@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/data-lifecycle/validation.js

@@ -0,0 +1,837 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataLifecyclePolicyError = void 0;
+exports.normalizeDataLifecycleDescriptor = normalizeDataLifecycleDescriptor;
+exports.canonicalDataLifecycleDescriptorJson = canonicalDataLifecycleDescriptorJson;
+exports.digestDataLifecycleDescriptor = digestDataLifecycleDescriptor;
+exports.requireProductionDataLifecycleCoverage = requireProductionDataLifecycleCoverage;
+const node_crypto_1 = require("node:crypto");
+const model_js_1 = require("./model.js");
+class DataLifecyclePolicyError extends Error {
+    classification;
+    pointer;
+    constructor(classification, pointer, message) {
+        super(`${pointer}: ${message}`);
+        this.classification = classification;
+        this.pointer = pointer;
+        this.name = 'DataLifecyclePolicyError';
+    }
+}
+exports.DataLifecyclePolicyError = DataLifecyclePolicyError;
+const ID_PATTERN = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+){0,15}$/;
+const SLICE_PATTERN = /^[a-z][a-z0-9-]{0,62}$/;
+const ACTION_PATTERN = /^[a-z][a-z0-9-]{0,62}:[a-z][a-z0-9-]{0,62}$/;
+const POLICY_VERSION_PATTERN = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
+const TOKEN_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/@#-]{0,255}$/;
+const REGION_PATTERN = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
+const MAX_TEXT_LENGTH = 512;
+const MAX_COLLECTION_LENGTH = 1_000;
+const MAX_RETENTION_DAYS = 36_500;
+function fail(pointer, message, classification = 'data-lifecycle-descriptor-invalid') {
+    throw new DataLifecyclePolicyError(classification, pointer, message);
+}
+function pointerToken(value) {
+    return value.replace(/~/g, '~0').replace(/\//g, '~1');
+}
+function requireRecord(value, pointer) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        fail(pointer, 'must be a plain object');
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        fail(pointer, 'must use a plain or null prototype');
+    }
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== 'string') {
+            fail(pointer, 'must not contain symbol keys');
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor?.enumerable ||
+            !Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+            fail(`${pointer}/${pointerToken(key)}`, 'must be an enumerable data field');
+        }
+    }
+    return value;
+}
+function requireKeys(value, pointer, required, optional = []) {
+    const allowed = new Set([...required, ...optional]);
+    for (const key of Object.keys(value)) {
+        if (!allowed.has(key)) {
+            fail(`${pointer}/${pointerToken(key)}`, 'is not a declared descriptor field');
+        }
+    }
+    for (const key of required) {
+        if (!Object.prototype.hasOwnProperty.call(value, key)) {
+            fail(`${pointer}/${pointerToken(key)}`, 'is required');
+        }
+    }
+}
+function requireString(value, pointer, options = {}) {
+    const containsControlCharacter = typeof value === 'string' &&
+        Array.from(value).some((character) => {
+            const codePoint = character.codePointAt(0) ?? 0;
+            return ((codePoint >= 0 && codePoint <= 0x1f) ||
+                (codePoint >= 0x7f && codePoint <= 0x9f) ||
+                codePoint === 0x2028 ||
+                codePoint === 0x2029);
+        });
+    if (typeof value !== 'string' ||
+        value.length === 0 ||
+        value.length > (options.maxLength ?? MAX_TEXT_LENGTH) ||
+        value.trim() !== value ||
+        containsControlCharacter ||
+        (options.pattern && !options.pattern.test(value))) {
+        fail(pointer, 'must be a bounded, normalized string');
+    }
+    return value;
+}
+function requireBoolean(value, pointer) {
+    if (typeof value !== 'boolean') {
+        fail(pointer, 'must be a boolean');
+    }
+    return value;
+}
+function requireLiteral(value, expected, pointer) {
+    if (value !== expected) {
+        fail(pointer, `must equal ${String(expected)}`);
+    }
+    return expected;
+}
+function requireEnum(value, allowed, pointer) {
+    if (typeof value !== 'string' || !allowed.includes(value)) {
+        fail(pointer, `must be one of ${allowed.join(', ')}`);
+    }
+    return value;
+}
+function requirePositiveInteger(value, pointer, maximum) {
+    if (typeof value !== 'number' ||
+        !Number.isSafeInteger(value) ||
+        value < 1 ||
+        value > maximum) {
+        fail(pointer, `must be an integer from 1 through ${maximum}`);
+    }
+    return value;
+}
+function requireArray(value, pointer, parse, options = {}) {
+    if (!Array.isArray(value) ||
+        value.length > MAX_COLLECTION_LENGTH ||
+        (!options.allowEmpty && value.length === 0)) {
+        fail(pointer, options.allowEmpty
+            ? `must be an array with at most ${MAX_COLLECTION_LENGTH} entries`
+            : `must contain from 1 through ${MAX_COLLECTION_LENGTH} entries`);
+    }
+    return value.map((entry, index) => parse(entry, `${pointer}/${index}`));
+}
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function sortedUniqueStrings(value, pointer, options = {}) {
