@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-schedule.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,kBAqBX;AArBD,WAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,qDAA+B,CAAA;IAC/B,kMAAkM;IAClM,qCAAe,CAAA;IACf;;;;;;;OAOG;IACH,+CAAyB,CAAA;IACzB,kNAAkN;IAClN,2DAAqC,CAAA;AACvC,CAAC,EArBW,kBAAkB,KAAlB,kBAAkB,QAqB7B;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,aAAa,CAC/D,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAC1B,yBAAyB,CAC1B,CAAC;AAGF;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAkD;IAElD,OAAO,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC;AACtG,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/**\n * **The four data classes an application declares a retention period for.**\n *\n * ## Why four, and not one per resource\n *\n * `retentionPolicy.mode` on a resource says WHAT erasure does to a row. Nothing said HOW LONG a row\n * is kept, and a privacy notice cannot be written without that number: a confident paragraph about\n * impersonalization READS to a reader as an answer about retention, so the derivable half made the\n * missing half harder to see rather than easier (issue #89).\n *\n * The first design put a duration on every resource. It was rejected as false precision: an operator\n * decides \"customer data three years, logs ninety days, audit seven years\", not twelve numbers, and\n * twelve numbers are twelve things to keep true. What an operator actually decides is a schedule over\n * DATA CLASSES — and those classes are the ones that already differ in law, in storage and in who\n * asks for them.\n *\n * ## The classes are the STORES, and that is deliberate\n *\n * Each member maps to a distinct backing service, so one declaration answers two questions that have\n * always been asked separately: what a privacy notice must state, and what a backup-and-restore\n * inventory must protect and for how long (issue #8, which today has no inventory of any kind).\n *\n * | class | where it lives |\n * |---|---|\n * | {@link RESOURCE_DATA} | MongoDB / PostgreSQL |\n * | {@link FILES} | MinIO / S3 |\n * | {@link AUDIT_LOGS} | immudb — the tamper-evident ledger |\n * | {@link OPERATIONAL_LOGS} | the logging pipeline |\n *\n * Splitting further is available later and is not free: every additional class is another period an\n * operator must decide and defend, and an undecided period is worse than a coarse one.\n */\nexport enum DataRetentionClass {\n  /**\n   * The application's own records — every resource row in its primary datastore.\n   *\n   * The class a privacy notice's retention paragraph is mostly about, because it is where the data a\n   * customer gave the application lives.\n   */\n  RESOURCE_DATA = \"RESOURCE_DATA\",\n  /** Uploaded file BYTES in object storage. Separate because their lawful window rarely matches the row that references them, and because losing them is a different incident from losing a row. */\n  FILES = \"FILES\",\n  /**\n   * The audit trail.\n   *\n   * Kept longest, and for a reason no other class shares: it is the record an operator needs to\n   * DEFEND itself, which is exactly the GDPR Art. 17(3) ground on which erasure may lawfully be\n   * refused. Never fold this into {@link RESOURCE_DATA} — doing so would let a shorter customer-data\n   * period silently shorten the evidence an operator may need years later.\n   */\n  AUDIT_LOGS = \"AUDIT_LOGS\",\n  /** Operational and diagnostic logs. Usually the shortest period, and the one most often left undeclared because nobody thinks of it as personal data — it routinely carries IP addresses and user identifiers. */\n  OPERATIONAL_LOGS = \"OPERATIONAL_LOGS\",\n}\n\n/**\n * One declared retention period.\n *\n * `retentionDays` is REQUIRED when a class is declared at all: the whole point is the number. A class\n * an application has not decided is OMITTED from the schedule, which is a different answer and stays\n * a different answer — see {@link ApplicationRetentionScheduleSchema}.\n */\nexport const DataRetentionPeriodSchema = z.strictObject({\n  /**\n   * How long a record of this class is kept, counted from the point the application stops needing it\n   * for the purpose it was collected for.\n   *\n   * Days rather than a duration string because it is the unit every downstream consumer needs — a\n   * notice renders it, a backup schedule compares it, and a sweep would subtract it. A free-text\n   * period (\"as long as necessary\") is the placeholder this field exists to make impossible.\n   */\n  retentionDays: z.number().int().positive(),\n  /**\n   * WHY this period, in the operator's words — the lawful basis, the contractual term, the statutory\n   * minimum.\n   *\n   * Required, and it is the field that keeps the number honest: a period with no stated reason is a\n   * guess that will be published as a commitment. A notice may render it; a reviewer certainly reads it.\n   */\n  rationale: z.string().trim().min(1),\n});\nexport type DataRetentionPeriod = z.infer<typeof DataRetentionPeriodSchema>;\n\n/**\n * The application's declared retention schedule — a period per {@link DataRetentionClass}.\n *\n * ## Partial ON PURPOSE, and absence is never read as \"kept forever\"\n *\n * Every class is optional, and an omitted class means *the operator has not decided this yet* — not\n * that nothing is kept, and not that it is kept indefinitely. Both of those would be a statement, and\n * neither is one anybody made.\n *\n * That is what makes this safe to ship before an operator has answered: a compliance document states\n * the classes that ARE declared and marks the rest as needing a decision, naming who supplies it. The\n * alternative — requiring all four — would block a document on a number nobody has yet, which is\n * exactly the gate this whole capability exists to remove. **Never default a period.**\n */\nexport const ApplicationRetentionScheduleSchema = z.partialRecord(\n  z.enum(DataRetentionClass),\n  DataRetentionPeriodSchema,\n);\nexport type ApplicationRetentionSchedule = z.infer<typeof ApplicationRetentionScheduleSchema>;\n\n/**\n * The classes an application has NOT declared a period for — what a document must mark as owed.\n *\n * Derived rather than stored, and total over the enum, so a class added to the vocabulary tomorrow is\n * reported as undeclared by every existing application rather than silently omitted from the answer.\n */\nexport function undeclaredRetentionClasses(\n  schedule: ApplicationRetentionSchedule | undefined,\n): readonly DataRetentionClass[] {\n  return Object.values(DataRetentionClass).filter((dataClass) => schedule?.[dataClass] === undefined);\n}\n"]}
+{"version":3,"file":"retention-schedule.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sHAAsH;AACtH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,kBAuCX;AAvCD,WAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,qDAA+B,CAAA;IAC/B,kMAAkM;IAClM,qCAAe,CAAA;IACf;;;;;;;OAOG;IACH,+CAAyB,CAAA;IACzB,kNAAkN;IAClN,2DAAqC,CAAA;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAqC,CAAA;AACvC,CAAC,EAvCW,kBAAkB,KAAlB,kBAAkB,QAuC7B;AACD,oEAAoE;AAEpE,qHAAqH;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,mBA4BX;AA5BD,WAAY,mBAAmB;IAC7B,qGAAqG;IACrG,0CAAmB,CAAA;IACnB,uGAAuG;IACvG,oDAA6B,CAAA;IAC7B;;;;OAIG;IACH,sDAA+B,CAAA;IAC/B;;;OAGG;IACH,oEAA6C,CAAA;IAC7C;;;;;;;;;;OAUG;IACH,sDAA+B,CAAA;AACjC,CAAC,EA5BW,mBAAmB,KAAnB,mBAAmB,QA4B9B;AAED,uHAAuH;AACvH,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,kIAAkI;IAClI,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC1C,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,sEAAsE;AACtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,aAAa,CAC/D,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAC1B,yBAAyB,CAC1B,CAAC;AAEF,oEAAoE;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAkD;IAElD,OAAO,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC;AACtG,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule facet:layer:shared facet:audience:app-developer */\n/**\n * **The data classes an application declares a retention period for.