@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/compliance/privacy/retention-binding.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention-binding.shared.utils.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-binding.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAGnF,OAAO,EACL,+BAA+B,EAC/B,mBAAmB,GAGpB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAC3D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAiC;IAC9E,QAAQ,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3B,KAAK,mBAAmB,CAAC,OAAO,CAAC;QACjC,KAAK,mBAAmB,CAAC,oBAAoB;YAC3C,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB,CAAC,aAAa;YACpC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,OAAO,CAAC,gBAAgB,CAAC;IACpC,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,OAAa;IACnC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,OAAa;IACjC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAkBD,MAAM,UAAU,2BAA2B,CACzC,OAAiC,EACjC,aAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,mBAAmB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,oBAAoB,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,UAAU,KAAK,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;QACpE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,mBAAmB,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B,EAAE,SAAiB;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAwB,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA4B,EAC5B,OAAiC;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,OAAO,CAAC,UAAU,KAAK,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA4B,EAC5B,OAAiC,EACjC,QAAkD;IAElD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,GAAG,oBAAoB,CAAC,CAAC;AACrF,CAAC;AAuBD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAwB;IAC5D,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,iBAAiB,CAAC,UAAmB,CAAiC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,SAAS;QACnD,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAmF;IACnH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAA6C;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,UAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7H,IAAI,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACpI,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC","sourcesContent":["import { getTtlParams, getZodObjectShape, hasTtl } from '@wildo-ai/zod-decorators';\nimport type { z } from 'zod';\n\nimport {\n  RETENTION_STARTED_AT_FIELD_NAME,\n  RetentionStartPoint,\n  type ApplicationRetentionSchedule,\n  type ResourceRetentionBinding,\n} from './retention-schedule.shared.schemas';\n\n/**\n * # Retention binding derivations — one authority for \"when does a bound row expire\"\n *\n * Every consumer of a retention binding asks one of four questions, and each is answered here once:\n *\n * | question | function | consumers |\n * |---|---|---|\n * | which field carries the start instant? | {@link resolveRetentionStartFieldName} | the sweep's query, the factory's field checks |\n * | which rows are past their period now? | {@link resolveBoundRetentionCutoff} | the sweep, the startup past-expiry report |\n * | when did THIS row's clock start / when does it end? | {@link resolveRetentionStartedAt} / {@link resolveRetentionExpiresAt} | subject erasure's `retainedUntil` (#1635), deletion evidence (#1636) |\n * | which resources hold data nobody bound? | {@link unboundRetentionResources} | compliance documents, the startup report |\n *\n * Pure and adapter-neutral: the cutoff is a single `field < instant` comparison, which MongoDB and both\n * PostgreSQL filter compilers evaluate identically — and a NULL start instant matches neither, which is\n * exactly \"a row whose start point has not occurred never expires\" (#1613 invariant 2), by construction\n * rather than by a guard somebody could forget.\n */\n\nconst MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** The infrastructure-owned creation instant both adapters maintain. */\nexport const RETENTION_CREATED_AT_FIELD_NAME = 'createdAt';\n/** The infrastructure-owned last-update instant both adapters maintain. */\nexport const RETENTION_UPDATED_AT_FIELD_NAME = 'updatedAt';\n\n/**\n * The field whose value is a bound row's retention start instant (or, for\n * {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}, the instant the start is derived from).\n *\n * Throws for a {@link RetentionStartPoint.CLOSURE_EVENT} binding with no `closureFieldName`: the factory\n * refuses that configuration, so reaching it here means a binding bypassed the factory, and guessing a\n * field would delete rows by the wrong clock.\n */\nexport function resolveRetentionStartFieldName(binding: ResourceRetentionBinding): string {\n  switch (binding.startPoint) {\n    case RetentionStartPoint.CREATED:\n    case RetentionStartPoint.END_OF_CALENDAR_YEAR:\n      return RETENTION_CREATED_AT_FIELD_NAME;\n    case RetentionStartPoint.LAST_UPDATED:\n      return RETENTION_UPDATED_AT_FIELD_NAME;\n    case RetentionStartPoint.SCOPE_DELETED:\n      return RETENTION_STARTED_AT_FIELD_NAME;\n    case RetentionStartPoint.CLOSURE_EVENT:\n      if (!binding.closureFieldName) {\n        throw new Error('A CLOSURE_EVENT retention binding must name its closureFieldName.');\n      }\n      return binding.closureFieldName;\n  }\n}\n\n/** The instant 00:00:00.000 UTC on 1 January of `instant`'s UTC year. */\nfunction startOfUtcYear(instant: Date): Date {\n  return new Date(Date.UTC(instant.getUTCFullYear(), 0, 1));\n}\n\n/** The last millisecond of `instant`'s UTC year: 31 December 23:59:59.999 UTC. */\nfunction endOfUtcYear(instant: Date): Date {\n  return new Date(Date.UTC(instant.getUTCFullYear() + 1, 0, 1) - 1);\n}\n\n/**\n * The rows a bound resource must delete at `now`: those whose {@link BoundRetentionCutoff.fieldName} is\n * STRICTLY before {@link BoundRetentionCutoff.before}.