@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/compliance/privacy/subject-erasure.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-erasure.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,yBAoEX;AApED,WAAY,yBAAyB;IACnC;;;;;OAKG;IACH,8CAAiB,CAAA;IAEjB;;;;OAIG;IACH,kFAAqD,CAAA;IAErD;;;;;;;;OAQG;IACH,gFAAmD,CAAA;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,oFAAuD,CAAA;IAEvD;;;;;OAKG;IACH,oDAAuB,CAAA;IAEvB;;;;;OAKG;IACH,0DAA6B,CAAA;IAE7B;;;;;OAKG;IACH,0EAA6C,CAAA;AAC/C,CAAC,EApEW,yBAAyB,KAAzB,yBAAyB,QAoEpC;AA+BD,oEAAoE;AACpE,MAAM,qBAAqB,GAA2C,IAAI,GAAG,CAAC;IAC5E,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,oBAAoB;CAC/C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAsC;IAEtC,OAAO,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,UAAU,iCAAiC,CAC/C,YAAkC,EAClC,2BAEwD;IAExD,MAAM,iBAAiB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACrE,MAAM,QAAQ,GAAG,CACf,WAAsC,EACtC,MAAc,EACoB,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpF,gGAAgG;IAChG,+FAA+F;IAC/F,uDAAuD;IACvD,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,yBAAyB,CAAC,SAAS,EACnC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,yBAAyB,CAAC,SAAS,EACnC,0BAA0B,cAAc,2CAA2C;YACjF,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,oBAAoB;IACpB,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAC3F,YAAY,CACb,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,QAAQ,CACb,yBAAyB,CAAC,YAAY,EACtC,2FAA2F;YACzF,oFAAoF;YACpF,0FAA0F;YAC1F,oFAAoF;YACpF,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,IAAI,cAAc,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,QAAQ,CACb,yBAAyB,CAAC,uBAAuB,EACjD,0FAA0F;YACxF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,iGAAiG;IACjG,wEAAwE;IACxE,IAAI,cAAc,CAAC,QAAQ,KAAK,sBAAsB,CAAC,2BAA2B,EAAE,CAAC;QACnF,OAAO,QAAQ,CACb,yBAAyB,CAAC,yBAAyB,EACnD,gGAAgG;YAC9F,iGAAiG;YACjG,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,kBAAkB,CAAC,SAAS,CAAC;IACjE,IAAI,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,QAAQ,CACb,yBAAyB,CAAC,oBAAoB,EAC9C,2BAA2B,IAAI,6DAA6D;YAC1F,yFAAyF;YACzF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC;IACjD,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;IAE5E,IAAI,oBAAoB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAChD,MAAM,iBAAiB,GACrB,aAAa,KAAK,oBAAoB,CAAC,wBAAwB;YAC7D,CAAC,CAAC,yBAAyB,CAAC,wBAAwB;YACpD,CAAC,CAAC,yBAAyB,CAAC,uBAAuB,CAAC;QAExD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,QAAQ,CACb,iBAAiB,EACjB,qDAAqD,aAAa,2BAA2B;gBAC3F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,sFAAsF,CACzF,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;WAgBG;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,QAAQ,GAAG,gBAAgB,IAAI,sBAAsB,CAAC,MAAM,CAAC;IACnE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,sBAAsB,CAAC,MAAM;YAChC,OAAO,QAAQ,CACb,yBAAyB,CAAC,MAAM,EAChC,0FAA0F;gBACxF,4CAA4C,CAC/C,CAAC;QAEJ,KAAK,sBAAsB,CAAC,wBAAwB;YAClD,OAAO,QAAQ,CACb,yBAAyB,CAAC,wBAAwB,EAClD,0FAA0F;gBACxF,6EAA6E,CAChF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,6FAA6F;YAC7F,mFAAmF;YACnF,MAAM,wBAAwB,GAAU,QAAQ,CAAC;YACjD,OAAO,QAAQ,CACb,yBAAyB,CAAC,YAAY,EACtC,uDAAuD;gBACrD,IAAI,MAAM,CAAC,wBAAwB,CAAC,uCAAuC,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,iCAAiC,CAC/C,uBAAqC,EACrC,kCAAsG,EACtG,2BAEwD;IAExD,MAAM,OAAO,GAAuC,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,OAAO,GAAmB,CAAC,uBAAuB,CAAC,CAAC;IAE1D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,EAAG,CAAC;QAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAAE,SAAS;QACrD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAEvC,KAAK,MAAM,YAAY,IAAI,kCAAkC,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;YACxF,MAAM,cAAc,GAAG,iCAAiC,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC;YACnE,IAAI,cAAc,CAAC,WAAW,KAAK,yBAAyB,CAAC,MAAM,EAAE,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AACH,MAAM,UAAU,uCAAuC,CACrD,YAA8B;IAE9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqD,CAAC;IACpF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/D,IAAI,WAAW,KAAK,yBAAyB,CAAC,MAAM,IAAI,WAAW,KAAK,yBAAyB,CAAC,wBAAwB,EAAE,CAAC;YAC3H,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QACpH,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,WAAW,KAAK,yBAAyB,CAAC,MAAM;YAAE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YAChF,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3H,CAAC;AA2DD;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kCAmDX;AAnDD,WAAY,kCAAkC;IAC5C,sEAAsE;IACtE,6DAAuB,CAAA;IACvB;;;;OAIG;IACH,2EAAqC,CAAA;IACrC;;;;OAIG;IACH,yDAAmB,CAAA;IACnB,mGAAmG;IACnG,uDAAiB,CAAA;IACjB;;;OAGG;IACH,uEAAiC,CAAA;IAEjC;;;;OAIG;IACH,+DAAyB,CAAA;IAEzB;;;;;;;OAOG;IACH,2FAAqD,CAAA;IAErD;;;;;;;;;OASG;IACH,2FAAqD,CAAA;AACvD,CAAC,EAnDW,kCAAkC,KAAlC,kCAAkC,QAmD7C;AAED,gGAAgG;AAChG,MAAM,UAAU,wCAAwC,CACtD,MAA0C;IAE1C,OAAO,MAAM,KAAK,kCAAkC,CAAC,OAAO;WACvD,MAAM,KAAK,kCAAkC,CAAC,MAAM;WACpD,MAAM,KAAK,kCAAkC,CAAC,cAAc;WAC5D,MAAM,KAAK,kCAAkC,CAAC,UAAU;QAC3D,4FAA4F;QAC5F,kFAAkF;WAC/E,MAAM,KAAK,kCAAkC,CAAC,wBAAwB,CAAC;AAC9E,CAAC;AAkFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,4CAA4C,CAC1D,YAA8B,EAC9B,2BAEwD;IAExD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,IAAI,CAAC,cAAc,CAAC,WAAW,KAAK,yBAAyB,CAAC,MAAM;WACjE,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,YAA8B,EAC9B,mBAA2B;IAE3B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,IAAI,CAAC,cAAc,CAAC,WAAW,KAAK,yBAAyB,CAAC,MAAM;WACjE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;AACtF,CAAC","sourcesContent":["import {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport {\n  ChildLifecycleMode,\n  ChildLifecycleStrategy,\n} from '../../resources/child-operations.shared.schemas';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\nimport { ErasureRetentionMode } from './impersonalization.shared.schemas';\n\n/**\n * What a SUBJECT ERASURE does to one child-direction edge of the subject.\n *\n * ## Why this vocabulary exists at all\n *\n * \"Erase this subject\" (a `delete my account` request) is not \"delete this row\". The subject row\n * SURVIVES — scrubbed and marked `RETAINED` — so that foreign keys from legally-retained financial\n * rows keep resolving to an anonymized person. But the subject's OWN dependents must each be\n * disposed of, and the disposition differs per edge: a profile holding a name and an avatar has to\n * go, an invoice has to stay, an audit log was never the subject's to begin with.\n *\n * This enum is the closed set of answers, and it is deliberately WIDER than the two teardown\n * strategies of {@link ChildLifecycleStrategy}: the delete cascade only ever asks about edges that\n * opted IN (`onParentDelete.enabled === true`) and silently ignores the rest, whereas an erasure\n * must account for EVERY edge — including the ones nobody opted in — because an edge nobody thought\n * about is exactly where personal data survives an erasure unnoticed.\n *\n * Two members therefore have no runtime action and exist to make the erasure FAIL LOUD\n * ({@link UNCLASSIFIED}, {@link UNSUPPORTED_DEFERRED}), and three describe leaving a row alone for\n * three genuinely different reasons ({@link RETAINED_BY_DECLARATION}, {@link RESTRICTED_BY_DECLARATION},\n * {@link NOT_OWNED}). They are not merged despite sharing a no-op: a data-protection reviewer asking\n * \"why is this row still here?\" needs \"because the author declared it retained\", \"because its parent\n * may not be deleted while it exists\" and \"because it was never the subject's row\" to be different\n * answers, and only the first one is a retention claim someone made.\n */\nexport enum SubjectErasureDisposition {\n  /**\n   * Hard-delete the child rows. The author declared this dependent's data dies with the parent's\n   * ownership (`onParentDelete.enabled`, `strategy: DELETE`) — on an erasure the ownership ends in\n   * the only way that matters for personal data, so the rows go. This is the `USER_PROFILES` case:\n   * there is no legal obligation to retain a name, a bio or an avatar.\n   */\n  DELETE = 'delete',\n\n  /**\n   * Scrub the child rows' personal fields in place and KEEP them, flipping `retentionStatus` to\n   * `RETAINED` (`onParentDelete.strategy = IMPERSONALIZE_AND_RETAIN`). For a dependent that must\n   * survive for a legal/audit obligation while holding personal data of its own.\n   */\n  IMPERSONALIZE_AND_RETAIN = 'impersonalize_and_retain',\n\n  /**\n   * LEAVE THE ROWS EXACTLY AS THEY ARE — a dependent whose cascade the author explicitly DISABLED\n   * (`onParentDelete.enabled: false`). That declaration says \"this row survives its parent's\n   * teardown\", which is a positive compliance claim, not an omission.\n   *\n   * This is how the retained billing rows are expressed: subscriptions, invoice refs, usage records\n   * and credit pools each disable the cascade, keep their financial audit trail fully VISIBLE, and\n   * rely on the erased subject row still resolving their foreign keys.\n   */\n  RETAINED_BY_DECLARATION = 'retained_by_declaration',\n\n  /**\n   * LEAVE THE ROWS EXACTLY AS THEY ARE — a dependent whose edge declares the RESTRICT posture\n   * (`onParentDelete.strategy: REFUSE_WHILE_CHILDREN_EXIST`): the parent's delete is refused while\n   * these rows exist, and nothing about the parent's teardown removes them.\n   *\n   * An erasure scrubs its subject in place and never deletes it, so at the direct level the refusal is\n   * never met and the rows keep resolving their foreign key, as a retained row does. Below a dependent\n   * the erasure DELETES, the same edge holding rows refuses the erasure, as a delete cascade frame does,\n   * because deleting that parent would strand them. Kept apart from\n   * {@link RETAINED_BY_DECLARATION} because the claim differs: that one says \"these rows must outlive\n   * their parent\", this one says \"their parent may not go while they exist\". The second is about\n   * referential integrity (an org-unit subtree, the provider-customer mapping a billing account holds\n   * for its financial records), not a retention obligation.\n   *\n   * Like the other leave-alone dispositions, the erasure does not walk below these rows.\n   */\n  RESTRICTED_BY_DECLARATION = 'restricted_by_declaration',\n\n  /**\n   * LEAVE THE ROWS ALONE — the edge is not an ownership edge at all\n   * (`lifecycleModelMode` is `INDEPENDENT` or `LINK_ONLY`, or the relationship is disabled). The\n   * related rows live independently of the subject, so their disposition is not the subject's\n   * erasure to decide (audit logs, job executions, membership links).\n   */\n  NOT_OWNED = 'not_owned',\n\n  /**\n   * ⛔ NO ANSWER — a DEPENDENT child with NO `onParentDelete` declaration whatsoever. The author\n   * owns this dependent's lifecycle but never said what happens to it, and an erasure must not\n   * guess: deleting could destroy data a retention obligation required keeping, and leaving could\n   * strand personal data that the erasure claimed to have removed. The orchestrator throws.\n   */\n  UNCLASSIFIED = 'unclassified',\n\n  /**\n   * ⛔ DECLARED BUT NOT EXECUTABLE AS PART OF AN ERASURE — the edge opted in with\n   * `mode: LAZY` (queue the teardown for later). Deferring is a legitimate performance choice for a\n   * parent delete, but it would let an erasure report success while the subject's personal data is\n   * still live in a queue nobody is watching. The orchestrator throws.\n   */\n  UNSUPPORTED_DEFERRED = 'unsupported_deferred',\n}\n\n/** The classification of ONE child-direction edge of an erasure subject. */\nexport interface SubjectErasureEdgeClassification {\n  /** The dependent resource on the far side of the edge. */\n  childResourceType: ResourceType;\n  /** What the erasure will do with that dependent's rows. */\n  disposition: SubjectErasureDisposition;\n  /**\n   * Human-readable justification, quoting the configuration that produced it. Surfaced in the\n   * erasure report and in the fail-loud error, so an operator never has to re-derive WHY a row was\n   * deleted, retained, or refused.\n   */\n  reason: string;\n}\n\n/**\n * The only part of a child's `retentionPolicy` an erasure classification reads (#1279).\n *\n * Structural and minimal on purpose: the classifier needs the erasure TREATMENT and nothing else, and\n * narrowing the parameter to this keeps every caller — the runtime orchestrator, the registry sweep and\n * the boot-time guards, which each hold a differently-shaped configuration record — able to answer\n * without first building a full `ResourceRetentionPolicy` it does not otherwise need.\n *\n * `mode` is optional because a caller may legitimately hold a resource entry with no retention opt-in;\n * that is the same answer as passing `undefined` and means \"this child declares no erasure treatment\".\n */\nexport interface SubjectErasureChildRetentionDeclaration {\n  readonly mode?: ErasureRetentionMode;\n}\n\n/** Dispositions that ABORT the erasure rather than executing it. */\nconst BLOCKING_DISPOSITIONS: ReadonlySet<SubjectErasureDisposition> = new Set([\n  SubjectErasureDisposition.UNCLASSIFIED,\n  SubjectErasureDisposition.UNSUPPORTED_DEFERRED,\n]);\n\n/**\n * True when a disposition must stop the erasure before any write lands.\n *\n * Exported (rather than inlined at the one call site) so a future boot-time guard — the erasure\n * analogue of `validateCompositionCascadeDeletability` — reports exactly the edges the runtime\n * would refuse, instead of re-deriving the rule and drifting from it.\n */\nexport function isBlockingSubjectErasureDisposition(\n  disposition: SubjectErasureDisposition,\n): boolean {\n  return BLOCKING_DISPOSITIONS.has(disposition);\n}\n\n/**\n * Classify what a subject erasure must do with ONE child-direction edge — the delete-vs-retain\n * decision, DERIVED FROM CONFIGURATION rather than from a hardcoded list of resource types.\n *\n * ## Where the answer comes from\n *\n * Two declarations the author already makes, read through the SAME shared authority the runtime\n * delete cascade reads (`resolveRelationshipLifecycleOnParentDeleteConfig`), so the erasure and the\n * cascade can never disagree about what an edge says:\n *\n *  1. **`handling.lifecycleModelMode`** — does the subject own this dependent's lifecycle at all?\n *     `INDEPENDENT` / `LINK_ONLY` answers \"no\", and the erasure leaves those rows alone.\n *  2. **`childOperations.lifecycle.onParentDelete`** — for an owned dependent, what did the author\n *     declare happens when the parent stops owning it: hard-delete, scrub-and-retain, or nothing.\n *\n *  3. **the child's own `retentionPolicy`** — the ONE declaration whose entire subject is this\n *     question: *\"`retentionPolicy.mode` on a resource says WHAT erasure does to a row\"*\n *     (`retention-schedule.shared.schemas.ts`). Supplied through `resolveChildRetentionPolicy` so this\n *     function stays pure.\n *\n * ## The semantic caveat — CORRECTED 2026-09-17 (#1279), and the correction is the point\n *\n * `onParentDelete` literally answers \"what happens when the parent row is DELETED\", and an erasure\n * does NOT delete the subject — it scrubs and keeps it. This function used to treat the two questions\n * as one, on a stated premise: *\"they have the same answer for every edge in the shipped registry\"*.\n *\n * **That premise was false, and it had never been measured.** Measured across `engine/`, `platform/`\n * and `examples/`: 28 edges reached a `DELETE` erasure disposition while the child resource declared\n * `retentionPolicy` — i.e. an erasure deleting rows whose own resource says an erasure keeps them.\n *\n * What made it invisible was a SCHEMA DEFAULT. `strategy` carried\n * `.default(ChildLifecycleStrategy.DELETE)`, so every parsed edge presented `strategy: 'delete'` as an\n * own property whether or not a human had ever considered the question — and **28 of those 28 edges\n * reached DELETE through that default. Not one author had written `strategy: DELETE` for a\n * retain-declaring resource.** The default was removed (see `ChildLifecycleOnDeleteConfigSchema`), so\n * absence now arrives here intact and this function can tell a decision from a silence.\n *\n * ## The precedence, which decides no legal question\n *\n * | child `retentionPolicy` | this edge's `strategy` | disposition |\n * |---|---|---|\n * | declared (retain) | **absent** | the retain treatment — the author answered the ERASURE question and nobody answered the teardown one. A default may not overrule a declaration |\n * | declared (retain) | authored `DELETE` | `CONTRADICTED_BY_DECLARATIONS` — refused |\n * | declared (retain) | authored `IMPERSONALIZE_AND_RETAIN` | they agree; the edge's arm below runs |\n * | none | anything, including absent | unchanged — no erasure declaration exists to honour |\n *\n * Note what is deliberately NOT done: \"retain wins\" is not made a blanket default over an AUTHORED\n * `DELETE`. {@link findSubjectErasureRetainDeleteConflicts} rejects exactly that reasoning for the\n * edge-vs-edge case — *it decides a legal question on the author's behalf; neither default is safe, so\n * no default* — and that rejection stands here. Deleting data a retention obligation required keeping\n * and stranding data an erasure claimed to have removed are both unsafe, and nothing in the\n * configuration says which the author meant. The only thing that changed is that a SCHEMA DEFAULT may\n * no longer impersonate an author's decision.\n *\n * A sibling `onSubjectErasure` axis on the edge was reconsidered and stays rejected: `retentionPolicy`\n * already IS the erasure axis, and adding a second one would give app authors two ways to say the same\n * thing — the objection the previous version of this note raised against it, which survives its own\n * premise being wrong.\n *\n * Pure and side-effect free — no registry lookups, no I/O — so it is equally usable from a runtime\n * orchestrator and from a boot-time guard.\n */\nexport function classifySubjectErasureDisposition(\n  relationship: ResourceRelationship,\n  resolveChildRetentionPolicy: (\n    resourceType: ResourceType,\n  ) => SubjectErasureChildRetentionDeclaration | undefined,\n): SubjectErasureEdgeClassification {\n  const childResourceType = relationship.resourceType2 as ResourceType;\n  const classify = (\n    disposition: SubjectErasureDisposition,\n    reason: string,\n  ): SubjectErasureEdgeClassification => ({ childResourceType, disposition, reason });\n\n  // A disabled relationship is not part of the live graph — the runtime never traverses it, so an\n  // erasure must not refuse to run because of it (the alternative would be a permanently blocked\n  // erasure on a resource carrying a switched-off edge).\n  if (relationship.isDisabled === true) {\n    return classify(\n      SubjectErasureDisposition.NOT_OWNED,\n      'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n    );\n  }\n\n  const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n  const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n  if (lifecycleModel !== RelationshipLifecycleModel.DEPENDENT) {\n    return classify(\n      SubjectErasureDisposition.NOT_OWNED,\n      `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): the related rows live ` +\n        `independently of the subject, so their disposition is not this erasure's decision`,\n    );\n  }\n\n  // DEPENDENT from here on: the subject owns this dependent's lifecycle, so the erasure MUST have\n  // an answer for it.\n  const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(\n    relationship,\n  );\n\n  if (!onParentDelete) {\n    return classify(\n      SubjectErasureDisposition.UNCLASSIFIED,\n      `the subject owns this dependent (lifecycleModelMode: DEPENDENT) but the edge declares no ` +\n        `onParentDelete lifecycle, so nobody has said whether its rows survive an erasure. ` +\n        `Declare onParentDelete on the edge: 'enabled: true' with strategy DELETE (the rows hold ` +\n        `no retainable value) or IMPERSONALIZE_AND_RETAIN (they must survive scrubbed), or ` +\n        `'enabled: false' to state explicitly that they survive intact`,\n    );\n  }\n\n  /*\n   * ## DECIDED 2026-09-17 (#1084): this is NOT reconciled against a DELETE path, and that is correct\n   *\n   * The question was whether a resource reached BOTH by this disposition and by a DELETE edge should\n   * be refused the way #1017 refuses `IMPERSONALIZE_AND_RETAIN` against `DELETE`. It should not, and\n   * the reason is that the two cases are not alike.\n   *\n   * #1017 refuses because TWO EXECUTED TREATMENTS disagree about the same row: one scrubs it and keeps\n   * it, the other removes it, and nothing says which wins. `enabled: false` executes nothing. The\n   * erasure never traverses this edge and never discovers these rows, so there is no competing\n   * treatment to reconcile — only one edge that acts and one that says nothing. A row with two parents\n   * that survives one teardown and dies with the other is also exactly what an ordinary parent delete\n   * does, so refusing here would make an erasure stricter than the lifecycle it is built on.