**\n *\n * ## Why a handful of classes, and not one period per resource\n *\n * `retentionPolicy.mode` on a resource says WHAT erasure does to a row. Nothing said HOW LONG a row\n * is kept, and a privacy notice cannot be written without that number: a confident paragraph about\n * impersonalization READS to a reader as an answer about retention, so the derivable half made the\n * missing half harder to see rather than easier (issue #89).\n *\n * The first design put a duration on every resource. It was rejected as false precision: an operator\n * decides \"customer data three years, logs ninety days, audit seven years\", not twelve numbers, and\n * twelve numbers are twelve things to keep true. What an operator actually decides is a schedule over\n * DATA CLASSES — and those classes are the ones that already differ in law, in storage and in who\n * asks for them.\n *\n * ## The classes are the STORES, and that is deliberate\n *\n * Each member maps to a distinct backing service, so one declaration answers two questions that have\n * always been asked separately: what a privacy notice must state, and what a backup-and-restore\n * inventory must protect and for how long (issue #8, which today has no inventory of any kind).\n *\n * | class | where it lives |\n * |---|---|\n * | {@link RESOURCE_DATA} | MongoDB / PostgreSQL |\n * | {@link FILES} | MinIO / S3 |\n * | {@link AUDIT_LOGS} | immudb — the tamper-evident ledger |\n * | {@link OPERATIONAL_LOGS} | the logging pipeline |\n * | {@link BUSINESS_RECORDS} | MongoDB / PostgreSQL — the one class split by LAW rather than by store |\n *\n * Splitting further is available later and is not free: every additional class is another period an\n * operator must decide and defend, and an undecided period is worse than a coarse one. The criterion\n * for a new member is that its records differ in law, in storage or in who asks for them —\n * {@link BUSINESS_RECORDS} is the first split made on the law alone (#1613).\n *\n * ## How a row is bound to a class\n *\n * A resource declares `retentionBinding: { retentionClass, startPoint }` in its resource\n * configuration ({@link ResourceRetentionBindingSchema}). An engine sweep then deletes a bound row\n * once `retentionDays` of its class have passed since the row's {@link RetentionStartPoint}. A\n * resource with no binding is kept until it is erased, and is reported by\n * `unboundRetentionResources` so the gap stays visible.\n */\nexport enum DataRetentionClass {\n  /**\n   * The application's own records — every resource row in its primary datastore.\n   *\n   * The class a privacy notice's retention paragraph is mostly about, because it is where the data a\n   * customer gave the application lives.\n   */\n  RESOURCE_DATA = \"RESOURCE_DATA\",\n  /** Uploaded file BYTES in object storage. Separate because their lawful window rarely matches the row that references them, and because losing them is a different incident from losing a row. */\n  FILES = \"FILES\",\n  /**\n   * The audit trail.\n   *\n   * Kept longest, and for a reason no other class shares: it is the record an operator needs to\n   * DEFEND itself, which is exactly the GDPR Art. 17(3) ground on which erasure may lawfully be\n   * refused. Never fold this into {@link RESOURCE_DATA} — doing so would let a shorter customer-data\n   * period silently shorten the evidence an operator may need years later.\n   */\n  AUDIT_LOGS = \"AUDIT_LOGS\",\n  /** Operational and diagnostic logs. Usually the shortest period, and the one most often left undeclared because nobody thinks of it as personal data — it routinely carries IP addresses and user identifiers. */\n  OPERATIONAL_LOGS = \"OPERATIONAL_LOGS\",\n  /**\n   * Records whose MINIMUM retention is set by law: business correspondence, accounting documents and\n   * their supporting pieces.\n   *\n   * A separate class because its members differ in law from {@link RESOURCE_DATA}: the period is a\n   * statutory floor, not the operator's choice, and it usually outlives the customer relationship.\n   * Germany's HGB §257 and AO §147 require 6 years for business letters and 8 for booking vouchers,\n   * counted from the end of the calendar year; France's Code de commerce L123-22 requires 10 years\n   * for accounting documents; UK law-firm practice follows the 15-year long-stop of the Limitation\n   * Act 1980 s.14B. Folding these into {@link RESOURCE_DATA} would force one of two wrong answers:\n   * delete statutory records with the customer data, or keep all customer data for a decade.\n   *\n   * Carries NO default period, like every class: the number depends on the jurisdiction and the\n   * record, and a defaulted statutory period is a legal statement nobody made. A resource that binds\n   * it usually counts from {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}. What an erasure does to a\n   * row still inside its period is the subject-erasure lane's (#1635), not this class's.\n   */\n  BUSINESS_RECORDS = \"BUSINESS_RECORDS\",\n}\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/** @wildo_source:part:start saas.models.privacy.retention-binding facet:layer:shared facet:audience:app-developer */\n/**\n * **When a bound row's retention clock starts.**\n *\n * A schedule period is counted \"from the point the application stops needing it for the purpose it\n * was collected for\" ({@link DataRetentionPeriodSchema}), so binding a live record to a class\n * counted from its CREATION would delete it while it is still in use. Every binding therefore names\n * its start point explicitly: there is no default, because every candidate default deletes somebody's\n * live data for some resource (#1613 review F1).\n *\n * ## The instant is READ from what the framework already records — not stamped a second time\n *\n * Four of the five members read an instant the row already carries, so the retention clock is the\n * same value every other surface shows, and no write path has to remember to maintain a copy:\n *\n * | member | the clock starts at | read from |\n * |---|---|---|\n * | {@link CREATED} | the insert | `createdAt` — infrastructure-owned on both adapters |\n * | {@link LAST_UPDATED} | the most recent update | `updatedAt` — infrastructure-owned on both adapters |\n * | {@link CLOSURE_EVENT} | the moment the declared closure date field is set | that field; null never expires |\n * | {@link END_OF_CALENDAR_YEAR} | 31 December 23:59:59.999 UTC of the creation year | `createdAt` |\n * | {@link SCOPE_DELETED} | the row's organization was marked for deletion | `retentionStartedAt`, stamped by the tenant purge |\n *\n * Rejected: persisting a `retentionStartedAt` on EVERY bound row. `createdAt` and `updatedAt` are\n * already maintained by the persistence adapter on every write path (the Mongoose timestamps plugin;\n * the PostgreSQL repository's timestamp stamping), and a second copy would have to be written at\n * each of those paths too — the one-invariant-many-sites shape that has shipped half-applied\n * repeatedly in this repository. Only {@link SCOPE_DELETED} has no instant on the row, so only it\n * stores one.\n *\n * The EXPIRY is never stored, for any member: the sweep computes `start + retentionDays` from the\n * CURRENT schedule at every run, so changing a period needs no backfill.\n */\nexport enum RetentionStartPoint {\n  /** At insert. For records whose purpose ends with their creation: a log line, a delivery attempt. */\n  CREATED = \"CREATED\",\n  /** At every update. For state kept only while it is still being touched: a draft, a session record. */\n  LAST_UPDATED = \"LAST_UPDATED\",\n  /**\n   * When the resource's declared `closureFieldName` date field is set — a ticket closed, a contract\n   * ended, a case archived. While that field is null the row never expires, which is what makes this\n   * the member for \"kept while it is open, then N days\".