@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-data-lifecycle-files.js

@@ -0,0 +1,750 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductDataLifecycleFiles = renderProductDataLifecycleFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+function retention(durationDays, reason, trigger, deletionMethod = 'hard-delete') {
+    return { deletionMethod, durationDays, reason, trigger };
+}
+/** @internal */
+function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00.000Z') {
+    const reviewDueAt = new Date(Date.parse(reviewedAt) + 365 * 24 * 60 * 60 * 1_000).toISOString();
+    const pascalName = name
+        .split('-')
+        .map((segment) => segment[0]?.toUpperCase() + segment.slice(1))
+        .join('');
+    const policy = {
+        backups: [
+            {
+                backupStoreId: 'database-backup',
+                categoryIds: ['product-record'],
+                developmentCopy: 'prohibited',
+                disasterRecoveryUse: 'only',
+                id: 'primary-database-backup',
+                restoreOnly: true,
+                restorePlanId: 'primary-database-restore',
+                retention: retention(30, 'Cover the reviewed point-in-time recovery window.', 'copy-created', 'lifecycle-expiry'),
+                sourceStoreId: 'primary-database',
+            },
+        ],
+        categories: [
+            {
+                allowedUses: ['authenticated-request'],
+                classification: 'confidential',
+                description: 'Issuer-signed access token held in a bounded secure cookie.',
+                evidenceRefs: ['testing/auth-session'],
+                id: 'auth-access-token',
+                ingress: [
+                    {
+                        authorizationAction: `${name}:protected-read`,
+                        contractRef: 'runtime/auth-session',
+                        validationRef: 'runtime/auth-backend',
+                    },
+                ],
+                owner: name,
+                primaryStoreIds: ['browser-access-cookie'],
+                provenance: [{ kind: 'subject', sourceRef: 'cognito/access-token' }],
+                purpose: 'Authenticate and bind one request to a typed principal until signed expiry.',
+                rights: {
+                    correction: 'not-applicable',
+                    deletion: 'supported',
+                    export: 'not-applicable',
+                    rationale: 'Session state is revoked or expired and is not a product record.',
+                },
+                runbookRefs: ['docs/runbooks/data-lifecycle.md'],
+                sensitiveTypes: ['access-token', 'session-identifier'],
+                steward: `${name}-data-steward`,
+                subject: 'authenticated-user',
+            },
+            {
+                allowedUses: ['session-refresh'],
+                classification: 'confidential',
+                description: 'Longer-lived refresh token held separately from the access token.',
+                evidenceRefs: ['testing/auth-session'],
+                id: 'auth-refresh-token',
+                ingress: [
+                    {
+                        authorizationAction: `${name}:protected-read`,
+                        contractRef: 'runtime/auth-session',
+                        validationRef: 'runtime/auth-session',
+                    },
+                ],
+                owner: name,
+                primaryStoreIds: ['browser-refresh-cookie'],
+                provenance: [{ kind: 'subject', sourceRef: 'cognito/refresh-token' }],
+                purpose: 'Rotate expired access credentials without exposing token material to browser scripts.',
+                rights: {
+                    correction: 'not-applicable',
+                    deletion: 'supported',
+                    export: 'not-applicable',
+                    rationale: 'Refresh state is revoked or cleared at logout and is not a product record.',
+                },
+                runbookRefs: ['docs/runbooks/data-lifecycle.md'],
+                sensitiveTypes: ['refresh-token', 'session-identifier'],
+                steward: `${name}-data-steward`,
+                subject: 'authenticated-user',
+            },
+            {
+                allowedUses: ['product-operation', 'recovery', 'subject-export'],
+                classification: 'confidential',
+                description: 'Synthetic product records owned by one authenticated principal.',
+                evidenceRefs: ['testing/data-lifecycle', 'testing/local-integration'],
+                id: 'product-record',
+                ingress: [
+                    {
+                        authorizationAction: `${name}:record-write`,
+                        contractRef: `${name}/api-contract`,
+                        validationRef: 'api/contracts/protected.ts',
+                    },
+                ],
+                owner: name,
+                primaryStoreIds: ['primary-database'],
+                provenance: [{ kind: 'subject', sourceRef: `${name}/records` }],
+                purpose: 'Serve the generated product record journey.',
+                rights: {
+                    correction: 'supported',
+                    deletion: 'supported',
+                    export: 'supported',
+                    rationale: 'The Standard journey exposes bounded correction, deletion, and an approved owner-scoped confidential export.',