\n   *\n   * Refusing was the filed recommendation and is rejected for a further reason: the #1017 refusal's own\n   * remedy tells an operator to \"disable one edge's teardown (onParentDelete.enabled: false)\". Treating\n   * the result as a new conflict would make the documented remedy produce the next refusal.\n   *\n   * What this disposition means is therefore narrower than its name suggests, and worth saying plainly:\n   * it records that THIS EDGE does not cascade, not that the rows are guaranteed to survive the\n   * erasure. Another path may still delete them, and that path's declaration is the one that decides.\n   */\n  if (onParentDelete.enabled !== true) {\n    return classify(\n      SubjectErasureDisposition.RETAINED_BY_DECLARATION,\n      'onParentDelete.enabled is false: the author declared these rows survive their parent\\'s ' +\n        'teardown, so the erasure leaves them intact',\n    );\n  }\n\n  // The RESTRICT posture is read BEFORE the mode: it tears nothing down, so there is no teardown to\n  // defer, and a `mode: LAZY` written beside it must not turn a leave-alone edge into a blocking one.\n  // After this return TypeScript narrows `strategy` below to the teardown members, so the switch's\n  // exhaustiveness check still turns any FUTURE member into a type error.\n  if (onParentDelete.strategy === ChildLifecycleStrategy.REFUSE_WHILE_CHILDREN_EXIST) {\n    return classify(\n      SubjectErasureDisposition.RESTRICTED_BY_DECLARATION,\n      'onParentDelete declares strategy REFUSE_WHILE_CHILDREN_EXIST: the parent\\'s delete is refused ' +\n        'while these rows exist, and an erasure scrubs the subject in place rather than deleting it, so ' +\n        'the erasure leaves the rows intact',\n    );\n  }\n\n  const mode = onParentDelete.mode ?? ChildLifecycleMode.IMMEDIATE;\n  if (mode !== ChildLifecycleMode.IMMEDIATE) {\n    return classify(\n      SubjectErasureDisposition.UNSUPPORTED_DEFERRED,\n      `onParentDelete.mode is '${mode}': deferring the teardown to a queue would let the erasure ` +\n        `report success while the subject's personal data is still live. Set mode: IMMEDIATE on ` +\n        `this edge for it to participate in a subject erasure`,\n    );\n  }\n\n  /*\n   * #1279 — the child's OWN erasure declaration is consulted BEFORE the edge's teardown strategy.\n   *\n   * ## Why this sits AFTER the deferral check, deliberately\n   *\n   * `mode: LAZY` is read above and refuses first, so a deferred edge never reaches the retention\n   * question. The alternative — letting a retain policy rescue a LAZY edge, the way the RESTRICT\n   * posture is read before `mode` — was considered and REJECTED: RESTRICT tears nothing down, so\n   * there is genuinely no teardown to defer, while `RETAIN_AND_IMPERSONALIZE` is an ACTION (the\n   * in-place scrub), and an erasure that defers its own scrub reports success while personal data is\n   * still live. Refusing is the fail-closed answer and the one an operator can act on.\n   *\n   * Measured 2026-09-17: the shipped registry declares ZERO `mode: LAZY` edges, so this ordering is\n   * currently unobservable. It is written down rather than left to be re-derived by whoever declares\n   * the first one.\n   *\n   * `strategy` is read RAW here, never through `resolveChildLifecycleTeardownStrategy`. That helper\n   * resolves absence to DELETE for the CASCADE, where the premise \"the parent row is gone\" makes it\n   * correct. An erasure keeps the parent row, so the premise is false and the resolution would be a\n   * manufactured answer — which is precisely the defect this replaces.\n   */\n  const authoredStrategy = onParentDelete.strategy;\n  const childRetentionPolicy = resolveChildRetentionPolicy(childResourceType);\n\n  if (childRetentionPolicy?.mode !== undefined) {\n    const retentionMode = childRetentionPolicy.mode;\n    const retainDisposition =\n      retentionMode === ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE\n        ? SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN\n        : SubjectErasureDisposition.RETAINED_BY_DECLARATION;\n\n    if (authoredStrategy === undefined) {\n      return classify(\n        retainDisposition,\n        `the child resource declares retentionPolicy.mode '${retentionMode}' — the declaration that ` +\n          `states what an erasure does to its rows — and this edge authors no onParentDelete.strategy, ` +\n          `so nothing contradicts it. The erasure applies the declared retention treatment rather than ` +\n          `the teardown the delete cascade would apply, because an erasure keeps the parent row`,\n      );\n    }\n\n    /*\n     * An AUTHORED strategy is left to the switch below, deliberately — including an authored DELETE,\n     * which CONTRADICTS this retention policy.\n     *\n     * Refusing it here as a per-edge disposition was implemented first and REVERTED, because a\n     * blocking disposition is refused by the orchestrator BEFORE the plan-level detectors run: it\n     * shadowed {@link findSubjectErasureRetainDeleteConflicts} (#1017) and\n     * {@link findSubjectErasureSubjectTypeDeleteEdges} (#1085), whose refusals name both offending\n     * edges and the resource, with a generic \"no executable disposition\" message. Two purpose-built,\n     * mutation-proven refusals became unreachable for their whole population — every shape they\n     * detect requires the child to declare a `retentionPolicy`, so every one of them is also this\n     * contradiction.\n     *\n     * A contradiction is a relation between TWO declarations, which is what a plan-level detector\n     * models and what a single edge's disposition cannot. It therefore lives beside its siblings, as\n     * {@link findSubjectErasureRetentionContradictedEdges}.\n     */\n  }\n\n  /*\n   * The residual, named rather than left to look like an inconsistency with everything above.\n   *\n   * A child that declares NO `retentionPolicy` and sits on a SILENT edge has had nothing said about it\n   * in either field, and here absence still resolves to DELETE — the reading the engine has always\n   * had, that a dependent's data has no life of its own once the subject's ownership does not. 33\n   * children are in that position (measured 2026-09-17), and the alternative was to refuse all 33 as\n   * UNCLASSIFIED until someone authored a declaration for each.\n   *\n   * That was rejected for the reason `application-creation-directive.md` gives: the remedy would be\n   * \"an author decides something\", which makes an erasure impossible to run until a large authoring\n   * backlog is cleared, and #1279 was about an erasure doing the WRONG thing, not about it being\n   * under-declared. The narrow fix is the one that keeps the correction checkable.\n   *\n   * What changed is precise and worth stating: silence no longer overrules a DECLARATION. It still\n   * carries the historical default where there is no declaration to overrule. If this project later\n   * wants that last case explicit too, the place for it is a per-edge `onSubjectErasure` axis, and\n   * the argument against adding one speculatively is in this function's header.\n   */\n  const strategy = authoredStrategy ?? ChildLifecycleStrategy.DELETE;\n  switch (strategy) {\n    case ChildLifecycleStrategy.DELETE:\n      return classify(\n        SubjectErasureDisposition.DELETE,\n        'onParentDelete declares strategy DELETE: the dependent\\'s data dies with the subject\\'s ' +\n          'ownership, so the erasure removes the rows',\n      );\n\n    case ChildLifecycleStrategy.IMPERSONALIZE_AND_RETAIN:\n      return classify(\n        SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN,\n        'onParentDelete declares strategy IMPERSONALIZE_AND_RETAIN: the rows survive the erasure ' +\n          'with their personal fields scrubbed and retentionStatus flipped to RETAINED',\n      );\n\n    default: {\n      // Compile-time exhaustiveness: a new ChildLifecycleStrategy member without an erasure arm is\n      // a TYPE error here, not a silent runtime discovery on someone's deletion request.\n      const _exhaustiveStrategyCheck: never = strategy;\n      return classify(\n        SubjectErasureDisposition.UNCLASSIFIED,\n        `onParentDelete declares an unknown teardown strategy ` +\n          `'${String(_exhaustiveStrategyCheck)}' that subject erasure has no arm for`,\n      );\n    }\n  }\n}\n\n/**\n * One DESCENDANT edge an erasure must account for — an edge below the subject's direct dependents,\n * planned from configuration before anything runs (#976).\n *\n * `parentResourceType` is the resource whose rows the erasure tears down and that owns this edge;\n * the classification is the same one a direct edge gets, from the same shared classifier, so a\n * descendant and a direct edge can never disagree about what an identical declaration means.\n */\nexport interface SubjectErasureDescendantEdgePlan {\n  /** The edge itself, as the parent resource's configuration declares it. */\n  relationship: ResourceRelationship;\n  /** The resource that owns this edge — its rows are the ones being torn down above it. */\n  parentResourceType: ResourceType;\n  classification: SubjectErasureEdgeClassification;\n}\n\n/**\n * Plan every DESCENDANT edge a subject erasure walks below ONE direct dependent (#976).\n *\n * ## What an erasure walks, and why exactly that\n *\n * - **Below a `DELETE` edge — everything, at every depth, regardless of `maxDepth`.** The rows are\n *   gone, so whatever depended on them has lost its owner; an erasure that stops at a depth budget\n *   leaves the subject's data one level down with nothing left to reach it. `maxDepth` is a\n *   parent-DELETE performance budget and keeps meaning exactly that on the delete cascade.\n * - **Below an `IMPERSONALIZE_AND_RETAIN` edge — nothing.** The retained row survives, scrubbed, so\n *   its own dependents still have their owner and remain bound to THAT row's future lifecycle. The\n *   retention obligation that keeps the row is the obligation that keeps what hangs off it; tearing\n *   those down would destroy records a legal obligation required keeping, and scrubbing them would\n *   need a declaration nobody made. This matches the cascade itself, whose retain arm never recurses.\n * - **Below `RETAINED_BY_DECLARATION` / `NOT_OWNED` — nothing.** The rows are not touched.\n *\n * Every child-direction edge of every walked resource is returned — including the ones that do\n * nothing — because the receipt is total over what the erasure walked, exactly as it is at the\n * direct level. A blocking classification anywhere in the plan must refuse the erasure BEFORE its\n * transaction opens; returning it (rather than throwing here) lets the caller name every one.\n *\n * ## Termination\n *\n * The walk is over RESOURCE TYPES, not rows, so each type's edges are planned once: a self-referential\n * edge (a folder of folders) or a cycle between types terminates here, while the row-level cascade\n * keeps its own visited-row guard.\n *\n * Pure: the caller supplies the lookup, so a boot-time guard can run the same planner the runtime\n * does rather than re-deriving it.\n *\n * @param directChildResourceType - the far side of the subject's direct `DELETE` edge.\n * @param resolveChildDirectionRelationships - the child-direction edges of a resource type, or\n *   `undefined` when the type has no configuration in this process (nothing is planned below it; the\n *   runtime cascade then declines that edge and reports it as not executed).\n * @param resolveChildRetentionPolicy - a resource type's declared `retentionPolicy`, or `undefined`\n *   when it declares none. Injected for the same reason as the lookup above: it keeps this planner\n *   pure, so a boot-time guard classifies a descendant edge exactly as the runtime will (#1279).\n */\nexport function planSubjectErasureDescendantEdges(\n  directChildResourceType: ResourceType,\n  resolveChildDirectionRelationships: (resourceType: ResourceType) => ResourceRelationship[] | undefined,\n  resolveChildRetentionPolicy: (\n    resourceType: ResourceType,\n  ) => SubjectErasureChildRetentionDeclaration | undefined,\n): SubjectErasureDescendantEdgePlan[] {\n  const planned: SubjectErasureDescendantEdgePlan[] = [];\n  const walked = new Set<string>();\n  const pending: ResourceType[] = [directChildResourceType];\n\n  while (pending.length > 0) {\n    const parentResourceType = pending.shift()!;\n    if (walked.has(String(parentResourceType))) continue;\n    walked.add(String(parentResourceType));\n\n    for (const relationship of resolveChildDirectionRelationships(parentResourceType) ?? []) {\n      const classification = classifySubjectErasureDisposition(relationship, resolveChildRetentionPolicy);\n      planned.push({ relationship, parentResourceType, classification });\n      if (classification.disposition === SubjectErasureDisposition.DELETE) {\n        pending.push(classification.childResourceType);\n      }\n    }\n  }\n\n  return planned;\n}\n\n/**\n * One resource an erasure's plan reaches both to KEEP its rows and to DELETE them (#1017).\n *\n * `TEdge` is whatever the caller planned — a direct edge, a descendant edge, or its own record of either —\n * so the orchestrator can name the edges the way its refusal already names unresolved ones.\n */\nexport interface SubjectErasureRetainDeleteConflict<TEdge> {\n  /** The resource on the far side of every edge below. */\n  resourceType: ResourceType;\n  /** Edges that scrub these rows and keep them (`IMPERSONALIZE_AND_RETAIN`), in plan order. */\n  retainingEdges: TEdge[];\n  /** Edges that hard-delete these rows (`DELETE`), in plan order. */\n  deletingEdges: TEdge[];\n}\n\n/**\n * Find every resource a subject erasure's WHOLE plan reaches through both a retaining edge and a deleting\n * edge (#1017). The erasure REFUSES before its transaction opens when this returns anything.\n *\n * ## The shape\n *\n * Each edge applies its own declared treatment to the rows it reaches: `DELETE` hard-deletes them,\n * `IMPERSONALIZE_AND_RETAIN` scrubs them and keeps them. Two DIFFERENT paths can reach the same resource — a\n * `people → records` retain edge beside `people → profiles → notes → records` delete, or two edges on one\n * resource through two foreign keys — and nothing in either declaration says what happens to a row BOTH\n * reach. Before this, the answer was the walk order: a row kept by the retain edge could still be deleted\n * when the delete edge's cascade got there, and #976 could only make the receipt admit it (`executed: false`).\n *\n * ## Why REFUSE, and why at the level of resource types\n *\n * The two declarations contradict each other for the rows they share, and neither outranks the other in\n * configuration. Refusing is the one answer that needs no new meaning: it surfaces the contradiction to the\n * author, who owns both declarations and can make them agree — declare the delete edge\n * `IMPERSONALIZE_AND_RETAIN` too, declare the retain edge `DELETE`, or disable one edge's teardown\n * (`onParentDelete.enabled: false`) — on the ground the legal obligation actually gives.\n *\n * The check is over resource TYPES, not rows, on purpose. Whether two edges share a row is only knowable by\n * reading rows, which the pre-flight must not do (every refusal here lands before the first read and write),\n * and it changes as rows are written, so a row-level \"no overlap today\" would be a guess about the future.\n * An edge pair that can never share a row in practice is still refused; the remedy is the same one-edge edit.\n *\n * ## Rejected: a precedence where retain wins\n *\n * \"Keep a row whenever any edge retains it\" was considered and rejected, for three reasons:\n *\n * - **It decides a legal question on the author's behalf.** A `DELETE` edge is a declaration too — that the\n *   rows hold nothing worth keeping once their owner is gone. GDPR Art. 17(3) lists the grounds on which the\n *   right to erasure does not apply (a legal obligation, the defence of legal claims, archiving, …), and\n *   Art. 5(2) makes the controller \"responsible for, and be able to demonstrate compliance with\" the\n *   principles. Keeping personal data an explicit declaration said to remove therefore needs a ground the\n *   controller can name, and a framework default names none. \"Delete wins\" fails the other way, destroying\n *   records a retention obligation required keeping. Neither default is safe, so no default.\n *   spec-cite: Regulation (EU) 2016/679, Art. 5(2) (accountability) and Art. 17(3)(a)–(e) (exceptions to the right to erasure).\n * - **Only its row-level form is faithful, and that form cannot be decided before the transaction.** A\n *   TYPE-level \"retain wins\" could be decided pre-flight, but it would keep every row of the resource,\n *   including rows only the delete edge reaches and the retain edge never touches — rows no retention\n *   declaration covers. The faithful rule is ROW-level: the delete walk skips each row a retain edge kept and\n *   prunes everything it planned below that row (a kept row still anchors its own dependents), per row,\n *   mid-transaction. The pre-flight plan is over types and cannot express that, so the\n *   refusal-before-any-write guarantee the rest of the erasure keeps would be lost.\n * - **It adds a meaning with no vocabulary for its opposite.** Once precedence exists, an author who needs\n *   the delete to win has no way to say so.\n *\n * ## What is NOT a conflict\n *\n * Only `DELETE` against `IMPERSONALIZE_AND_RETAIN` — the two treatments the erasure EXECUTES. Two deleting or\n * two retaining edges agree. `NOT_OWNED` rows are not the subject's, and the erasure never discovers them.\n * Two cases are deliberately NOT refused here. Each is an open decision, not an answer this rule gives:\n *\n * - **(a) A `RETAINED_BY_DECLARATION` dependent beside a `DELETE` path to the same resource (#1084).** The\n *   erasure never discovers `enabled: false` rows, and a row with two parents that survives one teardown and\n *   dies with the other is also what an ordinary parent delete does. **DECIDED 2026-09-17: this stays out.**\n *   `enabled: false` executes nothing, so there are not two treatments to reconcile — and the refusal below\n *   names `onParentDelete.enabled: false` as its own remedy, so counting it as a conflict would make that\n *   remedy produce the next refusal. The full argument is at the classification site.\n * - **(b) A delete closure that cycles back to the SUBJECT's own resource type while the subject row is\n *   retained (#1085).** The subject's retention is the erasure's own final step (the scrub), not an edge, so\n *   this detector — which reads only edges — cannot see it. **CLOSED 2026-09-17 by\n *   {@link findSubjectErasureSubjectTypeDeleteEdges}**, a sibling that takes the subject's own type as an\n *   argument precisely because it is not derivable from the edges.\n *\n * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.\n *\n * @param plannedEdges - every edge of ONE erasure: the subject's direct edges AND every descendant edge\n *   planned below its deleted dependents, each carrying its classification.\n * @returns one entry per conflicting resource, in the order the resource is first reached.\n */\nexport function findSubjectErasureRetainDeleteConflicts<TEdge extends { classification: SubjectErasureEdgeClassification }>(\n  plannedEdges: readonly TEdge[],\n): Array<SubjectErasureRetainDeleteConflict<TEdge>> {\n  const byResourceType = new Map<string, SubjectErasureRetainDeleteConflict<TEdge>>();\n  for (const edge of plannedEdges) {\n    const { disposition, childResourceType } = edge.classification;\n    if (disposition !== SubjectErasureDisposition.DELETE && disposition !== SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN) {\n      continue;\n    }\n    const key = String(childResourceType);\n    const entry = byResourceType.get(key) ?? { resourceType: childResourceType, retainingEdges: [], deletingEdges: [] };\n    byResourceType.set(key, entry);\n    if (disposition === SubjectErasureDisposition.DELETE) entry.deletingEdges.push(edge);\n    else entry.retainingEdges.push(edge);\n  }\n  return [...byResourceType.values()].filter((entry) => entry.retainingEdges.length > 0 && entry.deletingEdges.length > 0);\n}\n\n/**\n * What happened on ONE descendant edge of an executed erasure (#976) — reported exactly like a direct\n * edge: its disposition, the configuration that justified it, and whether its teardown ran.