\n   */\n  CLOSURE_EVENT = \"CLOSURE_EVENT\",\n  /**\n   * 31 December 23:59:59.999 UTC of the year the row was created — how HGB §257(5) and AO §147(4)\n   * count commercial and tax retention.\n   */\n  END_OF_CALENDAR_YEAR = \"END_OF_CALENDAR_YEAR\",\n  /**\n   * When the row's organization is marked for deletion — \"kept while the account exists, then N days\".\n   *\n   * Two cases, decided at startup by the resource's `organizations → <resource>` teardown edge:\n   * - the edge DELETES the row in the tenant purge: the purge IS the enforcement, at\n   *   `tenantTeardown.retentionWindowDays`, which is single-sourced to {@link DataRetentionClass.RESOURCE_DATA}\n   *   — so only that class may be bound this way;\n   * - the row OUTLIVES its tenant (the edge is disabled, retains-and-impersonalizes, or is absent):\n   *   the purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and the\n   *   retention sweep deletes the row after its own class period.\n   */\n  SCOPE_DELETED = \"SCOPE_DELETED\",\n}\n\n/** The one field the framework stores for a retention clock: the {@link RetentionStartPoint.SCOPE_DELETED} instant. */\nexport const RETENTION_STARTED_AT_FIELD_NAME = \"retentionStartedAt\";\n\n/**\n * A resource's binding to a {@link DataRetentionClass}, declared as `retentionBinding` in its\n * resource configuration.\n *\n * ⚠️ NOT `retentionPolicy`. That is the erasure TREATMENT (what an erasure does to a row: delete, or\n * retain and scrub); this is the retention PERIOD (how long a row is kept at all). A resource may\n * declare either, both or neither, and they answer different questions for different readers.\n *\n * Strict, so a misspelled key fails at configuration build instead of being ignored — an ignored\n * binding would be a retention period the application states and nothing enforces.\n */\nexport const ResourceRetentionBindingSchema = z.strictObject({\n  /** The class whose declared period applies. The period itself lives in the application's `dataRetention` schedule, never here. */\n  retentionClass: z.enum(DataRetentionClass),\n  /** When the clock starts. Required, with no default — see {@link RetentionStartPoint}. */\n  startPoint: z.enum(RetentionStartPoint),\n  /**\n   * The date field whose value is the closure instant. Required for, and only allowed with,\n   * {@link RetentionStartPoint.CLOSURE_EVENT}; the resource factory refuses a field that is not a\n   * date, is not database-indexed (the sweep queries it on every run), or can be written by a\n   * client-routed create or update (a caller could backdate it into a delete). Make it server-owned:\n   * excluded from create and update, set by the owning handlers, declared in their `authoritativeFields`.\n   */\n  closureFieldName: z.string().trim().min(1).optional(),\n});\nexport type ResourceRetentionBinding = z.infer<typeof ResourceRetentionBindingSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-binding */\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule */\n/**\n * One declared retention period.\n *\n * `retentionDays` is REQUIRED when a class is declared at all: the whole point is the number. A class\n * an application has not decided is OMITTED from the schedule, which is a different answer and stays\n * a different answer — see {@link ApplicationRetentionScheduleSchema}.\n */\nexport const DataRetentionPeriodSchema = z.strictObject({\n  /**\n   * How long a record of this class is kept, counted from the point the application stops needing it\n   * for the purpose it was collected for.\n   *\n   * Days rather than a duration string because it is the unit every downstream consumer needs — a\n   * notice renders it, a backup schedule compares it, and a sweep would subtract it. A free-text\n   * period (\"as long as necessary\") is the placeholder this field exists to make impossible.\n   */\n  retentionDays: z.number().int().positive(),\n  /**\n   * WHY this period, in the operator's words — the lawful basis, the contractual term, the statutory\n   * minimum.\n   *\n   * Required, and it is the field that keeps the number honest: a period with no stated reason is a\n   * guess that will be published as a commitment. A notice may render it; a reviewer certainly reads it.\n   */\n  rationale: z.string().trim().min(1),\n});\nexport type DataRetentionPeriod = z.infer<typeof DataRetentionPeriodSchema>;\n\n/**\n * The application's declared retention schedule — a period per {@link DataRetentionClass}.\n *\n * ## Partial ON PURPOSE, and absence is never read as \"kept forever\"\n *\n * Every class is optional, and an omitted class means *the operator has not decided this yet* — not\n * that nothing is kept, and not that it is kept indefinitely. Both of those would be a statement, and\n * neither is one anybody made.\n *\n * That is what makes this safe to ship before an operator has answered: a compliance document states\n * the classes that ARE declared and marks the rest as needing a decision, naming who supplies it. The\n * alternative — requiring every class — would block a document on a number nobody has yet, which is\n * exactly the gate this whole capability exists to remove. **Never default a period.**\n */\nexport const ApplicationRetentionScheduleSchema = z.partialRecord(\n  z.enum(DataRetentionClass),\n  DataRetentionPeriodSchema,\n);\nexport type ApplicationRetentionSchedule = z.infer<typeof ApplicationRetentionScheduleSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/**\n * The classes an application has NOT declared a period for — what a document must mark as owed.\n *\n * Derived rather than stored, and total over the enum, so a class added to the vocabulary tomorrow is\n * reported as undeclared by every existing application rather than silently omitted from the answer.\n */\nexport function undeclaredRetentionClasses(\n  schedule: ApplicationRetentionSchedule | undefined,\n): readonly DataRetentionClass[] {\n  return Object.values(DataRetentionClass).filter((dataClass) => schedule?.[dataClass] === undefined);\n}\n"]}

package/dist/esm/compliance/privacy/retention-scope-deleted.shared.utils.d.ts

@@ -0,0 +1,53 @@
+import type { ResourceConfiguration_ResourceRelationships } from '../../resources/resources-config.shared.schemas';
+import { type ResourceRetentionBinding } from './retention-schedule.shared.schemas';
+/**
+ * How a `RetentionStartPoint.SCOPE_DELETED` binding is ENFORCED — decided by what the tenant purge
+ * does to the resource's rows.
+ *
+ * The purge dispatches the ordinary `ORGANIZATIONS | DELETE`, and the resource's own
+ * `organizations → <resource>` teardown edge decides the rows' fate. So there are exactly two cases, and
+ * the retention sweep must treat them differently:
+ */
+export declare enum ScopeDeletedRetentionEnforcement {
+    /**
+     * The edge DELETES the rows in the purge cascade. The purge IS the enforcement: it fires at
+     * `tenantTeardown.retentionWindowDays`, single-sourced to `RESOURCE_DATA`, so only that class may be
+     * bound this way, and the sweep has nothing to do for the resource.
+     */
+    PURGE_CASCADE = "PURGE_CASCADE",
+    /**
+     * The rows OUTLIVE their tenant — the edge is disabled, retains-and-impersonalizes, refuses, or does
+     * not exist. The purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and
+     * the retention sweep deletes each row after its own class period.
+     */
+    OUTLIVES_TENANT = "OUTLIVES_TENANT"
+}
+/**
+ * Classify a resource's SCOPE_DELETED enforcement from its DIRECT `organizations → resource` edge.
+ *
+ * Only the direct edge is read, deliberately: it is the edge the purge dispatches with the resource's own
+ * teardown budget. A resource reached only through a DEEPER cascade (a grandchild of the organization)
+ * classifies as {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}; if the cascade does delete it,
+ * the purge's stamp and the sweep simply find nothing, which is the safe direction — a wrong classification
+ * the other way would skip a sweep that owes deletions.
