@lunora/privacy 0.0.0-stage → 1.0.0-alpha.1

package/dist/packem_shared/define.d-Dv7btZmk.d.ts

@@ -0,0 +1,368 @@
+import { b as RetainDirective, R as RetentionRule, P as PrivacyPreset } from "./rules.d-DJa3SIb3.js";
+/** One problem the coverage check found. */
+interface CoverageProblem {
+  /** `unclassified`: no dataset and no exclusion. `excluded_without_reason`: excluded with a blank reason. */
+  readonly code: "excluded_without_reason" | "unclassified";
+  readonly table: string;
+}
+/** The better-auth tables `authDataset()` covers when no table is renamed. */
+declare const AUTH_DEFAULT_TABLES: readonly ["account", "apikey", "member", "passkey", "session", "teamMember", "twoFactor", "user"];
+/**
+ * Which GDPR articles a dataset's export falls under. One export serves both
+ * Art. 15 (access, every origin) and Art. 20 (portability, data the subject
+ * provided, on consent or contract, by automated means).
+ */
+/** Where a dataset's data came from. */
+type DataOrigin = "provided" | "observed" | "derived" | "inferred";
+/** The Art. 6(1) basis the data is processed on. */
+type LegalBasis = "consent" | "contract" | "legal_obligation" | "legitimate_interest";
+/** When a dataset is handled. Erasure runs `quiesce` first, so nothing writes behind it. */
+type DatasetPhase = "quiesce" | "erase" | "tombstone";
+/** Which shard holds the subject's rows. */
+type DatasetPlacement = "subject" | "root" | "global";
+/** What erasure does to one table. */
+type TableErasure = "delete" | "anonymise" | RetainDirective;
+/** How one table in a dataset is treated. */
+interface TableSpec {
+  /** Defaults to `delete`. */
+  readonly erase?: TableErasure;
+  /** Columns left out of the export, such as internal bookkeeping. */
+  readonly omit?: ReadonlyArray<string>;
+  /** Overrides the dataset's origin for this table. */
+  readonly origin?: DataOrigin;
+}
+/** The description a module writes for its dataset. */
+interface DatasetSpec {
+  /**
+   * Object-storage files the subject owns. `prefix` returns the key prefix of one subject's
+   * files; it must be specific to that subject, because erasure deletes everything under it.
+   */
+  readonly files?: {
+    readonly prefix: (subjectId: string) => string;
+  };
+  readonly legalBasis: LegalBasis;
+  readonly origin: DataOrigin;
+  readonly phase?: DatasetPhase;
+  readonly placement?: DatasetPlacement;
+  readonly purpose: string;
+  readonly recipients?: ReadonlyArray<string>;
+  readonly tables: Readonly<Record<string, TableSpec>>;
+}
+/** A validated dataset, ready for the coverage check and the workflows. */
+interface Dataset extends DatasetSpec {
+  readonly id: string;
+  readonly phase: DatasetPhase;
+  readonly placement: DatasetPlacement;
+  readonly recipients: ReadonlyArray<string>;
+  /** The tables this dataset covers, by bare name. */
+  readonly tableNames: ReadonlyArray<string>;
+}
+/**
+ * Validate and freeze a dataset. Refuses an empty purpose, a dataset with no
+ * tables, and an id that is not a plain identifier, so the Art. 30 draft and the
+ * workflow step names stay well formed.
+ */
+declare const defineDataset: (id: string, spec: DatasetSpec) => Dataset;
+/** Rows per table per call. A drain step never erases more, so one step stays inside the platform's limits. */
+declare const ERASE_BATCH = 100;
+/** What happens to a row when its table is erased. */
+type Disposition = {
+  readonly kind: "delete";
+} | {
+  readonly kind: "anonymise";
+} | {
+  readonly kind: "keep";
+  readonly until: Date;
+};
+/** The package's verdict for one row, which the app's `eraseBatch` applies. */
+type RowDisposition = (dataset: Dataset, table: string, row: {
+  readonly [column: string]: unknown;
+}, now: Date) => Disposition;
+/**
+ * Bind the presets' retention rules into the verdict `eraseBatch` receives. A table with no
+ * `erase` is deleted, `delete` and `anonymise` apply as written, and a `retain` directive keeps
+ * the row while its rule's period is running.
+ */
+declare const dispositionFor: (rules: ReadonlyMap<string, RetentionRule>) => RowDisposition;
+/**
+ * The statuses a privacy request moves through, and which of them are terminal.
+ *
+ * `@lunora/privacy` stores them and the Studio's Privacy requests page renders them.
+ * The Studio must not depend on the runtime package, so both read the list from here
+ * and the bundler inlines it into each. A status added here reaches both, and the
+ * Studio's exhaustive badge map fails to compile until it has a variant.
+ */
+/** Every status, in lifecycle order. */
+declare const REQUEST_STATUSES: readonly ["received", "grace", "processing", "ready", "completed", "failed", "cancelled", "expired"];
+type RequestStatus = (typeof REQUEST_STATUSES)[number];
+type RequestType = "erasure" | "export";
+declare const isTerminal: (status: RequestStatus) => boolean;
+/** A request as the service sees it. */
+interface RequestRecord {
+  readonly dueAt: Date;
+  readonly erasureGraceUntil?: Date;
+  /** When the archive stops being downloadable. */
+  readonly expiresAt?: Date;
+  readonly extendedDueAt?: Date;
+  readonly id: string;
+  readonly reason?: string;
+  readonly receivedAt: Date;
+  readonly status: RequestStatus;
+  /** Where the finished archive is kept, once the request is ready. */
+  readonly storageKey?: string;
+  readonly subjectId: string;
+  readonly type: RequestType;
+}
+/** The storage the service needs. The app implements it over `ctx.db`. */
+interface RequestStore {
+  addEvent: (requestId: string, at: Date, kind: string, detail?: string) => Promise<void>;
+  /**
+   * Apply the patch only if the request still holds `from`, and report whether it did. The host must
+   * make the check and the write one step, so two callers that both read `from` cannot both win.
+   */
+  claim: (id: string, from: RequestStatus, patch: Partial<Omit<RequestRecord, "id">>) => Promise<boolean>;
+  /** The subject's request of this type that is not yet terminal, if any. */
+  findOpen: (subjectId: string, type: RequestType) => Promise<RequestRecord | undefined>;
+  get: (id: string) => Promise<RequestRecord | undefined>;
+  insert: (record: RequestRecord) => Promise<void>;
+  /** Every request of the subject, in every status. Erasure deletes the files each one wrote. */
+  listForSubject: (subjectId: string) => Promise<ReadonlyArray<RequestRecord>>;
+  /** Every request that is not yet terminal, for the deadline sweep. */
+  listOpen: () => Promise<ReadonlyArray<RequestRecord>>;
+  update: (id: string, patch: Partial<Omit<RequestRecord, "id">>) => Promise<void>;
+}
+/** Inputs that come from the caller and the app's settings. */
+interface ErasureSettings {
+  readonly drainBudgetDays: number;
+  /** The sign-in window an erasure needs, in milliseconds. Account deletion uses 24 hours. */
+  readonly freshAgeMs: number;
+  readonly graceDays: number;
+}
+/**
+ * The storage the tombstones need. Keep it outside the database a restore rolls back: a tombstone
+ * restored away with the data it guards would let the restore bring the erased subject back.
+ */
+interface TombstonePort {
+  /**
+   * Record that the subject was erased at this time. Must be an idempotent upsert keyed by `key`:
+   * a workflow step that fails after the write is retried and writes the same tombstone again, and a
+   * second row for one key must not appear.
+   */
+  readonly add: (key: string, erasedAt: Date) => Promise<void>;
+  /** Every tombstone key on record. */
+  readonly keys: () => Promise<ReadonlySet<string>>;
+}
+/** The app's data, one dataset at a time. The app implements it over its tables. */
+interface DataPort {
+  /** The subject's rows for each table of the dataset, keyed by table name. */
+  readonly collect: (dataset: Dataset, subjectId: string) => Promise<Readonly<Record<string, ReadonlyArray<Readonly<Record<string, unknown>>>>>>;
+  /**
+   * Erase one batch of the dataset's rows for the subject. The package decides and the app
+   * writes: call `disposition` for each row, then delete a `delete` row, anonymise an
+   * `anonymise` row, and move a `keep` row into the archive table. A kept row must not be
+   * selected again, or the drain never finishes.
+   */
+  readonly eraseBatch: (dataset: Dataset, subjectId: string, now: Date, disposition: RowDisposition) => Promise<{
+    readonly hasMore: boolean;
+  }>;
+  /**
+   * Rows still present per table after erasure, for the verify step. Two kinds of row may be
+   * counted and are excluded from the verdict by the package: a row a retention rule still keeps
+   * (verify judges each one again through `collect`), and every row of an `anonymise` table, which
+   * stays in place once anonymised. Prefer not to count anonymised rows at all; the package cannot
+   * tell an anonymised row from one `eraseBatch` missed, so it does not hold them against the erasure.
+   */
+  readonly remaining: (dataset: Dataset, subjectId: string) => Promise<Readonly<Record<string, number>>>;
+}
+/**
+ * Where a request's files are kept between steps and in the end. `put` must key a request's
+ * files under `${requestId}/`, so listing that prefix finds every file the request wrote.
+ */
+interface StorePort {
+  /** Remove one stored object. Removing a key that is not there is not an error. */
+  readonly delete: (key: string) => Promise<void>;
+  /** The keys of every stored object whose key starts with the prefix. */
+  readonly list: (prefix: string) => Promise<ReadonlyArray<string>>;
+  readonly put: (requestId: string, file: {
