@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-data-retention-job-files.js

@@ -0,0 +1,2604 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductDataRetentionJobFiles = renderProductDataRetentionJobFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const frozen_container_js_1 = require("../workload/frozen-container.js");
+/** @internal */
+function renderProductDataRetentionJobFiles(name, runtimeVersion) {
+    const pascalName = name
+        .split('-')
+        .map((segment) => segment[0]?.toUpperCase() + segment.slice(1))
+        .join('');
+    const identifierPrefix = pascalName.charAt(0).toLowerCase() + pascalName.slice(1);
+    return {
+        'data/retention-control.ts': `import {
+  createApprovalRequest,
+  decideApprovalRequest,
+  digestApprovalRequest,
+  type ApprovalRequest,
+  type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import {
+  createDataLifecyclePseudonymousReference,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import type { Client as PgClient } from 'pg';
+import {
+  ${identifierPrefix}AuthorizationPolicy,
+} from '../authorization/policy.js';
+import { requireDirectAdmin } from './data-rights-shared.js';
+import { approvalReference } from './pseudonymous-reference.js';
+import {
+  ${pascalName}DataLifecycleRuntimePolicy,
+} from './runtime-policy.cjs';
+import { withPrimaryDatabase } from '../database/runtime-client.js';
+
+const ACTION = '${name}:retention-apply';
+const POLICY_VERSION =
+  ${pascalName}DataLifecycleRuntimePolicy.policyVersion;
+const RETENTION_DAYS =
+  ${pascalName}DataLifecycleRuntimePolicy.retentionDays;
+const AUTHORIZATION_POLICY_VERSION =
+  ${identifierPrefix}AuthorizationPolicy.version;
+
+export interface ${pascalName}RetentionPlanV1 {
+  asOf: string;
+  candidateDigest: string;
+  categoryId: 'product-record';
+  due: number;
+  locationId: 'primary-database';
+  maxItems: 10000;
+  pageSize: 100;
+  policyVersion: string;
+  retentionDays: number;
+  runId: string;
+}
+
+interface RetentionReportRow {
+  approvalRequestId: string | null;
+  plan: ${pascalName}RetentionPlanV1;
+  revision: number;
+  status: string;
+}
+
+function plusDays(value: string, days: number): string {
+  const result = new Date(value);
+  result.setUTCDate(result.getUTCDate() + days);
+  return result.toISOString();
+}
+
+function runReference(runId: string): string {
+  return createDataLifecyclePseudonymousReference({
+    categoryId: 'lifecycle-control-metadata',
+    slice: '${name}',
+    value: runId,
+  });
+}
+
+function requirePlan(
+  value: ${pascalName}RetentionPlanV1,
+  runId: string,
+): ${pascalName}RetentionPlanV1 {
+  if (
+    value?.runId !== runId ||
+    value.policyVersion !== POLICY_VERSION ||
+    value.categoryId !== 'product-record' ||
+    value.locationId !== 'primary-database' ||
+    value.maxItems !== 10000 ||
+    value.pageSize !== 100 ||
+    value.retentionDays !== RETENTION_DAYS ||
+    !Number.isSafeInteger(value.due) ||
+    value.due < 0 ||
+    !/^sha256:[a-f0-9]{64}$/.test(value.candidateDigest)
+  ) {
+    throw new Error('Retention report plan is invalid.');
+  }
+  return value;
+}
+
+async function loadReport(
+  client: PgClient,
+  runId: string,
+): Promise<RetentionReportRow> {
+  const result = await client.query<{
+    approvalRequestId: string | null;
+    plan: ${pascalName}RetentionPlanV1;
+    revision: number;
+    status: string;
+  }>(
+    \`SELECT approval_request_id::text AS "approvalRequestId",
+            plan_json AS plan, revision, status
+     FROM data_lifecycle_retention_runs
+     WHERE id = $1::uuid
+     FOR UPDATE\`,
+    [runId],
+  );
+  const row = result.rows[0];
+  if (!row) throw new Error('Retention report was not found.');
+  return { ...row, plan: requirePlan(row.plan, runId) };
+}
+
+async function writeAudit(
+  client: PgClient,
+  input: {
+    action: string;
+    approvalRequestId: string;
+    correlationId: string;
+    principal: AuthorizationPrincipal;
+    reasonCategory: string;
+    runId: string;
+  },
+) {
+  await client.query(
+    \`INSERT INTO authorization_audit
+       (action, approval_reference, authority_mode, correlation_id, decision,
+        delegation_reference, policy_version, principal_kind,
+        pseudonymous_subject_id, reason_category, resource_reference,
+        resource_type, slice, stage, subject_type)
+     VALUES ($1, $2, 'direct', $3, 'allow', NULL, $4, $5, $6, $7, $8,
+             'retention-run', $9, $10, $11)\`,
+    [
+      input.action,
+      approvalReference(input.approvalRequestId),
+      input.correlationId,
+      AUTHORIZATION_POLICY_VERSION,
+      input.principal.kind,
+      createDataLifecyclePseudonymousReference({
+        categoryId: 'authorization-subject',
+        slice: '${name}',
+        value: input.principal.actor.id,
+      }),
+      input.reasonCategory,
+      runReference(input.runId),
+      '${name}',
+      process.env.EBK_STAGE ?? 'development',
+      input.principal.subject.type,
+    ],
+  );
+}
+
+export async function request${pascalName}RetentionApproval(input: {
+  correlationId: string;
+  now: string;
+  principal: AuthorizationPrincipal;
+  runId: string;
+}) {
+  requireDirectAdmin(input.principal);
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const report = await loadReport(client, input.runId);
+        if (
+          report.status !== 'reported' ||
+          report.approvalRequestId !== null
+        ) {
+          throw new Error(
+            'Retention report already has an approval request or is no longer reviewable.',
+          );
+        }
+        const approval = createApprovalRequest({
+          action: ACTION,
+          author: input.principal,
+          command: report.plan,
+          expiresAt: plusDays(input.now, 1),
+          now: input.now,
+          policyVersion: AUTHORIZATION_POLICY_VERSION,
+          resource: { id: input.runId, type: 'retention-run' },
+          slice: '${name}',
+        });
+        await client.query(
+          \`INSERT INTO approval_requests
+             (id, author_reference, expires_at, policy_version,
+              request_digest, request_json, revision, status)
+           VALUES ($1::uuid, $2, $3, $4, $5, $6::jsonb, $7, $8)\`,
+          [
+            approval.id,
+            approval.author.effectiveHumanId ?? approval.author.actorId,
+            approval.expiresAt,
+            approval.policyVersion,
+            approval.requestDigest,
+            JSON.stringify(approval),
+            approval.revision,
+            approval.status,
+          ],
+        );
+        const updated = await client.query(
+          \`UPDATE data_lifecycle_retention_runs
+           SET approval_request_id = $3::uuid, revision = revision + 1,
+               status = 'approval-pending', updated_at = $4
+           WHERE id = $1::uuid AND revision = $2
+             AND approval_request_id IS NULL AND status = 'reported'\`,
+          [input.runId, report.revision, approval.id, input.now],
+        );
+        if (updated.rowCount !== 1) {
+          throw new Error('Retention approval request lost compare-and-set.');
+        }
+        await writeAudit(client, {
+          action: '${name}:retention-approval-request',
+          approvalRequestId: approval.id,
+          correlationId: input.correlationId,
+          principal: input.principal,
+          reasonCategory: 'approval-pending',
+          runId: input.runId,
+        });
+        await client.query('COMMIT');
+        return {
+          approvalRequestId: approval.id,
+          expiresAt: approval.expiresAt,
+          requestDigest: approval.requestDigest,
+          status: approval.status,
+        };
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+export async function decide${pascalName}RetentionApproval(input: {
+  approvalRequestId: string;
+  correlationId: string;
+  expectedRequestDigest: string;
+  now: string;
+  outcome: 'approved' | 'rejected';
+  principal: AuthorizationPrincipal;
+  reasonReference: string;
+  runId: string;
+}) {
+  requireDirectAdmin(input.principal);
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const report = await loadReport(client, input.runId);
+        if (
+          report.status !== 'approval-pending' ||
+          report.approvalRequestId !== input.approvalRequestId
+        ) {
+          throw new Error('Retention approval does not match the report.');
+        }
+        const stored = await client.query<{
+          request: ApprovalRequest<string>;
+        }>(
+          \`SELECT request_json AS request
+           FROM approval_requests
+           WHERE id = $1::uuid
+           FOR UPDATE\`,
+          [input.approvalRequestId],
+        );
+        const approval = stored.rows[0]?.request;
+        if (
+          !approval ||
+          approval.id !== input.approvalRequestId ||
+          approval.action !== ACTION ||
+          approval.policyVersion !== AUTHORIZATION_POLICY_VERSION ||
+          approval.resource.id !== input.runId ||
+          approval.resource.type !== 'retention-run' ||
+          approval.schemaVersion !== 1 ||
+          approval.slice !== '${name}' ||
+          digestApprovalRequest({
+            action: ACTION,
+            command: report.plan,
+            resource: { id: input.runId, type: 'retention-run' },
+          }) !== approval.requestDigest
+        ) {
+          throw new Error('Retention approval is not bound to the report.');
+        }
+        const transition = decideApprovalRequest(approval, {
+          approver: input.principal,
+          expectedRequestDigest: input.expectedRequestDigest,
+          now: input.now,
+          outcome: input.outcome,
+          reasonReference: input.reasonReference,
+          requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
+        });
+        if (transition.decision.decision !== 'allow') {
+          throw new Error(
+            'Retention approval decision was denied: ' +
+              transition.decision.category,
+          );
+        }
+        const approvalUpdated = await client.query(
+          \`UPDATE approval_requests
+           SET request_json = $3::jsonb, revision = $4, status = $5
+           WHERE id = $1::uuid AND revision = $2\`,
+          [
+            approval.id,
+            approval.revision,
+            JSON.stringify(transition.request),
+            transition.request.revision,
+            transition.request.status,
+          ],
+        );
+        const reportUpdated = await client.query(
+          \`UPDATE data_lifecycle_retention_runs
+           SET revision = revision + 1, status = $3, updated_at = $4
+           WHERE id = $1::uuid AND revision = $2
+             AND status = 'approval-pending'\`,
+          [
+            input.runId,
+            report.revision,
+            transition.request.status === 'approved'