+ */
+export declare function classifyScopeDeletedRetentionEnforcement(configuration: {
+    readonly resourceIdentifier: string;
+    readonly resourceRelationships: ResourceConfiguration_ResourceRelationships;
+}): ScopeDeletedRetentionEnforcement;
+/**
+ * The resources whose rows OUTLIVE a deleted tenant and are bound to a retention class counted from that
+ * deletion (`RetentionStartPoint.SCOPE_DELETED`, {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}).
+ *
+ * The ONE selection both ends of the SCOPE_DELETED clock use: the tenant purge STARTS the clock on these
+ * resources' rows just before it deletes the organization, and `organizations.restore` CLEARS it on the same
+ * resources when a purge that stamped them failed and the tenant is brought back. Two hand-kept filters
+ * would drift, and a restore that cleared a narrower set than the purge stamped would leave a live tenant's
+ * rows counting down to deletion.
+ */
+export declare function outlivingScopeDeletedBoundResourceTypes<TConfiguration extends {
+    readonly resourceIdentifier: string;
+    readonly resourceRelationships: ResourceConfiguration_ResourceRelationships;
+    readonly retentionBinding?: ResourceRetentionBinding;
+}>(configurations: Iterable<TConfiguration>): string[];
+//# sourceMappingURL=retention-scope-deleted.shared.utils.d.ts.map

package/dist/esm/compliance/privacy/retention-scope-deleted.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention-scope-deleted.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-scope-deleted.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,iDAAiD,CAAC;AAGnH,OAAO,EAAuB,KAAK,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAEzG;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wCAAwC,CAAC,aAAa,EAAE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;CAC7E,GAAG,gCAAgC,CAenC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,cAAc,SAAS;IAC7E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;CACtD,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAQrD"}

package/dist/esm/compliance/privacy/retention-scope-deleted.shared.utils.js

@@ -0,0 +1,74 @@
+import { ChildLifecycleStrategy, resolveChildLifecycleTeardownStrategy } from '../../resources/child-operations.shared.schemas.js';
+import { CoreResourceType } from '../../resources/resources.shared.core.definitions.js';
+import { Resources_SharedUtils } from '../../resources/resources.shared.utils.js';
+import { RetentionStartPoint } from './retention-schedule.shared.schemas.js';
+/**
+ * How a `RetentionStartPoint.SCOPE_DELETED` binding is ENFORCED — decided by what the tenant purge
+ * does to the resource's rows.
+ *
+ * The purge dispatches the ordinary `ORGANIZATIONS | DELETE`, and the resource's own
+ * `organizations → <resource>` teardown edge decides the rows' fate. So there are exactly two cases, and
+ * the retention sweep must treat them differently:
+ */
+export var ScopeDeletedRetentionEnforcement;
+(function (ScopeDeletedRetentionEnforcement) {
+    /**
+     * The edge DELETES the rows in the purge cascade. The purge IS the enforcement: it fires at
+     * `tenantTeardown.retentionWindowDays`, single-sourced to `RESOURCE_DATA`, so only that class may be
+     * bound this way, and the sweep has nothing to do for the resource.
+     */
+    ScopeDeletedRetentionEnforcement["PURGE_CASCADE"] = "PURGE_CASCADE";
+    /**
+     * The rows OUTLIVE their tenant — the edge is disabled, retains-and-impersonalizes, refuses, or does
+     * not exist. The purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and
+     * the retention sweep deletes each row after its own class period.
+     */
+    ScopeDeletedRetentionEnforcement["OUTLIVES_TENANT"] = "OUTLIVES_TENANT";
+})(ScopeDeletedRetentionEnforcement || (ScopeDeletedRetentionEnforcement = {}));
+/**
+ * Classify a resource's SCOPE_DELETED enforcement from its DIRECT `organizations → resource` edge.
+ *
+ * Only the direct edge is read, deliberately: it is the edge the purge dispatches with the resource's own
+ * teardown budget. A resource reached only through a DEEPER cascade (a grandchild of the organization)
+ * classifies as {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}; if the cascade does delete it,
+ * the purge's stamp and the sweep simply find nothing, which is the safe direction — a wrong classification
+ * the other way would skip a sweep that owes deletions.
+ */
+export function classifyScopeDeletedRetentionEnforcement(configuration) {
+    const relationships = configuration.resourceRelationships;
+    const organizationEdge = [
+        ...relationships.parentRelationships,
+        ...relationships.childRelationships,
+        ...relationships.selfRelationships,
+    ].find((relationship) => relationship.resourceType1 === CoreResourceType.ORGANIZATIONS
+        && relationship.resourceType2 === configuration.resourceIdentifier);
+    if (!organizationEdge)
+        return ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT;
+    const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(organizationEdge);
+    // The cascade's own default rule, read through its one named source rather than re-derived here.
+    const deletesInCascade = onParentDelete?.enabled === true
+        && resolveChildLifecycleTeardownStrategy(onParentDelete) === ChildLifecycleStrategy.DELETE;
+    return deletesInCascade ? ScopeDeletedRetentionEnforcement.PURGE_CASCADE : ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT;
+}
+/**
+ * The resources whose rows OUTLIVE a deleted tenant and are bound to a retention class counted from that
+ * deletion (`RetentionStartPoint.SCOPE_DELETED`, {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}).
+ *
+ * The ONE selection both ends of the SCOPE_DELETED clock use: the tenant purge STARTS the clock on these
+ * resources' rows just before it deletes the organization, and `organizations.restore` CLEARS it on the same
+ * resources when a purge that stamped them failed and the tenant is brought back. Two hand-kept filters
+ * would drift, and a restore that cleared a narrower set than the purge stamped would leave a live tenant's
+ * rows counting down to deletion.