\n *\n * A row is deleted only AFTER `start + retentionDays`, never at it: a row whose start is exactly\n * `now − retentionDays` has reached the end of its period and not passed it, so it survives this run.\n *\n * For {@link RetentionStartPoint.END_OF_CALENDAR_YEAR} the comparison is still on `createdAt`, rewritten\n * so no per-row arithmetic is needed: `endOfYear(createdAt) + days < now` holds exactly when `createdAt`\n * falls in a year BEFORE the year of `now − days`, i.e. `createdAt < 1 January (UTC) of year(now − days)`.\n */\nexport interface BoundRetentionCutoff {\n  readonly fieldName: string;\n  readonly before: Date;\n}\n\nexport function resolveBoundRetentionCutoff(\n  binding: ResourceRetentionBinding,\n  retentionDays: number,\n  now: Date,\n): BoundRetentionCutoff {\n  const fieldName = resolveRetentionStartFieldName(binding);\n  const periodStartedBefore = new Date(now.getTime() - retentionDays * MILLISECONDS_PER_DAY);\n  if (binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR) {\n    return { fieldName, before: startOfUtcYear(periodStartedBefore) };\n  }\n  return { fieldName, before: periodStartedBefore };\n}\n\nfunction readInstant(row: Record<string, unknown>, fieldName: string): Date | undefined {\n  const value = row[fieldName];\n  if (value === null || value === undefined) return undefined;\n  const instant = value instanceof Date ? value : new Date(value as string | number);\n  return Number.isNaN(instant.getTime()) ? undefined : instant;\n}\n\n/**\n * When `row`'s retention clock started, or `undefined` while its start point has not occurred (an open\n * CLOSURE_EVENT row, a SCOPE_DELETED row whose organization still exists).\n */\nexport function resolveRetentionStartedAt(\n  row: Record<string, unknown>,\n  binding: ResourceRetentionBinding,\n): Date | undefined {\n  const instant = readInstant(row, resolveRetentionStartFieldName(binding));\n  if (!instant) return undefined;\n  return binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR ? endOfUtcYear(instant) : instant;\n}\n\n/**\n * The instant after which `row` is deleted under the CURRENT schedule, or `undefined` when its start\n * point has not occurred or its class declares no period (undeclared is \"not decided\", never \"now\").\n */\nexport function resolveRetentionExpiresAt(\n  row: Record<string, unknown>,\n  binding: ResourceRetentionBinding,\n  schedule: ApplicationRetentionSchedule | undefined,\n): Date | undefined {\n  const period = schedule?.[binding.retentionClass];\n  const startedAt = resolveRetentionStartedAt(row, binding);\n  if (!period || !startedAt) return undefined;\n  return new Date(startedAt.getTime() + period.retentionDays * MILLISECONDS_PER_DAY);\n}\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// Row TTL — the OTHER retention authority, kept for framework plumbing that holds no business data\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n\n/**\n * A declared `.ttl()` ROW-EXPIRY policy: rows expire `expireAfterSeconds` after `fieldName`'s value.\n *\n * `expireAfterSeconds: 0` means the field IS the absolute expiry instant (`jobPayloadStorage.expiresAt`);\n * a positive value is a window measured from the field (`jobExecutions.createdAt`). These are MongoDB's\n * `expireAfterSeconds` semantics verbatim, so one declaration cannot mean two things per adapter.\n *\n * Distinct from a {@link ResourceRetentionBinding} on purpose: `.ttl()` is a fixed number of seconds on a\n * field, for framework plumbing that holds no business or personal data, and MongoDB honours it NATIVELY\n * with no application code running. A resource holding such data binds a class instead, and a resource\n * may not declare both (one row, one retention authority).\n */\nexport interface RowTtlPolicy {\n  readonly fieldName: string;\n  readonly expireAfterSeconds: number;\n}\n\n/**\n * Every `.ttl()` declaration on a resource's main schema — ONE authority, read by the SQL planner, the\n * `.ttl()` sweep, the startup refusals and the resource factory.\n *\n * Tolerates a non-object schema (it declares no fields, so no TTL): this is called while enumerating\n * EVERY registered resource, and one exotic schema must not take the enumeration down.\n */\nexport function collectRowTtlPolicies(mainSchema: z.ZodTypeAny): RowTtlPolicy[] {\n  let shape: Record<string, z.ZodTypeAny> | undefined;\n  try {\n    shape = getZodObjectShape(mainSchema as never) as Record<string, z.ZodTypeAny>;\n  } catch {\n    return [];\n  }\n  if (!shape) return [];\n  const policies: RowTtlPolicy[] = [];\n  for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n    if (!fieldSchema || !hasTtl(fieldSchema)) continue;\n    const params = getTtlParams(fieldSchema);\n    if (!params) continue;\n    policies.push({ fieldName, expireAfterSeconds: params.expireAfterSeconds });\n  }\n  return policies;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// The gap report\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n\n/** The part of a resource configuration the gap report reads. Structural, so it takes a registry's configs as-is. */\nexport interface RetentionBindingGapInput {\n  readonly resourceIdentifier: string;\n  readonly retentionBinding?: ResourceRetentionBinding;\n  readonly mainSchema?: unknown;\n}\n\n/**\n * THE rule for \"kept until erased\": a resource no retention mechanism ever deletes has no class binding\n * and no `.ttl()`. One predicate, so the startup report (which reads schemas) and the RETENTION_RULES\n * document fact (which receives `declaresRowTtl` across a JSON boundary) cannot disagree about who is in\n * the list.