@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/compliance/privacy/subject-erasure.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-erasure.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iDAAiD,CAAC;AAGzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,yBAkDX;AAlDD,WAAY,yBAAyB;IACnC;;;;;OAKG;IACH,8CAAiB,CAAA;IAEjB;;;;OAIG;IACH,kFAAqD,CAAA;IAErD;;;;;;;;OAQG;IACH,gFAAmD,CAAA;IAEnD;;;;;OAKG;IACH,oDAAuB,CAAA;IAEvB;;;;;OAKG;IACH,0DAA6B,CAAA;IAE7B;;;;;OAKG;IACH,0EAA6C,CAAA;AAC/C,CAAC,EAlDW,yBAAyB,KAAzB,yBAAyB,QAkDpC;AAgBD,oEAAoE;AACpE,MAAM,qBAAqB,GAA2C,IAAI,GAAG,CAAC;IAC5E,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,oBAAoB;CAC/C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAsC;IAEtC,OAAO,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,iCAAiC,CAC/C,YAAkC;IAElC,MAAM,iBAAiB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACrE,MAAM,QAAQ,GAAG,CACf,WAAsC,EACtC,MAAc,EACoB,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpF,gGAAgG;IAChG,+FAA+F;IAC/F,uDAAuD;IACvD,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,yBAAyB,CAAC,SAAS,EACnC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,yBAAyB,CAAC,SAAS,EACnC,0BAA0B,cAAc,2CAA2C;YACjF,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,oBAAoB;IACpB,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAC3F,YAAY,CACb,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,QAAQ,CACb,yBAAyB,CAAC,YAAY,EACtC,2FAA2F;YACzF,oFAAoF;YACpF,0FAA0F;YAC1F,oFAAoF;YACpF,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,QAAQ,CACb,yBAAyB,CAAC,uBAAuB,EACjD,0FAA0F;YACxF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,kBAAkB,CAAC,SAAS,CAAC;IACjE,IAAI,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,QAAQ,CACb,yBAAyB,CAAC,oBAAoB,EAC9C,2BAA2B,IAAI,6DAA6D;YAC1F,yFAAyF;YACzF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,IAAI,sBAAsB,CAAC,MAAM,CAAC;IAC1E,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,sBAAsB,CAAC,MAAM;YAChC,OAAO,QAAQ,CACb,yBAAyB,CAAC,MAAM,EAChC,0FAA0F;gBACxF,4CAA4C,CAC/C,CAAC;QAEJ,KAAK,sBAAsB,CAAC,wBAAwB;YAClD,OAAO,QAAQ,CACb,yBAAyB,CAAC,wBAAwB,EAClD,0FAA0F;gBACxF,6EAA6E,CAChF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,6FAA6F;YAC7F,mFAAmF;YACnF,MAAM,wBAAwB,GAAU,QAAQ,CAAC;YACjD,OAAO,QAAQ,CACb,yBAAyB,CAAC,YAAY,EACtC,uDAAuD;gBACrD,IAAI,MAAM,CAAC,wBAAwB,CAAC,uCAAuC,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AA0BD;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kCA4CX;AA5CD,WAAY,kCAAkC;IAC5C,sEAAsE;IACtE,6DAAuB,CAAA;IACvB;;;;OAIG;IACH,2EAAqC,CAAA;IACrC;;;;OAIG;IACH,yDAAmB,CAAA;IACnB,mGAAmG;IACnG,uDAAiB,CAAA;IACjB;;;OAGG;IACH,uEAAiC,CAAA;IAEjC;;;;;;;OAOG;IACH,2FAAqD,CAAA;IAErD;;;;;;;;;OASG;IACH,2FAAqD,CAAA;AACvD,CAAC,EA5CW,kCAAkC,KAAlC,kCAAkC,QA4C7C;AAED,gGAAgG;AAChG,MAAM,UAAU,wCAAwC,CACtD,MAA0C;IAE1C,OAAO,MAAM,KAAK,kCAAkC,CAAC,OAAO;WACvD,MAAM,KAAK,kCAAkC,CAAC,MAAM;WACpD,MAAM,KAAK,kCAAkC,CAAC,cAAc;QAC/D,4FAA4F;QAC5F,kFAAkF;WAC/E,MAAM,KAAK,kCAAkC,CAAC,wBAAwB,CAAC;AAC9E,CAAC","sourcesContent":["import {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport {\n  ChildLifecycleMode,\n  ChildLifecycleStrategy,\n} from '../../resources/child-operations.shared.schemas';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\n\n/**\n * What a SUBJECT ERASURE does to one child-direction edge of the subject.\n *\n * ## Why this vocabulary exists at all\n *\n * \"Erase this subject\" (a `delete my account` request) is not \"delete this row\". The subject row\n * SURVIVES — scrubbed and marked `RETAINED` — so that foreign keys from legally-retained financial\n * rows keep resolving to an anonymized person. But the subject's OWN dependents must each be\n * disposed of, and the disposition differs per edge: a profile holding a name and an avatar has to\n * go, an invoice has to stay, an audit log was never the subject's to begin with.\n *\n * This enum is the closed set of answers, and it is deliberately WIDER than the two teardown\n * strategies of {@link ChildLifecycleStrategy}: the delete cascade only ever asks about edges that\n * opted IN (`onParentDelete.enabled === true`) and silently ignores the rest, whereas an erasure\n * must account for EVERY edge — including the ones nobody opted in — because an edge nobody thought\n * about is exactly where personal data survives an erasure unnoticed.\n *\n * Two members therefore have no runtime action and exist to make the erasure FAIL LOUD\n * ({@link UNCLASSIFIED}, {@link UNSUPPORTED_DEFERRED}), and two describe leaving a row alone for\n * two genuinely different reasons ({@link RETAINED_BY_DECLARATION} vs {@link NOT_OWNED}). Those two\n * are not merged despite sharing a no-op: a data-protection reviewer asking \"why is this row still\n * here?\" needs \"because the author declared it retained\" and \"because it was never the subject's\n * row\" to be different answers, and only the first one is a compliance claim someone made.\n */\nexport enum SubjectErasureDisposition {\n  /**\n   * Hard-delete the child rows. The author declared this dependent's data dies with the parent's\n   * ownership (`onParentDelete.enabled`, `strategy: DELETE`) — on an erasure the ownership ends in\n   * the only way that matters for personal data, so the rows go. This is the `USER_PROFILES` case:\n   * there is no legal obligation to retain a name, a bio or an avatar.\n   */\n  DELETE = 'delete',\n\n  /**\n   * Scrub the child rows' personal fields in place and KEEP them, flipping `retentionStatus` to\n   * `RETAINED` (`onParentDelete.strategy = IMPERSONALIZE_AND_RETAIN`). For a dependent that must\n   * survive for a legal/audit obligation while holding personal data of its own.\n   */\n  IMPERSONALIZE_AND_RETAIN = 'impersonalize_and_retain',\n\n  /**\n   * LEAVE THE ROWS EXACTLY AS THEY ARE — a dependent whose cascade the author explicitly DISABLED\n   * (`onParentDelete.enabled: false`). That declaration says \"this row survives its parent's\n   * teardown\", which is a positive compliance claim, not an omission.\n   *\n   * This is how the retained billing rows are expressed: subscriptions, invoice refs, usage records\n   * and credit pools each disable the cascade, keep their financial audit trail fully VISIBLE, and\n   * rely on the erased subject row still resolving their foreign keys.\n   */\n  RETAINED_BY_DECLARATION = 'retained_by_declaration',\n\n  /**\n   * LEAVE THE ROWS ALONE — the edge is not an ownership edge at all\n   * (`lifecycleModelMode` is `INDEPENDENT` or `LINK_ONLY`, or the relationship is disabled). The\n   * related rows live independently of the subject, so their disposition is not the subject's\n   * erasure to decide (audit logs, job executions, membership links).\n   */\n  NOT_OWNED = 'not_owned',\n\n  /**\n   * ⛔ NO ANSWER — a DEPENDENT child with NO `onParentDelete` declaration whatsoever. The author\n   * owns this dependent's lifecycle but never said what happens to it, and an erasure must not\n   * guess: deleting could destroy data a retention obligation required keeping, and leaving could\n   * strand personal data that the erasure claimed to have removed. The orchestrator throws.\n   */\n  UNCLASSIFIED = 'unclassified',\n\n  /**\n   * ⛔ DECLARED BUT NOT EXECUTABLE AS PART OF AN ERASURE — the edge opted in with\n   * `mode: LAZY` (queue the teardown for later). Deferring is a legitimate performance choice for a\n   * parent delete, but it would let an erasure report success while the subject's personal data is\n   * still live in a queue nobody is watching. The orchestrator throws.\n   */\n  UNSUPPORTED_DEFERRED = 'unsupported_deferred',\n}\n\n/** The classification of ONE child-direction edge of an erasure subject. */\nexport interface SubjectErasureEdgeClassification {\n  /** The dependent resource on the far side of the edge. */\n  childResourceType: ResourceType;\n  /** What the erasure will do with that dependent's rows. */\n  disposition: SubjectErasureDisposition;\n  /**\n   * Human-readable justification, quoting the configuration that produced it. Surfaced in the\n   * erasure report and in the fail-loud error, so an operator never has to re-derive WHY a row was\n   * deleted, retained, or refused.\n   */\n  reason: string;\n}\n\n/** Dispositions that ABORT the erasure rather than executing it. */\nconst BLOCKING_DISPOSITIONS: ReadonlySet<SubjectErasureDisposition> = new Set([\n  SubjectErasureDisposition.UNCLASSIFIED,\n  SubjectErasureDisposition.UNSUPPORTED_DEFERRED,\n]);\n\n/**\n * True when a disposition must stop the erasure before any write lands.\n *\n * Exported (rather than inlined at the one call site) so a future boot-time guard — the erasure\n * analogue of `validateCompositionCascadeDeletability` — reports exactly the edges the runtime\n * would refuse, instead of re-deriving the rule and drifting from it.\n */\nexport function isBlockingSubjectErasureDisposition(\n  disposition: SubjectErasureDisposition,\n): boolean {\n  return BLOCKING_DISPOSITIONS.has(disposition);\n}\n\n/**\n * Classify what a subject erasure must do with ONE child-direction edge — the delete-vs-retain\n * decision, DERIVED FROM CONFIGURATION rather than from a hardcoded list of resource types.\n *\n * ## Where the answer comes from\n *\n * Two declarations the author already makes, read through the SAME shared authority the runtime\n * delete cascade reads (`resolveRelationshipLifecycleOnParentDeleteConfig`), so the erasure and the\n * cascade can never disagree about what an edge says:\n *\n *  1. **`handling.lifecycleModelMode`** — does the subject own this dependent's lifecycle at all?\n *     `INDEPENDENT` / `LINK_ONLY` answers \"no\", and the erasure leaves those rows alone.\n *  2. **`childOperations.lifecycle.onParentDelete`** — for an owned dependent, what did the author\n *     declare happens when the parent stops owning it: hard-delete, scrub-and-retain, or nothing.\n *\n * ## The semantic caveat, stated plainly\n *\n * `onParentDelete` literally answers \"what happens when the parent row is DELETED\", and an erasure\n * does NOT delete the subject — it scrubs and keeps it. v1 deliberately treats the two questions as\n * one because they have the same answer for every edge in the shipped registry, and because an\n * author who declared \"this dependent dies with its parent\" has already said the thing that\n * matters: the dependent's data has no life of its own once the subject's does not.\n *\n * They are NOT the same question though, and the day a resource needs to answer them differently\n * (retain a dependent on erasure that it hard-deletes on parent-delete, or the reverse) the\n * expressible extension is a sibling `onSubjectErasure` axis on the same edge, defaulting to this\n * derivation. Adding that axis speculatively now would give app authors a second knob with no\n * consumer and two ways to say the same thing.\n *\n * Pure and side-effect free — no registry lookups, no I/O — so it is equally usable from a runtime\n * orchestrator and from a boot-time guard.\n */\nexport function classifySubjectErasureDisposition(\n  relationship: ResourceRelationship,\n): SubjectErasureEdgeClassification {\n  const childResourceType = relationship.resourceType2 as ResourceType;\n  const classify = (\n    disposition: SubjectErasureDisposition,\n    reason: string,\n  ): SubjectErasureEdgeClassification => ({ childResourceType, disposition, reason });\n\n  // A disabled relationship is not part of the live graph — the runtime never traverses it, so an\n  // erasure must not refuse to run because of it (the alternative would be a permanently blocked\n  // erasure on a resource carrying a switched-off edge).\n  if (relationship.isDisabled === true) {\n    return classify(\n      SubjectErasureDisposition.NOT_OWNED,\n      'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n    );\n  }\n\n  const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n  const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n  if (lifecycleModel !== RelationshipLifecycleModel.DEPENDENT) {\n    return classify(\n      SubjectErasureDisposition.NOT_OWNED,\n      `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): the related rows live ` +\n        `independently of the subject, so their disposition is not this erasure's decision`,\n    );\n  }\n\n  // DEPENDENT from here on: the subject owns this dependent's lifecycle, so the erasure MUST have\n  // an answer for it.\n  const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(\n    relationship,\n  );\n\n  if (!onParentDelete) {\n    return classify(\n      SubjectErasureDisposition.UNCLASSIFIED,\n      `the subject owns this dependent (lifecycleModelMode: DEPENDENT) but the edge declares no ` +\n        `onParentDelete lifecycle, so nobody has said whether its rows survive an erasure. ` +\n        `Declare onParentDelete on the edge: 'enabled: true' with strategy DELETE (the rows hold ` +\n        `no retainable value) or IMPERSONALIZE_AND_RETAIN (they must survive scrubbed), or ` +\n        `'enabled: false' to state explicitly that they survive intact`,\n    );\n  }\n\n  if (onParentDelete.enabled !== true) {\n    return classify(\n      SubjectErasureDisposition.RETAINED_BY_DECLARATION,\n      'onParentDelete.enabled is false: the author declared these rows survive their parent\\'s ' +\n        'teardown, so the erasure leaves them intact',\n    );\n  }\n\n  const mode = onParentDelete.mode ?? ChildLifecycleMode.IMMEDIATE;\n  if (mode !== ChildLifecycleMode.IMMEDIATE) {\n    return classify(\n      SubjectErasureDisposition.UNSUPPORTED_DEFERRED,\n      `onParentDelete.mode is '${mode}': deferring the teardown to a queue would let the erasure ` +\n        `report success while the subject's personal data is still live. Set mode: IMMEDIATE on ` +\n        `this edge for it to participate in a subject erasure`,\n    );\n  }\n\n  const strategy = onParentDelete.strategy ?? ChildLifecycleStrategy.DELETE;\n  switch (strategy) {\n    case ChildLifecycleStrategy.DELETE:\n      return classify(\n        SubjectErasureDisposition.DELETE,\n        'onParentDelete declares strategy DELETE: the dependent\\'s data dies with the subject\\'s ' +\n          'ownership, so the erasure removes the rows',\n      );\n\n    case ChildLifecycleStrategy.IMPERSONALIZE_AND_RETAIN:\n      return classify(\n        SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN,\n        'onParentDelete declares strategy IMPERSONALIZE_AND_RETAIN: the rows survive the erasure ' +\n          'with their personal fields scrubbed and retentionStatus flipped to RETAINED',\n      );\n\n    default: {\n      // Compile-time exhaustiveness: a new ChildLifecycleStrategy member without an erasure arm is\n      // a TYPE error here, not a silent runtime discovery on someone's deletion request.\n      const _exhaustiveStrategyCheck: never = strategy;\n      return classify(\n        SubjectErasureDisposition.UNCLASSIFIED,\n        `onParentDelete declares an unknown teardown strategy ` +\n          `'${String(_exhaustiveStrategyCheck)}' that subject erasure has no arm for`,\n      );\n    }\n  }\n}\n\n/** Per-edge outcome of an executed erasure — the classification plus what actually happened. */\nexport interface SubjectErasureEdgeOutcome extends SubjectErasureEdgeClassification {\n  /**\n   * `true` when the erasure ran a teardown for this edge.\n   *\n   * Reports that the teardown RAN, not that rows existed — discovery finding no dependents is a\n   * teardown that ran with nothing to do, and is `true`.\n   *\n   * **Read it together with `disposition`, because `false` has two very different meanings:**\n   *\n   * - a NON-executing disposition (`RETAINED_BY_DECLARATION`, `NOT_OWNED`) ⇒ the erasure deliberately\n   *   left the rows alone, and `false` is the expected, correct answer;\n   * - an EXECUTING disposition (`DELETE`, `IMPERSONALIZE_AND_RETAIN`) ⇒ the cascade DECLINED the edge\n   *   (the child had no registered service or repository, or the depth budget was spent). The\n   *   subject's data is partly still live. This pairing should never appear in a healthy system; it is\n   *   logged at ERROR when it happens, with the missing registration named.\n   *\n   * ⚠️ This flag was set unconditionally until 2026-08-11 — it meant \"the dispatcher returned without\n   * throwing\" and reported a skipped edge as torn down. Anything persisted before that date overstates\n   * what was erased. Treat this field as evidence only for reports produced after the fix.\n   */\n  executed: boolean;\n}\n\n/**\n * Outcome of one EXTERNAL, non-transactional erasure effect (a third-party provider the subject's\n * personal data also reached — a billing provider customer, say).\n *\n * A separate vocabulary from {@link SubjectErasureDisposition} on purpose. An edge disposition\n * describes a decision derived from configuration BEFORE anything ran, and its teardown is part of\n * the database transaction. An external effect is the opposite on both counts: it is discovered by\n * calling out to a system Wildo does not own, and it CANNOT join the transaction. Collapsing the\n * two would let a caller read \"the erasure succeeded\" from a value that only ever described the\n * local rows.\n */\nexport enum SubjectErasureExternalEffectStatus {\n  /** Every step of the effect completed against the external system. */\n  COMPLETED = 'completed',\n  /**\n   * The subject had nothing at this external system — no provider customer, no linked record. A\n   * legitimate success, kept DISTINCT from `COMPLETED` so \"there was nothing to erase\" can never be\n   * mistaken for \"we erased it\", which is exactly the confusion a regulator would probe.\n   */\n  NOTHING_TO_ERASE = 'nothing-to-erase',\n  /**\n   * The effect ran and some steps succeeded while others failed — personal data may still be live\n   * at the external system. The loudest state in this enum: it demands follow-up, and it is why the\n   * status is not a boolean.\n   */\n  PARTIAL = 'partial',\n  /** The effect could not run at all (provider unreachable, not configured). Nothing was changed. */\n  FAILED = 'failed',\n  /**\n   * No handler was registered for this effect. Distinct from `NOTHING_TO_ERASE`: that means we\n   * looked and found nothing, this means nobody looked.\n   */\n  NOT_REGISTERED = 'not-registered',\n\n  /**\n   * The external system's binding DECLARES its rows hold no personal/subject data\n   * (`HttpApiErasureStance.NO_SUBJECT_DATA`, ETL D6 stance 6a) — nothing was erased because,\n   * by declaration, there is nothing an erasure could apply to. Distinct from\n   * {@link NOTHING_TO_ERASE}: that means we LOOKED and found no linked rows; this means the\n   * declaration made looking unnecessary. A complete outcome — the declaration's coherence is\n   * validated at boot (a 6a resource cannot participate in subject export).\n   */\n  DECLARED_NO_SUBJECT_DATA = 'declared-no-subject-data',\n\n  /**\n   * The rows live in an external system the platform cannot erase, and the CONTROLLER explicitly\n   * acknowledged completing the erasure anyway (`HttpApiErasureStance.\n   * CONTROLLER_ACKNOWLEDGED_NON_ERASURE`, ETL D6 stance 6c — the per-request\n   * `acknowledgeHttpApiNonErasure` option). Deliberately INCOMPLETE in\n   * {@link isIncompleteSubjectErasureExternalEffect}: the subject's data is still live at the\n   * third party, and a compliance artifact must say so however deliberate the decision was. The\n   * acknowledgement itself is additionally recorded as a CRITICAL audit event — the record is\n   * the control (`administrative-continuity-floors.md`).\n   */\n  ACKNOWLEDGED_NON_ERASURE = 'acknowledged-non-erasure',\n}\n\n/** Whether an external-effect status leaves personal data potentially live at a third party. */\nexport function isIncompleteSubjectErasureExternalEffect(\n  status: SubjectErasureExternalEffectStatus,\n): boolean {\n  return status === SubjectErasureExternalEffectStatus.PARTIAL\n    || status === SubjectErasureExternalEffectStatus.FAILED\n    || status === SubjectErasureExternalEffectStatus.NOT_REGISTERED\n    // An acknowledged non-erasure is a DELIBERATE hole, and still a hole: personal data remains\n    // live at the third party, so \"is this erasure actually complete\" must answer no.\n    || status === SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE;\n}\n\nexport interface SubjectErasureExternalEffectOutcome {\n  /** Stable identifier of the effect, e.g. `'billing-provider'`. */\n  effectRef: string;\n  status: SubjectErasureExternalEffectStatus;\n  /**\n   * Human-readable account of what ran, for the compliance artifact. On `PARTIAL` / `FAILED` this\n   * must name what did NOT happen — the report is the only place that survives the request.\n   */\n  detail: string;\n  /**\n   * Per-step results, so a partial outcome is actionable rather than merely alarming (which step\n   * against which external id). Never carries personal data — ids and step names only.\n   */\n  steps?: Array<{ step: string; targetRef?: string; succeeded: boolean; error?: string }>;\n}\n\n/**\n * What one subject erasure did — the compliance artifact of a \"delete my account\" request.\n *\n * Returned to the caller (rather than only logged) so the flow that fronts the request can record\n * or surface it: every edge of the subject appears exactly once with the disposition applied and\n * the configuration that justified it, which is the evidence a data-protection response needs.\n */\nexport interface SubjectErasureReport {\n  /** The erased subject's resource type. */\n  subjectResourceType: ResourceType;\n  /** The erased subject rows. */\n  subjectIds: string[];\n  /** Every child-direction edge of the subject, classified, in registry order. */\n  edges: SubjectErasureEdgeOutcome[];\n  /**\n   * `true` once the subject rows themselves were scrubbed and flipped to `RETAINED`. Always `true`\n   * on a successful erasure — an erasure that could not retain its subject throws rather than\n   * returning a report.\n   */\n  subjectImpersonalized: boolean;\n  /**\n   * Outcomes of the external, non-transactional effects the erasure triggered — every SYSTEM WE\n   * DO NOT OWN that the subject's personal data reached: registered effect handlers (a billing\n   * provider), and each HTTP_API-bound resource linked to the subject (one entry per resource,\n   * `effectRef: 'http-api:<resourceType>'`, carrying its declared D6 erasure stance's outcome).\n   *\n   * Empty when no effect was registered for the subject's resource type. These run AFTER the local\n   * scrub has committed, so a failure here cannot roll the erasure back — the local data is\n   * already gone and re-running the whole erasure would be wrong. That asymmetry is precisely why\n   * the outcome is reported rather than thrown: the local part genuinely succeeded, and the caller\n   * needs to know that a third party still holds something.\n   *\n   * Check {@link isIncompleteSubjectErasureExternalEffect} over these before treating a report as a\n   * complete erasure.\n   */\n  /**\n   * Whose sessions this erasure ended, and whether resolving them failed.\n   *\n   * A LOCAL fact, not an external effect: the revocation is a write to our own session fence, applied\n   * at the scrub chokepoint so it covers every path that scrubs a person's row. It is recorded here\n   * because \"the erased person can no longer be logged in\" is exactly what a data-protection response\n   * has to be able to evidence.\n   *\n   * `lookupFailed` is kept distinct from an empty `principalUserIds`: no principals is a legitimate\n   * outcome (the resource declared `NO_PRINCIPAL`), whereas a failed lookup means the person may\n   * still hold a live session — and the two must never look alike in a compliance artifact.\n   */\n  sessionRevocation?: {\n    principalUserIds: string[];\n    lookupFailed: boolean;\n  };\n  externalEffects: SubjectErasureExternalEffectOutcome[];\n}\n"]}
