@wildo-ai/saas-models 1.1.7 → 1.1.9

package/dist/esm/compliance/privacy/retention-enforcement-records.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-enforcement-records.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-enforcement-records.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE9F,gIAAgI;AAChI;;;GAGG;AACH,MAAM,CAAN,IAAY,2BAaX;AAbD,WAAY,2BAA2B;IACrC,sGAAsG;IACtG,sDAAuB,CAAA;IACvB;;;;OAIG;IACH,0EAA2C,CAAA;IAC3C,wHAAwH;IACxH,gDAAiB,CAAA;IACjB,gHAAgH;IAChH,kDAAmB,CAAA;AACrB,CAAC,EAbW,2BAA2B,KAA3B,2BAA2B,QAatC;AAED,uHAAuH;AACvH,MAAM,CAAN,IAAY,+BAkBX;AAlBD,WAAY,+BAA+B;IACzC,2FAA2F;IAC3F,gDAAa,CAAA;IACb,+FAA+F;IAC/F,oDAAiB,CAAA;IACjB,+HAA+H;IAC/H,8DAA2B,CAAA;IAC3B;;;OAGG;IACH,sFAAmD,CAAA;IACnD;;;;OAIG;IACH,4DAAyB,CAAA;AAC3B,CAAC,EAlBW,+BAA+B,KAA/B,+BAA+B,QAkB1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,6GAA6G;IAC7G,sEAAqC,CAAA;IACrC,iGAAiG;IACjG,sFAAqD,CAAA;AACvD,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,2GAA2G;IAC3G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAE/C;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAElD;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACxD,8FAA8F;IAC9F,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1G,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;IAEzE;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2GAA2G;IAC3G,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,gHAAgH;IAChH,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD;;;OAGG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAE9B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACrH,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,UAAU,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IAC9G,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IAExG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAEH,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBhE;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAmG;IAC/I,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,MAAM,CAAC;IACjF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,OAAO,CAAC;IAChF,IAAI,MAAM,CAAC,iBAAiB;QAAE,OAAO,2BAA2B,CAAC,mBAAmB,CAAC;IACrF,OAAO,2BAA2B,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAAwC,EACxC,GAAyF;IAEzF,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,MAAM,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,6BAA6B,CAAC,MAAM,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,gCAAgC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnJ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC;IAC1D,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAGH,MAAM,2CAA2C,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,wBAAwB,EAAE,wBAAwB,CAAU,CAAC;AAEvI;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,KAAc;IAClE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,KAA+B,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACtH,MAAM,OAAO,GAAG,CAAE,KAAgC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACzD,MAAM,OAAO,GAA4B,EAAE,GAAI,MAAkC,EAAE,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,2CAA2C,EAAE,CAAC;YAChE,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAW,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,kCAAkC,CAAC,SAAS,CAAC,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,CAAC,CAAC;IAChH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC","sourcesContent":["/**\n * One row per (retention-class sweep run × class-bound resource): what the run deleted for that resource,\n * under which declared period, what it held back, and how it ended (#1636).\n *\n * ## Why a store, when the sweep already returns its outcome\n *\n * GDPR Art. 5(1)(e) (storage limitation) is a principle the operator must be able to DEMONSTRATE\n * (Art. 5(2), accountability). The sweep's run output is transient: a successful run's result is kept only\n * as long as the job execution that carried it, and a failed run survives only as an invocation status. So\n * after #1613 the engine deleted by period and nothing durable said that it had. This row is that record,\n * and it is the first producer of `AssuranceDocumentFactAuthorityKind.RUNTIME_EVIDENCE`: a privacy notice\n * says a class's retention is ENFORCED only when these rows show it.\n *\n * ## Counts and instants only, by construction\n *\n * The evidence must outlive the rows it describes WITHOUT re-creating them. So no field names a deleted\n * row, and none carries a field value: {@link projectRetentionEnforcementRecord} is the only producer and\n * copies a closed list of counts, instants and vocabulary members. A row id or a value added here would\n * turn deletion evidence into a copy of what was deleted — the key set is pinned by a test for that reason.\n *\n * ## Every run, including a failed one\n *\n * The sweep writes one row per bound resource per run in a `finally`, so a run that fails still leaves a\n * `FAILED` row: a failed run is evidence too, and an operator whose sweep stopped working must be able to\n * see WHEN it stopped. A resource the sweep skipped leaves a `SKIPPED` row naming why, because a skip that\n * leaves nothing is indistinguishable from a sweep that never ran.\n *\n * ## Retention of the evidence itself\n *\n * Bound to `AUDIT_LOGS` from `CREATED` (see the resource configuration): this is the operator's defence\n * evidence, so it is kept as long as the audit trail and outlives the data it describes.\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — records evidence that declared retention was enforced.\n */\nimport { z } from 'zod';\n\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\n\n/** @wildo_source:part:start saas.models.privacy.retention-enforcement-record facet:layer:shared facet:audience:app-developer */\n/**\n * How one sweep run ended for one class-bound resource. The three non-skip members are the three outcomes\n * the sweep distinguishes; `SKIPPED` is a resource the sweep deliberately did not work on this run.\n */\nexport enum RetentionEnforcementOutcome {\n  /** Every row past its period that the sweep listed was deleted; nothing was left for the next run. */\n  COMPLETED = 'COMPLETED',\n  /**\n   * The run stopped at its per-run ceiling with expired rows still waiting, which the next run resumes.\n   * Normal operation after a period is shortened or a backlog builds up, and NOT a failure: the period is\n   * being enforced, bounded per run so a mistake cannot become one unbounded delete.\n   */\n  DEFERRED_BY_CEILING = 'DEFERRED_BY_CEILING',\n  /** Listing or deleting failed, or the delete removed nothing. Retention was NOT enforced for this resource this run. */\n  FAILED = 'FAILED',\n  /** The sweep did not work on this resource this run; `skipReason` says why. Neither enforcement nor failure. */\n  SKIPPED = 'SKIPPED',\n}\n\n/** Which step of a resource's sweep failed. Named so the log, the thrown message and the record say the same thing. */\nexport enum RetentionClassSweepFailureStage {\n  /** Listing expired rows failed, so nothing more was deleted for that resource this run. */\n  READ = 'read',\n  /** A service-layer delete failed; earlier rows of the same resource may already be deleted. */\n  DELETE = 'delete',\n  /** The same rows were listed again after being deleted — the delete removed nothing, so the sweep stopped rather than loop. */\n  NO_PROGRESS = 'no-progress',\n  /**\n   * The active legal holds could not be read (#1634), so whether the listed rows are held is unknown. The\n   * sweep deletes nothing more for that resource this run — a read error never means \"not held\".\n   */\n  LEGAL_HOLD_UNVERIFIABLE = 'legal-hold-unverifiable',\n  /**\n   * The resource's sweep THREW instead of returning an outcome (every expected failure is caught and reported as\n   * one of the stages above). Deletions it made before throwing are not counted, so read `deletedCount: 0` on\n   * this stage as \"unknown\", not as \"none\".\n   */\n  UNEXPECTED = 'unexpected',\n}\n\n/**\n * Why a bound resource was not swept at all this run. A skip is REPORTED, never silent: a sweep that\n * quietly skips a resource is indistinguishable from one that found nothing expired.\n */\nexport enum RetentionClassSweepSkipReason {\n  /** The bound class has no declared period. Undecided is never \"delete now\" — the gap is reported instead. */\n  CLASS_UNDECLARED = 'class-undeclared',\n  /** A SCOPE_DELETED binding whose rows die in the tenant purge cascade: the purge enforces it. */\n  ENFORCED_BY_TENANT_PURGE = 'enforced-by-tenant-purge',\n}\n\nexport const RetentionEnforcementRecordSchema = z.object({\n  /** Document id. `.isPrimaryKey()` is what makes the PostgreSQL planner emit the PRIMARY KEY constraint. */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n\n  /**\n   * The application RECORD id, the APPLICATION scope's key, stamped from the canonical identity. Optional because\n   * the routed APPLICATION edge is OPTIONAL (the Mongo convertor requires the column's requiredness to match the\n   * edge), and because a run whose identity cannot be resolved still writes its evidence, without it.\n   */\n  applicationId: z.string().isDBIndexed().optional(),\n\n  /**\n   * The sweep run — one ATTEMPT — this row belongs to: `<jobId>/<attempt id>` when the queue ran it (the prefix is\n   * the `JobExecution` key; retries share it, so the attempt keeps them apart), otherwise an id the sweep minted.\n   * Every row of one attempt carries the same value, so a run's rows group.\n   */\n  runRef: z.string().min(1).isDBIndexed().isSummaryField(),\n  /** The instant the run computed its cutoffs from. The window the evidence door filters on. */\n  sweptAt: z.date().isDBIndexed().isSummaryField(),\n\n  retentionClass: z.enum(DataRetentionClass).systemEnum('DataRetentionClass').isDBIndexed().isSummaryField(),\n  /** The bound resource this row describes. A resource TYPE, never a row. */\n  resourceType: z.string().min(1).isDBIndexed().isSummaryField(),\n  startPoint: z.enum(RetentionStartPoint).systemEnum('RetentionStartPoint'),\n\n  /**\n   * The period read from the schedule for THIS run. Stored because a schedule change must be visible in\n   * the evidence: the same resource swept under 365 days and then under 30 leaves two rows that say so.\n   * Absent on a `SKIPPED` row whose class had no declared period.\n   */\n  retentionDaysApplied: z.number().int().min(0).optional(),\n  /** Rows whose retention start was strictly before this instant were due for deletion. Absent on a skip. */\n  cutoff: z.date().optional(),\n\n  deletedCount: z.number().int().min(0),\n  /** The retention start of the earliest and latest row deleted: the window actually deleted, not the one due. */\n  oldestDeletedStartedAt: z.date().optional(),\n  newestDeletedStartedAt: z.date().optional(),\n  /**\n   * Rows past their period the sweep did NOT delete because a legal hold covers them (#1634). ABSENT means\n   * no hold check ran for this resource this run — \"not measured\", which is not the same as zero.\n   */\n  heldSkippedCount: z.number().int().min(0).optional(),\n  /**\n   * Rows retained under a statutory restriction (#1635) that are still inside their period — a count only.\n   * ABSENT means nothing measured it this run.\n   */\n  statutoryRestrictedCount: z.number().int().min(0).optional(),\n  reachedRunCeiling: z.boolean(),\n\n  outcome: z.enum(RetentionEnforcementOutcome).systemEnum('RetentionEnforcementOutcome').isDBIndexed().isSummaryField(),\n  failureStage: z.enum(RetentionClassSweepFailureStage).systemEnum('RetentionClassSweepFailureStage').optional(),\n  skipReason: z.enum(RetentionClassSweepSkipReason).systemEnum('RetentionClassSweepSkipReason').optional(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\nexport type RetentionEnforcementRecord = z.infer<typeof RetentionEnforcementRecordSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-enforcement-record */\n\n/**\n * How often the retention-class sweep runs: hourly (`RETENTION_CLASS_SWEEP_CRON`, `15 * * * *`, in the backend's\n * batch manifests). A COPY, because the manifest lives in the backend and the reader deciding whether a record\n * is recent — the document-fact derivation — cannot import it; a backend test pins the two together.\n */\nexport const RETENTION_CLASS_SWEEP_INTERVAL_MS = 60 * 60 * 1000;\n\n/** What the sweep knows about one bound resource at the end of a run — the input {@link projectRetentionEnforcementRecord} reads. */\nexport interface RetentionEnforcementRecordSource {\n  readonly resourceType: string;\n  readonly retentionClass: DataRetentionClass;\n  readonly startPoint: RetentionStartPoint;\n  readonly retentionDaysApplied?: number;\n  readonly cutoff?: Date;\n  readonly deletedCount: number;\n  readonly oldestDeletedStartedAt?: Date;\n  readonly newestDeletedStartedAt?: Date;\n  readonly heldSkippedCount?: number;\n  readonly statutoryRestrictedCount?: number;\n  readonly reachedRunCeiling: boolean;\n  readonly failureStage?: RetentionClassSweepFailureStage;\n  readonly skipReason?: RetentionClassSweepSkipReason;\n}\n\n/**\n * The outcome a resource's run ended in. ONE rule, so the record, the audit event and the log cannot\n * disagree about whether a run failed: a failure stage wins over everything, then a skip, then the ceiling.\n */\nexport function retentionEnforcementOutcomeOf(source: Pick<RetentionEnforcementRecordSource, 'failureStage' | 'skipReason' | 'reachedRunCeiling'>): RetentionEnforcementOutcome {\n  if (source.failureStage !== undefined) return RetentionEnforcementOutcome.FAILED;\n  if (source.skipReason !== undefined) return RetentionEnforcementOutcome.SKIPPED;\n  if (source.reachedRunCeiling) return RetentionEnforcementOutcome.DEFERRED_BY_CEILING;\n  return RetentionEnforcementOutcome.COMPLETED;\n}\n\n/**\n * The ONLY way a retention-enforcement record is built: a closed projection of one resource's sweep outcome.\n *\n * Closed on purpose. It names every field it copies, so a row id or a field value added to the sweep's\n * outcome later cannot reach the table by accident (see the file header).\n */\nexport function projectRetentionEnforcementRecord(\n  source: RetentionEnforcementRecordSource,\n  run: { readonly applicationId?: string; readonly runRef: string; readonly sweptAt: Date },\n): Omit<RetentionEnforcementRecord, '_id' | 'createdAt'> {\n  return {\n    ...(run.applicationId !== undefined ? { applicationId: run.applicationId } : {}),\n    runRef: run.runRef,\n    sweptAt: run.sweptAt,\n    retentionClass: source.retentionClass,\n    resourceType: source.resourceType,\n    startPoint: source.startPoint,\n    ...(source.retentionDaysApplied !== undefined ? { retentionDaysApplied: source.retentionDaysApplied } : {}),\n    ...(source.cutoff !== undefined ? { cutoff: source.cutoff } : {}),\n    deletedCount: source.deletedCount,\n    ...(source.oldestDeletedStartedAt !== undefined ? { oldestDeletedStartedAt: source.oldestDeletedStartedAt } : {}),\n    ...(source.newestDeletedStartedAt !== undefined ? { newestDeletedStartedAt: source.newestDeletedStartedAt } : {}),\n    ...(source.heldSkippedCount !== undefined ? { heldSkippedCount: source.heldSkippedCount } : {}),\n    ...(source.statutoryRestrictedCount !== undefined ? { statutoryRestrictedCount: source.statutoryRestrictedCount } : {}),\n    reachedRunCeiling: source.reachedRunCeiling,\n    outcome: retentionEnforcementOutcomeOf(source),\n    ...(source.failureStage !== undefined ? { failureStage: source.failureStage } : {}),\n    ...(source.skipReason !== undefined ? { skipReason: source.skipReason } : {}),\n  };\n}\n\n/**\n * # Retention enforcement, answered to an evidence reader\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — whether each declared period was enforced is\n * answerable for any window.\n *\n * What `GET /assurance/retention-enforcement-evidence` returns: the enforcement records whose run fell in a\n * closed window. The records ARE counts and instants (see the file header), so handing them over names no\n * person and no deleted row; the door drops only the storage ids.\n */\nexport const RetentionEnforcementEvidenceRecordSchema = RetentionEnforcementRecordSchema.omit({ _id: true, applicationId: true, createdAt: true });\nexport type RetentionEnforcementEvidenceRecord = z.infer<typeof RetentionEnforcementEvidenceRecordSchema>;\n\nexport const RetentionEnforcementEvidenceSchema = z.object({\n  window: z.object({ from: z.string(), to: z.string() }),\n  /** Every record whose `sweptAt` falls in the window, oldest first. */\n  records: z.array(RetentionEnforcementEvidenceRecordSchema),\n  /** How many distinct sweep runs those records come from. */\n  runCount: z.number().int().min(0),\n});\nexport type RetentionEnforcementEvidence = z.infer<typeof RetentionEnforcementEvidenceSchema>;\n\nconst RETENTION_ENFORCEMENT_RECORD_INSTANT_FIELDS = ['sweptAt', 'cutoff', 'oldestDeletedStartedAt', 'newestDeletedStartedAt'] as const;\n\n/**\n * Read an evidence answer that crossed a JSON boundary — the door's response, or the copy the assurance\n * collector committed — back into {@link RetentionEnforcementEvidence}. ONE place revives the instants, which\n * JSON carries as strings, so every reader of a committed answer reads it alike. `undefined` when the value is\n * not an evidence answer: a reader treats that as \"no evidence\", never as \"nothing enforced\".\n */\nexport function parseRetentionEnforcementEvidenceJson(value: unknown): RetentionEnforcementEvidence | undefined {\n  if (!value || typeof value !== 'object' || !Array.isArray((value as { records?: unknown }).records)) return undefined;\n  const records = ((value as { records: unknown[] }).records).map((record) => {\n    if (!record || typeof record !== 'object') return record;\n    const revived: Record<string, unknown> = { ...(record as Record<string, unknown>) };\n    for (const field of RETENTION_ENFORCEMENT_RECORD_INSTANT_FIELDS) {\n      if (typeof revived[field] === 'string') revived[field] = new Date(revived[field] as string);\n    }\n    return revived;\n  });\n  const parsed = RetentionEnforcementEvidenceSchema.safeParse({ ...(value as Record<string, unknown>), records });\n  return parsed.success ? parsed.data : undefined;\n}\n"]}
+{"version":3,"file":"retention-enforcement-records.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-enforcement-records.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE9F,gIAAgI;AAChI;;;GAGG;AACH,MAAM,CAAN,IAAY,2BAaX;AAbD,WAAY,2BAA2B;IACrC,sGAAsG;IACtG,sDAAuB,CAAA;IACvB;;;;OAIG;IACH,0EAA2C,CAAA;IAC3C,wHAAwH;IACxH,gDAAiB,CAAA;IACjB,gHAAgH;IAChH,kDAAmB,CAAA;AACrB,CAAC,EAbW,2BAA2B,KAA3B,2BAA2B,QAatC;AAED,uHAAuH;AACvH,MAAM,CAAN,IAAY,+BAkBX;AAlBD,WAAY,+BAA+B;IACzC,2FAA2F;IAC3F,gDAAa,CAAA;IACb,+FAA+F;IAC/F,oDAAiB,CAAA;IACjB,+HAA+H;IAC/H,8DAA2B,CAAA;IAC3B;;;OAGG;IACH,sFAAmD,CAAA;IACnD;;;;OAIG;IACH,4DAAyB,CAAA;AAC3B,CAAC,EAlBW,+BAA+B,KAA/B,+BAA+B,QAkB1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,6GAA6G;IAC7G,sEAAqC,CAAA;IACrC,iGAAiG;IACjG,sFAAqD,CAAA;AACvD,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,2GAA2G;IAC3G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAE/C;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAElD;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACxD,8FAA8F;IAC9F,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEhD,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC1G,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;IAEzE;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2GAA2G;IAC3G,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,gHAAgH;IAChH,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD;;;OAGG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAE9B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACrH,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,UAAU,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IAC9G,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IAExG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAEH,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBhE;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAmG;IAC/I,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,MAAM,CAAC;IACjF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,2BAA2B,CAAC,OAAO,CAAC;IAChF,IAAI,MAAM,CAAC,iBAAiB;QAAE,OAAO,2BAA2B,CAAC,mBAAmB,CAAC;IACrF,OAAO,2BAA2B,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAAwC,EACxC,GAAyF;IAEzF,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,MAAM,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,OAAO,EAAE,6BAA6B,CAAC,MAAM,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,gCAAgC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAGnJ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC;IAC1D,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAGH,MAAM,2CAA2C,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,wBAAwB,EAAE,wBAAwB,CAAU,CAAC;AAEvI;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,KAAc;IAClE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,KAA+B,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACtH,MAAM,OAAO,GAAG,CAAE,KAAgC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACzD,MAAM,OAAO,GAA4B,EAAE,GAAI,MAAkC,EAAE,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,2CAA2C,EAAE,CAAC;YAChE,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAW,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,kCAAkC,CAAC,SAAS,CAAC,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,CAAC,CAAC;IAChH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC","sourcesContent":["/**\n * One row per (retention-class sweep run × class-bound resource): what the run deleted for that resource,\n * under which declared period, what it held back, and how it ended (#1636).