@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/data-lifecycle/model.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DATA_LIFECYCLE_HOLD_PURPOSES = exports.DATA_LIFECYCLE_DELETION_METHODS = exports.DATA_LIFECYCLE_RETENTION_TRIGGERS = exports.DATA_LIFECYCLE_PROVENANCE_KINDS = exports.DATA_LIFECYCLE_COPY_KINDS = exports.DATA_LIFECYCLE_STORE_KINDS = exports.DATA_CLASSIFICATIONS = exports.DATA_LIFECYCLE_DESCRIPTOR_SCHEMA_VERSION = exports.DATA_LIFECYCLE_DESCRIPTOR_KIND = void 0;
+exports.compareDataClassifications = compareDataClassifications;
+exports.highestDataClassification = highestDataClassification;
+exports.DATA_LIFECYCLE_DESCRIPTOR_KIND = 'ebk-data-lifecycle-policy';
+exports.DATA_LIFECYCLE_DESCRIPTOR_SCHEMA_VERSION = 1;
+exports.DATA_CLASSIFICATIONS = [
+    'public',
+    'internal',
+    'confidential',
+    'regulated',
+];
+exports.DATA_LIFECYCLE_STORE_KINDS = [
+    'database',
+    'object-store',
+    'cache',
+    'search',
+    'audit',
+    'log',
+    'trace',
+    'event-archive',
+    'queue',
+    'dlq',
+    'browser',
+    'client',
+    'export',
+    'backup',
+    'test-fixture',
+];
+exports.DATA_LIFECYCLE_COPY_KINDS = [
+    'index',
+    'materialized-view',
+    'cache',
+    'search',
+    'event',
+    'queue',
+    'dlq',
+    'replay-archive',
+    'log',
+    'trace',
+    'metric',
+    'browser-cookie',
+    'browser-storage',
+    'client-cache',
+    'export',
+    'backup',
+    'test-fixture',
+    'derived',
+    'downstream',
+];
+exports.DATA_LIFECYCLE_PROVENANCE_KINDS = [
+    'subject',
+    'operator',
+    'product-agent',
+    'slice',
+    'external-provider',
+    'derived',
+];
+exports.DATA_LIFECYCLE_RETENTION_TRIGGERS = [
+    'collection',
+    'last-activity',
+    'contract-end',
+    'event-completion',
+    'copy-created',
+];
+exports.DATA_LIFECYCLE_DELETION_METHODS = [
+    'hard-delete',
+    'lifecycle-expiry',
+    'cryptographic-erasure',
+    'tombstone-then-delete',
+];
+exports.DATA_LIFECYCLE_HOLD_PURPOSES = [
+    'legal',
+    'security',
+    'fraud',
+    'support',
+    'incident',
+];
+const CLASSIFICATION_RANK = {
+    public: 0,
+    internal: 1,
+    confidential: 2,
+    regulated: 3,
+};
+function compareDataClassifications(left, right) {
+    return CLASSIFICATION_RANK[left] - CLASSIFICATION_RANK[right];
+}
+function highestDataClassification(values) {
+    if (values.length === 0) {
+        throw new Error('At least one declared classification is required to derive a container classification.');
+    }
+    return values.reduce((highest, value) => compareDataClassifications(value, highest) > 0 ? value : highest);
+}
+//# sourceMappingURL=model.js.map

package/src/data-lifecycle/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../packages/nx/src/data-lifecycle/model.ts"],"names":[],"mappings":";;;AA2RA,gEAKC;AAED,8DAWC;AA7SY,QAAA,8BAA8B,GACzC,2BAAoC,CAAC;AAC1B,QAAA,wCAAwC,GAAG,CAAU,CAAC;AAEtD,QAAA,oBAAoB,GAAG;IAClC,QAAQ;IACR,UAAU;IACV,cAAc;IACd,WAAW;CACH,CAAC;AAIE,QAAA,0BAA0B,GAAG;IACxC,UAAU;IACV,cAAc;IACd,OAAO;IACP,QAAQ;IACR,OAAO;IACP,KAAK;IACL,OAAO;IACP,eAAe;IACf,OAAO;IACP,KAAK;IACL,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,cAAc;CACN,CAAC;AAKE,QAAA,yBAAyB,GAAG;IACvC,OAAO;IACP,mBAAmB;IACnB,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,KAAK;IACL,gBAAgB;IAChB,KAAK;IACL,OAAO;IACP,QAAQ;IACR,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,SAAS;IACT,YAAY;CACJ,CAAC;AAIE,QAAA,+BAA+B,GAAG;IAC7C,SAAS;IACT,UAAU;IACV,eAAe;IACf,OAAO;IACP,mBAAmB;IACnB,SAAS;CACD,CAAC;AAKE,QAAA,iCAAiC,GAAG;IAC/C,YAAY;IACZ,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,cAAc;CACN,CAAC;AAKE,QAAA,+BAA+B,GAAG;IAC7C,aAAa;IACb,kBAAkB;IAClB,uBAAuB;IACvB,uBAAuB;CACf,CAAC;AAuIE,QAAA,4BAA4B,GAAG;IAC1C,OAAO;IACP,UAAU;IACV,OAAO;IACP,SAAS;IACT,UAAU;CACF,CAAC;AAiDX,MAAM,mBAAmB,GAAiD;IACxE,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,CAAC;IACX,YAAY,EAAE,CAAC;IACf,SAAS,EAAE,CAAC;CACb,CAAC;AAEF,SAAgB,0BAA0B,CACxC,IAAwB,EACxB,KAAyB;IAEzB,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAgB,yBAAyB,CACvC,MAAqC;IAErC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACtC,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CACjE,CAAC;AACJ,CAAC"}