\n */\nexport interface SubjectErasureDescendantEdgeOutcome extends SubjectErasureEdgeClassification {\n  /** The resource that owns this edge. */\n  parentResourceType: ResourceType;\n  /**\n   * `true` when every teardown the erasure reached on this edge ran, `false` when any was declined, when\n   * this DELETE edge reached rows an earlier retain edge of the same walk scrubbed and KEPT (they are not\n   * gone, whatever this edge declares — unreachable since #1017, which refuses a plan that retains and deletes\n   * one resource before it runs, and kept as defence in depth), or when an edge ABOVE it was declined (its rows were then never\n   * walked, so nothing can be said about what they still hold). `false` on a non-executing disposition\n   * is expected, as on a direct edge.\n   *\n   * An executing edge the walk never had to dispatch — its parent resource had no rows of the subject's\n   * left to tear down — is `true`: that is a teardown with nothing to do, not a decline.\n   */\n  executed: boolean;\n}\n\n/** Per-edge outcome of an executed erasure — the classification plus what actually happened. */\nexport interface SubjectErasureEdgeOutcome extends SubjectErasureEdgeClassification {\n  /**\n   * Every edge below this one that the erasure walked, flat and in plan order (#976). Empty for a\n   * non-executing disposition and for `IMPERSONALIZE_AND_RETAIN`, which retains its rows and therefore\n   * does not walk below them — see {@link planSubjectErasureDescendantEdges}.\n   */\n  descendantEdges: SubjectErasureDescendantEdgeOutcome[];\n  /**\n   * `true` when the erasure ran a teardown for this edge AND for every descendant edge below it whose\n   * disposition executes (#976). A declined descendant therefore makes its direct edge `false`: a\n   * reader who only counts direct edges must not read a subtree that still holds live data as erased.\n   * {@link descendantEdges} says which descendant it was.\n   *\n   * Reports that the teardown RAN, not that rows existed — discovery finding no dependents is a\n   * teardown that ran with nothing to do, and is `true`.\n   *\n   * **Read it together with `disposition`, because `false` has two very different meanings:**\n   *\n   * - a NON-executing disposition (`RETAINED_BY_DECLARATION`, `NOT_OWNED`) ⇒ the erasure deliberately\n   *   left the rows alone, and `false` is the expected, correct answer;\n   * - an EXECUTING disposition (`DELETE`, `IMPERSONALIZE_AND_RETAIN`) ⇒ the cascade DECLINED the edge\n   *   (the child had no registered service or repository), or an edge BELOW it did not tear its rows\n   *   down (see `descendantEdges`) — declined the same way, or a DELETE edge that reached rows an\n   *   earlier retain edge of the walk kept. An erasure never spends a depth budget — it walks every\n   *   descendant. The subject's data is partly still live. This pairing should never appear in a\n   *   healthy system; it is logged at ERROR when it happens, naming the missing registration or the\n   *   descendant edges concerned.\n   *\n   * ⚠️ This flag was set unconditionally until 2026-08-11 — it meant \"the dispatcher returned without\n   * throwing\" and reported a skipped edge as torn down. Anything persisted before that date overstates\n   * what was erased. Treat this field as evidence only for reports produced after the fix.\n   */\n  executed: boolean;\n}\n\n/**\n * Outcome of one EXTERNAL, non-transactional erasure effect (a third-party provider the subject's\n * personal data also reached — a billing provider customer, say).\n *\n * A separate vocabulary from {@link SubjectErasureDisposition} on purpose. An edge disposition\n * describes a decision derived from configuration BEFORE anything ran, and its teardown is part of\n * the database transaction. An external effect is the opposite on both counts: it is discovered by\n * calling out to a system Wildo does not own, and it CANNOT join the transaction. Collapsing the\n * two would let a caller read \"the erasure succeeded\" from a value that only ever described the\n * local rows.\n */\nexport enum SubjectErasureExternalEffectStatus {\n  /** Every step of the effect completed against the external system. */\n  COMPLETED = 'completed',\n  /**\n   * The subject had nothing at this external system — no provider customer, no linked record. A\n   * legitimate success, kept DISTINCT from `COMPLETED` so \"there was nothing to erase\" can never be\n   * mistaken for \"we erased it\", which is exactly the confusion a regulator would probe.\n   */\n  NOTHING_TO_ERASE = 'nothing-to-erase',\n  /**\n   * The effect ran and some steps succeeded while others failed — personal data may still be live\n   * at the external system. The loudest state in this enum: it demands follow-up, and it is why the\n   * status is not a boolean.\n   */\n  PARTIAL = 'partial',\n  /** The effect could not run at all (provider unreachable, not configured). Nothing was changed. */\n  FAILED = 'failed',\n  /**\n   * No handler was registered for this effect. Distinct from `NOTHING_TO_ERASE`: that means we\n   * looked and found nothing, this means nobody looked.\n   */\n  NOT_REGISTERED = 'not-registered',\n\n  /**\n   * A bound external-effects port returned no usable report. The local erasure committed, but\n   * external outcomes are UNKNOWN: neither no work nor no change can be inferred. Incomplete;\n   * reconcile provider state before retrying work that may already have succeeded.\n   */\n  UNMEASURED = 'unmeasured',\n\n  /**\n   * The external system's binding DECLARES its rows hold no personal/subject data\n   * (`HttpApiErasureStance.NO_SUBJECT_DATA`, ETL D6 stance 6a) — nothing was erased because,\n   * by declaration, there is nothing an erasure could apply to. Distinct from\n   * {@link NOTHING_TO_ERASE}: that means we LOOKED and found no linked rows; this means the\n   * declaration made looking unnecessary. A complete outcome — the declaration's coherence is\n   * validated at boot (a 6a resource cannot participate in subject export).\n   */\n  DECLARED_NO_SUBJECT_DATA = 'declared-no-subject-data',\n\n  /**\n   * The rows live in an external system the platform cannot erase, and the CONTROLLER explicitly\n   * acknowledged completing the erasure anyway (`HttpApiErasureStance.\n   * CONTROLLER_ACKNOWLEDGED_NON_ERASURE`, ETL D6 stance 6c — the per-request\n   * `acknowledgeHttpApiNonErasure` option). Deliberately INCOMPLETE in\n   * {@link isIncompleteSubjectErasureExternalEffect}: the subject's data is still live at the\n   * third party, and a compliance artifact must say so however deliberate the decision was. The\n   * acknowledgement itself is additionally recorded as a CRITICAL audit event — the record is\n   * the control (`administrative-continuity-floors.md`).\n   */\n  ACKNOWLEDGED_NON_ERASURE = 'acknowledged-non-erasure',\n}\n\n/** Whether an external-effect status leaves personal data potentially live at a third party. */\nexport function isIncompleteSubjectErasureExternalEffect(\n  status: SubjectErasureExternalEffectStatus,\n): boolean {\n  return status === SubjectErasureExternalEffectStatus.PARTIAL\n    || status === SubjectErasureExternalEffectStatus.FAILED\n    || status === SubjectErasureExternalEffectStatus.NOT_REGISTERED\n    || status === SubjectErasureExternalEffectStatus.UNMEASURED\n    // An acknowledged non-erasure is a DELIBERATE hole, and still a hole: personal data remains\n    // live at the third party, so \"is this erasure actually complete\" must answer no.\n    || status === SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE;\n}\n\nexport interface SubjectErasureExternalEffectOutcome {\n  /** Stable identifier of the effect, e.g. `'billing-provider'`. */\n  effectRef: string;\n  status: SubjectErasureExternalEffectStatus;\n  /**\n   * Human-readable account of what ran, for the compliance artifact. On `PARTIAL` / `FAILED` this\n   * must name what did NOT happen — the report is the only place that survives the request.\n   */\n  detail: string;\n  /**\n   * Per-step results, so a partial outcome is actionable rather than merely alarming (which step\n   * against which external id). Never carries personal data — ids and step names only.\n   */\n  steps?: Array<{ step: string; targetRef?: string; succeeded: boolean; error?: string }>;\n}\n\n/**\n * What one subject erasure did — the compliance artifact of a \"delete my account\" request.\n *\n * Returned to the caller (rather than only logged) so the flow that fronts the request can record\n * or surface it: every edge of the subject appears exactly once with the disposition applied and\n * the configuration that justified it, which is the evidence a data-protection response needs.\n *\n * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure accounts per store instead of\n * one verdict: each direct dependent edge with whether its teardown ran, each descendant edge the\n * erasure walked below it (nested in `descendantEdges`, folded into the direct edge's `executed`),\n * each registered external effect with its own outcome. The engine returns this and persists none of\n * it; retaining it is the calling application's job.\n */\nexport interface SubjectErasureReport {\n  /** The erased subject's resource type. */\n  subjectResourceType: ResourceType;\n  /** The erased subject rows. */\n  subjectIds: string[];\n  /** Every child-direction edge of the subject, classified, in registry order. */\n  edges: SubjectErasureEdgeOutcome[];\n  /**\n   * `true` once the subject rows themselves were scrubbed and flipped to `RETAINED`. Always `true`\n   * on a successful erasure — an erasure that could not retain its subject throws rather than\n   * returning a report.\n   */\n  subjectImpersonalized: boolean;\n  /**\n   * Whose sessions this erasure ended, and whether resolving them failed.\n   *\n   * A LOCAL fact, not an external effect: the revocation is a write to our own session fence, applied\n   * at the scrub chokepoint so it covers every path that scrubs a person's row. It is recorded here\n   * because \"the erased person can no longer be logged in\" is exactly what a data-protection response\n   * has to be able to evidence.\n   *\n   * `lookupFailed` is kept distinct from an empty `principalUserIds`: no principals is a legitimate\n   * outcome (the resource declared `NO_PRINCIPAL`), whereas a failed lookup means the person may\n   * still hold a live session — and the two must never look alike in a compliance artifact.\n   */\n  sessionRevocation?: {\n    principalUserIds: string[];\n    lookupFailed: boolean;\n  };\n  /**\n   * Outcomes of the external, non-transactional effects the erasure triggered — every SYSTEM WE\n   * DO NOT OWN that the subject's personal data reached: registered effect handlers (a billing\n   * provider), and each HTTP_API-bound resource linked to the subject (one entry per resource,\n   * `effectRef: 'http-api:<resourceType>'`, carrying its declared D6 erasure stance's outcome).\n   *\n   * A malformed response from a bound registry produces one aggregate UNMEASURED entry,\n   * identifying that boundary rather than inventing individual provider outcomes.\n   *\n   * Empty when no effect was registered for the subject's resource type. These run AFTER the local\n   * scrub has committed, so a failure here cannot roll the erasure back — the local data is\n   * already gone and re-running the whole erasure would be wrong. That asymmetry is precisely why\n   * the outcome is reported rather than thrown: the local part genuinely succeeded, and the caller\n   * needs to know that a third party still holds something.\n   *\n   * Check {@link isIncompleteSubjectErasureExternalEffect} over these before treating a report as a\n   * complete erasure.\n   */\n  externalEffects: SubjectErasureExternalEffectOutcome[];\n}\n\n\n/**\n * Edges whose DELETE would reach the SUBJECT'S OWN resource type (#1085).\n *\n * ## The hazard\n *\n * A subject erasure SCRUBS the subject row and keeps it — that is the erasure's contract with the data\n * subject, and it is unconditional: `eraseSubjectInPlace` refuses outright when the subject resource\n * declares no `retentionPolicy`. Since #976 the walk also descends below every dependent it deletes, so\n * a DELETE closure that comes back round to the subject's own type would delete the very row the\n * erasure promised to retain — and the receipt would still report it retained.\n *\n * That last part is why this refuses rather than skips. `SubjectErasureDescendantWalk`'s accounting is\n * written so a receipt can never OVERSTATE an erasure; deleting the scrubbed subject would overstate in\n * the one way nothing downstream can detect, because every edge reports exactly what it did.\n *\n * ## Why the sibling detector cannot do this\n *\n * {@link findSubjectErasureRetainDeleteConflicts} compares two EDGE dispositions. The subject's retention\n * is not an edge — no relationship declares it — so the subject's type is passed in here rather than\n * inferred. It is the whole reason this is a second function and not a case in the first.\n *\n * ## Measured 2026-09-17: the population is EMPTY, and that is the point\n *\n * In the engine's core graph `USERS` is never the CHILD of a composition. The one relationship naming it\n * second — `ORGANIZATIONS → USERS` — is a `RelationshipNature.ASSOCIATION` through\n * `ORGANIZATION_MEMBERS`, and an association carries no `onParentDelete` teardown, so no closure can\n * reach it. A guard over an empty population costs nothing at runtime and is exactly the shape worth\n * having: it cannot regress silently, and an application that later declares such an edge meets a\n * refusal before any read or write instead of an erasure that quietly contradicts itself.\n *\n * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.\n *\n * @param plannedEdges - every edge of ONE erasure, each carrying its classification.\n * @param subjectResourceType - the resource being erased, whose row is retained.\n * @returns the offending edges, in plan order. Empty is the healthy answer.\n */\n/**\n * Edges that DELETE a resource whose OWN `retentionPolicy` says an erasure keeps its rows (#1279).\n *\n * ## The contradiction\n *\n * A resource's `retentionPolicy` is the declaration whose entire subject is what an erasure does to\n * its rows, and the config factory refuses it unless it is paired with a `dataSubjectPolicy` — so it\n * is among the most deliberate statements an author makes. An edge that nevertheless AUTHORS\n * `onParentDelete.strategy: DELETE` says the opposite about the same rows. Nothing in the\n * configuration ranks the two, so an erasure must refuse rather than pick: deleting could destroy\n * data a retention obligation required keeping, and retaining could strand personal data the erasure\n * claimed to have removed. That is the same reasoning {@link findSubjectErasureRetainDeleteConflicts}\n * gives for refusing rather than defaulting, applied one level down — there between two EDGES, here\n * between an edge and the RESOURCE it points at.\n *\n * ## Why a DELETE disposition here is necessarily AUTHORED\n *\n * Since #1279 `classifySubjectErasureDisposition` applies the child's retention treatment whenever the\n * edge is SILENT, so a `DELETE` disposition toward a retain-declaring child can only have come from an\n * author writing `strategy: DELETE`. This filter therefore needs no second look at the declaration:\n * the invariant is expressed once, in the classifier, and read here. Do NOT re-derive \"was it\n * authored?\" from the relationship — that would be a second copy of the rule, free to drift.\n *\n * ## Measured population: ZERO, and that is the point\n *\n * Across `engine/`, `platform/` and `examples/` on 2026-09-17, 28 edges deleted a retain-declaring\n * resource and **not one of them authored `DELETE`** — every one reached that outcome through the\n * schema default this fix removed. So the shipped registry trips this detector nowhere, which is the\n * shape worth having: it cannot regress silently, and an application that later authors the\n * contradiction meets a refusal before any read or write rather than an erasure that quietly\n * contradicts its own declarations.\n *\n * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.\n *\n * @param plannedEdges - every edge of ONE erasure, each carrying its classification.\n * @param resolveChildRetentionPolicy - a resource type's declared `retentionPolicy`, or `undefined`.\n * @returns the offending edges, in plan order. Empty is the healthy answer.\n */\nexport function findSubjectErasureRetentionContradictedEdges<TEdge extends { classification: SubjectErasureEdgeClassification }>(\n  plannedEdges: readonly TEdge[],\n  resolveChildRetentionPolicy: (\n    resourceType: ResourceType,\n  ) => SubjectErasureChildRetentionDeclaration | undefined,\n): TEdge[] {\n  return plannedEdges.filter((edge) =>\n    edge.classification.disposition === SubjectErasureDisposition.DELETE\n    && resolveChildRetentionPolicy(edge.classification.childResourceType)?.mode !== undefined);\n}\n\nexport function findSubjectErasureSubjectTypeDeleteEdges<TEdge extends { classification: SubjectErasureEdgeClassification }>(\n  plannedEdges: readonly TEdge[],\n  subjectResourceType: string,\n): TEdge[] {\n  return plannedEdges.filter((edge) =>\n    edge.classification.disposition === SubjectErasureDisposition.DELETE\n    && String(edge.classification.childResourceType) === String(subjectResourceType));\n}\n"]}
+{"version":3,"file":"subject-erasure.