+              ? 'approval-approved'
+              : 'approval-rejected',
+            input.now,
+          ],
+        );
+        if (
+          approvalUpdated.rowCount !== 1 ||
+          reportUpdated.rowCount !== 1
+        ) {
+          throw new Error('Retention approval decision lost compare-and-set.');
+        }
+        await writeAudit(client, {
+          action: '${name}:retention-approval-decision',
+          approvalRequestId: approval.id,
+          correlationId: input.correlationId,
+          principal: input.principal,
+          reasonCategory:
+            transition.request.status === 'approved'
+              ? 'approval-approved'
+              : 'approval-rejected',
+          runId: input.runId,
+        });
+        await client.query('COMMIT');
+        return {
+          approvalRequestId: approval.id,
+          status: transition.request.status as 'approved' | 'rejected',
+        };
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+`,
+        'jobs/data-retention/src/approval-compatibility.spec.ts': `import {
+  beginApprovalExecution,
+  createApprovalRequest,
+  decideApprovalRequest,
+  type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import { describe, expect, it } from 'vitest';
+
+function human(id: string, kind: 'admin' | 'customer') {
+  return {
+    actor: { id, type: 'user' as const },
+    authority: { mode: 'direct' as const },
+    kind,
+    roles: kind === 'admin' ? ['${name}-admin'] : [],
+    scopes: [],
+    subject: { id, type: 'user' as const },
+  } satisfies AuthorizationPrincipal;
+}
+
+describe('${pascalName} retention approval compatibility', () => {
+  it('denies stale apply and stale exact-retry policy versions', () => {
+    const runId = '00000000-0000-4000-8000-000000000001';
+    const plan = {
+      asOf: '2026-07-27T12:00:00.000Z',
+      candidateDigest: 'sha256:' + 'a'.repeat(64),
+      categoryId: 'product-record',
+      due: 1,
+      locationId: 'primary-database',
+      maxItems: 10000,
+      pageSize: 100,
+      policyVersion: '1.0.0',
+      retentionDays: 365,
+      runId,
+    };
+    const pending = createApprovalRequest({
+      action: '${name}:retention-apply',
+      author: human('report-author', 'admin'),
+      command: plan,
+      expiresAt: '2026-07-27T13:00:00.000Z',
+      now: '2026-07-27T12:00:00.000Z',
+      policyVersion: '1.0.0',
+      resource: { id: runId, type: 'retention-run' },
+      slice: '${name}',
+    });
+    expect(
+      decideApprovalRequest(pending, {
+        approver: human('privacy-reviewer', 'admin'),
+        expectedRequestDigest: pending.requestDigest,
+        now: '2026-07-27T12:05:00.000Z',
+        outcome: 'approved',
+        reasonReference: 'privacy-review-stale',
+        requiredPolicyVersion: '2.0.0',
+      }),
+    ).toMatchObject({
+      decision: {
+        category: 'policy-stale',
+        decision: 'deny',
+        policyVersion: '2.0.0',
+      },
+      request: pending,
+    });
+    const approved = decideApprovalRequest(pending, {
+      approver: human('privacy-reviewer', 'admin'),
+      expectedRequestDigest: pending.requestDigest,
+      now: '2026-07-27T12:05:00.000Z',
+      outcome: 'approved',
+      reasonReference: 'privacy-review-1',
+      requiredPolicyVersion: '1.0.0',
+    }).request;
+    const input = {
+      action: '${name}:retention-apply',
+      command: plan,
+      executionId: runId,
+      now: '2026-07-27T12:06:00.000Z',
+      resource: { id: runId, type: 'retention-run' },
+    };
+
+    expect(
+      beginApprovalExecution(approved, {
+        ...input,
+        requiredPolicyVersion: '2.0.0',
+      }),
+    ).toMatchObject({
+      decision: {
+        category: 'policy-stale',
+        decision: 'deny',
+        policyVersion: '2.0.0',
+      },
+      request: { status: 'approved' },
+    });
+    const begun = beginApprovalExecution(approved, {
+      ...input,
+      requiredPolicyVersion: '1.0.0',
+    });
+    expect(begun.decision).toMatchObject({ decision: 'allow' });
+    expect(
+      beginApprovalExecution(begun.request, {
+        ...input,
+        now: '2026-07-27T12:07:00.000Z',
+        requiredPolicyVersion: '2.0.0',
+      }),
+    ).toMatchObject({
+      decision: {
+        category: 'policy-stale',
+        decision: 'deny',
+        policyVersion: '2.0.0',
+      },
+      request: begun.request,
+    });
+  });
+});
+`,
+        'jobs/data-retention/package.json': (0, built_in_plan_shared_js_1.json)({
+            name: `@${name}/job-data-retention`,
+            private: true,
+            type: 'module',
+            version: '0.0.0',
+            scripts: {
+                build: 'tsc -p tsconfig.build.json',
+                'docker-build': `docker build -f packages/${name}/jobs/data-retention/Dockerfile -t ${name}-data-retention:local ../../../..`,
+                lint: 'eslint .',
+                test: 'vitest run',
+                typecheck: 'tsc --noEmit -p tsconfig.json',
+                verify: 'pnpm run lint && pnpm run typecheck && pnpm test && pnpm run build',
+            },
+            dependencies: {
+                '@aws-sdk/client-eventbridge': built_in_plan_shared_js_1.PRODUCT_VERSIONS.awsEventBridge,
+                '@aws-sdk/client-sfn': built_in_plan_shared_js_1.PRODUCT_VERSIONS.awsSfn,
+                '@empire-builder-kit/runtime': runtimeVersion,
+                pg: built_in_plan_shared_js_1.PRODUCT_VERSIONS.pg,
+            },
+            devDependencies: {
+                '@types/node': built_in_plan_shared_js_1.PRODUCT_VERSIONS.typesNode,
+                '@types/pg': built_in_plan_shared_js_1.PRODUCT_VERSIONS.typesPg,
+                typescript: '~5.9.2',
+                vitest: built_in_plan_shared_js_1.PRODUCT_VERSIONS.vitest,
+            },
+        }),
+        'jobs/data-retention/tsconfig.json': (0, built_in_plan_shared_js_1.json)({
+            compilerOptions: {
+                forceConsistentCasingInFileNames: true,
+                module: 'nodenext',
+                moduleResolution: 'nodenext',
+                noEmitOnError: true,
+                outDir: 'dist',
+                resolveJsonModule: true,
+                rootDir: '../..',
+                strict: true,
+                target: 'es2022',
+                types: ['node'],
+            },
+            include: [
+                'src/**/*.ts',
+                '../../authorization/policy.ts',
+                '../../contracts/events.ts',
+                '../../data/lifecycle-event.ts',
+                '../../data/policy.json',
+                '../../data/pseudonymous-reference.ts',
+                '../../data/runtime-policy.cts',
+                '../../secrets/declarations.ts',
+            ],
+        }),
+        'jobs/data-retention/tsconfig.build.json': (0, built_in_plan_shared_js_1.json)({
+            extends: './tsconfig.json',
+            exclude: ['src/**/*.spec.ts'],
+        }),
+        'jobs/data-retention/vitest.config.ts': `import { configDefaults, defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    exclude: [...configDefaults.exclude, '**/dist/**'],
+  },
+});
+`,
+        'jobs/data-retention/Dockerfile': `FROM ${frozen_container_js_1.WORKLOAD_CONTAINER_NODE_IMAGE} AS build
+ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org
+ENV COREPACK_NPM_REGISTRY=$NPM_CONFIG_REGISTRY
+ENV NPM_CONFIG_REGISTRY=$NPM_CONFIG_REGISTRY
+ENV PNPM_HOME=/pnpm
+ENV PATH=/pnpm:$PATH
+WORKDIR /workspace
+RUN corepack enable && corepack prepare ${frozen_container_js_1.WORKLOAD_CONTAINER_PNPM_DESCRIPTOR} --activate
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN pnpm fetch --frozen-lockfile
+COPY packages/${name}/jobs/data-retention/package.json packages/${name}/jobs/data-retention/package.json
+RUN pnpm --filter @${name}/job-data-retention install --offline --frozen-lockfile
+COPY packages/${name}/jobs/data-retention/tsconfig.json packages/${name}/jobs/data-retention/tsconfig.build.json packages/${name}/jobs/data-retention/
+COPY packages/${name}/jobs/data-retention/src packages/${name}/jobs/data-retention/src
+COPY packages/${name}/authorization/policy.ts packages/${name}/authorization/policy.ts
+COPY packages/${name}/contracts/events.ts packages/${name}/contracts/events.ts
+COPY packages/${name}/data/lifecycle-event.ts packages/${name}/data/lifecycle-event.ts
+COPY packages/${name}/data/policy.json packages/${name}/data/policy.json
+COPY packages/${name}/data/pseudonymous-reference.ts packages/${name}/data/pseudonymous-reference.ts
+COPY packages/${name}/data/runtime-policy.cts packages/${name}/data/runtime-policy.cts
+COPY packages/${name}/secrets/declarations.ts packages/${name}/secrets/declarations.ts
+RUN pnpm --filter @${name}/job-data-retention run build
+RUN --network=none pnpm --config.inject-workspace-packages=true --config.store-dir=/workspace/.ebk/cache/pnpm-store --filter @${name}/job-data-retention deploy --prod --offline --frozen-lockfile /opt/data-retention
+
+FROM ${frozen_container_js_1.WORKLOAD_CONTAINER_NODE_IMAGE}
+WORKDIR /app
+ADD --checksum=sha256:e5bb2084ccf45087bda1c9bffdea0eb15ee67f0b91646106e466714f9de3c7e3 https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem ./rds-global-bundle.pem
+COPY --from=build --chown=node:node /opt/data-retention ./
+USER node
+CMD ["node", "dist/jobs/data-retention/src/run.js"]
+`,
+        'jobs/data-retention/README.md': `# Data retention Job
+
+This is the one generated Standard data-retention Job. The Slice target starts
+its fixed AWS-internal Step Functions workflow; operators never run this image
+or connect to the database directly.
+
+Report scans at most 100 pages of 100 records, freezes the exact candidate
+set, and returns its safe run reference without mutating product data or
+creating an approval. The authenticated API creates the exact durable request;
+apply requires approval by a different direct human. The Job claims approval
+with compare-and-set, persists its checkpoint after every page, uses stable
+per-record idempotency, and resumes only the same execution identity.
+
+If any candidate changes after the approved scan, apply fails closed. Preserve
+the frozen candidate set, create a new report, and obtain a new non-self
+approval. Never delete or rewrite the changed row to make the old approval
+appear current.
+
+Control-row expiry is not part of an approved retention plan. Infrastructure
+must invoke \`dist/jobs/data-retention/src/maintenance.js\` on an independent
+bounded schedule with \`EBK_MAINTENANCE_CORRELATION_ID\`; that entrypoint uses
+the exact \`${name}:retention-maintenance\` action and fails closed on active
+control-metadata holds.
+
+The seeded adapter owns the Product Slice's record selection. Keep it aligned
+with \`data/policy.json\`; never log or return raw identifiers or record
+content.