+{"version":3,"file":"subject-erasure.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,yBAoEX;AApED,WAAY,yBAAyB;IACnC;;;;;OAKG;IACH,8CAAiB,CAAA;IAEjB;;;;OAIG;IACH,kFAAqD,CAAA;IAErD;;;;;;;;OAQG;IACH,gFAAmD,CAAA;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,oFAAuD,CAAA;IAEvD;;;;;OAKG;IACH,oDAAuB,CAAA;IAEvB;;;;;OAKG;IACH,0DAA6B,CAAA;IAE7B;;;;;OAKG;IACH,0EAA6C,CAAA;AAC/C,CAAC,EApEW,yBAAyB,KAAzB,yBAAyB,QAoEpC;AA+BD,oEAAoE;AACpE,MAAM,qBAAqB,GAA2C,IAAI,GAAG,CAAC;IAC5E,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,oBAAoB;CAC/C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAsC;IAEtC,OAAO,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,UAAU,iCAAiC,CAC/C,YAAkC,EAClC,2BAEwD;IAExD,MAAM,iBAAiB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACrE,MAAM,QAAQ,GAAG,CACf,WAAsC,EACtC,MAAc,EACoB,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpF,gGAAgG;IAChG,+FAA+F;IAC/F,uDAAuD;IACvD,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,yBAAyB,CAAC,SAAS,EACnC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,yBAAyB,CAAC,SAAS,EACnC,0BAA0B,cAAc,2CAA2C;YACjF,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,oBAAoB;IACpB,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAC3F,YAAY,CACb,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,QAAQ,CACb,yBAAyB,CAAC,YAAY,EACtC,2FAA2F;YACzF,oFAAoF;YACpF,0FAA0F;YAC1F,oFAAoF;YACpF,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,IAAI,cAAc,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,QAAQ,CACb,yBAAyB,CAAC,uBAAuB,EACjD,0FAA0F;YACxF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,iGAAiG;IACjG,wEAAwE;IACxE,IAAI,cAAc,CAAC,QAAQ,KAAK,sBAAsB,CAAC,2BAA2B,EAAE,CAAC;QACnF,OAAO,QAAQ,CACb,yBAAyB,CAAC,yBAAyB,EACnD,gGAAgG;YAC9F,iGAAiG;YACjG,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,kBAAkB,CAAC,SAAS,CAAC;IACjE,IAAI,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,QAAQ,CACb,yBAAyB,CAAC,oBAAoB,EAC9C,2BAA2B,IAAI,6DAA6D;YAC1F,yFAAyF;YACzF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC;IACjD,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;IAE5E,IAAI,oBAAoB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAChD,MAAM,iBAAiB,GACrB,aAAa,KAAK,oBAAoB,CAAC,wBAAwB;YAC7D,CAAC,CAAC,yBAAyB,CAAC,wBAAwB;YACpD,CAAC,CAAC,yBAAyB,CAAC,uBAAuB,CAAC;QAExD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,QAAQ,CACb,iBAAiB,EACjB,qDAAqD,aAAa,2BAA2B;gBAC3F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,sFAAsF,CACzF,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;WAgBG;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,QAAQ,GAAG,gBAAgB,IAAI,sBAAsB,CAAC,MAAM,CAAC;IACnE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,sBAAsB,CAAC,MAAM;YAChC,OAAO,QAAQ,CACb,yBAAyB,CAAC,MAAM,EAChC,0FAA0F;gBACxF,4CAA4C,CAC/C,CAAC;QAEJ,KAAK,sBAAsB,CAAC,wBAAwB;YAClD,OAAO,QAAQ,CACb,yBAAyB,CAAC,wBAAwB,EAClD,0FAA0F;gBACxF,6EAA6E,CAChF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,6FAA6F;YAC7F,mFAAmF;YACnF,MAAM,wBAAwB,GAAU,QAAQ,CAAC;YACjD,OAAO,QAAQ,CACb,yBAAyB,CAAC,YAAY,EACtC,uDAAuD;gBACrD,IAAI,MAAM,CAAC,wBAAwB,CAAC,uCAAuC,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,iCAAiC,CAC/C,uBAAqC,EACrC,kCAAsG,EACtG,2BAEwD;IAExD,MAAM,OAAO,GAAuC,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,OAAO,GAAmB,CAAC,uBAAuB,CAAC,CAAC;IAE1D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,EAAG,CAAC;QAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAAE,SAAS;QACrD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAEvC,KAAK,MAAM,YAAY,IAAI,kCAAkC,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;YACxF,MAAM,cAAc,GAAG,iCAAiC,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC;YACnE,IAAI,cAAc,CAAC,WAAW,KAAK,yBAAyB,CAAC,MAAM,EAAE,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AACH,MAAM,UAAU,uCAAuC,CACrD,YAA8B;IAE9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqD,CAAC;IACpF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/D,IAAI,WAAW,KAAK,yBAAyB,CAAC,MAAM,IAAI,WAAW,KAAK,yBAAyB,CAAC,wBAAwB,EAAE,CAAC;YAC3H,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QACpH,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,WAAW,KAAK,yBAAyB,CAAC,MAAM;YAAE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YAChF,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3H,CAAC;AA2DD;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kCAmDX;AAnDD,WAAY,kCAAkC;IAC5C,sEAAsE;IACtE,6DAAuB,CAAA;IACvB;;;;OAIG;IACH,2EAAqC,CAAA;IACrC;;;;OAIG;IACH,yDAAmB,CAAA;IACnB,mGAAmG;IACnG,uDAAiB,CAAA;IACjB;;;OAGG;IACH,uEAAiC,CAAA;IAEjC;;;;OAIG;IACH,+DAAyB,CAAA;IAEzB;;;;;;;OAOG;IACH,2FAAqD,CAAA;IAErD;;;;;;;;;OASG;IACH,2FAAqD,CAAA;AACvD,CAAC,EAnDW,kCAAkC,KAAlC,kCAAkC,QAmD7C;AAED,gGAAgG;AAChG,MAAM,UAAU,wCAAwC,CACtD,MAA0C;IAE1C,OAAO,MAAM,KAAK,kCAAkC,CAAC,OAAO;WACvD,MAAM,KAAK,kCAAkC,CAAC,MAAM;WACpD,MAAM,KAAK,kCAAkC,CAAC,cAAc;WAC5D,MAAM,KAAK,kCAAkC,CAAC,UAAU;QAC3D,4FAA4F;QAC5F,kFAAkF;WAC/E,MAAM,KAAK,kCAAkC,CAAC,wBAAwB,CAAC;AAC9E,CAAC;AAkFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,4CAA4C,CAC1D,YAA8B,EAC9B,2BAEwD;IAExD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,IAAI,CAAC,cAAc,CAAC,WAAW,KAAK,yBAAyB,CAAC,MAAM;WACjE,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,YAA8B,EAC9B,mBAA2B;IAE3B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,IAAI,CAAC,cAAc,CAAC,WAAW,KAAK,yBAAyB,CAAC,MAAM;WACjE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;AACtF,CAAC","sourcesContent":["import {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport {\n  ChildLifecycleMode,\n  ChildLifecycleStrategy,\n} from '../../resources/child-operations.shared.schemas';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\nimport { ErasureRetentionMode } from './impersonalization.shared.schemas';\n\n/**\n * What a SUBJECT ERASURE does to one child-direction edge of the subject.\n *\n * ## Why this vocabulary exists at all\n *\n * \"Erase this subject\" (a `delete my account` request) is not \"delete this row\". The subject row\n * SURVIVES — scrubbed and marked `RETAINED` — so that foreign keys from legally-retained financial\n * rows keep resolving to an anonymized person. But the subject's OWN dependents must each be\n * disposed of, and the disposition differs per edge: a profile holding a name and an avatar has to\n * go, an invoice has to stay, an audit log was never the subject's to begin with.\n *\n * This enum is the closed set of answers, and it is deliberately WIDER than the two teardown\n * strategies of {@link ChildLifecycleStrategy}: the delete cascade only ever asks about edges that\n * opted IN (`onParentDelete.enabled === true`) and silently ignores the rest, whereas an erasure\n * must account for EVERY edge — including the ones nobody opted in — because an edge nobody thought\n * about is exactly where personal data survives an erasure unnoticed.\n *\n * Two members therefore have no runtime action and exist to make the erasure FAIL LOUD\n * ({@link UNCLASSIFIED}, {@link UNSUPPORTED_DEFERRED}), and three describe leaving a row alone for\n * three genuinely different reasons ({@link RETAINED_BY_DECLARATION}, {@link RESTRICTED_BY_DECLARATION},\n * {@link NOT_OWNED}). They are not merged despite sharing a no-op: a data-protection reviewer asking\n * \"why is this row still here?\" needs \"because the author declared it retained\", \"because its parent\n * may not be deleted while it exists\" and \"because it was never the subject's row\" to be different\n * answers, and only the first one is a retention claim someone made.\n */\nexport enum SubjectErasureDisposition {\n  /**\n   * Hard-delete the child rows. The author declared this dependent's data dies with the parent's\n   * ownership (`onParentDelete.enabled`, `strategy: DELETE`) — on an erasure the ownership ends in\n   * the only way that matters for personal data, so the rows go. This is the `USER_PROFILES` case:\n   * there is no legal obligation to retain a name, a bio or an avatar.\n   */\n  DELETE = 'delete',\n\n  /**\n   * Scrub the child rows' personal fields in place and KEEP them, flipping `retentionStatus` to\n   * `RETAINED` (`onParentDelete.strategy = IMPERSONALIZE_AND_RETAIN`). For a dependent that must\n   * survive for a legal/audit obligation while holding personal data of its own.\n   */\n  IMPERSONALIZE_AND_RETAIN = 'impersonalize_and_retain',\n\n  /**\n   * LEAVE THE ROWS EXACTLY AS THEY ARE — a dependent whose cascade the author explicitly DISABLED\n   * (`onParentDelete.enabled: false`). That declaration says \"this row survives its parent's\n   * teardown\", which is a positive compliance claim, not an omission.\n   *\n   * This is how the retained billing rows are expressed: subscriptions, invoice refs, usage records\n   * and credit pools each disable the cascade, keep their financial audit trail fully VISIBLE, and\n   * rely on the erased subject row still resolving their foreign keys.\n   */\n  RETAINED_BY_DECLARATION = 'retained_by_declaration',\n\n  /**\n   * LEAVE THE ROWS EXACTLY AS THEY ARE — a dependent whose edge declares the RESTRICT posture\n   * (`onParentDelete.strategy: REFUSE_WHILE_CHILDREN_EXIST`): the parent's delete is refused while\n   * these rows exist, and nothing about the parent's teardown removes them.\n   *\n   * An erasure scrubs its subject in place and never deletes it, so at the direct level the refusal is\n   * never met and the rows keep resolving their foreign key, as a retained row does. Below a dependent\n   * the erasure DELETES, the same edge holding rows refuses the erasure, as a delete cascade frame does,\n   * because deleting that parent would strand them. Kept apart from\n   * {@link RETAINED_BY_DECLARATION} because the claim differs: that one says \"these rows must outlive\n   * their parent\", this one says \"their parent may not go while they exist\". The second is about\n   * referential integrity (an org-unit subtree, the provider-customer mapping a billing account holds\n   * for its financial records), not a retention obligation.\n   *\n   * Like the other leave-alone dispositions, the erasure does not walk below these rows.\n   */\n  RESTRICTED_BY_DECLARATION = 'restricted_by_declaration',\n\n  /**\n   * LEAVE THE ROWS ALONE — the edge is not an ownership edge at all\n   * (`lifecycleModelMode` is `INDEPENDENT` or `LINK_ONLY`, or the relationship is disabled). The\n   * related rows live independently of the subject, so their disposition is not the subject's\n   * erasure to decide (audit logs, job executions, membership links).\n   */\n  NOT_OWNED = 'not_owned',\n\n  /**\n   * ⛔ NO ANSWER — a DEPENDENT child with NO `onParentDelete` declaration whatsoever. The author\n   * owns this dependent's lifecycle but never said what happens to it, and an erasure must not\n   * guess: deleting could destroy data a retention obligation required keeping, and leaving could\n   * strand personal data that the erasure claimed to have removed. The orchestrator throws.\n   */\n  UNCLASSIFIED = 'unclassified',\n\n  /**\n   * ⛔ DECLARED BUT NOT EXECUTABLE AS PART OF AN ERASURE — the edge opted in with\n   * `mode: LAZY` (queue the teardown for later). Deferring is a legitimate performance choice for a\n   * parent delete, but it would let an erasure report success while the subject's personal data is\n   * still live in a queue nobody is watching. The orchestrator throws.\n   */\n  UNSUPPORTED_DEFERRED = 'unsupported_deferred',\n}\n\n/** The classification of ONE child-direction edge of an erasure subject. */\nexport interface SubjectErasureEdgeClassification {\n  /** The dependent resource on the far side of the edge. */\n  childResourceType: ResourceType;\n  /** What the erasure will do with that dependent's rows. */\n  disposition: SubjectErasureDisposition;\n  /**\n   * Human-readable justification, quoting the configuration that produced it. Surfaced in the\n   * erasure report and in the fail-loud error, so an operator never has to re-derive WHY a row was\n   * deleted, retained, or refused.\n   */\n  reason: string;\n}\n\n/**\n * The only part of a child's `retentionPolicy` an erasure classification reads (#1279).\n *\n * Structural and minimal on purpose: the classifier needs the erasure TREATMENT and nothing else, and\n * narrowing the parameter to this keeps every caller — the runtime orchestrator, the registry sweep and\n * the boot-time guards, which each hold a differently-shaped configuration record — able to answer\n * without first building a full `ResourceRetentionPolicy` it does not otherwise need.\n *\n * `mode` is optional because a caller may legitimately hold a resource entry with no retention opt-in;\n * that is the same answer as passing `undefined` and means \"this child declares no erasure treatment\".\n */\nexport interface SubjectErasureChildRetentionDeclaration {\n  readonly mode?: ErasureRetentionMode;\n}\n\n/** Dispositions that ABORT the erasure rather than executing it. */\nconst BLOCKING_DISPOSITIONS: ReadonlySet<SubjectErasureDisposition> = new Set([\n  SubjectErasureDisposition.UNCLASSIFIED,\n  SubjectErasureDisposition.UNSUPPORTED_DEFERRED,\n]);\n\n/**\n * True when a disposition must stop the erasure before any write lands.\n *\n * Exported (rather than inlined at the one call site) so a future boot-time guard — the erasure\n * analogue of `validateCompositionCascadeDeletability` — reports exactly the edges the runtime\n * would refuse, instead of re-deriving the rule and drifting from it.\n */\nexport function isBlockingSubjectErasureDisposition(\n  disposition: SubjectErasureDisposition,\n): boolean {\n  return BLOCKING_DISPOSITIONS.has(disposition);\n}\n\n/**\n * Classify what a subject erasure must do with ONE child-direction edge — the delete-vs-retain\n * decision, DERIVED FROM CONFIGURATION rather than from a hardcoded list of resource types.\n *\n * ## Where the answer comes from\n *\n * Two declarations the author already makes, read through the SAME shared authority the runtime\n * delete cascade reads (`resolveRelationshipLifecycleOnParentDeleteConfig`), so the erasure and the\n * cascade can never disagree about what an edge says:\n *\n *  1. **`handling.lifecycleModelMode`** — does the subject own this dependent's lifecycle at all?\n *     `INDEPENDENT` / `LINK_ONLY` answers \"no\", and the erasure leaves those rows alone.\n *  2. **`childOperations.lifecycle.onParentDelete`** — for an owned dependent, what did the author\n *     declare happens when the parent stops owning it: hard-delete, scrub-and-retain, or nothing.\n *\n *  3. **the child's own `retentionPolicy`** — the ONE declaration whose entire subject is this\n *     question: *\"`retentionPolicy.mode` on a resource says WHAT erasure does to a row\"*\n *     (`retention-schedule.shared.schemas.ts`). Supplied through `resolveChildRetentionPolicy` so this\n *     function stays pure.\n *\n * ## The semantic caveat — CORRECTED 2026-09-17 (#1279), and the correction is the point\n *\n * `onParentDelete` literally answers \"what happens when the parent row is DELETED\", and an erasure\n * does NOT delete the subject — it scrubs and keeps it. This function used to treat the two questions\n * as one, on a stated premise: *\"they have the same answer for every edge in the shipped registry\"*.\n *\n * **That premise was false, and it had never been measured.** Measured across `engine/`, `platform/`\n * and `examples/`: 28 edges reached a `DELETE` erasure disposition while the child resource declared\n * `retentionPolicy` — i.e. an erasure deleting rows whose own resource says an erasure keeps them.\n *\n * What made it invisible was a SCHEMA DEFAULT. `strategy` carried\n * `.default(ChildLifecycleStrategy.DELETE)`, so every parsed edge presented `strategy: 'delete'` as an\n * own property whether or not a human had ever considered the question — and **28 of those 28 edges\n * reached DELETE through that default. Not one author had written `strategy: DELETE` for a\n * retain-declaring resource.** The default was removed (see `ChildLifecycleOnDeleteConfigSchema`), so\n * absence now arrives here intact and this function can tell a decision from a silence.\n *\n * ## The precedence, which decides no legal question\n *\n * | child `retentionPolicy` | this edge's `strategy` | disposition |\n * |---|---|---|\n * | declared (retain) | **absent** | the retain treatment — the author answered the ERASURE question and nobody answered the teardown one. A default may not overrule a declaration |\n * | declared (retain) | authored `DELETE` | `CONTRADICTED_BY_DECLARATIONS` — refused |\n * | declared (retain) | authored `IMPERSONALIZE_AND_RETAIN` | they agree; the edge's arm below runs |\n * | none | anything, including absent | unchanged — no erasure declaration exists to honour |\n *\n * Note what is deliberately NOT done: \"retain wins\" is not made a blanket default over an AUTHORED\n * `DELETE`. {@link findSubjectErasureRetainDeleteConflicts} rejects exactly that reasoning for the\n * edge-vs-edge case — *it decides a legal question on the author's behalf; neither default is safe, so\n * no default* — and that rejection stands here. Deleting data a retention obligation required keeping\n * and stranding data an erasure claimed to have removed are both unsafe, and nothing in the\n * configuration says which the author meant. The only thing that changed is that a SCHEMA DEFAULT may\n * no longer impersonate an author's decision.\n *\n * A sibling `onSubjectErasure` axis on the edge was reconsidered and stays rejected: `retentionPolicy`\n * already IS the erasure axis, and adding a second one would give app authors two ways to say the same\n * thing — the objection the previous version of this note raised against it, which survives its own\n * premise being wrong.\n *\n * Pure and side-effect free — no registry lookups, no I/O — so it is equally usable from a runtime\n * orchestrator and from a boot-time guard.\n */\nexport function classifySubjectErasureDisposition(\n  relationship: ResourceRelationship,\n  resolveChildRetentionPolicy: (\n    resourceType: ResourceType,\n  ) => SubjectErasureChildRetentionDeclaration | undefined,\n): SubjectErasureEdgeClassification {\n  const childResourceType = relationship.resourceType2 as ResourceType;\n  const classify = (\n    disposition: SubjectErasureDisposition,\n    reason: string,\n  ): SubjectErasureEdgeClassification => ({ childResourceType, disposition, reason });\n\n  // A disabled relationship is not part of the live graph — the runtime never traverses it, so an\n  // erasure must not refuse to run because of it (the alternative would be a permanently blocked\n  // erasure on a resource carrying a switched-off edge).\n  if (relationship.isDisabled === true) {\n    return classify(\n      SubjectErasureDisposition.NOT_OWNED,\n      'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n    );\n  }\n\n  const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n  const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n  if (lifecycleModel !== RelationshipLifecycleModel.DEPENDENT) {\n    return classify(\n      SubjectErasureDisposition.NOT_OWNED,\n      `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): the related rows live ` +\n        `independently of the subject, so their disposition is not this erasure's decision`,\n    );\n  }\n\n  // DEPENDENT from here on: the subject owns this dependent's lifecycle, so the erasure MUST have\n  // an answer for it.\n  const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(\n    relationship,\n  );\n\n  if (!onParentDelete) {\n    return classify(\n      SubjectErasureDisposition.UNCLASSIFIED,\n      `the subject owns this dependent (lifecycleModelMode: DEPENDENT) but the edge declares no ` +\n        `onParentDelete lifecycle, so nobody has said whether its rows survive an erasure. ` +\n        `Declare onParentDelete on the edge: 'enabled: true' with strategy DELETE (the rows hold ` +\n        `no retainable value) or IMPERSONALIZE_AND_RETAIN (they must survive scrubbed), or ` +\n        `'enabled: false' to state explicitly that they survive intact`,\n    );\n  }\n\n  /*\n   * ## DECIDED 2026-09-17 (#1084): this is NOT reconciled against a DELETE path, and that is correct\n   *\n   * The question was whether a resource reached BOTH by this disposition and by a DELETE edge should\n   * be refused the way #1017 refuses `IMPERSONALIZE_AND_RETAIN` against `DELETE`. It should not, and\n   * the reason is that the two cases are not alike.\n   *\n   * #1017 refuses because TWO EXECUTED TREATMENTS disagree about the same row: one scrubs it and keeps\n   * it, the other removes it, and nothing says which wins. `enabled: false` executes nothing. The\n   * erasure never traverses this edge and never discovers these rows, so there is no competing\n   * treatment to reconcile — only one edge that acts and one that says nothing. A row with two parents\n   * that survives one teardown and dies with the other is also exactly what an ordinary parent delete\n   * does, so refusing here would make an erasure stricter than the lifecycle it is built on.\n   *\n   * Refusing was the filed recommendation and is rejected for a further reason: the #1017 refusal's own\n   * remedy tells an operator to \"disable one edge's teardown (onParentDelete.enabled: false)\". Treating\n   * the result as a new conflict would make the documented remedy produce the next refusal.\n   *\n   * What this disposition means is therefore narrower than its name suggests, and worth saying plainly:\n   * it records that THIS EDGE does not cascade, not that the rows are guaranteed to survive the\n   * erasure. Another path may still delete them, and that path's declaration is the one that decides.\n   */\n  if (onParentDelete.enabled !== true) {\n    return classify(\n      SubjectErasureDisposition.RETAINED_BY_DECLARATION,\n      'onParentDelete.enabled is false: the author declared these rows survive their parent\\'s ' +\n        'teardown, so the erasure leaves them intact',\n    );\n  }\n\n  // The RESTRICT posture is read BEFORE the mode: it tears nothing down, so there is no teardown to\n  // defer, and a `mode: LAZY` written beside it must not turn a leave-alone edge into a blocking one.\n  // After this return TypeScript narrows `strategy` below to the teardown members, so the switch's\n  // exhaustiveness check still turns any FUTURE member into a type error.