@ya-accelerators/web-backend-framework 0.0.110 → 0.0.112

package/dist/.generated/policy/dsr-deadline.d.ts

@@ -0,0 +1,4 @@
+export declare const DSR_RESPONSE_DEADLINE_DAYS: {
+    readonly eu: 30;
+};
+export declare const dsrDueAt: (jurisdiction: keyof typeof DSR_RESPONSE_DEADLINE_DAYS, from: Date) => Date;

package/dist/.generated/policy/dsr-deadline.js

@@ -0,0 +1,6 @@
+import { MS_PER_DAY } from './retention.js';
+export const DSR_RESPONSE_DEADLINE_DAYS = {
+    eu: 30,
+};
+export const dsrDueAt = (jurisdiction, from) => new Date(from.getTime() + DSR_RESPONSE_DEADLINE_DAYS[jurisdiction] * MS_PER_DAY);
+//# sourceMappingURL=dsr-deadline.js.map

package/dist/.generated/policy/dsr-deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsr-deadline.js","sourceRoot":"","sources":["../../../src/.generated/policy/dsr-deadline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,EAAE,EAAE,EAAE;CACE,CAAA;AAEV,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,YAAqD,EAAE,IAAU,EAAE,EAAE,CAC5F,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,0BAA0B,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC,CAAA"}

package/dist/.generated/policy/markers.d.ts

@@ -0,0 +1,50 @@
+declare const PII_CATEGORIES: readonly ['direct identifier', 'quasi-identifier', 'subject reference', 'external identifier', 'payload', 'sensitive'];
+export type PiiCategory = (typeof PII_CATEGORIES)[number];
+declare const ERASE_STRATEGIES: readonly ['delete-row', 'anonymize', 'none'];
+export type EraseStrategy = (typeof ERASE_STRATEGIES)[number];
+export type RetentionMarker = {
+    kind: 'category';
+    category: string;
+} | {
+    kind: 'override';
+    constant: string;
+};
+export type FieldMarkers = {
+    pii?: string;
+    retentionAnchor?: boolean;
+    type: string;
+    optional: boolean;
+};
+export type ModelMarkers = {
+    name: string;
+    isEvent: boolean;
+    erase?: EraseStrategy;
+    retention?: RetentionMarker;
+    fields: Record<string, FieldMarkers>;
+};
+export type MarkerRegistry = Record<string, ModelMarkers>;
+export type SchemaField = {
+    name: string;
+    documentation?: string;
+    type: string;
+    isRequired: boolean;
+};
+export type SchemaModel = {
+    name: string;
+    documentation?: string;
+    fields: readonly SchemaField[];
+};
+export declare const parseMarkers: (models: readonly SchemaModel[]) => MarkerRegistry;
+export type Finding = {
+    model: string;
+    field?: string;
+    severity: 'HIGH' | 'MEDIUM';
+    rule: string;
+    message: string;
+};
+export declare const validateCoverage: (registry: MarkerRegistry, policy: {
+    categories: ReadonlySet<string>;
+    eventCategory: string;
+    constants: ReadonlySet<string>;
+}) => Finding[];
+export {};