\n *\n * ## Why a store, when the sweep already returns its outcome\n *\n * GDPR Art. 5(1)(e) (storage limitation) is a principle the operator must be able to DEMONSTRATE\n * (Art. 5(2), accountability). The sweep's run output is transient: a successful run's result is kept only\n * as long as the job execution that carried it, and a failed run survives only as an invocation status. So\n * after #1613 the engine deleted by period and nothing durable said that it had. This row is that record,\n * and it is the first producer of `AssuranceDocumentFactAuthorityKind.RUNTIME_EVIDENCE`: a privacy notice\n * says a class's retention is ENFORCED only when these rows show it.\n *\n * ## Counts and instants only, by construction\n *\n * The evidence must outlive the rows it describes WITHOUT re-creating them. So no field names a deleted\n * row, and none carries a field value: {@link projectRetentionEnforcementRecord} is the only producer and\n * copies a closed list of counts, instants and vocabulary members. A row id or a value added here would\n * turn deletion evidence into a copy of what was deleted — the key set is pinned by a test for that reason.\n *\n * ## Every run, including a failed one\n *\n * The sweep writes one row per bound resource per run in a `finally`, so a run that fails still leaves a\n * `FAILED` row: a failed run is evidence too, and an operator whose sweep stopped working must be able to\n * see WHEN it stopped. A resource the sweep skipped leaves a `SKIPPED` row naming why, because a skip that\n * leaves nothing is indistinguishable from a sweep that never ran.\n *\n * ## Retention of the evidence itself\n *\n * Bound to `AUDIT_LOGS` from `CREATED` (see the resource configuration): this is the operator's defence\n * evidence, so it is kept as long as the audit trail and outlives the data it describes.\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — records evidence that declared retention was enforced.\n */\nimport { z } from 'zod';\n\nimport { DataRetentionClass, RetentionStartPoint } from './retention-schedule.shared.schemas';\n\n/** @wildo_source:part:start saas.models.privacy.retention-enforcement-record facet:layer:shared facet:audience:app-developer */\n/**\n * How one sweep run ended for one class-bound resource. The three non-skip members are the three outcomes\n * the sweep distinguishes; `SKIPPED` is a resource the sweep deliberately did not work on this run.\n */\nexport enum RetentionEnforcementOutcome {\n  /** Every row past its period that the sweep listed was deleted; nothing was left for the next run. */\n  COMPLETED = 'COMPLETED',\n  /**\n   * The run stopped at its per-run ceiling with expired rows still waiting, which the next run resumes.\n   * Normal operation after a period is shortened or a backlog builds up, and NOT a failure: the period is\n   * being enforced, bounded per run so a mistake cannot become one unbounded delete.\n   */\n  DEFERRED_BY_CEILING = 'DEFERRED_BY_CEILING',\n  /** Listing or deleting failed, or the delete removed nothing. Retention was NOT enforced for this resource this run. */\n  FAILED = 'FAILED',\n  /** The sweep did not work on this resource this run; `skipReason` says why. Neither enforcement nor failure. */\n  SKIPPED = 'SKIPPED',\n}\n\n/** Which step of a resource's sweep failed. Named so the log, the thrown message and the record say the same thing. */\nexport enum RetentionClassSweepFailureStage {\n  /** Listing expired rows failed, so nothing more was deleted for that resource this run. */\n  READ = 'read',\n  /** A service-layer delete failed; earlier rows of the same resource may already be deleted. */\n  DELETE = 'delete',\n  /** The same rows were listed again after being deleted — the delete removed nothing, so the sweep stopped rather than loop. */\n  NO_PROGRESS = 'no-progress',\n  /**\n   * The active legal holds could not be read (#1634), so whether the listed rows are held is unknown. The\n   * sweep deletes nothing more for that resource this run — a read error never means \"not held\".\n   */\n  LEGAL_HOLD_UNVERIFIABLE = 'legal-hold-unverifiable',\n  /**\n   * The resource's sweep THREW instead of returning an outcome (every expected failure is caught and reported as\n   * one of the stages above). Deletions it made before throwing are not counted, so read `deletedCount: 0` on\n   * this stage as \"unknown\", not as \"none\".\n   */\n  UNEXPECTED = 'unexpected',\n}\n\n/**\n * Why a bound resource was not swept at all this run. A skip is REPORTED, never silent: a sweep that\n * quietly skips a resource is indistinguishable from one that found nothing expired.\n */\nexport enum RetentionClassSweepSkipReason {\n  /** The bound class has no declared period. Undecided is never \"delete now\" — the gap is reported instead. */\n  CLASS_UNDECLARED = 'class-undeclared',\n  /** A SCOPE_DELETED binding whose rows die in the tenant purge cascade: the purge enforces it. */\n  ENFORCED_BY_TENANT_PURGE = 'enforced-by-tenant-purge',\n}\n\nexport const RetentionEnforcementRecordSchema = z.object({\n  /** Document id. `.isPrimaryKey()` is what makes the PostgreSQL planner emit the PRIMARY KEY constraint. */\n  _id: z.string().isPrimaryKey().isSummaryField(),\n\n  /**\n   * The application RECORD id, the APPLICATION scope's key, stamped from the canonical identity. Optional because\n   * the routed APPLICATION edge is OPTIONAL (the Mongo convertor requires the column's requiredness to match the\n   * edge), and because a run whose identity cannot be resolved still writes its evidence, without it.\n   */\n  applicationId: z.string().isDBIndexed().optional(),\n\n  /**\n   * The sweep run — one ATTEMPT — this row belongs to: `<jobId>/<attempt id>` when the queue ran it (the prefix is\n   * the `JobExecution` key; retries share it, so the attempt keeps them apart), otherwise an id the sweep minted.\n   * Every row of one attempt carries the same value, so a run's rows group.\n   */\n  runRef: z.string().min(1).isDBIndexed().isSummaryField(),\n  /** The instant the run computed its cutoffs from. The window the evidence door filters on. */\n  sweptAt: z.date().isDBIndexed().isSummaryField(),\n\n  retentionClass: z.enum(DataRetentionClass).systemEnum('DataRetentionClass').isDBIndexed().isSummaryField(),\n  /** The bound resource this row describes. A resource TYPE, never a row. */\n  resourceType: z.string().min(1).isDBIndexed().isSummaryField(),\n  startPoint: z.enum(RetentionStartPoint).systemEnum('RetentionStartPoint'),\n\n  /**\n   * The period read from the schedule for THIS run. Stored because a schedule change must be visible in\n   * the evidence: the same resource swept under 365 days and then under 30 leaves two rows that say so.\n   * Absent on a `SKIPPED` row whose class had no declared period.\n   */\n  retentionDaysApplied: z.number().int().min(0).optional(),\n  /** Rows whose retention start was strictly before this instant were due for deletion. Absent on a skip. */\n  cutoff: z.date().optional(),\n\n  deletedCount: z.number().int().min(0),\n  /** The retention start of the earliest and latest row deleted: the window actually deleted, not the one due. */\n  oldestDeletedStartedAt: z.date().optional(),\n  newestDeletedStartedAt: z.date().optional(),\n  /**\n   * Rows past their period the sweep did NOT delete because a legal hold covers them (#1634). ABSENT means\n   * no hold check ran for this resource this run — \"not measured\", which is not the same as zero.\n   */\n  heldSkippedCount: z.number().int().min(0).optional(),\n  /**\n   * Rows retained under a statutory restriction (#1635) that are still inside their period — a count only.\n   * ABSENT means nothing measured it this run.\n   */\n  statutoryRestrictedCount: z.number().int().min(0).optional(),\n  reachedRunCeiling: z.boolean(),\n\n  outcome: z.enum(RetentionEnforcementOutcome).systemEnum('RetentionEnforcementOutcome').isDBIndexed().isSummaryField(),\n  failureStage: z.enum(RetentionClassSweepFailureStage).systemEnum('RetentionClassSweepFailureStage').optional(),\n  skipReason: z.enum(RetentionClassSweepSkipReason).systemEnum('RetentionClassSweepSkipReason').optional(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\nexport type RetentionEnforcementRecord = z.infer<typeof RetentionEnforcementRecordSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-enforcement-record */\n\n/**\n * How often the retention-class sweep runs: hourly (`RETENTION_CLASS_SWEEP_CRON`, `15 * * * *`, in the backend's\n * batch manifests). A COPY, because the manifest lives in the backend and the reader deciding whether a record\n * is recent — the document-fact derivation — cannot import it; a backend test pins the two together.\n */\nexport const RETENTION_CLASS_SWEEP_INTERVAL_MS = 60 * 60 * 1000;\n\n/** What the sweep knows about one bound resource at the end of a run — the input {@link projectRetentionEnforcementRecord} reads. */\nexport interface RetentionEnforcementRecordSource {\n  readonly resourceType: string;\n  readonly retentionClass: DataRetentionClass;\n  readonly startPoint: RetentionStartPoint;\n  readonly retentionDaysApplied?: number;\n  readonly cutoff?: Date;\n  readonly deletedCount: number;\n  readonly oldestDeletedStartedAt?: Date;\n  readonly newestDeletedStartedAt?: Date;\n  readonly heldSkippedCount?: number;\n  readonly statutoryRestrictedCount?: number;\n  readonly reachedRunCeiling: boolean;\n  readonly failureStage?: RetentionClassSweepFailureStage;\n  readonly skipReason?: RetentionClassSweepSkipReason;\n}\n\n/**\n * The outcome a resource's run ended in. ONE rule, so the record, the audit event and the log cannot\n * disagree about whether a run failed: a failure stage wins over everything, then a skip, then the ceiling.\n */\nexport function retentionEnforcementOutcomeOf(source: Pick<RetentionEnforcementRecordSource, 'failureStage' | 'skipReason' | 'reachedRunCeiling'>): RetentionEnforcementOutcome {\n  if (source.failureStage !== undefined) return RetentionEnforcementOutcome.FAILED;\n  if (source.skipReason !== undefined) return RetentionEnforcementOutcome.SKIPPED;\n  if (source.reachedRunCeiling) return RetentionEnforcementOutcome.DEFERRED_BY_CEILING;\n  return RetentionEnforcementOutcome.COMPLETED;\n}\n\n/**\n * The ONLY way a retention-enforcement record is built: a closed projection of one resource's sweep outcome.\n *\n * Closed on purpose. It names every field it copies, so a row id or a field value added to the sweep's\n * outcome later cannot reach the table by accident (see the file header).\n */\nexport function projectRetentionEnforcementRecord(\n  source: RetentionEnforcementRecordSource,\n  run: { readonly applicationId?: string; readonly runRef: string; readonly sweptAt: Date },\n): Omit<RetentionEnforcementRecord, '_id' | 'createdAt'> {\n  return {\n    ...(run.applicationId !== undefined ? { applicationId: run.applicationId } : {}),\n    runRef: run.runRef,\n    sweptAt: run.sweptAt,\n    retentionClass: source.retentionClass,\n    resourceType: source.resourceType,\n    startPoint: source.startPoint,\n    ...(source.retentionDaysApplied !== undefined ? { retentionDaysApplied: source.retentionDaysApplied } : {}),\n    ...(source.cutoff !== undefined ? { cutoff: source.cutoff } : {}),\n    deletedCount: source.deletedCount,\n    ...(source.oldestDeletedStartedAt !== undefined ? { oldestDeletedStartedAt: source.oldestDeletedStartedAt } : {}),\n    ...(source.newestDeletedStartedAt !== undefined ? { newestDeletedStartedAt: source.newestDeletedStartedAt } : {}),\n    ...(source.heldSkippedCount !== undefined ? { heldSkippedCount: source.heldSkippedCount } : {}),\n    ...(source.statutoryRestrictedCount !== undefined ? { statutoryRestrictedCount: source.statutoryRestrictedCount } : {}),\n    reachedRunCeiling: source.reachedRunCeiling,\n    outcome: retentionEnforcementOutcomeOf(source),\n    ...(source.failureStage !== undefined ? { failureStage: source.failureStage } : {}),\n    ...(source.skipReason !== undefined ? { skipReason: source.skipReason } : {}),\n  };\n}\n\n/**\n * # Retention enforcement, answered to an evidence reader\n *\n * assurance-control: WILDO.PRIVACY.STORAGE_LIMITATION — whether each declared period was enforced is\n * answerable for any window.\n *\n * What `GET /assurance/retention-enforcement-evidence` returns: the enforcement records whose run fell in a\n * closed window. The records ARE counts and instants (see the file header), so handing them over names no\n * person and no deleted row; the door drops only the storage ids.\n */\nexport const RetentionEnforcementEvidenceRecordSchema = RetentionEnforcementRecordSchema.omit({ _id: true, applicationId: true, createdAt: true });\nexport type RetentionEnforcementEvidenceRecord = z.infer<typeof RetentionEnforcementEvidenceRecordSchema>;\n\nexport const RetentionEnforcementEvidenceSchema = z.object({\n  window: z.object({ from: z.string(), to: z.string() }),\n  /** Every record whose `sweptAt` falls in the window, oldest first. */\n  records: z.array(RetentionEnforcementEvidenceRecordSchema),\n  /** How many distinct sweep runs those records come from. */\n  runCount: z.number().int().min(0),\n});\nexport type RetentionEnforcementEvidence = z.infer<typeof RetentionEnforcementEvidenceSchema>;\n\nconst RETENTION_ENFORCEMENT_RECORD_INSTANT_FIELDS = ['sweptAt', 'cutoff', 'oldestDeletedStartedAt', 'newestDeletedStartedAt'] as const;\n\n/**\n * Read an evidence answer that crossed a JSON boundary — the door's response, or the copy the assurance\n * collector committed — back into {@link RetentionEnforcementEvidence}. ONE place revives the instants, which\n * JSON carries as strings, so every reader of a committed answer reads it alike. `undefined` when the value is\n * not an evidence answer: a reader treats that as \"no evidence\", never as \"nothing enforced\".\n */\nexport function parseRetentionEnforcementEvidenceJson(value: unknown): RetentionEnforcementEvidence | undefined {\n  if (!value || typeof value !== 'object' || !Array.isArray((value as { records?: unknown }).records)) return undefined;\n  const records = ((value as { records: unknown[] }).records).map((record) => {\n    if (!record || typeof record !== 'object') return record;\n    const revived: Record<string, unknown> = { ...(record as Record<string, unknown>) };\n    for (const field of RETENTION_ENFORCEMENT_RECORD_INSTANT_FIELDS) {\n      if (typeof revived[field] === 'string') revived[field] = new Date(revived[field] as string);\n    }\n    return revived;\n  });\n  const parsed = RetentionEnforcementEvidenceSchema.safeParse({ ...(value as Record<string, unknown>), records });\n  return parsed.success ? parsed.data : undefined;\n}\n"]}

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sHAAsH;AACtH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,qBAAqB;CACtC;AACD,oEAAoE;AAEpE,qHAAqH;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,mBAAmB;IAC7B,qGAAqG;IACrG,OAAO,YAAY;IACnB,uGAAuG;IACvG,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,aAAa,kBAAkB;IAC/B;;;OAGG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;CAChC;AAED,uHAAuH;AACvH,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B;IACzC,kIAAkI;;IAElI,0FAA0F;;IAE1F;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,mEAAmE;AAEnE,sEAAsE;AACtE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,oEAAoE;AAEpE;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}
+{"version":3,"file":"retention-schedule.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sHAAsH;AACtH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,aAAa,kBAAkB;IAC/B,kMAAkM;IAClM,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,UAAU,eAAe;IACzB,kNAAkN;IAClN,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,qBAAqB;CACtC;AACD,oEAAoE;AAEpE,qHAAqH;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,mBAAmB;IAC7B,qGAAqG;IACrG,OAAO,YAAY;IACnB,uGAAuG;IACvG,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,aAAa,kBAAkB;IAC/B;;;OAGG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;CAChC;AAED,uHAAuH;AACvH,eAAO,MAAM,+BAA+B,uBAAuB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B;IACzC,kIAAkI;;IAElI,0FAA0F;;IAE1F;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,mEAAmE;AAEnE,sEAAsE;AACtE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;IACpC;;;;;;;OAOG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC;IAlC7C;;;;;;;OAOG;;IAEH;;;;;;OAMG;;mBAsBJ,CAAC;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,oEAAoE;AAEpE;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,GACjD,SAAS,kBAAkB,EAAE,CAE/B"}

package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-schedule.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sHAAsH;AACtH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,kBAuCX;AAvCD,WAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,qDAA+B,CAAA;IAC/B,kMAAkM;IAClM,qCAAe,CAAA;IACf;;;;;;;OAOG;IACH,+CAAyB,CAAA;IACzB,kNAAkN;IAClN,2DAAqC,CAAA;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAqC,CAAA;AACvC,CAAC,EAvCW,kBAAkB,KAAlB,kBAAkB,QAuC7B;AACD,oEAAoE;AAEpE,qHAAqH;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,mBA4BX;AA5BD,WAAY,mBAAmB;IAC7B,qGAAqG;IACrG,0CAAmB,CAAA;IACnB,uGAAuG;IACvG,oDAA6B,CAAA;IAC7B;;;;OAIG;IACH,sDAA+B,CAAA;IAC/B;;;OAGG;IACH,oEAA6C,CAAA;IAC7C;;;;;;;;;;OAUG;IACH,sDAA+B,CAAA;AACjC,CAAC,EA5BW,mBAAmB,KAAnB,mBAAmB,QA4B9B;AAED,uHAAuH;AACvH,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,kIAAkI;IAClI,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC1C,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,sEAAsE;AACtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,aAAa,CAC/D,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAC1B,yBAAyB,CAC1B,CAAC;AAEF,oEAAoE;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAkD;IAElD,OAAO,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC;AACtG,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule facet:layer:shared facet:audience:app-developer */\n/**\n * **The data classes an application declares a retention period for.**\n *\n * ## Why a handful of classes, and not one period per resource\n *\n * `retentionPolicy.mode` on a resource says WHAT erasure does to a row. Nothing said HOW LONG a row\n * is kept, and a privacy notice cannot be written without that number: a confident paragraph about\n * impersonalization READS to a reader as an answer about retention, so the derivable half made the\n * missing half harder to see rather than easier (issue #89).\n *\n * The first design put a duration on every resource. It was rejected as false precision: an operator\n * decides \"customer data three years, logs ninety days, audit seven years\", not twelve numbers, and\n * twelve numbers are twelve things to keep true. What an operator actually decides is a schedule over\n * DATA CLASSES — and those classes are the ones that already differ in law, in storage and in who\n * asks for them.\n *\n * ## The classes are the STORES, and that is deliberate\n *\n * Each member maps to a distinct backing service, so one declaration answers two questions that have\n * always been asked separately: what a privacy notice must state, and what a backup-and-restore\n * inventory must protect and for how long (issue #8, which today has no inventory of any kind).\n *\n * | class | where it lives |\n * |---|---|\n * | {@link RESOURCE_DATA} | MongoDB / PostgreSQL |\n * | {@link FILES} | MinIO / S3 |\n * | {@link AUDIT_LOGS} | immudb — the tamper-evident ledger |\n * | {@link OPERATIONAL_LOGS} | the logging pipeline |\n * | {@link BUSINESS_RECORDS} | MongoDB / PostgreSQL — the one class split by LAW rather than by store |\n *\n * Splitting further is available later and is not free: every additional class is another period an\n * operator must decide and defend, and an undecided period is worse than a coarse one. The criterion\n * for a new member is that its records differ in law, in storage or in who asks for them —\n * {@link BUSINESS_RECORDS} is the first split made on the law alone (#1613).\n *\n * ## How a row is bound to a class\n *\n * A resource declares `retentionBinding: { retentionClass, startPoint }` in its resource\n * configuration ({@link ResourceRetentionBindingSchema}). An engine sweep then deletes a bound row\n * once `retentionDays` of its class have passed since the row's {@link RetentionStartPoint}. A\n * resource with no binding is kept until it is erased, and is reported by\n * `unboundRetentionResources` so the gap stays visible.\n */\nexport enum DataRetentionClass {\n  /**\n   * The application's own records — every resource row in its primary datastore.\n   *\n   * The class a privacy notice's retention paragraph is mostly about, because it is where the data a\n   * customer gave the application lives.\n   */\n  RESOURCE_DATA = \"RESOURCE_DATA\",\n  /** Uploaded file BYTES in object storage. Separate because their lawful window rarely matches the row that references them, and because losing them is a different incident from losing a row. */\n  FILES = \"FILES\",\n  /**\n   * The audit trail.\n   *\n   * Kept longest, and for a reason no other class shares: it is the record an operator needs to\n   * DEFEND itself, which is exactly the GDPR Art. 17(3) ground on which erasure may lawfully be\n   * refused. Never fold this into {@link RESOURCE_DATA} — doing so would let a shorter customer-data\n   * period silently shorten the evidence an operator may need years later.\n   */\n  AUDIT_LOGS = \"AUDIT_LOGS\",\n  /** Operational and diagnostic logs. Usually the shortest period, and the one most often left undeclared because nobody thinks of it as personal data — it routinely carries IP addresses and user identifiers. */\n  OPERATIONAL_LOGS = \"OPERATIONAL_LOGS\",\n  /**\n   * Records whose MINIMUM retention is set by law: business correspondence, accounting documents and\n   * their supporting pieces.\n   *\n   * A separate class because its members differ in law from {@link RESOURCE_DATA}: the period is a\n   * statutory floor, not the operator's choice, and it usually outlives the customer relationship.\n   * Germany's HGB §257 and AO §147 require 6 years for business letters and 8 for booking vouchers,\n   * counted from the end of the calendar year; France's Code de commerce L123-22 requires 10 years\n   * for accounting documents; UK law-firm practice follows the 15-year long-stop of the Limitation\n   * Act 1980 s.14B. Folding these into {@link RESOURCE_DATA} would force one of two wrong answers:\n   * delete statutory records with the customer data, or keep all customer data for a decade.