---
id: 06-compliance-generator-scripts
epic: compliance-manifests-pii-retention-subprocessors
title: Compliance generator scripts (emit-data-map, emit-retention-policy, emit-sub-processors, emit-all)
type: technical-story
status: done
feature: tooling
depends-on: [01-pii-retention-type-primitives, 05-backfill-template-collections]
blocks: [07-pre-commit-and-ci-integration, 08-docs-compliance-reference-files]
created: 2026-05-18T17:52:09Z
updated: 2026-05-18T20:12:13.181Z
---

## Goal

Add four ESM scripts under `scripts/compliance/` and wire them as `pnpm compliance:*` package scripts in root `package.json`. Each emitter walks the relevant source (Payload collections or library traces), produces deterministic YAML, supports `--check` (diff against committed file, exit non-zero on mismatch) and `--print` (stdout) modes, and ships with unit tests. The final task commits the initial generated `compliance/*.yml` artifacts.

## Why

The generators are the runtime bridge between source declarations (Payload configs, ADR-022 library traces) and audit evidence (`compliance/*.yml`). Without them, the pre-commit hook and CI integration (Story 07) have nothing to invoke, and `compliance/` stays empty.

## Done when

- `scripts/compliance/emit-data-map.mjs`: walks Payload collections, applies `PAYLOAD_AUTH_PII_DEFAULTS` + `custom.authPii` overrides, emits deterministic `compliance/data-map.yml`, supports `--check` / `--print`; unit tests cover happy path, `--check` match, `--check` mismatch (readable diff), empty-collections, auth-defaults applied, and `authPii` override applied.
- `scripts/compliance/emit-retention-policy.mjs`: walks collections, validates `purgeSchedule` present per collection (exit non-zero + hint if missing), emits `compliance/retention-policy.yml`, supports `--check` / `--print`; unit tests cover required fields validation and diff modes.
- `scripts/compliance/emit-sub-processors.mjs`: walks `docs/library-decisions/*.md`, filters `is-sub-processor: true`, merges `compliance/sub-processors.manual.yml` (if present, with `source: manual` flag), emits sorted `compliance/sub-processors.yml`, supports `--check` / `--print`; unit tests cover discriminated-union parsing, absent manual file graceful skip, and merge.
- `scripts/compliance/emit-all.mjs`: orchestrates all three in `--check` mode, exits non-zero if any generator fails.
- Root `package.json` gains scripts: `compliance:data-map`, `compliance:retention-policy`, `compliance:sub-processors`, `compliance:emit-all`.
- Initial `compliance/data-map.yml`, `compliance/retention-policy.yml`, `compliance/sub-processors.yml` generated and committed.
- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass.

## In scope

- `scripts/compliance/emit-data-map.mjs` + tests.
- `scripts/compliance/emit-retention-policy.mjs` + tests.
- `scripts/compliance/emit-sub-processors.mjs` + tests.
- `scripts/compliance/emit-all.mjs`.
- Root `package.json` script entries.
- Initial `compliance/*.yml` files committed.

## Out of scope

- Pre-commit hook wiring (Story 07).
- CI integration (Story 07).
- `compliance/sub-processors.manual.yml` — consumer-authored; generator handles its absence gracefully.

## Tasks

- [x] Add `scripts/compliance/emit-data-map.mjs` + unit tests + `compliance:data-map` root package script — walks Payload collections, applies auth PII defaults and `authPii` overrides, deterministic YAML output, `--check` and `--print` modes — all gates pass on this commit.
- [x] Add `scripts/compliance/emit-retention-policy.mjs` + unit tests + `compliance:retention-policy` root package script — validates `purgeSchedule` on every collection, deterministic YAML output, `--check` and `--print` modes — all gates pass on this commit.
- [x] Add `scripts/compliance/emit-sub-processors.mjs` + unit tests + `compliance:sub-processors` root package script — parses `is-sub-processor` discriminated union from library traces, merges manual entries with `source: manual` flag, sorted deterministic YAML output, `--check` and `--print` modes — all gates pass on this commit.
- [x] Add `scripts/compliance/emit-all.mjs` orchestrator + `compliance:emit-all` root package script, run `pnpm compliance:emit-all` to produce and commit initial `compliance/data-map.yml`, `compliance/retention-policy.yml`, and `compliance/sub-processors.yml` — all gates pass on this commit.
