@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-data-deletion-files.js

@@ -0,0 +1,1101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductDataDeletionFiles = renderProductDataDeletionFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+/** @internal */
+function renderProductDataDeletionFiles(name, pascalName, workspace) {
+    const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
+    return {
+        'data/lifecycle-consumers.json': (0, built_in_plan_shared_js_1.json)({
+            acceptedSources: [name],
+            schemaVersion: 1,
+        }),
+        'data/pseudonymous-reference.ts': `import {
+  createDataLifecyclePseudonymousReference,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+
+function reference(namespace: string, value: string): string {
+  return createDataLifecyclePseudonymousReference({
+    categoryId: namespace,
+    slice: '${name}',
+    value,
+  });
+}
+
+/** One Slice-local identity for the record across holds, ledger, and events. */
+export function productRecordReference(recordId: string): string {
+  return reference('product-record', recordId);
+}
+
+/** Safe request identity retained after the approval row expires. */
+export function approvalReference(approvalRequestId: string): string {
+  return reference('approval-request', approvalRequestId);
+}
+`,
+        'database/deletions.ts': `import { createHash } from 'node:crypto';
+import {
+  EventBridgeClient,
+  PutEventsCommand,
+  type PutEventsRequestEntry,
+} from '@aws-sdk/client-eventbridge';
+import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import type { Principal } from '@empire-builder-kit/runtime/auth';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import {
+  assertAuthorizationAllowed,
+  beginApprovalExecution,
+  completeApprovalExecution,
+  createApprovalRequest,
+  createDirectAuthorizationPrincipal,
+  decideApprovalRequest,
+  type ApprovalRequest,
+} from '@empire-builder-kit/runtime/authorization';
+import {
+  createDataLifecycleDeletionRequest,
+  createDataLifecycleLedgerEntry,
+  transitionDataLifecycleDeletion,
+  type DataLifecycleDeletionRequestV1,
+  type DataLifecycleRuntimeHoldV1,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import { buildEventEntry } from '@empire-builder-kit/runtime/events';
+import { RuntimeError } from '@empire-builder-kit/runtime/response';
+import type { Client as PgClient } from 'pg';
+import {
+  ${identifierPrefix}DecideRecordDeletion,
+  ${identifierPrefix}DeleteRecord,
+  ${identifierPrefix}RequestRecordDeletion,
+} from '../api/contracts/protected.js';
+import { authorize${pascalName}Operation } from '../authorization/runtime.js';
+import {
+  ${identifierPrefix}AuthorizationPolicy,
+  type ${pascalName}AuthorizationAction,
+} from '../authorization/policy.js';
+import {
+  ${pascalName}DataLifecycleChanged,
+} from '../contracts/events.js';
+import {
+  create${pascalName}DataLifecycleChanged,
+} from '../data/lifecycle-event.js';
+import {
+  approvalReference,
+  productRecordReference,
+} from '../data/pseudonymous-reference.js';
+import {
+  ${pascalName}DataLifecycleRuntimePolicy,
+} from '../data/runtime-policy.cjs';
+import { withPrimaryDatabase } from './runtime-client.js';
+
+const POLICY_VERSION =
+  ${pascalName}DataLifecycleRuntimePolicy.policyVersion;
+const AUTHORIZATION_POLICY_VERSION =
+  ${identifierPrefix}AuthorizationPolicy.version;
+const OUTBOX_COPY_ID = 'event-contract';
+const eventBridge = new EventBridgeClient({});
+
+type ProductApproval = ApprovalRequest<${pascalName}AuthorizationAction>;
+
+interface WorkflowRow {
+  approval: ProductApproval;
+  lifecycle: DataLifecycleDeletionRequestV1;
+}
+
+interface OutboxRow {
+  eventJson: PutEventsRequestEntry;
+  publishedAt: Date | null;
+}
+
+function canonicalNow(): string {
+  return new Date().toISOString();
+}
+
+function digestReference(namespace: string, value: string): string {
+  return (
+    'sha256:' +
+    createHash('sha256')
+      .update('${name}\\0' + namespace + '\\0' + value)
+      .digest('hex')
+  );
+}
+
+function deletionCommand(recordId: string, reasonCode: string) {
+  return { reasonCode, recordId };
+}
+
+function plusDays(value: string, days: number): string {
+  const result = new Date(value);
+  result.setUTCDate(result.getUTCDate() + days);
+  return result.toISOString();
+}
+
