npm - @wildo-ai/saas-models - Versions diffs - 1.1.3 → 1.1.4 - Mend

@wildo-ai/saas-models 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (496) hide show

package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,kGAAkG;MAClG,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/*\n WHERE this application operates, as the one source every compliance surface reads (issue #229).\n \n ## The hole this closes\n \n Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n \n ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n \n Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n \n Keeping them siblings means each is answerable the day it is known.\n \n ## Why an open slug and not an enum\n \n A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n \n The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n /\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n 'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n + 'optionally with a regime or subdivision suffix such as \"us-ca\" — lowercase, because a slug that '\n + 'differs only by case is a second identifier for one place';\n\n/\n The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n \n Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n \n A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n \n What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n /\nfunction canonicalRegionSubtag(subtag: string): string \| null {\n const requested = `und-${subtag.toUpperCase()}`;\n try {\n const [canonical] = Intl.getCanonicalLocales(requested);\n return canonical === undefined ? null : canonical.slice('und-'.length);\n } catch {\n return null;\n }\n}\n\n/\n What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n \n Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n /\nexport function jurisdictionSlugProblem(slug: string): string \| null {\n if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n }\n const [root] = slug.split('-');\n const canonical = canonicalRegionSubtag(root!);\n if (canonical === null) {\n return `\"${root}\" is not a well-formed region code`;\n }\n if (canonical.toLowerCase() !== root) {\n return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n }\n return null;\n}\n\nexport const JurisdictionSlugSchema = z\n .string()\n .trim()\n .superRefine((slug, context) => {\n const problem = jurisdictionSlugProblem(slug);\n if (problem !== null) {\n context.addIssue({ code: 'custom', message: problem });\n }\n });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/\n The namespace every jurisdiction REFERENCE carries.\n \n A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n /\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/* Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. /\nexport enum JurisdictionRefProblemScope {\n /* The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. /\n NAMESPACE = 'NAMESPACE',\n /* The namespace is right and the slug is not a jurisdiction. /\n SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n readonly scope: JurisdictionRefProblemScope;\n readonly message: string;\n}\n\n/* What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. /\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem \| null {\n if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n return {\n scope: JurisdictionRefProblemScope.NAMESPACE,\n message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n };\n }\n const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/* `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. /\nexport const JurisdictionRefSchema = z\n .string()\n .trim()\n .superRefine((ref, context) => {\n const problem = jurisdictionRefProblem(ref);\n if (problem !== null) {\n context.addIssue({ code: 'custom', message: problem.message });\n }\n });\n\n/\n One jurisdiction this application operates in, and why it reaches the product.\n \n `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n \n It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n /\nexport const OperatingJurisdictionSchema = z.strictObject({\n jurisdictionSlug: JurisdictionSlugSchema,\n /* Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". /\n basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/\n The jurisdictions this application operates in.\n \n ## Absent is UNDECLARED, and an empty list is not offered\n \n The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n /\nexport const ApplicationOperatingJurisdictionsSchema = z\n .strictObject({\n jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n })\n .superRefine((declaration, context) => {\n const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n if (duplicates.length > 0) {\n context.addIssue({\n code: 'custom',\n path: ['jurisdictions'],\n message:\n `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n });\n }\n });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/\n Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n \n Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n \n ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n /\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n eu: Object.freeze([\n 'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n 'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n ]),\n});\n\n/\n Does a source addressing `reach` answer for an application operating in `declared`?\n \n Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n if (reach === declared) return true;\n // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n if (declared.startsWith(`${reach}-`)) return true;\n return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n (member) => member === declared \|\| declared.startsWith(`${member}-`),\n );\n}\n"]}
1	+ {"version":3,"file":"operating-jurisdictions.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/operating-jurisdictions.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,+BAA+B,GACnC,gGAAgG;MAC9F,wFAAwF;MACxF,2DAA2D,CAAC;AAEhE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,+BAA+B,gBAAgB,IAAI,GAAG,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,oCAAoC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,sBAAsB,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC;IACvH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,CACL,IAAI,IAAI,mDAAmD,IAAI,oCAAoC;cACjG,IAAI,IAAI,8FAA8F;cACtG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,gHAAgH;AAChH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,+GAA+G;IAC/G,sDAAuB,CAAA;IACvB,iEAAiE;IACjE,4CAAa,CAAA;AACf,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAOD,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,2BAA2B,CAAC,SAAS;YAC5C,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,0BAA0B,YAAY;SACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC;AAC/H,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,WAAW,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,gBAAgB,EAAE,sBAAsB;IACxC,+GAA+G;IAC/G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3D,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;kBAC5G,+FAA+F;SACpG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IACjG,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAClF,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KAC7E,CAAC;CACH,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,mHAAmH;IACnH,gHAAgH;IAChH,oHAAoH;IACpH,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/*\n WHERE this application operates, as the one source every compliance surface reads (issue #229).\n \n ## The hole this closes\n \n Measured 2026-09-02: nothing in application configuration said which jurisdictions an application\n * reaches. `jurisdiction` appeared only as prose, as the Art. 27 origin of a representative, and as\n * `jurisdictionRefs` on a governed-document release. The assurance programme's `jurisdictionSlugs`\n * were free text supplied per run BY THE PRODUCING MODEL — which is the opposite of a source: it is\n * unverifiable, it can differ between two runs of the same application, and nothing downstream could\n * disagree with it.\n \n ## Why a sibling of `operatorComplianceIdentity` rather than a field inside it\n \n Both describe legal posture, so folding this in is tempting. It is the wrong shape for one reason\n * that outranks the tidiness: that schema is all-or-nothing inside, so a jurisdiction could not be\n * recorded until the lawful bases were settled with counsel. Where you sell is known long before why\n * you may process — and issue #228 exists precisely because filling the entity must never block.\n \n Keeping them siblings means each is answerable the day it is known.\n \n ## Why an open slug and not an enum\n \n A jurisdiction is a genuinely open identifier: an application may operate anywhere, and an enum\n * would have to be widened before an operator could state the truth about their own product. That is\n * the \"genuinely open app/provider/resource identifier\" exemption in the semantic-literal rule, not a\n * shortcut around it. The shape is constrained; the membership is not.\n \n The framework's ability to KNOW what a declared jurisdiction requires is a separate question, and\n * a deliberately visible one — see {@link JURISDICTION_CONTAINMENT} and the coverage report that\n * consumes it. An application may always declare where it operates; Wildo says plainly where it has\n * nothing to offer.\n /\nconst JURISDICTION_SLUG_SHAPE = /^[a-z]{2}(-[a-z0-9]{1,8})?$/u;\n\nconst JURISDICTION_SLUG_SHAPE_MESSAGE =\n 'a jurisdiction slug is an ISO 3166-1 alpha-2 country code, a supranational code such as \"eu\", '\n + 'optionally with a SUBDIVISION suffix such as \"us-ca\" — lowercase, because a slug that '\n + 'differs only by case is a second identifier for one place';\n\n/\n The CANONICAL form of a region subtag, or `null` when the subtag is not well-formed.\n \n Shape alone cannot separate `gb` from `uk`: both are two lowercase letters, both name the same\n * place, and only one is the ISO 3166-1 alpha-2 code. So the shape check is answered by the regex\n * and IDENTITY is answered here, by the same authority the publication validator already uses for\n * the locale half of a variant — `Intl.getCanonicalLocales`, which resolves the CLDR alias table.\n \n A data file was rejected. An enumerated country list is a legal fact with a review trigger (the\n * one table this file does keep, {@link JURISDICTION_CONTAINMENT}, says so and is 27 rows), and a\n * second one covering every country on earth would rot with nobody watching. `Intl` ships the table\n * with the runtime and updates with it.\n \n What this deliberately does NOT catch: a well-formed but unassigned code (`qq`, `aa`) canonicalises\n * to itself and passes. Those are not authoring mistakes anybody makes; `uk` demonstrably is — it is\n * in this repository's own tests and prose.\n /\nfunction canonicalRegionSubtag(subtag: string): string \| null {\n const requested = `und-${subtag.toUpperCase()}`;\n try {\n const [canonical] = Intl.getCanonicalLocales(requested);\n return canonical === undefined ? null : canonical.slice('und-'.length);\n } catch {\n return null;\n }\n}\n\n/\n What is wrong with `slug` as a jurisdiction slug, or `null` when nothing is.\n \n Exported as a FUNCTION rather than only as a schema because the consumers that matter do not parse\n * — the governed-document publication validator and the `_core` compliance-document candidate\n * validator both emit their own typed issue records, and routing them through a Zod error to recover\n * a message is how two surfaces come to disagree about what a jurisdiction is. One rule, three\n * readers.\n \n ## A suffix under an AGGREGATE root is refused, and that is the third check\n \n The suffix means ONE thing — a place INSIDE the root — because that is the only thing\n * {@link jurisdictionReachCovers} can read it as: `declared.startsWith(`${reach}-`)` says a source\n * addressing the root answers for the suffixed place. That inference is sound for `us` → `us-ca`\n * and it INVERTS for an aggregate: `eu-eea` was authored to mean the EEA, which is a SUPERSET of the\n * EU (Iceland, Liechtenstein and Norway are in it and not in the EU), so a source addressing only\n * `eu` was reported as answering for those three. Over-coverage, which is the failure mode that\n * trains a reader to skim past the warnings that matter (measured 2026-09-09; the value was live in\n * a landed publication variant).\n \n A regime is not expressible in this grammar and does not need to be: the places it covers each\n * have their own code, so the EEA is `eu`, `is`, `li`, `no` — said explicitly, checkable, and with\n * no second kind of suffix for a future reader to have to tell apart.\n \n The aggregate roots are read from {@link JURISDICTION_CONTAINMENT}, which is the table that\n * already declares \"this root stands for other jurisdictions\" and already carries the review trigger\n * for changing it. Deliberately NOT a second list of supranational codes: a hand-kept list beside a\n * hand-kept list is the thing that rots. The forward reference is safe because the table is a module\n * constant and this function is only ever called after module evaluation.\n /\nexport function jurisdictionSlugProblem(slug: string): string \| null {\n if (!JURISDICTION_SLUG_SHAPE.test(slug)) {\n return `${JURISDICTION_SLUG_SHAPE_MESSAGE} — received \"${slug}\"`;\n }\n const [root, suffix] = slug.split('-');\n const canonical = canonicalRegionSubtag(root!);\n if (canonical === null) {\n return `\"${root}\" is not a well-formed region code`;\n }\n if (canonical.toLowerCase() !== root) {\n return `\"${root}\" is an alias for \"${canonical.toLowerCase()}\" — use the canonical code, or two slugs are one place`;\n }\n if (suffix !== undefined && Object.hasOwn(JURISDICTION_CONTAINMENT, root!)) {\n return (\n `\"${root}\" stands for the jurisdictions it contains, so \"${slug}\" would be read as a place INSIDE `\n + `\"${root}\" — and a suffix on an aggregate names a regime, which is normally wider than the aggregate `\n + 'rather than narrower. Name the places explicitly instead (the EEA is \"eu\", \"is\", \"li\", \"no\")'\n );\n }\n return null;\n}\n\nexport const JurisdictionSlugSchema = z\n .string()\n .trim()\n .superRefine((slug, context) => {\n const problem = jurisdictionSlugProblem(slug);\n if (problem !== null) {\n context.addIssue({ code: 'custom', message: problem });\n }\n });\nexport type JurisdictionSlug = z.infer<typeof JurisdictionSlugSchema>;\n\n/\n The namespace every jurisdiction REFERENCE carries.\n \n A ref is `jurisdiction:<slug>`, and both halves are checked, because checking only the namespace is\n * what let `jurisdiction:united-kingdom` — a value {@link JurisdictionSlugSchema} would refuse\n * outright — sit in a landed application specification beside that same application's configuration\n * declaring `gb`.\n /\nexport const JURISDICTION_REF_NAMESPACE = 'jurisdiction:';\n\n/* Which half of a `jurisdiction:<slug>` ref is wrong. The two are separate failures with separate remedies. /\nexport enum JurisdictionRefProblemScope {\n /* The ref is not in the `jurisdiction:` namespace, so it resolves against a different vocabulary entirely. /\n NAMESPACE = 'NAMESPACE',\n /* The namespace is right and the slug is not a jurisdiction. /\n SLUG = 'SLUG',\n}\n\nexport interface JurisdictionRefProblem {\n readonly scope: JurisdictionRefProblemScope;\n readonly message: string;\n}\n\n/* What is wrong with `ref` as a `jurisdiction:<slug>` reference, or `null` when nothing is. /\nexport function jurisdictionRefProblem(ref: string): JurisdictionRefProblem \| null {\n if (!ref.startsWith(JURISDICTION_REF_NAMESPACE)) {\n return {\n scope: JurisdictionRefProblemScope.NAMESPACE,\n message: `jurisdiction ref ${ref} must use the ${JURISDICTION_REF_NAMESPACE} namespace`,\n };\n }\n const problem = jurisdictionSlugProblem(ref.slice(JURISDICTION_REF_NAMESPACE.length));\n return problem === null ? null : { scope: JurisdictionRefProblemScope.SLUG, message: `jurisdiction ref ${ref}: ${problem}` };\n}\n\n/* `jurisdiction:<slug>`, with the slug held to the same rule as a declared operating jurisdiction. /\nexport const JurisdictionRefSchema = z\n .string()\n .trim()\n .superRefine((ref, context) => {\n const problem = jurisdictionRefProblem(ref);\n if (problem !== null) {\n context.addIssue({ code: 'custom', message: problem.message });\n }\n });\n\n/\n One jurisdiction this application operates in, and why it reaches the product.\n \n `basis` is REQUIRED, and it is the half that makes the declaration mean anything — the same\n * argument the sibling schemas make for `assessmentNote` on a legitimate-interests basis and for\n * `gatedProcessing` on a consent gate. \"eu\" alone does not say whether the operator is established\n * there, sells there, or merely holds data about people there, and those imply different obligations.\n \n It is free prose deliberately. Nothing structured exists to key it to, and inventing a closed\n * vocabulary of reasons would be a legal taxonomy nobody reviewed.\n /\nexport const OperatingJurisdictionSchema = z.strictObject({\n jurisdictionSlug: JurisdictionSlugSchema,\n /* Why this jurisdiction reaches the product — \"customers established here\", \"data subjects resident here\". /\n basis: z.string().trim().min(1),\n});\nexport type OperatingJurisdiction = z.infer<typeof OperatingJurisdictionSchema>;\n\n/\n The jurisdictions this application operates in.