+ */
+export function outlivingScopeDeletedBoundResourceTypes(configurations) {
+    const resourceTypes = [];
+    for (const configuration of configurations) {
+        if (configuration.retentionBinding?.startPoint !== RetentionStartPoint.SCOPE_DELETED)
+            continue;
+        if (classifyScopeDeletedRetentionEnforcement(configuration) !== ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT)
+            continue;
+        resourceTypes.push(configuration.resourceIdentifier);
+    }
+    return resourceTypes;
+}
+//# sourceMappingURL=retention-scope-deleted.shared.utils.js.map

package/dist/esm/compliance/privacy/retention-scope-deleted.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention-scope-deleted.shared.utils.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-scope-deleted.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,qCAAqC,EAAE,MAAM,iDAAiD,CAAC;AAEhI,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAiC,MAAM,qCAAqC,CAAC;AAEzG;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAaX;AAbD,WAAY,gCAAgC;IAC1C;;;;OAIG;IACH,mEAA+B,CAAA;IAC/B;;;;OAIG;IACH,uEAAmC,CAAA;AACrC,CAAC,EAbW,gCAAgC,KAAhC,gCAAgC,QAa3C;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wCAAwC,CAAC,aAGxD;IACC,MAAM,aAAa,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAC1D,MAAM,gBAAgB,GAAG;QACvB,GAAG,aAAa,CAAC,mBAAmB;QACpC,GAAG,aAAa,CAAC,kBAAkB;QACnC,GAAG,aAAa,CAAC,iBAAiB;KACnC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACtB,YAAY,CAAC,aAAa,KAAK,gBAAgB,CAAC,aAAa;WAC1D,YAAY,CAAC,aAAa,KAAK,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACtE,IAAI,CAAC,gBAAgB;QAAE,OAAO,gCAAgC,CAAC,eAAe,CAAC;IAC/E,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAAC,gBAAgB,CAAC,CAAC;IAChH,iGAAiG;IACjG,MAAM,gBAAgB,GAAG,cAAc,EAAE,OAAO,KAAK,IAAI;WACpD,qCAAqC,CAAC,cAAc,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC;IAC7F,OAAO,gBAAgB,CAAC,CAAC,CAAC,gCAAgC,CAAC,aAAa,CAAC,CAAC,CAAC,gCAAgC,CAAC,eAAe,CAAC;AAC9H,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uCAAuC,CAIpD,cAAwC;IACzC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,gBAAgB,EAAE,UAAU,KAAK,mBAAmB,CAAC,aAAa;YAAE,SAAS;QAC/F,IAAI,wCAAwC,CAAC,aAAa,CAAC,KAAK,gCAAgC,CAAC,eAAe;YAAE,SAAS;QAC3H,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import { ChildLifecycleStrategy, resolveChildLifecycleTeardownStrategy } from '../../resources/child-operations.shared.schemas';\nimport type { ResourceConfiguration_ResourceRelationships } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceType } from '../../resources/resources.shared.core.definitions';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport { RetentionStartPoint, type ResourceRetentionBinding } from './retention-schedule.shared.schemas';\n\n/**\n * How a `RetentionStartPoint.SCOPE_DELETED` binding is ENFORCED — decided by what the tenant purge\n * does to the resource's rows.\n *\n * The purge dispatches the ordinary `ORGANIZATIONS | DELETE`, and the resource's own\n * `organizations → <resource>` teardown edge decides the rows' fate. So there are exactly two cases, and\n * the retention sweep must treat them differently:\n */\nexport enum ScopeDeletedRetentionEnforcement {\n  /**\n   * The edge DELETES the rows in the purge cascade. The purge IS the enforcement: it fires at\n   * `tenantTeardown.retentionWindowDays`, single-sourced to `RESOURCE_DATA`, so only that class may be\n   * bound this way, and the sweep has nothing to do for the resource.\n   */\n  PURGE_CASCADE = 'PURGE_CASCADE',\n  /**\n   * The rows OUTLIVE their tenant — the edge is disabled, retains-and-impersonalizes, refuses, or does\n   * not exist. The purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and\n   * the retention sweep deletes each row after its own class period.\n   */\n  OUTLIVES_TENANT = 'OUTLIVES_TENANT',\n}\n\n/**\n * Classify a resource's SCOPE_DELETED enforcement from its DIRECT `organizations → resource` edge.\n *\n * Only the direct edge is read, deliberately: it is the edge the purge dispatches with the resource's own\n * teardown budget. A resource reached only through a DEEPER cascade (a grandchild of the organization)\n * classifies as {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}; if the cascade does delete it,\n * the purge's stamp and the sweep simply find nothing, which is the safe direction — a wrong classification\n * the other way would skip a sweep that owes deletions.\n */\nexport function classifyScopeDeletedRetentionEnforcement(configuration: {\n  readonly resourceIdentifier: string;\n  readonly resourceRelationships: ResourceConfiguration_ResourceRelationships;\n}): ScopeDeletedRetentionEnforcement {\n  const relationships = configuration.resourceRelationships;\n  const organizationEdge = [\n    ...relationships.parentRelationships,\n    ...relationships.childRelationships,\n    ...relationships.selfRelationships,\n  ].find((relationship) =>\n    relationship.resourceType1 === CoreResourceType.ORGANIZATIONS\n    && relationship.resourceType2 === configuration.resourceIdentifier);\n  if (!organizationEdge) return ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT;\n  const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(organizationEdge);\n  // The cascade's own default rule, read through its one named source rather than re-derived here.\n  const deletesInCascade = onParentDelete?.enabled === true\n    && resolveChildLifecycleTeardownStrategy(onParentDelete) === ChildLifecycleStrategy.DELETE;\n  return deletesInCascade ? ScopeDeletedRetentionEnforcement.PURGE_CASCADE : ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT;\n}\n\n/**\n * The resources whose rows OUTLIVE a deleted tenant and are bound to a retention class counted from that\n * deletion (`RetentionStartPoint.SCOPE_DELETED`, {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}).\n *\n * The ONE selection both ends of the SCOPE_DELETED clock use: the tenant purge STARTS the clock on these\n * resources' rows just before it deletes the organization, and `organizations.restore` CLEARS it on the same\n * resources when a purge that stamped them failed and the tenant is brought back. Two hand-kept filters\n * would drift, and a restore that cleared a narrower set than the purge stamped would leave a live tenant's\n * rows counting down to deletion.\n */\nexport function outlivingScopeDeletedBoundResourceTypes<TConfiguration extends {\n  readonly resourceIdentifier: string;\n  readonly resourceRelationships: ResourceConfiguration_ResourceRelationships;\n  readonly retentionBinding?: ResourceRetentionBinding;\n}>(configurations: Iterable<TConfiguration>): string[] {\n  const resourceTypes: string[] = [];\n  for (const configuration of configurations) {\n    if (configuration.retentionBinding?.startPoint !== RetentionStartPoint.SCOPE_DELETED) continue;\n    if (classifyScopeDeletedRetentionEnforcement(configuration) !== ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT) continue;\n    resourceTypes.push(configuration.resourceIdentifier);\n  }\n  return resourceTypes;\n}\n"]}

package/dist/esm/compliance/privacy/subject-data-recipients.shared.schemas.d.ts

@@ -0,0 +1,311 @@
+/**
+ * **Who else holds a data subject's personal data, and what erasure owes each of them** — the RUNTIME half of #1710.
+ *
+ * ## Why the running application needs the recipient list
+ *
+ * A subject export answers GDPR Art. 15, which gives the data subject a right to "the recipients or categories of
+ * recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or
+ * international organisations" (Art. 15(1)(c)). An erasure answers Art. 17, and Art. 19 then requires the controller to
+ * "communicate any rectification or erasure of personal data … to each recipient to whom the personal data have been
+ * disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data
+ * subject about those recipients if the data subject requests it." Both are answered by the running backend, which
+ * until now knew only its own stores: a subject export listed no recipient, and an erasure reported nothing about a
+ * vendor that no registered effect happened to reach.
+ * spec-cite: GDPR Art. 15(1)(c), https://gdpr-info.eu/art-15-gdpr/ (fetched 2026-09-29)
+ * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)
+ *
+ * ## Derived ONCE, at design time, and projected — never re-derived here
+ *
+ * Who the recipients are is decided by the application's committed declarations: the recipient population (which
+ * vendors a data path reaches, and with whose account), the processor register (the LEGAL identity the operator
+ * adopted), the #1709 disclosures (which categories each flow carries) and the providers' compliance profiles. None
+ * of those inputs exists in a running backend — the register and the typed-client scan live in the application's
+ * specifications and source — so `wildo config subject-data-recipients` runs that one derivation and writes the result
+ * into `backend-api/src/subject-data-recipients.generated.ts`, which the application composes into
+ * `compliance.subjectDataRecipients`. The `dataRetention` precedent: one value, derived where its inputs are, read
+ * where it is enforced.
+ *
+ * Two alternatives were rejected:
+ *
+ * - **Re-deriving at runtime from the loaded provider modules.** Their `vendorLegalEntityName` is a sourced SUGGESTION
+ *   the operator adopts by committing a register entry (Paul, 2026-09-25) — telling a data subject the suggestion
+ *   would state a fact nobody adopted. And the runtime cannot see a typed client, so it would silently drop a vendor.
+ * - **Moving the derivation into this package.** Its inputs are still unavailable at runtime; only the code would move.