package/dist/.generated/policy/markers.js

@@ -0,0 +1,145 @@
+const PII_CATEGORIES = [
+    'direct identifier',
+    'quasi-identifier',
+    'subject reference',
+    'external identifier',
+    'payload',
+    'sensitive',
+];
+// Runtime tuple (not just a union type) so parse narrows a regex capture to a member via `.find` rather than
+// an unchecked `as` cast, mirroring PII_CATEGORIES.
+const ERASE_STRATEGIES = ['delete-row', 'anonymize', 'none'];
+// The erase pattern is built from the vocabulary so an out-of-vocabulary strategy simply does not match.
+// The PII marker deliberately captures the raw token instead (see
+// parseFieldDoc): its unknown values MUST reach validateCoverage's `unknown-pii-category` rule, exactly like
+// the retention marker's lazy-validate — eager narrowing here would silently drop a typo'd category and make
+// the fail-closed coverage gate pass (db-schema.md § Personal data classification).
+const eraseMarkerPattern = new RegExp(`^erase:\\s*(${ERASE_STRATEGIES.join('|')})\\b`);
+const parseModelDoc = (doc) => {
+    const result = {};
+    for (const raw of (doc ?? '').split('\n')) {
+        const line = raw.trim();
+        const erase = eraseMarkerPattern.exec(line);
+        if (erase) {
+            const strategy = ERASE_STRATEGIES.find((value) => value === erase[1]);
+            if (strategy !== undefined) {
+                result.erase = strategy;
+            }
+        }
+        const retention = /^retention:\s*(.+)$/.exec(line);
+        if (retention) {
+            const override = /^override\s+(\S+)/.exec(retention[1].trim());
+            result.retention = override
+                ? { kind: 'override', constant: override[1] }
+                : { kind: 'category', category: retention[1].trim().split(/\s/)[0] };
+        }
+    }
+    return result;
+};
+const parseFieldDoc = (doc) => {
+    const result = {};
+    for (const raw of (doc ?? '').split('\n')) {
+        const line = raw.trim();
+        const pii = /^PII:\s*(.+)$/.exec(line);
+        if (pii) {
+            result.pii = pii[1].trim();
+        }
+        if (/^retention-anchor\b/.test(line)) {
+            result.retentionAnchor = true;
+        }
+    }
+    return result;
+};
+export const parseMarkers = (models) => {
+    const registry = {};
+    for (const model of models) {
+        const fields = {};
+        for (const field of model.fields) {
+            const parsed = parseFieldDoc(field.documentation);
+            if (parsed.pii || parsed.retentionAnchor) {
+                fields[field.name] = { ...parsed, type: field.type, optional: !field.isRequired };
+            }
+        }
+        registry[model.name] = {
+            name: model.name,
+            isEvent: model.name.startsWith('Event'),
+            ...parseModelDoc(model.documentation),
+            fields,
+        };
+    }
+    return registry;
+};
+// Fail-closed coverage validation. The retention `policy` is injected by the caller:
+// - `categories`: the valid `/// retention: <category>` names (keys of RETENTION_CATEGORY_DAYS).
+// - `eventCategory`: the category every `Event*` table must use (audit evidence).
+// - `constants`: the `RETENTION_<TABLE>_DAYS` names exported by the service's own constants.ts
+//   (so `/// retention: override <CONST>` markers resolve to a real source).
+export const validateCoverage = (registry, policy) => {
+    const findings = [];
+    for (const model of Object.values(registry)) {
+        if (Object.values(model.fields).some((field) => field.pii === 'subject reference') && !model.erase) {
+            findings.push({
+                model: model.name,
+                severity: 'HIGH',
+                rule: 'erase-coverage',
+                message: 'has a `/// PII: subject reference` field but no `/// erase:` marker (delete-row | anonymize | none)',
+            });
+        }
+        if (!model.retention) {
+            findings.push({
+                model: model.name,
+                severity: 'HIGH',
+                rule: 'retention-coverage',
+                message: 'has no `/// retention:` marker',
+            });
+        }
+        else if (model.retention.kind === 'override') {
+            if (!policy.constants.has(model.retention.constant)) {
+                findings.push({
+                    model: model.name,
+                    severity: 'HIGH',
+                    rule: 'override-constant',
+                    message: `\`/// retention: override ${model.retention.constant}\` but that constant is not exported from constants.ts`,
+                });
+            }
+        }
+        else if (!policy.categories.has(model.retention.category)) {
+            findings.push({
+                model: model.name,
+                severity: 'HIGH',
+                rule: 'unknown-category',
+                message: `\`/// retention: ${model.retention.category}\` is not a known retention category`,
+            });
+        }
+        else if (model.isEvent && model.retention.category !== policy.eventCategory) {
+            findings.push({
+                model: model.name,
+                severity: 'HIGH',
+                rule: 'event-retention',
+                message: `Event* tables must be \`/// retention: ${policy.eventCategory}\`, found \`${model.retention.category}\``,
+            });
+        }
+        for (const [name, field] of Object.entries(model.fields)) {
+            if (field.pii !== undefined && !PII_CATEGORIES.some((category) => category === field.pii)) {
+                findings.push({
+                    model: model.name,
+                    field: name,
+                    severity: 'HIGH',
+                    rule: 'unknown-pii-category',
+                    message: `\`/// PII: ${field.pii}\` is not a known PII category`,
+                });
+            }
+            if (field.retentionAnchor && !(field.type === 'DateTime' && field.optional)) {
+                findings.push({
+                    model: model.name,
+                    field: name,
+                    severity: 'MEDIUM',
+                    rule: 'anchor-type',
+                    message: '`/// retention-anchor` must be on a nullable `DateTime?` column',
+                });
+            }
+        }
+    }
+    return findings;
+};
+//# sourceMappingURL=markers.js.map

