@wildo-ai/saas-models 1.1.6 → 1.1.7

package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AAoED,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"privacy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,YAAY,iBAAiB,CAAE,mCAAmC;IAClE,OAAO,YAAY;CACpB;AAED,oBAAY,6BAA6B;IACvC,MAAM,WAAW,CAAE,sBAAsB;IACzC,oBAAoB,yBAAyB,CAAE,uDAAuD;IACtG,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;;OAMG;IACH,UAAU,eAAe;CAC1B;AAoED,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/privacy.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACzH,QAAQ,CACP,yBAAyB,OAAO,qJAAqJ,CACtL,CAAC;AAEJ,MAAM,qBAAqB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACnE,QAAQ,CACP,QAAQ,OAAO,oIAAoI,CACpJ,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACvH,QAAQ,CACP,2CAA2C,OAAO,sGAAsG,CACzJ,CAAC;AAEJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,iBAAiB,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;IACnE,eAAe,EAAE,oBAAoB,CAAC,wBAAwB,CAAC;IAC/D,gBAAgB,EAAE,qBAAqB,CAAC,wBAAwB,CAAC;CAClE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,iBAAiB,EAAE,sBAAsB,CAAC,WAAW,CAAC;IACtD,gBAAgB,EAAE,qBAAqB,CAAC,WAAW,CAAC;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,sGAAsG;IACtG,EAAE;IACF,sGAAsG;IACtG,qGAAqG;IACrG,wFAAwF;IACxF,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,oGAAoG;IACpG,4FAA4F;IAC5F,iBAAiB,EAAE,sBAAsB,CAAC,aAAa,CAAC;SACrD,eAAe,EAAE;IACpB,gBAAgB,EAAE,qBAAqB,CAAC,aAAa,CAAC;CACvD,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport \"@wildo-ai/zod-decorators\";\n\nimport { ConsentPurpose } from \"./consent-purposes.shared\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\n/**\n * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n *\n * Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n *\n * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n *\n * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\n/**\n * The purposes a person has granted, and whether they have decided at all — the two facts every\n * consent surface reads (#534).\n *\n * `consentedPurposes` defaults to the EMPTY set, and that default is the point. It used to be\n * `.default(DataProcessingConsent.BASIC)`: every record asserted a consent its subject never gave.\n * The empty set asserts nothing.\n *\n * `consentDecidedAt` is what separates \"declined everything\" from \"was never asked\" — the two are the\n * same empty set and must not be the same fact. Absent means undecided, so a consent surface asks; set\n * means the person made an affirmative choice at that instant, whatever they chose.\n */\n/*\n * `.systemEnum('ConsentPurpose')` names the ONE vocabulary a purpose is worded by, everywhere it is stored —\n * a person's preferences, an anonymous visitor, a lead — and on the application consent gate that asks for\n * it. A purpose is a legal statement to the person deciding, so it gets one wording, authored once under\n * `system_enums.ConsentPurpose.<value>`; the labelling planner plans it there and the frontend reads it\n * there, both because this field declares it (#966).\n */\nconst consentedPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes ${subject} has granted, each independently. A set, not a level: granting one purpose implies nothing about another. Empty means nothing optional was granted.`,\n  );\n\nconst consentDecidedAtField = (subject: string) => z.date().optional()\n  .describe(\n    `When ${subject} last made an affirmative consent choice. Absent means no choice was ever made, which is different from choosing to grant nothing.`,\n  );\n\n/**\n * The purposes a surface actually PUT IN FRONT of the person when they decided.\n *\n * ## Why a decision is not describable by its grants alone\n *\n * A grant set says what was agreed to. It cannot say what was ASKED, and the two differ by surface:\n * a website panel offers `purposesInUse`, derived from that site's own live providers, while the\n * application's gate offers `optionalPurposes`, derived from that application's configuration. A\n * marketing site running analytics and an application that also does marketing legitimately ask\n * different questions.\n *\n * Without this field, carrying a visitor's decision to their new account records\n * `consentDecidedAt` — which every consent surface reads as *\"this person was asked and answered\"* —\n * for purposes they were never shown. The application then stops prompting, and a purpose nobody\n * displayed is stored as declined. The existing surfaces already avoid this internally (*\"Purposes\n * the panel does not offer keep their stored grant\"*); only the CARRY crossed a surface boundary, and\n * it needed to know where the boundary was.\n *\n * So a decision is `(granted ⊆ offered, at an instant)`, and the carry adopts grants for offered\n * purposes while leaving an unoffered one genuinely undecided.\n *\n * ## Why only the anonymous holder declares it\n *\n * It is the only holder whose decision is taken on one surface and read on another. A member's\n * preferences are written and read by the same application, and a lead's opt-in is never carried\n * anywhere — adding the field there would be a second thing to keep true with no reader.\n *\n * Defaults to the EMPTY set, which is the honest value for every row written before this existed and\n * for a session that has been initialized but never asked: an empty offered set means no question was\n * put, so a carry from it carries nothing, which is the same outcome those rows have today.\n */\nconst offeredPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes actually shown to ${subject} by the surface they decided on. What is NOT here was never asked, and must not be read as declined.`,\n  );\n\nexport const AnonymousUserPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this anonymous visitor'),\n  offeredPurposes: offeredPurposesField('this anonymous visitor'),\n  consentDecidedAt: consentDecidedAtField('this anonymous visitor'),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this lead'),\n  consentDecidedAt: consentDecidedAtField('this lead'),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on the granted purposes, and deliberately NOT on the block that contains them.\n  //\n  // The granted set is the subject's own privacy DECISION held as a closed vocabulary, so recording its\n  // before/after values on `resource_operation_performed` is exactly the \"mark what decides authority,\n  // never what identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting set. Reached by the consent\n  // gate and prompt, the self-service preferences RESET and self/admin UPDATE. UPDATE explicitly opts\n  // into audit emission below the risk floor; only marked decision leaves enter the evidence.\n  consentedPurposes: consentedPurposesField('this person')\n    .isAuditEvidence(),\n  consentDecidedAt: consentDecidedAtField('this person'),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}
+{"version":3,"file":"privacy.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/privacy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,sEAA6C,CAAA;IAC7C,sDAA6B,CAAA;IAC7B,4CAAmB,CAAA;AACrB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,8EAA6C,CAAA;IAC7C,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAsBX;AAtBD,WAAY,qBAAqB;IAC/B;;;;;OAKG;IACH,8CAAqB,CAAA;IACrB;;;;OAIG;IACH,4CAAmB,CAAA;IACnB;;;;;;OAMG;IACH,kDAAyB,CAAA;AAC3B,CAAC,EAtBW,qBAAqB,KAArB,qBAAqB,QAsBhC;AACD,0EAA0E;AAE1E;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACzH,QAAQ,CACP,yBAAyB,OAAO,qJAAqJ,CACtL,CAAC;AAEJ,MAAM,qBAAqB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACnE,QAAQ,CACP,QAAQ,OAAO,oIAAoI,CACpJ,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACvH,QAAQ,CACP,2CAA2C,OAAO,sGAAsG,CACzJ,CAAC;AAEJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,iBAAiB,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;IACnE,eAAe,EAAE,oBAAoB,CAAC,wBAAwB,CAAC;IAC/D,gBAAgB,EAAE,qBAAqB,CAAC,wBAAwB,CAAC;CAClE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,iBAAiB,EAAE,sBAAsB,CAAC,WAAW,CAAC;IACtD,gBAAgB,EAAE,qBAAqB,CAAC,WAAW,CAAC;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,sGAAsG;IACtG,EAAE;IACF,sGAAsG;IACtG,qGAAqG;IACrG,wFAAwF;IACxF,EAAE;IACF,8FAA8F;IAC9F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,oGAAoG;IACpG,4FAA4F;IAC5F,iBAAiB,EAAE,sBAAsB,CAAC,aAAa,CAAC;SACrD,eAAe,EAAE;IACpB,gBAAgB,EAAE,qBAAqB,CAAC,aAAa,CAAC;CACvD,CAAC,CAAC","sourcesContent":["/**\n * Privacy Shared Schemas\n *\n * Privacy-related schemas and enums for user data management\n */\n\nimport { z } from \"zod\";\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport \"@wildo-ai/zod-decorators\";\n\nimport { ConsentPurpose } from \"./consent-purposes.shared\";\n\n/**\n * Profile Visibility Enum\n *\n * Controls who can see a user's profile information\n */\nexport enum UserProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  ORGANIZATION = \"organization\", // Visible within organization only\n  PRIVATE = \"private\", // Visible to user only\n}\n\nexport enum OrganizationProfileVisibility {\n  PUBLIC = \"public\", // Visible to everyone\n  APPLICATION_INTERNAL = \"application_internal\", // Visible within application, for connected users only\n  PRIVATE = \"private\", // Visible to user only\n}\n\n/**\n * Whether — and with what lifetime — this application identifies the CLIENT INSTALL\n * (`clientInstanceId`, sent as `x-client-instance-id` and recorded on the audit row).\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\", which the\n * per-request `correlationId` (server-minted, never stored on the device) and `frontendServiceName`\n * (a static per-app build constant) deliberately cannot. It is what lets an investigator group a\n * hostile actor's requests across sessions and logins — genuine security value, and exactly why it\n * needs a policy rather than a default.\n *\n * **This is a closed vocabulary with the OFF state inside it, on purpose.** Modelling it as\n * `{ enabled: boolean; scope: … }` would admit the meaningless `enabled: false, scope: PERSISTENT`\n * state; one enum makes \"off\" and \"how long it lives\" a single, always-coherent decision.\n *\n * **Why the framework refuses to choose for you (Fork D / SD9).** Storing an identifier on the\n * user's terminal equipment engages ePrivacy Directive Art 5(3), whose \"strictly necessary\"\n * exemption the EDPB reads narrowly (Guidelines 2/2023) — and *duration* is itself a\n * misclassification signal, so a long-lived id is the hardest case. GDPR Recital 49 (network and\n * information security as a legitimate interest) is a lawful basis for the PROCESSING but does not\n * remove the ePrivacy STORAGE consent question. Meanwhile NIST SP 800-53 AU-3 / AU-6(3)\n * affirmatively want this correlation capability for audit review. Those pull in opposite\n * directions, and the resolution is jurisdiction- and DPA-specific — so Wildo ships the mechanism\n * OFF and each application decides, with counsel, which member it may lawfully select.\n *\n * Not legal advice. See `.claude/plans/traceability-correlation-id.md` (SD9) for the full analysis\n * and the compliance obligations that attach to each non-`DISABLED` member.\n */\n/**\n * @wildo_source:part:start saas.models.privacy.client-instance-id-scope facet:layer:shared facet:audience:app-developer\n *\n * Whether the application identifies a browser INSTALL across visits, declared as\n * `compliance.clientInstanceIdScope`.\n *\n * It lives on `compliance` rather than beside the observability settings because it is a PRIVACY\n * decision, and on the SHARED config because both halves must obey one authored value: the frontend\n * decides whether to mint, store and send the id, and the backend independently decides whether to\n * ingest and record it. Two gates, one source — so an application that never opts in is protected\n * even if some client sends the header anyway.\n *\n * **`DISABLED` is the default**, so the privacy-preserving posture is what you get by doing nothing.\n * Choosing another member is choosing an obligation, not just a signal: start-up prints the\n * obligations each opt-in creates.\n */\nexport enum ClientInstanceIdScope {\n  /**\n   * DEFAULT. No client-install identifier is minted, sent, stored, or recorded — and the backend\n   * additionally REFUSES an inbound `x-client-instance-id` (fail-closed, so a rogue or misconfigured\n   * client cannot start populating a pseudonymous identifier in an application's retained audit\n   * trail without that application ever opting in).\n   */\n  DISABLED = \"disabled\",\n  /**\n   * Minted per browsing session (`sessionStorage`) — dies when the tab closes and does NOT survive a\n   * restart, so it cannot follow a user across visits. The proportionate choice when the goal is\n   * correlating one session's activity; the easiest to justify as strictly necessary.\n   */\n  SESSION = \"session\",\n  /**\n   * Minted once per browser install (`localStorage`) — survives tab close, restart, logout, and\n   * account switch. The strongest investigative signal (it links pre- and post-authentication\n   * activity, and two accounts used from one machine) and correspondingly the most likely to require\n   * consent. Select only with a recorded legitimate-interest assessment and, where required,\n   * consent-gating.\n   */\n  PERSISTENT = \"persistent\",\n}\n/** @wildo_source:part:end saas.models.privacy.client-instance-id-scope */\n\n/**\n * The purposes a person has granted, and whether they have decided at all — the two facts every\n * consent surface reads (#534).\n *\n * `consentedPurposes` defaults to the EMPTY set, and that default is the point. It used to be\n * `.default(DataProcessingConsent.BASIC)`: every record asserted a consent its subject never gave.\n * The empty set asserts nothing.\n *\n * `consentDecidedAt` is what separates \"declined everything\" from \"was never asked\" — the two are the\n * same empty set and must not be the same fact. Absent means undecided, so a consent surface asks; set\n * means the person made an affirmative choice at that instant, whatever they chose.\n */\n/*\n * `.systemEnum('ConsentPurpose')` names the ONE vocabulary a purpose is worded by, everywhere it is stored —\n * a person's preferences, an anonymous visitor, a lead — and on the application consent gate that asks for\n * it. A purpose is a legal statement to the person deciding, so it gets one wording, authored once under\n * `system_enums.ConsentPurpose.<value>`; the labelling planner plans it there and the frontend reads it\n * there, both because this field declares it (#966).\n */\nconst consentedPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes ${subject} has granted, each independently. A set, not a level: granting one purpose implies nothing about another. Empty means nothing optional was granted.`,\n  );\n\nconst consentDecidedAtField = (subject: string) => z.date().optional()\n  .describe(\n    `When ${subject} last made an affirmative consent choice. Absent means no choice was ever made, which is different from choosing to grant nothing.`,\n  );\n\n/**\n * The purposes a surface actually PUT IN FRONT of the person when they decided.\n *\n * ## Why a decision is not describable by its grants alone\n *\n * A grant set says what was agreed to. It cannot say what was ASKED, and the two differ by surface:\n * a website panel offers `purposesInUse`, derived from that site's own live providers, while the\n * application's gate offers `optionalPurposes`, derived from that application's configuration. A\n * marketing site running analytics and an application that also does marketing legitimately ask\n * different questions.\n *\n * Without this field, carrying a visitor's decision to their new account records\n * `consentDecidedAt` — which every consent surface reads as *\"this person was asked and answered\"* —\n * for purposes they were never shown. The application then stops prompting, and a purpose nobody\n * displayed is stored as declined. The existing surfaces already avoid this internally (*\"Purposes\n * the panel does not offer keep their stored grant\"*); only the CARRY crossed a surface boundary, and\n * it needed to know where the boundary was.\n *\n * So a decision is `(granted ⊆ offered, at an instant)`, and the carry adopts grants for offered\n * purposes while leaving an unoffered one genuinely undecided.\n *\n * ## Why only the anonymous holder declares it\n *\n * It is the only holder whose decision is taken on one surface and read on another. A member's\n * preferences are written and read by the same application, and a lead's opt-in is never carried\n * anywhere — adding the field there would be a second thing to keep true with no reader.\n *\n * Defaults to the EMPTY set, which is the honest value for every row written before this existed and\n * for a session that has been initialized but never asked: an empty offered set means no question was\n * put, so a carry from it carries nothing, which is the same outcome those rows have today.\n */\nconst offeredPurposesField = (subject: string) => z.array(z.enum(ConsentPurpose).systemEnum('ConsentPurpose')).default([])\n  .describe(\n    `The optional purposes actually shown to ${subject} by the surface they decided on. What is NOT here was never asked, and must not be read as declined.`,\n  );\n\nexport const AnonymousUserPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this anonymous visitor'),\n  offeredPurposes: offeredPurposesField('this anonymous visitor'),\n  consentDecidedAt: consentDecidedAtField('this anonymous visitor'),\n});\n\nexport type AnonymousUserPrivacy = z.infer<typeof AnonymousUserPrivacySchema>;\n\nexport const InboundContactPrivacySchema = z.object({\n  consentedPurposes: consentedPurposesField('this lead'),\n  consentDecidedAt: consentDecidedAtField('this lead'),\n});\n\nexport type InboundContactPrivacy = z.infer<typeof InboundContactPrivacySchema>;\n\nexport const UserPrivacySchema = z.object({\n  // `.isAuditEvidence()` on the granted purposes, and deliberately NOT on the block that contains them.\n  //\n  // The granted set is the subject's own privacy DECISION held as a closed vocabulary, so recording its\n  // before/after values on `resource_operation_performed` is exactly the \"mark what decides authority,\n  // never what identifies a person\" rule that governs the same decorator on `UserSchema`.\n  //\n  // Evidence is selected per leaf; the audit walker resolves the dotted path. Governed-document\n  // interactions are separate immutable release-bound records and are never embedded in preferences.\n  //\n  // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a consent change is a security-relevant\n  // decision and must leave a trail naming the previous and resulting set. Reached by the consent\n  // gate and prompt, the self-service preferences RESET and self/admin UPDATE. UPDATE explicitly opts\n  // into audit emission below the risk floor; only marked decision leaves enter the evidence.\n  consentedPurposes: consentedPurposesField('this person')\n    .isAuditEvidence(),\n  consentDecidedAt: consentDecidedAtField('this person'),\n});\n\nexport type UserPrivacy = z.infer<typeof UserPrivacySchema>;\n"]}

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-capability-disclosure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,4BAA4B;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,GAAG,IAAI,CAAC,CAmF5H,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG;IACnF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAkBA"}
+{"version":3,"file":"provider-capability-disclosure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,4BAA4B;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,sGAAsG;IACtG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,GAAG,IAAI,CAAC,CAmF5H,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG;IACnF,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAkBA"}