+ *
+ * ## Per subject, by CATEGORY — and never omitted when unknown
+ *
+ * The declaration is application-wide and names PROVIDERS only — a system of record is maintained on its own lane (its
+ * erasure is the HTTP_API effects' under the binding's D6 stance). For one request, {@link selectSubjectDataRecipients}
+ * says a recipient CARRIES the subject's data when the subject is an account holder and the recipient's capability
+ * categories meet the categories the involved resources declare (`.dataCategories()`) — the engine composes capability
+ * calls from account holders' data. Everything less
+ * certain is kept as {@link SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED}: a category match for any other subject, a
+ * recipient whose categories are NOT all derivable or only a FLOOR (free text can carry any category), and every
+ * recipient when the SUBJECT side is not fully known (an unreadable resource, a personal field with no category). An
+ * unknown is a reason to name the vendor, never to leave it out; only a recipient whose fully derived categories
+ * demonstrably miss fully known subject data is left out. The role split reads the SUBJECT's resource type only: data a
+ * processor-scope resource sends a vendor under a controller-scope subject is still reported under the subject's role.
+ *
+ * ## Absent is NOT DECLARED, and is marked
+ *
+ * An application that never generated the projection has not said who received anything. The export states NOT
+ * DECLARED, and the erasure carries one UNMEASURED outcome naming the missing projection — incomplete, never a silent
+ * pass, and never a refusal (`.claude/rules/application-creation-directive.md`).
+ *
+ * @wildo_source:part:start saas.models.privacy.subject-data-recipients facet:layer:shared facet:audience:app-developer
+ */
+import { z } from 'zod';
+import { HttpApiErasureStance } from '../../http-api-binding/http-api-erasure-stance.shared';
+import { OperatorProcessingRole } from './operator-compliance-identity.shared.schemas';
+import { PersonalDataCategory } from './personal-data-category.shared.schemas';
+import { SubjectErasureExternalEffectStatus, type SubjectErasureExternalEffectOutcome } from './subject-erasure.shared.schemas';
+/** Why a recipient's categories are not all derivable (#1709) — the reason travels with the recipient to runtime. */
+export declare enum RecipientCategoriesNotDerivableReason {
+    /** Reached by a typed client, a browser operation or unscanned code: no declared field-to-input map exists. */
+    FLOW_UNDECLARED = "flow-undeclared",
+    /** A system-of-record instance that no resource binds or pipes: nothing declares what reaches it. */
+    NO_RESOURCE_FLOW = "no-resource-flow",
+    /** The resource flows could not be read (the introspection failed), so nothing is known — which is not "none". */
+    FLOWS_NOT_READ = "flows-not-read",
+    /** Some flowing field is personal by the application's own declaration and carries no category. */
+    UNCATEGORIZED_PERSONAL_FIELDS = "uncategorized-personal-fields"
+}
+/**
+ * WHOSE account reached the recipient — which decides who owes the Art. 19 communication.
+ *
+ * Not the population class: that also answers "operator-run" and "declared without a data path", neither of which is a
+ * recipient. This is the question an erasure asks of a recipient that exists.
+ */
+export declare enum SubjectDataRecipientReach {
+    /** Reached with an application-owned credential: the operator engaged this vendor. */
+    OPERATOR_ACCOUNT = "operator-account",
+    /** Reached ONLY through a tenant's or a person's connected account: the tenant's own vendor (#1707). */
+    TENANT_ACCOUNT = "tenant-account"
+}
+/**
+ * The stance a VENDOR declares about subject data it keeps (#1710) — on the provider's compliance profile. The D6
+ * vocabulary, narrowed to the two stances a vendor fact can take: the third, an acknowledged non-erasure, is the
+ * CONTROLLER's act and is declared by the operator ({@link ProviderSubjectErasureAcknowledgementSchema}).
+ */
+export declare const ProviderSubjectErasureDeclarationSchema: z.ZodObject<{
+    /**
+     * - `NO_SUBJECT_DATA`: the vendor keeps nothing about a subject beyond the call itself — erasure reports
+     *   DECLARED_NO_SUBJECT_DATA, which is complete.
+     * - `EXTERNAL_ERASURE_OPERATION`: an erasure effect in the external-effects registry reaches this vendor (the billing
+     *   effect for a billing provider). If none is registered for it at runtime, erasure reports NOT_REGISTERED.
+     */
+    stance: z.ZodEnum<{
+        readonly NO_SUBJECT_DATA: HttpApiErasureStance.NO_SUBJECT_DATA;
+        readonly EXTERNAL_ERASURE_OPERATION: HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION;
+    }>;
+}, z.core.$strict>;
+export type ProviderSubjectErasureDeclaration = z.infer<typeof ProviderSubjectErasureDeclarationSchema>;
+/**
+ * The OPERATOR's acknowledgement that erasure does not reach this vendor (#1710): the D6 stance
+ * CONTROLLER_ACKNOWLEDGED_NON_ERASURE for a provider, on `providerComplianceChoices.<ref>`. Erasure then reports
+ * ACKNOWLEDGED_NON_ERASURE — still incomplete, because the data is still live at the vendor, however deliberate the
+ * decision was.
+ */
+export declare const ProviderSubjectErasureAcknowledgementSchema: z.ZodObject<{
+    /** Why the operator accepts that erasure does not reach the vendor — "Resend deletes its logs within 90 days". */
+    reason: z.ZodString;
+}, z.core.$strict>;
+export type ProviderSubjectErasureAcknowledgement = z.infer<typeof ProviderSubjectErasureAcknowledgementSchema>;
+/** One recipient, as the running application needs to state it. */
+export declare const SubjectDataRecipientSchema: z.ZodObject<{
+    /** The provider ref. A system of record is never a recipient here (see the module JSDoc). */
+    ref: z.ZodString;
+    /**
+     * The legal entity the operator's processor register adopted for it, or `null` when the register has no entry — a
+     * gap stated as such, never filled with a suggestion.
+     */
+    legalEntityName: z.ZodNullable<z.ZodString>;
+    /** Where the register says it processes. Empty when there is no register entry. */
+    processingRegions: z.ZodArray<z.ZodString>;
+    reach: z.ZodEnum<typeof SubjectDataRecipientReach>;
+    /** The categories its declared flows carry to it (#1709), in enum order. */
+    categories: z.ZodArray<z.ZodEnum<typeof PersonalDataCategory>>;
+    /** Every reason those categories are not all known. Empty when the declared flows account for everything. */
+    categoriesNotDerivable: z.ZodArray<z.ZodEnum<typeof RecipientCategoriesNotDerivableReason>>;
+    /** True when the categories include free text a person wrote, which can carry any other category. */
+    categoriesAreAFloor: z.ZodBoolean;
+    /** The declared flows the categories come from — `capability:EMAIL_TRANSACTIONAL`, … */
+    derivedFrom: z.ZodArray<z.ZodString>;
+    /**
+     * The erasure stance: the vendor's declaration, or the operator's acknowledged non-erasure. `null` when neither
+     * exists — erasure then reports UNMEASURED for this recipient.