\n  if (onParentDelete.strategy === ChildLifecycleStrategy.REFUSE_WHILE_CHILDREN_EXIST) {\n    return classify(\n      SubjectErasureDisposition.RESTRICTED_BY_DECLARATION,\n      'onParentDelete declares strategy REFUSE_WHILE_CHILDREN_EXIST: the parent\\'s delete is refused ' +\n        'while these rows exist, and an erasure scrubs the subject in place rather than deleting it, so ' +\n        'the erasure leaves the rows intact',\n    );\n  }\n\n  const mode = onParentDelete.mode ?? ChildLifecycleMode.IMMEDIATE;\n  if (mode !== ChildLifecycleMode.IMMEDIATE) {\n    return classify(\n      SubjectErasureDisposition.UNSUPPORTED_DEFERRED,\n      `onParentDelete.mode is '${mode}': deferring the teardown to a queue would let the erasure ` +\n        `report success while the subject's personal data is still live. Set mode: IMMEDIATE on ` +\n        `this edge for it to participate in a subject erasure`,\n    );\n  }\n\n  /*\n   * #1279 — the child's OWN erasure declaration is consulted BEFORE the edge's teardown strategy.\n   *\n   * ## Why this sits AFTER the deferral check, deliberately\n   *\n   * `mode: LAZY` is read above and refuses first, so a deferred edge never reaches the retention\n   * question. The alternative — letting a retain policy rescue a LAZY edge, the way the RESTRICT\n   * posture is read before `mode` — was considered and REJECTED: RESTRICT tears nothing down, so\n   * there is genuinely no teardown to defer, while `RETAIN_AND_IMPERSONALIZE` is an ACTION (the\n   * in-place scrub), and an erasure that defers its own scrub reports success while personal data is\n   * still live. Refusing is the fail-closed answer and the one an operator can act on.\n   *\n   * Measured 2026-09-17: the shipped registry declares ZERO `mode: LAZY` edges, so this ordering is\n   * currently unobservable. It is written down rather than left to be re-derived by whoever declares\n   * the first one.\n   *\n   * `strategy` is read RAW here, never through `resolveChildLifecycleTeardownStrategy`. That helper\n   * resolves absence to DELETE for the CASCADE, where the premise \"the parent row is gone\" makes it\n   * correct. An erasure keeps the parent row, so the premise is false and the resolution would be a\n   * manufactured answer — which is precisely the defect this replaces.\n   */\n  const authoredStrategy = onParentDelete.strategy;\n  const childRetentionPolicy = resolveChildRetentionPolicy(childResourceType);\n\n  if (childRetentionPolicy?.mode !== undefined) {\n    const retentionMode = childRetentionPolicy.mode;\n    const retainDisposition =\n      retentionMode === ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE\n        ? SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN\n        : SubjectErasureDisposition.RETAINED_BY_DECLARATION;\n\n    if (authoredStrategy === undefined) {\n      return classify(\n        retainDisposition,\n        `the child resource declares retentionPolicy.mode '${retentionMode}' — the declaration that ` +\n          `states what an erasure does to its rows — and this edge authors no onParentDelete.strategy, ` +\n          `so nothing contradicts it. The erasure applies the declared retention treatment rather than ` +\n          `the teardown the delete cascade would apply, because an erasure keeps the parent row`,\n      );\n    }\n\n    /*\n     * An AUTHORED strategy is left to the switch below, deliberately — including an authored DELETE,\n     * which CONTRADICTS this retention policy.\n     *\n     * Refusing it here as a per-edge disposition was implemented first and REVERTED, because a\n     * blocking disposition is refused by the orchestrator BEFORE the plan-level detectors run: it\n     * shadowed {@link findSubjectErasureRetainDeleteConflicts} (#1017) and\n     * {@link findSubjectErasureSubjectTypeDeleteEdges} (#1085), whose refusals name both offending\n     * edges and the resource, with a generic \"no executable disposition\" message. Two purpose-built,\n     * mutation-proven refusals became unreachable for their whole population — every shape they\n     * detect requires the child to declare a `retentionPolicy`, so every one of them is also this\n     * contradiction.\n     *\n     * A contradiction is a relation between TWO declarations, which is what a plan-level detector\n     * models and what a single edge's disposition cannot. It therefore lives beside its siblings, as\n     * {@link findSubjectErasureRetentionContradictedEdges}.\n     */\n  }\n\n  /*\n   * The residual, named rather than left to look like an inconsistency with everything above.\n   *\n   * A child that declares NO `retentionPolicy` and sits on a SILENT edge has had nothing said about it\n   * in either field, and here absence still resolves to DELETE — the reading the engine has always\n   * had, that a dependent's data has no life of its own once the subject's ownership does not. 33\n   * children are in that position (measured 2026-09-17), and the alternative was to refuse all 33 as\n   * UNCLASSIFIED until someone authored a declaration for each.\n   *\n   * That was rejected for the reason `application-creation-directive.md` gives: the remedy would be\n   * \"an author decides something\", which makes an erasure impossible to run until a large authoring\n   * backlog is cleared, and #1279 was about an erasure doing the WRONG thing, not about it being\n   * under-declared. The narrow fix is the one that keeps the correction checkable.\n   *\n   * What changed is precise and worth stating: silence no longer overrules a DECLARATION. It still\n   * carries the historical default where there is no declaration to overrule. If this project later\n   * wants that last case explicit too, the place for it is a per-edge `onSubjectErasure` axis, and\n   * the argument against adding one speculatively is in this function's header.\n   */\n  const strategy = authoredStrategy ?? ChildLifecycleStrategy.DELETE;\n  switch (strategy) {\n    case ChildLifecycleStrategy.DELETE:\n      return classify(\n        SubjectErasureDisposition.DELETE,\n        'onParentDelete declares strategy DELETE: the dependent\\'s data dies with the subject\\'s ' +\n          'ownership, so the erasure removes the rows',\n      );\n\n    case ChildLifecycleStrategy.IMPERSONALIZE_AND_RETAIN:\n      return classify(\n        SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN,\n        'onParentDelete declares strategy IMPERSONALIZE_AND_RETAIN: the rows survive the erasure ' +\n          'with their personal fields scrubbed and retentionStatus flipped to RETAINED',\n      );\n\n    default: {\n      // Compile-time exhaustiveness: a new ChildLifecycleStrategy member without an erasure arm is\n      // a TYPE error here, not a silent runtime discovery on someone's deletion request.\n      const _exhaustiveStrategyCheck: never = strategy;\n      return classify(\n        SubjectErasureDisposition.UNCLASSIFIED,\n        `onParentDelete declares an unknown teardown strategy ` +\n          `'${String(_exhaustiveStrategyCheck)}' that subject erasure has no arm for`,\n      );\n    }\n  }\n}\n\n/**\n * One DESCENDANT edge an erasure must account for — an edge below the subject's direct dependents,\n * planned from configuration before anything runs (#976).\n *\n * `parentResourceType` is the resource whose rows the erasure tears down and that owns this edge;\n * the classification is the same one a direct edge gets, from the same shared classifier, so a\n * descendant and a direct edge can never disagree about what an identical declaration means.\n */\nexport interface SubjectErasureDescendantEdgePlan {\n  /** The edge itself, as the parent resource's configuration declares it. */\n  relationship: ResourceRelationship;\n  /** The resource that owns this edge — its rows are the ones being torn down above it. */\n  parentResourceType: ResourceType;\n  classification: SubjectErasureEdgeClassification;\n}\n\n/**\n * Plan every DESCENDANT edge a subject erasure walks below ONE direct dependent (#976).\n *\n * ## What an erasure walks, and why exactly that\n *\n * - **Below a `DELETE` edge — everything, at every depth, regardless of `maxDepth`.** The rows are\n *   gone, so whatever depended on them has lost its owner; an erasure that stops at a depth budget\n *   leaves the subject's data one level down with nothing left to reach it. `maxDepth` is a\n *   parent-DELETE performance budget and keeps meaning exactly that on the delete cascade.\n * - **Below an `IMPERSONALIZE_AND_RETAIN` edge — nothing.** The retained row survives, scrubbed, so\n *   its own dependents still have their owner and remain bound to THAT row's future lifecycle. The\n *   retention obligation that keeps the row is the obligation that keeps what hangs off it; tearing\n *   those down would destroy records a legal obligation required keeping, and scrubbing them would\n *   need a declaration nobody made. This matches the cascade itself, whose retain arm never recurses.\n * - **Below `RETAINED_BY_DECLARATION` / `NOT_OWNED` — nothing.** The rows are not touched.\n *\n * Every child-direction edge of every walked resource is returned — including the ones that do\n * nothing — because the receipt is total over what the erasure walked, exactly as it is at the\n * direct level. A blocking classification anywhere in the plan must refuse the erasure BEFORE its\n * transaction opens; returning it (rather than throwing here) lets the caller name every one.\n *\n * ## Termination\n *\n * The walk is over RESOURCE TYPES, not rows, so each type's edges are planned once: a self-referential\n * edge (a folder of folders) or a cycle between types terminates here, while the row-level cascade\n * keeps its own visited-row guard.\n *\n * Pure: the caller supplies the lookup, so a boot-time guard can run the same planner the runtime\n * does rather than re-deriving it.\n *\n * @param directChildResourceType - the far side of the subject's direct `DELETE` edge.\n * @param resolveChildDirectionRelationships - the child-direction edges of a resource type, or\n *   `undefined` when the type has no configuration in this process (nothing is planned below it; the\n *   runtime cascade then declines that edge and reports it as not executed).\n * @param resolveChildRetentionPolicy - a resource type's declared `retentionPolicy`, or `undefined`\n *   when it declares none. Injected for the same reason as the lookup above: it keeps this planner\n *   pure, so a boot-time guard classifies a descendant edge exactly as the runtime will (#1279).\n */\nexport function planSubjectErasureDescendantEdges(\n  directChildResourceType: ResourceType,\n  resolveChildDirectionRelationships: (resourceType: ResourceType) => ResourceRelationship[] | undefined,\n  resolveChildRetentionPolicy: (\n    resourceType: ResourceType,\n  ) => SubjectErasureChildRetentionDeclaration | undefined,\n): SubjectErasureDescendantEdgePlan[] {\n  const planned: SubjectErasureDescendantEdgePlan[] = [];\n  const walked = new Set<string>();\n  const pending: ResourceType[] = [directChildResourceType];\n\n  while (pending.length > 0) {\n    const parentResourceType = pending.shift()!;\n    if (walked.has(String(parentResourceType))) continue;\n    walked.add(String(parentResourceType));\n\n    for (const relationship of resolveChildDirectionRelationships(parentResourceType) ?? []) {\n      const classification = classifySubjectErasureDisposition(relationship, resolveChildRetentionPolicy);\n      planned.push({ relationship, parentResourceType, classification });\n      if (classification.disposition === SubjectErasureDisposition.DELETE) {\n        pending.push(classification.childResourceType);\n      }\n    }\n  }\n\n  return planned;\n}\n\n/**\n * One resource an erasure's plan reaches both to KEEP its rows and to DELETE them (#1017).\n *\n * `TEdge` is whatever the caller planned — a direct edge, a descendant edge, or its own record of either —\n * so the orchestrator can name the edges the way its refusal already names unresolved ones.\n */\nexport interface SubjectErasureRetainDeleteConflict<TEdge> {\n  /** The resource on the far side of every edge below. */\n  resourceType: ResourceType;\n  /** Edges that scrub these rows and keep them (`IMPERSONALIZE_AND_RETAIN`), in plan order. */\n  retainingEdges: TEdge[];\n  /** Edges that hard-delete these rows (`DELETE`), in plan order. */\n  deletingEdges: TEdge[];\n}\n\n/**\n * Find every resource a subject erasure's WHOLE plan reaches through both a retaining edge and a deleting\n * edge (#1017). The erasure REFUSES before its transaction opens when this returns anything.\n *\n * ## The shape\n *\n * Each edge applies its own declared treatment to the rows it reaches: `DELETE` hard-deletes them,\n * `IMPERSONALIZE_AND_RETAIN` scrubs them and keeps them. Two DIFFERENT paths can reach the same resource — a\n * `people → records` retain edge beside `people → profiles → notes → records` delete, or two edges on one\n * resource through two foreign keys — and nothing in either declaration says what happens to a row BOTH\n * reach. Before this, the answer was the walk order: a row kept by the retain edge could still be deleted\n * when the delete edge's cascade got there, and #976 could only make the receipt admit it (`executed: false`).\n *\n * ## Why REFUSE, and why at the level of resource types\n *\n * The two declarations contradict each other for the rows they share, and neither outranks the other in\n * configuration. Refusing is the one answer that needs no new meaning: it surfaces the contradiction to the\n * author, who owns both declarations and can make them agree — declare the delete edge\n * `IMPERSONALIZE_AND_RETAIN` too, declare the retain edge `DELETE`, or disable one edge's teardown\n * (`onParentDelete.enabled: false`) — on the ground the legal obligation actually gives.\n *\n * The check is over resource TYPES, not rows, on purpose. Whether two edges share a row is only knowable by\n * reading rows, which the pre-flight must not do (every refusal here lands before the first read and write),\n * and it changes as rows are written, so a row-level \"no overlap today\" would be a guess about the future.\n * An edge pair that can never share a row in practice is still refused; the remedy is the same one-edge edit.\n *\n * ## Rejected: a precedence where retain wins\n *\n * \"Keep a row whenever any edge retains it\" was considered and rejected, for three reasons:\n *\n * - **It decides a legal question on the author's behalf.** A `DELETE` edge is a declaration too — that the\n *   rows hold nothing worth keeping once their owner is gone. GDPR Art. 17(3) lists the grounds on which the\n *   right to erasure does not apply (a legal obligation, the defence of legal claims, archiving, …), and\n *   Art. 5(2) makes the controller \"responsible for, and be able to demonstrate compliance with\" the\n *   principles. Keeping personal data an explicit declaration said to remove therefore needs a ground the\n *   controller can name, and a framework default names none. \"Delete wins\" fails the other way, destroying\n *   records a retention obligation required keeping. Neither default is safe, so no default.\n *   spec-cite: Regulation (EU) 2016/679, Art. 5(2) (accountability) and Art. 17(3)(a)–(e) (exceptions to the right to erasure).\n * - **Only its row-level form is faithful, and that form cannot be decided before the transaction.** A\n *   TYPE-level \"retain wins\" could be decided pre-flight, but it would keep every row of the resource,\n *   including rows only the delete edge reaches and the retain edge never touches — rows no retention\n *   declaration covers. The faithful rule is ROW-level: the delete walk skips each row a retain edge kept and\n *   prunes everything it planned below that row (a kept row still anchors its own dependents), per row,\n *   mid-transaction. The pre-flight plan is over types and cannot express that, so the\n *   refusal-before-any-write guarantee the rest of the erasure keeps would be lost.\n * - **It adds a meaning with no vocabulary for its opposite.** Once precedence exists, an author who needs\n *   the delete to win has no way to say so.\n *\n * ## What is NOT a conflict\n *\n * Only `DELETE` against `IMPERSONALIZE_AND_RETAIN` — the two treatments the erasure EXECUTES. Two deleting or\n * two retaining edges agree. `NOT_OWNED` rows are not the subject's, and the erasure never discovers them.\n * Two cases are deliberately NOT refused here. Each is an open decision, not an answer this rule gives:\n *\n * - **(a) A `RETAINED_BY_DECLARATION` dependent beside a `DELETE` path to the same resource (#1084).** The\n *   erasure never discovers `enabled: false` rows, and a row with two parents that survives one teardown and\n *   dies with the other is also what an ordinary parent delete does. **DECIDED 2026-09-17: this stays out.**\n *   `enabled: false` executes nothing, so there are not two treatments to reconcile — and the refusal below\n *   names `onParentDelete.enabled: false` as its own remedy, so counting it as a conflict would make that\n *   remedy produce the next refusal. The full argument is at the classification site.\n * - **(b) A delete closure that cycles back to the SUBJECT's own resource type while the subject row is\n *   retained (#1085).** The subject's retention is the erasure's own final step (the scrub), not an edge, so\n *   this detector — which reads only edges — cannot see it. **CLOSED 2026-09-17 by\n *   {@link findSubjectErasureSubjectTypeDeleteEdges}**, a sibling that takes the subject's own type as an\n *   argument precisely because it is not derivable from the edges.\n *\n * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.\n *\n * @param plannedEdges - every edge of ONE erasure: the subject's direct edges AND every descendant edge\n *   planned below its deleted dependents, each carrying its classification.\n * @returns one entry per conflicting resource, in the order the resource is first reached.\n */\nexport function findSubjectErasureRetainDeleteConflicts<TEdge extends { classification: SubjectErasureEdgeClassification }>(\n  plannedEdges: readonly TEdge[],\n): Array<SubjectErasureRetainDeleteConflict<TEdge>> {\n  const byResourceType = new Map<string, SubjectErasureRetainDeleteConflict<TEdge>>();\n  for (const edge of plannedEdges) {\n    const { disposition, childResourceType } = edge.classification;\n    if (disposition !== SubjectErasureDisposition.DELETE && disposition !== SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN) {\n      continue;\n    }\n    const key = String(childResourceType);\n    const entry = byResourceType.get(key) ?? { resourceType: childResourceType, retainingEdges: [], deletingEdges: [] };\n    byResourceType.set(key, entry);\n    if (disposition === SubjectErasureDisposition.DELETE) entry.deletingEdges.push(edge);\n    else entry.retainingEdges.push(edge);\n  }\n  return [...byResourceType.values()].filter((entry) => entry.retainingEdges.length > 0 && entry.deletingEdges.length > 0);\n}\n\n/**\n * What happened on ONE descendant edge of an executed erasure (#976) — reported exactly like a direct\n * edge: its disposition, the configuration that justified it, and whether its teardown ran.\n */\nexport interface SubjectErasureDescendantEdgeOutcome extends SubjectErasureEdgeClassification {\n  /** The resource that owns this edge. */\n  parentResourceType: ResourceType;\n  /**\n   * `true` when every teardown the erasure reached on this edge ran, `false` when any was declined, when\n   * this DELETE edge reached rows an earlier retain edge of the same walk scrubbed and KEPT (they are not\n   * gone, whatever this edge declares — unreachable since #1017, which refuses a plan that retains and deletes\n   * one resource before it runs, and kept as defence in depth), or when an edge ABOVE it was declined (its rows were then never\n   * walked, so nothing can be said about what they still hold). `false` on a non-executing disposition\n   * is expected, as on a direct edge.\n   *\n   * An executing edge the walk never had to dispatch — its parent resource had no rows of the subject's\n   * left to tear down — is `true`: that is a teardown with nothing to do, not a decline.\n   */\n  executed: boolean;\n}\n\n/** Per-edge outcome of an executed erasure — the classification plus what actually happened. */\nexport interface SubjectErasureEdgeOutcome extends SubjectErasureEdgeClassification {\n  /**\n   * Every edge below this one that the erasure walked, flat and in plan order (#976). Empty for a\n   * non-executing disposition and for `IMPERSONALIZE_AND_RETAIN`, which retains its rows and therefore\n   * does not walk below them — see {@link planSubjectErasureDescendantEdges}.\n   */\n  descendantEdges: SubjectErasureDescendantEdgeOutcome[];\n  /**\n   * `true` when the erasure ran a teardown for this edge AND for every descendant edge below it whose\n   * disposition executes (#976). A declined descendant therefore makes its direct edge `false`: a\n   * reader who only counts direct edges must not read a subtree that still holds live data as erased.\n   * {@link descendantEdges} says which descendant it was.\n   *\n   * Reports that the teardown RAN, not that rows existed — discovery finding no dependents is a\n   * teardown that ran with nothing to do, and is `true`.\n   *\n   * **Read it together with `disposition`, because `false` has two very different meanings:**\n   *\n   * - a NON-executing disposition (`RETAINED_BY_DECLARATION`, `NOT_OWNED`) ⇒ the erasure deliberately\n   *   left the rows alone, and `false` is the expected, correct answer;\n   * - an EXECUTING disposition (`DELETE`, `IMPERSONALIZE_AND_RETAIN`) ⇒ the cascade DECLINED the edge\n   *   (the child had no registered service or repository), or an edge BELOW it did not tear its rows\n   *   down (see `descendantEdges`) — declined the same way, or a DELETE edge that reached rows an\n   *   earlier retain edge of the walk kept. An erasure never spends a depth budget — it walks every\n   *   descendant. The subject's data is partly still live. This pairing should never appear in a\n   *   healthy system; it is logged at ERROR when it happens, naming the missing registration or the\n   *   descendant edges concerned.\n   *\n   * ⚠️ This flag was set unconditionally until 2026-08-11 — it meant \"the dispatcher returned without\n   * throwing\" and reported a skipped edge as torn down. Anything persisted before that date overstates\n   * what was erased. Treat this field as evidence only for reports produced after the fix.\n   */\n  executed: boolean;\n}\n\n/**\n * Outcome of one EXTERNAL, non-transactional erasure effect (a third-party provider the subject's\n * personal data also reached — a billing provider customer, say).\n *\n * A separate vocabulary from {@link SubjectErasureDisposition} on purpose. An edge disposition\n * describes a decision derived from configuration BEFORE anything ran, and its teardown is part of\n * the database transaction. An external effect is the opposite on both counts: it is discovered by\n * calling out to a system Wildo does not own, and it CANNOT join the transaction. Collapsing the\n * two would let a caller read \"the erasure succeeded\" from a value that only ever described the\n * local rows.