@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/compliance/privacy/subject-data-recipients.shared.schemas.js

@@ -0,0 +1,355 @@
+/**
+ * **Who else holds a data subject's personal data, and what erasure owes each of them** — the RUNTIME half of #1710.
+ *
+ * ## Why the running application needs the recipient list
+ *
+ * A subject export answers GDPR Art. 15, which gives the data subject a right to "the recipients or categories of
+ * recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or
+ * international organisations" (Art. 15(1)(c)). An erasure answers Art. 17, and Art. 19 then requires the controller to
+ * "communicate any rectification or erasure of personal data … to each recipient to whom the personal data have been
+ * disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data
+ * subject about those recipients if the data subject requests it." Both are answered by the running backend, which
+ * until now knew only its own stores: a subject export listed no recipient, and an erasure reported nothing about a
+ * vendor that no registered effect happened to reach.
+ * spec-cite: GDPR Art. 15(1)(c), https://gdpr-info.eu/art-15-gdpr/ (fetched 2026-09-29)
+ * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)
+ *
+ * ## Derived ONCE, at design time, and projected — never re-derived here
+ *
+ * Who the recipients are is decided by the application's committed declarations: the recipient population (which
+ * vendors a data path reaches, and with whose account), the processor register (the LEGAL identity the operator
+ * adopted), the #1709 disclosures (which categories each flow carries) and the providers' compliance profiles. None
+ * of those inputs exists in a running backend — the register and the typed-client scan live in the application's
+ * specifications and source — so `wildo config subject-data-recipients` runs that one derivation and writes the result
+ * into `backend-api/src/subject-data-recipients.generated.ts`, which the application composes into
+ * `compliance.subjectDataRecipients`. The `dataRetention` precedent: one value, derived where its inputs are, read
+ * where it is enforced.
+ *
+ * Two alternatives were rejected:
+ *
+ * - **Re-deriving at runtime from the loaded provider modules.** Their `vendorLegalEntityName` is a sourced SUGGESTION
+ *   the operator adopts by committing a register entry (Paul, 2026-09-25) — telling a data subject the suggestion
+ *   would state a fact nobody adopted. And the runtime cannot see a typed client, so it would silently drop a vendor.
+ * - **Moving the derivation into this package.** Its inputs are still unavailable at runtime; only the code would move.
+ *
+ * ## Per subject, by CATEGORY — and never omitted when unknown
+ *
+ * The declaration is application-wide and names PROVIDERS only — a system of record is maintained on its own lane (its
+ * erasure is the HTTP_API effects' under the binding's D6 stance). For one request, {@link selectSubjectDataRecipients}
+ * says a recipient CARRIES the subject's data when the subject is an account holder and the recipient's capability
+ * categories meet the categories the involved resources declare (`.dataCategories()`) — the engine composes capability
+ * calls from account holders' data. Everything less
+ * certain is kept as {@link SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED}: a category match for any other subject, a
+ * recipient whose categories are NOT all derivable or only a FLOOR (free text can carry any category), and every
+ * recipient when the SUBJECT side is not fully known (an unreadable resource, a personal field with no category). An
+ * unknown is a reason to name the vendor, never to leave it out; only a recipient whose fully derived categories
+ * demonstrably miss fully known subject data is left out. The role split reads the SUBJECT's resource type only: data a
+ * processor-scope resource sends a vendor under a controller-scope subject is still reported under the subject's role.
+ *
+ * ## Absent is NOT DECLARED, and is marked
+ *
+ * An application that never generated the projection has not said who received anything. The export states NOT
+ * DECLARED, and the erasure carries one UNMEASURED outcome naming the missing projection — incomplete, never a silent
+ * pass, and never a refusal (`.claude/rules/application-creation-directive.md`).
+ *
+ * @wildo_source:part:start saas.models.privacy.subject-data-recipients facet:layer:shared facet:audience:app-developer
+ */
+import { z } from 'zod';
+// The D6 erasure vocabulary, REUSED rather than restated (#1710). Published from the package root, because the
+// contracts below carry it into the root-exported application configuration and provider compliance profile.
+import { HttpApiErasureStance } from '../../http-api-binding/http-api-erasure-stance.shared.js';
+import { OperatorProcessingRole } from './operator-compliance-identity.shared.schemas.js';
+import { PersonalDataCategory } from './personal-data-category.shared.schemas.js';
+import { SubjectErasureExternalEffectStatus, } from './subject-erasure.shared.schemas.js';
+/** Why a recipient's categories are not all derivable (#1709) — the reason travels with the recipient to runtime. */
+export var RecipientCategoriesNotDerivableReason;
+(function (RecipientCategoriesNotDerivableReason) {
+    /** Reached by a typed client, a browser operation or unscanned code: no declared field-to-input map exists. */
+    RecipientCategoriesNotDerivableReason["FLOW_UNDECLARED"] = "flow-undeclared";
+    /** A system-of-record instance that no resource binds or pipes: nothing declares what reaches it. */
+    RecipientCategoriesNotDerivableReason["NO_RESOURCE_FLOW"] = "no-resource-flow";
+    /** The resource flows could not be read (the introspection failed), so nothing is known — which is not "none". */
+    RecipientCategoriesNotDerivableReason["FLOWS_NOT_READ"] = "flows-not-read";
+    /** Some flowing field is personal by the application's own declaration and carries no category. */
+    RecipientCategoriesNotDerivableReason["UNCATEGORIZED_PERSONAL_FIELDS"] = "uncategorized-personal-fields";
+})(RecipientCategoriesNotDerivableReason || (RecipientCategoriesNotDerivableReason = {}));
+/**
+ * WHOSE account reached the recipient — which decides who owes the Art. 19 communication.
+ *
+ * Not the population class: that also answers "operator-run" and "declared without a data path", neither of which is a
+ * recipient. This is the question an erasure asks of a recipient that exists.
+ */
+export var SubjectDataRecipientReach;
+(function (SubjectDataRecipientReach) {
+    /** Reached with an application-owned credential: the operator engaged this vendor. */
+    SubjectDataRecipientReach["OPERATOR_ACCOUNT"] = "operator-account";
+    /** Reached ONLY through a tenant's or a person's connected account: the tenant's own vendor (#1707). */
+    SubjectDataRecipientReach["TENANT_ACCOUNT"] = "tenant-account";
+})(SubjectDataRecipientReach || (SubjectDataRecipientReach = {}));
+/**
+ * The stance a VENDOR declares about subject data it keeps (#1710) — on the provider's compliance profile. The D6
+ * vocabulary, narrowed to the two stances a vendor fact can take: the third, an acknowledged non-erasure, is the
+ * CONTROLLER's act and is declared by the operator ({@link ProviderSubjectErasureAcknowledgementSchema}).
+ */
+export const ProviderSubjectErasureDeclarationSchema = z.strictObject({
+    /**
+     * - `NO_SUBJECT_DATA`: the vendor keeps nothing about a subject beyond the call itself — erasure reports
+     *   DECLARED_NO_SUBJECT_DATA, which is complete.
+     * - `EXTERNAL_ERASURE_OPERATION`: an erasure effect in the external-effects registry reaches this vendor (the billing
+     *   effect for a billing provider). If none is registered for it at runtime, erasure reports NOT_REGISTERED.
+     */
+    stance: z.enum({
+        NO_SUBJECT_DATA: HttpApiErasureStance.NO_SUBJECT_DATA,
+        EXTERNAL_ERASURE_OPERATION: HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION,
+    }),
+});
+/**
+ * The OPERATOR's acknowledgement that erasure does not reach this vendor (#1710): the D6 stance
+ * CONTROLLER_ACKNOWLEDGED_NON_ERASURE for a provider, on `providerComplianceChoices.<ref>`. Erasure then reports
+ * ACKNOWLEDGED_NON_ERASURE — still incomplete, because the data is still live at the vendor, however deliberate the
+ * decision was.
+ */
+export const ProviderSubjectErasureAcknowledgementSchema = z.strictObject({
+    /** Why the operator accepts that erasure does not reach the vendor — "Resend deletes its logs within 90 days". */
+    reason: z.string().trim().min(1),
+});
+/** One recipient, as the running application needs to state it. */
+export const SubjectDataRecipientSchema = z.strictObject({
+    /** The provider ref. A system of record is never a recipient here (see the module JSDoc). */
+    ref: z.string().trim().min(1),
+    /**
+     * The legal entity the operator's processor register adopted for it, or `null` when the register has no entry — a
+     * gap stated as such, never filled with a suggestion.
