@krizaka/privacy 0.2.3 → 0.2.4

package/README.md

@@ -1,6 +1,6 @@
 # @krizaka/privacy
 
-Privacy for every Krizaka product (Loi 25): **consents by purpose**, the person's data **exported** from every module that holds it, **erased** from every module in one transaction, and **retention** per purpose set by the admin. Six products had a partial copy (Yomizaka's consents, export and delete; Akinaza's `recordConsent` and `eraseClient`; the asynchronous export and the admin exports the products carried; the consent columns). This is the one version.
+Privacy for every Krizaka product (Loi 25): **consents by purpose**, the person's data **exported** from every module that holds it, **erased** from every module in one transaction, and **retention** per purpose set by the admin. Six products had a partial copy (Verikora's consents, export and delete; Folioviv's `recordConsent` and `eraseClient`; the asynchronous export and the admin exports the products carried; the consent columns). This is the one version.
 
 ```ts
 import { transaction } from "@krizaka/db";
@@ -11,22 +11,29 @@ emitMigration(privacySchema, 1, { tables: {} }); // commit the SQL once, in your
 
 const privacy = createPrivacy({
   clock: { now: () => new Date() },
-  purposes: ["marketing", "screening"],                 // the purposes the product declares
+  purposes: ["marketing", "screening"], // the purposes the product declares
   contributors: [auditContributor(audit), ordersContributor, filesContributor], // every module that holds personal data
   transaction: (work) => transaction(connect, work),
   retentionDays: retentionFromSettings((key) => settings.get(key)), // privacy.retention.<purpose>Days
-  audit, outbox,                                         // optional: the erasure is recorded; a large export goes through the outbox
+  audit,
+  outbox, // optional: the erasure is recorded; a large export goes through the outbox
 });
 
-const eric = { kind: "account", id: account.id };         // a subject is a kind and an id: an account, a client file, an application
-await privacy.recordConsent(query, { subject: eric, purpose: "marketing", version: "2026-10-01", granted: true, means: "checkbox" });
-await privacy.hasConsent(query, eric, "marketing");       // the consent with the last word; never having said anything is a no
+const eric = { kind: "account", id: account.id }; // a subject is a kind and an id: an account, a client file, an application
+await privacy.recordConsent(query, {
+  subject: eric,
+  purpose: "marketing",
+  version: "2026-10-01",
+  granted: true,
+  means: "checkbox",
+});
+await privacy.hasConsent(query, eric, "marketing"); // the consent with the last word; never having said anything is a no
 const document = await privacy.exportSubject(query, eric); // { format: 1, subject, generatedAt, modules: { audit, orders, files } }
-await privacy.eraseSubject(eric);                         // every contributor, one transaction, consents withdrawn, a record without personal data
-await privacy.purge(query);                               // from the product's job: what is past each purpose's retention
+await privacy.eraseSubject(eric); // every contributor, one transaction, consents withdrawn, a record without personal data
+await privacy.purge(query); // from the product's job: what is past each purpose's retention
 ```
 