+`,
+        'jobs/data-retention/src/adapter.ts': `import { createHash } from 'node:crypto';
+import {
+  createDataLifecycleLedgerEntry,
+  evaluateDataLifecycleHolds,
+  type DataLifecycleRetentionAdapter,
+  type DataLifecycleRuntimeHoldV1,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import { buildEventEntry } from '@empire-builder-kit/runtime/events';
+import type { Client } from 'pg';
+import {
+  ${pascalName}DataLifecycleChanged,
+} from '../../../contracts/events.js';
+import {
+  create${pascalName}DataLifecycleChanged,
+} from '../../../data/lifecycle-event.js';
+import {
+  approvalReference,
+  productRecordReference,
+} from '../../../data/pseudonymous-reference.js';
+import {
+  ${pascalName}DataLifecycleRuntimePolicy,
+} from '../../../data/runtime-policy.cjs';
+
+const OUTBOX_COPY_ID = 'event-contract';
+const POLICY_VERSION =
+  ${pascalName}DataLifecycleRuntimePolicy.policyVersion;
+const RETENTION_DAYS =
+  ${pascalName}DataLifecycleRuntimePolicy.retentionDays;
+
+interface RetentionLifecycleEventEntry {
+  Detail: string;
+  DetailType: string;
+  EventBusName: string;
+  Source: string;
+}
+
+function ledgerExpiry(completedAt: string): string {
+  const expiresAt = new Date(completedAt);
+  expiresAt.setUTCDate(expiresAt.getUTCDate() + 400);
+  return expiresAt.toISOString();
+}
+
+export interface ${pascalName}RetentionAdapterOptions {
+  approvalRequestId?: string;
+  asOf: string;
+  client: Client;
+  completedAt: string;
+  correlationId: string;
+  eventBusName: string;
+  mode: 'apply' | 'report';
+  publishLifecycleEvent(
+    entry: RetentionLifecycleEventEntry,
+  ): Promise<void>;
+  runId: string;
+  stage: string;
+}
+
+export interface ${pascalName}RetentionCandidateRecord {
+  candidateOrder: string;
+  dueAt: string;
+  recordId: string;
+  recordRef: string;
+}
+
+/**
+ * Product-specific retention selection is seeded. Raw identifiers remain
+ * inside this AWS-internal Job and never enter its checkpoint or evidence.
+ */
+export function create${pascalName}RetentionAdapter(
+  options: ${pascalName}RetentionAdapterOptions,
+): DataLifecycleRetentionAdapter & {
+  candidateDigest(): string;
+  candidateRecords(): readonly ${pascalName}RetentionCandidateRecord[];
+} {
+  const recordIds = new Map<string, string>();
+  const candidateRecords = new Map<
+    string,
+    ${pascalName}RetentionCandidateRecord
+  >();
+  const digest = createHash('sha256');
+  return {
+    candidateDigest() {
+      return 'sha256:' + digest.copy().digest('hex');
+    },
+    candidateRecords() {
+      return [...candidateRecords.values()];
+    },
+    async scan({ asOf, cursor, limit }) {
+      const result = await options.client.query<{
+        cursorKey: string;
+        dueAt: Date;
+        id: string;
+      }>(
+        options.mode === 'report'
+          ? \`SELECT md5('${name}\\0' || id::text) AS "cursorKey",
+                    last_activity_at + ($4::int * INTERVAL '1 day') AS "dueAt",
+                    id::text
+             FROM records
+             WHERE last_activity_at + ($4::int * INTERVAL '1 day')
+                     <= $1::timestamptz
+               AND test_expires_at IS NULL
+               AND ($2::text IS NULL OR md5('${name}\\0' || id::text) > $2)
+             ORDER BY md5('${name}\\0' || id::text)
+             LIMIT $3\`
+          : \`SELECT candidate_order AS "cursorKey", due_at AS "dueAt",
+                    record_id::text AS id
+             FROM data_lifecycle_retention_candidates
+             WHERE run_id = $1::uuid
+               AND ($2::text IS NULL OR candidate_order > $2)
+             ORDER BY candidate_order
+             LIMIT $3\`,
+        options.mode === 'report'
+          ? [asOf, cursor ?? null, limit + 1, RETENTION_DAYS]
+          : [options.runId, cursor ?? null, limit + 1],
+      );
+      const pageRows = result.rows.slice(0, limit);
+      const items = pageRows.map((row) => {
+        const recordRef = productRecordReference(row.id);
+        recordIds.set(recordRef, row.id);
+        const dueAt = row.dueAt.toISOString();
+        candidateRecords.set(recordRef, {
+          candidateOrder: row.cursorKey,
+          dueAt,
+          recordId: row.id,
+          recordRef,
+        });
+        const candidate = {
+          categoryId: 'product-record',
+          dueAt,
+          locationId: 'primary-database',
+          recordRef,
+        };
+        digest.update(
+          [
+            candidate.categoryId,
+            candidate.dueAt,
+            candidate.locationId,
+            candidate.recordRef,
+          ].join('\\0') + '\\n',
+          'utf8',
+        );
+        return candidate;
+      });
+      return {
+        items,
+        ...(result.rows.length > limit
+          ? { nextCursor: pageRows.at(-1)?.cursorKey }
+          : {}),
+      };
+    },
+    async apply({ candidate, idempotencyKey }) {
+      const recordId = recordIds.get(candidate.recordRef);
+      if (!recordId) {
+        throw new Error(
+          'Retention apply must use a candidate from this bounded adapter scan.',
+        );
+      }
+      const ledger = createDataLifecycleLedgerEntry({
+        action: 'deletion',
+        categoryId: candidate.categoryId,
+        effectiveAt: options.completedAt,
+        expiresAt: ledgerExpiry(options.completedAt),
+        policyVersion: POLICY_VERSION,
+        pseudonymousKey: candidate.recordRef,
+      });
+      const requestRef = approvalReference(
+        options.approvalRequestId ?? options.runId + ':' + idempotencyKey,
+      );
+      const lifecycleEvent = create${pascalName}DataLifecycleChanged({
+        action: 'deletion',
+        occurredAt: options.completedAt,
+        policyVersion: POLICY_VERSION,
+        recordId,
+        requestRef,
+      });
+      const built = buildEventEntry(
+        ${pascalName}DataLifecycleChanged,
+        lifecycleEvent,
+        {
+          busName: options.eventBusName,
+          context: { correlationId: options.correlationId },
+          eventId: idempotencyKey,
+          occurredAt: options.completedAt,
+          stage: options.stage,
+        },
+      );
+      let event: RetentionLifecycleEventEntry = {
+        Detail: built.entry.detail,
+        DetailType: built.entry.detailType,
+        EventBusName: built.entry.eventBusName,
+        Source: built.entry.source,
+      };
+      let deletedNow = false;
+      let publishedAt: Date | null = null;
+      let copyStatus: string | undefined;
+      await options.client.query('BEGIN');
+      try {
+        const record = await options.client.query<{
+          due: boolean;
+        }>(
+          \`SELECT
+               last_activity_at + ($3::int * INTERVAL '1 day')
+                 <= $2::timestamptz
+                 AS due
+             FROM records
+             WHERE id = $1::uuid
+             FOR UPDATE\`,
+          [recordId, options.asOf, RETENTION_DAYS],
+        );
+        const existing = await options.client.query<{
+          eventJson: RetentionLifecycleEventEntry;
+          publishedAt: Date | null;
+        }>(
+          \`SELECT event_json AS "eventJson", published_at AS "publishedAt"
+             FROM data_lifecycle_outbox
+             WHERE idempotency_key = $1
+             FOR UPDATE\`,
+          [idempotencyKey],
+        );
+        const copy = await options.client.query<{ status: string }>(
+          \`SELECT status
+             FROM data_lifecycle_downstream_copies
+             WHERE source_slice = $1
+               AND pseudonymous_key = $2
+               AND copy_id = $3
+             FOR UPDATE\`,
+          ['${name}', candidate.recordRef, OUTBOX_COPY_ID],
+        );
+        publishedAt = existing.rows[0]?.publishedAt ?? null;
+        copyStatus = copy.rows[0]?.status;
+        if (record.rows[0]) {
+          if (!record.rows[0].due) {
+            throw new Error(
+              'Retention candidate changed after its approved scan.',
+            );
+          }
+          if (existing.rowCount !== 0 || copy.rowCount !== 0) {
+            throw new Error(
+              'Retention propagation state exists for an undeleted candidate.',
+            );
+          }
+          const holdRows = await options.client.query<{
+            holdJson: DataLifecycleRuntimeHoldV1;
+          }>(
+            \`SELECT hold_json AS "holdJson"
+               FROM data_lifecycle_holds
+               WHERE category_id = 'product-record'
+                 AND scope_ref = $1
+                 AND status = 'active'
+               ORDER BY hold_id
+               FOR SHARE\`,
+            [candidate.recordRef],
+          );
+          const hold = evaluateDataLifecycleHolds({
+            categoryId: candidate.categoryId,
+            holds: [
+              ...${pascalName}DataLifecycleRuntimePolicy.declaredHolds,
+              ...holdRows.rows.map(({ holdJson }) => holdJson),
+            ],
+            now: options.completedAt,
+            operation: 'deletion',
+            scopeRef: candidate.recordRef,
+          });
+          if (hold.blocked) {
+            throw new Error(
+              'Retention candidate is protected by an active hold.',
+            );
+          }
+        } else {
+          if (existing.rowCount !== 1 || copy.rowCount !== 1) {
+            throw new Error(
+              'Retention candidate disappeared without durable propagation state.',
+            );
+          }
+          event = existing.rows[0].eventJson;
+        }
+        const recorded = await options.client.query(
+          \`INSERT INTO data_lifecycle_ledger
+             (entry_id, action, category_id, effective_at, expires_at,
+              idempotency_key, policy_version, pseudonymous_key)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+           ON CONFLICT (idempotency_key) DO NOTHING
+           RETURNING entry_id\`,
+          [
+            ledger.entryId,
+            ledger.action,
+            ledger.categoryId,
+            ledger.effectiveAt,
+            ledger.expiresAt,
+            idempotencyKey,
+            ledger.policyVersion,
+            ledger.pseudonymousKey,
+          ],
+        );
+        if (record.rows[0]) {
+          if (recorded.rowCount !== 1) {
+            throw new Error(
+              'Retention ledger already exists for an undeleted candidate.',
+            );
+          }
+        } else if (recorded.rowCount !== 0) {
+          throw new Error(
+            'Retention candidate disappeared without its durable ledger entry.',
+          );
+        }
+        if (record.rows[0]) {
+          const deleted = await options.client.query(
+            \`DELETE FROM records
+             WHERE id = $1::uuid
+               AND last_activity_at + ($3::int * INTERVAL '1 day')
+                     <= $2::timestamptz
+             RETURNING id\`,
+            [recordId, options.asOf, RETENTION_DAYS],
+          );
+          if (deleted.rowCount !== 1) {
+            throw new Error(
+              'Retention candidate changed after its approved scan.',