+    readonly data: Uint8Array | string;
+    readonly name: string;
+  }) => Promise<string>;
+  /** The text of a file written earlier in the same request, or `undefined` if it is not there. */
+  readonly read: (requestId: string, name: string) => Promise<string | undefined>;
+  /** A short-lived link to a stored file. The caller decides the lifetime, and the link is checked by the host. */
+  readonly signedUrl: (key: string, ttlSeconds: number) => Promise<string>;
+}
+/**
+ * The archive of rows erasure kept under a retention rule (`privacy_archive`, or the app's own
+ * table). The app writes a `keep` row into it with the `until` its disposition carries as
+ * `retainUntil`; the sweep purges it once that date has passed.
+ */
+interface ArchivePort {
+  /**
+   * Delete up to `ERASE_BATCH` archived rows whose `retainUntil` is before `before`, and say how
+   * many it deleted and whether more may remain.
+   */
+  readonly purgeBatch: (before: Date) => Promise<{
+    readonly hasMore: boolean;
+    readonly purged: number;
+  }>;
+}
+/** The ports one invocation binds: the app's data, storage, requests and clock. */
+interface PrivacyPorts {
+  /** Where kept rows wait out their retention period. Required for `admin.sweep` once a dataset uses `retain`. */
+  readonly archive?: ArchivePort;
+  readonly data: DataPort;
+  readonly files: StorePort;
+  readonly newId: () => string;
+  readonly now: () => Date;
+  readonly store: RequestStore;
+  /**
+   * Where erased subjects are tombstoned, so a restored backup can be erased again. An erasure and
+   * `restore` refuse to run without it; a call that only exports or reads may leave it out.
+   */
+  readonly tombstones?: TombstonePort;
+}
+/**
+ * How a run executes its named steps. A durable host memoises each `do` by name and retries a step
+ * that throws, so every step result is JSON-safe. `sleepUntil` is the host's durable sleep; the
+ * one-call path has none, so it refuses an erasure that is still inside its grace window.
+ */
+interface StepRunner {
+  readonly do: <T>(name: string, run: () => Promise<T>) => Promise<T>;
+  readonly sleepUntil?: (name: string, when: Date) => Promise<void>;
+}
+/** The outcome of an export run. */
+interface ExportOutcome {
+  readonly archiveKey?: string;
+  readonly status: RequestStatus;
+}
+/** The outcome of an erasure run. */
+interface ErasureOutcome {
+  readonly leftover: ReadonlyArray<string>;
+  readonly status: RequestStatus;
+}
+/** The app's erasure settings. An unset field takes the decided default (D3 and the sign-in window). */
+type ErasureOptions = Partial<ErasureSettings>;
+/**
+ * The authenticated subject of a call. The app resolves it from its session, never from a request
+ * argument, and passes it as the second argument of `privacyFor(ctx, identity)`, so a caller cannot
+ * act on another subject's data by naming them. An operator call, a cron or a workflow passes none.
+ */
+interface PrivacyIdentity {
+  readonly sessionAgeMs: number;
+  readonly subjectId: string;
+}
+/**
+ * Everything `definePrivacy` needs from the app. The ports depend on the invocation: a
+ * mutation's `ctx.db` exists only inside that call, so `ports` runs once per call with
+ * the caller's context.
+ */
+interface PrivacyConfig<C> {
+  readonly datasets: ReadonlyArray<Dataset>;
+  readonly erasure?: ErasureOptions;
+  /** Tables left out of the export and erasure, each with the reason the reviewer reads. */
+  readonly exclude?: Readonly<Record<string, string>>;
+  readonly ports: (context: C) => PrivacyPorts;
+  readonly presets?: ReadonlyArray<PrivacyPreset>;
+  /** The identifier the archive shows for the subject. Defaults to the subject id itself. */
+  readonly subjectKey?: (subjectId: string) => string;
+  /**
+   * The HMAC secret tombstone keys are derived with. Every erasure and `restore` refuse to run
+   * without it and without a `tombstones` port. Keep it in a secret binding, and keep it stable,
+   * because a new secret no longer matches the tombstones already written.
+   */
+  readonly tombstoneSecret?: string;
+}
+/**
+ * Binds an invocation's context, and the caller's identity when the caller is a data subject, into
+ * the API: `privacyFor(ctx, identity).requestExport()`. The subject methods refuse a call bound
+ * without an identity; the operator methods and the workflows never read it.
+ */
+type PrivacyFor<C> = (context: C, identity?: PrivacyIdentity) => Privacy;
+/** The step surface a Workflow handler receives. Matches the native `WorkflowStep` methods the package uses. */
+interface PrivacyWorkflowContext {
+  readonly params: {
+    readonly requestId: string;
+  };
+  readonly step: Required<StepRunner>;
+}
+/** The bound API. */
+interface Privacy {
+  /** Operator views and actions. Each one is for the operator's own console, not the subject. */
+  readonly admin: {
+    /**
+     * Extend a request's deadline by the policy's further months (Art. 12(3) sentence 2). Extension
+     * is the controller's decision, so it is an operator action: once per request, within the first
+     * period, with the reasons the controller must give the subject.
+     */
+    readonly extend: (requestId: string, reason: string) => Promise<RequestRecord>;
+    /** Every request that is not yet terminal. */
+    readonly open: () => Promise<ReadonlyArray<RequestRecord>>;
+    /**
+     * Retry a failed export or erasure; any other status is refused. The Art. 12(3) clock keeps
+     * running throughout. An export runs again in this call and returns `ran` with its outcome. An
+     * erasure is moved to `processing` in this call and returns `restart`: the app then starts its
+     * erasure workflow for the request, in the same mutation, and the workflow resumes it. Because
+     * the request leaves `failed` here, a second retry is refused rather than starting a second run.
+     */
+    readonly retry: (requestId: string) => Promise<RetryResult>;
+    /**
+     * The housekeeping sweep. Run it from a cron. It expires every ready export past its download
+     * window (its files go first, then it is marked `expired`), and it purges every archived row
+     * whose retention period has ended through the `archive` port. Returns the expired requests
+     * and how many archived rows it purged.
+     */
+    readonly sweep: () => Promise<SweepResult>;
+  };
+  readonly cancelRequest: (input: {
+    requestId: string;
+  }) => Promise<RequestRecord>;
+  readonly coverage: (tables: ReadonlyArray<string>, exclusions?: Readonly<Record<string, string>>) => ReadonlyArray<CoverageProblem>;
+  /** The subject's download link for a finished export. Refused for anyone but the subject, and once expired. */
+  readonly downloadUrl: (input: {
+    requestId: string;
+  }) => Promise<string>;
+  /** Every request of the subject, in every status, newest first. A finished erasure's requests no longer carry the subject's id. */
+  readonly myRequests: () => Promise<ReadonlyArray<RequestRecord>>;
+  readonly requestErasure: () => Promise<RequestRecord>;
+  readonly requestExport: () => Promise<RequestRecord>;
+  /** Erase again any restored subject that was erased after the backup. Returns the subject ids it re-erased. */
+  readonly restore: (input: {
+    restoredSubjectIds: ReadonlyArray<string>;
+  }) => Promise<ReadonlyArray<string>>;
+  readonly runErasure: (requestId: string) => Promise<ErasureOutcome>;
+  readonly runExport: (requestId: string) => Promise<ExportOutcome>;
+  /** The deadline sweep: requests due within seven days, and those already overdue. Run it from a cron. */
+  readonly tick: () => Promise<{
+    readonly approaching: ReadonlyArray<RequestRecord>;
+    readonly overdue: ReadonlyArray<RequestRecord>;
+  }>;
+  /** The durable handlers the app registers with `defineWorkflow`. Each step is memoised by name. */
+  readonly workflows: {
+    readonly erasureHandler: (context: PrivacyWorkflowContext) => Promise<void>;
+    readonly exportHandler: (context: PrivacyWorkflowContext) => Promise<void>;
+  };
+}
+/**
+ * What `admin.retry` did: an export ran again (`ran`), or an erasure was moved out of `failed` and the
+ * app must now start its erasure workflow for `requestId` (`restart`).
+ */
+type RetryResult = {
+  readonly kind: "ran";
+  readonly outcome: ExportOutcome;
+} | {
+  readonly kind: "restart";
+  readonly requestId: string;
+};
+/** What `admin.sweep` did. */
+interface SweepResult {
+  readonly expired: ReadonlyArray<RequestRecord>;
+  /** Archived rows deleted because their retention period has ended. */
+  readonly purged: number;
+}
+/**
+ * Bind the settings into a factory. Pure construction: nothing runs until a method is
+ * called, and each call of the factory binds the ports for that invocation.
+ */
+declare const definePrivacy: <C>(config: PrivacyConfig<C>) => PrivacyFor<C>;
+export { AUTH_DEFAULT_TABLES as A, isTerminal as B, CoverageProblem as C, Dataset as D, ERASE_BATCH as E, LegalBasis as L, PrivacyConfig as P, RequestStatus as R, StorePort as S, TableErasure as T, PrivacyPorts as a, RequestType as b, RequestRecord as c, ArchivePort as d, DataOrigin as e, DataPort as f, DatasetPhase as g, DatasetPlacement as h, DatasetSpec as i, Disposition as j, ErasureOptions as k, ErasureOutcome as l, ExportOutcome as m, Privacy as n, PrivacyFor as o, PrivacyIdentity as p, PrivacyWorkflowContext as q, RequestStore as r, RetryResult as s, RowDisposition as t, SweepResult as u, TableSpec as v, TombstonePort as w, defineDataset as x, definePrivacy as y, dispositionFor as z };