+function notFound(): never {
+  throw new RuntimeError({
+    code: 'record_not_found',
+    message: 'The record was not found.',
+    retryable: false,
+    status: 404,
+  });
+}
+
+function held(): never {
+  throw new RuntimeError({
+    code: 'data_deletion_held',
+    message: 'Deletion is blocked by an active hold.',
+    retryable: false,
+    status: 409,
+  });
+}
+
+function retryRequired(): never {
+  throw new RuntimeError({
+    code: 'data_deletion_retry_required',
+    message: 'Deletion propagation requires retry.',
+    retryable: true,
+    status: 503,
+  });
+}
+
+function approvalOutcome(value: string): 'approved' | 'rejected' {
+  if (value === 'approved' || value === 'rejected') return value;
+  throw new RuntimeError({
+    code: 'approval_outcome_invalid',
+    message: 'The approval outcome is invalid.',
+    retryable: false,
+    status: 400,
+  });
+}
+
+async function rollback(client: PgClient): Promise<void> {
+  await client.query('ROLLBACK').catch(() => undefined);
+}
+
+async function loadWorkflow(
+  client: PgClient,
+  approvalRequestId: string,
+): Promise<WorkflowRow | undefined> {
+  const result = await client.query<{
+    approval: ProductApproval;
+    lifecycle: DataLifecycleDeletionRequestV1;
+  }>(
+    \`SELECT a.request_json AS approval,
+            d.request_json AS lifecycle
+     FROM approval_requests a
+     JOIN data_lifecycle_requests d
+       ON d.approval_request_id = a.id
+     WHERE a.id = $1::uuid
+     FOR UPDATE OF a, d\`,
+    [approvalRequestId],
+  );
+  return result.rows[0];
+}
+
+async function writeApproval(
+  client: PgClient,
+  previousRevision: number,
+  approval: ProductApproval,
+): Promise<void> {
+  const result = await client.query(
+    \`UPDATE approval_requests
+     SET expires_at = $3,
+         policy_version = $4,
+         request_digest = $5,
+         request_json = $6::jsonb,
+         revision = $7,
+         status = $8
+     WHERE id = $1::uuid AND revision = $2\`,
+    [
+      approval.id,
+      previousRevision,
+      approval.expiresAt,
+      approval.policyVersion,
+      approval.requestDigest,
+      JSON.stringify(approval),
+      approval.revision,
+      approval.status,
+    ],
+  );
+  if (result.rowCount !== 1) {
+    throw new Error('Approval compare-and-set failed.');
+  }
+}
+
+async function writeLifecycle(
+  client: PgClient,
+  approvalRequestId: string,
+  lifecycle: DataLifecycleDeletionRequestV1,
+): Promise<void> {
+  const result = await client.query(
+    \`UPDATE data_lifecycle_requests
+     SET request_json = $2::jsonb,
+         revision = revision + 1,
+         status = $3,
+         updated_at = $4
+     WHERE approval_request_id = $1::uuid\`,
+    [
+      approvalRequestId,
+      JSON.stringify(lifecycle),
+      lifecycle.status,
+      lifecycle.updatedAt,
+    ],
+  );
+  if (result.rowCount !== 1) {
+    throw new Error('Lifecycle request compare-and-set failed.');
+  }
+}
+
+async function writeWorkflowAudit(
+  client: PgClient,
+  input: {
+    action: string;
+    approvalRequestId: string;
+    correlationId: string;
+    principal: Principal;
+    reasonCategory: string;
+    recordId: string;
+  },
+): Promise<void> {
+  await client.query(
+    \`INSERT INTO authorization_audit
+       (action, approval_reference, authority_mode, correlation_id, decision,
+        delegation_reference, policy_version, principal_kind,
+        pseudonymous_subject_id, reason_category, resource_reference,
+        resource_type, slice, stage, subject_type)
+     VALUES ($1, $2, 'direct', $3, 'allow', NULL, $4, $5, $6, $7, $8,
+             'record', $9, $10, $11)\`,
+    [
+      input.action,
+      digestReference('approval', input.approvalRequestId),
+      input.correlationId,
+      AUTHORIZATION_POLICY_VERSION,
+      input.principal.kind,
+      digestReference('subject', input.principal.id),
+      input.reasonCategory,
+      digestReference('record', input.recordId),
+      '${name}',
+      process.env.EBK_STAGE ?? 'development',
+      input.principal.session.subject.type,
+    ],
+  );
+}
+
+async function activeHolds(
+  client: PgClient,
+  scopeRef: string,
+): Promise<DataLifecycleRuntimeHoldV1[]> {
+  const result = await client.query<{ holdJson: DataLifecycleRuntimeHoldV1 }>(
+    \`SELECT hold_json AS "holdJson"
+     FROM data_lifecycle_holds