+            );
+          }
+          await options.client.query(
+            \`INSERT INTO data_lifecycle_outbox
+               (idempotency_key, event_json, expires_at)
+             VALUES ($1, $2::jsonb, $3)\`,
+            [idempotencyKey, JSON.stringify(event), ledgerExpiry(options.completedAt)],
+          );
+          await options.client.query(
+            \`INSERT INTO data_lifecycle_downstream_copies
+               (source_slice, pseudonymous_key, copy_id, recipient, purpose,
+                expires_at, action, hold_refs, status, updated_at)
+             VALUES ($1, $2, $3, $4, 'lifecycle-reconciliation', $5,
+                     'deletion', '[]'::jsonb, 'propagation-pending', $6)\`,
+            [
+              '${name}',
+              candidate.recordRef,
+              OUTBOX_COPY_ID,
+              'foundation-event-bus',
+              ledgerExpiry(options.completedAt),
+              options.completedAt,
+            ],
+          );
+          deletedNow = true;
+          copyStatus = 'propagation-pending';
+        }
+        await options.client.query('COMMIT');
+      } catch (error) {
+        await options.client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+      if (publishedAt && copyStatus === 'reconciled') {
+        return 'already-applied';
+      }
+      if (publishedAt || copyStatus !== 'propagation-pending') {
+        throw new Error('Retention propagation state is inconsistent.');
+      }
+      try {
+        await options.publishLifecycleEvent(event);
+      } catch (error) {
+        await options.client
+          .query(
+            \`UPDATE data_lifecycle_outbox
+             SET attempts = attempts + 1,
+                 last_error_code = 'event-publication-failed'
+             WHERE idempotency_key = $1\`,
+            [idempotencyKey],
+          )
+          .catch(() => undefined);
+        throw error;
+      }
+      await options.client.query('BEGIN');
+      try {
+        const published = await options.client.query(
+          \`UPDATE data_lifecycle_outbox
+           SET attempts = attempts + 1,
+               last_error_code = NULL,
+               published_at = $2
+           WHERE idempotency_key = $1
+             AND published_at IS NULL\`,
+          [idempotencyKey, options.completedAt],
+        );
+        const reconciled = await options.client.query(
+          \`UPDATE data_lifecycle_downstream_copies
+           SET status = 'reconciled', updated_at = $4
+           WHERE source_slice = $1
+             AND pseudonymous_key = $2
+             AND copy_id = $3
+             AND status = 'propagation-pending'\`,
+          [
+            '${name}',
+            candidate.recordRef,
+            OUTBOX_COPY_ID,
+            options.completedAt,
+          ],
+        );
+        if (published.rowCount !== 1 || reconciled.rowCount !== 1) {
+          throw new Error(
+            'Retention propagation acknowledgement lost compare-and-set.',
+          );
+        }
+        await options.client.query('COMMIT');
+      } catch (error) {
+        await options.client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+      return deletedNow ? 'applied' : 'already-applied';
+    },
+  };
+}
+`,
+        'jobs/data-retention/src/maintenance.ts': `import { readFile } from 'node:fs/promises';
+import {
+  createAuthorizationEvaluator,
+  defineCoarseAdmission,
+  type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import {
+  createDataLifecyclePseudonymousReference,
+  evaluateDataLifecycleHolds,
+  type DataLifecycleRuntimeHoldV1,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import { createLogger } from '@empire-builder-kit/runtime/logging';
+import {
+  bindServerSecretRuntime,
+  createAwsSecretsManagerSource,
+  createServerSecretResolver,
+} from '@empire-builder-kit/runtime/secrets';
+import pg from 'pg';
+import {
+  ${identifierPrefix}AuthorizationActions,
+  ${identifierPrefix}AuthorizationPolicy,
+} from '../../../authorization/policy.js';
+import { Secrets } from '../../../secrets/declarations.js';
+
+const { Client } = pg;
+const POLICY_VERSION = ${identifierPrefix}AuthorizationPolicy.version;
+const WORKLOAD_IDENTITY = '${name}:data-retention-job';
+const BATCH_LIMIT = 1000;
+let credentialResolver:
+  | ReturnType<typeof createServerSecretResolver>
+  | undefined;
+
+function required(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(name + ' is required.');
+  return value;
+}
+
+function databaseCredentialResolver() {
+  credentialResolver ??= createServerSecretResolver({
+    binding: bindServerSecretRuntime({
+      stage: required('EBK_STAGE'),
+      workload: WORKLOAD_IDENTITY,
+    }),
+    cache: { freshTtlMs: 0, staleTtlMs: 0 },
+    source: createAwsSecretsManagerSource(),
+  });
+  return credentialResolver;
+}
+
+async function readCredential(secretArn: string, correlationId: string) {
+  const declaration = Secrets.${pascalName}PrimaryDatabaseCredential;
+  const credential = await databaseCredentialResolver().get(
+    declaration,
+    {
+      logicalName: declaration.logicalName,
+      provider: 'aws-secrets-manager',
+      secretArn,
+    },
+    { correlationId },
+  );
+  if (
+    credential.database !== required('EBK_DATABASE_NAME') ||
+    credential.host !== required('EBK_DATABASE_HOST') ||
+    credential.port !== Number(required('EBK_DATABASE_PORT')) ||
+    credential.username !== required('EBK_DATABASE_USERNAME') ||
+    !credential.password
+  ) {
+    throw new Error(
+      'Database credential does not match the exact maintenance binding.',
+    );
+  }
+  return credential;
+}
+
+export async function authorizeRetentionMaintenance(
+  now: string,
+): Promise<AuthorizationPrincipal> {
+  if (required('EBK_WORKLOAD_IDENTITY') !== WORKLOAD_IDENTITY) {
+    throw new Error('Retention maintenance workload identity is invalid.');
+  }
+  const principal: AuthorizationPrincipal = {
+    actor: { id: WORKLOAD_IDENTITY, type: 'service' },
+    audience: WORKLOAD_IDENTITY,
+    authority: {
+      machineIdentityId: WORKLOAD_IDENTITY,
+      mode: 'machine',
+    },
+    kind: 'agent',
+    roles: [],
+    scopes: [],
+    subject: { id: WORKLOAD_IDENTITY, type: 'service' },
+  };
+  const evaluator = createAuthorizationEvaluator({
+    admission: defineCoarseAdmission({
+      anyOf: [{ kinds: ['agent'], subjectTypes: ['service'] }],
+    }),
+    policy: ${identifierPrefix}AuthorizationPolicy,
+    requiredPolicyVersion: POLICY_VERSION,
+  });
+  await evaluator.authorize({
+    action: ${identifierPrefix}AuthorizationActions.retentionMaintenance,
+    context: {
+      facts: { operationId: 'bounded-control-maintenance' },
+      now,
+      stage: required('EBK_STAGE'),
+    },
+    principal,
+    resource: { attributes: { collection: true }, type: 'slice' },
+  });
+  return principal;
+}
+
+function assertNoActiveControlHold(
+  holds: readonly DataLifecycleRuntimeHoldV1[],
+  now: string,
+) {
+  for (const hold of holds) {
+    const evaluated = evaluateDataLifecycleHolds({
+      categoryId: 'lifecycle-control-metadata',
+      holds: [hold],
+      now,
+      operation: 'deletion',
+      scopeRef: hold.scopeRef,
+    });
+    if (evaluated.blocked) {
+      throw new Error(
+        'Retention maintenance is blocked by an active control-metadata hold.',
+      );
+    }
+  }
+}
+
+const reconciliationStatements = [
+  \`WITH candidates AS (
+     SELECT approval.ctid
+     FROM approval_requests approval
+     WHERE approval.expires_at <= $1::timestamptz
+       AND approval.status IN ('pending', 'approved')
+       AND (
+         EXISTS (
+           SELECT 1 FROM data_lifecycle_requests request
+           WHERE request.approval_request_id = approval.id
+             AND request.status IN ('requested', 'verified', 'held')
+         )
+         OR EXISTS (
+           SELECT 1 FROM data_lifecycle_retention_runs run
+           WHERE run.approval_request_id = approval.id
+             AND run.status IN (
+               'approval-pending',
+               'approval-approved'
+             )
+         )
+       )
+     ORDER BY approval.expires_at, approval.id
+     LIMIT $2
+     FOR UPDATE OF approval SKIP LOCKED
+   )
+   UPDATE approval_requests approval
+   SET request_json = jsonb_set(
+         jsonb_set(
+           approval.request_json,
+           '{status}',
+           to_jsonb('expired'::text),
+           true
+         ),
+         '{revision}',
+         to_jsonb(approval.revision + 1),
+         true
+       ),
+       revision = approval.revision + 1,
+       status = 'expired'
+   WHERE approval.ctid IN (SELECT ctid FROM candidates)\`,
+  \`WITH candidates AS (
+     SELECT request.ctid,
+            CASE approval.status
+              WHEN 'expired' THEN 'approval-expired'
+              ELSE 'approval-rejected'
+            END::text AS outcome_code
+     FROM data_lifecycle_requests request
+     JOIN approval_requests approval
+       ON approval.id = request.approval_request_id
+     WHERE approval.status IN ('expired', 'rejected')
+       AND request.status IN ('requested', 'verified', 'held')
+       AND request.request_json->>'kind' IN (
+         'data-deletion',
+         'data-export'
+       )
+     ORDER BY request.updated_at, request.id
+     LIMIT $2
+     FOR UPDATE OF request SKIP LOCKED
+   )
+   UPDATE data_lifecycle_requests request
+   SET request_json = jsonb_set(
+         jsonb_set(
+           jsonb_set(
+             request.request_json,
+             '{status}',
+             to_jsonb('rejected'::text),
+             true
+           ),
+           '{outcomeCode}',
+           to_jsonb(candidates.outcome_code),
+           true
+         ),
+         '{updatedAt}',
+         to_jsonb($1::text),
+         true
+       ),
+       revision = request.revision + 1,
+       status = 'rejected',
+       updated_at = $1::timestamptz
+   FROM candidates
+   WHERE request.ctid = candidates.ctid\`,
+  \`WITH candidates AS (
+     SELECT artifact.ctid
+     FROM data_lifecycle_export_artifacts artifact
+     JOIN data_lifecycle_requests request
+       ON request.approval_request_id = artifact.approval_request_id
+     WHERE request.status = 'rejected'
+       AND request.request_json->>'kind' = 'data-export'
+       AND artifact.cleanup_state = 'requested'
+       AND artifact.upload_started_at IS NULL
+       AND artifact.current_version_id IS NULL
+       AND NOT EXISTS (
+         SELECT 1 FROM data_lifecycle_export_versions version
+         WHERE version.approval_request_id =
+           artifact.approval_request_id
+       )
+     ORDER BY artifact.updated_at, artifact.approval_request_id
+     LIMIT $2
+     FOR UPDATE OF artifact SKIP LOCKED
+   )
+   UPDATE data_lifecycle_export_artifacts artifact
+   SET cleanup_state = 'completed',
+       last_error_code = NULL,
+       updated_at = $1::timestamptz
+   WHERE artifact.ctid IN (SELECT ctid FROM candidates)\`,
+  \`WITH candidates AS (
+     SELECT run.ctid
+     FROM data_lifecycle_retention_runs run
+     WHERE run.expires_at <= $1::timestamptz