package/dist/packem_shared/defineDataset-BoLQrc_1.mjs

@@ -0,0 +1 @@
+import{LunoraError as s}from"@lunora/errors";const o=/^[a-z]\w*$/u,a={erase:1,quiesce:0,tombstone:2},i=(t,e)=>{if(!o.test(t))throw new s("BAD_REQUEST",`Dataset id "${t}" must be a lowercase identifier.`);if(e.purpose.trim()==="")throw new s("BAD_REQUEST",`Dataset "${t}" needs a purpose; the Art. 30 record reads it.`);const r=Object.keys(e.tables);if(r.length===0&&e.files===void 0)throw new s("BAD_REQUEST",`Dataset "${t}" declares no tables or files.`);return{...e,id:t,phase:e.phase??"erase",placement:e.placement??"subject",recipients:e.recipients??[],tableNames:r}},c=t=>[...t].toSorted((e,r)=>a[e.phase]-a[r.phase]),l=t=>t.tableNames.flatMap(e=>{const r=t.tables[e]?.erase;return typeof r=="object"?[{directive:r,table:e}]:[]});export{i as defineDataset,c as erasureOrder,l as retainedTables};

package/dist/packem_shared/definePrivacy-DsCj6Gwv.mjs

@@ -0,0 +1 @@
+import{LunoraError as u}from"@lunora/errors";import{c as W,a as z}from"./privacy-coverage-Edq9aBy0.mjs";import{retainedTables as v,erasureOrder as F}from"./defineDataset-BoLQrc_1.mjs";import{d as J,b as E,e as X,D as R}from"./deadlines-DlEH-01d.mjs";import{drainUntilEmpty as M,verifyErasure as Z,dispositionForPresets as ee}from"./ERASE_BATCH-BqeymwxG.mjs";import{checkErasureGraceDays as te,DEFAULT_ERASURE_GRACE_DAYS as se}from"../eu.mjs";import{erasureGraceUntil as ae,canCancel as re,transition as A,canExtend as ne,isRequestStatus as oe,canTransition as C,MIN_DRAIN_BUDGET_DAYS as ie,isOverdue as ce,awaitsResponse as de,effectiveDueAt as ue}from"./OPEN_STATUSES-B_NpOD7X.mjs";import{isTerminal as j}from"./isTerminal-C0AnfFUl.mjs";import{e as le}from"./wire-codec-C0ExsJJg.mjs";import{PDFDocument as we,StandardFonts as fe}from"@cantoo/pdf-lib";import{zipSync as ye}from"fflate";import{createHmac as pe}from"node:crypto";const me=e=>{const t={};for(const[s,a]of Object.entries(e))a!==void 0&&(t[s]=a instanceof Date?a.toISOString():String(a));return t},m=e=>new u("INTERNAL",`A workflow step returned a privacy request with a malformed "${e}".`),be=e=>{if(typeof e!="object"||e===null)throw m("record");const t=new Map(Object.entries(e)),s=i=>{const l=t.get(i);if(typeof l!="string")throw m(i);return l},a=i=>{const l=new Date(s(i));if(Number.isNaN(l.getTime()))throw m(i);return l},r=i=>t.get(i)!==void 0,n=s("status"),o=s("type");if(!oe(n))throw m("status");if(o!=="export"&&o!=="erasure")throw m("type");return{dueAt:a("dueAt"),id:s("id"),receivedAt:a("receivedAt"),status:n,subjectId:s("subjectId"),type:o,...r("erasureGraceUntil")?{erasureGraceUntil:a("erasureGraceUntil")}:{},...r("expiresAt")?{expiresAt:a("expiresAt")}:{},...r("extendedDueAt")?{extendedDueAt:a("extendedDueAt")}:{},...r("reason")?{reason:s("reason")}:{},...r("storageKey")?{storageKey:s("storageKey")}:{}}},f=async(e,t)=>{const s=await e.get(t);if(s===void 0)throw new u("NOT_FOUND",`No privacy request with id ${t}.`);return s},P=async(e,t)=>{if(t.type==="erasure"&&t.erasure!==void 0&&(t.sessionAgeMs??Number.POSITIVE_INFINITY)>t.erasure.freshAgeMs)throw new u("PRIVACY_SESSION_NOT_FRESH","Sign in again to request erasure.");const s=await e.findOpen(t.subjectId,t.type);if(s!==void 0&&!j(s.status))throw new u("PRIVACY_REQUEST_OPEN",`This subject already has an open ${t.type} request.`);const{erasure:a}=t,r=J(t.now,t.deadlines??E),n=t.type==="erasure"&&a!==void 0&&a.graceDays>0?"grace":"received",o={dueAt:r,id:t.id,receivedAt:t.now,status:n,subjectId:t.subjectId,type:t.type,...t.type==="erasure"&&a!==void 0?{erasureGraceUntil:ae(t.now,r,a.graceDays,a.drainBudgetDays)}:{}};return await e.insert(o),await e.addEvent(o.id,t.now,"received"),o},ge=async(e,t)=>{const s=await f(e,t.id);if(!re(s.type,s.status))throw new u("UNPROCESSABLE",`A ${s.type} request in "${s.status}" can no longer be cancelled.`);const a=A(s.status,"cancelled");return await e.update(s.id,{status:a}),await e.addEvent(s.id,t.now,"cancelled"),{...s,status:a}},he=async(e,t)=>{const s=await f(e,t.id);if(j(s.status)||!ne(s,t.now))throw new u("UNPROCESSABLE","This request cannot be extended any more.");const a=X(s.receivedAt,t.deadlines??E);return await e.update(s.id,{extendedDueAt:a,reason:t.reason}),await e.addEvent(s.id,t.now,"extended",t.reason),{...s,extendedDueAt:a,reason:t.reason}},Ee=1,ve=e=>({datasets:e.datasets,formatVersion:Ee,generatedAt:e.generatedAt.toISOString(),subjectKey:e.subjectKey}),Ae=(e,t,s=6)=>{const a=new TextEncoder,r={};for(const n of e){const o=typeof n.data=="string"?a.encode(n.data):n.data;r[n.path]=[o,{level:s,mtime:t}]}return ye(r)},Se=/[^\u0020-\u007E\u00A0-\u00FF\u20AC\u201A\u0192\u201E\u2026\u2020\u2021\u02C6\u2030\u0160\u2039\u0152\u017D\u2018\u2019\u201C\u201D\u2022\u2013\u2014\u02DC\u2122\u0161\u203A\u0153\u017E\u0178]/gu,Te=e=>e.replaceAll(Se,"?"),xe=14,De=780,Re=40,$=50,je=async e=>{const t=await we.create();t.setCreationDate(e.generatedAt),t.setModificationDate(e.generatedAt),t.setProducer("@lunora/privacy"),t.setCreator("@lunora/privacy"),t.setTitle(e.title);const s=await t.embedFont(fe.Helvetica),a=[e.title,`Generated: ${e.generatedAt.toISOString()}`,`Subject: ${e.subjectKey}`,"",...e.datasets.flatMap(r=>[`${r.id}: ${r.purpose}`,`  Articles: ${r.articles.map(n=>`Art. ${n}`).join(", ")}`,`  Retention: ${r.retention}`])];for(let r=0;r<a.length;r+=$){const n=t.addPage();a.slice(r,r+$).forEach((o,i)=>{n.drawText(Te(o),{font:s,size:10,x:Re,y:De-i*xe})})}return t.save()},Ne=(e,t)=>(e==="provided"||e==="observed")&&(t==="consent"||t==="contract")?