Initial commit

docs/work/epics/compliance-manifests-pii-retention-subprocessors/06-compliance-generator-scripts/_story.md

@@ -0,0 +1,52 @@
+---
+id: 06-compliance-generator-scripts
+epic: compliance-manifests-pii-retention-subprocessors
+title: Compliance generator scripts (emit-data-map, emit-retention-policy, emit-sub-processors, emit-all)
+type: technical-story
+status: done
+feature: tooling
+depends-on: [01-pii-retention-type-primitives, 05-backfill-template-collections]
+blocks: [07-pre-commit-and-ci-integration, 08-docs-compliance-reference-files]
+created: 2026-05-18T17:52:09Z
+updated: 2026-05-18T20:12:13.181Z
+---
+
+## Goal
+
+Add four ESM scripts under `scripts/compliance/` and wire them as `pnpm compliance:*` package scripts in root `package.json`. Each emitter walks the relevant source (Payload collections or library traces), produces deterministic YAML, supports `--check` (diff against committed file, exit non-zero on mismatch) and `--print` (stdout) modes, and ships with unit tests. The final task commits the initial generated `compliance/*.yml` artifacts.
+
+## Why
+
+The generators are the runtime bridge between source declarations (Payload configs, ADR-022 library traces) and audit evidence (`compliance/*.yml`). Without them, the pre-commit hook and CI integration (Story 07) have nothing to invoke, and `compliance/` stays empty.
+
+## Done when
+
+- `scripts/compliance/emit-data-map.mjs`: walks Payload collections, applies `PAYLOAD_AUTH_PII_DEFAULTS` + `custom.authPii` overrides, emits deterministic `compliance/data-map.yml`, supports `--check` / `--print`; unit tests cover happy path, `--check` match, `--check` mismatch (readable diff), empty-collections, auth-defaults applied, and `authPii` override applied.
+- `scripts/compliance/emit-retention-policy.mjs`: walks collections, validates `purgeSchedule` present per collection (exit non-zero + hint if missing), emits `compliance/retention-policy.yml`, supports `--check` / `--print`; unit tests cover required fields validation and diff modes.
+- `scripts/compliance/emit-sub-processors.mjs`: walks `docs/library-decisions/*.md`, filters `is-sub-processor: true`, merges `compliance/sub-processors.manual.yml` (if present, with `source: manual` flag), emits sorted `compliance/sub-processors.yml`, supports `--check` / `--print`; unit tests cover discriminated-union parsing, absent manual file graceful skip, and merge.
+- `scripts/compliance/emit-all.mjs`: orchestrates all three in `--check` mode, exits non-zero if any generator fails.
+- Root `package.json` gains scripts: `compliance:data-map`, `compliance:retention-policy`, `compliance:sub-processors`, `compliance:emit-all`.
+- Initial `compliance/data-map.yml`, `compliance/retention-policy.yml`, `compliance/sub-processors.yml` generated and committed.
+- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass.
+
+## In scope
+
+- `scripts/compliance/emit-data-map.mjs` + tests.
+- `scripts/compliance/emit-retention-policy.mjs` + tests.
+- `scripts/compliance/emit-sub-processors.mjs` + tests.
+- `scripts/compliance/emit-all.mjs`.
+- Root `package.json` script entries.
+- Initial `compliance/*.yml` files committed.
+
+## Out of scope
+
+- Pre-commit hook wiring (Story 07).
+- CI integration (Story 07).
+- `compliance/sub-processors.manual.yml` — consumer-authored; generator handles its absence gracefully.
+
+## Tasks
+
+- [x] Add `scripts/compliance/emit-data-map.mjs` + unit tests + `compliance:data-map` root package script — walks Payload collections, applies auth PII defaults and `authPii` overrides, deterministic YAML output, `--check` and `--print` modes — all gates pass on this commit.
+- [x] Add `scripts/compliance/emit-retention-policy.mjs` + unit tests + `compliance:retention-policy` root package script — validates `purgeSchedule` on every collection, deterministic YAML output, `--check` and `--print` modes — all gates pass on this commit.
+- [x] Add `scripts/compliance/emit-sub-processors.mjs` + unit tests + `compliance:sub-processors` root package script — parses `is-sub-processor` discriminated union from library traces, merges manual entries with `source: manual` flag, sorted deterministic YAML output, `--check` and `--print` modes — all gates pass on this commit.
+- [x] Add `scripts/compliance/emit-all.mjs` orchestrator + `compliance:emit-all` root package script, run `pnpm compliance:emit-all` to produce and commit initial `compliance/data-map.yml`, `compliance/retention-policy.yml`, and `compliance/sub-processors.yml` — all gates pass on this commit.