@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/base-classes/services/services/system-access.backend.service.d.ts

@@ -82,6 +82,37 @@ export declare class SystemAccessBackendService {
     /** The runtime profile of this process, defaulting fail-safe if the principal is unresolvable. */
     private resolveRuntimeProfile;
     private buildUnaccountableAccessError;
+    /**
+     * Emit the see-through REVEAL audit. Always fail-closed, on every runtime.
+     *
+     * This is deliberately NOT {@link emitPrivilegedReadAudit}'s two-posture rule, and the difference
+     * is the act rather than the process. That method asks WHICH RUNTIME is reading, because its
+     * subject is the framework's most common internal read path and blocking it on audit availability
+     * would turn an audit hiccup into an application-wide outage. A see-through read is the opposite
+     * kind of event: rare, human-initiated, and already refused unless the caller clears three
+     * fail-closed gates — the `seeRetained` policy verb, a privileged role, and a real `accessingUserId`
+     * plus `reason`. Those three answer WHO may reveal scrubbed personal data. The reason it is
+     * permitted at all is that the reveal leaves evidence, and that fourth gate was the only one of the
+     * four that a failure could silently skip.
+     *
+     * So the trade runs the other way here: refusing costs one operator one retry, while proceeding
+     * costs a reveal of retained PII that no record can attest to. An unbound audit subsystem is
+     * treated identically to a failed write — an inability to record is not an exemption from
+     * recording, the same reading {@link emitPrivilegedReadAudit} takes.
+     *
+     * Called AFTER the read, so throwing withholds rows the database already returned. That is the
+     * meaningful boundary: the caller never OBTAINS retained data whose reveal went unrecorded.
+     *
+     * assurance-control: WILDO.PRIVACY.RETAINED_DATA_REVEAL — a see-through reveal is recorded or refused.
+     */
+    private emitRetainedDataRevealAudit;
+    /**
+     * Distinct from {@link buildUnaccountableAccessError} on purpose: both refuse an unrecordable
+     * privileged access, but the remedies differ and a client branching on `reason` has to be able to
+     * tell them apart. That one means "this runtime requires accountability and the audit is down";
+     * this one means "a reveal of retained personal data was not recorded, so it did not happen".
+     */
+    private buildUnrecordableRevealError;
     private getServicesRegistryHandler;
     /**
      * WHICH RUNTIME is performing this privileged access, for audit attribution.
@@ -317,8 +348,9 @@ export declare class SystemAccessBackendService {
      * the M5a hide-predicate hides from normal callers. Fail-closed on the `seeRetained` policy verb + a
      * privileged HUMAN role; sets the EC see-through flag so `buildContextualFilter` suppresses ONLY the
      * retention predicate for THIS read (scope still applies); emits the HUMAN-attributed
-     * `RETAINED_DATA_ACCESS` audit. The human's id/roles + a `reason` are REQUIRED — this layer has no
-     * ambient user. Strictly read-only.
+     * `RETAINED_DATA_ACCESS` audit, which is ACCOUNTABLE rather than best-effort — a reveal that cannot
+     * be recorded is refused and the rows are withheld (see {@link emitRetainedDataRevealAudit}). The
+     * human's id/roles + a `reason` are REQUIRED — this layer has no ambient user. Strictly read-only.
      */
     readRetainedAsSystem<T = any>(resourceType: ResourceType, id_or_ids_or_filter: IdOrIdsOrFilterType, auth: {
         accessingUserId: string;
@@ -333,7 +365,8 @@ export declare class SystemAccessBackendService {
     }): Promise<T | null>;
     /**
      * SEE-THROUGH collection read (M5b): the list sibling of {@link readRetainedAsSystem}. Same gates
-     * (`seeRetained` verb + privileged role), same EC see-through flag, same HUMAN-attributed audit.