+                },
+                runbookRefs: [
+                    'docs/runbooks/data-lifecycle.md',
+                    'docs/runbooks/data-restore-reconciliation.md',
+                ],
+                sensitiveTypes: ['pseudonymous-identifier'],
+                steward: `${name}-data-steward`,
+                subject: 'record-owner',
+            },
+            {
+                allowedUses: [
+                    'authorization-audit',
+                    'data-lifecycle-control',
+                    'restore-reconciliation',
+                ],
+                classification: 'confidential',
+                description: 'Content-free authorization, approval, hold, outbox, receipt, retention-run, and deletion-ledger control records.',
+                evidenceRefs: ['testing/data-lifecycle', 'authorization/workflows'],
+                id: 'lifecycle-control-metadata',
+                ingress: [
+                    {
+                        authorizationAction: `${name}:retention-maintenance`,
+                        contractRef: 'runtime/data-lifecycle',
+                        validationRef: 'runtime/authorization',
+                    },
+                ],
+                owner: name,
+                primaryStoreIds: ['downstream-copy-registry', 'lifecycle-control'],
+                provenance: [
+                    { kind: 'derived', sourceRef: `${name}/authorized-operations` },
+                ],
+                purpose: 'Enforce approvals, holds, idempotency, downstream reconciliation, bounded retention, and restore safety without retaining record content.',
+                rights: {
+                    correction: 'not-applicable',
+                    deletion: 'supported',
+                    export: 'not-applicable',
+                    rationale: 'Control rows expire under their declared enforcement or audit window and contain only safe or pseudonymous references.',
+                },
+                runbookRefs: [
+                    'docs/runbooks/authorization.md',
+                    'docs/runbooks/data-lifecycle.md',
+                ],
+                sensitiveTypes: ['pseudonymous-identifier'],
+                steward: `${name}-data-steward`,
+                subject: 'authorized-operation',
+            },
+            {
+                allowedUses: ['contract-test'],
+                classification: 'internal',
+                description: 'Deterministic synthetic values generated independently of production data.',
+                evidenceRefs: ['testing/data-lifecycle'],
+                id: 'synthetic-test-data',
+                ingress: [
+                    {
+                        authorizationAction: `${name}:record-write`,
+                        contractRef: 'testing/data-lifecycle',
+                        validationRef: 'testing/data-lifecycle.spec.ts',
+                    },
+                ],
+                owner: name,
+                primaryStoreIds: ['test-fixture', 'test-record-database'],
+                provenance: [{ kind: 'derived', sourceRef: 'testing/synthetic-seed' }],
+                purpose: 'Exercise lifecycle contracts without copying production records.',
+                rights: {
+                    correction: 'not-applicable',
+                    deletion: 'supported',
+                    export: 'not-applicable',
+                    rationale: 'Fixtures are disposable synthetic evidence with no data subject.',
+                },
+                runbookRefs: ['docs/runbooks/data-lifecycle.md'],
+                sensitiveTypes: [],
+                steward: `${name}-data-steward`,
+                subject: 'synthetic',
+            },
+        ],
+        copies: [
+            {
+                categoryIds: ['product-record'],
+                deletionPropagation: 'contract-event',
+                handling: 'pseudonymous',
+                id: 'created-event-archive',
+                kind: 'replay-archive',
+                purpose: `Retain minimized ${pascalName}DataLifecycleChanged events for bounded replay and correction.`,
+                retention: retention(30, 'Match the Foundation event archive replay window.', 'event-completion', 'lifecycle-expiry'),
+                sourceStoreIds: ['primary-database'],
+                storeId: 'event-archive',
+            },
+            {
+                categoryIds: ['product-record'],
+                deletionPropagation: 'contract-event',
+                handling: 'pseudonymous',
+                id: 'created-event-queue',
+                kind: 'queue',
+                purpose: 'Deliver minimized lifecycle events to the declared Slice consumer.',
+                retention: retention(4, 'Match the explicit Standard event queue message-retention window.', 'event-completion', 'lifecycle-expiry'),
+                sourceStoreIds: ['event-archive'],
+                storeId: 'event-queue',
+            },
+            {
+                categoryIds: ['product-record'],
+                deletionPropagation: 'contract-event',
+                handling: 'pseudonymous',
+                id: 'created-event-dead-letter',
+                kind: 'dlq',
+                purpose: 'Hold failed minimized lifecycle deliveries for bounded recovery.',