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAE3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAiC,MAAM,oCAAoC,CAAC;AAOzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAI7E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,yBA2FX;AA3FD,WAAY,yBAAyB;IACnC;;;;;OAKG;IACH,8CAAiB,CAAA;IAEjB;;;;OAIG;IACH,kFAAqD,CAAA;IAErD;;;;;;;;OAQG;IACH,gFAAmD,CAAA;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,oFAAuD,CAAA;IAEvD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,0GAA6E,CAAA;IAE7E;;;;;OAKG;IACH,oDAAuB,CAAA;IAEvB;;;;;OAKG;IACH,0DAA6B,CAAA;IAE7B;;;;;OAKG;IACH,0EAA6C,CAAA;AAC/C,CAAC,EA3FW,yBAAyB,KAAzB,yBAAyB,QA2FpC;AAqCD,oEAAoE;AACpE,MAAM,qBAAqB,GAA2C,IAAI,GAAG,CAAC;IAC5E,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,oBAAoB;CAC/C,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAA2C,IAAI,GAAG,CAAC;IAC7E,yBAAyB,CAAC,MAAM;IAChC,yBAAyB,CAAC,wBAAwB;IAClD,yBAAyB,CAAC,oCAAoC;CAC/D,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAClD,WAAsC;IAEtC,OAAO,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,8BAA8B,CAAC,WAAsC;IAC5E,OAAO,WAAW,KAAK,yBAAyB,CAAC,wBAAwB;WACpE,WAAW,KAAK,yBAAyB,CAAC,oCAAoC,CAAC;AACtF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAsC;IAEtC,OAAO,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,UAAU,iCAAiC,CAC/C,YAAkC,EAClC,2BAEwD;IAExD,MAAM,iBAAiB,GAAG,YAAY,CAAC,aAA6B,CAAC;IACrE,MAAM,QAAQ,GAAG,CACf,WAAsC,EACtC,MAAc,EACoB,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpF,gGAAgG;IAChG,+FAA+F;IAC/F,uDAAuD;IACvD,IAAI,YAAY,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,QAAQ,CACb,yBAAyB,CAAC,SAAS,EACnC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,oCAAoC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAE7D,IAAI,cAAc,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5D,OAAO,QAAQ,CACb,yBAAyB,CAAC,SAAS,EACnC,0BAA0B,cAAc,2CAA2C;YACjF,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,oBAAoB;IACpB,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAC3F,YAAY,CACb,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,QAAQ,CACb,yBAAyB,CAAC,YAAY,EACtC,2FAA2F;YACzF,oFAAoF;YACpF,0FAA0F;YAC1F,oFAAoF;YACpF,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,IAAI,cAAc,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,QAAQ,CACb,yBAAyB,CAAC,uBAAuB,EACjD,0FAA0F;YACxF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,iGAAiG;IACjG,wEAAwE;IACxE,IAAI,cAAc,CAAC,QAAQ,KAAK,sBAAsB,CAAC,2BAA2B,EAAE,CAAC;QACnF,OAAO,QAAQ,CACb,yBAAyB,CAAC,yBAAyB,EACnD,gGAAgG;YAC9F,iGAAiG;YACjG,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,IAAI,kBAAkB,CAAC,SAAS,CAAC;IACjE,IAAI,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,QAAQ,CACb,yBAAyB,CAAC,oBAAoB,EAC9C,2BAA2B,IAAI,6DAA6D;YAC1F,yFAAyF;YACzF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC;IACjD,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;IAE5E,IAAI,oBAAoB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAEhD;;;;;;;;;;WAUG;QACH,IACE,oBAAoB,CAAC,kBAAkB,KAAK,SAAS;eAClD,CAAC,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,sBAAsB,CAAC,wBAAwB,CAAC,EAC3G,CAAC;YACD,OAAO,QAAQ,CACb,yBAAyB,CAAC,oCAAoC,EAC9D,2EAA2E,oBAAoB,CAAC,kBAAkB,CAAC,MAAM,MAAM;gBAC7H,kGAAkG;gBAClG,gGAAgG;gBAChG,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GACrB,aAAa,KAAK,oBAAoB,CAAC,wBAAwB;YAC7D,CAAC,CAAC,yBAAyB,CAAC,wBAAwB;YACpD,CAAC,CAAC,yBAAyB,CAAC,uBAAuB,CAAC;QAExD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,QAAQ,CACb,iBAAiB,EACjB,qDAAqD,aAAa,2BAA2B;gBAC3F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,sFAAsF,CACzF,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;WAgBG;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,QAAQ,GAAG,gBAAgB,IAAI,sBAAsB,CAAC,MAAM,CAAC;IACnE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,sBAAsB,CAAC,MAAM;YAChC,OAAO,QAAQ,CACb,yBAAyB,CAAC,MAAM,EAChC,0FAA0F;gBACxF,4CAA4C,CAC/C,CAAC;QAEJ,KAAK,sBAAsB,CAAC,wBAAwB;YAClD,OAAO,QAAQ,CACb,yBAAyB,CAAC,wBAAwB,EAClD,0FAA0F;gBACxF,6EAA6E,CAChF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,6FAA6F;YAC7F,mFAAmF;YACnF,MAAM,wBAAwB,GAAU,QAAQ,CAAC;YACjD,OAAO,QAAQ,CACb,yBAAyB,CAAC,YAAY,EACtC,uDAAuD;gBACrD,IAAI,MAAM,CAAC,wBAAwB,CAAC,uCAAuC,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,iCAAiC,CAC/C,uBAAqC,EACrC,kCAAsG,EACtG,2BAEwD;IAExD,MAAM,OAAO,GAAuC,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,OAAO,GAAmB,CAAC,uBAAuB,CAAC,CAAC;IAE1D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,EAAG,CAAC;QAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAAE,SAAS;QACrD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAEvC,KAAK,MAAM,YAAY,IAAI,kCAAkC,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;YACxF,MAAM,cAAc,GAAG,iCAAiC,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC;YACnE,IAAI,cAAc,CAAC,WAAW,KAAK,yBAAyB,CAAC,MAAM,EAAE,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,MAAM,UAAU,uCAAuC,CACrD,YAA8B;IAE9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqD,CAAC;IACpF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/D,IAAI,WAAW,KAAK,yBAAyB,CAAC,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,EAAE,CAAC;YACrG,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QACpH,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,WAAW,KAAK,yBAAyB,CAAC,MAAM;YAAE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YAChF,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3H,CAAC;AA2DD;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kCAmDX;AAnDD,WAAY,kCAAkC;IAC5C,sEAAsE;IACtE,6DAAuB,CAAA;IACvB;;;;OAIG;IACH,2EAAqC,CAAA;IACrC;;;;OAIG;IACH,yDAAmB,CAAA;IACnB,mGAAmG;IACnG,uDAAiB,CAAA;IACjB;;;OAGG;IACH,uEAAiC,CAAA;IAEjC;;;;OAIG;IACH,+DAAyB,CAAA;IAEzB;;;;;;;OAOG;IACH,2FAAqD,CAAA;IAErD;;;;;;;;;OASG;IACH,2FAAqD,CAAA;AACvD,CAAC,EAnDW,kCAAkC,KAAlC,kCAAkC,QAmD7C;AAED,gGAAgG;AAChG,MAAM,UAAU,wCAAwC,CACtD,MAA0C;IAE1C,OAAO,MAAM,KAAK,kCAAkC,CAAC,OAAO;WACvD,MAAM,KAAK,kCAAkC,CAAC,MAAM;WACpD,MAAM,KAAK,kCAAkC,CAAC,cAAc;WAC5D,MAAM,KAAK,kCAAkC,CAAC,UAAU;QAC3D,4FAA4F;QAC5F,kFAAkF;WAC/E,MAAM,KAAK,kCAAkC,CAAC,wBAAwB,CAAC;AAC9E,CAAC;AA0JD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAO/C;IACC,MAAM,UAAU,GAAyC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAA6C,EAAE,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc;YAC5C,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;YAC7C,aAAa,EAAE,SAAS,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,4CAA4C,CAC1D,YAA8B,EAC9B,2BAEwD;IAExD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,IAAI,CAAC,cAAc,CAAC,WAAW,KAAK,yBAAyB,CAAC,MAAM;WACjE,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,wCAAwC,CACtD,YAA8B,EAC9B,mBAA2B;IAE3B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,IAAI,CAAC,cAAc,CAAC,WAAW,KAAK,yBAAyB,CAAC,MAAM;WACjE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;AACtF,CAAC","sourcesContent":["import {\n  RelationshipLifecycleModel,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport {\n  ChildLifecycleMode,\n  ChildLifecycleStrategy,\n} from '../../resources/child-operations.shared.schemas';\nimport type { ResourceType } from '../../resources/resources.shared.core.definitions';\nimport { ErasureRetentionMode, type StatutoryRetentionGround } from './impersonalization.shared.schemas';\nimport type {\n  ApplicationRetentionSchedule,\n  DataRetentionClass,\n  ResourceRetentionBinding,\n  RetentionStartPoint,\n} from './retention-schedule.shared.schemas';\nimport { resolveRetentionExpiresAt } from './retention-binding.shared.utils';\nimport type { SubjectErasureLegalHoldRetention } from './legal-holds.shared.schemas';\nimport type { SubjectDataRecipientsStatement, SubjectErasureRecipientOutcome } from './subject-data-recipients.shared.schemas';\n\n/**\n * What a SUBJECT ERASURE does to one child-direction edge of the subject.\n *\n * ## Why this vocabulary exists at all\n *\n * \"Erase this subject\" (a `delete my account` request) is not \"delete this row\". The subject row\n * SURVIVES — scrubbed and marked `RETAINED` — so that foreign keys from legally-retained financial\n * rows keep resolving to an anonymized person. But the subject's OWN dependents must each be\n * disposed of, and the disposition differs per edge: a profile holding a name and an avatar has to\n * go, an invoice has to stay, an audit log was never the subject's to begin with.\n *\n * This enum is the closed set of answers, and it is deliberately WIDER than the two teardown\n * strategies of {@link ChildLifecycleStrategy}: the delete cascade only ever asks about edges that\n * opted IN (`onParentDelete.enabled === true`) and silently ignores the rest, whereas an erasure\n * must account for EVERY edge — including the ones nobody opted in — because an edge nobody thought\n * about is exactly where personal data survives an erasure unnoticed.\n *\n * Two members therefore have no runtime action and exist to make the erasure FAIL LOUD\n * ({@link UNCLASSIFIED}, {@link UNSUPPORTED_DEFERRED}), and three describe leaving a row alone for\n * three genuinely different reasons ({@link RETAINED_BY_DECLARATION}, {@link RESTRICTED_BY_DECLARATION},\n * {@link NOT_OWNED}). They are not merged despite sharing a no-op: a data-protection reviewer asking\n * \"why is this row still here?\" needs \"because the author declared it retained\", \"because its parent\n * may not be deleted while it exists\" and \"because it was never the subject's row\" to be different\n * answers, and only the first one is a retention claim someone made.\n */\nexport enum SubjectErasureDisposition {\n  /**\n   * Hard-delete the child rows. The author declared this dependent's data dies with the parent's\n   * ownership (`onParentDelete.enabled`, `strategy: DELETE`) — on an erasure the ownership ends in\n   * the only way that matters for personal data, so the rows go. This is the `USER_PROFILES` case:\n   * there is no legal obligation to retain a name, a bio or an avatar.\n   */\n  DELETE = 'delete',\n\n  /**\n   * Scrub the child rows' personal fields in place and KEEP them, flipping `retentionStatus` to\n   * `RETAINED` (`onParentDelete.strategy = IMPERSONALIZE_AND_RETAIN`). For a dependent that must\n   * survive for a legal/audit obligation while holding personal data of its own.\n   */\n  IMPERSONALIZE_AND_RETAIN = 'impersonalize_and_retain',\n\n  /**\n   * LEAVE THE ROWS EXACTLY AS THEY ARE — a dependent whose cascade the author explicitly DISABLED\n   * (`onParentDelete.enabled: false`). That declaration says \"this row survives its parent's\n   * teardown\", which is a positive compliance claim, not an omission.\n   *\n   * This is how the retained billing rows are expressed: subscriptions, invoice refs, usage records\n   * and credit pools each disable the cascade, keep their financial audit trail fully VISIBLE, and\n   * rely on the erased subject row still resolving their foreign keys.\n   */\n  RETAINED_BY_DECLARATION = 'retained_by_declaration',\n\n  /**\n   * LEAVE THE ROWS EXACTLY AS THEY ARE — a dependent whose edge declares the RESTRICT posture\n   * (`onParentDelete.strategy: REFUSE_WHILE_CHILDREN_EXIST`): the parent's delete is refused while\n   * these rows exist, and nothing about the parent's teardown removes them.\n   *\n   * An erasure scrubs its subject in place and never deletes it, so at the direct level the refusal is\n   * never met and the rows keep resolving their foreign key, as a retained row does. Below a dependent\n   * the erasure DELETES, the same edge holding rows refuses the erasure, as a delete cascade frame does,\n   * because deleting that parent would strand them. Kept apart from\n   * {@link RETAINED_BY_DECLARATION} because the claim differs: that one says \"these rows must outlive\n   * their parent\", this one says \"their parent may not go while they exist\". The second is about\n   * referential integrity (an org-unit subtree, the provider-customer mapping a billing account holds\n   * for its financial records), not a retention obligation.\n   *\n   * Like the other leave-alone dispositions, the erasure does not walk below these rows.\n   */\n  RESTRICTED_BY_DECLARATION = 'restricted_by_declaration',\n\n  /**\n   * KEEP THE ROWS, RESTRICTED, UNTIL THE LAW LETS THEM GO (#1635) — the child resource declares\n   * `retentionPolicy.statutoryRetention`: its rows are business records a statute requires kept, bound to\n   * `DataRetentionClass.BUSINESS_RECORDS`.\n   *\n   * GDPR Art. 17(3)(b) exempts them from erasure while the statutory period runs, and the erasure applies\n   * the Art. 18(2) restriction instead: each row takes the resource's declared `retentionPolicy.mode`\n   * treatment (scrubbed where the mode says so) and is flipped to `RETAINED`, which the retention\n   * row-hide chokepoints exclude from every ordinary read and write. The rows are LISTED in\n   * `SubjectErasureReport.restrictedUnderStatutoryRetention` with their ground and the instant their period\n   * ends, and the retention-class sweep deletes them then. Every other edge of the request is erased as\n   * usual — a statutory row never refuses the erasure.\n   *\n   * An EXECUTING disposition, like {@link IMPERSONALIZE_AND_RETAIN}, whose treatment it shares. Kept apart\n   * from it, and from {@link RETAINED_BY_DECLARATION}, because the CLAIM differs: those say the author chose\n   * to keep the rows; this says the law requires it, names the ground, and has an end. A reviewer asking\n   * \"why is this row still here, and until when?\" needs that difference in the receipt, not inferred.\n   *\n   * Like the other retain dispositions, the erasure does not walk below these rows: a kept row still\n   * anchors its own dependents.\n   */\n  RESTRICTED_UNDER_STATUTORY_RETENTION = 'restricted_under_statutory_retention',\n\n  /**\n   * LEAVE THE ROWS ALONE — the edge is not an ownership edge at all\n   * (`lifecycleModelMode` is `INDEPENDENT` or `LINK_ONLY`, or the relationship is disabled). The\n   * related rows live independently of the subject, so their disposition is not the subject's\n   * erasure to decide (audit logs, job executions, membership links).\n   */\n  NOT_OWNED = 'not_owned',\n\n  /**\n   * ⛔ NO ANSWER — a DEPENDENT child with NO `onParentDelete` declaration whatsoever. The author\n   * owns this dependent's lifecycle but never said what happens to it, and an erasure must not\n   * guess: deleting could destroy data a retention obligation required keeping, and leaving could\n   * strand personal data that the erasure claimed to have removed. The orchestrator throws.\n   */\n  UNCLASSIFIED = 'unclassified',\n\n  /**\n   * ⛔ DECLARED BUT NOT EXECUTABLE AS PART OF AN ERASURE — the edge opted in with\n   * `mode: LAZY` (queue the teardown for later). Deferring is a legitimate performance choice for a\n   * parent delete, but it would let an erasure report success while the subject's personal data is\n   * still live in a queue nobody is watching. The orchestrator throws.\n   */\n  UNSUPPORTED_DEFERRED = 'unsupported_deferred',\n}\n\n/** The classification of ONE child-direction edge of an erasure subject. */\nexport interface SubjectErasureEdgeClassification {\n  /** The dependent resource on the far side of the edge. */\n  childResourceType: ResourceType;\n  /** What the erasure will do with that dependent's rows. */\n  disposition: SubjectErasureDisposition;\n  /**\n   * Human-readable justification, quoting the configuration that produced it. Surfaced in the\n   * erasure report and in the fail-loud error, so an operator never has to re-derive WHY a row was\n   * deleted, retained, or refused.\n   */\n  reason: string;\n}\n\n/**\n * The only part of a child's `retentionPolicy` an erasure classification reads (#1279).\n *\n * Structural and minimal on purpose: the classifier needs the erasure TREATMENT and nothing else, and\n * narrowing the parameter to this keeps every caller — the runtime orchestrator, the registry sweep and\n * the boot-time guards, which each hold a differently-shaped configuration record — able to answer\n * without first building a full `ResourceRetentionPolicy` it does not otherwise need.\n *\n * `mode` is optional because a caller may legitimately hold a resource entry with no retention opt-in;\n * that is the same answer as passing `undefined` and means \"this child declares no erasure treatment\".\n */\nexport interface SubjectErasureChildRetentionDeclaration {\n  readonly mode?: ErasureRetentionMode;\n  /**\n   * The statutory ground the child keeps its rows on (#1635). Present only on a `BUSINESS_RECORDS`-bound\n   * resource — the resource factory refuses it anywhere else. Its presence is what turns the retain\n   * disposition into {@link SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION}.\n   */\n  readonly statutoryRetention?: { readonly ground: StatutoryRetentionGround };\n}\n\n/** Dispositions that ABORT the erasure rather than executing it. */\nconst BLOCKING_DISPOSITIONS: ReadonlySet<SubjectErasureDisposition> = new Set([\n  SubjectErasureDisposition.UNCLASSIFIED,\n  SubjectErasureDisposition.UNSUPPORTED_DEFERRED,\n]);\n\n/**\n * Dispositions whose edge the erasure DISPATCHES a teardown for — the ones whose `executed: false` means the\n * subject's data is partly still live, rather than that the rows were deliberately left alone (#1635).\n *\n * THE one list. It was re-derived by hand at four sites (the descendant walk's accounting, the executor's\n * decline log, the HTTP_API erasure-coherence check in the resources registry, and Wonder Todos'\n * COMPLETED/FAILED predicate), which is exactly how a new executing member would have been read as\n * \"left alone\" by the one site nobody updated.\n */\nconst EXECUTING_DISPOSITIONS: ReadonlySet<SubjectErasureDisposition> = new Set([\n  SubjectErasureDisposition.DELETE,\n  SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN,\n  SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION,\n]);\n\n/**\n * True when the erasure runs a teardown for an edge of this disposition, so `executed: false` on it is a\n * DECLINE — personal data possibly still live — and never an expected leave-alone. Read an edge's\n * `executed` through this, never through a hand-written list of members.\n */\nexport function isExecutingSubjectErasureDisposition(\n  disposition: SubjectErasureDisposition,\n): boolean {\n  return EXECUTING_DISPOSITIONS.has(disposition);\n}\n\n/**\n * Dispositions that KEEP the rows they reach while running a treatment on them — the retaining side of\n * {@link findSubjectErasureRetainDeleteConflicts}.\n */\nfunction isRetainingExecutedDisposition(disposition: SubjectErasureDisposition): boolean {\n  return disposition === SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN\n    || disposition === SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION;\n}\n\n/**\n * True when a disposition must stop the erasure before any write lands.\n *\n * Exported (rather than inlined at the one call site) so a future boot-time guard — the erasure\n * analogue of `validateCompositionCascadeDeletability` — reports exactly the edges the runtime\n * would refuse, instead of re-deriving the rule and drifting from it.\n */\nexport function isBlockingSubjectErasureDisposition(\n  disposition: SubjectErasureDisposition,\n): boolean {\n  return BLOCKING_DISPOSITIONS.has(disposition);\n}\n\n/**\n * Classify what a subject erasure must do with ONE child-direction edge — the delete-vs-retain\n * decision, DERIVED FROM CONFIGURATION rather than from a hardcoded list of resource types.\n *\n * ## Where the answer comes from\n *\n * Two declarations the author already makes, read through the SAME shared authority the runtime\n * delete cascade reads (`resolveRelationshipLifecycleOnParentDeleteConfig`), so the erasure and the\n * cascade can never disagree about what an edge says:\n *\n *  1. **`handling.lifecycleModelMode`** — does the subject own this dependent's lifecycle at all?\n *     `INDEPENDENT` / `LINK_ONLY` answers \"no\", and the erasure leaves those rows alone.\n *  2. **`childOperations.lifecycle.onParentDelete`** — for an owned dependent, what did the author\n *     declare happens when the parent stops owning it: hard-delete, scrub-and-retain, or nothing.\n *\n *  3. **the child's own `retentionPolicy`** — the ONE declaration whose entire subject is this\n *     question: *\"`retentionPolicy.mode` on a resource says WHAT erasure does to a row\"*\n *     (`retention-schedule.shared.schemas.ts`). Supplied through `resolveChildRetentionPolicy` so this\n *     function stays pure.\n *\n * ## The semantic caveat — CORRECTED 2026-09-17 (#1279), and the correction is the point\n *\n * `onParentDelete` literally answers \"what happens when the parent row is DELETED\", and an erasure\n * does NOT delete the subject — it scrubs and keeps it. This function used to treat the two questions\n * as one, on a stated premise: *\"they have the same answer for every edge in the shipped registry\"*.\n *\n * **That premise was false, and it had never been measured.** Measured across `engine/`, `platform/`\n * and `examples/`: 28 edges reached a `DELETE` erasure disposition while the child resource declared\n * `retentionPolicy` — i.e. an erasure deleting rows whose own resource says an erasure keeps them.\n *\n * What made it invisible was a SCHEMA DEFAULT. `strategy` carried\n * `.default(ChildLifecycleStrategy.DELETE)`, so every parsed edge presented `strategy: 'delete'` as an\n * own property whether or not a human had ever considered the question — and **28 of those 28 edges\n * reached DELETE through that default. Not one author had written `strategy: DELETE` for a\n * retain-declaring resource.** The default was removed (see `ChildLifecycleOnDeleteConfigSchema`), so\n * absence now arrives here intact and this function can tell a decision from a silence.\n *\n * ## The precedence, which decides no legal question\n *\n * | child `retentionPolicy` | this edge's `strategy` | disposition |\n * |---|---|---|\n * | declared (retain) | **absent** | the retain treatment — the author answered the ERASURE question and nobody answered the teardown one. A default may not overrule a declaration |\n * | declared (retain) | authored `DELETE` | `CONTRADICTED_BY_DECLARATIONS` — refused |\n * | declared (retain) | authored `IMPERSONALIZE_AND_RETAIN` | they agree; the edge's arm below runs |\n * | none | anything, including absent | unchanged — no erasure declaration exists to honour |\n *\n * Note what is deliberately NOT done: \"retain wins\" is not made a blanket default over an AUTHORED\n * `DELETE`. {@link findSubjectErasureRetainDeleteConflicts} rejects exactly that reasoning for the\n * edge-vs-edge case — *it decides a legal question on the author's behalf; neither default is safe, so\n * no default* — and that rejection stands here. Deleting data a retention obligation required keeping\n * and stranding data an erasure claimed to have removed are both unsafe, and nothing in the\n * configuration says which the author meant. The only thing that changed is that a SCHEMA DEFAULT may\n * no longer impersonate an author's decision.\n *\n * A sibling `onSubjectErasure` axis on the edge was reconsidered and stays rejected: `retentionPolicy`\n * already IS the erasure axis, and adding a second one would give app authors two ways to say the same\n * thing — the objection the previous version of this note raised against it, which survives its own\n * premise being wrong.\n *\n * Pure and side-effect free — no registry lookups, no I/O — so it is equally usable from a runtime\n * orchestrator and from a boot-time guard.\n */\nexport function classifySubjectErasureDisposition(\n  relationship: ResourceRelationship,\n  resolveChildRetentionPolicy: (\n    resourceType: ResourceType,\n  ) => SubjectErasureChildRetentionDeclaration | undefined,\n): SubjectErasureEdgeClassification {\n  const childResourceType = relationship.resourceType2 as ResourceType;\n  const classify = (\n    disposition: SubjectErasureDisposition,\n    reason: string,\n  ): SubjectErasureEdgeClassification => ({ childResourceType, disposition, reason });\n\n  // A disabled relationship is not part of the live graph — the runtime never traverses it, so an\n  // erasure must not refuse to run because of it (the alternative would be a permanently blocked\n  // erasure on a resource carrying a switched-off edge).