+    const entries = requireArray(value, pointer, (entry, entryPointer) => requireString(entry, entryPointer, { pattern: options.pattern }), { allowEmpty: options.allowEmpty }).sort(compareStrings);
+    for (let index = 1; index < entries.length; index += 1) {
+        if (entries[index] === entries[index - 1]) {
+            fail(pointer, `contains duplicate value ${entries[index]}`);
+        }
+    }
+    return entries;
+}
+function requireTimestamp(value, pointer) {
+    const timestamp = requireString(value, pointer, { maxLength: 40 });
+    if (!Number.isFinite(Date.parse(timestamp)) ||
+        new Date(timestamp).toISOString() !== timestamp) {
+        fail(pointer, 'must be a canonical ISO-8601 timestamp');
+    }
+    return timestamp;
+}
+function parseRetention(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'deletionMethod',
+        'durationDays',
+        'reason',
+        'trigger',
+    ]);
+    return {
+        deletionMethod: requireEnum(record['deletionMethod'], model_js_1.DATA_LIFECYCLE_DELETION_METHODS, `${pointer}/deletionMethod`),
+        durationDays: requirePositiveInteger(record['durationDays'], `${pointer}/durationDays`, MAX_RETENTION_DAYS),
+        reason: requireString(record['reason'], `${pointer}/reason`),
+        trigger: requireEnum(record['trigger'], model_js_1.DATA_LIFECYCLE_RETENTION_TRIGGERS, `${pointer}/trigger`),
+    };
+}
+function parseRights(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'correction',
+        'deletion',
+        'export',
+        'rationale',
+    ]);
+    const decisions = ['supported', 'not-applicable'];
+    return {
+        correction: requireEnum(record['correction'], decisions, `${pointer}/correction`),
+        deletion: requireEnum(record['deletion'], decisions, `${pointer}/deletion`),
+        export: requireEnum(record['export'], decisions, `${pointer}/export`),
+        rationale: requireString(record['rationale'], `${pointer}/rationale`),
+    };
+}
+function parseIngress(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'authorizationAction',
+        'contractRef',
+        'validationRef',
+    ]);
+    return {
+        authorizationAction: requireString(record['authorizationAction'], `${pointer}/authorizationAction`, { pattern: ACTION_PATTERN }),
+        contractRef: requireString(record['contractRef'], `${pointer}/contractRef`, {
+            pattern: TOKEN_PATTERN,
+        }),
+        validationRef: requireString(record['validationRef'], `${pointer}/validationRef`, { pattern: TOKEN_PATTERN }),
+    };
+}
+function parseProvenance(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, ['kind', 'sourceRef']);
+    return {
+        kind: requireEnum(record['kind'], model_js_1.DATA_LIFECYCLE_PROVENANCE_KINDS, `${pointer}/kind`),
+        sourceRef: requireString(record['sourceRef'], `${pointer}/sourceRef`, {
+            pattern: TOKEN_PATTERN,
+        }),
+    };
+}
+function parseCategory(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'allowedUses',
+        'classification',
+        'description',
+        'evidenceRefs',
+        'id',
+        'ingress',
+        'owner',
+        'primaryStoreIds',
+        'provenance',
+        'purpose',
+        'rights',
+        'runbookRefs',
+        'sensitiveTypes',
+        'steward',
+        'subject',
+    ]);
+    const ingress = requireArray(record['ingress'], `${pointer}/ingress`, parseIngress, { allowEmpty: false }).sort((left, right) => compareStrings(left.contractRef, right.contractRef));
+    const provenance = requireArray(record['provenance'], `${pointer}/provenance`, parseProvenance).sort((left, right) => compareStrings(`${left.kind}\0${left.sourceRef}`, `${right.kind}\0${right.sourceRef}`));
+    return {
+        allowedUses: sortedUniqueStrings(record['allowedUses'], `${pointer}/allowedUses`, { pattern: TOKEN_PATTERN }),
+        classification: requireEnum(record['classification'], model_js_1.DATA_CLASSIFICATIONS, `${pointer}/classification`),
+        description: requireString(record['description'], `${pointer}/description`),
+        evidenceRefs: sortedUniqueStrings(record['evidenceRefs'], `${pointer}/evidenceRefs`, { allowEmpty: true, pattern: TOKEN_PATTERN }),
+        id: requireString(record['id'], `${pointer}/id`, { pattern: ID_PATTERN }),
+        ingress,
+        owner: requireString(record['owner'], `${pointer}/owner`, {
+            pattern: TOKEN_PATTERN,
+        }),
+        primaryStoreIds: sortedUniqueStrings(record['primaryStoreIds'], `${pointer}/primaryStoreIds`, { pattern: ID_PATTERN }),
+        provenance,
+        purpose: requireString(record['purpose'], `${pointer}/purpose`),
+        rights: parseRights(record['rights'], `${pointer}/rights`),
+        runbookRefs: sortedUniqueStrings(record['runbookRefs'], `${pointer}/runbookRefs`, { allowEmpty: true, pattern: TOKEN_PATTERN }),
+        sensitiveTypes: sortedUniqueStrings(record['sensitiveTypes'], `${pointer}/sensitiveTypes`, { allowEmpty: true, pattern: TOKEN_PATTERN }),
+        steward: requireString(record['steward'], `${pointer}/steward`, {
+            pattern: TOKEN_PATTERN,
+        }),