["15","20"]:["15"],B=e=>`parts/${e.id}.json`,Oe=e=>v(e).length>0,_e=e=>{const t=[...new Set(v(e).map(({directive:s})=>s.rule))];return t.length===0?"until erasure":`kept under ${t.join(", ")}`},Ue=(e,t)=>t.length===0?e:e.map(s=>Object.fromEntries(Object.entries(s).filter(([a])=>!t.includes(a)))),Pe=async(e,t,s)=>{const a=await e.data.collect(t,s.subjectId),r=Object.fromEntries(t.tableNames.map(n=>[n,Ue(a[n]??[],t.tables[n]?.omit??[])]));await e.files.put(s.id,{data:JSON.stringify(le({tables:r})),name:B(t)})},$e=async(e,t,s,a)=>{const r=[],n=[];for(const c of t){const p=await e.files.read(s.id,B(c));if(p===void 0)throw new Error(`Export part for "${c.id}" is missing; collect it again.`);const{tables:g}=JSON.parse(p);for(const y of c.tableNames)r.push({data:JSON.stringify(g[y]??[]),path:`data/${c.id}/${y}.json`});n.push({articles:Ne(c.origin,c.legalBasis),files:c.tableNames.map(y=>`data/${c.id}/${y}.json`),id:c.id,legalBasis:c.legalBasis,origin:c.origin,purpose:c.purpose,recipients:c.recipients,restricted:Oe(c),retention:_e(c)})}const o=e.now(),i=ve({datasets:n,generatedAt:o,subjectKey:a}),l=Ae([...r,{data:JSON.stringify(i,void 0,2),path:"manifest.json"}],o),w=await je({datasets:n.map(c=>({articles:c.articles,id:c.id,purpose:c.purpose,retention:c.retention})),generatedAt:o,subjectKey:a,title:"Your data"}),d=await e.files.put(s.id,{data:l,name:"export.zip"});return await e.files.put(s.id,{data:w,name:"summary.pdf"}),d},N=(e,t)=>{if(e.trim()==="")throw new u("BAD_REQUEST","A tombstone needs a non-empty subject id.");return pe("sha256",t).update(e).digest("hex")},Ie=async(e,t,s)=>{const a=await t.keys(),r=[];for(const n of new Set(e))a.has(N(n,s))&&r.push(n);return r},O={do:async(e,t)=>t()},Fe=async(e,t)=>{const s=new Set(await e.list(`${t.id}/`));t.storageKey!==void 0&&s.add(t.storageKey),await Promise.all([...s].map(async a=>e.delete(a)))},k=(e,t)=>{if(e.files===void 0)return;const s=e.files.prefix(t);if(s.trim()==="")throw new u("BAD_REQUEST",`Dataset "${e.id}" returned an empty files prefix; erasing it would delete every subject's files.`);return s},L=async(e,t)=>{await Fe(e.files,t),t.status==="ready"&&(await e.store.update(t.id,{status:A("ready","expired")}),await e.store.addEvent(t.id,e.now(),"expired"))},Me=async(e,t,s)=>{const a=await e.store.listForSubject(s);await Promise.all(a.map(async n=>L(e,n)));const r=t.map(n=>k(n,s)).filter(n=>n!==void 0);await Promise.all(r.map(async n=>{const o=await e.files.list(n);await Promise.all(o.map(async i=>e.files.delete(i)))}))},Ce=async(e,t,s,a)=>{const r=t.tableNames.filter(d=>(a[d]??0)>0),n=r.filter(d=>t.tables[d]?.erase==="anonymise"),o=v(t).map(({table:d})=>d).filter(d=>r.includes(d)),i=Object.fromEntries(n.map(d=>[d,a[d]??0]));if(o.length===0)return i;const l=await e.ports.data.collect(t,s),w=e.ports.now();for(const d of o)i[d]=(l[d]??[]).filter(c=>e.disposition(t,d,c,w).kind==="keep").length;return i},Be=async(e,t,s)=>{const a={},r={};for(const n of t){const o=await e.ports.data.remaining(n,s);Object.assign(a,o),Object.assign(r,await Ce(e,n,s,o));const i=k(n,s);if(i!==void 0){const l=await e.ports.files.list(i);a[`files:${n.id}`]=l.length}}return Z(a,r)},ke=7*R,G=e=>e instanceof Error?e.message:String(e),S=async(e,t,s)=>{const a=A(s.from,s.to);await e.store.update(t,{...s.patch,status:a}),await e.store.addEvent(t,e.now(),a,s.detail)},K=async(e,t,s)=>be(await t.do("load",async()=>me(await f(e.ports.store,s)))),q=async(e,t,s)=>t.do("start",async()=>{const{status:a}=await f(e.ports.store,s);return C(a,"processing")?(await S(e.ports,s,{from:a,to:"processing"}),"processing"):a}),H=async(e,t,s,a,r)=>t.do(a,async()=>{const{status:n}=await f(e.ports.store,s);if(n!=="processing")return{status:n};const o=await r();return o===void 0?{status:n}:{status:n,value:o}}),x=async(e,t,s,a)=>t.do("fail",async()=>{const{status:r}=await f(e.ports.store,s);return C(r,"failed")?(await S(e.ports,s,{detail:a,from:r,to:"failed"}),"failed"):r}),D=async(e,t,s)=>{const a=async(n,o)=>H(e,t,s,n,o),r=await K(e,t,s);try{const n=await q(e,t,s);if(n!=="processing")return{status:n};for(const d of e.datasets){const c=await a(`collect:${d.id}`,async()=>Pe(e.ports,d,r));if(c.status!=="processing")return{status:c.status}}const o=await a("assemble",async()=>$e(e.ports,e.datasets,r,e.subjectKey(r.subjectId))),i=o.value;if(i===void 0)return{status:o.status};const w=await a("ready",async()=>{const d={expiresAt:new Date(e.ports.now().getTime()+ke),storageKey:i};await S(e.ports,s,{detail:i,from:"processing",patch:d,to:"ready"})});return w.status==="processing"?{archiveKey:i,status:"ready"}:{status:w.status}}catch(n){return{status:await x(e,t,s,G(n))}}},Le=e=>{if(e===void 0||e==="")throw new u("BAD_REQUEST","Tombstones need a secret: pass `tombstoneSecret` to definePrivacy.");return e},_=e=>{const t=e.ports.tombstones;if(t===void 0)throw new u("BAD_REQUEST","An erasure needs a tombstone store: pass `tombstones` in the privacy ports.");return{port:t,secret:Le(e.tombstoneSecret)}},Y=async(e,t,s)=>{await M(()=>e.ports.data.eraseBatch(t,s,e.ports.now(),e.disposition))},Ge=async(e,t,s,a)=>{const n=(await e.store.listForSubject(s)).filter(o=>o.id!==t);await Promise.all(n.map(async o=>e.store.update(o.id,{subjectId:a}))),await S(e,t,{from:"processing",patch:{subjectId:a},to:"completed"})},Q=async(e,t,s)=>{const a=async(n,o)=>H(e,t,s,n,o),r=await K(e,t,s);if(r.status==="grace"&&r.erasureGraceUntil!==void 0){if(t.sleepUntil===void 0)throw new u("UNPROCESSABLE","This erasure is inside its grace window. The erasure workflow runs it when the window ends.");await t.sleepUntil("grace",r.erasureGraceUntil)}try{const n=_(e),o=await q(e,t,s);if(o!=="processing")return{leftover:[],status:o};const i=N(r.subjectId,n.secret),l=await a("tombstone",async()=>n.port.add(i,e.ports.now()));if(l.status!