package/dist/.generated/policy/markers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markers.js","sourceRoot":"","sources":["../../../src/.generated/policy/markers.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG;IACrB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;IACrB,SAAS;IACT,WAAW;CACH,CAAA;AAIV,6GAA6G;AAC7G,oDAAoD;AACpD,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAU,CAAA;AAIrE,yGAAyG;AACzG,kEAAkE;AAClE,6GAA6G;AAC7G,6GAA6G;AAC7G,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,eAAe,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;AAwBtF,MAAM,aAAa,GAAG,CAAC,GAAY,EAA6C,EAAE;IAChF,MAAM,MAAM,GAA8C,EAAE,CAAA;IAC5D,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACrE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAA;YACzB,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAC9D,MAAM,CAAC,SAAS,GAAG,QAAQ;gBACzB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE;gBAC7C,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACxE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,GAAY,EAA+C,EAAE;IAClF,MAAM,MAAM,GAAgD,EAAE,CAAA;IAC9D,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACvB,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,CAAC;QACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,eAAe,GAAG,IAAI,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAA8B,EAAkB,EAAE;IAC7E,MAAM,QAAQ,GAAmB,EAAE,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAiC,EAAE,CAAA;QAC/C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;YACjD,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,CAAA;YACnF,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACvC,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC;YACrC,MAAM;SACP,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAUD,qFAAqF;AACrF,iGAAiG;AACjG,kFAAkF;AAClF,+FAA+F;AAC/F,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,QAAwB,EACxB,MAAkG,EAClG,EAAE;IACF,MAAM,QAAQ,GAAc,EAAE,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACnG,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,qGAAqG;aAC/G,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,gCAAgC;aAC1C,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,6BAA6B,KAAK,CAAC,SAAS,CAAC,QAAQ,wDAAwD;iBACvH,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,oBAAoB,KAAK,CAAC,SAAS,CAAC,QAAQ,sCAAsC;aAC5F,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9E,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0CAA0C,MAAM,CAAC,aAAa,eAAe,KAAK,CAAC,SAAS,CAAC,QAAQ,IAAI;aACnH,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1F,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,cAAc,KAAK,CAAC,GAAG,gCAAgC;iBACjE,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5E,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,iEAAiE;iBAC3E,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA"}

package/dist/.generated/policy/retention.d.ts

@@ -0,0 +1,19 @@
+export declare const RETENTION_CATEGORY_DAYS: {
+    readonly 'tax-accounting': 2555;
+    readonly 'security-audit': 730;
+    readonly 'operational-logs': 180;
+    readonly 'webhook-payloads': 90;
+    readonly 'consent-evidence': 1095;
+    readonly 'legal-hold': 730;
+    readonly 'audit-trail': 4745;
+    readonly suppression: 'indefinite';
+    readonly 'account-active': 'indefinite';
+    readonly governance: 'indefinite';
+    readonly configuration: 'indefinite';
+};
+export declare const EVENT_RETENTION_CATEGORY = "security-audit";
+export type RetentionCategory = keyof typeof RETENTION_CATEGORY_DAYS;
+export declare const MS_PER_DAY: number;
+export declare const retentionDays: (category: RetentionCategory) => 90 | 180 | 730 | 1095 | 2555 | 4745 | undefined;
+export declare const purgeCutoff: (category: RetentionCategory, now: Date) => Date | undefined;
+export declare const retainUntil: (category: RetentionCategory, sealedAt: Date) => Date | undefined;

package/dist/.generated/policy/retention.js

@@ -0,0 +1,45 @@
+export const RETENTION_CATEGORY_DAYS = {
+    'tax-accounting': 2555, // 7y — fiscal-year-aligned purge and WORM retention (Estonia Accounting Act §12)
+    'security-audit': 730, // 2y — security forensics
+    'operational-logs': 180, // 6mo — incident investigation
+    'webhook-payloads': 90,
+    'consent-evidence': 1095, // 3y rolling from occurredAt
+    'legal-hold': 730, // 2y rolling from releasedAt
+    'audit-trail': 4745,
+    suppression: 'indefinite',
+    'account-active': 'indefinite',
+    governance: 'indefinite',
+    configuration: 'indefinite',
+};
+export const EVENT_RETENTION_CATEGORY = 'security-audit';
+export const MS_PER_DAY = 24 * 60 * 60 * 1000;
+const fiscalYearEnd = (year) => new Date(`${year}-12-31T23:59:59.999Z`);
+export const retentionDays = (category) => {
+    const days = RETENTION_CATEGORY_DAYS[category];
+    return days === 'indefinite' ? undefined : days;
+};
+// Rows whose retention anchor is before this cutoff are purged. `undefined` = never time-purged. Tax /
+// accounting is fiscal-year aligned (kept until the end of FY + window); the rest roll from the anchor.
+export const purgeCutoff = (category, now) => {
+    const days = RETENTION_CATEGORY_DAYS[category];
+    if (days === 'indefinite') {
+        return undefined;
+    }
+    if (category === 'tax-accounting') {
+        return fiscalYearEnd(now.getUTCFullYear() - Math.floor(days / 365) - 1);
+    }
+    return new Date(now.getTime() - days * MS_PER_DAY);
+};
+// Object-lock retain-until for a sealed object (WORM). Tax / accounting is fiscal-year aligned;
+// the rest roll from the seal time. `undefined` = no WORM expiry for indefinite categories.
+export const retainUntil = (category, sealedAt) => {
+    const days = RETENTION_CATEGORY_DAYS[category];
+    if (days === 'indefinite') {
+        return undefined;
+    }
+    if (category === 'tax-accounting') {
+        return fiscalYearEnd(sealedAt.getUTCFullYear() + Math.floor(days / 365));
+    }
+    return new Date(sealedAt.getTime() + days * MS_PER_DAY);
+};
+//# sourceMappingURL=retention.js.map