+     * (`seeRetained` verb + privileged role), same EC see-through flag, same HUMAN-attributed audit, and
+     * the same accountability: an unrecordable reveal is refused rather than performed silently.
      */
     listRetainedAsSystem<T = any>(resourceType: ResourceType, auth: {
         accessingUserId: string;

package/dist/esm/base-classes/services/services/system-access.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-access.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/system-access.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,SAAS,EAAgC,MAAM,WAAW,CAAC;AACpE,OAAO,EACL,YAAY,EAWb,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAGV,2BAA2B,EAC3B,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAiB/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,mDAAmD,EAEpD,MAAM,iGAAiG,CAAC;AACzG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAK/H,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAmB9H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBACa,0BAA0B;IAEa,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACpB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAGpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAGP,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAEvE,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;gBAfkB,YAAY,EAAE,0BAA0B,EACpC,iBAAiB,EAAE,+BAA+B,EACpC,uBAAuB,EAAE,qCAAqC,EAG1F,SAAS,EAAE,SAAS,EAGD,gBAAgB,CAAC,EAAE,uBAAuB,EAKpD,MAAM,CAAC,EAAE,aAAa,EAErE,6BAA6B,CAAC,EAAE,mDAAmD;IAGtG;;;;;;;;;;;;;;;;;;OAkBG;YACW,uBAAuB;IA4BrC,kGAAkG;IAClG,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,6BAA6B;IAYrC,OAAO,CAAC,0BAA0B;IAMlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;IAU/B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,sCAAsC;IAgDpD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,6CAA6C;IA2C3D;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAsCvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,OAAO,CAAC,0BAA0B;IAWlC;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA8BjC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACU,YAAY,CAAC,CAAC,GAAG,GAAG,EAC/B,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpF;;;;;;WAMG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GACA,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAqCpB;;;;;;;;OAQG;IACU,YAAY,CAAC,CAAC,GAAG,GAAG,EAC/B,YAAY,EAAE,YAAY,EAC1B,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EACzB,UAAU,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,EACjD,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpF,oHAAoH;QACpH,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GACA,OAAO,CAAC,CAAC,EAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;IA4C9C;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAgBhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAc5B;;;;;;OAMG;IACH,OAAO,CAAC,2BAA2B;IAanC;;;;;;;OAOG;IACU,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAC/E,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAuCpB;;;OAGG;IACU,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAC/E,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EACzB,UAAU,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,EACjD,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,EAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAsC9C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,cAAc,CAAC,CAAC,GAAG,GAAG,EACjC,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,CAAC;IAuCb;;;;;;;OAOG;IACU,cAAc,CAAC,CAAC,GAAG,GAAG,EACjC,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAuCpB;;;;;;;OAOG;IACU,kBAAkB,CAAC,CAAC,GAAG,GAAG,EACrC,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,EAAE,CAAC;IAuCf;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,4BAA4B,CACvC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,EAC5B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,IAAI,CAAC;IAyChB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACU,qBAAqB,CAChC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,EAC5B,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,mBAAmB,CAAC;IAsE/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mCAAmC;IAqD9B,oBAAoB,CAC/B,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,EAC5B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpF;;;;;;;;;;WAUG;QACH,uCAAuC,CAAC,EAAE,OAAO,CAAC;QAClD;;;;;;;WAOG;QACH,8CAA8C,CAAC,EAAE,OAAO,CAAC;QACzD;;;;;;;;;;;;;;;WAeG;QACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;KACxC,GACA,OAAO,CAAC,oBAAoB,CAAC;CAuKjC"}