=="processing")return{leftover:[],status:l.status};for(const g of F(e.datasets)){const y=await a(`erase:${g.id}`,async()=>Y(e,g,r.subjectId));if(y.status!=="processing")return{leftover:[],status:y.status}}const w=await a("erase:files",async()=>Me(e.ports,e.datasets,r.subjectId));if(w.status!=="processing")return{leftover:[],status:w.status};const d=await a("verify",async()=>Be(e,e.datasets,r.subjectId)),c=d.value;if(c===void 0)return{leftover:[],status:d.status};if(!c.complete)return{leftover:c.leftover,status:await x(e,t,s,c.leftover.join(","))};const p=await a("complete",async()=>Ge(e.ports,s,r.subjectId,i));return{leftover:[],status:p.status==="processing"?"completed":p.status}}catch(n){return{leftover:[],status:await x(e,t,s,G(n))}}},V=async(e,t,s)=>{const a=await e.get(t);if(a?.subjectId!==s)throw new u("NOT_FOUND",`No privacy request with id ${t}.`);return a},Ke=900,qe=R,He=7*R,b=e=>{if(e.identity===void 0)throw new u("UNAUTHENTICATED","This privacy call is not bound to a subject: pass the caller's identity to privacyFor.");return e.identity},U=async e=>(await e.ports.store.listOpen()).filter(s=>!j(s.status)),h=async(e,t,s)=>{const a=await f(e.ports.store,t);if(a.type!==s)throw new u("UNPROCESSABLE",`Request ${t} is an ${a.type}, not an ${s}.`)},Ye=async(e,t)=>(await h(e,t,"erasure"),_(e),Q(e,O,t)),Qe=async(e,t)=>{const s=await f(e.ports.store,t);if(s.status!=="failed")throw new u("UNPROCESSABLE",`Only a failed request can be retried; this one is "${s.status}".`);if(s.type==="erasure"){if(!await e.ports.store.claim(t,"failed",{status:A("failed","processing")}))throw new u("UNPROCESSABLE","This request was already retried.");return await e.ports.store.addEvent(t,e.ports.now(),"processing","retry"),{kind:"restart",requestId:t}}return{kind:"ran",outcome:await D(e,O,t)}},Ve=async e=>{const t=e.ports.now().getTime(),a=(await U(e)).filter(r=>r.status==="ready"&&r.expiresAt!==void 0&&r.expiresAt.getTime()<t);return await Promise.all(a.map(async r=>L(e.ports,r))),a.map(r=>({...r,status:"expired"}))},We=e=>e.some(t=>v(t).length>0),ze=async e=>{const{archive:t}=e.ports;if(t===void 0){if(We(e.datasets))throw new u("BAD_REQUEST","A dataset retains rows, so the sweep needs an `archive` port to purge them once their period ends.");return 0}const s=e.ports.now();let a=0;return await M(async()=>{const r=await t.purgeBatch(s);return a+=r.purged,r}),a},Je=async e=>{const t=await Ve(e),s=await ze(e);return{expired:t,purged:s}},Xe=async e=>{const t=e.ports.now(),s=await U(e),a=s.filter(n=>ce(n,t));return{approaching:s.filter(n=>{if(!de(n.status))return!1;const o=ue(n).getTime();return o-t.getTime()<=He&&o>=t.getTime()}),overdue:a}},Ze=async(e,t)=>{const s=await V(e.ports.store,t,b(e).subjectId);if(s.type!=="export")throw new u("NOT_FOUND",`No export with id ${t}.`);if(s.status!=="ready"||s.storageKey===void 0)throw new u("UNPROCESSABLE","This export is not ready to download.");if(s.expiresAt!==void 0&&e.ports.now().getTime()>s.expiresAt.getTime())throw new u("UNPROCESSABLE","This export has expired. Request a new one.");return e.ports.files.signedUrl(s.storageKey,Ke)},et=async(e,t)=>{const s=_(e),a=await Ie(t,s.port,s.secret);for(const r of a){for(const i of F(e.datasets))await Y(e,i,r);const n=N(r,s.secret),o=await e.ports.store.listForSubject(r);await Promise.all(o.map(async i=>e.ports.store.update(i.id,{subjectId:n})))}return a},tt=(e,t,s)=>{const a=e.datasets.flatMap(r=>r.tableNames.map(n=>[n,r.id]));return W(t,z(a,Object.entries({...e.exclude,...s})))},st=(e,t,s)=>{const a={...e,identity:s,ports:t};return{admin:{extend:async(r,n)=>he(t.store,{deadlines:e.deadlines,id:r,now:t.now(),reason:n}),open:async()=>U(a),retry:async r=>Qe(a,r),sweep:async()=>Je(a)},cancelRequest:async({requestId:r})=>(await V(t.store,r,b(a).subjectId),ge(t.store,{id:r,now:t.now()})),coverage:(r,n={})=>tt(a,r,n),downloadUrl:async({requestId:r})=>Ze(a,r),myRequests:async()=>(await t.store.listForSubject(b(a).subjectId)).toSorted((n,o)=>o.receivedAt.getTime()-n.receivedAt.getTime()),requestErasure:async()=>{const{sessionAgeMs:r,subjectId:n}=b(a);return P(t.store,{deadlines:e.deadlines,erasure:e.erasure,id:t.newId(),now:t.now(),sessionAgeMs:r,subjectId:n,type:"erasure"})},requestExport:async()=>P(t.store,{deadlines:e.deadlines,id:t.newId(),now:t.now(),subjectId:b(a).subjectId,type:"export"}),restore:async({restoredSubjectIds:r})=>et(a,r),runErasure:async r=>Ye(a,r),runExport:async r=>(await h(a,r,"export"),D(a,O,r)),tick:async()=>Xe(a),workflows:{erasureHandler:async r=>{await h(a,r.params.requestId,"erasure"),await Q(a,r.step,r.params.requestId)},exportHandler:async r=>{await h(a,r.params.requestId,"export"),await D(a,r.step,r.params.requestId)}}}},T=(e,t)=>{const s=[...e??[]].toReversed().find(a=>typeof a.policy?.[t]=="number")?.policy?.[t];return typeof s=="number"?s:void 0},I=(e,t,s)=>{if(!Number.isInteger(t)||t<s)throw new u("BAD_REQUEST",`The preset's ${e} must be a whole number of months, at least ${String(s)}; got ${String(t)}.`);return t},pt=e=>{const t=T(e.presets,"erasureGraceDays"),s={extensionMonths:I("extensionMonths",T(e.presets,"extensionMonths")??E.extensionMonths,0),responseMonths:I("responseMonths",T(e.presets,"responseMonths")??E.responseMonths,1)},a={datasets:e.datasets,deadlines:s,disposition:ee(e.presets??[]),erasure:{drainBudgetDays:e.erasure?.drainBudgetDays??ie,freshAgeMs:e.erasure?.freshAgeMs??qe,graceDays:te(e.erasure?.graceDays??t??se)},exclude:e.exclude??{},subjectKey:e.subjectKey??(r=>r),tombstoneSecret:e.tombstoneSecret};return(r,n)=>st(a,e.ports(r),n)};export{pt as definePrivacy};