package/src/data-lifecycle/sensitive-artifacts.d.ts

@@ -0,0 +1,28 @@
+export declare const DATA_LIFECYCLE_ARTIFACT_MAX_BYTES: number;
+export type DataLifecycleArtifactProvenance = 'synthetic' | 'sanitized-metadata' | 'production-derived' | 'unknown';
+export type DataLifecycleArtifactSurface = 'source' | 'fixture' | 'ci-artifact' | 'evidence';
+export type DataLifecycleArtifactDetection = 'artifact-contract-invalid' | 'artifact-too-large' | 'binary-uninspected' | 'credential' | 'database-dump' | 'personal-data' | 'production-derived-data' | 'production-export' | 'protected-subject-identifier' | 'unproven-synthetic-origin';
+export interface DataLifecycleArtifactInspection {
+    detections: readonly DataLifecycleArtifactDetection[];
+    safe: boolean;
+}
+export declare class DataLifecycleArtifactError extends Error {
+    readonly detections: readonly DataLifecycleArtifactDetection[];
+    constructor(detections: readonly DataLifecycleArtifactDetection[]);
+}
+/**
+ * Pattern checks are a negative guard, not proof that classification is
+ * complete. Provenance must still establish synthetic or sanitized input.
+ */
+export declare function inspectDataLifecycleArtifact(options: {
+    contents: string | Uint8Array;
+    path?: string;
+    provenance: DataLifecycleArtifactProvenance;
+    surface: DataLifecycleArtifactSurface;
+}): DataLifecycleArtifactInspection;
+export declare function requireSafeDataLifecycleArtifact(options: {
+    contents: string | Uint8Array;
+    path?: string;
+    provenance: DataLifecycleArtifactProvenance;
+    surface: DataLifecycleArtifactSurface;
+}): DataLifecycleArtifactInspection;

package/src/data-lifecycle/sensitive-artifacts.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataLifecycleArtifactError = exports.DATA_LIFECYCLE_ARTIFACT_MAX_BYTES = void 0;
+exports.inspectDataLifecycleArtifact = inspectDataLifecycleArtifact;
+exports.requireSafeDataLifecycleArtifact = requireSafeDataLifecycleArtifact;
+const sensitive_patterns_1 = require("@empire-builder-kit/runtime/sensitive-patterns");
+exports.DATA_LIFECYCLE_ARTIFACT_MAX_BYTES = 1024 * 1024;
+class DataLifecycleArtifactError extends Error {
+    detections;
+    constructor(detections) {
+        super(`Data lifecycle artifact is prohibited: ${detections.join(', ') || 'unknown sensitive content'}.`);
+        this.detections = detections;
+        this.name = 'DataLifecycleArtifactError';
+    }
+}
+exports.DataLifecycleArtifactError = DataLifecycleArtifactError;
+const CREDENTIAL_PATTERNS = [
+    ...sensitive_patterns_1.CREDENTIAL_SHAPE_DEFINITIONS.map(({ pattern }) => pattern),
+];
+const DATABASE_DUMP_PATTERNS = [
+    /--\s*(?:PostgreSQL|MySQL) database dump/i,
+    /\bCOPY\s+[A-Za-z_][A-Za-z0-9_."]*\s*\([^)]*\)\s+FROM\s+stdin\s*;/i,
+    /\bpg_dump\b.*\b(?:production|prod)\b/i,
+];
+const PRODUCTION_EXPORT_PATTERNS = [
+    /\b(?:production|prod)\b.{0,40}\b(?:export|snapshot|dump|backup)\b/i,
+    /\b(?:export|snapshot|dump|backup)\b.{0,40}\b(?:production|prod)\b/i,
+    /\benvironment\s*[:=]\s*["']?production\b/i,
+];
+const PROTECTED_SUBJECT_PATTERNS = [
+    /["']?(?:customerId|userId|subjectId|accountId)["']?\s*[:=]\s*["']?(?!synthetic[-_:]|test[-_:]|fixture[-_:]|[a-f0-9]{32,}\b)[A-Za-z0-9][A-Za-z0-9._:@-]{7,}/i,
+];
+const DIRECT_PERSONAL_PATTERNS = [
+    /\b\d{3}-\d{2}-\d{4}\b/,
+    /["']?(?:ssn|socialSecurityNumber|nationalId|dateOfBirth)["']?\s*[:=]\s*["']?(?!\[?redacted\]?|removed\b|synthetic\b)[^"',}\s]{4,}/i,
+    /\b(?:\+?1[-. (]*)?(?:\d{3}[-. )]*)\d{3}[-. ]*\d{4}\b/,
+];
+const EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@([A-Z0-9.-]+\.[A-Z]{2,})\b/gi;
+const SAFE_EMAIL_DOMAINS = new Set([
+    'example.com',
+    'example.net',
+    'example.org',
+    'example.test',
+    'localhost.test',
+]);
+function hasPersonalEmail(value) {
+    EMAIL_PATTERN.lastIndex = 0;
+    for (const match of value.matchAll(EMAIL_PATTERN)) {
+        const domain = match[1]?.toLowerCase();
+        const address = match[0].toLowerCase();
