@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/generators/slice/built-in-plan-data-deletion-files.js

@@ -2,10 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductDataDeletionFiles = renderProductDataDeletionFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const built_in_plan_key_value_deletion_js_1 = require("./built-in-plan-key-value-deletion.js");
 /** @internal */
 function renderProductDataDeletionFiles(name, pascalName, workspace) {
-    const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
     return {
+        ...(0, built_in_plan_key_value_deletion_js_1.renderKeyValueDeletionFiles)(name, pascalName, workspace),
         'data/lifecycle-consumers.json': (0, built_in_plan_shared_js_1.json)({
             acceptedSources: [name],
             schemaVersion: 1,
@@ -31,835 +32,6 @@ export function productRecordReference(recordId: string): string {
 export function approvalReference(approvalRequestId: string): string {
   return reference('approval-request', approvalRequestId);
 }
-`,
-        'database/deletions.ts': `import { createHash } from 'node:crypto';
-import {
-  EventBridgeClient,
-  PutEventsCommand,
-  type PutEventsRequestEntry,
-} from '@aws-sdk/client-eventbridge';
-import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
-import type { Principal } from '@empire-builder-kit/runtime/auth';
-import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
-import {
-  assertAuthorizationAllowed,
-  beginApprovalExecution,
-  completeApprovalExecution,
-  createApprovalRequest,
-  createDirectAuthorizationPrincipal,
-  decideApprovalRequest,
-  type ApprovalRequest,
-} from '@empire-builder-kit/runtime/authorization';
-import {
-  createDataLifecycleDeletionRequest,
-  createDataLifecycleLedgerEntry,
-  transitionDataLifecycleDeletion,
-  type DataLifecycleDeletionRequestV1,
-  type DataLifecycleRuntimeHoldV1,
-} from '@empire-builder-kit/runtime/data-lifecycle';
-import { buildEventEntry } from '@empire-builder-kit/runtime/events';
-import { RuntimeError } from '@empire-builder-kit/runtime/response';
-import type { Client as PgClient } from 'pg';
-import {
-  ${identifierPrefix}DecideRecordDeletion,
-  ${identifierPrefix}DeleteRecord,
-  ${identifierPrefix}RequestRecordDeletion,
-} from '../api/contracts/protected.js';
-import { authorize${pascalName}Operation } from '../authorization/runtime.js';
-import {
-  ${identifierPrefix}AuthorizationPolicy,
-  type ${pascalName}AuthorizationAction,
-} from '../authorization/policy.js';
-import {
-  ${pascalName}DataLifecycleChanged,
-} from '../contracts/events.js';
-import {
-  create${pascalName}DataLifecycleChanged,
-} from '../data/lifecycle-event.js';
-import {
-  approvalReference,
-  productRecordReference,
-} from '../data/pseudonymous-reference.js';
-import {
-  ${pascalName}DataLifecycleRuntimePolicy,
-} from '../data/runtime-policy.cjs';
-import { withPrimaryDatabase } from './runtime-client.js';
-
-const POLICY_VERSION =
-  ${pascalName}DataLifecycleRuntimePolicy.policyVersion;
-const AUTHORIZATION_POLICY_VERSION =
-  ${identifierPrefix}AuthorizationPolicy.version;
-const OUTBOX_COPY_ID = 'event-contract';
-const eventBridge = new EventBridgeClient({});
-
-type ProductApproval = ApprovalRequest<${pascalName}AuthorizationAction>;
-
-interface WorkflowRow {
-  approval: ProductApproval;
-  lifecycle: DataLifecycleDeletionRequestV1;
-}
-
-interface OutboxRow {
-  eventJson: PutEventsRequestEntry;
-  publishedAt: Date | null;
-}
-
-function canonicalNow(): string {
-  return new Date().toISOString();
-}
-
-function digestReference(namespace: string, value: string): string {
-  return (
-    'sha256:' +
-    createHash('sha256')
-      .update('${name}\\0' + namespace + '\\0' + value)
-      .digest('hex')
-  );
-}
-
-function deletionCommand(recordId: string, reasonCode: string) {
-  return { reasonCode, recordId };