package/dist/esm/compliance/privacy/provider-capability-disclosure.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-capability-disclosure.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAE5B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AACvH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAuC/E,MAAM,CAAC,MAAM,+BAA+B,GAAqF;IAC/H,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE;QACjD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACtJ,SAAS,EAAE,sLAAsL;KAClM;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE;QAC3C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACrF,SAAS,EAAE,0GAA0G;KACtH;IACD,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE;QACjC,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,WAAW,CAAC;QACpF,SAAS,EAAE,8EAA8E;KAC1F;IACD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE;QACrC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,SAAS,CAAC;QACjH,SAAS,EAAE,wFAAwF;KACpG;IACD,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE;QACxC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,wGAAwG;KACpH;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,qDAAqD;KACjE;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE;QAC5C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,qFAAqF;KACjG;IACD,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE;QACtD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,+DAA+D;KAC3E;IACD,8GAA8G;IAC9G,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,IAAI;IAChD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,kBAAkB;KAC9B;IACD,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE;QACvD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,+HAA+H;KAC3I;IACD,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE;QACxD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,gFAAgF;KAC5F;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,mCAAmC;KAC/C;IACD,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,EAAE;QAClD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,iEAAiE;KAC7E;IACD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC;QACxC,SAAS,EAAE,yDAAyD;KACrE;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,gEAAgE;KAC5E;IACD,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE;QAC/C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC;QAC3E,SAAS,EAAE,uEAAuE;KACnF;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,uHAAuH;KACnI;IACD,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE;QACpD,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACvE,SAAS,EAAE,oEAAoE;KAChF;CACF,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAAyB;IAIhF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,+BAA+B,GAAG,+BAAgG,CAAC;IACzI,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,oBAAoB,GAAG,KAAK,IAAI,+BAA+B;YACnE,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC5K,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,kBAAkB,IAAI,oBAAoB,EAAE,CAAC;YACtD,KAAK,MAAM,QAAQ,IAAI,+BAA+B,CAAC,kBAAkB,CAAC,EAAE,UAAU,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACtH,CAAC","sourcesContent":["import {\n  BUILTIN_PROVIDER_CAPABILITY,\n  type BuiltinProviderCapability,\n} from '../../external-providers/provider-capability.shared.schemas';\nimport { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY } from '../../external-providers/engine-capabilities.shared.schemas';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/**\n * WHICH categories of personal data the ENGINE sends to a provider that serves a capability (#1709).\n *\n * ## Why a table the engine owns\n *\n * A record of processing lists the categories of personal data and the categories of recipients (GDPR Art. 30(1)(c),\n * (d)); saying which categories reach which recipient is the practice that keeps the two lists consistent. For a\n * provider reached through a CAPABILITY, the application writes no\n * field map: the ENGINE composes the request — the recipient address of an email, the customer of a billing call,\n * the prompt of a model call. So the categories are a fact about the engine's own behaviour, the same for every\n * application, and the engine states it here rather than asking each operator to narrate it\n * (`.claude/rules/derive-before-you-ask.md`).\n *\n * The provider compliance profile's header rejects restating this on each provider module, as \"a second authority\n * for one fact\": the capability is the authority, and this is where it speaks.\n *\n * ## Total over the provider-capability vocabulary\n *\n * A `Record` over every {@link BuiltinProviderCapability}, so a capability added tomorrow is a compile error here\n * until someone states what it sends. `null` is an ANSWER: the capability sends no personal data of the application's\n * users to the vendor (a build-time coding agent works on source code).\n *\n * ## Read it as a FLOOR of what reaches the vendor, never a ceiling\n *\n * `USER_CONTENT` is listed wherever free text a person wrote rides the call (a prompt, a message body, a search\n * query), and free text can carry ANY other category — see {@link PersonalDataCategory.USER_CONTENT}. A notice\n * states the listed categories and must not conclude that nothing else ever reaches the vendor.\n *\n * @wildo_source:part:start saas.models.privacy.provider-capability-disclosure facet:layer:shared facet:audience:app-developer\n */\nexport interface ProviderCapabilityDisclosure {\n  /** The categories the engine sends when it calls a provider for this capability. */\n  readonly categories: readonly PersonalDataCategory[];\n  /** What in the call carries them — so a reader can check the claim against the engine's behaviour. */\n  readonly carriedBy: string;\n}\n\nexport const PROVIDER_CAPABILITY_DISCLOSURES: Readonly<Record<BuiltinProviderCapability, ProviderCapabilityDisclosure | null>> = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY, PersonalDataCategory.CREDENTIALS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the recipient address, the recipient name the templates address, the rendered message body, and the magic-link, verification and password-reset tokens the engine\\'s own mails carry',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the subscriber address and name synchronised to the audience',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the sender and recipient addresses, and the message bodies and attachments the vendor receives and holds',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.CREDENTIALS],\n    carriedBy: 'the telephone number, and the one-time verification code the message carries',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.FINANCIAL],\n    carriedBy: 'the customer name and email address, and the payment, subscription and invoice records',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_OAUTH2]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the sign-in request, which may name the account (login hint), and the identity the vendor asserts back',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_SAML]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the authentication request and the asserted subject',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the prompt and the context the application assembles into it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the text of every field a resource marks as a retrieval source, sent to be embedded',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the bytes of every uploaded document sent for text extraction',\n  },\n  // Build-time tooling: a coding run sends the application's SOURCE CODE and specifications, not a user's data.\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: null,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the image prompt',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the error event with its device, browser and page context, and the signed-in user identifier when the application attaches it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the product events and the identifier the application identifies the person by',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_SEARCH]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the search query the person types',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_FILE_PICKER]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the files the person picks from their own account at the vendor',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA]: {\n    categories: [PersonalDataCategory.USAGE],\n    carriedBy: 'the interaction and device signals the challenge scores',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ADDRESS_LOOKUP]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.LOCATION],\n    carriedBy: 'the address text the person types and the place it resolves to',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: {\n    categories: [PersonalDataCategory.USER_CONTENT, PersonalDataCategory.USAGE],\n    carriedBy: 'the traced generation — its prompt and output — and the call metadata',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the traces, metrics and logs of requests, which carry request metadata and the acting user\\'s identifier on each span',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.USAGE],\n    carriedBy: 'every audit event: the acting user, the subject, and what was done',\n  },\n};\n/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */\n\n/**\n * The categories disclosed through a set of capabilities, as the population's data paths name them — provider\n * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).\n *\n * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the\n * {@link PersonalDataCategory} enum order, so one application produces one sentence.\n */\nexport function personalDataDisclosedThroughCapabilities(tokens: readonly string[]): {\n  readonly categories: readonly PersonalDataCategory[];\n  readonly undeclared: readonly string[];\n} {\n  const found = new Set<PersonalDataCategory>();\n  const undeclared: string[] = [];\n  const disclosuresByProviderCapability = PROVIDER_CAPABILITY_DISCLOSURES as Readonly<Record<string, ProviderCapabilityDisclosure | null>>;\n  for (const token of tokens) {\n    const providerCapabilities = token in disclosuresByProviderCapability\n      ? [token]\n      : Object.entries(PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY).filter(([, engineCapability]) => engineCapability === token).map(([providerCapability]) => providerCapability);\n    if (providerCapabilities.length === 0) {\n      undeclared.push(token);\n      continue;\n    }\n    for (const providerCapability of providerCapabilities) {\n      for (const category of disclosuresByProviderCapability[providerCapability]?.categories ?? []) found.add(category);\n    }\n  }\n  const order = Object.values(PersonalDataCategory);\n  return { categories: order.filter((category) => found.has(category)), undeclared: [...new Set(undeclared)].sort() };\n}\n"]}
+{"version":3,"file":"provider-capability-disclosure.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/provider-capability-disclosure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAE5B,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AACvH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAuC/E,MAAM,CAAC,MAAM,+BAA+B,GAAqF;IAC/H,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE;QACjD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACtJ,SAAS,EAAE,sLAAsL;KAClM;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE;QAC3C,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,YAAY,CAAC;QACrF,SAAS,EAAE,0GAA0G;KACtH;IACD,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE;QACjC,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,WAAW,CAAC;QACpF,SAAS,EAAE,8EAA8E;KAC1F;IACD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE;QACrC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,SAAS,CAAC;QACjH,SAAS,EAAE,wFAAwF;KACpG;IACD,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE;QACxC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,wGAAwG;KACpH;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,eAAe,CAAC;QACjF,SAAS,EAAE,qDAAqD;KACjE;IACD,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE;QACtC,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,8DAA8D;KAC1E;IACD,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE;QAC5C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,qFAAqF;KACjG;IACD,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE;QACtD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,+DAA+D;KAC3E;IACD,8GAA8G;IAC9G,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,IAAI;IAChD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,kBAAkB;KAC9B;IACD,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE;QACvD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,+HAA+H;KAC3I;IACD,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE;QACxD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,gFAAgF;KAC5F;IACD,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE;QAC7C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,mCAAmC;KAC/C;IACD,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,EAAE;QAClD,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,iEAAiE;KAC7E;IACD,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE;QAC9C,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC;QACxC,SAAS,EAAE,yDAAyD;KACrE;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACjF,SAAS,EAAE,gEAAgE;KAC5E;IACD,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE;QAC/C,UAAU,EAAE,CAAC,oBAAoB,CAAC,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC;QAC3E,SAAS,EAAE,uEAAuE;KACnF;IACD,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE;QACrD,UAAU,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACvE,SAAS,EAAE,uHAAuH;KACnI;IACD,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE;QACpD,UAAU,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACvE,SAAS,EAAE,oEAAoE;KAChF;CACF,CAAC;AACF,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAAyB;IAIhF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,+BAA+B,GAAG,+BAAgG,CAAC;IACzI,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,oBAAoB,GAAG,KAAK,IAAI,+BAA+B;YACnE,CAAC,CAAC,CAAC,KAAK,CAAC;YACT,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC5K,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,kBAAkB,IAAI,oBAAoB,EAAE,CAAC;YACtD,KAAK,MAAM,QAAQ,IAAI,+BAA+B,CAAC,kBAAkB,CAAC,EAAE,UAAU,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACtH,CAAC","sourcesContent":["import {\n  BUILTIN_PROVIDER_CAPABILITY,\n  type BuiltinProviderCapability,\n} from '../../external-providers/provider-capability.shared.schemas';\nimport { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY } from '../../external-providers/engine-capabilities.shared.schemas';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\n\n/**\n * WHICH categories of personal data the ENGINE sends to a provider that serves a capability (#1709).\n *\n * ## Why a table the engine owns\n *\n * A record of processing lists the categories of personal data and the categories of recipients (GDPR Art. 30(1)(c),\n * (d)); saying which categories reach which recipient is the practice that keeps the two lists consistent. For a\n * provider reached through a CAPABILITY, the application writes no\n * field map: the ENGINE composes the request — the recipient address of an email, the customer of a billing call,\n * the prompt of a model call. So the categories are a fact about the engine's own behaviour, the same for every\n * application, and the engine states it here rather than asking each operator to narrate it\n * (`.claude/rules/derive-before-you-ask.md`).\n *\n * The provider compliance profile's header rejects restating this on each provider module, as \"a second authority\n * for one fact\": the capability is the authority, and this is where it speaks.\n *\n * ## Total over the provider-capability vocabulary\n *\n * A `Record` over every {@link BuiltinProviderCapability}, so a capability added tomorrow is a compile error here\n * until someone states what it sends. `null` is an ANSWER: the capability sends no personal data of the application's\n * users to the vendor (a build-time coding agent works on source code).\n *\n * ## Read it as a FLOOR of what reaches the vendor, never a ceiling\n *\n * `USER_CONTENT` is listed wherever free text a person wrote rides the call (a prompt, a message body, a search\n * query), and free text can carry ANY other category — see {@link PersonalDataCategory.USER_CONTENT}. A notice\n * states the listed categories and must not conclude that nothing else ever reaches the vendor.\n *\n * @wildo_source:part:start saas.models.privacy.provider-capability-disclosure facet:layer:shared facet:audience:app-developer\n */\nexport interface ProviderCapabilityDisclosure {\n  /** The categories the engine sends when it calls a provider for this capability. */\n  readonly categories: readonly PersonalDataCategory[];\n  /** What in the call carries them — so a reader can check the claim against the engine's behaviour. */\n  readonly carriedBy: string;\n}\n\nexport const PROVIDER_CAPABILITY_DISCLOSURES: Readonly<Record<BuiltinProviderCapability, ProviderCapabilityDisclosure | null>> = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY, PersonalDataCategory.CREDENTIALS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the recipient address, the recipient name the templates address, the rendered message body, and the magic-link, verification and password-reset tokens the engine\\'s own mails carry',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the subscriber address and name synchronised to the audience',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the sender and recipient addresses, and the message bodies and attachments the vendor receives and holds',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.CREDENTIALS],\n    carriedBy: 'the telephone number, and the one-time verification code the message carries',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.FINANCIAL],\n    carriedBy: 'the customer name and email address, and the payment, subscription and invoice records',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_OAUTH2]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the sign-in request, which may name the account (login hint), and the identity the vendor asserts back',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.SSO_SAML]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.CONTACT_DETAILS],\n    carriedBy: 'the authentication request and the asserted subject',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the prompt and the context the application assembles into it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the text of every field a resource marks as a retrieval source, sent to be embedded',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the bytes of every uploaded document sent for text extraction',\n  },\n  // Build-time tooling: a coding run sends the application's SOURCE CODE and specifications, not a user's data.\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: null,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the image prompt',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the error event with its device, browser and page context, and the signed-in user identifier when the application attaches it',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the product events and the identifier the application identifies the person by',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_SEARCH]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the search query the person types',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_FILE_PICKER]: {\n    categories: [PersonalDataCategory.USER_CONTENT],\n    carriedBy: 'the files the person picks from their own account at the vendor',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA]: {\n    categories: [PersonalDataCategory.USAGE],\n    carriedBy: 'the interaction and device signals the challenge scores',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ADDRESS_LOOKUP]: {\n    categories: [PersonalDataCategory.CONTACT_DETAILS, PersonalDataCategory.LOCATION],\n    carriedBy: 'the address text the person types and the place it resolves to',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: {\n    categories: [PersonalDataCategory.USER_CONTENT, PersonalDataCategory.USAGE],\n    carriedBy: 'the traced generation — its prompt and output — and the call metadata',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: {\n    categories: [PersonalDataCategory.USAGE, PersonalDataCategory.IDENTITY],\n    carriedBy: 'the traces, metrics and logs of requests, which carry request metadata and the acting user\\'s identifier on each span',\n  },\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: {\n    categories: [PersonalDataCategory.IDENTITY, PersonalDataCategory.USAGE],\n    carriedBy: 'every audit event: the acting user, the subject, and what was done',\n  },\n};\n/** @wildo_source:part:end saas.models.privacy.provider-capability-disclosure */\n\n/**\n * The categories disclosed through a set of capabilities, as the population's data paths name them — provider\n * capability tokens, and engine capabilities (each the union of the provider capabilities that fill it).\n *\n * `undeclared` lists a token this table does not know, so a caller reports it instead of dropping it. Sorted in the\n * {@link PersonalDataCategory} enum order, so one application produces one sentence.\n */\nexport function personalDataDisclosedThroughCapabilities(tokens: readonly string[]): {\n  readonly categories: readonly PersonalDataCategory[];\n  readonly undeclared: readonly string[];\n} {\n  const found = new Set<PersonalDataCategory>();\n  const undeclared: string[] = [];\n  const disclosuresByProviderCapability = PROVIDER_CAPABILITY_DISCLOSURES as Readonly<Record<string, ProviderCapabilityDisclosure | null>>;\n  for (const token of tokens) {\n    const providerCapabilities = token in disclosuresByProviderCapability\n      ? [token]\n      : Object.entries(PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY).filter(([, engineCapability]) => engineCapability === token).map(([providerCapability]) => providerCapability);\n    if (providerCapabilities.length === 0) {\n      undeclared.push(token);\n      continue;\n    }\n    for (const providerCapability of providerCapabilities) {\n      for (const category of disclosuresByProviderCapability[providerCapability]?.categories ?? []) found.add(category);\n    }\n  }\n  const order = Object.values(PersonalDataCategory);\n  return { categories: order.filter((category) => found.has(category)), undeclared: [...new Set(undeclared)].sort() };\n}\n"]}