+     */
+    legalEntityName: z.string().trim().min(1).nullable(),
+    /** Where the register says it processes. Empty when there is no register entry. */
+    processingRegions: z.array(z.string().trim().min(1)),
+    reach: z.enum(SubjectDataRecipientReach),
+    /** The categories its declared flows carry to it (#1709), in enum order. */
+    categories: z.array(z.enum(PersonalDataCategory)),
+    /** Every reason those categories are not all known. Empty when the declared flows account for everything. */
+    categoriesNotDerivable: z.array(z.enum(RecipientCategoriesNotDerivableReason)),
+    /** True when the categories include free text a person wrote, which can carry any other category. */
+    categoriesAreAFloor: z.boolean(),
+    /** The declared flows the categories come from — `capability:EMAIL_TRANSACTIONAL`, … */
+    derivedFrom: z.array(z.string().trim().min(1)),
+    /**
+     * The erasure stance: the vendor's declaration, or the operator's acknowledged non-erasure. `null` when neither
+     * exists — erasure then reports UNMEASURED for this recipient.
+     */
+    erasureStance: z.enum(HttpApiErasureStance).nullable(),
+});
+/** Which resource types one operator role covers, from `operatorComplianceIdentity.roleAllocations[].resourceTypes`. */
+export const SubjectDataRoleAllocationSchema = z.strictObject({
+    role: z.enum(OperatorProcessingRole),
+    resourceTypes: z.array(z.string().trim().min(1)).min(1),
+});
+/** The derived projection `compliance.subjectDataRecipients` carries. */
+export const SubjectDataRecipientsDeclarationSchema = z.strictObject({
+    recipients: z.array(SubjectDataRecipientSchema),
+    /** The role allocations that name their resource types. An allocation in prose only is not carried. */
+    roleAllocations: z.array(SubjectDataRoleAllocationSchema),
+});
+/** Whether the running application has a recipient declaration at all. */
+export var SubjectDataRecipientsStatementStatus;
+(function (SubjectDataRecipientsStatementStatus) {
+    /** The projection is composed; the list below is the derived answer (possibly empty). */
+    SubjectDataRecipientsStatementStatus["DECLARED"] = "declared";
+    /** No projection: the application has not stated who received personal data. A gap, marked. */
+    SubjectDataRecipientsStatementStatus["NOT_DECLARED"] = "not-declared";
+    /**
+     * A declaration may exist, but applying it to this request FAILED (the erasure's post-commit accounting threw), so
+     * which recipients hold this subject's data is unknown. Distinct from NOT_DECLARED, whose remedy is to generate the
+     * projection; this one's is to reconcile the vendors by hand and look at the logged error.
+     */
+    SubjectDataRecipientsStatementStatus["UNDETERMINED"] = "undetermined";
+})(SubjectDataRecipientsStatementStatus || (SubjectDataRecipientsStatementStatus = {}));
+/** Why one recipient is listed for this subject. */
+export var SubjectDataRecipientRelevance;
+(function (SubjectDataRecipientRelevance) {
+    /** Its derived categories meet this subject's data, or its flow names one of the involved resources. */
+    SubjectDataRecipientRelevance["CARRIES_SUBJECT_DATA"] = "carries-subject-data";
+    /** Its categories are not all derivable, or are a floor: it may have received this subject's data. */
+    SubjectDataRecipientRelevance["MAY_HAVE_RECEIVED"] = "may-have-received";
+})(SubjectDataRecipientRelevance || (SubjectDataRecipientRelevance = {}));
+/**
+ * Who owes what to this recipient when the subject's data is erased — the role split (#1710).
+ *
+ * A processor "assists the controller … for the fulfilment of the controller's obligation to respond to requests for
+ * exercising the data subject's rights" (Art. 28(3)(e)); the Art. 19 communication is the controller's.
+ * spec-cite: GDPR Art. 28(3)(e), https://gdpr-info.eu/art-28-gdpr/ (fetched 2026-09-29)
+ */
+export var SubjectDataRecipientObligation;
+(function (SubjectDataRecipientObligation) {
+    /** The operator is CONTROLLER (or joint controller) for this data: it communicates the erasure (Art. 19). */
+    SubjectDataRecipientObligation["OPERATOR_COMMUNICATES"] = "operator-communicates";
+    /** The operator is PROCESSOR for this data: the outcome is assistance evidence for the tenant, the controller. */
+    SubjectDataRecipientObligation["OPERATOR_ASSISTS_CONTROLLER"] = "operator-assists-controller";
+    /** Reached with the tenant's own account: the tenant's recipient, and the tenant's to notify. */
+    SubjectDataRecipientObligation["TENANT_NOTIFIES"] = "tenant-notifies";
+    /** No role allocation names the subject's resource type, so who owes the communication is not declared. */
+    SubjectDataRecipientObligation["ROLE_UNDECLARED"] = "role-undeclared";
+})(SubjectDataRecipientObligation || (SubjectDataRecipientObligation = {}));
+/** The operator role an allocation declares for a resource type, or `null` when none names it. */
+export function operatorRoleForResourceType(declaration, resourceType) {
+    return declaration?.roleAllocations.find((allocation) => allocation.resourceTypes.includes(resourceType))?.role ?? null;
+}
+function obligationOf(reach, role) {
+    if (reach === SubjectDataRecipientReach.TENANT_ACCOUNT)
+        return SubjectDataRecipientObligation.TENANT_NOTIFIES;
+    switch (role) {
+        case OperatorProcessingRole.CONTROLLER:
+        case OperatorProcessingRole.JOINT_CONTROLLER:
+            return SubjectDataRecipientObligation.OPERATOR_COMMUNICATES;
+        case OperatorProcessingRole.PROCESSOR:
+            return SubjectDataRecipientObligation.OPERATOR_ASSISTS_CONTROLLER;
+        case null:
+            return SubjectDataRecipientObligation.ROLE_UNDECLARED;
+        default: {
+            const unhandled = role;
+            throw new Error(`subject data recipients: unhandled operator role ${String(unhandled)}`);
+        }
+    }
+}
+/**
+ * The `derivedFrom` token kind of a flow the ENGINE composes through a capability: `capability:<token>` (#1709), written
+ * by `deriveRecipientDisclosures`. The only flow kind this list carries, because systems of record are kept out of it.
+ */
+export const RECIPIENT_CAPABILITY_FLOW_TOKEN_KIND = 'capability';
+/**
+ * The recipients one subject export or erasure must name — see the module JSDoc for the rule. Pure, so the backend,
+ * a test and a reviewer apply the same one.
+ */
+export function selectSubjectDataRecipients(params) {
+    if (params.declaration === undefined)
+        return notDeclaredSubjectDataRecipientsStatement();
+    const role = operatorRoleForResourceType(params.declaration, params.subjectResourceType);
+    const involvedCategories = new Set(params.involvedCategories);
+    const recipients = [];
+    for (const recipient of params.declaration.recipients) {
+        const sharesACategory = recipient.categories.some((category) => involvedCategories.has(category));
+        const carries = sharesACategory && params.subjectIsAccountHolder;
+        const uncertain = sharesACategory
+            || recipient.categoriesNotDerivable.length > 0
+            || recipient.categoriesAreAFloor
+            || !params.involvedCategoriesComplete;
+        if (!carries && !uncertain)
+            continue;
+        recipients.push({
+            ...recipient,
+            relevance: carries ? SubjectDataRecipientRelevance.CARRIES_SUBJECT_DATA : SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED,
+            obligation: obligationOf(recipient.reach, role),
+        });
+    }
+    return { status: SubjectDataRecipientsStatementStatus.DECLARED, operatorRole: role, recipients };
+}
+/**
+ * The statement of an application with no recipient declaration. Also the placeholder an orchestrator writes into a
+ * report its caller completes (the erasure and export doors fill the real statement, as they fill `externalEffects`).
+ */
+export function notDeclaredSubjectDataRecipientsStatement() {
+    return { status: SubjectDataRecipientsStatementStatus.NOT_DECLARED, operatorRole: null, recipients: [] };
+}
+/** The statement of a request whose recipient accounting failed — see {@link SubjectDataRecipientsStatementStatus.UNDETERMINED}. */
+export function undeterminedSubjectDataRecipientsStatement() {
+    return { status: SubjectDataRecipientsStatementStatus.UNDETERMINED, operatorRole: null, recipients: [] };
+}
+/** The effect ref the recipient reconciliation writes for a recipient no registered effect reached. */
+export function subjectErasureRecipientEffectRef(recipientRef) {
+    return `recipient:${recipientRef}`;
+}
+/** The effect ref of the single outcome an erasure carries when its recipients are not declared or could not be determined. */
+export const SUBJECT_DATA_RECIPIENTS_NOT_DECLARED_EFFECT_REF = 'subject-data-recipients';
+/**
+ * Most-incomplete-wins when several effects reach one recipient: a PARTIAL next to a COMPLETED is still partial.