\n */\nexport function isKeptUntilErased(resource: { readonly retentionBinding?: unknown; readonly declaresRowTtl: boolean }): boolean {\n  return !resource.retentionBinding && !resource.declaresRowTtl;\n}\n\n/**\n * The resources whose rows no retention mechanism ever deletes: no class binding and no `.ttl()`.\n *\n * Kept until erased. That is today's behaviour for every unbound resource and is not wrong in itself —\n * it is UNDECIDED, and this report is what keeps it visible next to `undeclaredRetentionClasses`, in the\n * compliance documents and in the startup log. Rejected: defaulting every unbound resource to\n * `RESOURCE_DATA`. That would silently delete data nobody decided about.\n *\n * Sorted, so two runs over the same registry produce the same list.\n */\nexport function unboundRetentionResources(resources: Iterable<RetentionBindingGapInput>): readonly string[] {\n  const unbound: string[] = [];\n  for (const resource of resources) {\n    const declaresRowTtl = Boolean(resource.mainSchema) && collectRowTtlPolicies(resource.mainSchema as z.ZodTypeAny).length > 0;\n    if (isKeptUntilErased({ retentionBinding: resource.retentionBinding, declaresRowTtl })) unbound.push(resource.resourceIdentifier);\n  }\n  return unbound.sort();\n}\n"]}

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Retention-enforcement records: resource configuration (#1636).
+ *
+ * ONE writer and two readers:
+ * - the writer is the retention-class sweep, through the repository (`CREATE` is `REPOSITORY_ONLY`, so no
+ *   route creates a record). It uses the repository rather than the trusted-system-write primitive on
+ *   purpose, for the provider-call-records reason: `createAsSystem` emits a `SYSTEM_CONTEXT_WRITE` audit row
+ *   per call, and the run already emits ONE `RETENTION_ENFORCEMENT_RECORDED` event carrying its totals.
+ * - the application administration console reads them (`READ`/`LIST` are `API_CALL`) — the operator's view
+ *   of whether each declared period is being enforced;
+ * - the retention-enforcement evidence door reads a window of them for an assurance collector.
+ *
+ * APPEND-ONLY: there is no UPDATE. A run happened; a later run is a new row. `DELETE_MANY` exists only for
+ * the retention-class sweep itself, which deletes records past the application's declared `AUDIT_LOGS`
+ * period, and it is `INTERNAL_CALL`, so enforcing retention on the evidence creates no public deletion route.
+ */
+import { z } from 'zod';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../../resources/resources.shared.schemas';
+import { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';
+import { RetentionEnforcementOutcome } from './retention-enforcement-records.shared.schemas';
+export declare const retentionEnforcementRecordsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.DELETE_MANY | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    applicationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    runRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    sweptAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+    retentionClass: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DataRetentionClass>>>>;
+    resourceType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    startPoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionStartPoint>>;
+    retentionDaysApplied: z.ZodOptional<z.ZodNumber>;
+    cutoff: z.ZodOptional<z.ZodDate>;
+    deletedCount: z.ZodNumber;
+    oldestDeletedStartedAt: z.ZodOptional<z.ZodDate>;
+    newestDeletedStartedAt: z.ZodOptional<z.ZodDate>;
+    heldSkippedCount: z.ZodOptional<z.ZodNumber>;
+    statutoryRestrictedCount: z.ZodOptional<z.ZodNumber>;
+    reachedRunCeiling: z.ZodBoolean;
+    outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionEnforcementOutcome>>>>;
+    failureStage: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./retention-enforcement-records.shared.schemas").RetentionClassSweepFailureStage>>>;
+    skipReason: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./retention-enforcement-records.shared.schemas").RetentionClassSweepSkipReason>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
+}, z.core.$strip>>;
+//# sourceMappingURL=retention-enforcement-records.shared.resources-config.schemas.d.ts.map

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention-enforcement-records.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAG1I,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAoC,MAAM,gDAAgD,CAAC;AAE/H,eAAO,MAAM,sEAAsE,GACjF,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;kBAsF9C,CAAC"}

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.js

@@ -0,0 +1,106 @@
+/**
+ * Retention-enforcement records: resource configuration (#1636).
