\\r]/.test(safe) ? `\"${safe.replaceAll('\"', '\"\"')}\"` : safe;\n};\nexport const REGISTER_CSV_COLUMNS = [\"id\", \"kind\", \"aware_at\", \"occurred_at\", \"description\", \"information\", \"persons_concerned\", \"serious_injury\", \"assessed_at\", \"cai_notice_at\", \"persons_notice_at\", \"measures\", \"status\", \"drill\", \"closed_at\", \"retain_until\"] as const;\n\n/** The register as CSV (RFC 4180), cells that a spreadsheet would read as a formula are quoted with a leading apostrophe. */\nexport function registerToCsv(entries: readonly Incident[]): string {\n  const rows = entries.map((e) =>\n    [e.id, e.kind, e.awareAt, e.occurredAt, e.description, e.information.join(\"; \"), e.personsConcerned, e.assessment?.seriousInjury ?? \"\", e.assessment?.assessedAt ?? \"\", e.caiNotice?.sentAt ?? \"\", e.personsNotice?.sentAt ?? \"\", e.measures.map((m) => m.text).join(\"; \"), e.status, e.drill, e.closedAt, e.retainUntil].map(cell).join(\",\"),\n  );\n  return [REGISTER_CSV_COLUMNS.join(\",\"), ...rows].join(\"\\r\\n\") + \"\\r\\n\";\n}\n","import { type Incident, INCIDENT_STATUS, type IncidentStore } from \"./incident\";\n\n/** An in-memory incident store, for unit tests and demos (the contract kit runs on it and on the database's). */\nexport function memoryIncidentStore(): IncidentStore {\n  const rows = new Map<string, Incident>();\n  const key = (scope: string, id: string) => `${scope}\\u0000${id}`;\n  return {\n    async insert(incident) {\n      rows.set(key(incident.scope, incident.id), structuredClone(incident));\n    },\n    async save(incident) {\n      const k = key(incident.scope, incident.id);\n      const current = rows.get(k);\n      if (!current) return; // like an UPDATE that matches nothing\n      if (current.status === INCIDENT_STATUS.closed) throw new Error(\"a closed incident is never edited\");\n      rows.set(k, structuredClone(incident));\n    },\n    async get(scope, id) {\n      const found = rows.get(key(scope, id));\n      return found ? structuredClone(found) : null;\n    },\n    async list(scope) {\n      return [...rows.values()].filter((i) => i.scope === scope).sort((a, b) => a.awareAt.valueOf() - b.awareAt.valueOf() || a.id.localeCompare(b.id)).map((i) => structuredClone(i));\n    },\n  };\n}\n","import { ident, type Query } from \"@krizaka/db\";\n\nimport type { Incident, IncidentAssessment, IncidentKind, IncidentMeasure, IncidentNotice, IncidentStatus, IncidentStore, Level } from \"./incident\";\n\ntype Stamp = Date | string;\ninterface IncidentRow {\n  id: string;\n  scope: string;\n  kind: IncidentKind;\n  aware_at: Stamp;\n  occurred_at: Stamp | null;\n  description: string;\n  information: string[];\n  persons_concerned: number | null;\n  measures: { at: string; text: string }[];\n  status: IncidentStatus;\n  assessment: { sensitivity: Level; consequences: Level; likelihood: Level; seriousInjury: boolean; rationale: string; assessedAt: string; assessedBy: string } | null;\n  cai_notice: { sentAt: string; channel: string; reference: string | null } | null;\n  persons_notice: { sentAt: string; channel: string; reference: string | null } | null;\n  drill: boolean;\n  opened_by: string;\n  opened_at: Stamp;\n  closed_at: Stamp | null;\n  retain_until: Stamp;\n}\n\nconst COLUMNS = \"id, scope, kind, aware_at, occurred_at, description, information, persons_concerned, measures, status, assessment, cai_notice, persons_notice, drill, opened_by, opened_at, closed_at, retain_until\";\nconst optional = (stamp: Stamp | null) => (stamp === null ? null : new Date(stamp));\nconst toNotice = (n: IncidentRow[\"cai_notice\"]): IncidentNotice | null => (n ? { sentAt: new Date(n.sentAt), channel: n.channel, reference: n.reference } : null);\nconst toAssessment = (a: IncidentRow[\"assessment\"]): IncidentAssessment | null => (a ? { ...a, assessedAt: new Date(a.assessedAt) } : null);\n\nconst toIncident = (r: IncidentRow): Incident => ({\n  id: r.id,\n  scope: r.scope,\n  kind: r.kind,\n  awareAt: new Date(r.aware_at),\n  occurredAt: optional(r.occurred_at),\n  description: r.description,\n  information: r.information,\n  personsConcerned: r.persons_concerned,\n  measures: r.measures.map((m): IncidentMeasure => ({ at: new Date(m.at), text: m.text })),\n  status: r.status,\n  assessment: toAssessment(r.assessment),\n  caiNotice: toNotice(r.cai_notice),\n  personsNotice: toNotice(r.persons_notice),\n  drill: r.drill,\n  openedBy: r.opened_by,\n  openedAt: new Date(r.opened_at),\n  closedAt: optional(r.closed_at),\n  retainUntil: new Date(r.retain_until),\n});\n\nconst json = (value: unknown) => (value === null ? null : JSON.stringify(value));\n\n/** The PostgreSQL incident store, over the `Query` it is given (the caller's transaction). `schema`: default `privacy`. */\nexport function dbIncidentStore(query: Query, schema = \"privacy\"): IncidentStore {\n  const table = `${ident(schema)}.incident`;\n  const values = (i: Incident) => [i.id, i.scope, i.kind, i.awareAt, i.occurredAt, i.description, i.information, i.personsConcerned, JSON.stringify(i.measures), i.status, json(i.assessment), json(i.caiNotice), json(i.personsNotice), i.drill, i.openedBy, i.openedAt, i.closedAt, i.retainUntil];\n  return {\n    async insert(i) {\n      await query(`INSERT INTO ${table} (${COLUMNS}) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::jsonb, $10, $11::jsonb, $12::jsonb, $13::jsonb, $14, $15, $16, $17, $18)`, values(i));\n    },\n    async save(i) {\n      await query(\n        `UPDATE ${table} SET kind = $3, aware_at = $4, occurred_at = $5, description = $6, information = $7, persons_concerned = $8, measures = $9::jsonb, status = $10, assessment = $11::jsonb, cai_notice = $12::jsonb, persons_notice = $13::jsonb, drill = $14, opened_by = $15, opened_at = $16, closed_at = $17, retain_until = $18 WHERE scope = $2 AND id = $1`,\n        values(i),\n      );\n    },\n    async get(scope, id, options) {\n      const [row] = await query<IncidentRow>(`SELECT ${COLUMNS} FROM ${table} WHERE scope = $1 AND id = $2${options?.lock ? \" FOR UPDATE\" : \"\"}`, [scope, id]);\n      return row ? toIncident(row) : null;\n    },\n    async list(scope) {\n      return (await query<IncidentRow>(`SELECT ${COLUMNS} FROM ${table} WHERE scope = $1 ORDER BY aware_at, id`, [scope])).map(toIncident);\n    },\n  };\n}\n","import { randomUUID } from \"node:crypto\";\n\nimport { ident } from \"@krizaka/db\";\n\nimport {\n  type AssessmentInput,\n  type Incident,\n  INCIDENT_CODE,\n  INCIDENT_KIND,\n  INCIDENT_STATUS,\n  type IncidentActor,\n  type IncidentDeps,\n  IncidentError,\n  type IncidentInput,\n  type IncidentRegister,\n  LEVEL,\n  NOTICE_TARGET,\n  retainUntil,\n} from \"./incident\";\nimport { dbIncidentStore } from \"./incident-persistence\";\nimport type { Query } from \"./port\";\n\nconst bad = (message: string) => new IncidentError(INCIDENT_CODE.badInput, message);\nconst within = (value: string, max: number, what: string) => {\n  if (value.trim().length < 1 || value.length > max) throw bad(`${what}: 1 to ${max} characters`);\n};\nconst KINDS: readonly string[] = Object.values(INCIDENT_KIND);\nconst LEVELS: readonly string[] = Object.values(LEVEL);\n\nfunction checkScope(scope: string) {\n  within(scope, 100, \"scope\");\n}\n\n/**\n * The confidentiality incident register of a product (Loi 25, ss. 3.5 to 3.8). Every call is by scope (the tenant), and a closed\n * entry is never edited again; the database refuses to delete an entry before its retention ends.\n */\nexport function createIncidentRegister(deps: IncidentDeps): IncidentRegister {\n  const schema = ident(deps.schema ?? \"privacy\");\n  const storeFor = deps.storeFor ?? ((query: Query) => dbIncidentStore(query, schema));\n\n  async function trace(query: Query, actor: IncidentActor, action: string, incident: Incident) {\n    await deps.audit?.record(query, { actorId: actor.id, actorLabel: actor.label, action: `privacy.incident_${action}`, target: { type: \"incident\", id: incident.id }, detail: { scope: incident.scope, drill: incident.drill } });\n  }\n\n  /** Reads the incident under lock, applies `change` to a copy, saves it, traces it. */\n  async function update(query: Query, scope: string, id: string, action: string, actor: IncidentActor, change: (incident: Incident) => void): Promise<Incident> {\n    checkScope(scope);\n    const store = storeFor(query);\n    const incident = await store.get(scope, id, { lock: true });\n    if (!incident) throw new IncidentError(INCIDENT_CODE.unknown, \"no such incident in this register\");\n    if (incident.status === INCIDENT_STATUS.closed) throw new IncidentError(INCIDENT_CODE.closed, \"a closed entry of the register is never edited\");\n    change(incident);\n    await store.save(incident);\n    await trace(query, actor, action, incident);\n    return incident;\n  }\n\n  return {\n    async open(query, input: IncidentInput, actor) {\n      checkScope(input.scope);\n      if (!KINDS.includes(input.kind)) throw bad(`kind « ${input.kind} » is not one of ${KINDS.join(\", \")}`);\n      within(input.description, 2000, \"description\");\n      if (input.information.length < 1 || input.information.length > 30) throw bad(\"information: 1 to 30 categories\");\n      for (const category of input.information) within(category, 80, \"information category\");\n      if (input.personsConcerned !