package/dist/packem_shared/fromRequestRow-D-Vn3ieZ.mjs

@@ -0,0 +1 @@
+const t=e=>e?.getTime(),s=e=>e===void 0?void 0:new Date(e),u=e=>Object.fromEntries(Object.entries(e).filter(([,i])=>i!==void 0)),n=e=>u({dueAt:new Date(e.dueAt),erasureGraceUntil:s(e.erasureGraceUntil),expiresAt:s(e.expiresAt),extendedDueAt:s(e.extendedDueAt),id:e.requestId,reason:e.reason,receivedAt:new Date(e.receivedAt),status:e.status,storageKey:e.storageKey,subjectId:e.subjectId,type:e.type}),d=e=>u({dueAt:e.dueAt.getTime(),erasureGraceUntil:t(e.erasureGraceUntil),expiresAt:t(e.expiresAt),extendedDueAt:t(e.extendedDueAt),reason:e.reason,receivedAt:e.receivedAt.getTime(),requestId:e.id,status:e.status,storageKey:e.storageKey,subjectId:e.subjectId,type:e.type}),a=e=>u({dueAt:t(e.dueAt),erasureGraceUntil:t(e.erasureGraceUntil),expiresAt:t(e.expiresAt),extendedDueAt:t(e.extendedDueAt),reason:e.reason,receivedAt:t(e.receivedAt),status:e.status,storageKey:e.storageKey,subjectId:e.subjectId,type:e.type});export{n as fromRequestRow,a as toRequestPatch,d as toRequestRow};

package/dist/packem_shared/isTerminal-C0AnfFUl.mjs

@@ -0,0 +1 @@
+const d=["received","grace","processing","ready","completed","failed","cancelled","expired"],c=new Set(["cancelled","completed","expired"]),l=e=>c.has(e);export{d as REQUEST_STATUSES,l as isTerminal};

package/dist/packem_shared/privacy-coverage-Edq9aBy0.mjs

@@ -0,0 +1 @@
+const a=["account","apikey","member","passkey","session","teamMember","twoFactor","user"],n=(c,t)=>{const e={};for(const[s,o]of c)e[s]={dataset:o};for(const[s,o]of t)e[s]={excluded:o};return e},i=(c,t)=>{const e=[];for(const s of c){const o=t[s];o===void 0?e.push({code:"unclassified",table:s}):"excluded"in o&&o.excluded.trim()===""&&e.push({code:"excluded_without_reason",table:s})}return e};export{a as A,n as a,i as c};

package/dist/packem_shared/privacyExtension-EMCPGigC.mjs

@@ -0,0 +1 @@
+import{defineSchemaExtension as i,defineTable as t,v as e}from"@lunora/server";import{REQUEST_STATUSES as r}from"./isTerminal-C0AnfFUl.mjs";const u=i("privacy",{tables:{archive:t({datasetId:e.string(),retainUntil:e.number(),row:e.string(),subjectId:e.string(),table:e.string()}).index("byRetainUntil",["retainUntil"]),events:t({at:e.number(),detail:e.optional(e.string()),kind:e.string(),requestId:e.string()}),requests:t({dueAt:e.number(),erasureGraceUntil:e.optional(e.number()),expiresAt:e.optional(e.number()),extendedDueAt:e.optional(e.number()),reason:e.optional(e.string()),receivedAt:e.number(),requestId:e.string(),status:e.union(...r.map(n=>e.literal(n))),storageKey:e.optional(e.string()),subjectId:e.string(),type:e.union(e.literal("export"),e.literal("erasure"))}).index("byRequestId",["requestId"]).index("bySubject",["subjectId","type"]).index("byStatus",["status","dueAt"])}});export{u as default};

package/dist/packem_shared/retain-BtQqIGNh.mjs

@@ -0,0 +1 @@
+import{a as e}from"./deadlines-DlEH-01d.mjs";const r=(a,t={})=>({kind:"retain",rule:a,...t.from===void 0?{}:{from:t.from}}),i=a=>new Map(a.flatMap(t=>t.retention).map(t=>[t.id,t])),o=(a,t)=>a.start==="endOfCalendarYear"?new Date(Date.UTC(t.getUTCFullYear()+a.years,11,31,23,59,59,999)):e(t,a.years*12);export{r as retain,o as retainUntil,i as retentionRulesOf};