+     */
+    erasureStance: z.ZodNullable<z.ZodEnum<typeof HttpApiErasureStance>>;
+}, z.core.$strict>;
+export type SubjectDataRecipient = z.infer<typeof SubjectDataRecipientSchema>;
+/** Which resource types one operator role covers, from `operatorComplianceIdentity.roleAllocations[].resourceTypes`. */
+export declare const SubjectDataRoleAllocationSchema: z.ZodObject<{
+    role: z.ZodEnum<typeof OperatorProcessingRole>;
+    resourceTypes: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type SubjectDataRoleAllocation = z.infer<typeof SubjectDataRoleAllocationSchema>;
+/** The derived projection `compliance.subjectDataRecipients` carries. */
+export declare const SubjectDataRecipientsDeclarationSchema: z.ZodObject<{
+    recipients: z.ZodArray<z.ZodObject<{
+        /** The provider ref. A system of record is never a recipient here (see the module JSDoc). */
+        ref: z.ZodString;
+        /**
+         * The legal entity the operator's processor register adopted for it, or `null` when the register has no entry — a
+         * gap stated as such, never filled with a suggestion.
+         */
+        legalEntityName: z.ZodNullable<z.ZodString>;
+        /** Where the register says it processes. Empty when there is no register entry. */
+        processingRegions: z.ZodArray<z.ZodString>;
+        reach: z.ZodEnum<typeof SubjectDataRecipientReach>;
+        /** The categories its declared flows carry to it (#1709), in enum order. */
+        categories: z.ZodArray<z.ZodEnum<typeof PersonalDataCategory>>;
+        /** Every reason those categories are not all known. Empty when the declared flows account for everything. */
+        categoriesNotDerivable: z.ZodArray<z.ZodEnum<typeof RecipientCategoriesNotDerivableReason>>;
+        /** True when the categories include free text a person wrote, which can carry any other category. */
+        categoriesAreAFloor: z.ZodBoolean;
+        /** The declared flows the categories come from — `capability:EMAIL_TRANSACTIONAL`, … */
+        derivedFrom: z.ZodArray<z.ZodString>;
+        /**
+         * The erasure stance: the vendor's declaration, or the operator's acknowledged non-erasure. `null` when neither
+         * exists — erasure then reports UNMEASURED for this recipient.
+         */
+        erasureStance: z.ZodNullable<z.ZodEnum<typeof HttpApiErasureStance>>;
+    }, z.core.$strict>>;
+    /** The role allocations that name their resource types. An allocation in prose only is not carried. */
+    roleAllocations: z.ZodArray<z.ZodObject<{
+        role: z.ZodEnum<typeof OperatorProcessingRole>;
+        resourceTypes: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SubjectDataRecipientsDeclaration = z.infer<typeof SubjectDataRecipientsDeclarationSchema>;
+/** Whether the running application has a recipient declaration at all. */
+export declare enum SubjectDataRecipientsStatementStatus {
+    /** The projection is composed; the list below is the derived answer (possibly empty). */
+    DECLARED = "declared",
+    /** No projection: the application has not stated who received personal data. A gap, marked. */
+    NOT_DECLARED = "not-declared",
+    /**
+     * A declaration may exist, but applying it to this request FAILED (the erasure's post-commit accounting threw), so
+     * which recipients hold this subject's data is unknown. Distinct from NOT_DECLARED, whose remedy is to generate the
+     * projection; this one's is to reconcile the vendors by hand and look at the logged error.
+     */
+    UNDETERMINED = "undetermined"
+}
+/** Why one recipient is listed for this subject. */
+export declare enum SubjectDataRecipientRelevance {
+    /** Its derived categories meet this subject's data, or its flow names one of the involved resources. */
+    CARRIES_SUBJECT_DATA = "carries-subject-data",
+    /** Its categories are not all derivable, or are a floor: it may have received this subject's data. */
+    MAY_HAVE_RECEIVED = "may-have-received"
+}
+/**
+ * Who owes what to this recipient when the subject's data is erased — the role split (#1710).
+ *
+ * A processor "assists the controller … for the fulfilment of the controller's obligation to respond to requests for
+ * exercising the data subject's rights" (Art. 28(3)(e)); the Art. 19 communication is the controller's.
+ * spec-cite: GDPR Art. 28(3)(e), https://gdpr-info.eu/art-28-gdpr/ (fetched 2026-09-29)
+ */
+export declare enum SubjectDataRecipientObligation {
+    /** The operator is CONTROLLER (or joint controller) for this data: it communicates the erasure (Art. 19). */
+    OPERATOR_COMMUNICATES = "operator-communicates",
+    /** The operator is PROCESSOR for this data: the outcome is assistance evidence for the tenant, the controller. */
+    OPERATOR_ASSISTS_CONTROLLER = "operator-assists-controller",
+    /** Reached with the tenant's own account: the tenant's recipient, and the tenant's to notify. */
+    TENANT_NOTIFIES = "tenant-notifies",
+    /** No role allocation names the subject's resource type, so who owes the communication is not declared. */
+    ROLE_UNDECLARED = "role-undeclared"
+}
+/** One recipient listed for one request. */
+export interface SubjectDataRecipientStatementEntry extends SubjectDataRecipient {
+    relevance: SubjectDataRecipientRelevance;
+    obligation: SubjectDataRecipientObligation;
+}
+/** The recipient part of a subject export or erasure report. Contains no personal data. */
+export interface SubjectDataRecipientsStatement {
+    status: SubjectDataRecipientsStatementStatus;
+    /** The operator's role for the subject's resource type, or `null` when no allocation names it. */
+    operatorRole: OperatorProcessingRole | null;
+    recipients: SubjectDataRecipientStatementEntry[];
+}
+/** The operator role an allocation declares for a resource type, or `null` when none names it. */
+export declare function operatorRoleForResourceType(declaration: SubjectDataRecipientsDeclaration | undefined, resourceType: string): OperatorProcessingRole | null;
+/**
+ * The `derivedFrom` token kind of a flow the ENGINE composes through a capability: `capability:<token>` (#1709), written
+ * by `deriveRecipientDisclosures`. The only flow kind this list carries, because systems of record are kept out of it.
+ */
+export declare const RECIPIENT_CAPABILITY_FLOW_TOKEN_KIND = "capability";
+/**
+ * The recipients one subject export or erasure must name — see the module JSDoc for the rule. Pure, so the backend,
+ * a test and a reviewer apply the same one.
+ */
+export declare function selectSubjectDataRecipients(params: {
+    declaration: SubjectDataRecipientsDeclaration | undefined;
+    subjectResourceType: string;
+    /** The union of the `.dataCategories()` those resources declare. */
+    involvedCategories: readonly PersonalDataCategory[];
+    /**
+     * `false` when the involved categories are NOT the whole answer: a resource's configuration could not be read, or it
+     * declares personal fields with no category. An unknown on the SUBJECT side must widen the list exactly as an unknown
+     * on the recipient side does — every recipient not matched is then kept as MAY_HAVE_RECEIVED, never dropped.
+     */
+    involvedCategoriesComplete: boolean;
+    /**
+     * Whether the subject is an ACCOUNT HOLDER (a user). A capability recipient's categories are what the ENGINE sends
+     * when it composes the call — the recipient address of an account's mail, the billing customer, the signed-in actor —
+     * which are account holders' data. So a category match through a capability alone says the vendor carries an account
+     * holder's data; for any other subject (a CRM contact) it says only that it MAY have received it, because nothing
+     * declares that the application routes that subject's data to the capability.
+     */
+    subjectIsAccountHolder: boolean;
+}): SubjectDataRecipientsStatement;
+/**
+ * The statement of an application with no recipient declaration. Also the placeholder an orchestrator writes into a
+ * report its caller completes (the erasure and export doors fill the real statement, as they fill `externalEffects`).