== undefined && (!Number.isInteger(input.personsConcerned) || input.personsConcerned < 0)) throw bad(\"personsConcerned: a whole number, 0 or more\");\n      const now = deps.clock.now();\n      const awareAt = input.awareAt ?? now;\n      if (awareAt.valueOf() > now.valueOf()) throw bad(\"awareAt cannot be in the future\");\n      if (input.occurredAt && input.occurredAt.valueOf() > now.valueOf()) throw bad(\"occurredAt cannot be in the future\");\n      const incident: Incident = {\n        id: randomUUID(),\n        scope: input.scope,\n        kind: input.kind,\n        awareAt,\n        occurredAt: input.occurredAt ?? null,\n        description: input.description,\n        information: [...input.information],\n        personsConcerned: input.personsConcerned ?? null,\n        measures: [],\n        status: INCIDENT_STATUS.open,\n        assessment: null,\n        caiNotice: null,\n        personsNotice: null,\n        drill: input.drill ?? false,\n        openedBy: actor.label,\n        openedAt: now,\n        closedAt: null,\n        retainUntil: retainUntil(awareAt),\n      };\n      await storeFor(query).insert(incident);\n      await trace(query, actor, \"opened\", incident);\n      return incident;\n    },\n    assess(query, scope, id, input: AssessmentInput, actor) {\n      for (const level of [input.sensitivity, input.consequences, input.likelihood]) if (!LEVELS.includes(level)) throw bad(`level « ${level} » is not one of ${LEVELS.join(\", \")}`);\n      within(input.rationale, 2000, \"rationale\");\n      return update(query, scope, id, \"assessed\", actor, (incident) => {\n        incident.assessment = { ...input, assessedAt: deps.clock.now(), assessedBy: actor.label };\n        incident.status = INCIDENT_STATUS.assessed;\n      });\n    },\n    recordMeasure(query, scope, id, text, actor) {\n      within(text, 1000, \"measure\");\n      return update(query, scope, id, \"measure_recorded\", actor, (incident) => {\n        incident.measures.push({ at: deps.clock.now(), text });\n      });\n    },\n    recordNotice(query, scope, id, target, notice, actor) {\n      within(notice.channel, 40, \"channel\");\n      return update(query, scope, id, `notice_${target}`, actor, (incident) => {\n        if (!incident.assessment) throw new IncidentError(INCIDENT_CODE.notAssessed, \"assess the risk before notifying\");\n        if (!incident.assessment.seriousInjury) throw new IncidentError(INCIDENT_CODE.noNoticeDue, \"no notice is due: the assessment found no risk of serious injury\");\n        const sent = { sentAt: deps.clock.now(), channel: notice.channel, reference: notice.reference ?? null };\n        if (target === NOTICE_TARGET.cai) incident.caiNotice = sent;\n        else incident.personsNotice = sent;\n      });\n    },\n    markDrill(query, scope, id, drill, actor) {\n      return update(query, scope, id, \"drill_marked\", actor, (incident) => {\n        incident.drill = drill;\n      });\n    },\n    close(query, scope, id, actor) {\n      return update(query, scope, id, \"closed\", actor, (incident) => {\n        if (!incident.assessment) throw new IncidentError(INCIDENT_CODE.notAssessed, \"assess the risk before closing\");\n        if (incident.assessment.seriousInjury && (!incident.caiNotice || !incident.personsNotice)) throw new IncidentError(INCIDENT_CODE.noticesMissing, \"a risk of serious injury is closed once the Commission and the people concerned are notified\");\n        incident.status = INCIDENT_STATUS.closed;\n        incident.closedAt = deps.clock.now();\n      });\n    },\n    async get(query, scope, id) {\n      checkScope(scope);\n      return storeFor(query).get(scope, id);\n    },\n    async list(query, scope) {\n      checkScope(scope);\n      return storeFor(query).list(scope);\n    },\n    async exportRegister(query, scope) {\n      checkScope(scope);\n      return { format: 1, scope, generatedAt: deps.clock.now().toISOString(), entries: await storeFor(query).list(scope) };\n    },\n  };\n}\n","import type { ConsentRecord, PrivacyRequest, PrivacyStore, Subject } from \"./port\";\n\nconst sameSubject = (a: Subject, b: Subject) => a.kind === b.kind && a.id === b.id;\n\n/** An in-memory store, for unit tests and demos (the same behaviour as the database's: the contract kit runs on both). */\nexport function memoryPrivacyStore(): PrivacyStore {\n  const consents: ConsentRecord[] = [];\n  const requests = new Map<string, PrivacyRequest>();\n  return {\n    async insertConsent(c) {\n      consents.push(structuredClone(c));\n    },\n    async latestConsent(subject, purpose) {\n      const found = consents.filter((c) => sameSubject(c.subject, subject) && c.purpose === purpose).at(-1);\n      return found ? structuredClone(found) : null;\n    },\n    async consentHistory(subject) {\n      return consents.filter((c) => sameSubject(c.subject, subject)).map((c) => structuredClone(c));\n    },\n    async insertRequest(r) {\n      requests.set(r.id, structuredClone(r));\n    },\n    async getRequest(id) {\n      const found = requests.get(id);\n      return found ? structuredClone(found) : null;\n    },\n    async finishRequest(id, outcome) {\n      const found = requests.get(id);\n      if (found) Object.assign(found, { status: outcome.status, completedAt: outcome.at, failure: outcome.failure ?? null });\n    },\n    async requestsOf(subject) {\n      return [...requests.values()].filter((r) => sameSubject(r.subject, subject)).sort((a, b) => b.requestedAt.valueOf() - a.requestedAt.valueOf()).map((r) => structuredClone(r));\n    },\n  };\n}\n","import { ident, type Query } from \"@krizaka/db\";\n\nimport type { ConsentRecord, PrivacyRequest, PrivacyStore, RequestKind, RequestStatus, Subject } from \"./port\";\n\ninterface ConsentRow {\n  id: string;\n  subject_kind: string;\n  subject_id: string;\n  purpose: string;\n  version: string;\n  granted: boolean;\n  means: string | null;\n  at: Date | string;\n}\ninterface RequestRow {\n  id: string;\n  subject_kind: string;\n  subject_id: string;\n  kind: RequestKind;\n  status: RequestStatus;\n  requested_at: Date | string;\n  completed_at: Date | string | null;\n  failure: string | null;\n}\n\nconst toConsent = (r: ConsentRow): ConsentRecord => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, purpose: r.purpose, version: r.version, granted: r.granted, means: r.means, at: new Date(r.at) });\nconst toRequest = (r: RequestRow): PrivacyRequest => ({ id: r.id, subject: { kind: r.subject_kind, id: r.subject_id }, kind: r.kind, status: r.status, requestedAt: new Date(r.requested_at), completedAt: r.completed_at === null ? null : new Date(r.completed_at), failure: r.failure });\n\nconst CONSENT_COLUMNS = \"id, subject_kind, subject_id, purpose, version, granted, means, at\";\nconst REQUEST_COLUMNS = \"id, subject_kind, subject_id, kind, status, requested_at, completed_at, failure\";\n\n/**\n * The PostgreSQL store of « privacy », over the `Query` it is given (the caller's transaction, to join its unit of work).\n * @param schema the Postgres schema of the module, default `privacy`\n */\nexport function dbPrivacyStore(query: Query, schema = \"privacy\"): PrivacyStore {\n  const consent = `${ident(schema)}.consent`;\n  const request = `${ident(schema)}.request`;\n  const same = (subject: Subject) => [subject.kind, subject.id];\n  return {\n    async insertConsent(c) {\n      await query(`INSERT INTO ${consent} (id, subject_kind, subject_id, purpose, version, granted, means, at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [c.id, c.subject.kind, c.subject.id, c.purpose, c.version, c.granted, c.means, c.at]);\n    },\n    async latestConsent(subject, purpose) {\n      const [row] = await query<ConsentRow>(`SELECT ${CONSENT_COLUMNS} FROM ${consent} WHERE subject_kind = $1 AND subject_id = $2 AND purpose = $3 ORDER BY seq DESC LIMIT 1`, [...same(subject), purpose]);\n      return row ? toConsent(row) : null;\n    },\n    async consentHistory(subject) {\n      return (await query<ConsentRow>(`SELECT ${CONSENT_COLUMNS} FROM ${consent} WHERE subject_kind = $1 AND subject_id = $2 ORDER BY seq`, same(subject))).map(toConsent);\n    },\n    async insertRequest(r) {\n      await query(`INSERT INTO ${request} (id, subject_kind, subject_id, kind, status, requested_at, completed_at, failure) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [r.id, r.subject.kind, r.subject.id, r.kind, r.status, r.requestedAt, r.completedAt, r.failure]);\n    },\n    async getRequest(id) {\n      const [row] = await query<RequestRow>(`SELECT ${REQUEST_COLUMNS} FROM ${request} WHERE id = $1`, [id]);\n      return row ? toRequest(row) : null;\n    },\n    async finishRequest(id, outcome) {\n      await query(`UPDATE ${request} SET status = $2, completed_at = $3, failure = $4 WHERE id = $1`, [id, outcome.status, outcome.at, outcome.failure ?? null]);\n    },\n    async requestsOf(subject) {\n      return (await query<RequestRow>(`SELECT ${REQUEST_COLUMNS} FROM ${request} WHERE subject_kind = $1 AND subject_id = $2 ORDER BY requested_at DESC, id`, same(subject))).map(toRequest);\n    },\n  };\n}\n","import { randomUUID } from \"node:crypto\";\n\nimport { ident } from \"@krizaka/db\";\nimport { subHours } from \"@krizaka/time\";\n\nimport { dbPrivacyStore } from \"./persistence\";\nimport {\n  type AuditPort,\n  type Clock,\n  type ConsentInput,\n  type ConsentRecord,\n  type ExportDocument,\n  type OutboxPort,\n  PRIVACY_CODE,\n  type PrivacyContributor,\n  PrivacyError,\n  type PrivacyRequest,\n  type PrivacyStore,\n  type Query,\n  REQUEST_KIND,\n  REQUEST_STATUS,\n  type Subject,\n} from \"./port\";\nimport { checkPurpose, checkSubject } from \"./rules\";\n\n/** The product's unit of work: runs `work` on one connection, commits when it resolves, rolls back when it throws (`transaction` of `@krizaka/db`). */\nexport type Transaction = <T>(work: (tx: Query) => Promise<T>) => Promise<T>;\n\nexport interface PrivacyDeps {\n  clock: Clock;\n  /** Every module that holds personal data, and the product's own. Their names are the keys of the export. */\n  contributors: readonly PrivacyContributor[];\n  /** The purposes the product declares (`screening`, `marketing`). A consent for another is refused. */\n  purposes: readonly string[];\n  /** The product's transaction, for the erasure. */\n  transaction: Transaction;\n  /** How many days a purpose is kept: the settings `privacy.retention.<purpose>Days` (`retentionFromSettings`). `undefined` = no retention for it. */\n  retentionDays?: (purpose: string) => number | undefined | Promise<number | undefined>;\n  /** The audit trail: an erasure is recorded there without personal data. */\n  audit?: AuditPort;\n  /** The outbox: required for the asynchronous export of a large account (`requestExport`). */\n  outbox?: OutboxPort;\n  /** The store over a query. Default: the PostgreSQL store on schema `privacy`. */\n  storeFor?: (query: Query) => PrivacyStore;\n  /** The Postgres schema, when the product renamed the module's (used by the default store). */\n  schema?: string;\n}\n\nexport interface Privacy {\n  /** Writes a consent or a withdrawal. Never edits one. */\n  recordConsent(query: Query, input: ConsentInput): Promise<ConsentRecord>;\n  /** Whether the consent with the last word for this purpose is a yes. A person who never said anything has not consented. */\n  hasConsent(query: Query, subject: Subject, purpose: string): Promise<boolean>;\n  /** Every consent and withdrawal of the subject, oldest first. */\n  consentHistory(query: Query, subject: Subject): Promise<ConsentRecord[]>;\n  /** The export, at once: one document with a part per contributor. The request is recorded. */\n  exportSubject(query: Query, subject: Subject): Promise<ExportDocument>;\n  /**\n   * The export of a large account, asynchronously: records the request and appends a message to the outbox IN THE CALLER'S\n   * TRANSACTION (`tx`). A worker then calls `fulfilExport(requestId, deliver)`. The message holds the request id only.