+        subject: requireString(record['subject'], `${pointer}/subject`),
+    };
+}
+function parseStore(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'accessPurposes',
+        'categoryIds',
+        'classification',
+        'encryption',
+        'id',
+        'kind',
+        'locationRef',
+        'owner',
+        'production',
+        'residency',
+        'retention',
+    ]);
+    const encryption = requireRecord(record['encryption'], `${pointer}/encryption`);
+    requireKeys(encryption, `${pointer}/encryption`, [
+        'atRest',
+        'inTransit',
+        'keyOwner',
+    ]);
+    return {
+        accessPurposes: sortedUniqueStrings(record['accessPurposes'], `${pointer}/accessPurposes`, { pattern: TOKEN_PATTERN }),
+        categoryIds: sortedUniqueStrings(record['categoryIds'], `${pointer}/categoryIds`, { pattern: ID_PATTERN }),
+        classification: requireEnum(record['classification'], model_js_1.DATA_CLASSIFICATIONS, `${pointer}/classification`),
+        encryption: {
+            atRest: requireLiteral(encryption['atRest'], 'required', `${pointer}/encryption/atRest`),
+            inTransit: requireLiteral(encryption['inTransit'], 'required', `${pointer}/encryption/inTransit`),
+            keyOwner: requireString(encryption['keyOwner'], `${pointer}/encryption/keyOwner`, { pattern: TOKEN_PATTERN }),
+        },
+        id: requireString(record['id'], `${pointer}/id`, { pattern: ID_PATTERN }),
+        kind: requireEnum(record['kind'], model_js_1.DATA_LIFECYCLE_STORE_KINDS, `${pointer}/kind`),
+        locationRef: requireString(record['locationRef'], `${pointer}/locationRef`, { pattern: TOKEN_PATTERN }),
+        owner: requireString(record['owner'], `${pointer}/owner`, {
+            pattern: TOKEN_PATTERN,
+        }),
+        production: requireBoolean(record['production'], `${pointer}/production`),
+        residency: sortedUniqueStrings(record['residency'], `${pointer}/residency`, { pattern: REGION_PATTERN }),
+        retention: parseRetention(record['retention'], `${pointer}/retention`),
+    };
+}
+function parseCopy(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'categoryIds',
+        'deletionPropagation',
+        'handling',
+        'id',
+        'kind',
+        'purpose',
+        'retention',
+        'sourceStoreIds',
+        'storeId',
+    ], ['recipient']);
+    const copy = {
+        categoryIds: sortedUniqueStrings(record['categoryIds'], `${pointer}/categoryIds`, { pattern: ID_PATTERN }),
+        deletionPropagation: requireEnum(record['deletionPropagation'], ['local', 'contract-event', 'recipient-owned'], `${pointer}/deletionPropagation`),
+        handling: requireEnum(record['handling'], ['raw', 'pseudonymous', 'redacted', 'aggregated'], `${pointer}/handling`),
+        id: requireString(record['id'], `${pointer}/id`, { pattern: ID_PATTERN }),
+        kind: requireEnum(record['kind'], model_js_1.DATA_LIFECYCLE_COPY_KINDS, `${pointer}/kind`),
+        purpose: requireString(record['purpose'], `${pointer}/purpose`),
+        retention: parseRetention(record['retention'], `${pointer}/retention`),
+        sourceStoreIds: sortedUniqueStrings(record['sourceStoreIds'], `${pointer}/sourceStoreIds`, { pattern: ID_PATTERN }),
+        storeId: requireString(record['storeId'], `${pointer}/storeId`, {
+            pattern: ID_PATTERN,
+        }),
+    };
+    if (Object.prototype.hasOwnProperty.call(record, 'recipient')) {
+        copy.recipient = requireString(record['recipient'], `${pointer}/recipient`, { pattern: TOKEN_PATTERN });
+    }
+    return copy;
+}
+function parseBackup(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'backupStoreId',
+        'categoryIds',
+        'developmentCopy',
+        'disasterRecoveryUse',
+        'id',
+        'restoreOnly',
+        'restorePlanId',
+        'retention',
+        'sourceStoreId',
+    ]);
+    return {
+        backupStoreId: requireString(record['backupStoreId'], `${pointer}/backupStoreId`, { pattern: ID_PATTERN }),
+        categoryIds: sortedUniqueStrings(record['categoryIds'], `${pointer}/categoryIds`, { pattern: ID_PATTERN }),
+        developmentCopy: requireLiteral(record['developmentCopy'], 'prohibited', `${pointer}/developmentCopy`),
+        disasterRecoveryUse: requireLiteral(record['disasterRecoveryUse'], 'only', `${pointer}/disasterRecoveryUse`),
+        id: requireString(record['id'], `${pointer}/id`, { pattern: ID_PATTERN }),
+        restoreOnly: requireLiteral(record['restoreOnly'], true, `${pointer}/restoreOnly`),
+        restorePlanId: requireString(record['restorePlanId'], `${pointer}/restorePlanId`, { pattern: ID_PATTERN }),
+        retention: parseRetention(record['retention'], `${pointer}/retention`),
+        sourceStoreId: requireString(record['sourceStoreId'], `${pointer}/sourceStoreId`, { pattern: ID_PATTERN }),
+    };
+}
+function parseRestorePlan(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'authorization',
+        'backupId',
+        'deletionCorrectionReplay',
+        'downstreamReconciliation',
+        'id',
+        'integrityValidation',
+        'isolatedTarget',
+        'retentionJobs',
+        'runbookRef',