\n \n ## Absent is UNDECLARED, and an empty list is not offered\n \n The sibling `clientStorage` inventory distinguishes absent (\"not inventoried\") from an empty array\n * (\"this surface sets nothing\"), because there both are meaningful. Here only one is: every product\n * operates somewhere, so an empty list would be a claim nobody could mean. `min(1)` therefore refuses\n * it, and the whole declaration stays optional at the configuration level — absence is the honest\n * \"nobody has answered\", and every consumer must render it as that rather than as \"nowhere\".\n /\nexport const ApplicationOperatingJurisdictionsSchema = z\n .strictObject({\n jurisdictions: z.array(OperatingJurisdictionSchema).min(1),\n })\n .superRefine((declaration, context) => {\n const slugs = declaration.jurisdictions.map((entry) => entry.jurisdictionSlug);\n const duplicates = slugs.filter((slug, index) => slugs.indexOf(slug) !== index);\n if (duplicates.length > 0) {\n context.addIssue({\n code: 'custom',\n path: ['jurisdictions'],\n message:\n `jurisdiction ${[...new Set(duplicates)].map((slug) => `\"${slug}\"`).join(', ')} is declared more than once — `\n + 'one place has one basis, and two entries would let a document cite whichever suits the clause',\n });\n }\n });\nexport type ApplicationOperatingJurisdictions = z.infer<typeof ApplicationOperatingJurisdictionsSchema>;\n\n/\n Which jurisdictions a broader one contains, so a source addressing the broader one answers for them.\n \n Without this, an application declaring `fr` would be reported as uncovered while the GDPR source\n * plainly reaches it — over-warning, which is the failure mode that trains a reader to skim past the\n * warnings that matter. Subdivisions need no table: `us-ca` is contained by `us` by construction, and\n * that rule is applied in code rather than enumerated here.\n \n This table has a SECOND duty, so do not read it as coverage-only: its KEYS are the roots that stand\n * for other jurisdictions, and {@link jurisdictionSlugProblem} refuses a suffix on any of them —\n * because a suffix can only be read as a place inside its root, and on an aggregate that reading\n * inverts. Adding a key therefore also closes `<key>-<anything>` as an authorable slug, which is the\n * intended consequence: the places a regime covers each have their own code.\n \n ⚠️ EU membership is a legal fact with a review trigger, not a convenience list: it changes when a\n * state accedes or withdraws, and it has done both. Verified against the 27 members as of 2026-09-02.\n * Nothing derives it, so a change is a deliberate edit here.\n /\nexport const JURISDICTION_CONTAINMENT: Readonly<Record<string, readonly string[]>> = Object.freeze({\n eu: Object.freeze([\n 'at', 'be', 'bg', 'cy', 'cz', 'de', 'dk', 'ee', 'es', 'fi', 'fr', 'gr', 'hr', 'hu',\n 'ie', 'it', 'lt', 'lu', 'lv', 'mt', 'nl', 'pl', 'pt', 'ro', 'se', 'si', 'sk',\n ]),\n});\n\n/\n Does a source addressing `reach` answer for an application operating in `declared`?\n \n Three ways, and the order is deliberate — exact first, because it is the common case and the other\n * two are refinements of it.\n */\nexport function jurisdictionReachCovers(reach: string, declared: string): boolean {\n if (reach === declared) return true;\n // A source addressing the whole of `us` answers for `us-ca`; one addressing only `us-ca` does not answer for `us`.\n // Sound only because a suffix is now guaranteed to be a SUBDIVISION: `jurisdictionSlugProblem` refuses a suffix\n // on any key of JURISDICTION_CONTAINMENT, so no `eu-eea`-shaped slug — a regime WIDER than its root — reaches here.\n if (declared.startsWith(`${reach}-`)) return true;\n return (JURISDICTION_CONTAINMENT[reach] ?? []).some(\n (member) => member === declared \|\| declared.startsWith(`${member}-`),\n );\n}\n"]}

package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;kBAGpG,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;;IAG1G;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;OAMG;;IAEH;;;;;;OAMG;;kBAgBH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QAzKH,oGAAoG;;;;IA2KpG;;;;;;OAMG;;QAzKH,0GAA0G;;;QAG1G;;;WAGG;;;IAqKH;;;;;;OAMG;;QAzHH;;;;;;WAMG;;QAEH;;;;;;WAMG;;;kBAiIH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAQ3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}
1	+ {"version":3,"file":"operator-compliance-identity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/operator-compliance-identity.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,oBAAY,WAAW;IACrB,gGAAgG;IAChG,OAAO,YAAY;IACnB,iGAAiG;IACjG,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,4FAA4F;IAC5F,eAAe,oBAAoB;IACnC,wFAAwF;IACxF,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,6GAA6G;AAC7G,oBAAY,sBAAsB;IAChC,sDAAsD;IACtD,UAAU,eAAe;IACzB,mHAAmH;IACnH,SAAS,cAAc;IACvB,oHAAoH;IACpH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B;IACvC,oGAAoG;;;kBAGpG,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,0GAA0G;;;IAG1G;;;OAGG;;kBAgBH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;OAMG;;IAEH;;;;;;OAMG;;kBAgBH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,2CAA2C;IACtD,2HAA2H;;IAE3H,qGAAqG;;IAErG;;;;;OAKG;;IAEH;;;;;;OAMG;;;;;IAKH;;;;OAIG;;QAzKH,oGAAoG;;;;IA2KpG;;;;;;OAMG;;QAzKH,0GAA0G;;;QAG1G;;;WAGG;;;IAqKH;;;;;;OAMG;;QAzHH;;;;;;WAMG;;QAEH;;;;;;WAMG;;;kBAiIH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAGhH;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC,iBAAiB,oBAAoB;IACrC,kBAAkB,sBAAsB;IACxC,eAAe,mBAAmB;IAClC,gBAAgB,oBAAoB;IACpC,YAAY,gBAAgB;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,qCAAqC,GAAG,SAAS,GAC1D,SAAS,8BAA8B,EAAE,CAQ3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,SAAS,WAAW,EAAE,GAAG,SAAS,CAKvH;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,GAAG,SAAS,CAGxH"}

package/dist/esm/compliance/privacy/personal-data-category.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}
1	+ {"version":3,"file":"personal-data-category.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-category.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,oBAAY,oBAAoB;IAC9B,mFAAmF;IACnF,QAAQ,aAAa;IACrB,kFAAkF;IAClF,eAAe,oBAAoB;IACnC;;;;;;OAMG;IACH,WAAW,gBAAgB;IAC3B,wFAAwF;IACxF,SAAS,cAAc;IACvB,mGAAmG;IACnG,KAAK,UAAU;IACf,qFAAqF;IACrF,QAAQ,aAAa;IACrB;;;;;;;OAOG;IACH,YAAY,iBAAiB;IAC7B,iGAAiG;IACjG,YAAY,iBAAiB;IAI7B,0CAA0C;IAC1C,wCAAwC,6CAA6C;IACrF,qCAAqC;IACrC,mCAAmC,wCAAwC;IAC3E,qDAAqD;IACrD,mDAAmD,wDAAwD;IAC3G,yCAAyC;IACzC,uCAAuC,4CAA4C;IACnF,+BAA+B;IAC/B,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD,yCAAyC;IACzC,uBAAuB,4BAA4B;IACnD,oFAAoF;IACpF,+CAA+C,oDAAoD;IAEnG;;;;;;OAMG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,oBAAoB,CAAgC,CAAC;AAE/G;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,oBAAoB,CAEvF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAErF;AACD,4DAA4D;AAE5D,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAG5F;AAED;;;;GAIG;AACH,oBAAY,sBAAsB;IAChC,8CAA8C;IAC9C,QAAQ,aAAa;IACrB,6GAA6G;IAC7G,iBAAiB,sBAAsB;IACvC,gGAAgG;IAChG,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,sBAAsB,2BAA2B;CAClD;AAED,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAED,2FAA2F;AAC3F,MAAM,WAAW,mCAAmC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACtD;AAID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,EAAE,CAEtH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,OAAO,GAAG,mCAAmC,CA6C9G"}

package/dist/esm/compliance/privacy/personal-data-declaration.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}
1	+ {"version":3,"file":"personal-data-declaration.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/personal-data-declaration.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAGtJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6GAA6G;AAC7G,wBAAgB,uCAAuC,CAAC,aAAa,EAAE,8BAA8B,GAAG,OAAO,CAK9G;AAED,iGAAiG;AACjG,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wDAAwD,CAAC,MAAM,EAAE;IAC/E,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD,GAAG,SAAS,8BAA8B,EAAE,CAgB5C;AAED,gIAAgI;AAChI,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,8BAA8B,GAAG,8BAA8B,CAE9H"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY,CAAE,0BAA0B;IAC/C,QAAQ,aAAa,CAAE,2BAA2B;IAClD,QAAQ,aAAa;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AACD,0EAA0E;AAE1E,eAAO,MAAM,0BAA0B;;iBAKrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;iBAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAuB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
1	+ {"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,oBAAY,YAAY;IACtB,OAAO,YAAY,CAAE,0BAA0B;IAC/C,QAAQ,aAAa,CAAE,2BAA2B;IAClD,QAAQ,aAAa;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AACD,0EAA0E;AAE1E,eAAO,MAAM,0BAA0B;;iBAKrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;iBAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAuB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,wCAAe,CAAA;IACf,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,sCAAa,CAAA;AACf,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,6LAA6L,CAC9L;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,gLAAgL,CACjL;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,2FAA2F;IAC3F,EAAE;IACF,yFAAyF;IACzF,4FAA4F;IAC5F,yFAAyF;IACzF,6EAA6E;IAC7E,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,4SAA4S,CAC7S;SACA,eAAe,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;SAC9D,QAAQ,CAAC,4JAA4J,CAAC;SACtK,eAAe,EAAE;CACrB,CAAC,CAAC","sourcesContent":["/*\n Privacy Shared Schemas\n \n Privacy-related schemas and enums for user data management\n /\n\nimport { z } from \"zod\";\n\n/\n Profile Visibility Enum\n \n Controls who can see a user's profile information\n /\nexport enum UserProfileVisibility {\n PUBLIC = \"public\", // Visible to everyone\n APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n ORGANIZATION = \"organization\", // Visible within organization only\n PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n PUBLIC = \"public\", // Visible to everyone\n APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum DataProcessingConsent {\n NONE = \"none\",\n BASIC = \"basic\",\n ANALYTICS = \"analytics\",\n MARKETING = \"marketing\",\n FULL = \"full\",\n}\n\nexport enum PrivacyLevel {\n MINIMAL = \"minimal\", // Minimum data collection\n STANDARD = \"standard\", // Standard data collection\n ENHANCED = \"enhanced\", // Enhanced features with more data\n}\n\n/\n Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n \n A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n \n This is a closed vocabulary with the OFF state inside it, on purpose. Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n \n Why the framework refuses to choose for you (Fork D / SD9). Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and duration is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n \n Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n /\n/\n @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n \n Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n \n It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n \n `DISABLED` is the default, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n /\nexport enum ClientInstanceIdScope {\n /\n DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n * client cannot start populating a pseudonymous identifier in an application's retained audit\n * trail without that application ever opting in).\n /\n DISABLED = \"disabled\",\n /\n Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n * correlating one session's activity; the easiest to justify as strictly necessary.\n /\n SESSION = \"session\",\n /\n Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n * account switch. The strongest investigative signal (it links pre- and post-authentication\n * activity, and two accounts used from one machine) and correspondingly the most likely to require\n * consent. Select only with a recorded legitimate-interest assessment and, where required,\n * consent-gating.\n /\n PERSISTENT = \"persistent\",\n}\n/* @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\nexport const AnonymousUserPrivacySchema = z.object({\n dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n .describe(\n 'The processing this anonymous visitor has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n ),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n .describe(\n 'The processing this lead has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n ),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.\n //\n // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the\n // collection scope — held as closed vocabularies, so recording their before/after values on\n // `resource_operation_performed` is exactly the \"mark what decides authority, never what\n // identifies a person\" rule that governs the same decorator on `UserSchema`.\n //\n // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n // interactions are separate immutable release-bound records and are never embedded in preferences.\n //\n // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n // decision and must leave a trail naming the previous and resulting value. Reached today by the\n // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the\n // same emission point, so no verb can change consent without a record.\n dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n .describe(\n 'The processing this person has agreed to. It is the subject\\'s own decision and only they (or an administrator acting for them) change it. The application decides what each level permits — the framework stores the decision and records every change, it does not attach a fixed meaning to the levels.',\n )\n .isAuditEvidence(),\n privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD)\n .describe('How much this person has agreed the application may collect about them, alongside the processing consent. The application decides what each level permits.')\n .isAuditEvidence(),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}
1	+ {"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,sCAAa,CAAA;IACb,wCAAe,CAAA;IACf,gDAAuB,CAAA;IACvB,gDAAuB,CAAA;IACvB,sCAAa,CAAA;AACf,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,qCAAqB,CAAA;IACrB,qCAAqB,CAAA;AACvB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,6LAA6L,CAC9L;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,gLAAgL,CACjL;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,2FAA2F;IAC3F,EAAE;IACF,yFAAyF;IACzF,4FAA4F;IAC5F,yFAAyF;IACzF,6EAA6E;IAC7E,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,uEAAuE;IACvE,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC;SACtF,QAAQ,CACP,4SAA4S,CAC7S;SACA,eAAe,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;SAC9D,QAAQ,CAAC,4JAA4J,CAAC;SACtK,eAAe,EAAE;CACrB,CAAC,CAAC","sourcesContent":["/*\n Privacy Shared Schemas\n \n Privacy-related schemas and enums for user data management\n /\n\nimport { z } from \"zod\";\n\n/\n Profile Visibility Enum\n \n Controls who can see a user's profile information\n /\nexport enum UserProfileVisibility {\n PUBLIC = \"public\", // Visible to everyone\n APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n ORGANIZATION = \"organization\", // Visible within organization only\n PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n PUBLIC = \"public\", // Visible to everyone\n APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum DataProcessingConsent {\n NONE = \"none\",\n BASIC = \"basic\",\n ANALYTICS = \"analytics\",\n MARKETING = \"marketing\",\n FULL = \"full\",\n}\n\nexport enum PrivacyLevel {\n MINIMAL = \"minimal\", // Minimum data collection\n STANDARD = \"standard\", // Standard data collection\n ENHANCED = \"enhanced\", // Enhanced features with more data\n}\n\n/\n Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n \n A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n \n This is a closed vocabulary with the OFF state inside it, on purpose. Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n \n Why the framework refuses to choose for you (Fork D / SD9). Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and duration is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n \n Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n /\n/\n @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n \n Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n \n It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n \n `DISABLED` is the default, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n /\nexport enum ClientInstanceIdScope {\n /\n DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n * client cannot start populating a pseudonymous identifier in an application's retained audit\n * trail without that application ever opting in).\n /\n DISABLED = \"disabled\",\n /\n Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n * correlating one session's activity; the easiest to justify as strictly necessary.\n /\n SESSION = \"session\",\n /\n Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n * account switch. The strongest investigative signal (it links pre- and post-authentication\n * activity, and two accounts used from one machine) and correspondingly the most likely to require\n * consent. Select only with a recorded legitimate-interest assessment and, where required,\n * consent-gating.\n /\n PERSISTENT = \"persistent\",\n}\n/* @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\nexport const AnonymousUserPrivacySchema = z.object({\n dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n .describe(\n 'The processing this anonymous visitor has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n ),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n .describe(\n 'The processing this lead has agreed to. The application decides what each level permits — the framework stores the decision, it does not attach a fixed meaning to the levels.',\n ),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n // `.isAuditEvidence()` on these two, and deliberately NOT on the block that contains them.\n //\n // Both are the subject's own privacy DECISIONS — the lawful basis for processing and the\n // collection scope — held as closed vocabularies, so recording their before/after values on\n // `resource_operation_performed` is exactly the \"mark what decides authority, never what\n // identifies a person\" rule that governs the same decorator on `UserSchema`.\n //\n // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n // interactions are separate immutable release-bound records and are never embedded in preferences.\n //\n // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n // decision and must leave a trail naming the previous and resulting value. Reached today by the\n // preferences RESET, the generic UPDATE, and `update_privacy`, all of which route through the\n // same emission point, so no verb can change consent without a record.\n dataProcessingConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.BASIC)\n .describe(\n 'The processing this person has agreed to. It is the subject\\'s own decision and only they (or an administrator acting for them) change it. The application decides what each level permits — the framework stores the decision and records every change, it does not attach a fixed meaning to the levels.',\n )\n .isAuditEvidence(),\n privacyLevel: z.enum(PrivacyLevel).default(PrivacyLevel.STANDARD)\n .describe('How much this person has agreed the application may collect about them, alongside the processing consent. The application decides what each level permits.')\n .isAuditEvidence(),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
