feat(cli): pull per-workflow deletion dependencies into transcend.yml

.changeset/wal-10452-pull-per-workflow-deletion-dependencies.md

@@ -0,0 +1,8 @@
+---
+"@transcend-io/cli": minor
+"@transcend-io/sdk": minor
+---
+
+`transcend inventory pull` now writes per-workflow deletion dependencies into `transcend.yml`. Global-only configs stay as a list of titles; once any override exists, the whole field is written as objects. Overrides on workflows without an internal name are skipped with a warning, since `transcend.yml` references workflows by internal name.
+
+`DataSiloEnriched` gains `dependedOnDataSilosPerWorkflow`.

packages/cli/src/lib/graphql/buildDeletionDependencies.ts

@@ -0,0 +1,46 @@
+import type { DataSiloEnriched } from '@transcend-io/sdk';
+
+import type { DataSiloInput } from '../../codecs.js';
+
+/**
+ * Build the `deletion-dependencies` entries for a data silo being pulled into transcend.yml.
+ *
+ * With no per-workflow overrides, global dependencies stay as a list of titles so existing
+ * configurations round-trip unchanged. When overrides exist, the whole field is a list of
+ * objects (`{ titles }` for global, `{ workflow, titles }` for each override).
+ *
+ * @param dataSilo - The data silo being pulled
+ * @returns The `deletion-dependencies` field, or an empty object when there is nothing to write
+ */
+export function buildDeletionDependenciesInput(
+  dataSilo: Pick<DataSiloEnriched, 'dependentDataSilos' | 'dependedOnDataSilosPerWorkflow'>,
+): Pick<DataSiloInput, 'deletion-dependencies'> {
+  const { dependentDataSilos, dependedOnDataSilosPerWorkflow } = dataSilo;
+
+  const globalTitles = dependentDataSilos.map(({ title }) => title);
+
+  const workflowOverrides = dependedOnDataSilosPerWorkflow.map(
+    ({ workflowInternalName, dependedOnDataSilos }) => ({
+      workflow: workflowInternalName,
+      titles: dependedOnDataSilos.map(({ title }) => title),
+    }),
+  );
+
+  // If there are no global or workflow dependencies, return an empty object
+  if (globalTitles.length === 0 && workflowOverrides.length === 0) {
+    return {};
+  }
+
+  // If there are no workflow overrides, return the global titles as string[], to keep legacy behavior
+  if (workflowOverrides.length === 0) {
+    return { 'deletion-dependencies': globalTitles };
+  }
+
+  // If there are workflow overrides, return a list of objects
+  return {
+    'deletion-dependencies': [
+      ...(globalTitles.length > 0 ? [{ titles: globalTitles }] : []),
+      ...workflowOverrides,
+    ],
+  };
+}

packages/cli/src/lib/graphql/pullTranscendConfiguration.ts

@@ -95,6 +95,7 @@ import {
 } from '../../codecs.js';
 import { TranscendPullResource } from '../../enums.js';
 import { logger } from '../../logger.js';
+import { buildDeletionDependenciesInput } from './buildDeletionDependencies.js';
 import { fetchAllAssessmentTemplates } from './fetchAllAssessmentTemplates.js';
 
 export const DEFAULT_TRANSCEND_PULL_RESOURCES = [
@@ -1519,6 +1520,7 @@ export async function pullTranscendConfiguration(
           notifyEmailAddress,
           identifiers,
           dependentDataSilos,
+          dependedOnDataSilosPerWorkflow,
           owners,
           country,
           countrySubDivision,
@@ -1548,11 +1550,10 @@ export async function pullTranscendConfiguration(
         'identity-keys': identifiers
           .filter(({ isConnected }) => isConnected)
           .map(({ name }) => name),
-        ...(dependentDataSilos.length > 0
-          ? {
-              'deletion-dependencies': dependentDataSilos.map(({ title }) => title),
-            }
-          : {}),
+        ...buildDeletionDependenciesInput({
+          dependentDataSilos,
+          dependedOnDataSilosPerWorkflow,
+        }),
         ...(owners.length > 0 ? { owners: owners.map(({ email }) => email) } : {}),
         ...(teams.length > 0 ? { teams: teams.map(({ name }) => name) } : {}),
         ...(discoveredBy.length > 0