\n */\nexport enum SubjectErasureExternalEffectStatus {\n  /** Every step of the effect completed against the external system. */\n  COMPLETED = 'completed',\n  /**\n   * The subject had nothing at this external system — no provider customer, no linked record. A\n   * legitimate success, kept DISTINCT from `COMPLETED` so \"there was nothing to erase\" can never be\n   * mistaken for \"we erased it\", which is exactly the confusion a regulator would probe.\n   */\n  NOTHING_TO_ERASE = 'nothing-to-erase',\n  /**\n   * The effect ran and some steps succeeded while others failed — personal data may still be live\n   * at the external system. The loudest state in this enum: it demands follow-up, and it is why the\n   * status is not a boolean.\n   */\n  PARTIAL = 'partial',\n  /** The effect could not run at all (provider unreachable, not configured). Nothing was changed. */\n  FAILED = 'failed',\n  /**\n   * No handler was registered for this effect. Distinct from `NOTHING_TO_ERASE`: that means we\n   * looked and found nothing, this means nobody looked.\n   */\n  NOT_REGISTERED = 'not-registered',\n\n  /**\n   * A bound external-effects port returned no usable report. The local erasure committed, but\n   * external outcomes are UNKNOWN: neither no work nor no change can be inferred. Incomplete;\n   * reconcile provider state before retrying work that may already have succeeded.\n   */\n  UNMEASURED = 'unmeasured',\n\n  /**\n   * The external system's binding DECLARES its rows hold no personal/subject data\n   * (`HttpApiErasureStance.NO_SUBJECT_DATA`, ETL D6 stance 6a) — nothing was erased because,\n   * by declaration, there is nothing an erasure could apply to. Distinct from\n   * {@link NOTHING_TO_ERASE}: that means we LOOKED and found no linked rows; this means the\n   * declaration made looking unnecessary. A complete outcome — the declaration's coherence is\n   * validated at boot (a 6a resource cannot participate in subject export).\n   */\n  DECLARED_NO_SUBJECT_DATA = 'declared-no-subject-data',\n\n  /**\n   * The rows live in an external system the platform cannot erase, and the CONTROLLER explicitly\n   * acknowledged completing the erasure anyway (`HttpApiErasureStance.\n   * CONTROLLER_ACKNOWLEDGED_NON_ERASURE`, ETL D6 stance 6c — the per-request\n   * `acknowledgeHttpApiNonErasure` option). Deliberately INCOMPLETE in\n   * {@link isIncompleteSubjectErasureExternalEffect}: the subject's data is still live at the\n   * third party, and a compliance artifact must say so however deliberate the decision was. The\n   * acknowledgement itself is additionally recorded as a CRITICAL audit event — the record is\n   * the control (`administrative-continuity-floors.md`).\n   */\n  ACKNOWLEDGED_NON_ERASURE = 'acknowledged-non-erasure',\n}\n\n/** Whether an external-effect status leaves personal data potentially live at a third party. */\nexport function isIncompleteSubjectErasureExternalEffect(\n  status: SubjectErasureExternalEffectStatus,\n): boolean {\n  return status === SubjectErasureExternalEffectStatus.PARTIAL\n    || status === SubjectErasureExternalEffectStatus.FAILED\n    || status === SubjectErasureExternalEffectStatus.NOT_REGISTERED\n    || status === SubjectErasureExternalEffectStatus.UNMEASURED\n    // An acknowledged non-erasure is a DELIBERATE hole, and still a hole: personal data remains\n    // live at the third party, so \"is this erasure actually complete\" must answer no.\n    || status === SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE;\n}\n\nexport interface SubjectErasureExternalEffectOutcome {\n  /** Stable identifier of the effect, e.g. `'billing-provider'`. */\n  effectRef: string;\n  status: SubjectErasureExternalEffectStatus;\n  /**\n   * Human-readable account of what ran, for the compliance artifact. On `PARTIAL` / `FAILED` this\n   * must name what did NOT happen — the report is the only place that survives the request.\n   */\n  detail: string;\n  /**\n   * Per-step results, so a partial outcome is actionable rather than merely alarming (which step\n   * against which external id). Never carries personal data — ids and step names only.\n   */\n  steps?: Array<{ step: string; targetRef?: string; succeeded: boolean; error?: string }>;\n}\n\n/**\n * What one subject erasure did — the compliance artifact of a \"delete my account\" request.\n *\n * Returned to the caller (rather than only logged) so the flow that fronts the request can record\n * or surface it: every edge of the subject appears exactly once with the disposition applied and\n * the configuration that justified it, which is the evidence a data-protection response needs.\n *\n * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure accounts per store instead of\n * one verdict: each direct dependent edge with whether its teardown ran, each descendant edge the\n * erasure walked below it (nested in `descendantEdges`, folded into the direct edge's `executed`),\n * each registered external effect with its own outcome. The engine returns this and persists none of\n * it; retaining it is the calling application's job.\n */\nexport interface SubjectErasureReport {\n  /** The erased subject's resource type. */\n  subjectResourceType: ResourceType;\n  /** The erased subject rows. */\n  subjectIds: string[];\n  /** Every child-direction edge of the subject, classified, in registry order. */\n  edges: SubjectErasureEdgeOutcome[];\n  /**\n   * `true` once the subject rows themselves were scrubbed and flipped to `RETAINED`. Always `true`\n   * on a successful erasure — an erasure that could not retain its subject throws rather than\n   * returning a report.\n   */\n  subjectImpersonalized: boolean;\n  /**\n   * Whose sessions this erasure ended, and whether resolving them failed.\n   *\n   * A LOCAL fact, not an external effect: the revocation is a write to our own session fence, applied\n   * at the scrub chokepoint so it covers every path that scrubs a person's row. It is recorded here\n   * because \"the erased person can no longer be logged in\" is exactly what a data-protection response\n   * has to be able to evidence.\n   *\n   * `lookupFailed` is kept distinct from an empty `principalUserIds`: no principals is a legitimate\n   * outcome (the resource declared `NO_PRINCIPAL`), whereas a failed lookup means the person may\n   * still hold a live session — and the two must never look alike in a compliance artifact.\n   */\n  sessionRevocation?: {\n    principalUserIds: string[];\n    lookupFailed: boolean;\n  };\n  /**\n   * Outcomes of the external, non-transactional effects the erasure triggered — every SYSTEM WE\n   * DO NOT OWN that the subject's personal data reached: registered effect handlers (a billing\n   * provider), and each HTTP_API-bound resource linked to the subject (one entry per resource,\n   * `effectRef: 'http-api:<resourceType>'`, carrying its declared D6 erasure stance's outcome).\n   *\n   * A malformed response from a bound registry produces one aggregate UNMEASURED entry,\n   * identifying that boundary rather than inventing individual provider outcomes.\n   *\n   * Empty when no effect was registered for the subject's resource type. These run AFTER the local\n   * scrub has committed, so a failure here cannot roll the erasure back — the local data is\n   * already gone and re-running the whole erasure would be wrong. That asymmetry is precisely why\n   * the outcome is reported rather than thrown: the local part genuinely succeeded, and the caller\n   * needs to know that a third party still holds something.\n   *\n   * Check {@link isIncompleteSubjectErasureExternalEffect} over these before treating a report as a\n   * complete erasure.\n   */\n  externalEffects: SubjectErasureExternalEffectOutcome[];\n}\n\n\n/**\n * Edges whose DELETE would reach the SUBJECT'S OWN resource type (#1085).\n *\n * ## The hazard\n *\n * A subject erasure SCRUBS the subject row and keeps it — that is the erasure's contract with the data\n * subject, and it is unconditional: `eraseSubjectInPlace` refuses outright when the subject resource\n * declares no `retentionPolicy`. Since #976 the walk also descends below every dependent it deletes, so\n * a DELETE closure that comes back round to the subject's own type would delete the very row the\n * erasure promised to retain — and the receipt would still report it retained.\n *\n * That last part is why this refuses rather than skips. `SubjectErasureDescendantWalk`'s accounting is\n * written so a receipt can never OVERSTATE an erasure; deleting the scrubbed subject would overstate in\n * the one way nothing downstream can detect, because every edge reports exactly what it did.\n *\n * ## Why the sibling detector cannot do this\n *\n * {@link findSubjectErasureRetainDeleteConflicts} compares two EDGE dispositions. The subject's retention\n * is not an edge — no relationship declares it — so the subject's type is passed in here rather than\n * inferred. It is the whole reason this is a second function and not a case in the first.\n *\n * ## Measured 2026-09-17: the population is EMPTY, and that is the point\n *\n * In the engine's core graph `USERS` is never the CHILD of a composition. The one relationship naming it\n * second — `ORGANIZATIONS → USERS` — is a `RelationshipNature.ASSOCIATION` through\n * `ORGANIZATION_MEMBERS`, and an association carries no `onParentDelete` teardown, so no closure can\n * reach it. A guard over an empty population costs nothing at runtime and is exactly the shape worth\n * having: it cannot regress silently, and an application that later declares such an edge meets a\n * refusal before any read or write instead of an erasure that quietly contradicts itself.\n *\n * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.\n *\n * @param plannedEdges - every edge of ONE erasure, each carrying its classification.\n * @param subjectResourceType - the resource being erased, whose row is retained.\n * @returns the offending edges, in plan order. Empty is the healthy answer.\n */\n/**\n * Edges that DELETE a resource whose OWN `retentionPolicy` says an erasure keeps its rows (#1279).\n *\n * ## The contradiction\n *\n * A resource's `retentionPolicy` is the declaration whose entire subject is what an erasure does to\n * its rows, and the config factory refuses it unless it is paired with a `dataSubjectPolicy` — so it\n * is among the most deliberate statements an author makes. An edge that nevertheless AUTHORS\n * `onParentDelete.strategy: DELETE` says the opposite about the same rows. Nothing in the\n * configuration ranks the two, so an erasure must refuse rather than pick: deleting could destroy\n * data a retention obligation required keeping, and retaining could strand personal data the erasure\n * claimed to have removed. That is the same reasoning {@link findSubjectErasureRetainDeleteConflicts}\n * gives for refusing rather than defaulting, applied one level down — there between two EDGES, here\n * between an edge and the RESOURCE it points at.\n *\n * ## Why a DELETE disposition here is necessarily AUTHORED\n *\n * Since #1279 `classifySubjectErasureDisposition` applies the child's retention treatment whenever the\n * edge is SILENT, so a `DELETE` disposition toward a retain-declaring child can only have come from an\n * author writing `strategy: DELETE`. This filter therefore needs no second look at the declaration:\n * the invariant is expressed once, in the classifier, and read here. Do NOT re-derive \"was it\n * authored?\" from the relationship — that would be a second copy of the rule, free to drift.\n *\n * ## Measured population: ZERO, and that is the point\n *\n * Across `engine/`, `platform/` and `examples/` on 2026-09-17, 28 edges deleted a retain-declaring\n * resource and **not one of them authored `DELETE`** — every one reached that outcome through the\n * schema default this fix removed. So the shipped registry trips this detector nowhere, which is the\n * shape worth having: it cannot regress silently, and an application that later authors the\n * contradiction meets a refusal before any read or write rather than an erasure that quietly\n * contradicts its own declarations.\n *\n * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.\n *\n * @param plannedEdges - every edge of ONE erasure, each carrying its classification.\n * @param resolveChildRetentionPolicy - a resource type's declared `retentionPolicy`, or `undefined`.\n * @returns the offending edges, in plan order. Empty is the healthy answer.\n */\nexport function findSubjectErasureRetentionContradictedEdges<TEdge extends { classification: SubjectErasureEdgeClassification }>(\n  plannedEdges: readonly TEdge[],\n  resolveChildRetentionPolicy: (\n    resourceType: ResourceType,\n  ) => SubjectErasureChildRetentionDeclaration | undefined,\n): TEdge[] {\n  return plannedEdges.filter((edge) =>\n    edge.classification.disposition === SubjectErasureDisposition.DELETE\n    && resolveChildRetentionPolicy(edge.classification.childResourceType)?.mode !== undefined);\n}\n\nexport function findSubjectErasureSubjectTypeDeleteEdges<TEdge extends { classification: SubjectErasureEdgeClassification }>(\n  plannedEdges: readonly TEdge[],\n  subjectResourceType: string,\n): TEdge[] {\n  return plannedEdges.filter((edge) =>\n    edge.classification.disposition === SubjectErasureDisposition.DELETE\n    && String(edge.classification.childResourceType) === String(subjectResourceType));\n}\n"]}

package/dist/esm/compliance/privacy/subject-export-render.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-export-render.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EAGpB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,oBAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,IAAI,SAAS;IAEb;;;;OAIG;IACH,GAAG,QAAQ;CACZ;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACpC;AAkED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,6BAA6B,CAmC/B"}
+{"version":3,"file":"subject-export-render.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EAGpB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,oBAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,IAAI,SAAS;IAEb;;;;OAIG;IACH,GAAG,QAAQ;CACZ;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACpC;AAkED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,6BAA6B,CAmC/B"}

package/dist/esm/compliance/privacy/subject-export.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-export.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAItF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,aAAa,kBAAkB;IAE/B;;;;OAIG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,yBAAyB;IACnC;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;OAIG;IACH,QAAQ,aAAa;IAErB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oBAAY,4BAA4B;IACtC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,2BAA2B,gCAAgC;IAE3D;;;;OAIG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;OAOG;IACH,6BAA6B,kCAAkC;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,4EAA4E;AAC5E,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAGT;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,wDAAwD;IACxD,mBAAmB,EAAE,YAAY,CAAC;IAClC,0DAA0D;IAC1D,WAAW,EAAE,4BAA4B,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,oBAAoB,GAC5B,+BAA+B,CAmEjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,iFAAiF;AACjF,MAAM,WAAW,kCAAkC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4CAA4C,CAC1D,mBAAmB,EAAE,YAAY,EACjC,aAAa,EAAE,gCAAgC,EAC/C,OAAO,EAAE,oBAAoB,GAC5B,kCAAkC,EAAE,CA8BtC;AAED,kGAAkG;AAClG,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,kCAAkC,GAAG,MAAM,CAW3G;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,gDAAgD;IAChD,QAAQ,aAAa;IAErB;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,eAAe;CAC1B;AAED,uFAAuF;AACvF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,yBAAyB,GAAG,SAAS,EACjD,OAAO,EAAE,oBAAoB,GAC5B,uBAAuB,CAqBzB;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAWnF;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0CAA0C,CACxD,WAAW,EAAE,CAAC,CAAC,UAAU,EACzB,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,EAChE,YAAY,EAAE,MAAM,GACnB,yBAAyB,GAAG,SAAS,CAiBvC;AAED,2EAA2E;AAC3E,oBAAY,+BAA+B;IACzC,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,wBAAwB,6BAA6B;IACrD,UAAU,eAAe;IACzB,WAAW,gBAAgB;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;CACjD;AAID;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASnH;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,GAAG,0BAA0B,EAAE,CAmD/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,mBAAmB,EAAE,YAAY,CAAC;IAClC,iCAAiC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACzC,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACtC"}
+{"version":3,"file":"subject-export.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAItF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,aAAa,kBAAkB;IAE/B;;;;OAIG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,yBAAyB;IACnC;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;OAIG;IACH,QAAQ,aAAa;IAErB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oBAAY,4BAA4B;IACtC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,2BAA2B,gCAAgC;IAE3D;;;;OAIG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;OAOG;IACH,6BAA6B,kCAAkC;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,4EAA4E;AAC5E,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAGT;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,wDAAwD;IACxD,mBAAmB,EAAE,YAAY,CAAC;IAClC,0DAA0D;IAC1D,WAAW,EAAE,4BAA4B,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,oBAAoB,GAC5B,+BAA+B,CAmEjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,iFAAiF;AACjF,MAAM,WAAW,kCAAkC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4CAA4C,CAC1D,mBAAmB,EAAE,YAAY,EACjC,aAAa,EAAE,gCAAgC,EAC/C,OAAO,EAAE,oBAAoB,GAC5B,kCAAkC,EAAE,CA8BtC;AAED,kGAAkG;AAClG,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,kCAAkC,GAAG,MAAM,CAW3G;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,gDAAgD;IAChD,QAAQ,aAAa;IAErB;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,eAAe;CAC1B;AAED,uFAAuF;AACvF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,yBAAyB,GAAG,SAAS,EACjD,OAAO,EAAE,oBAAoB,GAC5B,uBAAuB,CAqBzB;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAWnF;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0CAA0C,CACxD,WAAW,EAAE,CAAC,CAAC,UAAU,EACzB,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,EAChE,YAAY,EAAE,MAAM,GACnB,yBAAyB,GAAG,SAAS,CAiBvC;AAED,2EAA2E;AAC3E,oBAAY,+BAA+B;IACzC,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,wBAAwB,6BAA6B;IACrD,UAAU,eAAe;IACzB,WAAW,gBAAgB;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;CACjD;AAID;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASnH;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,GAAG,0BAA0B,EAAE,CAmD/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,mBAAmB,EAAE,YAAY,CAAC;IAClC,iCAAiC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACzC,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACtC"}

package/dist/esm/compliance/privacy/subject-export.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-export.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAG/E,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,uDAA+B,CAAA;IAE/B;;;;OAIG;IACH,iEAAyC,CAAA;AAC3C,CAAC,EAdW,oBAAoB,KAApB,oBAAoB,QAc/B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,yBAqBX;AArBD,WAAY,yBAAyB;IACnC;;;OAGG;IACH,kEAAqC,CAAA;IAErC;;;;OAIG;IACH,kDAAqB,CAAA;IAErB;;;;;OAKG;IACH,gDAAmB,CAAA;AACrB,CAAC,EArBW,yBAAyB,KAAzB,yBAAyB,QAqBpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAN,IAAY,4BAuDX;AAvDD,WAAY,4BAA4B;IACtC;;;;OAIG;IACH,iEAAiC,CAAA;IAEjC;;;;;;;;;OASG;IACH,2FAA2D,CAAA;IAE3D;;;;OAIG;IACH,uFAAuD,CAAA;IAEvD;;;;;;;OAOG;IACH,+FAA+D,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,qFAAqD,CAAA;AACvD,CAAC,EAvDW,4BAA4B,KAA5B,4BAA4B,QAuDvC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sCAAsC,CACpD,WAAyC;IAEzC,OAAO,WAAW,KAAK,4BAA4B,CAAC,cAAc;WAC7D,WAAW,KAAK,4BAA4B,CAAC,2BAA2B,CAAC;AAChF,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,YAAkC,EAClC,OAA6B;IAE7B,MAAM,mBAAmB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACvE,MAAM,QAAQ,GAAG,CACf,WAAyC,EACzC,MAAc,EACmB,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAErF,6FAA6F;IAC7F,2CAA2C;IAC3C,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,4BAA4B,CAAC,cAAc,EAC3C,2FAA2F;cACvF,mCAAmC,CACxC,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACjG,MAAM,wBAAwB,GAAG,gBAAgB,KAAK,YAAY,CAAC,aAAa,CAAC;IAEjF,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,0BAA0B,cAAc,qDAAqD;cACzF,sFAAsF,CAC3F,CAAC;IACJ,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,2BAA2B,EACxD,0BAA0B,cAAc,8CAA8C;kBAClF,qFAAqF;kBACrF,sCAAsC,CAC3C,CAAC;QAEJ,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,QAAQ,CACb,4BAA4B,CAAC,6BAA6B,EAC1D,0BAA0B,cAAc,8CAA8C;kBAClF,sFAAsF;kBACtF,gFAAgF,CACrF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,wFAAwF;YACxF,yEAAyE;YACzE,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,iEAAiE;kBAC7D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAuBD;;;;;;;;GAQG;AACH,MAAM,UAAU,4CAA4C,CAC1D,mBAAiC,EACjC,aAA+C,EAC/C,OAA6B;IAE7B,MAAM,qBAAqB,GAAG;QAC5B,GAAG,aAAa,CAAC,kBAAkB;QACnC,GAAG,aAAa,CAAC,mBAAmB;QACpC,GAAG,aAAa,CAAC,iBAAiB;KACnC,CAAC;IACF,OAAO,qBAAqB;SACzB,GAAG,CAAC,CAAC,YAAY,EAAsC,EAAE;QACxD,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,CAAC,mBAAmB,CAAC,2BAA2B;kBAC/F,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,sBAAsB,GAAG,YAAY,CAAC,aAAa,KAAK,mBAAmB;YAC/E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,GAAG,YAAY;gBACf,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,YAAY,EAAE,YAAY,CAAC,YAAY;aACxC,CAAC;QACN,OAAO;YACL,YAAY;YACZ,sBAAsB;YACtB,cAAc,EAAE,gCAAgC,CAAC,sBAAsB,EAAE,OAAO,CAAC;SAClF,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE,qCAAqC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5I,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qCAAqC,CAAC,SAA6C;IACjG,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC;IACtD,OAAO;QACL,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,MAAM;QACnB,YAAY,CAAC,eAAe,IAAI,EAAE;QAClC,SAAS,CAAC,cAAc,CAAC,WAAW;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC,gDAAgD;IAChD,gDAAqB,CAAA;IAErB;;;OAGG;IACH,gEAAqC,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,oDAAyB,CAAA;AAC3B,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AAED,uFAAuF;AACvF,MAAM,UAAU,iCAAiC,CAAC,KAA8B;IAC9E,OAAO,KAAK,KAAK,uBAAuB,CAAC,UAAU,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAiD,EACjD,OAA6B;IAE7B,QAAQ,OAAO,EAAE,CAAC;QAChB,gGAAgG;QAChG,iFAAiF;QACjF,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,uFAAuF;YACvF,iDAAiD;YACjD,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,+DAA+D;kBAC3D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CACnC,UAAiD;IAEjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,uBAAuB,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,QAAQ,UAAU,EAAE,CAAC;QACnB,+FAA+F;QAC/F,+FAA+F;QAC/F,kBAAkB;QAClB,KAAK,yBAAyB,CAAC,gBAAgB,CAAC;QAChD,KAAK,yBAAyB,CAAC,QAAQ;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,yBAAyB,CAAC,OAAO;YACpC,OAAO,uBAAuB,CAAC,gBAAgB,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,MAAM,0BAA0B,GAAU,UAAU,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,yDAAyD;kBACrD,IAAI,MAAM,CAAC,0BAA0B,CAAC,GAAG,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAyB;IACxE,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,yFAAyF;IACzF,8DAA8D;IAC9D,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,sGAAsG;AACtG,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0CAA0C,CACxD,WAAyB,EACzB,yBAAgE,EAChE,YAAoB;IAEpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,IAAI,YAAY,4BAA4B,QAAQ,wCAAwC;cACxF,2BAA2B,CAAC,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;cAC5F,uFAAuF;cACvF,+CAA+C,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,QAAqC,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,0EAAuC,CAAA;IACvC,wEAAqC,CAAA;IACrC,wFAAqD,CAAA;IACrD,4DAAyB,CAAA;IACzB,8DAA2B,CAAA;AAC7B,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAWD,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,MAAe;IAC5E,IAAI,OAAO,GAAQ,MAAM,CAAC;IAC1B,KAAK,IAAI,WAAW,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,GAAG,8BAA8B,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC;QACpG,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,KAAgC,CAAC;QACxG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,MAAM,SAAS,GAAG,8CAA8C,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAiC,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,aAAqB,EAAE,KAAa,EAAQ,EAAE;QAC3F,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,SAAS,EAAE,CAAC;YAChD,IAAI,KAAK,IAAI,8BAA8B,EAAE,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,uBAAuB,CAAC,UAAU;oBACzC,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,WAAW;iBACnD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,gCAAgC,CAAC,WAA2B,CAAC,EAAE,CAAC;gBAClE,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,wBAAwB;iBAChE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,8CAA8C,CAAC,WAAW,CAAC,CAAC;YAChF,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAA2B,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,0CAA0C,CAAC,WAA2B,EAAE,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAC7H,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;gBAChE,UAAU,EAAE,UAAU,IAAI,IAAI;gBAC9B,KAAK,EAAE,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,+BAA+B,CAAC,iBAAiB;oBACnD,CAAC,CAAC,UAAU,KAAK,SAAS;wBACxB,CAAC,CAAC,+BAA+B,CAAC,gBAAgB;wBAClD,CAAC,CAAC,+BAA+B,CAAC,UAAU;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import type { z } from 'zod';\nimport { getPortabilityProvenance } from '@wildo-ai/zod-decorators';\nimport { isNonDisclosableFieldValue } from '../../resources/utils/field-value-disclosure.utils';\nimport {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\n\nconst compareCanonicalText = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\n\n/**\n * WHICH data-subject right an export is answering.