@wildo-ai/saas-models 1.1.2 → 1.1.4

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts

@@ -1,48 +1,101 @@
 import { z } from "zod";
 /**
- * Field-treatment vocabulary, shared by two consumers (D9 — "one authority axis"):
- *  - flow-actors `redactionRules` (log / response redaction), and
- *  - the impersonalization `.impersonalizeWith()` per-field treatment (erasure scrub —
- *    scrub a person out of a record that must be retained).
- *
- * Adding members is additive for both consumers (no exhaustive switches read it).
- * `KEEP` is meaningful only for impersonalization (never scrub this field) — the
- * never-scrub scope-FK floor relies on it. Reversible tokenization is intentionally
- * NOT in v1 (D6 = irreversible); `ENCRYPT` remains the existing reversible option, and a
- * dedicated `TOKENIZE` member can be added additively if a vault-backed mode ships later.
+ * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer
+ *
+ * How one field's value is replaced when it is redacted or scrubbed.
+ *
+ * Imported from `@wildo-ai/saas-models`.
+ *
+ * ## Two consumers, and only one of them accepts every member
+ *
+ * | consumer | what it does | accepts |
+ * |---|---|---|
+ * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |
+ * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |
+ *
+ * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is
+ * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's
+ * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be
+ * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw
+ * when the erasure runs, not when you author the field, so choosing one leaves a resource that
+ * configures cleanly and fails the first time somebody is erased.
+ *
+ * ## Choosing a treatment for an erasure scrub
+ *
+ * | the field | treatment |
+ * |---|---|
+ * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |
+ * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |
+ * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |
+ * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |
+ *
+ * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than
+ * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,
+ * and `MASK` writes a string, which cannot express an array, a record, a number or a date.
+ *
+ * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal
+ * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,
+ * so a field such as `lastActiveAt` would record the erased person as active at the moment they were
+ * erased. That fabricates information rather than removing it. Give the field a static neutral
+ * default such as `new Date(0)`, which asserts "no recorded value", or make it nullable and use
+ * `REMOVE`, which asserts "unknown". Those are different claims about a person; choose deliberately.
+ *
+ * ## The never-scrub floor
+ *
+ * A row's link to the organization or application it belongs to, and its `createdByUserId`, are
+ * never scrubbed — even when a treatment is declared on them. They connect the retained row to the
+ * tenant that must keep it, and nulling them would orphan the record the retention exists to
+ * preserve. `KEEP` is the way to say the same thing explicitly about any other field.
+ *
+ * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a
+ * legally required value — an invoice line, an amount, a date — survives the erasure of the person
+ * the record names.
+ *
+ * @example Scrubbing a person out of a retained record
+ * ```ts
+ * import { RedactionType } from '@wildo-ai/saas-models';
+ *
+ * const contactSchema = z.object({
+ *   // nullable → REMOVE
+ *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),
+ *   // constrained string → MASK with a value the field's own schema accepts
+ *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),
+ *   // non-nullable with a default → RESET
+ *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })
+ *     .impersonalizeWith(RedactionType.RESET),
+ *   // no treatment → survives the erasure, deliberately
+ *   invoicedAmount: z.number(),
+ * });
+ * ```
  */
 export declare enum RedactionType {
-    /** Replace with a fixed mask (e.g. `••••••••`). */
+    /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */
     MASK = "mask",
-    /** Remove / null the value. Impersonalization: the default scrub. */
+    /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */
     REMOVE = "remove",
-    /** Replace with a one-way hash — irreversible. */
+    /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */
     HASH = "hash",
-    /** Replace with a reversible ciphertext (key-dependent). */
+    /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */
     ENCRYPT = "encrypt",
-    /** Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. */
+    /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */
     KEEP = "keep",
     /**
-     * Impersonalization only: reset the field to its OWN schema default.
+     * Erasure scrub only: reset the field to its OWN schema default.
      *
-     * The treatment for a field that is non-nullable and carries a `.default()` — where neither of the
-     * other two reaches. `REMOVE` writes null, which fails the strict re-parse of the row erasure just
-     * wrote; `MASK` cannot express the value, because `maskValue` is typed `string` while these fields
-     * are arrays, records, numbers, dates and objects.