1	+ {"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/redaction.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/\n MAINTAINER NOTE — not part of the anchored, application-facing block below.\n \n One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n \n Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n /\n\n/\n @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n \n How one field's value is replaced when it is redacted or scrubbed.\n \n Imported from `@wildo-ai/saas-models`.\n \n ## Two consumers, and only one of them accepts every member\n \n \| consumer \| what it does \| accepts \|\n * \|---\|---\|---\|\n * \| flow-actors `redactionRules` \| hides a value in a LOG or an API RESPONSE; the stored row is untouched \| every member \|\n * \| `.impersonalizeWith(...)` on a schema field \| ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained \| `REMOVE` · `MASK` · `RESET` · `KEEP` only \|\n \n `HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time. An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n \n ## Choosing a treatment for an erasure scrub\n \n \| the field \| treatment \|\n * \|---\|---\|\n * \| nullable, or `.nullish()` \| `REMOVE` — writes `null`. The default choice. \|\n * \| a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) \| `MASK` with an explicit `maskValue` that satisfies the field's own schema \|\n * \| NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array \| `RESET` — writes what the schema says the field is when nobody has set it \|\n * \| the row's link to its tenant or its creator \| nothing: the never-scrub floor already protects it \|\n \n `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n \n ⚠️ `RESET` refuses a default that reads the clock. `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n \n ## The never-scrub floor\n \n A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n \n A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n \n @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n \n const contactSchema = z.object({\n * // nullable → REMOVE\n * phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n * // constrained string → MASK with a value the field's own schema accepts\n * email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n * // non-nullable with a default → RESET\n * preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n * .impersonalizeWith(RedactionType.RESET),\n * // no treatment → survives the erasure, deliberately\n * invoicedAmount: z.number(),\n * });\n * ```\n /\nexport enum RedactionType {\n /* Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. /\n MASK = 'mask',\n /* Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. /\n REMOVE = 'remove',\n /* Replace with a one-way hash. Redaction only — throws if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. /\n HASH = 'hash',\n /* Replace with a reversible ciphertext. Redaction only — forbidden for an erasure scrub, because a reversible erasure is not an erasure. /\n ENCRYPT = 'encrypt',\n /* Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. /\n KEEP = 'keep',\n /\n Erasure scrub only: reset the field to its OWN schema default.\n \n The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n * and objects.\n \n The value is read from the schema rather than authored a second time, so it cannot drift from\n * the default the field already declares — and for a person's counters and settings, \"what this is\n * when nobody has set it\" is exactly what an erasure should leave behind.\n \n Refused when the field declares no `.default()`, and refused when that default reads the clock.\n /\n RESET = 'reset',\n}\n/* @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n fieldPath: z.string(),\n isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n redactionType: z.enum(RedactionType),\n forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}
1	+ {"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/\n MAINTAINER NOTE — not part of the anchored, application-facing block below.\n \n One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n \n Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n /\n\n/\n @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n \n How one field's value is replaced when it is redacted or scrubbed.\n \n Imported from `@wildo-ai/saas-models`.\n \n ## Two consumers, and only one of them accepts every member\n \n \| consumer \| what it does \| accepts \|\n * \|---\|---\|---\|\n * \| flow-actors `redactionRules` \| hides a value in a LOG or an API RESPONSE; the stored row is untouched \| every member \|\n * \| `.impersonalizeWith(...)` on a schema field \| ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained \| `REMOVE` · `MASK` · `RESET` · `KEEP` only \|\n \n `HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time. An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n \n ## Choosing a treatment for an erasure scrub\n \n \| the field \| treatment \|\n * \|---\|---\|\n * \| nullable, or `.nullish()` \| `REMOVE` — writes `null`. The default choice. \|\n * \| a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) \| `MASK` with an explicit `maskValue` that satisfies the field's own schema \|\n * \| NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array \| `RESET` — writes what the schema says the field is when nobody has set it \|\n * \| the row's link to its tenant or its creator \| nothing: the never-scrub floor already protects it \|\n \n `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n \n ⚠️ `RESET` refuses a default that reads the clock. `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n \n ## The never-scrub floor\n \n A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n \n A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n \n @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n \n const contactSchema = z.object({\n * // nullable → REMOVE\n * phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n * // constrained string → MASK with a value the field's own schema accepts\n * email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n * // non-nullable with a default → RESET\n * preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n * .impersonalizeWith(RedactionType.RESET),\n * // no treatment → survives the erasure, deliberately\n * invoicedAmount: z.number(),\n * });\n * ```\n /\nexport enum RedactionType {\n /* Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. /\n MASK = 'mask',\n /* Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. /\n REMOVE = 'remove',\n /* Replace with a one-way hash. Redaction only — throws if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. /\n HASH = 'hash',\n /* Replace with a reversible ciphertext. Redaction only — forbidden for an erasure scrub, because a reversible erasure is not an erasure. /\n ENCRYPT = 'encrypt',\n /* Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. /\n KEEP = 'keep',\n /\n Erasure scrub only: reset the field to its OWN schema default.\n \n The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n * and objects.\n \n The value is read from the schema rather than authored a second time, so it cannot drift from\n * the default the field already declares — and for a person's counters and settings, \"what this is\n * when nobody has set it\" is exactly what an erasure should leave behind.\n \n Refused when the field declares no `.default()`, and refused when that default reads the clock.\n /\n RESET = 'reset',\n}\n/* @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n fieldPath: z.string(),\n isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n redactionType: z.enum(RedactionType),\n forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}
1	+ {"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}

package/dist/esm/compliance/privacy/subject-erasure.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"subject-erasure.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,MAAM,WAAW;IAEjB;;;;OAIG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;OAKG;IACH,SAAS,cAAc;IAEvB;;;;;OAKG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,0DAA0D;IAC1D,iBAAiB,EAAE,YAAY,CAAC;IAChC,2DAA2D;IAC3D,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAQD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,oBAAoB,GACjC,gCAAgC,CA0FlC;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,gCAAgC;IACjF;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kCAAkC;IAC5C,sEAAsE;IACtE,SAAS,cAAc;IACvB;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,YAAY;IACnB,mGAAmG;IACnG,MAAM,WAAW;IACjB;;;OAGG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;CACtD;AAED,gGAAgG;AAChG,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAOT;AAED,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kCAAkC,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,mBAAmB,EAAE,YAAY,CAAC;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE;QAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,eAAe,EAAE,mCAAmC,EAAE,CAAC;CACxD"}
1	+ {"version":3,"file":"subject-erasure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,MAAM,WAAW;IAEjB;;;;OAIG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;OAKG;IACH,SAAS,cAAc;IAEvB;;;;;OAKG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,0DAA0D;IAC1D,iBAAiB,EAAE,YAAY,CAAC;IAChC,2DAA2D;IAC3D,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAQD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,oBAAoB,GACjC,gCAAgC,CA0FlC;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,gCAAgC;IACjF;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kCAAkC;IAC5C,sEAAsE;IACtE,SAAS,cAAc;IACvB;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,YAAY;IACnB,mGAAmG;IACnG,MAAM,WAAW;IACjB;;;OAGG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;CACtD;AAED,gGAAgG;AAChG,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAOT;AAED,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kCAAkC,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,mBAAmB,EAAE,YAAY,CAAC;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE;QAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,eAAe,EAAE,mCAAmC,EAAE,CAAC;CACxD"}

package/dist/esm/compliance/privacy/subject-export-render.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"subject-export-render.shared.utils.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EAGpB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,oBAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,IAAI,SAAS;IAEb;;;;OAIG;IACH,GAAG,QAAQ;CACZ;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACpC;AAkED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,6BAA6B,CAmC/B"}
1	+ {"version":3,"file":"subject-export-render.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EAGpB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,oBAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,IAAI,SAAS;IAEb;;;;OAIG;IACH,GAAG,QAAQ;CACZ;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACpC;AAkED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,6BAA6B,CAmC/B"}

package/dist/esm/compliance/privacy/subject-export.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"subject-export.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAItF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,aAAa,kBAAkB;IAE/B;;;;OAIG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,yBAAyB;IACnC;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;OAIG;IACH,QAAQ,aAAa;IAErB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oBAAY,4BAA4B;IACtC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,2BAA2B,gCAAgC;IAE3D;;;;OAIG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;OAOG;IACH,6BAA6B,kCAAkC;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,4EAA4E;AAC5E,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAGT;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,wDAAwD;IACxD,mBAAmB,EAAE,YAAY,CAAC;IAClC,0DAA0D;IAC1D,WAAW,EAAE,4BAA4B,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,oBAAoB,GAC5B,+BAA+B,CAmEjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,iFAAiF;AACjF,MAAM,WAAW,kCAAkC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4CAA4C,CAC1D,mBAAmB,EAAE,YAAY,EACjC,aAAa,EAAE,gCAAgC,EAC/C,OAAO,EAAE,oBAAoB,GAC5B,kCAAkC,EAAE,CA8BtC;AAED,kGAAkG;AAClG,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,kCAAkC,GAAG,MAAM,CAW3G;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,gDAAgD;IAChD,QAAQ,aAAa;IAErB;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,eAAe;CAC1B;AAED,uFAAuF;AACvF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,yBAAyB,GAAG,SAAS,EACjD,OAAO,EAAE,oBAAoB,GAC5B,uBAAuB,CAqBzB;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAWnF;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0CAA0C,CACxD,WAAW,EAAE,CAAC,CAAC,UAAU,EACzB,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,EAChE,YAAY,EAAE,MAAM,GACnB,yBAAyB,GAAG,SAAS,CAiBvC;AAED,2EAA2E;AAC3E,oBAAY,+BAA+B;IACzC,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,wBAAwB,6BAA6B;IACrD,UAAU,eAAe;IACzB,WAAW,gBAAgB;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;CACjD;AAID;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASnH;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,GAAG,0BAA0B,EAAE,CAmD/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,mBAAmB,EAAE,YAAY,CAAC;IAClC,iCAAiC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACzC,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACtC"}
1	+ {"version":3,"file":"subject-export.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAItF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,aAAa,kBAAkB;IAE/B;;;;OAIG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,yBAAyB;IACnC;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;OAIG;IACH,QAAQ,aAAa;IAErB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oBAAY,4BAA4B;IACtC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,2BAA2B,gCAAgC;IAE3D;;;;OAIG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;OAOG;IACH,6BAA6B,kCAAkC;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,4EAA4E;AAC5E,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAGT;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,wDAAwD;IACxD,mBAAmB,EAAE,YAAY,CAAC;IAClC,0DAA0D;IAC1D,WAAW,EAAE,4BAA4B,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,oBAAoB,GAC5B,+BAA+B,CAmEjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,iFAAiF;AACjF,MAAM,WAAW,kCAAkC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4CAA4C,CAC1D,mBAAmB,EAAE,YAAY,EACjC,aAAa,EAAE,gCAAgC,EAC/C,OAAO,EAAE,oBAAoB,GAC5B,kCAAkC,EAAE,CA8BtC;AAED,kGAAkG;AAClG,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,kCAAkC,GAAG,MAAM,CAW3G;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,gDAAgD;IAChD,QAAQ,aAAa;IAErB;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,eAAe;CAC1B;AAED,uFAAuF;AACvF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,yBAAyB,GAAG,SAAS,EACjD,OAAO,EAAE,oBAAoB,GAC5B,uBAAuB,CAqBzB;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAWnF;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0CAA0C,CACxD,WAAW,EAAE,CAAC,CAAC,UAAU,EACzB,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,EAChE,YAAY,EAAE,MAAM,GACnB,yBAAyB,GAAG,SAAS,CAiBvC;AAED,2EAA2E;AAC3E,oBAAY,+BAA+B;IACzC,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,wBAAwB,6BAA6B;IACrD,UAAU,eAAe;IACzB,WAAW,gBAAgB;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;CACjD;AAID;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASnH;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,GAAG,0BAA0B,EAAE,CAmD/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,mBAAmB,EAAE,YAAY,CAAC;IAClC,iCAAiC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACzC,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACtC"}