\n *\n * ## Why this is an enum and not a boolean flag on one bundle\n *\n * GDPR Art. 15 (right of access) and Art. 20 (right to data portability) are DIFFERENT rights over\n * DIFFERENT data, and conflating them is the defect this capability was built to correct: the four\n * routed export operations removed on 2026-08-01 declared themselves \"portability / GDPR\" while\n * their actual options (`includeActivityData`, `includeOrganizationData`) described an *access*\n * bundle. One output with a flag would reproduce that merge.\n *\n * - **Access** is a disclosure obligation: everything the controller holds *concerning* the subject,\n *   including data the controller itself derived about them, in any readable form.\n * - **Portability** is a transfer obligation: only the data the subject *provided* — actively, or by\n *   using the service — and it must be machine-readable and re-importable elsewhere. Data the\n *   controller inferred is deliberately OUT of scope; a competitor must not receive a rival's\n *   analytics through a subject's portability request.\n *\n * The two therefore diverge at BOTH levels this module classifies: per-edge (see\n * {@link classifySubjectExportDisposition}) and per-field (see\n * {@link resolveSubjectExportFieldScope}).\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n */\nexport enum SubjectExportPurpose {\n  /**\n   * Art. 15 — right of access. The broadest bundle: every row concerning the subject, whoever\n   * produced it, including rows the subject does not own (an audit log about them, a membership an\n   * administrator created).\n   */\n  ACCESS_ART_15 = 'access_art_15',\n\n  /**\n   * Art. 20 — right to data portability. Narrower on purpose: only data the subject supplied or\n   * generated by using the service, and only from rows the subject owns. Controller-derived data is\n   * excluded by {@link DataPortabilityProvenance.DERIVED}.\n   */\n  PORTABILITY_ART_20 = 'portability_art_20',\n}\n\n/**\n * WHERE one field's value came from — the axis that decides Art. 20 scope.\n *\n * ## Why three values and not `isSubjectProvided: boolean`\n *\n * EDPB/WP29 guidance splits \"provided by the data subject\" into data supplied *knowingly* and data\n * *observed* from the subject's use of the service, and puts BOTH in Art. 20 scope while excluding\n * data the controller *inferred*. A boolean forces `OBSERVED` to be mis-filed against whichever\n * side the author guesses — and it is the member most often got wrong, because \"the user did not\n * type it\" reads as \"the user did not provide it\", which is precisely the wrong conclusion.\n *\n * ## Why this is per-FIELD and not per-resource\n *\n * A single row routinely mixes the two: a user profile holds `firstName` (supplied) beside a\n * controller-computed status or score. A resource-level answer would have to round one way for the\n * whole row. The resource-level declaration exists only as a DEFAULT\n * (`portabilityPolicy.defaultProvenance`) so that annotating a resource stays a one-line cost; the\n * per-field decorator overrides it where a field differs.\n *\n * ⚠️ NOT a redaction or scrub concept. This says where a value CAME FROM, for a disclosure\n * decision. What happens to a value on ERASURE is `.impersonalizeWith()` / `RedactionType`, a\n * different axis entirely — a field can be `SUBJECT_PROVIDED` and also masked on erasure.\n */\nexport enum DataPortabilityProvenance {\n  /**\n   * The subject actively and knowingly supplied this value — form input, an uploaded file, a\n   * setting they chose. Unambiguously in scope for both rights.\n   */\n  SUBJECT_PROVIDED = 'subject_provided',\n\n  /**\n   * Generated by the subject's USE of the service rather than typed by them — activity timestamps,\n   * event history, usage counters, telemetry. **In scope for Art. 20**, which is the whole reason\n   * this member exists separately from {@link DERIVED}.\n   */\n  OBSERVED = 'observed',\n\n  /**\n   * Produced BY the controller about the subject — inferred classifications, computed scores,\n   * risk or segmentation labels, server-assigned lifecycle state. Disclosed under Art. 15 (the\n   * subject may see what we concluded about them) but **excluded from Art. 20** (a portability\n   * request is not a channel for exporting the controller's own analysis).\n   */\n  DERIVED = 'derived',\n}\n\n/**\n * What an export does with ONE child-direction edge of the subject.\n *\n * ## Why this is NOT `SubjectErasureDisposition`\n *\n * Erasure and export share a traversal and answer opposite questions — *what do I destroy?* versus\n * *what must I disclose?* — and they diverge on exactly the edges erasure calls `NOT_OWNED`.\n *\n * Erasure leaves audit logs, memberships and job executions alone, correctly: you do not delete an\n * audit log because a user exercised a right. But those same rows hold personal data CONCERNING the\n * subject, and Art. 15 covers \"all personal data concerning him or her\" — not \"rows he owns\".\n * Reusing erasure's vocabulary verbatim would have silently omitted the data an access request most\n * often targets. Hence {@link INCLUDED_REFERENCES_SUBJECT}, a case erasure has no use for.\n *\n * The two classifiers still read the SAME upstream authority for what an edge *says*\n * (`requireResolvedRelationshipSemantics`), so they can never disagree about ownership — only about\n * what to do with it.\n *\n * ## Why there is no blocking disposition here\n *\n * Erasure refuses up-front on `UNCLASSIFIED` / `UNSUPPORTED_DEFERRED` because it is about to\n * WRITE, cannot half-destroy a subject, and needs a teardown declaration nobody made. An export\n * writes nothing: ownership alone answers the edge question, a deferred teardown is irrelevant to a\n * read, and a cross-adapter dependent is merely a second query rather than a broken transaction.\n * The one genuine refusal in an export is field-level and Art. 20-only — see\n * {@link SubjectExportFieldScope.UNDECLARED}. Manufacturing an edge-level blocker for symmetry\n * would be false symmetry.\n */\nexport enum SubjectExportEdgeDisposition {\n  /**\n   * The subject OWNS this dependent (`lifecycleModelMode: DEPENDENT`), so its rows are the\n   * subject's own data. Included for both purposes — for Art. 20 the per-field provenance filter\n   * still applies to what comes back.\n   */\n  INCLUDED_OWNED = 'included_owned',\n\n  /**\n   * The subject does NOT own these rows, but they REFERENCE the subject — the far side carries a\n   * foreign key back to them (an audit log, an organization membership, a job execution).\n   *\n   * **Art. 15 only.** These are personal data concerning the subject, so an access request must\n   * disclose them. A portability request must not: the subject did not provide a row that a third\n   * party or the controller created about them, and shipping them would export the controller's\n   * operational records under a transfer right. For `PORTABILITY_ART_20` this same edge classifies\n   * as {@link EXCLUDED_NOT_SUBJECT_PROVIDED}.\n   */\n  INCLUDED_REFERENCES_SUBJECT = 'included_references_subject',\n\n  /**\n   * The edge carries no personal data of the subject at all: an independent or link-only\n   * relationship whose far side does not even reference them, or a disabled relationship that is\n   * not part of the live graph. Out of scope for both rights.\n   */\n  EXCLUDED_NOT_SUBJECT_DATA = 'excluded_not_subject_data',\n\n  /**\n   * In scope for access, but excluded from THIS export because the export is a portability request\n   * and the rows were not provided by the subject. Kept as its own member rather than collapsing\n   * into {@link EXCLUDED_NOT_SUBJECT_DATA}: a reviewer asking \"why is my audit trail missing from\n   * my portability export?\" needs \"because Art. 20 does not cover controller records\" and \"because\n   * that edge holds nothing about you\" to be different answers, and only the first is a legal\n   * position someone took.\n   */\n  EXCLUDED_NOT_SUBJECT_PROVIDED = 'excluded_not_subject_provided',\n\n  /**\n   * The rows ARE the subject's data and the right covers them, but the resource is declared\n   * `systemAccessPolicy.exportSubject = FORBIDDEN` — someone decided it must never reach a data\n   * subject (an authentication-credential store, a security audit trail).\n   *\n   * ## Why this excludes rather than refusing\n   *\n   * An UNDECLARED resource refuses the whole export, because nobody has decided yet and refusing is\n   * what forces the decision. A FORBIDDEN one is the opposite: the decision exists, and refusing\n   * would make it permanent sabotage — a `USERS` access export whose graph touches a credential\n   * store could then NEVER run, no matter how many other resources opted in. Honouring the\n   * declaration means leaving those rows out and saying so.\n   *\n   * ⚠️ This applies to EDGES only. A subject whose OWN resource is FORBIDDEN still refuses: there is\n   * no export of a person whose identity row may not be disclosed, and silently returning an\n   * edges-only bundle would be a disclosure that omits its own subject.\n   */\n  EXCLUDED_NOT_DISCLOSABLE = 'excluded_not_disclosable',\n}\n\n/** Whether an edge disposition puts the far side's rows INTO the bundle. */\nexport function isIncludedSubjectExportEdgeDisposition(\n  disposition: SubjectExportEdgeDisposition,\n): boolean {\n  return disposition === SubjectExportEdgeDisposition.INCLUDED_OWNED\n    || disposition === SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT;\n}\n\n/** The classification of ONE child-direction edge of an export subject. */\nexport interface SubjectExportEdgeClassification {\n  /** The related resource on the far side of the edge. */\n  relatedResourceType: ResourceType;\n  /** Whether, and why, this edge's rows join the bundle. */\n  disposition: SubjectExportEdgeDisposition;\n  /**\n   * Human-readable justification quoting the configuration that produced it. Surfaced in the export\n   * report so a data-protection reviewer never has to re-derive WHY a resource was included or\n   * left out — which, for a disclosure obligation, is the evidence that matters.\n   */\n  reason: string;\n}\n\n/**\n * Classify what an export must do with ONE child-direction edge — the disclose-vs-omit decision,\n * DERIVED FROM CONFIGURATION rather than a hardcoded list of resource types.\n *\n * ## Where the answer comes from\n *\n * Two declarations the author already makes, read through the same shared authorities the delete\n * cascade and the erasure orchestrator read, so the three can never disagree about what an edge is:\n *\n *  1. **`handling.lifecycleModelMode`** — does the subject own this related resource's lifecycle?\n *     `DEPENDENT` means the rows are the subject's own data.\n *  2. **Foreign-key topology** (`resolveForeignKeyHolderResourceType`, cardinality-only and\n *     therefore pure) — for a NON-owned edge, does the far side nonetheless carry a reference back\n *     to the subject? If it does, its rows are *about* the subject and Art. 15 must disclose them.\n *\n * ## The `purpose` parameter, and why it is a parameter\n *\n * Art. 15 and Art. 20 diverge on exactly one edge case — the referencing-but-not-owned edge — and\n * keeping that divergence in ONE switch here is what stops two near-identical classifiers from\n * drifting apart. Exposing `classifyForAccess` / `classifyForPortability` would duplicate the\n * ownership logic, and the day someone fixes a bug in one they would miss the other.\n *\n * ## Caller contract\n *\n * `relationship.resourceType2` MUST be the far side and `resourceType1` the subject — the same\n * child-direction normalization {@link classifySubjectErasureDisposition} requires. The caller\n * filters to child-direction edges before classifying.\n *\n * Pure and side-effect free — no registry lookups, no I/O, no row reads — so it is equally usable\n * from a runtime orchestrator and from a boot-time coherence guard.\n */\nexport function classifySubjectExportDisposition(\n  relationship: ResourceRelationship,\n  purpose: SubjectExportPurpose,\n): SubjectExportEdgeClassification {\n  const relatedResourceType = relationship.resourceType2 as ResourceType;\n  const classify = (\n    disposition: SubjectExportEdgeDisposition,\n    reason: string,\n  ): SubjectExportEdgeClassification => ({ relatedResourceType, disposition, reason });\n\n  // A disabled relationship is not part of the live graph — the runtime never traverses it, so\n  // there are no rows behind it to disclose.\n  if (relationship.isDisabled === true) {\n    return classify(\n      SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n      'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n    );\n  }\n\n  const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n  const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n  if (lifecycleModel === RelationshipLifecycleModel.DEPENDENT) {\n    return classify(\n      SubjectExportEdgeDisposition.INCLUDED_OWNED,\n      'lifecycleModelMode is DEPENDENT: the subject owns these rows, so they are the subject\\'s '\n        + 'own data and belong in the bundle',\n    );\n  }\n\n  // NOT owned from here on. The rows still count as personal data if they POINT AT the subject —\n  // which is the Art. 15 / Art. 20 fork.\n  const foreignKeyHolder = Resources_SharedUtils.resolveForeignKeyHolderResourceType(relationship);\n  const farSideReferencesSubject = foreignKeyHolder === relationship.resourceType2;\n\n  if (!farSideReferencesSubject) {\n    return classify(\n      SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n      `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT) and the far side does not hold a `\n        + 'foreign key to the subject, so these rows are neither owned by nor about the subject',\n    );\n  }\n\n  switch (purpose) {\n    case SubjectExportPurpose.ACCESS_ART_15:\n      return classify(\n        SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT,\n        `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT), but the far side holds a `\n          + 'foreign key to the subject, so these rows are personal data CONCERNING the subject '\n          + 'and Art. 15 requires disclosing them',\n      );\n\n    case SubjectExportPurpose.PORTABILITY_ART_20:\n      return classify(\n        SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_PROVIDED,\n        `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): these rows reference the `\n          + 'subject but were created by the controller or a third party rather than provided by '\n          + 'the subject, so Art. 20 does not cover them (they ARE disclosed under Art. 15)',\n      );\n\n    default: {\n      // Compile-time exhaustiveness: a new SubjectExportPurpose without an arm here is a TYPE\n      // error, not a silent runtime discovery on someone's disclosure request.\n      const _exhaustivePurposeCheck: never = purpose;\n      throw new Error(\n        `classifySubjectExportDisposition has no arm for export purpose `\n          + `'${String(_exhaustivePurposeCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * The three relationship buckets exposed by a compiled resource configuration.\n *\n * Kept structural here so the privacy compiler does not import resource configuration schemas:\n * those schemas already import this module for {@link DataPortabilityProvenance}.\n */\nexport interface SubjectExportRelationshipBuckets {\n  readonly parentRelationships: readonly ResourceRelationship[];\n  readonly childRelationships: readonly ResourceRelationship[];\n  readonly selfRelationships: readonly ResourceRelationship[];\n}\n\n/** One graph edge normalized so the export subject is always `resourceType1`. */\nexport interface SubjectExportRelationshipTraversal {\n  /** Original compiled relationship; runtime adapters use it to resolve the real FK field. */\n  readonly relationship: ResourceRelationship;\n  /** Direction-normalized relationship consumed by the shared legal-scope classifier. */\n  readonly normalizedRelationship: ResourceRelationship;\n  readonly classification: SubjectExportEdgeClassification;\n}\n\n/**\n * Enumerate every edge touching one export subject, including child-first reference declarations.\n *\n * Resource configurations deliberately preserve parent/child/self buckets. Subject disclosure is\n * different: personal data can point *to* the subject from either authored orientation. This helper\n * joins both directional buckets, includes self edges once, and swaps only the positional topology\n * needed by {@link classifySubjectExportDisposition}. It preserves the original compiled edge for\n * FK resolution and never collapses multiple foreign keys between the same resource pair.\n */\nexport function enumerateSubjectExportRelationshipTraversals(\n  subjectResourceType: ResourceType,\n  relationships: SubjectExportRelationshipBuckets,\n  purpose: SubjectExportPurpose,\n): SubjectExportRelationshipTraversal[] {\n  const touchingRelationships = [\n    ...relationships.childRelationships,\n    ...relationships.parentRelationships,\n    ...relationships.selfRelationships,\n  ];\n  return touchingRelationships\n    .map((relationship): SubjectExportRelationshipTraversal => {\n      if (relationship.resourceType1 !== subjectResourceType && relationship.resourceType2 !== subjectResourceType) {\n        throw new Error(\n          `Subject-export relationship traversal for ${String(subjectResourceType)} received unrelated edge `\n            + `${String(relationship.resourceType1)} -> ${String(relationship.resourceType2)}.`,\n        );\n      }\n      const normalizedRelationship = relationship.resourceType1 === subjectResourceType\n        ? relationship\n        : {\n            ...relationship,\n            resourceType1: relationship.resourceType2,\n            resourceType2: relationship.resourceType1,\n            cardinality1: relationship.cardinality2,\n            cardinality2: relationship.cardinality1,\n          };\n      return {\n        relationship,\n        normalizedRelationship,\n        classification: classifySubjectExportDisposition(normalizedRelationship, purpose),\n      };\n    })\n    .sort((left, right) => compareCanonicalText(subjectExportRelationshipTraversalKey(left), subjectExportRelationshipTraversalKey(right)));\n}\n\n/** Stable identity retaining distinct foreign keys between otherwise identical resource pairs. */\nexport function subjectExportRelationshipTraversalKey(traversal: SubjectExportRelationshipTraversal): string {\n  const relationship = traversal.normalizedRelationship;\n  return [\n    relationship.resourceType1,\n    relationship.resourceType2,\n    relationship.cardinality1,\n    relationship.cardinality2,\n    relationship.nature,\n    relationship.foreignKeyField ?? '',\n    traversal.classification.disposition,\n  ].join('\\0');\n}\n\n/**\n * Whether ONE field's value joins the bundle, for a given purpose.\n *\n * Separate from {@link SubjectExportEdgeDisposition} because the two answer different questions at\n * different granularities: an edge decides whether a RESOURCE's rows are in scope at all, a field\n * scope decides which COLUMNS of an in-scope row survive the Art. 20 narrowing.\n */\nexport enum SubjectExportFieldScope {\n  /** The field's value belongs in this bundle. */\n  INCLUDED = 'included',\n\n  /**\n   * Excluded because the value is controller-DERIVED and this is a portability request. Never\n   * reached for `ACCESS_ART_15`, which discloses derived data.\n   */\n  EXCLUDED_DERIVED = 'excluded_derived',\n\n  /**\n   * ⛔ NO ANSWER — the field carries no provenance declaration and none is inherited from its\n   * resource, while the export is a portability request that needs one.\n   *\n   * The export REFUSES rather than guessing, because both guesses are harmful and neither is the\n   * conservative one: excluding an undeclared field UNDER-DELIVERS a legal right the subject is\n   * owed, and including it OVER-SHARES data the controller derived. There is no safe default to\n   * fall back on, which is exactly the condition that justifies failing loud — the same reasoning\n   * that makes `SubjectErasureDisposition.UNCLASSIFIED` refuse an erasure.\n   *\n   * `ACCESS_ART_15` never produces this: access includes every field regardless of provenance, so\n   * an application can serve access requests before annotating anything.