package/dist/.generated/policy/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../../src/.generated/policy/retention.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,gBAAgB,EAAE,IAAI,EAAE,iFAAiF;IACzG,gBAAgB,EAAE,GAAG,EAAE,0BAA0B;IACjD,kBAAkB,EAAE,GAAG,EAAE,+BAA+B;IACxD,kBAAkB,EAAE,EAAE;IACtB,kBAAkB,EAAE,IAAI,EAAE,6BAA6B;IACvD,YAAY,EAAE,GAAG,EAAE,6BAA6B;IAChD,aAAa,EAAE,IAAI;IACnB,WAAW,EAAE,YAAY;IACzB,gBAAgB,EAAE,YAAY;IAC9B,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,YAAY;CACnB,CAAA;AAEV,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAA;AAIxD,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE7C,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAA;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAA2B,EAAE,EAAE;IAC3D,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAC9C,OAAO,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC,CAAA;AAED,uGAAuG;AACvG,wGAAwG;AACxG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAA2B,EAAE,GAAS,EAAE,EAAE;IACpE,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,CAAA;AACpD,CAAC,CAAA;AAED,gGAAgG;AAChG,4FAA4F;AAC5F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAA2B,EAAE,QAAc,EAAE,EAAE;IACzE,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,aAAa,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,CAAA;AACzD,CAAC,CAAA"}

package/dist/.generated/policy/sanitize.d.ts

@@ -0,0 +1,5 @@
+export declare const sanitizeKeys: {
+    SANITIZE_KEYWORDS: readonly ['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'apikey', 'api_key', 'api-key', 'token', 'secret', 'password', 'passwd', 'signature', 'private', 'session', 'jwt', 'bearer', 'email', 'fullname', 'isikukood', 'dateofbirth', 'phone', 'wage', 'screenedname', 'familyname', 'givenname', 'middlename', 'holdername', 'namekana', 'nickname', 'fax', 'workplaceaddress', 'complainantcontact', 'affiliatedorganization', 'nationalid', 'zipcode', 'taxnumber', 'corporateid', 'useragent', 'hostcountry', 'residencycountry', 'jobtitle', 'department', 'authenticationkey'];
+    SANITIZE_EXACT_KEYS: readonly ['ip'];
+    SANITIZE_EXACT_KEYS_EXCEPT_ERRORS: readonly ['name'];
+};

package/dist/.generated/policy/sanitize.js

@@ -0,0 +1,63 @@
+// The key sets `Util.sanitize` redacts by. They live here rather than in the framework's constants.ts
+// because the sanitize-coverage gate reads them too, and a gate that reached into a package would break
+// when that package moved a file. The framework spreads this bundle into its own `constants` object, so
+// every runtime caller still reads `constants.SANITIZE_*`.
+export const sanitizeKeys = {
+    // The keys `Util.sanitize` redacts by substring match. Every entry must stay low-false-positive: a
+    // substring here masks any key containing it, so a generic word would gut incident investigation. Bare
+    // 'name' (a direct identifier, db-schema.md) belongs in SANITIZE_EXACT_KEYS_EXCEPT_ERRORS instead — a
+    // substring entry would mask serviceName / fileName / ….
+    SANITIZE_KEYWORDS: [
+        'authorization',
+        'proxy-authorization',
+        'cookie',
+        'set-cookie',
+        'x-api-key',
+        'apikey',
+        'api_key',
+        'api-key',
+        'token',
+        'secret',
+        'password',
+        'passwd',
+        'signature',
+        'private',
+        'session',
+        'jwt',
+        'bearer',
+        'email',
+        'fullname',
+        'isikukood',
+        'dateofbirth',
+        'phone',
+        'wage',
+        'screenedname',
+        'familyname',
+        'givenname',
+        'middlename',
+        'holdername',
+        'namekana',
+        'nickname',
+        'fax',
+        'workplaceaddress',
+        'complainantcontact',
+        'affiliatedorganization',
+        'nationalid',
+        'zipcode',
+        'taxnumber',
+        'corporateid',
+        'useragent',
+        'hostcountry',
+        'residencycountry',
+        'jobtitle',
+        'department',
+        'authenticationkey',
+    ],
+    // Exact-match-only PII keys. A substring entry would be catastrophic here — 'ip' matches recipient /
+    // description / zip / script — so these are compared whole.
+    SANITIZE_EXACT_KEYS: ['ip'],
+    // Exact-match PII keys that an object produced from an Error is exempt from: its `name` is the error
+    // class, not a person's.
+    SANITIZE_EXACT_KEYS_EXCEPT_ERRORS: ['name'],
+};
+//# sourceMappingURL=sanitize.js.map