+    ]);
+    return {
+        authorization: requireLiteral(record['authorization'], 'required', `${pointer}/authorization`),
+        backupId: requireString(record['backupId'], `${pointer}/backupId`, {
+            pattern: ID_PATTERN,
+        }),
+        deletionCorrectionReplay: requireLiteral(record['deletionCorrectionReplay'], 'required-before-service', `${pointer}/deletionCorrectionReplay`),
+        downstreamReconciliation: requireLiteral(record['downstreamReconciliation'], 'required-before-service', `${pointer}/downstreamReconciliation`),
+        id: requireString(record['id'], `${pointer}/id`, { pattern: ID_PATTERN }),
+        integrityValidation: requireLiteral(record['integrityValidation'], 'required', `${pointer}/integrityValidation`),
+        isolatedTarget: requireLiteral(record['isolatedTarget'], 'required', `${pointer}/isolatedTarget`),
+        retentionJobs: requireLiteral(record['retentionJobs'], 'required-before-service', `${pointer}/retentionJobs`),
+        runbookRef: requireString(record['runbookRef'], `${pointer}/runbookRef`, {
+            pattern: TOKEN_PATTERN,
+        }),
+    };
+}
+function parseLineageEndpoint(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, ['id', 'kind']);
+    return {
+        id: requireString(record['id'], `${pointer}/id`, { pattern: ID_PATTERN }),
+        kind: requireEnum(record['kind'], ['category', 'store', 'copy'], `${pointer}/kind`),
+    };
+}
+function parseLineage(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, ['categoryIds', 'from', 'id', 'minimization', 'purpose', 'to', 'transport'], ['recipient']);
+    const lineage = {
+        categoryIds: sortedUniqueStrings(record['categoryIds'], `${pointer}/categoryIds`, { pattern: ID_PATTERN }),
+        from: parseLineageEndpoint(record['from'], `${pointer}/from`),
+        id: requireString(record['id'], `${pointer}/id`, { pattern: ID_PATTERN }),
+        minimization: requireString(record['minimization'], `${pointer}/minimization`),
+        purpose: requireString(record['purpose'], `${pointer}/purpose`),
+        to: parseLineageEndpoint(record['to'], `${pointer}/to`),
+        transport: requireEnum(record['transport'], ['api', 'event', 'derived', 'backup', 'export'], `${pointer}/transport`),
+    };
+    if (Object.prototype.hasOwnProperty.call(record, 'recipient')) {
+        lineage.recipient = requireString(record['recipient'], `${pointer}/recipient`, { pattern: TOKEN_PATTERN });
+    }
+    return lineage;
+}
+function parseLedger(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'actions',
+        'backupIdsCovered',
+        'classification',
+        'keyMaterial',
+        'retention',
+        'storeId',
+    ]);
+    return {
+        actions: sortedUniqueStrings(record['actions'], `${pointer}/actions`).map((action, index) => requireEnum(action, ['correction', 'deletion'], `${pointer}/actions/${index}`)),
+        backupIdsCovered: sortedUniqueStrings(record['backupIdsCovered'], `${pointer}/backupIdsCovered`, { pattern: ID_PATTERN }),
+        classification: requireLiteral(record['classification'], 'confidential', `${pointer}/classification`),
+        keyMaterial: requireLiteral(record['keyMaterial'], 'pseudonymous-only', `${pointer}/keyMaterial`),
+        retention: parseRetention(record['retention'], `${pointer}/retention`),
+        storeId: requireString(record['storeId'], `${pointer}/storeId`, {
+            pattern: ID_PATTERN,
+        }),
+    };
+}
+function parseHold(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'categoryIds',
+        'effects',
+        'expiresAt',
+        'id',
+        'issuerRef',
+        'purpose',
+        'reviewAt',
+        'scopeRef',
+        'startsAt',
+        'status',
+    ], ['releasedAt']);
+    const status = requireEnum(record['status'], ['active', 'released'], `${pointer}/status`);
+    const hold = {
+        categoryIds: sortedUniqueStrings(record['categoryIds'], `${pointer}/categoryIds`, { pattern: ID_PATTERN }),
+        effects: sortedUniqueStrings(record['effects'], `${pointer}/effects`).map((effect, index) => requireEnum(effect, ['block-deletion', 'block-export'], `${pointer}/effects/${index}`)),
+        expiresAt: requireTimestamp(record['expiresAt'], `${pointer}/expiresAt`),
+        id: requireString(record['id'], `${pointer}/id`, { pattern: ID_PATTERN }),
+        issuerRef: requireString(record['issuerRef'], `${pointer}/issuerRef`, {
+            pattern: TOKEN_PATTERN,
+        }),
+        purpose: requireEnum(record['purpose'], model_js_1.DATA_LIFECYCLE_HOLD_PURPOSES, `${pointer}/purpose`),
+        reviewAt: requireTimestamp(record['reviewAt'], `${pointer}/reviewAt`),
+        scopeRef: requireString(record['scopeRef'], `${pointer}/scopeRef`, {
+            pattern: TOKEN_PATTERN,
+        }),
+        startsAt: requireTimestamp(record['startsAt'], `${pointer}/startsAt`),
+        status,
+    };
+    if (Object.prototype.hasOwnProperty.call(record, 'releasedAt')) {
+        hold.releasedAt = requireTimestamp(record['releasedAt'], `${pointer}/releasedAt`);
+    }
+    if (status === 'released' && !hold.releasedAt) {
+        fail(`${pointer}/releasedAt`, 'is required for a released hold');
