@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-api-contract-files.js

@@ -0,0 +1,2656 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductApiContractFiles = renderProductApiContractFiles;
+const api_contract_1 = require("@empire-builder-kit/runtime/api-contract");
+const index_js_1 = require("../../api-contract/index.js");
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+function createStandardApiContract(name, pascalName) {
+    const authenticationProblems = [
+        {
+            code: 'auth_invalid_token',
+            message: 'The access token is invalid or expired.',
+            retryable: false,
+            status: 401,
+            type: 'https://empirebuilderkit.dev/problems/auth/invalid-token',
+        },
+        {
+            code: 'auth_unauthenticated',
+            message: 'Authentication is required.',
+            retryable: false,
+            status: 401,
+            type: 'https://empirebuilderkit.dev/problems/auth/unauthenticated',
+        },
+    ];
+    const authorizationProblems = [
+        ...authenticationProblems,
+        {
+            code: 'authorization_admission_required',
+            message: 'Required operation admission is missing.',
+            retryable: false,
+            status: 403,
+            type: 'https://empirebuilderkit.dev/problems/authorization/admission-required',
+        },
+        {
+            code: 'authorization_approval_required',
+            message: 'Approval is required.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/authorization/approval-required',
+        },
+        {
+            code: 'authorization_denied',
+            message: 'Authorization denied.',
+            retryable: false,
+            status: 403,
+            type: 'https://empirebuilderkit.dev/problems/authorization/denied',
+        },
+        {
+            code: 'authorization_input_invalid',
+            message: 'Authorization input is invalid.',
+            retryable: false,
+            status: 403,
+            type: 'https://empirebuilderkit.dev/problems/authorization/input-invalid',
+        },
+        {
+            code: 'authorization_policy_stale',
+            message: 'Authorization policy is not current.',
+            retryable: true,
+            status: 503,
+            type: 'https://empirebuilderkit.dev/problems/authorization/policy-stale',
+        },
+        {
+            code: 'authorization_unavailable',
+            message: 'Authorization is temporarily unavailable.',
+            retryable: true,
+            status: 503,
+            type: 'https://empirebuilderkit.dev/problems/authorization/unavailable',
+        },
+    ];
+    const recordConflictProblems = [
+        ...authorizationProblems,
+        {
+            code: 'record_conflict',
+            message: 'The record identifier is owned by another principal.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/records/conflict',
+        },
+        {
+            code: 'record_correction_retry_required',
+            message: 'Record correction propagation requires retry.',
+            retryable: true,
+            status: 503,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/correction-retry-required',
+        },
+        {
+            code: 'test_data_expiry_invalid',
+            message: 'Test data expiry must be a canonical future timestamp within 48 hours.',
+            retryable: false,
+            status: 400,
+            type: 'https://empirebuilderkit.dev/problems/testing/expiry-invalid',
+        },
+    ];
+    const recordNotFoundProblems = [
+        ...authorizationProblems,
+        {
+            code: 'record_not_found',
+            message: 'The record was not found.',
+            retryable: false,
+            status: 404,
+            type: 'https://empirebuilderkit.dev/problems/records/not-found',
+        },
+    ];
+    const delegationProblems = [
+        ...authorizationProblems,
+        {
+            code: 'authorization_delegation_expired',
+            message: 'Delegated authority has expired.',
+            retryable: false,
+            status: 403,
+            type: 'https://empirebuilderkit.dev/problems/authorization/delegation-expired',
+        },
+        {
+            code: 'authorization_delegation_out_of_bounds',
+            message: 'Delegated authority does not cover this request.',
+            retryable: false,
+            status: 403,
+            type: 'https://empirebuilderkit.dev/problems/authorization/delegation-out-of-bounds',
+        },
+        {
+            code: 'authorization_delegation_rate_limited',
+            message: 'Delegated authority use limit has been reached.',
+            retryable: false,
+            status: 429,
+            type: 'https://empirebuilderkit.dev/problems/authorization/delegation-rate-limited',
+        },
+        {
+            code: 'authorization_delegation_revoked',
+            message: 'Delegated authority has been revoked.',
+            retryable: false,
+            status: 403,
+            type: 'https://empirebuilderkit.dev/problems/authorization/delegation-revoked',
+        },
+    ];
+    const delegatedRecordProblems = [
+        ...delegationProblems,
+        {
+            code: 'record_not_found',
+            message: 'The record was not found.',
+            retryable: false,
+            status: 404,
+            type: 'https://empirebuilderkit.dev/problems/records/not-found',
+        },
+    ];
+    const deletionProblems = [
+        ...recordNotFoundProblems,
+        {
+            code: 'authorization_approval_expired',
+            message: 'Approval has expired.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/authorization/approval-expired',
+        },
+        {
+            code: 'authorization_approval_invalid',
+            message: 'Approval is not valid for this request.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/authorization/approval-invalid',
+        },
+        {
+            code: 'authorization_approval_pending',
+            message: 'Approval is pending.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/authorization/approval-pending',
+        },
+        {
+            code: 'data_deletion_held',
+            message: 'Deletion is blocked by an active hold.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/deletion-held',
+        },
+        {
+            code: 'data_deletion_retry_required',
+            message: 'Deletion propagation requires retry.',
+            retryable: true,
+            status: 503,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/deletion-retry-required',
+        },
+    ];
+    const dataRightsProblems = [
+        ...recordNotFoundProblems,
+        {
+            code: 'data_export_expired',
+            message: 'The confidential export has expired.',
+            retryable: false,
+            status: 410,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-expired',
+        },
+        {
+            code: 'data_export_held',
+            message: 'An active hold blocks the confidential export.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-held',
+        },
+        {
+            code: 'data_export_not_ready',
+            message: 'The confidential export is not ready.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-not-ready',
+        },
+        {
+            code: 'data_export_rate_limited',
+            message: 'The bounded confidential export rate was exceeded.',
+            retryable: false,
+            status: 429,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-rate-limited',
+        },
+        {
+            code: 'data_export_retry_required',
+            message: 'Confidential export processing requires retry.',
+            retryable: true,
+            status: 503,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-retry-required',
+        },
+        {
+            code: 'data_rights_input_invalid',
+            message: 'The data-rights request is invalid.',
+            retryable: false,
+            status: 400,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/input-invalid',
+        },
+        {
+            code: 'record_hold_invalid',
+            message: 'The record hold cannot make the requested transition.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/hold-invalid',
+        },
+    ];
+    const retentionProblems = [
+        {
+            code: 'data_retention_approval_invalid',
+            message: 'The retention approval is invalid for this report.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-approval-invalid',
+        },
+        {
+            code: 'data_retention_input_invalid',
+            message: 'The retention review request is invalid.',
+            retryable: false,
+            status: 400,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-input-invalid',
+        },
+        {
+            code: 'data_retention_not_reviewable',
+            message: 'The retention report is no longer reviewable.',
+            retryable: false,
+            status: 409,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-not-reviewable',
+        },
+        {
+            code: 'data_retention_report_not_found',
+            message: 'The retention report was not found.',
+            retryable: false,
+            status: 404,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-report-not-found',
+        },
+        {
+            code: 'data_retention_retry_required',
+            message: 'Retention review persistence requires retry.',
+            retryable: true,
+            status: 503,
+            type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-retry-required',
+        },
+    ];
+    const recordPath = () => (0, api_contract_1.apiObject)({
+        recordId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+    });
+    const deletionRequestPath = () => (0, api_contract_1.apiObject)({
+        approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+        recordId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+    });
+    const delegationPath = () => (0, api_contract_1.apiObject)({
+        delegationId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+        recordId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+    });
+    const exportPath = () => (0, api_contract_1.apiObject)({
+        approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+        recordId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+    });
+    const holdPath = () => (0, api_contract_1.apiObject)({
+        holdId: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 1 }),
+        recordId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+    });
+    const retentionApprovalPath = () => (0, api_contract_1.apiObject)({
+        approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+        runId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+    });