\n  if (relationship.isDisabled === true) {\n    return classify(\n      SubjectErasureDisposition.NOT_OWNED,\n      'the relationship is disabled (isDisabled: true), so it is not part of the live graph',\n    );\n  }\n\n  const semantics = Resources_SharedUtils.requireResolvedRelationshipSemantics(relationship);\n  const lifecycleModel = semantics.handling.lifecycleModelMode;\n\n  if (lifecycleModel !== RelationshipLifecycleModel.DEPENDENT) {\n    return classify(\n      SubjectErasureDisposition.NOT_OWNED,\n      `lifecycleModelMode is '${lifecycleModel}' (not DEPENDENT): the related rows live ` +\n        `independently of the subject, so their disposition is not this erasure's decision`,\n    );\n  }\n\n  // DEPENDENT from here on: the subject owns this dependent's lifecycle, so the erasure MUST have\n  // an answer for it.\n  const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(\n    relationship,\n  );\n\n  if (!onParentDelete) {\n    return classify(\n      SubjectErasureDisposition.UNCLASSIFIED,\n      `the subject owns this dependent (lifecycleModelMode: DEPENDENT) but the edge declares no ` +\n        `onParentDelete lifecycle, so nobody has said whether its rows survive an erasure. ` +\n        `Declare onParentDelete on the edge: 'enabled: true' with strategy DELETE (the rows hold ` +\n        `no retainable value) or IMPERSONALIZE_AND_RETAIN (they must survive scrubbed), or ` +\n        `'enabled: false' to state explicitly that they survive intact`,\n    );\n  }\n\n  /*\n   * ## DECIDED 2026-09-17 (#1084): this is NOT reconciled against a DELETE path, and that is correct\n   *\n   * The question was whether a resource reached BOTH by this disposition and by a DELETE edge should\n   * be refused the way #1017 refuses `IMPERSONALIZE_AND_RETAIN` against `DELETE`. It should not, and\n   * the reason is that the two cases are not alike.\n   *\n   * #1017 refuses because TWO EXECUTED TREATMENTS disagree about the same row: one scrubs it and keeps\n   * it, the other removes it, and nothing says which wins. `enabled: false` executes nothing. The\n   * erasure never traverses this edge and never discovers these rows, so there is no competing\n   * treatment to reconcile — only one edge that acts and one that says nothing. A row with two parents\n   * that survives one teardown and dies with the other is also exactly what an ordinary parent delete\n   * does, so refusing here would make an erasure stricter than the lifecycle it is built on.\n   *\n   * Refusing was the filed recommendation and is rejected for a further reason: the #1017 refusal's own\n   * remedy tells an operator to \"disable one edge's teardown (onParentDelete.enabled: false)\". Treating\n   * the result as a new conflict would make the documented remedy produce the next refusal.\n   *\n   * What this disposition means is therefore narrower than its name suggests, and worth saying plainly:\n   * it records that THIS EDGE does not cascade, not that the rows are guaranteed to survive the\n   * erasure. Another path may still delete them, and that path's declaration is the one that decides.\n   */\n  if (onParentDelete.enabled !== true) {\n    return classify(\n      SubjectErasureDisposition.RETAINED_BY_DECLARATION,\n      'onParentDelete.enabled is false: the author declared these rows survive their parent\\'s ' +\n        'teardown, so the erasure leaves them intact',\n    );\n  }\n\n  // The RESTRICT posture is read BEFORE the mode: it tears nothing down, so there is no teardown to\n  // defer, and a `mode: LAZY` written beside it must not turn a leave-alone edge into a blocking one.\n  // After this return TypeScript narrows `strategy` below to the teardown members, so the switch's\n  // exhaustiveness check still turns any FUTURE member into a type error.\n  if (onParentDelete.strategy === ChildLifecycleStrategy.REFUSE_WHILE_CHILDREN_EXIST) {\n    return classify(\n      SubjectErasureDisposition.RESTRICTED_BY_DECLARATION,\n      'onParentDelete declares strategy REFUSE_WHILE_CHILDREN_EXIST: the parent\\'s delete is refused ' +\n        'while these rows exist, and an erasure scrubs the subject in place rather than deleting it, so ' +\n        'the erasure leaves the rows intact',\n    );\n  }\n\n  const mode = onParentDelete.mode ?? ChildLifecycleMode.IMMEDIATE;\n  if (mode !== ChildLifecycleMode.IMMEDIATE) {\n    return classify(\n      SubjectErasureDisposition.UNSUPPORTED_DEFERRED,\n      `onParentDelete.mode is '${mode}': deferring the teardown to a queue would let the erasure ` +\n        `report success while the subject's personal data is still live. Set mode: IMMEDIATE on ` +\n        `this edge for it to participate in a subject erasure`,\n    );\n  }\n\n  /*\n   * #1279 — the child's OWN erasure declaration is consulted BEFORE the edge's teardown strategy.\n   *\n   * ## Why this sits AFTER the deferral check, deliberately\n   *\n   * `mode: LAZY` is read above and refuses first, so a deferred edge never reaches the retention\n   * question. The alternative — letting a retain policy rescue a LAZY edge, the way the RESTRICT\n   * posture is read before `mode` — was considered and REJECTED: RESTRICT tears nothing down, so\n   * there is genuinely no teardown to defer, while `RETAIN_AND_IMPERSONALIZE` is an ACTION (the\n   * in-place scrub), and an erasure that defers its own scrub reports success while personal data is\n   * still live. Refusing is the fail-closed answer and the one an operator can act on.\n   *\n   * Measured 2026-09-17: the shipped registry declares ZERO `mode: LAZY` edges, so this ordering is\n   * currently unobservable. It is written down rather than left to be re-derived by whoever declares\n   * the first one.\n   *\n   * `strategy` is read RAW here, never through `resolveChildLifecycleTeardownStrategy`. That helper\n   * resolves absence to DELETE for the CASCADE, where the premise \"the parent row is gone\" makes it\n   * correct. An erasure keeps the parent row, so the premise is false and the resolution would be a\n   * manufactured answer — which is precisely the defect this replaces.\n   */\n  const authoredStrategy = onParentDelete.strategy;\n  const childRetentionPolicy = resolveChildRetentionPolicy(childResourceType);\n\n  if (childRetentionPolicy?.mode !== undefined) {\n    const retentionMode = childRetentionPolicy.mode;\n\n    /*\n     * #1635 — a STATUTORY ground outranks the author's own retain choice, and agrees with an authored\n     * IMPERSONALIZE_AND_RETAIN: both keep the rows; the ground adds WHY and UNTIL WHEN. The treatment the\n     * executor runs is the same retain-and-scrub core, and under `RETAIN_ONLY` it scrubs nothing and still\n     * flips the row to RETAINED — which RETAINED_BY_DECLARATION would not do: that disposition leaves rows\n     * exactly as they are, VISIBLE, and a statutory row must be restricted, not merely left.\n     *\n     * An authored DELETE is NOT absorbed here: it falls through to the switch and is refused by\n     * `findSubjectErasureRetentionContradictedEdges`, for the reason on that function — two declarations\n     * disagree about the same rows and nothing ranks them.\n     */\n    if (\n      childRetentionPolicy.statutoryRetention !== undefined\n      && (authoredStrategy === undefined || authoredStrategy === ChildLifecycleStrategy.IMPERSONALIZE_AND_RETAIN)\n    ) {\n      return classify(\n        SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION,\n        `the child resource declares retentionPolicy.statutoryRetention (ground '${childRetentionPolicy.statutoryRetention.ground}'): ` +\n          `its rows are business records a statute requires kept, so the erasure keeps each row inside its ` +\n          `statutory period RESTRICTED (retained, hidden from ordinary processing) and lists it with the ` +\n          `instant its period ends; the retention-class sweep deletes it then`,\n      );\n    }\n\n    const retainDisposition =\n      retentionMode === ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE\n        ? SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN\n        : SubjectErasureDisposition.RETAINED_BY_DECLARATION;\n\n    if (authoredStrategy === undefined) {\n      return classify(\n        retainDisposition,\n        `the child resource declares retentionPolicy.mode '${retentionMode}' — the declaration that ` +\n          `states what an erasure does to its rows — and this edge authors no onParentDelete.strategy, ` +\n          `so nothing contradicts it. The erasure applies the declared retention treatment rather than ` +\n          `the teardown the delete cascade would apply, because an erasure keeps the parent row`,\n      );\n    }\n\n    /*\n     * An AUTHORED strategy is left to the switch below, deliberately — including an authored DELETE,\n     * which CONTRADICTS this retention policy.\n     *\n     * Refusing it here as a per-edge disposition was implemented first and REVERTED, because a\n     * blocking disposition is refused by the orchestrator BEFORE the plan-level detectors run: it\n     * shadowed {@link findSubjectErasureRetainDeleteConflicts} (#1017) and\n     * {@link findSubjectErasureSubjectTypeDeleteEdges} (#1085), whose refusals name both offending\n     * edges and the resource, with a generic \"no executable disposition\" message. Two purpose-built,\n     * mutation-proven refusals became unreachable for their whole population — every shape they\n     * detect requires the child to declare a `retentionPolicy`, so every one of them is also this\n     * contradiction.\n     *\n     * A contradiction is a relation between TWO declarations, which is what a plan-level detector\n     * models and what a single edge's disposition cannot. It therefore lives beside its siblings, as\n     * {@link findSubjectErasureRetentionContradictedEdges}.\n     */\n  }\n\n  /*\n   * The residual, named rather than left to look like an inconsistency with everything above.\n   *\n   * A child that declares NO `retentionPolicy` and sits on a SILENT edge has had nothing said about it\n   * in either field, and here absence still resolves to DELETE — the reading the engine has always\n   * had, that a dependent's data has no life of its own once the subject's ownership does not. 33\n   * children are in that position (measured 2026-09-17), and the alternative was to refuse all 33 as\n   * UNCLASSIFIED until someone authored a declaration for each.\n   *\n   * That was rejected for the reason `application-creation-directive.md` gives: the remedy would be\n   * \"an author decides something\", which makes an erasure impossible to run until a large authoring\n   * backlog is cleared, and #1279 was about an erasure doing the WRONG thing, not about it being\n   * under-declared. The narrow fix is the one that keeps the correction checkable.\n   *\n   * What changed is precise and worth stating: silence no longer overrules a DECLARATION. It still\n   * carries the historical default where there is no declaration to overrule. If this project later\n   * wants that last case explicit too, the place for it is a per-edge `onSubjectErasure` axis, and\n   * the argument against adding one speculatively is in this function's header.\n   */\n  const strategy = authoredStrategy ?? ChildLifecycleStrategy.DELETE;\n  switch (strategy) {\n    case ChildLifecycleStrategy.DELETE:\n      return classify(\n        SubjectErasureDisposition.DELETE,\n        'onParentDelete declares strategy DELETE: the dependent\\'s data dies with the subject\\'s ' +\n          'ownership, so the erasure removes the rows',\n      );\n\n    case ChildLifecycleStrategy.IMPERSONALIZE_AND_RETAIN:\n      return classify(\n        SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN,\n        'onParentDelete declares strategy IMPERSONALIZE_AND_RETAIN: the rows survive the erasure ' +\n          'with their personal fields scrubbed and retentionStatus flipped to RETAINED',\n      );\n\n    default: {\n      // Compile-time exhaustiveness: a new ChildLifecycleStrategy member without an erasure arm is\n      // a TYPE error here, not a silent runtime discovery on someone's deletion request.\n      const _exhaustiveStrategyCheck: never = strategy;\n      return classify(\n        SubjectErasureDisposition.UNCLASSIFIED,\n        `onParentDelete declares an unknown teardown strategy ` +\n          `'${String(_exhaustiveStrategyCheck)}' that subject erasure has no arm for`,\n      );\n    }\n  }\n}\n\n/**\n * One DESCENDANT edge an erasure must account for — an edge below the subject's direct dependents,\n * planned from configuration before anything runs (#976).\n *\n * `parentResourceType` is the resource whose rows the erasure tears down and that owns this edge;\n * the classification is the same one a direct edge gets, from the same shared classifier, so a\n * descendant and a direct edge can never disagree about what an identical declaration means.\n */\nexport interface SubjectErasureDescendantEdgePlan {\n  /** The edge itself, as the parent resource's configuration declares it. */\n  relationship: ResourceRelationship;\n  /** The resource that owns this edge — its rows are the ones being torn down above it. */\n  parentResourceType: ResourceType;\n  classification: SubjectErasureEdgeClassification;\n}\n\n/**\n * Plan every DESCENDANT edge a subject erasure walks below ONE direct dependent (#976).\n *\n * ## What an erasure walks, and why exactly that\n *\n * - **Below a `DELETE` edge — everything, at every depth, regardless of `maxDepth`.** The rows are\n *   gone, so whatever depended on them has lost its owner; an erasure that stops at a depth budget\n *   leaves the subject's data one level down with nothing left to reach it. `maxDepth` is a\n *   parent-DELETE performance budget and keeps meaning exactly that on the delete cascade.\n * - **Below an `IMPERSONALIZE_AND_RETAIN` or `RESTRICTED_UNDER_STATUTORY_RETENTION` edge — nothing.**\n *   The retained row survives, scrubbed where its mode says so, so\n *   its own dependents still have their owner and remain bound to THAT row's future lifecycle. The\n *   retention obligation that keeps the row is the obligation that keeps what hangs off it; tearing\n *   those down would destroy records a legal obligation required keeping, and scrubbing them would\n *   need a declaration nobody made. This matches the cascade itself, whose retain arm never recurses.\n * - **Below `RETAINED_BY_DECLARATION` / `NOT_OWNED` — nothing.** The rows are not touched.\n *\n * Every child-direction edge of every walked resource is returned — including the ones that do\n * nothing — because the receipt is total over what the erasure walked, exactly as it is at the\n * direct level. A blocking classification anywhere in the plan must refuse the erasure BEFORE its\n * transaction opens; returning it (rather than throwing here) lets the caller name every one.\n *\n * ## Termination\n *\n * The walk is over RESOURCE TYPES, not rows, so each type's edges are planned once: a self-referential\n * edge (a folder of folders) or a cycle between types terminates here, while the row-level cascade\n * keeps its own visited-row guard.\n *\n * Pure: the caller supplies the lookup, so a boot-time guard can run the same planner the runtime\n * does rather than re-deriving it.\n *\n * @param directChildResourceType - the far side of the subject's direct `DELETE` edge.\n * @param resolveChildDirectionRelationships - the child-direction edges of a resource type, or\n *   `undefined` when the type has no configuration in this process (nothing is planned below it; the\n *   runtime cascade then declines that edge and reports it as not executed).\n * @param resolveChildRetentionPolicy - a resource type's declared `retentionPolicy`, or `undefined`\n *   when it declares none. Injected for the same reason as the lookup above: it keeps this planner\n *   pure, so a boot-time guard classifies a descendant edge exactly as the runtime will (#1279).\n */\nexport function planSubjectErasureDescendantEdges(\n  directChildResourceType: ResourceType,\n  resolveChildDirectionRelationships: (resourceType: ResourceType) => ResourceRelationship[] | undefined,\n  resolveChildRetentionPolicy: (\n    resourceType: ResourceType,\n  ) => SubjectErasureChildRetentionDeclaration | undefined,\n): SubjectErasureDescendantEdgePlan[] {\n  const planned: SubjectErasureDescendantEdgePlan[] = [];\n  const walked = new Set<string>();\n  const pending: ResourceType[] = [directChildResourceType];\n\n  while (pending.length > 0) {\n    const parentResourceType = pending.shift()!;\n    if (walked.has(String(parentResourceType))) continue;\n    walked.add(String(parentResourceType));\n\n    for (const relationship of resolveChildDirectionRelationships(parentResourceType) ?? []) {\n      const classification = classifySubjectErasureDisposition(relationship, resolveChildRetentionPolicy);\n      planned.push({ relationship, parentResourceType, classification });\n      if (classification.disposition === SubjectErasureDisposition.DELETE) {\n        pending.push(classification.childResourceType);\n      }\n    }\n  }\n\n  return planned;\n}\n\n/**\n * One resource an erasure's plan reaches both to KEEP its rows and to DELETE them (#1017).\n *\n * `TEdge` is whatever the caller planned — a direct edge, a descendant edge, or its own record of either —\n * so the orchestrator can name the edges the way its refusal already names unresolved ones.\n */\nexport interface SubjectErasureRetainDeleteConflict<TEdge> {\n  /** The resource on the far side of every edge below. */\n  resourceType: ResourceType;\n  /**\n   * Edges that keep these rows under a treatment (`IMPERSONALIZE_AND_RETAIN`, or\n   * `RESTRICTED_UNDER_STATUTORY_RETENTION` since #1635), in plan order.\n   */\n  retainingEdges: TEdge[];\n  /** Edges that hard-delete these rows (`DELETE`), in plan order. */\n  deletingEdges: TEdge[];\n}\n\n/**\n * Find every resource a subject erasure's WHOLE plan reaches through both a retaining edge and a deleting\n * edge (#1017). The erasure REFUSES before its transaction opens when this returns anything.\n *\n * ## The shape\n *\n * Each edge applies its own declared treatment to the rows it reaches: `DELETE` hard-deletes them,\n * `IMPERSONALIZE_AND_RETAIN` scrubs them and keeps them. Two DIFFERENT paths can reach the same resource — a\n * `people → records` retain edge beside `people → profiles → notes → records` delete, or two edges on one\n * resource through two foreign keys — and nothing in either declaration says what happens to a row BOTH\n * reach. Before this, the answer was the walk order: a row kept by the retain edge could still be deleted\n * when the delete edge's cascade got there, and #976 could only make the receipt admit it (`executed: false`).\n *\n * ## Why REFUSE, and why at the level of resource types\n *\n * The two declarations contradict each other for the rows they share, and neither outranks the other in\n * configuration. Refusing is the one answer that needs no new meaning: it surfaces the contradiction to the\n * author, who owns both declarations and can make them agree — declare the delete edge\n * `IMPERSONALIZE_AND_RETAIN` too, declare the retain edge `DELETE`, or disable one edge's teardown\n * (`onParentDelete.enabled: false`) — on the ground the legal obligation actually gives.\n *\n * The check is over resource TYPES, not rows, on purpose. Whether two edges share a row is only knowable by\n * reading rows, which the pre-flight must not do (every refusal here lands before the first read and write),\n * and it changes as rows are written, so a row-level \"no overlap today\" would be a guess about the future.\n * An edge pair that can never share a row in practice is still refused; the remedy is the same one-edge edit.\n *\n * ## Rejected: a precedence where retain wins\n *\n * \"Keep a row whenever any edge retains it\" was considered and rejected, for three reasons:\n *\n * - **It decides a legal question on the author's behalf.** A `DELETE` edge is a declaration too — that the\n *   rows hold nothing worth keeping once their owner is gone. GDPR Art. 17(3) lists the grounds on which the\n *   right to erasure does not apply (a legal obligation, the defence of legal claims, archiving, …), and\n *   Art. 5(2) makes the controller \"responsible for, and be able to demonstrate compliance with\" the\n *   principles. Keeping personal data an explicit declaration said to remove therefore needs a ground the\n *   controller can name, and a framework default names none. \"Delete wins\" fails the other way, destroying\n *   records a retention obligation required keeping. Neither default is safe, so no default.