\n   */\n  requestExport(tx: Query, subject: Subject): Promise<{ requestId: string }>;\n  /** Assembles the export of a recorded request and hands it to `deliver` (store the file, mail a link); the request is completed after `deliver` returns. */\n  fulfilExport(query: Query, requestId: string, deliver: (document: ExportDocument, request: PrivacyRequest) => Promise<void>): Promise<void>;\n  /**\n   * Erases the subject from every contributor in ONE transaction, withdraws their live consents, and records the request and an\n   * audit entry that names no one. If a contributor fails nothing is erased, the request is recorded as failed, and the error is thrown.\n   */\n  eraseSubject(subject: Subject, options?: { noticeVersion?: string }): Promise<PrivacyRequest>;\n  /** Removes, for each purpose with a retention, what the contributors hold past it. Returns how many rows each purpose removed. */\n  purge(query: Query): Promise<Record<string, number>>;\n  /** The subject's requests, newest first. */\n  requests(query: Query, subject: Subject): Promise<PrivacyRequest[]>;\n}\n\nconst FAILURE_CODE = \"CONTRIBUTOR_FAILED\";\nconst ERASURE_VERSION = \"erasure\";\n\n/**\n * Privacy for a product (Loi 25).\n * @param deps the contributors, the purposes, the product's transaction and the clock\n * @throws PrivacyError for a purpose or a contributor name that is not well formed or appears twice\n */\nexport function createPrivacy(deps: PrivacyDeps): Privacy {\n  const schema = ident(deps.schema ?? \"privacy\");\n  const storeFor = deps.storeFor ?? ((query: Query) => dbPrivacyStore(query, schema));\n  for (const purpose of deps.purposes) checkPurpose(purpose);\n  const names = deps.contributors.map((c) => c.name);\n  if (new Set(names).size !== names.length) throw new PrivacyError(PRIVACY_CODE.contributorFailed, `two contributors have the same name: ${names.join(\", \")}`);\n  const known = new Set(deps.purposes);\n\n  async function assemble(query: Query, subject: Subject): Promise<ExportDocument> {\n    const modules: Record<string, unknown> = {};\n    for (const contributor of deps.contributors) {\n      try {\n        modules[contributor.name] = await contributor.exportFor(query, subject);\n      } catch (cause) {\n        throw new PrivacyError(PRIVACY_CODE.contributorFailed, `the export of « ${contributor.name} » failed`, { cause });\n      }\n    }\n    return { format: 1, subject, generatedAt: deps.clock.now().toISOString(), modules };\n  }\n\n  const newRequest = (subject: Subject, kind: PrivacyRequest[\"kind\"]): PrivacyRequest => ({ id: randomUUID(), subject, kind, status: REQUEST_STATUS.requested, requestedAt: deps.clock.now(), completedAt: null, failure: null });\n\n  async function recordConsent(query: Query, input: ConsentInput): Promise<ConsentRecord> {\n    checkSubject(input.subject);\n    checkPurpose(input.purpose);\n    if (!known.has(input.purpose)) throw new PrivacyError(PRIVACY_CODE.badPurpose, `purpose « ${input.purpose} » is not one the product declared`);\n    if (input.version.length < 1 || input.version.length > 100) throw new PrivacyError(PRIVACY_CODE.badConsent, \"the notice version is 1 to 100 characters\");\n    const record: ConsentRecord = { id: randomUUID(), subject: input.subject, purpose: input.purpose, version: input.version, granted: input.granted, means: input.means ?? null, at: deps.clock.now() };\n    await storeFor(query).insertConsent(record);\n    return record;\n  }\n\n  return {\n    recordConsent,\n    async hasConsent(query, subject, purpose) {\n      checkSubject(subject);\n      checkPurpose(purpose);\n      return (await storeFor(query).latestConsent(subject, purpose))?.granted === true;\n    },\n    async consentHistory(query, subject) {\n      checkSubject(subject);\n      return storeFor(query).consentHistory(subject);\n    },\n    async exportSubject(query, subject) {\n      checkSubject(subject);\n      const store = storeFor(query);\n      const request = newRequest(subject, REQUEST_KIND.export);\n      await store.insertRequest(request);\n      try {\n        const document = await assemble(query, subject);\n        await store.finishRequest(request.id, { status: REQUEST_STATUS.completed, at: deps.clock.now() });\n        return document;\n      } catch (error) {\n        await store.finishRequest(request.id, { status: REQUEST_STATUS.failed, at: deps.clock.now(), failure: FAILURE_CODE });\n        throw error;\n      }\n    },\n    async requestExport(tx, subject) {\n      checkSubject(subject);\n      if (!deps.outbox) throw new PrivacyError(PRIVACY_CODE.noOutbox, \"an asynchronous export needs the outbox\");\n      const request = newRequest(subject, REQUEST_KIND.export);\n      await storeFor(tx).insertRequest(request);\n      await deps.outbox.append(tx, { topic: \"privacy\", type: \"evt.privacy.export_requested.v1\", payload: { requestId: request.id }, id: request.id });\n      return { requestId: request.id };\n    },\n    async fulfilExport(query, requestId, deliver) {\n      const store = storeFor(query);\n      const request = await store.getRequest(requestId);\n      if (!request) throw new PrivacyError(PRIVACY_CODE.unknownRequest, `no request ${requestId}`);\n      if (request.kind !== REQUEST_KIND.export) throw new PrivacyError(PRIVACY_CODE.notAnExport, `request ${requestId} is not an export`);\n      if (request.status === REQUEST_STATUS.completed) throw new PrivacyError(PRIVACY_CODE.alreadyDone, `request ${requestId} is already completed`);\n      try {\n        await deliver(await assemble(query, request.subject), request);\n      } catch (error) {\n        await store.finishRequest(requestId, { status: REQUEST_STATUS.failed, at: deps.clock.now(), failure: FAILURE_CODE });\n        throw error;\n      }\n      await store.finishRequest(requestId, { status: REQUEST_STATUS.completed, at: deps.clock.now() });\n    },\n    async eraseSubject(subject, options = {}) {\n      checkSubject(subject);\n      const request = newRequest(subject, REQUEST_KIND.erasure);\n      try {\n        return await deps.transaction(async (tx) => {\n          const store = storeFor(tx);\n          await store.insertRequest(request);\n          for (const contributor of deps.contributors) {\n            try {\n              await contributor.eraseFor(tx, subject);\n            } catch (cause) {\n              throw new PrivacyError(PRIVACY_CODE.contributorFailed, `the erasure of « ${contributor.name} » failed`, { cause });\n            }\n          }\n          for (const purpose of deps.purposes) {\n            if ((await store.latestConsent(subject, purpose))?.granted) await recordConsent(tx, { subject, purpose, version: options.noticeVersion ?? ERASURE_VERSION, granted: false, means: ERASURE_VERSION });\n          }\n          const completedAt = deps.clock.now();\n          await store.finishRequest(request.id, { status: REQUEST_STATUS.completed, at: completedAt });\n          // the entry names the request and the modules, never the person\n          await deps.audit?.record(tx, { actorId: null, actorLabel: \"privacy\", action: \"privacy.erasure_completed\", target: { type: \"privacy_request\", id: request.id }, detail: { contributors: names } });\n          return { ...request, status: REQUEST_STATUS.completed, completedAt };\n        });\n      } catch (error) {\n        // the transaction rolled back, request row included: record the failure beside it, and never mask the original error\n        try {\n          await deps.transaction((tx) => storeFor(tx).insertRequest({ ...request, status: REQUEST_STATUS.failed, completedAt: deps.clock.now(), failure: FAILURE_CODE }));\n        } catch (recordFailure) {\n          throw new AggregateError([error, recordFailure], \"the erasure failed, and so did recording its failure\", { cause: recordFailure });\n        }\n        throw error;\n      }\n    },\n    async purge(query) {\n      const removed: Record<string, number> = {};\n      for (const purpose of deps.purposes) {\n        const days = await deps.retentionDays?.(purpose);\n        if (days === undefined) continue;\n        if (!Number.isInteger(days) || days < 1) throw new RangeError(`the retention of « ${purpose} » must be a whole number of days from 1, got ${days}`);\n        const before = subHours(deps.clock.now(), days * 24);\n        let total = 0;\n        for (const contributor of deps.contributors) total += (await contributor.purgeExpired?.(query, { purpose, before })) ?? 0;\n        removed[purpose] = total;\n      }\n      return removed;\n    },\n    async requests(query, subject) {\n      checkSubject(subject);\n      return storeFor(query).requestsOf(subject);\n    },\n  };\n}\n","import { defineModule } from \"@krizaka/db\";\n\n/**\n * The tables of « privacy », in their own Postgres schema (ADR-001 §3). They reference no product table: a subject is a kind and an\n * id the product chooses (an account, a client file, an application).\n *\n * - `consent` is WRITTEN ONCE: a trigger refuses any update. A withdrawal is a new row; the consent with the last word (highest `seq`) wins.\n * - `request` is the record of an export or an erasure: when, of what kind, how it ended. It holds an id and no other personal data,\n *   so it can outlive the erasure it proves.\n *\n * Version 1 is frozen once released: a change is version 2.