@zanii/subprocessor 0.1.0 → 0.2.1

package/dist/index.d.ts

@@ -52,22 +52,36 @@ export interface SubprocessorGraph {
         to: string;
         ts: string;
     }>;
+    /** Structurally broken transfers (missing from/to/agreement/ts) — never silently dropped. */
+    malformed: Array<{
+        index: number;
+        reason: string;
+    }>;
 }
 /**
  * Build the onward-transfer graph and check it against the **declared** subprocessor
  * allow-list. `undeclared` is the load-bearing output: any receiver not on the list is a
  * provable Art. 28 violation. `missing_agreement_id` flags dpa/scc transfers with no id.
- * Pure — pass the transfers you recorded (from the ledger).
+ * Pass `controller` (the data controller/origin) to also flag undeclared SENDERS — without
+ * it, an undeclared `from` is indistinguishable from the origin and goes unchecked.
+ * Pure — pass the transfers you recorded (from the ledger). Never throws; broken entries
+ * land in `malformed`.
  */
-export declare function subprocessorGraph(transfers: Transfer[], declared: string[]): SubprocessorGraph;
+export declare function subprocessorGraph(transfers: Transfer[], declared: string[], opts?: {
+    controller?: string;
+}): SubprocessorGraph;
 export interface TransferCheck {
     ok: boolean;
     reasons: string[];
 }
 /**
  * The compliance verdict for one data object's transfers: every receiver is declared, and
- * every dpa/scc transfer carries an agreement id. `ok` means the recorded onward chain is
- * clean; it does not assert no off-record transfer happened (see the limit).
+ * every dpa/scc transfer carries an agreement id. Pass `controller` to also require every
+ * SENDER to be the controller or declared (Art. 28 covers possession, not just receipt).
+ * `ok` means the recorded onward chain is clean; it does not assert no off-record transfer
+ * happened (see the limit). Never throws — a malformed transfer fails the verdict.
  */
-export declare function verifyTransfers(transfers: Transfer[], declared: string[]): TransferCheck;
+export declare function verifyTransfers(transfers: Transfer[], declared: string[], opts?: {
+    controller?: string;
+}): TransferCheck;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,SAAS;IACxB,0EAA0E;IAC1E,IAAI,EAAE,gBAAgB,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IACjD,0CAA0C;IAC1C,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,uBAAuB,CAAC;IAC9B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAiBxG;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEhD;AAED,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yBAAyB;IACzB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sEAAsE;IACtE,oBAAoB,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAoB9F;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAMxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,SAAS;IACxB,0EAA0E;IAC1E,IAAI,EAAE,gBAAgB,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IACjD,0CAA0C;IAC1C,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,uBAAuB,CAAC;IAC9B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAQD,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAiBxG;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEhD;AAED,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yBAAyB;IACzB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sEAAsE;IACtE,oBAAoB,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,6FAA6F;IAC7F,SAAS,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAWD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,iBAAiB,CA6B9H;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAOxH"}