-- **A subject is a kind and an id**, not necessarily an account: Akinaza's data subject is a client file, Yomizaka's a tenant on an application.
+- **A subject is a kind and an id**, not necessarily an account: Folioviv's data subject is a client file, Verikora's a tenant on an application.
 - **`privacy.consent` is written once**: a trigger refuses every update; a withdrawal is a new row; the row with the last `seq` wins. Each consent holds the **version of the notice shown**, the means and the instant: the proof of what the person agreed to.
 - **`PrivacyContributor`** is the port every module implements: `exportFor(query, subject)`, `eraseFor(tx, subject)` (erase or anonymise through the transaction it is given: a module that keeps an invoice for six years blanks the name and keeps the row), and optionally `purgeExpired(tx, { purpose, before })`. The product registers one for its own tables. `auditContributor(audit)` is provided for `@krizaka/audit` (the export lists the actor's entries; the erasure detaches them and keeps the facts). A side effect outside the database (a file in storage) is not done in `eraseFor`: append it to the outbox in the same transaction.
 - **Export** assembles one JSON document with a part per contributor; a contributor that fails fails the export, naming it (a silent omission would be a lie). **A large export** is asked in the caller's transaction with `requestExport(tx, subject)` (it appends `evt.privacy.export_requested.v1` to the outbox, holding the request id only) and a worker calls `fulfilExport(query, requestId, deliver)`: the asynchronous mode.
@@ -41,15 +48,31 @@ The register that the Act respecting the protection of personal information in t
 ```ts
 import { createIncidentRegister, registerToCsv, suggestSeriousInjury } from "@krizaka/privacy";
 
-emitMigration(privacySchema, 2, { tables: {} });            // privacy.incident (after version 1)
+emitMigration(privacySchema, 2, { tables: {} }); // privacy.incident (after version 1)
 const incidents = createIncidentRegister({ clock: { now: () => new Date() }, audit });
 const admin = { id: account.id, label: account.name };
 
-const { id } = await incidents.open(query, { scope: tenantId, kind: "access", description: "…", information: ["lease"], personsConcerned: 3 }, admin);
+const { id } = await incidents.open(
+  query,
+  { scope: tenantId, kind: "access", description: "…", information: ["lease"], personsConcerned: 3 },
+  admin,
+);
 await incidents.recordMeasure(query, tenantId, id, "Session revoked", admin);
-await incidents.assess(query, tenantId, id, { sensitivity: "high", consequences: "high", likelihood: "medium", seriousInjury: suggestSeriousInjury(factors), rationale: "…" }, admin);
-await incidents.recordNotice(query, tenantId, id, "cai", { channel: "form" }, admin);     // and "persons"
-await incidents.close(query, tenantId, id, admin);       // a serious injury closes once both notices are recorded
+await incidents.assess(
+  query,
+  tenantId,
+  id,
+  {
+    sensitivity: "high",
+    consequences: "high",
+    likelihood: "medium",
+    seriousInjury: suggestSeriousInjury(factors),
+    rationale: "…",
+  },
+  admin,
+);
+await incidents.recordNotice(query, tenantId, id, "cai", { channel: "form" }, admin); // and "persons"
+await incidents.close(query, tenantId, id, admin); // a serious injury closes once both notices are recorded
 registerToCsv((await incidents.exportRegister(query, tenantId)).entries);
 ```
 

package/dist/{chunk-HXGBMBVB.js → chunk-DVWHUJHQ.js}

@@ -49,4 +49,4 @@ export {
   checkSubject,
   checkPurpose
 };
-//# sourceMappingURL=chunk-HXGBMBVB.js.map
+//# sourceMappingURL=chunk-DVWHUJHQ.js.map