+{"version":3,"file":"system-access.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/system-access.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,SAAS,EAAgC,MAAM,WAAW,CAAC;AACpE,OAAO,EACL,YAAY,EAWb,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAGV,2BAA2B,EAC3B,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAiB/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,mDAAmD,EAEpD,MAAM,iGAAiG,CAAC;AACzG,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAE3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAK/H,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAmB9H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBACa,0BAA0B;IAEa,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACpB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAGpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAKP,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAEvE,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;gBAjBkB,YAAY,EAAE,0BAA0B,EACpC,iBAAiB,EAAE,+BAA+B,EACpC,uBAAuB,EAAE,qCAAqC,EAG1F,SAAS,EAAE,SAAS,EAKD,gBAAgB,CAAC,EAAE,uBAAuB,EAKpD,MAAM,CAAC,EAAE,aAAa,EAErE,6BAA6B,CAAC,EAAE,mDAAmD;IAGtG;;;;;;;;;;;;;;;;;;OAkBG;YACW,uBAAuB;IA4BrC,kGAAkG;IAClG,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,6BAA6B;IAYrC;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,2BAA2B;IAczC;;;;;OAKG;IACH,OAAO,CAAC,4BAA4B;IAapC,OAAO,CAAC,0BAA0B;IAMlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;IAU/B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,sCAAsC;IAgDpD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,6CAA6C;IA2C3D;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IA8CvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,OAAO,CAAC,0BAA0B;IAWlC;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA8BjC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACU,YAAY,CAAC,CAAC,GAAG,GAAG,EAC/B,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,mBAAmB,EACxC,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpF;;;;;;WAMG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GACA,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAqCpB;;;;;;;;OAQG;IACU,YAAY,CAAC,CAAC,GAAG,GAAG,EAC/B,YAAY,EAAE,YAAY,EAC1B,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EACzB,UAAU,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,EACjD,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpF,oHAAoH;QACpH,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GACA,OAAO,CAAC,CAAC,EAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;IA4C9C;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAgBhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAc5B;;;;;;OAMG;IACH,OAAO,CAAC,2BAA2B;IAanC;;;;;;;;OAQG;IACU,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAC/E,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAuCpB;;;;OAIG;IACU,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAC/E,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EACzB,UAAU,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,EACjD,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,EAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAsC9C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,cAAc,CAAC,CAAC,GAAG,GAAG,EACjC,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,CAAC;IAuCb;;;;;;;OAOG;IACU,cAAc,CAAC,CAAC,GAAG,GAAG,EACjC,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAuCpB;;;;;;;OAOG;IACU,kBAAkB,CAAC,CAAC,GAAG,GAAG,EACrC,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,mBAAmB,EACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,CAAC,EAAE,CAAC;IAuCf;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,4BAA4B,CACvC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,EAC5B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,IAAI,CAAC;IAyChB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACU,qBAAqB,CAChC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,EAC5B,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrF,GACA,OAAO,CAAC,mBAAmB,CAAC;IAsE/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mCAAmC;IAqD9B,oBAAoB,CAC/B,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,EAC5B,OAAO,CAAC,EAAE,cAAc,GAAG;QACzB,YAAY,CAAC,EAAE;YAAE,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpF;;;;;;;;;;WAUG;QACH,uCAAuC,CAAC,EAAE,OAAO,CAAC;QAClD;;;;;;;WAOG;QACH,8CAA8C,CAAC,EAAE,OAAO,CAAC;QACzD;;;;;;;;;;;;;;;WAeG;QACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;KACxC,GACA,OAAO,CAAC,oBAAoB,CAAC;CAuKjC"}

package/dist/esm/base-classes/services/services/system-access.backend.service.js

@@ -33,6 +33,7 @@ import { ErrorBuilderBackendService } from '../../../errors/services/error-build
 import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
 import { SubjectErasureExternalEffectsRegistryBackendService, selectIncompleteExternalEffects, } from '../../../compliance/privacy/services/subject-erasure-external-effects.backend.service.js';
 import { ResourcesRegistryBackendService } from '../../../resources/services/resources-registry.backend.service.js';
+import { describeCaughtError } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { ExecutionContextCreatorBackendService } from '../../../runtime/services/execution-context-creator.backend.service.js';
 import { registerTransactionPostCommitEffect } from '../../../databases/models/transaction.shared.schemas.js';
 import { assertSuperAdminFloorForSubjectErasure, isSuperAdminFloorGovernedSubjectResource, readSubjectsForSuperAdminFloor, resolveSuperAdminConferringRoles, } from '../../../security/authorizations/super-admin-floor.backend.utils.js';
@@ -155,6 +156,57 @@ let SystemAccessBackendService = class SystemAccessBackendService {
             },
         });
     }
+    /**
+     * Emit the see-through REVEAL audit. Always fail-closed, on every runtime.