+    }
+    if (status === 'active' && hold.releasedAt) {
+        fail(`${pointer}/releasedAt`, 'must be absent for an active hold');
+    }
+    if (Date.parse(hold.startsAt) >= Date.parse(hold.reviewAt) ||
+        Date.parse(hold.reviewAt) > Date.parse(hold.expiresAt) ||
+        (hold.releasedAt &&
+            (Date.parse(hold.releasedAt) < Date.parse(hold.startsAt) ||
+                Date.parse(hold.releasedAt) > Date.parse(hold.expiresAt)))) {
+        fail(pointer, 'hold timestamps must form a bounded chronological interval');
+    }
+    return hold;
+}
+function parseGovernance(value, pointer) {
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, [
+        'owner',
+        'reviewDueAt',
+        'reviewedAt',
+        'steward',
+    ]);
+    const governance = {
+        owner: requireString(record['owner'], `${pointer}/owner`, {
+            pattern: TOKEN_PATTERN,
+        }),
+        reviewDueAt: requireTimestamp(record['reviewDueAt'], `${pointer}/reviewDueAt`),
+        reviewedAt: requireTimestamp(record['reviewedAt'], `${pointer}/reviewedAt`),
+        steward: requireString(record['steward'], `${pointer}/steward`, {
+            pattern: TOKEN_PATTERN,
+        }),
+    };
+    if (Date.parse(governance.reviewedAt) >= Date.parse(governance.reviewDueAt)) {
+        fail(pointer, 'reviewDueAt must be later than reviewedAt');
+    }
+    return governance;
+}
+function requireUniqueIds(values, pointer) {
+    const seen = new Set();
+    values.forEach((entry, index) => {
+        if (seen.has(entry.id)) {
+            fail(`${pointer}/${index}/id`, `duplicates ${entry.id}`);
+        }
+        seen.add(entry.id);
+    });
+}
+function requireReferences(values, known, pointer, label) {
+    values.forEach((value, index) => {
+        if (!known.has(value)) {
+            fail(`${pointer}/${index}`, `references unknown ${label} ${value}`);
+        }
+    });
+}
+function requireLineageEndpoint(endpoint, pointer, ids) {
+    const known = endpoint.kind === 'category'
+        ? ids.categories
+        : endpoint.kind === 'copy'
+            ? ids.copies
+            : ids.stores;
+    if (!known.has(endpoint.id)) {
+        fail(`${pointer}/id`, `references unknown ${endpoint.kind} ${endpoint.id}`);
+    }
+}
+function sameRetentionControl(left, right) {
+    return (left.deletionMethod === right.deletionMethod &&
+        left.durationDays === right.durationDays &&
+        left.trigger === right.trigger);
+}
+function copyRetentionFitsStoreEnvelope(copy, store) {
+    return (copy.deletionMethod === store.deletionMethod &&
+        copy.durationDays <= store.durationDays);
+}
+function validateRelationships(descriptor) {
+    requireUniqueIds(descriptor.categories, '/categories');
+    requireUniqueIds(descriptor.stores, '/stores');
+    requireUniqueIds(descriptor.copies, '/copies');
+    requireUniqueIds(descriptor.backups, '/backups');
+    requireUniqueIds(descriptor.restorePlans, '/restorePlans');
+    requireUniqueIds(descriptor.lineage, '/lineage');
+    requireUniqueIds(descriptor.holds, '/holds');
+    const categories = new Map(descriptor.categories.map((category) => [category.id, category]));
+    const stores = new Map(descriptor.stores.map((store) => [store.id, store]));
+    const copies = new Map(descriptor.copies.map((copy) => [copy.id, copy]));
+    const backups = new Map(descriptor.backups.map((backup) => [backup.id, backup]));
+    const restorePlans = new Map(descriptor.restorePlans.map((plan) => [plan.id, plan]));
+    const ids = {
+        categories: new Set(categories.keys()),
+        copies: new Set(copies.keys()),
+        stores: new Set(stores.keys()),
+    };
+    descriptor.categories.forEach((category, categoryIndex) => {
+        requireReferences(category.primaryStoreIds, ids.stores, `/categories/${categoryIndex}/primaryStoreIds`, 'store');
+        category.primaryStoreIds.forEach((storeId, storeIndex) => {
+            if (!stores.get(storeId)?.categoryIds.includes(category.id)) {
+                fail(`/categories/${categoryIndex}/primaryStoreIds/${storeIndex}`, `store ${storeId} does not declare category ${category.id}`, 'data-lifecycle-policy-invalid');
+            }
+        });
+    });
+    descriptor.stores.forEach((store, storeIndex) => {
+        requireReferences(store.categoryIds, ids.categories, `/stores/${storeIndex}/categoryIds`, 'category');
+        const inherited = (0, model_js_1.highestDataClassification)(store.categoryIds.map((categoryId) => {
+            const category = categories.get(categoryId);
+            if (!category) {
+                fail(`/stores/${storeIndex}/categoryIds`, `references unknown category ${categoryId}`);
+            }
+            return category.classification;
+        }));
+        if ((0, model_js_1.compareDataClassifications)(store.classification, inherited) < 0) {
+            fail(`/stores/${storeIndex}/classification`, `must be at least ${inherited}, the highest contained classification`, 'data-lifecycle-policy-invalid');
+        }
+    });
+    descriptor.copies.forEach((copy, copyIndex) => {