package/dist/.generated/policy/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/.generated/policy/sanitize.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,wGAAwG;AACxG,wGAAwG;AACxG,2DAA2D;AAC3D,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,mGAAmG;IACnG,uGAAuG;IACvG,sGAAsG;IACtG,yDAAyD;IACzD,iBAAiB,EAAE;QACjB,eAAe;QACf,qBAAqB;QACrB,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,QAAQ;QACR,SAAS;QACT,SAAS;QACT,OAAO;QACP,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,WAAW;QACX,SAAS;QACT,SAAS;QACT,KAAK;QACL,QAAQ;QACR,OAAO;QACP,UAAU;QACV,WAAW;QACX,aAAa;QACb,OAAO;QACP,MAAM;QACN,cAAc;QACd,YAAY;QACZ,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,UAAU;QACV,KAAK;QACL,kBAAkB;QAClB,oBAAoB;QACpB,wBAAwB;QACxB,YAAY;QACZ,SAAS;QACT,WAAW;QACX,aAAa;QACb,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,UAAU;QACV,YAAY;QACZ,mBAAmB;KACX;IAEV,qGAAqG;IACrG,4DAA4D;IAC5D,mBAAmB,EAAE,CAAC,IAAI,CAAU;IAEpC,qGAAqG;IACrG,yBAAyB;IACzB,iCAAiC,EAAE,CAAC,MAAM,CAAU;CACrD,CAAA"}

package/dist/.generated/policy/schema.d.ts

@@ -0,0 +1,2 @@
+import type { SchemaModel } from './markers.ts';
+export declare const readSchemaModels: (schemaText: string) => SchemaModel[];

package/dist/.generated/policy/schema.js

@@ -0,0 +1,51 @@
+// Reads a Prisma schema's text into the model/field slice the marker reader consumes. Pure string
+// parse — no `@prisma/internals` / `getDMMF` — so the same function runs in the CI marker check
+// (backend/bin/check-marker-coverage.ts) and in the runtime erase / retention-purge batch callers.
+// The Prisma 7 `prisma-client` generator strips `///` documentation from its `runtimeDataModel`,
+// so the generated client is not a usable source at runtime — the schema text is.
+// Mirrors Prisma's own `///` association rule: only the run of `///` doc-comment lines directly
+// above a `model` or field declaration becomes its documentation. A blank line or a plain `//`
+// line breaks the run (so layout headers like `// ---- Foo ----` never leak into a marker), and
+// the next declaration consumes the accumulated lines.
+export const readSchemaModels = (schemaText) => {
+    const models = [];
+    let pendingDoc = [];
+    let current = null;
+    for (const raw of schemaText.split('\n')) {
+        const line = raw.trim();
+        if (line.startsWith('///')) {
+            pendingDoc.push(line.replace(/^\/\/\/\s?/, ''));
+            continue;
+        }
+        const modelMatch = /^model\s+(\w+)\s*\{/.exec(line);
+        if (modelMatch) {
+            current = {
+                name: modelMatch[1],
+                documentation: pendingDoc.length ? pendingDoc.join('\n') : undefined,
+                fields: [],
+            };
+            models.push(current);
+            pendingDoc = [];
+            continue;
+        }
+        if (current && line === '}') {
+            current = null;
+            pendingDoc = [];
+            continue;
+        }
+        if (current && !line.startsWith('@')) {
+            const fieldMatch = /^(\w+)\s+([A-Za-z0-9_]+)(\?)?/.exec(line);
+            if (fieldMatch) {
+                current.fields.push({
+                    name: fieldMatch[1],
+                    documentation: pendingDoc.length ? pendingDoc.join('\n') : undefined,
+                    type: fieldMatch[2],
+                    isRequired: !fieldMatch[3],
+                });
+            }
+        }
+        pendingDoc = [];
+    }
+    return models;
+};
+//# sourceMappingURL=schema.js.map