package/dist/packem_shared/rules.d-DJa3SIb3.d.mts

@@ -0,0 +1,48 @@
+/** Where a retention period starts. `endOfCalendarYear` is the HGB §257 / AO §147 reading. */
+type RetentionStart = "endOfCalendarYear" | "from";
+/** A named retention period. */
+interface RetentionRule {
+  /** The statute or regulation the period comes from. */
+  readonly citation: string;
+  /** Stable id, `preset.name`, referenced by `retain(ruleId, …)`. */
+  readonly id: string;
+  /** What is still open about the rule, when something is. */
+  readonly note?: string;
+  /** `true` until the rule has been reviewed by counsel or a tax adviser. */
+  readonly reviewRequired: boolean;
+  /** When the period starts. */
+  readonly start: RetentionStart;
+  /** ISO date of the last review, when there has been one. */
+  readonly verifiedAt?: string;
+  /** Whole years the record must be kept. */
+  readonly years: number;
+}
+/** The response-time policy an app runs under. Each value carries its own review status. */
+interface PrivacyPolicy {
+  /** Days between an accepted erasure request and the start of erasure. Capped before the deadline. */
+  readonly erasureGraceDays: number;
+  /** Art. 12(3) sentence 2: further months when the response is extended. */
+  readonly extensionMonths: number;
+  /** Art. 12(3): months from receipt to the response. */
+  readonly responseMonths: number;
+  /** `true` until counsel has reviewed the value. */
+  readonly reviewRequired: boolean;
+}
+/** A jurisdiction preset: the policy it sets and the retention rules it names. */
+interface PrivacyPreset {
+  readonly id: "de" | "eu";
+  readonly policy?: Partial<PrivacyPolicy>;
+  readonly retention: ReadonlyArray<RetentionRule>;
+}
+/** A table's erasure outcome that keeps the rows for a named rule. */
+interface RetainDirective {
+  /** The column whose date starts the period, when the rule starts `from` a date. */
+  readonly from?: string;
+  readonly kind: "retain";
+  readonly rule: string;
+}
+/** Erase the rows of a table that a rule would otherwise keep. */
+declare const retain: (rule: string, options?: {
+  from?: string;
+}) => RetainDirective;
+export { PrivacyPreset as P, RetentionRule as R, PrivacyPolicy as a, RetainDirective as b, RetentionStart as c, retain as r };

package/dist/packem_shared/rules.d-DJa3SIb3.d.ts

@@ -0,0 +1,48 @@
+/** Where a retention period starts. `endOfCalendarYear` is the HGB §257 / AO §147 reading. */
+type RetentionStart = "endOfCalendarYear" | "from";
+/** A named retention period. */
+interface RetentionRule {
+  /** The statute or regulation the period comes from. */
+  readonly citation: string;
+  /** Stable id, `preset.name`, referenced by `retain(ruleId, …)`. */
+  readonly id: string;
+  /** What is still open about the rule, when something is. */
+  readonly note?: string;
+  /** `true` until the rule has been reviewed by counsel or a tax adviser. */
+  readonly reviewRequired: boolean;
+  /** When the period starts. */
+  readonly start: RetentionStart;
+  /** ISO date of the last review, when there has been one. */
+  readonly verifiedAt?: string;
+  /** Whole years the record must be kept. */
+  readonly years: number;
+}
+/** The response-time policy an app runs under. Each value carries its own review status. */
+interface PrivacyPolicy {
+  /** Days between an accepted erasure request and the start of erasure. Capped before the deadline. */
+  readonly erasureGraceDays: number;
+  /** Art. 12(3) sentence 2: further months when the response is extended. */
+  readonly extensionMonths: number;
+  /** Art. 12(3): months from receipt to the response. */
+  readonly responseMonths: number;
+  /** `true` until counsel has reviewed the value. */
+  readonly reviewRequired: boolean;
+}
+/** A jurisdiction preset: the policy it sets and the retention rules it names. */
+interface PrivacyPreset {
+  readonly id: "de" | "eu";
+  readonly policy?: Partial<PrivacyPolicy>;
+  readonly retention: ReadonlyArray<RetentionRule>;
+}
+/** A table's erasure outcome that keeps the rows for a named rule. */
+interface RetainDirective {
+  /** The column whose date starts the period, when the rule starts `from` a date. */
+  readonly from?: string;
+  readonly kind: "retain";
+  readonly rule: string;
+}
+/** Erase the rows of a table that a rule would otherwise keep. */
+declare const retain: (rule: string, options?: {
+  from?: string;
+}) => RetainDirective;
+export { PrivacyPreset as P, RetentionRule as R, PrivacyPolicy as a, RetainDirective as b, RetentionStart as c, retain as r };

package/dist/packem_shared/wire-codec-C0ExsJJg.mjs

@@ -0,0 +1 @@
+const d=e=>{let t="";for(let o=0;o<e.length;o+=32768)t+=String.fromCharCode(...e.subarray(o,o+32768));return btoa(t)},A=e=>{const t=atob(e),f=new Uint8Array(t.length);for(let o=0;o<t.length;o+=1)f[o]=t.codePointAt(o)??0;return f},i="$lunora.wire$";const w="__proto__",g={BigInt64Array,BigUint64Array,Float32Array,Float64Array,Int8Array,Int16Array,Int32Array,Uint8Array,Uint8ClampedArray,Uint16Array,Uint32Array},p={Error,EvalError,RangeError,ReferenceError,SyntaxError,TypeError,URIError},l=e=>{if(e===null||typeof e!="object")return!1;const t=Object.getPrototypeOf(e);return t===null||t===Object.prototype},b=(e,t=0)=>{if(t>64)throw new RangeError("wire-codec: value nesting exceeds the 64-level limit");if(e===void 0)return[i,"undefined"];if(e===null)return null;const f=typeof e;if(f==="bigint"){const r=e.toString();if(r.length>1024)throw new RangeError("wire-codec: over-long bigint (max 1024 digits)");return[i,"bigint",r]}if(f==="number"){const r=e;return Number.isNaN(r)?[i,"nan"]:r===1/0?[i,"inf"]:r===-1/0?[i,"-inf"]:r}if(f!=="object")return e;if(e instanceof Date)return[i,"date",b(e.getTime(),t+1)];if(e instanceof Error){const r=e,n=b(Object.fromEntries(Object.keys(r).map(c=>[c,r[c]])),t+1),s=[i,"error",String(r.name),String(r.message),n];return r.cause!==void 0&&s.push(b(r.cause,t+1)),s}if(e instanceof URL)return[i,"url",e.href];if(e instanceof Map)return[i,"map",[...e.entries()].map(([r,n])=>[b(r,t+1),b(n,t+1)])];if(e instanceof Set)return[i,"set",[...e].map(r=>b(r,t+1))];if(e instanceof ArrayBuffer)return[i,"bytes",d(new Uint8Array(e)),"ArrayBuffer"];if(ArrayBuffer.isView(e)){const r=e,n=r.constructor.name,s=new Uint8Array(r.buffer,r.byteOffset,r.byteLength);return n==="Uint8Array"?[i,"bytes",d(s)]:[i,"bytes",d(s),n]}if(Array.isArray(e)){const r=e.map(n=>b(n,t+1));return r.length>0&&r[0]===i?[i,"arr",r]:r}if(!l(e)){const r=e.constructor?.name??"value";throw new TypeError(`wire-codec: cannot encode a ${r} over the Lunora wire — only plain objects, arrays, and the supported built-ins (Date, Error, URL, Map, Set, ArrayBuffer/typed arrays, bigint) round-trip`)}const o=e,a={};for(const r of Object.keys(o)){const n=o[r];if(n===void 0)continue;const s=b(n,t+1);r===w?Object.defineProperty(a,r,{configurable:!0,enumerable:!0,value:s,writable:!0}):a[r]=s}return a},y=(e,t=0)=>{if(t>64)throw new RangeError("wire-codec: value nesting exceeds the 64-level limit");if(e===null||typeof e!="object")return e;if(Array.isArray(e)){if(e[0]===i)switch(e[1]){case"-inf":return-1/0;case"arr":return e[2].map(r=>y(r,t+1));case"bigint":{const r=e[2];if(typeof r!="string"||r.length>1024||!/^-?\d+$/.test(r))throw new RangeError("wire-codec: invalid or over-long bigint (max 1024 digits)");return BigInt(r)}case"date":{const r=y(e[2],t+1);if(typeof r!="number")throw new TypeError("wire-codec: malformed date — epoch must be a number");return new Date(r)}case"map":{const r=e[2];return new Map(r.map(n=>{if(!Array.isArray(n)||n.length!==2)throw new TypeError("wire-codec: malformed map entry — expected a [key, value] pair");return[y(n[0],t+1),y(n[1],t+1)]}))}case"set":return new Set(e[2].map(r=>y(r,t+1)));case"url":{const r=e[2];if(typeof r!="string")throw new TypeError("wire-codec: malformed url — href must be a string");return new URL(r)}case"error":{const r=e[2],n=e[3];if(typeof r!="string"||typeof n!="string")throw new TypeError("wire-codec: malformed error — name and message must be strings");const s=(Object.hasOwn(p,r)?p[r]:void 0)??Error,c=new s(n);c.name!==r&&Object.defineProperty(c,"name",{configurable:!0,value:r,writable:!0});const u=y(e[4],t+1);if(u===null||typeof u!="object"||Array.isArray(u))throw new TypeError("wire-codec: malformed error — props must be an object");for(const m of Object.keys(u))m===w?Object.defineProperty(c,m,{configurable:!0,enumerable:!0,value:u[m],writable:!0}):c[m]=u[m];return e.length>5&&Object.defineProperty(c,"cause",{configurable:!0,value:y(e[5],t+1),writable:!0}),c}case"bytes":{const r=e[2];if(typeof r!="string")throw new TypeError("wire-codec: malformed bytes — payload must be a base64 string");const n=A(r);if(d(n)!==r)throw new TypeError("wire-codec: malformed bytes — payload must be canonical padded base64");const s=e[3]??"Uint8Array";if(s==="ArrayBuffer")return n.buffer.byteLength===n.byteLength?n.buffer:n.slice().buffer;const c=Object.hasOwn(g,s)?g[s]:void 0;return c?new c(n.slice().buffer):n}case"inf":return 1/0;case"nan":return Number.NaN;case"undefined":return;default:return e.map(r=>y(r,t+1))}return e.map(a=>y(a,t+1))}const f=e,o={};for(const a of Object.keys(f)){const r=y(f[a],t+1);a===w?Object.defineProperty(o,a,{configurable:!0,enumerable:!0,value:r,writable:!0}):o[a]=r}return o};export{y as d,b as e};