package/dist/chunk-DVWHUJHQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port.ts","../src/rules.ts"],"sourcesContent":["/**\n * The ports of « privacy » (Loi 25): consents by purpose, the person's data exported from every module that holds it, and erased\n * from every module in one transaction. Generic: no product import, no database client (a `Query` comes in), no wall clock (a\n * `Clock` comes in). What a module holds, and what erasing it means (blanking a row, deleting a file, keeping an invoice for six\n * years), is the module's: it implements `PrivacyContributor`.\n */\nexport type { Clock, Query } from \"@krizaka/db\";\nimport type { Query } from \"@krizaka/db\";\n\n/**\n * Whose data it is. Usually an account (`{ kind: \"account\", id }`), but a product's data subject is not always an account: Folioviv's\n * is a client file, Verikora's a tenant on an application. The `kind` says which.\n */\nexport interface Subject {\n  /** What the id identifies: `account`, `client`, `application`. Lower-case letters, digits and `_`. */\n  kind: string;\n  /** The product's id for it (a UUID, a slug). */\n  id: string;\n}\n\n/** What a product records when a person agrees, or withdraws. */\nexport interface ConsentInput {\n  subject: Subject;\n  /** What the person agreed to (`marketing`, `screening`, `reminders`): one of the product's declared purposes. */\n  purpose: string;\n  /** The version of the notice shown to them: the proof of WHAT they agreed to. */\n  version: string;\n  granted: boolean;\n  /** How they said it (`checkbox`, `link`, `verbal`, `erasure`). */\n  means?: string | undefined;\n}\n\n/** A consent as written. It is never edited: a withdrawal is a new row. */\nexport interface ConsentRecord {\n  id: string;\n  subject: Subject;\n  purpose: string;\n  version: string;\n  granted: boolean;\n  means: string | null;\n  at: Date;\n}\n\nexport const REQUEST_KIND = { export: \"export\", erasure: \"erasure\" } as const;\nexport type RequestKind = (typeof REQUEST_KIND)[keyof typeof REQUEST_KIND];\nexport const REQUEST_STATUS = { requested: \"requested\", completed: \"completed\", failed: \"failed\" } as const;\nexport type RequestStatus = (typeof REQUEST_STATUS)[keyof typeof REQUEST_STATUS];\n\n/** An export or an erasure asked for, and where it stands. It holds an id of the subject and no other personal data. */\nexport interface PrivacyRequest {\n  id: string;\n  subject: Subject;\n  kind: RequestKind;\n  status: RequestStatus;\n  requestedAt: Date;\n  completedAt: Date | null;\n  /** A code, never a message that could carry data. */\n  failure: string | null;\n}\n\n/**\n * A module that holds personal data. The product registers one per module and one for its own tables.\n *\n * - `exportFor` returns what the module holds about the subject, as JSON-able data.\n * - `eraseFor` erases or anonymises it, through the transaction it is given, so the whole erasure commits or rolls back together.\n *   A side effect outside the database (a file in storage) is not done here: append it to the outbox in the same transaction.\n * - `purgeExpired` (optional) removes what the retention of a purpose says is past, for everyone.\n */\nexport interface PrivacyContributor {\n  /** A stable name, the key of its part in the export (`audit`, `orders`). */\n  name: string;\n  exportFor(query: Query, subject: Subject): Promise<unknown>;\n  eraseFor(tx: Query, subject: Subject): Promise<void>;\n  purgeExpired?