\n */\nexport const privacySchema = defineModule({\n  module: \"privacy\",\n  migrations: [\n    {\n      version: 1,\n      name: \"consents and requests\",\n      sql: (c) => `\nCREATE TABLE ${c.schema}.consent (\n  seq          bigserial UNIQUE,\n  id           uuid PRIMARY KEY,\n  subject_kind text NOT NULL CHECK (subject_kind ~ '^[a-z][a-z0-9_]{0,39}$'),\n  subject_id   text NOT NULL CHECK (char_length(subject_id) BETWEEN 1 AND 200),\n  purpose      text NOT NULL CHECK (purpose ~ '^[a-z][a-z0-9_-]{0,39}$'),\n  version      text NOT NULL CHECK (char_length(version) BETWEEN 1 AND 100),\n  granted      boolean NOT NULL,\n  means        text CHECK (means IS NULL OR char_length(means) <= 40),\n  at           timestamptz NOT NULL\n);\nCREATE INDEX consent_subject ON ${c.schema}.consent (subject_kind, subject_id, purpose, seq DESC);\nCREATE FUNCTION ${c.schema}.consent_written_once() RETURNS trigger LANGUAGE plpgsql AS $fn$\nBEGIN\n  RAISE EXCEPTION 'a consent is written once: a withdrawal is a new row' USING ERRCODE = 'restrict_violation';\nEND;\n$fn$;\nCREATE TRIGGER consent_written_once BEFORE UPDATE ON ${c.schema}.consent FOR EACH ROW EXECUTE FUNCTION ${c.schema}.consent_written_once();\nCREATE TABLE ${c.schema}.request (\n  id           uuid PRIMARY KEY,\n  subject_kind text NOT NULL CHECK (subject_kind ~ '^[a-z][a-z0-9_]{0,39}$'),\n  subject_id   text NOT NULL CHECK (char_length(subject_id) BETWEEN 1 AND 200),\n  kind         text NOT NULL CHECK (kind IN ('export', 'erasure')),\n  status       text NOT NULL CHECK (status IN ('requested', 'completed', 'failed')),\n  requested_at timestamptz NOT NULL,\n  completed_at timestamptz,\n  failure      text CHECK (failure IS NULL OR char_length(failure) <= 100)\n);\nCREATE INDEX request_subject ON ${c.schema}.request (subject_kind, subject_id, requested_at DESC);`,\n    },\n    {\n      version: 2,\n      name: \"confidentiality incident register\",\n      sql: (c) => `\nCREATE TABLE ${c.schema}.incident (\n  id                uuid PRIMARY KEY,\n  scope             text NOT NULL CHECK (char_length(scope) BETWEEN 1 AND 100),\n  kind              text NOT NULL CHECK (kind IN ('access', 'use', 'communication', 'loss')),\n  aware_at          timestamptz NOT NULL,\n  occurred_at       timestamptz,\n  description       text NOT NULL CHECK (char_length(description) BETWEEN 1 AND 2000),\n  information       text[] NOT NULL CHECK (cardinality(information) BETWEEN 1 AND 30),\n  persons_concerned integer CHECK (persons_concerned IS NULL OR persons_concerned >= 0),\n  measures          jsonb NOT NULL DEFAULT '[]',\n  status            text NOT NULL CHECK (status IN ('open', 'assessed', 'closed')),\n  assessment        jsonb,\n  cai_notice        jsonb,\n  persons_notice    jsonb,\n  drill             boolean NOT NULL DEFAULT false,\n  opened_by         text NOT NULL,\n  opened_at         timestamptz NOT NULL,\n  closed_at         timestamptz,\n  retain_until      timestamptz NOT NULL\n);\nCREATE INDEX incident_scope ON ${c.schema}.incident (scope, aware_at, id);\nCREATE FUNCTION ${c.schema}.incident_guard() RETURNS trigger LANGUAGE plpgsql AS $fn$\nBEGIN\n  IF TG_OP = 'DELETE' THEN\n    IF OLD.retain_until > now() THEN\n      RAISE EXCEPTION 'an incident stays in the register until its retention ends' USING ERRCODE = 'restrict_violation';\n    END IF;\n    RETURN OLD;\n  END IF;\n  IF OLD.status = 'closed' THEN\n    RAISE EXCEPTION 'a closed entry of the register is never edited' USING ERRCODE = 'restrict_violation';\n  END IF;\n  IF NEW.id <> OLD.id OR NEW.scope <> OLD.scope THEN\n    RAISE EXCEPTION 'an incident never changes register' USING ERRCODE = 'restrict_violation';\n  END IF;\n  RETURN NEW;\nEND;\n$fn$;\nCREATE TRIGGER incident_guard BEFORE UPDATE OR DELETE ON ${c.schema}.incident FOR EACH ROW EXECUTE FUNCTION ${c.schema}.incident_guard();`,\n    },\n  ],\n});\n"],"mappings":";;;;;;;;;;AAeO,SAAS,iBAAiB,OAAmB,UAA6B,CAAC,GAAuB;AACvG,QAAM,OAAO,QAAQ,QAAQ;AAC7B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,UAAU,OAAO,SAAS;AAC9B,aAAO,QAAQ,SAAS,OAAO,MAAM,UAAU,OAAO,QAAQ,EAAE,IAAI,CAAC;AAAA,IACvE;AAAA,IACA,MAAM,SAAS,IAAI,SAAS;AAC1B,UAAI,QAAQ,SAAS,KAAM,OAAM,MAAM,YAAY,IAAI,QAAQ,EAAE;AAAA,IACnE;AAAA,EACF;AACF;;;AChBO,IAAM,gBAAgB,EAAE,QAAQ,UAAU,KAAK,OAAO,eAAe,iBAAiB,MAAM,OAAO;AAGnG,IAAM,kBAAkB,EAAE,MAAM,QAAQ,UAAU,YAAY,QAAQ,SAAS;AAG/E,IAAM,QAAQ,EAAE,KAAK,OAAO,QAAQ,UAAU,MAAM,OAAO;AAG3D,IAAM,gBAAgB,EAAE,KAAK,OAAO,SAAS,UAAU;AAmIvD,IAAM,gBAAgB;AAAA,EAC3B,UAAU;AAAA,EACV,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAa;AAAA,EACb,gBAAgB;AAClB;AAGO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YACW,MACT,SACA;AACA,UAAM,OAAO;AAHJ;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAEA,IAAM,OAA8B,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,EAAE;AAM1D,SAAS,qBAAqB,SAAwF;AAC3H,QAAM,EAAE,aAAa,cAAc,WAAW,IAAI,EAAE,aAAa,KAAK,QAAQ,WAAW,GAAG,cAAc,KAAK,QAAQ,YAAY,GAAG,YAAY,KAAK,QAAQ,UAAU,EAAE;AAC3K,MAAI,gBAAgB,KAAK,QAAQ,cAAc,KAAK,OAAQ,QAAO;AACnE,MAAI,iBAAiB,KAAK,QAAQ,eAAe,KAAK,KAAM,QAAO;AACnE,SAAO,eAAe,KAAK,UAAU,gBAAgB,KAAK,UAAU,eAAe,KAAK;AAC1F;AAGO,SAAS,YAAY,SAAqB;AAC/C,QAAM,QAAQ,IAAI,KAAK,OAAO;AAC9B,QAAM,eAAe,MAAM,eAAe,IAAI,CAAC;AAC/C,SAAO;AACT;AAEA,IAAM,UAAU;AAChB,IAAM,OAAO,CAAC,UAA2B;AACvC,QAAM,OAAO,UAAU,QAAQ,UAAU,SAAY,KAAK,iBAAiB,OAAO,MAAM,YAAY,IAAI,OAAO,KAAK;AACpH,QAAM,OAAO,QAAQ,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK;AAC/C,SAAO,WAAW,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,MAAM;AACrE;AACO,IAAM,uBAAuB,CAAC,MAAM,QAAQ,YAAY,eAAe,eAAe,eAAe,qBAAqB,kBAAkB,eAAe,iBAAiB,qBAAqB,YAAY,UAAU,SAAS,aAAa,cAAc;AAG3P,SAAS,cAAc,SAAsC;AAClE,QAAM,OAAO,QAAQ;AAAA,IAAI,CAAC,MACxB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,KAAK,IAAI,GAAG,EAAE,kBAAkB,EAAE,YAAY,iBAAiB,IAAI,EAAE,YAAY,cAAc,IAAI,EAAE,WAAW,UAAU,IAAI,EAAE,eAAe,UAAU,IAAI,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,KAAK,GAAG;AAAA,EAC9U;AACA,SAAO,CAAC,qBAAqB,KAAK,GAAG,GAAG,GAAG,IAAI,EAAE,KAAK,MAAM,IAAI;AAClE;;;ACzMO,SAAS,sBAAqC;AACnD,QAAM,OAAO,oBAAI,IAAsB;AACvC,QAAM,MAAM,CAAC,OAAe,OAAe,GAAG,KAAK,KAAS,EAAE;AAC9D,SAAO;AAAA,IACL,MAAM,OAAO,UAAU;AACrB,WAAK,IAAI,IAAI,SAAS,OAAO,SAAS,EAAE,GAAG,gBAAgB,QAAQ,CAAC;AAAA,IACtE;AAAA,IACA,MAAM,KAAK,UAAU;AACnB,YAAM,IAAI,IAAI,SAAS,OAAO,SAAS,EAAE;AACzC,YAAM,UAAU,KAAK,IAAI,CAAC;AAC1B,UAAI,CAAC,QAAS;AACd,UAAI,QAAQ,WAAW,gBAAgB,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AAClG,WAAK,IAAI,GAAG,gBAAgB,QAAQ,CAAC;AAAA,IACvC;AAAA,IACA,MAAM,IAAI,OAAO,IAAI;AACnB,YAAM,QAAQ,KAAK,IAAI,IAAI,OAAO,EAAE,CAAC;AACrC,aAAO,QAAQ,gBAAgB,KAAK,IAAI;AAAA,IAC1C;AAAA,IACA,MAAM,KAAK,OAAO;AAChB,aAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,QAAQ,IAAI,EAAE,QAAQ,QAAQ,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAAA,IAChL;AAAA,EACF;AACF;;;ACzBA,SAAS,aAAyB;AA0BlC,IAAM,UAAU;AAChB,IAAM,WAAW,CAAC,UAAyB,UAAU,OAAO,OAAO,IAAI,KAAK,KAAK;AACjF,IAAM,WAAW,CAAC,MAAyD,IAAI,EAAE,QAAQ,IAAI,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,WAAW,EAAE,UAAU,IAAI;AAC5J,IAAM,eAAe,CAAC,MAA6D,IAAI,EAAE,GAAG,GAAG,YAAY,IAAI,KAAK,EAAE,UAAU,EAAE,IAAI;AAEtI,IAAM,aAAa,CAAC,OAA8B;AAAA,EAChD,IAAI,EAAE;AAAA,EACN,OAAO,EAAE;AAAA,EACT,MAAM,EAAE;AAAA,EACR,SAAS,IAAI,KAAK,EAAE,QAAQ;AAAA,EAC5B,YAAY,SAAS,EAAE,WAAW;AAAA,EAClC,aAAa,EAAE;AAAA,EACf,aAAa,EAAE;AAAA,EACf,kBAAkB,EAAE;AAAA,EACpB,UAAU,EAAE,SAAS,IAAI,CAAC,OAAwB,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;AAAA,EACvF,QAAQ,EAAE;AAAA,EACV,YAAY,aAAa,EAAE,UAAU;AAAA,EACrC,WAAW,SAAS,EAAE,UAAU;AAAA,EAChC,eAAe,SAAS,EAAE,cAAc;AAAA,EACxC,OAAO,EAAE;AAAA,EACT,UAAU,EAAE;AAAA,EACZ,UAAU,IAAI,KAAK,EAAE,SAAS;AAAA,EAC9B,UAAU,SAAS,EAAE,SAAS;AAAA,EAC9B,aAAa,IAAI,KAAK,EAAE,YAAY;AACtC;AAEA,IAAM,OAAO,CAAC,UAAoB,UAAU,OAAO,OAAO,KAAK,UAAU,KAAK;AAGvE,SAAS,gBAAgB,OAAc,SAAS,WAA0B;AAC/E,QAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;AAC9B,QAAM,SAAS,CAAC,MAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,KAAK,UAAU,EAAE,QAAQ,GAAG,EAAE,QAAQ,KAAK,EAAE,UAAU,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,aAAa,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW;AACjS,SAAO;AAAA,IACL,MAAM,OAAO,GAAG;AACd,YAAM,MAAM,eAAe,KAAK,KAAK,OAAO,0HAA0H,OAAO,CAAC,CAAC;AAAA,IACjL;AAAA,IACA,MAAM,KAAK,GAAG;AACZ,YAAM;AAAA,QACJ,UAAU,KAAK;AAAA,QACf,OAAO,CAAC;AAAA,MACV;AAAA,IACF;AAAA,IACA,MAAM,IAAI,OAAO,IAAI,SAAS;AAC5B,YAAM,CAAC,GAAG,IAAI,MAAM,MAAmB,UAAU,OAAO,SAAS,KAAK,gCAAgC,SAAS,OAAO,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACvJ,aAAO,MAAM,WAAW,GAAG,IAAI;AAAA,IACjC;AAAA,IACA,MAAM,KAAK,OAAO;AAChB,cAAQ,MAAM,MAAmB,UAAU,OAAO,SAAS,KAAK,2CAA2C,CAAC,KAAK,CAAC,GAAG,IAAI,UAAU;AAAA,IACrI;AAAA,EACF;AACF;;;AC5EA,SAAS,kBAAkB;AAE3B,SAAS,SAAAA,cAAa;AAoBtB,IAAM,MAAM,CAAC,YAAoB,IAAI,cAAc,cAAc,UAAU,OAAO;AAClF,IAAM,SAAS,CAAC,OAAe,KAAa,SAAiB;AAC3D,MAAI,MAAM,KAAK,EAAE,SAAS,KAAK,MAAM,SAAS,IAAK,OAAM,IAAI,GAAG,IAAI,UAAU,GAAG,aAAa;AAChG;AACA,IAAM,QAA2B,OAAO,OAAO,aAAa;AAC5D,IAAM,SAA4B,OAAO,OAAO,KAAK;AAErD,SAAS,WAAW,OAAe;AACjC,SAAO,OAAO,KAAK,OAAO;AAC5B;AAMO,SAAS,uBAAuB,MAAsC;AAC3E,QAAM,SAASC,OAAM,KAAK,UAAU,SAAS;AAC7C,QAAM,WAAW,KAAK,aAAa,CAAC,UAAiB,gBAAgB,OAAO,MAAM;AAElF,iBAAe,MAAM,OAAc,OAAsB,QAAgB,UAAoB;AAC3F,UAAM,KAAK,OAAO,OAAO,OAAO,EAAE,SAAS,MAAM,IAAI,YAAY,MAAM,OAAO,QAAQ,oBAAoB,MAAM,IAAI,QAAQ,EAAE,MAAM,YAAY,IAAI,SAAS,GAAG,GAAG,QAAQ,EAAE,OAAO,SAAS,OAAO,OAAO,SAAS,MAAM,EAAE,CAAC;AAAA,EAC/N;AAGA,iBAAe,OAAO,OAAc,OAAe,IAAY,QAAgB,OAAsB,QAAyD;AAC5J,eAAW,KAAK;AAChB,UAAM,QAAQ,SAAS,KAAK;AAC5B,UAAM,WAAW,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,MAAM,KAAK,CAAC;AAC1D,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,cAAc,SAAS,mCAAmC;AACjG,QAAI,SAAS,WAAW,gBAAgB,OAAQ,OAAM,IAAI,cAAc,cAAc,QAAQ,gDAAgD;AAC9I,WAAO,QAAQ;AACf,UAAM,MAAM,KAAK,QAAQ;AACzB,UAAM,MAAM,OAAO,OAAO,QAAQ,QAAQ;AAC1C,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,KAAK,OAAO,OAAsB,OAAO;AAC7C,iBAAW,MAAM,KAAK;AACtB,UAAI,CAAC,MAAM,SAAS,MAAM,IAAI,EAAG,OAAM,IAAI,aAAU,MAAM,IAAI,uBAAoB,MAAM,KAAK,IAAI,CAAC,EAAE;AACrG,aAAO,MAAM,aAAa,KAAM,aAAa;AAC7C,UAAI,MAAM,YAAY,SAAS,KAAK,MAAM,YAAY,SAAS,GAAI,OAAM,IAAI,iCAAiC;AAC9G,iBAAW,YAAY,MAAM,YAAa,QAAO,UAAU,IAAI,sBAAsB;AACrF,UAAI,MAAM,qBAAqB,WAAc,CAAC,OAAO,UAAU,MAAM,gBAAgB,KAAK,MAAM,mBAAmB,GAAI,OAAM,IAAI,6CAA6C;AAC9K,YAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,YAAM,UAAU,MAAM,WAAW;AACjC,UAAI,QAAQ,QAAQ,IAAI,IAAI,QAAQ,EAAG,OAAM,IAAI,iCAAiC;AAClF,UAAI,MAAM,cAAc,MAAM,WAAW,QAAQ,IAAI,IAAI,QAAQ,EAAG,OAAM,IAAI,oCAAoC;AAClH,YAAM,WAAqB;AAAA,QACzB,IAAI,WAAW;AAAA,QACf,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ;AAAA,QACA,YAAY,MAAM,cAAc;AAAA,QAChC,aAAa,MAAM;AAAA,QACnB,aAAa,CAAC,GAAG,MAAM,WAAW;AAAA,QAClC,kBAAkB,MAAM,oBAAoB;AAAA,QAC5C,UAAU,CAAC;AAAA,QACX,QAAQ,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe;AAAA,QACf,OAAO,MAAM,SAAS;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa,YAAY,OAAO;AAAA,MAClC;AACA,YAAM,SAAS,KAAK,EAAE,OAAO,QAAQ;AACrC,YAAM,MAAM,OAAO,OAAO,UAAU,QAAQ;AAC5C,aAAO;AAAA,IACT;AAAA,IACA,OAAO,OAAO,OAAO,IAAI,OAAwB,OAAO;AACtD,iBAAW,SAAS,CAAC,MAAM,aAAa,MAAM,cAAc,MAAM,UAAU,EAAG,KAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,cAAW,KAAK,uBAAoB,OAAO,KAAK,IAAI,CAAC