+    const retentionRunPath = () => (0, api_contract_1.apiObject)({
+        runId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+    });
+    const recordResponse = () => (0, api_contract_1.apiObject)({
+        id: (0, api_contract_1.apiString)({ format: 'uuid' }),
+        name: (0, api_contract_1.apiString)({ maxLength: 128, minLength: 1 }),
+        runScope: (0, api_contract_1.apiString)({ maxLength: 128, minLength: 1 }),
+    });
+    const holdResponse = () => (0, api_contract_1.apiObject)({
+        expiresAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+        holdId: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 1 }),
+        reviewAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+        status: (0, api_contract_1.apiString)({ enum: ['active', 'released'] }),
+    });
+    const health = (0, api_contract_1.defineApiOperation)({
+        authentication: 'anonymous',
+        authorizationActions: [],
+        contractVersion: '1.0.0',
+        feature: 'operations',
+        lifecycle: { status: 'active' },
+        method: 'GET',
+        operationId: `${name}.health`,
+        path: '/health',
+        problems: [],
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                service: (0, api_contract_1.apiString)({ enum: [name] }),
+                sourceCommit: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 1 }),
+                stage: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 1 }),
+                status: (0, api_contract_1.apiString)({ enum: ['ok'] }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Read ${pascalName} API health`,
+    });
+    const machineAuthorizationProof = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:machine-proof-read`],
+        contractVersion: '1.0.0',
+        feature: 'authorization',
+        lifecycle: { status: 'active' },
+        method: 'GET',
+        operationId: `${name}.machine-authorization-proof`,
+        path: '/authorization/machine-proof',
+        problems: authorizationProblems,
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                message: (0, api_contract_1.apiString)({
+                    enum: ['Machine authorization accepted.'],
+                }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Prove narrow ${pascalName} machine authorization`,
+    });
+    const issueRecordDelegation = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-delegation-issue`],
+        contractVersion: '1.0.0',
+        feature: 'authorization',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.issue-record-delegation`,
+        path: '/records/{recordId}/delegations',
+        problems: authorizationProblems,
+        request: {
+            body: (0, api_contract_1.apiObject)({
+                expiresAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+                purposeReference: (0, api_contract_1.apiString)({ maxLength: 256, minLength: 1 }),
+            }),
+            maxBodyBytes: 512,
+            path: recordPath(),
+        },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                capability: (0, api_contract_1.apiString)({ maxLength: 43, minLength: 43 }),
+                delegationId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                expiresAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+                status: (0, api_contract_1.apiString)({ enum: ['active'] }),
+            }),
+            status: 201,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Issue one attended ${pascalName} record delegation`,
+    });
+    const revokeRecordDelegation = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-delegation-revoke`],
+        contractVersion: '1.0.0',
+        feature: 'authorization',
+        lifecycle: { status: 'active' },
+        method: 'DELETE',
+        operationId: `${name}.revoke-record-delegation`,
+        path: '/records/{recordId}/delegations/{delegationId}',
+        problems: authorizationProblems,
+        request: { path: delegationPath() },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                delegationId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                status: (0, api_contract_1.apiString)({ enum: ['revoked'] }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Revoke one attended ${pascalName} record delegation`,
+    });
+    const useRecordDelegation = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-delegation-use`],
+        contractVersion: '1.0.0',
+        feature: 'authorization',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.use-record-delegation`,
+        path: '/records/{recordId}/delegations/{delegationId}/use',
+        problems: delegatedRecordProblems,
+        request: {
+            body: (0, api_contract_1.apiObject)({
+                capability: (0, api_contract_1.apiString)({ maxLength: 43, minLength: 43 }),
+            }),
+            maxBodyBytes: 256,
+            path: delegationPath(),
+        },
+        response: { body: recordResponse(), status: 200 },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Use one attended ${pascalName} record delegation`,
+    });
+    const requestRecordExport = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-export`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.request-record-export`,
+        path: '/records/{recordId}/exports',
+        problems: dataRightsProblems,
+        request: { path: recordPath() },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                expiresAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+                requestDigest: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 64 }),
+                status: (0, api_contract_1.apiString)({ enum: ['pending'] }),
+            }),
+            status: 202,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Request one subject-bound ${pascalName} record export`,
+    });
+    const decideRecordExport = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:approval-review`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.decide-record-export`,
+        path: '/records/{recordId}/exports/{approvalRequestId}/decision',
+        problems: dataRightsProblems,
+        request: {
+            body: (0, api_contract_1.apiObject)({
+                expectedRequestDigest: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 64 }),
+                outcome: (0, api_contract_1.apiString)({ enum: ['approved', 'rejected'] }),
+                reasonReference: (0, api_contract_1.apiString)({ maxLength: 128, minLength: 1 }),
+            }),
+            maxBodyBytes: 512,
+            path: exportPath(),
+        },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                status: (0, api_contract_1.apiString)({ enum: ['approved', 'rejected'] }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Decide one ${pascalName} record export`,
+    });
+    const executeRecordExport = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-export`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.execute-record-export`,
+        path: '/records/{recordId}/exports/{approvalRequestId}/execute',
+        problems: dataRightsProblems,
+        request: { path: exportPath() },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                artifactRef: (0, api_contract_1.apiOptional)((0, api_contract_1.apiString)({ maxLength: 128, minLength: 1 })),
+                expiresAt: (0, api_contract_1.apiOptional)((0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 })),
+                status: (0, api_contract_1.apiString)({ enum: ['held', 'ready'] }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Execute one approved ${pascalName} record export`,
+    });
+    const deliverRecordExport = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-export`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'GET',
+        operationId: `${name}.deliver-record-export`,
+        path: '/records/{recordId}/exports/{approvalRequestId}/delivery',
+        problems: dataRightsProblems,
+        request: { path: exportPath() },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                artifactRef: (0, api_contract_1.apiString)({ maxLength: 128, minLength: 1 }),
+                deliveredAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+                expiresAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+                record: recordResponse(),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Deliver one unexpired ${pascalName} record export`,
+    });
+    const cleanupRecordExport = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-export-cleanup`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'DELETE',
+        operationId: `${name}.cleanup-record-export`,
+        path: '/records/{recordId}/exports/{approvalRequestId}',
+        problems: dataRightsProblems,
+        request: { path: exportPath() },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                deletedVersions: (0, api_contract_1.apiNumber)({ integer: true, minimum: 0 }),
+                status: (0, api_contract_1.apiString)({
+                    enum: ['completed', 'retry-required'],
+                }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Clean up one expired ${pascalName} record export`,
+    });
+    const requestRetentionApproval = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:retention-review`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.request-retention-approval`,
+        path: '/data-retention/runs/{runId}/approval-requests',
+        problems: retentionProblems,
+        request: { path: retentionRunPath() },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                expiresAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+                requestDigest: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 64 }),
+                status: (0, api_contract_1.apiString)({ enum: ['pending'] }),
+            }),
+            status: 202,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Request direct-admin review of one ${pascalName} retention report`,
+    });
+    const decideRetentionApproval = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:retention-review`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.decide-retention-approval`,
+        path: '/data-retention/runs/{runId}/approval-requests/{approvalRequestId}/decision',
+        problems: retentionProblems,
+        request: {
+            body: (0, api_contract_1.apiObject)({
+                expectedRequestDigest: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 64 }),
+                outcome: (0, api_contract_1.apiString)({ enum: ['approved', 'rejected'] }),
+                reasonReference: (0, api_contract_1.apiString)({ maxLength: 128, minLength: 1 }),
+            }),
+            maxBodyBytes: 512,
+            path: retentionApprovalPath(),