-}
-
-function plusDays(value: string, days: number): string {
-  const result = new Date(value);
-  result.setUTCDate(result.getUTCDate() + days);
-  return result.toISOString();
-}
-
-function notFound(): never {
-  throw new RuntimeError({
-    code: 'record_not_found',
-    message: 'The record was not found.',
-    retryable: false,
-    status: 404,
-  });
-}
-
-function held(): never {
-  throw new RuntimeError({
-    code: 'data_deletion_held',
-    message: 'Deletion is blocked by an active hold.',
-    retryable: false,
-    status: 409,
-  });
-}
-
-function retryRequired(): never {
-  throw new RuntimeError({
-    code: 'data_deletion_retry_required',
-    message: 'Deletion propagation requires retry.',
-    retryable: true,
-    status: 503,
-  });
-}
-
-function approvalOutcome(value: string): 'approved' | 'rejected' {
-  if (value === 'approved' || value === 'rejected') return value;
-  throw new RuntimeError({
-    code: 'approval_outcome_invalid',
-    message: 'The approval outcome is invalid.',
-    retryable: false,
-    status: 400,
-  });
-}
-
-async function rollback(client: PgClient): Promise<void> {
-  await client.query('ROLLBACK').catch(() => undefined);
-}
-
-async function loadWorkflow(
-  client: PgClient,
-  approvalRequestId: string,
-): Promise<WorkflowRow | undefined> {
-  const result = await client.query<{
-    approval: ProductApproval;
-    lifecycle: DataLifecycleDeletionRequestV1;
-  }>(
-    \`SELECT a.request_json AS approval,
-            d.request_json AS lifecycle
-     FROM approval_requests a
-     JOIN data_lifecycle_requests d
-       ON d.approval_request_id = a.id
-     WHERE a.id = $1::uuid
-     FOR UPDATE OF a, d\`,
-    [approvalRequestId],
-  );
-  return result.rows[0];
-}
-
-async function writeApproval(
-  client: PgClient,
-  previousRevision: number,
-  approval: ProductApproval,
-): Promise<void> {
-  const result = await client.query(
-    \`UPDATE approval_requests
-     SET expires_at = $3,
-         policy_version = $4,
-         request_digest = $5,
-         request_json = $6::jsonb,
-         revision = $7,
-         status = $8
-     WHERE id = $1::uuid AND revision = $2\`,
-    [
-      approval.id,
-      previousRevision,
-      approval.expiresAt,
-      approval.policyVersion,
-      approval.requestDigest,
-      JSON.stringify(approval),
-      approval.revision,
-      approval.status,
-    ],
-  );
-  if (result.rowCount !== 1) {
-    throw new Error('Approval compare-and-set failed.');
-  }
-}
-
-async function writeLifecycle(
-  client: PgClient,
-  approvalRequestId: string,
-  lifecycle: DataLifecycleDeletionRequestV1,
-): Promise<void> {
-  const result = await client.query(
-    \`UPDATE data_lifecycle_requests
-     SET request_json = $2::jsonb,
-         revision = revision + 1,
-         status = $3,
-         updated_at = $4
-     WHERE approval_request_id = $1::uuid\`,
-    [
-      approvalRequestId,
-      JSON.stringify(lifecycle),
-      lifecycle.status,
-      lifecycle.updatedAt,
-    ],
-  );
-  if (result.rowCount !== 1) {
-    throw new Error('Lifecycle request compare-and-set failed.');
-  }
-}
-
-async function writeWorkflowAudit(
-  client: PgClient,
-  input: {
-    action: string;
-    approvalRequestId: string;
-    correlationId: string;
-    principal: Principal;
-    reasonCategory: string;
-    recordId: string;
-  },
-): Promise<void> {
-  await client.query(
-    \`INSERT INTO authorization_audit
-       (action, approval_reference, authority_mode, correlation_id, decision,
-        delegation_reference, policy_version, principal_kind,
-        pseudonymous_subject_id, reason_category, resource_reference,
-        resource_type, slice, stage, subject_type)
-     VALUES ($1, $2, 'direct', $3, 'allow', NULL, $4, $5, $6, $7, $8,
-             'record', $9, $10, $11)\`,