+ * Ordered from the state a reader must act on first to the states that close the question.
+ */
+const STATUS_SEVERITY = [
+    SubjectErasureExternalEffectStatus.PARTIAL,
+    SubjectErasureExternalEffectStatus.FAILED,
+    SubjectErasureExternalEffectStatus.UNMEASURED,
+    SubjectErasureExternalEffectStatus.NOT_REGISTERED,
+    SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE,
+    SubjectErasureExternalEffectStatus.COMPLETED,
+    SubjectErasureExternalEffectStatus.NOTHING_TO_ERASE,
+    SubjectErasureExternalEffectStatus.DECLARED_NO_SUBJECT_DATA,
+];
+function combinedStatus(statuses) {
+    return STATUS_SEVERITY.find((status) => statuses.includes(status)) ?? SubjectErasureExternalEffectStatus.UNMEASURED;
+}
+/**
+ * Reconcile the recipients an erasure must reach with the effects that ran (#1710).
+ *
+ * Every operator-account recipient gets a status, so none can pass silently:
+ * - a registered effect that names it as its `recipientRef` → that effect's status;
+ * - otherwise its stance decides: NO_SUBJECT_DATA → DECLARED_NO_SUBJECT_DATA (complete); an acknowledged
+ *   non-erasure → ACKNOWLEDGED_NON_ERASURE; EXTERNAL_ERASURE_OPERATION with no effect registered → NOT_REGISTERED;
+ *   no stance → UNMEASURED. Each becomes an `externalEffects` outcome under `recipient:<ref>`, so every existing
+ *   reader of the report (`isIncompleteSubjectErasureExternalEffect`, the Wonder Todos request lane) sees it without
+ *   learning a new field.
+ * - NOT DECLARED adds one UNMEASURED outcome naming the missing projection.
+ *
+ * It marks and never refuses: the local erasure has already committed when this runs.
+ */
+export function reconcileSubjectErasureRecipients(params) {
+    const addedEffectOutcomes = [];
+    if (params.statement.status !== SubjectDataRecipientsStatementStatus.DECLARED) {
+        addedEffectOutcomes.push({
+            effectRef: SUBJECT_DATA_RECIPIENTS_NOT_DECLARED_EFFECT_REF,
+            status: SubjectErasureExternalEffectStatus.UNMEASURED,
+            detail: params.statement.status === SubjectDataRecipientsStatementStatus.NOT_DECLARED
+                ? 'The application declares no subject-data recipients (compliance.subjectDataRecipients is absent), so which vendors hold this subject\'s data is unknown. Run `wildo config subject-data-recipients` and redeploy.'
+                : 'Which recipients hold this subject\'s data could not be determined for this request; reconcile each vendor before treating the erasure as complete.',
+        });
+        return { recipients: [], addedEffectOutcomes };
+    }
+    const recipients = params.statement.recipients.map((recipient) => {
+        const base = {
+            recipientRef: recipient.ref,
+            legalEntityName: recipient.legalEntityName,
+            reach: recipient.reach,
+            relevance: recipient.relevance,
+            obligation: recipient.obligation,
+        };
+        if (recipient.reach === SubjectDataRecipientReach.TENANT_ACCOUNT)
+            return { ...base, status: null, effectRefs: [] };
+        const covering = params.effectOutcomes.filter((outcome) => params.recipientRefByEffectRef.get(outcome.effectRef) === recipient.ref);
+        if (covering.length > 0) {
+            return { ...base, status: combinedStatus(covering.map((outcome) => outcome.status)), effectRefs: covering.map((outcome) => outcome.effectRef) };
+        }
+        const effectRef = subjectErasureRecipientEffectRef(recipient.ref);
+        const registeredForOtherSubjects = [...params.recipientRefByEffectRef.entries()]
+            .filter(([, recipientRef]) => recipientRef === recipient.ref).map(([registeredRef]) => registeredRef);
+        const decided = registeredForOtherSubjects.length > 0
+            // An effect reaches this vendor, but not for this subject's type (the billing effect answers for users). That is
+            // no evidence either way about THIS subject's data there, so it is unmeasured — never "not registered", which
+            // would say nobody built the door.
+            ? {
+                effectRef,
+                status: SubjectErasureExternalEffectStatus.UNMEASURED,
+                detail: `${recipient.ref} is reached by the erasure effect(s) ${registeredForOtherSubjects.join(', ')}, which do not apply to this subject's type; whether ${recipient.ref} holds this subject's data is not measured.`,
+            }
+            : uncoveredRecipientOutcome(recipient, effectRef);
+        addedEffectOutcomes.push(decided);
+        return { ...base, status: decided.status, effectRefs: [effectRef] };
+    });
+    return { recipients, addedEffectOutcomes };
+}
+function uncoveredRecipientOutcome(recipient, effectRef) {
+    switch (recipient.erasureStance) {
+        case HttpApiErasureStance.NO_SUBJECT_DATA:
+            return { effectRef, status: SubjectErasureExternalEffectStatus.DECLARED_NO_SUBJECT_DATA, detail: `${recipient.ref} declares it keeps no subject data beyond the call.` };
+        case HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE:
+            return { effectRef, status: SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE, detail: `The operator acknowledged that erasure does not reach ${recipient.ref}; its copy of the subject's data remains until the vendor deletes it.` };
+        case HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION:
+            return { effectRef, status: SubjectErasureExternalEffectStatus.NOT_REGISTERED, detail: `${recipient.ref} declares an erasure operation, but no erasure effect reaching it is registered in this application.` };
+        case null:
+            return { effectRef, status: SubjectErasureExternalEffectStatus.UNMEASURED, detail: `${recipient.ref} declares no erasure stance and no effect reaches it, so whether it still holds the subject's data is unknown.` };
+        default: {
+            const unhandled = recipient.erasureStance;
+            throw new Error(`subject data recipients: unhandled erasure stance ${String(unhandled)}`);
+        }
+    }
+}
+/** @wildo_source:part:end saas.models.privacy.subject-data-recipients */
+//# sourceMappingURL=subject-data-recipients.shared.schemas.js.map

package/dist/esm/compliance/privacy/subject-data-recipients.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-data-recipients.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-data-recipients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,+GAA+G;AAC/G,6GAA6G;AAC7G,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EACL,kCAAkC,GAEnC,MAAM,kCAAkC,CAAC;AAE1C,qHAAqH;AACrH,MAAM,CAAN,IAAY,qCASX;AATD,WAAY,qCAAqC;IAC/C,+GAA+G;IAC/G,4EAAmC,CAAA;IACnC,qGAAqG;IACrG,8EAAqC,CAAA;IACrC,kHAAkH;IAClH,0EAAiC,CAAA;IACjC,mGAAmG;IACnG,wGAA+D,CAAA;AACjE,CAAC,EATW,qCAAqC,KAArC,qCAAqC,QAShD;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,sFAAsF;IACtF,kEAAqC,CAAA;IACrC,wGAAwG;IACxG,8DAAiC,CAAA;AACnC,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QACb,eAAe,EAAE,oBAAoB,CAAC,eAAe;QACrD,0BAA0B,EAAE,oBAAoB,CAAC,0BAA0B;KAC5E,CAAC;CACH,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,kHAAkH;IAClH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH,mEAAmE;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,6FAA6F;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B;;;OAGG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IACxC,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjD,6GAA6G;IAC7G,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC9E,qGAAqG;IACrG,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,wHAAwH;AACxH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACxD,CAAC,CAAC;AAGH,yEAAyE;AACzE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;IAC/C,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;CAC1D,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAN,IAAY,oCAWX;AAXD,WAAY,oCAAoC;IAC9C,yFAAyF;IACzF,6DAAqB,CAAA;IACrB,+FAA+F;IAC/F,qEAA6B,CAAA;IAC7B;;;;OAIG;IACH,qEAA6B,CAAA;AAC/B,CAAC,EAXW,oCAAoC,KAApC,oCAAoC,QAW/C;AAED,oDAAoD;AACpD,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,wGAAwG;IACxG,8EAA6C,CAAA;IAC7C,sGAAsG;IACtG,wEAAuC,CAAA;AACzC,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,6GAA6G;IAC7G,iFAA+C,CAAA;IAC/C,kHAAkH;IAClH,6FAA2D,CAAA;IAC3D,iGAAiG;IACjG,qEAAmC,CAAA;IACnC,2GAA2G;IAC3G,qEAAmC,CAAA;AACrC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAgBD,kGAAkG;AAClG,MAAM,UAAU,2BAA2B,CACzC,WAAyD,EACzD,YAAoB;IAEpB,OAAO,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AAC1H,CAAC;AAED,SAAS,YAAY,CAAC,KAAgC,EAAE,IAAmC;IACzF,IAAI,KAAK,KAAK,yBAAyB,CAAC,cAAc;QAAE,OAAO,8BAA8B,CAAC,eAAe,CAAC;IAC9G,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB,CAAC,UAAU,CAAC;QACvC,KAAK,sBAAsB,CAAC,gBAAgB;YAC1C,OAAO,8BAA8B,CAAC,qBAAqB,CAAC;QAC9D,KAAK,sBAAsB,CAAC,SAAS;YACnC,OAAO,8BAA8B,CAAC,2BAA2B,CAAC;QACpE,KAAK,IAAI;YACP,OAAO,8BAA8B,CAAC,eAAe,CAAC;QACxD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,IAAI,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,YAAY,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAmB3C;IACC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,yCAAyC,EAAE,CAAC;IACzF,MAAM,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAyC,EAAE,CAAC;IAC5D,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,eAAe,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClG,MAAM,OAAO,GAAG,eAAe,IAAI,MAAM,CAAC,sBAAsB,CAAC;QACjE,MAAM,SAAS,GAAG,eAAe;eAC5B,SAAS,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC;eAC3C,SAAS,CAAC,mBAAmB;eAC7B,CAAC,MAAM,CAAC,0BAA0B,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,SAAS;QACrC,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,SAAS;YACZ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,oBAAoB,CAAC,CAAC,CAAC,6BAA6B,CAAC,iBAAiB;YACzH,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,oCAAoC,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACnG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yCAAyC;IACvD,OAAO,EAAE,MAAM,EAAE,oCAAoC,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC3G,CAAC;AAED,oIAAoI;AACpI,MAAM,UAAU,0CAA0C;IACxD,OAAO,EAAE,MAAM,EAAE,oCAAoC,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC3G,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,gCAAgC,CAAC,YAAoB;IACnE,OAAO,aAAa,YAAY,EAAE,CAAC;AACrC,CAAC;AAED,+HAA+H;AAC/H,MAAM,CAAC,MAAM,+CAA+C,GAAG,yBAAyB,CAAC;AAkBzF;;;GAGG;AACH,MAAM,eAAe,GAAkD;IACrE,kCAAkC,CAAC,OAAO;IAC1C,kCAAkC,CAAC,MAAM;IACzC,kCAAkC,CAAC,UAAU;IAC7C,kCAAkC,CAAC,cAAc;IACjD,kCAAkC,CAAC,wBAAwB;IAC3D,kCAAkC,CAAC,SAAS;IAC5C,kCAAkC,CAAC,gBAAgB;IACnD,kCAAkC,CAAC,wBAAwB;CAC5D,CAAC;AAEF,SAAS,cAAc,CAAC,QAAuD;IAC7E,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,kCAAkC,CAAC,UAAU,CAAC;AACtH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAKjD;IACC,MAAM,mBAAmB,GAA0C,EAAE,CAAC;IACtE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,oCAAoC,CAAC,QAAQ,EAAE,CAAC;QAC9E,mBAAmB,CAAC,IAAI,CAAC;YACvB,SAAS,EAAE,+CAA+C;YAC1D,MAAM,EAAE,kCAAkC,CAAC,UAAU;YACrD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,oCAAoC,CAAC,YAAY;gBACnF,CAAC,CAAC,mNAAmN;gBACrN,CAAC,CAAC,qJAAqJ;SAC1J,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAkC,EAAE;QAC/F,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,SAAS,CAAC,GAAG;YAC3B,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC,CAAC;QACF,IAAI,SAAS,CAAC,KAAK,KAAK,yBAAyB,CAAC,cAAc;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACnH,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC;QACpI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAClJ,CAAC;QACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC;aAC7E,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC;QACxG,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,GAAG,CAAC;YACnD,iHAAiH;YACjH,8GAA8G;YAC9G,mCAAmC;YACnC,CAAC,CAAC;gBACA,SAAS;gBACT,MAAM,EAAE,kCAAkC,CAAC,UAAU;gBACrD,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,wCAAwC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD,SAAS,CAAC,GAAG,6CAA6C;aACxN;YACD,CAAC,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,yBAAyB,CAAC,SAA6C,EAAE,SAAiB;IACjG,QAAQ,SAAS,CAAC,aAAa,EAAE,CAAC;QAChC,KAAK,oBAAoB,CAAC,eAAe;YACvC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,qDAAqD,EAAE,CAAC;QAC3K,KAAK,oBAAoB,CAAC,mCAAmC;YAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,MAAM,EAAE,yDAAyD,SAAS,CAAC,GAAG,uEAAuE,EAAE,CAAC;QACnP,KAAK,oBAAoB,CAAC,0BAA0B;YAClD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,sGAAsG,EAAE,CAAC;QAClN,KAAK,IAAI;YACP,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,gHAAgH,EAAE,CAAC;QACxN,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,SAAS,CAAC,aAAa,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;AACH,CAAC;AACD,yEAAyE","sourcesContent":["/**\n * **Who else holds a data subject's personal data, and what erasure owes each of them** — the RUNTIME half of #1710.\n *\n * ## Why the running application needs the recipient list\n *\n * A subject export answers GDPR Art. 15, which gives the data subject a right to \"the recipients or categories of\n * recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or\n * international organisations\" (Art. 15(1)(c)). An erasure answers Art. 17, and Art. 19 then requires the controller to\n * \"communicate any rectification or erasure of personal data … to each recipient to whom the personal data have been\n * disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data\n * subject about those recipients if the data subject requests it.\" Both are answered by the running backend, which\n * until now knew only its own stores: a subject export listed no recipient, and an erasure reported nothing about a\n * vendor that no registered effect happened to reach.\n * spec-cite: GDPR Art. 15(1)(c), https://gdpr-info.eu/art-15-gdpr/ (fetched 2026-09-29)\n * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)\n *\n * ## Derived ONCE, at design time, and projected — never re-derived here\n *\n * Who the recipients are is decided by the application's committed declarations: the recipient population (which\n * vendors a data path reaches, and with whose account), the processor register (the LEGAL identity the operator\n * adopted), the #1709 disclosures (which categories each flow carries) and the providers' compliance profiles. None\n * of those inputs exists in a running backend — the register and the typed-client scan live in the application's\n * specifications and source — so `wildo config subject-data-recipients` runs that one derivation and writes the result\n * into `backend-api/src/subject-data-recipients.generated.ts`, which the application composes into\n * `compliance.subjectDataRecipients`. The `dataRetention` precedent: one value, derived where its inputs are, read\n * where it is enforced.\n *\n * Two alternatives were rejected:\n *\n * - **Re-deriving at runtime from the loaded provider modules.** Their `vendorLegalEntityName` is a sourced SUGGESTION\n *   the operator adopts by committing a register entry (Paul, 2026-09-25) — telling a data subject the suggestion\n *   would state a fact nobody adopted. And the runtime cannot see a typed client, so it would silently drop a vendor.\n * - **Moving the derivation into this package.** Its inputs are still unavailable at runtime; only the code would move.\n *\n * ## Per subject, by CATEGORY — and never omitted when unknown\n *\n * The declaration is application-wide and names PROVIDERS only — a system of record is maintained on its own lane (its\n * erasure is the HTTP_API effects' under the binding's D6 stance). For one request, {@link selectSubjectDataRecipients}\n * says a recipient CARRIES the subject's data when the subject is an account holder and the recipient's capability\n * categories meet the categories the involved resources declare (`.dataCategories()`) — the engine composes capability\n * calls from account holders' data. Everything less\n * certain is kept as {@link SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED}: a category match for any other subject, a\n * recipient whose categories are NOT all derivable or only a FLOOR (free text can carry any category), and every\n * recipient when the SUBJECT side is not fully known (an unreadable resource, a personal field with no category). An\n * unknown is a reason to name the vendor, never to leave it out; only a recipient whose fully derived categories\n * demonstrably miss fully known subject data is left out. The role split reads the SUBJECT's resource type only: data a\n * processor-scope resource sends a vendor under a controller-scope subject is still reported under the subject's role.\n *\n * ## Absent is NOT DECLARED, and is marked\n *\n * An application that never generated the projection has not said who received anything. The export states NOT\n * DECLARED, and the erasure carries one UNMEASURED outcome naming the missing projection — incomplete, never a silent\n * pass, and never a refusal (`.claude/rules/application-creation-directive.md`).\n *\n * @wildo_source:part:start saas.models.privacy.subject-data-recipients facet:layer:shared facet:audience:app-developer\n */\nimport { z } from 'zod';\n// The D6 erasure vocabulary, REUSED rather than restated (#1710). Published from the package root, because the\n// contracts below carry it into the root-exported application configuration and provider compliance profile.