+        },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                status: (0, api_contract_1.apiString)({ enum: ['approved', 'rejected'] }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Decide one ${pascalName} retention approval as a non-author admin`,
+    });
+    const issueRecordHold = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-hold-manage`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.issue-record-hold`,
+        path: '/records/{recordId}/holds',
+        problems: dataRightsProblems,
+        request: {
+            body: (0, api_contract_1.apiObject)({
+                effects: (0, api_contract_1.apiArray)((0, api_contract_1.apiString)({
+                    enum: ['block-deletion', 'block-export'],
+                }), { maxItems: 2, minItems: 1 }),
+                expiresAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+                purpose: (0, api_contract_1.apiString)({
+                    enum: ['fraud', 'incident', 'legal', 'security', 'support'],
+                }),
+                reviewAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+            }),
+            maxBodyBytes: 512,
+            path: recordPath(),
+        },
+        response: { body: holdResponse(), status: 201 },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Issue one bounded ${pascalName} record hold`,
+    });
+    const reviewRecordHold = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-hold-manage`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.review-record-hold`,
+        path: '/records/{recordId}/holds/{holdId}/review',
+        problems: dataRightsProblems,
+        request: {
+            body: (0, api_contract_1.apiObject)({
+                expiresAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+                reviewAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+            }),
+            maxBodyBytes: 256,
+            path: holdPath(),
+        },
+        response: { body: holdResponse(), status: 200 },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Review one bounded ${pascalName} record hold`,
+    });
+    const releaseRecordHold = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-hold-manage`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'DELETE',
+        operationId: `${name}.release-record-hold`,
+        path: '/records/{recordId}/holds/{holdId}',
+        problems: dataRightsProblems,
+        request: { path: holdPath() },
+        response: { body: holdResponse(), status: 200 },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Release one bounded ${pascalName} record hold`,
+    });
+    const expireRecordHold = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-hold-manage`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.expire-record-hold`,
+        path: '/records/{recordId}/holds/{holdId}/expire',
+        problems: dataRightsProblems,
+        request: { path: holdPath() },
+        response: { body: holdResponse(), status: 200 },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Expire one due ${pascalName} record hold`,
+    });
+    const protectedExample = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:protected-read`],
+        contractVersion: '1.0.0',
+        feature: 'authorization',
+        lifecycle: { status: 'active' },
+        method: 'GET',
+        operationId: `${name}.protected-example`,
+        path: '/protected',
+        problems: authorizationProblems,
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                message: (0, api_contract_1.apiString)({
+                    enum: ['Authenticated request accepted.'],
+                }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Read the authenticated ${pascalName} example`,
+    });
+    const databaseHealth = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:database-read`],
+        contractVersion: '1.0.0',
+        feature: 'database',
+        lifecycle: { status: 'active' },
+        method: 'GET',
+        operationId: `${name}.database-health`,
+        path: '/database-health',
+        problems: authorizationProblems,
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                service: (0, api_contract_1.apiString)({ enum: [name] }),
+                status: (0, api_contract_1.apiString)({ enum: ['ok'] }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Read ${pascalName} database health`,
+    });
+    const decideRecordDeletion = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:approval-review`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.decide-record-deletion`,
+        path: '/records/{recordId}/deletion-requests/{approvalRequestId}/decision',
+        problems: deletionProblems,
+        request: {
+            body: (0, api_contract_1.apiObject)({
+                expectedRequestDigest: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 64 }),
+                outcome: (0, api_contract_1.apiString)({ enum: ['approved', 'rejected'] }),
+                reasonReference: (0, api_contract_1.apiString)({ maxLength: 128, minLength: 1 }),
+            }),
+            maxBodyBytes: 512,
+            path: deletionRequestPath(),
+        },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                status: (0, api_contract_1.apiString)({ enum: ['approved', 'rejected'] }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Decide one pending ${pascalName} record deletion`,
+    });
+    const deleteSyntheticRecord = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-delete`],
+        contractVersion: '1.0.0',
+        feature: 'database',
+        lifecycle: { status: 'active' },
+        method: 'DELETE',
+        operationId: `${name}.delete-record`,
+        path: '/records/{recordId}',
+        problems: deletionProblems,
+        request: {
+            path: recordPath(),
+            query: (0, api_contract_1.apiObject)({
+                approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                reasonCode: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 1 }),
+            }),
+        },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                deleted: (0, api_contract_1.apiBoolean)(),
+                id: (0, api_contract_1.apiString)({ format: 'uuid' }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Delete one owned ${pascalName} record`,
+    });
+    const getSyntheticRecord = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-read`],
+        contractVersion: '1.0.0',
+        feature: 'database',
+        lifecycle: { status: 'active' },
+        method: 'GET',
+        operationId: `${name}.get-record`,
+        path: '/records/{recordId}',
+        problems: recordNotFoundProblems,
+        request: { path: recordPath() },
+        response: { body: recordResponse(), status: 200 },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Read one owned ${pascalName} record`,
+    });
+    const publishCreated = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:event-publish`],
+        contractVersion: '1.0.0',
+        feature: 'events',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.publish-created`,
+        path: '/events/example',
+        problems: authorizationProblems,
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                eventId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+            }),
+            status: 200,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Publish a ${pascalName} example event`,
+    });
+    const putSyntheticRecord = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-write`],
+        contractVersion: '1.0.0',
+        feature: 'database',
+        lifecycle: { status: 'active' },
+        method: 'PUT',
+        operationId: `${name}.put-record`,
+        path: '/records/{recordId}',
+        problems: recordConflictProblems,
+        request: {
+            body: (0, api_contract_1.apiObject)({
+                name: (0, api_contract_1.apiString)({ maxLength: 128, minLength: 1 }),
+                runScope: (0, api_contract_1.apiString)({ maxLength: 128, minLength: 1 }),
+                testExpiresAt: (0, api_contract_1.apiOptional)((0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 })),
+            }),
+            maxBodyBytes: 512,
+            path: recordPath(),
+        },
+        response: { body: recordResponse(), status: 200 },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Create or replace one owned ${pascalName} record`,
+    });
+    const requestRecordDeletion = (0, api_contract_1.defineApiOperation)({
+        authentication: 'customer',
+        authorizationActions: [`${name}:record-delete`],
+        contractVersion: '1.0.0',
+        feature: 'data-lifecycle',
+        lifecycle: { status: 'active' },
+        method: 'POST',
+        operationId: `${name}.request-record-deletion`,
+        path: '/records/{recordId}/deletion-requests',
+        problems: recordNotFoundProblems,
+        request: {
+            body: (0, api_contract_1.apiObject)({
+                reasonCode: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 1 }),
+            }),
+            maxBodyBytes: 256,
+            path: recordPath(),
+        },
+        response: {
+            body: (0, api_contract_1.apiObject)({
+                approvalRequestId: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                expiresAt: (0, api_contract_1.apiString)({ maxLength: 40, minLength: 20 }),
+                requestDigest: (0, api_contract_1.apiString)({ maxLength: 64, minLength: 64 }),
+                status: (0, api_contract_1.apiString)({ enum: ['pending'] }),
+            }),
+            status: 202,
+        },
+        responseProfile: 'ebk-app-v1',
+        slice: name,
+        summary: `Request approval for one ${pascalName} record deletion`,
+    });
+    return (0, api_contract_1.defineApiContract)({
+        operations: [
+            cleanupRecordExport,
+            databaseHealth,
+            decideRecordExport,
+            decideRecordDeletion,
+            decideRetentionApproval,
+            deliverRecordExport,
+            deleteSyntheticRecord,
+            executeRecordExport,
+            expireRecordHold,
+            getSyntheticRecord,
+            health,
+            issueRecordDelegation,
+            issueRecordHold,
+            machineAuthorizationProof,
+            protectedExample,
+            publishCreated,
+            putSyntheticRecord,
+            requestRecordDeletion,
+            requestRecordExport,
+            requestRetentionApproval,
+            releaseRecordHold,
+            reviewRecordHold,
+            revokeRecordDelegation,
+            useRecordDelegation,
+        ],
+        slice: name,
+        title: `${pascalName} API`,
+        version: '1.0.0',
+    });
+}
+/** @internal */
+function renderProductApiContractFiles(name, pascalName) {