packages/cli/src/lib/tests/buildDeletionDependencies.test.ts

@@ -0,0 +1,80 @@
+import { expect, describe, it } from 'vitest';
+
+import { buildDeletionDependenciesInput } from '../graphql/buildDeletionDependencies.js';
+
+describe('buildDeletionDependenciesInput', () => {
+  it('omits the field when there are no dependencies', () => {
+    expect(
+      buildDeletionDependenciesInput({
+        dependentDataSilos: [],
+        dependedOnDataSilosPerWorkflow: [],
+      }),
+    ).to.deep.equal({});
+  });
+
+  it('writes global dependencies as the string shorthand', () => {
+    expect(
+      buildDeletionDependenciesInput({
+        dependentDataSilos: [{ title: 'Identity Service' }],
+        dependedOnDataSilosPerWorkflow: [],
+      }),
+    ).to.deep.equal({ 'deletion-dependencies': ['Identity Service'] });
+  });
+
+  it('writes workflow overrides as a full object list', () => {
+    expect(
+      buildDeletionDependenciesInput({
+        dependentDataSilos: [{ title: 'Identity Service' }],
+        dependedOnDataSilosPerWorkflow: [
+          {
+            workflowConfigId: 'wf-gdpr',
+            workflowInternalName: 'GDPR Erasure',
+            dependedOnDataSilos: [{ title: 'Identity Service' }, { title: 'CRM Warehouse' }],
+          },
+        ],
+      }),
+    ).to.deep.equal({
+      'deletion-dependencies': [
+        { titles: ['Identity Service'] },
+        { workflow: 'GDPR Erasure', titles: ['Identity Service', 'CRM Warehouse'] },
+      ],
+    });
+  });
+
+  it('keeps an explicit empty override distinguishable from an absent one', () => {
+    expect(
+      buildDeletionDependenciesInput({
+        dependentDataSilos: [{ title: 'Identity Service' }],
+        dependedOnDataSilosPerWorkflow: [
+          {
+            workflowConfigId: 'wf-gdpr',
+            workflowInternalName: 'GDPR Erasure',
+            dependedOnDataSilos: [],
+          },
+        ],
+      }),
+    ).to.deep.equal({
+      'deletion-dependencies': [
+        { titles: ['Identity Service'] },
+        { workflow: 'GDPR Erasure', titles: [] },
+      ],
+    });
+  });
+
+  it('omits the global object when only workflow overrides are present', () => {
+    expect(
+      buildDeletionDependenciesInput({
+        dependentDataSilos: [],
+        dependedOnDataSilosPerWorkflow: [
+          {
+            workflowConfigId: 'wf-gdpr',
+            workflowInternalName: 'GDPR Erasure',
+            dependedOnDataSilos: [{ title: 'Identity Service' }],
+          },
+        ],
+      }),
+    ).to.deep.equal({
+      'deletion-dependencies': [{ workflow: 'GDPR Erasure', titles: ['Identity Service'] }],
+    });
+  });
+});

packages/sdk/src/data-inventory/fetchEnrichedDataSilos.ts

@@ -46,11 +46,26 @@ export interface DataSiloEnriched {
     /** True if identifier is wired */
     isConnected: boolean;
   }[];
-  /** Dependent data silos */
+  /** Dependent data silos that apply to every erasure workflow */
   dependentDataSilos: {
     /** Title of silo */
     title: string;
   }[];
+  /**
+   * Dependent data silos for the erasure workflows that override the global configuration.
+   * An entry with an empty list is a workflow that runs this data silo with no dependencies.
+   */
+  dependedOnDataSilosPerWorkflow: {
+    /** ID of the workflow config the override applies to */
+    workflowConfigId: string;
+    /** Internal name of the workflow config; used as the transcend.yml workflow key */
+    workflowInternalName: string;
+    /** Silos depended on within that workflow */
+    dependedOnDataSilos: {
+      /** Title of silo */
+      title: string;
+    }[];
+  }[];
   /** Silo owners */
   owners: {
     /** Email owners */

packages/sdk/src/data-inventory/gqls/dataSilo.ts

@@ -82,6 +82,13 @@ export const DATA_SILOS_ENRICHED = gql`
         dependentDataSilos {
           title
         }
+        dependedOnDataSilosPerWorkflow {
+          workflowConfigId
+          workflowInternalName
+          dependedOnDataSilos {
+            title
+          }
+        }
         owners {
           email
         }