package/dist/index.js

@@ -20,15 +20,18 @@
  * And an agreement id is a reference, not a guarantee the counterparty honored it.
  */
 import { jcsHash } from '@zanii/core';
+const AGREEMENTS = ['zero-retention', 'dpa', 'scc', 'other'];
+// strict ISO check — Date.parse alone accepts 'Aug 20 2026', which Python's verifier rejects
+const validTs = (ts) => typeof ts === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(ts) && !Number.isNaN(Date.parse(ts));
 /** Build one onward-transfer record. Record it; the `to` is checked against your declared list. */
 export function buildTransfer(input) {
     if (!input.from || !input.to)
         throw new Error('from and to are required');
     if (input.from === input.to)
         throw new Error('a transfer must cross parties (from != to)');
-    if (!input.agreement?.type)
+    if (!AGREEMENTS.includes(input.agreement?.type))
         throw new Error('agreement.type is required');
-    if (Number.isNaN(Date.parse(input.ts)))
+    if (!validTs(input.ts))
         throw new Error('ts must be an ISO timestamp');
     const t = {
         v: 1,
@@ -49,23 +52,48 @@ export function buildTransfer(input) {
 export function transferHash(t) {
     return jcsHash(t);
 }
+const transferProblem = (t) => {
+    if (!t || typeof t !== 'object')
+        return 'not a transfer object';
+    if (typeof t.from !== 'string' || !t.from)
+        return 'missing from';
+    if (typeof t.to !== 'string' || !t.to)
+        return 'missing to';
+    if (typeof t.agreement?.type !== 'string')
+        return 'missing agreement';
+    if (!validTs(t.ts))
+        return 'missing/invalid ts';
+    return null;
+};
 /**
  * Build the onward-transfer graph and check it against the **declared** subprocessor
  * allow-list. `undeclared` is the load-bearing output: any receiver not on the list is a
  * provable Art. 28 violation. `missing_agreement_id` flags dpa/scc transfers with no id.
- * Pure — pass the transfers you recorded (from the ledger).
+ * Pass `controller` (the data controller/origin) to also flag undeclared SENDERS — without
+ * it, an undeclared `from` is indistinguishable from the origin and goes unchecked.
+ * Pure — pass the transfers you recorded (from the ledger). Never throws; broken entries
+ * land in `malformed`.
  */
-export function subprocessorGraph(transfers, declared) {
+export function subprocessorGraph(transfers, declared, opts) {
     const parties = new Set();
     const edges = [];
     const undeclared = new Set();
     const missing = [];
-    for (const t of transfers) {
+    const malformed = [];
+    for (let i = 0; i < transfers.length; i++) {
+        const t = transfers[i];
+        const problem = transferProblem(t);
+        if (problem) {
+            malformed.push({ index: i, reason: problem });
+            continue;
+        }
         parties.add(t.from);
         parties.add(t.to);
         edges.push({ from: t.from, to: t.to, agreement: t.agreement, ts: t.ts });
         if (!declared.includes(t.to))
             undeclared.add(t.to);
+        if (opts?.controller !== undefined && t.from !== opts.controller && !declared.includes(t.from))
+            undeclared.add(t.from);
         if ((t.agreement.type === 'dpa' || t.agreement.type === 'scc') && !t.agreement.id) {
             missing.push({ to: t.to, ts: t.ts });
         }
@@ -75,16 +103,21 @@ export function subprocessorGraph(transfers, declared) {
         edges: edges.sort((a, b) => Date.parse(a.ts) - Date.parse(b.ts)),
         undeclared: [...undeclared].sort(),
         missing_agreement_id: missing,
+        malformed,
     };
 }
 /**
  * The compliance verdict for one data object's transfers: every receiver is declared, and
- * every dpa/scc transfer carries an agreement id. `ok` means the recorded onward chain is
- * clean; it does not assert no off-record transfer happened (see the limit).
+ * every dpa/scc transfer carries an agreement id. Pass `controller` to also require every
+ * SENDER to be the controller or declared (Art. 28 covers possession, not just receipt).
+ * `ok` means the recorded onward chain is clean; it does not assert no off-record transfer
+ * happened (see the limit). Never throws — a malformed transfer fails the verdict.
  */
-export function verifyTransfers(transfers, declared) {
-    const g = subprocessorGraph(transfers, declared);
+export function verifyTransfers(transfers, declared, opts) {
+    const g = subprocessorGraph(transfers, declared, opts);
     const reasons = [];
+    for (const b of g.malformed)
+        reasons.push(`transfer ${b.index}: ${b.reason}`);
     for (const u of g.undeclared)
         reasons.push(`data reached '${u}', which is NOT a declared subprocessor`);
     for (const m of g.missing_agreement_id)