,EAAE;AAC7K,aAAO,MAAM,WAAW,KAAM,WAAW;AACzC,aAAO,OAAO,OAAO,OAAO,IAAI,YAAY,OAAO,CAAC,aAAa;AAC/D,iBAAS,aAAa,EAAE,GAAG,OAAO,YAAY,KAAK,MAAM,IAAI,GAAG,YAAY,MAAM,MAAM;AACxF,iBAAS,SAAS,gBAAgB;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,IACA,cAAc,OAAO,OAAO,IAAI,MAAM,OAAO;AAC3C,aAAO,MAAM,KAAM,SAAS;AAC5B,aAAO,OAAO,OAAO,OAAO,IAAI,oBAAoB,OAAO,CAAC,aAAa;AACvE,iBAAS,SAAS,KAAK,EAAE,IAAI,KAAK,MAAM,IAAI,GAAG,KAAK,CAAC;AAAA,MACvD,CAAC;AAAA,IACH;AAAA,IACA,aAAa,OAAO,OAAO,IAAI,QAAQ,QAAQ,OAAO;AACpD,aAAO,OAAO,SAAS,IAAI,SAAS;AACpC,aAAO,OAAO,OAAO,OAAO,IAAI,UAAU,MAAM,IAAI,OAAO,CAAC,aAAa;AACvE,YAAI,CAAC,SAAS,WAAY,OAAM,IAAI,cAAc,cAAc,aAAa,kCAAkC;AAC/G,YAAI,CAAC,SAAS,WAAW,cAAe,OAAM,IAAI,cAAc,cAAc,aAAa,kEAAkE;AAC7J,cAAM,OAAO,EAAE,QAAQ,KAAK,MAAM,IAAI,GAAG,SAAS,OAAO,SAAS,WAAW,OAAO,aAAa,KAAK;AACtG,YAAI,WAAW,cAAc,IAAK,UAAS,YAAY;AAAA,YAClD,UAAS,gBAAgB;AAAA,MAChC,CAAC;AAAA,IACH;AAAA,IACA,UAAU,OAAO,OAAO,IAAI,OAAO,OAAO;AACxC,aAAO,OAAO,OAAO,OAAO,IAAI,gBAAgB,OAAO,CAAC,aAAa;AACnE,iBAAS,QAAQ;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,OAAO,OAAO,IAAI,OAAO;AAC7B,aAAO,OAAO,OAAO,OAAO,IAAI,UAAU,OAAO,CAAC,aAAa;AAC7D,YAAI,CAAC,SAAS,WAAY,OAAM,IAAI,cAAc,cAAc,aAAa,gCAAgC;AAC7G,YAAI,SAAS,WAAW,kBAAkB,CAAC,SAAS,aAAa,CAAC,SAAS,eAAgB,OAAM,IAAI,cAAc,cAAc,gBAAgB,8FAA8F;AAC/O,iBAAS,SAAS,gBAAgB;AAClC,iBAAS,WAAW,KAAK,MAAM,IAAI;AAAA,MACrC,CAAC;AAAA,IACH;AAAA,IACA,MAAM,IAAI,OAAO,OAAO,IAAI;AAC1B,iBAAW,KAAK;AAChB,aAAO,SAAS,KAAK,EAAE,IAAI,OAAO,EAAE;AAAA,IACtC;AAAA,IACA,MAAM,KAAK,OAAO,OAAO;AACvB,iBAAW,KAAK;AAChB,aAAO,SAAS,KAAK,EAAE,KAAK,KAAK;AAAA,IACnC;AAAA,IACA,MAAM,eAAe,OAAO,OAAO;AACjC,iBAAW,KAAK;AAChB,aAAO,EAAE,QAAQ,GAAG,OAAO,aAAa,KAAK,MAAM,IAAI,EAAE,YAAY,GAAG,SAAS,MAAM,SAAS,KAAK,EAAE,KAAK,KAAK,EAAE;AAAA,IACrH;AAAA,EACF;AACF;;;AC9IA,IAAM,cAAc,CAAC,GAAY,MAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;AAGzE,SAAS,qBAAmC;AACjD,QAAM,WAA4B,CAAC;AACnC,QAAM,WAAW,oBAAI,IAA4B;AACjD,SAAO;AAAA,IACL,MAAM,cAAc,GAAG;AACrB,eAAS,KAAK,gBAAgB,CAAC,CAAC;AAAA,IAClC;AAAA,IACA,MAAM,cAAc,SAAS,SAAS;AACpC,YAAM,QAAQ,SAAS,OAAO,CAAC,MAAM,YAAY,EAAE,SAAS,OAAO,KAAK,EAAE,YAAY,OAAO,EAAE,GAAG,EAAE;AACpG,aAAO,QAAQ,gBAAgB,KAAK,IAAI;AAAA,IAC1C;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,aAAO,SAAS,OAAO,CAAC,MAAM,YAAY,EAAE,SAAS,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAAA,IAC9F;AAAA,IACA,MAAM,cAAc,GAAG;AACrB,eAAS,IAAI,EAAE,IAAI,gBAAgB,CAAC,CAAC;AAAA,IACvC;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,QAAQ,SAAS,IAAI,EAAE;AAC7B,aAAO,QAAQ,gBAAgB,KAAK,IAAI;AAAA,IAC1C;AAAA,IACA,MAAM,cAAc,IAAI,SAAS;AAC/B,YAAM,QAAQ,SAAS,IAAI,EAAE;AAC7B,UAAI,MAAO,QAAO,OAAO,OAAO,EAAE,QAAQ,QAAQ,QAAQ,aAAa,QAAQ,IAAI,SAAS,QAAQ,WAAW,KAAK,CAAC;AAAA,IACvH;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,aAAO,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,YAAY,EAAE,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,QAAQ,IAAI,EAAE,YAAY,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAAA,IAC9K;AAAA,EACF;AACF;;;AClCA,SAAS,SAAAC,cAAyB;AAyBlC,IAAM,YAAY,CAAC,OAAkC,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,MAAM,EAAE,cAAc,IAAI,EAAE,WAAW,GAAG,SAAS,EAAE,SAAS,SAAS,EAAE,SAAS,SAAS,EAAE,SAAS,OAAO,EAAE,OAAO,IAAI,IAAI,KAAK,EAAE,EAAE,EAAE;AACrN,IAAM,YAAY,CAAC,OAAmC,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,MAAM,EAAE,cAAc,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,aAAa,IAAI,KAAK,EAAE,YAAY,GAAG,aAAa,EAAE,iBAAiB,OAAO,OAAO,IAAI,KAAK,EAAE,YAAY,GAAG,SAAS,EAAE,QAAQ;AAEzR,IAAM,kBAAkB;AACxB,IAAM,kBAAkB;AAMjB,SAAS,eAAe,OAAc,SAAS,WAAyB;AAC7E,QAAM,UAAU,GAAGA,OAAM,MAAM,CAAC;AAChC,QAAM,UAAU,GAAGA,OAAM,MAAM,CAAC;AAChC,QAAM,OAAO,CAAC,YAAqB,CAAC,QAAQ,MAAM,QAAQ,EAAE;AAC5D,SAAO;AAAA,IACL,MAAM,cAAc,GAAG;AACrB,YAAM,MAAM,eAAe,OAAO,iHAAiH,CAAC,EAAE,IAAI,EAAE,QAAQ,MAAM,EAAE,QAAQ,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;AAAA,IACzO;AAAA,IACA,MAAM,cAAc,SAAS,SAAS;AACpC,YAAM,CAAC,GAAG,IAAI,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,2FAA2F,CAAC,GAAG,KAAK,OAAO,GAAG,OAAO,CAAC;AACrM,aAAO,MAAM,UAAU,GAAG,IAAI;AAAA,IAChC;AAAA,IACA,MAAM,eAAe,SAAS;AAC5B,cAAQ,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,6DAA6D,KAAK,OAAO,CAAC,GAAG,IAAI,SAAS;AAAA,IACrK;AAAA,IACA,MAAM,cAAc,GAAG;AACrB,YAAM,MAAM,eAAe,OAAO,8HAA8H,CAAC,EAAE,IAAI,EAAE,QAAQ,MAAM,EAAE,QAAQ,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC;AAAA,IACjQ;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,CAAC,GAAG,IAAI,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,kBAAkB,CAAC,EAAE,CAAC;AACrG,aAAO,MAAM,UAAU,GAAG,IAAI;AAAA,IAChC;AAAA,IACA,MAAM,cAAc,IAAI,SAAS;AAC/B,YAAM,MAAM,UAAU,OAAO,mEAAmE,CAAC,IAAI,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,WAAW,IAAI,CAAC;AAAA,IAC3J;AAAA,IACA,MAAM,WAAW,SAAS;AACxB,cAAQ,MAAM,MAAkB,UAAU,eAAe,SAAS,OAAO,+EAA+E,KAAK,OAAO,CAAC,GAAG,IAAI,SAAS;AAAA,IACvL;AAAA,EACF;AACF;;;AChEA,SAAS,cAAAC,mBAAkB;AAE3B,SAAS,SAAAC,cAAa;AACtB,SAAS,gBAAgB;AAwEzB,IAAM,eAAe;AACrB,IAAM,kBAAkB;AAOjB,SAAS,cAAc,MAA4B;AACxD,QAAM,SAASC,OAAM,KAAK,UAAU,SAAS;AAC7C,QAAM,WAAW,KAAK,aAAa,CAAC,UAAiB,eAAe,OAAO,MAAM;AACjF,aAAW,WAAW,KAAK,SAAU,cAAa,OAAO;AACzD,QAAM,QAAQ,KAAK,aAAa,IAAI,CAAC,MAAM,EAAE,IAAI;AACjD,MAAI,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,OAAQ,OAAM,IAAI,aAAa,aAAa,mBAAmB,wCAAwC,MAAM,KAAK,IAAI,CAAC,EAAE;AAC3J,QAAM,QAAQ,IAAI,IAAI,KAAK,QAAQ;AAEnC,iBAAe,SAAS,OAAc,SAA2C;AAC/E,UAAM,UAAmC,CAAC;AAC1C,eAAW,eAAe,KAAK,cAAc;AAC3C,UAAI;AACF,gBAAQ,YAAY,IAAI,IAAI,MAAM,YAAY,UAAU,OAAO,OAAO;AAAA,MACxE,SAAS,OAAO;AACd,cAAM,IAAI,aAAa,aAAa,mBAAmB,sBAAmB,YAAY,IAAI,gBAAa,EAAE,MAAM,CAAC;AAAA,MAClH;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,GAAG,SAAS,aAAa,KAAK,MAAM,IAAI,EAAE,YAAY,GAAG,QAAQ;AAAA,EACpF;AAEA,QAAM,aAAa,CAAC,SAAkB,UAAkD,EAAE,IAAIC,YAAW,GAAG,SAAS,MAAM,QAAQ,eAAe,WAAW,aAAa,KAAK,MAAM,IAAI,GAAG,aAAa,MAAM,SAAS,KAAK;AAE7N,iBAAe,cAAc,OAAc,OAA6C;AACtF,iBAAa,MAAM,OAAO;AAC1B,iBAAa,MAAM,OAAO;AAC1B,QAAI,CAAC,MAAM,IAAI,MAAM,OAAO,EAAG,OAAM,IAAI,aAAa,aAAa,YAAY,gBAAa,MAAM,OAAO,uCAAoC;AAC7I,QAAI,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,SAAS,IAAK,OAAM,IAAI,aAAa,aAAa,YAAY,2CAA2C;AACvJ,UAAM,SAAwB,EAAE,IAAIA,YAAW,GAAG,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,MAAM,SAAS,MAAM,IAAI,KAAK,MAAM,IAAI,EAAE;AACnM,UAAM,SAAS,KAAK,EAAE,cAAc,MAAM;AAC1C,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,WAAW,OAAO,SAAS,SAAS;AACxC,mBAAa,OAAO;AACpB,mBAAa,OAAO;AACpB,cAAQ,MAAM,SAAS,KAAK,EAAE,cAAc,SAAS,OAAO,IAAI,YAAY;AAAA,IAC9E;AAAA,IACA,MAAM,eAAe,OAAO,SAAS;AACnC,mBAAa,OAAO;AACpB,aAAO,SAAS,KAAK,EAAE,eAAe,OAAO;AAAA,IAC/C;AAAA,IACA,MAAM,cAAc,OAAO,SAAS;AAClC,mBAAa,OAAO;AACpB,YAAM,QAAQ,SAAS,KAAK;AAC5B,YAAM,UAAU,WAAW,SAAS,aAAa,MAAM;AACvD,YAAM,MAAM,cAAc,OAAO;AACjC,UAAI;AACF,cAAM,WAAW,MAAM,SAAS,OAAO,OAAO;AAC9C,cAAM,MAAM,cAAc,QAAQ,IAAI,EAAE,QAAQ,eAAe,WAAW,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC;AAChG,eAAO;AAAA,MACT,SAAS,OAAO;AACd,cAAM,MAAM,cAAc,QAAQ,IAAI,EAAE,QAAQ,eAAe,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,aAAa,CAAC;AACpH,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,cAAc,IAAI,SAAS;AAC/B,mBAAa,OAAO;AACpB,UAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,aAAa,aAAa,UAAU,yCAAyC;AACzG,YAAM,UAAU,WAAW,SAAS,aAAa,MAAM;AACvD,YAAM,SAAS,EAAE,EAAE,cAAc,OAAO;AACxC,YAAM,KAAK,OAAO,OAAO,IAAI,EAAE,OAAO,WAAW,MAAM,mCAAmC,SAAS,EAAE,WAAW,QAAQ,GAAG,GAAG,IAAI,QAAQ,GAAG,CAAC;AAC9I,aAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,aAAa,OAAO,WAAW,SAAS;AAC5C,YAAM,QAAQ,SAAS,KAAK;AAC5B,YAAM,UAAU,MAAM,MAAM,WAAW,SAAS;AAChD,UAAI,CAAC,QAAS,OAAM,IAAI,aAAa,aAAa,gBAAgB,cAAc,SAAS,EAAE;AAC3F,UAAI,QAAQ,SAAS,aAAa,OAAQ,OAAM,IAAI,aAAa,aAAa,aAAa,WAAW,SAAS,mBAAmB;AAClI,UAAI,QAAQ,WAAW,eAAe,UAAW,OAAM,IAAI,aAAa,aAAa,aAAa,WAAW,SAAS,uBAAuB;AAC7I,UAAI;AACF,cAAM,QAAQ,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG,OAAO;AAAA,MAC/D,SAAS,OAAO;AACd,cAAM,MAAM,cAAc,WAAW,EAAE,QAAQ,eAAe,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,aAAa,CAAC;AACnH,cAAM;AAAA,MACR;AACA,YAAM,MAAM,cAAc,WAAW,EAAE,QAAQ,eAAe,WAAW,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC;AAAA,IACjG;AAAA,IACA,MAAM,aAAa,SAAS,UAAU,CAAC,GAAG;AACxC,mBAAa,OAAO;AACpB,YAAM,UAAU,WAAW,SAAS,aAAa,OAAO;AACxD,UAAI;AACF,eAAO,MAAM,KAAK,YAAY,OAAO,OAAO;AAC1C,gBAAM,QAAQ,SAAS,EAAE;AACzB,gBAAM,MAAM,cAAc,OAAO;AACjC,qBAAW,eAAe,KAAK,cAAc;AAC3C,gBAAI;AACF,oBAAM,YAAY,SAAS,IAAI,OAAO;AAAA,YACxC,SAAS,OAAO;AACd,oBAAM,IAAI,aAAa,aAAa,mBAAmB,uBAAoB,YAAY,IAAI,gBAAa,EAAE,MAAM,CAAC;AAAA,YACnH;AAAA,UACF;AACA,qBAAW,WAAW,KAAK,UAAU;AACnC,iBAAK,MAAM,MAAM,cAAc,SAAS,OAAO,IAAI,QAAS,OAAM,cAAc,IAAI,EAAE,SAAS,SAAS,SAAS,QAAQ,iBAAiB,iBAAiB,SAAS,OAAO,OAAO,gBAAgB,CAAC;AAAA,UACrM;AACA,gBAAM,cAAc,KAAK,MAAM,IAAI;AACnC,gBAAM,MAAM,cAAc,QAAQ,IAAI,EAAE,QAAQ,eAAe,WAAW,IAAI,YAAY,CAAC;AAE3F,gBAAM,KAAK,OAAO,OAAO,IAAI,EAAE,SAAS,MAAM,YAAY,WAAW,QAAQ,6BAA6B,QAAQ,EAAE,MAAM,mBAAmB,IAAI,QAAQ,GAAG,GAAG,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC;AAChM,iBAAO,EAAE,GAAG,SAAS,QAAQ,eAAe,WAAW,YAAY;AAAA,QACrE,CAAC;AAAA,MACH,SAAS,OAAO;AAEd,YAAI;AACF,gBAAM,KAAK,YAAY,CAAC,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,GAAG,SAAS,QAAQ,eAAe,QAAQ,aAAa,KAAK,MAAM,IAAI,GAAG,SAAS,aAAa,CAAC,CAAC;AAAA,QAChK,SAAS,eAAe;AACtB,gBAAM,IAAI,eAAe,CAAC,OAAO,aAAa,GAAG,wDAAwD,EAAE,OAAO,cAAc,CAAC;AAAA,QACnI;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,MAAM,OAAO;AACjB,YAAM,UAAkC,CAAC;AACzC,iBAAW,WAAW,KAAK,UAAU;AACnC,cAAM,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAC/C,YAAI,SAAS,OAAW;AACxB,YAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,EAAG,OAAM,IAAI,WAAW,yBAAsB,OAAO,oDAAiD,IAAI,EAAE;AAClJ,cAAM,SAAS,SAAS,KAAK,MAAM,IAAI,GAAG,OAAO,EAAE;AACnD,YAAI,QAAQ;AACZ,mBAAW,eAAe,KAAK,aAAc,UAAU,MAAM,YAAY,eAAe,OAAO,EAAE,SAAS,OAAO,CAAC,KAAM;AACxH,gBAAQ,OAAO,IAAI;AAAA,MACrB;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,SAAS,OAAO,SAAS;AAC7B,mBAAa,OAAO;AACpB,aAAO,SAAS,KAAK,EAAE,WAAW,OAAO;AAAA,IAC3C;AAAA,EACF;AACF;;;ACrNA,SAAS,oBAAoB;AAYtB,IAAM,gBAAgB,aAAa;AAAA,EACxC,QAAQ;AAAA,EACR,YAAY;AAAA,IACV;AAAA,MACE,SAAS;AAAA,MACT,MAAM;AAAA,MACN,KAAK,CAAC,MAAM;AAAA,eACH,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAWW,EAAE,MAAM;AAAA,kBACxB,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,uDAK6B,EAAE,MAAM,0CAA0C,EAAE,MAAM;AAAA,eAClG,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAUW,EAAE,MAAM;AAAA,IACtC;AAAA,IACA;AAAA,MACE,SAAS;AAAA,MACT,MAAM;AAAA,MACN,KAAK,CAAC,MAAM;AAAA,eACH,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iCAoBU,EAAE,MAAM;AAAA,kBACvB,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2DAiBiC,EAAE,MAAM,2CAA2C,EAAE,MAAM;AAAA,IAClH;AAAA,EACF;AACF,CAAC;","names":["ident","ident","ident","randomUUID","ident","ident","randomUUID"]}

package/dist/testkit.d.ts