+     WHERE category_id = 'product-record'
+       AND scope_ref = $1
+       AND status = 'active'
+     ORDER BY hold_id\`,
+    [scopeRef],
+  );
+  return [
+    ...${pascalName}DataLifecycleRuntimePolicy.declaredHolds,
+    ...result.rows.map(({ holdJson }) => holdJson),
+  ];
+}
+
+export const requestDeletionHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}RequestRecordDeletion,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'database-records',
+  operation: ${identifierPrefix}RequestRecordDeletion,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  async handle({ context, principal, request }) {
+    const now = canonicalNow();
+    const command = deletionCommand(
+      request.path.recordId,
+      request.body.reasonCode,
+    );
+    const approval = createApprovalRequest<${pascalName}AuthorizationAction>({
+      action: '${name}:record-delete',
+      author: createDirectAuthorizationPrincipal(principal),
+      command,
+      expiresAt: plusDays(now, 1),
+      now,
+      policyVersion: AUTHORIZATION_POLICY_VERSION,
+      resource: { id: request.path.recordId, type: 'record' },
+      slice: '${name}',
+    });
+    const lifecycle = createDataLifecycleDeletionRequest({
+      approvalRequirement: 'required',
+      categoryId: 'product-record',
+      createdAt: now,
+      downstreamCopyIds: [OUTBOX_COPY_ID],
+      policyVersion: POLICY_VERSION,
+      primaryLocationId: 'primary-database',
+      requestRef: approvalReference(approval.id),
+      scopeRef: productRecordReference(request.path.recordId),
+    });
+
+    await withPrimaryDatabase(
+      context,
+      'api-database-records',
+      async (client) => {
+        await client.query('BEGIN');
+        try {
+          const record = await client.query(
+            'SELECT 1 FROM records WHERE id = $1::uuid FOR UPDATE',
+            [request.path.recordId],
+          );
+          if (record.rowCount !== 1) notFound();
+          await client.query(
+            \`INSERT INTO approval_requests
+               (id, author_reference, expires_at, policy_version,
+                request_digest, request_json, revision, status)
+             VALUES ($1::uuid, $2, $3, $4, $5, $6::jsonb, $7, $8)\`,
+            [
+              approval.id,
+              approval.author.effectiveHumanId ?? approval.author.actorId,
+              approval.expiresAt,
+              approval.policyVersion,
+              approval.requestDigest,
+              JSON.stringify(approval),
+              approval.revision,
+              approval.status,
+            ],
+          );
+          await client.query(
+            \`INSERT INTO data_lifecycle_requests
+               (id, approval_request_id, request_json, revision, status,
+                updated_at)
+             VALUES (gen_random_uuid(), $1::uuid, $2::jsonb, 0, $3, $4)\`,
+            [
+              approval.id,
+              JSON.stringify(lifecycle),
+              lifecycle.status,
+              lifecycle.updatedAt,
+            ],
+          );
+          await writeWorkflowAudit(client, {
+            action: '${name}:approval-request',
+            approvalRequestId: approval.id,
+            correlationId: context.correlationId,
+            principal,
+            reasonCategory: 'approval-pending',
+            recordId: request.path.recordId,
+          });
+          await client.query('COMMIT');
+        } catch (error) {
+          await rollback(client);
+          throw error;
+        }
+      },
+    );
+    return {
+      approvalRequestId: approval.id,
+      expiresAt: approval.expiresAt,
+      requestDigest: approval.requestDigest,
+      status: 'pending' as const,
+    };
+  },
+});
+
+export const decideDeletionHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}DecideRecordDeletion,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'database-records',
+  operation: ${identifierPrefix}DecideRecordDeletion,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  async handle({ context, principal, request }) {
+    const result = await withPrimaryDatabase(
+      context,
+      'api-database-records',
+      async (client) => {
+        await client.query('BEGIN');
+        try {
+          const workflow = await loadWorkflow(
+            client,
+            request.path.approvalRequestId,