package/dist/esm/compliance/privacy/subject-export.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"subject-export.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAG/E,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,uDAA+B,CAAA;IAE/B;;;;OAIG;IACH,iEAAyC,CAAA;AAC3C,CAAC,EAdW,oBAAoB,KAApB,oBAAoB,QAc/B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,yBAqBX;AArBD,WAAY,yBAAyB;IACnC;;;OAGG;IACH,kEAAqC,CAAA;IAErC;;;;OAIG;IACH,kDAAqB,CAAA;IAErB;;;;;OAKG;IACH,gDAAmB,CAAA;AACrB,CAAC,EArBW,yBAAyB,KAAzB,yBAAyB,QAqBpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAN,IAAY,4BAuDX;AAvDD,WAAY,4BAA4B;IACtC;;;;OAIG;IACH,iEAAiC,CAAA;IAEjC;;;;;;;;;OASG;IACH,2FAA2D,CAAA;IAE3D;;;;OAIG;IACH,uFAAuD,CAAA;IAEvD;;;;;;;OAOG;IACH,+FAA+D,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,qFAAqD,CAAA;AACvD,CAAC,EAvDW,4BAA4B,KAA5B,4BAA4B,QAuDvC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sCAAsC,CACpD,WAAyC;IAEzC,OAAO,WAAW,KAAK,4BAA4B,CAAC,cAAc;WAC7D,WAAW,KAAK,4BAA4B,CAAC,2BAA2B,CAAC;AAChF,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,YAAkC,EAClC,OAA6B;IAE7B,MAAM,mBAAmB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACvE,MAAM,QAAQ,GAAG,CACf,WAAyC,EACzC,MAAc,EACmB,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAErF,6FAA6F;IAC7F,2CAA2C;IAC3C,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,4BAA4B,CAAC,cAAc,EAC3C,2FAA2F;cACvF,mCAAmC,CACxC,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACjG,MAAM,wBAAwB,GAAG,gBAAgB,KAAK,YAAY,CAAC,aAAa,CAAC;IAEjF,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,0BAA0B,cAAc,qDAAqD;cACzF,sFAAsF,CAC3F,CAAC;IACJ,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,2BAA2B,EACxD,0BAA0B,cAAc,8CAA8C;kBAClF,qFAAqF;kBACrF,sCAAsC,CAC3C,CAAC;QAEJ,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,QAAQ,CACb,4BAA4B,CAAC,6BAA6B,EAC1D,0BAA0B,cAAc,8CAA8C;kBAClF,sFAAsF;kBACtF,gFAAgF,CACrF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,wFAAwF;YACxF,yEAAyE;YACzE,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,iEAAiE;kBAC7D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAuBD;;;;;;;;GAQG;AACH,MAAM,UAAU,4CAA4C,CAC1D,mBAAiC,EACjC,aAA+C,EAC/C,OAA6B;IAE7B,MAAM,qBAAqB,GAAG;QAC5B,GAAG,aAAa,CAAC,kBAAkB;QACnC,GAAG,aAAa,CAAC,mBAAmB;QACpC,GAAG,aAAa,CAAC,iBAAiB;KACnC,CAAC;IACF,OAAO,qBAAqB;SACzB,GAAG,CAAC,CAAC,YAAY,EAAsC,EAAE;QACxD,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,CAAC,mBAAmB,CAAC,2BAA2B;kBAC/F,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,sBAAsB,GAAG,YAAY,CAAC,aAAa,KAAK,mBAAmB;YAC/E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,GAAG,YAAY;gBACf,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,YAAY,EAAE,YAAY,CAAC,YAAY;aACxC,CAAC;QACN,OAAO;YACL,YAAY;YACZ,sBAAsB;YACtB,cAAc,EAAE,gCAAgC,CAAC,sBAAsB,EAAE,OAAO,CAAC;SAClF,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE,qCAAqC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5I,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qCAAqC,CAAC,SAA6C;IACjG,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC;IACtD,OAAO;QACL,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,MAAM;QACnB,YAAY,CAAC,eAAe,IAAI,EAAE;QAClC,SAAS,CAAC,cAAc,CAAC,WAAW;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC,gDAAgD;IAChD,gDAAqB,CAAA;IAErB;;;OAGG;IACH,gEAAqC,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,oDAAyB,CAAA;AAC3B,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AAED,uFAAuF;AACvF,MAAM,UAAU,iCAAiC,CAAC,KAA8B;IAC9E,OAAO,KAAK,KAAK,uBAAuB,CAAC,UAAU,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAiD,EACjD,OAA6B;IAE7B,QAAQ,OAAO,EAAE,CAAC;QAChB,gGAAgG;QAChG,iFAAiF;QACjF,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,uFAAuF;YACvF,iDAAiD;YACjD,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,+DAA+D;kBAC3D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CACnC,UAAiD;IAEjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,uBAAuB,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,QAAQ,UAAU,EAAE,CAAC;QACnB,+FAA+F;QAC/F,+FAA+F;QAC/F,kBAAkB;QAClB,KAAK,yBAAyB,CAAC,gBAAgB,CAAC;QAChD,KAAK,yBAAyB,CAAC,QAAQ;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,yBAAyB,CAAC,OAAO;YACpC,OAAO,uBAAuB,CAAC,gBAAgB,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,MAAM,0BAA0B,GAAU,UAAU,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,yDAAyD;kBACrD,IAAI,MAAM,CAAC,0BAA0B,CAAC,GAAG,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAyB;IACxE,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,yFAAyF;IACzF,8DAA8D;IAC9D,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,sGAAsG;AACtG,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0CAA0C,CACxD,WAAyB,EACzB,yBAAgE,EAChE,YAAoB;IAEpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,IAAI,YAAY,4BAA4B,QAAQ,wCAAwC;cACxF,2BAA2B,CAAC,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;cAC5F,uFAAuF;cACvF,+CAA+C,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,QAAqC,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,0EAAuC,CAAA;IACvC,wEAAqC,CAAA;IACrC,wFAAqD,CAAA;IACrD,4DAAyB,CAAA;IACzB,8DAA2B,CAAA;AAC7B,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAWD,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,MAAe;IAC5E,IAAI,OAAO,GAAQ,MAAM,CAAC;IAC1B,KAAK,IAAI,WAAW,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,GAAG,8BAA8B,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC;QACpG,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,KAAgC,CAAC;QACxG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,MAAM,SAAS,GAAG,8CAA8C,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAiC,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,aAAqB,EAAE,KAAa,EAAQ,EAAE;QAC3F,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,SAAS,EAAE,CAAC;YAChD,IAAI,KAAK,IAAI,8BAA8B,EAAE,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,uBAAuB,CAAC,UAAU;oBACzC,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,WAAW;iBACnD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,gCAAgC,CAAC,WAA2B,CAAC,EAAE,CAAC;gBAClE,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,wBAAwB;iBAChE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,8CAA8C,CAAC,WAAW,CAAC,CAAC;YAChF,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAA2B,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,0CAA0C,CAAC,WAA2B,EAAE,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAC7H,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;gBAChE,UAAU,EAAE,UAAU,IAAI,IAAI;gBAC9B,KAAK,EAAE,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,+BAA+B,CAAC,iBAAiB;oBACnD,CAAC,CAAC,UAAU,KAAK,SAAS;wBACxB,CAAC,CAAC,+BAA+B,CAAC,gBAAgB;wBAClD,CAAC,CAAC,+BAA+B,CAAC,UAAU;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import type { z } from 'zod';\nimport { getPortabilityProvenance } from '@wildo-ai/zod-decorators';\nimport { isNonDisclosableFieldValue } from '../../resources/utils/field-value-disclosure.utils';\nimport {\n RelationshipLifecycleModel,\n type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\n\nconst compareCanonicalText = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\n\n/*\n WHICH data-subject right an export is answering.\n \n ## Why this is an enum and not a boolean flag on one bundle\n \n GDPR Art. 15 (right of access) and Art. 20 (right to data portability) are DIFFERENT rights over\n * DIFFERENT data, and conflating them is the defect this capability was built to correct: the four\n * routed export operations removed on 2026-08-01 declared themselves \"portability / GDPR\" while\n * their actual options (`includeActivityData`, `includeOrganizationData`) described an access\n * bundle. One output with a flag would reproduce that merge.\n \n - Access is a disclosure obligation: everything the controller holds concerning the subject,\n * including data the controller itself derived about them, in any readable form.\n * - Portability is a transfer obligation: only the data the subject provided — actively, or by\n * using the service — and it must be machine-readable and re-importable elsewhere. Data the\n * controller inferred is deliberately OUT of scope; a competitor must not receive a rival's\n * analytics through a subject's portability request.\n \n The two therefore diverge at BOTH levels this module classifies: per-edge (see\n * {@link classifySubjectExportDisposition}) and per-field (see\n * {@link resolveSubjectExportFieldScope}).\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\nexport enum SubjectExportPurpose {\n /\n Art. 15 — right of access. The broadest bundle: every row concerning the subject, whoever\n * produced it, including rows the subject does not own (an audit log about them, a membership an\n * administrator created).\n /\n ACCESS_ART_15 = 'access_art_15',\n\n /\n Art. 20 — right to data portability. Narrower on purpose: only data the subject supplied or\n * generated by using the service, and only from rows the subject owns. Controller-derived data is\n * excluded by {@link DataPortabilityProvenance.DERIVED}.\n /\n PORTABILITY_ART_20 = 'portability_art_20',\n}\n\n/\n WHERE one field's value came from — the axis that decides Art. 20 scope.\n \n ## Why three values and not `isSubjectProvided: boolean`\n \n EDPB/WP29 guidance splits \"provided by the data subject\" into data supplied knowingly and data\n * observed from the subject's use of the service, and puts BOTH in Art. 20 scope while excluding\n * data the controller inferred. A boolean forces `OBSERVED` to be mis-filed against whichever\n * side the author guesses — and it is the member most often got wrong, because \"the user did not\n * type it\" reads as \"the user did not provide it\", which is precisely the wrong conclusion.\n \n ## Why this is per-FIELD and not per-resource\n \n A single row routinely mixes the two: a user profile holds `firstName` (supplied) beside a\n * controller-computed status or score. A resource-level answer would have to round one way for the\n * whole row. The resource-level declaration exists only as a DEFAULT\n * (`portabilityPolicy.defaultProvenance`) so that annotating a resource stays a one-line cost; the\n * per-field decorator overrides it where a field differs.\n \n ⚠️ NOT a redaction or scrub concept. This says where a value CAME FROM, for a disclosure\n * decision. What happens to a value on ERASURE is `.impersonalizeWith()` / `RedactionType`, a\n * different axis entirely — a field can be `SUBJECT_PROVIDED` and also masked on erasure.\n /\nexport enum DataPortabilityProvenance {\n /\n The subject actively and knowingly supplied this value — form input, an uploaded file, a\n * setting they chose. Unambiguously in scope for both rights.\n /\n SUBJECT_PROVIDED = 'subject_provided',\n\n /\n Generated by the subject's USE of the service rather than typed by them — activity timestamps,\n * event history, usage counters, telemetry. In scope for Art. 20, which is the whole reason\n * this member exists separately from {@link DERIVED}.\n /\n OBSERVED = 'observed',\n\n /\n Produced BY the controller about the subject — inferred classifications, computed scores,\n * risk or segmentation labels, server-assigned lifecycle state. Disclosed under Art. 15 (the\n * subject may see what we concluded about them) but excluded from Art. 20 (a portability\n * request is not a channel for exporting the controller's own analysis).\n /\n DERIVED = 'derived',\n}\n\n/\n What an export does with ONE child-direction edge of the subject.\n \n ## Why this is NOT `SubjectErasureDisposition`\n \n Erasure and export share a traversal and answer opposite questions — what do I destroy? versus\n * what must I disclose? — and they diverge on exactly the edges erasure calls `NOT_OWNED`.\n \n Erasure leaves audit logs, memberships and job executions alone, correctly: you do not delete an\n * audit log because a user exercised a right. But those same rows hold personal data CONCERNING the\n * subject, and Art. 15 covers \"all personal data concerning him or her\" — not \"rows he owns\".\n * Reusing erasure's vocabulary verbatim would have silently omitted the data an access request most\n * often targets. Hence {@link INCLUDED_REFERENCES_SUBJECT}, a case erasure has no use for.\n \n The two classifiers still read the SAME upstream authority for what an edge says\n * (`requireResolvedRelationshipSemantics`), so they can never disagree about ownership — only about\n * what to do with it.\n \n ## Why there is no blocking disposition here\n \n Erasure refuses up-front on `UNCLASSIFIED` / `UNSUPPORTED_DEFERRED` because it is about to\n * WRITE, cannot half-destroy a subject, and needs a teardown declaration nobody made. An export\n * writes nothing: ownership alone answers the edge question, a deferred teardown is irrelevant to a\n * read, and a cross-adapter dependent is merely a second query rather than a broken transaction.\n * The one genuine refusal in an export is field-level and Art. 20-only — see\n * {@link SubjectExportFieldScope.UNDECLARED}. Manufacturing an edge-level blocker for symmetry\n * would be false symmetry.\n /\nexport enum SubjectExportEdgeDisposition {\n /\n The subject OWNS this dependent (`lifecycleModelMode: DEPENDENT`), so its rows are the\n * subject's own data. Included for both purposes — for Art. 20 the per-field provenance filter\n * still applies to what comes back.\n /\n INCLUDED_OWNED = 'included_owned',\n\n /\n The subject does NOT own these rows, but they REFERENCE the subject — the far side carries a\n * foreign key back to them (an audit log, an organization membership, a job execution).\n \n Art. 15 only. These are personal data concerning the subject, so an access request must\n * disclose them. A portability request must not: the subject did not provide a row that a third\n * party or the controller created about them, and shipping them would export the controller's\n * operational records under a transfer right. For `PORTABILITY_ART_20` this same edge classifies\n * as {@link EXCLUDED_NOT_SUBJECT_PROVIDED}.\n /\n INCLUDED_REFERENCES_SUBJECT = 'included_references_subject',\n\n /\n The edge carries no personal data of the subject at all: an independent or link-only\n * relationship whose far side does not even reference them, or a disabled relationship that is\n * not part of the live graph. Out of scope for both rights.\n /\n EXCLUDED_NOT_SUBJECT_DATA = 'excluded_not_subject_data',\n\n /\n In scope for access, but excluded from THIS export because the export is a portability request\n * and the rows were not provided by the subject. Kept as its own member rather than collapsing\n * into {@link EXCLUDED_NOT_SUBJECT_DATA}: a reviewer asking \"why is my audit trail missing from\n * my portability export?\" needs \"because Art. 20 does not cover controller records\" and \"because\n * that edge holds nothing about you\" to be different answers, and only the first is a legal\n * position someone took.\n /\n EXCLUDED_NOT_SUBJECT_PROVIDED = 'excluded_not_subject_provided',\n\n /\n The rows ARE the subject's data and the right covers them, but the resource is declared\n * `systemAccessPolicy.exportSubject = FORBIDDEN` — someone decided it must never reach a data\n * subject (an authentication-credential store, a security audit trail).\n \n ## Why this excludes rather than refusing\n \n An UNDECLARED resource refuses the whole export, because nobody has decided yet and refusing is\n * what forces the decision. A FORBIDDEN one is the opposite: the decision exists, and refusing\n * would make it permanent sabotage — a `USERS` access export whose graph touches a credential\n * store could then NEVER run, no matter how many other resources opted in. Honouring the\n * declaration means leaving those rows out and saying so.\n \n ⚠️ This applies to EDGES only. A subject whose OWN resource is FORBIDDEN still refuses: there is\n * no export of a person whose identity row may not be disclosed, and silently returning an\n * edges-only bundle would be a disclosure that omits its own subject.\n /\n EXCLUDED_NOT_DISCLOSABLE = 'excluded_not_disclosable',\n}\n\n/* Whether an edge disposition puts the far side's rows INTO the bundle. /\nexport function isIncludedSubjectExportEdgeDisposition(\n disposition: SubjectExportEdgeDisposition,\n): boolean {\n return disposition === SubjectExportEdgeDisposition.INCLUDED_OWNED\n \|\| disposition === SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT;\n}\n\n/* The classification of ONE child-direction edge of an export subject. /\nexport interface SubjectExportEdgeClassification {\n /* The related resource on the far side of the edge. /\n relatedResourceType: ResourceType;\n /* Whether, and why, this edge's rows join the bundle. /\n disposition: SubjectExportEdgeDisposition;\n /\n Human-readable justification quoting the configuration that produced it. Surfaced in the export\n * report so a data-protection reviewer never has to re-derive WHY a resource was included or\n * left out — which, for a disclosure obligation, is the evidence that matters.\n /\n reason: string;\n}\n\n/\n Classify what an export must do with ONE child-direction edge — the disclose-vs-omit decision,\n * DERIVED FROM CONFIGURATION rather than a hardcoded list of resource types.\n \n ## Where the answer comes from\n \n Two declarations the author already makes, read through the same shared authorities the delete\n * cascade and the erasure orchestrator read, so the three can never disagree about what an edge is:\n \n 1. `handling.lifecycleModelMode` — does the subject own this related resource's lifecycle?\n * `DEPENDENT` means the rows are the subject's own data.\n * 2. Foreign-key topology (`resolveForeignKeyHolderResourceType`, cardinality-only and\n * therefore pure) — for a NON-owned edge, does the far side nonetheless carry a reference back\n * to the subject? If it does, its rows are about the subject and Art. 15 must disclose them.