-    [
-      input.action,
-      digestReference('approval', input.approvalRequestId),
-      input.correlationId,
-      AUTHORIZATION_POLICY_VERSION,
-      input.principal.kind,
-      digestReference('subject', input.principal.id),
-      input.reasonCategory,
-      digestReference('record', input.recordId),
-      '${name}',
-      process.env.EBK_STAGE ?? 'development',
-      input.principal.session.subject.type,
-    ],
-  );
-}
-
-async function activeHolds(
-  client: PgClient,
-  scopeRef: string,
-): Promise<DataLifecycleRuntimeHoldV1[]> {
-  const result = await client.query<{ holdJson: DataLifecycleRuntimeHoldV1 }>(
-    \`SELECT hold_json AS "holdJson"
-     FROM data_lifecycle_holds
-     WHERE category_id = 'product-record'
-       AND scope_ref = $1
-       AND status = 'active'
-     ORDER BY hold_id\`,
-    [scopeRef],
-  );
-  return [
-    ...${pascalName}DataLifecycleRuntimePolicy.declaredHolds,
-    ...result.rows.map(({ holdJson }) => holdJson),
-  ];
-}
-
-export const requestDeletionHandler = createContractHttpJsonHandler<
-  typeof ${identifierPrefix}RequestRecordDeletion,
-  RuntimeHttpEvent,
-  Principal
->({
-  component: 'database-records',
-  operation: ${identifierPrefix}RequestRecordDeletion,
-  workspace: '${workspace}',
-  authorize: authorize${pascalName}Operation,
-  async handle({ context, principal, request }) {
-    const now = canonicalNow();
-    const command = deletionCommand(
-      request.path.recordId,
-      request.body.reasonCode,
-    );
-    const approval = createApprovalRequest<${pascalName}AuthorizationAction>({
-      action: '${name}:record-delete',
-      author: createDirectAuthorizationPrincipal(principal),
-      command,
-      expiresAt: plusDays(now, 1),
-      now,
-      policyVersion: AUTHORIZATION_POLICY_VERSION,
-      resource: { id: request.path.recordId, type: 'record' },
-      slice: '${name}',
-    });
-    const lifecycle = createDataLifecycleDeletionRequest({
-      approvalRequirement: 'required',
-      categoryId: 'product-record',
-      createdAt: now,
-      downstreamCopyIds: [OUTBOX_COPY_ID],
-      policyVersion: POLICY_VERSION,
-      primaryLocationId: 'primary-database',
-      requestRef: approvalReference(approval.id),
-      scopeRef: productRecordReference(request.path.recordId),
-    });
-
-    await withPrimaryDatabase(
-      context,
-      'api-database-records',
-      async (client) => {
-        await client.query('BEGIN');
-        try {
-          const record = await client.query(
-            'SELECT 1 FROM records WHERE id = $1::uuid FOR UPDATE',
-            [request.path.recordId],
-          );
-          if (record.rowCount !== 1) notFound();
-          await client.query(
-            \`INSERT INTO approval_requests
-               (id, author_reference, expires_at, policy_version,
-                request_digest, request_json, revision, status)
-             VALUES ($1::uuid, $2, $3, $4, $5, $6::jsonb, $7, $8)\`,
-            [
-              approval.id,
-              approval.author.effectiveHumanId ?? approval.author.actorId,
-              approval.expiresAt,
-              approval.policyVersion,
-              approval.requestDigest,
-              JSON.stringify(approval),
-              approval.revision,
-              approval.status,
-            ],
-          );
-          await client.query(
-            \`INSERT INTO data_lifecycle_requests
-               (id, approval_request_id, request_json, revision, status,
-                updated_at)
-             VALUES (gen_random_uuid(), $1::uuid, $2::jsonb, 0, $3, $4)\`,
-            [
-              approval.id,
-              JSON.stringify(lifecycle),
-              lifecycle.status,
-              lifecycle.updatedAt,
-            ],
-          );
-          await writeWorkflowAudit(client, {