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"purpose-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAAoG,CAAC"}
+{"version":3,"file":"purpose-ref.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,aAAoG,CAAC"}

package/dist/esm/compliance/privacy/purpose-ref.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"purpose-ref.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE,0CAA0C,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.\n *\n * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that\n * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the\n * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator\n * identity's module graph with it.\n */\nexport const LawfulBasisPurposeRefSchema = z.string().trim().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'a purpose ref is a lower-case kebab slug');\n"]}
+{"version":3,"file":"purpose-ref.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/purpose-ref.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE,0CAA0C,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * A stable slug naming one processing purpose (#1709) — `account-security`, `billing-records`.\n *\n * Declared on a lawful basis (`operatorComplianceIdentity.lawfulBases[].purposeRef`) and named by every recipient that\n * serves it (`providerComplianceChoices.<ref>.purposeRefs`). One schema for both ends, in an import-free atom, so the\n * compliance choice (reachable from the browser's public runtime) can validate a ref without pulling the operator\n * identity's module graph with it.\n */\nexport const LawfulBasisPurposeRefSchema = z.string().trim().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'a purpose ref is a lower-case kebab slug');\n"]}

package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"redaction.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,oBAAY,aAAa;IACvB,sJAAsJ;IACtJ,IAAI,SAAS;IACb,0GAA0G;IAC1G,MAAM,WAAW;IACjB,4JAA4J;IAC5J,IAAI,SAAS;IACb,iJAAiJ;IACjJ,OAAO,YAAY;IACnB,wGAAwG;IACxG,IAAI,SAAS;IACb;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU;CAChB;AACD,sEAAsE;AAGtE,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/compliance/privacy/redaction.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n * MAINTAINER NOTE — not part of the anchored, application-facing block below.\n *\n * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n *\n * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n */\n\n/**\n * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n *\n * How one field's value is replaced when it is redacted or scrubbed.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Two consumers, and only one of them accepts every member\n *\n * | consumer | what it does | accepts |\n * |---|---|---|\n * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |\n * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |\n *\n * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n *\n * ## Choosing a treatment for an erasure scrub\n *\n * | the field | treatment |\n * |---|---|\n * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |\n * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |\n * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |\n * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |\n *\n * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n *\n * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n *\n * ## The never-scrub floor\n *\n * A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n *\n * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n *\n * @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n *\n * const contactSchema = z.object({\n *   // nullable → REMOVE\n *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n *   // constrained string → MASK with a value the field's own schema accepts\n *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n *   // non-nullable with a default → RESET\n *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n *     .impersonalizeWith(RedactionType.RESET),\n *   // no treatment → survives the erasure, deliberately\n *   invoicedAmount: z.number(),\n * });\n * ```\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */\n  MASK = 'mask',\n  /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */\n  ENCRYPT = 'encrypt',\n  /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */\n  KEEP = 'keep',\n  /**\n   * Erasure scrub only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n   * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n   * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n   * and objects.\n   *\n   * The value is read from the schema rather than authored a second time, so it cannot drift from\n   * the default the field already declares — and for a person's counters and settings, \"what this is\n   * when nobody has set it\" is exactly what an erasure should leave behind.\n   *\n   * Refused when the field declares no `.default()`, and refused when that default reads the clock.\n   */\n  RESET = 'reset',\n}\n/** @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}
+{"version":3,"file":"redaction.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/redaction.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAN,IAAY,aA0BX;AA1BD,WAAY,aAAa;IACvB,sJAAsJ;IACtJ,8BAAa,CAAA;IACb,0GAA0G;IAC1G,kCAAiB,CAAA;IACjB,4JAA4J;IAC5J,8BAAa,CAAA;IACb,iJAAiJ;IACjJ,oCAAmB,CAAA;IACnB,wGAAwG;IACxG,8BAAa,CAAA;IACb;;;;;;;;;;;;;OAaG;IACH,gCAAe,CAAA;AACjB,CAAC,EA1BW,aAAa,KAAb,aAAa,QA0BxB;AACD,sEAAsE;AAGtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,4DAA4D;IACrG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { RolesSchema } from \"../../security/authorizations/roles.shared.schemas\";\n\n/*\n * MAINTAINER NOTE — not part of the anchored, application-facing block below.\n *\n * One authority axis (D9): this vocabulary is shared by flow-actors `redactionRules` and by the\n * impersonalization `.impersonalizeWith()` treatment, deliberately, so the two cannot drift into two\n * spellings of the same idea. Adding a member is additive for both consumers — no exhaustive switch\n * reads it — EXCEPT `buildImpersonalizeScrubPatch`, whose `default` arm throws on purpose so a new\n * member fails loud in an erasure rather than being silently skipped.\n *\n * Reversible tokenization is intentionally NOT in v1 (D6 = irreversible). `ENCRYPT` stays the\n * existing reversible option for redaction, and a vault-backed `TOKENIZE` member can be added\n * additively if such a mode ships.\n */\n\n/**\n * @wildo_source:part:start saas.models.privacy.redaction-treatments facet:layer:shared facet:audience:app-developer\n *\n * How one field's value is replaced when it is redacted or scrubbed.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Two consumers, and only one of them accepts every member\n *\n * | consumer | what it does | accepts |\n * |---|---|---|\n * | flow-actors `redactionRules` | hides a value in a LOG or an API RESPONSE; the stored row is untouched | every member |\n * | `.impersonalizeWith(...)` on a schema field | ERASURE scrub: permanently rewrites the stored value when the person is erased and the row is retained | `REMOVE` · `MASK` · `RESET` · `KEEP` only |\n *\n * **`HASH` and `ENCRYPT` are accepted by the type and REFUSED at erasure time.** An erasure scrub is\n * one static write shared by every row in the batch, so `HASH` — which would have to hash each row's\n * own value — cannot be expressed and throws. `ENCRYPT` is reversible, and an erasure that can be\n * undone is not an erasure, so it is forbidden here and stays a redaction-only option. Both throw\n * when the erasure runs, not when you author the field, so choosing one leaves a resource that\n * configures cleanly and fails the first time somebody is erased.\n *\n * ## Choosing a treatment for an erasure scrub\n *\n * | the field | treatment |\n * |---|---|\n * | nullable, or `.nullish()` | `REMOVE` — writes `null`. The default choice. |\n * | a constrained string that cannot hold the default mask (`z.email()`, `z.uuid()`, `.min(n)`) | `MASK` with an explicit `maskValue` that satisfies the field's own schema |\n * | NON-nullable and carries a `.default()` — a counter, a settings object, a stage history, an array | `RESET` — writes what the schema says the field is when nobody has set it |\n * | the row's link to its tenant or its creator | nothing: the never-scrub floor already protects it |\n *\n * `RESET` is the one to reach for when the other two do not fit, and that case is common rather than\n * exotic: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure just wrote,\n * and `MASK` writes a string, which cannot express an array, a record, a number or a date.\n *\n * ⚠️ **`RESET` refuses a default that reads the clock.** `.default(() => new Date())` — or a literal\n * `.default(new Date())` evaluated when the module loads — makes the erasure write its OWN timestamp,\n * so a field such as `lastActiveAt` would record the erased person as active at the moment they were\n * erased. That fabricates information rather than removing it. Give the field a static neutral\n * default such as `new Date(0)`, which asserts \"no recorded value\", or make it nullable and use\n * `REMOVE`, which asserts \"unknown\". Those are different claims about a person; choose deliberately.\n *\n * ## The never-scrub floor\n *\n * A row's link to the organization or application it belongs to, and its `createdByUserId`, are\n * never scrubbed — even when a treatment is declared on them. They connect the retained row to the\n * tenant that must keep it, and nulling them would orphan the record the retention exists to\n * preserve. `KEEP` is the way to say the same thing explicitly about any other field.\n *\n * A field with NO `.impersonalizeWith()` is left untouched by an erasure. Declaring nothing is how a\n * legally required value — an invoice line, an amount, a date — survives the erasure of the person\n * the record names.\n *\n * @example Scrubbing a person out of a retained record\n * ```ts\n * import { RedactionType } from '@wildo-ai/saas-models';\n *\n * const contactSchema = z.object({\n *   // nullable → REMOVE\n *   phone: z.string().nullish().impersonalizeWith(RedactionType.REMOVE),\n *   // constrained string → MASK with a value the field's own schema accepts\n *   email: z.email().impersonalizeWith(RedactionType.MASK, { maskValue: 'erased@erased.invalid' }),\n *   // non-nullable with a default → RESET\n *   preferences: z.object({ digest: z.boolean() }).default({ digest: false })\n *     .impersonalizeWith(RedactionType.RESET),\n *   // no treatment → survives the erasure, deliberately\n *   invoicedAmount: z.number(),\n * });\n * ```\n */\nexport enum RedactionType {\n  /** Replace with a fixed mask. In an erasure scrub the value must satisfy the field's own schema — pass `maskValue` when the default mask does not. */\n  MASK = 'mask',\n  /** Remove / null the value. The default erasure scrub; requires a field that can actually hold `null`. */\n  REMOVE = 'remove',\n  /** Replace with a one-way hash. Redaction only — **throws** if an erasure scrub reaches it, because a scrub is one static write and cannot hash per row. */\n  HASH = 'hash',\n  /** Replace with a reversible ciphertext. Redaction only — **forbidden** for an erasure scrub, because a reversible erasure is not an erasure. */\n  ENCRYPT = 'encrypt',\n  /** Erasure scrub only: keep this field exactly as it is. The explicit form of the never-scrub floor. */\n  KEEP = 'keep',\n  /**\n   * Erasure scrub only: reset the field to its OWN schema default.\n   *\n   * The treatment for a field that is non-nullable and carries a `.default()`, where neither of the\n   * others reaches: `REMOVE` writes `null`, which fails the strict re-parse of the row the erasure\n   * just wrote, and `MASK` writes a string, while these fields are arrays, records, numbers, dates\n   * and objects.\n   *\n   * The value is read from the schema rather than authored a second time, so it cannot drift from\n   * the default the field already declares — and for a person's counters and settings, \"what this is\n   * when nobody has set it\" is exactly what an erasure should leave behind.\n   *\n   * Refused when the field declares no `.default()`, and refused when that default reads the clock.\n   */\n  RESET = 'reset',\n}\n/** @wildo_source:part:end saas.models.privacy.redaction-treatments */\n\n\nexport const RedationRulesSchema = z.object({\n  fieldPath: z.string(),\n  isRecursive: z.boolean().default(false), // default false - if true, will redaction all nested fields\n  redactionType: z.enum(RedactionType),\n  forRoles: z.array(RolesSchema).optional(),\n});\n\nexport type RedationRules = z.infer<typeof RedationRulesSchema>;\n"]}

package/dist/esm/compliance/privacy/retention-binding.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-binding.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-binding.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC9B,MAAM,qCAAqC,CAAC;AAsB7C,wEAAwE;AACxE,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAC3D,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAE3D;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAexF;AAYD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,wBAAwB,EACjC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,IAAI,GACR,oBAAoB,CAOtB;AASD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,GAChC,IAAI,GAAG,SAAS,CAIlB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,IAAI,GAAG,SAAS,CAKlB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,YAAY,EAAE,CAgB9E;AAMD,qHAAqH;AACrH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAE9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAAG,SAAS,MAAM,EAAE,CAO1G"}
+{"version":3,"file":"retention-binding.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-binding.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC9B,MAAM,qCAAqC,CAAC;AAsB7C,wEAAwE;AACxE,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAC3D,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAE3D;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAexF;AAYD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,wBAAwB,EACjC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,IAAI,GACR,oBAAoB,CAOtB;AASD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,GAChC,IAAI,GAAG,SAAS,CAIlB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,IAAI,GAAG,SAAS,CAKlB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,YAAY,EAAE,CAgB9E;AAMD,qHAAqH;AACrH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAE9H;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAAG,SAAS,MAAM,EAAE,CAO1G"}

package/dist/esm/compliance/privacy/retention-binding.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-binding.shared.utils.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-binding.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAGnF,OAAO,EACL,+BAA+B,EAC/B,mBAAmB,GAGpB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAC3D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAiC;IAC9E,QAAQ,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3B,KAAK,mBAAmB,CAAC,OAAO,CAAC;QACjC,KAAK,mBAAmB,CAAC,oBAAoB;YAC3C,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB,CAAC,aAAa;YACpC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,OAAO,CAAC,gBAAgB,CAAC;IACpC,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,OAAa;IACnC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,OAAa;IACjC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAkBD,MAAM,UAAU,2BAA2B,CACzC,OAAiC,EACjC,aAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,mBAAmB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,oBAAoB,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,UAAU,KAAK,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;QACpE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,mBAAmB,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B,EAAE,SAAiB;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAwB,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA4B,EAC5B,OAAiC;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,OAAO,CAAC,UAAU,KAAK,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA4B,EAC5B,OAAiC,EACjC,QAAkD;IAElD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,GAAG,oBAAoB,CAAC,CAAC;AACrF,CAAC;AAuBD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAwB;IAC5D,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,iBAAiB,CAAC,UAAmB,CAAiC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,SAAS;QACnD,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAmF;IACnH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAA6C;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,UAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7H,IAAI,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACpI,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC","sourcesContent":["import { getTtlParams, getZodObjectShape, hasTtl } from '@wildo-ai/zod-decorators';\nimport type { z } from 'zod';\n\nimport {\n  RETENTION_STARTED_AT_FIELD_NAME,\n  RetentionStartPoint,\n  type ApplicationRetentionSchedule,\n  type ResourceRetentionBinding,\n} from './retention-schedule.shared.schemas';\n\n/**\n * # Retention binding derivations — one authority for \"when does a bound row expire\"\n *\n * Every consumer of a retention binding asks one of four questions, and each is answered here once:\n *\n * | question | function | consumers |\n * |---|---|---|\n * | which field carries the start instant? | {@link resolveRetentionStartFieldName} | the sweep's query, the factory's field checks |\n * | which rows are past their period now? | {@link resolveBoundRetentionCutoff} | the sweep, the startup past-expiry report |\n * | when did THIS row's clock start / when does it end? | {@link resolveRetentionStartedAt} / {@link resolveRetentionExpiresAt} | subject erasure's `retainedUntil` (#1635), deletion evidence (#1636) |\n * | which resources hold data nobody bound? | {@link unboundRetentionResources} | compliance documents, the startup report |\n *\n * Pure and adapter-neutral: the cutoff is a single `field < instant` comparison, which MongoDB and both\n * PostgreSQL filter compilers evaluate identically — and a NULL start instant matches neither, which is\n * exactly \"a row whose start point has not occurred never expires\" (#1613 invariant 2), by construction\n * rather than by a guard somebody could forget.\n */\n\nconst MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** The infrastructure-owned creation instant both adapters maintain. */\nexport const RETENTION_CREATED_AT_FIELD_NAME = 'createdAt';\n/** The infrastructure-owned last-update instant both adapters maintain. */\nexport const RETENTION_UPDATED_AT_FIELD_NAME = 'updatedAt';\n\n/**\n * The field whose value is a bound row's retention start instant (or, for\n * {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}, the instant the start is derived from).\n *\n * Throws for a {@link RetentionStartPoint.CLOSURE_EVENT} binding with no `closureFieldName`: the factory\n * refuses that configuration, so reaching it here means a binding bypassed the factory, and guessing a\n * field would delete rows by the wrong clock.\n */\nexport function resolveRetentionStartFieldName(binding: ResourceRetentionBinding): string {\n  switch (binding.startPoint) {\n    case RetentionStartPoint.CREATED:\n    case RetentionStartPoint.END_OF_CALENDAR_YEAR:\n      return RETENTION_CREATED_AT_FIELD_NAME;\n    case RetentionStartPoint.LAST_UPDATED:\n      return RETENTION_UPDATED_AT_FIELD_NAME;\n    case RetentionStartPoint.SCOPE_DELETED:\n      return RETENTION_STARTED_AT_FIELD_NAME;\n    case RetentionStartPoint.CLOSURE_EVENT:\n      if (!binding.closureFieldName) {\n        throw new Error('A CLOSURE_EVENT retention binding must name its closureFieldName.');\n      }\n      return binding.closureFieldName;\n  }\n}\n\n/** The instant 00:00:00.000 UTC on 1 January of `instant`'s UTC year. */\nfunction startOfUtcYear(instant: Date): Date {\n  return new Date(Date.UTC(instant.getUTCFullYear(), 0, 1));\n}\n\n/** The last millisecond of `instant`'s UTC year: 31 December 23:59:59.999 UTC. */\nfunction endOfUtcYear(instant: Date): Date {\n  return new Date(Date.UTC(instant.getUTCFullYear() + 1, 0, 1) - 1);\n}\n\n/**\n * The rows a bound resource must delete at `now`: those whose {@link BoundRetentionCutoff.fieldName} is\n * STRICTLY before {@link BoundRetentionCutoff.before}.