+          );
+          if (
+            !workflow ||
+            workflow.approval.resource.id !== request.path.recordId
+          ) {
+            notFound();
+          }
+          const now = canonicalNow();
+          const transition = decideApprovalRequest(workflow.approval, {
+            approver: createDirectAuthorizationPrincipal(principal),
+            expectedRequestDigest: request.body.expectedRequestDigest,
+            now,
+            outcome: approvalOutcome(request.body.outcome),
+            reasonReference: request.body.reasonReference,
+            requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
+          });
+          assertAuthorizationAllowed(transition.decision);
+          await writeApproval(
+            client,
+            workflow.approval.revision,
+            transition.request,
+          );
+          if (transition.request.status === 'rejected') {
+            await writeLifecycle(
+              client,
+              transition.request.id,
+              transitionDataLifecycleDeletion(workflow.lifecycle, {
+                at: now,
+                reasonCode: 'approval-rejected',
+                type: 'reject',
+              }),
+            );
+          }
+          await writeWorkflowAudit(client, {
+            action: '${name}:approval-decision',
+            approvalRequestId: transition.request.id,
+            correlationId: context.correlationId,
+            principal,
+            reasonCategory:
+              transition.request.status === 'approved'
+                ? 'approval-approved'
+                : 'approval-rejected',
+            recordId: request.path.recordId,
+          });
+          await client.query('COMMIT');
+          return transition.request;
+        } catch (error) {
+          await rollback(client);
+          throw error;
+        }
+      },
+    );
+    return {
+      approvalRequestId: result.id,
+      status: result.status as 'approved' | 'rejected',
+    };
+  },
+});
+
+interface PreparedDeletion {
+  alreadyCompleted: boolean;
+  approval: ProductApproval;
+  event?: PutEventsRequestEntry;
+  held: boolean;
+  lifecycle: DataLifecycleDeletionRequestV1;
+}
+
+async function prepareDeletion(
+  client: PgClient,
+  input: {
+    approvalRequestId: string;
+    correlationId: string;
+    principal: Principal;
+    reasonCode: string;
+    recordId: string;
+  },
+): Promise<PreparedDeletion> {
+  const workflow = await loadWorkflow(client, input.approvalRequestId);
+  if (
+    !workflow ||
+    workflow.approval.resource.id !== input.recordId ||
+    workflow.approval.action !== '${name}:record-delete'
+  ) {
+    notFound();
+  }
+  if (
+    workflow.approval.status === 'executed' &&
+    workflow.lifecycle.status === 'completed'
+  ) {
+    return {
+      alreadyCompleted: true,
+      approval: workflow.approval,
+      held: false,
+      lifecycle: workflow.lifecycle,
+    };
+  }
+
+  const now = canonicalNow();
+  const command = deletionCommand(input.recordId, input.reasonCode);
+  const executionId = 'deletion:' + input.approvalRequestId;
+  if (
+    workflow.lifecycle.status === 'requested' ||
+    workflow.lifecycle.status === 'held' ||
+    workflow.lifecycle.status === 'verified'
+  ) {
+    const record = await client.query(
+      'SELECT 1 FROM records WHERE id = $1::uuid FOR UPDATE',
+      [input.recordId],
+    );
+    if (record.rowCount !== 1) notFound();
+  }
+  const begun = beginApprovalExecution(workflow.approval, {
+    action: '${name}:record-delete',
+    command,
+    executionId,
+    now,
+    requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
+    resource: { id: input.recordId, type: 'record' },
+  });
+  assertAuthorizationAllowed(begun.decision);
+  let lifecycle = workflow.lifecycle;
+  if (lifecycle.status === 'requested' || lifecycle.status === 'held') {
+    lifecycle = transitionDataLifecycleDeletion(lifecycle, {
+      approvalRef: approvalReference(input.approvalRequestId),
+      at: now,
+      authorityRef: digestReference('subject', input.principal.id),
+      holds: await activeHolds(client, lifecycle.scopeRef),
+      type: 'verify',
+    });
+  }
+  if (lifecycle.status === 'held') {
+    await writeLifecycle(client, input.approvalRequestId, lifecycle);
+    return {
+      alreadyCompleted: false,