\nimport { HttpApiErasureStance } from '../../http-api-binding/http-api-erasure-stance.shared';\nimport { OperatorProcessingRole } from './operator-compliance-identity.shared.schemas';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\nimport {\n  SubjectErasureExternalEffectStatus,\n  type SubjectErasureExternalEffectOutcome,\n} from './subject-erasure.shared.schemas';\n\n/** Why a recipient's categories are not all derivable (#1709) — the reason travels with the recipient to runtime. */\nexport enum RecipientCategoriesNotDerivableReason {\n  /** Reached by a typed client, a browser operation or unscanned code: no declared field-to-input map exists. */\n  FLOW_UNDECLARED = 'flow-undeclared',\n  /** A system-of-record instance that no resource binds or pipes: nothing declares what reaches it. */\n  NO_RESOURCE_FLOW = 'no-resource-flow',\n  /** The resource flows could not be read (the introspection failed), so nothing is known — which is not \"none\". */\n  FLOWS_NOT_READ = 'flows-not-read',\n  /** Some flowing field is personal by the application's own declaration and carries no category. */\n  UNCATEGORIZED_PERSONAL_FIELDS = 'uncategorized-personal-fields',\n}\n\n/**\n * WHOSE account reached the recipient — which decides who owes the Art. 19 communication.\n *\n * Not the population class: that also answers \"operator-run\" and \"declared without a data path\", neither of which is a\n * recipient. This is the question an erasure asks of a recipient that exists.\n */\nexport enum SubjectDataRecipientReach {\n  /** Reached with an application-owned credential: the operator engaged this vendor. */\n  OPERATOR_ACCOUNT = 'operator-account',\n  /** Reached ONLY through a tenant's or a person's connected account: the tenant's own vendor (#1707). */\n  TENANT_ACCOUNT = 'tenant-account',\n}\n\n/**\n * The stance a VENDOR declares about subject data it keeps (#1710) — on the provider's compliance profile. The D6\n * vocabulary, narrowed to the two stances a vendor fact can take: the third, an acknowledged non-erasure, is the\n * CONTROLLER's act and is declared by the operator ({@link ProviderSubjectErasureAcknowledgementSchema}).\n */\nexport const ProviderSubjectErasureDeclarationSchema = z.strictObject({\n  /**\n   * - `NO_SUBJECT_DATA`: the vendor keeps nothing about a subject beyond the call itself — erasure reports\n   *   DECLARED_NO_SUBJECT_DATA, which is complete.\n   * - `EXTERNAL_ERASURE_OPERATION`: an erasure effect in the external-effects registry reaches this vendor (the billing\n   *   effect for a billing provider). If none is registered for it at runtime, erasure reports NOT_REGISTERED.\n   */\n  stance: z.enum({\n    NO_SUBJECT_DATA: HttpApiErasureStance.NO_SUBJECT_DATA,\n    EXTERNAL_ERASURE_OPERATION: HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION,\n  }),\n});\nexport type ProviderSubjectErasureDeclaration = z.infer<typeof ProviderSubjectErasureDeclarationSchema>;\n\n/**\n * The OPERATOR's acknowledgement that erasure does not reach this vendor (#1710): the D6 stance\n * CONTROLLER_ACKNOWLEDGED_NON_ERASURE for a provider, on `providerComplianceChoices.<ref>`. Erasure then reports\n * ACKNOWLEDGED_NON_ERASURE — still incomplete, because the data is still live at the vendor, however deliberate the\n * decision was.\n */\nexport const ProviderSubjectErasureAcknowledgementSchema = z.strictObject({\n  /** Why the operator accepts that erasure does not reach the vendor — \"Resend deletes its logs within 90 days\". */\n  reason: z.string().trim().min(1),\n});\nexport type ProviderSubjectErasureAcknowledgement = z.infer<typeof ProviderSubjectErasureAcknowledgementSchema>;\n\n/** One recipient, as the running application needs to state it. */\nexport const SubjectDataRecipientSchema = z.strictObject({\n  /** The provider ref. A system of record is never a recipient here (see the module JSDoc). */\n  ref: z.string().trim().min(1),\n  /**\n   * The legal entity the operator's processor register adopted for it, or `null` when the register has no entry — a\n   * gap stated as such, never filled with a suggestion.\n   */\n  legalEntityName: z.string().trim().min(1).nullable(),\n  /** Where the register says it processes. Empty when there is no register entry. */\n  processingRegions: z.array(z.string().trim().min(1)),\n  reach: z.enum(SubjectDataRecipientReach),\n  /** The categories its declared flows carry to it (#1709), in enum order. */\n  categories: z.array(z.enum(PersonalDataCategory)),\n  /** Every reason those categories are not all known. Empty when the declared flows account for everything. */\n  categoriesNotDerivable: z.array(z.enum(RecipientCategoriesNotDerivableReason)),\n  /** True when the categories include free text a person wrote, which can carry any other category. */\n  categoriesAreAFloor: z.boolean(),\n  /** The declared flows the categories come from — `capability:EMAIL_TRANSACTIONAL`, … */\n  derivedFrom: z.array(z.string().trim().min(1)),\n  /**\n   * The erasure stance: the vendor's declaration, or the operator's acknowledged non-erasure. `null` when neither\n   * exists — erasure then reports UNMEASURED for this recipient.\n   */\n  erasureStance: z.enum(HttpApiErasureStance).nullable(),\n});\nexport type SubjectDataRecipient = z.infer<typeof SubjectDataRecipientSchema>;\n\n/** Which resource types one operator role covers, from `operatorComplianceIdentity.roleAllocations[].resourceTypes`. */\nexport const SubjectDataRoleAllocationSchema = z.strictObject({\n  role: z.enum(OperatorProcessingRole),\n  resourceTypes: z.array(z.string().trim().min(1)).min(1),\n});\nexport type SubjectDataRoleAllocation = z.infer<typeof SubjectDataRoleAllocationSchema>;\n\n/** The derived projection `compliance.subjectDataRecipients` carries. */\nexport const SubjectDataRecipientsDeclarationSchema = z.strictObject({\n  recipients: z.array(SubjectDataRecipientSchema),\n  /** The role allocations that name their resource types. An allocation in prose only is not carried. */\n  roleAllocations: z.array(SubjectDataRoleAllocationSchema),\n});\nexport type SubjectDataRecipientsDeclaration = z.infer<typeof SubjectDataRecipientsDeclarationSchema>;\n\n/** Whether the running application has a recipient declaration at all. */\nexport enum SubjectDataRecipientsStatementStatus {\n  /** The projection is composed; the list below is the derived answer (possibly empty). */\n  DECLARED = 'declared',\n  /** No projection: the application has not stated who received personal data. A gap, marked. */\n  NOT_DECLARED = 'not-declared',\n  /**\n   * A declaration may exist, but applying it to this request FAILED (the erasure's post-commit accounting threw), so\n   * which recipients hold this subject's data is unknown. Distinct from NOT_DECLARED, whose remedy is to generate the\n   * projection; this one's is to reconcile the vendors by hand and look at the logged error.\n   */\n  UNDETERMINED = 'undetermined',\n}\n\n/** Why one recipient is listed for this subject. */\nexport enum SubjectDataRecipientRelevance {\n  /** Its derived categories meet this subject's data, or its flow names one of the involved resources. */\n  CARRIES_SUBJECT_DATA = 'carries-subject-data',\n  /** Its categories are not all derivable, or are a floor: it may have received this subject's data. */\n  MAY_HAVE_RECEIVED = 'may-have-received',\n}\n\n/**\n * Who owes what to this recipient when the subject's data is erased — the role split (#1710).\n *\n * A processor \"assists the controller … for the fulfilment of the controller's obligation to respond to requests for\n * exercising the data subject's rights\" (Art. 28(3)(e)); the Art. 19 communication is the controller's.