\n *\n * A row is deleted only AFTER `start + retentionDays`, never at it: a row whose start is exactly\n * `now − retentionDays` has reached the end of its period and not passed it, so it survives this run.\n *\n * For {@link RetentionStartPoint.END_OF_CALENDAR_YEAR} the comparison is still on `createdAt`, rewritten\n * so no per-row arithmetic is needed: `endOfYear(createdAt) + days < now` holds exactly when `createdAt`\n * falls in a year BEFORE the year of `now − days`, i.e. `createdAt < 1 January (UTC) of year(now − days)`.\n */\nexport interface BoundRetentionCutoff {\n  readonly fieldName: string;\n  readonly before: Date;\n}\n\nexport function resolveBoundRetentionCutoff(\n  binding: ResourceRetentionBinding,\n  retentionDays: number,\n  now: Date,\n): BoundRetentionCutoff {\n  const fieldName = resolveRetentionStartFieldName(binding);\n  const periodStartedBefore = new Date(now.getTime() - retentionDays * MILLISECONDS_PER_DAY);\n  if (binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR) {\n    return { fieldName, before: startOfUtcYear(periodStartedBefore) };\n  }\n  return { fieldName, before: periodStartedBefore };\n}\n\nfunction readInstant(row: Record<string, unknown>, fieldName: string): Date | undefined {\n  const value = row[fieldName];\n  if (value === null || value === undefined) return undefined;\n  const instant = value instanceof Date ? value : new Date(value as string | number);\n  return Number.isNaN(instant.getTime()) ? undefined : instant;\n}\n\n/**\n * When `row`'s retention clock started, or `undefined` while its start point has not occurred (an open\n * CLOSURE_EVENT row, a SCOPE_DELETED row whose organization still exists).\n */\nexport function resolveRetentionStartedAt(\n  row: Record<string, unknown>,\n  binding: ResourceRetentionBinding,\n): Date | undefined {\n  const instant = readInstant(row, resolveRetentionStartFieldName(binding));\n  if (!instant) return undefined;\n  return binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR ? endOfUtcYear(instant) : instant;\n}\n\n/**\n * The instant after which `row` is deleted under the CURRENT schedule, or `undefined` when its start\n * point has not occurred or its class declares no period (undeclared is \"not decided\", never \"now\").\n */\nexport function resolveRetentionExpiresAt(\n  row: Record<string, unknown>,\n  binding: ResourceRetentionBinding,\n  schedule: ApplicationRetentionSchedule | undefined,\n): Date | undefined {\n  const period = schedule?.[binding.retentionClass];\n  const startedAt = resolveRetentionStartedAt(row, binding);\n  if (!period || !startedAt) return undefined;\n  return new Date(startedAt.getTime() + period.retentionDays * MILLISECONDS_PER_DAY);\n}\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// Row TTL — the OTHER retention authority, kept for framework plumbing that holds no business data\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n\n/**\n * A declared `.ttl()` ROW-EXPIRY policy: rows expire `expireAfterSeconds` after `fieldName`'s value.\n *\n * `expireAfterSeconds: 0` means the field IS the absolute expiry instant (`jobPayloadStorage.expiresAt`);\n * a positive value is a window measured from the field (`jobExecutions.createdAt`). These are MongoDB's\n * `expireAfterSeconds` semantics verbatim, so one declaration cannot mean two things per adapter.\n *\n * Distinct from a {@link ResourceRetentionBinding} on purpose: `.ttl()` is a fixed number of seconds on a\n * field, for framework plumbing that holds no business or personal data, and MongoDB honours it NATIVELY\n * with no application code running. A resource holding such data binds a class instead, and a resource\n * may not declare both (one row, one retention authority).\n */\nexport interface RowTtlPolicy {\n  readonly fieldName: string;\n  readonly expireAfterSeconds: number;\n}\n\n/**\n * Every `.ttl()` declaration on a resource's main schema — ONE authority, read by the SQL planner, the\n * `.ttl()` sweep, the startup refusals and the resource factory.\n *\n * Tolerates a non-object schema (it declares no fields, so no TTL): this is called while enumerating\n * EVERY registered resource, and one exotic schema must not take the enumeration down.\n */\nexport function collectRowTtlPolicies(mainSchema: z.ZodTypeAny): RowTtlPolicy[] {\n  let shape: Record<string, z.ZodTypeAny> | undefined;\n  try {\n    shape = getZodObjectShape(mainSchema as never) as Record<string, z.ZodTypeAny>;\n  } catch {\n    return [];\n  }\n  if (!shape) return [];\n  const policies: RowTtlPolicy[] = [];\n  for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n    if (!fieldSchema || !hasTtl(fieldSchema)) continue;\n    const params = getTtlParams(fieldSchema);\n    if (!params) continue;\n    policies.push({ fieldName, expireAfterSeconds: params.expireAfterSeconds });\n  }\n  return policies;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// The gap report\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n\n/** The part of a resource configuration the gap report reads. Structural, so it takes a registry's configs as-is. */\nexport interface RetentionBindingGapInput {\n  readonly resourceIdentifier: string;\n  readonly retentionBinding?: ResourceRetentionBinding;\n  readonly mainSchema?: unknown;\n}\n\n/**\n * THE rule for \"kept until erased\": a resource no retention mechanism ever deletes has no class binding\n * and no `.ttl()`. One predicate, so the startup report (which reads schemas) and the RETENTION_RULES\n * document fact (which receives `declaresRowTtl` across a JSON boundary) cannot disagree about who is in\n * the list.\n */\nexport function isKeptUntilErased(resource: { readonly retentionBinding?: unknown; readonly declaresRowTtl: boolean }): boolean {\n  return !resource.retentionBinding && !resource.declaresRowTtl;\n}\n\n/**\n * The resources whose rows no retention mechanism ever deletes: no class binding and no `.ttl()`.\n *\n * Kept until erased. That is today's behaviour for every unbound resource and is not wrong in itself —\n * it is UNDECIDED, and this report is what keeps it visible next to `undeclaredRetentionClasses`, in the\n * compliance documents and in the startup log. Rejected: defaulting every unbound resource to\n * `RESOURCE_DATA`. That would silently delete data nobody decided about.\n *\n * Sorted, so two runs over the same registry produce the same list.\n */\nexport function unboundRetentionResources(resources: Iterable<RetentionBindingGapInput>): readonly string[] {\n  const unbound: string[] = [];\n  for (const resource of resources) {\n    const declaresRowTtl = Boolean(resource.mainSchema) && collectRowTtlPolicies(resource.mainSchema as z.ZodTypeAny).length > 0;\n    if (isKeptUntilErased({ retentionBinding: resource.retentionBinding, declaresRowTtl })) unbound.push(resource.resourceIdentifier);\n  }\n  return unbound.sort();\n}\n"]}
+{"version":3,"file":"retention-binding.shared.utils.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-binding.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAGnF,OAAO,EACL,+BAA+B,EAC/B,mBAAmB,GAGpB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAC3D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAiC;IAC9E,QAAQ,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3B,KAAK,mBAAmB,CAAC,OAAO,CAAC;QACjC,KAAK,mBAAmB,CAAC,oBAAoB;YAC3C,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB,CAAC,aAAa;YACpC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,OAAO,CAAC,gBAAgB,CAAC;IACpC,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,OAAa;IACnC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,OAAa;IACjC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAkBD,MAAM,UAAU,2BAA2B,CACzC,OAAiC,EACjC,aAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,mBAAmB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,oBAAoB,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,UAAU,KAAK,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;QACpE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,mBAAmB,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B,EAAE,SAAiB;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAwB,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA4B,EAC5B,OAAiC;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,OAAO,CAAC,UAAU,KAAK,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA4B,EAC5B,OAAiC,EACjC,QAAkD;IAElD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,GAAG,oBAAoB,CAAC,CAAC;AACrF,CAAC;AAuBD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAwB;IAC5D,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,iBAAiB,CAAC,UAAmB,CAAiC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,SAAS;QACnD,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAmF;IACnH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAA6C;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,UAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7H,IAAI,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACpI,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC","sourcesContent":["import { getTtlParams, getZodObjectShape, hasTtl } from '@wildo-ai/zod-decorators';\nimport type { z } from 'zod';\n\nimport {\n  RETENTION_STARTED_AT_FIELD_NAME,\n  RetentionStartPoint,\n  type ApplicationRetentionSchedule,\n  type ResourceRetentionBinding,\n} from './retention-schedule.shared.schemas';\n\n/**\n * # Retention binding derivations — one authority for \"when does a bound row expire\"\n *\n * Every consumer of a retention binding asks one of four questions, and each is answered here once:\n *\n * | question | function | consumers |\n * |---|---|---|\n * | which field carries the start instant? | {@link resolveRetentionStartFieldName} | the sweep's query, the factory's field checks |\n * | which rows are past their period now? | {@link resolveBoundRetentionCutoff} | the sweep, the startup past-expiry report |\n * | when did THIS row's clock start / when does it end? | {@link resolveRetentionStartedAt} / {@link resolveRetentionExpiresAt} | subject erasure's `retainedUntil` (#1635), deletion evidence (#1636) |\n * | which resources hold data nobody bound? | {@link unboundRetentionResources} | compliance documents, the startup report |\n *\n * Pure and adapter-neutral: the cutoff is a single `field < instant` comparison, which MongoDB and both\n * PostgreSQL filter compilers evaluate identically — and a NULL start instant matches neither, which is\n * exactly \"a row whose start point has not occurred never expires\" (#1613 invariant 2), by construction\n * rather than by a guard somebody could forget.\n */\n\nconst MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;\n\n/** The infrastructure-owned creation instant both adapters maintain. */\nexport const RETENTION_CREATED_AT_FIELD_NAME = 'createdAt';\n/** The infrastructure-owned last-update instant both adapters maintain. */\nexport const RETENTION_UPDATED_AT_FIELD_NAME = 'updatedAt';\n\n/**\n * The field whose value is a bound row's retention start instant (or, for\n * {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}, the instant the start is derived from).\n *\n * Throws for a {@link RetentionStartPoint.CLOSURE_EVENT} binding with no `closureFieldName`: the factory\n * refuses that configuration, so reaching it here means a binding bypassed the factory, and guessing a\n * field would delete rows by the wrong clock.\n */\nexport function resolveRetentionStartFieldName(binding: ResourceRetentionBinding): string {\n  switch (binding.startPoint) {\n    case RetentionStartPoint.CREATED:\n    case RetentionStartPoint.END_OF_CALENDAR_YEAR:\n      return RETENTION_CREATED_AT_FIELD_NAME;\n    case RetentionStartPoint.LAST_UPDATED:\n      return RETENTION_UPDATED_AT_FIELD_NAME;\n    case RetentionStartPoint.SCOPE_DELETED:\n      return RETENTION_STARTED_AT_FIELD_NAME;\n    case RetentionStartPoint.CLOSURE_EVENT:\n      if (!binding.closureFieldName) {\n        throw new Error('A CLOSURE_EVENT retention binding must name its closureFieldName.');\n      }\n      return binding.closureFieldName;\n  }\n}\n\n/** The instant 00:00:00.000 UTC on 1 January of `instant`'s UTC year. */\nfunction startOfUtcYear(instant: Date): Date {\n  return new Date(Date.UTC(instant.getUTCFullYear(), 0, 1));\n}\n\n/** The last millisecond of `instant`'s UTC year: 31 December 23:59:59.999 UTC. */\nfunction endOfUtcYear(instant: Date): Date {\n  return new Date(Date.UTC(instant.getUTCFullYear() + 1, 0, 1) - 1);\n}\n\n/**\n * The rows a bound resource must delete at `now`: those whose {@link BoundRetentionCutoff.fieldName} is\n * STRICTLY before {@link BoundRetentionCutoff.before}.\n *\n * A row is deleted only AFTER `start + retentionDays`, never at it: a row whose start is exactly\n * `now − retentionDays` has reached the end of its period and not passed it, so it survives this run.\n *\n * For {@link RetentionStartPoint.END_OF_CALENDAR_YEAR} the comparison is still on `createdAt`, rewritten\n * so no per-row arithmetic is needed: `endOfYear(createdAt) + days < now` holds exactly when `createdAt`\n * falls in a year BEFORE the year of `now − days`, i.e. `createdAt < 1 January (UTC) of year(now − days)`.\n */\nexport interface BoundRetentionCutoff {\n  readonly fieldName: string;\n  readonly before: Date;\n}\n\nexport function resolveBoundRetentionCutoff(\n  binding: ResourceRetentionBinding,\n  retentionDays: number,\n  now: Date,\n): BoundRetentionCutoff {\n  const fieldName = resolveRetentionStartFieldName(binding);\n  const periodStartedBefore = new Date(now.getTime() - retentionDays * MILLISECONDS_PER_DAY);\n  if (binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR) {\n    return { fieldName, before: startOfUtcYear(periodStartedBefore) };\n  }\n  return { fieldName, before: periodStartedBefore };\n}\n\nfunction readInstant(row: Record<string, unknown>, fieldName: string): Date | undefined {\n  const value = row[fieldName];\n  if (value === null || value === undefined) return undefined;\n  const instant = value instanceof Date ? value : new Date(value as string | number);\n  return Number.isNaN(instant.getTime()) ? undefined : instant;\n}\n\n/**\n * When `row`'s retention clock started, or `undefined` while its start point has not occurred (an open\n * CLOSURE_EVENT row, a SCOPE_DELETED row whose organization still exists).\n */\nexport function resolveRetentionStartedAt(\n  row: Record<string, unknown>,\n  binding: ResourceRetentionBinding,\n): Date | undefined {\n  const instant = readInstant(row, resolveRetentionStartFieldName(binding));\n  if (!instant) return undefined;\n  return binding.startPoint === RetentionStartPoint.END_OF_CALENDAR_YEAR ? endOfUtcYear(instant) : instant;\n}\n\n/**\n * The instant after which `row` is deleted under the CURRENT schedule, or `undefined` when its start\n * point has not occurred or its class declares no period (undeclared is \"not decided\", never \"now\").\n */\nexport function resolveRetentionExpiresAt(\n  row: Record<string, unknown>,\n  binding: ResourceRetentionBinding,\n  schedule: ApplicationRetentionSchedule | undefined,\n): Date | undefined {\n  const period = schedule?.[binding.retentionClass];\n  const startedAt = resolveRetentionStartedAt(row, binding);\n  if (!period || !startedAt) return undefined;\n  return new Date(startedAt.getTime() + period.retentionDays * MILLISECONDS_PER_DAY);\n}\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// Row TTL — the OTHER retention authority, kept for framework plumbing that holds no business data\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n\n/**\n * A declared `.ttl()` ROW-EXPIRY policy: rows expire `expireAfterSeconds` after `fieldName`'s value.\n *\n * `expireAfterSeconds: 0` means the field IS the absolute expiry instant (`jobPayloadStorage.expiresAt`);\n * a positive value is a window measured from the field (`jobExecutions.createdAt`). These are MongoDB's\n * `expireAfterSeconds` semantics verbatim, so one declaration cannot mean two things per adapter.\n *\n * Distinct from a {@link ResourceRetentionBinding} on purpose: `.ttl()` is a fixed number of seconds on a\n * field, for framework plumbing that holds no business or personal data, and MongoDB honours it NATIVELY\n * with no application code running. A resource holding such data binds a class instead, and a resource\n * may not declare both (one row, one retention authority).\n */\nexport interface RowTtlPolicy {\n  readonly fieldName: string;\n  readonly expireAfterSeconds: number;\n}\n\n/**\n * Every `.ttl()` declaration on a resource's main schema — ONE authority, read by the SQL planner, the\n * `.ttl()` sweep, the startup refusals and the resource factory.\n *\n * Tolerates a non-object schema (it declares no fields, so no TTL): this is called while enumerating\n * EVERY registered resource, and one exotic schema must not take the enumeration down.\n */\nexport function collectRowTtlPolicies(mainSchema: z.ZodTypeAny): RowTtlPolicy[] {\n  let shape: Record<string, z.ZodTypeAny> | undefined;\n  try {\n    shape = getZodObjectShape(mainSchema as never) as Record<string, z.ZodTypeAny>;\n  } catch {\n    return [];\n  }\n  if (!shape) return [];\n  const policies: RowTtlPolicy[] = [];\n  for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n    if (!fieldSchema || !hasTtl(fieldSchema)) continue;\n    const params = getTtlParams(fieldSchema);\n    if (!params) continue;\n    policies.push({ fieldName, expireAfterSeconds: params.expireAfterSeconds });\n  }\n  return policies;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// The gap report\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n\n/** The part of a resource configuration the gap report reads. Structural, so it takes a registry's configs as-is. */\nexport interface RetentionBindingGapInput {\n  readonly resourceIdentifier: string;\n  readonly retentionBinding?: ResourceRetentionBinding;\n  readonly mainSchema?: unknown;\n}\n\n/**\n * THE rule for \"kept until erased\": a resource no retention mechanism ever deletes has no class binding\n * and no `.ttl()`. One predicate, so the startup report (which reads schemas) and the RETENTION_RULES\n * document fact (which receives `declaresRowTtl` across a JSON boundary) cannot disagree about who is in\n * the list.\n */\nexport function isKeptUntilErased(resource: { readonly retentionBinding?: unknown; readonly declaresRowTtl: boolean }): boolean {\n  return !resource.retentionBinding && !resource.declaresRowTtl;\n}\n\n/**\n * The resources whose rows no retention mechanism ever deletes: no class binding and no `.ttl()`.\n *\n * Kept until erased. That is today's behaviour for every unbound resource and is not wrong in itself —\n * it is UNDECIDED, and this report is what keeps it visible next to `undeclaredRetentionClasses`, in the\n * compliance documents and in the startup log. Rejected: defaulting every unbound resource to\n * `RESOURCE_DATA`. That would silently delete data nobody decided about.\n *\n * Sorted, so two runs over the same registry produce the same list.\n */\nexport function unboundRetentionResources(resources: Iterable<RetentionBindingGapInput>): readonly string[] {\n  const unbound: string[] = [];\n  for (const resource of resources) {\n    const declaresRowTtl = Boolean(resource.mainSchema) && collectRowTtlPolicies(resource.mainSchema as z.ZodTypeAny).length > 0;\n    if (isKeptUntilErased({ retentionBinding: resource.retentionBinding, declaresRowTtl })) unbound.push(resource.resourceIdentifier);\n  }\n  return unbound.sort();\n}\n"]}

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-enforcement-records.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAG1I,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAoC,MAAM,gDAAgD,CAAC;AAE/H,eAAO,MAAM,sEAAsE,GACjF,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;kBAsF9C,CAAC"}
+{"version":3,"file":"retention-enforcement-records.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAG1I,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAoC,MAAM,gDAAgD,CAAC;AAE/H,eAAO,MAAM,sEAAsE,GACjF,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;kBAsF9C,CAAC"}