@@ -1,7 +1,9 @@
-import { a as PrivacyStore } from './port-Ds9VVyC2.js';
+import { I as IncidentStore, c as PrivacyStore } from './incident-DLXCVzpW.js';
 import '@krizaka/db';
 
 /** What every `PrivacyStore` adapter must do: the same behaviour behind the same port. `make` gives an empty store. */
 declare function privacyStoreContract(name: string, make: () => PrivacyStore | Promise<PrivacyStore>): void;
+/** What every `IncidentStore` adapter must do. `make` gives an empty store. */
+declare function incidentStoreContract(name: string, make: () => IncidentStore | Promise<IncidentStore>): void;
 
-export { privacyStoreContract };
+export { incidentStoreContract, privacyStoreContract };

package/dist/testkit.js

@@ -57,7 +57,66 @@ function privacyStoreContract(name, make) {
     expect(await store.requestsOf(CLIENT)).toEqual([]);
   });
 }
+var awareDay = /* @__PURE__ */ new Date("2026-10-20T09:00:00.000Z");
+var incident = (scope, overrides = {}) => ({
+  id: randomUUID(),
+  scope,
+  kind: "access",
+  awareAt: awareDay,
+  occurredAt: null,
+  description: "A staff account opened a file it should not have.",
+  information: ["lease"],
+  personsConcerned: 3,
+  measures: [{ at: awareDay, text: "Session revoked." }],
+  status: "open",
+  assessment: null,
+  caiNotice: null,
+  personsNotice: null,
+  drill: false,
+  openedBy: "admin",
+  openedAt: awareDay,
+  closedAt: null,
+  retainUntil: /* @__PURE__ */ new Date("2031-10-20T09:00:00.000Z"),
+  ...overrides
+});
+function incidentStoreContract(name, make) {
+  it(`${name}: writes an entry and reads it back whole, dates included`, async () => {
+    const store = await make();
+    const assessed = incident("t1", { status: "assessed", assessment: { sensitivity: "high", consequences: "medium", likelihood: "high", seriousInjury: true, rationale: "Leases.", assessedAt: at(5), assessedBy: "dpo" }, caiNotice: { sentAt: at(9), channel: "form", reference: "CAI-1" } });
+    await store.insert(assessed);
+    expect(await store.get("t1", assessed.id)).toEqual(assessed);
+  });
+  it(`${name}: never shows an entry to another scope`, async () => {
+    const store = await make();
+    const mine = incident("t1");
+    await store.insert(mine);
+    await store.insert(incident("t2"));
+    expect(await store.get("t2", mine.id)).toBeNull();
+    expect((await store.list("t1")).map((i) => i.id)).toEqual([mine.id]);
+    await store.save({ ...mine, scope: "t2", description: "changed" });
+    expect((await store.get("t1", mine.id))?.description).toBe(mine.description);
+    expect(await store.get("t2", mine.id)).toBeNull();
+  });
+  it(`${name}: lists the register oldest awareness first, and replaces an open entry`, async () => {
+    const store = await make();
+    const later = incident("t1", { awareAt: at(100) });
+    const earlier = incident("t1", { awareAt: at(-100) });
+    await store.insert(later);
+    await store.insert(earlier);
+    expect((await store.list("t1")).map((i) => i.id)).toEqual([earlier.id, later.id]);
+    await store.save({ ...later, personsConcerned: 12 });
+    expect((await store.get("t1", later.id, { lock: true }))?.personsConcerned).toBe(12);
+  });
+  it(`${name}: refuses to edit a closed entry`, async () => {
+    const store = await make();
+    const closed = incident("t1", { status: "closed", closedAt: at(1) });
+    await store.insert(closed);
+    await expect(store.save({ ...closed, description: "rewritten" })).rejects.toThrow();
+    expect((await store.get("t1", closed.id))?.description).toBe(closed.description);
+  });
+}
 export {
+  incidentStoreContract,
   privacyStoreContract
 };
 //# sourceMappingURL=testkit.js.map

package/dist/testkit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/testkit.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\n\nimport { expect, it } from \"vitest\";\n\nimport type { ConsentRecord, PrivacyRequest, PrivacyStore, Subject } from \"./port\";\n\nconst T0 = new Date(\"2026-10-26T12:00:00.000Z\");\nconst at = (seconds: number) => new Date(T0.valueOf() + seconds * 1000);\nconst ERIC: Subject = { kind: \"account\", id: \"11111111-1111-4111-8111-111111111111\" };\nconst CLIENT: Subject = { kind: \"client\", id: \"c-42\" };\n\nconst consent = (subject: Subject, purpose: string, granted: boolean, seconds: number): ConsentRecord => ({ id: randomUUID(), subject, purpose, version: \"2026-10-01\", granted, means: \"checkbox\", at: at(seconds) });\nconst request = (subject: Subject, kind: PrivacyRequest[\"kind\"], seconds: number): PrivacyRequest => ({ id: randomUUID(), subject, kind, status: \"requested\", requestedAt: at(seconds), completedAt: null, failure: null });\n\n/** What every `PrivacyStore` adapter must do: the same behaviour behind the same port. `make` gives an empty store. */\nexport function privacyStoreContract(name: string, make: () => PrivacyStore | Promise<PrivacyStore>) {\n  it(`${name}: knows nothing about a person who never said anything`, async () => {\n    const store = await make();\n    expect(await store.latestConsent(ERIC, \"marketing\")).toBeNull();\n    expect(await store.consentHistory(ERIC)).toEqual([]);\n  });\n\n  it(`${name}: the consent with the last word wins, and the history keeps every one in order`, async () => {\n    const store = await make();\n    const first = consent(ERIC, \"marketing\", true, 0);\n    const second = consent(ERIC, \"marketing\", false, 10);\n    const third = consent(ERIC, \"marketing\", true, 20);\n    for (const c of [first, second, third]) await store.insertConsent(c);\n    expect(await store.latestConsent(ERIC, \"marketing\")).toEqual(third);\n    expect((await store.consentHistory(ERIC)).map((c) => c.id)).toEqual([first.id, second.id, third.id]);\n  });\n\n  it(`${name}: keeps purposes and subjects apart, whatever the kind of subject`, async () => {\n    const store = await make();\n    await store.insertConsent(consent(ERIC, \"marketing\", true, 0));\n    await store.insertConsent(consent(ERIC, \"screening\", false, 1));\n    await store.insertConsent(consent(CLIENT, \"marketing\", false, 2));\n    expect((await store.latestConsent(ERIC, \"marketing\"))?.granted).toBe(true);\n    expect((await store.latestConsent(ERIC, \"screening\"))?.granted).toBe(false);\n    expect((await store.latestConsent(CLIENT, \"marketing\"))?.granted).toBe(false);\n    expect(await store.consentHistory(CLIENT)).toHaveLength(1);\n    expect(await store.latestConsent({ kind: \"client\", id: ERIC.id }, \"marketing\")).toBeNull(); // same id, another kind\n  });\n\n  it(`${name}: records the proof: the notice version, the means and the instant`, async () => {\n    const store = await make();\n    const c = { ...consent(ERIC, \"marketing\", true, 5), version: \"v7\", means: \"link\" };\n    await store.insertConsent(c);\n    const found = await store.latestConsent(ERIC, \"marketing\");\n    expect(found).toMatchObject({ version: \"v7\", means: \"link\", granted: true });\n    expect(found!.at.toISOString()).toBe(at(5).toISOString());\n  });\n\n  it(`${name}: follows a request from asked to completed, or failed with a code`, async () => {\n    const store = await make();\n    const done = request(ERIC, \"export\", 0);\n    const broke = request(ERIC, \"erasure\", 10);\n    await store.insertRequest(done);\n    await store.insertRequest(broke);\n    await store.finishRequest(done.id, { status: \"completed\", at: at(3) });\n    await store.finishRequest(broke.id, { status: \"failed\", at: at(11), failure: \"CONTRIBUTOR_FAILED\" });\n    expect(await store.getRequest(done.id)).toMatchObject({ kind: \"export\", status: \"completed\", failure: null });\n    expect((await store.getRequest(done.id))!.completedAt!.toISOString()).toBe(at(3).toISOString());\n    expect(await store.getRequest(broke.id)).toMatchObject({ kind: \"erasure\", status: \"failed\", failure: \"CONTRIBUTOR_FAILED\" });\n    expect(await store.getRequest(randomUUID())).toBeNull();\n    expect((await store.requestsOf(ERIC)).map((r) => r.id)).toEqual([broke.id, done.id]); // newest first\n    expect(await store.requestsOf(CLIENT)).toEqual([]);\n  });\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAE3B,SAAS,QAAQ,UAAU;AAI3B,IAAM,KAAK,oBAAI,KAAK,0BAA0B;AAC9C,IAAM,KAAK,CAAC,YAAoB,IAAI,KAAK,GAAG,QAAQ,IAAI,UAAU,GAAI;AACtE,IAAM,OAAgB,EAAE,MAAM,WAAW,IAAI,uCAAuC;AACpF,IAAM,SAAkB,EAAE,MAAM,UAAU,IAAI,OAAO;AAErD,IAAM,UAAU,CAAC,SAAkB,SAAiB,SAAkB,aAAoC,EAAE,IAAI,WAAW,GAAG,SAAS,SAAS,SAAS,cAAc,SAAS,OAAO,YAAY,IAAI,GAAG,OAAO,EAAE;AACnN,IAAM,UAAU,CAAC,SAAkB,MAA8B,aAAqC,EAAE,IAAI,WAAW,GAAG,SAAS,MAAM,QAAQ,aAAa,aAAa,GAAG,OAAO,GAAG,aAAa,MAAM,SAAS,KAAK;AAGlN,SAAS,qBAAqB,MAAc,MAAkD;AACnG,KAAG,GAAG,IAAI,0DAA0D,YAAY;AAC9E,UAAM,QAAQ,MAAM,KAAK;AACzB,WAAO,MAAM,MAAM,cAAc,MAAM,WAAW,CAAC,EAAE,SAAS;AAC9D,WAAO,MAAM,MAAM,eAAe,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACrD,CAAC;AAED,KAAG,GAAG,IAAI,mFAAmF,YAAY;AACvG,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,QAAQ,QAAQ,MAAM,aAAa,MAAM,CAAC;AAChD,UAAM,SAAS,QAAQ,MAAM,aAAa,OAAO,EAAE;AACnD,UAAM,QAAQ,QAAQ,MAAM,aAAa,MAAM,EAAE;AACjD,eAAW,KAAK,CAAC,OAAO,QAAQ,KAAK,EAAG,OAAM,MAAM,cAAc,CAAC;AACnE,WAAO,MAAM,MAAM,cAAc,MAAM,WAAW,CAAC,EAAE,QAAQ,KAAK;AAClE,YAAQ,MAAM,MAAM,eAAe,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;AAAA,EACrG,CAAC;AAED,KAAG,GAAG,IAAI,qEAAqE,YAAY;AACzF,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,MAAM,cAAc,QAAQ,MAAM,aAAa,MAAM,CAAC,CAAC;AAC7D,UAAM,MAAM,cAAc,QAAQ,MAAM,aAAa,OAAO,CAAC,CAAC;AAC9D,UAAM,MAAM,cAAc,QAAQ,QAAQ,aAAa,OAAO,CAAC,CAAC;AAChE,YAAQ,MAAM,MAAM,cAAc,MAAM,WAAW,IAAI,OAAO,EAAE,KAAK,IAAI;AACzE,YAAQ,MAAM,MAAM,cAAc,MAAM,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK;AAC1E,YAAQ,MAAM,MAAM,cAAc,QAAQ,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK;AAC5E,WAAO,MAAM,MAAM,eAAe,MAAM,CAAC,EAAE,aAAa,CAAC;AACzD,WAAO,MAAM,MAAM,cAAc,EAAE,MAAM,UAAU,IAAI,KAAK,GAAG,GAAG,WAAW,CAAC,EAAE,SAAS;AAAA,EAC3F,CAAC;AAED,KAAG,GAAG,IAAI,sEAAsE,YAAY;AAC1F,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,IAAI,EAAE,GAAG,QAAQ,MAAM,aAAa,MAAM,CAAC,GAAG,SAAS,MAAM,OAAO,OAAO;AACjF,UAAM,MAAM,cAAc,CAAC;AAC3B,UAAM,QAAQ,MAAM,MAAM,cAAc,MAAM,WAAW;AACzD,WAAO,KAAK,EAAE,cAAc,EAAE,SAAS,MAAM,OAAO,QAAQ,SAAS,KAAK,CAAC;AAC3E,WAAO,MAAO,GAAG,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,CAAC;AAAA,EAC1D,CAAC;AAED,KAAG,GAAG,IAAI,sEAAsE,YAAY;AAC1F,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,OAAO,QAAQ,MAAM,UAAU,CAAC;AACtC,UAAM,QAAQ,QAAQ,MAAM,WAAW,EAAE;AACzC,UAAM,MAAM,cAAc,IAAI;AAC9B,UAAM,MAAM,cAAc,KAAK;AAC/B,UAAM,MAAM,cAAc,KAAK,IAAI,EAAE,QAAQ,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;AACrE,UAAM,MAAM,cAAc,MAAM,IAAI,EAAE,QAAQ,UAAU,IAAI,GAAG,EAAE,GAAG,SAAS,qBAAqB,CAAC;AACnG,WAAO,MAAM,MAAM,WAAW,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,UAAU,QAAQ,aAAa,SAAS,KAAK,CAAC;AAC5G,YAAQ,MAAM,MAAM,WAAW,KAAK,EAAE,GAAI,YAAa,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,CAAC;AAC9F,WAAO,MAAM,MAAM,WAAW,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,WAAW,QAAQ,UAAU,SAAS,qBAAqB,CAAC;AAC3H,WAAO,MAAM,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,SAAS;AACtD,YAAQ,MAAM,MAAM,WAAW,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;AACnF,WAAO,MAAM,MAAM,WAAW,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACnD,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/testkit.