(tx: Query, input: { purpose: string; before: Date }): Promise<number>;\n}\n\n/** The whole export of a subject: one document, a part per contributor. */\nexport interface ExportDocument {\n  format: 1;\n  subject: Subject;\n  generatedAt: string;\n  modules: Record<string, unknown>;\n}\n\n/** Where consents and requests live. Every adapter runs `privacyStoreContract` (`@krizaka/privacy/testkit`). */\nexport interface PrivacyStore {\n  insertConsent(consent: ConsentRecord): Promise<void>;\n  /** The consent with the last word for this purpose, or null when the person never said anything. */\n  latestConsent(subject: Subject, purpose: string): Promise<ConsentRecord | null>;\n  /** Every consent of the subject, oldest first. */\n  consentHistory(subject: Subject): Promise<ConsentRecord[]>;\n  insertRequest(request: PrivacyRequest): Promise<void>;\n  getRequest(id: string): Promise<PrivacyRequest | null>;\n  finishRequest(id: string, outcome: { status: \"completed\" | \"failed\"; at: Date; failure?: string }): Promise<void>;\n  requestsOf(subject: Subject): Promise<PrivacyRequest[]>;\n}\n\n/** The structural slice of `@krizaka/audit` this package writes through, so it adds no dependency. */\nexport interface AuditPort {\n  record(\n    query: Query,\n    entry: {\n      actorId: string | null;\n      actorLabel: string;\n      action: string;\n      target?: { type: string; id: string } | null;\n      detail?: Record<string, unknown>;\n    },\n  ): Promise<unknown>;\n}\n\n/** The structural slice of `@krizaka/outbox` used for a large export. */\nexport interface OutboxPort {\n  append(tx: Query, message: { topic: string; type: string; payload: unknown; id?: string }): Promise<unknown>;\n}\n\nexport const PRIVACY_CODE = {\n  badSubject: \"PRIVACY_BAD_SUBJECT\",\n  badPurpose: \"PRIVACY_BAD_PURPOSE\",\n  badConsent: \"PRIVACY_BAD_CONSENT\",\n  unknownRequest: \"PRIVACY_UNKNOWN_REQUEST\",\n  notAnExport: \"PRIVACY_NOT_AN_EXPORT\",\n  alreadyDone: \"PRIVACY_ALREADY_DONE\",\n  contributorFailed: \"PRIVACY_CONTRIBUTOR_FAILED\",\n  noOutbox: \"PRIVACY_NO_OUTBOX\",\n} as const;\nexport type PrivacyCode = (typeof PRIVACY_CODE)[keyof typeof PRIVACY_CODE];\n\nexport class PrivacyError extends Error {\n  constructor(\n    readonly code: PrivacyCode,\n    message: string,\n    options?: { cause?: unknown },\n  ) {\n    super(message, options);\n    this.name = \"PrivacyError\";\n  }\n}\n","import { PRIVACY_CODE, PrivacyError, type Subject } from \"./port\";\n\nconst KIND = /^[a-z][a-z0-9_]{0,39}$/;\nconst PURPOSE = /^[a-z][a-z0-9_-]{0,39}$/;\nconst MAX_ID = 200;\n\n/** @throws PrivacyError for a subject whose kind or id is not well formed */\nexport function checkSubject(subject: Subject): void {\n  if (!KIND.test(subject.kind))\n    throw new PrivacyError(\n      PRIVACY_CODE.badSubject,\n      `subject kind « ${subject.kind} »: lower-case letters, digits and _, starting with a letter`,\n    );\n  if (subject.id.length < 1 || subject.id.length > MAX_ID)\n    throw new PrivacyError(PRIVACY_CODE.badSubject, `subject id: 1 to ${MAX_ID} characters`);\n}\n\n/** @throws PrivacyError for a purpose that is not lower-case letters, digits, `_` and `-`, starting with a letter */\nexport function checkPurpose(purpose: string): void {\n  if (!PURPOSE.test(purpose))\n    throw new PrivacyError(\n      PRIVACY_CODE.badPurpose,\n      `purpose « ${purpose} »: lower-case letters, digits, _ and -, starting with a letter, at most 40 characters`,\n    );\n}\n"],"mappings":";AA2CO,IAAM,eAAe,EAAE,QAAQ,UAAU,SAAS,UAAU;AAE5D,IAAM,iBAAiB,EAAE,WAAW,aAAa,WAAW,aAAa,QAAQ,SAAS;AAuE1F,IAAM,eAAe;AAAA,EAC1B,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,UAAU;AACZ;AAGO,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YACW,MACT,SACA,SACA;AACA,UAAM,SAAS,OAAO;AAJb;AAKT,SAAK,OAAO;AAAA,EACd;AAAA,EANW;AAOb;;;ACvIA,IAAM,OAAO;AACb,IAAM,UAAU;AAChB,IAAM,SAAS;AAGR,SAAS,aAAa,SAAwB;AACnD,MAAI,CAAC,KAAK,KAAK,QAAQ,IAAI;AACzB,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,qBAAkB,QAAQ,IAAI;AAAA,IAChC;AACF,MAAI,QAAQ,GAAG,SAAS,KAAK,QAAQ,GAAG,SAAS;AAC/C,UAAM,IAAI,aAAa,aAAa,YAAY,oBAAoB,MAAM,aAAa;AAC3F;AAGO,SAAS,aAAa,SAAuB;AAClD,MAAI,CAAC,QAAQ,KAAK,OAAO;AACvB,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,gBAAa,OAAO;AAAA,IACtB;AACJ;","names":[]}