+       AND run.status = 'reported'
+     ORDER BY run.expires_at, run.id
+     LIMIT $2
+     FOR UPDATE OF run SKIP LOCKED
+   )
+   UPDATE data_lifecycle_retention_runs run
+   SET revision = run.revision + 1,
+       status = 'expired',
+       updated_at = $1::timestamptz
+   WHERE run.ctid IN (SELECT ctid FROM candidates)\`,
+  \`WITH candidates AS (
+     SELECT run.ctid,
+            CASE approval.status
+              WHEN 'expired' THEN 'approval-expired'
+              ELSE 'approval-rejected'
+            END::text AS terminal_status
+     FROM data_lifecycle_retention_runs run
+     JOIN approval_requests approval
+       ON approval.id = run.approval_request_id
+     WHERE run.status IN ('approval-pending', 'approval-approved')
+       AND approval.status IN ('expired', 'rejected')
+     ORDER BY run.updated_at, run.id
+     LIMIT $2
+     FOR UPDATE OF run SKIP LOCKED
+   )
+   UPDATE data_lifecycle_retention_runs run
+   SET revision = run.revision + 1,
+       status = candidates.terminal_status,
+       updated_at = $1::timestamptz
+   FROM candidates
+   WHERE run.ctid = candidates.ctid\`,
+] as const;
+
+const maintenanceStatements = [
+  \`WITH expired AS (
+     SELECT ctid FROM data_lifecycle_outbox
+     WHERE expires_at <= $1::timestamptz
+       AND published_at IS NOT NULL
+     ORDER BY expires_at, idempotency_key
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM data_lifecycle_outbox
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`WITH expired AS (
+     SELECT ctid FROM data_lifecycle_ledger
+     WHERE expires_at <= $1::timestamptz
+     ORDER BY expires_at, entry_id
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM data_lifecycle_ledger
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`SELECT ebk_prune_data_lifecycle_audit(
+     $1::timestamptz,
+     $2::integer
+   )\`,
+  \`WITH expired AS (
+     SELECT ctid FROM data_lifecycle_export_artifacts
+     WHERE cleanup_state = 'completed'
+       AND updated_at <= $1::timestamptz - INTERVAL '400 days'
+     ORDER BY updated_at, approval_request_id
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM data_lifecycle_export_artifacts
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`WITH expired AS (
+     SELECT ctid FROM data_lifecycle_receipts
+     WHERE received_at <= $1::timestamptz - INTERVAL '400 days'
+     ORDER BY received_at, source_slice, pseudonymous_key
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM data_lifecycle_receipts
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`WITH expired AS (
+     SELECT ctid FROM data_lifecycle_downstream_copies
+     WHERE expires_at <= $1::timestamptz
+       AND status IN ('deleted', 'expired', 'reconciled')
+     ORDER BY expires_at, source_slice, pseudonymous_key, copy_id
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM data_lifecycle_downstream_copies
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`SELECT ebk_prune_authorization_audit(
+     $1::timestamptz,
+     $2::integer
+   )\`,
+  \`WITH expired AS (
+     SELECT ctid FROM delegation_grants
+     WHERE expires_at <= $1::timestamptz
+       AND created_at <= $1::timestamptz - INTERVAL '400 days'
+     ORDER BY expires_at, id
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM delegation_grants
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`WITH expired AS (
+     SELECT ctid FROM data_lifecycle_holds
+     WHERE status = 'released'
+       AND expires_at <= $1::timestamptz - INTERVAL '400 days'
+     ORDER BY expires_at, hold_id
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM data_lifecycle_holds
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`WITH expired AS (
+     SELECT ctid FROM data_lifecycle_requests
+     WHERE updated_at <= $1::timestamptz - INTERVAL '400 days'
+       AND status IN ('completed', 'failed', 'rejected')
+     ORDER BY updated_at, id
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM data_lifecycle_requests
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`WITH expired AS (
+     SELECT candidate.ctid
+     FROM data_lifecycle_retention_candidates candidate
+     JOIN data_lifecycle_retention_runs run ON run.id = candidate.run_id
+     WHERE run.expires_at <= $1::timestamptz
+       AND run.status IN (
+         'completed',
+         'approval-expired',
+         'approval-rejected',
+         'expired'
+       )
+     ORDER BY run.expires_at, candidate.run_id, candidate.candidate_order
+     LIMIT $2
+     FOR UPDATE OF candidate SKIP LOCKED
+   )
+   DELETE FROM data_lifecycle_retention_candidates
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`WITH expired AS (
+     SELECT ctid FROM data_lifecycle_retention_runs
+     WHERE expires_at <= $1::timestamptz
+       AND status IN (
+         'completed',
+         'approval-expired',
+         'approval-rejected',
+         'expired'
+       )
+       AND NOT EXISTS (
+         SELECT 1 FROM data_lifecycle_retention_candidates
+         WHERE run_id = data_lifecycle_retention_runs.id
+       )
+     ORDER BY expires_at, id
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM data_lifecycle_retention_runs
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+  \`WITH expired AS (
+     SELECT ctid FROM approval_requests
+     WHERE expires_at <= $1::timestamptz - INTERVAL '400 days'
+       AND NOT EXISTS (
+         SELECT 1 FROM data_lifecycle_requests
+         WHERE approval_request_id = approval_requests.id
+       )
+       AND NOT EXISTS (
+         SELECT 1 FROM data_lifecycle_retention_runs
+         WHERE approval_request_id = approval_requests.id
+       )
+     ORDER BY expires_at, id
+     LIMIT $2
+     FOR UPDATE SKIP LOCKED
+   )
+   DELETE FROM approval_requests
+   WHERE ctid IN (SELECT ctid FROM expired)\`,
+] as const;
+
+export async function runRetentionMaintenance() {
+  const now = new Date().toISOString();
+  const correlationId = required('EBK_MAINTENANCE_CORRELATION_ID');
+  const principal = await authorizeRetentionMaintenance(now);
+  const logger = createLogger({
+    component: 'job-data-retention-maintenance',
+    feature: 'data-lifecycle',
+    operation: 'retention-maintenance',
+    slice: '${name}',
+    stage: required('EBK_STAGE'),
+    workspace: required('EBK_WORKSPACE'),
+  });
+  const credential = await readCredential(
+    required('EBK_READWRITE_SECRET_ARN'),
+    correlationId,
+  );
+  const ca = await readFile(required('EBK_RDS_CA_BUNDLE'), 'utf8');
+  const client = new Client({
+    ...credential,
+    connectionTimeoutMillis: 10_000,
+    ssl: { ca, rejectUnauthorized: true },
+  });
+  try {
+    await client.connect();
+    await client.query('BEGIN ISOLATION LEVEL SERIALIZABLE');
+    try {
+      await client.query(
+        \`INSERT INTO authorization_audit
+           (action, approval_reference, authority_mode, correlation_id,
+            decision, delegation_reference, policy_version, principal_kind,
+            pseudonymous_subject_id, reason_category, resource_reference,
+            resource_type, slice, stage, subject_type)
+         VALUES ($1, NULL, 'machine', $2, 'allow', NULL, $3, 'agent', $4,
+                 'policy-allow', $5, 'slice', $6, $7, 'service')\`,
+        [
+          ${identifierPrefix}AuthorizationActions.retentionMaintenance,
+          correlationId,
+          POLICY_VERSION,
+          createDataLifecyclePseudonymousReference({
+            categoryId: 'authorization-subject',
+            slice: '${name}',
+            value: principal.actor.id,
+          }),
+          createDataLifecyclePseudonymousReference({
+            categoryId: 'lifecycle-control-metadata',
+            slice: '${name}',
+            value: 'bounded-control-maintenance',
+          }),
+          '${name}',
+          required('EBK_STAGE'),
+        ],
+      );
+      const holdRows = await client.query<{
+        holdJson: DataLifecycleRuntimeHoldV1;
+      }>(
+        \`SELECT hold_json AS "holdJson"
+         FROM data_lifecycle_holds
+         WHERE category_id = 'lifecycle-control-metadata'
+           AND status = 'active'
+         ORDER BY hold_id
+         FOR SHARE\`,
+      );
+      assertNoActiveControlHold(
+        holdRows.rows.map(({ holdJson }) => holdJson),
+        now,
+      );
+      let reconciled = 0;
+      for (const statement of reconciliationStatements) {
+        const result = await client.query(statement, [now, BATCH_LIMIT]);
+        reconciled += result.rowCount ?? 0;
+      }
+      let deleted = 0;
+      for (const statement of maintenanceStatements) {
+        const result = await client.query(statement, [now, BATCH_LIMIT]);
+        deleted += result.rowCount ?? 0;
+      }
+      await client.query('COMMIT');
+      logger.info('Retention control maintenance completed', {
+        attributes: {
+          deleted,
+          reconciled,
+          statementCount:
+            reconciliationStatements.length +
+            maintenanceStatements.length,
+        },
+        outcome: 'success',
+      });
+      return {
+        deleted,
+        reconciled,
+        statementCount:
+          reconciliationStatements.length + maintenanceStatements.length,
+      };
+    } catch (error) {
+      await client.query('ROLLBACK').catch(() => undefined);
+      throw error;
+    }
+  } catch (error) {
+    logger.error('Retention control maintenance failed', {
+      attributes: {
+        errorCode:
+          error instanceof Error
+            ? error.name.replace(/[^A-Za-z0-9_.-]/g, '').slice(0, 80)
+            : 'RetentionMaintenanceError',
+      },
+      outcome: 'failure',
+    });
+    throw error;
+  } finally {
+    await client.end().catch(() => undefined);
+  }
+}
+
+if (import.meta.url === new URL(process.argv[1] ?? '', 'file:').href) {
+  await runRetentionMaintenance();
+}
+`,
+        'jobs/data-retention/src/retention-contract.spec.ts': `import { readFile } from 'node:fs/promises';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { runDataLifecycleRetention } from '@empire-builder-kit/runtime/data-lifecycle';
+import type { Client } from 'pg';
+import {
+  ${identifierPrefix}AuthorizationActions,
+} from '../../../authorization/policy.js';
+import { productRecordReference } from '../../../data/pseudonymous-reference.js';
+import { create${pascalName}RetentionAdapter } from './adapter.js';
+import { authorizeRetentionMaintenance } from './maintenance.js';
+import { authorizeRetentionOperation } from './run.js';
+
+const recordId = '11111111-1111-4111-8111-111111111111';
+const runId = '22222222-2222-4222-8222-222222222222';
+const asOf = '2026-07-28T12:00:00.000Z';
+
+interface QueryScenario {
+  hold: boolean;
+  queries: string[];
+}
+
+function clientFor(scenario: QueryScenario): Client {
+  return {
+    async query(statement: string) {
+      const normalized = statement.replace(/\\s+/g, ' ').trim();
+      scenario.queries.push(normalized);
+      if (
+        normalized.includes(
+          'FROM data_lifecycle_retention_candidates',
+        )
+      ) {
+        return {
+          rowCount: 1,
+          rows: [
+            {