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-enforcement-records.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,MAAM,gDAAgD,CAAC;AAE/H,MAAM,CAAC,MAAM,sEAAsE,GAAG,CACpF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,gCAAgC;IAC5C,kBAAkB,EAAE,gBAAgB,CAAC,6BAA6B;IAClE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,6BAA6B,CAAC;IAC3G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;OAMG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE;;;;;OAKG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,OAAO;KACxC;IAED,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,qGAAqG;QACrG,wGAAwG;QACxG,oGAAoG;QACpG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,GAAG,gCAAgC,CAAC;oBAC5C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,GAAG,gCAAgC,CAAC;oBAC5C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE;wBACZ,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;wBACxB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;wBAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;qBAClB;oBACD,+FAA+F;oBAC/F,UAAU,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,CAAU;oBACpF,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;QACD,iGAAiG;QACjG,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Retention-enforcement records: resource configuration (#1636).\n *\n * ONE writer and two readers:\n * - the writer is the retention-class sweep, through the repository (`CREATE` is `REPOSITORY_ONLY`, so no\n *   route creates a record). It uses the repository rather than the trusted-system-write primitive on\n *   purpose, for the provider-call-records reason: `createAsSystem` emits a `SYSTEM_CONTEXT_WRITE` audit row\n *   per call, and the run already emits ONE `RETENTION_ENFORCEMENT_RECORDED` event carrying its totals.\n * - the application administration console reads them (`READ`/`LIST` are `API_CALL`) — the operator's view\n *   of whether each declared period is being enforced;\n * - the retention-enforcement evidence door reads a window of them for an assurance collector.\n *\n * APPEND-ONLY: there is no UPDATE. A run happened; a later run is a new row. `DELETE_MANY` exists only for\n * the retention-class sweep itself, which deletes records past the application's declared `AUDIT_LOGS`\n * period, and it is `INTERNAL_CALL`, so enforcing retention on the evidence creates no public deletion route.\n */\nimport { z } from 'zod';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { APPLICATION_AUDIT_LOG_READ_ROLES } from '../audit-trails/application-audit-logs.shared.resources-config.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\nimport { RetentionEnforcementOutcome, RetentionEnforcementRecordSchema } from './retention-enforcement-records.shared.schemas';\n\nexport const retentionEnforcementRecordsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.DELETE_MANY,\n  typeof RetentionEnforcementRecordSchema\n>({\n  mainSchema: RetentionEnforcementRecordSchema,\n  resourceIdentifier: CoreResourceType.RETENTION_ENFORCEMENT_RECORDS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.RETENTION_ENFORCEMENT_RECORDS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /*\n   * Subject-export: FORBIDDEN, and deliberately NO `retentionPolicy`. A record holds counts and instants about\n   * a resource TYPE and names no person and no row (see the schema header), so it is not data about a subject\n   * and no erasure visits it. FORBIDDEN rather than undeclared so the decision is visible, the\n   * provider-call-records precedent. If a field ever named a row or a person, this exemption is wrong and must\n   * be revisited in the same change.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n  /*\n   * Kept for the application's declared AUDIT_LOGS period, counted from the record's creation. This is the\n   * operator's defence evidence that retention was enforced, so it must outlive the data it describes: the\n   * AUDIT_LOGS period is the one the audit trail itself is kept for. The sweep that writes these rows is also\n   * what deletes them once that period ends, through the same service-layer path as every bound resource.\n   */\n  retentionBinding: {\n    retentionClass: DataRetentionClass.AUDIT_LOGS,\n    startPoint: RetentionStartPoint.CREATED,\n  },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.DELETE_MANY,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n      }],\n    },\n    // The audit door's audience (`APPLICATION_AUDIT_LOG_READ_ROLES`): the operator who acts on a failing\n    // sweep, and an evidence reader who must read and must not act. No tenant's rows are behind this door —\n    // a record names a resource type, never an organization — so no cross-tenant admission is declared.\n    [CoreResourceOperation.READ]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n      }],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        filterFields: {\n          retentionClass: z.enum(DataRetentionClass),\n          resourceType: z.string(),\n          outcome: z.enum(RetentionEnforcementOutcome),\n          runRef: z.string(),\n          sweptAt: z.date(),\n        },\n        /** `_id` last, as the keyset tie-breaker: one run writes many rows with the same `sweptAt`. */\n        sortFields: ['sweptAt', 'retentionClass', 'resourceType', 'outcome', '_id'] as const,\n        maxPaginatedResultPerPageLimit: 100,\n      }],\n    },\n    // The retention-class sweep deletes expired pages through the SERVICE layer, which resolves only\n    // INTERNAL_CALL (not REPOSITORY_ONLY) — and INTERNAL_CALL is route-less too.\n    [CoreResourceOperation.DELETE_MANY]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.HIGH,\n      }],\n    },\n  },\n});\n"]}
+{"version":3,"file":"retention-enforcement-records.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-enforcement-records.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,MAAM,gDAAgD,CAAC;AAE/H,MAAM,CAAC,MAAM,sEAAsE,GAAG,CACpF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,gCAAgC;IAC5C,kBAAkB,EAAE,gBAAgB,CAAC,6BAA6B;IAClE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,6BAA6B,CAAC;IAC3G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;OAMG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IAEzE;;;;;OAKG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,OAAO;KACxC;IAED,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,qGAAqG;QACrG,wGAAwG;QACxG,oGAAoG;QACpG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,GAAG,gCAAgC,CAAC;oBAC5C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,GAAG,gCAAgC,CAAC;oBAC5C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE;wBACZ,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;wBACxB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;wBAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;qBAClB;oBACD,+FAA+F;oBAC/F,UAAU,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,CAAU;oBACpF,8BAA8B,EAAE,GAAG;iBACpC,CAAC;SACH;QACD,iGAAiG;QACjG,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Retention-enforcement records: resource configuration (#1636).\n *\n * ONE writer and two readers:\n * - the writer is the retention-class sweep, through the repository (`CREATE` is `REPOSITORY_ONLY`, so no\n *   route creates a record). It uses the repository rather than the trusted-system-write primitive on\n *   purpose, for the provider-call-records reason: `createAsSystem` emits a `SYSTEM_CONTEXT_WRITE` audit row\n *   per call, and the run already emits ONE `RETENTION_ENFORCEMENT_RECORDED` event carrying its totals.\n * - the application administration console reads them (`READ`/`LIST` are `API_CALL`) — the operator's view\n *   of whether each declared period is being enforced;\n * - the retention-enforcement evidence door reads a window of them for an assurance collector.\n *\n * APPEND-ONLY: there is no UPDATE. A run happened; a later run is a new row. `DELETE_MANY` exists only for\n * the retention-class sweep itself, which deletes records past the application's declared `AUDIT_LOGS`\n * period, and it is `INTERNAL_CALL`, so enforcing retention on the evidence creates no public deletion route.\n */\nimport { z } from 'zod';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../../security/authorizations/roles.shared.schemas';\nimport { APPLICATION_AUDIT_LOG_READ_ROLES } from '../audit-trails/application-audit-logs.shared.resources-config.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\nimport { RetentionEnforcementOutcome, RetentionEnforcementRecordSchema } from './retention-enforcement-records.shared.schemas';\n\nexport const retentionEnforcementRecordsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.CREATE | CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.DELETE_MANY,\n  typeof RetentionEnforcementRecordSchema\n>({\n  mainSchema: RetentionEnforcementRecordSchema,\n  resourceIdentifier: CoreResourceType.RETENTION_ENFORCEMENT_RECORDS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.RETENTION_ENFORCEMENT_RECORDS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /*\n   * Subject-export: FORBIDDEN, and deliberately NO `retentionPolicy`. A record holds counts and instants about\n   * a resource TYPE and names no person and no row (see the schema header), so it is not data about a subject\n   * and no erasure visits it. FORBIDDEN rather than undeclared so the decision is visible, the\n   * provider-call-records precedent. If a field ever named a row or a person, this exemption is wrong and must\n   * be revisited in the same change.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n\n  /*\n   * Kept for the application's declared AUDIT_LOGS period, counted from the record's creation. This is the\n   * operator's defence evidence that retention was enforced, so it must outlive the data it describes: the\n   * AUDIT_LOGS period is the one the audit trail itself is kept for. The sweep that writes these rows is also\n   * what deletes them once that period ends, through the same service-layer path as every bound resource.\n   */\n  retentionBinding: {\n    retentionClass: DataRetentionClass.AUDIT_LOGS,\n    startPoint: RetentionStartPoint.CREATED,\n  },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.DELETE_MANY,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n      }],\n    },\n    // The audit door's audience (`APPLICATION_AUDIT_LOG_READ_ROLES`): the operator who acts on a failing\n    // sweep, and an evidence reader who must read and must not act. No tenant's rows are behind this door —\n    // a record names a resource type, never an organization — so no cross-tenant admission is declared.\n    [CoreResourceOperation.READ]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n      }],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [...APPLICATION_AUDIT_LOG_READ_ROLES],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        filterFields: {\n          retentionClass: z.enum(DataRetentionClass),\n          resourceType: z.string(),\n          outcome: z.enum(RetentionEnforcementOutcome),\n          runRef: z.string(),\n          sweptAt: z.date(),\n        },\n        /** `_id` last, as the keyset tie-breaker: one run writes many rows with the same `sweptAt`. */\n        sortFields: ['sweptAt', 'retentionClass', 'resourceType', 'outcome', '_id'] as const,\n        maxPaginatedResultPerPageLimit: 100,\n      }],\n    },\n    // The retention-class sweep deletes expired pages through the SERVICE layer, which resolves only\n    // INTERNAL_CALL (not REPOSITORY_ONLY) — and INTERNAL_CALL is route-less too.\n    [CoreResourceOperation.DELETE_MANY]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.HIGH,\n      }],\n    },\n  },\n});\n"]}

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-enforcement-records.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-enforcement-records.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE9F,gIAAgI;AAChI;;;GAGG;AACH,oBAAY,2BAA2B;IACrC,sGAAsG;IACtG,SAAS,cAAc;IACvB;;;;OAIG;IACH,mBAAmB,wBAAwB;IAC3C,wHAAwH;IACxH,MAAM,WAAW;IACjB,gHAAgH;IAChH,OAAO,YAAY;CACpB;AAED,uHAAuH;AACvH,oBAAY,+BAA+B;IACzC,2FAA2F;IAC3F,IAAI,SAAS;IACb,+FAA+F;IAC/F,MAAM,WAAW;IACjB,+HAA+H;IAC/H,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,uBAAuB,4BAA4B;IACnD;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;GAGG;AACH,oBAAY,6BAA6B;IACvC,6GAA6G;IAC7G,gBAAgB,qBAAqB;IACrC,iGAAiG;IACjG,wBAAwB,6BAA6B;CACtD;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;iBAuD3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,8EAA8E;AAE9E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,QAAiB,CAAC;AAEhE,qIAAqI;AACrI,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,+BAA+B,CAAC;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,6BAA6B,CAAC;CACrD;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,gCAAgC,EAAE,cAAc,GAAG,YAAY,GAAG,mBAAmB,CAAC,GAAG,2BAA2B,CAK9K;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,gCAAgC,EACxC,GAAG,EAAE;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GACxF,IAAI,CAAC,0BAA0B,EAAE,KAAK,GAAG,WAAW,CAAC,CAoBvD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;iBAA6F,CAAC;AACnJ,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;iBAM7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAI9F;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,4BAA4B,GAAG,SAAS,CAY9G"}
+{"version":3,"file":"retention-enforcement-records.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-enforcement-records.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE9F,gIAAgI;AAChI;;;GAGG;AACH,oBAAY,2BAA2B;IACrC,sGAAsG;IACtG,SAAS,cAAc;IACvB;;;;OAIG;IACH,mBAAmB,wBAAwB;IAC3C,wHAAwH;IACxH,MAAM,WAAW;IACjB,gHAAgH;IAChH,OAAO,YAAY;CACpB;AAED,uHAAuH;AACvH,oBAAY,+BAA+B;IACzC,2FAA2F;IAC3F,IAAI,SAAS;IACb,+FAA+F;IAC/F,MAAM,WAAW;IACjB,+HAA+H;IAC/H,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,uBAAuB,4BAA4B;IACnD;;;;OAIG;IACH,UAAU,eAAe;CAC1B;AAED;;;GAGG;AACH,oBAAY,6BAA6B;IACvC,6GAA6G;IAC7G,gBAAgB,qBAAqB;IACrC,iGAAiG;IACjG,wBAAwB,6BAA6B;CACtD;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;iBAuD3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,8EAA8E;AAE9E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,QAAiB,CAAC;AAEhE,qIAAqI;AACrI,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,+BAA+B,CAAC;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,6BAA6B,CAAC;CACrD;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,gCAAgC,EAAE,cAAc,GAAG,YAAY,GAAG,mBAAmB,CAAC,GAAG,2BAA2B,CAK9K;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,gCAAgC,EACxC,GAAG,EAAE;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GACxF,IAAI,CAAC,0BAA0B,EAAE,KAAK,GAAG,WAAW,CAAC,CAoBvD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;iBAA6F,CAAC;AACnJ,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;iBAM7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAI9F;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,4BAA4B,GAAG,SAAS,CAY9G"}

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-enforcement-records.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-enforcement-records.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE9F,gIAAgI;AAChI;;;GAGG;AACH,MAAM,CAAN,IAAY,2BAaX;AAbD,WAAY,2BAA2B;IACrC,sGAAsG;IACtG,sDAAuB,CAAA;IACvB;;;;OAIG;IACH,0EAA2C,CAAA;IAC3C,wHAAwH;IACxH,gDAAiB,CAAA;IACjB,gHAAgH;IAChH,kDAAmB,CAAA;AACrB,CAAC,EAbW,2BAA2B,KAA3B,2BAA2B,QAatC;AAED,uHAAuH;AACvH,MAAM,CAAN,IAAY,+BAkBX;AAlBD,WAAY,+BAA+B;IACzC,2FAA2F;IAC3F,gDAAa,CAAA;IACb,+FAA+F;IAC/F,oDAAiB,CAAA;IACjB,+HAA+H;IAC/H,8DAA2B,CAAA;IAC3B;;;OAGG;IACH,sFAAmD,CAAA;IACnD;;;;OAIG;IACH,4DAAyB,CAAA;AAC3B,CAAC,EAlBW,+BAA+B,KAA/B,+BAA+B,QAkB1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,6GAA6G;IAC7G,sEAAqC,CAAA;IACrC,iGAAiG;IACjG,sFAAqD,CAAA;AACvD,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,2GAA2G;IAC3G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAE/C;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAElD;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACxD,8FAA8F;IAC9F,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1G,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;IAEzE;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2GAA2G;IAC3G,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,gHAAgH;IAChH,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD;;;OAGG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAE9B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACrH,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,UAAU,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IAC9G,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IAExG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAEH,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBhE;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAmG;IAC/I,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,MAAM,CAAC;IACjF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,OAAO,CAAC;IAChF,IAAI,MAAM,CAAC,iBAAiB;QAAE,OAAO,2BAA2B,CAAC,mBAAmB,CAAC;IACrF,OAAO,2BAA2B,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAAwC,EACxC,GAAyF;IAEzF,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,MAAM,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,6BAA6B,CAAC,MAAM,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,gCAAgC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnJ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC;IAC1D,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAGH,MAAM,2CAA2C,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,wBAAwB,EAAE,wBAAwB,CAAU,CAAC;AAEvI;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,KAAc;IAClE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,KAA+B,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACtH,MAAM,OAAO,GAAG,CAAE,KAAgC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACzD,MAAM,OAAO,GAA4B,EAAE,GAAI,MAAkC,EAAE,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,2CAA2C,EAAE,CAAC;YAChE,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAW,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,kCAAkC,CAAC,SAAS,CAAC,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,CAAC,CAAC;IAChH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC","sourcesContent":["/**\n * One row per (retention-class sweep run × class-bound resource): what the run deleted for that resource,\n * under which declared period, what it held back, and how it ended (#1636).\n *\n * ## Why a store, when the sweep already returns its outcome\n *\n * GDPR Art. 5(1)(e) (storage limitation) is a principle the operator must be able to DEMONSTRATE\n * (Art. 5(2), accountability). The sweep's run output is transient: a successful run's result is kept only\n * as long as the job execution that carried it, and a failed run survives only as an invocation status. So\n * after #1613 the engine deleted by period and nothing durable said that it had. This row is that record,\n * and it is the first producer of `AssuranceDocumentFactAuthorityKind.RUNTIME_EVIDENCE`: a privacy notice\n * says a class's retention is ENFORCED only when these rows show it.\n *\n * ## Counts and instants only, by construction\n *\n * The evidence must outlive the rows it describes WITHOUT re-creating them. So no field names a deleted\n * row, and none carries a field value: {@link projectRetentionEnforcementRecord} is the only producer and\n * copies a closed list of counts, instants and vocabulary members. A row id or a value added here would\n * turn deletion evidence into a copy of what was deleted — the key set is pinned by a test for that reason.\n *\n * ## Every run, including a failed one\n *\n * The sweep writes one row per bound resource per run in a `finally`, so a run that fails still leaves a\n * `FAILED` row: a failed run is evidence too, and an operator whose sweep stopped working must be able to\n * see WHEN it stopped. A resource the sweep skipped leaves a `SKIPPED` row naming why, because a skip that\n * leaves nothing is indistinguishable from a sweep that never ran.\n *\n * ## Retention of the evidence itself\n *\n * Bound to `AUDIT_LOGS` from `CREATED` (see the resource configuration): this is the operator's defence\n * evidence, so it is kept as long as the audit trail and outlives the data it describes.\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — records evidence that declared retention was enforced.\n */\nimport { z } from 'zod';\n\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\n\n/** @wildo_source:part:start saas.models.privacy.retention-enforcement-record facet:layer:shared facet:audience:app-developer */\n/**\n * How one sweep run ended for one class-bound resource. The three non-skip members are the three outcomes\n * the sweep distinguishes; `SKIPPED` is a resource the sweep deliberately did not work on this run.\n */\nexport enum RetentionEnforcementOutcome {\n  /** Every row past its period that the sweep listed was deleted; nothing was left for the next run. */\n  COMPLETED = 'COMPLETED',\n  /**\n   * The run stopped at its per-run ceiling with expired rows still waiting, which the next run resumes.\n   * Normal operation after a period is shortened or a backlog builds up, and NOT a failure: the period is\n   * being enforced, bounded per run so a mistake cannot become one unbounded delete.