+     * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the
+     * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure
+     * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates
+     * and objects.
      *
-     * That is not a rare shape. Measured 2026-08-31 across the engine schemas still owed an erasure
-     * posture, ELEVEN categorized fields were of it and NONE was scrubbable — behavioural counters,
-     * stage histories, notification preferences, regional settings carrying LOCATION. Those resources
-     * could declare no honest posture at all: `RETAIN_AND_IMPERSONALIZE` is refused when nothing would
-     * be scrubbed, and `RETAIN_ONLY` would assert they hold no personal data, which is false.
+     * The value is read from the schema rather than authored a second time, so it cannot drift from
+     * the default the field already declares — and for a person's counters and settings, "what this is
+     * when nobody has set it" is exactly what an erasure should leave behind.
      *
-     * The value comes from the schema rather than from the author, deliberately. A second copy of every
-     * default would drift from the first, and "what this field is when nobody has set it" is a question
-     * the schema already answers — for a person's settings and counters that is exactly what erasure
-     * should leave behind.
+     * Refused when the field declares no `.default()`, and refused when that default reads the clock.
      */
     RESET = "reset"
 }
+/** @wildo_source:part:end saas.models.privacy.redaction-treatments */
 export declare const RedationRulesSchema: z.ZodObject<{
     fieldPath: z.ZodString;
     isRecursive: z.ZodDefault<z.ZodBoolean>;

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;GAWG;AACH,oBAAY,aAAa;IACvB,mDAAmD;IACnD,IAAI,SAAS;IACb,qEAAqE;IACrE,MAAM,WAAW;IACjB,kDAAkD;IAClD,IAAI,SAAS;IACb,4DAA4D;IAC5D,OAAO,YAAY;IACnB,uGAAuG;IACvG,IAAI,SAAS;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,UAAU;CAChB;AAGD,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/redaction.shared.schemas.js

@@ -1,50 +1,116 @@
 import { z } from "zod";
 import { RolesSchema } from "../../security/authorizations/roles.shared.schemas.js";
+/*
+ * MAINTAINER NOTE — not part of the anchored, application-facing block below.
+ *
+ * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the
+ * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two
+ * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch
+ * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new
+ * member fails loud in an erasure rather than being silently skipped.
+ *
+ * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the
+ * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added
+ * additively if such a mode ships.
+ */
 /**
- * Field-treatment vocabulary, shared by two consumers (D9 — "one authority axis"):
- *  - flow-actors `redactionRules` (log / response redaction), and
- *  - the impersonalization `.impersonalizeWith()` per-field treatment (erasure scrub —
- *    scrub a person out of a record that must be retained).
- *
- * Adding members is additive for both consumers (no exhaustive switches read it).
- * `KEEP` is meaningful only for impersonalization (never scrub this field) — the
- * never-scrub scope-FK floor relies on it. Reversible tokenization is intentionally
- * NOT in v1 (D6 = irreversible); `ENCRYPT` remains the existing reversible option, and a
- * dedicated `TOKENIZE` member can be added additively if a vault-backed mode ships later.
+ * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer
+ *
+ * How one field's value is replaced when it is redacted or scrubbed.
+ *
+ * Imported from `@wildo-ai/saas-models`.
+ *
+ * ## Two consumers, and only one of them accepts every member
+ *
+ * | consumer | what it does | accepts |
+ * |---|---|---|
+ * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |
+ * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |
+ *
+ * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is
+ * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's
+ * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be
+ * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw
+ * when the erasure runs, not when you author the field, so choosing one leaves a resource that
+ * configures cleanly and fails the first time somebody is erased.
+ *
+ * ## Choosing a treatment for an erasure scrub
+ *
+ * | the field | treatment |
+ * |---|---|
+ * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |
+ * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |
+ * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |
+ * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |
+ *
+ * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than
+ * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,
+ * and `MASK` writes a string, which cannot express an array, a record, a number or a date.
+ *
+ * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal
+ * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,
+ * so a field such as `lastActiveAt` would record the erased person as active at the moment they were
+ * erased. That fabricates information rather than removing it. Give the field a static neutral
+ * default such as `new Date(0)`, which asserts "no recorded value", or make it nullable and use
+ * `REMOVE`, which asserts "unknown". Those are different claims about a person; choose deliberately.