package/dist/{incident-DLXCVzpW.d.ts → incident-B4bxcEgY.d.ts}

@@ -8,8 +8,8 @@ import { Query, Clock } from '@krizaka/db';
  */
 
 /**
- * Whose data it is. Usually an account (`{ kind: "account", id }`), but a product's data subject is not always an account: Akinaza's
- * is a client file, Yomizaka's a tenant on an application. The `kind` says which.
+ * Whose data it is. Usually an account (`{ kind: "account", id }`), but a product's data subject is not always an account: Folioviv's
+ * is a client file, Verikora's a tenant on an application. The `kind` says which.
  */
 interface Subject {
     /** What the id identifies: `account`, `client`, `application`. Lower-case letters, digits and `_`. */

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import * as _krizaka_db from '@krizaka/db';
 import { Query, Clock } from '@krizaka/db';
 export { Clock, Query } from '@krizaka/db';
-import { P as PrivacyContributor, I as IncidentStore, a as IncidentDeps, b as IncidentRegister, c as PrivacyStore, C as ConsentInput, d as ConsentRecord, S as Subject, E as ExportDocument, e as PrivacyRequest, A as AuditPort, O as OutboxPort } from './incident-DLXCVzpW.js';
-export { f as AssessmentInput, g as INCIDENT_CODE, h as INCIDENT_KIND, i as INCIDENT_STATUS, j as Incident, k as IncidentActor, l as IncidentAssessment, m as IncidentCode, n as IncidentError, o as IncidentInput, p as IncidentKind, q as IncidentMeasure, r as IncidentNotice, s as IncidentStatus, L as LEVEL, t as Level, N as NOTICE_TARGET, u as NoticeTarget, v as PRIVACY_CODE, w as PrivacyCode, x as PrivacyError, R as REGISTER_CSV_COLUMNS, y as REQUEST_KIND, z as REQUEST_STATUS, B as RegisterDocument, D as RequestKind, F as RequestStatus, G as registerToCsv, H as retainUntil, J as suggestSeriousInjury } from './incident-DLXCVzpW.js';
+import { P as PrivacyContributor, I as IncidentStore, a as IncidentDeps, b as IncidentRegister, c as PrivacyStore, C as ConsentInput, d as ConsentRecord, S as Subject, E as ExportDocument, e as PrivacyRequest, A as AuditPort, O as OutboxPort } from './incident-B4bxcEgY.js';
+export { f as AssessmentInput, g as INCIDENT_CODE, h as INCIDENT_KIND, i as INCIDENT_STATUS, j as Incident, k as IncidentActor, l as IncidentAssessment, m as IncidentCode, n as IncidentError, o as IncidentInput, p as IncidentKind, q as IncidentMeasure, r as IncidentNotice, s as IncidentStatus, L as LEVEL, t as Level, N as NOTICE_TARGET, u as NoticeTarget, v as PRIVACY_CODE, w as PrivacyCode, x as PrivacyError, R as REGISTER_CSV_COLUMNS, y as REQUEST_KIND, z as REQUEST_STATUS, B as RegisterDocument, D as RequestKind, F as RequestStatus, G as registerToCsv, H as retainUntil, J as suggestSeriousInjury } from './incident-B4bxcEgY.js';
 
 /** The structural slice of `@krizaka/audit` that contributes: what the trail holds about an actor, and detaching them from it. */
 interface AuditTrail {

package/dist/index.js

@@ -5,7 +5,7 @@ import {
   REQUEST_STATUS,
   checkPurpose,
   checkSubject
-} from "./chunk-HXGBMBVB.js";
+} from "./chunk-DVWHUJHQ.js";
 
 // src/contributors.ts
 function auditContributor(audit, options = {}) {

package/dist/settings.js

@@ -1,6 +1,6 @@
 import {
   checkPurpose
-} from "./chunk-HXGBMBVB.js";
+} from "./chunk-DVWHUJHQ.js";
 
 // src/settings.ts
 import { integer } from "@krizaka/settings";

package/dist/testkit.d.ts

@@ -1,4 +1,4 @@
-import { I as IncidentStore, c as PrivacyStore } from './incident-DLXCVzpW.js';
+import { I as IncidentStore, c as PrivacyStore } from './incident-B4bxcEgY.js';
 import '@krizaka/db';
 
 /** What every `PrivacyStore` adapter must do: the same behaviour behind the same port. `make` gives an empty store. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@krizaka/privacy",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Privacy for every Krizaka product (Loi 25): consents by purpose written once with the notice version shown, an export assembled from every module that holds the person's data, an erasure that runs in one transaction and leaves a record without personal data, and retention per purpose set by the admin. A port each module implements; no database client, no wall clock.",
   "keywords": [
     "krizaka",
@@ -58,12 +58,12 @@
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
     "zod": "^4.6.7",
-    "@krizaka/config": "^0.20.0"
+    "@krizaka/config": "^0.21.0"
   },
   "dependencies": {
     "@krizaka/db": "^0.3.1",
-    "@krizaka/time": "^0.2.0",
-    "@krizaka/settings": "^0.6.0"
+    "@krizaka/settings": "^0.7.0",
+    "@krizaka/time": "^0.2.0"
   },
   "peerDependencies": {
     "vitest": ">=4",