\n \n ## The `purpose` parameter, and why it is a parameter\n \n Art. 15 and Art. 20 diverge on exactly one edge case — the referencing-but-not-owned edge — and\n * keeping that divergence in ONE switch here is what stops two near-identical classifiers from\n * drifting apart. Exposing `classifyForAccess` / `classifyForPortability` would duplicate the\n * ownership logic, and the day someone fixes a bug in one they would miss the other.\n \n ## Caller contract\n \n `relationship.resourceType2` MUST be the far side and `resourceType1` the subject — the same\n * child-direction normalization {@link classifySubjectErasureDisposition} requires. The caller\n * filters to child-direction edges before classifying.\n \n Pure and side-effect free — no registry lookups, no I/O, no row reads — so it is equally usable\n * from a runtime orchestrator and from a boot-time coherence guard.\n /\nexport function classifySubjectExportDisposition(\n relationship: ResourceRelationship,\n purpose: SubjectExportPurpose,\n): SubjectExportEdgeClassification {\n const relatedResourceType = relationship.resourceType2 as ResourceType;\n const classify = (\n disposition: SubjectExportEdgeDisposition,\n reason: string,\n ): SubjectExportEdgeClassification => ({ relatedResourceType, disposition, reason });\n\n // A disabled relationship is not part of the live graph — the runtime never traverses it, so\n // there are no rows behind it to disclose.\n if (relationship.isDisabled === true) {\n return classify(\n SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n 'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n );\n }\n\n const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n if (lifecycleModel === RelationshipLifecycleModel.DEPENDENT) {\n return classify(\n SubjectExportEdgeDisposition.INCLUDED_OWNED,\n 'lifecycleModelMode is DEPENDENT: the subject owns these rows, so they are the subject\\'s '\n + 'own data and belong in the bundle',\n );\n }\n\n // NOT owned from here on. The rows still count as personal data if they POINT AT the subject —\n // which is the Art. 15 / Art. 20 fork.\n const foreignKeyHolder = Resources_SharedUtils.resolveForeignKeyHolderResourceType(relationship);\n const farSideReferencesSubject = foreignKeyHolder === relationship.resourceType2;\n\n if (!farSideReferencesSubject) {\n return classify(\n SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT) and the far side does not hold a `\n + 'foreign key to the subject, so these rows are neither owned by nor about the subject',\n );\n }\n\n switch (purpose) {\n case SubjectExportPurpose.ACCESS_ART_15:\n return classify(\n SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT,\n `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT), but the far side holds a `\n + 'foreign key to the subject, so these rows are personal data CONCERNING the subject '\n + 'and Art. 15 requires disclosing them',\n );\n\n case SubjectExportPurpose.PORTABILITY_ART_20:\n return classify(\n SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_PROVIDED,\n `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): these rows reference the `\n + 'subject but were created by the controller or a third party rather than provided by '\n + 'the subject, so Art. 20 does not cover them (they ARE disclosed under Art. 15)',\n );\n\n default: {\n // Compile-time exhaustiveness: a new SubjectExportPurpose without an arm here is a TYPE\n // error, not a silent runtime discovery on someone's disclosure request.\n const _exhaustivePurposeCheck: never = purpose;\n throw new Error(\n `classifySubjectExportDisposition has no arm for export purpose `\n + `'${String(_exhaustivePurposeCheck)}'`,\n );\n }\n }\n}\n\n/\n The three relationship buckets exposed by a compiled resource configuration.\n \n Kept structural here so the privacy compiler does not import resource configuration schemas:\n * those schemas already import this module for {@link DataPortabilityProvenance}.\n /\nexport interface SubjectExportRelationshipBuckets {\n readonly parentRelationships: readonly ResourceRelationship[];\n readonly childRelationships: readonly ResourceRelationship[];\n readonly selfRelationships: readonly ResourceRelationship[];\n}\n\n/* One graph edge normalized so the export subject is always `resourceType1`. /\nexport interface SubjectExportRelationshipTraversal {\n /* Original compiled relationship; runtime adapters use it to resolve the real FK field. /\n readonly relationship: ResourceRelationship;\n /* Direction-normalized relationship consumed by the shared legal-scope classifier. /\n readonly normalizedRelationship: ResourceRelationship;\n readonly classification: SubjectExportEdgeClassification;\n}\n\n/\n Enumerate every edge touching one export subject, including child-first reference declarations.\n \n Resource configurations deliberately preserve parent/child/self buckets. Subject disclosure is\n * different: personal data can point to the subject from either authored orientation. This helper\n * joins both directional buckets, includes self edges once, and swaps only the positional topology\n * needed by {@link classifySubjectExportDisposition}. It preserves the original compiled edge for\n * FK resolution and never collapses multiple foreign keys between the same resource pair.\n /\nexport function enumerateSubjectExportRelationshipTraversals(\n subjectResourceType: ResourceType,\n relationships: SubjectExportRelationshipBuckets,\n purpose: SubjectExportPurpose,\n): SubjectExportRelationshipTraversal[] {\n const touchingRelationships = [\n ...relationships.childRelationships,\n ...relationships.parentRelationships,\n ...relationships.selfRelationships,\n ];\n return touchingRelationships\n .map((relationship): SubjectExportRelationshipTraversal => {\n if (relationship.resourceType1 !== subjectResourceType && relationship.resourceType2 !== subjectResourceType) {\n throw new Error(\n `Subject-export relationship traversal for ${String(subjectResourceType)} received unrelated edge `\n + `${String(relationship.resourceType1)} -> ${String(relationship.resourceType2)}.`,\n );\n }\n const normalizedRelationship = relationship.resourceType1 === subjectResourceType\n ? relationship\n : {\n ...relationship,\n resourceType1: relationship.resourceType2,\n resourceType2: relationship.resourceType1,\n cardinality1: relationship.cardinality2,\n cardinality2: relationship.cardinality1,\n };\n return {\n relationship,\n normalizedRelationship,\n classification: classifySubjectExportDisposition(normalizedRelationship, purpose),\n };\n })\n .sort((left, right) => compareCanonicalText(subjectExportRelationshipTraversalKey(left), subjectExportRelationshipTraversalKey(right)));\n}\n\n/* Stable identity retaining distinct foreign keys between otherwise identical resource pairs. /\nexport function subjectExportRelationshipTraversalKey(traversal: SubjectExportRelationshipTraversal): string {\n const relationship = traversal.normalizedRelationship;\n return [\n relationship.resourceType1,\n relationship.resourceType2,\n relationship.cardinality1,\n relationship.cardinality2,\n relationship.nature,\n relationship.foreignKeyField ?? '',\n traversal.classification.disposition,\n ].join('\\0');\n}\n\n/\n Whether ONE field's value joins the bundle, for a given purpose.\n \n Separate from {@link SubjectExportEdgeDisposition} because the two answer different questions at\n * different granularities: an edge decides whether a RESOURCE's rows are in scope at all, a field\n * scope decides which COLUMNS of an in-scope row survive the Art. 20 narrowing.\n /\nexport enum SubjectExportFieldScope {\n /* The field's value belongs in this bundle. /\n INCLUDED = 'included',\n\n /\n Excluded because the value is controller-DERIVED and this is a portability request. Never\n * reached for `ACCESS_ART_15`, which discloses derived data.\n /\n EXCLUDED_DERIVED = 'excluded_derived',\n\n /\n ⛔ NO ANSWER — the field carries no provenance declaration and none is inherited from its\n * resource, while the export is a portability request that needs one.\n \n The export REFUSES rather than guessing, because both guesses are harmful and neither is the\n * conservative one: excluding an undeclared field UNDER-DELIVERS a legal right the subject is\n * owed, and including it OVER-SHARES data the controller derived. There is no safe default to\n * fall back on, which is exactly the condition that justifies failing loud — the same reasoning\n * that makes `SubjectErasureDisposition.UNCLASSIFIED` refuse an erasure.\n \n `ACCESS_ART_15` never produces this: access includes every field regardless of provenance, so\n * an application can serve access requests before annotating anything.\n /\n UNDECLARED = 'undeclared',\n}\n\n/* Whether a field scope must ABORT the export rather than merely omitting a value. /\nexport function isBlockingSubjectExportFieldScope(scope: SubjectExportFieldScope): boolean {\n return scope === SubjectExportFieldScope.UNDECLARED;\n}\n\n/\n Decide whether one field's value belongs in the bundle.\n \n `provenance` is the field's EFFECTIVE provenance — its own `.portabilityProvenance()` declaration\n * if it carries one, otherwise the resource's `portabilityPolicy.defaultProvenance`, otherwise\n * `undefined`. Resolving that fallback chain is the factory's job (Phase 0B); this function only\n * judges the resolved value, which keeps it pure and independently testable.\n /\nexport function resolveSubjectExportFieldScope(\n provenance: DataPortabilityProvenance \| undefined,\n purpose: SubjectExportPurpose,\n): SubjectExportFieldScope {\n switch (purpose) {\n // Access discloses everything concerning the subject, so provenance is simply not a question it\n // asks — an unannotated application can still answer an Art. 15 request in full.\n case SubjectExportPurpose.ACCESS_ART_15:\n return SubjectExportFieldScope.INCLUDED;\n\n case SubjectExportPurpose.PORTABILITY_ART_20:\n return resolvePortabilityFieldScope(provenance);\n\n default: {\n // Compile-time exhaustiveness on the PURPOSE axis too. Without this arm a third right added\n // to the enum would silently inherit the portability narrowing — a disclosure boundary\n // decided by fall-through rather than by anyone.\n const _exhaustivePurposeCheck: never = purpose;\n throw new Error(\n `resolveSubjectExportFieldScope has no arm for export purpose `\n + `'${String(_exhaustivePurposeCheck)}'`,\n );\n }\n }\n}\n\n/\n The Art. 20 narrowing, split out so {@link resolveSubjectExportFieldScope} can switch\n * exhaustively on `purpose` while this switches exhaustively on `provenance`. Module-private: the\n * purpose gate is not optional, and a caller reaching this directly would bypass it.\n /\nfunction resolvePortabilityFieldScope(\n provenance: DataPortabilityProvenance \| undefined,\n): SubjectExportFieldScope {\n if (provenance === undefined) {\n return SubjectExportFieldScope.UNDECLARED;\n }\n\n switch (provenance) {\n // Both are \"provided by the data subject\" in the Art. 20 sense — OBSERVED is data generated by\n // the subject's USE of the service, which the guidance places in scope even though the subject\n // never typed it.\n case DataPortabilityProvenance.SUBJECT_PROVIDED:\n case DataPortabilityProvenance.OBSERVED:\n return SubjectExportFieldScope.INCLUDED;\n\n case DataPortabilityProvenance.DERIVED:\n return SubjectExportFieldScope.EXCLUDED_DERIVED;\n\n default: {\n // Compile-time exhaustiveness: a new provenance member without an arm is a TYPE error here.\n const _exhaustiveProvenanceCheck: never = provenance;\n throw new Error(\n `resolvePortabilityFieldScope has no arm for provenance `\n + `'${String(_exhaustiveProvenanceCheck)}'`,\n );\n }\n }\n}\n\n/\n Is this field withheld from EVERY subject export, whatever right is being answered?\n \n ## Why this exists at all — the layering trap it closes\n \n The export orchestrator collects rows at the REPOSITORY layer, which sits BELOW the service-layer\n * DTO projection that normally strips `.isBackendOnly()` fields on their way to a client. Without an\n * explicit check here, a subject export would disclose exactly the values that projection exists to\n * hide — `passwordHash` and `backupCodesHashed` on `USER_CREDENTIALS` are the motivating case, and\n * the config change that exposed them would have looked entirely routine.\n \n ## Why it is deliberately CONSERVATIVE\n \n This withholds every backend-only field, not only the secrets. Some backend-only fields are\n * genuinely disclosable under Art. 15 (`passwordChangedAt`, `firstMfaPromptAt` — facts about the\n * subject they may ask for), so this errs toward withholding.\n \n That asymmetry is intentional. Under-disclosing produces a complaint that is answerable and\n * fixable; disclosing an authentication secret is neither, and it degrades the security of\n * processing the framework is separately obliged to maintain (GDPR Art. 32). Between an\n * over-cautious bundle and a leaked credential, only one is recoverable.\n \n The withheld fields are REPORTED (`SubjectExportReport.fieldsWithheldAsNonDisclosable`) so the\n * caution is visible rather than silent. When a resource needs a specific backend-only field\n * disclosed, the expressible extension is a per-field opt-in on this predicate — NOT loosening it\n * wholesale.\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\nexport function isFieldWithheldFromSubjectExport(fieldSchema: z.ZodTypeAny): boolean {\n // Delegated to the ONE field-value disclosure rule rather than restated. The reasoning that used\n // to sit here — that `isWriteOnlySecret` is checked explicitly rather than assumed to imply\n // backend-only, because they are separate decorators and a future authoring form may set one\n // without the other — moved WITH the rule, and is now the shared module's own justification.\n //\n // This function keeps its own name and its own assurance marker deliberately: subject export is a\n // distinct obligation from model disclosure, its own docstring anticipates a per-field opt-in that\n // would apply HERE and nowhere else, and merging the two names would make that extension\n // unexpressible. What is shared is the rule, not the concept.\n return isNonDisclosableFieldValue(fieldSchema);\n}\n\n/* Every legal {@link DataPortabilityProvenance} value, for validating an opaque decorator string. /\nconst KNOWN_PORTABILITY_PROVENANCES: ReadonlySet<string> = new Set(\n Object.values(DataPortabilityProvenance),\n);\n\n/\n Resolve ONE field's EFFECTIVE provenance by joining the two declaration levels.\n \n ## The fallback chain, and why it has exactly two rungs\n \n 1. the field's own `.portabilityProvenance()` declaration, if it carries one;\n * 2. otherwise the resource's `portabilityPolicy.defaultProvenance`;\n * 3. otherwise `undefined` — which {@link resolveSubjectExportFieldScope} turns into a REFUSAL for\n * an Art. 20 export and ignores entirely for Art. 15.\n \n Two rungs is what makes the fail-loud rule adoptable: without the resource default, every field of\n * every resource would need a decorator before a single portability request could be answered, and a\n * capability that expensive to adopt does not get adopted. With it, annotating a resource is one\n * line and only the exceptions carry a decorator.\n \n ## Why the enum check lives HERE\n \n `zod-decorators` sits below this package and cannot import {@link DataPortabilityProvenance}, so\n * it stores whatever non-empty string it was given — it can reject a BLANK but not a WRONG value.\n * This is the first layer that knows the vocabulary, so it is where a typo'd `'subject-provided'`\n * (hyphen, not underscore) must fail rather than silently resolving to `undefined` and turning a\n * declared field into a refusal — or worse, into a silent omission if the caller treats unknown as\n * derived. Mirrors how `RedactionType` validity is checked in this layer for `.impersonalizeWith()`.\n \n @param fieldSchema the field's Zod schema; the reader walks wrapper types, so a declaration made\n * before or after `.optional()` / `.nullish()` / `.default()` is observed either way.\n * @param resourceDefaultProvenance the owning resource's `portabilityPolicy.defaultProvenance`.\n * Taken as a bare value rather than the policy object so this module stays free of the\n * resource-config import (which imports THIS module for the enum).\n * @param fieldLocator `resourceType.fieldName`, used only to make a rejection actionable.\n /\nexport function resolveEffectiveFieldPortabilityProvenance(\n fieldSchema: z.ZodTypeAny,\n resourceDefaultProvenance: DataPortabilityProvenance \| undefined,\n fieldLocator: string,\n): DataPortabilityProvenance \| undefined {\n const declared = getPortabilityProvenance(fieldSchema);\n\n if (declared === undefined) {\n return resourceDefaultProvenance;\n }\n\n if (!KNOWN_PORTABILITY_PROVENANCES.has(declared)) {\n throw new Error(\n `[${fieldLocator}] portabilityProvenance('${declared}') is not a DataPortabilityProvenance `\n + `value. Expected one of: ${[...KNOWN_PORTABILITY_PROVENANCES].join(', ')}. An unrecognised `\n + `value would resolve as UNDECLARED and make an Art. 20 export refuse, hiding the typo `\n + `behind what looks like a deliberate omission.`,\n );\n }\n\n return declared as DataPortabilityProvenance;\n}\n\n/* Why a compiled leaf-field decision has its effective export meaning. /\nexport enum SubjectExportFieldDecisionBasis {\n FIELD_DECLARATION = 'field_declaration',\n RESOURCE_DEFAULT = 'resource_default',\n WITHHELD_NON_DISCLOSABLE = 'withheld_non_disclosable',\n UNDECLARED = 'undeclared',\n DEPTH_LIMIT = 'depth_limit',\n}\n\n/* Canonical, runtime-effective decision for one leaf path in one export purpose. /\nexport interface SubjectExportFieldDecision {\n readonly locator: string;\n readonly purpose: SubjectExportPurpose;\n readonly scope: SubjectExportFieldScope \| null;\n readonly provenance: DataPortabilityProvenance \| null;\n readonly basis: SubjectExportFieldDecisionBasis;\n}\n\nconst SUBJECT_EXPORT_FIELD_MAX_DEPTH = 10;\n\n/\n Resolve an object shape through the same bounded wrapper protocol used by subject export.