+                retention: retention(14, 'Match the explicit Standard dead-letter queue recovery window.', 'event-completion', 'lifecycle-expiry'),
+                sourceStoreIds: ['event-queue'],
+                storeId: 'event-dlq',
+            },
+            {
+                categoryIds: ['product-record'],
+                deletionPropagation: 'local',
+                handling: 'redacted',
+                id: 'operational-log',
+                kind: 'log',
+                purpose: 'Diagnose operations with content-free structured metadata.',
+                retention: retention(30, 'Bound operational diagnosis while excluding record content.', 'collection', 'lifecycle-expiry'),
+                sourceStoreIds: ['primary-database'],
+                storeId: 'application-log',
+            },
+            {
+                categoryIds: ['product-record'],
+                deletionPropagation: 'local',
+                handling: 'raw',
+                id: 'subject-export',
+                kind: 'export',
+                purpose: 'Deliver one approved, owner-scoped confidential export through a bounded encrypted artifact.',
+                retention: retention(1, 'Delete every version of the confidential export no later than 24 hours after creation.', 'copy-created', 'lifecycle-expiry'),
+                sourceStoreIds: ['primary-database'],
+                storeId: 'confidential-export',
+            },
+        ],
+        governance: {
+            owner: name,
+            reviewDueAt,
+            reviewedAt,
+            steward: `${name}-data-steward`,
+        },
+        holds: [],
+        kind: 'ebk-data-lifecycle-policy',
+        ledger: {
+            actions: ['correction', 'deletion'],
+            backupIdsCovered: ['primary-database-backup'],
+            classification: 'confidential',
+            keyMaterial: 'pseudonymous-only',
+            retention: retention(400, 'Cover every backup window and one annual policy review.', 'collection'),
+            storeId: 'lifecycle-audit',
+        },
+        lineage: [
+            {
+                categoryIds: ['product-record'],
+                from: { id: 'primary-database', kind: 'store' },
+                id: 'database-to-event',
+                minimization: 'Publish identifiers and lifecycle metadata only.',
+                purpose: `Propagate ${pascalName}DataLifecycleChanged correction and deletion state.`,
+                recipient: `${name}-declared-consumer`,
+                to: { id: 'created-event-archive', kind: 'copy' },
+                transport: 'event',
+            },
+            {
+                categoryIds: ['product-record'],
+                from: { id: 'created-event-archive', kind: 'copy' },
+                id: 'event-archive-to-queue',
+                minimization: 'Preserve only the versioned lifecycle event envelope and opaque subject reference.',
+                purpose: 'Deliver lifecycle state to the declared consumer.',
+                recipient: `${name}-declared-consumer`,
+                to: { id: 'created-event-queue', kind: 'copy' },
+                transport: 'event',
+            },
+            {
+                categoryIds: ['product-record'],
+                from: { id: 'created-event-queue', kind: 'copy' },
+                id: 'event-queue-to-dead-letter',
+                minimization: 'Retain the failed minimized envelope without adding provider response content.',
+                purpose: 'Recover failed lifecycle event delivery.',
+                recipient: `${name}-operations`,
+                to: { id: 'created-event-dead-letter', kind: 'copy' },
+                transport: 'event',
+            },
+            {
+                categoryIds: ['product-record'],
+                from: { id: 'primary-database', kind: 'store' },
+                id: 'database-to-log',
+                minimization: 'Project content-free operation metadata.',
+                purpose: 'Support bounded operational diagnosis.',
+                to: { id: 'operational-log', kind: 'copy' },
+                transport: 'derived',
+            },
+            {
+                categoryIds: ['product-record'],
+                from: { id: 'primary-database', kind: 'store' },
+                id: 'database-to-export',
+                minimization: 'Select only the authenticated owner record approved by the exact durable export request.',
+                purpose: 'Create a bounded encrypted subject export.',
+                recipient: 'authenticated-record-owner',
+                to: { id: 'subject-export', kind: 'copy' },
+                transport: 'export',
+            },
+        ],
+        policyVersion: '1.0.0',
+        restorePlans: [
+            {
+                authorization: 'required',
+                backupId: 'primary-database-backup',
+                deletionCorrectionReplay: 'required-before-service',
+                downstreamReconciliation: 'required-before-service',
+                id: 'primary-database-restore',
+                integrityValidation: 'required',
+                isolatedTarget: 'required',
+                retentionJobs: 'required-before-service',
+                runbookRef: 'docs/runbooks/data-restore-reconciliation.md',
+            },
+        ],
+        schemaVersion: 1,
+        slice: name,
+        stores: [
+            {
+                accessPurposes: ['authentication'],