package/dist/chunk-HXGBMBVB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/port.ts","../src/rules.ts"],"sourcesContent":["/**\n * The ports of « privacy » (Loi 25): consents by purpose, the person's data exported from every module that holds it, and erased\n * from every module in one transaction. Generic: no product import, no database client (a `Query` comes in), no wall clock (a\n * `Clock` comes in). What a module holds, and what erasing it means (blanking a row, deleting a file, keeping an invoice for six\n * years), is the module's: it implements `PrivacyContributor`.\n */\nexport type { Clock, Query } from \"@krizaka/db\";\nimport type { Query } from \"@krizaka/db\";\n\n/**\n * Whose data it is. Usually an account (`{ kind: \"account\", id }`), but a product's data subject is not always an account: Akinaza's\n * is a client file, Yomizaka's a tenant on an application. The `kind` says which.\n */\nexport interface Subject {\n  /** What the id identifies: `account`, `client`, `application`. Lower-case letters, digits and `_`. */\n  kind: string;\n  /** The product's id for it (a UUID, a slug). */\n  id: string;\n}\n\n/** What a product records when a person agrees, or withdraws. */\nexport interface ConsentInput {\n  subject: Subject;\n  /** What the person agreed to (`marketing`, `screening`, `reminders`): one of the product's declared purposes. */\n  purpose: string;\n  /** The version of the notice shown to them: the proof of WHAT they agreed to. */\n  version: string;\n  granted: boolean;\n  /** How they said it (`checkbox`, `link`, `verbal`, `erasure`). */\n  means?: string | undefined;\n}\n\n/** A consent as written. It is never edited: a withdrawal is a new row. */\nexport interface ConsentRecord {\n  id: string;\n  subject: Subject;\n  purpose: string;\n  version: string;\n  granted: boolean;\n  means: string | null;\n  at: Date;\n}\n\nexport const REQUEST_KIND = { export: \"export\", erasure: \"erasure\" } as const;\nexport type RequestKind = (typeof REQUEST_KIND)[keyof typeof REQUEST_KIND];\nexport const REQUEST_STATUS = { requested: \"requested\", completed: \"completed\", failed: \"failed\" } as const;\nexport type RequestStatus = (typeof REQUEST_STATUS)[keyof typeof REQUEST_STATUS];\n\n/** An export or an erasure asked for, and where it stands. It holds an id of the subject and no other personal data. */\nexport interface PrivacyRequest {\n  id: string;\n  subject: Subject;\n  kind: RequestKind;\n  status: RequestStatus;\n  requestedAt: Date;\n  completedAt: Date | null;\n  /** A code, never a message that could carry data. */\n  failure: string | null;\n}\n\n/**\n * A module that holds personal data. The product registers one per module and one for its own tables.\n *\n * - `exportFor` returns what the module holds about the subject, as JSON-able data.\n * - `eraseFor` erases or anonymises it, through the transaction it is given, so the whole erasure commits or rolls back together.\n *   A side effect outside the database (a file in storage) is not done here: append it to the outbox in the same transaction.\n * - `purgeExpired` (optional) removes what the retention of a purpose says is past, for everyone.\n */\nexport interface PrivacyContributor {\n  /** A stable name, the key of its part in the export (`audit`, `orders`). */\n  name: string;\n  exportFor(query: Query, subject: Subject): Promise<unknown>;\n  eraseFor(tx: Query, subject: Subject): Promise<void>;\n  purgeExpired?