+      approval: workflow.approval,
+      held: true,
+      lifecycle,
+    };
+  }
+  if (lifecycle.status === 'failed') {
+    lifecycle = transitionDataLifecycleDeletion(lifecycle, {
+      at: now,
+      type: 'retry',
+    });
+  }
+
+  let event: PutEventsRequestEntry | undefined;
+  if (
+    lifecycle.status === 'verified' ||
+    lifecycle.status === 'primary-deletion-in-progress'
+  ) {
+    if (lifecycle.status === 'verified') {
+      lifecycle = transitionDataLifecycleDeletion(lifecycle, {
+        at: now,
+        type: 'start-primary',
+      });
+    }
+    const deleted = await client.query(
+      'DELETE FROM records WHERE id = $1::uuid',
+      [input.recordId],
+    );
+    const pseudonymousKey = productRecordReference(input.recordId);
+    const ledger = createDataLifecycleLedgerEntry({
+      action: 'deletion',
+      categoryId: 'product-record',
+      effectiveAt: now,
+      expiresAt: plusDays(now, 400),
+      policyVersion: POLICY_VERSION,
+      pseudonymousKey,
+    });
+    await client.query(
+      \`INSERT INTO data_lifecycle_ledger
+         (entry_id, action, category_id, effective_at, expires_at,
+          idempotency_key, policy_version, pseudonymous_key)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+       ON CONFLICT (idempotency_key) DO NOTHING\`,
+      [
+        ledger.entryId,
+        ledger.action,
+        ledger.categoryId,
+        ledger.effectiveAt,
+        ledger.expiresAt,
+        digestReference('approval', input.approvalRequestId),
+        ledger.policyVersion,
+        ledger.pseudonymousKey,
+      ],
+    );
+    const lifecycleEvent = create${pascalName}DataLifecycleChanged({
+      action: 'deletion',
+      occurredAt: now,
+      policyVersion: POLICY_VERSION,
+      recordId: input.recordId,
+      requestRef: approvalReference(input.approvalRequestId),
+    });
+    const built = buildEventEntry(
+      ${pascalName}DataLifecycleChanged,
+      lifecycleEvent,
+      {
+        busName: process.env.EVENT_BUS_NAME ?? '',
+        context: { correlationId: input.correlationId },
+        eventId: input.approvalRequestId,
+        occurredAt: now,
+        stage: process.env.EBK_STAGE ?? 'development',
+      },
+    );
+    event = {
+      Detail: built.entry.detail,
+      DetailType: built.entry.detailType,
+      EventBusName: built.entry.eventBusName,
+      Source: built.entry.source,
+    };
+    await client.query(
+      \`INSERT INTO data_lifecycle_outbox
+         (idempotency_key, event_json, expires_at)
+       VALUES ($1, $2::jsonb, $3)
+       ON CONFLICT (idempotency_key) DO NOTHING\`,
+      [
+        digestReference('outbox', input.approvalRequestId),
+        JSON.stringify(event),
+        plusDays(now, 30),
+      ],
+    );
+    lifecycle = transitionDataLifecycleDeletion(lifecycle, {
+      at: now,
+      outcomeCode: deleted.rowCount === 1 ? 'deleted' : 'not-found',
+      type: 'complete-primary',
+    });
+  } else {
+    const outbox = await client.query<OutboxRow>(
+      \`SELECT event_json AS "eventJson", published_at AS "publishedAt"
+       FROM data_lifecycle_outbox
+       WHERE idempotency_key = $1
+       FOR UPDATE\`,
+      [digestReference('outbox', input.approvalRequestId)],
+    );
+    event = outbox.rows[0]?.eventJson;
+  }
+
+  if (begun.request !== workflow.approval) {
+    await writeApproval(
+      client,
+      workflow.approval.revision,
+      begun.request,
+    );
+  }
+  await writeLifecycle(client, input.approvalRequestId, lifecycle);
+  return {
+    alreadyCompleted: false,
+    approval: begun.request,
+    event,
+    held: false,
+    lifecycle,
+  };
+}
+
+async function recordPublicationFailure(
+  context: { correlationId: string },
+  approvalRequestId: string,
+): Promise<void> {
+  await withPrimaryDatabase(
+    context,
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const workflow = await loadWorkflow(client, approvalRequestId);
+        if (
+          workflow &&
+          workflow.lifecycle.status ===
+            'downstream-deletion-in-progress'
+        ) {
+          const at = canonicalNow();
+          const started = transitionDataLifecycleDeletion(
+            workflow.lifecycle,
+            { at, copyId: OUTBOX_COPY_ID, type: 'start-copy' },
+          );
+          const failed = transitionDataLifecycleDeletion(started, {