package/dist/workflow.d.mts

@@ -0,0 +1,22 @@
+import { P as PrivacyConfig, a as PrivacyPorts } from "./packem_shared/define.d-B0cbIvBs.mjs";
+import "./packem_shared/rules.d-DJa3SIb3.mjs";
+/**
+ * Run one port call on the server side of the hop: decode the arguments, call the app's own port,
+ * and encode the result. `config` is the `definePrivacy` config, or any object with its datasets and
+ * presets: a data call's dataset is looked up there by id, and an `eraseBatch` gets the disposition
+ * the presets' retention rules give.
+ */
+declare const dispatchPort: (config: Pick<PrivacyConfig<never>, "datasets" | "presets">, ports: PrivacyPorts, method: string, payload: string) => Promise<string>;
+/** Send one encoded port call across the hop and resolve to the encoded result text. */
+type PortTransport = (call: {
+  readonly method: string;
+  readonly payload: string;
+}) => Promise<unknown>;
+/**
+ * The ports for a workflow step: every method is one call through `send`, which the app points at
+ * its internal port mutation, so each read and write runs in a database transaction. The result is
+ * a plain object, so an app may spread it and replace a port it reaches another way. The clock and
+ * the id source run locally.
+ */
+declare const remotePorts: (send: PortTransport) => Required<PrivacyPorts>;
+export { type PortTransport, dispatchPort, remotePorts };

package/dist/workflow.d.ts

@@ -0,0 +1,22 @@
+import { P as PrivacyConfig, a as PrivacyPorts } from "./packem_shared/define.d-Dv7btZmk.js";
+import "./packem_shared/rules.d-DJa3SIb3.js";
+/**
+ * Run one port call on the server side of the hop: decode the arguments, call the app's own port,
+ * and encode the result. `config` is the `definePrivacy` config, or any object with its datasets and
+ * presets: a data call's dataset is looked up there by id, and an `eraseBatch` gets the disposition
+ * the presets' retention rules give.
+ */
+declare const dispatchPort: (config: Pick<PrivacyConfig<never>, "datasets" | "presets">, ports: PrivacyPorts, method: string, payload: string) => Promise<string>;
+/** Send one encoded port call across the hop and resolve to the encoded result text. */
+type PortTransport = (call: {
+  readonly method: string;
+  readonly payload: string;
+}) => Promise<unknown>;
+/**
+ * The ports for a workflow step: every method is one call through `send`, which the app points at
+ * its internal port mutation, so each read and write runs in a database transaction. The result is
+ * a plain object, so an app may spread it and replace a port it reaches another way. The clock and
+ * the id source run locally.
+ */
+declare const remotePorts: (send: PortTransport) => Required<PrivacyPorts>;
+export { type PortTransport, dispatchPort, remotePorts };

package/dist/workflow.mjs

@@ -0,0 +1 @@
+import{randomUUID as u}from"node:crypto";import{LunoraError as i}from"@lunora/errors";import{d as E,e as O}from"./packem_shared/wire-codec-C0ExsJJg.mjs";import{dispositionForPresets as T}from"./packem_shared/ERASE_BATCH-BqeymwxG.mjs";const s=()=>({decode:t=>t,encode:t=>t}),d={archive:{purgeBatch:s()},data:{collect:{decode:([t,e],o)=>[o.dataset(t),e],encode:([t,e])=>[t.id,e]},eraseBatch:{decode:([t,e,o],r)=>[r.dataset(t),e,o,r.disposition()],encode:([t,e,o])=>[t.id,e,o]},remaining:{decode:([t,e],o)=>[o.dataset(t),e],encode:([t,e])=>[t.id,e]}},files:{delete:s(),list:s(),put:s(),read:s(),signedUrl:s()},store:{addEvent:s(),claim:s(),findOpen:s(),get:s(),insert:s(),listForSubject:s(),listOpen:s(),update:s()},tombstones:{add:s(),keys:s()}},v=t=>Object.hasOwn(d,t),f=t=>{const[e="",o="",...r]=t.split(".");if(r.length>0||!v(e)||!Object.hasOwn(d[e],o))throw new i("BAD_REQUEST",`Unknown privacy port call "${t}".`);return{codec:d[e][o],method:o,port:e}},w=t=>JSON.stringify(O(t)),h=t=>E(JSON.parse(t)),R=async(t,e,o)=>{const r=Reflect.get(t,e);if(typeof r!="function")throw new i("INTERNAL",`The privacy port has no method "${e}".`);return Reflect.apply(r,t,o)},U=async(t,e,o,r)=>{const n=f(o),c=h(r);if(!Array.isArray(c))throw new i("BAD_REQUEST",`The privacy port call "${o}" needs an argument list.`);const a=e[n.port];if(a===void 0)throw new i("BAD_REQUEST",`The privacy port "${n.port}" is not bound for this call.`);const y={dataset:p=>{const l=t.datasets.find(m=>m.id===p);if(l===void 0)throw new i("BAD_REQUEST",`No privacy dataset with id "${p}".`);return l},disposition:()=>T(t.presets??[])};return w(await R(a,n.method,n.codec.decode(c,y)))},$=t=>{const e=async(r,n)=>{const{codec:c}=f(r),a=await t({method:r,payload:w(c.encode(n))});if(typeof a!="string")throw new i("INTERNAL",`The privacy port call "${r}" returned no result.`);return h(a)};return{...Object.fromEntries(Object.entries(d).map(([r,n])=>[r,Object.fromEntries(Object.keys(n).map(c=>[c,async(...a)=>e(`${r}.${c}`,a)]))])),newId:()=>u(),now:()=>new Date}};export{U as dispatchPort,$ as remotePorts};