+    const contract = createStandardApiContract(name, pascalName);
+    const artifacts = (0, api_contract_1.createApiContractArtifacts)(contract);
+    const baseline = (0, index_js_1.canonicalApiContractBaselineJson)((0, index_js_1.createApiContractBaseline)(artifacts.normalized));
+    const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
+    const contractIdentifier = `${identifierPrefix}ApiContract`;
+    return {
+        'api/contracts/protected.ts': `import {
+  apiArray,
+  apiBoolean,
+  apiNumber,
+  apiObject,
+  apiOptional,
+  apiString,
+  defineApiContract,
+  defineApiOperation,
+} from '@empire-builder-kit/runtime/api-contract';
+
+const authenticationProblems = [
+  {
+    code: 'auth_invalid_token',
+    message: 'The access token is invalid or expired.',
+    retryable: false,
+    status: 401,
+    type: 'https://empirebuilderkit.dev/problems/auth/invalid-token',
+  },
+  {
+    code: 'auth_unauthenticated',
+    message: 'Authentication is required.',
+    retryable: false,
+    status: 401,
+    type: 'https://empirebuilderkit.dev/problems/auth/unauthenticated',
+  },
+] as const;
+
+const authorizationProblems = [
+  ...authenticationProblems,
+  {
+    code: 'authorization_admission_required',
+    message: 'Required operation admission is missing.',
+    retryable: false,
+    status: 403,
+    type: 'https://empirebuilderkit.dev/problems/authorization/admission-required',
+  },
+  {
+    code: 'authorization_approval_required',
+    message: 'Approval is required.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/authorization/approval-required',
+  },
+  {
+    code: 'authorization_denied',
+    message: 'Authorization denied.',
+    retryable: false,
+    status: 403,
+    type: 'https://empirebuilderkit.dev/problems/authorization/denied',
+  },
+  {
+    code: 'authorization_input_invalid',
+    message: 'Authorization input is invalid.',
+    retryable: false,
+    status: 403,
+    type: 'https://empirebuilderkit.dev/problems/authorization/input-invalid',
+  },
+  {
+    code: 'authorization_policy_stale',
+    message: 'Authorization policy is not current.',
+    retryable: true,
+    status: 503,
+    type: 'https://empirebuilderkit.dev/problems/authorization/policy-stale',
+  },
+  {
+    code: 'authorization_unavailable',
+    message: 'Authorization is temporarily unavailable.',
+    retryable: true,
+    status: 503,
+    type: 'https://empirebuilderkit.dev/problems/authorization/unavailable',
+  },
+] as const;
+
+const recordConflictProblems = [
+  ...authorizationProblems,
+  {
+    code: 'record_conflict',
+    message: 'The record identifier is owned by another principal.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/records/conflict',
+  },
+  {
+    code: 'record_correction_retry_required',
+    message: 'Record correction propagation requires retry.',
+    retryable: true,
+    status: 503,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/correction-retry-required',
+  },
+  {
+    code: 'test_data_expiry_invalid',
+    message:
+      'Test data expiry must be a canonical future timestamp within 48 hours.',
+    retryable: false,
+    status: 400,
+    type: 'https://empirebuilderkit.dev/problems/testing/expiry-invalid',
+  },
+] as const;
+
+const recordNotFoundProblems = [
+  ...authorizationProblems,
+  {
+    code: 'record_not_found',
+    message: 'The record was not found.',
+    retryable: false,
+    status: 404,
+    type: 'https://empirebuilderkit.dev/problems/records/not-found',
+  },
+] as const;
+
+const delegationProblems = [
+  ...authorizationProblems,
+  {
+    code: 'authorization_delegation_expired',
+    message: 'Delegated authority has expired.',
+    retryable: false,
+    status: 403,
+    type: 'https://empirebuilderkit.dev/problems/authorization/delegation-expired',
+  },
+  {
+    code: 'authorization_delegation_out_of_bounds',
+    message: 'Delegated authority does not cover this request.',
+    retryable: false,
+    status: 403,
+    type: 'https://empirebuilderkit.dev/problems/authorization/delegation-out-of-bounds',
+  },
+  {
+    code: 'authorization_delegation_rate_limited',
+    message: 'Delegated authority use limit has been reached.',
+    retryable: false,
+    status: 429,
+    type: 'https://empirebuilderkit.dev/problems/authorization/delegation-rate-limited',
+  },
+  {
+    code: 'authorization_delegation_revoked',
+    message: 'Delegated authority has been revoked.',
+    retryable: false,
+    status: 403,
+    type: 'https://empirebuilderkit.dev/problems/authorization/delegation-revoked',
+  },
+] as const;
+
+const delegatedRecordProblems = [
+  ...delegationProblems,
+  {
+    code: 'record_not_found',
+    message: 'The record was not found.',
+    retryable: false,
+    status: 404,
+    type: 'https://empirebuilderkit.dev/problems/records/not-found',
+  },
+] as const;
+
+const deletionProblems = [
+  ...recordNotFoundProblems,
+  {
+    code: 'authorization_approval_expired',
+    message: 'Approval has expired.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/authorization/approval-expired',
+  },
+  {
+    code: 'authorization_approval_invalid',
+    message: 'Approval is not valid for this request.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/authorization/approval-invalid',
+  },
+  {
+    code: 'authorization_approval_pending',
+    message: 'Approval is pending.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/authorization/approval-pending',
+  },
+  {
+    code: 'data_deletion_held',
+    message: 'Deletion is blocked by an active hold.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/deletion-held',
+  },
+  {
+    code: 'data_deletion_retry_required',
+    message: 'Deletion propagation requires retry.',
+    retryable: true,
+    status: 503,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/deletion-retry-required',
+  },
+] as const;
+
+const dataRightsProblems = [
+  ...recordNotFoundProblems,
+  {
+    code: 'data_export_expired',
+    message: 'The confidential export has expired.',
+    retryable: false,
+    status: 410,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-expired',
+  },
+  {
+    code: 'data_export_held',
+    message: 'An active hold blocks the confidential export.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-held',
+  },
+  {
+    code: 'data_export_not_ready',
+    message: 'The confidential export is not ready.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-not-ready',
+  },
+  {
+    code: 'data_export_rate_limited',
+    message: 'The bounded confidential export rate was exceeded.',
+    retryable: false,
+    status: 429,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-rate-limited',
+  },
+  {
+    code: 'data_export_retry_required',
+    message: 'Confidential export processing requires retry.',
+    retryable: true,
+    status: 503,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/export-retry-required',
+  },
+  {
+    code: 'data_rights_input_invalid',
+    message: 'The data-rights request is invalid.',
+    retryable: false,
+    status: 400,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/input-invalid',
+  },
+  {
+    code: 'record_hold_invalid',
+    message: 'The record hold cannot make the requested transition.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/hold-invalid',
+  },
+] as const;
+
+const retentionProblems = [
+  {
+    code: 'data_retention_approval_invalid',
+    message: 'The retention approval is invalid for this report.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-approval-invalid',
+  },
+  {
+    code: 'data_retention_input_invalid',
+    message: 'The retention review request is invalid.',
+    retryable: false,
+    status: 400,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-input-invalid',
+  },
+  {
+    code: 'data_retention_not_reviewable',
+    message: 'The retention report is no longer reviewable.',
+    retryable: false,
+    status: 409,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-not-reviewable',
+  },
+  {
+    code: 'data_retention_report_not_found',
+    message: 'The retention report was not found.',
+    retryable: false,
+    status: 404,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-report-not-found',
+  },
+  {
+    code: 'data_retention_retry_required',
+    message: 'Retention review persistence requires retry.',
+    retryable: true,
+    status: 503,
+    type: 'https://empirebuilderkit.dev/problems/data-lifecycle/retention-retry-required',
+  },
+] as const;
+
+const recordPath = () =>
+  apiObject({
+    recordId: apiString({ format: 'uuid' }),
+  });
+
+const deletionRequestPath = () =>
+  apiObject({
+    approvalRequestId: apiString({ format: 'uuid' }),
+    recordId: apiString({ format: 'uuid' }),
+  });
+
+const delegationPath = () =>
+  apiObject({
+    delegationId: apiString({ format: 'uuid' }),
+    recordId: apiString({ format: 'uuid' }),
+  });
+
+const exportPath = () =>
+  apiObject({
+    approvalRequestId: apiString({ format: 'uuid' }),
+    recordId: apiString({ format: 'uuid' }),
+  });
+
+const holdPath = () =>
+  apiObject({
+    holdId: apiString({ maxLength: 64, minLength: 1 }),
+    recordId: apiString({ format: 'uuid' }),
+  });
+
+const retentionApprovalPath = () =>
+  apiObject({
+    approvalRequestId: apiString({ format: 'uuid' }),
+    runId: apiString({ format: 'uuid' }),
+  });
+
+const retentionRunPath = () =>
+  apiObject({
+    runId: apiString({ format: 'uuid' }),
+  });
+
+const recordResponse = () =>
+  apiObject({
+    id: apiString({ format: 'uuid' }),
+    name: apiString({ maxLength: 128, minLength: 1 }),
+    runScope: apiString({ maxLength: 128, minLength: 1 }),
+  });
+
+const holdResponse = () =>
+  apiObject({
+    expiresAt: apiString({ maxLength: 40, minLength: 20 }),
+    holdId: apiString({ maxLength: 64, minLength: 1 }),
+    reviewAt: apiString({ maxLength: 40, minLength: 20 }),
+    status: apiString({ enum: ['active', 'released'] as const }),
+  });
+
+export const ${identifierPrefix}Health = defineApiOperation({
+  authentication: 'anonymous',
+  authorizationActions: [],
+  contractVersion: '1.0.0',
+  feature: 'operations',
+  lifecycle: { status: 'active' },
+  method: 'GET',
+  operationId: '${name}.health',
+  path: '/health',
+  problems: [],
+  response: {
+    body: apiObject({
+      service: apiString({ enum: ['${name}'] as const }),
+      sourceCommit: apiString({ maxLength: 64, minLength: 1 }),
+      stage: apiString({ maxLength: 64, minLength: 1 }),
+      status: apiString({ enum: ['ok'] as const }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Read ${pascalName} API health',
+});
+
+export const ${identifierPrefix}MachineAuthorizationProof = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:machine-proof-read'],
+  contractVersion: '1.0.0',
+  feature: 'authorization',
+  lifecycle: { status: 'active' },
+  method: 'GET',
+  operationId: '${name}.machine-authorization-proof',