\n *   spec-cite: Regulation (EU) 2016/679, Art. 5(2) (accountability) and Art. 17(3)(a)–(e) (exceptions to the right to erasure).\n * - **Only its row-level form is faithful, and that form cannot be decided before the transaction.** A\n *   TYPE-level \"retain wins\" could be decided pre-flight, but it would keep every row of the resource,\n *   including rows only the delete edge reaches and the retain edge never touches — rows no retention\n *   declaration covers. The faithful rule is ROW-level: the delete walk skips each row a retain edge kept and\n *   prunes everything it planned below that row (a kept row still anchors its own dependents), per row,\n *   mid-transaction. The pre-flight plan is over types and cannot express that, so the\n *   refusal-before-any-write guarantee the rest of the erasure keeps would be lost.\n * - **It adds a meaning with no vocabulary for its opposite.** Once precedence exists, an author who needs\n *   the delete to win has no way to say so.\n *\n * ## What is NOT a conflict\n *\n * Only `DELETE` against a retaining treatment the erasure EXECUTES — `IMPERSONALIZE_AND_RETAIN`, and\n * `RESTRICTED_UNDER_STATUTORY_RETENTION` (#1635), which keeps its rows by the same treatment. Two deleting or\n * two retaining edges agree. `NOT_OWNED` rows are not the subject's, and the erasure never discovers them.\n * Two cases are deliberately NOT refused here. Each is an open decision, not an answer this rule gives:\n *\n * - **(a) A `RETAINED_BY_DECLARATION` dependent beside a `DELETE` path to the same resource (#1084).** The\n *   erasure never discovers `enabled: false` rows, and a row with two parents that survives one teardown and\n *   dies with the other is also what an ordinary parent delete does. **DECIDED 2026-09-17: this stays out.**\n *   `enabled: false` executes nothing, so there are not two treatments to reconcile — and the refusal below\n *   names `onParentDelete.enabled: false` as its own remedy, so counting it as a conflict would make that\n *   remedy produce the next refusal. The full argument is at the classification site.\n * - **(b) A delete closure that cycles back to the SUBJECT's own resource type while the subject row is\n *   retained (#1085).** The subject's retention is the erasure's own final step (the scrub), not an edge, so\n *   this detector — which reads only edges — cannot see it. **CLOSED 2026-09-17 by\n *   {@link findSubjectErasureSubjectTypeDeleteEdges}**, a sibling that takes the subject's own type as an\n *   argument precisely because it is not derivable from the edges.\n *\n * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.\n *\n * @param plannedEdges - every edge of ONE erasure: the subject's direct edges AND every descendant edge\n *   planned below its deleted dependents, each carrying its classification.\n * @returns one entry per conflicting resource, in the order the resource is first reached.\n */\nexport function findSubjectErasureRetainDeleteConflicts<TEdge extends { classification: SubjectErasureEdgeClassification }>(\n  plannedEdges: readonly TEdge[],\n): Array<SubjectErasureRetainDeleteConflict<TEdge>> {\n  const byResourceType = new Map<string, SubjectErasureRetainDeleteConflict<TEdge>>();\n  for (const edge of plannedEdges) {\n    const { disposition, childResourceType } = edge.classification;\n    if (disposition !== SubjectErasureDisposition.DELETE && !isRetainingExecutedDisposition(disposition)) {\n      continue;\n    }\n    const key = String(childResourceType);\n    const entry = byResourceType.get(key) ?? { resourceType: childResourceType, retainingEdges: [], deletingEdges: [] };\n    byResourceType.set(key, entry);\n    if (disposition === SubjectErasureDisposition.DELETE) entry.deletingEdges.push(edge);\n    else entry.retainingEdges.push(edge);\n  }\n  return [...byResourceType.values()].filter((entry) => entry.retainingEdges.length > 0 && entry.deletingEdges.length > 0);\n}\n\n/**\n * What happened on ONE descendant edge of an executed erasure (#976) — reported exactly like a direct\n * edge: its disposition, the configuration that justified it, and whether its teardown ran.\n */\nexport interface SubjectErasureDescendantEdgeOutcome extends SubjectErasureEdgeClassification {\n  /** The resource that owns this edge. */\n  parentResourceType: ResourceType;\n  /**\n   * `true` when every teardown the erasure reached on this edge ran, `false` when any was declined, when\n   * this DELETE edge reached rows an earlier retain edge of the same walk scrubbed and KEPT (they are not\n   * gone, whatever this edge declares — unreachable since #1017, which refuses a plan that retains and deletes\n   * one resource before it runs, and kept as defence in depth), or when an edge ABOVE it was declined (its rows were then never\n   * walked, so nothing can be said about what they still hold). `false` on a non-executing disposition\n   * is expected, as on a direct edge.\n   *\n   * An executing edge the walk never had to dispatch — its parent resource had no rows of the subject's\n   * left to tear down — is `true`: that is a teardown with nothing to do, not a decline.\n   */\n  executed: boolean;\n}\n\n/** Per-edge outcome of an executed erasure — the classification plus what actually happened. */\nexport interface SubjectErasureEdgeOutcome extends SubjectErasureEdgeClassification {\n  /**\n   * Every edge below this one that the erasure walked, flat and in plan order (#976). Empty for a\n   * non-executing disposition and for `IMPERSONALIZE_AND_RETAIN`, which retains its rows and therefore\n   * does not walk below them — see {@link planSubjectErasureDescendantEdges}.\n   */\n  descendantEdges: SubjectErasureDescendantEdgeOutcome[];\n  /**\n   * `true` when the erasure ran a teardown for this edge AND for every descendant edge below it whose\n   * disposition executes (#976). A declined descendant therefore makes its direct edge `false`: a\n   * reader who only counts direct edges must not read a subtree that still holds live data as erased.\n   * {@link descendantEdges} says which descendant it was.\n   *\n   * Reports that the teardown RAN, not that rows existed — discovery finding no dependents is a\n   * teardown that ran with nothing to do, and is `true`.\n   *\n   * **Read it together with `disposition`, because `false` has two very different meanings:**\n   *\n   * - a NON-executing disposition (`RETAINED_BY_DECLARATION`, `NOT_OWNED`) ⇒ the erasure deliberately\n   *   left the rows alone, and `false` is the expected, correct answer;\n   * - an EXECUTING disposition (`DELETE`, `IMPERSONALIZE_AND_RETAIN`) ⇒ the cascade DECLINED the edge\n   *   (the child had no registered service or repository), or an edge BELOW it did not tear its rows\n   *   down (see `descendantEdges`) — declined the same way, or a DELETE edge that reached rows an\n   *   earlier retain edge of the walk kept. An erasure never spends a depth budget — it walks every\n   *   descendant. The subject's data is partly still live. This pairing should never appear in a\n   *   healthy system; it is logged at ERROR when it happens, naming the missing registration or the\n   *   descendant edges concerned.\n   *\n   * ⚠️ This flag was set unconditionally until 2026-08-11 — it meant \"the dispatcher returned without\n   * throwing\" and reported a skipped edge as torn down. Anything persisted before that date overstates\n   * what was erased. Treat this field as evidence only for reports produced after the fix.\n   */\n  executed: boolean;\n}\n\n/**\n * Outcome of one EXTERNAL, non-transactional erasure effect (a third-party provider the subject's\n * personal data also reached — a billing provider customer, say).\n *\n * A separate vocabulary from {@link SubjectErasureDisposition} on purpose. An edge disposition\n * describes a decision derived from configuration BEFORE anything ran, and its teardown is part of\n * the database transaction. An external effect is the opposite on both counts: it is discovered by\n * calling out to a system Wildo does not own, and it CANNOT join the transaction. Collapsing the\n * two would let a caller read \"the erasure succeeded\" from a value that only ever described the\n * local rows.\n */\nexport enum SubjectErasureExternalEffectStatus {\n  /** Every step of the effect completed against the external system. */\n  COMPLETED = 'completed',\n  /**\n   * The subject had nothing at this external system — no provider customer, no linked record. A\n   * legitimate success, kept DISTINCT from `COMPLETED` so \"there was nothing to erase\" can never be\n   * mistaken for \"we erased it\", which is exactly the confusion a regulator would probe.\n   */\n  NOTHING_TO_ERASE = 'nothing-to-erase',\n  /**\n   * The effect ran and some steps succeeded while others failed — personal data may still be live\n   * at the external system. The loudest state in this enum: it demands follow-up, and it is why the\n   * status is not a boolean.\n   */\n  PARTIAL = 'partial',\n  /** The effect could not run at all (provider unreachable, not configured). Nothing was changed. */\n  FAILED = 'failed',\n  /**\n   * No handler was registered for this effect. Distinct from `NOTHING_TO_ERASE`: that means we\n   * looked and found nothing, this means nobody looked.\n   */\n  NOT_REGISTERED = 'not-registered',\n\n  /**\n   * A bound external-effects port returned no usable report. The local erasure committed, but\n   * external outcomes are UNKNOWN: neither no work nor no change can be inferred. Incomplete;\n   * reconcile provider state before retrying work that may already have succeeded.\n   */\n  UNMEASURED = 'unmeasured',\n\n  /**\n   * The external system's binding DECLARES its rows hold no personal/subject data\n   * (`HttpApiErasureStance.NO_SUBJECT_DATA`, ETL D6 stance 6a) — nothing was erased because,\n   * by declaration, there is nothing an erasure could apply to. Distinct from\n   * {@link NOTHING_TO_ERASE}: that means we LOOKED and found no linked rows; this means the\n   * declaration made looking unnecessary. A complete outcome — the declaration's coherence is\n   * validated at boot (a 6a resource cannot participate in subject export).\n   */\n  DECLARED_NO_SUBJECT_DATA = 'declared-no-subject-data',\n\n  /**\n   * The rows live in an external system the platform cannot erase, and the CONTROLLER explicitly\n   * acknowledged completing the erasure anyway (`HttpApiErasureStance.\n   * CONTROLLER_ACKNOWLEDGED_NON_ERASURE`, ETL D6 stance 6c — the per-request\n   * `acknowledgeHttpApiNonErasure` option). Deliberately INCOMPLETE in\n   * {@link isIncompleteSubjectErasureExternalEffect}: the subject's data is still live at the\n   * third party, and a compliance artifact must say so however deliberate the decision was. The\n   * acknowledgement itself is additionally recorded as a CRITICAL audit event — the record is\n   * the control (`administrative-continuity-floors.md`).\n   */\n  ACKNOWLEDGED_NON_ERASURE = 'acknowledged-non-erasure',\n}\n\n/** Whether an external-effect status leaves personal data potentially live at a third party. */\nexport function isIncompleteSubjectErasureExternalEffect(\n  status: SubjectErasureExternalEffectStatus,\n): boolean {\n  return status === SubjectErasureExternalEffectStatus.PARTIAL\n    || status === SubjectErasureExternalEffectStatus.FAILED\n    || status === SubjectErasureExternalEffectStatus.NOT_REGISTERED\n    || status === SubjectErasureExternalEffectStatus.UNMEASURED\n    // An acknowledged non-erasure is a DELIBERATE hole, and still a hole: personal data remains\n    // live at the third party, so \"is this erasure actually complete\" must answer no.\n    || status === SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE;\n}\n\nexport interface SubjectErasureExternalEffectOutcome {\n  /** Stable identifier of the effect, e.g. `'billing-provider'`. */\n  effectRef: string;\n  status: SubjectErasureExternalEffectStatus;\n  /**\n   * Human-readable account of what ran, for the compliance artifact. On `PARTIAL` / `FAILED` this\n   * must name what did NOT happen — the report is the only place that survives the request.\n   */\n  detail: string;\n  /**\n   * Per-step results, so a partial outcome is actionable rather than merely alarming (which step\n   * against which external id). Never carries personal data — ids and step names only.\n   */\n  steps?: Array<{ step: string; targetRef?: string; succeeded: boolean; error?: string }>;\n}\n\n/**\n * What one subject erasure did — the compliance artifact of a \"delete my account\" request.\n *\n * Returned to the caller (rather than only logged) so the flow that fronts the request can record\n * or surface it: every edge of the subject appears exactly once with the disposition applied and\n * the configuration that justified it, which is the evidence a data-protection response needs.\n *\n * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure accounts per store instead of\n * one verdict: each direct dependent edge with whether its teardown ran, each descendant edge the\n * erasure walked below it (nested in `descendantEdges`, folded into the direct edge's `executed`),\n * each registered external effect with its own outcome. The engine returns this and persists none of\n * it; retaining it is the calling application's job.\n */\nexport interface SubjectErasureReport {\n  /** The erased subject's resource type. */\n  subjectResourceType: ResourceType;\n  /** The erased subject rows. */\n  subjectIds: string[];\n  /** Every child-direction edge of the subject, classified, in registry order. */\n  edges: SubjectErasureEdgeOutcome[];\n  /**\n   * `true` once EVERY subject row was scrubbed and flipped to `RETAINED`. An erasure that could not retain its\n   * subject throws rather than returning a report — with one exception: a subject row under an active legal hold\n   * (#1634) is left as it is, reported in {@link heldByLegalHold}, and this is `false` while the rest completes.\n   * Also `false` when no subject row was found (`subjectIds` empty).\n   */\n  subjectImpersonalized: boolean;\n  /**\n   * Whose sessions this erasure ended, and whether resolving them failed.\n   *\n   * A LOCAL fact, not an external effect: the revocation is a write to our own session fence, applied\n   * at the scrub chokepoint so it covers every path that scrubs a person's row. It is recorded here\n   * because \"the erased person can no longer be logged in\" is exactly what a data-protection response\n   * has to be able to evidence.\n   *\n   * `lookupFailed` is kept distinct from an empty `principalUserIds`: no principals is a legitimate\n   * outcome (the resource declared `NO_PRINCIPAL`), whereas a failed lookup means the person may\n   * still hold a live session — and the two must never look alike in a compliance artifact.\n   */\n  sessionRevocation?: {\n    principalUserIds: string[];\n    lookupFailed: boolean;\n  };\n  /**\n   * Outcomes of the external, non-transactional effects the erasure triggered — every SYSTEM WE\n   * DO NOT OWN that the subject's personal data reached: registered effect handlers (a billing\n   * provider), and each HTTP_API-bound resource linked to the subject (one entry per resource,\n   * `effectRef: 'http-api:<resourceType>'`, carrying its declared D6 erasure stance's outcome).\n   *\n   * A malformed response from a bound registry produces one aggregate UNMEASURED entry,\n   * identifying that boundary rather than inventing individual provider outcomes.\n   *\n   * Empty when no effect was registered for the subject's resource type. These run AFTER the local\n   * scrub has committed, so a failure here cannot roll the erasure back — the local data is\n   * already gone and re-running the whole erasure would be wrong. That asymmetry is precisely why\n   * the outcome is reported rather than thrown: the local part genuinely succeeded, and the caller\n   * needs to know that a third party still holds something.\n   *\n   * Check {@link isIncompleteSubjectErasureExternalEffect} over these before treating a report as a\n   * complete erasure.\n   */\n  externalEffects: SubjectErasureExternalEffectOutcome[];\n  /**\n   * Every row the erasure KEPT because a statute requires it, with the ground and the instant it may go\n   * (#1635) — what an operator tells the data subject under GDPR Art. 12(4) and Art. 19: what was not\n   * erased, why, and until when.\n   *\n   * One entry per row of a {@link SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION} edge\n   * (direct or below a deleted dependent) whose statutory period had NOT ended at the erasure: still\n   * running, or not yet started. Rows only; no field of the row travels here. Empty when nothing\n   * statutory was reached — which is the ordinary answer, and not a sign the capability is off.\n   */\n  restrictedUnderStatutoryRetention: SubjectErasureStatutoryRestriction[];\n  /**\n   * Rows of a statutory edge whose period had ALREADY ended when the erasure reached them (#1635).\n   *\n   * No longer exempt, so they are NOT listed under a legal ground above. The erasure does not delete them\n   * inline: it gives them the same restriction (hidden, frozen, processed for nothing) and the NEXT run of the\n   * retention-class sweep disposes of them through the service layer, cascades included — the one mechanism\n   * that deletes bound rows at period end. Deleting inline was rejected because the erasure's pre-flight\n   * plans walks only below DELETE edges, so the refusals that guard an erasure would not cover the cascades\n   * below these rows. The window is one sweep interval.\n   */\n  releasedToRetentionSweep: SubjectErasureReleasedToRetentionSweep[];\n  /**\n   * Every row the erasure left EXACTLY as it was because a legal hold covers it (#1634) — neither deleted\n   * nor scrubbed, since impersonalization destroys what a hold preserves. One entry per row, with the\n   * grounds, which are what the data subject is told (Art. 17(3)(b)/(e)). The rest of the erasure\n   * completes; an edge whose rows were held reports `executed: false`, and a held subject row leaves\n   * `subjectImpersonalized: false`.\n   */\n  heldByLegalHold: SubjectErasureLegalHoldRetention[];\n  /**\n   * Every recipient that may hold the erased subject's data, and what the erasure did about each (#1710) — the list\n   * Art. 19 asks the controller to communicate to, and to give the data subject on request.\n   *\n   * `statement` names the recipients and the operator's role for the subject's resource type; `outcomes` gives each\n   * operator-account recipient a status (a registered effect's, or the one its declared stance decides — UNMEASURED\n   * when it declares none), and names each tenant-account recipient for the tenant to notify. A recipient no\n   * registered effect reached ALSO appears in {@link externalEffects} under `recipient:<ref>`, so completeness is\n   * judged by the one predicate every reader already uses.\n   */\n  recipients: {\n    statement: SubjectDataRecipientsStatement;\n    outcomes: SubjectErasureRecipientOutcome[];\n  };\n}\n\n/** One row a subject erasure restricted under a statutory ground instead of erasing (#1635). */\nexport interface SubjectErasureStatutoryRestriction {\n  resourceType: ResourceType;\n  rowId: string;\n  /** The GDPR Art. 17(3) exemption the resource declares. */\n  ground: StatutoryRetentionGround;\n  /** The class whose period applies — `BUSINESS_RECORDS` by construction; carried so the entry reads alone. */\n  retentionClass: DataRetentionClass;\n  /** Where the period is counted from — what an operator names when {@link retainedUntil} is `null`. */\n  retentionStartPoint: RetentionStartPoint;\n  /**\n   * The instant after which the row is deleted, under the schedule in force at the erasure.\n   *\n   * `null` when that instant is not yet knowable: the start point has not occurred (a `SCOPE_DELETED`\n   * row whose organization still exists), or the application declares no `BUSINESS_RECORDS` period.\n   * Never a guess — the row stays restricted either way, and the sweep deletes it once both are known.\n   */\n  retainedUntil: Date | null;\n}\n\n/** One row of a statutory edge whose period had already ended at the erasure (#1635). */\nexport interface SubjectErasureReleasedToRetentionSweep {\n  resourceType: ResourceType;\n  rowId: string;\n  /** The instant its statutory period ended — at or before the erasure. */\n  retentionEndedAt: Date;\n}\n\n/**\n * Split the rows a statutory edge reached into those still under the statute and those already released\n * (#1635). Pure: the executor passes the discovered rows, the resource's binding and ground, the schedule it\n * read, and the erasure instant.