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\n\nimport { expect, it } from \"vitest\";\n\nimport type { Incident, IncidentStore } from \"./incident\";\nimport type { ConsentRecord, PrivacyRequest, PrivacyStore, Subject } from \"./port\";\n\nconst T0 = new Date(\"2026-10-26T12:00:00.000Z\");\nconst at = (seconds: number) => new Date(T0.valueOf() + seconds * 1000);\nconst ERIC: Subject = { kind: \"account\", id: \"11111111-1111-4111-8111-111111111111\" };\nconst CLIENT: Subject = { kind: \"client\", id: \"c-42\" };\n\nconst consent = (subject: Subject, purpose: string, granted: boolean, seconds: number): ConsentRecord => ({ id: randomUUID(), subject, purpose, version: \"2026-10-01\", granted, means: \"checkbox\", at: at(seconds) });\nconst request = (subject: Subject, kind: PrivacyRequest[\"kind\"], seconds: number): PrivacyRequest => ({ id: randomUUID(), subject, kind, status: \"requested\", requestedAt: at(seconds), completedAt: null, failure: null });\n\n/** What every `PrivacyStore` adapter must do: the same behaviour behind the same port. `make` gives an empty store. */\nexport function privacyStoreContract(name: string, make: () => PrivacyStore | Promise<PrivacyStore>) {\n  it(`${name}: knows nothing about a person who never said anything`, async () => {\n    const store = await make();\n    expect(await store.latestConsent(ERIC, \"marketing\")).toBeNull();\n    expect(await store.consentHistory(ERIC)).toEqual([]);\n  });\n\n  it(`${name}: the consent with the last word wins, and the history keeps every one in order`, async () => {\n    const store = await make();\n    const first = consent(ERIC, \"marketing\", true, 0);\n    const second = consent(ERIC, \"marketing\", false, 10);\n    const third = consent(ERIC, \"marketing\", true, 20);\n    for (const c of [first, second, third]) await store.insertConsent(c);\n    expect(await store.latestConsent(ERIC, \"marketing\")).toEqual(third);\n    expect((await store.consentHistory(ERIC)).map((c) => c.id)).toEqual([first.id, second.id, third.id]);\n  });\n\n  it(`${name}: keeps purposes and subjects apart, whatever the kind of subject`, async () => {\n    const store = await make();\n    await store.insertConsent(consent(ERIC, \"marketing\", true, 0));\n    await store.insertConsent(consent(ERIC, \"screening\", false, 1));\n    await store.insertConsent(consent(CLIENT, \"marketing\", false, 2));\n    expect((await store.latestConsent(ERIC, \"marketing\"))?.granted).toBe(true);\n    expect((await store.latestConsent(ERIC, \"screening\"))?.granted).toBe(false);\n    expect((await store.latestConsent(CLIENT, \"marketing\"))?.granted).toBe(false);\n    expect(await store.consentHistory(CLIENT)).toHaveLength(1);\n    expect(await store.latestConsent({ kind: \"client\", id: ERIC.id }, \"marketing\")).toBeNull(); // same id, another kind\n  });\n\n  it(`${name}: records the proof: the notice version, the means and the instant`, async () => {\n    const store = await make();\n    const c = { ...consent(ERIC, \"marketing\", true, 5), version: \"v7\", means: \"link\" };\n    await store.insertConsent(c);\n    const found = await store.latestConsent(ERIC, \"marketing\");\n    expect(found).toMatchObject({ version: \"v7\", means: \"link\", granted: true });\n    expect(found!.at.toISOString()).toBe(at(5).toISOString());\n  });\n\n  it(`${name}: follows a request from asked to completed, or failed with a code`, async () => {\n    const store = await make();\n    const done = request(ERIC, \"export\", 0);\n    const broke = request(ERIC, \"erasure\", 10);\n    await store.insertRequest(done);\n    await store.insertRequest(broke);\n    await store.finishRequest(done.id, { status: \"completed\", at: at(3) });\n    await store.finishRequest(broke.id, { status: \"failed\", at: at(11), failure: \"CONTRIBUTOR_FAILED\" });\n    expect(await store.getRequest(done.id)).toMatchObject({ kind: \"export\", status: \"completed\", failure: null });\n    expect((await store.getRequest(done.id))!.completedAt!.toISOString()).toBe(at(3).toISOString());\n    expect(await store.getRequest(broke.id)).toMatchObject({ kind: \"erasure\", status: \"failed\", failure: \"CONTRIBUTOR_FAILED\" });\n    expect(await store.getRequest(randomUUID())).toBeNull();\n    expect((await store.requestsOf(ERIC)).map((r) => r.id)).toEqual([broke.id, done.id]); // newest first\n    expect(await store.requestsOf(CLIENT)).toEqual([]);\n  });\n}\n\nconst awareDay = new Date(\"2026-10-20T09:00:00.000Z\");\nconst incident = (scope: string, overrides: Partial<Incident> = {}): Incident => ({\n  id: randomUUID(),\n  scope,\n  kind: \"access\",\n  awareAt: awareDay,\n  occurredAt: null,\n  description: \"A staff account opened a file it should not have.\",\n  information: [\"lease\"],\n  personsConcerned: 3,\n  measures: [{ at: awareDay, text: \"Session revoked.\" }],\n  status: \"open\",\n  assessment: null,\n  caiNotice: null,\n  personsNotice: null,\n  drill: false,\n  openedBy: \"admin\",\n  openedAt: awareDay,\n  closedAt: null,\n  retainUntil: new Date(\"2031-10-20T09:00:00.000Z\"),\n  ...overrides,\n});\n\n/** What every `IncidentStore` adapter must do. `make` gives an empty store. */\nexport function incidentStoreContract(name: string, make: () => IncidentStore | Promise<IncidentStore>) {\n  it(`${name}: writes an entry and reads it back whole, dates included`, async () => {\n    const store = await make();\n    const assessed = incident(\"t1\", { status: \"assessed\", assessment: { sensitivity: \"high\", consequences: \"medium\", likelihood: \"high\", seriousInjury: true, rationale: \"Leases.\", assessedAt: at(5), assessedBy: \"dpo\" }, caiNotice: { sentAt: at(9), channel: \"form\", reference: \"CAI-1\" } });\n    await store.insert(assessed);\n    expect(await store.get(\"t1\", assessed.id)).toEqual(assessed);\n  });\n\n  it(`${name}: never shows an entry to another scope`, async () => {\n    const store = await make();\n    const mine = incident(\"t1\");\n    await store.insert(mine);\n    await store.insert(incident(\"t2\"));\n    expect(await store.get(\"t2\", mine.id)).toBeNull();\n    expect((await store.list(\"t1\")).map((i) => i.id)).toEqual([mine.id]);\n    await store.save({ ...mine, scope: \"t2\", description: \"changed\" });\n    expect((await store.get(\"t1\", mine.id))?.description).toBe(mine.description);\n    expect(await store.get(\"t2\", mine.id)).toBeNull();\n  });\n\n  it(`${name}: lists the register oldest awareness first, and replaces an open entry`, async () => {\n    const store = await make();\n    const later = incident(\"t1\", { awareAt: at(100) });\n    const earlier = incident(\"t1\", { awareAt: at(-100) });\n    await store.insert(later);\n    await store.insert(earlier);\n    expect((await store.list(\"t1\")).map((i) => i.id)).toEqual([earlier.id, later.id]);\n    await store.save({ ...later, personsConcerned: 12 });\n    expect((await store.get(\"t1\", later.id, { lock: true }))?.personsConcerned).toBe(12);\n  });\n\n  it(`${name}: refuses to edit a closed entry`, async () => {\n    const store = await make();\n    const closed = incident(\"t1\", { status: \"closed\", closedAt: at(1) });\n    await store.insert(closed);\n    await expect(store.save({ ...closed, description: \"rewritten\" })).rejects.toThrow();\n    expect((await store.get(\"t1\", closed.id))?.description).toBe(closed.description);\n  });\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAE3B,SAAS,QAAQ,UAAU;AAK3B,IAAM,KAAK,oBAAI,KAAK,0BAA0B;AAC9C,IAAM,KAAK,CAAC,YAAoB,IAAI,KAAK,GAAG,QAAQ,IAAI,UAAU,GAAI;AACtE,IAAM,OAAgB,EAAE,MAAM,WAAW,IAAI,uCAAuC;AACpF,IAAM,SAAkB,EAAE,MAAM,UAAU,IAAI,OAAO;AAErD,IAAM,UAAU,CAAC,SAAkB,SAAiB,SAAkB,aAAoC,EAAE,IAAI,WAAW,GAAG,SAAS,SAAS,SAAS,cAAc,SAAS,OAAO,YAAY,IAAI,GAAG,OAAO,EAAE;AACnN,IAAM,UAAU,CAAC,SAAkB,MAA8B,aAAqC,EAAE,IAAI,WAAW,GAAG,SAAS,MAAM,QAAQ,aAAa,aAAa,GAAG,OAAO,GAAG,aAAa,MAAM,SAAS,KAAK;AAGlN,SAAS,qBAAqB,MAAc,MAAkD;AACnG,KAAG,GAAG,IAAI,0DAA0D,YAAY;AAC9E,UAAM,QAAQ,MAAM,KAAK;AACzB,WAAO,MAAM,MAAM,cAAc,MAAM,WAAW,CAAC,EAAE,SAAS;AAC9D,WAAO,MAAM,MAAM,eAAe,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACrD,CAAC;AAED,KAAG,GAAG,IAAI,mFAAmF,YAAY;AACvG,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,QAAQ,QAAQ,MAAM,aAAa,MAAM,CAAC;AAChD,UAAM,SAAS,QAAQ,MAAM,aAAa,OAAO,EAAE;AACnD,UAAM,QAAQ,QAAQ,MAAM,aAAa,MAAM,EAAE;AACjD,eAAW,KAAK,CAAC,OAAO,QAAQ,KAAK,EAAG,OAAM,MAAM,cAAc,CAAC;AACnE,WAAO,MAAM,MAAM,cAAc,MAAM,WAAW,CAAC,EAAE,QAAQ,KAAK;AAClE,YAAQ,MAAM,MAAM,eAAe,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;AAAA,EACrG,CAAC;AAED,KAAG,GAAG,IAAI,qEAAqE,YAAY;AACzF,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,MAAM,cAAc,QAAQ,MAAM,aAAa,MAAM,CAAC,CAAC;AAC7D,UAAM,MAAM,cAAc,QAAQ,MAAM,aAAa,OAAO,CAAC,CAAC;AAC9D,UAAM,MAAM,cAAc,QAAQ,QAAQ,aAAa,OAAO,CAAC,CAAC;AAChE,YAAQ,MAAM,MAAM,cAAc,MAAM,WAAW,IAAI,OAAO,EAAE,KAAK,IAAI;AACzE,YAAQ,MAAM,MAAM,cAAc,MAAM,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK;AAC1E,YAAQ,MAAM,MAAM,cAAc,QAAQ,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK;AAC5E,WAAO,MAAM,MAAM,eAAe,MAAM,CAAC,EAAE,aAAa,CAAC;AACzD,WAAO,MAAM,MAAM,cAAc,EAAE,MAAM,UAAU,IAAI,KAAK,GAAG,GAAG,WAAW,CAAC,EAAE,SAAS;AAAA,EAC3F,CAAC;AAED,KAAG,GAAG,IAAI,sEAAsE,YAAY;AAC1F,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,IAAI,EAAE,GAAG,QAAQ,MAAM,aAAa,MAAM,CAAC,GAAG,SAAS,MAAM,OAAO,OAAO;AACjF,UAAM,MAAM,cAAc,CAAC;AAC3B,UAAM,QAAQ,MAAM,MAAM,cAAc,MAAM,WAAW;AACzD,WAAO,KAAK,EAAE,cAAc,EAAE,SAAS,MAAM,OAAO,QAAQ,SAAS,KAAK,CAAC;AAC3E,WAAO,MAAO,GAAG,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,CAAC;AAAA,EAC1D,CAAC;AAED,KAAG,GAAG,IAAI,sEAAsE,YAAY