+  path: '/authorization/machine-proof',
+  problems: authorizationProblems,
+  response: {
+    body: apiObject({
+      message: apiString({
+        enum: ['Machine authorization accepted.'] as const,
+      }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Prove narrow ${pascalName} machine authorization',
+});
+
+export const ${identifierPrefix}IssueRecordDelegation = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-delegation-issue'],
+  contractVersion: '1.0.0',
+  feature: 'authorization',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.issue-record-delegation',
+  path: '/records/{recordId}/delegations',
+  problems: authorizationProblems,
+  request: {
+    body: apiObject({
+      expiresAt: apiString({ maxLength: 40, minLength: 20 }),
+      purposeReference: apiString({ maxLength: 256, minLength: 1 }),
+    }),
+    maxBodyBytes: 512,
+    path: recordPath(),
+  },
+  response: {
+    body: apiObject({
+      capability: apiString({ maxLength: 43, minLength: 43 }),
+      delegationId: apiString({ format: 'uuid' }),
+      expiresAt: apiString({ maxLength: 40, minLength: 20 }),
+      status: apiString({ enum: ['active'] as const }),
+    }),
+    status: 201,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Issue one attended ${pascalName} record delegation',
+});
+
+export const ${identifierPrefix}RevokeRecordDelegation = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-delegation-revoke'],
+  contractVersion: '1.0.0',
+  feature: 'authorization',
+  lifecycle: { status: 'active' },
+  method: 'DELETE',
+  operationId: '${name}.revoke-record-delegation',
+  path: '/records/{recordId}/delegations/{delegationId}',
+  problems: authorizationProblems,
+  request: { path: delegationPath() },
+  response: {
+    body: apiObject({
+      delegationId: apiString({ format: 'uuid' }),
+      status: apiString({ enum: ['revoked'] as const }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Revoke one attended ${pascalName} record delegation',
+});
+
+export const ${identifierPrefix}UseRecordDelegation = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-delegation-use'],
+  contractVersion: '1.0.0',
+  feature: 'authorization',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.use-record-delegation',
+  path: '/records/{recordId}/delegations/{delegationId}/use',
+  problems: delegatedRecordProblems,
+  request: {
+    body: apiObject({
+      capability: apiString({ maxLength: 43, minLength: 43 }),
+    }),
+    maxBodyBytes: 256,
+    path: delegationPath(),
+  },
+  response: { body: recordResponse(), status: 200 },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Use one attended ${pascalName} record delegation',
+});
+
+export const ${identifierPrefix}RequestRecordExport = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-export'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.request-record-export',
+  path: '/records/{recordId}/exports',
+  problems: dataRightsProblems,
+  request: { path: recordPath() },
+  response: {
+    body: apiObject({
+      approvalRequestId: apiString({ format: 'uuid' }),
+      expiresAt: apiString({ maxLength: 40, minLength: 20 }),
+      requestDigest: apiString({ maxLength: 64, minLength: 64 }),
+      status: apiString({ enum: ['pending'] as const }),
+    }),
+    status: 202,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Request one subject-bound ${pascalName} record export',
+});
+
+export const ${identifierPrefix}DecideRecordExport = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:approval-review'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.decide-record-export',
+  path: '/records/{recordId}/exports/{approvalRequestId}/decision',
+  problems: dataRightsProblems,
+  request: {
+    body: apiObject({
+      expectedRequestDigest: apiString({ maxLength: 64, minLength: 64 }),
+      outcome: apiString({ enum: ['approved', 'rejected'] as const }),
+      reasonReference: apiString({ maxLength: 128, minLength: 1 }),
+    }),
+    maxBodyBytes: 512,
+    path: exportPath(),
+  },
+  response: {
+    body: apiObject({
+      approvalRequestId: apiString({ format: 'uuid' }),
+      status: apiString({ enum: ['approved', 'rejected'] as const }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Decide one ${pascalName} record export',
+});
+
+export const ${identifierPrefix}ExecuteRecordExport = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-export'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.execute-record-export',
+  path: '/records/{recordId}/exports/{approvalRequestId}/execute',
+  problems: dataRightsProblems,
+  request: { path: exportPath() },
+  response: {
+    body: apiObject({
+      artifactRef: apiOptional(
+        apiString({ maxLength: 128, minLength: 1 }),
+      ),
+      expiresAt: apiOptional(
+        apiString({ maxLength: 40, minLength: 20 }),
+      ),
+      status: apiString({ enum: ['held', 'ready'] as const }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Execute one approved ${pascalName} record export',
+});
+
+export const ${identifierPrefix}DeliverRecordExport = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-export'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'GET',
+  operationId: '${name}.deliver-record-export',
+  path: '/records/{recordId}/exports/{approvalRequestId}/delivery',
+  problems: dataRightsProblems,
+  request: { path: exportPath() },
+  response: {
+    body: apiObject({
+      artifactRef: apiString({ maxLength: 128, minLength: 1 }),
+      deliveredAt: apiString({ maxLength: 40, minLength: 20 }),
+      expiresAt: apiString({ maxLength: 40, minLength: 20 }),
+      record: recordResponse(),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Deliver one unexpired ${pascalName} record export',
+});
+
+export const ${identifierPrefix}CleanupRecordExport = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-export-cleanup'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'DELETE',
+  operationId: '${name}.cleanup-record-export',
+  path: '/records/{recordId}/exports/{approvalRequestId}',
+  problems: dataRightsProblems,
+  request: { path: exportPath() },
+  response: {
+    body: apiObject({
+      deletedVersions: apiNumber({ integer: true, minimum: 0 }),
+      status: apiString({
+        enum: ['completed', 'retry-required'] as const,
+      }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Clean up one expired ${pascalName} record export',
+});
+
+export const ${identifierPrefix}RequestRetentionApproval =
+  defineApiOperation({
+    authentication: 'customer',
+    authorizationActions: ['${name}:retention-review'],
+    contractVersion: '1.0.0',
+    feature: 'data-lifecycle',
+    lifecycle: { status: 'active' },
+    method: 'POST',
+    operationId: '${name}.request-retention-approval',
+    path: '/data-retention/runs/{runId}/approval-requests',
+    problems: retentionProblems,
+    request: { path: retentionRunPath() },
+    response: {
+      body: apiObject({
+        approvalRequestId: apiString({ format: 'uuid' }),
+        expiresAt: apiString({ maxLength: 40, minLength: 20 }),
+        requestDigest: apiString({ maxLength: 64, minLength: 64 }),
+        status: apiString({ enum: ['pending'] as const }),
+      }),
+      status: 202,
+    },
+    responseProfile: 'ebk-app-v1',
+    slice: '${name}',
+    summary:
+      'Request direct-admin review of one ${pascalName} retention report',
+  });
+
+export const ${identifierPrefix}DecideRetentionApproval =
+  defineApiOperation({
+    authentication: 'customer',
+    authorizationActions: ['${name}:retention-review'],
+    contractVersion: '1.0.0',
+    feature: 'data-lifecycle',
+    lifecycle: { status: 'active' },
+    method: 'POST',
+    operationId: '${name}.decide-retention-approval',
+    path:
+      '/data-retention/runs/{runId}/approval-requests/{approvalRequestId}/decision',
+    problems: retentionProblems,
+    request: {
+      body: apiObject({
+        expectedRequestDigest: apiString({ maxLength: 64, minLength: 64 }),
+        outcome: apiString({ enum: ['approved', 'rejected'] as const }),
+        reasonReference: apiString({ maxLength: 128, minLength: 1 }),
+      }),
+      maxBodyBytes: 512,
+      path: retentionApprovalPath(),
+    },
+    response: {
+      body: apiObject({
+        approvalRequestId: apiString({ format: 'uuid' }),
+        status: apiString({ enum: ['approved', 'rejected'] as const }),
+      }),
+      status: 200,
+    },
+    responseProfile: 'ebk-app-v1',
+    slice: '${name}',
+    summary:
+      'Decide one ${pascalName} retention approval as a non-author admin',
+  });
+
+export const ${identifierPrefix}IssueRecordHold = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-hold-manage'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.issue-record-hold',
+  path: '/records/{recordId}/holds',
+  problems: dataRightsProblems,
+  request: {
+    body: apiObject({
+      effects: apiArray(
+        apiString({
+          enum: ['block-deletion', 'block-export'] as const,
+        }),
+        { maxItems: 2, minItems: 1 },
+      ),
+      expiresAt: apiString({ maxLength: 40, minLength: 20 }),
+      purpose: apiString({
+        enum: ['fraud', 'incident', 'legal', 'security', 'support'] as const,
+      }),
+      reviewAt: apiString({ maxLength: 40, minLength: 20 }),
+    }),
+    maxBodyBytes: 512,
+    path: recordPath(),
+  },
+  response: { body: holdResponse(), status: 201 },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Issue one bounded ${pascalName} record hold',
+});
+
+export const ${identifierPrefix}ReviewRecordHold = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-hold-manage'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.review-record-hold',
+  path: '/records/{recordId}/holds/{holdId}/review',
+  problems: dataRightsProblems,
+  request: {
+    body: apiObject({
+      expiresAt: apiString({ maxLength: 40, minLength: 20 }),
+      reviewAt: apiString({ maxLength: 40, minLength: 20 }),
+    }),
+    maxBodyBytes: 256,
+    path: holdPath(),
+  },
+  response: { body: holdResponse(), status: 200 },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Review one bounded ${pascalName} record hold',
+});
+
+export const ${identifierPrefix}ReleaseRecordHold = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-hold-manage'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'DELETE',
+  operationId: '${name}.release-record-hold',
+  path: '/records/{recordId}/holds/{holdId}',
+  problems: dataRightsProblems,
+  request: { path: holdPath() },
+  response: { body: holdResponse(), status: 200 },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Release one bounded ${pascalName} record hold',
+});
+
+export const ${identifierPrefix}ExpireRecordHold = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-hold-manage'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.expire-record-hold',