\n   *\n   * Carries NO default period, like every class: the number depends on the jurisdiction and the\n   * record, and a defaulted statutory period is a legal statement nobody made. A resource that binds\n   * it usually counts from {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}. What an erasure does to a\n   * row still inside its period is the subject-erasure lane's (#1635), not this class's.\n   */\n  BUSINESS_RECORDS = \"BUSINESS_RECORDS\",\n}\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/** @wildo_source:part:start saas.models.privacy.retention-binding facet:layer:shared facet:audience:app-developer */\n/**\n * **When a bound row's retention clock starts.**\n *\n * A schedule period is counted \"from the point the application stops needing it for the purpose it\n * was collected for\" ({@link DataRetentionPeriodSchema}), so binding a live record to a class\n * counted from its CREATION would delete it while it is still in use. Every binding therefore names\n * its start point explicitly: there is no default, because every candidate default deletes somebody's\n * live data for some resource (#1613 review F1).\n *\n * ## The instant is READ from what the framework already records — not stamped a second time\n *\n * Four of the five members read an instant the row already carries, so the retention clock is the\n * same value every other surface shows, and no write path has to remember to maintain a copy:\n *\n * | member | the clock starts at | read from |\n * |---|---|---|\n * | {@link CREATED} | the insert | `createdAt` — infrastructure-owned on both adapters |\n * | {@link LAST_UPDATED} | the most recent update | `updatedAt` — infrastructure-owned on both adapters |\n * | {@link CLOSURE_EVENT} | the moment the declared closure date field is set | that field; null never expires |\n * | {@link END_OF_CALENDAR_YEAR} | 31 December 23:59:59.999 UTC of the creation year | `createdAt` |\n * | {@link SCOPE_DELETED} | the row's organization was marked for deletion | `retentionStartedAt`, stamped by the tenant purge |\n *\n * Rejected: persisting a `retentionStartedAt` on EVERY bound row. `createdAt` and `updatedAt` are\n * already maintained by the persistence adapter on every write path (the Mongoose timestamps plugin;\n * the PostgreSQL repository's timestamp stamping), and a second copy would have to be written at\n * each of those paths too — the one-invariant-many-sites shape that has shipped half-applied\n * repeatedly in this repository. Only {@link SCOPE_DELETED} has no instant on the row, so only it\n * stores one.\n *\n * The EXPIRY is never stored, for any member: the sweep computes `start + retentionDays` from the\n * CURRENT schedule at every run, so changing a period needs no backfill.\n */\nexport enum RetentionStartPoint {\n  /** At insert. For records whose purpose ends with their creation: a log line, a delivery attempt. */\n  CREATED = \"CREATED\",\n  /** At every update. For state kept only while it is still being touched: a draft, a session record. */\n  LAST_UPDATED = \"LAST_UPDATED\",\n  /**\n   * When the resource's declared `closureFieldName` date field is set — a ticket closed, a contract\n   * ended, a case archived. While that field is null the row never expires, which is what makes this\n   * the member for \"kept while it is open, then N days\".\n   */\n  CLOSURE_EVENT = \"CLOSURE_EVENT\",\n  /**\n   * 31 December 23:59:59.999 UTC of the year the row was created — how HGB §257(5) and AO §147(4)\n   * count commercial and tax retention.\n   */\n  END_OF_CALENDAR_YEAR = \"END_OF_CALENDAR_YEAR\",\n  /**\n   * When the row's organization is marked for deletion — \"kept while the account exists, then N days\".\n   *\n   * Two cases, decided at startup by the resource's `organizations → <resource>` teardown edge:\n   * - the edge DELETES the row in the tenant purge: the purge IS the enforcement, at\n   *   `tenantTeardown.retentionWindowDays`, which is single-sourced to {@link DataRetentionClass.RESOURCE_DATA}\n   *   — so only that class may be bound this way;\n   * - the row OUTLIVES its tenant (the edge is disabled, retains-and-impersonalizes, or is absent):\n   *   the purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and the\n   *   retention sweep deletes the row after its own class period.\n   */\n  SCOPE_DELETED = \"SCOPE_DELETED\",\n}\n\n/** The one field the framework stores for a retention clock: the {@link RetentionStartPoint.SCOPE_DELETED} instant. */\nexport const RETENTION_STARTED_AT_FIELD_NAME = \"retentionStartedAt\";\n\n/**\n * A resource's binding to a {@link DataRetentionClass}, declared as `retentionBinding` in its\n * resource configuration.\n *\n * ⚠️ NOT `retentionPolicy`. That is the erasure TREATMENT (what an erasure does to a row: delete, or\n * retain and scrub); this is the retention PERIOD (how long a row is kept at all). A resource may\n * declare either, both or neither, and they answer different questions for different readers.\n *\n * Strict, so a misspelled key fails at configuration build instead of being ignored — an ignored\n * binding would be a retention period the application states and nothing enforces.\n */\nexport const ResourceRetentionBindingSchema = z.strictObject({\n  /** The class whose declared period applies. The period itself lives in the application's `dataRetention` schedule, never here. */\n  retentionClass: z.enum(DataRetentionClass),\n  /** When the clock starts. Required, with no default — see {@link RetentionStartPoint}. */\n  startPoint: z.enum(RetentionStartPoint),\n  /**\n   * The date field whose value is the closure instant. Required for, and only allowed with,\n   * {@link RetentionStartPoint.CLOSURE_EVENT}; the resource factory refuses a field that is not a\n   * date, is not database-indexed (the sweep queries it on every run), or can be written by a\n   * client-routed create or update (a caller could backdate it into a delete). Make it server-owned:\n   * excluded from create and update, set by the owning handlers, declared in their `authoritativeFields`.\n   */\n  closureFieldName: z.string().trim().min(1).optional(),\n});\nexport type ResourceRetentionBinding = z.infer<typeof ResourceRetentionBindingSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-binding */\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule */\n/**\n * One declared retention period.\n *\n * `retentionDays` is REQUIRED when a class is declared at all: the whole point is the number. A class\n * an application has not decided is OMITTED from the schedule, which is a different answer and stays\n * a different answer — see {@link ApplicationRetentionScheduleSchema}.\n */\nexport const DataRetentionPeriodSchema = z.strictObject({\n  /**\n   * How long a record of this class is kept, counted from the point the application stops needing it\n   * for the purpose it was collected for.\n   *\n   * Days rather than a duration string because it is the unit every downstream consumer needs — a\n   * notice renders it, a backup schedule compares it, and a sweep would subtract it. A free-text\n   * period (\"as long as necessary\") is the placeholder this field exists to make impossible.\n   */\n  retentionDays: z.number().int().positive(),\n  /**\n   * WHY this period, in the operator's words — the lawful basis, the contractual term, the statutory\n   * minimum.\n   *\n   * Required, and it is the field that keeps the number honest: a period with no stated reason is a\n   * guess that will be published as a commitment. A notice may render it; a reviewer certainly reads it.\n   */\n  rationale: z.string().trim().min(1),\n});\nexport type DataRetentionPeriod = z.infer<typeof DataRetentionPeriodSchema>;\n\n/**\n * The application's declared retention schedule — a period per {@link DataRetentionClass}.\n *\n * ## Partial ON PURPOSE, and absence is never read as \"kept forever\"\n *\n * Every class is optional, and an omitted class means *the operator has not decided this yet* — not\n * that nothing is kept, and not that it is kept indefinitely. Both of those would be a statement, and\n * neither is one anybody made.\n *\n * That is what makes this safe to ship before an operator has answered: a compliance document states\n * the classes that ARE declared and marks the rest as needing a decision, naming who supplies it. The\n * alternative — requiring every class — would block a document on a number nobody has yet, which is\n * exactly the gate this whole capability exists to remove. **Never default a period.**\n */\nexport const ApplicationRetentionScheduleSchema = z.partialRecord(\n  z.enum(DataRetentionClass),\n  DataRetentionPeriodSchema,\n);\nexport type ApplicationRetentionSchedule = z.infer<typeof ApplicationRetentionScheduleSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/**\n * The classes an application has NOT declared a period for — what a document must mark as owed.\n *\n * Derived rather than stored, and total over the enum, so a class added to the vocabulary tomorrow is\n * reported as undeclared by every existing application rather than silently omitted from the answer.\n */\nexport function undeclaredRetentionClasses(\n  schedule: ApplicationRetentionSchedule | undefined,\n): readonly DataRetentionClass[] {\n  return Object.values(DataRetentionClass).filter((dataClass) => schedule?.[dataClass] === undefined);\n}\n"]}
+{"version":3,"file":"retention-schedule.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-schedule.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sHAAsH;AACtH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,kBAuCX;AAvCD,WAAY,kBAAkB;IAC5B;;;;;OAKG;IACH,qDAA+B,CAAA;IAC/B,kMAAkM;IAClM,qCAAe,CAAA;IACf;;;;;;;OAOG;IACH,+CAAyB,CAAA;IACzB,kNAAkN;IAClN,2DAAqC,CAAA;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAqC,CAAA;AACvC,CAAC,EAvCW,kBAAkB,KAAlB,kBAAkB,QAuC7B;AACD,oEAAoE;AAEpE,qHAAqH;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,mBA4BX;AA5BD,WAAY,mBAAmB;IAC7B,qGAAqG;IACrG,0CAAmB,CAAA;IACnB,uGAAuG;IACvG,oDAA6B,CAAA;IAC7B;;;;OAIG;IACH,sDAA+B,CAAA;IAC/B;;;OAGG;IACH,oEAA6C,CAAA;IAC7C;;;;;;;;;;OAUG;IACH,sDAA+B,CAAA;AACjC,CAAC,EA5BW,mBAAmB,KAAnB,mBAAmB,QA4B9B;AAED,uHAAuH;AACvH,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,kIAAkI;IAClI,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC1C,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvC;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,sEAAsE;AACtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,aAAa,CAC/D,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAC1B,yBAAyB,CAC1B,CAAC;AAEF,oEAAoE;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAkD;IAElD,OAAO,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC;AACtG,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule facet:layer:shared facet:audience:app-developer */\n/**\n * **The data classes an application declares a retention period for.**\n *\n * ## Why a handful of classes, and not one period per resource\n *\n * `retentionPolicy.mode` on a resource says WHAT erasure does to a row. Nothing said HOW LONG a row\n * is kept, and a privacy notice cannot be written without that number: a confident paragraph about\n * impersonalization READS to a reader as an answer about retention, so the derivable half made the\n * missing half harder to see rather than easier (issue #89).\n *\n * The first design put a duration on every resource. It was rejected as false precision: an operator\n * decides \"customer data three years, logs ninety days, audit seven years\", not twelve numbers, and\n * twelve numbers are twelve things to keep true. What an operator actually decides is a schedule over\n * DATA CLASSES — and those classes are the ones that already differ in law, in storage and in who\n * asks for them.\n *\n * ## The classes are the STORES, and that is deliberate\n *\n * Each member maps to a distinct backing service, so one declaration answers two questions that have\n * always been asked separately: what a privacy notice must state, and what a backup-and-restore\n * inventory must protect and for how long (issue #8, which today has no inventory of any kind).\n *\n * | class | where it lives |\n * |---|---|\n * | {@link RESOURCE_DATA} | MongoDB / PostgreSQL |\n * | {@link FILES} | MinIO / S3 |\n * | {@link AUDIT_LOGS} | immudb — the tamper-evident ledger |\n * | {@link OPERATIONAL_LOGS} | the logging pipeline |\n * | {@link BUSINESS_RECORDS} | MongoDB / PostgreSQL — the one class split by LAW rather than by store |\n *\n * Splitting further is available later and is not free: every additional class is another period an\n * operator must decide and defend, and an undecided period is worse than a coarse one. The criterion\n * for a new member is that its records differ in law, in storage or in who asks for them —\n * {@link BUSINESS_RECORDS} is the first split made on the law alone (#1613).\n *\n * ## How a row is bound to a class\n *\n * A resource declares `retentionBinding: { retentionClass, startPoint }` in its resource\n * configuration ({@link ResourceRetentionBindingSchema}). An engine sweep then deletes a bound row\n * once `retentionDays` of its class have passed since the row's {@link RetentionStartPoint}. A\n * resource with no binding is kept until it is erased, and is reported by\n * `unboundRetentionResources` so the gap stays visible.\n */\nexport enum DataRetentionClass {\n  /**\n   * The application's own records — every resource row in its primary datastore.\n   *\n   * The class a privacy notice's retention paragraph is mostly about, because it is where the data a\n   * customer gave the application lives.\n   */\n  RESOURCE_DATA = \"RESOURCE_DATA\",\n  /** Uploaded file BYTES in object storage. Separate because their lawful window rarely matches the row that references them, and because losing them is a different incident from losing a row. */\n  FILES = \"FILES\",\n  /**\n   * The audit trail.\n   *\n   * Kept longest, and for a reason no other class shares: it is the record an operator needs to\n   * DEFEND itself, which is exactly the GDPR Art. 17(3) ground on which erasure may lawfully be\n   * refused. Never fold this into {@link RESOURCE_DATA} — doing so would let a shorter customer-data\n   * period silently shorten the evidence an operator may need years later.\n   */\n  AUDIT_LOGS = \"AUDIT_LOGS\",\n  /** Operational and diagnostic logs. Usually the shortest period, and the one most often left undeclared because nobody thinks of it as personal data — it routinely carries IP addresses and user identifiers. */\n  OPERATIONAL_LOGS = \"OPERATIONAL_LOGS\",\n  /**\n   * Records whose MINIMUM retention is set by law: business correspondence, accounting documents and\n   * their supporting pieces.\n   *\n   * A separate class because its members differ in law from {@link RESOURCE_DATA}: the period is a\n   * statutory floor, not the operator's choice, and it usually outlives the customer relationship.\n   * Germany's HGB §257 and AO §147 require 6 years for business letters and 8 for booking vouchers,\n   * counted from the end of the calendar year; France's Code de commerce L123-22 requires 10 years\n   * for accounting documents; UK law-firm practice follows the 15-year long-stop of the Limitation\n   * Act 1980 s.14B. Folding these into {@link RESOURCE_DATA} would force one of two wrong answers:\n   * delete statutory records with the customer data, or keep all customer data for a decade.\n   *\n   * Carries NO default period, like every class: the number depends on the jurisdiction and the\n   * record, and a defaulted statutory period is a legal statement nobody made. A resource that binds\n   * it usually counts from {@link RetentionStartPoint.END_OF_CALENDAR_YEAR}. What an erasure does to a\n   * row still inside its period is the subject-erasure lane's (#1635), not this class's.\n   */\n  BUSINESS_RECORDS = \"BUSINESS_RECORDS\",\n}\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/** @wildo_source:part:start saas.models.privacy.retention-binding facet:layer:shared facet:audience:app-developer */\n/**\n * **When a bound row's retention clock starts.**\n *\n * A schedule period is counted \"from the point the application stops needing it for the purpose it\n * was collected for\" ({@link DataRetentionPeriodSchema}), so binding a live record to a class\n * counted from its CREATION would delete it while it is still in use. Every binding therefore names\n * its start point explicitly: there is no default, because every candidate default deletes somebody's\n * live data for some resource (#1613 review F1).\n *\n * ## The instant is READ from what the framework already records — not stamped a second time\n *\n * Four of the five members read an instant the row already carries, so the retention clock is the\n * same value every other surface shows, and no write path has to remember to maintain a copy:\n *\n * | member | the clock starts at | read from |\n * |---|---|---|\n * | {@link CREATED} | the insert | `createdAt` — infrastructure-owned on both adapters |\n * | {@link LAST_UPDATED} | the most recent update | `updatedAt` — infrastructure-owned on both adapters |\n * | {@link CLOSURE_EVENT} | the moment the declared closure date field is set | that field; null never expires |\n * | {@link END_OF_CALENDAR_YEAR} | 31 December 23:59:59.999 UTC of the creation year | `createdAt` |\n * | {@link SCOPE_DELETED} | the row's organization was marked for deletion | `retentionStartedAt`, stamped by the tenant purge |\n *\n * Rejected: persisting a `retentionStartedAt` on EVERY bound row. `createdAt` and `updatedAt` are\n * already maintained by the persistence adapter on every write path (the Mongoose timestamps plugin;\n * the PostgreSQL repository's timestamp stamping), and a second copy would have to be written at\n * each of those paths too — the one-invariant-many-sites shape that has shipped half-applied\n * repeatedly in this repository. Only {@link SCOPE_DELETED} has no instant on the row, so only it\n * stores one.\n *\n * The EXPIRY is never stored, for any member: the sweep computes `start + retentionDays` from the\n * CURRENT schedule at every run, so changing a period needs no backfill.\n */\nexport enum RetentionStartPoint {\n  /** At insert. For records whose purpose ends with their creation: a log line, a delivery attempt. */\n  CREATED = \"CREATED\",\n  /** At every update. For state kept only while it is still being touched: a draft, a session record. */\n  LAST_UPDATED = \"LAST_UPDATED\",\n  /**\n   * When the resource's declared `closureFieldName` date field is set — a ticket closed, a contract\n   * ended, a case archived. While that field is null the row never expires, which is what makes this\n   * the member for \"kept while it is open, then N days\".\n   */\n  CLOSURE_EVENT = \"CLOSURE_EVENT\",\n  /**\n   * 31 December 23:59:59.999 UTC of the year the row was created — how HGB §257(5) and AO §147(4)\n   * count commercial and tax retention.\n   */\n  END_OF_CALENDAR_YEAR = \"END_OF_CALENDAR_YEAR\",\n  /**\n   * When the row's organization is marked for deletion — \"kept while the account exists, then N days\".\n   *\n   * Two cases, decided at startup by the resource's `organizations → <resource>` teardown edge:\n   * - the edge DELETES the row in the tenant purge: the purge IS the enforcement, at\n   *   `tenantTeardown.retentionWindowDays`, which is single-sourced to {@link DataRetentionClass.RESOURCE_DATA}\n   *   — so only that class may be bound this way;\n   * - the row OUTLIVES its tenant (the edge is disabled, retains-and-impersonalizes, or is absent):\n   *   the purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and the\n   *   retention sweep deletes the row after its own class period.\n   */\n  SCOPE_DELETED = \"SCOPE_DELETED\",\n}\n\n/** The one field the framework stores for a retention clock: the {@link RetentionStartPoint.SCOPE_DELETED} instant. */\nexport const RETENTION_STARTED_AT_FIELD_NAME = \"retentionStartedAt\";\n\n/**\n * A resource's binding to a {@link DataRetentionClass}, declared as `retentionBinding` in its\n * resource configuration.\n *\n * ⚠️ NOT `retentionPolicy`. That is the erasure TREATMENT (what an erasure does to a row: delete, or\n * retain and scrub); this is the retention PERIOD (how long a row is kept at all). A resource may\n * declare either, both or neither, and they answer different questions for different readers.\n *\n * Strict, so a misspelled key fails at configuration build instead of being ignored — an ignored\n * binding would be a retention period the application states and nothing enforces.\n */\nexport const ResourceRetentionBindingSchema = z.strictObject({\n  /** The class whose declared period applies. The period itself lives in the application's `dataRetention` schedule, never here. */\n  retentionClass: z.enum(DataRetentionClass),\n  /** When the clock starts. Required, with no default — see {@link RetentionStartPoint}. */\n  startPoint: z.enum(RetentionStartPoint),\n  /**\n   * The date field whose value is the closure instant. Required for, and only allowed with,\n   * {@link RetentionStartPoint.CLOSURE_EVENT}; the resource factory refuses a field that is not a\n   * date, is not database-indexed (the sweep queries it on every run), or can be written by a\n   * client-routed create or update (a caller could backdate it into a delete). Make it server-owned:\n   * excluded from create and update, set by the owning handlers, declared in their `authoritativeFields`.\n   */\n  closureFieldName: z.string().trim().min(1).optional(),\n});\nexport type ResourceRetentionBinding = z.infer<typeof ResourceRetentionBindingSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-binding */\n\n/** @wildo_source:part:start saas.models.privacy.retention-schedule */\n/**\n * One declared retention period.\n *\n * `retentionDays` is REQUIRED when a class is declared at all: the whole point is the number. A class\n * an application has not decided is OMITTED from the schedule, which is a different answer and stays\n * a different answer — see {@link ApplicationRetentionScheduleSchema}.\n */\nexport const DataRetentionPeriodSchema = z.strictObject({\n  /**\n   * How long a record of this class is kept, counted from the point the application stops needing it\n   * for the purpose it was collected for.\n   *\n   * Days rather than a duration string because it is the unit every downstream consumer needs — a\n   * notice renders it, a backup schedule compares it, and a sweep would subtract it. A free-text\n   * period (\"as long as necessary\") is the placeholder this field exists to make impossible.\n   */\n  retentionDays: z.number().int().positive(),\n  /**\n   * WHY this period, in the operator's words — the lawful basis, the contractual term, the statutory\n   * minimum.\n   *\n   * Required, and it is the field that keeps the number honest: a period with no stated reason is a\n   * guess that will be published as a commitment. A notice may render it; a reviewer certainly reads it.\n   */\n  rationale: z.string().trim().min(1),\n});\nexport type DataRetentionPeriod = z.infer<typeof DataRetentionPeriodSchema>;\n\n/**\n * The application's declared retention schedule — a period per {@link DataRetentionClass}.\n *\n * ## Partial ON PURPOSE, and absence is never read as \"kept forever\"\n *\n * Every class is optional, and an omitted class means *the operator has not decided this yet* — not\n * that nothing is kept, and not that it is kept indefinitely. Both of those would be a statement, and\n * neither is one anybody made.\n *\n * That is what makes this safe to ship before an operator has answered: a compliance document states\n * the classes that ARE declared and marks the rest as needing a decision, naming who supplies it. The\n * alternative — requiring every class — would block a document on a number nobody has yet, which is\n * exactly the gate this whole capability exists to remove. **Never default a period.**\n */\nexport const ApplicationRetentionScheduleSchema = z.partialRecord(\n  z.enum(DataRetentionClass),\n  DataRetentionPeriodSchema,\n);\nexport type ApplicationRetentionSchedule = z.infer<typeof ApplicationRetentionScheduleSchema>;\n/** @wildo_source:part:end saas.models.privacy.retention-schedule */\n\n/**\n * The classes an application has NOT declared a period for — what a document must mark as owed.\n *\n * Derived rather than stored, and total over the enum, so a class added to the vocabulary tomorrow is\n * reported as undeclared by every existing application rather than silently omitted from the answer.\n */\nexport function undeclaredRetentionClasses(\n  schedule: ApplicationRetentionSchedule | undefined,\n): readonly DataRetentionClass[] {\n  return Object.values(DataRetentionClass).filter((dataClass) => schedule?.[dataClass] === undefined);\n}\n"]}