\n *\n * The rule, and its one boundary: a row is released only when `retainedUntil < now` — exactly the rows the\n * retention-class sweep's strict `start < now − days` (`resolveBoundRetentionCutoff`) selects, because\n * `start + days < now` is the same inequality. A row whose period ends AT this instant is still under the\n * statute and the sweep keeps it, so it is listed as restricted. Everything else is restricted too,\n * including a row whose instant is unknown (`null`): an unknown end is never an ended one.\n *\n * A row without an id is skipped rather than listed: an entry the operator cannot find is not evidence.\n */\nexport function partitionStatutoryRetentionRows(input: {\n  resourceType: ResourceType;\n  rows: readonly Record<string, unknown>[];\n  binding: ResourceRetentionBinding;\n  ground: StatutoryRetentionGround;\n  schedule: ApplicationRetentionSchedule | undefined;\n  now: Date;\n}): { restricted: SubjectErasureStatutoryRestriction[]; released: SubjectErasureReleasedToRetentionSweep[] } {\n  const restricted: SubjectErasureStatutoryRestriction[] = [];\n  const released: SubjectErasureReleasedToRetentionSweep[] = [];\n  for (const row of input.rows) {\n    const rawId = row._id ?? row.id;\n    const rowId = rawId === undefined || rawId === null ? undefined : String(rawId);\n    if (!rowId) continue;\n    const expiresAt = resolveRetentionExpiresAt(row, input.binding, input.schedule);\n    if (expiresAt !== undefined && expiresAt.getTime() < input.now.getTime()) {\n      released.push({ resourceType: input.resourceType, rowId, retentionEndedAt: expiresAt });\n      continue;\n    }\n    restricted.push({\n      resourceType: input.resourceType,\n      rowId,\n      ground: input.ground,\n      retentionClass: input.binding.retentionClass,\n      retentionStartPoint: input.binding.startPoint,\n      retainedUntil: expiresAt ?? null,\n    });\n  }\n  return { restricted, released };\n}\n\n\n/**\n * Edges that DELETE a resource whose OWN `retentionPolicy` says an erasure keeps its rows (#1279).\n *\n * ## The contradiction\n *\n * A resource's `retentionPolicy` is the declaration whose entire subject is what an erasure does to\n * its rows, and the config factory refuses it unless it is paired with a `dataSubjectPolicy` — so it\n * is among the most deliberate statements an author makes. An edge that nevertheless AUTHORS\n * `onParentDelete.strategy: DELETE` says the opposite about the same rows. Nothing in the\n * configuration ranks the two, so an erasure must refuse rather than pick: deleting could destroy\n * data a retention obligation required keeping, and retaining could strand personal data the erasure\n * claimed to have removed. That is the same reasoning {@link findSubjectErasureRetainDeleteConflicts}\n * gives for refusing rather than defaulting, applied one level down — there between two EDGES, here\n * between an edge and the RESOURCE it points at.\n *\n * ## Why a DELETE disposition here is necessarily AUTHORED\n *\n * Since #1279 `classifySubjectErasureDisposition` applies the child's retention treatment whenever the\n * edge is SILENT, so a `DELETE` disposition toward a retain-declaring child can only have come from an\n * author writing `strategy: DELETE`. This filter therefore needs no second look at the declaration:\n * the invariant is expressed once, in the classifier, and read here. Do NOT re-derive \"was it\n * authored?\" from the relationship — that would be a second copy of the rule, free to drift.\n *\n * ## Measured population: ZERO, and that is the point\n *\n * Across `engine/`, `platform/` and `examples/` on 2026-09-17, 28 edges deleted a retain-declaring\n * resource and **not one of them authored `DELETE`** — every one reached that outcome through the\n * schema default this fix removed. So the shipped registry trips this detector nowhere, which is the\n * shape worth having: it cannot regress silently, and an application that later authors the\n * contradiction meets a refusal before any read or write rather than an erasure that quietly\n * contradicts its own declarations.\n *\n * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.\n *\n * @param plannedEdges - every edge of ONE erasure, each carrying its classification.\n * @param resolveChildRetentionPolicy - a resource type's declared `retentionPolicy`, or `undefined`.\n * @returns the offending edges, in plan order. Empty is the healthy answer.\n */\nexport function findSubjectErasureRetentionContradictedEdges<TEdge extends { classification: SubjectErasureEdgeClassification }>(\n  plannedEdges: readonly TEdge[],\n  resolveChildRetentionPolicy: (\n    resourceType: ResourceType,\n  ) => SubjectErasureChildRetentionDeclaration | undefined,\n): TEdge[] {\n  return plannedEdges.filter((edge) =>\n    edge.classification.disposition === SubjectErasureDisposition.DELETE\n    && resolveChildRetentionPolicy(edge.classification.childResourceType)?.mode !== undefined);\n}\n\n/**\n * Edges whose DELETE would reach the SUBJECT'S OWN resource type (#1085).\n *\n * ## The hazard\n *\n * A subject erasure SCRUBS the subject row and keeps it — that is the erasure's contract with the data\n * subject, and it is unconditional: `eraseSubjectInPlace` refuses outright when the subject resource\n * declares no `retentionPolicy`. Since #976 the walk also descends below every dependent it deletes, so\n * a DELETE closure that comes back round to the subject's own type would delete the very row the\n * erasure promised to retain — and the receipt would still report it retained.\n *\n * That last part is why this refuses rather than skips. `SubjectErasureDescendantWalk`'s accounting is\n * written so a receipt can never OVERSTATE an erasure; deleting the scrubbed subject would overstate in\n * the one way nothing downstream can detect, because every edge reports exactly what it did.\n *\n * ## Why the sibling detector cannot do this\n *\n * {@link findSubjectErasureRetainDeleteConflicts} compares two EDGE dispositions. The subject's retention\n * is not an edge — no relationship declares it — so the subject's type is passed in here rather than\n * inferred. It is the whole reason this is a second function and not a case in the first.\n *\n * ## Measured 2026-09-17: the population is EMPTY, and that is the point\n *\n * In the engine's core graph `USERS` is never the CHILD of a composition. The one relationship naming it\n * second — `ORGANIZATIONS → USERS` — is a `RelationshipNature.ASSOCIATION` through\n * `ORGANIZATION_MEMBERS`, and an association carries no `onParentDelete` teardown, so no closure can\n * reach it. A guard over an empty population costs nothing at runtime and is exactly the shape worth\n * having: it cannot regress silently, and an application that later declares such an edge meets a\n * refusal before any read or write instead of an erasure that quietly contradicts itself.\n *\n * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.\n *\n * @param plannedEdges - every edge of ONE erasure, each carrying its classification.\n * @param subjectResourceType - the resource being erased, whose row is retained.\n * @returns the offending edges, in plan order. Empty is the healthy answer.\n */\nexport function findSubjectErasureSubjectTypeDeleteEdges<TEdge extends { classification: SubjectErasureEdgeClassification }>(\n  plannedEdges: readonly TEdge[],\n  subjectResourceType: string,\n): TEdge[] {\n  return plannedEdges.filter((edge) =>\n    edge.classification.disposition === SubjectErasureDisposition.DELETE\n    && String(edge.classification.childResourceType) === String(subjectResourceType));\n}\n"]}

package/dist/esm/compliance/privacy/subject-export-render.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-export-render.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EAGpB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,oBAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,IAAI,SAAS;IAEb;;;;OAIG;IACH,GAAG,QAAQ;CACZ;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACpC;AAkED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,6BAA6B,CAmC/B"}
+{"version":3,"file":"subject-export-render.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EAGpB,MAAM,iCAAiC,CAAC;AAQzC;;;;;;;;;;;GAWG;AACH,oBAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,IAAI,SAAS;IAEb;;;;OAIG;IACH,GAAG,QAAQ;CACZ;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACpC;AA4FD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,6BAA6B,CAmC/B"}

package/dist/esm/compliance/privacy/subject-export-render.shared.utils.js

@@ -1,4 +1,5 @@
 import { resolveCsvColumnsFromRows, toCsvCell } from '../../exports/tabular-csv.shared.utils.js';
+import { SubjectDataRecipientReach, SubjectDataRecipientRelevance, SubjectDataRecipientsStatementStatus, } from './subject-data-recipients.shared.schemas.js';
 /**
  * The wire format a subject export artifact is rendered into.
  *
@@ -75,8 +76,33 @@ function renderReportAsText(report) {
     if (report.fieldsWithheldAsNonDisclosable.length > 0) {
         lines.push('', 'FIELDS WITHHELD (security-sensitive; not disclosable under any request)', ...report.fieldsWithheldAsNonDisclosable.map((field) => `  - ${field}`));
     }
+    lines.push('', ...renderRecipientsAsText(report.recipients));
     return { name: 'SUMMARY.txt', contentType: 'text/plain', content: `${lines.join('\n')}\n` };
 }
+/**
+ * Who else holds the data (Art. 15(1)(c), #1710), as prose. Every recipient the statement lists appears, with the legal
+ * entity the operator adopted, where it processes and the categories its declared flow carries; a recipient whose flow
+ * is not fully declared says so, and a tenant's own vendor says whom to ask. An application that declares no
+ * recipients says THAT, rather than printing an empty list a reader would take for "nobody".
+ */
+function renderRecipientsAsText(statement) {
+    if (statement.status === SubjectDataRecipientsStatementStatus.NOT_DECLARED) {
+        return ['RECIPIENTS OF THIS DATA', '  Not declared by this application: who else received this data could not be stated.'];
+    }
+    if (statement.status === SubjectDataRecipientsStatementStatus.UNDETERMINED) {
+        return ['RECIPIENTS OF THIS DATA', '  Could not be determined for this request: who else received this data could not be stated.'];
+    }
+    if (statement.recipients.length === 0)
+        return ['RECIPIENTS OF THIS DATA', '  None: no declared flow sends this data to another party.'];
+    return ['RECIPIENTS OF THIS DATA', ...statement.recipients.map((recipient) => {
+            const identity = recipient.legalEntityName === null ? `${recipient.ref} (legal entity not recorded)` : `${recipient.legalEntityName} (${recipient.ref})`;
+            const regions = recipient.processingRegions.length > 0 ? ` — processes in ${recipient.processingRegions.join(', ')}` : '';
+            const categories = recipient.categories.length > 0 ? ` — receives ${recipient.categories.join(', ')}${recipient.categoriesAreAFloor ? ' (free text may carry more)' : ''}` : '';
+            const uncertain = recipient.relevance === SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED ? ' — may have received this data' : '';
+            const tenant = recipient.reach === SubjectDataRecipientReach.TENANT_ACCOUNT ? " — reached through your organisation's own account; your organisation can say more" : '';
+            return `  - ${identity}${regions}${categories}${uncertain}${tenant}`;
+        })];
+}
 /**
  * Render an assembled bundle into the artifact the data subject receives.
  *

package/dist/esm/compliance/privacy/subject-export-render.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-export-render.shared.utils.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAO9F;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,mBAeX;AAfD,WAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,oCAAa,CAAA;IAEb;;;;OAIG;IACH,kCAAW,CAAA;AACb,CAAC,EAfW,mBAAmB,KAAnB,mBAAmB,QAe9B;AAuBD,SAAS,gBAAgB,CAAC,KAAiC;IACzD,gGAAgG;IAChG,8FAA8F;IAC9F,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG;QACZ,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACtF,CAAC;IACF,OAAO;QACL,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM;QACzC,WAAW,EAAE,UAAU;QACvB,gGAAgG;QAChG,cAAc;QACd,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAA2B;IACrD,MAAM,KAAK,GAAa;QACtB,+BAA+B;QAC/B,EAAE;QACF,iBAAiB,MAAM,CAAC,OAAO,EAAE;QACjC,YAAY,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAClF,kBAAkB,MAAM,CAAC,gBAAgB,EAAE;QAC3C,EAAE;QACF,UAAU;KACX,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC,WAAW,YAAY,CAAC;QACnG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAChC,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CACR,EAAE,EACF,6FAA6F,EAC7F,GAAG,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,8BAA8B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,yEAAyE,EACzE,GAAG,MAAM,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA2B,EAC3B,MAA2B;IAE3B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,IAAI;YAC3B,OAAO;gBACL,MAAM;gBACN,KAAK,EAAE,CAAC;wBACN,IAAI,EAAE,qBAAqB;wBAC3B,WAAW,EAAE,kBAAkB;wBAC/B,yFAAyF;wBACzF,4CAA4C;wBAC5C,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;qBACxF,CAAC;aACH,CAAC;QAEJ,KAAK,mBAAmB,CAAC,GAAG;YAC1B,OAAO;gBACL,MAAM;gBACN,KAAK,EAAE;oBACL,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjC,0FAA0F;oBAC1F,qFAAqF;oBACrF,iCAAiC;oBACjC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACvC;aACF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,2FAA2F;YAC3F,uCAAuC;YACvC,MAAM,sBAAsB,GAAU,MAAM,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,yDAAyD,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { resolveCsvColumnsFromRows, toCsvCell } from '../../exports/tabular-csv.shared.utils';\nimport type {\n  SubjectExportBundle,\n  SubjectExportReport,\n  SubjectExportResourceSlice,\n} from './subject-export.shared.schemas';\n\n/**\n * The wire format a subject export artifact is rendered into.\n *\n * GDPR Art. 20 requires a \"structured, commonly used and machine-readable format\", which is a\n * property of the OUTPUT, not of the assembly — so it lives here rather than on the orchestrator.\n * Art. 15 places no format obligation at all, but a subject who receives their access bundle as an\n * unreadable blob has not meaningfully received it, so both rights render through the same path.\n *\n * A closed vocabulary: the four removed export operations declared `format: z.enum(['json','csv','pdf'])`\n * inline with no renderer behind any of them. `pdf` is deliberately NOT reinstated — it is a\n * presentation format, not a machine-readable one, and Art. 20 asks for the opposite of a PDF.\n */\nexport enum SubjectExportFormat {\n  /**\n   * Canonical and LOSSLESS. Preserves nested objects, arrays, types and nulls exactly as held, and\n   * carries the report alongside the data in one document. This is the format an Art. 20 request\n   * should receive by default — it is the only one a receiving system can re-import without\n   * guessing.\n   */\n  JSON = 'json',\n\n  /**\n   * Tabular and LOSSY, one file per resource. Widely readable by spreadsheet tools, which is why it\n   * is offered at all, but nested values are JSON-encoded into cells and type information is gone.\n   * Never the default for portability.\n   */\n  CSV = 'csv',\n}\n\n/** One file within a rendered export artifact. */\nexport interface SubjectExportRenderedFile {\n  /** Filename, stable across renders of the same bundle. */\n  name: string;\n  /** IANA media type, for an HTTP `Content-Type` when the artifact is served. */\n  contentType: string;\n  content: string;\n}\n\n/**\n * A rendered export artifact — what is actually handed to (or stored for) the data subject.\n *\n * Always a LIST of files, even for JSON which produces exactly one. A subject bundle is inherently\n * multi-resource, and modelling the single-file case as a bare string would force the CSV path to\n * either fabricate a join across unrelated tables or silently drop every resource but one.\n */\nexport interface SubjectExportRenderedArtifact {\n  format: SubjectExportFormat;\n  files: SubjectExportRenderedFile[];\n}\n\nfunction renderSliceAsCsv(slice: SubjectExportResourceSlice): SubjectExportRenderedFile {\n  // The whole slice is in hand here (a subject bundle is assembled before it is rendered), so the\n  // row-union column resolution is sound. A STREAMING export cannot use it — see its docstring.\n  const columns = resolveCsvColumnsFromRows(slice.rows);\n  const lines = [\n    columns.map(toCsvCell).join(','),\n    ...slice.rows.map((row) => columns.map((column) => toCsvCell(row[column])).join(',')),\n  ];\n  return {\n    name: `${String(slice.resourceType)}.csv`,\n    contentType: 'text/csv',\n    // Trailing newline: POSIX text convention, and several spreadsheet importers drop the final row\n    // without it.\n    content: `${lines.join('\\n')}\\n`,\n  };\n}\n\n/**\n * The report, rendered as prose for a human reading a CSV bundle.\n *\n * The JSON format carries the report as structured data; CSV has nowhere to put it, and shipping the\n * data files alone would be the more serious omission — see {@link renderSubjectExportBundle} on why\n * the report travels WITH the data.\n */\nfunction renderReportAsText(report: SubjectExportReport): SubjectExportRenderedFile {\n  const lines: string[] = [\n    'DATA SUBJECT EXPORT — SUMMARY',\n    '',\n    `Request type: ${report.purpose}`,\n    `Subject: ${String(report.subjectResourceType)} (${report.subjectIds.join(', ')})`,\n    `Total records: ${report.totalRecordCount}`,\n    '',\n    'INCLUDED',\n  ];\n  const collected = report.edges.filter((edge) => edge.collected);\n  lines.push(\n    ...(collected.length > 0\n      ? collected.map((edge) => `  - ${String(edge.relatedResourceType)}: ${edge.recordCount} record(s)`)\n      : ['  (no related records)']),\n  );\n\n  const omitted = report.edges.filter((edge) => !edge.collected);\n  if (omitted.length > 0) {\n    lines.push('', 'NOT INCLUDED, AND WHY');\n    lines.push(...omitted.map((edge) => `  - ${String(edge.relatedResourceType)}: ${edge.reason}`));\n  }\n  if (report.fieldsExcludedAsDerived.length > 0) {\n    lines.push(\n      '',\n      'FIELDS OUTSIDE THIS REQUEST (controller-derived; available under a right-of-access request)',\n      ...report.fieldsExcludedAsDerived.map((field) => `  - ${field}`),\n    );\n  }\n  if (report.fieldsWithheldAsNonDisclosable.length > 0) {\n    lines.push(\n      '',\n      'FIELDS WITHHELD (security-sensitive; not disclosable under any request)',\n      ...report.fieldsWithheldAsNonDisclosable.map((field) => `  - ${field}`),\n    );\n  }\n\n  return { name: 'SUMMARY.txt', contentType: 'text/plain', content: `${lines.join('\\n')}\\n` };\n}\n\n/**\n * Render an assembled bundle into the artifact the data subject receives.\n *\n * ## Why the report travels WITH the data\n *\n * It would be simpler to ship only the rows. But a subject handed \"your data\" with no statement of\n * what was left out — and on what basis — has been given a bundle that misrepresents itself by\n * omission. That is the same defect as the routed export operations this capability replaced: a\n * response that looks complete and is not. The report names every edge that was excluded and every\n * field narrowed away, so the artifact is self-describing and the subject can tell the difference\n * between \"we hold nothing else\" and \"the rest is outside this request\".\n *\n * It also gives an Art. 20 recipient the one thing they cannot otherwise derive: which fields exist\n * but were withheld as controller-derived, and are therefore obtainable through an Art. 15 request\n * instead.\n *\n * ## Determinism\n *\n * The same bundle renders byte-identically every time — column order is first-seen rather than\n * hash-ordered, and nothing is timestamped at render time. An artifact that changed on every render\n * could not be content-hashed, checksummed, or compared against a stored copy, which is exactly what\n * an integrity claim over a compliance artifact needs.\n *\n * Pure: no I/O, no clock, no registry. Storing the artifact is a separate concern.\n */\nexport function renderSubjectExportBundle(\n  bundle: SubjectExportBundle,\n  format: SubjectExportFormat,\n): SubjectExportRenderedArtifact {\n  switch (format) {\n    case SubjectExportFormat.JSON:\n      return {\n        format,\n        files: [{\n          name: 'subject-export.json',\n          contentType: 'application/json',\n          // `report` first: a reader opening the file meets the account of what this bundle is and\n          // what it omits before the rows themselves.