+        requireReferences(copy.categoryIds, ids.categories, `/copies/${copyIndex}/categoryIds`, 'category');
+        requireReferences(copy.sourceStoreIds, ids.stores, `/copies/${copyIndex}/sourceStoreIds`, 'store');
+        const sourceCategoryIds = new Set();
+        copy.sourceStoreIds.forEach((storeId, storeIndex) => {
+            const sourceStore = stores.get(storeId);
+            if (!sourceStore) {
+                fail(`/copies/${copyIndex}/sourceStoreIds/${storeIndex}`, `references unknown store ${storeId}`);
+            }
+            sourceStore.categoryIds.forEach((categoryId) => sourceCategoryIds.add(categoryId));
+            if (copy.kind === 'test-fixture' && sourceStore.production) {
+                fail(`/copies/${copyIndex}/sourceStoreIds/${storeIndex}`, 'synthetic test fixtures cannot derive from a production store', 'data-lifecycle-policy-invalid');
+            }
+        });
+        copy.categoryIds.forEach((categoryId) => {
+            if (!sourceCategoryIds.has(categoryId)) {
+                fail(`/copies/${copyIndex}/sourceStoreIds`, `declared source stores do not cover category ${categoryId}`, 'data-lifecycle-policy-invalid');
+            }
+        });
+        const destinationStore = stores.get(copy.storeId);
+        if (!destinationStore) {
+            fail(`/copies/${copyIndex}/storeId`, `references unknown store ${copy.storeId}`);
+        }
+        copy.categoryIds.forEach((categoryId, categoryIndex) => {
+            if (!destinationStore.categoryIds.includes(categoryId)) {
+                fail(`/copies/${copyIndex}/categoryIds/${categoryIndex}`, `destination store ${copy.storeId} does not declare category ${categoryId}`, 'data-lifecycle-policy-invalid');
+            }
+        });
+        if (!copyRetentionFitsStoreEnvelope(copy.retention, destinationStore.retention)) {
+            fail(`/copies/${copyIndex}/retention`, `must use the destination store ${copy.storeId}'s deletion method and not exceed its retention envelope`, 'data-lifecycle-policy-invalid');
+        }
+        const sensitive = copy.categoryIds.some((categoryId) => {
+            const category = categories.get(categoryId);
+            if (!category) {
+                fail(`/copies/${copyIndex}/categoryIds`, `references unknown category ${categoryId}`);
+            }
+            return (category.classification === 'confidential' ||
+                category.classification === 'regulated');
+        });
+        if (sensitive &&
+            ((copy.kind === 'metric' && copy.handling !== 'aggregated') ||
+                ((copy.kind === 'log' || copy.kind === 'trace') &&
+                    copy.handling !== 'redacted' &&
+                    copy.handling !== 'aggregated'))) {
+            fail(`/copies/${copyIndex}/handling`, 'confidential or regulated observability copies must be redacted or non-identifying aggregates', 'data-lifecycle-policy-invalid');
+        }
+        const isDownstream = copy.kind === 'downstream' ||
+            copy.deletionPropagation === 'recipient-owned';
+        if (isDownstream && !copy.recipient) {
+            fail(`/copies/${copyIndex}/recipient`, 'is required for a downstream or recipient-owned copy', 'data-lifecycle-policy-invalid');
+        }
+    });
+    descriptor.backups.forEach((backup, backupIndex) => {
+        requireReferences(backup.categoryIds, ids.categories, `/backups/${backupIndex}/categoryIds`, 'category');
+        if (!stores.has(backup.sourceStoreId)) {
+            fail(`/backups/${backupIndex}/sourceStoreId`, `references unknown store ${backup.sourceStoreId}`);
+        }
+        const backupStore = stores.get(backup.backupStoreId);
+        if (!backupStore || backupStore.kind !== 'backup') {
+            fail(`/backups/${backupIndex}/backupStoreId`, 'must reference a declared backup store', 'data-lifecycle-policy-invalid');
+        }
+        backup.categoryIds.forEach((categoryId, categoryIndex) => {
+            if (!backupStore.categoryIds.includes(categoryId)) {
+                fail(`/backups/${backupIndex}/categoryIds/${categoryIndex}`, `backup store ${backup.backupStoreId} does not declare category ${categoryId}`, 'data-lifecycle-policy-invalid');
+            }
+        });
+        if (!sameRetentionControl(backup.retention, backupStore.retention)) {
+            fail(`/backups/${backupIndex}/retention`, `must match backup store ${backup.backupStoreId}'s enforceable retention control`, 'data-lifecycle-policy-invalid');
+        }
+        const plan = restorePlans.get(backup.restorePlanId);
+        if (!plan || plan.backupId !== backup.id) {
+            fail(`/backups/${backupIndex}/restorePlanId`, 'must reference the restore plan for this backup', 'data-lifecycle-policy-invalid');
+        }
+    });
+    descriptor.restorePlans.forEach((plan, planIndex) => {
+        if (!backups.has(plan.backupId)) {
+            fail(`/restorePlans/${planIndex}/backupId`, `references unknown backup ${plan.backupId}`);
+        }
+    });
+    descriptor.lineage.forEach((edge, edgeIndex) => {
+        requireReferences(edge.categoryIds, ids.categories, `/lineage/${edgeIndex}/categoryIds`, 'category');