+                categoryIds: ['auth-access-token'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: 'subject-device',
+                },
+                id: 'browser-access-cookie',
+                kind: 'browser',
+                locationRef: 'runtime/auth-session#access-cookie',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(1, 'The httpOnly, Secure, SameSite=Strict access cookie expires no later than its signed token.', 'last-activity', 'cryptographic-erasure'),
+            },
+            {
+                accessPurposes: ['session-refresh'],
+                categoryIds: ['auth-refresh-token'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: 'subject-device',
+                },
+                id: 'browser-refresh-cookie',
+                kind: 'browser',
+                locationRef: 'runtime/auth-session#refresh-cookie',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(30, 'The separately scoped httpOnly refresh cookie matches the bounded runtime maximum and is cleared at logout.', 'last-activity', 'cryptographic-erasure'),
+            },
+            {
+                accessPurposes: ['product-operation'],
+                categoryIds: ['product-record'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: 'foundation-data',
+                },
+                id: 'primary-database',
+                kind: 'database',
+                locationRef: 'database/bindings.json#primary',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(365, 'Retain active product records until lifecycle expiry or deletion.', 'last-activity'),
+            },
+            {
+                accessPurposes: ['disaster-recovery'],
+                categoryIds: ['product-record'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: 'foundation-data',
+                },
+                id: 'database-backup',
+                kind: 'backup',
+                locationRef: 'foundation/database-backup',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(30, 'Match the reviewed point-in-time recovery window.', 'copy-created', 'lifecycle-expiry'),
+            },
+            {
+                accessPurposes: ['restore-reconciliation', 'security-audit'],
+                categoryIds: ['product-record'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: name,
+                },
+                id: 'lifecycle-audit',
+                kind: 'audit',
+                locationRef: 'database/data-lifecycle-audit',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(400, 'Cover backup replay and one annual policy review.', 'collection'),
+            },
+            {
+                accessPurposes: [
+                    'authorization-audit',
+                    'data-lifecycle-control',
+                    'restore-reconciliation',
+                ],
+                categoryIds: ['lifecycle-control-metadata'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: name,
+                },
+                id: 'lifecycle-control',
+                kind: 'audit',
+                locationRef: 'database/schema.ts#authorization-and-data-lifecycle-control',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(400, 'Cover the backup window, authorization evidence, retry, and one annual policy review before hard deletion.', 'collection'),
+            },
+            {
+                accessPurposes: ['restore-reconciliation'],
+                categoryIds: ['lifecycle-control-metadata'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: name,
+                },
+                id: 'downstream-copy-registry',
+                kind: 'audit',
+                locationRef: 'database/schema.ts#data_lifecycle_downstream_copies',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(400, 'Retain safe downstream copy reconciliation state through the backup and annual review window.', 'collection'),
+            },
+            {
+                accessPurposes: ['event-replay'],
+                categoryIds: ['product-record'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: 'foundation-events',
+                },
+                id: 'event-archive',
+                kind: 'event-archive',
+                locationRef: 'foundation/event-bus',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(30, 'Bound event replay and deletion propagation.', 'event-completion', 'lifecycle-expiry'),
+            },
+            {
+                accessPurposes: ['event-delivery'],
+                categoryIds: ['product-record'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: 'foundation-events',
+                },
+                id: 'event-queue',
+                kind: 'queue',
+                locationRef: 'infra/product.ts#event-queue',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(4, 'Match the explicit Standard event queue message-retention window.', 'event-completion', 'lifecycle-expiry'),
+            },
+            {
+                accessPurposes: ['event-recovery'],
+                categoryIds: ['product-record'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: 'foundation-events',
+                },
+                id: 'event-dlq',
+                kind: 'dlq',
+                locationRef: 'infra/product.ts#event-dlq',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(14, 'Match the explicit Standard dead-letter recovery window.', 'event-completion', 'lifecycle-expiry'),