-            action: '${name}:approval-request',
-            approvalRequestId: approval.id,
-            correlationId: context.correlationId,
-            principal,
-            reasonCategory: 'approval-pending',
-            recordId: request.path.recordId,
-          });
-          await client.query('COMMIT');
-        } catch (error) {
-          await rollback(client);
-          throw error;
-        }
-      },
-    );
-    return {
-      approvalRequestId: approval.id,
-      expiresAt: approval.expiresAt,
-      requestDigest: approval.requestDigest,
-      status: 'pending' as const,
-    };
-  },
-});
-
-export const decideDeletionHandler = createContractHttpJsonHandler<
-  typeof ${identifierPrefix}DecideRecordDeletion,
-  RuntimeHttpEvent,
-  Principal
->({
-  component: 'database-records',
-  operation: ${identifierPrefix}DecideRecordDeletion,
-  workspace: '${workspace}',
-  authorize: authorize${pascalName}Operation,
-  async handle({ context, principal, request }) {
-    const result = await withPrimaryDatabase(
-      context,
-      'api-database-records',
-      async (client) => {
-        await client.query('BEGIN');
-        try {
-          const workflow = await loadWorkflow(
-            client,
-            request.path.approvalRequestId,
-          );
-          if (
-            !workflow ||
-            workflow.approval.resource.id !== request.path.recordId
-          ) {
-            notFound();
-          }
-          const now = canonicalNow();
-          const transition = decideApprovalRequest(workflow.approval, {
-            approver: createDirectAuthorizationPrincipal(principal),
-            expectedRequestDigest: request.body.expectedRequestDigest,
-            now,
-            outcome: approvalOutcome(request.body.outcome),
-            reasonReference: request.body.reasonReference,
-            requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
-          });
-          assertAuthorizationAllowed(transition.decision);
-          await writeApproval(
-            client,
-            workflow.approval.revision,
-            transition.request,
-          );
-          if (transition.request.status === 'rejected') {
-            await writeLifecycle(
-              client,
-              transition.request.id,
-              transitionDataLifecycleDeletion(workflow.lifecycle, {
-                at: now,
-                reasonCode: 'approval-rejected',
-                type: 'reject',
-              }),
-            );
-          }
-          await writeWorkflowAudit(client, {
-            action: '${name}:approval-decision',
-            approvalRequestId: transition.request.id,
-            correlationId: context.correlationId,
-            principal,
-            reasonCategory:
-              transition.request.status === 'approved'
-                ? 'approval-approved'
-                : 'approval-rejected',
-            recordId: request.path.recordId,
-          });
-          await client.query('COMMIT');
-          return transition.request;
-        } catch (error) {
-          await rollback(client);
-          throw error;
-        }
-      },
-    );
-    return {
-      approvalRequestId: result.id,
-      status: result.status as 'approved' | 'rejected',
-    };
-  },
-});
-
-interface PreparedDeletion {
-  alreadyCompleted: boolean;
-  approval: ProductApproval;
-  event?: PutEventsRequestEntry;
-  held: boolean;
-  lifecycle: DataLifecycleDeletionRequestV1;
-}
-
-async function prepareDeletion(
-  client: PgClient,
-  input: {
-    approvalRequestId: string;
-    correlationId: string;
-    principal: Principal;
-    reasonCode: string;
-    recordId: string;
-  },
-): Promise<PreparedDeletion> {
-  const workflow = await loadWorkflow(client, input.approvalRequestId);
-  if (
-    !workflow ||
-    workflow.approval.resource.id !== input.recordId ||