\n   */\n  UNDECLARED = 'undeclared',\n}\n\n/** Whether a field scope must ABORT the export rather than merely omitting a value. */\nexport function isBlockingSubjectExportFieldScope(scope: SubjectExportFieldScope): boolean {\n  return scope === SubjectExportFieldScope.UNDECLARED;\n}\n\n/**\n * Decide whether one field's value belongs in the bundle.\n *\n * `provenance` is the field's EFFECTIVE provenance — its own `.portabilityProvenance()` declaration\n * if it carries one, otherwise the resource's `portabilityPolicy.defaultProvenance`, otherwise\n * `undefined`. Resolving that fallback chain is the factory's job (Phase 0B); this function only\n * judges the resolved value, which keeps it pure and independently testable.\n */\nexport function resolveSubjectExportFieldScope(\n  provenance: DataPortabilityProvenance | undefined,\n  purpose: SubjectExportPurpose,\n): SubjectExportFieldScope {\n  switch (purpose) {\n    // Access discloses everything concerning the subject, so provenance is simply not a question it\n    // asks — an unannotated application can still answer an Art. 15 request in full.\n    case SubjectExportPurpose.ACCESS_ART_15:\n      return SubjectExportFieldScope.INCLUDED;\n\n    case SubjectExportPurpose.PORTABILITY_ART_20:\n      return resolvePortabilityFieldScope(provenance);\n\n    default: {\n      // Compile-time exhaustiveness on the PURPOSE axis too. Without this arm a third right added\n      // to the enum would silently inherit the portability narrowing — a disclosure boundary\n      // decided by fall-through rather than by anyone.\n      const _exhaustivePurposeCheck: never = purpose;\n      throw new Error(\n        `resolveSubjectExportFieldScope has no arm for export purpose `\n          + `'${String(_exhaustivePurposeCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * The Art. 20 narrowing, split out so {@link resolveSubjectExportFieldScope} can switch\n * exhaustively on `purpose` while this switches exhaustively on `provenance`. Module-private: the\n * purpose gate is not optional, and a caller reaching this directly would bypass it.\n */\nfunction resolvePortabilityFieldScope(\n  provenance: DataPortabilityProvenance | undefined,\n): SubjectExportFieldScope {\n  if (provenance === undefined) {\n    return SubjectExportFieldScope.UNDECLARED;\n  }\n\n  switch (provenance) {\n    // Both are \"provided by the data subject\" in the Art. 20 sense — OBSERVED is data generated by\n    // the subject's USE of the service, which the guidance places in scope even though the subject\n    // never typed it.\n    case DataPortabilityProvenance.SUBJECT_PROVIDED:\n    case DataPortabilityProvenance.OBSERVED:\n      return SubjectExportFieldScope.INCLUDED;\n\n    case DataPortabilityProvenance.DERIVED:\n      return SubjectExportFieldScope.EXCLUDED_DERIVED;\n\n    default: {\n      // Compile-time exhaustiveness: a new provenance member without an arm is a TYPE error here.\n      const _exhaustiveProvenanceCheck: never = provenance;\n      throw new Error(\n        `resolvePortabilityFieldScope has no arm for provenance `\n          + `'${String(_exhaustiveProvenanceCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * Is this field withheld from EVERY subject export, whatever right is being answered?\n *\n * ## Why this exists at all — the layering trap it closes\n *\n * The export orchestrator collects rows at the REPOSITORY layer, which sits BELOW the service-layer\n * DTO projection that normally strips `.isBackendOnly()` fields on their way to a client. Without an\n * explicit check here, a subject export would disclose exactly the values that projection exists to\n * hide — `passwordHash` and `backupCodesHashed` on `USER_CREDENTIALS` are the motivating case, and\n * the config change that exposed them would have looked entirely routine.\n *\n * ## Why it is deliberately CONSERVATIVE\n *\n * This withholds every backend-only field, not only the secrets. Some backend-only fields are\n * genuinely disclosable under Art. 15 (`passwordChangedAt`, `firstMfaPromptAt` — facts about the\n * subject they may ask for), so this errs toward withholding.\n *\n * That asymmetry is intentional. Under-disclosing produces a complaint that is answerable and\n * fixable; disclosing an authentication secret is neither, and it degrades the security of\n * processing the framework is separately obliged to maintain (GDPR Art. 32). Between an\n * over-cautious bundle and a leaked credential, only one is recoverable.\n *\n * The withheld fields are REPORTED (`SubjectExportReport.fieldsWithheldAsNonDisclosable`) so the\n * caution is visible rather than silent. When a resource needs a specific backend-only field\n * disclosed, the expressible extension is a per-field opt-in on this predicate — NOT loosening it\n * wholesale.\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n */\nexport function isFieldWithheldFromSubjectExport(fieldSchema: z.ZodTypeAny): boolean {\n  // Delegated to the ONE field-value disclosure rule rather than restated. The reasoning that used\n  // to sit here — that `isWriteOnlySecret` is checked explicitly rather than assumed to imply\n  // backend-only, because they are separate decorators and a future authoring form may set one\n  // without the other — moved WITH the rule, and is now the shared module's own justification.\n  //\n  // This function keeps its own name and its own assurance marker deliberately: subject export is a\n  // distinct obligation from model disclosure, its own docstring anticipates a per-field opt-in that\n  // would apply HERE and nowhere else, and merging the two names would make that extension\n  // unexpressible. What is shared is the rule, not the concept.\n  return isNonDisclosableFieldValue(fieldSchema);\n}\n\n/** Every legal {@link DataPortabilityProvenance} value, for validating an opaque decorator string. */\nconst KNOWN_PORTABILITY_PROVENANCES: ReadonlySet<string> = new Set(\n  Object.values(DataPortabilityProvenance),\n);\n\n/**\n * Resolve ONE field's EFFECTIVE provenance by joining the two declaration levels.\n *\n * ## The fallback chain, and why it has exactly two rungs\n *\n * 1. the field's own `.portabilityProvenance()` declaration, if it carries one;\n * 2. otherwise the resource's `portabilityPolicy.defaultProvenance`;\n * 3. otherwise `undefined` — which {@link resolveSubjectExportFieldScope} turns into a REFUSAL for\n *    an Art. 20 export and ignores entirely for Art. 15.\n *\n * Two rungs is what makes the fail-loud rule adoptable: without the resource default, every field of\n * every resource would need a decorator before a single portability request could be answered, and a\n * capability that expensive to adopt does not get adopted. With it, annotating a resource is one\n * line and only the exceptions carry a decorator.\n *\n * ## Why the enum check lives HERE\n *\n * `zod-decorators` sits below this package and cannot import {@link DataPortabilityProvenance}, so\n * it stores whatever non-empty string it was given — it can reject a BLANK but not a WRONG value.\n * This is the first layer that knows the vocabulary, so it is where a typo'd `'subject-provided'`\n * (hyphen, not underscore) must fail rather than silently resolving to `undefined` and turning a\n * declared field into a refusal — or worse, into a silent omission if the caller treats unknown as\n * derived. Mirrors how `RedactionType` validity is checked in this layer for `.impersonalizeWith()`.\n *\n * @param fieldSchema the field's Zod schema; the reader walks wrapper types, so a declaration made\n *   before or after `.optional()` / `.nullish()` / `.default()` is observed either way.\n * @param resourceDefaultProvenance the owning resource's `portabilityPolicy.defaultProvenance`.\n *   Taken as a bare value rather than the policy object so this module stays free of the\n *   resource-config import (which imports THIS module for the enum).\n * @param fieldLocator `resourceType.fieldName`, used only to make a rejection actionable.\n */\nexport function resolveEffectiveFieldPortabilityProvenance(\n  fieldSchema: z.ZodTypeAny,\n  resourceDefaultProvenance: DataPortabilityProvenance | undefined,\n  fieldLocator: string,\n): DataPortabilityProvenance | undefined {\n  const declared = getPortabilityProvenance(fieldSchema);\n\n  if (declared === undefined) {\n    return resourceDefaultProvenance;\n  }\n\n  if (!KNOWN_PORTABILITY_PROVENANCES.has(declared)) {\n    throw new Error(\n      `[${fieldLocator}] portabilityProvenance('${declared}') is not a DataPortabilityProvenance `\n        + `value. Expected one of: ${[...KNOWN_PORTABILITY_PROVENANCES].join(', ')}. An unrecognised `\n        + `value would resolve as UNDECLARED and make an Art. 20 export refuse, hiding the typo `\n        + `behind what looks like a deliberate omission.`,\n    );\n  }\n\n  return declared as DataPortabilityProvenance;\n}\n\n/** Why a compiled leaf-field decision has its effective export meaning. */\nexport enum SubjectExportFieldDecisionBasis {\n  FIELD_DECLARATION = 'field_declaration',\n  RESOURCE_DEFAULT = 'resource_default',\n  WITHHELD_NON_DISCLOSABLE = 'withheld_non_disclosable',\n  UNDECLARED = 'undeclared',\n  DEPTH_LIMIT = 'depth_limit',\n}\n\n/** Canonical, runtime-effective decision for one leaf path in one export purpose. */\nexport interface SubjectExportFieldDecision {\n  readonly locator: string;\n  readonly purpose: SubjectExportPurpose;\n  readonly scope: SubjectExportFieldScope | null;\n  readonly provenance: DataPortabilityProvenance | null;\n  readonly basis: SubjectExportFieldDecisionBasis;\n}\n\nconst SUBJECT_EXPORT_FIELD_MAX_DEPTH = 10;\n\n/**\n * Resolve an object shape through the same bounded wrapper protocol used by subject export.\n * Returning `undefined` means the value is a leaf. Reaching the bound is handled fail-closed by\n * {@link compileSubjectExportFieldDecisions}, never as an implicit leaf inclusion.\n */\nexport function resolveSubjectExportObjectShapeThroughWrappers(schema: unknown): Record<string, unknown> | undefined {\n  let current: any = schema;\n  for (let unwrapDepth = 0; current && unwrapDepth < SUBJECT_EXPORT_FIELD_MAX_DEPTH; unwrapDepth += 1) {\n    if (current.shape && typeof current.shape === 'object') return current.shape as Record<string, unknown>;\n    const inner = current.def?.innerType ?? current._def?.innerType;\n    if (!inner) return undefined;\n    current = inner;\n  }\n  return undefined;\n}\n\n/**\n * Compile every runtime-effective leaf-field decision for one resource and right.\n *\n * Both the backend executor and application authority proof consume this function. A field-level\n * decorator, inherited default, withheld marker, wrapper layout or depth refusal therefore changes\n * one shared decision inventory instead of two independently maintained interpretations.\n */\nexport function compileSubjectExportFieldDecisions(input: {\n  readonly resourceType: ResourceType;\n  readonly mainSchema: unknown;\n  readonly defaultProvenance: DataPortabilityProvenance | undefined;\n  readonly purpose: SubjectExportPurpose;\n}): SubjectExportFieldDecision[] {\n  const rootShape = resolveSubjectExportObjectShapeThroughWrappers(input.mainSchema);\n  if (!rootShape) return [];\n  const decisions: SubjectExportFieldDecision[] = [];\n\n  const visit = (shape: Record<string, unknown>, locatorPrefix: string, depth: number): void => {\n    for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n      const locator = `${locatorPrefix}.${fieldName}`;\n      if (depth >= SUBJECT_EXPORT_FIELD_MAX_DEPTH) {\n        decisions.push({\n          locator,\n          purpose: input.purpose,\n          scope: SubjectExportFieldScope.UNDECLARED,\n          provenance: null,\n          basis: SubjectExportFieldDecisionBasis.DEPTH_LIMIT,\n        });\n        continue;\n      }\n      if (isFieldWithheldFromSubjectExport(fieldSchema as z.ZodTypeAny)) {\n        decisions.push({\n          locator,\n          purpose: input.purpose,\n          scope: null,\n          provenance: null,\n          basis: SubjectExportFieldDecisionBasis.WITHHELD_NON_DISCLOSABLE,\n        });\n        continue;\n      }\n      const nestedShape = resolveSubjectExportObjectShapeThroughWrappers(fieldSchema);\n      if (nestedShape) {\n        visit(nestedShape, locator, depth + 1);\n        continue;\n      }\n      const declared = getPortabilityProvenance(fieldSchema as z.ZodTypeAny);\n      const provenance = resolveEffectiveFieldPortabilityProvenance(fieldSchema as z.ZodTypeAny, input.defaultProvenance, locator);\n      decisions.push({\n        locator,\n        purpose: input.purpose,\n        scope: resolveSubjectExportFieldScope(provenance, input.purpose),\n        provenance: provenance ?? null,\n        basis: declared !== undefined\n          ? SubjectExportFieldDecisionBasis.FIELD_DECLARATION\n          : provenance !== undefined\n            ? SubjectExportFieldDecisionBasis.RESOURCE_DEFAULT\n            : SubjectExportFieldDecisionBasis.UNDECLARED,\n      });\n    }\n  };\n\n  visit(rootShape, String(input.resourceType), 0);\n  return decisions.sort((left, right) => compareCanonicalText(left.locator, right.locator));\n}\n\n/** Per-edge outcome of an executed export — the classification plus what actually happened. */\nexport interface SubjectExportEdgeOutcome extends SubjectExportEdgeClassification {\n  /**\n   * `true` when the export actually queried this edge. Note this reports that the read RAN, not\n   * that rows existed — an included edge with no rows for this subject is a legitimate empty\n   * result, and {@link recordCount} distinguishes the two.\n   */\n  collected: boolean;\n  /** How many rows this edge contributed. `0` on an included edge means the subject had none. */\n  recordCount: number;\n}\n\n/**\n * What one subject export produced — the compliance artifact of an Art. 15 or Art. 20 request.\n *\n * Returned to the caller (rather than only logged) so the flow fronting the request can record or\n * surface it: every edge of the subject appears exactly once with the disposition applied and the\n * configuration that justified it. For a disclosure obligation, the record of what was DELIBERATELY\n * LEFT OUT — and on what legal basis — matters as much as the data returned.\n */\nexport interface SubjectExportReport {\n  /** Which right this export answered. */\n  purpose: SubjectExportPurpose;\n  /** The exported subject's resource type. */\n  subjectResourceType: ResourceType;\n  /** The exported subject rows. */\n  subjectIds: string[];\n  /** Every child-direction edge of the subject, classified, in registry order. */\n  edges: SubjectExportEdgeOutcome[];\n  /**\n   * Fields omitted from the bundle as controller-DERIVED, as `resourceType.fieldName`. Populated\n   * only for `PORTABILITY_ART_20`. Recorded rather than silently dropped so the subject can see\n   * that derived data exists and request it under Art. 15 instead.\n   */\n  fieldsExcludedAsDerived: string[];\n  /**\n   * Fields withheld as NON-DISCLOSABLE regardless of purpose — see\n   * {@link isFieldWithheldFromSubjectExport}. Populated for BOTH rights, because a password hash is\n   * no more disclosable under Art. 15 than under Art. 20.\n   *\n   * Recorded rather than silently dropped for the same reason as the derived list, and one more: a\n   * reviewer auditing why an export looks thin needs to see that the framework withheld something\n   * deliberately, not that a resource was missed.\n   */\n  fieldsWithheldAsNonDisclosable: string[];\n  /** Total rows across every collected edge, including the subject's own row(s). */\n  totalRecordCount: number;\n}\n\n/** One resource's contribution to an export bundle. */\nexport interface SubjectExportResourceSlice {\n  resourceType: ResourceType;\n  /**\n   * The rows, already narrowed to the fields in scope for the export's purpose. For\n   * `PORTABILITY_ART_20` the controller-derived columns are gone; for `ACCESS_ART_15` every column\n   * the subject is entitled to see is present.\n   */\n  rows: Record<string, unknown>[];\n}\n\n/**\n * What an export ACTUALLY produced — the data, paired with the report that justifies its shape.\n *\n * ## Why the data and the report are one return value but two types\n *\n * {@link SubjectExportReport} is the compliance artifact: it survives the request, is safe to log\n * and persist, and contains NO personal data — only per-edge dispositions and counts. The slices\n * are the personal data itself, which must NOT be logged and whose lifetime ends when the artifact\n * is written.\n *\n * Returning them together keeps the caller from having to correlate two results, while the type\n * split keeps \"safe to record\" and \"must be handled carefully\" visibly distinct — a caller writing\n * `logger.info({ report })` is correct, and the same line with `bundle` would be a leak. Fusing\n * them into one flat object would erase exactly that distinction.\n */\nexport interface SubjectExportBundle {\n  report: SubjectExportReport;\n  slices: SubjectExportResourceSlice[];\n}\n"]}
+{"version":3,"file":"subject-export.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAG/E,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,uDAA+B,CAAA;IAE/B;;;;OAIG;IACH,iEAAyC,CAAA;AAC3C,CAAC,EAdW,oBAAoB,KAApB,oBAAoB,QAc/B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,yBAqBX;AArBD,WAAY,yBAAyB;IACnC;;;OAGG;IACH,kEAAqC,CAAA;IAErC;;;;OAIG;IACH,kDAAqB,CAAA;IAErB;;;;;OAKG;IACH,gDAAmB,CAAA;AACrB,CAAC,EArBW,yBAAyB,KAAzB,yBAAyB,QAqBpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAN,IAAY,4BAuDX;AAvDD,WAAY,4BAA4B;IACtC;;;;OAIG;IACH,iEAAiC,CAAA;IAEjC;;;;;;;;;OASG;IACH,2FAA2D,CAAA;IAE3D;;;;OAIG;IACH,uFAAuD,CAAA;IAEvD;;;;;;;OAOG;IACH,+FAA+D,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,qFAAqD,CAAA;AACvD,CAAC,EAvDW,4BAA4B,KAA5B,4BAA4B,QAuDvC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sCAAsC,CACpD,WAAyC;IAEzC,OAAO,WAAW,KAAK,4BAA4B,CAAC,cAAc;WAC7D,WAAW,KAAK,4BAA4B,CAAC,2BAA2B,CAAC;AAChF,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gCAAgC,CAC9C,YAAkC,EAClC,OAA6B;IAE7B,MAAM,mBAAmB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACvE,MAAM,QAAQ,GAAG,CACf,WAAyC,EACzC,MAAc,EACmB,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAErF,6FAA6F;IAC7F,2CAA2C;IAC3C,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,4BAA4B,CAAC,cAAc,EAC3C,2FAA2F;cACvF,mCAAmC,CACxC,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,mCAAmC,CAAC,YAAY,CAAC,CAAC;IACjG,MAAM,wBAAwB,GAAG,gBAAgB,KAAK,YAAY,CAAC,aAAa,CAAC;IAEjF,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,OAAO,QAAQ,CACb,4BAA4B,CAAC,yBAAyB,EACtD,0BAA0B,cAAc,qDAAqD;cACzF,sFAAsF,CAC3F,CAAC;IACJ,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,QAAQ,CACb,4BAA4B,CAAC,2BAA2B,EACxD,0BAA0B,cAAc,8CAA8C;kBAClF,qFAAqF;kBACrF,sCAAsC,CAC3C,CAAC;QAEJ,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,QAAQ,CACb,4BAA4B,CAAC,6BAA6B,EAC1D,0BAA0B,cAAc,8CAA8C;kBAClF,sFAAsF;kBACtF,gFAAgF,CACrF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,wFAAwF;YACxF,yEAAyE;YACzE,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,iEAAiE;kBAC7D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAuBD;;;;;;;;GAQG;AACH,MAAM,UAAU,4CAA4C,CAC1D,mBAAiC,EACjC,aAA+C,EAC/C,OAA6B;IAE7B,MAAM,qBAAqB,GAAG;QAC5B,GAAG,aAAa,CAAC,kBAAkB;QACnC,GAAG,aAAa,CAAC,mBAAmB;QACpC,GAAG,aAAa,CAAC,iBAAiB;KACnC,CAAC;IACF,OAAO,qBAAqB;SACzB,GAAG,CAAC,CAAC,YAAY,EAAsC,EAAE;QACxD,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,IAAI,YAAY,CAAC,aAAa,KAAK,mBAAmB,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,CAAC,mBAAmB,CAAC,2BAA2B;kBAC/F,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,sBAAsB,GAAG,YAAY,CAAC,aAAa,KAAK,mBAAmB;YAC/E,CAAC,CAAC,YAAY;YACd,CAAC,CAAC;gBACE,GAAG,YAAY;gBACf,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,YAAY,EAAE,YAAY,CAAC,YAAY;aACxC,CAAC;QACN,OAAO;YACL,YAAY;YACZ,sBAAsB;YACtB,cAAc,EAAE,gCAAgC,CAAC,sBAAsB,EAAE,OAAO,CAAC;SAClF,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE,qCAAqC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5I,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qCAAqC,CAAC,SAA6C;IACjG,MAAM,YAAY,GAAG,SAAS,CAAC,sBAAsB,CAAC;IACtD,OAAO;QACL,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,aAAa;QAC1B,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,YAAY;QACzB,YAAY,CAAC,MAAM;QACnB,YAAY,CAAC,eAAe,IAAI,EAAE;QAClC,SAAS,CAAC,cAAc,CAAC,WAAW;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC,gDAAgD;IAChD,gDAAqB,CAAA;IAErB;;;OAGG;IACH,gEAAqC,CAAA;IAErC;;;;;;;;;;;;OAYG;IACH,oDAAyB,CAAA;AAC3B,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AAED,uFAAuF;AACvF,MAAM,UAAU,iCAAiC,CAAC,KAA8B;IAC9E,OAAO,KAAK,KAAK,uBAAuB,CAAC,UAAU,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAiD,EACjD,OAA6B;IAE7B,QAAQ,OAAO,EAAE,CAAC;QAChB,gGAAgG;QAChG,iFAAiF;QACjF,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,oBAAoB,CAAC,kBAAkB;YAC1C,OAAO,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,uFAAuF;YACvF,iDAAiD;YACjD,MAAM,uBAAuB,GAAU,OAAO,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,+DAA+D;kBAC3D,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CACnC,UAAiD;IAEjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,uBAAuB,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,QAAQ,UAAU,EAAE,CAAC;QACnB,+FAA+F;QAC/F,+FAA+F;QAC/F,kBAAkB;QAClB,KAAK,yBAAyB,CAAC,gBAAgB,CAAC;QAChD,KAAK,yBAAyB,CAAC,QAAQ;YACrC,OAAO,uBAAuB,CAAC,QAAQ,CAAC;QAE1C,KAAK,yBAAyB,CAAC,OAAO;YACpC,OAAO,uBAAuB,CAAC,gBAAgB,CAAC;QAElD,OAAO,CAAC,CAAC,CAAC;YACR,4FAA4F;YAC5F,MAAM,0BAA0B,GAAU,UAAU,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,yDAAyD;kBACrD,IAAI,MAAM,CAAC,0BAA0B,CAAC,GAAG,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAyB;IACxE,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,yFAAyF;IACzF,8DAA8D;IAC9D,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,sGAAsG;AACtG,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CACzC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0CAA0C,CACxD,WAAyB,EACzB,yBAAgE,EAChE,YAAoB;IAEpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,IAAI,YAAY,4BAA4B,QAAQ,wCAAwC;cACxF,2BAA2B,CAAC,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;cAC5F,uFAAuF;cACvF,+CAA+C,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,QAAqC,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,0EAAuC,CAAA;IACvC,wEAAqC,CAAA;IACrC,wFAAqD,CAAA;IACrD,4DAAyB,CAAA;IACzB,8DAA2B,CAAA;AAC7B,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAWD,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,MAAe;IAC5E,IAAI,OAAO,GAAQ,MAAM,CAAC;IAC1B,KAAK,IAAI,WAAW,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,GAAG,8BAA8B,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC;QACpG,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,KAAgC,CAAC;QACxG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAKlD;IACC,MAAM,SAAS,GAAG,8CAA8C,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAiC,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,aAAqB,EAAE,KAAa,EAAQ,EAAE;QAC3F,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,SAAS,EAAE,CAAC;YAChD,IAAI,KAAK,IAAI,8BAA8B,EAAE,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,uBAAuB,CAAC,UAAU;oBACzC,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,WAAW;iBACnD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,gCAAgC,CAAC,WAA2B,CAAC,EAAE,CAAC;gBAClE,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,IAAI;oBACX,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,+BAA+B,CAAC,wBAAwB;iBAChE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,8CAA8C,CAAC,WAAW,CAAC,CAAC;YAChF,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,WAA2B,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,0CAA0C,CAAC,WAA2B,EAAE,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAC7H,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;gBAChE,UAAU,EAAE,UAAU,IAAI,IAAI;gBAC9B,KAAK,EAAE,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,+BAA+B,CAAC,iBAAiB;oBACnD,CAAC,CAAC,UAAU,KAAK,SAAS;wBACxB,CAAC,CAAC,+BAA+B,CAAC,gBAAgB;wBAClD,CAAC,CAAC,+BAA+B,CAAC,UAAU;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC","sourcesContent":["import type { z } from 'zod';\nimport { getPortabilityProvenance } from '@wildo-ai/zod-decorators';\nimport { isNonDisclosableFieldValue } from '../../resources/utils/field-value-disclosure.utils';\nimport {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\n\nconst compareCanonicalText = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\n\n/**\n * WHICH data-subject right an export is answering.