\n * spec-cite: GDPR Art. 28(3)(e), https://gdpr-info.eu/art-28-gdpr/ (fetched 2026-09-29)\n */\nexport enum SubjectDataRecipientObligation {\n  /** The operator is CONTROLLER (or joint controller) for this data: it communicates the erasure (Art. 19). */\n  OPERATOR_COMMUNICATES = 'operator-communicates',\n  /** The operator is PROCESSOR for this data: the outcome is assistance evidence for the tenant, the controller. */\n  OPERATOR_ASSISTS_CONTROLLER = 'operator-assists-controller',\n  /** Reached with the tenant's own account: the tenant's recipient, and the tenant's to notify. */\n  TENANT_NOTIFIES = 'tenant-notifies',\n  /** No role allocation names the subject's resource type, so who owes the communication is not declared. */\n  ROLE_UNDECLARED = 'role-undeclared',\n}\n\n/** One recipient listed for one request. */\nexport interface SubjectDataRecipientStatementEntry extends SubjectDataRecipient {\n  relevance: SubjectDataRecipientRelevance;\n  obligation: SubjectDataRecipientObligation;\n}\n\n/** The recipient part of a subject export or erasure report. Contains no personal data. */\nexport interface SubjectDataRecipientsStatement {\n  status: SubjectDataRecipientsStatementStatus;\n  /** The operator's role for the subject's resource type, or `null` when no allocation names it. */\n  operatorRole: OperatorProcessingRole | null;\n  recipients: SubjectDataRecipientStatementEntry[];\n}\n\n/** The operator role an allocation declares for a resource type, or `null` when none names it. */\nexport function operatorRoleForResourceType(\n  declaration: SubjectDataRecipientsDeclaration | undefined,\n  resourceType: string,\n): OperatorProcessingRole | null {\n  return declaration?.roleAllocations.find((allocation) => allocation.resourceTypes.includes(resourceType))?.role ?? null;\n}\n\nfunction obligationOf(reach: SubjectDataRecipientReach, role: OperatorProcessingRole | null): SubjectDataRecipientObligation {\n  if (reach === SubjectDataRecipientReach.TENANT_ACCOUNT) return SubjectDataRecipientObligation.TENANT_NOTIFIES;\n  switch (role) {\n    case OperatorProcessingRole.CONTROLLER:\n    case OperatorProcessingRole.JOINT_CONTROLLER:\n      return SubjectDataRecipientObligation.OPERATOR_COMMUNICATES;\n    case OperatorProcessingRole.PROCESSOR:\n      return SubjectDataRecipientObligation.OPERATOR_ASSISTS_CONTROLLER;\n    case null:\n      return SubjectDataRecipientObligation.ROLE_UNDECLARED;\n    default: {\n      const unhandled: never = role;\n      throw new Error(`subject data recipients: unhandled operator role ${String(unhandled)}`);\n    }\n  }\n}\n\n/**\n * The `derivedFrom` token kind of a flow the ENGINE composes through a capability: `capability:<token>` (#1709), written\n * by `deriveRecipientDisclosures`. The only flow kind this list carries, because systems of record are kept out of it.\n */\nexport const RECIPIENT_CAPABILITY_FLOW_TOKEN_KIND = 'capability';\n\n/**\n * The recipients one subject export or erasure must name — see the module JSDoc for the rule. Pure, so the backend,\n * a test and a reviewer apply the same one.\n */\nexport function selectSubjectDataRecipients(params: {\n  declaration: SubjectDataRecipientsDeclaration | undefined;\n  subjectResourceType: string;\n  /** The union of the `.dataCategories()` those resources declare. */\n  involvedCategories: readonly PersonalDataCategory[];\n  /**\n   * `false` when the involved categories are NOT the whole answer: a resource's configuration could not be read, or it\n   * declares personal fields with no category. An unknown on the SUBJECT side must widen the list exactly as an unknown\n   * on the recipient side does — every recipient not matched is then kept as MAY_HAVE_RECEIVED, never dropped.\n   */\n  involvedCategoriesComplete: boolean;\n  /**\n   * Whether the subject is an ACCOUNT HOLDER (a user). A capability recipient's categories are what the ENGINE sends\n   * when it composes the call — the recipient address of an account's mail, the billing customer, the signed-in actor —\n   * which are account holders' data. So a category match through a capability alone says the vendor carries an account\n   * holder's data; for any other subject (a CRM contact) it says only that it MAY have received it, because nothing\n   * declares that the application routes that subject's data to the capability.\n   */\n  subjectIsAccountHolder: boolean;\n}): SubjectDataRecipientsStatement {\n  if (params.declaration === undefined) return notDeclaredSubjectDataRecipientsStatement();\n  const role = operatorRoleForResourceType(params.declaration, params.subjectResourceType);\n  const involvedCategories = new Set(params.involvedCategories);\n  const recipients: SubjectDataRecipientStatementEntry[] = [];\n  for (const recipient of params.declaration.recipients) {\n    const sharesACategory = recipient.categories.some((category) => involvedCategories.has(category));\n    const carries = sharesACategory && params.subjectIsAccountHolder;\n    const uncertain = sharesACategory\n      || recipient.categoriesNotDerivable.length > 0\n      || recipient.categoriesAreAFloor\n      || !params.involvedCategoriesComplete;\n    if (!carries && !uncertain) continue;\n    recipients.push({\n      ...recipient,\n      relevance: carries ? SubjectDataRecipientRelevance.CARRIES_SUBJECT_DATA : SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED,\n      obligation: obligationOf(recipient.reach, role),\n    });\n  }\n  return { status: SubjectDataRecipientsStatementStatus.DECLARED, operatorRole: role, recipients };\n}\n\n/**\n * The statement of an application with no recipient declaration. Also the placeholder an orchestrator writes into a\n * report its caller completes (the erasure and export doors fill the real statement, as they fill `externalEffects`).\n */\nexport function notDeclaredSubjectDataRecipientsStatement(): SubjectDataRecipientsStatement {\n  return { status: SubjectDataRecipientsStatementStatus.NOT_DECLARED, operatorRole: null, recipients: [] };\n}\n\n/** The statement of a request whose recipient accounting failed — see {@link SubjectDataRecipientsStatementStatus.UNDETERMINED}. */\nexport function undeterminedSubjectDataRecipientsStatement(): SubjectDataRecipientsStatement {\n  return { status: SubjectDataRecipientsStatementStatus.UNDETERMINED, operatorRole: null, recipients: [] };\n}\n\n/** The effect ref the recipient reconciliation writes for a recipient no registered effect reached. */\nexport function subjectErasureRecipientEffectRef(recipientRef: string): string {\n  return `recipient:${recipientRef}`;\n}\n\n/** The effect ref of the single outcome an erasure carries when its recipients are not declared or could not be determined. */\nexport const SUBJECT_DATA_RECIPIENTS_NOT_DECLARED_EFFECT_REF = 'subject-data-recipients';\n\n/** What an erasure did about one recipient. */\nexport interface SubjectErasureRecipientOutcome {\n  recipientRef: string;\n  legalEntityName: string | null;\n  reach: SubjectDataRecipientReach;\n  relevance: SubjectDataRecipientRelevance;\n  obligation: SubjectDataRecipientObligation;\n  /**\n   * The outcome at this recipient: the covering effects' combined status, or the status the declared stance decides.\n   * `null` for a tenant-account recipient — not the operator's erasure to run, and named for the tenant to notify.\n   */\n  status: SubjectErasureExternalEffectStatus | null;\n  /** The effect refs that reached it — a registered effect, or the reconciliation's `recipient:<ref>`. */\n  effectRefs: string[];\n}\n\n/**\n * Most-incomplete-wins when several effects reach one recipient: a PARTIAL next to a COMPLETED is still partial.\n * Ordered from the state a reader must act on first to the states that close the question.\n */\nconst STATUS_SEVERITY: readonly SubjectErasureExternalEffectStatus[] = [\n  SubjectErasureExternalEffectStatus.PARTIAL,\n  SubjectErasureExternalEffectStatus.FAILED,\n  SubjectErasureExternalEffectStatus.UNMEASURED,\n  SubjectErasureExternalEffectStatus.NOT_REGISTERED,\n  SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE,\n  SubjectErasureExternalEffectStatus.COMPLETED,\n  SubjectErasureExternalEffectStatus.NOTHING_TO_ERASE,\n  SubjectErasureExternalEffectStatus.DECLARED_NO_SUBJECT_DATA,\n];\n\nfunction combinedStatus(statuses: readonly SubjectErasureExternalEffectStatus[]): SubjectErasureExternalEffectStatus {\n  return STATUS_SEVERITY.find((status) => statuses.includes(status)) ?? SubjectErasureExternalEffectStatus.UNMEASURED;\n}\n\n/**\n * Reconcile the recipients an erasure must reach with the effects that ran (#1710).\n *\n * Every operator-account recipient gets a status, so none can pass silently:\n * - a registered effect that names it as its `recipientRef` → that effect's status;\n * - otherwise its stance decides: NO_SUBJECT_DATA → DECLARED_NO_SUBJECT_DATA (complete); an acknowledged\n *   non-erasure → ACKNOWLEDGED_NON_ERASURE; EXTERNAL_ERASURE_OPERATION with no effect registered → NOT_REGISTERED;\n *   no stance → UNMEASURED. Each becomes an `externalEffects` outcome under `recipient:<ref>`, so every existing\n *   reader of the report (`isIncompleteSubjectErasureExternalEffect`, the Wonder Todos request lane) sees it without\n *   learning a new field.\n * - NOT DECLARED adds one UNMEASURED outcome naming the missing projection.\n *\n * It marks and never refuses: the local erasure has already committed when this runs.