package/dist/.generated/policy/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/.generated/policy/schema.ts"],"names":[],"mappings":"AAEA,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,kFAAkF;AAClF,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,uDAAuD;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAE,EAAE;IACrD,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,IAAI,UAAU,GAAa,EAAE,CAAA;IAC7B,IAAI,OAAO,GAA2E,IAAI,CAAA;IAE1F,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QAEvB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;YAC/C,SAAQ;QACV,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,GAAG;gBACR,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;gBACnB,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBACpE,MAAM,EAAE,EAAE;aACX,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACpB,UAAU,GAAG,EAAE,CAAA;YACf,SAAQ;QACV,CAAC;QAED,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,GAAG,IAAI,CAAA;YACd,UAAU,GAAG,EAAE,CAAA;YACf,SAAQ;QACV,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC7D,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;oBAClB,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;oBACnB,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;oBACpE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;oBACnB,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;iBAC3B,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,UAAU,GAAG,EAAE,CAAA;IACjB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/dist/constants.d.ts

@@ -1,4 +1,7 @@
 export declare const constants: {
+    SANITIZE_KEYWORDS: readonly ['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'apikey', 'api_key', 'api-key', 'token', 'secret', 'password', 'passwd', 'signature', 'private', 'session', 'jwt', 'bearer', 'email', 'fullname', 'isikukood', 'dateofbirth', 'phone', 'wage', 'screenedname', 'familyname', 'givenname', 'middlename', 'holdername', 'namekana', 'nickname', 'fax', 'workplaceaddress', 'complainantcontact', 'affiliatedorganization', 'nationalid', 'zipcode', 'taxnumber', 'corporateid', 'useragent', 'hostcountry', 'residencycountry', 'jobtitle', 'department', 'authenticationkey'];
+    SANITIZE_EXACT_KEYS: readonly ['ip'];
+    SANITIZE_EXACT_KEYS_EXCEPT_ERRORS: readonly ['name'];
     OAUTH_DEV_REDIRECTOR_URL: string;
     UPLOADS_PREFIX: string;
     UPLOADS_EXPIRE_DAYS: number;
@@ -7,7 +10,4 @@ export declare const constants: {
     UPLOAD_CONTENT_TYPE_MAX_LENGTH: number;
     UPLOAD_STORED_CONTENT_TYPE: string;
     PII_ALLOWED_AWS_REGIONS: readonly ['eu-north-1', 'eu-west-1', 'eu-west-3', 'eu-central-1', 'eu-south-1', 'eu-south-2'];
-    SANITIZE_KEYWORDS: readonly ['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'apikey', 'api_key', 'api-key', 'token', 'secret', 'password', 'passwd', 'signature', 'private', 'session', 'jwt', 'bearer', 'email', 'fullname', 'isikukood', 'dateofbirth', 'phone', 'wage', 'screenedname', 'familyname', 'givenname', 'middlename', 'holdername', 'namekana', 'nickname', 'fax', 'workplaceaddress', 'complainantcontact', 'affiliatedorganization', 'nationalid', 'zipcode', 'taxnumber', 'corporateid', 'useragent', 'hostcountry', 'residencycountry', 'jobtitle', 'department', 'authenticationkey'];
-    SANITIZE_EXACT_KEYS: readonly ['ip'];
-    SANITIZE_EXACT_KEYS_EXCEPT_ERRORS: readonly ['name'];
 };