+            at,
+            copyId: OUTBOX_COPY_ID,
+            errorCode: 'event-publication-failed',
+            type: 'fail-copy',
+          });
+          await writeLifecycle(client, approvalRequestId, failed);
+        }
+        await client.query(
+          \`UPDATE data_lifecycle_outbox
+           SET attempts = attempts + 1,
+               last_error_code = 'event-publication-failed'
+           WHERE idempotency_key = $1\`,
+          [digestReference('outbox', approvalRequestId)],
+        );
+        await client.query('COMMIT');
+      } catch (error) {
+        await rollback(client);
+        throw error;
+      }
+    },
+  );
+}
+
+async function completeDeletion(
+  context: { correlationId: string },
+  input: {
+    approvalRequestId: string;
+    principal: Principal;
+    recordId: string;
+  },
+): Promise<void> {
+  await withPrimaryDatabase(
+    context,
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const workflow = await loadWorkflow(
+          client,
+          input.approvalRequestId,
+        );
+        if (!workflow) notFound();
+        if (
+          workflow.approval.status === 'executed' &&
+          workflow.lifecycle.status === 'completed'
+        ) {
+          await client.query('COMMIT');
+          return;
+        }
+        const at = canonicalNow();
+        let lifecycle = workflow.lifecycle;
+        if (lifecycle.status === 'failed') {
+          lifecycle = transitionDataLifecycleDeletion(lifecycle, {
+            at,
+            type: 'retry',
+          });
+        }
+        const started = transitionDataLifecycleDeletion(lifecycle, {
+          at,
+          copyId: OUTBOX_COPY_ID,
+          type: 'start-copy',
+        });
+        lifecycle = transitionDataLifecycleDeletion(started, {
+          at,
+          copyId: OUTBOX_COPY_ID,
+          outcomeCode: 'acknowledged',
+          type: 'complete-copy',
+        });
+        const completed = completeApprovalExecution(workflow.approval, {
+          executionId: 'deletion:' + input.approvalRequestId,
+          now: at,
+          requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
+        });
+        assertAuthorizationAllowed(completed.decision);
+        await writeLifecycle(client, input.approvalRequestId, lifecycle);
+        await writeApproval(
+          client,
+          workflow.approval.revision,
+          completed.request,
+        );
+        await client.query(
+          \`UPDATE data_lifecycle_outbox
+           SET attempts = attempts + 1,
+               last_error_code = NULL,
+               published_at = $2
+           WHERE idempotency_key = $1\`,
+          [digestReference('outbox', input.approvalRequestId), at],
+        );
+        await writeWorkflowAudit(client, {
+          action: '${name}:approval-execution',
+          approvalRequestId: input.approvalRequestId,
+          correlationId: context.correlationId,
+          principal: input.principal,
+          reasonCategory: 'approval-executed',
+          recordId: input.recordId,
+        });
+        await client.query('COMMIT');
+      } catch (error) {
+        await rollback(client);
+        throw error;
+      }
+    },
+  );
+}
+
+export const deleteHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}DeleteRecord,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'database-records',
+  operation: ${identifierPrefix}DeleteRecord,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  async handle({ context, principal, request }) {
+    const prepared = await withPrimaryDatabase(
+      context,
+      'api-database-records',
+      async (client) => {
+        await client.query('BEGIN');
+        try {
+          const result = await prepareDeletion(client, {
+            approvalRequestId: request.query.approvalRequestId,
+            correlationId: context.correlationId,
+            principal,
+            reasonCode: request.query.reasonCode,
+            recordId: request.path.recordId,
+          });
+          await client.query('COMMIT');
+          return result;
+        } catch (error) {
+          await rollback(client);
+          throw error;
+        }
+      },
+    );
+    if (prepared.held) held();
+    if (prepared.alreadyCompleted) {
+      return { deleted: true, id: request.path.recordId };
+    }
