// tools/design-schema/privacy-audit.ts — SPEC-030 privacy audit field injection
/**
 * SPEC-030: Adds privacy audit fields to tables when PII is detected in spec.
 * Injects: deleted_at, data_owner_id, retention_expires_at (created_at/updated_at
 * are already added by generateTables).
 */
export function injectPrivacyAuditFields(tables, engine) {
    const PRIVACY_AUDIT_FIELDS = [
        {
            name: 'deleted_at',
            type: 'timestamp',
            nullable: true,
            default: null,
            comment: 'Soft delete timestamp (SPEC-030 privacy audit)',
        },
        {
            name: 'data_owner_id',
            type: engine === 'mongodb' ? 'ObjectId' : 'uuid',
            nullable: true,
            default: null,
            comment: 'ID of the data subject (user whose data this is) — required for GDPR right to erasure',
        },
        {
            name: 'retention_expires_at',
            type: 'timestamp',
            nullable: true,
            default: null,
            comment: 'When this record must be deleted or anonymized per retention policy (SPEC-030)',
        },
    ];
    for (const table of tables) {
        const existingNames = new Set(table.columns.map((c) => c.name));
        for (const field of PRIVACY_AUDIT_FIELDS) {
            if (!existingNames.has(field.name)) {
                table.columns.push({ ...field });
            }
        }
    }
}
//# sourceMappingURL=privacy-audit.js.map