+ *
+ * ## The never-scrub floor
+ *
+ * A row's link to the organization or application it belongs to, and its `createdByUserId`, are
+ * never scrubbed — even when a treatment is declared on them. They connect the retained row to the
+ * tenant that must keep it, and nulling them would orphan the record the retention exists to
+ * preserve. `KEEP` is the way to say the same thing explicitly about any other field.
+ *
+ * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a
+ * legally required value — an invoice line, an amount, a date — survives the erasure of the person
+ * the record names.
+ *
+ * @example Scrubbing a person out of a retained record
+ * ```ts
+ * import { RedactionType } from '@wildo-ai/saas-models';
+ *
+ * const contactSchema = z.object({
+ *   // nullable → REMOVE
+ *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),
+ *   // constrained string → MASK with a value the field's own schema accepts
+ *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),
+ *   // non-nullable with a default → RESET
+ *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })
+ *     .impersonalizeWith(RedactionType.RESET),
+ *   // no treatment → survives the erasure, deliberately
+ *   invoicedAmount: z.number(),
+ * });
+ * ```
  */
 export var RedactionType;
 (function (RedactionType) {
-    /** Replace with a fixed mask (e.g. `••••••••`). */
+    /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */
     RedactionType["MASK"] = "mask";
-    /** Remove / null the value. Impersonalization: the default scrub. */
+    /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */
     RedactionType["REMOVE"] = "remove";
-    /** Replace with a one-way hash — irreversible. */
+    /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */
     RedactionType["HASH"] = "hash";
-    /** Replace with a reversible ciphertext (key-dependent). */
+    /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */
     RedactionType["ENCRYPT"] = "encrypt";
-    /** Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. */
+    /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */
     RedactionType["KEEP"] = "keep";
     /**
-     * Impersonalization only: reset the field to its OWN schema default.
+     * Erasure scrub only: reset the field to its OWN schema default.
      *
-     * The treatment for a field that is non-nullable and carries a `.default()` — where neither of the
-     * other two reaches. `REMOVE` writes null, which fails the strict re-parse of the row erasure just
-     * wrote; `MASK` cannot express the value, because `maskValue` is typed `string` while these fields
-     * are arrays, records, numbers, dates and objects.
+     * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the
+     * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure
+     * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates
+     * and objects.
      *
-     * That is not a rare shape. Measured 2026-08-31 across the engine schemas still owed an erasure
-     * posture, ELEVEN categorized fields were of it and NONE was scrubbable — behavioural counters,
-     * stage histories, notification preferences, regional settings carrying LOCATION. Those resources
-     * could declare no honest posture at all: `RETAIN_AND_IMPERSONALIZE` is refused when nothing would
-     * be scrubbed, and `RETAIN_ONLY` would assert they hold no personal data, which is false.
+     * The value is read from the schema rather than authored a second time, so it cannot drift from
+     * the default the field already declares — and for a person's counters and settings, "what this is
+     * when nobody has set it" is exactly what an erasure should leave behind.
      *
-     * The value comes from the schema rather than from the author, deliberately. A second copy of every
-     * default would drift from the first, and "what this field is when nobody has set it" is a question
-     * the schema already answers — for a person's settings and counters that is exactly what erasure
-     * should leave behind.
+     * Refused when the field declares no `.default()`, and refused when that default reads the clock.