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAoCtC,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvF,MAAM,CAAC,GAAa;QAClB,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC;IACF,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACxD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,yBAAyB,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAuC,EAAE,CAAC;AACvH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,OAAO,OAAO,CAAC,CAAuC,CAAC,CAAC;AAC1D,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAqB,EAAE,QAAkB;IACzE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAA8C,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QAClC,oBAAoB,EAAE,OAAO;KAC9B,CAAC;AACJ,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,SAAqB,EAAE,QAAkB;IACvE,MAAM,CAAC,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;IACxG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,6CAA6C,CAAC,CAAC;IACpI,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAoCtC,MAAM,UAAU,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAE7D,6FAA6F;AAC7F,MAAM,OAAO,GAAG,CAAC,EAAW,EAAW,EAAE,CACvC,OAAO,EAAE,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAE5F,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvE,MAAM,CAAC,GAAa;QAClB,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,uBAAuB;QAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC;IACF,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACxD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,yBAAyB,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAuC,EAAE,CAAC;AACvH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,OAAO,OAAO,CAAC,CAAuC,CAAC,CAAC;AAC1D,CAAC;AAeD,MAAM,eAAe,GAAG,CAAC,CAAuB,EAAiB,EAAE;IACjE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,uBAAuB,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,cAAc,CAAC;IACjE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC;IAC3D,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAqB,EAAE,QAAkB,EAAE,IAA8B;IACzG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAA8C,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAmC,EAAE,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QACxB,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvH,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QAClC,oBAAoB,EAAE,OAAO;QAC7B,SAAS;KACV,CAAC;AACJ,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,SAAqB,EAAE,QAAkB,EAAE,IAA8B;IACvG,MAAM,CAAC,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;IACxG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,6CAA6C,CAAC,CAAC;IACpI,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zanii/subprocessor",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Prove the onward-transfer chain - which downstream processors actually saw the data, under which agreement (zero-retention, DPA id), tied to the junction/settlement. Answers the exact GDPR Art. 28 question every AI DPA raises: 'you sent my data to OpenAI, who sent it where?' A transfer to a party not in the declared subprocessor list is a provable, flagged violation. Proves recorded transfers; an off-record leak needs an attested enclave.",
   "license": "Apache-2.0",
   "homepage": "https://ledger.zanii.agency",
@@ -31,7 +31,7 @@
     "vitest": "^3.0.9"
   },
   "dependencies": {
-    "@zanii/core": "0.4.0"
+    "@zanii/core": "^0.5.2"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",

package/src/index.ts

@@ -55,12 +55,18 @@ export interface TransferInput {
   junction?: string;
 }
 
+const AGREEMENTS = ['zero-retention', 'dpa', 'scc', 'other'];
+
+// strict ISO check — Date.parse alone accepts 'Aug 20 2026', which Python's verifier rejects
+const validTs = (ts: unknown): boolean =>
+  typeof ts === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(ts) && !Number.isNaN(Date.parse(ts));
+
 /** Build one onward-transfer record. Record it; the `to` is checked against your declared list. */
 export function buildTransfer(input: TransferInput): { target: string; payload: Record<string, unknown> } {
   if (!input.from || !input.to) throw new Error('from and to are required');
   if (input.from === input.to) throw new Error('a transfer must cross parties (from != to)');
-  if (!input.agreement?.type) throw new Error('agreement.type is required');
-  if (Number.isNaN(Date.parse(input.ts))) throw new Error('ts must be an ISO timestamp');
+  if (!AGREEMENTS.includes(input.agreement?.type)) throw new Error('agreement.type is required');
+  if (!validTs(input.ts)) throw new Error('ts must be an ISO timestamp');
   const t: Transfer = {
     v: 1,
     type: 'subprocessor.transfer',
@@ -88,24 +94,46 @@ export interface SubprocessorGraph {
   undeclared: string[];
   /** Transfers with no agreement id where one is required (dpa/scc). */
   missing_agreement_id: Array<{ to: string; ts: string }>;
+  /** Structurally broken transfers (missing from/to/agreement/ts) — never silently dropped. */
+  malformed: Array<{ index: number; reason: string }>;
 }
 