\n          content: `${JSON.stringify({ report: bundle.report, data: bundle.slices }, null, 2)}\\n`,\n        }],\n      };\n\n    case SubjectExportFormat.CSV:\n      return {\n        format,\n        files: [\n          renderReportAsText(bundle.report),\n          // A slice with no rows still produces its (header-only) file: \"this resource was read and\n          // held nothing for you\" is a different statement from the file being absent, and the\n          // report distinguishes them too.\n          ...bundle.slices.map(renderSliceAsCsv),\n        ],\n      };\n\n    default: {\n      // Compile-time exhaustiveness: a new format without a renderer is a TYPE error here, not a\n      // subject receiving an empty artifact.\n      const _exhaustiveFormatCheck: never = format;\n      throw new Error(\n        `renderSubjectExportBundle has no renderer for format '${String(_exhaustiveFormatCheck)}'`,\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"subject-export-render.shared.utils.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export-render.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAM9F,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,oCAAoC,GAErC,MAAM,0CAA0C,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,mBAeX;AAfD,WAAY,mBAAmB;IAC7B;;;;;OAKG;IACH,oCAAa,CAAA;IAEb;;;;OAIG;IACH,kCAAW,CAAA;AACb,CAAC,EAfW,mBAAmB,KAAnB,mBAAmB,QAe9B;AAuBD,SAAS,gBAAgB,CAAC,KAAiC;IACzD,gGAAgG;IAChG,8FAA8F;IAC9F,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG;QACZ,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACtF,CAAC;IACF,OAAO;QACL,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM;QACzC,WAAW,EAAE,UAAU;QACvB,gGAAgG;QAChG,cAAc;QACd,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAA2B;IACrD,MAAM,KAAK,GAAa;QACtB,+BAA+B;QAC/B,EAAE;QACF,iBAAiB,MAAM,CAAC,OAAO,EAAE;QACjC,YAAY,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAClF,kBAAkB,MAAM,CAAC,gBAAgB,EAAE;QAC3C,EAAE;QACF,UAAU;KACX,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC,WAAW,YAAY,CAAC;QACnG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAChC,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CACR,EAAE,EACF,6FAA6F,EAC7F,GAAG,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,8BAA8B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,yEAAyE,EACzE,GAAG,MAAM,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CACxE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAE7D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,SAAyC;IACvE,IAAI,SAAS,CAAC,MAAM,KAAK,oCAAoC,CAAC,YAAY,EAAE,CAAC;QAC3E,OAAO,CAAC,yBAAyB,EAAE,sFAAsF,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,oCAAoC,CAAC,YAAY,EAAE,CAAC;QAC3E,OAAO,CAAC,yBAAyB,EAAE,8FAA8F,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,yBAAyB,EAAE,4DAA4D,CAAC,CAAC;IACxI,OAAO,CAAC,yBAAyB,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;YAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,8BAA8B,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,eAAe,KAAK,SAAS,CAAC,GAAG,GAAG,CAAC;YACzJ,MAAM,OAAO,GAAG,SAAS,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChL,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,KAAK,6BAA6B,CAAC,iBAAiB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClI,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,KAAK,yBAAyB,CAAC,cAAc,CAAC,CAAC,CAAC,oFAAoF,CAAC,CAAC,CAAC,EAAE,CAAC;YACxK,OAAO,OAAO,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA2B,EAC3B,MAA2B;IAE3B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,IAAI;YAC3B,OAAO;gBACL,MAAM;gBACN,KAAK,EAAE,CAAC;wBACN,IAAI,EAAE,qBAAqB;wBAC3B,WAAW,EAAE,kBAAkB;wBAC/B,yFAAyF;wBACzF,4CAA4C;wBAC5C,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;qBACxF,CAAC;aACH,CAAC;QAEJ,KAAK,mBAAmB,CAAC,GAAG;YAC1B,OAAO;gBACL,MAAM;gBACN,KAAK,EAAE;oBACL,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjC,0FAA0F;oBAC1F,qFAAqF;oBACrF,iCAAiC;oBACjC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;iBACvC;aACF,CAAC;QAEJ,OAAO,CAAC,CAAC,CAAC;YACR,2FAA2F;YAC3F,uCAAuC;YACvC,MAAM,sBAAsB,GAAU,MAAM,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,yDAAyD,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { resolveCsvColumnsFromRows, toCsvCell } from '../../exports/tabular-csv.shared.utils';\nimport type {\n  SubjectExportBundle,\n  SubjectExportReport,\n  SubjectExportResourceSlice,\n} from './subject-export.shared.schemas';\nimport {\n  SubjectDataRecipientReach,\n  SubjectDataRecipientRelevance,\n  SubjectDataRecipientsStatementStatus,\n  type SubjectDataRecipientsStatement,\n} from './subject-data-recipients.shared.schemas';\n\n/**\n * The wire format a subject export artifact is rendered into.\n *\n * GDPR Art. 20 requires a \"structured, commonly used and machine-readable format\", which is a\n * property of the OUTPUT, not of the assembly — so it lives here rather than on the orchestrator.\n * Art. 15 places no format obligation at all, but a subject who receives their access bundle as an\n * unreadable blob has not meaningfully received it, so both rights render through the same path.\n *\n * A closed vocabulary: the four removed export operations declared `format: z.enum(['json','csv','pdf'])`\n * inline with no renderer behind any of them. `pdf` is deliberately NOT reinstated — it is a\n * presentation format, not a machine-readable one, and Art. 20 asks for the opposite of a PDF.\n */\nexport enum SubjectExportFormat {\n  /**\n   * Canonical and LOSSLESS. Preserves nested objects, arrays, types and nulls exactly as held, and\n   * carries the report alongside the data in one document. This is the format an Art. 20 request\n   * should receive by default — it is the only one a receiving system can re-import without\n   * guessing.\n   */\n  JSON = 'json',\n\n  /**\n   * Tabular and LOSSY, one file per resource. Widely readable by spreadsheet tools, which is why it\n   * is offered at all, but nested values are JSON-encoded into cells and type information is gone.\n   * Never the default for portability.\n   */\n  CSV = 'csv',\n}\n\n/** One file within a rendered export artifact. */\nexport interface SubjectExportRenderedFile {\n  /** Filename, stable across renders of the same bundle. */\n  name: string;\n  /** IANA media type, for an HTTP `Content-Type` when the artifact is served. */\n  contentType: string;\n  content: string;\n}\n\n/**\n * A rendered export artifact — what is actually handed to (or stored for) the data subject.\n *\n * Always a LIST of files, even for JSON which produces exactly one. A subject bundle is inherently\n * multi-resource, and modelling the single-file case as a bare string would force the CSV path to\n * either fabricate a join across unrelated tables or silently drop every resource but one.\n */\nexport interface SubjectExportRenderedArtifact {\n  format: SubjectExportFormat;\n  files: SubjectExportRenderedFile[];\n}\n\nfunction renderSliceAsCsv(slice: SubjectExportResourceSlice): SubjectExportRenderedFile {\n  // The whole slice is in hand here (a subject bundle is assembled before it is rendered), so the\n  // row-union column resolution is sound. A STREAMING export cannot use it — see its docstring.\n  const columns = resolveCsvColumnsFromRows(slice.rows);\n  const lines = [\n    columns.map(toCsvCell).join(','),\n    ...slice.rows.map((row) => columns.map((column) => toCsvCell(row[column])).join(',')),\n  ];\n  return {\n    name: `${String(slice.resourceType)}.csv`,\n    contentType: 'text/csv',\n    // Trailing newline: POSIX text convention, and several spreadsheet importers drop the final row\n    // without it.\n    content: `${lines.join('\\n')}\\n`,\n  };\n}\n\n/**\n * The report, rendered as prose for a human reading a CSV bundle.\n *\n * The JSON format carries the report as structured data; CSV has nowhere to put it, and shipping the\n * data files alone would be the more serious omission — see {@link renderSubjectExportBundle} on why\n * the report travels WITH the data.\n */\nfunction renderReportAsText(report: SubjectExportReport): SubjectExportRenderedFile {\n  const lines: string[] = [\n    'DATA SUBJECT EXPORT — SUMMARY',\n    '',\n    `Request type: ${report.purpose}`,\n    `Subject: ${String(report.subjectResourceType)} (${report.subjectIds.join(', ')})`,\n    `Total records: ${report.totalRecordCount}`,\n    '',\n    'INCLUDED',\n  ];\n  const collected = report.edges.filter((edge) => edge.collected);\n  lines.push(\n    ...(collected.length > 0\n      ? collected.map((edge) => `  - ${String(edge.relatedResourceType)}: ${edge.recordCount} record(s)`)\n      : ['  (no related records)']),\n  );\n\n  const omitted = report.edges.filter((edge) => !edge.collected);\n  if (omitted.length > 0) {\n    lines.push('', 'NOT INCLUDED, AND WHY');\n    lines.push(...omitted.map((edge) => `  - ${String(edge.relatedResourceType)}: ${edge.reason}`));\n  }\n  if (report.fieldsExcludedAsDerived.length > 0) {\n    lines.push(\n      '',\n      'FIELDS OUTSIDE THIS REQUEST (controller-derived; available under a right-of-access request)',\n      ...report.fieldsExcludedAsDerived.map((field) => `  - ${field}`),\n    );\n  }\n  if (report.fieldsWithheldAsNonDisclosable.length > 0) {\n    lines.push(\n      '',\n      'FIELDS WITHHELD (security-sensitive; not disclosable under any request)',\n      ...report.fieldsWithheldAsNonDisclosable.map((field) => `  - ${field}`),\n    );\n  }\n\n  lines.push('', ...renderRecipientsAsText(report.recipients));\n\n  return { name: 'SUMMARY.txt', contentType: 'text/plain', content: `${lines.join('\\n')}\\n` };\n}\n\n/**\n * Who else holds the data (Art. 15(1)(c), #1710), as prose. Every recipient the statement lists appears, with the legal\n * entity the operator adopted, where it processes and the categories its declared flow carries; a recipient whose flow\n * is not fully declared says so, and a tenant's own vendor says whom to ask. An application that declares no\n * recipients says THAT, rather than printing an empty list a reader would take for \"nobody\".\n */\nfunction renderRecipientsAsText(statement: SubjectDataRecipientsStatement): string[] {\n  if (statement.status === SubjectDataRecipientsStatementStatus.NOT_DECLARED) {\n    return ['RECIPIENTS OF THIS DATA', '  Not declared by this application: who else received this data could not be stated.'];\n  }\n  if (statement.status === SubjectDataRecipientsStatementStatus.UNDETERMINED) {\n    return ['RECIPIENTS OF THIS DATA', '  Could not be determined for this request: who else received this data could not be stated.'];\n  }\n  if (statement.recipients.length === 0) return ['RECIPIENTS OF THIS DATA', '  None: no declared flow sends this data to another party.'];\n  return ['RECIPIENTS OF THIS DATA', ...statement.recipients.map((recipient) => {\n    const identity = recipient.legalEntityName === null ? `${recipient.ref} (legal entity not recorded)` : `${recipient.legalEntityName} (${recipient.ref})`;\n    const regions = recipient.processingRegions.length > 0 ? ` — processes in ${recipient.processingRegions.join(', ')}` : '';\n    const categories = recipient.categories.length > 0 ? ` — receives ${recipient.categories.join(', ')}${recipient.categoriesAreAFloor ? ' (free text may carry more)' : ''}` : '';\n    const uncertain = recipient.relevance === SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED ? ' — may have received this data' : '';\n    const tenant = recipient.reach === SubjectDataRecipientReach.TENANT_ACCOUNT ? \" — reached through your organisation's own account; your organisation can say more\" : '';\n    return `  - ${identity}${regions}${categories}${uncertain}${tenant}`;\n  })];\n}\n\n/**\n * Render an assembled bundle into the artifact the data subject receives.\n *\n * ## Why the report travels WITH the data\n *\n * It would be simpler to ship only the rows. But a subject handed \"your data\" with no statement of\n * what was left out — and on what basis — has been given a bundle that misrepresents itself by\n * omission. That is the same defect as the routed export operations this capability replaced: a\n * response that looks complete and is not. The report names every edge that was excluded and every\n * field narrowed away, so the artifact is self-describing and the subject can tell the difference\n * between \"we hold nothing else\" and \"the rest is outside this request\".\n *\n * It also gives an Art. 20 recipient the one thing they cannot otherwise derive: which fields exist\n * but were withheld as controller-derived, and are therefore obtainable through an Art. 15 request\n * instead.\n *\n * ## Determinism\n *\n * The same bundle renders byte-identically every time — column order is first-seen rather than\n * hash-ordered, and nothing is timestamped at render time. An artifact that changed on every render\n * could not be content-hashed, checksummed, or compared against a stored copy, which is exactly what\n * an integrity claim over a compliance artifact needs.\n *\n * Pure: no I/O, no clock, no registry. Storing the artifact is a separate concern.\n */\nexport function renderSubjectExportBundle(\n  bundle: SubjectExportBundle,\n  format: SubjectExportFormat,\n): SubjectExportRenderedArtifact {\n  switch (format) {\n    case SubjectExportFormat.JSON:\n      return {\n        format,\n        files: [{\n          name: 'subject-export.json',\n          contentType: 'application/json',\n          // `report` first: a reader opening the file meets the account of what this bundle is and\n          // what it omits before the rows themselves.\n          content: `${JSON.stringify({ report: bundle.report, data: bundle.slices }, null, 2)}\\n`,\n        }],\n      };\n\n    case SubjectExportFormat.CSV:\n      return {\n        format,\n        files: [\n          renderReportAsText(bundle.report),\n          // A slice with no rows still produces its (header-only) file: \"this resource was read and\n          // held nothing for you\" is a different statement from the file being absent, and the\n          // report distinguishes them too.\n          ...bundle.slices.map(renderSliceAsCsv),\n        ],\n      };\n\n    default: {\n      // Compile-time exhaustiveness: a new format without a renderer is a TYPE error here, not a\n      // subject receiving an empty artifact.\n      const _exhaustiveFormatCheck: never = format;\n      throw new Error(\n        `renderSubjectExportBundle has no renderer for format '${String(_exhaustiveFormatCheck)}'`,\n      );\n    }\n  }\n}\n"]}

package/dist/esm/compliance/privacy/subject-export.shared.schemas.d.ts

@@ -1,6 +1,7 @@
 import type { z } from 'zod';
 import { type ResourceRelationship } from '../../resources/resources.shared.schemas';
 import type { ResourceType } from '../../resources/resources.shared.core.definitions';
+import type { SubjectDataRecipientsStatement } from './subject-data-recipients.shared.schemas';
 /**
  * WHICH data-subject right an export is answering.
  *
@@ -424,6 +425,14 @@ export interface SubjectExportReport {
     fieldsWithheldAsNonDisclosable: string[];
     /** Total rows across every collected edge, including the subject's own row(s). */
     totalRecordCount: number;
+    /**
+     * The recipients this subject's personal data has been or will be disclosed to (Art. 15(1)(c), #1710): each with
+     * the legal identity the operator's register adopted and the categories its declared flow carries, selected by
+     * `selectSubjectDataRecipients` for the resources this export read. A recipient whose flow is not fully declared is
+     * listed as MAY_HAVE_RECEIVED, never left out; an application with no recipient declaration reads NOT_DECLARED.
+     * Vendor facts only — no personal data.
+     */
+    recipients: SubjectDataRecipientsStatement;
 }
 /** One resource's contribution to an export bundle. */
 export interface SubjectExportResourceSlice {

package/dist/esm/compliance/privacy/subject-export.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-export.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAItF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,aAAa,kBAAkB;IAE/B;;;;OAIG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,yBAAyB;IACnC;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;OAIG;IACH,QAAQ,aAAa;IAErB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oBAAY,4BAA4B;IACtC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,2BAA2B,gCAAgC;IAE3D;;;;OAIG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;OAOG;IACH,6BAA6B,kCAAkC;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,4EAA4E;AAC5E,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAGT;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,wDAAwD;IACxD,mBAAmB,EAAE,YAAY,CAAC;IAClC,0DAA0D;IAC1D,WAAW,EAAE,4BAA4B,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,oBAAoB,GAC5B,+BAA+B,CAmEjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,iFAAiF;AACjF,MAAM,WAAW,kCAAkC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4CAA4C,CAC1D,mBAAmB,EAAE,YAAY,EACjC,aAAa,EAAE,gCAAgC,EAC/C,OAAO,EAAE,oBAAoB,GAC5B,kCAAkC,EAAE,CA8BtC;AAED,kGAAkG;AAClG,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,kCAAkC,GAAG,MAAM,CAW3G;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,gDAAgD;IAChD,QAAQ,aAAa;IAErB;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,eAAe;CAC1B;AAED,uFAAuF;AACvF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,yBAAyB,GAAG,SAAS,EACjD,OAAO,EAAE,oBAAoB,GAC5B,uBAAuB,CAqBzB;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAWnF;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0CAA0C,CACxD,WAAW,EAAE,CAAC,CAAC,UAAU,EACzB,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,EAChE,YAAY,EAAE,MAAM,GACnB,yBAAyB,GAAG,SAAS,CAiBvC;AAED,2EAA2E;AAC3E,oBAAY,+BAA+B;IACzC,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,wBAAwB,6BAA6B;IACrD,UAAU,eAAe;IACzB,WAAW,gBAAgB;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;CACjD;AAID;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASnH;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,GAAG,0BAA0B,EAAE,CAmD/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,mBAAmB,EAAE,YAAY,CAAC;IAClC,iCAAiC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACzC,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACtC"}
+{"version":3,"file":"subject-export.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-export.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAI/F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,aAAa,kBAAkB;IAE/B;;;;OAIG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,yBAAyB;IACnC;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;OAIG;IACH,QAAQ,aAAa;IAErB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oBAAY,4BAA4B;IACtC;;;;OAIG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,2BAA2B,gCAAgC;IAE3D;;;;OAIG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;OAOG;IACH,6BAA6B,kCAAkC;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,4EAA4E;AAC5E,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAGT;AAED,2EAA2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,wDAAwD;IACxD,mBAAmB,EAAE,YAAY,CAAC;IAClC,0DAA0D;IAC1D,WAAW,EAAE,4BAA4B,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,oBAAoB,GAC5B,+BAA+B,CAmEjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC7D;AAED,iFAAiF;AACjF,MAAM,WAAW,kCAAkC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,4CAA4C,CAC1D,mBAAmB,EAAE,YAAY,EACjC,aAAa,EAAE,gCAAgC,EAC/C,OAAO,EAAE,oBAAoB,GAC5B,kCAAkC,EAAE,CA8BtC;AAED,kGAAkG;AAClG,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,kCAAkC,GAAG,MAAM,CAW3G;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC,gDAAgD;IAChD,QAAQ,aAAa;IAErB;;;OAGG;IACH,gBAAgB,qBAAqB;IAErC;;;;;;;;;;;;OAYG;IACH,UAAU,eAAe;CAC1B;AAED,uFAAuF;AACvF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,yBAAyB,GAAG,SAAS,EACjD,OAAO,EAAE,oBAAoB,GAC5B,uBAAuB,CAqBzB;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,OAAO,CAWnF;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0CAA0C,CACxD,WAAW,EAAE,CAAC,CAAC,UAAU,EACzB,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,EAChE,YAAY,EAAE,MAAM,GACnB,yBAAyB,GAAG,SAAS,CAiBvC;AAED,2EAA2E;AAC3E,oBAAY,+BAA+B;IACzC,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,wBAAwB,6BAA6B;IACrD,UAAU,eAAe;IACzB,WAAW,gBAAgB;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;CACjD;AAID;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASnH;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;CACxC,GAAG,0BAA0B,EAAE,CAmD/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,mBAAmB,EAAE,YAAY,CAAC;IAClC,iCAAiC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACzC,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,UAAU,EAAE,8BAA8B,CAAC;CAC5C;AAED,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACtC"}