+     *
+     * This is deliberately NOT {@link emitPrivilegedReadAudit}'s two-posture rule, and the difference
+     * is the act rather than the process. That method asks WHICH RUNTIME is reading, because its
+     * subject is the framework's most common internal read path and blocking it on audit availability
+     * would turn an audit hiccup into an application-wide outage. A see-through read is the opposite
+     * kind of event: rare, human-initiated, and already refused unless the caller clears three
+     * fail-closed gates — the `seeRetained` policy verb, a privileged role, and a real `accessingUserId`
+     * plus `reason`. Those three answer WHO may reveal scrubbed personal data. The reason it is
+     * permitted at all is that the reveal leaves evidence, and that fourth gate was the only one of the
+     * four that a failure could silently skip.
+     *
+     * So the trade runs the other way here: refusing costs one operator one retry, while proceeding
+     * costs a reveal of retained PII that no record can attest to. An unbound audit subsystem is
+     * treated identically to a failed write — an inability to record is not an exemption from
+     * recording, the same reading {@link emitPrivilegedReadAudit} takes.
+     *
+     * Called AFTER the read, so throwing withholds rows the database already returned. That is the
+     * meaningful boundary: the caller never OBTAINS retained data whose reveal went unrecorded.
+     *
+     * assurance-control: WILDO.PRIVACY.RETAINED_DATA_REVEAL — a see-through reveal is recorded or refused.
+     */
+    async emitRetainedDataRevealAudit(payload) {
+        if (!this.auditLogsService) {
+            throw this.buildUnrecordableRevealError(payload.resourceType, 'the audit subsystem is not available');
+        }
+        try {
+            await this.auditLogsService.logRetainedDataAccess(payload);
+        }
+        catch (error) {
+            throw this.buildUnrecordableRevealError(payload.resourceType, describeCaughtError(error));
+        }
+    }
+    /**
+     * Distinct from {@link buildUnaccountableAccessError} on purpose: both refuse an unrecordable
+     * privileged access, but the remedies differ and a client branching on `reason` has to be able to
+     * tell them apart. That one means "this runtime requires accountability and the audit is down";
+     * this one means "a reveal of retained personal data was not recorded, so it did not happen".
+     */
+    buildUnrecordableRevealError(resourceType, cause) {
+        return this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {
+            context: {
+                reason: 'retained_data_reveal_not_recordable',
+                message: `A see-through read of retained '${resourceType}' records was refused because the reveal could not be `
+                    + `audited: ${cause}. A reveal of impersonalized-and-retained personal data is permitted only because it `
+                    + 'leaves an attributed record, so an unrecordable reveal is not performed.',
+                resourceType,
+            },
+        });
+    }
     getServicesRegistryHandler() {
         return this.container.get(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService);
     }
@@ -296,6 +348,14 @@ let SystemAccessBackendService = class SystemAccessBackendService {
      * emit records for aborted attempts.
      */
     scheduleSystemContextWriteAudit(resourceType, operation, options) {
+        /*
+         * Best-effort, and deliberately NOT the accountable posture the see-through reveal takes. A write is
+         * not a disclosure: refusing it withholds nothing from anyone, it only fails an operation whose
+         * effect the caller intended. The erasure paths below rely on this directly — an erasure refused
+         * because the audit subsystem is down would make availability a ground for declining a data
+         * subject's request, which GDPR Art. 17(3) does not admit (see
+         * `.claude/rules/administrative-continuity-floors.md`).