package/dist/esm/compliance/privacy/retention-scope-deleted.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention-scope-deleted.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-scope-deleted.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,iDAAiD,CAAC;AAGnH,OAAO,EAAuB,KAAK,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAEzG;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wCAAwC,CAAC,aAAa,EAAE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;CAC7E,GAAG,gCAAgC,CAenC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,cAAc,SAAS;IAC7E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;CACtD,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAQrD"}
+{"version":3,"file":"retention-scope-deleted.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-scope-deleted.shared.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,iDAAiD,CAAC;AAGnH,OAAO,EAAuB,KAAK,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAEzG;;;;;;;GAOG;AACH,oBAAY,gCAAgC;IAC1C;;;;OAIG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wCAAwC,CAAC,aAAa,EAAE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;CAC7E,GAAG,gCAAgC,CAenC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uCAAuC,CAAC,cAAc,SAAS;IAC7E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;CACtD,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAQrD"}

package/dist/esm/compliance/privacy/retention-scope-deleted.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention-scope-deleted.shared.utils.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/retention-scope-deleted.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,qCAAqC,EAAE,MAAM,iDAAiD,CAAC;AAEhI,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAiC,MAAM,qCAAqC,CAAC;AAEzG;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAaX;AAbD,WAAY,gCAAgC;IAC1C;;;;OAIG;IACH,mEAA+B,CAAA;IAC/B;;;;OAIG;IACH,uEAAmC,CAAA;AACrC,CAAC,EAbW,gCAAgC,KAAhC,gCAAgC,QAa3C;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wCAAwC,CAAC,aAGxD;IACC,MAAM,aAAa,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAC1D,MAAM,gBAAgB,GAAG;QACvB,GAAG,aAAa,CAAC,mBAAmB;QACpC,GAAG,aAAa,CAAC,kBAAkB;QACnC,GAAG,aAAa,CAAC,iBAAiB;KACnC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACtB,YAAY,CAAC,aAAa,KAAK,gBAAgB,CAAC,aAAa;WAC1D,YAAY,CAAC,aAAa,KAAK,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACtE,IAAI,CAAC,gBAAgB;QAAE,OAAO,gCAAgC,CAAC,eAAe,CAAC;IAC/E,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAAC,gBAAgB,CAAC,CAAC;IAChH,iGAAiG;IACjG,MAAM,gBAAgB,GAAG,cAAc,EAAE,OAAO,KAAK,IAAI;WACpD,qCAAqC,CAAC,cAAc,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC;IAC7F,OAAO,gBAAgB,CAAC,CAAC,CAAC,gCAAgC,CAAC,aAAa,CAAC,CAAC,CAAC,gCAAgC,CAAC,eAAe,CAAC;AAC9H,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uCAAuC,CAIpD,cAAwC;IACzC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,gBAAgB,EAAE,UAAU,KAAK,mBAAmB,CAAC,aAAa;YAAE,SAAS;QAC/F,IAAI,wCAAwC,CAAC,aAAa,CAAC,KAAK,gCAAgC,CAAC,eAAe;YAAE,SAAS;QAC3H,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import { ChildLifecycleStrategy, resolveChildLifecycleTeardownStrategy } from '../../resources/child-operations.shared.schemas';\nimport type { ResourceConfiguration_ResourceRelationships } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceType } from '../../resources/resources.shared.core.definitions';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport { RetentionStartPoint, type ResourceRetentionBinding } from './retention-schedule.shared.schemas';\n\n/**\n * How a `RetentionStartPoint.SCOPE_DELETED` binding is ENFORCED — decided by what the tenant purge\n * does to the resource's rows.\n *\n * The purge dispatches the ordinary `ORGANIZATIONS | DELETE`, and the resource's own\n * `organizations → <resource>` teardown edge decides the rows' fate. So there are exactly two cases, and\n * the retention sweep must treat them differently:\n */\nexport enum ScopeDeletedRetentionEnforcement {\n  /**\n   * The edge DELETES the rows in the purge cascade. The purge IS the enforcement: it fires at\n   * `tenantTeardown.retentionWindowDays`, single-sourced to `RESOURCE_DATA`, so only that class may be\n   * bound this way, and the sweep has nothing to do for the resource.\n   */\n  PURGE_CASCADE = 'PURGE_CASCADE',\n  /**\n   * The rows OUTLIVE their tenant — the edge is disabled, retains-and-impersonalizes, refuses, or does\n   * not exist. The purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and\n   * the retention sweep deletes each row after its own class period.\n   */\n  OUTLIVES_TENANT = 'OUTLIVES_TENANT',\n}\n\n/**\n * Classify a resource's SCOPE_DELETED enforcement from its DIRECT `organizations → resource` edge.\n *\n * Only the direct edge is read, deliberately: it is the edge the purge dispatches with the resource's own\n * teardown budget. A resource reached only through a DEEPER cascade (a grandchild of the organization)\n * classifies as {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}; if the cascade does delete it,\n * the purge's stamp and the sweep simply find nothing, which is the safe direction — a wrong classification\n * the other way would skip a sweep that owes deletions.\n */\nexport function classifyScopeDeletedRetentionEnforcement(configuration: {\n  readonly resourceIdentifier: string;\n  readonly resourceRelationships: ResourceConfiguration_ResourceRelationships;\n}): ScopeDeletedRetentionEnforcement {\n  const relationships = configuration.resourceRelationships;\n  const organizationEdge = [\n    ...relationships.parentRelationships,\n    ...relationships.childRelationships,\n    ...relationships.selfRelationships,\n  ].find((relationship) =>\n    relationship.resourceType1 === CoreResourceType.ORGANIZATIONS\n    && relationship.resourceType2 === configuration.resourceIdentifier);\n  if (!organizationEdge) return ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT;\n  const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(organizationEdge);\n  // The cascade's own default rule, read through its one named source rather than re-derived here.\n  const deletesInCascade = onParentDelete?.enabled === true\n    && resolveChildLifecycleTeardownStrategy(onParentDelete) === ChildLifecycleStrategy.DELETE;\n  return deletesInCascade ? ScopeDeletedRetentionEnforcement.PURGE_CASCADE : ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT;\n}\n\n/**\n * The resources whose rows OUTLIVE a deleted tenant and are bound to a retention class counted from that\n * deletion (`RetentionStartPoint.SCOPE_DELETED`, {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}).\n *\n * The ONE selection both ends of the SCOPE_DELETED clock use: the tenant purge STARTS the clock on these\n * resources' rows just before it deletes the organization, and `organizations.restore` CLEARS it on the same\n * resources when a purge that stamped them failed and the tenant is brought back. Two hand-kept filters\n * would drift, and a restore that cleared a narrower set than the purge stamped would leave a live tenant's\n * rows counting down to deletion.\n */\nexport function outlivingScopeDeletedBoundResourceTypes<TConfiguration extends {\n  readonly resourceIdentifier: string;\n  readonly resourceRelationships: ResourceConfiguration_ResourceRelationships;\n  readonly retentionBinding?: ResourceRetentionBinding;\n}>(configurations: Iterable<TConfiguration>): string[] {\n  const resourceTypes: string[] = [];\n  for (const configuration of configurations) {\n    if (configuration.retentionBinding?.startPoint !== RetentionStartPoint.SCOPE_DELETED) continue;\n    if (classifyScopeDeletedRetentionEnforcement(configuration) !== ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT) continue;\n    resourceTypes.push(configuration.resourceIdentifier);\n  }\n  return resourceTypes;\n}\n"]}
+{"version":3,"file":"retention-scope-deleted.shared.utils.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/retention-scope-deleted.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,qCAAqC,EAAE,MAAM,iDAAiD,CAAC;AAEhI,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAiC,MAAM,qCAAqC,CAAC;AAEzG;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAaX;AAbD,WAAY,gCAAgC;IAC1C;;;;OAIG;IACH,mEAA+B,CAAA;IAC/B;;;;OAIG;IACH,uEAAmC,CAAA;AACrC,CAAC,EAbW,gCAAgC,KAAhC,gCAAgC,QAa3C;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wCAAwC,CAAC,aAGxD;IACC,MAAM,aAAa,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAC1D,MAAM,gBAAgB,GAAG;QACvB,GAAG,aAAa,CAAC,mBAAmB;QACpC,GAAG,aAAa,CAAC,kBAAkB;QACnC,GAAG,aAAa,CAAC,iBAAiB;KACnC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACtB,YAAY,CAAC,aAAa,KAAK,gBAAgB,CAAC,aAAa;WAC1D,YAAY,CAAC,aAAa,KAAK,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACtE,IAAI,CAAC,gBAAgB;QAAE,OAAO,gCAAgC,CAAC,eAAe,CAAC;IAC/E,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAAC,gBAAgB,CAAC,CAAC;IAChH,iGAAiG;IACjG,MAAM,gBAAgB,GAAG,cAAc,EAAE,OAAO,KAAK,IAAI;WACpD,qCAAqC,CAAC,cAAc,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC;IAC7F,OAAO,gBAAgB,CAAC,CAAC,CAAC,gCAAgC,CAAC,aAAa,CAAC,CAAC,CAAC,gCAAgC,CAAC,eAAe,CAAC;AAC9H,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uCAAuC,CAIpD,cAAwC;IACzC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,gBAAgB,EAAE,UAAU,KAAK,mBAAmB,CAAC,aAAa;YAAE,SAAS;QAC/F,IAAI,wCAAwC,CAAC,aAAa,CAAC,KAAK,gCAAgC,CAAC,eAAe;YAAE,SAAS;QAC3H,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import { ChildLifecycleStrategy, resolveChildLifecycleTeardownStrategy } from '../../resources/child-operations.shared.schemas';\nimport type { ResourceConfiguration_ResourceRelationships } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceType } from '../../resources/resources.shared.core.definitions';\nimport { Resources_SharedUtils } from '../../resources/resources.shared.utils';\nimport { RetentionStartPoint, type ResourceRetentionBinding } from './retention-schedule.shared.schemas';\n\n/**\n * How a `RetentionStartPoint.SCOPE_DELETED` binding is ENFORCED — decided by what the tenant purge\n * does to the resource's rows.\n *\n * The purge dispatches the ordinary `ORGANIZATIONS | DELETE`, and the resource's own\n * `organizations → <resource>` teardown edge decides the rows' fate. So there are exactly two cases, and\n * the retention sweep must treat them differently:\n */\nexport enum ScopeDeletedRetentionEnforcement {\n  /**\n   * The edge DELETES the rows in the purge cascade. The purge IS the enforcement: it fires at\n   * `tenantTeardown.retentionWindowDays`, single-sourced to `RESOURCE_DATA`, so only that class may be\n   * bound this way, and the sweep has nothing to do for the resource.\n   */\n  PURGE_CASCADE = 'PURGE_CASCADE',\n  /**\n   * The rows OUTLIVE their tenant — the edge is disabled, retains-and-impersonalizes, refuses, or does\n   * not exist. The purge stamps `retentionStartedAt` with the organization's `deletionRequestedAt`, and\n   * the retention sweep deletes each row after its own class period.\n   */\n  OUTLIVES_TENANT = 'OUTLIVES_TENANT',\n}\n\n/**\n * Classify a resource's SCOPE_DELETED enforcement from its DIRECT `organizations → resource` edge.\n *\n * Only the direct edge is read, deliberately: it is the edge the purge dispatches with the resource's own\n * teardown budget. A resource reached only through a DEEPER cascade (a grandchild of the organization)\n * classifies as {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}; if the cascade does delete it,\n * the purge's stamp and the sweep simply find nothing, which is the safe direction — a wrong classification\n * the other way would skip a sweep that owes deletions.\n */\nexport function classifyScopeDeletedRetentionEnforcement(configuration: {\n  readonly resourceIdentifier: string;\n  readonly resourceRelationships: ResourceConfiguration_ResourceRelationships;\n}): ScopeDeletedRetentionEnforcement {\n  const relationships = configuration.resourceRelationships;\n  const organizationEdge = [\n    ...relationships.parentRelationships,\n    ...relationships.childRelationships,\n    ...relationships.selfRelationships,\n  ].find((relationship) =>\n    relationship.resourceType1 === CoreResourceType.ORGANIZATIONS\n    && relationship.resourceType2 === configuration.resourceIdentifier);\n  if (!organizationEdge) return ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT;\n  const onParentDelete = Resources_SharedUtils.resolveRelationshipLifecycleOnParentDeleteConfig(organizationEdge);\n  // The cascade's own default rule, read through its one named source rather than re-derived here.\n  const deletesInCascade = onParentDelete?.enabled === true\n    && resolveChildLifecycleTeardownStrategy(onParentDelete) === ChildLifecycleStrategy.DELETE;\n  return deletesInCascade ? ScopeDeletedRetentionEnforcement.PURGE_CASCADE : ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT;\n}\n\n/**\n * The resources whose rows OUTLIVE a deleted tenant and are bound to a retention class counted from that\n * deletion (`RetentionStartPoint.SCOPE_DELETED`, {@link ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT}).\n *\n * The ONE selection both ends of the SCOPE_DELETED clock use: the tenant purge STARTS the clock on these\n * resources' rows just before it deletes the organization, and `organizations.restore` CLEARS it on the same\n * resources when a purge that stamped them failed and the tenant is brought back. Two hand-kept filters\n * would drift, and a restore that cleared a narrower set than the purge stamped would leave a live tenant's\n * rows counting down to deletion.\n */\nexport function outlivingScopeDeletedBoundResourceTypes<TConfiguration extends {\n  readonly resourceIdentifier: string;\n  readonly resourceRelationships: ResourceConfiguration_ResourceRelationships;\n  readonly retentionBinding?: ResourceRetentionBinding;\n}>(configurations: Iterable<TConfiguration>): string[] {\n  const resourceTypes: string[] = [];\n  for (const configuration of configurations) {\n    if (configuration.retentionBinding?.startPoint !== RetentionStartPoint.SCOPE_DELETED) continue;\n    if (classifyScopeDeletedRetentionEnforcement(configuration) !== ScopeDeletedRetentionEnforcement.OUTLIVES_TENANT) continue;\n    resourceTypes.push(configuration.resourceIdentifier);\n  }\n  return resourceTypes;\n}\n"]}

package/dist/esm/compliance/privacy/sharing.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharing.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/sharing.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC"}
+{"version":3,"file":"sharing.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/sharing.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC"}

package/dist/esm/compliance/privacy/sharing.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sharing.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/sharing.shared.schemas.ts"],"names":[],"mappings":"","sourcesContent":["export {};"]}
+{"version":3,"file":"sharing.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/sharing.shared.schemas.ts"],"names":[],"mappings":"","sourcesContent":["export {};"]}

package/dist/esm/compliance/privacy/subject-data-recipients.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-data-recipients.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-data-recipients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,mCAAmC,EACzC,MAAM,kCAAkC,CAAC;AAE1C,qHAAqH;AACrH,oBAAY,qCAAqC;IAC/C,+GAA+G;IAC/G,eAAe,oBAAoB;IACnC,qGAAqG;IACrG,gBAAgB,qBAAqB;IACrC,kHAAkH;IAClH,cAAc,mBAAmB;IACjC,mGAAmG;IACnG,6BAA6B,kCAAkC;CAChE;AAED;;;;;GAKG;AACH,oBAAY,yBAAyB;IACnC,sFAAsF;IACtF,gBAAgB,qBAAqB;IACrC,wGAAwG;IACxG,cAAc,mBAAmB;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;IAClD;;;;;OAKG;;;;;kBAKH,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C;IACtD,kHAAkH;;kBAElH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,mEAAmE;AACnE,eAAO,MAAM,0BAA0B;IACrC,6FAA6F;;IAE7F;;;OAGG;;IAEH,mFAAmF;;;IAGnF,4EAA4E;;IAE5E,6GAA6G;;IAE7G,qGAAqG;;IAErG,wFAAwF;;IAExF;;;OAGG;;kBAEH,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,wHAAwH;AACxH,eAAO,MAAM,+BAA+B;;;kBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,yEAAyE;AACzE,eAAO,MAAM,sCAAsC;;QAlCjD,6FAA6F;;QAE7F;;;WAGG;;QAEH,mFAAmF;;;QAGnF,4EAA4E;;QAE5E,6GAA6G;;QAE7G,qGAAqG;;QAErG,wFAAwF;;QAExF;;;WAGG;;;IAeH,uGAAuG;;;;;kBAEvG,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0EAA0E;AAC1E,oBAAY,oCAAoC;IAC9C,yFAAyF;IACzF,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AAED,oDAAoD;AACpD,oBAAY,6BAA6B;IACvC,wGAAwG;IACxG,oBAAoB,yBAAyB;IAC7C,sGAAsG;IACtG,iBAAiB,sBAAsB;CACxC;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,6GAA6G;IAC7G,qBAAqB,0BAA0B;IAC/C,kHAAkH;IAClH,2BAA2B,gCAAgC;IAC3D,iGAAiG;IACjG,eAAe,oBAAoB;IACnC,2GAA2G;IAC3G,eAAe,oBAAoB;CACpC;AAED,4CAA4C;AAC5C,MAAM,WAAW,kCAAmC,SAAQ,oBAAoB;IAC9E,SAAS,EAAE,6BAA6B,CAAC;IACzC,UAAU,EAAE,8BAA8B,CAAC;CAC5C;AAED,2FAA2F;AAC3F,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,oCAAoC,CAAC;IAC7C,kGAAkG;IAClG,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,UAAU,EAAE,kCAAkC,EAAE,CAAC;CAClD;AAED,kGAAkG;AAClG,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,gCAAgC,GAAG,SAAS,EACzD,YAAY,EAAE,MAAM,GACnB,sBAAsB,GAAG,IAAI,CAE/B;AAmBD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,eAAe,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,WAAW,EAAE,gCAAgC,GAAG,SAAS,CAAC;IAC1D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACpD;;;;OAIG;IACH,0BAA0B,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,sBAAsB,EAAE,OAAO,CAAC;CACjC,GAAG,8BAA8B,CAoBjC;AAED;;;GAGG;AACH,wBAAgB,yCAAyC,IAAI,8BAA8B,CAE1F;AAED,oIAAoI;AACpI,wBAAgB,0CAA0C,IAAI,8BAA8B,CAE3F;AAED,uGAAuG;AACvG,wBAAgB,gCAAgC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,+HAA+H;AAC/H,eAAO,MAAM,+CAA+C,4BAA4B,CAAC;AAEzF,+CAA+C;AAC/C,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,yBAAyB,CAAC;IACjC,SAAS,EAAE,6BAA6B,CAAC;IACzC,UAAU,EAAE,8BAA8B,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,kCAAkC,GAAG,IAAI,CAAC;IAClD,wGAAwG;IACxG,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE;IACxD,SAAS,EAAE,8BAA8B,CAAC;IAC1C,cAAc,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAC/D,sHAAsH;IACtH,uBAAuB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtD,GAAG;IAAE,UAAU,EAAE,8BAA8B,EAAE,CAAC;IAAC,mBAAmB,EAAE,mCAAmC,EAAE,CAAA;CAAE,CA0C/G;AAkBD,yEAAyE"}