+        if (domain &&
+            !SAFE_EMAIL_DOMAINS.has(domain) &&
+            !address.includes('synthetic') &&
+            !address.includes('fixture')) {
+            return true;
+        }
+    }
+    return false;
+}
+function hasMatch(value, patterns) {
+    return patterns.some((pattern) => pattern.test(value));
+}
+function sortedDetections(values) {
+    return [...new Set(values)].sort();
+}
+/**
+ * Pattern checks are a negative guard, not proof that classification is
+ * complete. Provenance must still establish synthetic or sanitized input.
+ */
+function inspectDataLifecycleArtifact(options) {
+    const allowedProvenance = [
+        'synthetic',
+        'sanitized-metadata',
+        'production-derived',
+        'unknown',
+    ];
+    const allowedSurfaces = [
+        'source',
+        'fixture',
+        'ci-artifact',
+        'evidence',
+    ];
+    const detections = [];
+    const contents = options.contents;
+    if (typeof contents !== 'string' && !(contents instanceof Uint8Array)) {
+        return { detections: ['artifact-contract-invalid'], safe: false };
+    }
+    const bytes = typeof contents === 'string'
+        ? Buffer.byteLength(contents, 'utf8')
+        : contents.byteLength;
+    if (!allowedProvenance.includes(options.provenance)) {
+        detections.push('artifact-contract-invalid');
+    }
+    else if (options.provenance === 'production-derived') {
+        detections.push('production-derived-data');
+    }
+    else if (options.provenance === 'unknown') {
+        detections.push('unproven-synthetic-origin');
+    }
+    if (!allowedSurfaces.includes(options.surface)) {
+        detections.push('artifact-contract-invalid');
+    }
+    if (options.path !== undefined &&
+        (typeof options.path !== 'string' ||
+            options.path.length === 0 ||
+            Buffer.byteLength(options.path, 'utf8') > 1_024)) {
+        detections.push('artifact-contract-invalid');
+    }
+    if (bytes > exports.DATA_LIFECYCLE_ARTIFACT_MAX_BYTES) {
+        detections.push('artifact-too-large');
+    }
+    if (typeof contents !== 'string') {
+        detections.push('binary-uninspected');
+        const result = sortedDetections(detections);
+        return { detections: result, safe: false };
+    }
+    if (bytes <= exports.DATA_LIFECYCLE_ARTIFACT_MAX_BYTES) {
+        const inspected = `${options.path ?? ''}\n${contents}`;
+        if (hasMatch(inspected, CREDENTIAL_PATTERNS)) {
+            detections.push('credential');
+        }
+        if (hasMatch(inspected, DATABASE_DUMP_PATTERNS)) {
+            detections.push('database-dump');
+        }
+        if (hasPersonalEmail(inspected) ||
+            hasMatch(inspected, DIRECT_PERSONAL_PATTERNS)) {
+            detections.push('personal-data');
+        }
+        if (hasMatch(inspected, PRODUCTION_EXPORT_PATTERNS)) {
+            detections.push('production-export');
+        }
+        if (hasMatch(inspected, PROTECTED_SUBJECT_PATTERNS)) {
+            detections.push('protected-subject-identifier');
+        }
+    }
+    const result = sortedDetections(detections);
+    return { detections: result, safe: result.length === 0 };
+}
+function requireSafeDataLifecycleArtifact(options) {
+    const inspection = inspectDataLifecycleArtifact(options);
+    if (!inspection.safe) {
+        throw new DataLifecycleArtifactError(inspection.detections);
+    }
+    return inspection;
+}
+//# sourceMappingURL=sensitive-artifacts.js.map