+  path: '/records/{recordId}/holds/{holdId}/expire',
+  problems: dataRightsProblems,
+  request: { path: holdPath() },
+  response: { body: holdResponse(), status: 200 },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Expire one due ${pascalName} record hold',
+});
+
+export const ${identifierPrefix}ProtectedExample = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:protected-read'],
+  contractVersion: '1.0.0',
+  feature: 'authorization',
+  lifecycle: { status: 'active' },
+  method: 'GET',
+  operationId: '${name}.protected-example',
+  path: '/protected',
+  problems: authorizationProblems,
+  response: {
+    body: apiObject({
+      message: apiString({
+        enum: ['Authenticated request accepted.'] as const,
+      }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Read the authenticated ${pascalName} example',
+});
+
+export const ${identifierPrefix}DatabaseHealth = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:database-read'],
+  contractVersion: '1.0.0',
+  feature: 'database',
+  lifecycle: { status: 'active' },
+  method: 'GET',
+  operationId: '${name}.database-health',
+  path: '/database-health',
+  problems: authorizationProblems,
+  response: {
+    body: apiObject({
+      service: apiString({ enum: ['${name}'] as const }),
+      status: apiString({ enum: ['ok'] as const }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Read ${pascalName} database health',
+});
+
+export const ${identifierPrefix}DecideRecordDeletion = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:approval-review'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.decide-record-deletion',
+  path: '/records/{recordId}/deletion-requests/{approvalRequestId}/decision',
+  problems: deletionProblems,
+  request: {
+    body: apiObject({
+      expectedRequestDigest: apiString({ maxLength: 64, minLength: 64 }),
+      outcome: apiString({ enum: ['approved', 'rejected'] as const }),
+      reasonReference: apiString({ maxLength: 128, minLength: 1 }),
+    }),
+    maxBodyBytes: 512,
+    path: deletionRequestPath(),
+  },
+  response: {
+    body: apiObject({
+      approvalRequestId: apiString({ format: 'uuid' }),
+      status: apiString({ enum: ['approved', 'rejected'] as const }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Decide one pending ${pascalName} record deletion',
+});
+
+export const ${identifierPrefix}DeleteRecord = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-delete'],
+  contractVersion: '1.0.0',
+  feature: 'database',
+  lifecycle: { status: 'active' },
+  method: 'DELETE',
+  operationId: '${name}.delete-record',
+  path: '/records/{recordId}',
+  problems: deletionProblems,
+  request: {
+    path: recordPath(),
+    query: apiObject({
+      approvalRequestId: apiString({ format: 'uuid' }),
+      reasonCode: apiString({ maxLength: 64, minLength: 1 }),
+    }),
+  },
+  response: {
+    body: apiObject({
+      deleted: apiBoolean(),
+      id: apiString({ format: 'uuid' }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Delete one owned ${pascalName} record',
+});
+
+export const ${identifierPrefix}GetRecord = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-read'],
+  contractVersion: '1.0.0',
+  feature: 'database',
+  lifecycle: { status: 'active' },
+  method: 'GET',
+  operationId: '${name}.get-record',
+  path: '/records/{recordId}',
+  problems: recordNotFoundProblems,
+  request: { path: recordPath() },
+  response: { body: recordResponse(), status: 200 },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Read one owned ${pascalName} record',
+});
+
+export const ${identifierPrefix}PublishCreated = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:event-publish'],
+  contractVersion: '1.0.0',
+  feature: 'events',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.publish-created',
+  path: '/events/example',
+  problems: authorizationProblems,
+  response: {
+    body: apiObject({
+      eventId: apiString({ format: 'uuid' }),
+    }),
+    status: 200,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Publish a ${pascalName} example event',
+});
+
+export const ${identifierPrefix}PutRecord = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-write'],
+  contractVersion: '1.0.0',
+  feature: 'database',
+  lifecycle: { status: 'active' },
+  method: 'PUT',
+  operationId: '${name}.put-record',
+  path: '/records/{recordId}',
+  problems: recordConflictProblems,
+  request: {
+    body: apiObject({
+      name: apiString({ maxLength: 128, minLength: 1 }),
+      runScope: apiString({ maxLength: 128, minLength: 1 }),
+      testExpiresAt: apiOptional(
+        apiString({ maxLength: 40, minLength: 20 }),
+      ),
+    }),
+    maxBodyBytes: 512,
+    path: recordPath(),
+  },
+  response: { body: recordResponse(), status: 200 },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Create or replace one owned ${pascalName} record',
+});
+
+export const ${identifierPrefix}RequestRecordDeletion = defineApiOperation({
+  authentication: 'customer',
+  authorizationActions: ['${name}:record-delete'],
+  contractVersion: '1.0.0',
+  feature: 'data-lifecycle',
+  lifecycle: { status: 'active' },
+  method: 'POST',
+  operationId: '${name}.request-record-deletion',
+  path: '/records/{recordId}/deletion-requests',
+  problems: recordNotFoundProblems,
+  request: {
+    body: apiObject({
+      reasonCode: apiString({ maxLength: 64, minLength: 1 }),
+    }),
+    maxBodyBytes: 256,
+    path: recordPath(),
+  },
+  response: {
+    body: apiObject({
+      approvalRequestId: apiString({ format: 'uuid' }),
+      expiresAt: apiString({ maxLength: 40, minLength: 20 }),
+      requestDigest: apiString({ maxLength: 64, minLength: 64 }),
+      status: apiString({ enum: ['pending'] as const }),
+    }),
+    status: 202,
+  },
+  responseProfile: 'ebk-app-v1',
+  slice: '${name}',
+  summary: 'Request approval for one ${pascalName} record deletion',
+});
+
+export const ${contractIdentifier} = defineApiContract({
+  operations: [
+    ${identifierPrefix}CleanupRecordExport,
+    ${identifierPrefix}DatabaseHealth,
+    ${identifierPrefix}DecideRecordExport,
+    ${identifierPrefix}DecideRecordDeletion,
+    ${identifierPrefix}DecideRetentionApproval,
+    ${identifierPrefix}DeliverRecordExport,
+    ${identifierPrefix}DeleteRecord,
+    ${identifierPrefix}ExecuteRecordExport,
+    ${identifierPrefix}ExpireRecordHold,
+    ${identifierPrefix}GetRecord,
+    ${identifierPrefix}Health,
+    ${identifierPrefix}IssueRecordDelegation,
+    ${identifierPrefix}IssueRecordHold,
+    ${identifierPrefix}MachineAuthorizationProof,
+    ${identifierPrefix}ProtectedExample,
+    ${identifierPrefix}PublishCreated,
+    ${identifierPrefix}PutRecord,
+    ${identifierPrefix}RequestRecordDeletion,
+    ${identifierPrefix}RequestRecordExport,
+    ${identifierPrefix}RequestRetentionApproval,
+    ${identifierPrefix}ReleaseRecordHold,
+    ${identifierPrefix}ReviewRecordHold,
+    ${identifierPrefix}RevokeRecordDelegation,
+    ${identifierPrefix}UseRecordDelegation,
+  ] as const,
+  slice: '${name}',
+  title: '${pascalName} API',
+  version: '1.0.0',
+});
+`,
+        'api/contracts/index.ts': `export {
+  ${contractIdentifier},
+  ${identifierPrefix}CleanupRecordExport,
+  ${identifierPrefix}DatabaseHealth,
+  ${identifierPrefix}DecideRecordExport,
+  ${identifierPrefix}DecideRecordDeletion,
+  ${identifierPrefix}DecideRetentionApproval,
+  ${identifierPrefix}DeliverRecordExport,
+  ${identifierPrefix}DeleteRecord,
+  ${identifierPrefix}ExecuteRecordExport,
+  ${identifierPrefix}ExpireRecordHold,
+  ${identifierPrefix}GetRecord,
+  ${identifierPrefix}Health,
+  ${identifierPrefix}IssueRecordDelegation,
+  ${identifierPrefix}IssueRecordHold,
+  ${identifierPrefix}MachineAuthorizationProof,
+  ${identifierPrefix}ProtectedExample,
+  ${identifierPrefix}PublishCreated,
+  ${identifierPrefix}PutRecord,
+  ${identifierPrefix}RequestRecordDeletion,
+  ${identifierPrefix}RequestRecordExport,
+  ${identifierPrefix}RequestRetentionApproval,
+  ${identifierPrefix}ReleaseRecordHold,
+  ${identifierPrefix}ReviewRecordHold,
+  ${identifierPrefix}RevokeRecordDelegation,
+  ${identifierPrefix}UseRecordDelegation,
+} from './protected.js';
+`,
+        'api/generated/client.ts': `import {
+  createApiContractClient,
+  type ApiContractClient,
+  type CreateApiClientOptions,
+} from '@empire-builder-kit/runtime/api-client';
+import { ${contractIdentifier} } from '../contracts/index.js';
+
+export type ${pascalName}ApiClient = ApiContractClient<
+  typeof ${contractIdentifier}
+>;
+
+export function create${pascalName}ApiClient(
+  options: CreateApiClientOptions,
+): ${pascalName}ApiClient {
+  return createApiContractClient(${contractIdentifier}, options);
+}
+`,
+        'api/generated/contract.json': artifacts.normalizedJson,
+        'api/generated/openapi.json': artifacts.openApiJson,
+        'api/generated/baseline.json': baseline,
+        'docs/api-contracts.md': `# ${name} synchronous API
+
+Author operation behavior in \`api/contracts/\`. The TypeScript contract is the
+source of truth. The normalized contract, OpenAPI document, and browser-safe
+client under \`api/generated/\` are managed output. The seeded compatibility
+baseline is reviewed product state and is never restamped by regeneration.
+
+Transport declarations must be lossless on the wire. String request headers
+use \`apiString({ format: 'ebk-http-header-value' })\`: visible ASCII only,
+at most 8 KiB, with no empty value, leading or trailing whitespace, controls,
+DEL, or non-ASCII. Path strings must exclude the empty value, and repeated
+query arrays must require at least one item.
+
+Every actionable authentication or authorization failure must be declared by
+the operation contract. An undeclared or inconsistent failure is treated as a
+contract defect and returned as a sanitized 500 response, never improvised as
+a new wire-visible 401 or 403 response.
+
+Run \`pnpm nx run ${name}:api-contract-generate\` after changing an operation,
+then inspect the generated diff and run
+\`pnpm nx run ${name}:api-contract-check\`. The check is report-first and never
+updates the accepted baseline.
+
+An intentional baseline update requires a reviewed JSON approval:
+
+\`\`\`sh
+pnpm nx run ${name}:api-contract-baseline -- --approval=path/to/approval.json
+\`\`\`
+
+Compatible approvals pin the exact candidate digest and reason. Conditional
+approvals also require semantic-review evidence. Breaking approvals require
+consumer evidence, rollout evidence, and an exact rollout-plan identity and
+digest. Baseline updates never occur during generation or verification.
+
+Other Slices may import only \`@<workspace>/${name}/api-contract\`,
+\`@<workspace>/${name}/api-client\`, or the transport-neutral
+\`@<workspace>/${name}/contracts\` surface. They may not import handlers,
+database code, or other implementation paths.