package/dist/constants.js

@@ -1,3 +1,4 @@
+import { sanitizeKeys } from './.generated/policy/sanitize.js';
 export const constants = {
     OAUTH_DEV_REDIRECTOR_URL: 'https://jbilvarnjxcewv7spngtoaowia0krqmu.lambda-url.eu-north-1.on.aws/',
     UPLOADS_PREFIX: '_uploads/',
@@ -18,61 +19,6 @@ export const constants = {
         'eu-south-1',
         'eu-south-2',
     ],
-    // The keys `Util.sanitize` redacts by substring match. Every entry must stay low-false-positive: a
-    // substring here masks any key containing it, so a generic word would gut incident investigation. Bare
-    // 'name' (a direct identifier, db-schema.md) belongs in SANITIZE_EXACT_KEYS_EXCEPT_ERRORS instead — a
-    // substring entry would mask serviceName / fileName / ….
-    SANITIZE_KEYWORDS: [
-        'authorization',
-        'proxy-authorization',
-        'cookie',
-        'set-cookie',
-        'x-api-key',
-        'apikey',
-        'api_key',
-        'api-key',
-        'token',
-        'secret',
-        'password',
-        'passwd',
-        'signature',
-        'private',
-        'session',
-        'jwt',
-        'bearer',
-        'email',
-        'fullname',
-        'isikukood',
-        'dateofbirth',
-        'phone',
-        'wage',
-        'screenedname',
-        'familyname',
-        'givenname',
-        'middlename',
-        'holdername',
-        'namekana',
-        'nickname',
-        'fax',
-        'workplaceaddress',
-        'complainantcontact',
-        'affiliatedorganization',
-        'nationalid',
-        'zipcode',
-        'taxnumber',
-        'corporateid',
-        'useragent',
-        'hostcountry',
-        'residencycountry',
-        'jobtitle',
-        'department',
-        'authenticationkey',
-    ],
-    // Exact-match-only PII keys. A substring entry would be catastrophic here — 'ip' matches recipient /
-    // description / zip / script — so these are compared whole.
-    SANITIZE_EXACT_KEYS: ['ip'],
-    // Exact-match PII keys that an object produced from an Error is exempt from: its `name` is the error
-    // class, not a person's.
-    SANITIZE_EXACT_KEYS_EXCEPT_ERRORS: ['name'],
+    ...sanitizeKeys,
 };
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,wBAAwB,EAAE,wEAAwE;IAClG,cAAc,EAAE,WAAW;IAC3B,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,GAAG;IAC/B,8BAA8B,EAAE,GAAG;IACnC,0BAA0B,EAAE,0BAA0B;IAEtD,4GAA4G;IAC5G,6GAA6G;IAC7G,4GAA4G;IAC5G,+CAA+C;IAC/C,uBAAuB,EAAE;QACvB,YAAY;QACZ,WAAW;QACX,WAAW;QACX,cAAc;QACd,YAAY;QACZ,YAAY;KACJ;IAEV,mGAAmG;IACnG,uGAAuG;IACvG,sGAAsG;IACtG,yDAAyD;IACzD,iBAAiB,EAAE;QACjB,eAAe;QACf,qBAAqB;QACrB,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,QAAQ;QACR,SAAS;QACT,SAAS;QACT,OAAO;QACP,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,WAAW;QACX,SAAS;QACT,SAAS;QACT,KAAK;QACL,QAAQ;QACR,OAAO;QACP,UAAU;QACV,WAAW;QACX,aAAa;QACb,OAAO;QACP,MAAM;QACN,cAAc;QACd,YAAY;QACZ,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,UAAU;QACV,KAAK;QACL,kBAAkB;QAClB,oBAAoB;QACpB,wBAAwB;QACxB,YAAY;QACZ,SAAS;QACT,WAAW;QACX,aAAa;QACb,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,UAAU;QACV,YAAY;QACZ,mBAAmB;KACX;IAEV,qGAAqG;IACrG,4DAA4D;IAC5D,mBAAmB,EAAE,CAAC,IAAI,CAAU;IAEpC,qGAAqG;IACrG,yBAAyB;IACzB,iCAAiC,EAAE,CAAC,MAAM,CAAU;CACrD,CAAA"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAE9D,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,wBAAwB,EAAE,wEAAwE;IAClG,cAAc,EAAE,WAAW;IAC3B,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,GAAG;IAC/B,8BAA8B,EAAE,GAAG;IACnC,0BAA0B,EAAE,0BAA0B;IAEtD,4GAA4G;IAC5G,6GAA6G;IAC7G,4GAA4G;IAC5G,+CAA+C;IAC/C,uBAAuB,EAAE;QACvB,YAAY;QACZ,WAAW;QACX,WAAW;QACX,cAAc;QACd,YAAY;QACZ,YAAY;KACJ;IAEV,GAAG,YAAY;CAChB,CAAA"}

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export * from './context/index.ts';
 export * from './coordination/index.ts';
 export * from './env.ts';
 export * from './logger/index.ts';
+export * as Policy from './policy.ts';
 export * from './repository/index.ts';
 export * from './server/index.ts';
 export * from './usecase/index.ts';

package/dist/index.js

@@ -4,6 +4,7 @@ export * from './context/index.js';
 export * from './coordination/index.js';
 export * from './env.js';
 export * from './logger/index.js';
+export * as Policy from './policy.js';
 export * from './repository/index.js';
 export * from './server/index.js';
 export * from './usecase/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA;AACpC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,yBAAyB,CAAA;AACvC,cAAc,UAAU,CAAA;AACxB,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA;AACpC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,yBAAyB,CAAA;AACvC,cAAc,UAAU,CAAA;AACxB,cAAc,mBAAmB,CAAA;AACjC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA"}