-    workflow.approval.action !== '${name}:record-delete'
-  ) {
-    notFound();
-  }
-  if (
-    workflow.approval.status === 'executed' &&
-    workflow.lifecycle.status === 'completed'
-  ) {
-    return {
-      alreadyCompleted: true,
-      approval: workflow.approval,
-      held: false,
-      lifecycle: workflow.lifecycle,
-    };
-  }
-
-  const now = canonicalNow();
-  const command = deletionCommand(input.recordId, input.reasonCode);
-  const executionId = 'deletion:' + input.approvalRequestId;
-  if (
-    workflow.lifecycle.status === 'requested' ||
-    workflow.lifecycle.status === 'held' ||
-    workflow.lifecycle.status === 'verified'
-  ) {
-    const record = await client.query(
-      'SELECT 1 FROM records WHERE id = $1::uuid FOR UPDATE',
-      [input.recordId],
-    );
-    if (record.rowCount !== 1) notFound();
-  }
-  const begun = beginApprovalExecution(workflow.approval, {
-    action: '${name}:record-delete',
-    command,
-    executionId,
-    now,
-    requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
-    resource: { id: input.recordId, type: 'record' },
-  });
-  assertAuthorizationAllowed(begun.decision);
-  let lifecycle = workflow.lifecycle;
-  if (lifecycle.status === 'requested' || lifecycle.status === 'held') {
-    lifecycle = transitionDataLifecycleDeletion(lifecycle, {
-      approvalRef: approvalReference(input.approvalRequestId),
-      at: now,
-      authorityRef: digestReference('subject', input.principal.id),
-      holds: await activeHolds(client, lifecycle.scopeRef),
-      type: 'verify',
-    });
-  }
-  if (lifecycle.status === 'held') {
-    await writeLifecycle(client, input.approvalRequestId, lifecycle);
-    return {
-      alreadyCompleted: false,
-      approval: workflow.approval,
-      held: true,
-      lifecycle,
-    };
-  }
-  if (lifecycle.status === 'failed') {
-    lifecycle = transitionDataLifecycleDeletion(lifecycle, {
-      at: now,
-      type: 'retry',
-    });
-  }
-
-  let event: PutEventsRequestEntry | undefined;
-  if (
-    lifecycle.status === 'verified' ||
-    lifecycle.status === 'primary-deletion-in-progress'
-  ) {
-    if (lifecycle.status === 'verified') {
-      lifecycle = transitionDataLifecycleDeletion(lifecycle, {
-        at: now,
-        type: 'start-primary',
-      });
-    }
-    const deleted = await client.query(
-      'DELETE FROM records WHERE id = $1::uuid',
-      [input.recordId],
-    );
-    const pseudonymousKey = productRecordReference(input.recordId);
-    const ledger = createDataLifecycleLedgerEntry({
-      action: 'deletion',
-      categoryId: 'product-record',
-      effectiveAt: now,
-      expiresAt: plusDays(now, 400),
-      policyVersion: POLICY_VERSION,
-      pseudonymousKey,
-    });
-    await client.query(
-      \`INSERT INTO data_lifecycle_ledger
-         (entry_id, action, category_id, effective_at, expires_at,
-          idempotency_key, policy_version, pseudonymous_key)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
-       ON CONFLICT (idempotency_key) DO NOTHING\`,
-      [
-        ledger.entryId,
-        ledger.action,
-        ledger.categoryId,
-        ledger.effectiveAt,
-        ledger.expiresAt,
-        digestReference('approval', input.approvalRequestId),
-        ledger.policyVersion,
-        ledger.pseudonymousKey,
-      ],
-    );
-    const lifecycleEvent = create${pascalName}DataLifecycleChanged({
-      action: 'deletion',
-      occurredAt: now,
-      policyVersion: POLICY_VERSION,
-      recordId: input.recordId,
-      requestRef: approvalReference(input.approvalRequestId),
-    });
-    const built = buildEventEntry(
-      ${pascalName}DataLifecycleChanged,
-      lifecycleEvent,
-      {
-        busName: process.env.EVENT_BUS_NAME ?? '',
-        context: { correlationId: input.correlationId },