\n * Returning `undefined` means the value is a leaf. Reaching the bound is handled fail-closed by\n * {@link compileSubjectExportFieldDecisions}, never as an implicit leaf inclusion.\n /\nexport function resolveSubjectExportObjectShapeThroughWrappers(schema: unknown): Record<string, unknown> \| undefined {\n let current: any = schema;\n for (let unwrapDepth = 0; current && unwrapDepth < SUBJECT_EXPORT_FIELD_MAX_DEPTH; unwrapDepth += 1) {\n if (current.shape && typeof current.shape === 'object') return current.shape as Record<string, unknown>;\n const inner = current.def?.innerType ?? current._def?.innerType;\n if (!inner) return undefined;\n current = inner;\n }\n return undefined;\n}\n\n/\n Compile every runtime-effective leaf-field decision for one resource and right.\n \n Both the backend executor and application authority proof consume this function. A field-level\n * decorator, inherited default, withheld marker, wrapper layout or depth refusal therefore changes\n * one shared decision inventory instead of two independently maintained interpretations.\n /\nexport function compileSubjectExportFieldDecisions(input: {\n readonly resourceType: ResourceType;\n readonly mainSchema: unknown;\n readonly defaultProvenance: DataPortabilityProvenance \| undefined;\n readonly purpose: SubjectExportPurpose;\n}): SubjectExportFieldDecision[] {\n const rootShape = resolveSubjectExportObjectShapeThroughWrappers(input.mainSchema);\n if (!rootShape) return [];\n const decisions: SubjectExportFieldDecision[] = [];\n\n const visit = (shape: Record<string, unknown>, locatorPrefix: string, depth: number): void => {\n for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n const locator = `${locatorPrefix}.${fieldName}`;\n if (depth >= SUBJECT_EXPORT_FIELD_MAX_DEPTH) {\n decisions.push({\n locator,\n purpose: input.purpose,\n scope: SubjectExportFieldScope.UNDECLARED,\n provenance: null,\n basis: SubjectExportFieldDecisionBasis.DEPTH_LIMIT,\n });\n continue;\n }\n if (isFieldWithheldFromSubjectExport(fieldSchema as z.ZodTypeAny)) {\n decisions.push({\n locator,\n purpose: input.purpose,\n scope: null,\n provenance: null,\n basis: SubjectExportFieldDecisionBasis.WITHHELD_NON_DISCLOSABLE,\n });\n continue;\n }\n const nestedShape = resolveSubjectExportObjectShapeThroughWrappers(fieldSchema);\n if (nestedShape) {\n visit(nestedShape, locator, depth + 1);\n continue;\n }\n const declared = getPortabilityProvenance(fieldSchema as z.ZodTypeAny);\n const provenance = resolveEffectiveFieldPortabilityProvenance(fieldSchema as z.ZodTypeAny, input.defaultProvenance, locator);\n decisions.push({\n locator,\n purpose: input.purpose,\n scope: resolveSubjectExportFieldScope(provenance, input.purpose),\n provenance: provenance ?? null,\n basis: declared !== undefined\n ? SubjectExportFieldDecisionBasis.FIELD_DECLARATION\n : provenance !== undefined\n ? SubjectExportFieldDecisionBasis.RESOURCE_DEFAULT\n : SubjectExportFieldDecisionBasis.UNDECLARED,\n });\n }\n };\n\n visit(rootShape, String(input.resourceType), 0);\n return decisions.sort((left, right) => compareCanonicalText(left.locator, right.locator));\n}\n\n/* Per-edge outcome of an executed export — the classification plus what actually happened. /\nexport interface SubjectExportEdgeOutcome extends SubjectExportEdgeClassification {\n /\n `true` when the export actually queried this edge. Note this reports that the read RAN, not\n * that rows existed — an included edge with no rows for this subject is a legitimate empty\n * result, and {@link recordCount} distinguishes the two.\n /\n collected: boolean;\n /* How many rows this edge contributed. `0` on an included edge means the subject had none. /\n recordCount: number;\n}\n\n/\n What one subject export produced — the compliance artifact of an Art. 15 or Art. 20 request.\n \n Returned to the caller (rather than only logged) so the flow fronting the request can record or\n * surface it: every edge of the subject appears exactly once with the disposition applied and the\n * configuration that justified it. For a disclosure obligation, the record of what was DELIBERATELY\n * LEFT OUT — and on what legal basis — matters as much as the data returned.\n /\nexport interface SubjectExportReport {\n /* Which right this export answered. /\n purpose: SubjectExportPurpose;\n /* The exported subject's resource type. /\n subjectResourceType: ResourceType;\n /* The exported subject rows. /\n subjectIds: string[];\n /* Every child-direction edge of the subject, classified, in registry order. /\n edges: SubjectExportEdgeOutcome[];\n /\n Fields omitted from the bundle as controller-DERIVED, as `resourceType.fieldName`. Populated\n * only for `PORTABILITY_ART_20`. Recorded rather than silently dropped so the subject can see\n * that derived data exists and request it under Art. 15 instead.\n /\n fieldsExcludedAsDerived: string[];\n /\n Fields withheld as NON-DISCLOSABLE regardless of purpose — see\n * {@link isFieldWithheldFromSubjectExport}. Populated for BOTH rights, because a password hash is\n * no more disclosable under Art. 15 than under Art. 20.\n \n Recorded rather than silently dropped for the same reason as the derived list, and one more: a\n * reviewer auditing why an export looks thin needs to see that the framework withheld something\n * deliberately, not that a resource was missed.\n /\n fieldsWithheldAsNonDisclosable: string[];\n /* Total rows across every collected edge, including the subject's own row(s). /\n totalRecordCount: number;\n}\n\n/* One resource's contribution to an export bundle. /\nexport interface SubjectExportResourceSlice {\n resourceType: ResourceType;\n /\n The rows, already narrowed to the fields in scope for the export's purpose. For\n * `PORTABILITY_ART_20` the controller-derived columns are gone; for `ACCESS_ART_15` every column\n * the subject is entitled to see is present.\n /\n rows: Record<string, unknown>[];\n}\n\n/\n What an export ACTUALLY produced — the data, paired with the report that justifies its shape.\n \n ## Why the data and the report are one return value but two types\n \n {@link SubjectExportReport} is the compliance artifact: it survives the request, is safe to log\n * and persist, and contains NO personal data — only per-edge dispositions and counts. The slices\n * are the personal data itself, which must NOT be logged and whose lifetime ends when the artifact\n * is written.\n \n Returning them together keeps the caller from having to correlate two results, while the type\n * split keeps \"safe to record\" and \"must be handled carefully\" visibly distinct — a caller writing\n * `logger.info({ report })` is correct, and the same line with `bundle` would be a leak. Fusing\n * them into one flat object would erase exactly that distinction.\n */\nexport interface SubjectExportBundle {\n report: SubjectExportReport;\n slices: SubjectExportResourceSlice[];\n}\n"]}
1	+ {"version":3,"file":"subject-export.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAG/E,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,uDAA+B,CAAA;IAE/B;;;;OAIG;IACH,iEAAyC,CAAA;AAC3C,CAAC,EAdW,oBAAoB,KAApB,oBAAoB,QAc/B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,yBAqBX;AArBD,WAAY,yBAAyB;IACnC;;;OAGG;IACH,kEAAqC,CAAA;IAErC;;;;OAIG;IACH,kDAAqB,CAAA;IAErB;;;;;OAKG;IACH,gDAAmB,CAAA;AACrB,CAAC,EArBW,yBAAyB,KAAzB,yBAAyB,QAqBpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAN,IAAY,4BAuDX;AAvDD,WAAY,4BAA4B;IACtC;;;;OAIG;IACH,iEAAiC,CAAA;IAEjC;;;;;;;;;OASG;IACH,2FAA2D,CAAA;IAE3D;;;;OAIG;IACH,uFAAuD,CAAA;IAEvD;;;;;;;OAOG;IACH,+FAA+D,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,qFAAqD,CAAA;AACvD,CAAC,EAvDW,4BAA4B,KAA5B,4BAA4B,QAuDvC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sCAAsC,CACpD,WAAyC;IAEzC,OAAO,WAAW,KAAK,4BAA4B,CAAC,cAAc;WAC7D,WAAW,KAAK,4BAA4B,CAAC,2BAA2B,CAAC;AAChF,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,YAAkC,EAClC,OAA6B;IAE7B,MAAM,mBAAmB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACvE,MAAM,QAAQ,GAAG,CACf,WAAyC,EACzC,MAAc,EACmB,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAErF,6FAA6F;IAC7F,2CAA2C;IAC3C,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,4BAA4B,CAAC,cAAc,EAC3C,2FAA2F;cACvF,mCAAmC,CACxC,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACjG,MAAM,wBAAwB,GAAG,gBAAgB,KAAK,YAAY,CAAC,aAAa,CAAC;IAEjF,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,0BAA0B,cAAc,qDAAqD;cACzF,sFAAsF,CAC3F,CAAC;IACJ,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,2BAA2B,EACxD,0BAA0B,cAAc,8CAA8C;kBAClF,qFAAqF;kBACrF,sCAAsC,CAC3C,CAAC;QAEJ,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,QAAQ,CACb,4BAA4B,CAAC,6BAA6B,EAC1D,0BAA0B,cAAc,8CAA8C;kBAClF,sFAAsF;kBACtF,gFAAgF,CACrF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,wFAAwF;YACxF,yEAAyE;YACzE,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,iEAAiE;kBAC7D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAuBD;;;;;;;;GAQG;AACH,MAAM,UAAU,4CAA4C,CAC1D,mBAAiC,EACjC,aAA+C,EAC/C,OAA6B;IAE7B,MAAM,qBAAqB,GAAG;QAC5B,GAAG,aAAa,CAAC,kBAAkB;QACnC,GAAG,aAAa,CAAC,mBAAmB;QACpC,GAAG,aAAa,CAAC,iBAAiB;KACnC,CAAC;IACF,OAAO,qBAAqB;SACzB,GAAG,CAAC,CAAC,YAAY,EAAsC,EAAE;QACxD,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,CAAC,mBAAmB,CAAC,2BAA2B;kBAC/F,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,sBAAsB,GAAG,YAAY,CAAC,aAAa,KAAK,mBAAmB;YAC/E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,GAAG,YAAY;gBACf,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,YAAY,EAAE,YAAY,CAAC,YAAY;aACxC,CAAC;QACN,OAAO;YACL,YAAY;YACZ,sBAAsB;YACtB,cAAc,EAAE,gCAAgC,CAAC,sBAAsB,EAAE,OAAO,CAAC;SAClF,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE,qCAAqC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5I,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qCAAqC,CAAC,SAA6C;IACjG,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC;IACtD,OAAO;QACL,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,MAAM;QACnB,YAAY,CAAC,eAAe,IAAI,EAAE;QAClC,SAAS,CAAC,cAAc,CAAC,WAAW;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC,gDAAgD;IAChD,gDAAqB,CAAA;IAErB;;;OAGG;IACH,gEAAqC,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,oDAAyB,CAAA;AAC3B,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AAED,uFAAuF;AACvF,MAAM,UAAU,iCAAiC,CAAC,KAA8B;IAC9E,OAAO,KAAK,KAAK,uBAAuB,CAAC,UAAU,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAiD,EACjD,OAA6B;IAE7B,QAAQ,OAAO,EAAE,CAAC;QAChB,gGAAgG;QAChG,iFAAiF;QACjF,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,uFAAuF;YACvF,iDAAiD;YACjD,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,+DAA+D;kBAC3D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CACnC,UAAiD;IAEjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,uBAAuB,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,QAAQ,UAAU,EAAE,CAAC;QACnB,+FAA+F;QAC/F,+FAA+F;QAC/F,kBAAkB;QAClB,KAAK,yBAAyB,CAAC,gBAAgB,CAAC;QAChD,KAAK,yBAAyB,CAAC,QAAQ;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,yBAAyB,CAAC,OAAO;YACpC,OAAO,uBAAuB,CAAC,gBAAgB,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,MAAM,0BAA0B,GAAU,UAAU,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,yDAAyD;kBACrD,IAAI,MAAM,CAAC,0BAA0B,CAAC,GAAG,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAyB;IACxE,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,yFAAyF;IACzF,8DAA8D;IAC9D,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,sGAAsG;AACtG,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0CAA0C,CACxD,WAAyB,EACzB,yBAAgE,EAChE,YAAoB;IAEpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,IAAI,YAAY,4BAA4B,QAAQ,wCAAwC;cACxF,2BAA2B,CAAC,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;cAC5F,uFAAuF;cACvF,+CAA+C,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,QAAqC,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,0EAAuC,CAAA;IACvC,wEAAqC,CAAA;IACrC,wFAAqD,CAAA;IACrD,4DAAyB,CAAA;IACzB,8DAA2B,CAAA;AAC7B,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAWD,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,MAAe;IAC5E,IAAI,OAAO,GAAQ,MAAM,CAAC;IAC1B,KAAK,IAAI,WAAW,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,GAAG,8BAA8B,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC;QACpG,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,KAAgC,CAAC;QACxG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,MAAM,SAAS,GAAG,8CAA8C,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAiC,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,aAAqB,EAAE,KAAa,EAAQ,EAAE;QAC3F,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,SAAS,EAAE,CAAC;YAChD,IAAI,KAAK,IAAI,8BAA8B,EAAE,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,uBAAuB,CAAC,UAAU;oBACzC,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,WAAW;iBACnD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,gCAAgC,CAAC,WAA2B,CAAC,EAAE,CAAC;gBAClE,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,wBAAwB;iBAChE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,8CAA8C,CAAC,WAAW,CAAC,CAAC;YAChF,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAA2B,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,0CAA0C,CAAC,WAA2B,EAAE,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAC7H,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;gBAChE,UAAU,EAAE,UAAU,IAAI,IAAI;gBAC9B,KAAK,EAAE,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,+BAA+B,CAAC,iBAAiB;oBACnD,CAAC,CAAC,UAAU,KAAK,SAAS;wBACxB,CAAC,CAAC,+BAA+B,CAAC,gBAAgB;wBAClD,CAAC,CAAC,+BAA+B,CAAC,UAAU;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import type { z } from 'zod';\nimport { getPortabilityProvenance } from '@wildo-ai/zod-decorators';\nimport { isNonDisclosableFieldValue } from '../../resources/utils/field-value-disclosure.utils';\nimport {\n RelationshipLifecycleModel,\n type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\n\nconst compareCanonicalText = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\n\n/*\n WHICH data-subject right an export is answering.\n \n ## Why this is an enum and not a boolean flag on one bundle\n \n GDPR Art. 15 (right of access) and Art. 20 (right to data portability) are DIFFERENT rights over\n * DIFFERENT data, and conflating them is the defect this capability was built to correct: the four\n * routed export operations removed on 2026-08-01 declared themselves \"portability / GDPR\" while\n * their actual options (`includeActivityData`, `includeOrganizationData`) described an access\n * bundle. One output with a flag would reproduce that merge.\n \n - Access is a disclosure obligation: everything the controller holds concerning the subject,\n * including data the controller itself derived about them, in any readable form.\n * - Portability is a transfer obligation: only the data the subject provided — actively, or by\n * using the service — and it must be machine-readable and re-importable elsewhere. Data the\n * controller inferred is deliberately OUT of scope; a competitor must not receive a rival's\n * analytics through a subject's portability request.\n \n The two therefore diverge at BOTH levels this module classifies: per-edge (see\n * {@link classifySubjectExportDisposition}) and per-field (see\n * {@link resolveSubjectExportFieldScope}).\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\nexport enum SubjectExportPurpose {\n /\n Art. 15 — right of access. The broadest bundle: every row concerning the subject, whoever\n * produced it, including rows the subject does not own (an audit log about them, a membership an\n * administrator created).\n /\n ACCESS_ART_15 = 'access_art_15',\n\n /\n Art. 20 — right to data portability. Narrower on purpose: only data the subject supplied or\n * generated by using the service, and only from rows the subject owns. Controller-derived data is\n * excluded by {@link DataPortabilityProvenance.DERIVED}.\n /\n PORTABILITY_ART_20 = 'portability_art_20',\n}\n\n/\n WHERE one field's value came from — the axis that decides Art. 20 scope.\n \n ## Why three values and not `isSubjectProvided: boolean`\n \n EDPB/WP29 guidance splits \"provided by the data subject\" into data supplied knowingly and data\n * observed from the subject's use of the service, and puts BOTH in Art. 20 scope while excluding\n * data the controller inferred. A boolean forces `OBSERVED` to be mis-filed against whichever\n * side the author guesses — and it is the member most often got wrong, because \"the user did not\n * type it\" reads as \"the user did not provide it\", which is precisely the wrong conclusion.\n \n ## Why this is per-FIELD and not per-resource\n \n A single row routinely mixes the two: a user profile holds `firstName` (supplied) beside a\n * controller-computed status or score. A resource-level answer would have to round one way for the\n * whole row. The resource-level declaration exists only as a DEFAULT\n * (`portabilityPolicy.defaultProvenance`) so that annotating a resource stays a one-line cost; the\n * per-field decorator overrides it where a field differs.\n \n ⚠️ NOT a redaction or scrub concept. This says where a value CAME FROM, for a disclosure\n * decision. What happens to a value on ERASURE is `.impersonalizeWith()` / `RedactionType`, a\n * different axis entirely — a field can be `SUBJECT_PROVIDED` and also masked on erasure.\n /\nexport enum DataPortabilityProvenance {\n /\n The subject actively and knowingly supplied this value — form input, an uploaded file, a\n * setting they chose. Unambiguously in scope for both rights.