+`,
+        'scripts/contract-dependencies.mjs': `import {
+  existsSync,
+  readFileSync,
+  realpathSync,
+  readdirSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { createRequire } from 'node:module';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const {
+  normalizeApiContractProjectDeclarations,
+  resolveApiContractDependencies,
+} = require('@empire-builder-kit/nx/api-contract');
+const {
+  validateGeneratedOwnershipRecord,
+} = require('@empire-builder-kit/nx/ownership');
+
+const projectRoot = process.cwd();
+const workspaceRoot = resolve(projectRoot, '../..');
+const action = process.argv[2] ?? 'check';
+if (action !== 'check' && action !== 'sync') {
+  throw new Error(
+    'Usage: node scripts/contract-dependencies.mjs <check|sync>',
+  );
+}
+const readJson = (path) => {
+  const contents = readFileSync(path, 'utf8');
+  try {
+    return JSON.parse(contents);
+  } catch (error) {
+    const qualifiedPath = relative(workspaceRoot, path)
+      .split(sep)
+      .join('/');
+    throw new Error(
+      qualifiedPath +
+        ' contains malformed JSON: ' +
+        (error instanceof Error ? error.message : String(error)),
+    );
+  }
+};
+const declarationPath = join(
+  projectRoot,
+  'contracts',
+  'dependencies.json',
+);
+const ownershipPath = join(projectRoot, '.ebk', 'ownership.json');
+const allowedContractExports = new Map([
+  ['./api-client', { exact: 'api/generated/client.ts' }],
+  ['./api-contract', { surface: 'api/contracts' }],
+  ['./contracts', { exact: 'contracts/index.ts' }],
+]);
+
+function isContained(root, candidate) {
+  const pathFromRoot = relative(root, candidate);
+  return (
+    pathFromRoot !== '..' &&
+    !pathFromRoot.startsWith('..' + sep) &&
+    !isAbsolute(pathFromRoot)
+  );
+}
+
+function declaredExportTargets(declaration, packageName, exportName) {
+  if (typeof declaration === 'string') return [declaration];
+  if (
+    !declaration ||
+    typeof declaration !== 'object' ||
+    Array.isArray(declaration) ||
+    Object.keys(declaration).length === 0 ||
+    Object.values(declaration).some((target) => typeof target !== 'string')
+  ) {
+    throw new Error(
+      'Package ' +
+        packageName +
+        ' has an invalid conditional export for ' +
+        exportName +
+        '.',
+    );
+  }
+  return Object.values(declaration);
+}
+
+function validateContractExports(root, packageJson, publications) {
+  const exports = packageJson.exports;
+  const packagePrefix = packageJson.name + '/';
+  const requiredExports = new Set();
+  for (const publication of publications) {
+    if (publication === packagePrefix + 'api-contract') {
+      requiredExports.add('./api-client');
+      requiredExports.add('./api-contract');
+    } else if (publication === packagePrefix + 'contracts') {
+      requiredExports.add('./contracts');
+    }
+  }
+  for (const exportName of [...requiredExports].sort()) {
+    const expected = allowedContractExports.get(exportName);
+    if (!expected) {
+      throw new Error(
+        'Package ' +
+          packageJson.name +
+          ' requires an unsupported contract export ' +
+          exportName +
+          '.',
+      );
+    }
+    if (!exports || !Object.hasOwn(exports, exportName)) {
+      throw new Error(
+        'Package ' +
+          packageJson.name +
+          ' is missing contract export ' +
+          exportName +
+          '.',
+      );
+    }
+    for (const target of declaredExportTargets(
+      exports[exportName],
+      packageJson.name,
+      exportName,
+    )) {
+      if (!target.startsWith('./')) {
+        throw new Error(
+          'Package ' +
+            packageJson.name +
+            ' contract export ' +
+            exportName +
+            ' must use a relative package target.',
+        );
+      }
+      const absoluteTarget = resolve(root, target);
+      if (
+        !isContained(workspaceRoot, absoluteTarget) ||
+        !isContained(root, absoluteTarget) ||
+        !existsSync(absoluteTarget) ||
+        !statSync(absoluteTarget).isFile()
+      ) {
+        throw new Error(
+          'Package ' +
+            packageJson.name +
+            ' contract export ' +
+            exportName +
+            ' points outside its package or to a missing file.',
+        );
+      }
+      const realTarget = realpathSync(absoluteTarget);
+      if (
+        !isContained(realpathSync(workspaceRoot), realTarget) ||
+        !isContained(realpathSync(root), realTarget)
+      ) {
+        throw new Error(
+          'Package ' +
+            packageJson.name +
+            ' contract export ' +
+            exportName +
+            ' escapes the repository through an aliased target.',
+        );
+      }
+      const targetFromPackage = relative(root, absoluteTarget)
+        .split(sep)
+        .join('/');
+      const expectedSurface = expected.exact ?? expected.surface;
+      const mapsToSurface =
+        expected.exact !== undefined
+          ? targetFromPackage === expected.exact
+          : targetFromPackage.endsWith('.ts') &&
+            isContained(join(root, expectedSurface), absoluteTarget) &&
+            absoluteTarget !== join(root, expectedSurface);
+      if (!mapsToSurface) {
+        throw new Error(
+          'Package ' +
+            packageJson.name +
+            ' contract export ' +
+            exportName +
+            ' is remapped outside its corresponding contract surface.',
+        );
+      }
+    }
+  }
+}
+
+const declaration = readJson(declarationPath);
+if (
+  !declaration ||
+  typeof declaration !== 'object' ||
+  Array.isArray(declaration) ||
+  declaration.schemaVersion !== 1 ||
+  !Array.isArray(declaration.consumes) ||
+  Object.keys(declaration).some(
+    (key) => !['consumes', 'schemaVersion'].includes(key),
+  )
+) {
+  throw new Error(
+    'contracts/dependencies.json must be a v1 consumes declaration.',
+  );
+}
+const ownership = readJson(ownershipPath);
+const [normalized] = normalizeApiContractProjectDeclarations([
+  {
+    contracts: {
+      consumes: declaration.consumes,
+      publishes: ownership.contracts?.publishes ?? [],
+    },
+    project: '${name}',
+  },
+]);
+if (!normalized) {
+  throw new Error('The contract dependency declaration did not normalize.');
+}
+
+const packagesRoot = join(workspaceRoot, 'packages');
+const projects = new Map();
+const packageNames = new Set();
+const declarations = [];
+for (const entry of readdirSync(packagesRoot, { withFileTypes: true })) {
+  if (!entry.isDirectory() || entry.name === 'foundation') continue;
+  const root = join(packagesRoot, entry.name);
+  const candidateOwnershipPath = join(root, '.ebk', 'ownership.json');
+  if (!existsSync(candidateOwnershipPath)) continue;
+  const candidateOwnership =
+    root === projectRoot
+      ? {
+          ...ownership,
+          contracts: {
+            ...ownership.contracts,
+            consumes: normalized.contracts.consumes,
+          },
+        }
+      : readJson(candidateOwnershipPath);
+  const validation = validateGeneratedOwnershipRecord(candidateOwnership);
+  if (!validation.valid) {
+    throw new Error(
+      'Product Slice ' +
+        entry.name +
+        ' has invalid ownership metadata: ' +
+        JSON.stringify(validation.issues),
+    );
+  }
+  const project = validation.value.slice;
+  const packageJson = readJson(join(root, 'package.json'));
+  if (
+    typeof packageJson.name !== 'string' ||
+    packageJson.name.length === 0 ||
+    projects.has(project) ||
+    packageNames.has(packageJson.name)
+  ) {
+    throw new Error(
+      'Product Slice projects and package names must be unique and explicit.',
+    );
+  }
+  packageNames.add(packageJson.name);
+  validateContractExports(
+    root,
+    packageJson,
+    validation.value.contracts.publishes,
+  );
+  projects.set(project, { packageJson, root });
+  declarations.push({
+    contracts: validation.value.contracts,
+    project,
+  });
+}
+if (!projects.has('${name}')) {
+  throw new Error(
+    'The current Product Slice is absent from workspace ownership.',
+  );
+}
+const resolution = resolveApiContractDependencies(declarations);
+for (const publication of resolution.contracts) {
+  const producer = projects.get(publication.producer);
+  if (!producer) {
+    throw new Error(
+      'Resolved contract producer ' + publication.producer + ' is absent.',
+    );
+  }
+  const prefix = producer.packageJson.name + '/';
+  if (!publication.contract.startsWith(prefix)) {
+    throw new Error(
+      'Published contract ' +
+        publication.contract +
+        ' is outside producer package ' +
+        producer.packageJson.name +
+        '.',
+    );
+  }
+  const exportName = './' + publication.contract.slice(prefix.length);
+  if (!allowedContractExports.has(exportName)) {
+    throw new Error(
+      'Published contract ' +
+        publication.contract +
+        ' does not use an allowed package export ' +
+        exportName +
+        '.',
+    );
+  }
+  for (const consumerName of publication.consumers) {
+    const consumer = projects.get(consumerName);
+    const version =
+      consumer?.packageJson.dependencies?.[producer.packageJson.name];
+    if (typeof version !== 'string' || !version.startsWith('workspace:')) {
+      throw new Error(
+        'Consumed contract ' +
+          publication.contract +
+          ' requires ' +
+          consumerName +
+          ' to declare a workspace dependency on ' +
+          producer.packageJson.name +
+          '.',
+      );
+    }
+  }
+}
+const current = [...(ownership.contracts?.consumes ?? [])].sort();
+const expected = [...normalized.contracts.consumes];
+if (action === 'check') {
+  if (JSON.stringify(current) !== JSON.stringify(expected)) {
+    throw new Error(
+      'Contract declarations are out of sync. Run ' +
+        'pnpm nx run ${name}:contract-dependencies-sync.',
+    );
+  }
+  process.stdout.write(
+    JSON.stringify({
+      action,
+      consumes: expected,
+      project: '${name}',
+      schemaVersion: 1,
+    }) + '\\n',
+  );
+} else {
+  const candidate = {
+    ...ownership,
+    contracts: {
+      ...ownership.contracts,
+      consumes: expected,
+    },
+  };
+  const validation = validateGeneratedOwnershipRecord(candidate);
+  if (!validation.valid) {
+    throw new Error(
+      'Contract dependency sync produced invalid ownership: ' +
+        JSON.stringify(validation.issues),
+    );
+  }
+  writeFileSync(
+    ownershipPath,
+    JSON.stringify(validation.value, null, 2) + '\\n',
+    'utf8',
+  );
+  process.stdout.write(
+    JSON.stringify({
+      action,
+      consumes: expected,
+      project: '${name}',
+      schemaVersion: 1,
+    }) + '\\n',
+  );
+}
+`,
+        'scripts/api-contract.mjs': `import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import {
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { createRequire } from 'node:module';
+import { join, resolve } from 'node:path';
+import { createApiContractArtifacts } from '@empire-builder-kit/runtime/api-contract';
+import { ${contractIdentifier} } from '../api/contracts/protected.ts';
+
+const require = createRequire(import.meta.url);
+const {
+  authorizeApiContractBaselineUpdate,
+  compareApiContracts,
+  createApiContractCompatibilityEvidence,
+  planApiContractBaselineUpdate,
+} = require('@empire-builder-kit/nx/api-contract');
+const {
+  createTestingEvidenceFromRunnerAttempts,
+  inspectTestingEvidenceArtifact,
+  normalizeVitestEvidenceAttempt,
+} = require('@empire-builder-kit/nx/testing-evidence');
+const {
+  validateGeneratedOwnershipRecord,
+} = require('@empire-builder-kit/nx/ownership');
+
+const projectRoot = process.cwd();
+const workspaceRoot = resolve(projectRoot, '../..');
+const generatedRoot = join(projectRoot, 'api', 'generated');
+const evidenceRoot = join(projectRoot, '.ebk', 'evidence');
+const ownershipPath = join(projectRoot, '.ebk', 'ownership.json');
+const normalizedPath = join(generatedRoot, 'contract.json');
+const openApiPath = join(generatedRoot, 'openapi.json');
+const baselinePath = join(generatedRoot, 'baseline.json');
+const reportPath = join(evidenceRoot, 'api-contract-compatibility.json');
+const resultPath = join(evidenceRoot, 'api-contract.json');
+const readJson = (path) => JSON.parse(readFileSync(path, 'utf8'));
+const workspacePackage = readJson(join(workspaceRoot, 'package.json'));
+const ownership = readJson(ownershipPath);
+const artifacts = createApiContractArtifacts(${contractIdentifier});
+const action = process.argv[2] ?? 'check';
+const digest = (contents) =>
+  'sha256:' + createHash('sha256').update(contents).digest('hex');
+
+function sourceIdentity() {
+  const commit =
+    process.env.EBK_SOURCE_COMMIT ??