\n   */\n  DEFERRED_BY_CEILING = 'DEFERRED_BY_CEILING',\n  /** Listing or deleting failed, or the delete removed nothing. Retention was NOT enforced for this resource this run. */\n  FAILED = 'FAILED',\n  /** The sweep did not work on this resource this run; `skipReason` says why. Neither enforcement nor failure. */\n  SKIPPED = 'SKIPPED',\n}\n\n/** Which step of a resource's sweep failed. Named so the log, the thrown message and the record say the same thing. */\nexport enum RetentionClassSweepFailureStage {\n  /** Listing expired rows failed, so nothing more was deleted for that resource this run. */\n  READ = 'read',\n  /** A service-layer delete failed; earlier rows of the same resource may already be deleted. */\n  DELETE = 'delete',\n  /** The same rows were listed again after being deleted — the delete removed nothing, so the sweep stopped rather than loop. */\n  NO_PROGRESS = 'no-progress',\n  /**\n   * The active legal holds could not be read (#1634), so whether the listed rows are held is unknown. The\n   * sweep deletes nothing more for that resource this run — a read error never means \"not held\".\n   */\n  LEGAL_HOLD_UNVERIFIABLE = 'legal-hold-unverifiable',\n  /**\n   * The resource's sweep THREW instead of returning an outcome (every expected failure is caught and reported as\n   * one of the stages above). Deletions it made before throwing are not counted, so read `deletedCount: 0` on\n   * this stage as \"unknown\", not as \"none\".\n   */\n  UNEXPECTED = 'unexpected',\n}\n\n/**\n * Why a bound resource was not swept at all this run. A skip is REPORTED, never silent: a sweep that\n * quietly skips a resource is indistinguishable from one that found nothing expired.\n */\nexport enum RetentionClassSweepSkipReason {\n  /** The bound class has no declared period. Undecided is never \"delete now\" — the gap is reported instead. */\n  CLASS_UNDECLARED = 'class-undeclared',\n  /** A SCOPE_DELETED binding whose rows die in the tenant purge cascade: the purge enforces it. */\n  ENFORCED_BY_TENANT_PURGE = 'enforced-by-tenant-purge',\n}\n\nexport const RetentionEnforcementRecordSchema = z.object({\n  /** Document id. `.isPrimaryKey()` is what makes the PostgreSQL planner emit the PRIMARY KEY constraint. */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n\n  /**\n   * The application RECORD id, the APPLICATION scope's key, stamped from the canonical identity. Optional because\n   * the routed APPLICATION edge is OPTIONAL (the Mongo convertor requires the column's requiredness to match the\n   * edge), and because a run whose identity cannot be resolved still writes its evidence, without it.\n   */\n  applicationId: z.string().isDBIndexed().optional(),\n\n  /**\n   * The sweep run — one ATTEMPT — this row belongs to: `<jobId>/<attempt id>` when the queue ran it (the prefix is\n   * the `JobExecution` key; retries share it, so the attempt keeps them apart), otherwise an id the sweep minted.\n   * Every row of one attempt carries the same value, so a run's rows group.\n   */\n  runRef: z.string().min(1).isDBIndexed().isSummaryField(),\n  /** The instant the run computed its cutoffs from. The window the evidence door filters on. */\n  sweptAt: z.date().isDBIndexed().isSummaryField(),\n\n  retentionClass: z.enum(DataRetentionClass).systemEnum('DataRetentionClass').isDBIndexed().isSummaryField(),\n  /** The bound resource this row describes. A resource TYPE, never a row. */\n  resourceType: z.string().min(1).isDBIndexed().isSummaryField(),\n  startPoint: z.enum(RetentionStartPoint).systemEnum('RetentionStartPoint'),\n\n  /**\n   * The period read from the schedule for THIS run. Stored because a schedule change must be visible in\n   * the evidence: the same resource swept under 365 days and then under 30 leaves two rows that say so.\n   * Absent on a `SKIPPED` row whose class had no declared period.\n   */\n  retentionDaysApplied: z.number().int().min(0).optional(),\n  /** Rows whose retention start was strictly before this instant were due for deletion. Absent on a skip. */\n  cutoff: z.date().optional(),\n\n  deletedCount: z.number().int().min(0),\n  /** The retention start of the earliest and latest row deleted: the window actually deleted, not the one due. */\n  oldestDeletedStartedAt: z.date().optional(),\n  newestDeletedStartedAt: z.date().optional(),\n  /**\n   * Rows past their period the sweep did NOT delete because a legal hold covers them (#1634). ABSENT means\n   * no hold check ran for this resource this run — \"not measured\", which is not the same as zero.\n   */\n  heldSkippedCount: z.number().int().min(0).optional(),\n  /**\n   * Rows retained under a statutory restriction (#1635) that are still inside their period — a count only.\n   * ABSENT means nothing measured it this run.\n   */\n  statutoryRestrictedCount: z.number().int().min(0).optional(),\n  reachedRunCeiling: z.boolean(),\n\n  outcome: z.enum(RetentionEnforcementOutcome).systemEnum('RetentionEnforcementOutcome').isDBIndexed().isSummaryField(),\n  failureStage: z.enum(RetentionClassSweepFailureStage).systemEnum('RetentionClassSweepFailureStage').optional(),\n  skipReason: z.enum(RetentionClassSweepSkipReason).systemEnum('RetentionClassSweepSkipReason').optional(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\nexport type RetentionEnforcementRecord = z.infer<typeof RetentionEnforcementRecordSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-enforcement-record */\n\n/**\n * How often the retention-class sweep runs: hourly (`RETENTION_CLASS_SWEEP_CRON`, `15 * * * *`, in the backend's\n * batch manifests). A COPY, because the manifest lives in the backend and the reader deciding whether a record\n * is recent — the document-fact derivation — cannot import it; a backend test pins the two together.\n */\nexport const RETENTION_CLASS_SWEEP_INTERVAL_MS = 60 * 60 * 1000;\n\n/** What the sweep knows about one bound resource at the end of a run — the input {@link projectRetentionEnforcementRecord} reads. */\nexport interface RetentionEnforcementRecordSource {\n  readonly resourceType: string;\n  readonly retentionClass: DataRetentionClass;\n  readonly startPoint: RetentionStartPoint;\n  readonly retentionDaysApplied?: number;\n  readonly cutoff?: Date;\n  readonly deletedCount: number;\n  readonly oldestDeletedStartedAt?: Date;\n  readonly newestDeletedStartedAt?: Date;\n  readonly heldSkippedCount?: number;\n  readonly statutoryRestrictedCount?: number;\n  readonly reachedRunCeiling: boolean;\n  readonly failureStage?: RetentionClassSweepFailureStage;\n  readonly skipReason?: RetentionClassSweepSkipReason;\n}\n\n/**\n * The outcome a resource's run ended in. ONE rule, so the record, the audit event and the log cannot\n * disagree about whether a run failed: a failure stage wins over everything, then a skip, then the ceiling.\n */\nexport function retentionEnforcementOutcomeOf(source: Pick<RetentionEnforcementRecordSource, 'failureStage' | 'skipReason' | 'reachedRunCeiling'>): RetentionEnforcementOutcome {\n  if (source.failureStage !== undefined) return RetentionEnforcementOutcome.FAILED;\n  if (source.skipReason !== undefined) return RetentionEnforcementOutcome.SKIPPED;\n  if (source.reachedRunCeiling) return RetentionEnforcementOutcome.DEFERRED_BY_CEILING;\n  return RetentionEnforcementOutcome.COMPLETED;\n}\n\n/**\n * The ONLY way a retention-enforcement record is built: a closed projection of one resource's sweep outcome.\n *\n * Closed on purpose. It names every field it copies, so a row id or a field value added to the sweep's\n * outcome later cannot reach the table by accident (see the file header).\n */\nexport function projectRetentionEnforcementRecord(\n  source: RetentionEnforcementRecordSource,\n  run: { readonly applicationId?: string; readonly runRef: string; readonly sweptAt: Date },\n): Omit<RetentionEnforcementRecord, '_id' | 'createdAt'> {\n  return {\n    ...(run.applicationId !== undefined ? { applicationId: run.applicationId } : {}),\n    runRef: run.runRef,\n    sweptAt: run.sweptAt,\n    retentionClass: source.retentionClass,\n    resourceType: source.resourceType,\n    startPoint: source.startPoint,\n    ...(source.retentionDaysApplied !== undefined ? { retentionDaysApplied: source.retentionDaysApplied } : {}),\n    ...(source.cutoff !== undefined ? { cutoff: source.cutoff } : {}),\n    deletedCount: source.deletedCount,\n    ...(source.oldestDeletedStartedAt !== undefined ? { oldestDeletedStartedAt: source.oldestDeletedStartedAt } : {}),\n    ...(source.newestDeletedStartedAt !== undefined ? { newestDeletedStartedAt: source.newestDeletedStartedAt } : {}),\n    ...(source.heldSkippedCount !== undefined ? { heldSkippedCount: source.heldSkippedCount } : {}),\n    ...(source.statutoryRestrictedCount !== undefined ? { statutoryRestrictedCount: source.statutoryRestrictedCount } : {}),\n    reachedRunCeiling: source.reachedRunCeiling,\n    outcome: retentionEnforcementOutcomeOf(source),\n    ...(source.failureStage !== undefined ? { failureStage: source.failureStage } : {}),\n    ...(source.skipReason !== undefined ? { skipReason: source.skipReason } : {}),\n  };\n}\n\n/**\n * # Retention enforcement, answered to an evidence reader\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — whether each declared period was enforced is\n * answerable for any window.\n *\n * What `GET /assurance/retention-enforcement-evidence` returns: the enforcement records whose run fell in a\n * closed window. The records ARE counts and instants (see the file header), so handing them over names no\n * person and no deleted row; the door drops only the storage ids.\n */\nexport const RetentionEnforcementEvidenceRecordSchema = RetentionEnforcementRecordSchema.omit({ _id: true, applicationId: true, createdAt: true });\nexport type RetentionEnforcementEvidenceRecord = z.infer<typeof RetentionEnforcementEvidenceRecordSchema>;\n\nexport const RetentionEnforcementEvidenceSchema = z.object({\n  window: z.object({ from: z.string(), to: z.string() }),\n  /** Every record whose `sweptAt` falls in the window, oldest first. */\n  records: z.array(RetentionEnforcementEvidenceRecordSchema),\n  /** How many distinct sweep runs those records come from. */\n  runCount: z.number().int().min(0),\n});\nexport type RetentionEnforcementEvidence = z.infer<typeof RetentionEnforcementEvidenceSchema>;\n\nconst RETENTION_ENFORCEMENT_RECORD_INSTANT_FIELDS = ['sweptAt', 'cutoff', 'oldestDeletedStartedAt', 'newestDeletedStartedAt'] as const;\n\n/**\n * Read an evidence answer that crossed a JSON boundary — the door's response, or the copy the assurance\n * collector committed — back into {@link RetentionEnforcementEvidence}. ONE place revives the instants, which\n * JSON carries as strings, so every reader of a committed answer reads it alike. `undefined` when the value is\n * not an evidence answer: a reader treats that as \"no evidence\", never as \"nothing enforced\".\n */\nexport function parseRetentionEnforcementEvidenceJson(value: unknown): RetentionEnforcementEvidence | undefined {\n  if (!value || typeof value !== 'object' || !Array.isArray((value as { records?: unknown }).records)) return undefined;\n  const records = ((value as { records: unknown[] }).records).map((record) => {\n    if (!record || typeof record !== 'object') return record;\n    const revived: Record<string, unknown> = { ...(record as Record<string, unknown>) };\n    for (const field of RETENTION_ENFORCEMENT_RECORD_INSTANT_FIELDS) {\n      if (typeof revived[field] === 'string') revived[field] = new Date(revived[field] as string);\n    }\n    return revived;\n  });\n  const parsed = RetentionEnforcementEvidenceSchema.safeParse({ ...(value as Record<string, unknown>), records });\n  return parsed.success ? parsed.data : undefined;\n}\n"]}
+{"version":3,"file":"retention-enforcement-records.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-enforcement-records.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE9F,gIAAgI;AAChI;;;GAGG;AACH,MAAM,CAAN,IAAY,2BAaX;AAbD,WAAY,2BAA2B;IACrC,sGAAsG;IACtG,sDAAuB,CAAA;IACvB;;;;OAIG;IACH,0EAA2C,CAAA;IAC3C,wHAAwH;IACxH,gDAAiB,CAAA;IACjB,gHAAgH;IAChH,kDAAmB,CAAA;AACrB,CAAC,EAbW,2BAA2B,KAA3B,2BAA2B,QAatC;AAED,uHAAuH;AACvH,MAAM,CAAN,IAAY,+BAkBX;AAlBD,WAAY,+BAA+B;IACzC,2FAA2F;IAC3F,gDAAa,CAAA;IACb,+FAA+F;IAC/F,oDAAiB,CAAA;IACjB,+HAA+H;IAC/H,8DAA2B,CAAA;IAC3B;;;OAGG;IACH,sFAAmD,CAAA;IACnD;;;;OAIG;IACH,4DAAyB,CAAA;AAC3B,CAAC,EAlBW,+BAA+B,KAA/B,+BAA+B,QAkB1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,6GAA6G;IAC7G,sEAAqC,CAAA;IACrC,iGAAiG;IACjG,sFAAqD,CAAA;AACvD,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,2GAA2G;IAC3G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAE/C;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAElD;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACxD,8FAA8F;IAC9F,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1G,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;IAEzE;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2GAA2G;IAC3G,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,gHAAgH;IAChH,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD;;;OAGG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAE9B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACrH,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,UAAU,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IAC9G,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IAExG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAEH,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBhE;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAmG;IAC/I,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,MAAM,CAAC;IACjF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,OAAO,CAAC;IAChF,IAAI,MAAM,CAAC,iBAAiB;QAAE,OAAO,2BAA2B,CAAC,mBAAmB,CAAC;IACrF,OAAO,2BAA2B,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAAwC,EACxC,GAAyF;IAEzF,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,MAAM,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,6BAA6B,CAAC,MAAM,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,gCAAgC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnJ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC;IAC1D,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAGH,MAAM,2CAA2C,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,wBAAwB,EAAE,wBAAwB,CAAU,CAAC;AAEvI;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,KAAc;IAClE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,KAA+B,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACtH,MAAM,OAAO,GAAG,CAAE,KAAgC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACzD,MAAM,OAAO,GAA4B,EAAE,GAAI,MAAkC,EAAE,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,2CAA2C,EAAE,CAAC;YAChE,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAW,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,kCAAkC,CAAC,SAAS,CAAC,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,CAAC,CAAC;IAChH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC","sourcesContent":["/**\n * One row per (retention-class sweep run × class-bound resource): what the run deleted for that resource,\n * under which declared period, what it held back, and how it ended (#1636).\n *\n * ## Why a store, when the sweep already returns its outcome\n *\n * GDPR Art. 5(1)(e) (storage limitation) is a principle the operator must be able to DEMONSTRATE\n * (Art. 5(2), accountability). The sweep's run output is transient: a successful run's result is kept only\n * as long as the job execution that carried it, and a failed run survives only as an invocation status. So\n * after #1613 the engine deleted by period and nothing durable said that it had. This row is that record,\n * and it is the first producer of `AssuranceDocumentFactAuthorityKind.RUNTIME_EVIDENCE`: a privacy notice\n * says a class's retention is ENFORCED only when these rows show it.\n *\n * ## Counts and instants only, by construction\n *\n * The evidence must outlive the rows it describes WITHOUT re-creating them. So no field names a deleted\n * row, and none carries a field value: {@link projectRetentionEnforcementRecord} is the only producer and\n * copies a closed list of counts, instants and vocabulary members. A row id or a value added here would\n * turn deletion evidence into a copy of what was deleted — the key set is pinned by a test for that reason.\n *\n * ## Every run, including a failed one\n *\n * The sweep writes one row per bound resource per run in a `finally`, so a run that fails still leaves a\n * `FAILED` row: a failed run is evidence too, and an operator whose sweep stopped working must be able to\n * see WHEN it stopped. A resource the sweep skipped leaves a `SKIPPED` row naming why, because a skip that\n * leaves nothing is indistinguishable from a sweep that never ran.\n *\n * ## Retention of the evidence itself\n *\n * Bound to `AUDIT_LOGS` from `CREATED` (see the resource configuration): this is the operator's defence\n * evidence, so it is kept as long as the audit trail and outlives the data it describes.\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — records evidence that declared retention was enforced.\n */\nimport { z } from 'zod';\n\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\n\n/** @wildo_source:part:start saas.models.privacy.retention-enforcement-record facet:layer:shared facet:audience:app-developer */\n/**\n * How one sweep run ended for one class-bound resource. The three non-skip members are the three outcomes\n * the sweep distinguishes; `SKIPPED` is a resource the sweep deliberately did not work on this run.\n */\nexport enum RetentionEnforcementOutcome {\n  /** Every row past its period that the sweep listed was deleted; nothing was left for the next run. */\n  COMPLETED = 'COMPLETED',\n  /**\n   * The run stopped at its per-run ceiling with expired rows still waiting, which the next run resumes.\n   * Normal operation after a period is shortened or a backlog builds up, and NOT a failure: the period is\n   * being enforced, bounded per run so a mistake cannot become one unbounded delete.\n   */\n  DEFERRED_BY_CEILING = 'DEFERRED_BY_CEILING',\n  /** Listing or deleting failed, or the delete removed nothing. Retention was NOT enforced for this resource this run. */\n  FAILED = 'FAILED',\n  /** The sweep did not work on this resource this run; `skipReason` says why. Neither enforcement nor failure. */\n  SKIPPED = 'SKIPPED',\n}\n\n/** Which step of a resource's sweep failed. Named so the log, the thrown message and the record say the same thing. */\nexport enum RetentionClassSweepFailureStage {\n  /** Listing expired rows failed, so nothing more was deleted for that resource this run. */\n  READ = 'read',\n  /** A service-layer delete failed; earlier rows of the same resource may already be deleted. */\n  DELETE = 'delete',\n  /** The same rows were listed again after being deleted — the delete removed nothing, so the sweep stopped rather than loop. */\n  NO_PROGRESS = 'no-progress',\n  /**\n   * The active legal holds could not be read (#1634), so whether the listed rows are held is unknown. The\n   * sweep deletes nothing more for that resource this run — a read error never means \"not held\".\n   */\n  LEGAL_HOLD_UNVERIFIABLE = 'legal-hold-unverifiable',\n  /**\n   * The resource's sweep THREW instead of returning an outcome (every expected failure is caught and reported as\n   * one of the stages above). Deletions it made before throwing are not counted, so read `deletedCount: 0` on\n   * this stage as \"unknown\", not as \"none\".\n   */\n  UNEXPECTED = 'unexpected',\n}\n\n/**\n * Why a bound resource was not swept at all this run. A skip is REPORTED, never silent: a sweep that\n * quietly skips a resource is indistinguishable from one that found nothing expired.\n */\nexport enum RetentionClassSweepSkipReason {\n  /** The bound class has no declared period. Undecided is never \"delete now\" — the gap is reported instead. */\n  CLASS_UNDECLARED = 'class-undeclared',\n  /** A SCOPE_DELETED binding whose rows die in the tenant purge cascade: the purge enforces it. */\n  ENFORCED_BY_TENANT_PURGE = 'enforced-by-tenant-purge',\n}\n\nexport const RetentionEnforcementRecordSchema = z.object({\n  /** Document id. `.isPrimaryKey()` is what makes the PostgreSQL planner emit the PRIMARY KEY constraint. */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n\n  /**\n   * The application RECORD id, the APPLICATION scope's key, stamped from the canonical identity. Optional because\n   * the routed APPLICATION edge is OPTIONAL (the Mongo convertor requires the column's requiredness to match the\n   * edge), and because a run whose identity cannot be resolved still writes its evidence, without it.\n   */\n  applicationId: z.string().isDBIndexed().optional(),\n\n  /**\n   * The sweep run — one ATTEMPT — this row belongs to: `<jobId>/<attempt id>` when the queue ran it (the prefix is\n   * the `JobExecution` key; retries share it, so the attempt keeps them apart), otherwise an id the sweep minted.\n   * Every row of one attempt carries the same value, so a run's rows group.