package/src/data-lifecycle/sensitive-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-artifacts.js","sourceRoot":"","sources":["../../../../../packages/nx/src/data-lifecycle/sensitive-artifacts.ts"],"names":[],"mappings":";;;AAsGA,oEA8EC;AAED,4EAWC;AAjMD,uFAA8F;AAEjF,QAAA,iCAAiC,GAAG,IAAI,GAAG,IAAI,CAAC;AAyB7D,MAAa,0BAA2B,SAAQ,KAAK;IAC9B;IAArB,YAAqB,UAAqD;QACxE,KAAK,CACH,0CAA0C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2BAA2B,GAAG,CAClG,CAAC;QAHiB,eAAU,GAAV,UAAU,CAA2C;QAIxE,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAPD,gEAOC;AAED,MAAM,mBAAmB,GAAsB;IAC7C,GAAG,iDAA4B,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC;CAC9D,CAAC;AAEF,MAAM,sBAAsB,GAAsB;IAChD,0CAA0C;IAC1C,mEAAmE;IACnE,uCAAuC;CACxC,CAAC;AAEF,MAAM,0BAA0B,GAAsB;IACpD,oEAAoE;IACpE,oEAAoE;IACpE,2CAA2C;CAC5C,CAAC;AAEF,MAAM,0BAA0B,GAAsB;IACpD,6JAA6J;CAC9J,CAAC;AAEF,MAAM,wBAAwB,GAAsB;IAClD,uBAAuB;IACvB,oIAAoI;IACpI,sDAAsD;CACvD,CAAC;AAEF,MAAM,aAAa,GAAG,+CAA+C,CAAC;AACtE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;IACd,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,KAAa;IACrC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,IACE,MAAM;YACN,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;YAC/B,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC9B,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,QAA2B;IAC1D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiD;IAEjD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAgB,4BAA4B,CAAC,OAK5C;IACC,MAAM,iBAAiB,GAA+C;QACpE,WAAW;QACX,oBAAoB;QACpB,oBAAoB;QACpB,SAAS;KACV,CAAC;IACF,MAAM,eAAe,GAA4C;QAC/D,QAAQ;QACR,SAAS;QACT,aAAa;QACb,UAAU;KACX,CAAC;IACF,MAAM,UAAU,GAAqC,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAY,OAAO,CAAC,QAAQ,CAAC;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,UAAU,EAAE,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GACT,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;QACrC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;IAE1B,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC5C,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IACE,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YACzB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,EAClD,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,GAAG,yCAAiC,EAAE,CAAC;QAC9C,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,IAAI,yCAAiC,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACvD,IAAI,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC,EAAE,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IACE,gBAAgB,CAAC,SAAS,CAAC;YAC3B,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAC7C,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,CAAC;YACpD,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,CAAC;YACpD,UAAU,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAgB,gCAAgC,CAAC,OAKhD;IACC,MAAM,UAAU,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,0BAA0B,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/src/data-lifecycle/validation.d.ts

@@ -0,0 +1,32 @@
+import { type DataClassification, type DataLifecycleDescriptorV1 } from './model.js';
+export type DataLifecyclePolicyFailureClassification = 'data-lifecycle-descriptor-invalid' | 'data-lifecycle-policy-invalid' | 'data-lifecycle-production-location-missing' | 'data-lifecycle-production-location-unknown' | 'data-lifecycle-production-data-unclassified' | 'data-lifecycle-review-expired';
+export declare class DataLifecyclePolicyError extends Error {
+    readonly classification: DataLifecyclePolicyFailureClassification;
+    readonly pointer: string;
+    constructor(classification: DataLifecyclePolicyFailureClassification, pointer: string, message: string);
+}
+export interface ProductionDataObservation {
+    categoryId?: string;
+    classification?: DataClassification;
+    locationId: string;
+    surface: 'copy' | 'store';
+}
+export interface DataLifecycleProductionCoverage {
+    covered: true;
+    observations: number;
+    policyVersion: string;
+}
+export interface NormalizeDataLifecycleDescriptorOptions {
+    now?: string;
+}
+export declare function normalizeDataLifecycleDescriptor(value: unknown, options?: NormalizeDataLifecycleDescriptorOptions): DataLifecycleDescriptorV1;
+export declare function canonicalDataLifecycleDescriptorJson(value: unknown): string;
+export declare function digestDataLifecycleDescriptor(value: unknown): string;
+/**
+ * Production discovery is compared with the reviewed descriptor. Unknown
+ * locations and missing/mismatched classifications fail closed.
+ */
+export declare function requireProductionDataLifecycleCoverage(options: {
+    descriptor: unknown;
+    observations: readonly unknown[];
+}): DataLifecycleProductionCoverage;