+        requireLineageEndpoint(edge.from, `/lineage/${edgeIndex}/from`, ids);
+        requireLineageEndpoint(edge.to, `/lineage/${edgeIndex}/to`, ids);
+        if ((edge.transport === 'api' || edge.transport === 'event') &&
+            !edge.recipient) {
+            fail(`/lineage/${edgeIndex}/recipient`, 'is required for API or event transfer lineage', 'data-lifecycle-policy-invalid');
+        }
+    });
+    descriptor.copies.forEach((copy, copyIndex) => {
+        if (!descriptor.lineage.some((edge) => edge.to.kind === 'copy' && edge.to.id === copy.id)) {
+            fail(`/copies/${copyIndex}/id`, `copy ${copy.id} has no incoming lineage`, 'data-lifecycle-policy-invalid');
+        }
+    });
+    descriptor.holds.forEach((hold, holdIndex) => {
+        requireReferences(hold.categoryIds, ids.categories, `/holds/${holdIndex}/categoryIds`, 'category');
+    });
+    const governedBackupIds = new Set();
+    for (const category of descriptor.categories) {
+        const needsLedger = category.rights.deletion === 'supported' ||
+            category.rights.correction === 'supported';
+        if (!needsLedger)
+            continue;
+        for (const backup of descriptor.backups) {
+            if (backup.categoryIds.includes(category.id)) {
+                governedBackupIds.add(backup.id);
+            }
+        }
+    }
+    if (governedBackupIds.size > 0 && !descriptor.ledger) {
+        fail('/ledger', 'is required when a deletion/correction-capable category has backup copies', 'data-lifecycle-policy-invalid');
+    }
+    if (descriptor.ledger) {
+        const ledgerStore = stores.get(descriptor.ledger.storeId);
+        if (!ledgerStore ||
+            ledgerStore.kind !== 'audit' ||
+            (0, model_js_1.compareDataClassifications)(ledgerStore.classification, 'confidential') < 0) {
+            fail('/ledger/storeId', 'must reference a confidential-or-stricter audit store', 'data-lifecycle-policy-invalid');
+        }
+        requireReferences(descriptor.ledger.backupIdsCovered, new Set(backups.keys()), '/ledger/backupIdsCovered', 'backup');
+        for (const backupId of governedBackupIds) {
+            if (!descriptor.ledger.backupIdsCovered.includes(backupId)) {
+                fail('/ledger/backupIdsCovered', `must cover backup ${backupId} for restore reconciliation`, 'data-lifecycle-policy-invalid');
+            }
+        }
+        for (const backupId of descriptor.ledger.backupIdsCovered) {
+            const backup = backups.get(backupId);
+            if (!backup) {
+                fail('/ledger/backupIdsCovered', `references unknown backup ${backupId}`);
+            }
+            if (descriptor.ledger.retention.durationDays < backup.retention.durationDays) {
+                fail('/ledger/retention/durationDays', `must cover backup ${backupId}'s retention window`, 'data-lifecycle-policy-invalid');
+            }
+        }
+    }
+}
+function normalizeDataLifecycleDescriptor(value, options = {}) {
+    const record = requireRecord(value, '');
+    requireKeys(record, '', [
+        'backups',
+        'categories',
+        'copies',
+        'governance',
+        'holds',
+        'kind',
+        'lineage',
+        'policyVersion',
+        'restorePlans',
+        'schemaVersion',
+        'slice',
+        'stores',
+    ], ['ledger']);
+    const descriptor = {
+        backups: requireArray(record['backups'], '/backups', parseBackup, {
+            allowEmpty: true,
+        }).sort((left, right) => compareStrings(left.id, right.id)),
+        categories: requireArray(record['categories'], '/categories', parseCategory).sort((left, right) => compareStrings(left.id, right.id)),
+        copies: requireArray(record['copies'], '/copies', parseCopy, {
+            allowEmpty: true,
+        }).sort((left, right) => compareStrings(left.id, right.id)),
+        governance: parseGovernance(record['governance'], '/governance'),
+        holds: requireArray(record['holds'], '/holds', parseHold, {
+            allowEmpty: true,
+        }).sort((left, right) => compareStrings(left.id, right.id)),
+        kind: requireLiteral(record['kind'], model_js_1.DATA_LIFECYCLE_DESCRIPTOR_KIND, '/kind'),
+        lineage: requireArray(record['lineage'], '/lineage', parseLineage, {
+            allowEmpty: true,
+        }).sort((left, right) => compareStrings(left.id, right.id)),
+        policyVersion: requireString(record['policyVersion'], '/policyVersion', {
+            pattern: POLICY_VERSION_PATTERN,
+        }),
+        restorePlans: requireArray(record['restorePlans'], '/restorePlans', parseRestorePlan, { allowEmpty: true }).sort((left, right) => compareStrings(left.id, right.id)),
+        schemaVersion: requireLiteral(record['schemaVersion'], model_js_1.DATA_LIFECYCLE_DESCRIPTOR_SCHEMA_VERSION, '/schemaVersion'),
+        slice: requireString(record['slice'], '/slice', { pattern: SLICE_PATTERN }),
+        stores: requireArray(record['stores'], '/stores', parseStore).sort((left, right) => compareStrings(left.id, right.id)),
+    };
+    if (Object.prototype.hasOwnProperty.call(record, 'ledger')) {
+        descriptor.ledger = parseLedger(record['ledger'], '/ledger');
+    }