+              cursorKey: 'candidate-001',
+              dueAt: new Date('2026-07-27T12:00:00.000Z'),
+              id: recordId,
+            },
+          ],
+        };
+      }
+      if (
+        normalized.includes('FROM records') &&
+        normalized.includes('FOR UPDATE')
+      ) {
+        return { rowCount: 1, rows: [{ due: true }] };
+      }
+      if (normalized.includes('FROM data_lifecycle_outbox')) {
+        return { rowCount: 0, rows: [] };
+      }
+      if (normalized.includes('FROM data_lifecycle_downstream_copies')) {
+        return { rowCount: 0, rows: [] };
+      }
+      if (normalized.includes('FROM data_lifecycle_holds')) {
+        return {
+          rowCount: scenario.hold ? 1 : 0,
+          rows: scenario.hold
+            ? [
+                {
+                  holdJson: {
+                    categoryId: 'product-record',
+                    effects: ['block-deletion'],
+                    expiresAt: '2099-07-28T12:00:00.000Z',
+                    holdId: 'retention-hold',
+                    issuerCode: 'legal',
+                    purpose: 'legal',
+                    reviewAt: '2098-07-28T12:00:00.000Z',
+                    scopeRef: productRecordReference(recordId),
+                    startsAt: '2026-07-27T12:00:00.000Z',
+                    status: 'active',
+                  },
+                },
+              ]
+            : [],
+        };
+      }
+      return { rowCount: 1, rows: [] };
+    },
+  } as unknown as Client;
+}
+
+function adapterFor(
+  scenario: QueryScenario,
+  publishLifecycleEvent: () => Promise<void>,
+) {
+  return create${pascalName}RetentionAdapter({
+    approvalRequestId: '33333333-3333-4333-8333-333333333333',
+    asOf,
+    client: clientFor(scenario),
+    completedAt: asOf,
+    correlationId: '44444444-4444-4444-8444-444444444444',
+    eventBusName: 'sample-product-development',
+    mode: 'apply',
+    publishLifecycleEvent,
+    runId,
+    stage: 'development',
+  });
+}
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+describe('generated data-retention Job contract', () => {
+  it('keeps bounded maintenance outside the approved candidate command', async () => {
+    const runSource = await readFile(new URL('./run.ts', import.meta.url), 'utf8');
+    const maintenanceSource = await readFile(
+      new URL('./maintenance.ts', import.meta.url),
+      'utf8',
+    );
+
+    expect(runSource).not.toContain('cleanupControlRows');
+    expect(runSource).not.toContain('retentionMaintenance');
+    expect(maintenanceSource).not.toContain('beginApprovalExecution');
+    expect(maintenanceSource).toContain(
+      '${identifierPrefix}AuthorizationActions.retentionMaintenance',
+    );
+    expect(maintenanceSource).toContain(
+      'BEGIN ISOLATION LEVEL SERIALIZABLE',
+    );
+    expect(maintenanceSource).toContain('LIMIT $2');
+  });
+
+  it('requires exact report/apply/maintenance actions and workload identity', async () => {
+    vi.stubEnv('EBK_STAGE', 'development');
+    vi.stubEnv('EBK_WORKLOAD_IDENTITY', '${name}:data-retention-job');
+    await expect(
+      authorizeRetentionOperation(
+        ${identifierPrefix}AuthorizationActions.retentionReport,
+        asOf,
+        runId,
+      ),
+    ).resolves.toMatchObject({
+      actor: { id: '${name}:data-retention-job', type: 'service' },
+    });
+    await expect(
+      authorizeRetentionOperation(
+        ${identifierPrefix}AuthorizationActions.retentionApply,
+        asOf,
+        runId,
+      ),
+    ).resolves.toMatchObject({
+      actor: { id: '${name}:data-retention-job', type: 'service' },
+    });
+    await expect(authorizeRetentionMaintenance(asOf)).resolves.toMatchObject({
+      actor: { id: '${name}:data-retention-job', type: 'service' },
+    });
+
+    vi.stubEnv('EBK_WORKLOAD_IDENTITY', '${name}:event-consumer');
+    await expect(
+      authorizeRetentionOperation(
+        ${identifierPrefix}AuthorizationActions.retentionReport,
+        asOf,
+        runId,
+      ),
+    ).rejects.toThrow('Retention Job workload identity is invalid.');
+    await expect(authorizeRetentionMaintenance(asOf)).rejects.toThrow(
+      'Retention maintenance workload identity is invalid.',
+    );
+
+    vi.stubEnv('EBK_WORKLOAD_IDENTITY', '');
+    await expect(
+      authorizeRetentionOperation(
+        ${identifierPrefix}AuthorizationActions.retentionApply,
+        asOf,
+        runId,
+      ),
+    ).rejects.toThrow('EBK_WORKLOAD_IDENTITY is required.');
+  });
+
+  it('locks the candidate before holds and leaves the checkpoint incomplete when held', async () => {
+    const scenario: QueryScenario = { hold: true, queries: [] };
+    const result = await runDataLifecycleRetention({
+      adapter: adapterFor(scenario, async () => undefined),
+      asOf,
+      limit: 100,
+      mode: 'apply',
+      policyVersion: '1.0.0',
+    });
+    const recordLock = scenario.queries.findIndex(
+      (statement) =>
+        statement.includes('FROM records') &&
+        statement.includes('FOR UPDATE'),
+    );
+    const holdRead = scenario.queries.findIndex((statement) =>
+      statement.includes('FROM data_lifecycle_holds'),
+    );
+
+    expect(result.status).toBe('retry-required');
+    expect(result.checkpoint.complete).toBe(false);
+    expect(recordLock).toBeGreaterThanOrEqual(0);
+    expect(holdRead).toBeGreaterThan(recordLock);
+    expect(
+      scenario.queries.some((statement) =>
+        statement.startsWith('DELETE FROM records'),
+      ),
+    ).toBe(false);
+  });
+
+  it('keeps the checkpoint incomplete until durable propagation is acknowledged', async () => {
+    const failed: QueryScenario = { hold: false, queries: [] };
+    const failedResult = await runDataLifecycleRetention({
+      adapter: adapterFor(failed, async () => {
+        throw new Error('event publication failed');
+      }),
+      asOf,
+      limit: 100,
+      mode: 'apply',
+      policyVersion: '1.0.0',
+    });
+
+    expect(failedResult.status).toBe('retry-required');
+    expect(failedResult.checkpoint.complete).toBe(false);
+    expect(
+      failed.queries.some((statement) =>
+        statement.includes('INSERT INTO data_lifecycle_outbox'),
+      ),
+    ).toBe(true);
+    expect(
+      failed.queries.some((statement) =>
+        statement.includes("status = 'reconciled'"),
+      ),
+    ).toBe(false);
+
+    const succeeded: QueryScenario = { hold: false, queries: [] };
+    const succeededResult = await runDataLifecycleRetention({
+      adapter: adapterFor(succeeded, async () => undefined),
+      asOf,
+      limit: 100,
+      mode: 'apply',
+      policyVersion: '1.0.0',
+    });
+
+    expect(succeededResult.status).toBe('complete');
+    expect(succeededResult.checkpoint.complete).toBe(true);
+    const published = succeeded.queries.findIndex((statement) =>
+      statement.includes('published_at = $2'),
+    );
+    const reconciled = succeeded.queries.findIndex((statement) =>
+      statement.includes("status = 'reconciled'"),
+    );
+    expect(published).toBeGreaterThanOrEqual(0);
+    expect(reconciled).toBeGreaterThanOrEqual(0);
+  });
+});
+`,
+        'jobs/data-retention/src/run.ts': `import { readFile } from 'node:fs/promises';
+import {
+  EventBridgeClient,
+  PutEventsCommand,
+  type PutEventsRequestEntry,
+} from '@aws-sdk/client-eventbridge';
+import {
+  SendTaskFailureCommand,
+  SendTaskSuccessCommand,
+  SFNClient,
+} from '@aws-sdk/client-sfn';
+import {
+  beginApprovalExecution,
+  completeApprovalExecution,
+  createAuthorizationEvaluator,
+  defineCoarseAdmission,
+  digestApprovalRequest,
+  type ApprovalRequest,
+  type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import {
+  createDataLifecycleEvidence,
+  createDataLifecyclePseudonymousReference,
+  createDataLifecycleRetentionCheckpoint,
+  runDataLifecycleRetention,
+  type DataLifecycleRetentionCheckpointV1,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import { createLogger } from '@empire-builder-kit/runtime/logging';
+import {
+  bindServerSecretRuntime,
+  createAwsSecretsManagerSource,
+  createServerSecretResolver,
+} from '@empire-builder-kit/runtime/secrets';
+import pg from 'pg';
+import {
+  ${identifierPrefix}AuthorizationActions,
+  ${identifierPrefix}AuthorizationPolicy,
+} from '../../../authorization/policy.js';
+import { approvalReference } from '../../../data/pseudonymous-reference.js';
+import {
+  ${pascalName}DataLifecycleRuntimePolicy,
+} from '../../../data/runtime-policy.cjs';
+import { Secrets } from '../../../secrets/declarations.js';
+import { create${pascalName}RetentionAdapter } from './adapter.js';
+
+const { Client } = pg;
+const eventBridge = new EventBridgeClient({});
+const POLICY_VERSION =
+  ${pascalName}DataLifecycleRuntimePolicy.policyVersion;
+const RETENTION_DAYS =
+  ${pascalName}DataLifecycleRuntimePolicy.retentionDays;
+const AUTHORIZATION_POLICY_VERSION =
+  ${identifierPrefix}AuthorizationPolicy.version;
+const ACTION = ${identifierPrefix}AuthorizationActions.retentionApply;
+const WORKLOAD_IDENTITY = '${name}:data-retention-job';
+const MAX_PAGES = 100;
+const PAGE_SIZE = 100;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+let credentialResolver:
+  | ReturnType<typeof createServerSecretResolver>
+  | undefined;
+
+async function publishLifecycleEvent(entry: PutEventsRequestEntry) {
+  const result = await eventBridge.send(
+    new PutEventsCommand({ Entries: [entry] }),
+  );
+  if (result.FailedEntryCount !== 0 || result.Entries?.[0]?.ErrorCode) {
+    throw new Error('EventBridge rejected the retention lifecycle event.');
+  }
+}
+
+interface RetentionPlan {
+  asOf: string;
+  candidateDigest: string;
+  categoryId: 'product-record';
+  due: number;
+  locationId: 'primary-database';
+  maxItems: 10000;
+  pageSize: 100;
+  policyVersion: string;
+  retentionDays: number;
+  runId: string;
+}
+
+interface RetentionCounts {
+  alreadyApplied: number;
+  applied: number;
+  applyPages: number;
+  due: number;
+  reportPages: number;
+}
+
+interface RetentionRunRow {
+  approvalRequestId: string;
+  checkpointJson: DataLifecycleRetentionCheckpointV1;
+  countsJson: RetentionCounts;
+  planJson: RetentionPlan;
+  revision: number;
+  status: string;
+}
+
+function required(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(name + ' is required.');
+  return value;
+}
+
+function requiredUuid(name: string): string {
+  const value = required(name);
+  if (!UUID.test(value)) throw new Error(name + ' must be a UUID.');
+  return value;
+}
+
+function requiredInstant(name: string): string {
+  const value = required(name);
+  const parsed = Date.parse(value);
+  if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value) {
+    throw new Error(name + ' must be a canonical timestamp.');
+  }
+  return value;
+}
+
+function optionalUuid(name: string): string | undefined {
+  const value = process.env[name]?.trim();
+  if (!value) return undefined;
+  if (!UUID.test(value)) throw new Error(name + ' must be a UUID.');
+  return value;
+}
+
+function safeErrorCode(error: unknown): string {