+{"version":3,"file":"subject-data-recipients.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-data-recipients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,mCAAmC,EACzC,MAAM,kCAAkC,CAAC;AAE1C,qHAAqH;AACrH,oBAAY,qCAAqC;IAC/C,+GAA+G;IAC/G,eAAe,oBAAoB;IACnC,qGAAqG;IACrG,gBAAgB,qBAAqB;IACrC,kHAAkH;IAClH,cAAc,mBAAmB;IACjC,mGAAmG;IACnG,6BAA6B,kCAAkC;CAChE;AAED;;;;;GAKG;AACH,oBAAY,yBAAyB;IACnC,sFAAsF;IACtF,gBAAgB,qBAAqB;IACrC,wGAAwG;IACxG,cAAc,mBAAmB;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;IAClD;;;;;OAKG;;;;;kBAKH,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C;IACtD,kHAAkH;;kBAElH,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,mEAAmE;AACnE,eAAO,MAAM,0BAA0B;IACrC,6FAA6F;;IAE7F;;;OAGG;;IAEH,mFAAmF;;;IAGnF,4EAA4E;;IAE5E,6GAA6G;;IAE7G,qGAAqG;;IAErG,wFAAwF;;IAExF;;;OAGG;;kBAEH,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,wHAAwH;AACxH,eAAO,MAAM,+BAA+B;;;kBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,yEAAyE;AACzE,eAAO,MAAM,sCAAsC;;QAlCjD,6FAA6F;;QAE7F;;;WAGG;;QAEH,mFAAmF;;;QAGnF,4EAA4E;;QAE5E,6GAA6G;;QAE7G,qGAAqG;;QAErG,wFAAwF;;QAExF;;;WAGG;;;IAeH,uGAAuG;;;;;kBAEvG,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0EAA0E;AAC1E,oBAAY,oCAAoC;IAC9C,yFAAyF;IACzF,QAAQ,aAAa;IACrB,+FAA+F;IAC/F,YAAY,iBAAiB;IAC7B;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AAED,oDAAoD;AACpD,oBAAY,6BAA6B;IACvC,wGAAwG;IACxG,oBAAoB,yBAAyB;IAC7C,sGAAsG;IACtG,iBAAiB,sBAAsB;CACxC;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,6GAA6G;IAC7G,qBAAqB,0BAA0B;IAC/C,kHAAkH;IAClH,2BAA2B,gCAAgC;IAC3D,iGAAiG;IACjG,eAAe,oBAAoB;IACnC,2GAA2G;IAC3G,eAAe,oBAAoB;CACpC;AAED,4CAA4C;AAC5C,MAAM,WAAW,kCAAmC,SAAQ,oBAAoB;IAC9E,SAAS,EAAE,6BAA6B,CAAC;IACzC,UAAU,EAAE,8BAA8B,CAAC;CAC5C;AAED,2FAA2F;AAC3F,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,oCAAoC,CAAC;IAC7C,kGAAkG;IAClG,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,UAAU,EAAE,kCAAkC,EAAE,CAAC;CAClD;AAED,kGAAkG;AAClG,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,gCAAgC,GAAG,SAAS,EACzD,YAAY,EAAE,MAAM,GACnB,sBAAsB,GAAG,IAAI,CAE/B;AAmBD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,eAAe,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,WAAW,EAAE,gCAAgC,GAAG,SAAS,CAAC;IAC1D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,kBAAkB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACpD;;;;OAIG;IACH,0BAA0B,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,sBAAsB,EAAE,OAAO,CAAC;CACjC,GAAG,8BAA8B,CAoBjC;AAED;;;GAGG;AACH,wBAAgB,yCAAyC,IAAI,8BAA8B,CAE1F;AAED,oIAAoI;AACpI,wBAAgB,0CAA0C,IAAI,8BAA8B,CAE3F;AAED,uGAAuG;AACvG,wBAAgB,gCAAgC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,+HAA+H;AAC/H,eAAO,MAAM,+CAA+C,4BAA4B,CAAC;AAEzF,+CAA+C;AAC/C,MAAM,WAAW,8BAA8B;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,yBAAyB,CAAC;IACjC,SAAS,EAAE,6BAA6B,CAAC;IACzC,UAAU,EAAE,8BAA8B,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,kCAAkC,GAAG,IAAI,CAAC;IAClD,wGAAwG;IACxG,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE;IACxD,SAAS,EAAE,8BAA8B,CAAC;IAC1C,cAAc,EAAE,SAAS,mCAAmC,EAAE,CAAC;IAC/D,sHAAsH;IACtH,uBAAuB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtD,GAAG;IAAE,UAAU,EAAE,8BAA8B,EAAE,CAAC;IAAC,mBAAmB,EAAE,mCAAmC,EAAE,CAAA;CAAE,CA0C/G;AAkBD,yEAAyE"}

package/dist/esm/compliance/privacy/subject-data-recipients.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-data-recipients.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-data-recipients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,+GAA+G;AAC/G,6GAA6G;AAC7G,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EACL,kCAAkC,GAEnC,MAAM,kCAAkC,CAAC;AAE1C,qHAAqH;AACrH,MAAM,CAAN,IAAY,qCASX;AATD,WAAY,qCAAqC;IAC/C,+GAA+G;IAC/G,4EAAmC,CAAA;IACnC,qGAAqG;IACrG,8EAAqC,CAAA;IACrC,kHAAkH;IAClH,0EAAiC,CAAA;IACjC,mGAAmG;IACnG,wGAA+D,CAAA;AACjE,CAAC,EATW,qCAAqC,KAArC,qCAAqC,QAShD;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,sFAAsF;IACtF,kEAAqC,CAAA;IACrC,wGAAwG;IACxG,8DAAiC,CAAA;AACnC,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QACb,eAAe,EAAE,oBAAoB,CAAC,eAAe;QACrD,0BAA0B,EAAE,oBAAoB,CAAC,0BAA0B;KAC5E,CAAC;CACH,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,kHAAkH;IAClH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH,mEAAmE;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,6FAA6F;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B;;;OAGG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IACxC,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjD,6GAA6G;IAC7G,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC9E,qGAAqG;IACrG,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,wHAAwH;AACxH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACxD,CAAC,CAAC;AAGH,yEAAyE;AACzE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;IAC/C,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;CAC1D,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAN,IAAY,oCAWX;AAXD,WAAY,oCAAoC;IAC9C,yFAAyF;IACzF,6DAAqB,CAAA;IACrB,+FAA+F;IAC/F,qEAA6B,CAAA;IAC7B;;;;OAIG;IACH,qEAA6B,CAAA;AAC/B,CAAC,EAXW,oCAAoC,KAApC,oCAAoC,QAW/C;AAED,oDAAoD;AACpD,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,wGAAwG;IACxG,8EAA6C,CAAA;IAC7C,sGAAsG;IACtG,wEAAuC,CAAA;AACzC,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,6GAA6G;IAC7G,iFAA+C,CAAA;IAC/C,kHAAkH;IAClH,6FAA2D,CAAA;IAC3D,iGAAiG;IACjG,qEAAmC,CAAA;IACnC,2GAA2G;IAC3G,qEAAmC,CAAA;AACrC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAgBD,kGAAkG;AAClG,MAAM,UAAU,2BAA2B,CACzC,WAAyD,EACzD,YAAoB;IAEpB,OAAO,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AAC1H,CAAC;AAED,SAAS,YAAY,CAAC,KAAgC,EAAE,IAAmC;IACzF,IAAI,KAAK,KAAK,yBAAyB,CAAC,cAAc;QAAE,OAAO,8BAA8B,CAAC,eAAe,CAAC;IAC9G,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB,CAAC,UAAU,CAAC;QACvC,KAAK,sBAAsB,CAAC,gBAAgB;YAC1C,OAAO,8BAA8B,CAAC,qBAAqB,CAAC;QAC9D,KAAK,sBAAsB,CAAC,SAAS;YACnC,OAAO,8BAA8B,CAAC,2BAA2B,CAAC;QACpE,KAAK,IAAI;YACP,OAAO,8BAA8B,CAAC,eAAe,CAAC;QACxD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,IAAI,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,YAAY,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAmB3C;IACC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,yCAAyC,EAAE,CAAC;IACzF,MAAM,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAyC,EAAE,CAAC;IAC5D,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,eAAe,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClG,MAAM,OAAO,GAAG,eAAe,IAAI,MAAM,CAAC,sBAAsB,CAAC;QACjE,MAAM,SAAS,GAAG,eAAe;eAC5B,SAAS,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC;eAC3C,SAAS,CAAC,mBAAmB;eAC7B,CAAC,MAAM,CAAC,0BAA0B,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,SAAS;QACrC,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,SAAS;YACZ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,oBAAoB,CAAC,CAAC,CAAC,6BAA6B,CAAC,iBAAiB;YACzH,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,oCAAoC,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACnG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yCAAyC;IACvD,OAAO,EAAE,MAAM,EAAE,oCAAoC,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC3G,CAAC;AAED,oIAAoI;AACpI,MAAM,UAAU,0CAA0C;IACxD,OAAO,EAAE,MAAM,EAAE,oCAAoC,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC3G,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,gCAAgC,CAAC,YAAoB;IACnE,OAAO,aAAa,YAAY,EAAE,CAAC;AACrC,CAAC;AAED,+HAA+H;AAC/H,MAAM,CAAC,MAAM,+CAA+C,GAAG,yBAAyB,CAAC;AAkBzF;;;GAGG;AACH,MAAM,eAAe,GAAkD;IACrE,kCAAkC,CAAC,OAAO;IAC1C,kCAAkC,CAAC,MAAM;IACzC,kCAAkC,CAAC,UAAU;IAC7C,kCAAkC,CAAC,cAAc;IACjD,kCAAkC,CAAC,wBAAwB;IAC3D,kCAAkC,CAAC,SAAS;IAC5C,kCAAkC,CAAC,gBAAgB;IACnD,kCAAkC,CAAC,wBAAwB;CAC5D,CAAC;AAEF,SAAS,cAAc,CAAC,QAAuD;IAC7E,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,kCAAkC,CAAC,UAAU,CAAC;AACtH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAKjD;IACC,MAAM,mBAAmB,GAA0C,EAAE,CAAC;IACtE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,oCAAoC,CAAC,QAAQ,EAAE,CAAC;QAC9E,mBAAmB,CAAC,IAAI,CAAC;YACvB,SAAS,EAAE,+CAA+C;YAC1D,MAAM,EAAE,kCAAkC,CAAC,UAAU;YACrD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,oCAAoC,CAAC,YAAY;gBACnF,CAAC,CAAC,mNAAmN;gBACrN,CAAC,CAAC,qJAAqJ;SAC1J,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAkC,EAAE;QAC/F,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,SAAS,CAAC,GAAG;YAC3B,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC,CAAC;QACF,IAAI,SAAS,CAAC,KAAK,KAAK,yBAAyB,CAAC,cAAc;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACnH,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC;QACpI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAClJ,CAAC;QACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC;aAC7E,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC;QACxG,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,GAAG,CAAC;YACnD,iHAAiH;YACjH,8GAA8G;YAC9G,mCAAmC;YACnC,CAAC,CAAC;gBACA,SAAS;gBACT,MAAM,EAAE,kCAAkC,CAAC,UAAU;gBACrD,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,wCAAwC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD,SAAS,CAAC,GAAG,6CAA6C;aACxN;YACD,CAAC,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,yBAAyB,CAAC,SAA6C,EAAE,SAAiB;IACjG,QAAQ,SAAS,CAAC,aAAa,EAAE,CAAC;QAChC,KAAK,oBAAoB,CAAC,eAAe;YACvC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,qDAAqD,EAAE,CAAC;QAC3K,KAAK,oBAAoB,CAAC,mCAAmC;YAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,MAAM,EAAE,yDAAyD,SAAS,CAAC,GAAG,uEAAuE,EAAE,CAAC;QACnP,KAAK,oBAAoB,CAAC,0BAA0B;YAClD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,sGAAsG,EAAE,CAAC;QAClN,KAAK,IAAI;YACP,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,gHAAgH,EAAE,CAAC;QACxN,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,SAAS,CAAC,aAAa,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;AACH,CAAC;AACD,yEAAyE","sourcesContent":["/**\n * **Who else holds a data subject's personal data, and what erasure owes each of them** — the RUNTIME half of #1710.\n *\n * ## Why the running application needs the recipient list\n *\n * A subject export answers GDPR Art. 15, which gives the data subject a right to \"the recipients or categories of\n * recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or\n * international organisations\" (Art. 15(1)(c)). An erasure answers Art. 17, and Art. 19 then requires the controller to\n * \"communicate any rectification or erasure of personal data … to each recipient to whom the personal data have been\n * disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data\n * subject about those recipients if the data subject requests it.\" Both are answered by the running backend, which\n * until now knew only its own stores: a subject export listed no recipient, and an erasure reported nothing about a\n * vendor that no registered effect happened to reach.\n * spec-cite: GDPR Art. 15(1)(c), https://gdpr-info.eu/art-15-gdpr/ (fetched 2026-09-29)\n * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)\n *\n * ## Derived ONCE, at design time, and projected — never re-derived here\n *\n * Who the recipients are is decided by the application's committed declarations: the recipient population (which\n * vendors a data path reaches, and with whose account), the processor register (the LEGAL identity the operator\n * adopted), the #1709 disclosures (which categories each flow carries) and the providers' compliance profiles. None\n * of those inputs exists in a running backend — the register and the typed-client scan live in the application's\n * specifications and source — so `wildo config subject-data-recipients` runs that one derivation and writes the result\n * into `backend-api/src/subject-data-recipients.generated.ts`, which the application composes into\n * `compliance.subjectDataRecipients`. The `dataRetention` precedent: one value, derived where its inputs are, read\n * where it is enforced.\n *\n * Two alternatives were rejected:\n *\n * - **Re-deriving at runtime from the loaded provider modules.** Their `vendorLegalEntityName` is a sourced SUGGESTION\n *   the operator adopts by committing a register entry (Paul, 2026-09-25) — telling a data subject the suggestion\n *   would state a fact nobody adopted. And the runtime cannot see a typed client, so it would silently drop a vendor.\n * - **Moving the derivation into this package.** Its inputs are still unavailable at runtime; only the code would move.\n *\n * ## Per subject, by CATEGORY — and never omitted when unknown\n *\n * The declaration is application-wide and names PROVIDERS only — a system of record is maintained on its own lane (its\n * erasure is the HTTP_API effects' under the binding's D6 stance). For one request, {@link selectSubjectDataRecipients}\n * says a recipient CARRIES the subject's data when the subject is an account holder and the recipient's capability\n * categories meet the categories the involved resources declare (`.dataCategories()`) — the engine composes capability\n * calls from account holders' data. Everything less\n * certain is kept as {@link SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED}: a category match for any other subject, a\n * recipient whose categories are NOT all derivable or only a FLOOR (free text can carry any category), and every\n * recipient when the SUBJECT side is not fully known (an unreadable resource, a personal field with no category). An\n * unknown is a reason to name the vendor, never to leave it out; only a recipient whose fully derived categories\n * demonstrably miss fully known subject data is left out. The role split reads the SUBJECT's resource type only: data a\n * processor-scope resource sends a vendor under a controller-scope subject is still reported under the subject's role.\n *\n * ## Absent is NOT DECLARED, and is marked\n *\n * An application that never generated the projection has not said who received anything. The export states NOT\n * DECLARED, and the erasure carries one UNMEASURED outcome naming the missing projection — incomplete, never a silent\n * pass, and never a refusal (`.claude/rules/application-creation-directive.md`).\n *\n * @wildo_source:part:start saas.models.privacy.subject-data-recipients facet:layer:shared facet:audience:app-developer\n */\nimport { z } from 'zod';\n// The D6 erasure vocabulary, REUSED rather than restated (#1710). Published from the package root, because the\n// contracts below carry it into the root-exported application configuration and provider compliance profile.\nimport { HttpApiErasureStance } from '../../http-api-binding/http-api-erasure-stance.shared';\nimport { OperatorProcessingRole } from './operator-compliance-identity.shared.schemas';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\nimport {\n  SubjectErasureExternalEffectStatus,\n  type SubjectErasureExternalEffectOutcome,\n} from './subject-erasure.shared.schemas';\n\n/** Why a recipient's categories are not all derivable (#1709) — the reason travels with the recipient to runtime. */\nexport enum RecipientCategoriesNotDerivableReason {\n  /** Reached by a typed client, a browser operation or unscanned code: no declared field-to-input map exists. */\n  FLOW_UNDECLARED = 'flow-undeclared',\n  /** A system-of-record instance that no resource binds or pipes: nothing declares what reaches it. */\n  NO_RESOURCE_FLOW = 'no-resource-flow',\n  /** The resource flows could not be read (the introspection failed), so nothing is known — which is not \"none\". */\n  FLOWS_NOT_READ = 'flows-not-read',\n  /** Some flowing field is personal by the application's own declaration and carries no category. */\n  UNCATEGORIZED_PERSONAL_FIELDS = 'uncategorized-personal-fields',\n}\n\n/**\n * WHOSE account reached the recipient — which decides who owes the Art. 19 communication.\n *\n * Not the population class: that also answers \"operator-run\" and \"declared without a data path\", neither of which is a\n * recipient. This is the question an erasure asks of a recipient that exists.\n */\nexport enum SubjectDataRecipientReach {\n  /** Reached with an application-owned credential: the operator engaged this vendor. */\n  OPERATOR_ACCOUNT = 'operator-account',\n  /** Reached ONLY through a tenant's or a person's connected account: the tenant's own vendor (#1707). */\n  TENANT_ACCOUNT = 'tenant-account',\n}\n\n/**\n * The stance a VENDOR declares about subject data it keeps (#1710) — on the provider's compliance profile. The D6\n * vocabulary, narrowed to the two stances a vendor fact can take: the third, an acknowledged non-erasure, is the\n * CONTROLLER's act and is declared by the operator ({@link ProviderSubjectErasureAcknowledgementSchema}).\n */\nexport const ProviderSubjectErasureDeclarationSchema = z.strictObject({\n  /**\n   * - `NO_SUBJECT_DATA`: the vendor keeps nothing about a subject beyond the call itself — erasure reports\n   *   DECLARED_NO_SUBJECT_DATA, which is complete.\n   * - `EXTERNAL_ERASURE_OPERATION`: an erasure effect in the external-effects registry reaches this vendor (the billing\n   *   effect for a billing provider). If none is registered for it at runtime, erasure reports NOT_REGISTERED.\n   */\n  stance: z.enum({\n    NO_SUBJECT_DATA: HttpApiErasureStance.NO_SUBJECT_DATA,\n    EXTERNAL_ERASURE_OPERATION: HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION,\n  }),\n});\nexport type ProviderSubjectErasureDeclaration = z.infer<typeof ProviderSubjectErasureDeclarationSchema>;\n\n/**\n * The OPERATOR's acknowledgement that erasure does not reach this vendor (#1710): the D6 stance\n * CONTROLLER_ACKNOWLEDGED_NON_ERASURE for a provider, on `providerComplianceChoices.<ref>`. Erasure then reports\n * ACKNOWLEDGED_NON_ERASURE — still incomplete, because the data is still live at the vendor, however deliberate the\n * decision was.\n */\nexport const ProviderSubjectErasureAcknowledgementSchema = z.strictObject({\n  /** Why the operator accepts that erasure does not reach the vendor — \"Resend deletes its logs within 90 days\". */\n  reason: z.string().trim().min(1),\n});\nexport type ProviderSubjectErasureAcknowledgement = z.infer<typeof ProviderSubjectErasureAcknowledgementSchema>;\n\n/** One recipient, as the running application needs to state it. */\nexport const SubjectDataRecipientSchema = z.strictObject({\n  /** The provider ref. A system of record is never a recipient here (see the module JSDoc). */\n  ref: z.string().trim().min(1),\n  /**\n   * The legal entity the operator's processor register adopted for it, or `null` when the register has no entry — a\n   * gap stated as such, never filled with a suggestion.\n   */\n  legalEntityName: z.string().trim().min(1).nullable(),\n  /** Where the register says it processes. Empty when there is no register entry. */\n  processingRegions: z.array(z.string().trim().min(1)),\n  reach: z.enum(SubjectDataRecipientReach),\n  /** The categories its declared flows carry to it (#1709), in enum order. */\n  categories: z.array(z.enum(PersonalDataCategory)),\n  /** Every reason those categories are not all known. Empty when the declared flows account for everything. */\n  categoriesNotDerivable: z.array(z.enum(RecipientCategoriesNotDerivableReason)),\n  /** True when the categories include free text a person wrote, which can carry any other category. */\n  categoriesAreAFloor: z.boolean(),\n  /** The declared flows the categories come from — `capability:EMAIL_TRANSACTIONAL`, … */\n  derivedFrom: z.array(z.string().trim().min(1)),\n  /**\n   * The erasure stance: the vendor's declaration, or the operator's acknowledged non-erasure. `null` when neither\n   * exists — erasure then reports UNMEASURED for this recipient.\n   */\n  erasureStance: z.enum(HttpApiErasureStance).nullable(),\n});\nexport type SubjectDataRecipient = z.infer<typeof SubjectDataRecipientSchema>;\n\n/** Which resource types one operator role covers, from `operatorComplianceIdentity.roleAllocations[].resourceTypes`. */\nexport const SubjectDataRoleAllocationSchema = z.strictObject({\n  role: z.enum(OperatorProcessingRole),\n  resourceTypes: z.array(z.string().trim().min(1)).min(1),\n});\nexport type SubjectDataRoleAllocation = z.infer<typeof SubjectDataRoleAllocationSchema>;\n\n/** The derived projection `compliance.subjectDataRecipients` carries. */\nexport const SubjectDataRecipientsDeclarationSchema = z.strictObject({\n  recipients: z.array(SubjectDataRecipientSchema),\n  /** The role allocations that name their resource types. An allocation in prose only is not carried. */\n  roleAllocations: z.array(SubjectDataRoleAllocationSchema),\n});\nexport type SubjectDataRecipientsDeclaration = z.infer<typeof SubjectDataRecipientsDeclarationSchema>;\n\n/** Whether the running application has a recipient declaration at all. */\nexport enum SubjectDataRecipientsStatementStatus {\n  /** The projection is composed; the list below is the derived answer (possibly empty). */\n  DECLARED = 'declared',\n  /** No projection: the application has not stated who received personal data. A gap, marked. */\n  NOT_DECLARED = 'not-declared',\n  /**\n   * A declaration may exist, but applying it to this request FAILED (the erasure's post-commit accounting threw), so\n   * which recipients hold this subject's data is unknown. Distinct from NOT_DECLARED, whose remedy is to generate the\n   * projection; this one's is to reconcile the vendors by hand and look at the logged error.\n   */\n  UNDETERMINED = 'undetermined',\n}\n\n/** Why one recipient is listed for this subject. */\nexport enum SubjectDataRecipientRelevance {\n  /** Its derived categories meet this subject's data, or its flow names one of the involved resources. */\n  CARRIES_SUBJECT_DATA = 'carries-subject-data',\n  /** Its categories are not all derivable, or are a floor: it may have received this subject's data. */\n  MAY_HAVE_RECEIVED = 'may-have-received',\n}\n\n/**\n * Who owes what to this recipient when the subject's data is erased — the role split (#1710).\n *\n * A processor \"assists the controller … for the fulfilment of the controller's obligation to respond to requests for\n * exercising the data subject's rights\" (Art. 28(3)(e)); the Art. 19 communication is the controller's.