+         */
         if (!this.auditLogsService)
             return;
         const emit = async () => {
@@ -609,8 +669,9 @@ let SystemAccessBackendService = class SystemAccessBackendService {
      * the M5a hide-predicate hides from normal callers. Fail-closed on the `seeRetained` policy verb + a
      * privileged HUMAN role; sets the EC see-through flag so `buildContextualFilter` suppresses ONLY the
      * retention predicate for THIS read (scope still applies); emits the HUMAN-attributed
-     * `RETAINED_DATA_ACCESS` audit. The human's id/roles + a `reason` are REQUIRED — this layer has no
-     * ambient user. Strictly read-only.
+     * `RETAINED_DATA_ACCESS` audit, which is ACCOUNTABLE rather than best-effort — a reveal that cannot
+     * be recorded is refused and the rows are withheld (see {@link emitRetainedDataRevealAudit}). The
+     * human's id/roles + a `reason` are REQUIRED — this layer has no ambient user. Strictly read-only.
      */
     async readRetainedAsSystem(resourceType, id_or_ids_or_filter, auth, options) {
         this.assertSeeRetainedAllowed(resourceType);
@@ -633,8 +694,8 @@ let SystemAccessBackendService = class SystemAccessBackendService {
         // M5b: reveal retained rows for THIS read only (suppresses ONLY the retention predicate, not scope).
         systemContext.setSeeRetainedData(true);
         const result = await this.getServicesRegistryHandler().read(resourceType, systemContext, id_or_ids_or_filter, options);
-        // M6: HUMAN-attributed, reason-bearing, best-effort (never blocks/fails the read).
-        this.auditLogsService?.logRetainedDataAccess({
+        // M6: HUMAN-attributed, reason-bearing, and ACCOUNTABLE — an unrecordable reveal is refused.
+        await this.emitRetainedDataRevealAudit({
             accessingUserId: auth.accessingUserId,
             roles: auth.accessingUserRoles,
             reason: auth.reason,
@@ -642,12 +703,13 @@ let SystemAccessBackendService = class SystemAccessBackendService {
             operationIdentifier: 'readRetainedAsSystem',
             retainedRecordCount: result == null ? 0 : 1,
             organizationId: options?.scopeContext?.organizationId,
-        }).catch(() => { });
+        });
         return result;
     }
     /**
      * SEE-THROUGH collection read (M5b): the list sibling of {@link readRetainedAsSystem}. Same gates
-     * (`seeRetained` verb + privileged role), same EC see-through flag, same HUMAN-attributed audit.
+     * (`seeRetained` verb + privileged role), same EC see-through flag, same HUMAN-attributed audit, and
+     * the same accountability: an unrecordable reveal is refused rather than performed silently.
      */
     async listRetainedAsSystem(resourceType, auth, filter, pagination, options) {
         this.assertSeeRetainedAllowed(resourceType);
@@ -670,7 +732,7 @@ let SystemAccessBackendService = class SystemAccessBackendService {
         systemContext.setSeeRetainedData(true);
         const result = await this.getServicesRegistryHandler().list(resourceType, systemContext, filter, pagination, options);
         const retainedRecordCount = Array.isArray(result) ? result.length : result.data?.length;
-        this.auditLogsService?.logRetainedDataAccess({
+        await this.emitRetainedDataRevealAudit({
             accessingUserId: auth.accessingUserId,
             roles: auth.accessingUserRoles,
             reason: auth.reason,
@@ -678,7 +740,7 @@ let SystemAccessBackendService = class SystemAccessBackendService {
             operationIdentifier: 'listRetainedAsSystem',
             retainedRecordCount,
             organizationId: options?.scopeContext?.organizationId,
-        }).catch(() => { });
+        });
         return result;
     }
     /**