;AAC1F,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,OAAO,QAAQ,MAAM,UAAU,CAAC;AACtC,UAAM,QAAQ,QAAQ,MAAM,WAAW,EAAE;AACzC,UAAM,MAAM,cAAc,IAAI;AAC9B,UAAM,MAAM,cAAc,KAAK;AAC/B,UAAM,MAAM,cAAc,KAAK,IAAI,EAAE,QAAQ,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;AACrE,UAAM,MAAM,cAAc,MAAM,IAAI,EAAE,QAAQ,UAAU,IAAI,GAAG,EAAE,GAAG,SAAS,qBAAqB,CAAC;AACnG,WAAO,MAAM,MAAM,WAAW,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,UAAU,QAAQ,aAAa,SAAS,KAAK,CAAC;AAC5G,YAAQ,MAAM,MAAM,WAAW,KAAK,EAAE,GAAI,YAAa,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,CAAC;AAC9F,WAAO,MAAM,MAAM,WAAW,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,WAAW,QAAQ,UAAU,SAAS,qBAAqB,CAAC;AAC3H,WAAO,MAAM,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,SAAS;AACtD,YAAQ,MAAM,MAAM,WAAW,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;AACnF,WAAO,MAAM,MAAM,WAAW,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACnD,CAAC;AACH;AAEA,IAAM,WAAW,oBAAI,KAAK,0BAA0B;AACpD,IAAM,WAAW,CAAC,OAAe,YAA+B,CAAC,OAAiB;AAAA,EAChF,IAAI,WAAW;AAAA,EACf;AAAA,EACA,MAAM;AAAA,EACN,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,aAAa,CAAC,OAAO;AAAA,EACrB,kBAAkB;AAAA,EAClB,UAAU,CAAC,EAAE,IAAI,UAAU,MAAM,mBAAmB,CAAC;AAAA,EACrD,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,eAAe;AAAA,EACf,OAAO;AAAA,EACP,UAAU;AAAA,EACV,UAAU;AAAA,EACV,UAAU;AAAA,EACV,aAAa,oBAAI,KAAK,0BAA0B;AAAA,EAChD,GAAG;AACL;AAGO,SAAS,sBAAsB,MAAc,MAAoD;AACtG,KAAG,GAAG,IAAI,6DAA6D,YAAY;AACjF,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,WAAW,SAAS,MAAM,EAAE,QAAQ,YAAY,YAAY,EAAE,aAAa,QAAQ,cAAc,UAAU,YAAY,QAAQ,eAAe,MAAM,WAAW,WAAW,YAAY,GAAG,CAAC,GAAG,YAAY,MAAM,GAAG,WAAW,EAAE,QAAQ,GAAG,CAAC,GAAG,SAAS,QAAQ,WAAW,QAAQ,EAAE,CAAC;AAC3R,UAAM,MAAM,OAAO,QAAQ;AAC3B,WAAO,MAAM,MAAM,IAAI,MAAM,SAAS,EAAE,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC7D,CAAC;AAED,KAAG,GAAG,IAAI,2CAA2C,YAAY;AAC/D,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,OAAO,SAAS,IAAI;AAC1B,UAAM,MAAM,OAAO,IAAI;AACvB,UAAM,MAAM,OAAO,SAAS,IAAI,CAAC;AACjC,WAAO,MAAM,MAAM,IAAI,MAAM,KAAK,EAAE,CAAC,EAAE,SAAS;AAChD,YAAQ,MAAM,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnE,UAAM,MAAM,KAAK,EAAE,GAAG,MAAM,OAAO,MAAM,aAAa,UAAU,CAAC;AACjE,YAAQ,MAAM,MAAM,IAAI,MAAM,KAAK,EAAE,IAAI,WAAW,EAAE,KAAK,KAAK,WAAW;AAC3E,WAAO,MAAM,MAAM,IAAI,MAAM,KAAK,EAAE,CAAC,EAAE,SAAS;AAAA,EAClD,CAAC;AAED,KAAG,GAAG,IAAI,2EAA2E,YAAY;AAC/F,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,QAAQ,SAAS,MAAM,EAAE,SAAS,GAAG,GAAG,EAAE,CAAC;AACjD,UAAM,UAAU,SAAS,MAAM,EAAE,SAAS,GAAG,IAAI,EAAE,CAAC;AACpD,UAAM,MAAM,OAAO,KAAK;AACxB,UAAM,MAAM,OAAO,OAAO;AAC1B,YAAQ,MAAM,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,QAAQ,IAAI,MAAM,EAAE,CAAC;AAChF,UAAM,MAAM,KAAK,EAAE,GAAG,OAAO,kBAAkB,GAAG,CAAC;AACnD,YAAQ,MAAM,MAAM,IAAI,MAAM,MAAM,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,gBAAgB,EAAE,KAAK,EAAE;AAAA,EACrF,CAAC;AAED,KAAG,GAAG,IAAI,oCAAoC,YAAY;AACxD,UAAM,QAAQ,MAAM,KAAK;AACzB,UAAM,SAAS,SAAS,MAAM,EAAE,QAAQ,UAAU,UAAU,GAAG,CAAC,EAAE,CAAC;AACnE,UAAM,MAAM,OAAO,MAAM;AACzB,UAAM,OAAO,MAAM,KAAK,EAAE,GAAG,QAAQ,aAAa,YAAY,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAClF,YAAQ,MAAM,MAAM,IAAI,MAAM,OAAO,EAAE,IAAI,WAAW,EAAE,KAAK,OAAO,WAAW;AAAA,EACjF,CAAC;AACH;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@krizaka/privacy",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Privacy for every Krizaka product (Loi 25): consents by purpose written once with the notice version shown, an export assembled from every module that holds the person's data, an erasure that runs in one transaction and leaves a record without personal data, and retention per purpose set by the admin. A port each module implements; no database client, no wall clock.",
   "keywords": [
     "krizaka",
@@ -58,12 +58,12 @@
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
     "zod": "^4.6.7",
-    "@krizaka/config": "^0.8.1"
+    "@krizaka/config": "^0.10.0"
   },
   "dependencies": {
     "@krizaka/db": "^0.2.0",
-    "@krizaka/settings": "^0.4.0",
-    "@krizaka/time": "^0.1.0"
+    "@krizaka/time": "^0.1.0",
+    "@krizaka/settings": "^0.5.0"
   },
   "peerDependencies": {
     "vitest": ">=4",

package/dist/port-Ds9VVyC2.d.ts

@@ -1,144 +0,0 @@
-import { Query } from '@krizaka/db';
-
-/**
- * The ports of « privacy » (Loi 25): consents by purpose, the person's data exported from every module that holds it, and erased
- * from every module in one transaction. Generic: no product import, no database client (a `Query` comes in), no wall clock (a
- * `Clock` comes in). What a module holds, and what erasing it means (blanking a row, deleting a file, keeping an invoice for six
- * years), is the module's: it implements `PrivacyContributor`.
- */
-
-/**
- * Whose data it is. Usually an account (`{ kind: "account", id }`), but a product's data subject is not always an account: Akinaza's
- * is a client file, Yomizaka's a tenant on an application. The `kind` says which.
- */
-interface Subject {
-    /** What the id identifies: `account`, `client`, `application`. Lower-case letters, digits and `_`. */
-    kind: string;
-    /** The product's id for it (a UUID, a slug). */
-    id: string;
-}
-/** What a product records when a person agrees, or withdraws. */
-interface ConsentInput {
-    subject: Subject;
-    /** What the person agreed to (`marketing`, `screening`, `reminders`): one of the product's declared purposes. */
-    purpose: string;
-    /** The version of the notice shown to them: the proof of WHAT they agreed to. */
-    version: string;
-    granted: boolean;
-    /** How they said it (`checkbox`, `link`, `verbal`, `erasure`). */
-    means?: string | undefined;
-}
-/** A consent as written. It is never edited: a withdrawal is a new row. */
-interface ConsentRecord {
-    id: string;
-    subject: Subject;
-    purpose: string;
-    version: string;
-    granted: boolean;
-    means: string | null;
-    at: Date;
-}
-declare const REQUEST_KIND: {
-    readonly export: "export";
-    readonly erasure: "erasure";
-};
-type RequestKind = (typeof REQUEST_KIND)[keyof typeof REQUEST_KIND];
-declare const REQUEST_STATUS: {
-    readonly requested: "requested";
-    readonly completed: "completed";
-    readonly failed: "failed";
-};
-type RequestStatus = (typeof REQUEST_STATUS)[keyof typeof REQUEST_STATUS];
-/** An export or an erasure asked for, and where it stands. It holds an id of the subject and no other personal data. */
-interface PrivacyRequest {
-    id: string;
-    subject: Subject;
-    kind: RequestKind;
-    status: RequestStatus;
-    requestedAt: Date;
-    completedAt: Date | null;
-    /** A code, never a message that could carry data. */
-    failure: string | null;
-}
-/**
- * A module that holds personal data. The product registers one per module and one for its own tables.
- *
- * - `exportFor` returns what the module holds about the subject, as JSON-able data.
- * - `eraseFor` erases or anonymises it, through the transaction it is given, so the whole erasure commits or rolls back together.
- *   A side effect outside the database (a file in storage) is not done here: append it to the outbox in the same transaction.
- * - `purgeExpired` (optional) removes what the retention of a purpose says is past, for everyone.
- */
-interface PrivacyContributor {
-    /** A stable name, the key of its part in the export (`audit`, `orders`). */
-    name: string;
-    exportFor(query: Query, subject: Subject): Promise<unknown>;
-    eraseFor(tx: Query, subject: Subject): Promise<void>;
-    purgeExpired?(tx: Query, input: {
-        purpose: string;
-        before: Date;
-    }): Promise<number>;
-}
-/** The whole export of a subject: one document, a part per contributor. */
-interface ExportDocument {
-    format: 1;
-    subject: Subject;
-    generatedAt: string;
-    modules: Record<string, unknown>;
-}
-/** Where consents and requests live. Every adapter runs `privacyStoreContract` (`@krizaka/privacy/testkit`). */
-interface PrivacyStore {
-    insertConsent(consent: ConsentRecord): Promise<void>;
-    /** The consent with the last word for this purpose, or null when the person never said anything. */
-    latestConsent(subject: Subject, purpose: string): Promise<ConsentRecord | null>;
-    /** Every consent of the subject, oldest first. */
-    consentHistory(subject: Subject): Promise<ConsentRecord[]>;
-    insertRequest(request: PrivacyRequest): Promise<void>;
-    getRequest(id: string): Promise<PrivacyRequest | null>;
-    finishRequest(id: string, outcome: {
-        status: "completed" | "failed";
-        at: Date;
-        failure?: string;
-    }): Promise<void>;
-    requestsOf(subject: Subject): Promise<PrivacyRequest[]>;
-}
-/** The structural slice of `@krizaka/audit` this package writes through, so it adds no dependency. */
-interface AuditPort {
-    record(query: Query, entry: {
-        actorId: string | null;
-        actorLabel: string;
-        action: string;
-        target?: {
-            type: string;
-            id: string;
-        } | null;
-        detail?: Record<string, unknown>;
-    }): Promise<unknown>;
-}
-/** The structural slice of `@krizaka/outbox` used for a large export. */
-interface OutboxPort {
-    append(tx: Query, message: {
-        topic: string;
-        type: string;
-        payload: unknown;
-        id?: string;
-    }): Promise<unknown>;
-}
-declare const PRIVACY_CODE: {
-    readonly badSubject: "PRIVACY_BAD_SUBJECT";
-    readonly badPurpose: "PRIVACY_BAD_PURPOSE";
-    readonly badConsent: "PRIVACY_BAD_CONSENT";
-    readonly unknownRequest: "PRIVACY_UNKNOWN_REQUEST";
-    readonly notAnExport: "PRIVACY_NOT_AN_EXPORT";
-    readonly alreadyDone: "PRIVACY_ALREADY_DONE";
-    readonly contributorFailed: "PRIVACY_CONTRIBUTOR_FAILED";
-    readonly noOutbox: "PRIVACY_NO_OUTBOX";
-};
-type PrivacyCode = (typeof PRIVACY_CODE)[keyof typeof PRIVACY_CODE];
-declare class PrivacyError extends Error {
-    readonly code: PrivacyCode;
-    constructor(code: PrivacyCode, message: string, options?: {
-        cause?: unknown;
-    });
-}
-
-export { type AuditPort as A, type ConsentInput as C, type ExportDocument as E, type OutboxPort as O, type PrivacyContributor as P, REQUEST_KIND as R, type Subject as S, type PrivacyStore as a, type ConsentRecord as b, type PrivacyRequest as c, PRIVACY_CODE as d, type PrivacyCode as e, PrivacyError as f, REQUEST_STATUS as g, type RequestKind as h, type RequestStatus as i };