+ *
+ * ONE writer and two readers:
+ * - the writer is the retention-class sweep, through the repository (`CREATE` is `REPOSITORY_ONLY`, so no
+ *   route creates a record). It uses the repository rather than the trusted-system-write primitive on
+ *   purpose, for the provider-call-records reason: `createAsSystem` emits a `SYSTEM_CONTEXT_WRITE` audit row
+ *   per call, and the run already emits ONE `RETENTION_ENFORCEMENT_RECORDED` event carrying its totals.
+ * - the application administration console reads them (`READ`/`LIST` are `API_CALL`) — the operator's view
+ *   of whether each declared period is being enforced;
+ * - the retention-enforcement evidence door reads a window of them for an assurance collector.
+ *
+ * APPEND-ONLY: there is no UPDATE. A run happened; a later run is a new row. `DELETE_MANY` exists only for
+ * the retention-class sweep itself, which deletes records past the application's declared `AUDIT_LOGS`
+ * period, and it is `INTERNAL_CALL`, so enforcing retention on the evidence creates no public deletion route.
+ */
+import { z } from 'zod';
+import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
+import { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas.js';
+import { APPLICATION_AUDIT_LOG_READ_ROLES } from '../audit-trails/application-audit-logs.shared.resources-config.schemas.js';
+import { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas.js';
+import { RetentionEnforcementOutcome, RetentionEnforcementRecordSchema } from './retention-enforcement-records.shared.schemas.js';
+export const retentionEnforcementRecordsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: RetentionEnforcementRecordSchema,
+    resourceIdentifier: CoreResourceType.RETENTION_ENFORCEMENT_RECORDS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.RETENTION_ENFORCEMENT_RECORDS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /*
+     * Subject-export: FORBIDDEN, and deliberately NO `retentionPolicy`. A record holds counts and instants about
+     * a resource TYPE and names no person and no row (see the schema header), so it is not data about a subject
+     * and no erasure visits it. FORBIDDEN rather than undeclared so the decision is visible, the
+     * provider-call-records precedent. If a field ever named a row or a person, this exemption is wrong and must
+     * be revisited in the same change.
+     */
+    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },
+    /*
+     * Kept for the application's declared AUDIT_LOGS period, counted from the record's creation. This is the
+     * operator's defence evidence that retention was enforced, so it must outlive the data it describes: the
+     * AUDIT_LOGS period is the one the audit trail itself is kept for. The sweep that writes these rows is also
+     * what deletes them once that period ends, through the same service-layer path as every bound resource.
+     */
+    retentionBinding: {
+        retentionClass: DataRetentionClass.AUDIT_LOGS,
+        startPoint: RetentionStartPoint.CREATED,
+    },
+    coreOperations: [
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.DELETE_MANY,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        // The audit door's audience (`APPLICATION_AUDIT_LOG_READ_ROLES`): the operator who acts on a failing
+        // sweep, and an evidence reader who must read and must not act. No tenant's rows are behind this door —
+        // a record names a resource type, never an organization — so no cross-tenant admission is declared.
+        [CoreResourceOperation.READ]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    filterFields: {
+                        retentionClass: z.enum(DataRetentionClass),
+                        resourceType: z.string(),
+                        outcome: z.enum(RetentionEnforcementOutcome),
+                        runRef: z.string(),
+                        sweptAt: z.date(),
+                    },
+                    /** `_id` last, as the keyset tie-breaker: one run writes many rows with the same `sweptAt`. */
+                    sortFields: ['sweptAt', 'retentionClass', 'resourceType', 'outcome', '_id'],
+                    maxPaginatedResultPerPageLimit: 100,
+                }],
+        },
+        // The retention-class sweep deletes expired pages through the SERVICE layer, which resolves only
+        // INTERNAL_CALL (not REPOSITORY_ONLY) — and INTERNAL_CALL is route-less too.