\n * spec-cite: GDPR Art. 28(3)(e), https://gdpr-info.eu/art-28-gdpr/ (fetched 2026-09-29)\n */\nexport enum SubjectDataRecipientObligation {\n  /** The operator is CONTROLLER (or joint controller) for this data: it communicates the erasure (Art. 19). */\n  OPERATOR_COMMUNICATES = 'operator-communicates',\n  /** The operator is PROCESSOR for this data: the outcome is assistance evidence for the tenant, the controller. */\n  OPERATOR_ASSISTS_CONTROLLER = 'operator-assists-controller',\n  /** Reached with the tenant's own account: the tenant's recipient, and the tenant's to notify. */\n  TENANT_NOTIFIES = 'tenant-notifies',\n  /** No role allocation names the subject's resource type, so who owes the communication is not declared. */\n  ROLE_UNDECLARED = 'role-undeclared',\n}\n\n/** One recipient listed for one request. */\nexport interface SubjectDataRecipientStatementEntry extends SubjectDataRecipient {\n  relevance: SubjectDataRecipientRelevance;\n  obligation: SubjectDataRecipientObligation;\n}\n\n/** The recipient part of a subject export or erasure report. Contains no personal data. */\nexport interface SubjectDataRecipientsStatement {\n  status: SubjectDataRecipientsStatementStatus;\n  /** The operator's role for the subject's resource type, or `null` when no allocation names it. */\n  operatorRole: OperatorProcessingRole | null;\n  recipients: SubjectDataRecipientStatementEntry[];\n}\n\n/** The operator role an allocation declares for a resource type, or `null` when none names it. */\nexport function operatorRoleForResourceType(\n  declaration: SubjectDataRecipientsDeclaration | undefined,\n  resourceType: string,\n): OperatorProcessingRole | null {\n  return declaration?.roleAllocations.find((allocation) => allocation.resourceTypes.includes(resourceType))?.role ?? null;\n}\n\nfunction obligationOf(reach: SubjectDataRecipientReach, role: OperatorProcessingRole | null): SubjectDataRecipientObligation {\n  if (reach === SubjectDataRecipientReach.TENANT_ACCOUNT) return SubjectDataRecipientObligation.TENANT_NOTIFIES;\n  switch (role) {\n    case OperatorProcessingRole.CONTROLLER:\n    case OperatorProcessingRole.JOINT_CONTROLLER:\n      return SubjectDataRecipientObligation.OPERATOR_COMMUNICATES;\n    case OperatorProcessingRole.PROCESSOR:\n      return SubjectDataRecipientObligation.OPERATOR_ASSISTS_CONTROLLER;\n    case null:\n      return SubjectDataRecipientObligation.ROLE_UNDECLARED;\n    default: {\n      const unhandled: never = role;\n      throw new Error(`subject data recipients: unhandled operator role ${String(unhandled)}`);\n    }\n  }\n}\n\n/**\n * The `derivedFrom` token kind of a flow the ENGINE composes through a capability: `capability:<token>` (#1709), written\n * by `deriveRecipientDisclosures`. The only flow kind this list carries, because systems of record are kept out of it.\n */\nexport const RECIPIENT_CAPABILITY_FLOW_TOKEN_KIND = 'capability';\n\n/**\n * The recipients one subject export or erasure must name — see the module JSDoc for the rule. Pure, so the backend,\n * a test and a reviewer apply the same one.\n */\nexport function selectSubjectDataRecipients(params: {\n  declaration: SubjectDataRecipientsDeclaration | undefined;\n  subjectResourceType: string;\n  /** The union of the `.dataCategories()` those resources declare. */\n  involvedCategories: readonly PersonalDataCategory[];\n  /**\n   * `false` when the involved categories are NOT the whole answer: a resource's configuration could not be read, or it\n   * declares personal fields with no category. An unknown on the SUBJECT side must widen the list exactly as an unknown\n   * on the recipient side does — every recipient not matched is then kept as MAY_HAVE_RECEIVED, never dropped.\n   */\n  involvedCategoriesComplete: boolean;\n  /**\n   * Whether the subject is an ACCOUNT HOLDER (a user). A capability recipient's categories are what the ENGINE sends\n   * when it composes the call — the recipient address of an account's mail, the billing customer, the signed-in actor —\n   * which are account holders' data. So a category match through a capability alone says the vendor carries an account\n   * holder's data; for any other subject (a CRM contact) it says only that it MAY have received it, because nothing\n   * declares that the application routes that subject's data to the capability.\n   */\n  subjectIsAccountHolder: boolean;\n}): SubjectDataRecipientsStatement {\n  if (params.declaration === undefined) return notDeclaredSubjectDataRecipientsStatement();\n  const role = operatorRoleForResourceType(params.declaration, params.subjectResourceType);\n  const involvedCategories = new Set(params.involvedCategories);\n  const recipients: SubjectDataRecipientStatementEntry[] = [];\n  for (const recipient of params.declaration.recipients) {\n    const sharesACategory = recipient.categories.some((category) => involvedCategories.has(category));\n    const carries = sharesACategory && params.subjectIsAccountHolder;\n    const uncertain = sharesACategory\n      || recipient.categoriesNotDerivable.length > 0\n      || recipient.categoriesAreAFloor\n      || !params.involvedCategoriesComplete;\n    if (!carries && !uncertain) continue;\n    recipients.push({\n      ...recipient,\n      relevance: carries ? SubjectDataRecipientRelevance.CARRIES_SUBJECT_DATA : SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED,\n      obligation: obligationOf(recipient.reach, role),\n    });\n  }\n  return { status: SubjectDataRecipientsStatementStatus.DECLARED, operatorRole: role, recipients };\n}\n\n/**\n * The statement of an application with no recipient declaration. Also the placeholder an orchestrator writes into a\n * report its caller completes (the erasure and export doors fill the real statement, as they fill `externalEffects`).\n */\nexport function notDeclaredSubjectDataRecipientsStatement(): SubjectDataRecipientsStatement {\n  return { status: SubjectDataRecipientsStatementStatus.NOT_DECLARED, operatorRole: null, recipients: [] };\n}\n\n/** The statement of a request whose recipient accounting failed — see {@link SubjectDataRecipientsStatementStatus.UNDETERMINED}. */\nexport function undeterminedSubjectDataRecipientsStatement(): SubjectDataRecipientsStatement {\n  return { status: SubjectDataRecipientsStatementStatus.UNDETERMINED, operatorRole: null, recipients: [] };\n}\n\n/** The effect ref the recipient reconciliation writes for a recipient no registered effect reached. */\nexport function subjectErasureRecipientEffectRef(recipientRef: string): string {\n  return `recipient:${recipientRef}`;\n}\n\n/** The effect ref of the single outcome an erasure carries when its recipients are not declared or could not be determined. */\nexport const SUBJECT_DATA_RECIPIENTS_NOT_DECLARED_EFFECT_REF = 'subject-data-recipients';\n\n/** What an erasure did about one recipient. */\nexport interface SubjectErasureRecipientOutcome {\n  recipientRef: string;\n  legalEntityName: string | null;\n  reach: SubjectDataRecipientReach;\n  relevance: SubjectDataRecipientRelevance;\n  obligation: SubjectDataRecipientObligation;\n  /**\n   * The outcome at this recipient: the covering effects' combined status, or the status the declared stance decides.\n   * `null` for a tenant-account recipient — not the operator's erasure to run, and named for the tenant to notify.\n   */\n  status: SubjectErasureExternalEffectStatus | null;\n  /** The effect refs that reached it — a registered effect, or the reconciliation's `recipient:<ref>`. */\n  effectRefs: string[];\n}\n\n/**\n * Most-incomplete-wins when several effects reach one recipient: a PARTIAL next to a COMPLETED is still partial.\n * Ordered from the state a reader must act on first to the states that close the question.\n */\nconst STATUS_SEVERITY: readonly SubjectErasureExternalEffectStatus[] = [\n  SubjectErasureExternalEffectStatus.PARTIAL,\n  SubjectErasureExternalEffectStatus.FAILED,\n  SubjectErasureExternalEffectStatus.UNMEASURED,\n  SubjectErasureExternalEffectStatus.NOT_REGISTERED,\n  SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE,\n  SubjectErasureExternalEffectStatus.COMPLETED,\n  SubjectErasureExternalEffectStatus.NOTHING_TO_ERASE,\n  SubjectErasureExternalEffectStatus.DECLARED_NO_SUBJECT_DATA,\n];\n\nfunction combinedStatus(statuses: readonly SubjectErasureExternalEffectStatus[]): SubjectErasureExternalEffectStatus {\n  return STATUS_SEVERITY.find((status) => statuses.includes(status)) ?? SubjectErasureExternalEffectStatus.UNMEASURED;\n}\n\n/**\n * Reconcile the recipients an erasure must reach with the effects that ran (#1710).\n *\n * Every operator-account recipient gets a status, so none can pass silently:\n * - a registered effect that names it as its `recipientRef` → that effect's status;\n * - otherwise its stance decides: NO_SUBJECT_DATA → DECLARED_NO_SUBJECT_DATA (complete); an acknowledged\n *   non-erasure → ACKNOWLEDGED_NON_ERASURE; EXTERNAL_ERASURE_OPERATION with no effect registered → NOT_REGISTERED;\n *   no stance → UNMEASURED. Each becomes an `externalEffects` outcome under `recipient:<ref>`, so every existing\n *   reader of the report (`isIncompleteSubjectErasureExternalEffect`, the Wonder Todos request lane) sees it without\n *   learning a new field.\n * - NOT DECLARED adds one UNMEASURED outcome naming the missing projection.\n *\n * It marks and never refuses: the local erasure has already committed when this runs.\n */\nexport function reconcileSubjectErasureRecipients(params: {\n  statement: SubjectDataRecipientsStatement;\n  effectOutcomes: readonly SubjectErasureExternalEffectOutcome[];\n  /** Which recipient each REGISTERED effect reaches — applicable to this subject or not: effect ref → recipient ref. */\n  recipientRefByEffectRef: ReadonlyMap<string, string>;\n}): { recipients: SubjectErasureRecipientOutcome[]; addedEffectOutcomes: SubjectErasureExternalEffectOutcome[] } {\n  const addedEffectOutcomes: SubjectErasureExternalEffectOutcome[] = [];\n  if (params.statement.status !== SubjectDataRecipientsStatementStatus.DECLARED) {\n    addedEffectOutcomes.push({\n      effectRef: SUBJECT_DATA_RECIPIENTS_NOT_DECLARED_EFFECT_REF,\n      status: SubjectErasureExternalEffectStatus.UNMEASURED,\n      detail: params.statement.status === SubjectDataRecipientsStatementStatus.NOT_DECLARED\n        ? 'The application declares no subject-data recipients (compliance.subjectDataRecipients is absent), so which vendors hold this subject\\'s data is unknown. Run `wildo config subject-data-recipients` and redeploy.'\n        : 'Which recipients hold this subject\\'s data could not be determined for this request; reconcile each vendor before treating the erasure as complete.',\n    });\n    return { recipients: [], addedEffectOutcomes };\n  }\n  const recipients = params.statement.recipients.map((recipient): SubjectErasureRecipientOutcome => {\n    const base = {\n      recipientRef: recipient.ref,\n      legalEntityName: recipient.legalEntityName,\n      reach: recipient.reach,\n      relevance: recipient.relevance,\n      obligation: recipient.obligation,\n    };\n    if (recipient.reach === SubjectDataRecipientReach.TENANT_ACCOUNT) return { ...base, status: null, effectRefs: [] };\n    const covering = params.effectOutcomes.filter((outcome) => params.recipientRefByEffectRef.get(outcome.effectRef) === recipient.ref);\n    if (covering.length > 0) {\n      return { ...base, status: combinedStatus(covering.map((outcome) => outcome.status)), effectRefs: covering.map((outcome) => outcome.effectRef) };\n    }\n    const effectRef = subjectErasureRecipientEffectRef(recipient.ref);\n    const registeredForOtherSubjects = [...params.recipientRefByEffectRef.entries()]\n      .filter(([, recipientRef]) => recipientRef === recipient.ref).map(([registeredRef]) => registeredRef);\n    const decided = registeredForOtherSubjects.length > 0\n      // An effect reaches this vendor, but not for this subject's type (the billing effect answers for users). That is\n      // no evidence either way about THIS subject's data there, so it is unmeasured — never \"not registered\", which\n      // would say nobody built the door.\n      ? {\n        effectRef,\n        status: SubjectErasureExternalEffectStatus.UNMEASURED,\n        detail: `${recipient.ref} is reached by the erasure effect(s) ${registeredForOtherSubjects.join(', ')}, which do not apply to this subject's type; whether ${recipient.ref} holds this subject's data is not measured.`,\n      }\n      : uncoveredRecipientOutcome(recipient, effectRef);\n    addedEffectOutcomes.push(decided);\n    return { ...base, status: decided.status, effectRefs: [effectRef] };\n  });\n  return { recipients, addedEffectOutcomes };\n}\n\nfunction uncoveredRecipientOutcome(recipient: SubjectDataRecipientStatementEntry, effectRef: string): SubjectErasureExternalEffectOutcome {\n  switch (recipient.erasureStance) {\n    case HttpApiErasureStance.NO_SUBJECT_DATA:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.DECLARED_NO_SUBJECT_DATA, detail: `${recipient.ref} declares it keeps no subject data beyond the call.` };\n    case HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE, detail: `The operator acknowledged that erasure does not reach ${recipient.ref}; its copy of the subject's data remains until the vendor deletes it.` };\n    case HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.NOT_REGISTERED, detail: `${recipient.ref} declares an erasure operation, but no erasure effect reaching it is registered in this application.` };\n    case null:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.UNMEASURED, detail: `${recipient.ref} declares no erasure stance and no effect reaches it, so whether it still holds the subject's data is unknown.` };\n    default: {\n      const unhandled: never = recipient.erasureStance;\n      throw new Error(`subject data recipients: unhandled erasure stance ${String(unhandled)}`);\n    }\n  }\n}\n/** @wildo_source:part:end saas.models.privacy.subject-data-recipients */\n"]}
+{"version":3,"file":"subject-data-recipients.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-data-recipients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,+GAA+G;AAC/G,6GAA6G;AAC7G,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EACL,kCAAkC,GAEnC,MAAM,kCAAkC,CAAC;AAE1C,qHAAqH;AACrH,MAAM,CAAN,IAAY,qCASX;AATD,WAAY,qCAAqC;IAC/C,+GAA+G;IAC/G,4EAAmC,CAAA;IACnC,qGAAqG;IACrG,8EAAqC,CAAA;IACrC,kHAAkH;IAClH,0EAAiC,CAAA;IACjC,mGAAmG;IACnG,wGAA+D,CAAA;AACjE,CAAC,EATW,qCAAqC,KAArC,qCAAqC,QAShD;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,sFAAsF;IACtF,kEAAqC,CAAA;IACrC,wGAAwG;IACxG,8DAAiC,CAAA;AACnC,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QACb,eAAe,EAAE,oBAAoB,CAAC,eAAe;QACrD,0BAA0B,EAAE,oBAAoB,CAAC,0BAA0B;KAC5E,CAAC;CACH,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,kHAAkH;IAClH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH,mEAAmE;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,6FAA6F;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B;;;OAGG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IACxC,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjD,6GAA6G;IAC7G,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC9E,qGAAqG;IACrG,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,wHAAwH;AACxH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACxD,CAAC,CAAC;AAGH,yEAAyE;AACzE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;IAC/C,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;CAC1D,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAN,IAAY,oCAWX;AAXD,WAAY,oCAAoC;IAC9C,yFAAyF;IACzF,6DAAqB,CAAA;IACrB,+FAA+F;IAC/F,qEAA6B,CAAA;IAC7B;;;;OAIG;IACH,qEAA6B,CAAA;AAC/B,CAAC,EAXW,oCAAoC,KAApC,oCAAoC,QAW/C;AAED,oDAAoD;AACpD,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,wGAAwG;IACxG,8EAA6C,CAAA;IAC7C,sGAAsG;IACtG,wEAAuC,CAAA;AACzC,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,6GAA6G;IAC7G,iFAA+C,CAAA;IAC/C,kHAAkH;IAClH,6FAA2D,CAAA;IAC3D,iGAAiG;IACjG,qEAAmC,CAAA;IACnC,2GAA2G;IAC3G,qEAAmC,CAAA;AACrC,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAgBD,kGAAkG;AAClG,MAAM,UAAU,2BAA2B,CACzC,WAAyD,EACzD,YAAoB;IAEpB,OAAO,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AAC1H,CAAC;AAED,SAAS,YAAY,CAAC,KAAgC,EAAE,IAAmC;IACzF,IAAI,KAAK,KAAK,yBAAyB,CAAC,cAAc;QAAE,OAAO,8BAA8B,CAAC,eAAe,CAAC;IAC9G,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB,CAAC,UAAU,CAAC;QACvC,KAAK,sBAAsB,CAAC,gBAAgB;YAC1C,OAAO,8BAA8B,CAAC,qBAAqB,CAAC;QAC9D,KAAK,sBAAsB,CAAC,SAAS;YACnC,OAAO,8BAA8B,CAAC,2BAA2B,CAAC;QACpE,KAAK,IAAI;YACP,OAAO,8BAA8B,CAAC,eAAe,CAAC;QACxD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,IAAI,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,YAAY,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAmB3C;IACC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,yCAAyC,EAAE,CAAC;IACzF,MAAM,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAyC,EAAE,CAAC;IAC5D,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,eAAe,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClG,MAAM,OAAO,GAAG,eAAe,IAAI,MAAM,CAAC,sBAAsB,CAAC;QACjE,MAAM,SAAS,GAAG,eAAe;eAC5B,SAAS,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC;eAC3C,SAAS,CAAC,mBAAmB;eAC7B,CAAC,MAAM,CAAC,0BAA0B,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,SAAS;QACrC,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,SAAS;YACZ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,oBAAoB,CAAC,CAAC,CAAC,6BAA6B,CAAC,iBAAiB;YACzH,UAAU,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,oCAAoC,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACnG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yCAAyC;IACvD,OAAO,EAAE,MAAM,EAAE,oCAAoC,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC3G,CAAC;AAED,oIAAoI;AACpI,MAAM,UAAU,0CAA0C;IACxD,OAAO,EAAE,MAAM,EAAE,oCAAoC,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC3G,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,gCAAgC,CAAC,YAAoB;IACnE,OAAO,aAAa,YAAY,EAAE,CAAC;AACrC,CAAC;AAED,+HAA+H;AAC/H,MAAM,CAAC,MAAM,+CAA+C,GAAG,yBAAyB,CAAC;AAkBzF;;;GAGG;AACH,MAAM,eAAe,GAAkD;IACrE,kCAAkC,CAAC,OAAO;IAC1C,kCAAkC,CAAC,MAAM;IACzC,kCAAkC,CAAC,UAAU;IAC7C,kCAAkC,CAAC,cAAc;IACjD,kCAAkC,CAAC,wBAAwB;IAC3D,kCAAkC,CAAC,SAAS;IAC5C,kCAAkC,CAAC,gBAAgB;IACnD,kCAAkC,CAAC,wBAAwB;CAC5D,CAAC;AAEF,SAAS,cAAc,CAAC,QAAuD;IAC7E,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,kCAAkC,CAAC,UAAU,CAAC;AACtH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAKjD;IACC,MAAM,mBAAmB,GAA0C,EAAE,CAAC;IACtE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,oCAAoC,CAAC,QAAQ,EAAE,CAAC;QAC9E,mBAAmB,CAAC,IAAI,CAAC;YACvB,SAAS,EAAE,+CAA+C;YAC1D,MAAM,EAAE,kCAAkC,CAAC,UAAU;YACrD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,oCAAoC,CAAC,YAAY;gBACnF,CAAC,CAAC,mNAAmN;gBACrN,CAAC,CAAC,qJAAqJ;SAC1J,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAkC,EAAE;QAC/F,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,SAAS,CAAC,GAAG;YAC3B,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC,CAAC;QACF,IAAI,SAAS,CAAC,KAAK,KAAK,yBAAyB,CAAC,cAAc;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACnH,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC;QACpI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAClJ,CAAC;QACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC;aAC7E,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC;QACxG,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,GAAG,CAAC;YACnD,iHAAiH;YACjH,8GAA8G;YAC9G,mCAAmC;YACnC,CAAC,CAAC;gBACA,SAAS;gBACT,MAAM,EAAE,kCAAkC,CAAC,UAAU;gBACrD,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,wCAAwC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD,SAAS,CAAC,GAAG,6CAA6C;aACxN;YACD,CAAC,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,yBAAyB,CAAC,SAA6C,EAAE,SAAiB;IACjG,QAAQ,SAAS,CAAC,aAAa,EAAE,CAAC;QAChC,KAAK,oBAAoB,CAAC,eAAe;YACvC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,qDAAqD,EAAE,CAAC;QAC3K,KAAK,oBAAoB,CAAC,mCAAmC;YAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,MAAM,EAAE,yDAAyD,SAAS,CAAC,GAAG,uEAAuE,EAAE,CAAC;QACnP,KAAK,oBAAoB,CAAC,0BAA0B;YAClD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,sGAAsG,EAAE,CAAC;QAClN,KAAK,IAAI;YACP,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,gHAAgH,EAAE,CAAC;QACxN,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,SAAS,CAAC,aAAa,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;AACH,CAAC;AACD,yEAAyE","sourcesContent":["/**\n * **Who else holds a data subject's personal data, and what erasure owes each of them** — the RUNTIME half of #1710.\n *\n * ## Why the running application needs the recipient list\n *\n * A subject export answers GDPR Art. 15, which gives the data subject a right to \"the recipients or categories of\n * recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or\n * international organisations\" (Art. 15(1)(c)). An erasure answers Art. 17, and Art. 19 then requires the controller to\n * \"communicate any rectification or erasure of personal data … to each recipient to whom the personal data have been\n * disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data\n * subject about those recipients if the data subject requests it.\" Both are answered by the running backend, which\n * until now knew only its own stores: a subject export listed no recipient, and an erasure reported nothing about a\n * vendor that no registered effect happened to reach.\n * spec-cite: GDPR Art. 15(1)(c), https://gdpr-info.eu/art-15-gdpr/ (fetched 2026-09-29)\n * spec-cite: GDPR Art. 19, https://gdpr-info.eu/art-19-gdpr/ (fetched 2026-09-29)\n *\n * ## Derived ONCE, at design time, and projected — never re-derived here\n *\n * Who the recipients are is decided by the application's committed declarations: the recipient population (which\n * vendors a data path reaches, and with whose account), the processor register (the LEGAL identity the operator\n * adopted), the #1709 disclosures (which categories each flow carries) and the providers' compliance profiles. None\n * of those inputs exists in a running backend — the register and the typed-client scan live in the application's\n * specifications and source — so `wildo config subject-data-recipients` runs that one derivation and writes the result\n * into `backend-api/src/subject-data-recipients.generated.ts`, which the application composes into\n * `compliance.subjectDataRecipients`. The `dataRetention` precedent: one value, derived where its inputs are, read\n * where it is enforced.\n *\n * Two alternatives were rejected:\n *\n * - **Re-deriving at runtime from the loaded provider modules.** Their `vendorLegalEntityName` is a sourced SUGGESTION\n *   the operator adopts by committing a register entry (Paul, 2026-09-25) — telling a data subject the suggestion\n *   would state a fact nobody adopted. And the runtime cannot see a typed client, so it would silently drop a vendor.