package/dist/policy.d.ts

@@ -0,0 +1,4 @@
+export * from './.generated/policy/dsr-deadline.ts';
+export * from './.generated/policy/markers.ts';
+export * from './.generated/policy/retention.ts';
+export * from './.generated/policy/schema.ts';

package/dist/policy.js

@@ -0,0 +1,5 @@
+export * from './.generated/policy/dsr-deadline.js';
+export * from './.generated/policy/markers.js';
+export * from './.generated/policy/retention.js';
+export * from './.generated/policy/schema.js';
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAA;AACnD,cAAc,gCAAgC,CAAA;AAC9C,cAAc,kCAAkC,CAAA;AAChD,cAAc,+BAA+B,CAAA"}

package/dist/server/trpc/declaration/index.d.ts

@@ -25,6 +25,10 @@ export declare namespace Ropa {
         readonly kind: 'ropa-none';
         readonly reason: Reason;
     };
+    type Unimplemented<Reason extends string> = {
+        readonly kind: 'ropa-unimplemented';
+        readonly reason: Reason;
+    };
 }
 export type ProcessingDeclaration = {
     readonly purpose: string;
@@ -51,7 +55,7 @@ export declare const submitProcessingDeclarations: <T extends Record<string, Pro
     }) => Promise<void>;
 }) => Promise<void>;
 export type AuthDeclaration = Auth.Tier<string> | Auth.Upstream<string> | Auth.None<string> | Auth.Unimplemented<string>;
-export type RopaDeclaration<Key extends string> = Ropa.Activity<Key> | Ropa.None<string>;
+export type RopaDeclaration<Key extends string> = Ropa.Activity<Key> | Ropa.None<string> | Ropa.Unimplemented<string>;
 export type DeclarationRequired = {
     readonly __declarationRequired: never;
 };

package/dist/server/trpc/declaration/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/server/trpc/declaration/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AA4BxC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,YAGG,EACH,EAAE,CAAC,YAAY,CAAA;AAEjB,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAmD,MASnG,EAAE,EAAE;IACH,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAqC,EAAE,CAAC;QAC7G,MAAM,MAAM,CAAC,MAAM,CAAC;YAClB,WAAW;YACX,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,OAAO;YACP,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACpG,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/server/trpc/declaration/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AA6BxC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,YAGG,EACH,EAAE,CAAC,YAAY,CAAA;AAEjB,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAmD,MASnG,EAAE,EAAE;IACH,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAqC,EAAE,CAAC;QAC7G,MAAM,MAAM,CAAC,MAAM,CAAC;YAClB,WAAW;YACX,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,OAAO;YACP,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACpG,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ya-accelerators/web-backend-framework",
-  "version": "0.0.110",
+  "version": "0.0.112",
   "packageRole": "library",
   "type": "module",
   "description": "",
@@ -19,6 +19,10 @@
     "./constants": {
       "types": "./dist/constants.d.ts",
       "default": "./dist/constants.js"
+    },
+    "./policy": {
+      "types": "./dist/policy.d.ts",
+      "default": "./dist/policy.js"
     }
   },
   "repository": {
@@ -37,8 +41,8 @@
   ],
   "scripts": {
     "setup": "pnpm run build",
-    "build": "tsc",
-    "dev": "tsc --watch --preserveWatchOutput",
+    "build": "node ../../bin/copy-policy.mts src/.generated/policy && tsc",
+    "dev": "node ../../bin/copy-policy.mts src/.generated/policy && tsc --watch --preserveWatchOutput",
     "lint": "run-p -l -c lint:*",
     "lint:tsc": "tsc --pretty --noEmit --incremental false",
     "lint:biome": "biome check .",
@@ -48,8 +52,8 @@
     "test:integration": "jest --testPathPatterns=integration"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1109.0",
-    "@aws-sdk/credential-provider-node": "^3.972.79",
+    "@aws-sdk/client-s3": "^3.1113.0",
+    "@aws-sdk/credential-provider-node": "^3.972.80",
     "@prisma/adapter-mariadb": "^7.9.1",
     "@prisma/extension-read-replicas": "^0.5.0",
     "@valkey/valkey-glide": "^2.5.1",
@@ -57,7 +61,7 @@
     "express": "^5.2.1",
     "google-auth-library": "^11.0.2",
     "http-proxy-middleware": "^4.2.0",
-    "jose": "^6.2.8",
+    "jose": "^6.2.9",
     "mariadb": "^3.5.3",
     "ulid": "^3.0.2"
   },