-        eventId: input.approvalRequestId,
-        occurredAt: now,
-        stage: process.env.EBK_STAGE ?? 'development',
-      },
-    );
-    event = {
-      Detail: built.entry.detail,
-      DetailType: built.entry.detailType,
-      EventBusName: built.entry.eventBusName,
-      Source: built.entry.source,
-    };
-    await client.query(
-      \`INSERT INTO data_lifecycle_outbox
-         (idempotency_key, event_json, expires_at)
-       VALUES ($1, $2::jsonb, $3)
-       ON CONFLICT (idempotency_key) DO NOTHING\`,
-      [
-        digestReference('outbox', input.approvalRequestId),
-        JSON.stringify(event),
-        plusDays(now, 30),
-      ],
-    );
-    lifecycle = transitionDataLifecycleDeletion(lifecycle, {
-      at: now,
-      outcomeCode: deleted.rowCount === 1 ? 'deleted' : 'not-found',
-      type: 'complete-primary',
-    });
-  } else {
-    const outbox = await client.query<OutboxRow>(
-      \`SELECT event_json AS "eventJson", published_at AS "publishedAt"
-       FROM data_lifecycle_outbox
-       WHERE idempotency_key = $1
-       FOR UPDATE\`,
-      [digestReference('outbox', input.approvalRequestId)],
-    );
-    event = outbox.rows[0]?.eventJson;
-  }
-
-  if (begun.request !== workflow.approval) {
-    await writeApproval(
-      client,
-      workflow.approval.revision,
-      begun.request,
-    );
-  }
-  await writeLifecycle(client, input.approvalRequestId, lifecycle);
-  return {
-    alreadyCompleted: false,
-    approval: begun.request,
-    event,
-    held: false,
-    lifecycle,
-  };
-}
-
-async function recordPublicationFailure(
-  context: { correlationId: string },
-  approvalRequestId: string,
-): Promise<void> {
-  await withPrimaryDatabase(
-    context,
-    'api-database-records',
-    async (client) => {
-      await client.query('BEGIN');
-      try {
-        const workflow = await loadWorkflow(client, approvalRequestId);
-        if (
-          workflow &&
-          workflow.lifecycle.status ===
-            'downstream-deletion-in-progress'
-        ) {
-          const at = canonicalNow();
-          const started = transitionDataLifecycleDeletion(
-            workflow.lifecycle,
-            { at, copyId: OUTBOX_COPY_ID, type: 'start-copy' },
-          );
-          const failed = transitionDataLifecycleDeletion(started, {
-            at,
-            copyId: OUTBOX_COPY_ID,
-            errorCode: 'event-publication-failed',
-            type: 'fail-copy',
-          });
-          await writeLifecycle(client, approvalRequestId, failed);
-        }
-        await client.query(
-          \`UPDATE data_lifecycle_outbox
-           SET attempts = attempts + 1,
-               last_error_code = 'event-publication-failed'
-           WHERE idempotency_key = $1\`,
-          [digestReference('outbox', approvalRequestId)],
-        );
-        await client.query('COMMIT');
-      } catch (error) {
-        await rollback(client);
-        throw error;
-      }
-    },
-  );
-}
-
-async function completeDeletion(
-  context: { correlationId: string },
-  input: {
-    approvalRequestId: string;
-    principal: Principal;
-    recordId: string;
-  },
-): Promise<void> {
-  await withPrimaryDatabase(
-    context,
-    'api-database-records',
-    async (client) => {
-      await client.query('BEGIN');
-      try {
-        const workflow = await loadWorkflow(
-          client,
-          input.approvalRequestId,
-        );
-        if (!workflow) notFound();
-        if (
-          workflow.approval.status === 'executed' &&
-          workflow.lifecycle.status === 'completed'
-        ) {
-          await client.query('COMMIT');
-          return;
-        }
-        const at = canonicalNow();
-        let lifecycle = workflow.lifecycle;
-        if (lifecycle.status === 'failed') {