+        [CoreResourceOperation.DELETE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+    },
+});
+//# sourceMappingURL=retention-enforcement-records.shared.resources-config.schemas.js.map

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention-enforcement-records.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,MAAM,gDAAgD,CAAC;AAE/H,MAAM,CAAC,MAAM,sEAAsE,GAAG,CACpF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,gCAAgC;IAC5C,kBAAkB,EAAE,gBAAgB,CAAC,6BAA6B;IAClE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,6BAA6B,CAAC;IAC3G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;OAMG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE;;;;;OAKG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,OAAO;KACxC;IAED,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,qGAAqG;QACrG,wGAAwG;QACxG,oGAAoG;QACpG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,GAAG,gCAAgC,CAAC;oBAC5C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,GAAG,gCAAgC,CAAC;oBAC5C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE;wBACZ,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;wBACxB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;wBAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;qBAClB;oBACD,+FAA+F;oBAC/F,UAAU,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,CAAU;oBACpF,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;QACD,iGAAiG;QACjG,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Retention-enforcement records: resource configuration (#1636).\n *\n * ONE writer and two readers:\n * - the writer is the retention-class sweep, through the repository (`CREATE` is `REPOSITORY_ONLY`, so no\n *   route creates a record). It uses the repository rather than the trusted-system-write primitive on\n *   purpose, for the provider-call-records reason: `createAsSystem` emits a `SYSTEM_CONTEXT_WRITE` audit row\n *   per call, and the run already emits ONE `RETENTION_ENFORCEMENT_RECORDED` event carrying its totals.\n * - the application administration console reads them (`READ`/`LIST` are `API_CALL`) — the operator's view\n *   of whether each declared period is being enforced;\n * - the retention-enforcement evidence door reads a window of them for an assurance collector.\n *\n * APPEND-ONLY: there is no UPDATE. A run happened; a later run is a new row. `DELETE_MANY` exists only for\n * the retention-class sweep itself, which deletes records past the application's declared `AUDIT_LOGS`\n * period, and it is `INTERNAL_CALL`, so enforcing retention on the evidence creates no public deletion route.\n */\nimport { z } from 'zod';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { APPLICATION_AUDIT_LOG_READ_ROLES } from '../audit-trails/application-audit-logs.shared.resources-config.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\nimport { RetentionEnforcementOutcome, RetentionEnforcementRecordSchema } from './retention-enforcement-records.shared.schemas';\n\nexport const retentionEnforcementRecordsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.DELETE_MANY,\n  typeof RetentionEnforcementRecordSchema\n>({\n  mainSchema: RetentionEnforcementRecordSchema,\n  resourceIdentifier: CoreResourceType.RETENTION_ENFORCEMENT_RECORDS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.RETENTION_ENFORCEMENT_RECORDS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /*\n   * Subject-export: FORBIDDEN, and deliberately NO `retentionPolicy`. A record holds counts and instants about\n   * a resource TYPE and names no person and no row (see the schema header), so it is not data about a subject\n   * and no erasure visits it. FORBIDDEN rather than undeclared so the decision is visible, the\n   * provider-call-records precedent. If a field ever named a row or a person, this exemption is wrong and must\n   * be revisited in the same change.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n  /*\n   * Kept for the application's declared AUDIT_LOGS period, counted from the record's creation. This is the\n   * operator's defence evidence that retention was enforced, so it must outlive the data it describes: the\n   * AUDIT_LOGS period is the one the audit trail itself is kept for. The sweep that writes these rows is also\n   * what deletes them once that period ends, through the same service-layer path as every bound resource.\n   */\n  retentionBinding: {\n    retentionClass: DataRetentionClass.AUDIT_LOGS,\n    startPoint: RetentionStartPoint.CREATED,\n  },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.DELETE_MANY,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n      }],\n    },\n    // The audit door's audience (`APPLICATION_AUDIT_LOG_READ_ROLES`): the operator who acts on a failing\n    // sweep, and an evidence reader who must read and must not act. No tenant's rows are behind this door —\n    // a record names a resource type, never an organization — so no cross-tenant admission is declared.\n    [CoreResourceOperation.READ]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n      }],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        filterFields: {\n          retentionClass: z.enum(DataRetentionClass),\n          resourceType: z.string(),\n          outcome: z.enum(RetentionEnforcementOutcome),\n          runRef: z.string(),\n          sweptAt: z.date(),\n        },\n        /** `_id` last, as the keyset tie-breaker: one run writes many rows with the same `sweptAt`. */\n        sortFields: ['sweptAt', 'retentionClass', 'resourceType', 'outcome', '_id'] as const,\n        maxPaginatedResultPerPageLimit: 100,\n      }],\n    },\n    // The retention-class sweep deletes expired pages through the SERVICE layer, which resolves only\n    // INTERNAL_CALL (not REPOSITORY_ONLY) — and INTERNAL_CALL is route-less too.\n    [CoreResourceOperation.DELETE_MANY]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.HIGH,\n      }],\n    },\n  },\n});\n"]}

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.schemas.d.ts

@@ -0,0 +1,209 @@
+/**
+ * One row per (retention-class sweep run × class-bound resource): what the run deleted for that resource,
+ * under which declared period, what it held back, and how it ended (#1636).