\n *\n * ## Why this is an enum and not a boolean flag on one bundle\n *\n * GDPR Art. 15 (right of access) and Art. 20 (right to data portability) are DIFFERENT rights over\n * DIFFERENT data, and conflating them is the defect this capability was built to correct: the four\n * routed export operations removed on 2026-08-01 declared themselves \"portability / GDPR\" while\n * their actual options (`includeActivityData`, `includeOrganizationData`) described an *access*\n * bundle. One output with a flag would reproduce that merge.\n *\n * - **Access** is a disclosure obligation: everything the controller holds *concerning* the subject,\n *   including data the controller itself derived about them, in any readable form.\n * - **Portability** is a transfer obligation: only the data the subject *provided* — actively, or by\n *   using the service — and it must be machine-readable and re-importable elsewhere. Data the\n *   controller inferred is deliberately OUT of scope; a competitor must not receive a rival's\n *   analytics through a subject's portability request.\n *\n * The two therefore diverge at BOTH levels this module classifies: per-edge (see\n * {@link classifySubjectExportDisposition}) and per-field (see\n * {@link resolveSubjectExportFieldScope}).\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n */\nexport enum SubjectExportPurpose {\n  /**\n   * Art. 15 — right of access. The broadest bundle: every row concerning the subject, whoever\n   * produced it, including rows the subject does not own (an audit log about them, a membership an\n   * administrator created).\n   */\n  ACCESS_ART_15 = 'access_art_15',\n\n  /**\n   * Art. 20 — right to data portability. Narrower on purpose: only data the subject supplied or\n   * generated by using the service, and only from rows the subject owns. Controller-derived data is\n   * excluded by {@link DataPortabilityProvenance.DERIVED}.\n   */\n  PORTABILITY_ART_20 = 'portability_art_20',\n}\n\n/**\n * WHERE one field's value came from — the axis that decides Art. 20 scope.\n *\n * ## Why three values and not `isSubjectProvided: boolean`\n *\n * EDPB/WP29 guidance splits \"provided by the data subject\" into data supplied *knowingly* and data\n * *observed* from the subject's use of the service, and puts BOTH in Art. 20 scope while excluding\n * data the controller *inferred*. A boolean forces `OBSERVED` to be mis-filed against whichever\n * side the author guesses — and it is the member most often got wrong, because \"the user did not\n * type it\" reads as \"the user did not provide it\", which is precisely the wrong conclusion.\n *\n * ## Why this is per-FIELD and not per-resource\n *\n * A single row routinely mixes the two: a user profile holds `firstName` (supplied) beside a\n * controller-computed status or score. A resource-level answer would have to round one way for the\n * whole row. The resource-level declaration exists only as a DEFAULT\n * (`portabilityPolicy.defaultProvenance`) so that annotating a resource stays a one-line cost; the\n * per-field decorator overrides it where a field differs.\n *\n * ⚠️ NOT a redaction or scrub concept. This says where a value CAME FROM, for a disclosure\n * decision. What happens to a value on ERASURE is `.impersonalizeWith()` / `RedactionType`, a\n * different axis entirely — a field can be `SUBJECT_PROVIDED` and also masked on erasure.\n */\nexport enum DataPortabilityProvenance {\n  /**\n   * The subject actively and knowingly supplied this value — form input, an uploaded file, a\n   * setting they chose. Unambiguously in scope for both rights.\n   */\n  SUBJECT_PROVIDED = 'subject_provided',\n\n  /**\n   * Generated by the subject's USE of the service rather than typed by them — activity timestamps,\n   * event history, usage counters, telemetry. **In scope for Art. 20**, which is the whole reason\n   * this member exists separately from {@link DERIVED}.\n   */\n  OBSERVED = 'observed',\n\n  /**\n   * Produced BY the controller about the subject — inferred classifications, computed scores,\n   * risk or segmentation labels, server-assigned lifecycle state. Disclosed under Art. 15 (the\n   * subject may see what we concluded about them) but **excluded from Art. 20** (a portability\n   * request is not a channel for exporting the controller's own analysis).\n   */\n  DERIVED = 'derived',\n}\n\n/**\n * What an export does with ONE child-direction edge of the subject.\n *\n * ## Why this is NOT `SubjectErasureDisposition`\n *\n * Erasure and export share a traversal and answer opposite questions — *what do I destroy?* versus\n * *what must I disclose?* — and they diverge on exactly the edges erasure calls `NOT_OWNED`.\n *\n * Erasure leaves audit logs, memberships and job executions alone, correctly: you do not delete an\n * audit log because a user exercised a right. But those same rows hold personal data CONCERNING the\n * subject, and Art. 15 covers \"all personal data concerning him or her\" — not \"rows he owns\".\n * Reusing erasure's vocabulary verbatim would have silently omitted the data an access request most\n * often targets. Hence {@link INCLUDED_REFERENCES_SUBJECT}, a case erasure has no use for.\n *\n * The two classifiers still read the SAME upstream authority for what an edge *says*\n * (`requireResolvedRelationshipSemantics`), so they can never disagree about ownership — only about\n * what to do with it.\n *\n * ## Why there is no blocking disposition here\n *\n * Erasure refuses up-front on `UNCLASSIFIED` / `UNSUPPORTED_DEFERRED` because it is about to\n * WRITE, cannot half-destroy a subject, and needs a teardown declaration nobody made. An export\n * writes nothing: ownership alone answers the edge question, a deferred teardown is irrelevant to a\n * read, and a cross-adapter dependent is merely a second query rather than a broken transaction.\n * The one genuine refusal in an export is field-level and Art. 20-only — see\n * {@link SubjectExportFieldScope.UNDECLARED}. Manufacturing an edge-level blocker for symmetry\n * would be false symmetry.\n */\nexport enum SubjectExportEdgeDisposition {\n  /**\n   * The subject OWNS this dependent (`lifecycleModelMode: DEPENDENT`), so its rows are the\n   * subject's own data. Included for both purposes — for Art. 20 the per-field provenance filter\n   * still applies to what comes back.\n   */\n  INCLUDED_OWNED = 'included_owned',\n\n  /**\n   * The subject does NOT own these rows, but they REFERENCE the subject — the far side carries a\n   * foreign key back to them (an audit log, an organization membership, a job execution).\n   *\n   * **Art. 15 only.** These are personal data concerning the subject, so an access request must\n   * disclose them. A portability request must not: the subject did not provide a row that a third\n   * party or the controller created about them, and shipping them would export the controller's\n   * operational records under a transfer right. For `PORTABILITY_ART_20` this same edge classifies\n   * as {@link EXCLUDED_NOT_SUBJECT_PROVIDED}.\n   */\n  INCLUDED_REFERENCES_SUBJECT = 'included_references_subject',\n\n  /**\n   * The edge carries no personal data of the subject at all: an independent or link-only\n   * relationship whose far side does not even reference them, or a disabled relationship that is\n   * not part of the live graph. Out of scope for both rights.\n   */\n  EXCLUDED_NOT_SUBJECT_DATA = 'excluded_not_subject_data',\n\n  /**\n   * In scope for access, but excluded from THIS export because the export is a portability request\n   * and the rows were not provided by the subject. Kept as its own member rather than collapsing\n   * into {@link EXCLUDED_NOT_SUBJECT_DATA}: a reviewer asking \"why is my audit trail missing from\n   * my portability export?\" needs \"because Art. 20 does not cover controller records\" and \"because\n   * that edge holds nothing about you\" to be different answers, and only the first is a legal\n   * position someone took.\n   */\n  EXCLUDED_NOT_SUBJECT_PROVIDED = 'excluded_not_subject_provided',\n\n  /**\n   * The rows ARE the subject's data and the right covers them, but the resource is declared\n   * `systemAccessPolicy.exportSubject = FORBIDDEN` — someone decided it must never reach a data\n   * subject (an authentication-credential store, a security audit trail).\n   *\n   * ## Why this excludes rather than refusing\n   *\n   * An UNDECLARED resource refuses the whole export, because nobody has decided yet and refusing is\n   * what forces the decision. A FORBIDDEN one is the opposite: the decision exists, and refusing\n   * would make it permanent sabotage — a `USERS` access export whose graph touches a credential\n   * store could then NEVER run, no matter how many other resources opted in. Honouring the\n   * declaration means leaving those rows out and saying so.\n   *\n   * ⚠️ This applies to EDGES only. A subject whose OWN resource is FORBIDDEN still refuses: there is\n   * no export of a person whose identity row may not be disclosed, and silently returning an\n   * edges-only bundle would be a disclosure that omits its own subject.\n   */\n  EXCLUDED_NOT_DISCLOSABLE = 'excluded_not_disclosable',\n}\n\n/** Whether an edge disposition puts the far side's rows INTO the bundle. */\nexport function isIncludedSubjectExportEdgeDisposition(\n  disposition: SubjectExportEdgeDisposition,\n): boolean {\n  return disposition === SubjectExportEdgeDisposition.INCLUDED_OWNED\n    || disposition === SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT;\n}\n\n/** The classification of ONE child-direction edge of an export subject. */\nexport interface SubjectExportEdgeClassification {\n  /** The related resource on the far side of the edge. */\n  relatedResourceType: ResourceType;\n  /** Whether, and why, this edge's rows join the bundle. */\n  disposition: SubjectExportEdgeDisposition;\n  /**\n   * Human-readable justification quoting the configuration that produced it. Surfaced in the export\n   * report so a data-protection reviewer never has to re-derive WHY a resource was included or\n   * left out — which, for a disclosure obligation, is the evidence that matters.\n   */\n  reason: string;\n}\n\n/**\n * Classify what an export must do with ONE child-direction edge — the disclose-vs-omit decision,\n * DERIVED FROM CONFIGURATION rather than a hardcoded list of resource types.\n *\n * ## Where the answer comes from\n *\n * Two declarations the author already makes, read through the same shared authorities the delete\n * cascade and the erasure orchestrator read, so the three can never disagree about what an edge is:\n *\n *  1. **`handling.lifecycleModelMode`** — does the subject own this related resource's lifecycle?\n *     `DEPENDENT` means the rows are the subject's own data.\n *  2. **Foreign-key topology** (`resolveForeignKeyHolderResourceType`, cardinality-only and\n *     therefore pure) — for a NON-owned edge, does the far side nonetheless carry a reference back\n *     to the subject? If it does, its rows are *about* the subject and Art. 15 must disclose them.\n *\n * ## The `purpose` parameter, and why it is a parameter\n *\n * Art. 15 and Art. 20 diverge on exactly one edge case — the referencing-but-not-owned edge — and\n * keeping that divergence in ONE switch here is what stops two near-identical classifiers from\n * drifting apart. Exposing `classifyForAccess` / `classifyForPortability` would duplicate the\n * ownership logic, and the day someone fixes a bug in one they would miss the other.\n *\n * ## Caller contract\n *\n * `relationship.resourceType2` MUST be the far side and `resourceType1` the subject — the same\n * child-direction normalization {@link classifySubjectErasureDisposition} requires. The caller\n * filters to child-direction edges before classifying.\n *\n * Pure and side-effect free — no registry lookups, no I/O, no row reads — so it is equally usable\n * from a runtime orchestrator and from a boot-time coherence guard.\n */\nexport function classifySubjectExportDisposition(\n  relationship: ResourceRelationship,\n  purpose: SubjectExportPurpose,\n): SubjectExportEdgeClassification {\n  const relatedResourceType = relationship.resourceType2 as ResourceType;\n  const classify = (\n    disposition: SubjectExportEdgeDisposition,\n    reason: string,\n  ): SubjectExportEdgeClassification => ({ relatedResourceType, disposition, reason });\n\n  // A disabled relationship is not part of the live graph — the runtime never traverses it, so\n  // there are no rows behind it to disclose.\n  if (relationship.isDisabled === true) {\n    return classify(\n      SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n      'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n    );\n  }\n\n  const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n  const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n  if (lifecycleModel === RelationshipLifecycleModel.DEPENDENT) {\n    return classify(\n      SubjectExportEdgeDisposition.INCLUDED_OWNED,\n      'lifecycleModelMode is DEPENDENT: the subject owns these rows, so they are the subject\\'s '\n        + 'own data and belong in the bundle',\n    );\n  }\n\n  // NOT owned from here on. The rows still count as personal data if they POINT AT the subject —\n  // which is the Art. 15 / Art. 20 fork.\n  const foreignKeyHolder = Resources_SharedUtils.resolveForeignKeyHolderResourceType(relationship);\n  const farSideReferencesSubject = foreignKeyHolder === relationship.resourceType2;\n\n  if (!farSideReferencesSubject) {\n    return classify(\n      SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_DATA,\n      `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT) and the far side does not hold a `\n        + 'foreign key to the subject, so these rows are neither owned by nor about the subject',\n    );\n  }\n\n  switch (purpose) {\n    case SubjectExportPurpose.ACCESS_ART_15:\n      return classify(\n        SubjectExportEdgeDisposition.INCLUDED_REFERENCES_SUBJECT,\n        `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT), but the far side holds a `\n          + 'foreign key to the subject, so these rows are personal data CONCERNING the subject '\n          + 'and Art. 15 requires disclosing them',\n      );\n\n    case SubjectExportPurpose.PORTABILITY_ART_20:\n      return classify(\n        SubjectExportEdgeDisposition.EXCLUDED_NOT_SUBJECT_PROVIDED,\n        `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): these rows reference the `\n          + 'subject but were created by the controller or a third party rather than provided by '\n          + 'the subject, so Art. 20 does not cover them (they ARE disclosed under Art. 15)',\n      );\n\n    default: {\n      // Compile-time exhaustiveness: a new SubjectExportPurpose without an arm here is a TYPE\n      // error, not a silent runtime discovery on someone's disclosure request.\n      const _exhaustivePurposeCheck: never = purpose;\n      throw new Error(\n        `classifySubjectExportDisposition has no arm for export purpose `\n          + `'${String(_exhaustivePurposeCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * The three relationship buckets exposed by a compiled resource configuration.\n *\n * Kept structural here so the privacy compiler does not import resource configuration schemas:\n * those schemas already import this module for {@link DataPortabilityProvenance}.\n */\nexport interface SubjectExportRelationshipBuckets {\n  readonly parentRelationships: readonly ResourceRelationship[];\n  readonly childRelationships: readonly ResourceRelationship[];\n  readonly selfRelationships: readonly ResourceRelationship[];\n}\n\n/** One graph edge normalized so the export subject is always `resourceType1`. */\nexport interface SubjectExportRelationshipTraversal {\n  /** Original compiled relationship; runtime adapters use it to resolve the real FK field. */\n  readonly relationship: ResourceRelationship;\n  /** Direction-normalized relationship consumed by the shared legal-scope classifier. */\n  readonly normalizedRelationship: ResourceRelationship;\n  readonly classification: SubjectExportEdgeClassification;\n}\n\n/**\n * Enumerate every edge touching one export subject, including child-first reference declarations.\n *\n * Resource configurations deliberately preserve parent/child/self buckets. Subject disclosure is\n * different: personal data can point *to* the subject from either authored orientation. This helper\n * joins both directional buckets, includes self edges once, and swaps only the positional topology\n * needed by {@link classifySubjectExportDisposition}. It preserves the original compiled edge for\n * FK resolution and never collapses multiple foreign keys between the same resource pair.\n */\nexport function enumerateSubjectExportRelationshipTraversals(\n  subjectResourceType: ResourceType,\n  relationships: SubjectExportRelationshipBuckets,\n  purpose: SubjectExportPurpose,\n): SubjectExportRelationshipTraversal[] {\n  const touchingRelationships = [\n    ...relationships.childRelationships,\n    ...relationships.parentRelationships,\n    ...relationships.selfRelationships,\n  ];\n  return touchingRelationships\n    .map((relationship): SubjectExportRelationshipTraversal => {\n      if (relationship.resourceType1 !== subjectResourceType && relationship.resourceType2 !== subjectResourceType) {\n        throw new Error(\n          `Subject-export relationship traversal for ${String(subjectResourceType)} received unrelated edge `\n            + `${String(relationship.resourceType1)} -> ${String(relationship.resourceType2)}.`,\n        );\n      }\n      const normalizedRelationship = relationship.resourceType1 === subjectResourceType\n        ? relationship\n        : {\n            ...relationship,\n            resourceType1: relationship.resourceType2,\n            resourceType2: relationship.resourceType1,\n            cardinality1: relationship.cardinality2,\n            cardinality2: relationship.cardinality1,\n          };\n      return {\n        relationship,\n        normalizedRelationship,\n        classification: classifySubjectExportDisposition(normalizedRelationship, purpose),\n      };\n    })\n    .sort((left, right) => compareCanonicalText(subjectExportRelationshipTraversalKey(left), subjectExportRelationshipTraversalKey(right)));\n}\n\n/** Stable identity retaining distinct foreign keys between otherwise identical resource pairs. */\nexport function subjectExportRelationshipTraversalKey(traversal: SubjectExportRelationshipTraversal): string {\n  const relationship = traversal.normalizedRelationship;\n  return [\n    relationship.resourceType1,\n    relationship.resourceType2,\n    relationship.cardinality1,\n    relationship.cardinality2,\n    relationship.nature,\n    relationship.foreignKeyField ?? '',\n    traversal.classification.disposition,\n  ].join('\\0');\n}\n\n/**\n * Whether ONE field's value joins the bundle, for a given purpose.\n *\n * Separate from {@link SubjectExportEdgeDisposition} because the two answer different questions at\n * different granularities: an edge decides whether a RESOURCE's rows are in scope at all, a field\n * scope decides which COLUMNS of an in-scope row survive the Art. 20 narrowing.\n */\nexport enum SubjectExportFieldScope {\n  /** The field's value belongs in this bundle. */\n  INCLUDED = 'included',\n\n  /**\n   * Excluded because the value is controller-DERIVED and this is a portability request. Never\n   * reached for `ACCESS_ART_15`, which discloses derived data.\n   */\n  EXCLUDED_DERIVED = 'excluded_derived',\n\n  /**\n   * ⛔ NO ANSWER — the field carries no provenance declaration and none is inherited from its\n   * resource, while the export is a portability request that needs one.\n   *\n   * The export REFUSES rather than guessing, because both guesses are harmful and neither is the\n   * conservative one: excluding an undeclared field UNDER-DELIVERS a legal right the subject is\n   * owed, and including it OVER-SHARES data the controller derived. There is no safe default to\n   * fall back on, which is exactly the condition that justifies failing loud — the same reasoning\n   * that makes `SubjectErasureDisposition.UNCLASSIFIED` refuse an erasure.\n   *\n   * `ACCESS_ART_15` never produces this: access includes every field regardless of provenance, so\n   * an application can serve access requests before annotating anything.\n   */\n  UNDECLARED = 'undeclared',\n}\n\n/** Whether a field scope must ABORT the export rather than merely omitting a value. */\nexport function isBlockingSubjectExportFieldScope(scope: SubjectExportFieldScope): boolean {\n  return scope === SubjectExportFieldScope.UNDECLARED;\n}\n\n/**\n * Decide whether one field's value belongs in the bundle.\n *\n * `provenance` is the field's EFFECTIVE provenance — its own `.portabilityProvenance()` declaration\n * if it carries one, otherwise the resource's `portabilityPolicy.defaultProvenance`, otherwise\n * `undefined`. Resolving that fallback chain is the factory's job (Phase 0B); this function only\n * judges the resolved value, which keeps it pure and independently testable.\n */\nexport function resolveSubjectExportFieldScope(\n  provenance: DataPortabilityProvenance | undefined,\n  purpose: SubjectExportPurpose,\n): SubjectExportFieldScope {\n  switch (purpose) {\n    // Access discloses everything concerning the subject, so provenance is simply not a question it\n    // asks — an unannotated application can still answer an Art. 15 request in full.\n    case SubjectExportPurpose.ACCESS_ART_15:\n      return SubjectExportFieldScope.INCLUDED;\n\n    case SubjectExportPurpose.PORTABILITY_ART_20:\n      return resolvePortabilityFieldScope(provenance);\n\n    default: {\n      // Compile-time exhaustiveness on the PURPOSE axis too. Without this arm a third right added\n      // to the enum would silently inherit the portability narrowing — a disclosure boundary\n      // decided by fall-through rather than by anyone.