-          lifecycle = transitionDataLifecycleDeletion(lifecycle, {
-            at,
-            type: 'retry',
-          });
-        }
-        const started = transitionDataLifecycleDeletion(lifecycle, {
-          at,
-          copyId: OUTBOX_COPY_ID,
-          type: 'start-copy',
-        });
-        lifecycle = transitionDataLifecycleDeletion(started, {
-          at,
-          copyId: OUTBOX_COPY_ID,
-          outcomeCode: 'acknowledged',
-          type: 'complete-copy',
-        });
-        const completed = completeApprovalExecution(workflow.approval, {
-          executionId: 'deletion:' + input.approvalRequestId,
-          now: at,
-          requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION,
-        });
-        assertAuthorizationAllowed(completed.decision);
-        await writeLifecycle(client, input.approvalRequestId, lifecycle);
-        await writeApproval(
-          client,
-          workflow.approval.revision,
-          completed.request,
-        );
-        await client.query(
-          \`UPDATE data_lifecycle_outbox
-           SET attempts = attempts + 1,
-               last_error_code = NULL,
-               published_at = $2
-           WHERE idempotency_key = $1\`,
-          [digestReference('outbox', input.approvalRequestId), at],
-        );
-        await writeWorkflowAudit(client, {
-          action: '${name}:approval-execution',
-          approvalRequestId: input.approvalRequestId,
-          correlationId: context.correlationId,
-          principal: input.principal,
-          reasonCategory: 'approval-executed',
-          recordId: input.recordId,
-        });
-        await client.query('COMMIT');
-      } catch (error) {
-        await rollback(client);
-        throw error;
-      }
-    },
-  );
-}
-
-export const deleteHandler = createContractHttpJsonHandler<
-  typeof ${identifierPrefix}DeleteRecord,
-  RuntimeHttpEvent,
-  Principal
->({
-  component: 'database-records',
-  operation: ${identifierPrefix}DeleteRecord,
-  workspace: '${workspace}',
-  authorize: authorize${pascalName}Operation,
-  async handle({ context, principal, request }) {
-    const prepared = await withPrimaryDatabase(
-      context,
-      'api-database-records',
-      async (client) => {
-        await client.query('BEGIN');
-        try {
-          const result = await prepareDeletion(client, {
-            approvalRequestId: request.query.approvalRequestId,
-            correlationId: context.correlationId,
-            principal,
-            reasonCode: request.query.reasonCode,
-            recordId: request.path.recordId,
-          });
-          await client.query('COMMIT');
-          return result;
-        } catch (error) {
-          await rollback(client);
-          throw error;
-        }
-      },
-    );
-    if (prepared.held) held();
-    if (prepared.alreadyCompleted) {
-      return { deleted: true, id: request.path.recordId };
-    }
-    if (!prepared.event) retryRequired();
-    try {
-      const result = await eventBridge.send(
-        new PutEventsCommand({ Entries: [prepared.event] }),
-      );
-      if (
-        result.FailedEntryCount !== 0 ||
-        result.Entries?.[0]?.ErrorCode
-      ) {
-        throw new Error('EventBridge rejected the lifecycle event.');
-      }
-    } catch {
-      await recordPublicationFailure(
-        { correlationId: context.correlationId },
-        request.query.approvalRequestId,
-      );
-      retryRequired();
-    }
-    await completeDeletion(
-      { correlationId: context.correlationId },
-      {
-        approvalRequestId: request.query.approvalRequestId,
-        principal,
-        recordId: request.path.recordId,
-      },
-    );
-    return { deleted: true, id: request.path.recordId };
-  },
-});
 `,
         'testing/data-deletion-journey.spec.ts': `import {
   beginApprovalExecution,