\n   */\n  runRef: z.string().min(1).isDBIndexed().isSummaryField(),\n  /** The instant the run computed its cutoffs from. The window the evidence door filters on. */\n  sweptAt: z.date().isDBIndexed().isSummaryField(),\n\n  retentionClass: z.enum(DataRetentionClass).systemEnum('DataRetentionClass').isDBIndexed().isSummaryField(),\n  /** The bound resource this row describes. A resource TYPE, never a row. */\n  resourceType: z.string().min(1).isDBIndexed().isSummaryField(),\n  startPoint: z.enum(RetentionStartPoint).systemEnum('RetentionStartPoint'),\n\n  /**\n   * The period read from the schedule for THIS run. Stored because a schedule change must be visible in\n   * the evidence: the same resource swept under 365 days and then under 30 leaves two rows that say so.\n   * Absent on a `SKIPPED` row whose class had no declared period.\n   */\n  retentionDaysApplied: z.number().int().min(0).optional(),\n  /** Rows whose retention start was strictly before this instant were due for deletion. Absent on a skip. */\n  cutoff: z.date().optional(),\n\n  deletedCount: z.number().int().min(0),\n  /** The retention start of the earliest and latest row deleted: the window actually deleted, not the one due. */\n  oldestDeletedStartedAt: z.date().optional(),\n  newestDeletedStartedAt: z.date().optional(),\n  /**\n   * Rows past their period the sweep did NOT delete because a legal hold covers them (#1634). ABSENT means\n   * no hold check ran for this resource this run — \"not measured\", which is not the same as zero.\n   */\n  heldSkippedCount: z.number().int().min(0).optional(),\n  /**\n   * Rows retained under a statutory restriction (#1635) that are still inside their period — a count only.\n   * ABSENT means nothing measured it this run.\n   */\n  statutoryRestrictedCount: z.number().int().min(0).optional(),\n  reachedRunCeiling: z.boolean(),\n\n  outcome: z.enum(RetentionEnforcementOutcome).systemEnum('RetentionEnforcementOutcome').isDBIndexed().isSummaryField(),\n  failureStage: z.enum(RetentionClassSweepFailureStage).systemEnum('RetentionClassSweepFailureStage').optional(),\n  skipReason: z.enum(RetentionClassSweepSkipReason).systemEnum('RetentionClassSweepSkipReason').optional(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\nexport type RetentionEnforcementRecord = z.infer<typeof RetentionEnforcementRecordSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-enforcement-record */\n\n/**\n * How often the retention-class sweep runs: hourly (`RETENTION_CLASS_SWEEP_CRON`, `15 * * * *`, in the backend's\n * batch manifests). A COPY, because the manifest lives in the backend and the reader deciding whether a record\n * is recent — the document-fact derivation — cannot import it; a backend test pins the two together.\n */\nexport const RETENTION_CLASS_SWEEP_INTERVAL_MS = 60 * 60 * 1000;\n\n/** What the sweep knows about one bound resource at the end of a run — the input {@link projectRetentionEnforcementRecord} reads. */\nexport interface RetentionEnforcementRecordSource {\n  readonly resourceType: string;\n  readonly retentionClass: DataRetentionClass;\n  readonly startPoint: RetentionStartPoint;\n  readonly retentionDaysApplied?: number;\n  readonly cutoff?: Date;\n  readonly deletedCount: number;\n  readonly oldestDeletedStartedAt?: Date;\n  readonly newestDeletedStartedAt?: Date;\n  readonly heldSkippedCount?: number;\n  readonly statutoryRestrictedCount?: number;\n  readonly reachedRunCeiling: boolean;\n  readonly failureStage?: RetentionClassSweepFailureStage;\n  readonly skipReason?: RetentionClassSweepSkipReason;\n}\n\n/**\n * The outcome a resource's run ended in. ONE rule, so the record, the audit event and the log cannot\n * disagree about whether a run failed: a failure stage wins over everything, then a skip, then the ceiling.\n */\nexport function retentionEnforcementOutcomeOf(source: Pick<RetentionEnforcementRecordSource, 'failureStage' | 'skipReason' | 'reachedRunCeiling'>): RetentionEnforcementOutcome {\n  if (source.failureStage !== undefined) return RetentionEnforcementOutcome.FAILED;\n  if (source.skipReason !== undefined) return RetentionEnforcementOutcome.SKIPPED;\n  if (source.reachedRunCeiling) return RetentionEnforcementOutcome.DEFERRED_BY_CEILING;\n  return RetentionEnforcementOutcome.COMPLETED;\n}\n\n/**\n * The ONLY way a retention-enforcement record is built: a closed projection of one resource's sweep outcome.\n *\n * Closed on purpose. It names every field it copies, so a row id or a field value added to the sweep's\n * outcome later cannot reach the table by accident (see the file header).\n */\nexport function projectRetentionEnforcementRecord(\n  source: RetentionEnforcementRecordSource,\n  run: { readonly applicationId?: string; readonly runRef: string; readonly sweptAt: Date },\n): Omit<RetentionEnforcementRecord, '_id' | 'createdAt'> {\n  return {\n    ...(run.applicationId !== undefined ? { applicationId: run.applicationId } : {}),\n    runRef: run.runRef,\n    sweptAt: run.sweptAt,\n    retentionClass: source.retentionClass,\n    resourceType: source.resourceType,\n    startPoint: source.startPoint,\n    ...(source.retentionDaysApplied !== undefined ? { retentionDaysApplied: source.retentionDaysApplied } : {}),\n    ...(source.cutoff !== undefined ? { cutoff: source.cutoff } : {}),\n    deletedCount: source.deletedCount,\n    ...(source.oldestDeletedStartedAt !== undefined ? { oldestDeletedStartedAt: source.oldestDeletedStartedAt } : {}),\n    ...(source.newestDeletedStartedAt !== undefined ? { newestDeletedStartedAt: source.newestDeletedStartedAt } : {}),\n    ...(source.heldSkippedCount !== undefined ? { heldSkippedCount: source.heldSkippedCount } : {}),\n    ...(source.statutoryRestrictedCount !== undefined ? { statutoryRestrictedCount: source.statutoryRestrictedCount } : {}),\n    reachedRunCeiling: source.reachedRunCeiling,\n    outcome: retentionEnforcementOutcomeOf(source),\n    ...(source.failureStage !== undefined ? { failureStage: source.failureStage } : {}),\n    ...(source.skipReason !== undefined ? { skipReason: source.skipReason } : {}),\n  };\n}\n\n/**\n * # Retention enforcement, answered to an evidence reader\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — whether each declared period was enforced is\n * answerable for any window.\n *\n * What `GET /assurance/retention-enforcement-evidence` returns: the enforcement records whose run fell in a\n * closed window. The records ARE counts and instants (see the file header), so handing them over names no\n * person and no deleted row; the door drops only the storage ids.\n */\nexport const RetentionEnforcementEvidenceRecordSchema = RetentionEnforcementRecordSchema.omit({ _id: true, applicationId: true, createdAt: true });\nexport type RetentionEnforcementEvidenceRecord = z.infer<typeof RetentionEnforcementEvidenceRecordSchema>;\n\nexport const RetentionEnforcementEvidenceSchema = z.object({\n  window: z.object({ from: z.string(), to: z.string() }),\n  /** Every record whose `sweptAt` falls in the window, oldest first. */\n  records: z.array(RetentionEnforcementEvidenceRecordSchema),\n  /** How many distinct sweep runs those records come from. */\n  runCount: z.number().int().min(0),\n});\nexport type RetentionEnforcementEvidence = z.infer<typeof RetentionEnforcementEvidenceSchema>;\n\nconst RETENTION_ENFORCEMENT_RECORD_INSTANT_FIELDS = ['sweptAt', 'cutoff', 'oldestDeletedStartedAt', 'newestDeletedStartedAt'] as const;\n\n/**\n * Read an evidence answer that crossed a JSON boundary — the door's response, or the copy the assurance\n * collector committed — back into {@link RetentionEnforcementEvidence}. ONE place revives the instants, which\n * JSON carries as strings, so every reader of a committed answer reads it alike. `undefined` when the value is\n * not an evidence answer: a reader treats that as \"no evidence\", never as \"nothing enforced\".\n */\nexport function parseRetentionEnforcementEvidenceJson(value: unknown): RetentionEnforcementEvidence | undefined {\n  if (!value || typeof value !== 'object' || !Array.isArray((value as { records?: unknown }).records)) return undefined;\n  const records = ((value as { records: unknown[] }).records).map((record) => {\n    if (!record || typeof record !== 'object') return record;\n    const revived: Record<string, unknown> = { ...(record as Record<string, unknown>) };\n    for (const field of RETENTION_ENFORCEMENT_RECORD_INSTANT_FIELDS) {\n      if (typeof revived[field] === 'string') revived[field] = new Date(revived[field] as string);\n    }\n    return revived;\n  });\n  const parsed = RetentionEnforcementEvidenceSchema.safeParse({ ...(value as Record<string, unknown>), records });\n  return parsed.success ? parsed.data : undefined;\n}\n"]}

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sHAAsH;AACtH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,qBAAqB;CACtC;AACD,oEAAoE;AAEpE,qHAAqH;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,mBAAmB;IAC7B,qGAAqG;IACrG,OAAO,YAAY;IACnB,uGAAuG;IACvG,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,aAAa,kBAAkB;IAC/B;;;OAGG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;CAChC;AAED,uHAAuH;AACvH,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B;IACzC,kIAAkI;;IAElI,0FAA0F;;IAE1F;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,mEAAmE;AAEnE,sEAAsE;AACtE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,oEAAoE;AAEpE;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}
+{"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sHAAsH;AACtH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,qBAAqB;CACtC;AACD,oEAAoE;AAEpE,qHAAqH;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,mBAAmB;IAC7B,qGAAqG;IACrG,OAAO,YAAY;IACnB,uGAAuG;IACvG,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,aAAa,kBAAkB;IAC/B;;;OAGG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;CAChC;AAED,uHAAuH;AACvH,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B;IACzC,kIAAkI;;IAElI,0FAA0F;;IAE1F;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,mEAAmE;AAEnE,sEAAsE;AACtE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,oEAAoE;AAEpE;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-schedule.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sHAAsH;AACtH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,kBAuCX;AAvCD,WAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,qDAA+B,CAAA;IAC/B,kMAAkM;IAClM,qCAAe,CAAA;IACf;;;;;;;OAOG;IACH,+CAAyB,CAAA;IACzB,kNAAkN;IAClN,2DAAqC,CAAA;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAqC,CAAA;AACvC,CAAC,EAvCW,kBAAkB,KAAlB,kBAAkB,QAuC7B;AACD,oEAAoE;AAEpE,qHAAqH;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,mBA4BX;AA5BD,WAAY,mBAAmB;IAC7B,qGAAqG;IACrG,0CAAmB,CAAA;IACnB,uGAAuG;IACvG,oDAA6B,CAAA;IAC7B;;;;OAIG;IACH,sDAA+B,CAAA;IAC/B;;;OAGG;IACH,oEAA6C,CAAA;IAC7C;;;;;;;;;;OAUG;IACH,sDAA+B,CAAA;AACjC,CAAC,EA5BW,mBAAmB,KAAnB,mBAAmB,QA4B9B;AAED,uHAAuH;AACvH,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,kIAAkI;IAClI,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC1C,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,sEAAsE;AACtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,aAAa,CAC/D,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAC1B,yBAAyB,CAC1B,CAAC;AAEF,oEAAoE;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAkD;IAElD,OAAO,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC;AACtG,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule facet:layer:shared facet:audience:app-developer */\n/**\n * **The data classes an application declares a retention period for.**\n *\n * ## Why a handful of classes, and not one period per resource\n *\n * `retentionPolicy.mode` on a resource says WHAT erasure does to a row. Nothing said HOW LONG a row\n * is kept, and a privacy notice cannot be written without that number: a confident paragraph about\n * impersonalization READS to a reader as an answer about retention, so the derivable half made the\n * missing half harder to see rather than easier (issue #89).\n *\n * The first design put a duration on every resource. It was rejected as false precision: an operator\n * decides \"customer data three years, logs ninety days, audit seven years\", not twelve numbers, and\n * twelve numbers are twelve things to keep true. What an operator actually decides is a schedule over\n * DATA CLASSES — and those classes are the ones that already differ in law, in storage and in who\n * asks for them.\n *\n * ## The classes are the STORES, and that is deliberate\n *\n * Each member maps to a distinct backing service, so one declaration answers two questions that have\n * always been asked separately: what a privacy notice must state, and what a backup-and-restore\n * inventory must protect and for how long (issue #8, which today has no inventory of any kind).\n *\n * | class | where it lives |\n * |---|---|\n * | {@link RESOURCE_DATA} | MongoDB / PostgreSQL |\n * | {@link FILES} | MinIO / S3 |\n * | {@link AUDIT_LOGS} | immudb — the tamper-evident ledger |\n * | {@link OPERATIONAL_LOGS} | the logging pipeline |\n * | {@link BUSINESS_RECORDS} | MongoDB / PostgreSQL — the one class split by LAW rather than by store |\n *\n * Splitting further is available later and is not free: every additional class is another period an\n * operator must decide and defend, and an undecided period is worse than a coarse one. The criterion\n * for a new member is that its records differ in law, in storage or in who asks for them —\n * {@link BUSINESS_RECORDS} is the first split made on the law alone (#1613).\n *\n * ## How a row is bound to a class\n *\n * A resource declares `retentionBinding: { retentionClass, startPoint }` in its resource\n * configuration ({@link ResourceRetentionBindingSchema}). An engine sweep then deletes a bound row\n * once `retentionDays` of its class have passed since the row's {@link RetentionStartPoint}. A\n * resource with no binding is kept until it is erased, and is reported by\n * `unboundRetentionResources` so the gap stays visible.\n */\nexport enum DataRetentionClass {\n  /**\n   * The application's own records — every resource row in its primary datastore.\n   *\n   * The class a privacy notice's retention paragraph is mostly about, because it is where the data a\n   * customer gave the application lives.\n   */\n  RESOURCE_DATA = \"RESOURCE_DATA\",\n  /** Uploaded file BYTES in object storage. Separate because their lawful window rarely matches the row that references them, and because losing them is a different incident from losing a row. */\n  FILES = \"FILES\",\n  /**\n   * The audit trail.\n   *\n   * Kept longest, and for a reason no other class shares: it is the record an operator needs to\n   * DEFEND itself, which is exactly the GDPR Art. 17(3) ground on which erasure may lawfully be\n   * refused. Never fold this into {@link RESOURCE_DATA} — doing so would let a shorter customer-data\n   * period silently shorten the evidence an operator may need years later.\n   */\n  AUDIT_LOGS = \"AUDIT_LOGS\",\n  /** Operational and diagnostic logs. Usually the shortest period, and the one most often left undeclared because nobody thinks of it as personal data — it routinely carries IP addresses and user identifiers. */\n  OPERATIONAL_LOGS = \"OPERATIONAL_LOGS\",\n  /**\n   * Records whose MINIMUM retention is set by law: business correspondence, accounting documents and\n   * their supporting pieces.\n   *\n   * A separate class because its members differ in law from {@link RESOURCE_DATA}: the period is a\n   * statutory floor, not the operator's choice, and it usually outlives the customer relationship.\n   * Germany's HGB §257 and AO §147 require 6 years for business letters and 8 for booking vouchers,\n   * counted from the end of the calendar year; France's Code de commerce L123-22 requires 10 years\n   * for accounting documents; UK law-firm practice follows the 15-year long-stop of the Limitation\n   * Act 1980 s.14B. Folding these into {@link RESOURCE_DATA} would force one of two wrong answers:\n   * delete statutory records with the customer data, or keep all customer data for a decade.\n   *\n   * Carries NO default period, like every class: the number depends on the jurisdiction and the\n   * record, and a defaulted statutory period is a legal statement nobody made. A resource that binds\n   * it usually counts from {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}. What an erasure does to a\n   * row still inside its period is the subject-erasure lane's (#1635), not this class's.\n   */\n  BUSINESS_RECORDS = \"BUSINESS_RECORDS\",\n}\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/** @wildo_source:part:start saas.models.privacy.retention-binding facet:layer:shared facet:audience:app-developer */\n/**\n * **When a bound row's retention clock starts.**\n *\n * A schedule period is counted \"from the point the application stops needing it for the purpose it\n * was collected for\" ({@link DataRetentionPeriodSchema}), so binding a live record to a class\n * counted from its CREATION would delete it while it is still in use. Every binding therefore names\n * its start point explicitly: there is no default, because every candidate default deletes somebody's\n * live data for some resource (#1613 review F1).\n *\n * ## The instant is READ from what the framework already records — not stamped a second time\n *\n * Four of the five members read an instant the row already carries, so the retention clock is the\n * same value every other surface shows, and no write path has to remember to maintain a copy:\n *\n * | member | the clock starts at | read from |\n * |---|---|---|\n * | {@link CREATED} | the insert | `createdAt` — infrastructure-owned on both adapters |\n * | {@link LAST_UPDATED} | the most recent update | `updatedAt` — infrastructure-owned on both adapters |\n * | {@link CLOSURE_EVENT} | the moment the declared closure date field is set | that field; null never expires |\n * | {@link END_OF_CALENDAR_YEAR} | 31 December 23:59:59.999 UTC of the creation year | `createdAt` |\n * | {@link SCOPE_DELETED} | the row's organization was marked for deletion | `retentionStartedAt`, stamped by the tenant purge |\n *\n * Rejected: persisting a `retentionStartedAt` on EVERY bound row. `createdAt` and `updatedAt` are\n * already maintained by the persistence adapter on every write path (the Mongoose timestamps plugin;\n * the PostgreSQL repository's timestamp stamping), and a second copy would have to be written at\n * each of those paths too — the one-invariant-many-sites shape that has shipped half-applied\n * repeatedly in this repository. Only {@link SCOPE_DELETED} has no instant on the row, so only it\n * stores one.\n *\n * The EXPIRY is never stored, for any member: the sweep computes `start + retentionDays` from the\n * CURRENT schedule at every run, so changing a period needs no backfill.\n */\nexport enum RetentionStartPoint {\n  /** At insert. For records whose purpose ends with their creation: a log line, a delivery attempt. */\n  CREATED = \"CREATED\",\n  /** At every update. For state kept only while it is still being touched: a draft, a session record. */\n  LAST_UPDATED = \"LAST_UPDATED\",\n  /**\n   * When the resource's declared `closureFieldName` date field is set — a ticket closed, a contract\n   * ended, a case archived. While that field is null the row never expires, which is what makes this\n   * the member for \"kept while it is open, then N days\".\n   */\n  CLOSURE_EVENT = \"CLOSURE_EVENT\",\n  /**\n   * 31 December 23:59:59.999 UTC of the year the row was created — how HGB §257(5) and AO §147(4)\n   * count commercial and tax retention.\n   */\n  END_OF_CALENDAR_YEAR = \"END_OF_CALENDAR_YEAR\",\n  /**\n   * When the row's organization is marked for deletion — \"kept while the account exists, then N days\".\n   *\n   * Two cases, decided at startup by the resource's `organizations → <resource>` teardown edge:\n   * - the edge DELETES the row in the tenant purge: the purge IS the enforcement, at\n   *   `tenantTeardown.retentionWindowDays`, which is single-sourced to {@link DataRetentionClass.RESOURCE_DATA}\n   *   — so only that class may be bound this way;\n   * - the row OUTLIVES its tenant (the edge is disabled, retains-and-impersonalizes, or is absent):\n   *   the purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and the\n   *   retention sweep deletes the row after its own class period.\n   */\n  SCOPE_DELETED = \"SCOPE_DELETED\",\n}\n\n/** The one field the framework stores for a retention clock: the {@link RetentionStartPoint.SCOPE_DELETED} instant. */\nexport const RETENTION_STARTED_AT_FIELD_NAME = \"retentionStartedAt\";\n\n/**\n * A resource's binding to a {@link DataRetentionClass}, declared as `retentionBinding` in its\n * resource configuration.\n *\n * ⚠️ NOT `retentionPolicy`. That is the erasure TREATMENT (what an erasure does to a row: delete, or\n * retain and scrub); this is the retention PERIOD (how long a row is kept at all). A resource may\n * declare either, both or neither, and they answer different questions for different readers.