\n      const _exhaustivePurposeCheck: never = purpose;\n      throw new Error(\n        `resolveSubjectExportFieldScope has no arm for export purpose `\n          + `'${String(_exhaustivePurposeCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * The Art. 20 narrowing, split out so {@link resolveSubjectExportFieldScope} can switch\n * exhaustively on `purpose` while this switches exhaustively on `provenance`. Module-private: the\n * purpose gate is not optional, and a caller reaching this directly would bypass it.\n */\nfunction resolvePortabilityFieldScope(\n  provenance: DataPortabilityProvenance | undefined,\n): SubjectExportFieldScope {\n  if (provenance === undefined) {\n    return SubjectExportFieldScope.UNDECLARED;\n  }\n\n  switch (provenance) {\n    // Both are \"provided by the data subject\" in the Art. 20 sense — OBSERVED is data generated by\n    // the subject's USE of the service, which the guidance places in scope even though the subject\n    // never typed it.\n    case DataPortabilityProvenance.SUBJECT_PROVIDED:\n    case DataPortabilityProvenance.OBSERVED:\n      return SubjectExportFieldScope.INCLUDED;\n\n    case DataPortabilityProvenance.DERIVED:\n      return SubjectExportFieldScope.EXCLUDED_DERIVED;\n\n    default: {\n      // Compile-time exhaustiveness: a new provenance member without an arm is a TYPE error here.\n      const _exhaustiveProvenanceCheck: never = provenance;\n      throw new Error(\n        `resolvePortabilityFieldScope has no arm for provenance `\n          + `'${String(_exhaustiveProvenanceCheck)}'`,\n      );\n    }\n  }\n}\n\n/**\n * Is this field withheld from EVERY subject export, whatever right is being answered?\n *\n * ## Why this exists at all — the layering trap it closes\n *\n * The export orchestrator collects rows at the REPOSITORY layer, which sits BELOW the service-layer\n * DTO projection that normally strips `.isBackendOnly()` fields on their way to a client. Without an\n * explicit check here, a subject export would disclose exactly the values that projection exists to\n * hide — `passwordHash` and `backupCodesHashed` on `USER_CREDENTIALS` are the motivating case, and\n * the config change that exposed them would have looked entirely routine.\n *\n * ## Why it is deliberately CONSERVATIVE\n *\n * This withholds every backend-only field, not only the secrets. Some backend-only fields are\n * genuinely disclosable under Art. 15 (`passwordChangedAt`, `firstMfaPromptAt` — facts about the\n * subject they may ask for), so this errs toward withholding.\n *\n * That asymmetry is intentional. Under-disclosing produces a complaint that is answerable and\n * fixable; disclosing an authentication secret is neither, and it degrades the security of\n * processing the framework is separately obliged to maintain (GDPR Art. 32). Between an\n * over-cautious bundle and a leaked credential, only one is recoverable.\n *\n * The withheld fields are REPORTED (`SubjectExportReport.fieldsWithheldAsNonDisclosable`) so the\n * caution is visible rather than silent. When a resource needs a specific backend-only field\n * disclosed, the expressible extension is a per-field opt-in on this predicate — NOT loosening it\n * wholesale.\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_DATA_EXPORT\n */\nexport function isFieldWithheldFromSubjectExport(fieldSchema: z.ZodTypeAny): boolean {\n  // Delegated to the ONE field-value disclosure rule rather than restated. The reasoning that used\n  // to sit here — that `isWriteOnlySecret` is checked explicitly rather than assumed to imply\n  // backend-only, because they are separate decorators and a future authoring form may set one\n  // without the other — moved WITH the rule, and is now the shared module's own justification.\n  //\n  // This function keeps its own name and its own assurance marker deliberately: subject export is a\n  // distinct obligation from model disclosure, its own docstring anticipates a per-field opt-in that\n  // would apply HERE and nowhere else, and merging the two names would make that extension\n  // unexpressible. What is shared is the rule, not the concept.\n  return isNonDisclosableFieldValue(fieldSchema);\n}\n\n/** Every legal {@link DataPortabilityProvenance} value, for validating an opaque decorator string. */\nconst KNOWN_PORTABILITY_PROVENANCES: ReadonlySet<string> = new Set(\n  Object.values(DataPortabilityProvenance),\n);\n\n/**\n * Resolve ONE field's EFFECTIVE provenance by joining the two declaration levels.\n *\n * ## The fallback chain, and why it has exactly two rungs\n *\n * 1. the field's own `.portabilityProvenance()` declaration, if it carries one;\n * 2. otherwise the resource's `portabilityPolicy.defaultProvenance`;\n * 3. otherwise `undefined` — which {@link resolveSubjectExportFieldScope} turns into a REFUSAL for\n *    an Art. 20 export and ignores entirely for Art. 15.\n *\n * Two rungs is what makes the fail-loud rule adoptable: without the resource default, every field of\n * every resource would need a decorator before a single portability request could be answered, and a\n * capability that expensive to adopt does not get adopted. With it, annotating a resource is one\n * line and only the exceptions carry a decorator.\n *\n * ## Why the enum check lives HERE\n *\n * `zod-decorators` sits below this package and cannot import {@link DataPortabilityProvenance}, so\n * it stores whatever non-empty string it was given — it can reject a BLANK but not a WRONG value.\n * This is the first layer that knows the vocabulary, so it is where a typo'd `'subject-provided'`\n * (hyphen, not underscore) must fail rather than silently resolving to `undefined` and turning a\n * declared field into a refusal — or worse, into a silent omission if the caller treats unknown as\n * derived. Mirrors how `RedactionType` validity is checked in this layer for `.impersonalizeWith()`.\n *\n * @param fieldSchema the field's Zod schema; the reader walks wrapper types, so a declaration made\n *   before or after `.optional()` / `.nullish()` / `.default()` is observed either way.\n * @param resourceDefaultProvenance the owning resource's `portabilityPolicy.defaultProvenance`.\n *   Taken as a bare value rather than the policy object so this module stays free of the\n *   resource-config import (which imports THIS module for the enum).\n * @param fieldLocator `resourceType.fieldName`, used only to make a rejection actionable.\n */\nexport function resolveEffectiveFieldPortabilityProvenance(\n  fieldSchema: z.ZodTypeAny,\n  resourceDefaultProvenance: DataPortabilityProvenance | undefined,\n  fieldLocator: string,\n): DataPortabilityProvenance | undefined {\n  const declared = getPortabilityProvenance(fieldSchema);\n\n  if (declared === undefined) {\n    return resourceDefaultProvenance;\n  }\n\n  if (!KNOWN_PORTABILITY_PROVENANCES.has(declared)) {\n    throw new Error(\n      `[${fieldLocator}] portabilityProvenance('${declared}') is not a DataPortabilityProvenance `\n        + `value. Expected one of: ${[...KNOWN_PORTABILITY_PROVENANCES].join(', ')}. An unrecognised `\n        + `value would resolve as UNDECLARED and make an Art. 20 export refuse, hiding the typo `\n        + `behind what looks like a deliberate omission.`,\n    );\n  }\n\n  return declared as DataPortabilityProvenance;\n}\n\n/** Why a compiled leaf-field decision has its effective export meaning. */\nexport enum SubjectExportFieldDecisionBasis {\n  FIELD_DECLARATION = 'field_declaration',\n  RESOURCE_DEFAULT = 'resource_default',\n  WITHHELD_NON_DISCLOSABLE = 'withheld_non_disclosable',\n  UNDECLARED = 'undeclared',\n  DEPTH_LIMIT = 'depth_limit',\n}\n\n/** Canonical, runtime-effective decision for one leaf path in one export purpose. */\nexport interface SubjectExportFieldDecision {\n  readonly locator: string;\n  readonly purpose: SubjectExportPurpose;\n  readonly scope: SubjectExportFieldScope | null;\n  readonly provenance: DataPortabilityProvenance | null;\n  readonly basis: SubjectExportFieldDecisionBasis;\n}\n\nconst SUBJECT_EXPORT_FIELD_MAX_DEPTH = 10;\n\n/**\n * Resolve an object shape through the same bounded wrapper protocol used by subject export.\n * Returning `undefined` means the value is a leaf. Reaching the bound is handled fail-closed by\n * {@link compileSubjectExportFieldDecisions}, never as an implicit leaf inclusion.\n */\nexport function resolveSubjectExportObjectShapeThroughWrappers(schema: unknown): Record<string, unknown> | undefined {\n  let current: any = schema;\n  for (let unwrapDepth = 0; current && unwrapDepth < SUBJECT_EXPORT_FIELD_MAX_DEPTH; unwrapDepth += 1) {\n    if (current.shape && typeof current.shape === 'object') return current.shape as Record<string, unknown>;\n    const inner = current.def?.innerType ?? current._def?.innerType;\n    if (!inner) return undefined;\n    current = inner;\n  }\n  return undefined;\n}\n\n/**\n * Compile every runtime-effective leaf-field decision for one resource and right.\n *\n * Both the backend executor and application authority proof consume this function. A field-level\n * decorator, inherited default, withheld marker, wrapper layout or depth refusal therefore changes\n * one shared decision inventory instead of two independently maintained interpretations.\n */\nexport function compileSubjectExportFieldDecisions(input: {\n  readonly resourceType: ResourceType;\n  readonly mainSchema: unknown;\n  readonly defaultProvenance: DataPortabilityProvenance | undefined;\n  readonly purpose: SubjectExportPurpose;\n}): SubjectExportFieldDecision[] {\n  const rootShape = resolveSubjectExportObjectShapeThroughWrappers(input.mainSchema);\n  if (!rootShape) return [];\n  const decisions: SubjectExportFieldDecision[] = [];\n\n  const visit = (shape: Record<string, unknown>, locatorPrefix: string, depth: number): void => {\n    for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n      const locator = `${locatorPrefix}.${fieldName}`;\n      if (depth >= SUBJECT_EXPORT_FIELD_MAX_DEPTH) {\n        decisions.push({\n          locator,\n          purpose: input.purpose,\n          scope: SubjectExportFieldScope.UNDECLARED,\n          provenance: null,\n          basis: SubjectExportFieldDecisionBasis.DEPTH_LIMIT,\n        });\n        continue;\n      }\n      if (isFieldWithheldFromSubjectExport(fieldSchema as z.ZodTypeAny)) {\n        decisions.push({\n          locator,\n          purpose: input.purpose,\n          scope: null,\n          provenance: null,\n          basis: SubjectExportFieldDecisionBasis.WITHHELD_NON_DISCLOSABLE,\n        });\n        continue;\n      }\n      const nestedShape = resolveSubjectExportObjectShapeThroughWrappers(fieldSchema);\n      if (nestedShape) {\n        visit(nestedShape, locator, depth + 1);\n        continue;\n      }\n      const declared = getPortabilityProvenance(fieldSchema as z.ZodTypeAny);\n      const provenance = resolveEffectiveFieldPortabilityProvenance(fieldSchema as z.ZodTypeAny, input.defaultProvenance, locator);\n      decisions.push({\n        locator,\n        purpose: input.purpose,\n        scope: resolveSubjectExportFieldScope(provenance, input.purpose),\n        provenance: provenance ?? null,\n        basis: declared !== undefined\n          ? SubjectExportFieldDecisionBasis.FIELD_DECLARATION\n          : provenance !== undefined\n            ? SubjectExportFieldDecisionBasis.RESOURCE_DEFAULT\n            : SubjectExportFieldDecisionBasis.UNDECLARED,\n      });\n    }\n  };\n\n  visit(rootShape, String(input.resourceType), 0);\n  return decisions.sort((left, right) => compareCanonicalText(left.locator, right.locator));\n}\n\n/** Per-edge outcome of an executed export — the classification plus what actually happened. */\nexport interface SubjectExportEdgeOutcome extends SubjectExportEdgeClassification {\n  /**\n   * `true` when the export actually queried this edge. Note this reports that the read RAN, not\n   * that rows existed — an included edge with no rows for this subject is a legitimate empty\n   * result, and {@link recordCount} distinguishes the two.\n   */\n  collected: boolean;\n  /** How many rows this edge contributed. `0` on an included edge means the subject had none. */\n  recordCount: number;\n}\n\n/**\n * What one subject export produced — the compliance artifact of an Art. 15 or Art. 20 request.\n *\n * Returned to the caller (rather than only logged) so the flow fronting the request can record or\n * surface it: every edge of the subject appears exactly once with the disposition applied and the\n * configuration that justified it. For a disclosure obligation, the record of what was DELIBERATELY\n * LEFT OUT — and on what legal basis — matters as much as the data returned.\n */\nexport interface SubjectExportReport {\n  /** Which right this export answered. */\n  purpose: SubjectExportPurpose;\n  /** The exported subject's resource type. */\n  subjectResourceType: ResourceType;\n  /** The exported subject rows. */\n  subjectIds: string[];\n  /** Every child-direction edge of the subject, classified, in registry order. */\n  edges: SubjectExportEdgeOutcome[];\n  /**\n   * Fields omitted from the bundle as controller-DERIVED, as `resourceType.fieldName`. Populated\n   * only for `PORTABILITY_ART_20`. Recorded rather than silently dropped so the subject can see\n   * that derived data exists and request it under Art. 15 instead.\n   */\n  fieldsExcludedAsDerived: string[];\n  /**\n   * Fields withheld as NON-DISCLOSABLE regardless of purpose — see\n   * {@link isFieldWithheldFromSubjectExport}. Populated for BOTH rights, because a password hash is\n   * no more disclosable under Art. 15 than under Art. 20.\n   *\n   * Recorded rather than silently dropped for the same reason as the derived list, and one more: a\n   * reviewer auditing why an export looks thin needs to see that the framework withheld something\n   * deliberately, not that a resource was missed.\n   */\n  fieldsWithheldAsNonDisclosable: string[];\n  /** Total rows across every collected edge, including the subject's own row(s). */\n  totalRecordCount: number;\n}\n\n/** One resource's contribution to an export bundle. */\nexport interface SubjectExportResourceSlice {\n  resourceType: ResourceType;\n  /**\n   * The rows, already narrowed to the fields in scope for the export's purpose. For\n   * `PORTABILITY_ART_20` the controller-derived columns are gone; for `ACCESS_ART_15` every column\n   * the subject is entitled to see is present.\n   */\n  rows: Record<string, unknown>[];\n}\n\n/**\n * What an export ACTUALLY produced — the data, paired with the report that justifies its shape.\n *\n * ## Why the data and the report are one return value but two types\n *\n * {@link SubjectExportReport} is the compliance artifact: it survives the request, is safe to log\n * and persist, and contains NO personal data — only per-edge dispositions and counts. The slices\n * are the personal data itself, which must NOT be logged and whose lifetime ends when the artifact\n * is written.\n *\n * Returning them together keeps the caller from having to correlate two results, while the type\n * split keeps \"safe to record\" and \"must be handled carefully\" visibly distinct — a caller writing\n * `logger.info({ report })` is correct, and the same line with `bundle` would be a leak. Fusing\n * them into one flat object would erase exactly that distinction.\n */\nexport interface SubjectExportBundle {\n  report: SubjectExportReport;\n  slices: SubjectExportResourceSlice[];\n}\n"]}

package/dist/esm/compliance/review-cadence.shared.schemas.d.ts

@@ -0,0 +1,56 @@
+/**
+ * How often something is re-reviewed, and the date that cadence schedules.
+ *
+ * ## Why it lives HERE
+ *
+ * Moved from `@wildo-ai/saas-specifications` `_core/market/market-authored-metadata.schemas` on
+ * 2026-09-11, and re-exported from there so its six existing importers are untouched. It had to move
+ * because it gained a consumer on the other side of a package boundary: an application declares
+ * `assuranceReviewCadence` in `wildo.saas.config.ts`, which is validated by
+ * `@wildo-ai/platform-config-lib` — a contracts-only package that does not depend on
+ * `saas-specifications` and should not start depending on it for one enum. `saas-models` is where the
+ * application-declared compliance vocabularies already live (`DataRetentionClass`, `LawfulBasis`,
+ * `PersonalDataCategory`, `OperatorProcessingRole`), and both packages already depend on it.
+ *
+ * The alternative — a second, purpose-named cadence enum beside this one — was rejected. It would
+ * have carried four identical members and differed only by excluding `AS_NEEDED`, which is a
+ * CONSUMER's constraint rather than a different vocabulary. CLAUDE.md: a closed vocabulary has one
+ * named runtime source.
+ */
+export declare enum ReviewCadence {
+    WEEKLY = "WEEKLY",
+    MONTHLY = "MONTHLY",
+    QUARTERLY = "QUARTERLY",
+    YEARLY = "YEARLY",
+    /** A real answer meaning "no schedule" — never a default, and never a date. See {@link deriveNextReviewOn}. */
+    AS_NEEDED = "AS_NEEDED"
+}
+/**
+ * How many days one {@link ReviewCadence} member means.
+ *
+ * ONE home, promoted 2026-09-11 from two byte-identical module-local copies —
+ * `roadmap-snapshot-validation.ts` and `brand-snapshot-validation.ts`, the second of which said so in
+ * its own comment: *"module-local there too — a shared promotion is part of the deferred
+ * authored-metadata generalization"*. A third consumer is what made the deferral stop paying.
+ *
+ * `Record<ReviewCadence, number>` and not a partial: a member added to the enum is a compile error
+ * here rather than a silent `undefined` that reads as "no cadence" at every call site.
+ *
+ * `AS_NEEDED` is `POSITIVE_INFINITY` deliberately, so every consumer must decide what "no schedule"
+ * means for it rather than receiving a number that quietly schedules something. `Number.isFinite` is
+ * the guard each one uses.
+ */
+export declare const REVIEW_CADENCE_TO_DAYS: Record<ReviewCadence, number>;
+/**
+ * The next review date a cadence schedules from a given instant, or `undefined` when it schedules none.
+ *
+ * `undefined` for `AS_NEEDED` is the whole contract. A caller that needs a DATE must treat the absence
+ * as the answer — "this application has not committed to a review schedule" — and say so, rather than
+ * inventing one. Returning a far-future date instead would turn "no commitment" into a commitment
+ * nobody made, which is exactly the shape `.claude/rules/derive-before-you-ask.md` describes when a
+ * date stands in for a decision.
+ *
+ * Returns a plain ISO date (`YYYY-MM-DD`): a review is scheduled on a day, not at an instant.
+ */
+export declare function deriveNextReviewOn(fromInstant: string, cadence: ReviewCadence): string | undefined;
+//# sourceMappingURL=review-cadence.shared.schemas.d.ts.map

package/dist/esm/compliance/review-cadence.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-cadence.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/review-cadence.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,aAAa;IACvB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,+GAA+G;IAC/G,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAMhE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAMlG"}

package/dist/esm/compliance/review-cadence.shared.schemas.js

@@ -0,0 +1,71 @@
+/**
+ * How often something is re-reviewed, and the date that cadence schedules.
+ *
+ * ## Why it lives HERE
+ *
+ * Moved from `@wildo-ai/saas-specifications` `_core/market/market-authored-metadata.schemas` on
+ * 2026-09-11, and re-exported from there so its six existing importers are untouched. It had to move
+ * because it gained a consumer on the other side of a package boundary: an application declares
+ * `assuranceReviewCadence` in `wildo.saas.config.ts`, which is validated by
+ * `@wildo-ai/platform-config-lib` — a contracts-only package that does not depend on
+ * `saas-specifications` and should not start depending on it for one enum. `saas-models` is where the
+ * application-declared compliance vocabularies already live (`DataRetentionClass`, `LawfulBasis`,
+ * `PersonalDataCategory`, `OperatorProcessingRole`), and both packages already depend on it.
+ *
+ * The alternative — a second, purpose-named cadence enum beside this one — was rejected. It would
+ * have carried four identical members and differed only by excluding `AS_NEEDED`, which is a
+ * CONSUMER's constraint rather than a different vocabulary. CLAUDE.md: a closed vocabulary has one
+ * named runtime source.
+ */
+export var ReviewCadence;
+(function (ReviewCadence) {
+    ReviewCadence["WEEKLY"] = "WEEKLY";
+    ReviewCadence["MONTHLY"] = "MONTHLY";
+    ReviewCadence["QUARTERLY"] = "QUARTERLY";
+    ReviewCadence["YEARLY"] = "YEARLY";
+    /** A real answer meaning "no schedule" — never a default, and never a date. See {@link deriveNextReviewOn}. */
+    ReviewCadence["AS_NEEDED"] = "AS_NEEDED";
+})(ReviewCadence || (ReviewCadence = {}));
+/**
+ * How many days one {@link ReviewCadence} member means.
+ *
+ * ONE home, promoted 2026-09-11 from two byte-identical module-local copies —
+ * `roadmap-snapshot-validation.ts` and `brand-snapshot-validation.ts`, the second of which said so in
+ * its own comment: *"module-local there too — a shared promotion is part of the deferred
+ * authored-metadata generalization"*. A third consumer is what made the deferral stop paying.
+ *
+ * `Record<ReviewCadence, number>` and not a partial: a member added to the enum is a compile error
+ * here rather than a silent `undefined` that reads as "no cadence" at every call site.
+ *
+ * `AS_NEEDED` is `POSITIVE_INFINITY` deliberately, so every consumer must decide what "no schedule"
+ * means for it rather than receiving a number that quietly schedules something. `Number.isFinite` is
+ * the guard each one uses.
+ */
+export const REVIEW_CADENCE_TO_DAYS = {
+    [ReviewCadence.WEEKLY]: 7,
+    [ReviewCadence.MONTHLY]: 31,
+    [ReviewCadence.QUARTERLY]: 92,
+    [ReviewCadence.YEARLY]: 366,
+    [ReviewCadence.AS_NEEDED]: Number.POSITIVE_INFINITY,
+};
+/**
+ * The next review date a cadence schedules from a given instant, or `undefined` when it schedules none.
+ *
+ * `undefined` for `AS_NEEDED` is the whole contract. A caller that needs a DATE must treat the absence
+ * as the answer — "this application has not committed to a review schedule" — and say so, rather than
+ * inventing one. Returning a far-future date instead would turn "no commitment" into a commitment
+ * nobody made, which is exactly the shape `.claude/rules/derive-before-you-ask.md` describes when a
+ * date stands in for a decision.
+ *
+ * Returns a plain ISO date (`YYYY-MM-DD`): a review is scheduled on a day, not at an instant.
+ */
+export function deriveNextReviewOn(fromInstant, cadence) {
+    const days = REVIEW_CADENCE_TO_DAYS[cadence];
+    if (!Number.isFinite(days))
+        return undefined;
+    const from = new Date(fromInstant);
+    if (Number.isNaN(from.getTime()))
+        return undefined;
+    return new Date(from.getTime() + days * 24 * 60 * 60 * 1000).toISOString().slice(0, 10);
+}
+//# sourceMappingURL=review-cadence.shared.schemas.js.map