      */
     RedactionType["RESET"] = "reset";
 })(RedactionType || (RedactionType = {}));
+/** @wildo_source:part:end saas.models.privacy.redaction-treatments */
 export const RedationRulesSchema = z.object({
     fieldPath: z.string(),
     isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields

package/dist/esm/compliance/privacy/redaction.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,aA+BX;AA/BD,WAAY,aAAa;IACvB,mDAAmD;IACnD,8BAAa,CAAA;IACb,qEAAqE;IACrE,kCAAiB,CAAA;IACjB,kDAAkD;IAClD,8BAAa,CAAA;IACb,4DAA4D;IAC5D,oCAAmB,CAAA;IACnB,uGAAuG;IACvG,8BAAa,CAAA;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,gCAAe,CAAA;AACjB,CAAC,EA/BW,aAAa,KAAb,aAAa,QA+BxB;AAGD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/**\n * Field-treatment vocabulary, shared by two consumers (D9 — \"one authority axis\"):\n *  - flow-actors `redactionRules` (log / response redaction), and\n *  - the impersonalization `.impersonalizeWith()` per-field treatment (erasure scrub —\n *    scrub a person out of a record that must be retained).\n *\n * Adding members is additive for both consumers (no exhaustive switches read it).\n * `KEEP` is meaningful only for impersonalization (never scrub this field) — the\n * never-scrub scope-FK floor relies on it. Reversible tokenization is intentionally\n * NOT in v1 (D6 = irreversible); `ENCRYPT` remains the existing reversible option, and a\n * dedicated `TOKENIZE` member can be added additively if a vault-backed mode ships later.\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask (e.g. `••••••••`). */\n  MASK = 'mask',\n  /** Remove / null the value. Impersonalization: the default scrub. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash — irreversible. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext (key-dependent). */\n  ENCRYPT = 'encrypt',\n  /** Impersonalization only: retain the field as-is (never scrub). The scope-FK KEEP-floor uses this. */\n  KEEP = 'keep',\n  /**\n   * Impersonalization only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()` — where neither of the\n   * other two reaches. `REMOVE` writes null, which fails the strict re-parse of the row erasure just\n   * wrote; `MASK` cannot express the value, because `maskValue` is typed `string` while these fields\n   * are arrays, records, numbers, dates and objects.\n   *\n   * That is not a rare shape. Measured 2026-08-31 across the engine schemas still owed an erasure\n   * posture, ELEVEN categorized fields were of it and NONE was scrubbable — behavioural counters,\n   * stage histories, notification preferences, regional settings carrying LOCATION. Those resources\n   * could declare no honest posture at all: `RETAIN_AND_IMPERSONALIZE` is refused when nothing would\n   * be scrubbed, and `RETAIN_ONLY` would assert they hold no personal data, which is false.\n   *\n   * The value comes from the schema rather than from the author, deliberately. A second copy of every\n   * default would drift from the first, and \"what this field is when nobody has set it\" is a question\n   * the schema already answers — for a person's settings and counters that is exactly what erasure\n   * should leave behind.\n   */\n  RESET = 'reset',\n}\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}
+{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n * MAINTAINER NOTE — not part of the anchored, application-facing block below.\n *\n * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n *\n * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n */\n\n/**\n * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n *\n * How one field's value is replaced when it is redacted or scrubbed.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Two consumers, and only one of them accepts every member\n *\n * | consumer | what it does | accepts |\n * |---|---|---|\n * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |\n * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |\n *\n * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n *\n * ## Choosing a treatment for an erasure scrub\n *\n * | the field | treatment |\n * |---|---|\n * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |\n * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |\n * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |\n * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |\n *\n * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n *\n * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n *\n * ## The never-scrub floor\n *\n * A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n *\n * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n *\n * @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n *\n * const contactSchema = z.object({\n *   // nullable → REMOVE\n *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n *   // constrained string → MASK with a value the field's own schema accepts\n *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n *   // non-nullable with a default → RESET\n *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n *     .impersonalizeWith(RedactionType.RESET),\n *   // no treatment → survives the erasure, deliberately\n *   invoicedAmount: z.number(),\n * });\n * ```\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */\n  MASK = 'mask',\n  /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */\n  ENCRYPT = 'encrypt',\n  /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */\n  KEEP = 'keep',\n  /**\n   * Erasure scrub only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n   * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n   * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n   * and objects.\n   *\n   * The value is read from the schema rather than authored a second time, so it cannot drift from\n   * the default the field already declares — and for a person's counters and settings, \"what this is\n   * when nobody has set it\" is exactly what an erasure should leave behind.\n   *\n   * Refused when the field declares no `.default()`, and refused when that default reads the clock.\n   */\n  RESET = 'reset',\n}\n/** @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}