+ */
+export declare function notDeclaredSubjectDataRecipientsStatement(): SubjectDataRecipientsStatement;
+/** The statement of a request whose recipient accounting failed — see {@link SubjectDataRecipientsStatementStatus.UNDETERMINED}. */
+export declare function undeterminedSubjectDataRecipientsStatement(): SubjectDataRecipientsStatement;
+/** The effect ref the recipient reconciliation writes for a recipient no registered effect reached. */
+export declare function subjectErasureRecipientEffectRef(recipientRef: string): string;
+/** The effect ref of the single outcome an erasure carries when its recipients are not declared or could not be determined. */
+export declare const SUBJECT_DATA_RECIPIENTS_NOT_DECLARED_EFFECT_REF = "subject-data-recipients";
+/** What an erasure did about one recipient. */
+export interface SubjectErasureRecipientOutcome {
+    recipientRef: string;
+    legalEntityName: string | null;
+    reach: SubjectDataRecipientReach;
+    relevance: SubjectDataRecipientRelevance;
+    obligation: SubjectDataRecipientObligation;
+    /**
+     * The outcome at this recipient: the covering effects' combined status, or the status the declared stance decides.
+     * `null` for a tenant-account recipient — not the operator's erasure to run, and named for the tenant to notify.
+     */
+    status: SubjectErasureExternalEffectStatus | null;
+    /** The effect refs that reached it — a registered effect, or the reconciliation's `recipient:<ref>`. */
+    effectRefs: string[];
+}
+/**
+ * Reconcile the recipients an erasure must reach with the effects that ran (#1710).
+ *
+ * Every operator-account recipient gets a status, so none can pass silently:
+ * - a registered effect that names it as its `recipientRef` → that effect's status;
+ * - otherwise its stance decides: NO_SUBJECT_DATA → DECLARED_NO_SUBJECT_DATA (complete); an acknowledged
+ *   non-erasure → ACKNOWLEDGED_NON_ERASURE; EXTERNAL_ERASURE_OPERATION with no effect registered → NOT_REGISTERED;
+ *   no stance → UNMEASURED. Each becomes an `externalEffects` outcome under `recipient:<ref>`, so every existing
+ *   reader of the report (`isIncompleteSubjectErasureExternalEffect`, the Wonder Todos request lane) sees it without
+ *   learning a new field.
+ * - NOT DECLARED adds one UNMEASURED outcome naming the missing projection.
+ *
+ * It marks and never refuses: the local erasure has already committed when this runs.
+ */
+export declare function reconcileSubjectErasureRecipients(params: {
+    statement: SubjectDataRecipientsStatement;
+    effectOutcomes: readonly SubjectErasureExternalEffectOutcome[];
+    /** Which recipient each REGISTERED effect reaches — applicable to this subject or not: effect ref → recipient ref. */
+    recipientRefByEffectRef: ReadonlyMap<string, string>;
+}): {
+    recipients: SubjectErasureRecipientOutcome[];
+    addedEffectOutcomes: SubjectErasureExternalEffectOutcome[];
+};
+/** @wildo_source:part:end saas.models.privacy.subject-data-recipients */
+//# sourceMappingURL=subject-data-recipients.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/subject-data-recipients.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-data-recipients.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-data-recipients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,mCAAmC,EACzC,MAAM,kCAAkC,CAAC;AAE1C,qHAAqH;AACrH,oBAAY,qCAAqC;IAC/C,+GAA+G;IAC/G,eAAe,oBAAoB;IACnC,qGAAqG;IACrG,gBAAgB,qBAAqB;IACrC,kHAAkH;IAClH,cAAc,mBAAmB;IACjC,mGAAmG;IACnG,6BAA6B,kCAAkC;CAChE;AAED;;;;;GAKG;AACH,oBAAY,yBAAyB;IACnC,sFAAsF;IACtF,gBAAgB,qBAAqB;IACrC,wGAAwG;IACxG,cAAc,mBAAmB;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;IAClD;;;;;OAKG;;;;;kBAKH,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C;IACtD,kHAAkH;;kBAElH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,mEAAmE;AACnE,eAAO,MAAM,0BAA0B;IACrC,6FAA6F;;IAE7F;;;OAGG;;IAEH,mFAAmF;;;IAGnF,4EAA4E;;IAE5E,6GAA6G;;IAE7G,qGAAqG;;IAErG,wFAAwF;;IAExF;;;OAGG;;kBAEH,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,wHAAwH;AACxH,eAAO,MAAM,+BAA+B;;;kBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,yEAAyE;AACzE,eAAO,MAAM,sCAAsC;;QAlCjD,6FAA6F;;QAE7F;;;WAGG;;QAEH,mFAAmF;;;QAGnF,4EAA4E;;QAE5E,6GAA6G;;QAE7G,qGAAqG;;QAErG,wFAAwF;;QAExF;;;WAGG;;;IAeH,uGAAuG;;;;;kBAEvG,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0EAA0E;AAC1E,oBAAY,oCAAoC;IAC9C,yFAAyF;IACzF,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AAED,oDAAoD;AACpD,oBAAY,6BAA6B;IACvC,wGAAwG;IACxG,oBAAoB,yBAAyB;IAC7C,sGAAsG;IACtG,iBAAiB,sBAAsB;CACxC;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,6GAA6G;IAC7G,qBAAqB,0BAA0B;IAC/C,kHAAkH;IAClH,2BAA2B,gCAAgC;IAC3D,iGAAiG;IACjG,eAAe,oBAAoB;IACnC,2GAA2G;IAC3G,eAAe,oBAAoB;CACpC;AAED,4CAA4C;AAC5C,MAAM,WAAW,kCAAmC,SAAQ,oBAAoB;IAC9E,SAAS,EAAE,6BAA6B,CAAC;IACzC,UAAU,EAAE,8BAA8B,CAAC;CAC5C;AAED,2FAA2F;AAC3F,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,oCAAoC,CAAC;IAC7C,kGAAkG;IAClG,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,UAAU,EAAE,kCAAkC,EAAE,CAAC;CAClD;AAED,kGAAkG;AAClG,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,gCAAgC,GAAG,SAAS,EACzD,YAAY,EAAE,MAAM,GACnB,sBAAsB,GAAG,IAAI,CAE/B;AAmBD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,eAAe,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,WAAW,EAAE,gCAAgC,GAAG,SAAS,CAAC;IAC1D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACpD;;;;OAIG;IACH,0BAA0B,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,sBAAsB,EAAE,OAAO,CAAC;CACjC,GAAG,8BAA8B,CAoBjC;AAED;;;GAGG;AACH,wBAAgB,yCAAyC,IAAI,8BAA8B,CAE1F;AAED,oIAAoI;AACpI,wBAAgB,0CAA0C,IAAI,8BAA8B,CAE3F;AAED,uGAAuG;AACvG,wBAAgB,gCAAgC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,+HAA+H;AAC/H,eAAO,MAAM,+CAA+C,4BAA4B,CAAC;AAEzF,+CAA+C;AAC/C,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,yBAAyB,CAAC;IACjC,SAAS,EAAE,6BAA6B,CAAC;IACzC,UAAU,EAAE,8BAA8B,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,kCAAkC,GAAG,IAAI,CAAC;IAClD,wGAAwG;IACxG,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE;IACxD,SAAS,EAAE,8BAA8B,CAAC;IAC1C,cAAc,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAC/D,sHAAsH;IACtH,uBAAuB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtD,GAAG;IAAE,UAAU,EAAE,8BAA8B,EAAE,CAAC;IAAC,mBAAmB,EAAE,mCAAmC,EAAE,CAAA;CAAE,CA0C/G;AAkBD,yEAAyE"}