+    execFileSync('git', ['rev-parse', 'HEAD'], {
+      cwd: workspaceRoot,
+      encoding: 'utf8',
+    }).trim();
+  const frameworkCandidate =
+    workspacePackage.dependencies?.['@empire-builder-kit/runtime'];
+  if (typeof frameworkCandidate !== 'string' || !frameworkCandidate) {
+    throw new Error('The workspace runtime candidate is unavailable.');
+  }
+  return {
+    blueprintCandidates: [
+      ownership.blueprint.name + '@' + ownership.blueprint.version,
+    ],
+    commit,
+    frameworkCandidate,
+  };
+}
+
+function writeManagedArtifacts() {
+  mkdirSync(generatedRoot, { recursive: true });
+  writeFileSync(normalizedPath, artifacts.normalizedJson, 'utf8');
+  writeFileSync(openApiPath, artifacts.openApiJson, 'utf8');
+}
+
+function restampManagedArtifacts() {
+  const managedArtifacts = new Map([
+    ['api/generated/contract.json', artifacts.normalizedJson],
+    ['api/generated/openapi.json', artifacts.openApiJson],
+  ]);
+  const restamped = new Set();
+  const candidate = {
+    ...ownership,
+    paths: ownership.paths.map((entry) => {
+      const contents = managedArtifacts.get(entry.path);
+      if (contents === undefined) return entry;
+      if (entry.mode !== 'managed' || entry.managedJsonPointers !== undefined) {
+        throw new Error(
+          'API contract generation can restamp only whole-file managed artifacts.',
+        );
+      }
+      restamped.add(entry.path);
+      return {
+        ...entry,
+        sha256: createHash('sha256').update(contents).digest('hex'),
+      };
+    }),
+  };
+  if (restamped.size !== managedArtifacts.size) {
+    throw new Error(
+      'API contract generation could not find every managed artifact in ownership metadata.',
+    );
+  }
+  const validation = validateGeneratedOwnershipRecord(candidate);
+  if (!validation.valid) {
+    throw new Error(
+      'API contract generation produced invalid ownership metadata: ' +
+        JSON.stringify(validation.issues),
+    );
+  }
+  writeFileSync(
+    ownershipPath,
+    JSON.stringify(validation.value, null, 2) + '\\n',
+    'utf8',
+  );
+}
+
+function approvalPath() {
+  const inline = process.argv.find((value) => value.startsWith('--approval='));
+  if (inline) return inline.slice('--approval='.length);
+  const index = process.argv.indexOf('--approval');
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+if (action === 'generate') {
+  writeManagedArtifacts();
+  restampManagedArtifacts();
+  process.stdout.write(
+    JSON.stringify({
+      action,
+      baselineUpdated: false,
+      normalizedDigest: digest(artifacts.normalizedJson),
+      openApiDigest: digest(artifacts.openApiJson),
+    }) + '\\n',
+  );
+} else if (action === 'baseline') {
+  const currentBaseline = readJson(baselinePath);
+  const plan = planApiContractBaselineUpdate(
+    currentBaseline,
+    artifacts.normalized,
+  );
+  if (plan.disposition === 'no-change') {
+    process.stdout.write(
+      JSON.stringify({
+        action,
+        baselineUpdated: false,
+        candidateDigest: plan.candidate.digest,
+        disposition: plan.disposition,
+      }) + '\\n',
+    );
+  } else {
+    const path = approvalPath();
+    if (!path) {
+      throw new Error(
+        'A baseline update requires --approval=<reviewed-json-path>.',
+      );
+    }
+    const authorization = authorizeApiContractBaselineUpdate(
+      plan,
+      readJson(resolve(projectRoot, path)),
+    );
+    writeFileSync(baselinePath, authorization.candidateJson, 'utf8');
+    process.stdout.write(
+      JSON.stringify({
+        acceptedClassification: authorization.acceptedClassification,
+        action,
+        baselineDigest: authorization.baselineDigest,
+        baselineUpdated: true,
+        candidateDigest: authorization.candidateDigest,
+      }) + '\\n',
+    );
+  }
+} else if (action === 'check') {
+  const startedAt = new Date().toISOString();
+  mkdirSync(evidenceRoot, { recursive: true });
+  rmSync(reportPath, { force: true });
+  rmSync(resultPath, { force: true });
+  try {
+    const baseline = readJson(baselinePath);
+    const report = compareApiContracts(baseline, artifacts.normalized);
+    const reportJson = JSON.stringify(report, null, 2) + '\\n';
+    const reportInspection = inspectTestingEvidenceArtifact({
+      contents: reportJson,
+    });
+    const generatedDrift =
+      readFileSync(normalizedPath, 'utf8') !== artifacts.normalizedJson ||
+      readFileSync(openApiPath, 'utf8') !== artifacts.openApiJson;
+    const completedAt = new Date().toISOString();
+    const retainedArtifacts = [];
+    if (reportInspection.safe) {
+      writeFileSync(reportPath, reportJson, 'utf8');
+      retainedArtifacts.push({
+        digest: digest(reportJson),
+        name: '.ebk/evidence/api-contract-compatibility.json',
+        retentionClass: 'source-result',
+      });
+    }
+    const evidenceOptions = {
+      artifacts: retainedArtifacts,
+      commandVersion: '1',
+      completedAt,
+      project: '${name}',
+      report,
+      source: sourceIdentity(),
+      startedAt,
+      target: 'api-contract-check',
+      workspace: workspacePackage.name,
+    };
+    const result =
+      generatedDrift || !reportInspection.safe
+        ? createTestingEvidenceFromRunnerAttempts({
+            artifacts: retainedArtifacts,
+            attempts: [
+              normalizeVitestEvidenceAttempt({
+                attempt: 1,
+                completedAt,
+                failed: 1,
+                findings: [
+                  {
+                    classification: generatedDrift
+                      ? 'environment-drift'
+                      : 'sensitive-artifact',
+                    summary: generatedDrift
+                      ? 'Managed API artifacts differ from the authoritative contract.'
+                      : 'The API compatibility report matched protected artifact data and was not retained.',
+                  },
+                ],
+                passed: 0,
+                skipped: 0,
+                startedAt,
+              }),
+            ],
+            cleanup: { outcome: 'not-required' },
+            environment: { class: 'source', deployed: false },
+            operation: {
+              commandVersion: '1',
+              project: '${name}',
+              proofLayer: 'contract-compatibility',
+              target: 'api-contract-check',
+            },
+            proofStarted: true,
+            slice: '${name}',
+            source: evidenceOptions.source,
+            workspace: workspacePackage.name,
+          })
+        : createApiContractCompatibilityEvidence(evidenceOptions);
+    writeFileSync(
+      resultPath,
+      JSON.stringify(result, null, 2) + '\\n',
+      'utf8',
+    );
+    process.stdout.write(JSON.stringify(result) + '\\n');
+    if (result.outcome !== 'passed') process.exitCode = 1;
+  } catch (error) {
+    const completedAt = new Date().toISOString();
+    const missing =
+      error &&
+      typeof error === 'object' &&
+      'code' in error &&
+      error.code === 'ENOENT';
+    const result = createTestingEvidenceFromRunnerAttempts({
+      artifacts: [],
+      attempts: [],
+      cleanup: { outcome: 'not-required' },
+      environment: { class: 'source', deployed: false },
+      operation: {
+        commandVersion: '1',
+        project: '${name}',
+        proofLayer: 'contract-compatibility',
+        target: 'api-contract-check',
+      },
+      preflight: {
+        completedAt,
+        findings: [
+          {
+            classification: missing
+              ? 'prerequisite-missing'
+              : 'environment-drift',
+            summary: missing
+              ? 'A required API contract artifact or baseline is missing.'
+              : 'A required API contract artifact or baseline is invalid.',
+          },
+        ],
+        startedAt,
+      },
+      proofStarted: false,
+      slice: '${name}',
+      source: sourceIdentity(),
+      workspace: workspacePackage.name,
+    });
+    writeFileSync(
+      resultPath,
+      JSON.stringify(result, null, 2) + '\\n',
+      'utf8',
+    );
+    process.stdout.write(JSON.stringify(result) + '\\n');
+    process.exitCode = 1;
+  }
+} else {
+  throw new Error(
+    'Usage: node scripts/api-contract.mjs <check|generate|baseline>',
+  );
+}
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-api-contract-files.js.map