+{"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}

package/dist/esm/compliance/privacy/subject-erasure.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-erasure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,MAAM,WAAW;IAEjB;;;;OAIG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;OAKG;IACH,SAAS,cAAc;IAEvB;;;;;OAKG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,0DAA0D;IAC1D,iBAAiB,EAAE,YAAY,CAAC;IAChC,2DAA2D;IAC3D,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAQD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,oBAAoB,GACjC,gCAAgC,CA0FlC;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,gCAAgC;IACjF;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kCAAkC;IAC5C,sEAAsE;IACtE,SAAS,cAAc;IACvB;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,YAAY;IACnB,mGAAmG;IACnG,MAAM,WAAW;IACjB;;;OAGG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;CACtD;AAED,gGAAgG;AAChG,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAOT;AAED,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kCAAkC,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,mBAAmB,EAAE,YAAY,CAAC;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE;QAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,eAAe,EAAE,mCAAmC,EAAE,CAAC;CACxD"}
+{"version":3,"file":"subject-erasure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,MAAM,WAAW;IAEjB;;;;OAIG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;OAKG;IACH,SAAS,cAAc;IAEvB;;;;;OAKG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,0DAA0D;IAC1D,iBAAiB,EAAE,YAAY,CAAC;IAChC,2DAA2D;IAC3D,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAQD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,oBAAoB,GACjC,gCAAgC,CA0FlC;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,gCAAgC;IACjF;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kCAAkC;IAC5C,sEAAsE;IACtE,SAAS,cAAc;IACvB;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,YAAY;IACnB,mGAAmG;IACnG,MAAM,WAAW;IACjB;;;OAGG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;CACtD;AAED,gGAAgG;AAChG,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAOT;AAED,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kCAAkC,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,mBAAmB,EAAE,YAAY,CAAC;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE;QAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,eAAe,EAAE,mCAAmC,EAAE,CAAC;CACxD"}

package/dist/esm/compliance/privacy/subject-export-render.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-export-render.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EAGpB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,oBAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,IAAI,SAAS;IAEb;;;;OAIG;IACH,GAAG,QAAQ;CACZ;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACpC;AAkED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,6BAA6B,CAmC/B"}
+{"version":3,"file":"subject-export-render.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EAGpB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,oBAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,IAAI,SAAS;IAEb;;;;OAIG;IACH,GAAG,QAAQ;CACZ;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACpC;AAkED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,6BAA6B,CAmC/B"}

package/dist/esm/compliance/privacy/subject-export.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-export.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAItF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,aAAa,kBAAkB;IAE/B;;;;OAIG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,yBAAyB;IACnC;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;OAIG;IACH,QAAQ,aAAa;IAErB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oBAAY,4BAA4B;IACtC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,2BAA2B,gCAAgC;IAE3D;;;;OAIG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;OAOG;IACH,6BAA6B,kCAAkC;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,4EAA4E;AAC5E,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAGT;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,wDAAwD;IACxD,mBAAmB,EAAE,YAAY,CAAC;IAClC,0DAA0D;IAC1D,WAAW,EAAE,4BAA4B,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,oBAAoB,GAC5B,+BAA+B,CAmEjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,iFAAiF;AACjF,MAAM,WAAW,kCAAkC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4CAA4C,CAC1D,mBAAmB,EAAE,YAAY,EACjC,aAAa,EAAE,gCAAgC,EAC/C,OAAO,EAAE,oBAAoB,GAC5B,kCAAkC,EAAE,CA8BtC;AAED,kGAAkG;AAClG,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,kCAAkC,GAAG,MAAM,CAW3G;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,gDAAgD;IAChD,QAAQ,aAAa;IAErB;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,eAAe;CAC1B;AAED