+ *
+ * ## Why a store, when the sweep already returns its outcome
+ *
+ * GDPR Art. 5(1)(e) (storage limitation) is a principle the operator must be able to DEMONSTRATE
+ * (Art. 5(2), accountability). The sweep's run output is transient: a successful run's result is kept only
+ * as long as the job execution that carried it, and a failed run survives only as an invocation status. So
+ * after #1613 the engine deleted by period and nothing durable said that it had. This row is that record,
+ * and it is the first producer of `AssuranceDocumentFactAuthorityKind.RUNTIME_EVIDENCE`: a privacy notice
+ * says a class's retention is ENFORCED only when these rows show it.
+ *
+ * ## Counts and instants only, by construction
+ *
+ * The evidence must outlive the rows it describes WITHOUT re-creating them. So no field names a deleted
+ * row, and none carries a field value: {@link projectRetentionEnforcementRecord} is the only producer and
+ * copies a closed list of counts, instants and vocabulary members. A row id or a value added here would
+ * turn deletion evidence into a copy of what was deleted — the key set is pinned by a test for that reason.
+ *
+ * ## Every run, including a failed one
+ *
+ * The sweep writes one row per bound resource per run in a `finally`, so a run that fails still leaves a
+ * `FAILED` row: a failed run is evidence too, and an operator whose sweep stopped working must be able to
+ * see WHEN it stopped. A resource the sweep skipped leaves a `SKIPPED` row naming why, because a skip that
+ * leaves nothing is indistinguishable from a sweep that never ran.
+ *
+ * ## Retention of the evidence itself
+ *
+ * Bound to `AUDIT_LOGS` from `CREATED` (see the resource configuration): this is the operator's defence
+ * evidence, so it is kept as long as the audit trail and outlives the data it describes.
+ *
+ * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — records evidence that declared retention was enforced.
+ */
+import { z } from 'zod';
+import { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';
+/** @wildo_source:part:start saas.models.privacy.retention-enforcement-record facet:layer:shared facet:audience:app-developer */
+/**
+ * How one sweep run ended for one class-bound resource. The three non-skip members are the three outcomes
+ * the sweep distinguishes; `SKIPPED` is a resource the sweep deliberately did not work on this run.
+ */
+export declare enum RetentionEnforcementOutcome {
+    /** Every row past its period that the sweep listed was deleted; nothing was left for the next run. */
+    COMPLETED = "COMPLETED",
+    /**
+     * The run stopped at its per-run ceiling with expired rows still waiting, which the next run resumes.
+     * Normal operation after a period is shortened or a backlog builds up, and NOT a failure: the period is
+     * being enforced, bounded per run so a mistake cannot become one unbounded delete.
+     */
+    DEFERRED_BY_CEILING = "DEFERRED_BY_CEILING",
+    /** Listing or deleting failed, or the delete removed nothing. Retention was NOT enforced for this resource this run. */
+    FAILED = "FAILED",
+    /** The sweep did not work on this resource this run; `skipReason` says why. Neither enforcement nor failure. */
+    SKIPPED = "SKIPPED"
+}
+/** Which step of a resource's sweep failed. Named so the log, the thrown message and the record say the same thing. */
+export declare enum RetentionClassSweepFailureStage {
+    /** Listing expired rows failed, so nothing more was deleted for that resource this run. */
+    READ = "read",
+    /** A service-layer delete failed; earlier rows of the same resource may already be deleted. */
+    DELETE = "delete",
+    /** The same rows were listed again after being deleted — the delete removed nothing, so the sweep stopped rather than loop. */
+    NO_PROGRESS = "no-progress",
+    /**
+     * The active legal holds could not be read (#1634), so whether the listed rows are held is unknown. The
+     * sweep deletes nothing more for that resource this run — a read error never means "not held".
+     */
+    LEGAL_HOLD_UNVERIFIABLE = "legal-hold-unverifiable",
+    /**
+     * The resource's sweep THREW instead of returning an outcome (every expected failure is caught and reported as
+     * one of the stages above). Deletions it made before throwing are not counted, so read `deletedCount: 0` on
+     * this stage as "unknown", not as "none".