\n */\nexport function reconcileSubjectErasureRecipients(params: {\n  statement: SubjectDataRecipientsStatement;\n  effectOutcomes: readonly SubjectErasureExternalEffectOutcome[];\n  /** Which recipient each REGISTERED effect reaches — applicable to this subject or not: effect ref → recipient ref. */\n  recipientRefByEffectRef: ReadonlyMap<string, string>;\n}): { recipients: SubjectErasureRecipientOutcome[]; addedEffectOutcomes: SubjectErasureExternalEffectOutcome[] } {\n  const addedEffectOutcomes: SubjectErasureExternalEffectOutcome[] = [];\n  if (params.statement.status !== SubjectDataRecipientsStatementStatus.DECLARED) {\n    addedEffectOutcomes.push({\n      effectRef: SUBJECT_DATA_RECIPIENTS_NOT_DECLARED_EFFECT_REF,\n      status: SubjectErasureExternalEffectStatus.UNMEASURED,\n      detail: params.statement.status === SubjectDataRecipientsStatementStatus.NOT_DECLARED\n        ? 'The application declares no subject-data recipients (compliance.subjectDataRecipients is absent), so which vendors hold this subject\\'s data is unknown. Run `wildo config subject-data-recipients` and redeploy.'\n        : 'Which recipients hold this subject\\'s data could not be determined for this request; reconcile each vendor before treating the erasure as complete.',\n    });\n    return { recipients: [], addedEffectOutcomes };\n  }\n  const recipients = params.statement.recipients.map((recipient): SubjectErasureRecipientOutcome => {\n    const base = {\n      recipientRef: recipient.ref,\n      legalEntityName: recipient.legalEntityName,\n      reach: recipient.reach,\n      relevance: recipient.relevance,\n      obligation: recipient.obligation,\n    };\n    if (recipient.reach === SubjectDataRecipientReach.TENANT_ACCOUNT) return { ...base, status: null, effectRefs: [] };\n    const covering = params.effectOutcomes.filter((outcome) => params.recipientRefByEffectRef.get(outcome.effectRef) === recipient.ref);\n    if (covering.length > 0) {\n      return { ...base, status: combinedStatus(covering.map((outcome) => outcome.status)), effectRefs: covering.map((outcome) => outcome.effectRef) };\n    }\n    const effectRef = subjectErasureRecipientEffectRef(recipient.ref);\n    const registeredForOtherSubjects = [...params.recipientRefByEffectRef.entries()]\n      .filter(([, recipientRef]) => recipientRef === recipient.ref).map(([registeredRef]) => registeredRef);\n    const decided = registeredForOtherSubjects.length > 0\n      // An effect reaches this vendor, but not for this subject's type (the billing effect answers for users). That is\n      // no evidence either way about THIS subject's data there, so it is unmeasured — never \"not registered\", which\n      // would say nobody built the door.\n      ? {\n        effectRef,\n        status: SubjectErasureExternalEffectStatus.UNMEASURED,\n        detail: `${recipient.ref} is reached by the erasure effect(s) ${registeredForOtherSubjects.join(', ')}, which do not apply to this subject's type; whether ${recipient.ref} holds this subject's data is not measured.`,\n      }\n      : uncoveredRecipientOutcome(recipient, effectRef);\n    addedEffectOutcomes.push(decided);\n    return { ...base, status: decided.status, effectRefs: [effectRef] };\n  });\n  return { recipients, addedEffectOutcomes };\n}\n\nfunction uncoveredRecipientOutcome(recipient: SubjectDataRecipientStatementEntry, effectRef: string): SubjectErasureExternalEffectOutcome {\n  switch (recipient.erasureStance) {\n    case HttpApiErasureStance.NO_SUBJECT_DATA:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.DECLARED_NO_SUBJECT_DATA, detail: `${recipient.ref} declares it keeps no subject data beyond the call.` };\n    case HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE, detail: `The operator acknowledged that erasure does not reach ${recipient.ref}; its copy of the subject's data remains until the vendor deletes it.` };\n    case HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.NOT_REGISTERED, detail: `${recipient.ref} declares an erasure operation, but no erasure effect reaching it is registered in this application.` };\n    case null:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.UNMEASURED, detail: `${recipient.ref} declares no erasure stance and no effect reaches it, so whether it still holds the subject's data is unknown.` };\n    default: {\n      const unhandled: never = recipient.erasureStance;\n      throw new Error(`subject data recipients: unhandled erasure stance ${String(unhandled)}`);\n    }\n  }\n}\n/** @wildo_source:part:end saas.models.privacy.subject-data-recipients */\n"]}

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.d.ts

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+/**
+ * # The subject-erasure lane, summarized for an evidence reader
+ *
+ * assurance-control: WILDO.PRIVACY.SUBJECT_ERASURE — the request lane's intake, withdrawal and
+ * execution are answerable without reading any subject's row.
+ *
+ * ## Why this shape, and not the rows
+ *
+ * `evidence-requirement:subject-erasure-execution-record` asks three things of an application that
+ * owns an erasure lane: that a request is recorded on intake carrying WHO raised it, that a pending
+ * request can be withdrawn by its subject, and that it is executed on the declared schedule with an
+ * outcome. Every one of those is a statement about the lane, and none of them needs an identity.
+ *
+ * So the answer is a count, computed where the rows live. Handing an evidence reader the rows in
+ * order to count them would disclose every data subject who has ever asked to be erased — to prove
+ * that erasure works, which is the exact inversion this surface exists to avoid.
+ *
+ * ## Read the zeroes carefully, which is why `laneDeclared` is separate
+ *
+ * A lane with no activity and an application with no lane produce the same zeroes in a row store,
+ * and the requirement's own limits say so. `laneDeclared: false` is therefore a distinct answer
+ * carrying no counts at all — a judge records `not_applicable_as_configured` from it rather than a
+ * nonconformity — while `laneDeclared: true` with zero requests says the lane exists and was quiet.
+ */
+export declare const SubjectErasureLaneEvidenceSchema: z.ZodObject<{
+    laneDeclared: z.ZodBoolean;
+    resourceType: z.ZodNullable<z.ZodString>;
+    window: z.ZodObject<{
+        from: z.ZodISODateTime;
+        to: z.ZodISODateTime;
+    }, z.core.$strip>;
+    raisedBySubject: z.ZodNumber;
+    raisedByController: z.ZodNumber;
+    controllerRaisedWithRequester: z.ZodNumber;
+    controllerRaisedWithJustification: z.ZodNumber;
+    terminal: z.ZodNumber;
+    terminalWithOutcome: z.ZodNumber;
+    notTerminal: z.ZodNumber;
+    withdrawn: z.ZodNullable<z.ZodNumber>;
+    withdrawalOperationIdentifier: z.ZodNullable<z.ZodString>;
+    withdrawalReachableToSubject: z.ZodBoolean;
+    executionOperationIdentifier: z.ZodNullable<z.ZodString>;
+    executionSchedule: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type SubjectErasureLaneEvidence = z.infer<typeof SubjectErasureLaneEvidenceSchema>;
+//# sourceMappingURL=subject-erasure-lane-evidence.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-erasure-lane-evidence.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;iBAuE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.js

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+/**
+ * # The subject-erasure lane, summarized for an evidence reader
+ *
+ * assurance-control: WILDO.PRIVACY.SUBJECT_ERASURE — the request lane's intake, withdrawal and
+ * execution are answerable without reading any subject's row.
+ *
+ * ## Why this shape, and not the rows
+ *
+ * `evidence-requirement:subject-erasure-execution-record` asks three things of an application that
+ * owns an erasure lane: that a request is recorded on intake carrying WHO raised it, that a pending
+ * request can be withdrawn by its subject, and that it is executed on the declared schedule with an
+ * outcome. Every one of those is a statement about the lane, and none of them needs an identity.
+ *
+ * So the answer is a count, computed where the rows live. Handing an evidence reader the rows in
+ * order to count them would disclose every data subject who has ever asked to be erased — to prove
+ * that erasure works, which is the exact inversion this surface exists to avoid.
+ *
+ * ## Read the zeroes carefully, which is why `laneDeclared` is separate
+ *
+ * A lane with no activity and an application with no lane produce the same zeroes in a row store,
+ * and the requirement's own limits say so. `laneDeclared: false` is therefore a distinct answer
+ * carrying no counts at all — a judge records `not_applicable_as_configured` from it rather than a
+ * nonconformity — while `laneDeclared: true` with zero requests says the lane exists and was quiet.