+    if (!prepared.event) retryRequired();
+    try {
+      const result = await eventBridge.send(
+        new PutEventsCommand({ Entries: [prepared.event] }),
+      );
+      if (
+        result.FailedEntryCount !== 0 ||
+        result.Entries?.[0]?.ErrorCode
+      ) {
+        throw new Error('EventBridge rejected the lifecycle event.');
+      }
+    } catch {
+      await recordPublicationFailure(
+        { correlationId: context.correlationId },
+        request.query.approvalRequestId,
+      );
+      retryRequired();
+    }
+    await completeDeletion(
+      { correlationId: context.correlationId },
+      {
+        approvalRequestId: request.query.approvalRequestId,
+        principal,
+        recordId: request.path.recordId,
+      },
+    );
+    return { deleted: true, id: request.path.recordId };
+  },
+});
+`,
+        'testing/data-deletion-journey.spec.ts': `import {
+  beginApprovalExecution,
+  completeApprovalExecution,
+  createApprovalRequest,
+  decideApprovalRequest,
+  type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import {
+  createDataLifecycleDeletionRequest,
+  createDataLifecycleLedgerEntry,
+  transitionDataLifecycleDeletion,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import { describe, expect, it } from 'vitest';
+import { create${pascalName}DataLifecycleChanged } from '../data/lifecycle-event.js';
+import {
+  approvalReference,
+  productRecordReference,
+} from '../data/pseudonymous-reference.js';
+
+const recordId = '00000000-0000-4000-8000-000000000001';
+const approvalRef = approvalReference(
+  '00000000-0000-4000-8000-000000000010',
+);
+const scopeRef = productRecordReference(recordId);
+const command = { reasonCode: 'subject-request', recordId };
+
+function human(
+  id: string,
+  kind: 'admin' | 'customer' = 'customer',
+): AuthorizationPrincipal {
+  return {
+    actor: { id, type: 'user' },
+    authority: { mode: 'direct' },
+    kind,
+    roles: kind === 'admin' ? ['${name}-admin'] : [],
+    scopes: [],
+    subject: { id, type: 'user' },
+  };
+}
+
+describe('${pascalName} durable data deletion journey', () => {
+  it('resumes one exact approved deletion through downstream retry', () => {
+    const pending = createApprovalRequest({
+      action: '${name}:record-delete',
+      author: human('record-owner'),
+      command,
+      expiresAt: '2026-07-27T13:00:00.000Z',
+      now: '2026-07-27T12:00:00.000Z',
+      policyVersion: '1.0.0',
+      resource: { id: recordId, type: 'record' },
+      slice: '${name}',
+    });
+    expect(
+      decideApprovalRequest(pending, {
+        approver: human('privacy-reviewer', 'admin'),
+        expectedRequestDigest: pending.requestDigest,
+        now: '2026-07-27T12:05:00.000Z',
+        outcome: 'approved',
+        reasonReference: 'privacy-review-stale',
+        requiredPolicyVersion: '2.0.0',
+      }),
+    ).toMatchObject({
+      decision: {
+        category: 'policy-stale',
+        decision: 'deny',
+        policyVersion: '2.0.0',
+      },
+      request: pending,
+    });
+    const approved = decideApprovalRequest(pending, {
+      approver: human('privacy-reviewer', 'admin'),
+      expectedRequestDigest: pending.requestDigest,
+      now: '2026-07-27T12:05:00.000Z',
+      outcome: 'approved',
+      reasonReference: 'privacy-review-1',
+      requiredPolicyVersion: '1.0.0',
+    }).request;
+    expect(
+      beginApprovalExecution(approved, {
+        action: '${name}:record-delete',
+        command,
+        executionId: 'deletion:' + pending.id,
+        now: '2026-07-27T12:06:00.000Z',
+        requiredPolicyVersion: '2.0.0',
+        resource: { id: recordId, type: 'record' },
+      }),
+    ).toMatchObject({
+      decision: {
+        category: 'policy-stale',
+        decision: 'deny',
+        policyVersion: '2.0.0',
+      },
+      request: { status: 'approved' },
+    });
+    const begun = beginApprovalExecution(approved, {
+      action: '${name}:record-delete',
+      command,
+      executionId: 'deletion:' + pending.id,
+      now: '2026-07-27T12:06:00.000Z',
+      requiredPolicyVersion: '1.0.0',
+      resource: { id: recordId, type: 'record' },
+    });
+    expect(begun.decision.decision).toBe('allow');
+
+    let deletion = createDataLifecycleDeletionRequest({
+      approvalRequirement: 'required',
+      categoryId: 'product-record',