+     */
+    UNEXPECTED = "unexpected"
+}
+/**
+ * Why a bound resource was not swept at all this run. A skip is REPORTED, never silent: a sweep that
+ * quietly skips a resource is indistinguishable from one that found nothing expired.
+ */
+export declare enum RetentionClassSweepSkipReason {
+    /** The bound class has no declared period. Undecided is never "delete now" — the gap is reported instead. */
+    CLASS_UNDECLARED = "class-undeclared",
+    /** A SCOPE_DELETED binding whose rows die in the tenant purge cascade: the purge enforces it. */
+    ENFORCED_BY_TENANT_PURGE = "enforced-by-tenant-purge"
+}
+export declare const RetentionEnforcementRecordSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    applicationId: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    runRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    sweptAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+    retentionClass: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DataRetentionClass>>>>;
+    resourceType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    startPoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionStartPoint>>;
+    retentionDaysApplied: z.ZodOptional<z.ZodNumber>;
+    cutoff: z.ZodOptional<z.ZodDate>;
+    deletedCount: z.ZodNumber;
+    oldestDeletedStartedAt: z.ZodOptional<z.ZodDate>;
+    newestDeletedStartedAt: z.ZodOptional<z.ZodDate>;
+    heldSkippedCount: z.ZodOptional<z.ZodNumber>;
+    statutoryRestrictedCount: z.ZodOptional<z.ZodNumber>;
+    reachedRunCeiling: z.ZodBoolean;
+    outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionEnforcementOutcome>>>>;
+    failureStage: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionClassSweepFailureStage>>>;
+    skipReason: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionClassSweepSkipReason>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
+}, z.core.$strip>;
+export type RetentionEnforcementRecord = z.infer<typeof RetentionEnforcementRecordSchema>;
+/** @wildo_source:part:end saas.models.privacy.retention-enforcement-record */
+/**
+ * How often the retention-class sweep runs: hourly (`RETENTION_CLASS_SWEEP_CRON`, `15 * * * *`, in the backend's
+ * batch manifests). A COPY, because the manifest lives in the backend and the reader deciding whether a record
+ * is recent — the document-fact derivation — cannot import it; a backend test pins the two together.
+ */
+export declare const RETENTION_CLASS_SWEEP_INTERVAL_MS: number;
+/** What the sweep knows about one bound resource at the end of a run — the input {@link projectRetentionEnforcementRecord} reads. */
+export interface RetentionEnforcementRecordSource {
+    readonly resourceType: string;
+    readonly retentionClass: DataRetentionClass;
+    readonly startPoint: RetentionStartPoint;
+    readonly retentionDaysApplied?: number;
+    readonly cutoff?: Date;
+    readonly deletedCount: number;
+    readonly oldestDeletedStartedAt?: Date;
+    readonly newestDeletedStartedAt?: Date;
+    readonly heldSkippedCount?: number;
+    readonly statutoryRestrictedCount?: number;
+    readonly reachedRunCeiling: boolean;
+    readonly failureStage?: RetentionClassSweepFailureStage;
+    readonly skipReason?: RetentionClassSweepSkipReason;
+}
+/**
+ * The outcome a resource's run ended in. ONE rule, so the record, the audit event and the log cannot
+ * disagree about whether a run failed: a failure stage wins over everything, then a skip, then the ceiling.
+ */
+export declare function retentionEnforcementOutcomeOf(source: Pick<RetentionEnforcementRecordSource, 'failureStage' | 'skipReason' | 'reachedRunCeiling'>): RetentionEnforcementOutcome;
+/**
+ * The ONLY way a retention-enforcement record is built: a closed projection of one resource's sweep outcome.
+ *
+ * Closed on purpose. It names every field it copies, so a row id or a field value added to the sweep's
+ * outcome later cannot reach the table by accident (see the file header).
+ */
+export declare function projectRetentionEnforcementRecord(source: RetentionEnforcementRecordSource, run: {
+    readonly applicationId?: string;
+    readonly runRef: string;
+    readonly sweptAt: Date;
+}): Omit<RetentionEnforcementRecord, '_id' | 'createdAt'>;
+/**
+ * # Retention enforcement, answered to an evidence reader
+ *
+ * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — whether each declared period was enforced is
+ * answerable for any window.
+ *
+ * What `GET /assurance/retention-enforcement-evidence` returns: the enforcement records whose run fell in a
+ * closed window. The records ARE counts and instants (see the file header), so handing them over names no
+ * person and no deleted row; the door drops only the storage ids.
