---
id: 02-eslint-rule-pii-declaration-complete
epic: compliance-manifests-pii-retention-subprocessors
title: Add pii-declaration-must-be-complete ESLint rule to core-eslint
type: technical-story
status: done
feature: core-eslint
depends-on: [01-pii-retention-type-primitives]
blocks: [05-backfill-template-collections]
created: 2026-05-18T17:52:09Z
updated: 2026-05-18T18:35:43.840Z
---

## Goal

Add the `conformance/pii-declaration-must-be-complete` rule to `@repo/core-eslint` at warn severity. The rule detects `custom: { pii: { ... } }` blocks in Payload collection/field TypeScript files and warns when any required sub-field (`category`, `purpose`, `exportable`, `restrictable`) is missing.

## Why

Provides sub-second editor and CI feedback when a developer partially declares a `custom.pii` block. Without this rule, a missing `exportable: false` could silently survive into `compliance/data-map.yml` and appear incorrectly in an audit report.

## Done when

- `packages/core-eslint/rules/pii-declaration-must-be-complete.js` exists and passes RuleTester fixtures.
- Fixtures cover: complete `custom.pii` → no warning; `category` missing → warn; `purpose` missing → warn; `exportable` missing → warn; `restrictable` missing → warn; non-pii `custom` block → no-op; malformed/non-object `custom.pii` → no-op.
- Rule registered in `plugin.js` and `base.js` at `"warn"` severity.
- ESLint rule count in `docs/guides/conformance-quickref.md` and `CLAUDE.md` updated from 7 to 8.
- `pnpm lint` exercises the rule; all gates pass.

## In scope

- `packages/core-eslint/rules/pii-declaration-must-be-complete.js` + RuleTester test file.
- `packages/core-eslint/plugin.js` + `packages/core-eslint/base.js` — rule registration at warn.
- `docs/guides/conformance-quickref.md` + `CLAUDE.md` conformance rule count bump.

## Out of scope

- Auto-fix path — warn only, no `--fix`.
- Migration of existing collection files — that is Story 05's job.

## Tasks

- [x] Add `pii-declaration-must-be-complete.js` rule to `@repo/core-eslint` — AST rule detecting incomplete `custom.pii` blocks in Payload config files, RuleTester fixtures (complete passes, each missing required field warns, non-pii custom block is no-op), register in `plugin.js` + `base.js` at `"warn"`, update conformance rule count in `conformance-quickref.md` and `CLAUDE.md` (7 → 8) — all gates pass on this commit.