(tx: Query, input: { purpose: string; before: Date }): Promise<number>;\n}\n\n/** The whole export of a subject: one document, a part per contributor. */\nexport interface ExportDocument {\n  format: 1;\n  subject: Subject;\n  generatedAt: string;\n  modules: Record<string, unknown>;\n}\n\n/** Where consents and requests live. Every adapter runs `privacyStoreContract` (`@krizaka/privacy/testkit`). */\nexport interface PrivacyStore {\n  insertConsent(consent: ConsentRecord): Promise<void>;\n  /** The consent with the last word for this purpose, or null when the person never said anything. */\n  latestConsent(subject: Subject, purpose: string): Promise<ConsentRecord | null>;\n  /** Every consent of the subject, oldest first. */\n  consentHistory(subject: Subject): Promise<ConsentRecord[]>;\n  insertRequest(request: PrivacyRequest): Promise<void>;\n  getRequest(id: string): Promise<PrivacyRequest | null>;\n  finishRequest(id: string, outcome: { status: \"completed\" | \"failed\"; at: Date; failure?: string }): Promise<void>;\n  requestsOf(subject: Subject): Promise<PrivacyRequest[]>;\n}\n\n/** The structural slice of `@krizaka/audit` this package writes through, so it adds no dependency. */\nexport interface AuditPort {\n  record(\n    query: Query,\n    entry: {\n      actorId: string | null;\n      actorLabel: string;\n      action: string;\n      target?: { type: string; id: string } | null;\n      detail?: Record<string, unknown>;\n    },\n  ): Promise<unknown>;\n}\n\n/** The structural slice of `@krizaka/outbox` used for a large export. */\nexport interface OutboxPort {\n  append(tx: Query, message: { topic: string; type: string; payload: unknown; id?: string }): Promise<unknown>;\n}\n\nexport const PRIVACY_CODE = {\n  badSubject: \"PRIVACY_BAD_SUBJECT\",\n  badPurpose: \"PRIVACY_BAD_PURPOSE\",\n  badConsent: \"PRIVACY_BAD_CONSENT\",\n  unknownRequest: \"PRIVACY_UNKNOWN_REQUEST\",\n  notAnExport: \"PRIVACY_NOT_AN_EXPORT\",\n  alreadyDone: \"PRIVACY_ALREADY_DONE\",\n  contributorFailed: \"PRIVACY_CONTRIBUTOR_FAILED\",\n  noOutbox: \"PRIVACY_NO_OUTBOX\",\n} as const;\nexport type PrivacyCode = (typeof PRIVACY_CODE)[keyof typeof PRIVACY_CODE];\n\nexport class PrivacyError extends Error {\n  constructor(\n    readonly code: PrivacyCode,\n    message: string,\n    options?: { cause?: unknown },\n  ) {\n    super(message, options);\n    this.name = \"PrivacyError\";\n  }\n}\n","import { PRIVACY_CODE, PrivacyError, type Subject } from \"./port\";\n\nconst KIND = /^[a-z][a-z0-9_]{0,39}$/;\nconst PURPOSE = /^[a-z][a-z0-9_-]{0,39}$/;\nconst MAX_ID = 200;\n\n/** @throws PrivacyError for a subject whose kind or id is not well formed */\nexport function checkSubject(subject: Subject): void {\n  if (!KIND.test(subject.kind))\n    throw new PrivacyError(\n      PRIVACY_CODE.badSubject,\n      `subject kind « ${subject.kind} »: lower-case letters, digits and _, starting with a letter`,\n    );\n  if (subject.id.length < 1 || subject.id.length > MAX_ID)\n    throw new PrivacyError(PRIVACY_CODE.badSubject, `subject id: 1 to ${MAX_ID} characters`);\n}\n\n/** @throws PrivacyError for a purpose that is not lower-case letters, digits, `_` and `-`, starting with a letter */\nexport function checkPurpose(purpose: string): void {\n  if (!PURPOSE.test(purpose))\n    throw new PrivacyError(\n      PRIVACY_CODE.badPurpose,\n      `purpose « ${purpose} »: lower-case letters, digits, _ and -, starting with a letter, at most 40 characters`,\n    );\n}\n"],"mappings":";AA2CO,IAAM,eAAe,EAAE,QAAQ,UAAU,SAAS,UAAU;AAE5D,IAAM,iBAAiB,EAAE,WAAW,aAAa,WAAW,aAAa,QAAQ,SAAS;AAuE1F,IAAM,eAAe;AAAA,EAC1B,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,UAAU;AACZ;AAGO,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YACW,MACT,SACA,SACA;AACA,UAAM,SAAS,OAAO;AAJb;AAKT,SAAK,OAAO;AAAA,EACd;AAAA,EANW;AAOb;;;ACvIA,IAAM,OAAO;AACb,IAAM,UAAU;AAChB,IAAM,SAAS;AAGR,SAAS,aAAa,SAAwB;AACnD,MAAI,CAAC,KAAK,KAAK,QAAQ,IAAI;AACzB,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,qBAAkB,QAAQ,IAAI;AAAA,IAChC;AACF,MAAI,QAAQ,GAAG,SAAS,KAAK,QAAQ,GAAG,SAAS;AAC/C,UAAM,IAAI,aAAa,aAAa,YAAY,oBAAoB,MAAM,aAAa;AAC3F;AAGO,SAAS,aAAa,SAAuB;AAClD,MAAI,CAAC,QAAQ,KAAK,OAAO;AACvB,UAAM,IAAI;AAAA,MACR,aAAa;AAAA,MACb,gBAAa,OAAO;AAAA,IACtB;AACJ;","names":[]}