+            },
+            {
+                accessPurposes: ['operations'],
+                categoryIds: ['product-record'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: 'foundation-observability',
+                },
+                id: 'application-log',
+                kind: 'log',
+                locationRef: 'operations/logging-components.json',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(30, 'Bound content-free operational diagnosis.', 'collection', 'lifecycle-expiry'),
+            },
+            {
+                accessPurposes: ['subject-export'],
+                categoryIds: ['product-record'],
+                classification: 'confidential',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: name,
+                },
+                id: 'confidential-export',
+                kind: 'export',
+                locationRef: 'infra/product.ts#dataExportBucket',
+                owner: name,
+                production: true,
+                residency: ['us-east-1'],
+                retention: retention(1, 'Delete all KMS-encrypted confidential export versions within 24 hours.', 'copy-created', 'lifecycle-expiry'),
+            },
+            {
+                accessPurposes: ['testing'],
+                categoryIds: ['synthetic-test-data'],
+                classification: 'internal',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: name,
+                },
+                id: 'test-fixture',
+                kind: 'test-fixture',
+                locationRef: 'testing/fixtures',
+                owner: name,
+                production: false,
+                residency: ['us-east-1'],
+                retention: retention(7, 'Remove generated synthetic data after the evidence window.', 'copy-created'),
+            },
+            {
+                accessPurposes: ['testing'],
+                categoryIds: ['synthetic-test-data'],
+                classification: 'internal',
+                encryption: {
+                    atRest: 'required',
+                    inTransit: 'required',
+                    keyOwner: 'foundation-data',
+                },
+                id: 'test-record-database',
+                kind: 'database',
+                locationRef: 'database/schema.ts#records.test_expires_at',
+                owner: name,
+                production: false,
+                residency: ['us-east-1'],
+                retention: retention(1, 'Delete explicitly tagged synthetic test rows after their bounded run window.', 'collection'),
+            },
+        ],
+    };
+    const physicalStores = {
+        observations: [
+            {
+                categoryId: 'auth-access-token',
+                classification: 'confidential',
+                locationId: 'browser-access-cookie',
+                sourceRef: 'runtime/auth-session#access-cookie',
+                surface: 'store',
+            },
+            {
+                categoryId: 'auth-refresh-token',
+                classification: 'confidential',
+                locationId: 'browser-refresh-cookie',
+                sourceRef: 'runtime/auth-session#refresh-cookie',
+                surface: 'store',
+            },
+            {
+                categoryId: 'product-record',
+                classification: 'confidential',
+                locationId: 'primary-database',
+                sourceRef: 'database/schema.ts#records',
+                surface: 'store',
+            },
+            {
+                categoryId: 'product-record',
+                classification: 'confidential',
+                locationId: 'database-backup',
+                sourceRef: 'foundation/database-backup',
+                surface: 'store',
+            },
+            {
+                categoryId: 'product-record',
+                classification: 'confidential',
+                locationId: 'lifecycle-audit',
+                sourceRef: 'database/schema.ts#data_lifecycle_ledger',
+                surface: 'store',
+            },
+            {
+                categoryId: 'lifecycle-control-metadata',
+                classification: 'confidential',
+                locationId: 'lifecycle-control',
+                sourceRef: 'database/schema.ts#authorization-and-lifecycle-tables',
+                surface: 'store',
+            },
+            {
+                categoryId: 'lifecycle-control-metadata',
+                classification: 'confidential',
+                locationId: 'downstream-copy-registry',
+                sourceRef: 'database/schema.ts#data_lifecycle_downstream_copies',
+                surface: 'store',
+            },
+            {
+                categoryId: 'product-record',
+                classification: 'confidential',
+                locationId: 'event-archive',
+                sourceRef: 'foundation/event-bus',
+                surface: 'store',
+            },
+            {
+                categoryId: 'product-record',
+                classification: 'confidential',
+                locationId: 'event-queue',
+                sourceRef: 'infra/product.ts#eventQueue',
+                surface: 'store',
+            },
+            {
+                categoryId: 'product-record',
+                classification: 'confidential',
+                locationId: 'event-dlq',
+                sourceRef: 'infra/product.ts#eventDlq',