+  const value =
+    error && typeof error === 'object' && 'name' in error
+      ? String(error.name)
+      : 'RetentionJobError';
+  return value.replace(/[^A-Za-z0-9_.-]/g, '').slice(0, 80) || 'Error';
+}
+
+function addDays(value: string, days: number): string {
+  const result = new Date(value);
+  result.setUTCDate(result.getUTCDate() + days);
+  return result.toISOString();
+}
+
+function databaseCredentialResolver() {
+  credentialResolver ??= createServerSecretResolver({
+    binding: bindServerSecretRuntime({
+      stage: required('EBK_STAGE'),
+      workload: WORKLOAD_IDENTITY,
+    }),
+    cache: { freshTtlMs: 0, staleTtlMs: 0 },
+    source: createAwsSecretsManagerSource(),
+  });
+  return credentialResolver;
+}
+
+async function readCredential(secretArn: string, correlationId: string) {
+  const declaration = Secrets.${pascalName}PrimaryDatabaseCredential;
+  const credential = await databaseCredentialResolver().get(
+    declaration,
+    {
+      logicalName: declaration.logicalName,
+      provider: 'aws-secrets-manager',
+      secretArn,
+    },
+    { correlationId },
+  );
+  if (
+    credential.database !== required('EBK_DATABASE_NAME') ||
+    credential.host !== required('EBK_DATABASE_HOST') ||
+    credential.port !== Number(required('EBK_DATABASE_PORT')) ||
+    credential.username !== required('EBK_DATABASE_USERNAME') ||
+    !credential.password
+  ) {
+    throw new Error(
+      'Database credential does not match the exact retention Job binding.',
+    );
+  }
+  return credential;
+}
+
+type RetentionAuthorizationAction =
+  | typeof ${identifierPrefix}AuthorizationActions.retentionApply
+  | typeof ${identifierPrefix}AuthorizationActions.retentionReport;
+
+export async function authorizeRetentionOperation(
+  action: RetentionAuthorizationAction,
+  now: string,
+  runId: string,
+): Promise<AuthorizationPrincipal> {
+  if (required('EBK_WORKLOAD_IDENTITY') !== WORKLOAD_IDENTITY) {
+    throw new Error('Retention Job workload identity is invalid.');
+  }
+  const principal: AuthorizationPrincipal = {
+    actor: { id: WORKLOAD_IDENTITY, type: 'service' },
+    audience: WORKLOAD_IDENTITY,
+    authority: {
+      machineIdentityId: WORKLOAD_IDENTITY,
+      mode: 'machine',
+    },
+    kind: 'agent',
+    roles: [],
+    scopes: [],
+    subject: { id: WORKLOAD_IDENTITY, type: 'service' },
+  };
+  const evaluator = createAuthorizationEvaluator({
+    admission: defineCoarseAdmission({
+      anyOf: [{ kinds: ['agent'], subjectTypes: ['service'] }],
+    }),
+    policy: ${identifierPrefix}AuthorizationPolicy,
+    requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
+  });
+  await evaluator.authorize({
+    action,
+    context: {
+      facts: { operationId: runId },
+      now,
+      stage: required('EBK_STAGE'),
+    },
+    principal,
+    resource: { attributes: { collection: true }, type: 'slice' },
+  });
+  return principal;
+}
+
+async function writeRetentionAuthorizationAudit(
+  client: InstanceType<typeof Client>,
+  action: RetentionAuthorizationAction,
+  correlationId: string,
+  now: string,
+  principal: AuthorizationPrincipal,
+  runId: string,
+) {
+  await client.query(
+    \`INSERT INTO authorization_audit
+       (action, approval_reference, authority_mode, correlation_id, decision,
+        delegation_reference, policy_version, principal_kind,
+        pseudonymous_subject_id, reason_category, resource_reference,
+        resource_type, slice, stage, subject_type)
+     VALUES ($1, NULL, 'machine', $2, 'allow', NULL, $3, 'agent', $4,
+             'policy-allow', $5, 'retention-run', $6, $7, 'service')\`,
+    [
+      action,
+      correlationId,
+      AUTHORIZATION_POLICY_VERSION,
+      createDataLifecyclePseudonymousReference({
+        categoryId: 'authorization-subject',
+        slice: '${name}',
+        value: principal.actor.id,
+      }),
+      createDataLifecyclePseudonymousReference({
+        categoryId: 'lifecycle-control-metadata',
+        slice: '${name}',
+        value: runId,
+      }),
+      '${name}',
+      required('EBK_STAGE'),
+    ],
+  );
+}
+
+async function report(
+  client: InstanceType<typeof Client>,
+  asOf: string,
+  correlationId: string,
+  runId: string,
+) {
+  const action = ${identifierPrefix}AuthorizationActions.retentionReport;
+  const principal = await authorizeRetentionOperation(action, asOf, runId);
+  await writeRetentionAuthorizationAudit(
+    client,
+    action,
+    correlationId,
+    asOf,
+    principal,
+    runId,
+  );
+  const adapter = create${pascalName}RetentionAdapter({
+    asOf,
+    client,
+    completedAt: asOf,
+    correlationId,
+    eventBusName: required('EVENT_BUS_NAME'),
+    mode: 'report',
+    publishLifecycleEvent,
+    runId,
+    stage: required('EBK_STAGE'),
+  });
+  let checkpoint: DataLifecycleRetentionCheckpointV1 | undefined;
+  let due = 0;
+  let pages = 0;
+  let status: 'complete' | 'more' | 'retry-required' = 'more';
+  while (status === 'more' && pages < MAX_PAGES) {
+    const result = await runDataLifecycleRetention({
+      adapter,
+      asOf,
+      checkpoint,
+      limit: PAGE_SIZE,
+      mode: 'report',
+      policyVersion: POLICY_VERSION,
+    });
+    checkpoint = result.checkpoint;
+    due += result.due;
+    status = result.status;
+    pages += 1;
+  }
+  if (status !== 'complete' || !checkpoint?.complete) {
+    throw new Error('Retention report exceeded its bounded execution.');
+  }
+  const plan: RetentionPlan = {
+    asOf,
+    candidateDigest: adapter.candidateDigest(),
+    categoryId: 'product-record',
+    due,
+    locationId: 'primary-database',
+    maxItems: 10000,
+    pageSize: 100,
+    policyVersion: POLICY_VERSION,
+    retentionDays: RETENTION_DAYS,
+    runId,
+  };
+  if (!SHA256.test(plan.candidateDigest)) {
+    throw new Error('Retention report candidate digest is invalid.');
+  }
+  const counts: RetentionCounts = {
+    alreadyApplied: 0,
+    applied: 0,
+    applyPages: 0,
+    due,
+    reportPages: pages,
+  };
+  await client.query('BEGIN');
+  try {
+    await client.query(
+      \`INSERT INTO data_lifecycle_retention_runs
+         (id, as_of, checkpoint_json, counts_json, expires_at, plan_json,
+          policy_version, revision, status)
+       VALUES ($1::uuid, $2, $3::jsonb, $4::jsonb, $5, $6::jsonb,
+               $7, 0, 'reported')\`,
+      [
+        runId,
+        asOf,
+        JSON.stringify(createDataLifecycleRetentionCheckpoint(POLICY_VERSION)),
+        JSON.stringify(counts),
+        addDays(asOf, 400),
+        JSON.stringify(plan),
+        POLICY_VERSION,
+      ],
+    );
+    const candidates = adapter.candidateRecords();
+    if (candidates.length !== due) {
+      throw new Error('Retention report candidate inventory is incomplete.');
+    }
+    for (const candidate of candidates) {
+      await client.query(
+        \`INSERT INTO data_lifecycle_retention_candidates
+           (run_id, candidate_order, record_id, record_ref, due_at)
+         VALUES ($1::uuid, $2, $3::uuid, $4, $5)\`,
+        [
+          runId,
+          candidate.candidateOrder,
+          candidate.recordId,
+          candidate.recordRef,
+          candidate.dueAt,
+        ],
+      );
+    }
+    await client.query('COMMIT');
+  } catch (error) {
+    await client.query('ROLLBACK').catch(() => undefined);
+    throw error;
+  }
+  return {
+    counts,
+    planDigest:
+      'sha256:' +
+      digestApprovalRequest({
+        action: ACTION,
+        command: plan,
+        resource: { id: runId, type: 'retention-run' },
+      }),
+    runRef: runId,
+  };
+}
+
+async function loadRun(
+  client: InstanceType<typeof Client>,
+  approvalRequestId: string,
+  runId: string,
+): Promise<{
+  approval: ApprovalRequest<string>;
+  run: RetentionRunRow;
+}> {
+  const result = await client.query<{
+    approvalJson: ApprovalRequest<string>;
+    approvalRequestId: string;
+    checkpointJson: DataLifecycleRetentionCheckpointV1;
+    countsJson: RetentionCounts;
+    planJson: RetentionPlan;
+    revision: number;
+    status: string;
+  }>(
+    \`SELECT a.request_json AS "approvalJson",
+            r.approval_request_id::text AS "approvalRequestId",
+            r.checkpoint_json AS "checkpointJson",
+            r.counts_json AS "countsJson",
+            r.plan_json AS "planJson",
+            r.revision,
+            r.status
+     FROM data_lifecycle_retention_runs r
+     JOIN approval_requests a ON a.id = r.approval_request_id
+     WHERE r.id = $1::uuid AND a.id = $2::uuid\`,
+    [runId, approvalRequestId],
+  );
+  const row = result.rows[0];
+  if (!row) throw new Error('Retention run and approval do not match.');
+  return {
+    approval: row.approvalJson,
+    run: {
+      approvalRequestId: row.approvalRequestId,
+      checkpointJson: row.checkpointJson,
+      countsJson: row.countsJson,
+      planJson: row.planJson,
+      revision: row.revision,
+      status: row.status,
+    },
+  };
+}
+
+async function validateApprovedPlan(
+  client: InstanceType<typeof Client>,
+  correlationId: string,
+  plan: RetentionPlan,
+) {
+  const adapter = create${pascalName}RetentionAdapter({
+    asOf: plan.asOf,
+    client,
+    completedAt: plan.asOf,
+    correlationId,
+    eventBusName: required('EVENT_BUS_NAME'),
+    mode: 'apply',
+    publishLifecycleEvent,
+    runId: plan.runId,
+    stage: required('EBK_STAGE'),
+  });
+  let checkpoint: DataLifecycleRetentionCheckpointV1 | undefined;
+  let due = 0;
+  let pages = 0;
+  let status: 'complete' | 'more' | 'retry-required' = 'more';
+  while (status === 'more' && pages < MAX_PAGES) {
+    const result = await runDataLifecycleRetention({
+      adapter,
+      asOf: plan.asOf,
+      checkpoint,
+      limit: PAGE_SIZE,
+      mode: 'report',
+      policyVersion: POLICY_VERSION,
+    });
+    checkpoint = result.checkpoint;
+    due += result.due;
+    pages += 1;
+    status = result.status;
+  }
+  if (
+    status !== 'complete' ||
+    !checkpoint?.complete ||
+    due !== plan.due ||
+    adapter.candidateDigest() !== plan.candidateDigest
+  ) {
+    throw new Error(
+      'Retention candidates changed after review; create and approve a new report.',
+    );
+  }
+}
+
+async function apply(
+  client: InstanceType<typeof Client>,
+  approvalRequestId: string,
+  correlationId: string,
+  now: string,
+  runId: string,
+) {
+  const lock = await client.query<{ locked: boolean }>(
+    \`SELECT pg_try_advisory_lock(hashtext($1)) AS locked\`,
+    ['data-retention:' + runId],
+  );
+  if (!lock.rows[0]?.locked) {
+    throw new Error('The retention run is already active.');
+  }
+  try {
+    let { approval, run } = await loadRun(
+      client,
+      approvalRequestId,
+      runId,
+    );
+    if (
+      run.planJson.runId !== runId ||
+      run.planJson.policyVersion !== POLICY_VERSION ||
+      run.planJson.maxItems !== 10000 ||
+      run.planJson.pageSize !== 100 ||
+      !SHA256.test(run.planJson.candidateDigest) ||
+      approval.id !== approvalRequestId ||