+      createdAt: '2026-07-27T12:00:00.000Z',
+      downstreamCopyIds: ['event-contract'],
+      policyVersion: '1.0.0',
+      primaryLocationId: 'primary-database',
+      requestRef: approvalRef,
+      scopeRef,
+    });
+    deletion = transitionDataLifecycleDeletion(deletion, {
+      approvalRef,
+      at: '2026-07-27T12:06:00.000Z',
+      authorityRef: 'sha256:' + 'c'.repeat(64),
+      holds: [],
+      type: 'verify',
+    });
+    deletion = transitionDataLifecycleDeletion(deletion, {
+      at: '2026-07-27T12:06:01.000Z',
+      type: 'start-primary',
+    });
+    deletion = transitionDataLifecycleDeletion(deletion, {
+      at: '2026-07-27T12:06:02.000Z',
+      outcomeCode: 'deleted',
+      type: 'complete-primary',
+    });
+    const ledger = createDataLifecycleLedgerEntry({
+      action: 'deletion',
+      categoryId: 'product-record',
+      effectiveAt: '2026-07-27T12:06:02.000Z',
+      expiresAt: '2027-09-01T12:06:02.000Z',
+      policyVersion: '1.0.0',
+      pseudonymousKey: scopeRef,
+    });
+    const event = create${pascalName}DataLifecycleChanged({
+      action: 'deletion',
+      occurredAt: ledger.effectiveAt,
+      policyVersion: ledger.policyVersion,
+      recordId,
+      requestRef: approvalRef,
+    });
+    expect(JSON.stringify({ event, ledger })).not.toContain(recordId);
+
+    deletion = transitionDataLifecycleDeletion(deletion, {
+      at: '2026-07-27T12:06:03.000Z',
+      copyId: 'event-contract',
+      type: 'start-copy',
+    });
+    deletion = transitionDataLifecycleDeletion(deletion, {
+      at: '2026-07-27T12:06:04.000Z',
+      copyId: 'event-contract',
+      errorCode: 'event-publication-failed',
+      type: 'fail-copy',
+    });
+    expect(deletion.status).toBe('failed');
+
+    const resumed = beginApprovalExecution(begun.request, {
+      action: '${name}:record-delete',
+      command,
+      executionId: 'deletion:' + pending.id,
+      now: '2026-07-27T12:07:00.000Z',
+      requiredPolicyVersion: '1.0.0',
+      resource: { id: recordId, type: 'record' },
+    });
+    expect(resumed.decision.decision).toBe('allow');
+    expect(resumed.request).toBe(begun.request);
+    deletion = transitionDataLifecycleDeletion(deletion, {
+      at: '2026-07-27T12:07:00.000Z',
+      type: 'retry',
+    });
+    deletion = transitionDataLifecycleDeletion(deletion, {
+      at: '2026-07-27T12:07:01.000Z',
+      copyId: 'event-contract',
+      type: 'start-copy',
+    });
+    deletion = transitionDataLifecycleDeletion(deletion, {
+      at: '2026-07-27T12:07:02.000Z',
+      copyId: 'event-contract',
+      outcomeCode: 'acknowledged',
+      type: 'complete-copy',
+    });
+    const completed = completeApprovalExecution(resumed.request, {
+      executionId: 'deletion:' + pending.id,
+      now: '2026-07-27T12:07:02.000Z',
+      requiredPolicyVersion: '1.0.0',
+    });
+    expect({
+      approval: completed.request.status,
+      lifecycle: deletion.status,
+    }).toEqual({ approval: 'executed', lifecycle: 'completed' });
+  });
+
+  it('persists a held state before any primary deletion starts', () => {
+    let deletion = createDataLifecycleDeletionRequest({
+      approvalRequirement: 'required',
+      categoryId: 'product-record',
+      createdAt: '2026-07-27T12:00:00.000Z',
+      downstreamCopyIds: ['event-contract'],
+      policyVersion: '1.0.0',
+      primaryLocationId: 'primary-database',
+      requestRef: approvalRef,
+      scopeRef,
+    });
+    deletion = transitionDataLifecycleDeletion(deletion, {
+      approvalRef,
+      at: '2026-07-27T12:05:00.000Z',
+      authorityRef: 'sha256:' + 'c'.repeat(64),
+      holds: [
+        {
+          categoryId: 'product-record',
+          effects: ['block-deletion'],
+          expiresAt: '2026-07-30T12:00:00.000Z',
+          holdId: 'legal-review',
+          issuerCode: 'privacy-office',
+          purpose: 'legal',
+          reviewAt: '2026-07-29T12:00:00.000Z',
+          scopeRef,
+          startsAt: '2026-07-27T12:00:00.000Z',
+          status: 'active',
+        },
+      ],
+      type: 'verify',
+    });
+    expect(deletion).toMatchObject({
+      holdIds: ['legal-review'],
+      primaryStatus: 'pending',
+      status: 'held',
+    });
+  });
+});
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-data-deletion-files.js.map