\n /\n SUBJECT_PROVIDED = 'subject_provided',\n\n /\n Generated by the subject's USE of the service rather than typed by them — activity timestamps,\n * event history, usage counters, telemetry. In scope for Art. 20, which is the whole reason\n * this member exists separately from {@link DERIVED}.\n /\n OBSERVED = 'observed',\n\n /\n Produced BY the controller about the subject — inferred classifications, computed scores,\n * risk or segmentation labels, server-assigned lifecycle state. Disclosed under Art. 15 (the\n * subject may see what we concluded about them) but excluded from Art. 20 (a portability\n * request is not a channel for exporting the controller's own analysis).\n /\n DERIVED = 'derived',\n}\n\n/\n What an export does with ONE child-direction edge of the subject.\n \n ## Why this is NOT `SubjectErasureDisposition`\n \n Erasure and export share a traversal and answer opposite questions — what do I destroy? versus\n * what must I disclose? — and they diverge on exactly the edges erasure calls `NOT_OWNED`.\n \n Erasure leaves audit logs, memberships and job executions alone, correctly: you do not delete an\n * audit log because a user exercised a right. But those same rows hold personal data CONCERNING the\n * subject, and Art. 15 covers \"all personal data concerning him or her\" — not \"rows he owns\".\n * Reusing erasure's vocabulary verbatim would have silently omitted the data an access request most\n * often targets. Hence {@link INCLUDED_REFERENCES_SUBJECT}, a case erasure has no use for.\n \n The two classifiers still read the SAME upstream authority for what an edge says\n * (`requireResolvedRelationshipSemantics`), so they can never disagree about ownership — only about\n * what to do with it.\n \n ## Why there is no blocking disposition here\n \n Erasure refuses up-front on `UNCLASSIFIED` / `UNSUPPORTED_DEFERRED` because it is about to\n * WRITE, cannot half-destroy a subject, and needs a teardown declaration nobody made. An export\n * writes nothing: ownership alone answers the edge question, a deferred teardown is irrelevant to a\n * read, and a cross-adapter dependent is merely a second query rather than a broken transaction.\n * The one genuine refusal in an export is field-level and Art. 20-only — see\n * {@link SubjectExportFieldScope.UNDECLARED}. Manufacturing an edge-level blocker for symmetry\n * would be false symmetry.\n /\nexport enum SubjectExportEdgeDisposition {\n /\n The subject OWNS this dependent (`lifecycleModelMode: DEPENDENT`), so its rows are the\n * subject's own data. Included for both purposes — for Art. 20 the per-field provenance filter\n * still applies to what comes back.\n /\n INCLUDED_OWNED = 'included_owned',\n\n /\n The subject does NOT own these rows, but they REFERENCE the subject — the far side carries a\n * foreign key back to them (an audit log, an organization membership, a job execution).\n \n Art. 15 only. These are personal data concerning the subject, so an access request must\n * disclose them. A portability request must not: the subject did not provide a row that a third\n * party or the controller created about them, and shipping them would export the controller's\n * operational records under a transfer right. For `PORTABILITY_ART_20` this same edge classifies\n * as {@link EXCLUDED_NOT_SUBJECT_PROVIDED}.\n /\n INCLUDED_REFERENCES_SUBJECT = 'included_references_subject',\n\n /\n The edge carries no personal data of the subject at all: an independent or link-only\n * relationship whose far side does not even reference them, or a disabled relationship that is\n * not part of the live graph. Out of scope for both rights.\n /\n EXCLUDED_NOT_SUBJECT_DATA = 'excluded_not_subject_data',\n\n /\n In scope for access, but excluded from THIS export because the export is a portability request\n * and the rows were not provided by the subject. Kept as its own member rather than collapsing\n * into {@link EXCLUDED_NOT_SUBJECT_DATA}: a reviewer asking \"why is my audit trail missing from\n * my portability export?\" needs \"because Art. 20 does not cover controller records\" and \"because\n * that edge holds nothing about you\" to be different answers, and only the first is a legal\n * position someone took.\n /\n EXCLUDED_NOT_SUBJECT_PROVIDED = 'excluded_not_subject_provided',\n\n /\n The rows ARE the subject's data and the right covers them, but the resource is declared\n * `systemAccessPolicy.exportSubject = FORBIDDEN` — someone decided it must never reach a data\n * subject (an authentication-credential store, a security audit trail).\n \n ## Why this excludes rather than refusing\n \n An UNDECLARED resource refuses the whole export, because nobody has decided yet and refusing is\n * what forces the decision. A FORBIDDEN one is the opposite: the decision exists, and refusing\n * would make it permanent sabotage — a `USERS` access export whose graph touches a credential\n * store could then NEVER run, no matter how many other resources opted in. Honouring the\n * declaration means leaving those rows out and saying so.\n \n ⚠️ This applies to EDGES only. A subject whose OWN resource is FORBIDDEN still refuses: there is\n * no export of a person whose identity row may not be disclosed, and silently returning an\n * edges-only bundle would be a disclosure that omits its own subject.\n /\n EXCLUDED_NOT_DISCLOSABLE = 'excluded_not_disclosable',\n}\n\n/* Whether an edge disposition puts the far side's rows INTO the bundle. /\nexport function isIncludedSubjectExportEdgeDisposition(\n disposition: SubjectExportEdgeDisposition,\n): boolean {\n return disposition === SubjectExportEdgeDisposition.INCLUDED_OWNED\n \|\| disposition === SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT;\n}\n\n/* The classification of ONE child-direction edge of an export subject. /\nexport interface SubjectExportEdgeClassification {\n /* The related resource on the far side of the edge. /\n relatedResourceType: ResourceType;\n /* Whether, and why, this edge's rows join the bundle. /\n disposition: SubjectExportEdgeDisposition;\n /\n Human-readable justification quoting the configuration that produced it. Surfaced in the export\n * report so a data-protection reviewer never has to re-derive WHY a resource was included or\n * left out — which, for a disclosure obligation, is the evidence that matters.\n /\n reason: string;\n}\n\n/\n Classify what an export must do with ONE child-direction edge — the disclose-vs-omit decision,\n * DERIVED FROM CONFIGURATION rather than a hardcoded list of resource types.\n \n ## Where the answer comes from\n \n Two declarations the author already makes, read through the same shared authorities the delete\n * cascade and the erasure orchestrator read, so the three can never disagree about what an edge is:\n \n 1. `handling.lifecycleModelMode` — does the subject own this related resource's lifecycle?\n * `DEPENDENT` means the rows are the subject's own data.\n * 2. Foreign-key topology (`resolveForeignKeyHolderResourceType`, cardinality-only and\n * therefore pure) — for a NON-owned edge, does the far side nonetheless carry a reference back\n * to the subject? If it does, its rows are about the subject and Art. 15 must disclose them.\n \n ## The `purpose` parameter, and why it is a parameter\n \n Art. 15 and Art. 20 diverge on exactly one edge case — the referencing-but-not-owned edge — and\n * keeping that divergence in ONE switch here is what stops two near-identical classifiers from\n * drifting apart. Exposing `classifyForAccess` / `classifyForPortability` would duplicate the\n * ownership logic, and the day someone fixes a bug in one they would miss the other.\n \n ## Caller contract\n \n `relationship.resourceType2` MUST be the far side and `resourceType1` the subject — the same\n * child-direction normalization {@link classifySubjectErasureDisposition} requires. The caller\n * filters to child-direction edges before classifying.\n \n Pure and side-effect free — no registry lookups, no I/O, no row reads — so it is equally usable\n * from a runtime orchestrator and from a boot-time coherence guard.\n /\nexport function classifySubjectExportDisposition(\n relationship: ResourceRelationship,\n purpose: SubjectExportPurpose,\n): SubjectExportEdgeClassification {\n const relatedResourceType = relationship.resourceType2 as ResourceType;\n const classify = (\n disposition: SubjectExportEdgeDisposition,\n reason: string,\n ): SubjectExportEdgeClassification => ({ relatedResourceType, disposition, reason });\n\n // A disabled relationship is not part of the live graph — the runtime never traverses it, so\n // there are no rows behind it to disclose.\n if (relationship.isDisabled === true) {\n return classify(\n SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n 'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n );\n }\n\n const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n if (lifecycleModel === RelationshipLifecycleModel.DEPENDENT) {\n return classify(\n SubjectExportEdgeDisposition.INCLUDED_OWNED,\n 'lifecycleModelMode is DEPENDENT: the subject owns these rows, so they are the subject\\'s '\n + 'own data and belong in the bundle',\n );\n }\n\n // NOT owned from here on. The rows still count as personal data if they POINT AT the subject —\n // which is the Art. 15 / Art. 20 fork.\n const foreignKeyHolder = Resources_SharedUtils.resolveForeignKeyHolderResourceType(relationship);\n const farSideReferencesSubject = foreignKeyHolder === relationship.resourceType2;\n\n if (!farSideReferencesSubject) {\n return classify(\n SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT) and the far side does not hold a `\n + 'foreign key to the subject, so these rows are neither owned by nor about the subject',\n );\n }\n\n switch (purpose) {\n case SubjectExportPurpose.ACCESS_ART_15:\n return classify(\n SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT,\n `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT), but the far side holds a `\n + 'foreign key to the subject, so these rows are personal data CONCERNING the subject '\n + 'and Art. 15 requires disclosing them',\n );\n\n case SubjectExportPurpose.PORTABILITY_ART_20:\n return classify(\n SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_PROVIDED,\n `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): these rows reference the `\n + 'subject but were created by the controller or a third party rather than provided by '\n + 'the subject, so Art. 20 does not cover them (they ARE disclosed under Art. 15)',\n );\n\n default: {\n // Compile-time exhaustiveness: a new SubjectExportPurpose without an arm here is a TYPE\n // error, not a silent runtime discovery on someone's disclosure request.\n const _exhaustivePurposeCheck: never = purpose;\n throw new Error(\n `classifySubjectExportDisposition has no arm for export purpose `\n + `'${String(_exhaustivePurposeCheck)}'`,\n );\n }\n }\n}\n\n/\n The three relationship buckets exposed by a compiled resource configuration.\n \n Kept structural here so the privacy compiler does not import resource configuration schemas:\n * those schemas already import this module for {@link DataPortabilityProvenance}.\n /\nexport interface SubjectExportRelationshipBuckets {\n readonly parentRelationships: readonly ResourceRelationship[];\n readonly childRelationships: readonly ResourceRelationship[];\n readonly selfRelationships: readonly ResourceRelationship[];\n}\n\n/* One graph edge normalized so the export subject is always `resourceType1`. /\nexport interface SubjectExportRelationshipTraversal {\n /* Original compiled relationship; runtime adapters use it to resolve the real FK field. /\n readonly relationship: ResourceRelationship;\n /* Direction-normalized relationship consumed by the shared legal-scope classifier. /\n readonly normalizedRelationship: ResourceRelationship;\n readonly classification: SubjectExportEdgeClassification;\n}\n\n/\n Enumerate every edge touching one export subject, including child-first reference declarations.\n \n Resource configurations deliberately preserve parent/child/self buckets. Subject disclosure is\n * different: personal data can point to the subject from either authored orientation. This helper\n * joins both directional buckets, includes self edges once, and swaps only the positional topology\n * needed by {@link classifySubjectExportDisposition}. It preserves the original compiled edge for\n * FK resolution and never collapses multiple foreign keys between the same resource pair.\n /\nexport function enumerateSubjectExportRelationshipTraversals(\n subjectResourceType: ResourceType,\n relationships: SubjectExportRelationshipBuckets,\n purpose: SubjectExportPurpose,\n): SubjectExportRelationshipTraversal[] {\n const touchingRelationships = [\n ...relationships.childRelationships,\n ...relationships.parentRelationships,\n ...relationships.selfRelationships,\n ];\n return touchingRelationships\n .map((relationship): SubjectExportRelationshipTraversal => {\n if (relationship.resourceType1 !== subjectResourceType && relationship.resourceType2 !== subjectResourceType) {\n throw new Error(\n `Subject-export relationship traversal for ${String(subjectResourceType)} received unrelated edge `\n + `${String(relationship.resourceType1)} -> ${String(relationship.resourceType2)}.`,\n );\n }\n const normalizedRelationship = relationship.resourceType1 === subjectResourceType\n ? relationship\n : {\n ...relationship,\n resourceType1: relationship.resourceType2,\n resourceType2: relationship.resourceType1,\n cardinality1: relationship.cardinality2,\n cardinality2: relationship.cardinality1,\n };\n return {\n relationship,\n normalizedRelationship,\n classification: classifySubjectExportDisposition(normalizedRelationship, purpose),\n };\n })\n .sort((left, right) => compareCanonicalText(subjectExportRelationshipTraversalKey(left), subjectExportRelationshipTraversalKey(right)));\n}\n\n/* Stable identity retaining distinct foreign keys between otherwise identical resource pairs. /\nexport function subjectExportRelationshipTraversalKey(traversal: SubjectExportRelationshipTraversal): string {\n const relationship = traversal.normalizedRelationship;\n return [\n relationship.resourceType1,\n relationship.resourceType2,\n relationship.cardinality1,\n relationship.cardinality2,\n relationship.nature,\n relationship.foreignKeyField ?? '',\n traversal.classification.disposition,\n ].join('\\0');\n}\n\n/\n Whether ONE field's value joins the bundle, for a given purpose.\n \n Separate from {@link SubjectExportEdgeDisposition} because the two answer different questions at\n * different granularities: an edge decides whether a RESOURCE's rows are in scope at all, a field\n * scope decides which COLUMNS of an in-scope row survive the Art. 20 narrowing.\n /\nexport enum SubjectExportFieldScope {\n /* The field's value belongs in this bundle. /\n INCLUDED = 'included',\n\n /\n Excluded because the value is controller-DERIVED and this is a portability request. Never\n * reached for `ACCESS_ART_15`, which discloses derived data.\n /\n EXCLUDED_DERIVED = 'excluded_derived',\n\n /\n ⛔ NO ANSWER — the field carries no provenance declaration and none is inherited from its\n * resource, while the export is a portability request that needs one.\n \n The export REFUSES rather than guessing, because both guesses are harmful and neither is the\n * conservative one: excluding an undeclared field UNDER-DELIVERS a legal right the subject is\n * owed, and including it OVER-SHARES data the controller derived. There is no safe default to\n * fall back on, which is exactly the condition that justifies failing loud — the same reasoning\n * that makes `SubjectErasureDisposition.UNCLASSIFIED` refuse an erasure.\n \n `ACCESS_ART_15` never produces this: access includes every field regardless of provenance, so\n * an application can serve access requests before annotating anything.\n /\n UNDECLARED = 'undeclared',\n}\n\n/* Whether a field scope must ABORT the export rather than merely omitting a value. /\nexport function isBlockingSubjectExportFieldScope(scope: SubjectExportFieldScope): boolean {\n return scope === SubjectExportFieldScope.UNDECLARED;\n}\n\n/\n Decide whether one field's value belongs in the bundle.\n \n `provenance` is the field's EFFECTIVE provenance — its own `.portabilityProvenance()` declaration\n * if it carries one, otherwise the resource's `portabilityPolicy.defaultProvenance`, otherwise\n * `undefined`. Resolving that fallback chain is the factory's job (Phase 0B); this function only\n * judges the resolved value, which keeps it pure and independently testable.\n /\nexport function resolveSubjectExportFieldScope(\n provenance: DataPortabilityProvenance \| undefined,\n purpose: SubjectExportPurpose,\n): SubjectExportFieldScope {\n switch (purpose) {\n // Access discloses everything concerning the subject, so provenance is simply not a question it\n // asks — an unannotated application can still answer an Art. 15 request in full.\n case SubjectExportPurpose.ACCESS_ART_15:\n return SubjectExportFieldScope.INCLUDED;\n\n case SubjectExportPurpose.PORTABILITY_ART_20:\n return resolvePortabilityFieldScope(provenance);\n\n default: {\n // Compile-time exhaustiveness on the PURPOSE axis too. Without this arm a third right added\n // to the enum would silently inherit the portability narrowing — a disclosure boundary\n // decided by fall-through rather than by anyone.