\n * - **Moving the derivation into this package.** Its inputs are still unavailable at runtime; only the code would move.\n *\n * ## Per subject, by CATEGORY — and never omitted when unknown\n *\n * The declaration is application-wide and names PROVIDERS only — a system of record is maintained on its own lane (its\n * erasure is the HTTP_API effects' under the binding's D6 stance). For one request, {@link selectSubjectDataRecipients}\n * says a recipient CARRIES the subject's data when the subject is an account holder and the recipient's capability\n * categories meet the categories the involved resources declare (`.dataCategories()`) — the engine composes capability\n * calls from account holders' data. Everything less\n * certain is kept as {@link SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED}: a category match for any other subject, a\n * recipient whose categories are NOT all derivable or only a FLOOR (free text can carry any category), and every\n * recipient when the SUBJECT side is not fully known (an unreadable resource, a personal field with no category). An\n * unknown is a reason to name the vendor, never to leave it out; only a recipient whose fully derived categories\n * demonstrably miss fully known subject data is left out. The role split reads the SUBJECT's resource type only: data a\n * processor-scope resource sends a vendor under a controller-scope subject is still reported under the subject's role.\n *\n * ## Absent is NOT DECLARED, and is marked\n *\n * An application that never generated the projection has not said who received anything. The export states NOT\n * DECLARED, and the erasure carries one UNMEASURED outcome naming the missing projection — incomplete, never a silent\n * pass, and never a refusal (`.claude/rules/application-creation-directive.md`).\n *\n * @wildo_source:part:start saas.models.privacy.subject-data-recipients facet:layer:shared facet:audience:app-developer\n */\nimport { z } from 'zod';\n// The D6 erasure vocabulary, REUSED rather than restated (#1710). Published from the package root, because the\n// contracts below carry it into the root-exported application configuration and provider compliance profile.\nimport { HttpApiErasureStance } from '../../http-api-binding/http-api-erasure-stance.shared';\nimport { OperatorProcessingRole } from './operator-compliance-identity.shared.schemas';\nimport { PersonalDataCategory } from './personal-data-category.shared.schemas';\nimport {\n  SubjectErasureExternalEffectStatus,\n  type SubjectErasureExternalEffectOutcome,\n} from './subject-erasure.shared.schemas';\n\n/** Why a recipient's categories are not all derivable (#1709) — the reason travels with the recipient to runtime. */\nexport enum RecipientCategoriesNotDerivableReason {\n  /** Reached by a typed client, a browser operation or unscanned code: no declared field-to-input map exists. */\n  FLOW_UNDECLARED = 'flow-undeclared',\n  /** A system-of-record instance that no resource binds or pipes: nothing declares what reaches it. */\n  NO_RESOURCE_FLOW = 'no-resource-flow',\n  /** The resource flows could not be read (the introspection failed), so nothing is known — which is not \"none\". */\n  FLOWS_NOT_READ = 'flows-not-read',\n  /** Some flowing field is personal by the application's own declaration and carries no category. */\n  UNCATEGORIZED_PERSONAL_FIELDS = 'uncategorized-personal-fields',\n}\n\n/**\n * WHOSE account reached the recipient — which decides who owes the Art. 19 communication.\n *\n * Not the population class: that also answers \"operator-run\" and \"declared without a data path\", neither of which is a\n * recipient. This is the question an erasure asks of a recipient that exists.\n */\nexport enum SubjectDataRecipientReach {\n  /** Reached with an application-owned credential: the operator engaged this vendor. */\n  OPERATOR_ACCOUNT = 'operator-account',\n  /** Reached ONLY through a tenant's or a person's connected account: the tenant's own vendor (#1707). */\n  TENANT_ACCOUNT = 'tenant-account',\n}\n\n/**\n * The stance a VENDOR declares about subject data it keeps (#1710) — on the provider's compliance profile. The D6\n * vocabulary, narrowed to the two stances a vendor fact can take: the third, an acknowledged non-erasure, is the\n * CONTROLLER's act and is declared by the operator ({@link ProviderSubjectErasureAcknowledgementSchema}).\n */\nexport const ProviderSubjectErasureDeclarationSchema = z.strictObject({\n  /**\n   * - `NO_SUBJECT_DATA`: the vendor keeps nothing about a subject beyond the call itself — erasure reports\n   *   DECLARED_NO_SUBJECT_DATA, which is complete.\n   * - `EXTERNAL_ERASURE_OPERATION`: an erasure effect in the external-effects registry reaches this vendor (the billing\n   *   effect for a billing provider). If none is registered for it at runtime, erasure reports NOT_REGISTERED.\n   */\n  stance: z.enum({\n    NO_SUBJECT_DATA: HttpApiErasureStance.NO_SUBJECT_DATA,\n    EXTERNAL_ERASURE_OPERATION: HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION,\n  }),\n});\nexport type ProviderSubjectErasureDeclaration = z.infer<typeof ProviderSubjectErasureDeclarationSchema>;\n\n/**\n * The OPERATOR's acknowledgement that erasure does not reach this vendor (#1710): the D6 stance\n * CONTROLLER_ACKNOWLEDGED_NON_ERASURE for a provider, on `providerComplianceChoices.<ref>`. Erasure then reports\n * ACKNOWLEDGED_NON_ERASURE — still incomplete, because the data is still live at the vendor, however deliberate the\n * decision was.\n */\nexport const ProviderSubjectErasureAcknowledgementSchema = z.strictObject({\n  /** Why the operator accepts that erasure does not reach the vendor — \"Resend deletes its logs within 90 days\". */\n  reason: z.string().trim().min(1),\n});\nexport type ProviderSubjectErasureAcknowledgement = z.infer<typeof ProviderSubjectErasureAcknowledgementSchema>;\n\n/** One recipient, as the running application needs to state it. */\nexport const SubjectDataRecipientSchema = z.strictObject({\n  /** The provider ref. A system of record is never a recipient here (see the module JSDoc). */\n  ref: z.string().trim().min(1),\n  /**\n   * The legal entity the operator's processor register adopted for it, or `null` when the register has no entry — a\n   * gap stated as such, never filled with a suggestion.\n   */\n  legalEntityName: z.string().trim().min(1).nullable(),\n  /** Where the register says it processes. Empty when there is no register entry. */\n  processingRegions: z.array(z.string().trim().min(1)),\n  reach: z.enum(SubjectDataRecipientReach),\n  /** The categories its declared flows carry to it (#1709), in enum order. */\n  categories: z.array(z.enum(PersonalDataCategory)),\n  /** Every reason those categories are not all known. Empty when the declared flows account for everything. */\n  categoriesNotDerivable: z.array(z.enum(RecipientCategoriesNotDerivableReason)),\n  /** True when the categories include free text a person wrote, which can carry any other category. */\n  categoriesAreAFloor: z.boolean(),\n  /** The declared flows the categories come from — `capability:EMAIL_TRANSACTIONAL`, … */\n  derivedFrom: z.array(z.string().trim().min(1)),\n  /**\n   * The erasure stance: the vendor's declaration, or the operator's acknowledged non-erasure. `null` when neither\n   * exists — erasure then reports UNMEASURED for this recipient.\n   */\n  erasureStance: z.enum(HttpApiErasureStance).nullable(),\n});\nexport type SubjectDataRecipient = z.infer<typeof SubjectDataRecipientSchema>;\n\n/** Which resource types one operator role covers, from `operatorComplianceIdentity.roleAllocations[].resourceTypes`. */\nexport const SubjectDataRoleAllocationSchema = z.strictObject({\n  role: z.enum(OperatorProcessingRole),\n  resourceTypes: z.array(z.string().trim().min(1)).min(1),\n});\nexport type SubjectDataRoleAllocation = z.infer<typeof SubjectDataRoleAllocationSchema>;\n\n/** The derived projection `compliance.subjectDataRecipients` carries. */\nexport const SubjectDataRecipientsDeclarationSchema = z.strictObject({\n  recipients: z.array(SubjectDataRecipientSchema),\n  /** The role allocations that name their resource types. An allocation in prose only is not carried. */\n  roleAllocations: z.array(SubjectDataRoleAllocationSchema),\n});\nexport type SubjectDataRecipientsDeclaration = z.infer<typeof SubjectDataRecipientsDeclarationSchema>;\n\n/** Whether the running application has a recipient declaration at all. */\nexport enum SubjectDataRecipientsStatementStatus {\n  /** The projection is composed; the list below is the derived answer (possibly empty). */\n  DECLARED = 'declared',\n  /** No projection: the application has not stated who received personal data. A gap, marked. */\n  NOT_DECLARED = 'not-declared',\n  /**\n   * A declaration may exist, but applying it to this request FAILED (the erasure's post-commit accounting threw), so\n   * which recipients hold this subject's data is unknown. Distinct from NOT_DECLARED, whose remedy is to generate the\n   * projection; this one's is to reconcile the vendors by hand and look at the logged error.\n   */\n  UNDETERMINED = 'undetermined',\n}\n\n/** Why one recipient is listed for this subject. */\nexport enum SubjectDataRecipientRelevance {\n  /** Its derived categories meet this subject's data, or its flow names one of the involved resources. */\n  CARRIES_SUBJECT_DATA = 'carries-subject-data',\n  /** Its categories are not all derivable, or are a floor: it may have received this subject's data. */\n  MAY_HAVE_RECEIVED = 'may-have-received',\n}\n\n/**\n * Who owes what to this recipient when the subject's data is erased — the role split (#1710).\n *\n * A processor \"assists the controller … for the fulfilment of the controller's obligation to respond to requests for\n * exercising the data subject's rights\" (Art. 28(3)(e)); the Art. 19 communication is the controller's.\n * spec-cite: GDPR Art. 28(3)(e), https://gdpr-info.eu/art-28-gdpr/ (fetched 2026-09-29)\n */\nexport enum SubjectDataRecipientObligation {\n  /** The operator is CONTROLLER (or joint controller) for this data: it communicates the erasure (Art. 19). */\n  OPERATOR_COMMUNICATES = 'operator-communicates',\n  /** The operator is PROCESSOR for this data: the outcome is assistance evidence for the tenant, the controller. */\n  OPERATOR_ASSISTS_CONTROLLER = 'operator-assists-controller',\n  /** Reached with the tenant's own account: the tenant's recipient, and the tenant's to notify. */\n  TENANT_NOTIFIES = 'tenant-notifies',\n  /** No role allocation names the subject's resource type, so who owes the communication is not declared. */\n  ROLE_UNDECLARED = 'role-undeclared',\n}\n\n/** One recipient listed for one request. */\nexport interface SubjectDataRecipientStatementEntry extends SubjectDataRecipient {\n  relevance: SubjectDataRecipientRelevance;\n  obligation: SubjectDataRecipientObligation;\n}\n\n/** The recipient part of a subject export or erasure report. Contains no personal data. */\nexport interface SubjectDataRecipientsStatement {\n  status: SubjectDataRecipientsStatementStatus;\n  /** The operator's role for the subject's resource type, or `null` when no allocation names it. */\n  operatorRole: OperatorProcessingRole | null;\n  recipients: SubjectDataRecipientStatementEntry[];\n}\n\n/** The operator role an allocation declares for a resource type, or `null` when none names it. */\nexport function operatorRoleForResourceType(\n  declaration: SubjectDataRecipientsDeclaration | undefined,\n  resourceType: string,\n): OperatorProcessingRole | null {\n  return declaration?.roleAllocations.find((allocation) => allocation.resourceTypes.includes(resourceType))?.role ?? null;\n}\n\nfunction obligationOf(reach: SubjectDataRecipientReach, role: OperatorProcessingRole | null): SubjectDataRecipientObligation {\n  if (reach === SubjectDataRecipientReach.TENANT_ACCOUNT) return SubjectDataRecipientObligation.TENANT_NOTIFIES;\n  switch (role) {\n    case OperatorProcessingRole.CONTROLLER:\n    case OperatorProcessingRole.JOINT_CONTROLLER:\n      return SubjectDataRecipientObligation.OPERATOR_COMMUNICATES;\n    case OperatorProcessingRole.PROCESSOR:\n      return SubjectDataRecipientObligation.OPERATOR_ASSISTS_CONTROLLER;\n    case null:\n      return SubjectDataRecipientObligation.ROLE_UNDECLARED;\n    default: {\n      const unhandled: never = role;\n      throw new Error(`subject data recipients: unhandled operator role ${String(unhandled)}`);\n    }\n  }\n}\n\n/**\n * The `derivedFrom` token kind of a flow the ENGINE composes through a capability: `capability:<token>` (#1709), written\n * by `deriveRecipientDisclosures`. The only flow kind this list carries, because systems of record are kept out of it.\n */\nexport const RECIPIENT_CAPABILITY_FLOW_TOKEN_KIND = 'capability';\n\n/**\n * The recipients one subject export or erasure must name — see the module JSDoc for the rule. Pure, so the backend,\n * a test and a reviewer apply the same one.\n */\nexport function selectSubjectDataRecipients(params: {\n  declaration: SubjectDataRecipientsDeclaration | undefined;\n  subjectResourceType: string;\n  /** The union of the `.dataCategories()` those resources declare. */\n  involvedCategories: readonly PersonalDataCategory[];\n  /**\n   * `false` when the involved categories are NOT the whole answer: a resource's configuration could not be read, or it\n   * declares personal fields with no category. An unknown on the SUBJECT side must widen the list exactly as an unknown\n   * on the recipient side does — every recipient not matched is then kept as MAY_HAVE_RECEIVED, never dropped.\n   */\n  involvedCategoriesComplete: boolean;\n  /**\n   * Whether the subject is an ACCOUNT HOLDER (a user). A capability recipient's categories are what the ENGINE sends\n   * when it composes the call — the recipient address of an account's mail, the billing customer, the signed-in actor —\n   * which are account holders' data. So a category match through a capability alone says the vendor carries an account\n   * holder's data; for any other subject (a CRM contact) it says only that it MAY have received it, because nothing\n   * declares that the application routes that subject's data to the capability.\n   */\n  subjectIsAccountHolder: boolean;\n}): SubjectDataRecipientsStatement {\n  if (params.declaration === undefined) return notDeclaredSubjectDataRecipientsStatement();\n  const role = operatorRoleForResourceType(params.declaration, params.subjectResourceType);\n  const involvedCategories = new Set(params.involvedCategories);\n  const recipients: SubjectDataRecipientStatementEntry[] = [];\n  for (const recipient of params.declaration.recipients) {\n    const sharesACategory = recipient.categories.some((category) => involvedCategories.has(category));\n    const carries = sharesACategory && params.subjectIsAccountHolder;\n    const uncertain = sharesACategory\n      || recipient.categoriesNotDerivable.length > 0\n      || recipient.categoriesAreAFloor\n      || !params.involvedCategoriesComplete;\n    if (!carries && !uncertain) continue;\n    recipients.push({\n      ...recipient,\n      relevance: carries ? SubjectDataRecipientRelevance.CARRIES_SUBJECT_DATA : SubjectDataRecipientRelevance.MAY_HAVE_RECEIVED,\n      obligation: obligationOf(recipient.reach, role),\n    });\n  }\n  return { status: SubjectDataRecipientsStatementStatus.DECLARED, operatorRole: role, recipients };\n}\n\n/**\n * The statement of an application with no recipient declaration. Also the placeholder an orchestrator writes into a\n * report its caller completes (the erasure and export doors fill the real statement, as they fill `externalEffects`).\n */\nexport function notDeclaredSubjectDataRecipientsStatement(): SubjectDataRecipientsStatement {\n  return { status: SubjectDataRecipientsStatementStatus.NOT_DECLARED, operatorRole: null, recipients: [] };\n}\n\n/** The statement of a request whose recipient accounting failed — see {@link SubjectDataRecipientsStatementStatus.UNDETERMINED}. */\nexport function undeterminedSubjectDataRecipientsStatement(): SubjectDataRecipientsStatement {\n  return { status: SubjectDataRecipientsStatementStatus.UNDETERMINED, operatorRole: null, recipients: [] };\n}\n\n/** The effect ref the recipient reconciliation writes for a recipient no registered effect reached. */\nexport function subjectErasureRecipientEffectRef(recipientRef: string): string {\n  return `recipient:${recipientRef}`;\n}\n\n/** The effect ref of the single outcome an erasure carries when its recipients are not declared or could not be determined. */\nexport const SUBJECT_DATA_RECIPIENTS_NOT_DECLARED_EFFECT_REF = 'subject-data-recipients';\n\n/** What an erasure did about one recipient. */\nexport interface SubjectErasureRecipientOutcome {\n  recipientRef: string;\n  legalEntityName: string | null;\n  reach: SubjectDataRecipientReach;\n  relevance: SubjectDataRecipientRelevance;\n  obligation: SubjectDataRecipientObligation;\n  /**\n   * The outcome at this recipient: the covering effects' combined status, or the status the declared stance decides.\n   * `null` for a tenant-account recipient — not the operator's erasure to run, and named for the tenant to notify.\n   */\n  status: SubjectErasureExternalEffectStatus | null;\n  /** The effect refs that reached it — a registered effect, or the reconciliation's `recipient:<ref>`. */\n  effectRefs: string[];\n}\n\n/**\n * Most-incomplete-wins when several effects reach one recipient: a PARTIAL next to a COMPLETED is still partial.\n * Ordered from the state a reader must act on first to the states that close the question.\n */\nconst STATUS_SEVERITY: readonly SubjectErasureExternalEffectStatus[] = [\n  SubjectErasureExternalEffectStatus.PARTIAL,\n  SubjectErasureExternalEffectStatus.FAILED,\n  SubjectErasureExternalEffectStatus.UNMEASURED,\n  SubjectErasureExternalEffectStatus.NOT_REGISTERED,\n  SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE,\n  SubjectErasureExternalEffectStatus.COMPLETED,\n  SubjectErasureExternalEffectStatus.NOTHING_TO_ERASE,\n  SubjectErasureExternalEffectStatus.DECLARED_NO_SUBJECT_DATA,\n];\n\nfunction combinedStatus(statuses: readonly SubjectErasureExternalEffectStatus[]): SubjectErasureExternalEffectStatus {\n  return STATUS_SEVERITY.find((status) => statuses.includes(status)) ?? SubjectErasureExternalEffectStatus.UNMEASURED;\n}\n\n/**\n * Reconcile the recipients an erasure must reach with the effects that ran (#1710).\n *\n * Every operator-account recipient gets a status, so none can pass silently:\n * - a registered effect that names it as its `recipientRef` → that effect's status;\n * - otherwise its stance decides: NO_SUBJECT_DATA → DECLARED_NO_SUBJECT_DATA (complete); an acknowledged\n *   non-erasure → ACKNOWLEDGED_NON_ERASURE; EXTERNAL_ERASURE_OPERATION with no effect registered → NOT_REGISTERED;\n *   no stance → UNMEASURED. Each becomes an `externalEffects` outcome under `recipient:<ref>`, so every existing\n *   reader of the report (`isIncompleteSubjectErasureExternalEffect`, the Wonder Todos request lane) sees it without\n *   learning a new field.\n * - NOT DECLARED adds one UNMEASURED outcome naming the missing projection.\n *\n * It marks and never refuses: the local erasure has already committed when this runs.\n */\nexport function reconcileSubjectErasureRecipients(params: {\n  statement: SubjectDataRecipientsStatement;\n  effectOutcomes: readonly SubjectErasureExternalEffectOutcome[];\n  /** Which recipient each REGISTERED effect reaches — applicable to this subject or not: effect ref → recipient ref. */\n  recipientRefByEffectRef: ReadonlyMap<string, string>;\n}): { recipients: SubjectErasureRecipientOutcome[]; addedEffectOutcomes: SubjectErasureExternalEffectOutcome[] } {\n  const addedEffectOutcomes: SubjectErasureExternalEffectOutcome[] = [];\n  if (params.statement.status !== SubjectDataRecipientsStatementStatus.DECLARED) {\n    addedEffectOutcomes.push({\n      effectRef: SUBJECT_DATA_RECIPIENTS_NOT_DECLARED_EFFECT_REF,\n      status: SubjectErasureExternalEffectStatus.UNMEASURED,\n      detail: params.statement.status === SubjectDataRecipientsStatementStatus.NOT_DECLARED\n        ? 'The application declares no subject-data recipients (compliance.subjectDataRecipients is absent), so which vendors hold this subject\\'s data is unknown. Run `wildo config subject-data-recipients` and redeploy.'\n        : 'Which recipients hold this subject\\'s data could not be determined for this request; reconcile each vendor before treating the erasure as complete.',\n    });\n    return { recipients: [], addedEffectOutcomes };\n  }\n  const recipients = params.statement.recipients.map((recipient): SubjectErasureRecipientOutcome => {\n    const base = {\n      recipientRef: recipient.ref,\n      legalEntityName: recipient.legalEntityName,\n      reach: recipient.reach,\n      relevance: recipient.relevance,\n      obligation: recipient.obligation,\n    };\n    if (recipient.reach === SubjectDataRecipientReach.TENANT_ACCOUNT) return { ...base, status: null, effectRefs: [] };\n    const covering = params.effectOutcomes.filter((outcome) => params.recipientRefByEffectRef.get(outcome.effectRef) === recipient.ref);\n    if (covering.length > 0) {\n      return { ...base, status: combinedStatus(covering.map((outcome) => outcome.status)), effectRefs: covering.map((outcome) => outcome.effectRef) };\n    }\n    const effectRef = subjectErasureRecipientEffectRef(recipient.ref);\n    const registeredForOtherSubjects = [...params.recipientRefByEffectRef.entries()]\n      .filter(([, recipientRef]) => recipientRef === recipient.ref).map(([registeredRef]) => registeredRef);\n    const decided = registeredForOtherSubjects.length > 0\n      // An effect reaches this vendor, but not for this subject's type (the billing effect answers for users). That is\n      // no evidence either way about THIS subject's data there, so it is unmeasured — never \"not registered\", which\n      // would say nobody built the door.\n      ? {\n        effectRef,\n        status: SubjectErasureExternalEffectStatus.UNMEASURED,\n        detail: `${recipient.ref} is reached by the erasure effect(s) ${registeredForOtherSubjects.join(', ')}, which do not apply to this subject's type; whether ${recipient.ref} holds this subject's data is not measured.`,\n      }\n      : uncoveredRecipientOutcome(recipient, effectRef);\n    addedEffectOutcomes.push(decided);\n    return { ...base, status: decided.status, effectRefs: [effectRef] };\n  });\n  return { recipients, addedEffectOutcomes };\n}\n\nfunction uncoveredRecipientOutcome(recipient: SubjectDataRecipientStatementEntry, effectRef: string): SubjectErasureExternalEffectOutcome {\n  switch (recipient.erasureStance) {\n    case HttpApiErasureStance.NO_SUBJECT_DATA:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.DECLARED_NO_SUBJECT_DATA, detail: `${recipient.ref} declares it keeps no subject data beyond the call.` };\n    case HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE, detail: `The operator acknowledged that erasure does not reach ${recipient.ref}; its copy of the subject's data remains until the vendor deletes it.` };\n    case HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.NOT_REGISTERED, detail: `${recipient.ref} declares an erasure operation, but no erasure effect reaching it is registered in this application.` };\n    case null:\n      return { effectRef, status: SubjectErasureExternalEffectStatus.UNMEASURED, detail: `${recipient.ref} declares no erasure stance and no effect reaches it, so whether it still holds the subject's data is unknown.` };\n    default: {\n      const unhandled: never = recipient.erasureStance;\n      throw new Error(`subject data recipients: unhandled erasure stance ${String(unhandled)}`);\n    }\n  }\n}\n/** @wildo_source:part:end saas.models.privacy.subject-data-recipients */\n"]}