+                surface: 'store',
+            },
+            {
+                categoryId: 'product-record',
+                classification: 'confidential',
+                locationId: 'application-log',
+                sourceRef: 'operations/logging-components.json',
+                surface: 'store',
+            },
+            {
+                categoryId: 'product-record',
+                classification: 'confidential',
+                locationId: 'confidential-export',
+                sourceRef: 'infra/product.ts#dataExportBucket',
+                surface: 'store',
+            },
+            {
+                categoryId: 'synthetic-test-data',
+                classification: 'internal',
+                locationId: 'test-fixture',
+                sourceRef: 'testing/fixtures',
+                surface: 'store',
+            },
+            {
+                categoryId: 'synthetic-test-data',
+                classification: 'internal',
+                locationId: 'test-record-database',
+                sourceRef: 'database/schema.ts#records.test_expires_at',
+                surface: 'store',
+            },
+            ...[
+                'created-event-archive',
+                'created-event-dead-letter',
+                'created-event-queue',
+                'operational-log',
+                'subject-export',
+            ].map((locationId) => ({
+                categoryId: 'product-record',
+                classification: 'confidential',
+                locationId,
+                sourceRef: `data/policy-observation#${locationId}`,
+                surface: 'copy',
+            })),
+        ],
+        schemaVersion: 1,
+    };
+    return {
+        'data/policy-acceptance.json': (0, built_in_plan_shared_js_1.json)({
+            physicalStores,
+            policy,
+            schemaVersion: 1,
+        }),
+        'data/physical-stores.json': (0, built_in_plan_shared_js_1.json)(physicalStores),
+        'data/policy.json': (0, built_in_plan_shared_js_1.json)(policy),
+        'docs/runbooks/data-lifecycle.md': `# Data lifecycle
+
+\`data/policy.json\` is the Slice-owned source of truth for data categories,
+purposes, classifications, stores, copies, retention, rights, holds, lineage,
+and evidence. Product changes update this seeded policy; framework upgrades do
+not weaken or overwrite it.
+
+Runtime retention, deletion, export, and restore import that same descriptor;
+policy version and retention duration are not copied constants. Checked-in
+holds and online \`data_lifecycle_holds\` rows are evaluated together, so either
+source blocks its declared operation. The generated v1 administration API
+creates exact-record holds only. Category-, subject-, and future-record holds
+require a separately reviewed extension rather than an inferred wildcard.
+
+\`data/physical-stores.json\` is the independently maintained, Slice-owned
+observation set. Record every category actually present at each production
+store and copy; one observed category never stands in for another category at
+the same location. Framework upgrades preserve this seeded inventory so an
+adopter must reconcile newly observed storage explicitly.
+
+Run \`pnpm nx run ${name}:data-policy-check\` before changing an API, schema,
+event, store, or log projection. Run
+\`pnpm nx run ${name}:data-retention -- --report\` before any apply. Applying a
+retention plan requires an approved request digest and writes content-free
+checkpoint and audit evidence.
+
+Product workloads may append and query audit rows but cannot update, truncate,
+or delete them directly. Bounded expiry runs only through the generated
+security-definer prune functions, whose execute privilege is granted during
+database migration.
+
+Production values, tokens, cookies, request bodies, and database rows are
+prohibited from source, test fixtures, prompts, logs, and evidence. Tests use
+deterministic synthetic references only. A deployed record may carry
+\`testExpiresAt\` only when the authenticated principal belongs to the generated
+\`${name}-test-writer\` group; ordinary product writes leave that column null.
+
+Confidential export execution persists its cleanup deadline before any object
+write and holds the workflow plus record locks through the versioned write and
+publication commit. The hourly cleanup also claims expired \`gathering\`
+workflows, discovers every exact object version and delete marker, and records
+artifact-free completion after recovering a post-write database failure.
+`,
+        'docs/runbooks/data-restore-reconciliation.md': `# Data restore reconciliation
+
+Restore into an isolated target and keep it unavailable to product traffic.
+Validate backup integrity, then replay every pseudonymous deletion/correction
+ledger entry that falls inside the backup window. Run retention and reconcile
+every downstream copy declared by \`data/policy.json\` before cutover.
+
+The restore result records policy and backup digests, checkpoint references,
+actual RPO/RTO, counts, and pass/fail outcomes. It never retains subject
+identity, record content, credentials, provider response bodies, or raw
+resource identifiers. A missing ledger range, failed replay, unresolved copy,
+or failed authorization blocks service restoration.
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-data-lifecycle-files.js.map