+ */
+export const SubjectErasureLaneEvidenceSchema = z.object({
+    /**
+     * Does any resource in this application declare a `subjectErasureLane`?
+     *
+     * FALSE is an answer, not an absence: an application that never built an erasure lane has failed
+     * no control, and every count below is omitted rather than reported as zero.
+     */
+    laneDeclared: z.boolean(),
+    /** The resource whose rows were counted, present only when a lane is declared. */
+    resourceType: z.string().nullable(),
+    /** The closed window the counts cover, as the caller asked for it. */
+    window: z.object({ from: z.iso.datetime(), to: z.iso.datetime() }),
+    /**
+     * Requests created in the window, split by WHO raised them.
+     *
+     * The split is read through the lane's own declaration — the field it named and the value it
+     * declared as meaning "the subject themselves" — so an application that models the distinction as
+     * a channel enum, a boolean or anything else is counted correctly without this schema asserting
+     * its vocabulary.
+     */
+    raisedBySubject: z.number().int().nonnegative(),
+    raisedByController: z.number().int().nonnegative(),
+    /**
+     * Controller-raised requests that DO carry the requester and the justification the clause asks for.
+     *
+     * Counted, never derived by subtracting from {@link raisedByController}. A difference would assume
+     * containment, and the clause's severity guidance turns exactly that mismatch into an OBSERVATION a
+     * judge is meant to see — so both halves are reported and the comparison is left to the reader.
+     */
+    controllerRaisedWithRequester: z.number().int().nonnegative(),
+    controllerRaisedWithJustification: z.number().int().nonnegative(),
+    /**
+     * Requests carrying the lane's terminal instant, and how many of those also carry an outcome.
+     *
+     * Two measured numbers for the same reason as above: a terminal request whose record of what
+     * happened is empty is the clause's other OBSERVATION case, and it is visible here only because
+     * neither number is derived from the other.
+     */
+    terminal: z.number().int().nonnegative(),
+    terminalWithOutcome: z.number().int().nonnegative(),
+    /**
+     * Requests in the window carrying no terminal instant — still pending, or withdrawn.
+     *
+     * A difference against the counted population rather than a status read, because the statuses are
+     * the application's and this contract must not assert them. {@link withdrawn} is what separates the
+     * two, when the lane declares how.
+     */
+    notTerminal: z.number().int().nonnegative(),
+    /**
+     * Withdrawn requests, and whether the withdrawal door is reachable to a subject at all.
+     *
+     * An EMPTY withdrawal set is explicitly not a deficiency — nobody may have changed their mind — so
+     * the evidence that matters is `withdrawalReachableToSubject`, derived from the declared
+     * withdrawal operation's own variant rather than from whether anyone used it.
+     *
+     * `withdrawn` is NULL, never zero, when the lane declares no `withdrawnMarker`: an application may
+     * not model withdrawal as a value at all, and a zero there would read as "nobody withdrew anything"
+     * when the truth is that nobody can tell.
+     */
+    withdrawn: z.number().int().nonnegative().nullable(),
+    withdrawalOperationIdentifier: z.string().nullable(),
+    withdrawalReachableToSubject: z.boolean(),
+    /**
+     * The schedule that drives execution, read from the declared execution operation.
+     *
+     * The clause asks for execution "on the declared schedule", and an outcome alone cannot be judged
+     * against a schedule nobody stated. `null` means the declared operation carries no cadence, which
+     * is itself the finding.
+     */
+    executionOperationIdentifier: z.string().nullable(),
+    executionSchedule: z.string().nullable(),
+});
+//# sourceMappingURL=subject-erasure-lane-evidence.shared.schemas.js.map

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-erasure-lane-evidence.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,sEAAsE;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD;;;;;;OAMG;IACH,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7D,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjE;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnD;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C;;;;;;;;;;OAUG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpD,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE;IACzC;;;;;;OAMG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * # The subject-erasure lane, summarized for an evidence reader\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_ERASURE — the request lane's intake, withdrawal and\n * execution are answerable without reading any subject's row.\n *\n * ## Why this shape, and not the rows\n *\n * `evidence-requirement:subject-erasure-execution-record` asks three things of an application that\n * owns an erasure lane: that a request is recorded on intake carrying WHO raised it, that a pending\n * request can be withdrawn by its subject, and that it is executed on the declared schedule with an\n * outcome. Every one of those is a statement about the lane, and none of them needs an identity.\n *\n * So the answer is a count, computed where the rows live. Handing an evidence reader the rows in\n * order to count them would disclose every data subject who has ever asked to be erased — to prove\n * that erasure works, which is the exact inversion this surface exists to avoid.\n *\n * ## Read the zeroes carefully, which is why `laneDeclared` is separate\n *\n * A lane with no activity and an application with no lane produce the same zeroes in a row store,\n * and the requirement's own limits say so. `laneDeclared: false` is therefore a distinct answer\n * carrying no counts at all — a judge records `not_applicable_as_configured` from it rather than a\n * nonconformity — while `laneDeclared: true` with zero requests says the lane exists and was quiet.\n */\nexport const SubjectErasureLaneEvidenceSchema = z.object({\n  /**\n   * Does any resource in this application declare a `subjectErasureLane`?\n   *\n   * FALSE is an answer, not an absence: an application that never built an erasure lane has failed\n   * no control, and every count below is omitted rather than reported as zero.\n   */\n  laneDeclared: z.boolean(),\n  /** The resource whose rows were counted, present only when a lane is declared. */\n  resourceType: z.string().nullable(),\n  /** The closed window the counts cover, as the caller asked for it. */\n  window: z.object({ from: z.iso.datetime(), to: z.iso.datetime() }),\n  /**\n   * Requests created in the window, split by WHO raised them.\n   *\n   * The split is read through the lane's own declaration — the field it named and the value it\n   * declared as meaning \"the subject themselves\" — so an application that models the distinction as\n   * a channel enum, a boolean or anything else is counted correctly without this schema asserting\n   * its vocabulary.\n   */\n  raisedBySubject: z.number().int().nonnegative(),\n  raisedByController: z.number().int().nonnegative(),\n  /**\n   * Controller-raised requests that DO carry the requester and the justification the clause asks for.\n   *\n   * Counted, never derived by subtracting from {@link raisedByController}. A difference would assume\n   * containment, and the clause's severity guidance turns exactly that mismatch into an OBSERVATION a\n   * judge is meant to see — so both halves are reported and the comparison is left to the reader.\n   */\n  controllerRaisedWithRequester: z.number().int().nonnegative(),\n  controllerRaisedWithJustification: z.number().int().nonnegative(),\n  /**\n   * Requests carrying the lane's terminal instant, and how many of those also carry an outcome.\n   *\n   * Two measured numbers for the same reason as above: a terminal request whose record of what\n   * happened is empty is the clause's other OBSERVATION case, and it is visible here only because\n   * neither number is derived from the other.\n   */\n  terminal: z.number().int().nonnegative(),\n  terminalWithOutcome: z.number().int().nonnegative(),\n  /**\n   * Requests in the window carrying no terminal instant — still pending, or withdrawn.\n   *\n   * A difference against the counted population rather than a status read, because the statuses are\n   * the application's and this contract must not assert them. {@link withdrawn} is what separates the\n   * two, when the lane declares how.\n   */\n  notTerminal: z.number().int().nonnegative(),\n  /**\n   * Withdrawn requests, and whether the withdrawal door is reachable to a subject at all.\n   *\n   * An EMPTY withdrawal set is explicitly not a deficiency — nobody may have changed their mind — so\n   * the evidence that matters is `withdrawalReachableToSubject`, derived from the declared\n   * withdrawal operation's own variant rather than from whether anyone used it.\n   *\n   * `withdrawn` is NULL, never zero, when the lane declares no `withdrawnMarker`: an application may\n   * not model withdrawal as a value at all, and a zero there would read as \"nobody withdrew anything\"\n   * when the truth is that nobody can tell.\n   */\n  withdrawn: z.number().int().nonnegative().nullable(),\n  withdrawalOperationIdentifier: z.string().nullable(),\n  withdrawalReachableToSubject: z.boolean(),\n  /**\n   * The schedule that drives execution, read from the declared execution operation.\n   *\n   * The clause asks for execution \"on the declared schedule\", and an outcome alone cannot be judged\n   * against a schedule nobody stated. `null` means the declared operation carries no cadence, which\n   * is itself the finding.\n   */\n  executionOperationIdentifier: z.string().nullable(),\n  executionSchedule: z.string().nullable(),\n});\n\nexport type SubjectErasureLaneEvidence = z.infer<typeof SubjectErasureLaneEvidenceSchema>;\n"]}