+    validateRelationships(descriptor);
+    if (options.now !== undefined) {
+        const now = requireTimestamp(options.now, '/validation/now');
+        if (Date.parse(descriptor.governance.reviewDueAt) <= Date.parse(now)) {
+            fail('/governance/reviewDueAt', 'the descriptor review is due or expired', 'data-lifecycle-review-expired');
+        }
+        descriptor.holds.forEach((hold, index) => {
+            if (hold.status === 'active' &&
+                (Date.parse(hold.reviewAt) <= Date.parse(now) ||
+                    Date.parse(hold.expiresAt) <= Date.parse(now))) {
+                fail(`/holds/${index}`, 'active hold review or expiry is due', 'data-lifecycle-review-expired');
+            }
+        });
+    }
+    return descriptor;
+}
+function canonicalDataLifecycleDescriptorJson(value) {
+    return `${JSON.stringify(normalizeDataLifecycleDescriptor(value), null, 2)}\n`;
+}
+function digestDataLifecycleDescriptor(value) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(canonicalDataLifecycleDescriptorJson(value), 'utf8')
+        .digest('hex');
+}
+function parseObservation(value, index) {
+    const pointer = `/observations/${index}`;
+    const record = requireRecord(value, pointer);
+    requireKeys(record, pointer, ['locationId', 'surface'], ['categoryId', 'classification']);
+    const observation = {
+        locationId: requireString(record['locationId'], `${pointer}/locationId`, {
+            pattern: ID_PATTERN,
+        }),
+        surface: requireEnum(record['surface'], ['copy', 'store'], `${pointer}/surface`),
+    };
+    if (Object.prototype.hasOwnProperty.call(record, 'categoryId')) {
+        observation.categoryId = requireString(record['categoryId'], `${pointer}/categoryId`, { pattern: ID_PATTERN });
+    }
+    if (Object.prototype.hasOwnProperty.call(record, 'classification')) {
+        observation.classification = requireEnum(record['classification'], model_js_1.DATA_CLASSIFICATIONS, `${pointer}/classification`);
+    }
+    return observation;
+}
+/**
+ * Production discovery is compared with the reviewed descriptor. Unknown
+ * locations and missing/mismatched classifications fail closed.
+ */
+function requireProductionDataLifecycleCoverage(options) {
+    const descriptor = normalizeDataLifecycleDescriptor(options.descriptor);
+    const categoryMap = new Map(descriptor.categories.map((category) => [category.id, category]));
+    const storeMap = new Map(descriptor.stores
+        .filter((store) => store.production)
+        .map((store) => [store.id, store]));
+    const copyMap = new Map(descriptor.copies
+        .filter((copy) => descriptor.stores.some((store) => store.id === copy.storeId && store.production))
+        .map((copy) => [copy.id, copy]));
+    const observedStoreCategories = new Set();
+    const observedCopyCategories = new Set();
+    const observationKey = (locationId, categoryId) => `${locationId}\0${categoryId}`;
+    options.observations.forEach((value, index) => {
+        const observation = parseObservation(value, index);
+        const location = observation.surface === 'store'
+            ? storeMap.get(observation.locationId)
+            : copyMap.get(observation.locationId);
+        if (!location) {
+            fail(`/observations/${index}/locationId`, `production ${observation.surface} ${observation.locationId} is not inventoried`, 'data-lifecycle-production-location-unknown');
+        }
+        if (!observation.categoryId || !observation.classification) {
+            fail(`/observations/${index}`, 'production data must declare a known category and classification', 'data-lifecycle-production-data-unclassified');
+        }
+        const category = categoryMap.get(observation.categoryId);
+        if (!category ||
+            !location.categoryIds.includes(observation.categoryId) ||
+            category.classification !== observation.classification) {
+            fail(`/observations/${index}/classification`, 'production category/classification does not match the reviewed inventory', 'data-lifecycle-production-data-unclassified');
+        }
+        (observation.surface === 'store'
+            ? observedStoreCategories
+            : observedCopyCategories).add(observationKey(observation.locationId, observation.categoryId));
+    });
+    for (const [surface, locations, observed] of [
+        ['store', storeMap, observedStoreCategories],
+        ['copy', copyMap, observedCopyCategories],
+    ]) {
+        for (const [locationId, location] of [...locations.entries()].sort(([left], [right]) => compareStrings(left, right))) {
+            for (const categoryId of location.categoryIds) {
+                if (!observed.has(observationKey(locationId, categoryId))) {
+                    fail('/observations', `production ${surface} ${locationId} category ${categoryId} has no physical observation`, 'data-lifecycle-production-location-missing');
+                }
+            }
+        }
+    }
+    return {
+        covered: true,
+        observations: options.observations.length,
+        policyVersion: descriptor.policyVersion,
+    };
+}
+//# sourceMappingURL=validation.js.map