\n *\n * Strict, so a misspelled key fails at configuration build instead of being ignored — an ignored\n * binding would be a retention period the application states and nothing enforces.\n */\nexport const ResourceRetentionBindingSchema = z.strictObject({\n  /** The class whose declared period applies. The period itself lives in the application's `dataRetention` schedule, never here. */\n  retentionClass: z.enum(DataRetentionClass),\n  /** When the clock starts. Required, with no default — see {@link RetentionStartPoint}. */\n  startPoint: z.enum(RetentionStartPoint),\n  /**\n   * The date field whose value is the closure instant. Required for, and only allowed with,\n   * {@link RetentionStartPoint.CLOSURE_EVENT}; the resource factory refuses a field that is not a\n   * date, is not database-indexed (the sweep queries it on every run), or can be written by a\n   * client-routed create or update (a caller could backdate it into a delete). Make it server-owned:\n   * excluded from create and update, set by the owning handlers, declared in their `authoritativeFields`.\n   */\n  closureFieldName: z.string().trim().min(1).optional(),\n});\nexport type ResourceRetentionBinding = z.infer<typeof ResourceRetentionBindingSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-binding */\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule */\n/**\n * One declared retention period.\n *\n * `retentionDays` is REQUIRED when a class is declared at all: the whole point is the number. A class\n * an application has not decided is OMITTED from the schedule, which is a different answer and stays\n * a different answer — see {@link ApplicationRetentionScheduleSchema}.\n */\nexport const DataRetentionPeriodSchema = z.strictObject({\n  /**\n   * How long a record of this class is kept, counted from the point the application stops needing it\n   * for the purpose it was collected for.\n   *\n   * Days rather than a duration string because it is the unit every downstream consumer needs — a\n   * notice renders it, a backup schedule compares it, and a sweep would subtract it. A free-text\n   * period (\"as long as necessary\") is the placeholder this field exists to make impossible.\n   */\n  retentionDays: z.number().int().positive(),\n  /**\n   * WHY this period, in the operator's words — the lawful basis, the contractual term, the statutory\n   * minimum.\n   *\n   * Required, and it is the field that keeps the number honest: a period with no stated reason is a\n   * guess that will be published as a commitment. A notice may render it; a reviewer certainly reads it.\n   */\n  rationale: z.string().trim().min(1),\n});\nexport type DataRetentionPeriod = z.infer<typeof DataRetentionPeriodSchema>;\n\n/**\n * The application's declared retention schedule — a period per {@link DataRetentionClass}.\n *\n * ## Partial ON PURPOSE, and absence is never read as \"kept forever\"\n *\n * Every class is optional, and an omitted class means *the operator has not decided this yet* — not\n * that nothing is kept, and not that it is kept indefinitely. Both of those would be a statement, and\n * neither is one anybody made.\n *\n * That is what makes this safe to ship before an operator has answered: a compliance document states\n * the classes that ARE declared and marks the rest as needing a decision, naming who supplies it. The\n * alternative — requiring every class — would block a document on a number nobody has yet, which is\n * exactly the gate this whole capability exists to remove. **Never default a period.**\n */\nexport const ApplicationRetentionScheduleSchema = z.partialRecord(\n  z.enum(DataRetentionClass),\n  DataRetentionPeriodSchema,\n);\nexport type ApplicationRetentionSchedule = z.infer<typeof ApplicationRetentionScheduleSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/**\n * The classes an application has NOT declared a period for — what a document must mark as owed.\n *\n * Derived rather than stored, and total over the enum, so a class added to the vocabulary tomorrow is\n * reported as undeclared by every existing application rather than silently omitted from the answer.\n */\nexport function undeclaredRetentionClasses(\n  schedule: ApplicationRetentionSchedule | undefined,\n): readonly DataRetentionClass[] {\n  return Object.values(DataRetentionClass).filter((dataClass) => schedule?.[dataClass] === undefined);\n}\n"]}
+{"version":3,"file":"retention-schedule.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sHAAsH;AACtH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,kBAuCX;AAvCD,WAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,qDAA+B,CAAA;IAC/B,kMAAkM;IAClM,qCAAe,CAAA;IACf;;;;;;;OAOG;IACH,+CAAyB,CAAA;IACzB,kNAAkN;IAClN,2DAAqC,CAAA;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAqC,CAAA;AACvC,CAAC,EAvCW,kBAAkB,KAAlB,kBAAkB,QAuC7B;AACD,oEAAoE;AAEpE,qHAAqH;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,mBA4BX;AA5BD,WAAY,mBAAmB;IAC7B,qGAAqG;IACrG,0CAAmB,CAAA;IACnB,uGAAuG;IACvG,oDAA6B,CAAA;IAC7B;;;;OAIG;IACH,sDAA+B,CAAA;IAC/B;;;OAGG;IACH,oEAA6C,CAAA;IAC7C;;;;;;;;;;OAUG;IACH,sDAA+B,CAAA;AACjC,CAAC,EA5BW,mBAAmB,KAAnB,mBAAmB,QA4B9B;AAED,uHAAuH;AACvH,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,kIAAkI;IAClI,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC1C,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,sEAAsE;AACtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,aAAa,CAC/D,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAC1B,yBAAyB,CAC1B,CAAC;AAEF,oEAAoE;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAkD;IAElD,OAAO,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC;AACtG,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule facet:layer:shared facet:audience:app-developer */\n/**\n * **The data classes an application declares a retention period for.**\n *\n * ## Why a handful of classes, and not one period per resource\n *\n * `retentionPolicy.mode` on a resource says WHAT erasure does to a row. Nothing said HOW LONG a row\n * is kept, and a privacy notice cannot be written without that number: a confident paragraph about\n * impersonalization READS to a reader as an answer about retention, so the derivable half made the\n * missing half harder to see rather than easier (issue #89).\n *\n * The first design put a duration on every resource. It was rejected as false precision: an operator\n * decides \"customer data three years, logs ninety days, audit seven years\", not twelve numbers, and\n * twelve numbers are twelve things to keep true. What an operator actually decides is a schedule over\n * DATA CLASSES — and those classes are the ones that already differ in law, in storage and in who\n * asks for them.\n *\n * ## The classes are the STORES, and that is deliberate\n *\n * Each member maps to a distinct backing service, so one declaration answers two questions that have\n * always been asked separately: what a privacy notice must state, and what a backup-and-restore\n * inventory must protect and for how long (issue #8, which today has no inventory of any kind).\n *\n * | class | where it lives |\n * |---|---|\n * | {@link RESOURCE_DATA} | MongoDB / PostgreSQL |\n * | {@link FILES} | MinIO / S3 |\n * | {@link AUDIT_LOGS} | immudb — the tamper-evident ledger |\n * | {@link OPERATIONAL_LOGS} | the logging pipeline |\n * | {@link BUSINESS_RECORDS} | MongoDB / PostgreSQL — the one class split by LAW rather than by store |\n *\n * Splitting further is available later and is not free: every additional class is another period an\n * operator must decide and defend, and an undecided period is worse than a coarse one. The criterion\n * for a new member is that its records differ in law, in storage or in who asks for them —\n * {@link BUSINESS_RECORDS} is the first split made on the law alone (#1613).\n *\n * ## How a row is bound to a class\n *\n * A resource declares `retentionBinding: { retentionClass, startPoint }` in its resource\n * configuration ({@link ResourceRetentionBindingSchema}). An engine sweep then deletes a bound row\n * once `retentionDays` of its class have passed since the row's {@link RetentionStartPoint}. A\n * resource with no binding is kept until it is erased, and is reported by\n * `unboundRetentionResources` so the gap stays visible.\n */\nexport enum DataRetentionClass {\n  /**\n   * The application's own records — every resource row in its primary datastore.\n   *\n   * The class a privacy notice's retention paragraph is mostly about, because it is where the data a\n   * customer gave the application lives.\n   */\n  RESOURCE_DATA = \"RESOURCE_DATA\",\n  /** Uploaded file BYTES in object storage. Separate because their lawful window rarely matches the row that references them, and because losing them is a different incident from losing a row. */\n  FILES = \"FILES\",\n  /**\n   * The audit trail.\n   *\n   * Kept longest, and for a reason no other class shares: it is the record an operator needs to\n   * DEFEND itself, which is exactly the GDPR Art. 17(3) ground on which erasure may lawfully be\n   * refused. Never fold this into {@link RESOURCE_DATA} — doing so would let a shorter customer-data\n   * period silently shorten the evidence an operator may need years later.\n   */\n  AUDIT_LOGS = \"AUDIT_LOGS\",\n  /** Operational and diagnostic logs. Usually the shortest period, and the one most often left undeclared because nobody thinks of it as personal data — it routinely carries IP addresses and user identifiers. */\n  OPERATIONAL_LOGS = \"OPERATIONAL_LOGS\",\n  /**\n   * Records whose MINIMUM retention is set by law: business correspondence, accounting documents and\n   * their supporting pieces.\n   *\n   * A separate class because its members differ in law from {@link RESOURCE_DATA}: the period is a\n   * statutory floor, not the operator's choice, and it usually outlives the customer relationship.\n   * Germany's HGB §257 and AO §147 require 6 years for business letters and 8 for booking vouchers,\n   * counted from the end of the calendar year; France's Code de commerce L123-22 requires 10 years\n   * for accounting documents; UK law-firm practice follows the 15-year long-stop of the Limitation\n   * Act 1980 s.14B. Folding these into {@link RESOURCE_DATA} would force one of two wrong answers:\n   * delete statutory records with the customer data, or keep all customer data for a decade.\n   *\n   * Carries NO default period, like every class: the number depends on the jurisdiction and the\n   * record, and a defaulted statutory period is a legal statement nobody made. A resource that binds\n   * it usually counts from {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}. What an erasure does to a\n   * row still inside its period is the subject-erasure lane's (#1635), not this class's.\n   */\n  BUSINESS_RECORDS = \"BUSINESS_RECORDS\",\n}\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/** @wildo_source:part:start saas.models.privacy.retention-binding facet:layer:shared facet:audience:app-developer */\n/**\n * **When a bound row's retention clock starts.**\n *\n * A schedule period is counted \"from the point the application stops needing it for the purpose it\n * was collected for\" ({@link DataRetentionPeriodSchema}), so binding a live record to a class\n * counted from its CREATION would delete it while it is still in use. Every binding therefore names\n * its start point explicitly: there is no default, because every candidate default deletes somebody's\n * live data for some resource (#1613 review F1).\n *\n * ## The instant is READ from what the framework already records — not stamped a second time\n *\n * Four of the five members read an instant the row already carries, so the retention clock is the\n * same value every other surface shows, and no write path has to remember to maintain a copy:\n *\n * | member | the clock starts at | read from |\n * |---|---|---|\n * | {@link CREATED} | the insert | `createdAt` — infrastructure-owned on both adapters |\n * | {@link LAST_UPDATED} | the most recent update | `updatedAt` — infrastructure-owned on both adapters |\n * | {@link CLOSURE_EVENT} | the moment the declared closure date field is set | that field; null never expires |\n * | {@link END_OF_CALENDAR_YEAR} | 31 December 23:59:59.999 UTC of the creation year | `createdAt` |\n * | {@link SCOPE_DELETED} | the row's organization was marked for deletion | `retentionStartedAt`, stamped by the tenant purge |\n *\n * Rejected: persisting a `retentionStartedAt` on EVERY bound row. `createdAt` and `updatedAt` are\n * already maintained by the persistence adapter on every write path (the Mongoose timestamps plugin;\n * the PostgreSQL repository's timestamp stamping), and a second copy would have to be written at\n * each of those paths too — the one-invariant-many-sites shape that has shipped half-applied\n * repeatedly in this repository. Only {@link SCOPE_DELETED} has no instant on the row, so only it\n * stores one.\n *\n * The EXPIRY is never stored, for any member: the sweep computes `start + retentionDays` from the\n * CURRENT schedule at every run, so changing a period needs no backfill.\n */\nexport enum RetentionStartPoint {\n  /** At insert. For records whose purpose ends with their creation: a log line, a delivery attempt. */\n  CREATED = \"CREATED\",\n  /** At every update. For state kept only while it is still being touched: a draft, a session record. */\n  LAST_UPDATED = \"LAST_UPDATED\",\n  /**\n   * When the resource's declared `closureFieldName` date field is set — a ticket closed, a contract\n   * ended, a case archived. While that field is null the row never expires, which is what makes this\n   * the member for \"kept while it is open, then N days\".\n   */\n  CLOSURE_EVENT = \"CLOSURE_EVENT\",\n  /**\n   * 31 December 23:59:59.999 UTC of the year the row was created — how HGB §257(5) and AO §147(4)\n   * count commercial and tax retention.\n   */\n  END_OF_CALENDAR_YEAR = \"END_OF_CALENDAR_YEAR\",\n  /**\n   * When the row's organization is marked for deletion — \"kept while the account exists, then N days\".\n   *\n   * Two cases, decided at startup by the resource's `organizations → <resource>` teardown edge:\n   * - the edge DELETES the row in the tenant purge: the purge IS the enforcement, at\n   *   `tenantTeardown.retentionWindowDays`, which is single-sourced to {@link DataRetentionClass.RESOURCE_DATA}\n   *   — so only that class may be bound this way;\n   * - the row OUTLIVES its tenant (the edge is disabled, retains-and-impersonalizes, or is absent):\n   *   the purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and the\n   *   retention sweep deletes the row after its own class period.\n   */\n  SCOPE_DELETED = \"SCOPE_DELETED\",\n}\n\n/** The one field the framework stores for a retention clock: the {@link RetentionStartPoint.SCOPE_DELETED} instant. */\nexport const RETENTION_STARTED_AT_FIELD_NAME = \"retentionStartedAt\";\n\n/**\n * A resource's binding to a {@link DataRetentionClass}, declared as `retentionBinding` in its\n * resource configuration.\n *\n * ⚠️ NOT `retentionPolicy`. That is the erasure TREATMENT (what an erasure does to a row: delete, or\n * retain and scrub); this is the retention PERIOD (how long a row is kept at all). A resource may\n * declare either, both or neither, and they answer different questions for different readers.\n *\n * Strict, so a misspelled key fails at configuration build instead of being ignored — an ignored\n * binding would be a retention period the application states and nothing enforces.\n */\nexport const ResourceRetentionBindingSchema = z.strictObject({\n  /** The class whose declared period applies. The period itself lives in the application's `dataRetention` schedule, never here. */\n  retentionClass: z.enum(DataRetentionClass),\n  /** When the clock starts. Required, with no default — see {@link RetentionStartPoint}. */\n  startPoint: z.enum(RetentionStartPoint),\n  /**\n   * The date field whose value is the closure instant. Required for, and only allowed with,\n   * {@link RetentionStartPoint.CLOSURE_EVENT}; the resource factory refuses a field that is not a\n   * date, is not database-indexed (the sweep queries it on every run), or can be written by a\n   * client-routed create or update (a caller could backdate it into a delete). Make it server-owned:\n   * excluded from create and update, set by the owning handlers, declared in their `authoritativeFields`.\n   */\n  closureFieldName: z.string().trim().min(1).optional(),\n});\nexport type ResourceRetentionBinding = z.infer<typeof ResourceRetentionBindingSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-binding */\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule */\n/**\n * One declared retention period.\n *\n * `retentionDays` is REQUIRED when a class is declared at all: the whole point is the number. A class\n * an application has not decided is OMITTED from the schedule, which is a different answer and stays\n * a different answer — see {@link ApplicationRetentionScheduleSchema}.\n */\nexport const DataRetentionPeriodSchema = z.strictObject({\n  /**\n   * How long a record of this class is kept, counted from the point the application stops needing it\n   * for the purpose it was collected for.\n   *\n   * Days rather than a duration string because it is the unit every downstream consumer needs — a\n   * notice renders it, a backup schedule compares it, and a sweep would subtract it. A free-text\n   * period (\"as long as necessary\") is the placeholder this field exists to make impossible.\n   */\n  retentionDays: z.number().int().positive(),\n  /**\n   * WHY this period, in the operator's words — the lawful basis, the contractual term, the statutory\n   * minimum.\n   *\n   * Required, and it is the field that keeps the number honest: a period with no stated reason is a\n   * guess that will be published as a commitment. A notice may render it; a reviewer certainly reads it.\n   */\n  rationale: z.string().trim().min(1),\n});\nexport type DataRetentionPeriod = z.infer<typeof DataRetentionPeriodSchema>;\n\n/**\n * The application's declared retention schedule — a period per {@link DataRetentionClass}.\n *\n * ## Partial ON PURPOSE, and absence is never read as \"kept forever\"\n *\n * Every class is optional, and an omitted class means *the operator has not decided this yet* — not\n * that nothing is kept, and not that it is kept indefinitely. Both of those would be a statement, and\n * neither is one anybody made.\n *\n * That is what makes this safe to ship before an operator has answered: a compliance document states\n * the classes that ARE declared and marks the rest as needing a decision, naming who supplies it. The\n * alternative — requiring every class — would block a document on a number nobody has yet, which is\n * exactly the gate this whole capability exists to remove. **Never default a period.**\n */\nexport const ApplicationRetentionScheduleSchema = z.partialRecord(\n  z.enum(DataRetentionClass),\n  DataRetentionPeriodSchema,\n);\nexport type ApplicationRetentionSchedule = z.infer<typeof ApplicationRetentionScheduleSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/**\n * The classes an application has NOT declared a period for — what a document must mark as owed.\n *\n * Derived rather than stored, and total over the enum, so a class added to the vocabulary tomorrow is\n * reported as undeclared by every existing application rather than silently omitted from the answer.\n */\nexport function undeclaredRetentionClasses(\n  schedule: ApplicationRetentionSchedule | undefined,\n): readonly DataRetentionClass[] {\n  return Object.values(DataRetentionClass).filter((dataClass) => schedule?.[dataClass] === undefined);\n}\n"]}

package/dist/esm/compliance/privacy/retention-scope-deleted.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-scope-deleted.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-scope-deleted.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,iDAAiD,CAAC;AAGnH,OAAO,EAAuB,KAAK,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAEzG;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wCAAwC,CAAC,aAAa,EAAE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;CAC7E,GAAG,gCAAgC,CAenC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,cAAc,SAAS;IAC7E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;CACtD,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAQrD"}
+{"version":3,"file":"retention-scope-deleted.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-scope-deleted.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,iDAAiD,CAAC;AAGnH,OAAO,EAAuB,KAAK,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAEzG;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wCAAwC,CAAC,aAAa,EAAE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;CAC7E,GAAG,gCAAgC,CAenC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,cAAc,SAAS;IAC7E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;CACtD,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAQrD"}