+const transferProblem = (t: Transfer | undefined): string | null => {
+  if (!t || typeof t !== 'object') return 'not a transfer object';
+  if (typeof t.from !== 'string' || !t.from) return 'missing from';
+  if (typeof t.to !== 'string' || !t.to) return 'missing to';
+  if (typeof t.agreement?.type !== 'string') return 'missing agreement';
+  if (!validTs(t.ts)) return 'missing/invalid ts';
+  return null;
+};
+
 /**
  * Build the onward-transfer graph and check it against the **declared** subprocessor
  * allow-list. `undeclared` is the load-bearing output: any receiver not on the list is a
  * provable Art. 28 violation. `missing_agreement_id` flags dpa/scc transfers with no id.
- * Pure — pass the transfers you recorded (from the ledger).
+ * Pass `controller` (the data controller/origin) to also flag undeclared SENDERS — without
+ * it, an undeclared `from` is indistinguishable from the origin and goes unchecked.
+ * Pure — pass the transfers you recorded (from the ledger). Never throws; broken entries
+ * land in `malformed`.
  */
-export function subprocessorGraph(transfers: Transfer[], declared: string[]): SubprocessorGraph {
+export function subprocessorGraph(transfers: Transfer[], declared: string[], opts?: { controller?: string }): SubprocessorGraph {
   const parties = new Set<string>();
   const edges: SubprocessorGraph['edges'] = [];
   const undeclared = new Set<string>();
   const missing: SubprocessorGraph['missing_agreement_id'] = [];
-  for (const t of transfers) {
+  const malformed: SubprocessorGraph['malformed'] = [];
+  for (let i = 0; i < transfers.length; i++) {
+    const t = transfers[i]!;
+    const problem = transferProblem(t);
+    if (problem) {
+      malformed.push({ index: i, reason: problem });
+      continue;
+    }
     parties.add(t.from);
     parties.add(t.to);
     edges.push({ from: t.from, to: t.to, agreement: t.agreement, ts: t.ts });
     if (!declared.includes(t.to)) undeclared.add(t.to);
+    if (opts?.controller !== undefined && t.from !== opts.controller && !declared.includes(t.from)) undeclared.add(t.from);
     if ((t.agreement.type === 'dpa' || t.agreement.type === 'scc') && !t.agreement.id) {
       missing.push({ to: t.to, ts: t.ts });
     }
@@ -115,6 +143,7 @@ export function subprocessorGraph(transfers: Transfer[], declared: string[]): Su
     edges: edges.sort((a, b) => Date.parse(a.ts) - Date.parse(b.ts)),
     undeclared: [...undeclared].sort(),
     missing_agreement_id: missing,
+    malformed,
   };
 }
 
@@ -125,12 +154,15 @@ export interface TransferCheck {
 
 /**
  * The compliance verdict for one data object's transfers: every receiver is declared, and
- * every dpa/scc transfer carries an agreement id. `ok` means the recorded onward chain is
- * clean; it does not assert no off-record transfer happened (see the limit).
+ * every dpa/scc transfer carries an agreement id. Pass `controller` to also require every
+ * SENDER to be the controller or declared (Art. 28 covers possession, not just receipt).
+ * `ok` means the recorded onward chain is clean; it does not assert no off-record transfer
+ * happened (see the limit). Never throws — a malformed transfer fails the verdict.
  */
-export function verifyTransfers(transfers: Transfer[], declared: string[]): TransferCheck {
-  const g = subprocessorGraph(transfers, declared);
+export function verifyTransfers(transfers: Transfer[], declared: string[], opts?: { controller?: string }): TransferCheck {
+  const g = subprocessorGraph(transfers, declared, opts);
   const reasons: string[] = [];
+  for (const b of g.malformed) reasons.push(`transfer ${b.index}: ${b.reason}`);
   for (const u of g.undeclared) reasons.push(`data reached '${u}', which is NOT a declared subprocessor`);
   for (const m of g.missing_agreement_id) reasons.push(`transfer to '${m.to}' at ${m.ts} has no agreement id (dpa/scc requires one)`);
   return { ok: reasons.length === 0, reasons };