+ */
+export declare const RetentionEnforcementEvidenceRecordSchema: z.ZodObject<{
+    resourceType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionEnforcementOutcome>>>>;
+    retentionClass: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DataRetentionClass>>>>;
+    startPoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionStartPoint>>;
+    deletedCount: z.ZodNumber;
+    runRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    sweptAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+    retentionDaysApplied: z.ZodOptional<z.ZodNumber>;
+    cutoff: z.ZodOptional<z.ZodDate>;
+    oldestDeletedStartedAt: z.ZodOptional<z.ZodDate>;
+    newestDeletedStartedAt: z.ZodOptional<z.ZodDate>;
+    heldSkippedCount: z.ZodOptional<z.ZodNumber>;
+    statutoryRestrictedCount: z.ZodOptional<z.ZodNumber>;
+    reachedRunCeiling: z.ZodBoolean;
+    failureStage: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionClassSweepFailureStage>>>;
+    skipReason: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionClassSweepSkipReason>>>;
+}, z.core.$strip>;
+export type RetentionEnforcementEvidenceRecord = z.infer<typeof RetentionEnforcementEvidenceRecordSchema>;
+export declare const RetentionEnforcementEvidenceSchema: z.ZodObject<{
+    window: z.ZodObject<{
+        from: z.ZodString;
+        to: z.ZodString;
+    }, z.core.$strip>;
+    records: z.ZodArray<z.ZodObject<{
+        resourceType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+        outcome: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionEnforcementOutcome>>>>;
+        retentionClass: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DataRetentionClass>>>>;
+        startPoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionStartPoint>>;
+        deletedCount: z.ZodNumber;
+        runRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+        sweptAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>;
+        retentionDaysApplied: z.ZodOptional<z.ZodNumber>;
+        cutoff: z.ZodOptional<z.ZodDate>;
+        oldestDeletedStartedAt: z.ZodOptional<z.ZodDate>;
+        newestDeletedStartedAt: z.ZodOptional<z.ZodDate>;
+        heldSkippedCount: z.ZodOptional<z.ZodNumber>;
+        statutoryRestrictedCount: z.ZodOptional<z.ZodNumber>;
+        reachedRunCeiling: z.ZodBoolean;
+        failureStage: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionClassSweepFailureStage>>>;
+        skipReason: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof RetentionClassSweepSkipReason>>>;
+    }, z.core.$strip>>;
+    runCount: z.ZodNumber;
+}, z.core.$strip>;
+export type RetentionEnforcementEvidence = z.infer<typeof RetentionEnforcementEvidenceSchema>;
+/**
+ * Read an evidence answer that crossed a JSON boundary — the door's response, or the copy the assurance
+ * collector committed — back into {@link RetentionEnforcementEvidence}. ONE place revives the instants, which
+ * JSON carries as strings, so every reader of a committed answer reads it alike. `undefined` when the value is
+ * not an evidence answer: a reader treats that as "no evidence", never as "nothing enforced".
+ */
+export declare function parseRetentionEnforcementEvidenceJson(value: unknown): RetentionEnforcementEvidence | undefined;
+//# sourceMappingURL=retention-enforcement-records.shared.schemas.d.ts.map

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention-enforcement-records.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-enforcement-records.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE9F,gIAAgI;AAChI;;;GAGG;AACH,oBAAY,2BAA2B;IACrC,sGAAsG;IACtG,SAAS,cAAc;IACvB;;;;OAIG;IACH,mBAAmB,wBAAwB;IAC3C,wHAAwH;IACxH,MAAM,WAAW;IACjB,gHAAgH;IAChH,OAAO,YAAY;CACpB;AAED,uHAAuH;AACvH,oBAAY,+BAA+B;IACzC,2FAA2F;IAC3F,IAAI,SAAS;IACb,+FAA+F;IAC/F,MAAM,WAAW;IACjB,+HAA+H;IAC/H,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,uBAAuB,4BAA4B;IACnD;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;GAGG;AACH,oBAAY,6BAA6B;IACvC,6GAA6G;IAC7G,gBAAgB,qBAAqB;IACrC,iGAAiG;IACjG,wBAAwB,6BAA6B;CACtD;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;iBAuD3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,8EAA8E;AAE9E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,QAAiB,CAAC;AAEhE,qIAAqI;AACrI,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,+BAA+B,CAAC;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,6BAA6B,CAAC;CACrD;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,gCAAgC,EAAE,cAAc,GAAG,YAAY,GAAG,mBAAmB,CAAC,GAAG,2BAA2B,CAK9K;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,gCAAgC,EACxC,GAAG,EAAE;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GACxF,IAAI,CAAC,0BAA0B,EAAE,KAAK,GAAG,WAAW,CAAC,CAoBvD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;iBAA6F,CAAC;AACnJ,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;iBAM7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAI9F;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,4BAA4B,GAAG,SAAS,CAY9G"}