,uFAAuF;AACvF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,yBAAyB,GAAG,SAAS,EACjD,OAAO,EAAE,oBAAoB,GAC5B,uBAAuB,CAqBzB;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAKnF;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0CAA0C,CACxD,WAAW,EAAE,CAAC,CAAC,UAAU,EACzB,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,EAChE,YAAY,EAAE,MAAM,GACnB,yBAAyB,GAAG,SAAS,CAiBvC;AAED,2EAA2E;AAC3E,oBAAY,+BAA+B;IACzC,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,wBAAwB,6BAA6B;IACrD,UAAU,eAAe;IACzB,WAAW,gBAAgB;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;CACjD;AAID;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASnH;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,GAAG,0BAA0B,EAAE,CAmD/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,mBAAmB,EAAE,YAAY,CAAC;IAClC,iCAAiC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACzC,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACtC"}
+{"version":3,"file":"subject-export.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAItF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,aAAa,kBAAkB;IAE/B;;;;OAIG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,yBAAyB;IACnC;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;OAIG;IACH,QAAQ,aAAa;IAErB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oBAAY,4BAA4B;IACtC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,2BAA2B,gCAAgC;IAE3D;;;;OAIG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;OAOG;IACH,6BAA6B,kCAAkC;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,4EAA4E;AAC5E,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAGT;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,wDAAwD;IACxD,mBAAmB,EAAE,YAAY,CAAC;IAClC,0DAA0D;IAC1D,WAAW,EAAE,4BAA4B,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,oBAAoB,GAC5B,+BAA+B,CAmEjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,iFAAiF;AACjF,MAAM,WAAW,kCAAkC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4CAA4C,CAC1D,mBAAmB,EAAE,YAAY,EACjC,aAAa,EAAE,gCAAgC,EAC/C,OAAO,EAAE,oBAAoB,GAC5B,kCAAkC,EAAE,CA8BtC;AAED,kGAAkG;AAClG,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,kCAAkC,GAAG,MAAM,CAW3G;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,gDAAgD;IAChD,QAAQ,aAAa;IAErB;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,eAAe;CAC1B;AAED,uFAAuF;AACvF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,yBAAyB,GAAG,SAAS,EACjD,OAAO,EAAE,oBAAoB,GAC5B,uBAAuB,CAqBzB;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAWnF;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0CAA0C,CACxD,WAAW,EAAE,CAAC,CAAC,UAAU,EACzB,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,EAChE,YAAY,EAAE,MAAM,GACnB,yBAAyB,GAAG,SAAS,CAiBvC;AAED,2EAA2E;AAC3E,oBAAY,+BAA+B;IACzC,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,wBAAwB,6BAA6B;IACrD,UAAU,eAAe;IACzB,WAAW,gBAAgB;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;CACjD;AAID;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASnH;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,GAAG,0BAA0B,EAAE,CAmD/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,mBAAmB,EAAE,YAAY,CAAC;IAClC,iCAAiC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACzC,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACtC"}

package/dist/esm/compliance/privacy/subject-export.shared.schemas.js

@@ -1,4 +1,5 @@
-import { getPortabilityProvenance, isBackendOnlyField, isWriteOnlySecretField } from '@wildo-ai/zod-decorators';
+import { getPortabilityProvenance } from '@wildo-ai/zod-decorators';
+import { isNonDisclosableFieldValue } from '../../resources/utils/field-value-disclosure.utils.js';
 import { RelationshipLifecycleModel, } from '../../resources/resources.shared.schemas.js';
 import { Resources_SharedUtils } from '../../resources/resources.shared.utils.js';
 const compareCanonicalText = (left, right) => (left < right ? -1 : left > right ? 1 : 0);
@@ -410,10 +411,16 @@ function resolvePortabilityFieldScope(provenance) {
  * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT
  */
 export function isFieldWithheldFromSubjectExport(fieldSchema) {
-    // `isWriteOnlySecret` is checked explicitly rather than assumed to imply backend-only: they are
-    // separate decorators, and a future authoring form that sets one without the other must not
-    // silently open a disclosure path.
-    return isBackendOnlyField(fieldSchema) || isWriteOnlySecretField(fieldSchema);
+    // Delegated to the ONE field-value disclosure rule rather than restated. The reasoning that used
+    // to sit here — that `isWriteOnlySecret` is checked explicitly rather than assumed to imply
+    // backend-only, because they are separate decorators and a future authoring form may set one
+    // without the other — moved WITH the rule, and is now the shared module's own justification.
+    //
+    // This function keeps its own name and its own assurance marker deliberately: subject export is a
+    // distinct obligation from model disclosure, its own docstring anticipates a per-field opt-in that
+    // would apply HERE and nowhere else, and merging the two names would make that extension
+    // unexpressible. What is shared is the rule, not the concept.
+    return isNonDisclosableFieldValue(fieldSchema);
 }
 /** Every legal {@link DataPortabilityProvenance} value, for validating an opaque decorator string. */
 const KNOWN_PORTABILITY_PROVENANCES = new Set(Object.values(DataPortabilityProvenance));