+      approval.policyVersion !== AUTHORIZATION_POLICY_VERSION ||
+      approval.schemaVersion !== 1 ||
+      approval.slice !== '${name}' ||
+      digestApprovalRequest({
+        action: ACTION,
+        command: run.planJson,
+        resource: { id: runId, type: 'retention-run' },
+      }) !== approval.requestDigest
+    ) {
+      throw new Error('Retention approval is not bound to the exact plan.');
+    }
+    if (
+      run.status !== 'approval-approved' &&
+      run.status !== 'retry-required' &&
+      run.status !== 'applying'
+    ) {
+      throw new Error('Retention run is not approved for apply.');
+    }
+    const claimed = beginApprovalExecution(approval, {
+      action: ACTION,
+      command: run.planJson,
+      executionId: runId,
+      now,
+      requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
+      resource: { id: runId, type: 'retention-run' },
+    });
+    if (claimed.decision.decision !== 'allow') {
+      throw new Error(
+        'Retention apply approval was denied: ' +
+          claimed.decision.category,
+      );
+    }
+    const principal = await authorizeRetentionOperation(
+      ${identifierPrefix}AuthorizationActions.retentionApply,
+      now,
+      runId,
+    );
+    if (run.status === 'approval-approved') {
+      await validateApprovedPlan(client, correlationId, run.planJson);
+    }
+    await client.query('BEGIN');
+    try {
+      if (claimed.request.revision !== approval.revision) {
+        const updated = await client.query(
+          \`UPDATE approval_requests
+           SET request_json = $3::jsonb, revision = $4, status = $5
+           WHERE id = $1::uuid AND revision = $2\`,
+          [
+            approval.id,
+            approval.revision,
+            JSON.stringify(claimed.request),
+            claimed.request.revision,
+            claimed.request.status,
+          ],
+        );
+        if (updated.rowCount !== 1) {
+          throw new Error('Retention approval claim lost compare-and-set.');
+        }
+      }
+      const started = await client.query(
+        \`UPDATE data_lifecycle_retention_runs
+         SET revision = revision + 1, status = 'applying', updated_at = $3
+         WHERE id = $1::uuid AND revision = $2
+           AND status IN ('approval-approved', 'retry-required', 'applying')\`,
+        [runId, run.revision, now],
+      );
+      if (started.rowCount !== 1) {
+        throw new Error('Retention run claim lost compare-and-set.');
+      }
+      await writeRetentionAuthorizationAudit(
+        client,
+        ${identifierPrefix}AuthorizationActions.retentionApply,
+        correlationId,
+        now,
+        principal,
+        runId,
+      );
+      await client.query('COMMIT');
+    } catch (error) {
+      await client.query('ROLLBACK').catch(() => undefined);
+      throw error;
+    }
+    approval = claimed.request;
+    run = (await loadRun(client, approvalRequestId, runId)).run;
+    const adapter = create${pascalName}RetentionAdapter({
+      approvalRequestId,
+      asOf: run.planJson.asOf,
+      client,
+      completedAt: now,
+      correlationId,
+      eventBusName: required('EVENT_BUS_NAME'),
+      mode: 'apply',
+      publishLifecycleEvent,
+      runId,
+      stage: required('EBK_STAGE'),
+    });
+    let checkpoint = run.checkpointJson;
+    const counts = { ...run.countsJson };
+    let invocationPages = 0;
+    let status: 'complete' | 'more' | 'retry-required' = 'more';
+    while (status === 'more' && invocationPages < MAX_PAGES) {
+      const result = await runDataLifecycleRetention({
+        adapter,
+        asOf: run.planJson.asOf,
+        checkpoint,
+        limit: PAGE_SIZE,
+        mode: 'apply',
+        policyVersion: POLICY_VERSION,
+      });
+      checkpoint = result.checkpoint;
+      counts.alreadyApplied += result.alreadyApplied;
+      counts.applied += result.applied;
+      counts.applyPages += 1;
+      invocationPages += 1;
+      status = result.status;
+      const persisted = await client.query(
+        \`UPDATE data_lifecycle_retention_runs
+         SET checkpoint_json = $2::jsonb, counts_json = $3::jsonb,
+             revision = revision + 1, status = $4, updated_at = $5
+         WHERE id = $1::uuid\`,
+        [
+          runId,
+          JSON.stringify(checkpoint),
+          JSON.stringify(counts),
+          status === 'retry-required' ? 'retry-required' : 'applying',
+          now,
+        ],
+      );
+      if (persisted.rowCount !== 1) {
+        throw new Error('Retention checkpoint could not be persisted.');
+      }
+    }
+    if (status !== 'complete' || !checkpoint.complete) {
+      throw new Error(
+        status === 'retry-required'
+          ? 'Retention adapter requires a safe checkpoint retry.'
+          : 'Retention apply exceeded its bounded execution.',
+      );
+    }
+    const completed = completeApprovalExecution(approval, {
+      executionId: runId,
+      now,
+      requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
+    });
+    if (completed.decision.decision !== 'allow') {
+      throw new Error('Retention approval completion was denied.');
+    }
+    await client.query('BEGIN');
+    try {
+      const approvalUpdated = await client.query(
+        \`UPDATE approval_requests
+         SET request_json = $3::jsonb, revision = $4, status = $5
+         WHERE id = $1::uuid AND revision = $2\`,
+        [
+          approval.id,
+          approval.revision,
+          JSON.stringify(completed.request),
+          completed.request.revision,
+          completed.request.status,
+        ],
+      );
+      const runUpdated = await client.query(
+        \`UPDATE data_lifecycle_retention_runs
+         SET checkpoint_json = $2::jsonb, completed_at = $3,
+             counts_json = $4::jsonb, revision = revision + 1,
+             status = 'completed', updated_at = $3
+         WHERE id = $1::uuid AND status = 'applying'\`,
+        [runId, JSON.stringify(checkpoint), now, JSON.stringify(counts)],
+      );
+      const candidatesDeleted = await client.query(
+        \`DELETE FROM data_lifecycle_retention_candidates
+         WHERE run_id = $1::uuid\`,
+        [runId],
+      );
+      if (approvalUpdated.rowCount !== 1 || runUpdated.rowCount !== 1) {
+        throw new Error('Retention completion lost compare-and-set.');
+      }
+      if (candidatesDeleted.rowCount !== run.planJson.due) {
+        throw new Error('Retention candidate cleanup was incomplete.');
+      }
+      await client.query('COMMIT');
+    } catch (error) {
+      await client.query('ROLLBACK').catch(() => undefined);
+      throw error;
+    }
+    return {
+      approvalRequestId: approval.id,
+      checkpointComplete: true,
+      checkpointDigest:
+        'sha256:' +
+        digestApprovalRequest({
+          action: 'checkpoint',
+          command: checkpoint,
+          resource: { id: runId, type: 'retention-run' },
+        }),
+      counts,
+      runRef: runId,
+    };
+  } finally {
+    await client
+      .query(\`SELECT pg_advisory_unlock(hashtext($1))\`, [
+        'data-retention:' + runId,
+      ])
+      .catch(() => undefined);
+  }
+}
+
+export async function runDataRetentionJob() {
+  const mode = required('EBK_RETENTION_MODE');
+  if (mode !== 'report' && mode !== 'apply') {
+    throw new Error('EBK_RETENTION_MODE must be report or apply.');
+  }
+  const asOf = requiredInstant('EBK_RETENTION_AS_OF');
+  const now = new Date().toISOString();
+  const runId = requiredUuid('EBK_RETENTION_RUN_ID');
+  const approvalRequestId = optionalUuid('EBK_RETENTION_APPROVAL_ID');
+  if (mode === 'apply' && !approvalRequestId) {
+    throw new Error('Retention apply requires its durable approval request.');
+  }
+  if (mode === 'report' && approvalRequestId) {
+    throw new Error('Retention report cannot select an approval request.');
+  }
+  const token = required('EBK_STEP_FUNCTIONS_TASK_TOKEN');
+  const correlationId = requiredUuid('EBK_RETENTION_CORRELATION_ID');
+  const logger = createLogger({
+    component: 'job-data-retention',
+    feature: 'data-lifecycle',
+    operation: 'retention-' + mode,
+    slice: '${name}',
+    stage: required('EBK_STAGE'),
+    workspace: required('EBK_WORKSPACE'),
+  });
+  const secretArn = required('EBK_READWRITE_SECRET_ARN');
+  const credential = await readCredential(secretArn, correlationId);
+  const ca = await readFile(required('EBK_RDS_CA_BUNDLE'), 'utf8');
+  const client = new Client({
+    ...credential,
+    connectionTimeoutMillis: 10_000,
+    ssl: { ca, rejectUnauthorized: true },
+  });
+  const sfn = new SFNClient({});
+  try {
+    await client.connect();
+    const result =
+      mode === 'report'
+        ? await report(client, asOf, correlationId, runId)
+        : await apply(
+            client,
+            approvalRequestId as string,
+            correlationId,
+            now,
+            runId,
+          );
+    const completedAt = new Date().toISOString();
+    const evidence = createDataLifecycleEvidence({
+      categoryId: 'product-record',
+      completedAt,
+      counts: {
+        ...result.counts,
+      },
+      operation: mode === 'apply' ? 'retention-apply' : 'retention-report',
+      outcome: 'succeeded',
+      policyVersion: POLICY_VERSION,
+      ...('approvalRequestId' in result
+        ? { requestRef: approvalReference(result.approvalRequestId) }
+        : {}),
+      startedAt: mode === 'report' ? asOf : now,
+      summary:
+        mode === 'apply'
+          ? 'AWS-internal bounded retention apply completed under durable non-author approval.'
+          : 'AWS-internal bounded retention report completed without product-data mutation; request and non-author approval remain required.',
+      systemIds: ['primary-database', 'lifecycle-control'],
+    });
+    const output = JSON.stringify({ evidence, ...result });
+    await sfn.send(
+      new SendTaskSuccessCommand({ output, taskToken: token }),
+    );
+    logger.info('Data retention Job completed', {
+      attributes: {
+        applied: result.counts.applied,
+        due: result.counts.due,
+        mode,
+        applyPages: result.counts.applyPages,
+        reportPages: result.counts.reportPages,
+      },
+      outcome: 'success',
+    });
+    return { evidence, ...result };
+  } catch (error) {
+    logger.error('Data retention Job failed', {
+      attributes: { errorCode: safeErrorCode(error), mode },
+      outcome: 'failure',
+    });
+    await sfn
+      .send(
+        new SendTaskFailureCommand({
+          cause: JSON.stringify({
+            code: safeErrorCode(error),
+            runRef: runId,
+          }),
+          error: 'DataRetentionJobFailed',
+          taskToken: token,
+        }),
+      )
+      .catch(() => undefined);
+    throw error;
+  } finally {
+    await client.end().catch(() => undefined);
+  }
+}
+
+if (import.meta.url === new URL(process.argv[1] ?? '', 'file:').href) {
+  await runDataRetentionJob();
+}
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-data-retention-job-files.js.map