\n const _exhaustivePurposeCheck: never = purpose;\n throw new Error(\n `resolveSubjectExportFieldScope has no arm for export purpose `\n + `'${String(_exhaustivePurposeCheck)}'`,\n );\n }\n }\n}\n\n/\n The Art. 20 narrowing, split out so {@link resolveSubjectExportFieldScope} can switch\n * exhaustively on `purpose` while this switches exhaustively on `provenance`. Module-private: the\n * purpose gate is not optional, and a caller reaching this directly would bypass it.\n /\nfunction resolvePortabilityFieldScope(\n provenance: DataPortabilityProvenance \| undefined,\n): SubjectExportFieldScope {\n if (provenance === undefined) {\n return SubjectExportFieldScope.UNDECLARED;\n }\n\n switch (provenance) {\n // Both are \"provided by the data subject\" in the Art. 20 sense — OBSERVED is data generated by\n // the subject's USE of the service, which the guidance places in scope even though the subject\n // never typed it.\n case DataPortabilityProvenance.SUBJECT_PROVIDED:\n case DataPortabilityProvenance.OBSERVED:\n return SubjectExportFieldScope.INCLUDED;\n\n case DataPortabilityProvenance.DERIVED:\n return SubjectExportFieldScope.EXCLUDED_DERIVED;\n\n default: {\n // Compile-time exhaustiveness: a new provenance member without an arm is a TYPE error here.\n const _exhaustiveProvenanceCheck: never = provenance;\n throw new Error(\n `resolvePortabilityFieldScope has no arm for provenance `\n + `'${String(_exhaustiveProvenanceCheck)}'`,\n );\n }\n }\n}\n\n/\n Is this field withheld from EVERY subject export, whatever right is being answered?\n \n ## Why this exists at all — the layering trap it closes\n \n The export orchestrator collects rows at the REPOSITORY layer, which sits BELOW the service-layer\n * DTO projection that normally strips `.isBackendOnly()` fields on their way to a client. Without an\n * explicit check here, a subject export would disclose exactly the values that projection exists to\n * hide — `passwordHash` and `backupCodesHashed` on `USER_CREDENTIALS` are the motivating case, and\n * the config change that exposed them would have looked entirely routine.\n \n ## Why it is deliberately CONSERVATIVE\n \n This withholds every backend-only field, not only the secrets. Some backend-only fields are\n * genuinely disclosable under Art. 15 (`passwordChangedAt`, `firstMfaPromptAt` — facts about the\n * subject they may ask for), so this errs toward withholding.\n \n That asymmetry is intentional. Under-disclosing produces a complaint that is answerable and\n * fixable; disclosing an authentication secret is neither, and it degrades the security of\n * processing the framework is separately obliged to maintain (GDPR Art. 32). Between an\n * over-cautious bundle and a leaked credential, only one is recoverable.\n \n The withheld fields are REPORTED (`SubjectExportReport.fieldsWithheldAsNonDisclosable`) so the\n * caution is visible rather than silent. When a resource needs a specific backend-only field\n * disclosed, the expressible extension is a per-field opt-in on this predicate — NOT loosening it\n * wholesale.\n \n assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n /\nexport function isFieldWithheldFromSubjectExport(fieldSchema: z.ZodTypeAny): boolean {\n // Delegated to the ONE field-value disclosure rule rather than restated. The reasoning that used\n // to sit here — that `isWriteOnlySecret` is checked explicitly rather than assumed to imply\n // backend-only, because they are separate decorators and a future authoring form may set one\n // without the other — moved WITH the rule, and is now the shared module's own justification.\n //\n // This function keeps its own name and its own assurance marker deliberately: subject export is a\n // distinct obligation from model disclosure, its own docstring anticipates a per-field opt-in that\n // would apply HERE and nowhere else, and merging the two names would make that extension\n // unexpressible. What is shared is the rule, not the concept.\n return isNonDisclosableFieldValue(fieldSchema);\n}\n\n/* Every legal {@link DataPortabilityProvenance} value, for validating an opaque decorator string. /\nconst KNOWN_PORTABILITY_PROVENANCES: ReadonlySet<string> = new Set(\n Object.values(DataPortabilityProvenance),\n);\n\n/\n Resolve ONE field's EFFECTIVE provenance by joining the two declaration levels.\n \n ## The fallback chain, and why it has exactly two rungs\n \n 1. the field's own `.portabilityProvenance()` declaration, if it carries one;\n * 2. otherwise the resource's `portabilityPolicy.defaultProvenance`;\n * 3. otherwise `undefined` — which {@link resolveSubjectExportFieldScope} turns into a REFUSAL for\n * an Art. 20 export and ignores entirely for Art. 15.\n \n Two rungs is what makes the fail-loud rule adoptable: without the resource default, every field of\n * every resource would need a decorator before a single portability request could be answered, and a\n * capability that expensive to adopt does not get adopted. With it, annotating a resource is one\n * line and only the exceptions carry a decorator.\n \n ## Why the enum check lives HERE\n \n `zod-decorators` sits below this package and cannot import {@link DataPortabilityProvenance}, so\n * it stores whatever non-empty string it was given — it can reject a BLANK but not a WRONG value.\n * This is the first layer that knows the vocabulary, so it is where a typo'd `'subject-provided'`\n * (hyphen, not underscore) must fail rather than silently resolving to `undefined` and turning a\n * declared field into a refusal — or worse, into a silent omission if the caller treats unknown as\n * derived. Mirrors how `RedactionType` validity is checked in this layer for `.impersonalizeWith()`.\n \n @param fieldSchema the field's Zod schema; the reader walks wrapper types, so a declaration made\n * before or after `.optional()` / `.nullish()` / `.default()` is observed either way.\n * @param resourceDefaultProvenance the owning resource's `portabilityPolicy.defaultProvenance`.\n * Taken as a bare value rather than the policy object so this module stays free of the\n * resource-config import (which imports THIS module for the enum).\n * @param fieldLocator `resourceType.fieldName`, used only to make a rejection actionable.\n /\nexport function resolveEffectiveFieldPortabilityProvenance(\n fieldSchema: z.ZodTypeAny,\n resourceDefaultProvenance: DataPortabilityProvenance \| undefined,\n fieldLocator: string,\n): DataPortabilityProvenance \| undefined {\n const declared = getPortabilityProvenance(fieldSchema);\n\n if (declared === undefined) {\n return resourceDefaultProvenance;\n }\n\n if (!KNOWN_PORTABILITY_PROVENANCES.has(declared)) {\n throw new Error(\n `[${fieldLocator}] portabilityProvenance('${declared}') is not a DataPortabilityProvenance `\n + `value. Expected one of: ${[...KNOWN_PORTABILITY_PROVENANCES].join(', ')}. An unrecognised `\n + `value would resolve as UNDECLARED and make an Art. 20 export refuse, hiding the typo `\n + `behind what looks like a deliberate omission.`,\n );\n }\n\n return declared as DataPortabilityProvenance;\n}\n\n/* Why a compiled leaf-field decision has its effective export meaning. /\nexport enum SubjectExportFieldDecisionBasis {\n FIELD_DECLARATION = 'field_declaration',\n RESOURCE_DEFAULT = 'resource_default',\n WITHHELD_NON_DISCLOSABLE = 'withheld_non_disclosable',\n UNDECLARED = 'undeclared',\n DEPTH_LIMIT = 'depth_limit',\n}\n\n/* Canonical, runtime-effective decision for one leaf path in one export purpose. /\nexport interface SubjectExportFieldDecision {\n readonly locator: string;\n readonly purpose: SubjectExportPurpose;\n readonly scope: SubjectExportFieldScope \| null;\n readonly provenance: DataPortabilityProvenance \| null;\n readonly basis: SubjectExportFieldDecisionBasis;\n}\n\nconst SUBJECT_EXPORT_FIELD_MAX_DEPTH = 10;\n\n/\n Resolve an object shape through the same bounded wrapper protocol used by subject export.\n * Returning `undefined` means the value is a leaf. Reaching the bound is handled fail-closed by\n * {@link compileSubjectExportFieldDecisions}, never as an implicit leaf inclusion.\n /\nexport function resolveSubjectExportObjectShapeThroughWrappers(schema: unknown): Record<string, unknown> \| undefined {\n let current: any = schema;\n for (let unwrapDepth = 0; current && unwrapDepth < SUBJECT_EXPORT_FIELD_MAX_DEPTH; unwrapDepth += 1) {\n if (current.shape && typeof current.shape === 'object') return current.shape as Record<string, unknown>;\n const inner = current.def?.innerType ?? current._def?.innerType;\n if (!inner) return undefined;\n current = inner;\n }\n return undefined;\n}\n\n/\n Compile every runtime-effective leaf-field decision for one resource and right.\n \n Both the backend executor and application authority proof consume this function. A field-level\n * decorator, inherited default, withheld marker, wrapper layout or depth refusal therefore changes\n * one shared decision inventory instead of two independently maintained interpretations.\n /\nexport function compileSubjectExportFieldDecisions(input: {\n readonly resourceType: ResourceType;\n readonly mainSchema: unknown;\n readonly defaultProvenance: DataPortabilityProvenance \| undefined;\n readonly purpose: SubjectExportPurpose;\n}): SubjectExportFieldDecision[] {\n const rootShape = resolveSubjectExportObjectShapeThroughWrappers(input.mainSchema);\n if (!rootShape) return [];\n const decisions: SubjectExportFieldDecision[] = [];\n\n const visit = (shape: Record<string, unknown>, locatorPrefix: string, depth: number): void => {\n for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n const locator = `${locatorPrefix}.${fieldName}`;\n if (depth >= SUBJECT_EXPORT_FIELD_MAX_DEPTH) {\n decisions.push({\n locator,\n purpose: input.purpose,\n scope: SubjectExportFieldScope.UNDECLARED,\n provenance: null,\n basis: SubjectExportFieldDecisionBasis.DEPTH_LIMIT,\n });\n continue;\n }\n if (isFieldWithheldFromSubjectExport(fieldSchema as z.ZodTypeAny)) {\n decisions.push({\n locator,\n purpose: input.purpose,\n scope: null,\n provenance: null,\n basis: SubjectExportFieldDecisionBasis.WITHHELD_NON_DISCLOSABLE,\n });\n continue;\n }\n const nestedShape = resolveSubjectExportObjectShapeThroughWrappers(fieldSchema);\n if (nestedShape) {\n visit(nestedShape, locator, depth + 1);\n continue;\n }\n const declared = getPortabilityProvenance(fieldSchema as z.ZodTypeAny);\n const provenance = resolveEffectiveFieldPortabilityProvenance(fieldSchema as z.ZodTypeAny, input.defaultProvenance, locator);\n decisions.push({\n locator,\n purpose: input.purpose,\n scope: resolveSubjectExportFieldScope(provenance, input.purpose),\n provenance: provenance ?? null,\n basis: declared !== undefined\n ? SubjectExportFieldDecisionBasis.FIELD_DECLARATION\n : provenance !== undefined\n ? SubjectExportFieldDecisionBasis.RESOURCE_DEFAULT\n : SubjectExportFieldDecisionBasis.UNDECLARED,\n });\n }\n };\n\n visit(rootShape, String(input.resourceType), 0);\n return decisions.sort((left, right) => compareCanonicalText(left.locator, right.locator));\n}\n\n/* Per-edge outcome of an executed export — the classification plus what actually happened. /\nexport interface SubjectExportEdgeOutcome extends SubjectExportEdgeClassification {\n /\n `true` when the export actually queried this edge. Note this reports that the read RAN, not\n * that rows existed — an included edge with no rows for this subject is a legitimate empty\n * result, and {@link recordCount} distinguishes the two.\n /\n collected: boolean;\n /* How many rows this edge contributed. `0` on an included edge means the subject had none. /\n recordCount: number;\n}\n\n/\n What one subject export produced — the compliance artifact of an Art. 15 or Art. 20 request.\n \n Returned to the caller (rather than only logged) so the flow fronting the request can record or\n * surface it: every edge of the subject appears exactly once with the disposition applied and the\n * configuration that justified it. For a disclosure obligation, the record of what was DELIBERATELY\n * LEFT OUT — and on what legal basis — matters as much as the data returned.\n /\nexport interface SubjectExportReport {\n /* Which right this export answered. /\n purpose: SubjectExportPurpose;\n /* The exported subject's resource type. /\n subjectResourceType: ResourceType;\n /* The exported subject rows. /\n subjectIds: string[];\n /* Every child-direction edge of the subject, classified, in registry order. /\n edges: SubjectExportEdgeOutcome[];\n /\n Fields omitted from the bundle as controller-DERIVED, as `resourceType.fieldName`. Populated\n * only for `PORTABILITY_ART_20`. Recorded rather than silently dropped so the subject can see\n * that derived data exists and request it under Art. 15 instead.\n /\n fieldsExcludedAsDerived: string[];\n /\n Fields withheld as NON-DISCLOSABLE regardless of purpose — see\n * {@link isFieldWithheldFromSubjectExport}. Populated for BOTH rights, because a password hash is\n * no more disclosable under Art. 15 than under Art. 20.\n \n Recorded rather than silently dropped for the same reason as the derived list, and one more: a\n * reviewer auditing why an export looks thin needs to see that the framework withheld something\n * deliberately, not that a resource was missed.\n /\n fieldsWithheldAsNonDisclosable: string[];\n /* Total rows across every collected edge, including the subject's own row(s). /\n totalRecordCount: number;\n}\n\n/* One resource's contribution to an export bundle. /\nexport interface SubjectExportResourceSlice {\n resourceType: ResourceType;\n /\n The rows, already narrowed to the fields in scope for the export's purpose. For\n * `PORTABILITY_ART_20` the controller-derived columns are gone; for `ACCESS_ART_15` every column\n * the subject is entitled to see is present.\n /\n rows: Record<string, unknown>[];\n}\n\n/\n What an export ACTUALLY produced — the data, paired with the report that justifies its shape.\n \n ## Why the data and the report are one return value but two types\n \n {@link SubjectExportReport} is the compliance artifact: it survives the request, is safe to log\n * and persist, and contains NO personal data — only per-edge dispositions and counts. The slices\n * are the personal data itself, which must NOT be logged and whose lifetime ends when the artifact\n * is written.\n \n Returning them together keeps the caller from having to correlate two results, while the type\n * split keeps \"safe to record\" and \"must be handled carefully\" visibly distinct — a caller writing\n * `logger.info({ report })` is correct, and the same line with `bundle` would be a leak. Fusing\n * them into one flat object would erase exactly that distinction.\n */\nexport interface SubjectExportBundle {\n report: SubjectExportReport;\n slices: SubjectExportResourceSlice[];\n}\n"]}

package/dist/esm/config/analytics-value-moments.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"analytics-value-moments.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/config/analytics-value-moments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;IACzC,KAAK,UAAU;IACf,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,mBAAmB,wBAAwB;IAC3C,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;CACtC;AAED,mHAAmH;AACnH,eAAO,MAAM,yBAAyB,EAAG,cAAuB,CAAC;AAEjE,6DAA6D;AAC7D,eAAO,MAAM,iCAAiC,EAAG,eAAwB,CAAC;AAE1E,2DAA2D;AAC3D,oBAAY,sBAAsB;IAChC,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,0DAA0D;AAC1D,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,qCAAqC,EAAG,2BAAoC,CAAC;AAI1F,oBAAY,eAAe;IACzB,kBAAkB,uBAAuB;IACzC,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAID;;;GAGG;AACH,eAAO,MAAM,wBAAwB,oGAGpC,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAuD1E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,eAAe;IACzB,4DAA4D;IAC5D,GAAG,QAAQ;IACX,+CAA+C;IAC/C,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,eAAe;IACzB,qFAAqF;IACrF,IAAI,SAAS;IACb,sDAAsD;IACtD,UAAU,eAAe;IACzB,+CAA+C;IAC/C,UAAU,eAAe;IACzB,uEAAuE;IACvE,YAAY,iBAAiB;CAC9B;AAED;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,sCAAsC;IACtC,IAAI,SAAS;IACb,oCAAoC;IACpC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,yBAAyB;;;iBAWpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAI5E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiD5B,CAAC;AACH,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
1	+ {"version":3,"file":"analytics-value-moments.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/analytics-value-moments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,SAAS,cAAc;IACvB,kBAAkB,uBAAuB;IACzC,KAAK,UAAU;IACf,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,mBAAmB,wBAAwB;IAC3C,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;CACtC;AAED,mHAAmH;AACnH,eAAO,MAAM,yBAAyB,EAAG,cAAuB,CAAC;AAEjE,6DAA6D;AAC7D,eAAO,MAAM,iCAAiC,EAAG,eAAwB,CAAC;AAE1E,2DAA2D;AAC3D,oBAAY,sBAAsB;IAChC,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,0DAA0D;AAC1D,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,qCAAqC,EAAG,2BAAoC,CAAC;AAI1F,oBAAY,eAAe;IACzB,kBAAkB,uBAAuB;IACzC,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAID;;;GAGG;AACH,eAAO,MAAM,wBAAwB,oGAGpC,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAuD1E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,eAAe;IACzB,4DAA4D;IAC5D,GAAG,QAAQ;IACX,+CAA+C;IAC/C,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,eAAe;IACzB,qFAAqF;IACrF,IAAI,SAAS;IACb,sDAAsD;IACtD,UAAU,eAAe;IACzB,+CAA+C;IAC/C,UAAU,eAAe;IACzB,uEAAuE;IACvE,YAAY,iBAAiB;CAC9B;AAED;;;GAGG;AACH,oBAAY,gBAAgB;IAC1B,sCAAsC;IACtC,IAAI,SAAS;IACb,oCAAoC;IACpC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,yBAAyB;;;iBAWpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAI5E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiD5B,CAAC;AACH,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}