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-erasure-lane-evidence.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;iBAuE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
+{"version":3,"file":"subject-erasure-lane-evidence.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;iBAuE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}

package/dist/esm/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-erasure-lane-evidence.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,sEAAsE;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD;;;;;;OAMG;IACH,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7D,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjE;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnD;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C;;;;;;;;;;OAUG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpD,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE;IACzC;;;;;;OAMG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * # The subject-erasure lane, summarized for an evidence reader\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_ERASURE — the request lane's intake, withdrawal and\n * execution are answerable without reading any subject's row.\n *\n * ## Why this shape, and not the rows\n *\n * `evidence-requirement:subject-erasure-execution-record` asks three things of an application that\n * owns an erasure lane: that a request is recorded on intake carrying WHO raised it, that a pending\n * request can be withdrawn by its subject, and that it is executed on the declared schedule with an\n * outcome. Every one of those is a statement about the lane, and none of them needs an identity.\n *\n * So the answer is a count, computed where the rows live. Handing an evidence reader the rows in\n * order to count them would disclose every data subject who has ever asked to be erased — to prove\n * that erasure works, which is the exact inversion this surface exists to avoid.\n *\n * ## Read the zeroes carefully, which is why `laneDeclared` is separate\n *\n * A lane with no activity and an application with no lane produce the same zeroes in a row store,\n * and the requirement's own limits say so. `laneDeclared: false` is therefore a distinct answer\n * carrying no counts at all — a judge records `not_applicable_as_configured` from it rather than a\n * nonconformity — while `laneDeclared: true` with zero requests says the lane exists and was quiet.\n */\nexport const SubjectErasureLaneEvidenceSchema = z.object({\n  /**\n   * Does any resource in this application declare a `subjectErasureLane`?\n   *\n   * FALSE is an answer, not an absence: an application that never built an erasure lane has failed\n   * no control, and every count below is omitted rather than reported as zero.\n   */\n  laneDeclared: z.boolean(),\n  /** The resource whose rows were counted, present only when a lane is declared. */\n  resourceType: z.string().nullable(),\n  /** The closed window the counts cover, as the caller asked for it. */\n  window: z.object({ from: z.iso.datetime(), to: z.iso.datetime() }),\n  /**\n   * Requests created in the window, split by WHO raised them.\n   *\n   * The split is read through the lane's own declaration — the field it named and the value it\n   * declared as meaning \"the subject themselves\" — so an application that models the distinction as\n   * a channel enum, a boolean or anything else is counted correctly without this schema asserting\n   * its vocabulary.\n   */\n  raisedBySubject: z.number().int().nonnegative(),\n  raisedByController: z.number().int().nonnegative(),\n  /**\n   * Controller-raised requests that DO carry the requester and the justification the clause asks for.\n   *\n   * Counted, never derived by subtracting from {@link raisedByController}. A difference would assume\n   * containment, and the clause's severity guidance turns exactly that mismatch into an OBSERVATION a\n   * judge is meant to see — so both halves are reported and the comparison is left to the reader.\n   */\n  controllerRaisedWithRequester: z.number().int().nonnegative(),\n  controllerRaisedWithJustification: z.number().int().nonnegative(),\n  /**\n   * Requests carrying the lane's terminal instant, and how many of those also carry an outcome.\n   *\n   * Two measured numbers for the same reason as above: a terminal request whose record of what\n   * happened is empty is the clause's other OBSERVATION case, and it is visible here only because\n   * neither number is derived from the other.\n   */\n  terminal: z.number().int().nonnegative(),\n  terminalWithOutcome: z.number().int().nonnegative(),\n  /**\n   * Requests in the window carrying no terminal instant — still pending, or withdrawn.\n   *\n   * A difference against the counted population rather than a status read, because the statuses are\n   * the application's and this contract must not assert them. {@link withdrawn} is what separates the\n   * two, when the lane declares how.\n   */\n  notTerminal: z.number().int().nonnegative(),\n  /**\n   * Withdrawn requests, and whether the withdrawal door is reachable to a subject at all.\n   *\n   * An EMPTY withdrawal set is explicitly not a deficiency — nobody may have changed their mind — so\n   * the evidence that matters is `withdrawalReachableToSubject`, derived from the declared\n   * withdrawal operation's own variant rather than from whether anyone used it.\n   *\n   * `withdrawn` is NULL, never zero, when the lane declares no `withdrawnMarker`: an application may\n   * not model withdrawal as a value at all, and a zero there would read as \"nobody withdrew anything\"\n   * when the truth is that nobody can tell.\n   */\n  withdrawn: z.number().int().nonnegative().nullable(),\n  withdrawalOperationIdentifier: z.string().nullable(),\n  withdrawalReachableToSubject: z.boolean(),\n  /**\n   * The schedule that drives execution, read from the declared execution operation.\n   *\n   * The clause asks for execution \"on the declared schedule\", and an outcome alone cannot be judged\n   * against a schedule nobody stated. `null` means the declared operation carries no cadence, which\n   * is itself the finding.\n   */\n  executionOperationIdentifier: z.string().nullable(),\n  executionSchedule: z.string().nullable(),\n});\n\nexport type SubjectErasureLaneEvidence = z.infer<typeof SubjectErasureLaneEvidenceSchema>;\n"]}
+{"version":3,"file":"subject-erasure-lane-evidence.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure-lane-evidence.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,kFAAkF;IAClF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,sEAAsE;IACtE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD;;;;;;OAMG;IACH,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7D,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjE;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnD;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C;;;;;;;;;;OAUG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpD,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE;IACzC;;;;;;OAMG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * # The subject-erasure lane, summarized for an evidence reader\n *\n * assurance-control: WILDO.PRIVACY.SUBJECT_ERASURE — the request lane's intake, withdrawal and\n * execution are answerable without reading any subject's row.\n *\n * ## Why this shape, and not the rows\n *\n * `evidence-requirement:subject-erasure-execution-record` asks three things of an application that\n * owns an erasure lane: that a request is recorded on intake carrying WHO raised it, that a pending\n * request can be withdrawn by its subject, and that it is executed on the declared schedule with an\n * outcome. Every one of those is a statement about the lane, and none of them needs an identity.\n *\n * So the answer is a count, computed where the rows live. Handing an evidence reader the rows in\n * order to count them would disclose every data subject who has ever asked to be erased — to prove\n * that erasure works, which is the exact inversion this surface exists to avoid.\n *\n * ## Read the zeroes carefully, which is why `laneDeclared` is separate\n *\n * A lane with no activity and an application with no lane produce the same zeroes in a row store,\n * and the requirement's own limits say so. `laneDeclared: false` is therefore a distinct answer\n * carrying no counts at all — a judge records `not_applicable_as_configured` from it rather than a\n * nonconformity — while `laneDeclared: true` with zero requests says the lane exists and was quiet.\n */\nexport const SubjectErasureLaneEvidenceSchema = z.object({\n  /**\n   * Does any resource in this application declare a `subjectErasureLane`?\n   *\n   * FALSE is an answer, not an absence: an application that never built an erasure lane has failed\n   * no control, and every count below is omitted rather than reported as zero.\n   */\n  laneDeclared: z.boolean(),\n  /** The resource whose rows were counted, present only when a lane is declared. */\n  resourceType: z.string().nullable(),\n  /** The closed window the counts cover, as the caller asked for it. */\n  window: z.object({ from: z.iso.datetime(), to: z.iso.datetime() }),\n  /**\n   * Requests created in the window, split by WHO raised them.\n   *\n   * The split is read through the lane's own declaration — the field it named and the value it\n   * declared as meaning \"the subject themselves\" — so an application that models the distinction as\n   * a channel enum, a boolean or anything else is counted correctly without this schema asserting\n   * its vocabulary.\n   */\n  raisedBySubject: z.number().int().nonnegative(),\n  raisedByController: z.number().int().nonnegative(),\n  /**\n   * Controller-raised requests that DO carry the requester and the justification the clause asks for.\n   *\n   * Counted, never derived by subtracting from {@link raisedByController}. A difference would assume\n   * containment, and the clause's severity guidance turns exactly that mismatch into an OBSERVATION a\n   * judge is meant to see — so both halves are reported and the comparison is left to the reader.\n   */\n  controllerRaisedWithRequester: z.number().int().nonnegative(),\n  controllerRaisedWithJustification: z.number().int().nonnegative(),\n  /**\n   * Requests carrying the lane's terminal instant, and how many of those also carry an outcome.\n   *\n   * Two measured numbers for the same reason as above: a terminal request whose record of what\n   * happened is empty is the clause's other OBSERVATION case, and it is visible here only because\n   * neither number is derived from the other.\n   */\n  terminal: z.number().int().nonnegative(),\n  terminalWithOutcome: z.number().int().nonnegative(),\n  /**\n   * Requests in the window carrying no terminal instant — still pending, or withdrawn.\n   *\n   * A difference against the counted population rather than a status read, because the statuses are\n   * the application's and this contract must not assert them. {@link withdrawn} is what separates the\n   * two, when the lane declares how.\n   */\n  notTerminal: z.number().int().nonnegative(),\n  /**\n   * Withdrawn requests, and whether the withdrawal door is reachable to a subject at all.\n   *\n   * An EMPTY withdrawal set is explicitly not a deficiency — nobody may have changed their mind — so\n   * the evidence that matters is `withdrawalReachableToSubject`, derived from the declared\n   * withdrawal operation's own variant rather than from whether anyone used it.\n   *\n   * `withdrawn` is NULL, never zero, when the lane declares no `withdrawnMarker`: an application may\n   * not model withdrawal as a value at all, and a zero there would read as \"nobody withdrew anything\"\n   * when the truth is that nobody can tell.\n   */\n  withdrawn: z.number().int().nonnegative().nullable(),\n  withdrawalOperationIdentifier: z.string().nullable(),\n  withdrawalReachableToSubject: z.boolean(),\n  /**\n   * The schedule that drives execution, read from the declared execution operation.\n   *\n   * The clause asks for execution \"on the declared schedule\", and an outcome alone cannot be judged\n   * against a schedule nobody stated. `null` means the declared operation carries no cadence, which\n   * is itself the finding.\n   */\n  executionOperationIdentifier: z.string().nullable(),\n  executionSchedule: z.string().nullable(),\n});\n\nexport type SubjectErasureLaneEvidence = z.infer<typeof SubjectErasureLaneEvidenceSchema>;\n"]}

package/dist/esm/compliance/privacy/subject-erasure.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-erasure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACzG,OAAO,KAAK,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,KAAK,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE/H;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,MAAM,WAAW;IAEjB;;;;OAIG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,oCAAoC,yCAAyC;IAE7E;;;;;OAKG;IACH,SAAS,cAAc;IAEvB;;;;;OAKG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,0DAA0D;IAC1D,iBAAiB,EAAE,YAAY,CAAC;IAChC,2DAA2D;IAC3D,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,CAAC;CAC7E;AAuBD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAWD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,oBAAoB,EAClC,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,gCAAgC,CAqOlC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,2EAA2E;IAC3E,YAAY,EAAE,oBAAoB,CAAC;IACnC,yFAAyF;IACzF,kBAAkB,EAAE,YAAY,CAAC;IACjC,cAAc,EAAE,gCAAgC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iCAAiC,CAC/C,uBAAuB,EAAE,YAAY,EACrC,kCAAkC,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,oBAAoB,EAAE,GAAG,SAAS,EACtG,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,gCAAgC,EAAE,CAoBpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC,CAAC,KAAK;IACvD,wDAAwD;IACxD,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,cAAc,EAAE,KAAK,EAAE,CAAC;IACxB,mEAAmE;IACnE,aAAa,EAAE,KAAK,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EACxH,YAAY,EAAE,SAAS,KAAK,EAAE,GAC7B,KAAK,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAclD;AAED;;;GAGG;AACH,MAAM,WAAW,mCAAoC,SAAQ,gCAAgC;IAC3F,wCAAwC;IACxC,kBAAkB,EAAE,YAAY,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,gCAAgC;IACjF;;;;OAIG;IACH,eAAe,EAAE,mCAAmC,EAAE,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kCAAkC;IAC5C,sEAAsE;IACtE,SAAS,cAAc;IACvB;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,YAAY;IACnB,mGAAmG;IACnG,MAAM,WAAW;IACjB;;;OAGG;IACH,cAAc,mBAAmB;IAEjC;;;;OAIG;IACH,UAAU,eAAe;IAEzB;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;CACtD;AAED,gGAAgG;AAChG,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAQT;AAED,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kCAAkC,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,mBAAmB,EAAE,YAAY,CAAC;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE;QAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;IACF;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE,mCAAmC,EAAE,CAAC;IACvD;;;;;;;;;OASG;IACH,iCAAiC,EAAE,kCAAkC,EAAE,CAAC;IACxE;;;;;;;;;OASG;IACH,wBAAwB,EAAE,sCAAsC,EAAE,CAAC;IACnE;;;;;;OAMG;IACH,eAAe,EAAE,gCAAgC,EAAE,CAAC;IACpD;;;;;;;;;OASG;IACH,UAAU,EAAE;QACV,SAAS,EAAE,8BAA8B,CAAC;QAC1C,QAAQ,EAAE,8BAA8B,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,gGAAgG;AAChG,MAAM,WAAW,kCAAkC;IACjD,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,MAAM,EAAE,wBAAwB,CAAC;IACjC,6GAA6G;IAC7G,cAAc,EAAE,kBAAkB,CAAC;IACnC,sGAAsG;IACtG,mBAAmB,EAAE,mBAAmB,CAAC;IACzC;;;;;;OAMG;IACH,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;CAC5B;AAED,yFAAyF;AACzF,MAAM,WAAW,sCAAsC;IACrD,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,gBAAgB,EAAE,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACzC,OAAO,EAAE,wBAAwB,CAAC;IAClC,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnD,GAAG,EAAE,IAAI,CAAC;CACX,GAAG;IAAE,UAAU,EAAE,kCAAkC,EAAE,CAAC;IAAC,QAAQ,EAAE,sCAAsC,EAAE,CAAA;CAAE,CAsB3G;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,4CAA4C,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EAC7H,YAAY,EAAE,SAAS,KAAK,EAAE,EAC9B,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,KAAK,EAAE,CAIT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EACzH,YAAY,EAAE,SAAS,KAAK,EAAE,EAC9B,mBAAmB,EAAE,MAAM,GAC1B,KAAK,EAAE,CAIT"}
+{"version":3,"file":"subject-erasure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACzG,OAAO,KAAK,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,KAAK,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE/H;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,MAAM,WAAW;IAEjB;;;;OAIG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,oCAAoC,yCAAyC;IAE7E;;;;;OAKG;IACH,SAAS,cAAc;IAEvB;;;;;OAKG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,0DAA0D;IAC1D,iBAAiB,EAAE,YAAY,CAAC;IAChC,2DAA2D;IAC3D,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,CAAC;CAC7E;AAuBD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAWD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,oBAAoB,EAClC,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,gCAAgC,CAqOlC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,2EAA2E;IAC3E,YAAY,EAAE,oBAAoB,CAAC;IACnC,yFAAyF;IACzF,kBAAkB,EAAE,YAAY,CAAC;IACjC,cAAc,EAAE,gCAAgC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iCAAiC,CAC/C,uBAAuB,EAAE,YAAY,EACrC,kCAAkC,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,oBAAoB,EAAE,GAAG,SAAS,EACtG,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,gCAAgC,EAAE,CAoBpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC,CAAC,KAAK;IACvD,wDAAwD;IACxD,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,cAAc,EAAE,KAAK,EAAE,CAAC;IACxB,mEAAmE;IACnE,aAAa,EAAE,KAAK,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EACxH,YAAY,EAAE,SAAS,KAAK,EAAE,GAC7B,KAAK,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAclD;AAED;;;GAGG;AACH,MAAM,WAAW,mCAAoC,SAAQ,gCAAgC;IAC3F,wCAAwC;IACxC,kBAAkB,EAAE,YAAY,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,gCAAgC;IACjF;;;;OAIG;IACH,eAAe,EAAE,mCAAmC,EAAE,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kCAAkC;IAC5C,sEAAsE;IACtE,SAAS,cAAc;IACvB;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,YAAY;IACnB,mGAAmG;IACnG,MAAM,WAAW;IACjB;;;OAGG;IACH,cAAc,mBAAmB;IAEjC;;;;OAIG;IACH,UAAU,eAAe;IAEzB;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;CACtD;AAED,gGAAgG;AAChG,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAQT;AAED,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kCAAkC,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,mBAAmB,EAAE,YAAY,CAAC;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE;QAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;IACF;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE,mCAAmC,EAAE,CAAC;IACvD;;;;;;;;;OASG;IACH,iCAAiC,EAAE,kCAAkC,EAAE,CAAC;IACxE;;;;;;;;;OASG;IACH,wBAAwB,EAAE,sCAAsC,EAAE,CAAC;IACnE;;;;;;OAMG;IACH,eAAe,EAAE,gCAAgC,EAAE,CAAC;IACpD;;;;;;;;;OASG;IACH,UAAU,EAAE;QACV,SAAS,EAAE,8BAA8B,CAAC;QAC1C,QAAQ,EAAE,8BAA8B,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,gGAAgG;AAChG,MAAM,WAAW,kCAAkC;IACjD,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,MAAM,EAAE,wBAAwB,CAAC;IACjC,6GAA6G;IAC7G,cAAc,EAAE,kBAAkB,CAAC;IACnC,sGAAsG;IACtG,mBAAmB,EAAE,mBAAmB,CAAC;IACzC;;;;;;OAMG;IACH,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;CAC5B;AAED,yFAAyF;AACzF,MAAM,WAAW,sCAAsC;IACrD,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,gBAAgB,EAAE,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACzC,OAAO,EAAE,wBAAwB,CAAC;IAClC,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnD,GAAG,EAAE,IAAI,CAAC;CACX,GAAG;IAAE,UAAU,EAAE,kCAAkC,EAAE,CAAC;IAAC,QAAQ,EAAE,sCAAsC,EAAE,CAAA;CAAE,CAsB3G;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,4CAA4C,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EAC7H,YAAY,EAAE,SAAS,KAAK,EAAE,EAC9B,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,KAAK,EAAE,CAIT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EACzH,YAAY,EAAE,SAAS,KAAK,EAAE,EAC9B,mBAAmB,EAAE,MAAM,GAC1B,KAAK,EAAE,CAIT"}