@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/generators/slice/built-in-plan-key-value-deletion.js

@@ -0,0 +1,377 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderKeyValueDeletionFiles = renderKeyValueDeletionFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+/** Same public deletion journey, backed by native item transactions and durable intents. */
+function renderKeyValueDeletionFiles(name, pascalName, workspace) {
+    const prefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
+    return {
+        'data/record-deletion.ts': `import {
+  assertAuthorizationAllowed, beginApprovalExecution, completeApprovalExecution,
+  createApprovalRequest, decideApprovalRequest, digestApprovalRequest,
+  type ApprovalRequest, type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import type { KeyValueChange } from '@empire-builder-kit/runtime/key-value';
+import { createDataLifecycleDeletionRequest, createDataLifecycleLedgerEntry,
+  transitionDataLifecycleDeletion, type DataLifecycleDeletionRequestV1,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import { buildEventEntry } from '@empire-builder-kit/runtime/events';
+import { RuntimeError } from '@empire-builder-kit/runtime/response';
+import { ${prefix}AuthorizationPolicy } from '../authorization/policy.js';
+import { ${pascalName}DataLifecycleChanged } from '../contracts/events.js';
+import { dispatchEventIntent } from '../async/key-value-delivery.js';
+import { create${pascalName}DataLifecycleChanged } from './lifecycle-event.js';
+import { approvalReference, productRecordReference } from './pseudonymous-reference.js';
+import { canonicalDataRightsNow, dataRightsAuditChange, dataRightsSubjectReference,
+  DATA_RIGHTS_POLICY_VERSION, plusDataRightsDays, requireDirectAdmin, requireDirectHuman,
+} from './data-rights-shared.js';
+import { loadActiveRecordHolds } from './record-holds.js';
+import { readProductRecord } from './records.js';
+import { dataStore } from './key-value.js';
+
+const ACTION = '${name}:record-delete';
+const COPY = 'event-contract';
+const AUTHORIZATION_POLICY_VERSION = ${prefix}AuthorizationPolicy.version;
+const COMPLETIONS = 'record-deletion-completions';
+interface Workflow {
+  kind: 'record-deletion'; schemaVersion: 1;
+  approval: ApprovalRequest<typeof ACTION>;
+  lifecycle: DataLifecycleDeletionRequestV1;
+}
+interface Command {
+  principal: AuthorizationPrincipal; recordId: string; correlationId: string; now?: string;
+}
+interface Execution extends Command { approvalRequestId: string; reasonCode: string }
+const command = (recordId: string, reasonCode: string) => ({ reasonCode, recordId });
+const digestInput = (recordId: string, reasonCode: string) => ({ action: ACTION,
+  resource: { id: recordId, type: 'record' }, command: command(recordId, reasonCode) } as const);
+function failure(code: string, message: string, status = 409): never {
+  throw new RuntimeError({ code, message, status, retryable: status === 503 || code === 'deletion_conflict' });
+}
+function validateInput(input: Command) {
+  requireDirectHuman(input.principal);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.recordId) || !input.correlationId || input.correlationId.length > 128)
+    failure('deletion_input_invalid', 'Deletion identity is invalid.', 400);
+}
+function recordAuthority(value: unknown, input: Command) {
+  const record = readProductRecord(value, input.recordId);
+  if (input.principal.kind !== 'admin' && record.ownerId !== input.principal.actor.id)
+    failure('record_not_found', 'The record was not found.', 404);
+}
+async function loadWorkflow(input: { recordId: string; approvalRequestId: string },
+  snapshot?: Awaited<ReturnType<ReturnType<typeof dataStore>['get']>>) {
+  const row = snapshot ?? await dataStore().get('application', 'record-deletions', input.approvalRequestId);
+  const workflow = row?.value as Workflow | undefined;
+  if (!row || !workflow || workflow.kind !== 'record-deletion' || workflow.schemaVersion !== 1 ||
+      workflow.approval?.id !== input.approvalRequestId || workflow.approval.action !== ACTION ||
+      workflow.approval.resource?.id !== input.recordId || workflow.approval.resource.type !== 'record' ||
+      workflow.approval.slice !== '${name}' || workflow.approval.schemaVersion !== 1 ||
+      !Number.isInteger(workflow.approval.revision) || workflow.approval.revision < 0 ||
+      workflow.lifecycle?.kind !== 'data-deletion' || workflow.lifecycle.version !== 1 ||
+      workflow.lifecycle.scopeRef !== productRecordReference(input.recordId) ||
+      workflow.lifecycle.requestRef !== approvalReference(input.approvalRequestId) ||
+      typeof workflow.lifecycle.policyVersion !== 'string' || !/^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$/.test(workflow.lifecycle.policyVersion))
+    failure('deletion_workflow_invalid', 'The exact deletion workflow was not found or is malformed.', 404);
+  if (workflow.lifecycle.categoryId !== 'product-record' || workflow.lifecycle.primaryLocationId !== 'primary-database' ||
+      workflow.lifecycle.approvalRequirement !== 'required' || !Array.isArray(workflow.lifecycle.downstreamCopies) || workflow.lifecycle.downstreamCopies.length !== 1 ||
+      workflow.lifecycle.downstreamCopies[0]?.copyId !== COPY)
+    failure('deletion_workflow_invalid', 'The deletion workflow has an invalid resource or propagation contract.');
+  if (workflow.approval.status === 'executed' &&
+      (workflow.approval.execution?.executionId !== 'deletion:' + input.approvalRequestId ||
+       !workflow.approval.execution.completedAt || workflow.approval.decision?.outcome !== 'approved' ||
+       workflow.lifecycle.status !== 'completed' || workflow.lifecycle.primaryStatus !== 'completed' ||
+       workflow.lifecycle.downstreamCopies[0].status !== 'completed'))
+    failure('deletion_workflow_invalid', 'The deletion workflow lacks completed execution and propagation evidence.');
+  return { workflow, version: row.version };
+}
+async function load(input: Command & { approvalRequestId: string }) {
+  const retained = await loadWorkflow(input);
+  if (retained.workflow.lifecycle.primaryStatus !== 'completed' &&
+      (retained.workflow.approval.policyVersion !== AUTHORIZATION_POLICY_VERSION ||
+       retained.workflow.lifecycle.policyVersion !== DATA_RIGHTS_POLICY_VERSION))
+    failure('deletion_policy_stale', 'The deletion approval policy has changed.');
+  if (input.principal.kind !== 'admin' && retained.workflow.approval.author?.actorId !== input.principal.actor.id)
+    failure('deletion_workflow_invalid', 'The exact deletion workflow was not found or is malformed.', 404);
+  return retained;
+}
+function requireCommittedExecution(workflow: Workflow, approvalRequestId: string) {
+  if (workflow.approval.status !== 'executing' || workflow.lifecycle.primaryStatus !== 'completed' ||
+      workflow.approval.decision?.outcome !== 'approved' ||
+      workflow.approval.execution?.executionId !== 'deletion:' + approvalRequestId ||
+      typeof workflow.approval.policyVersion !== 'string' || !workflow.approval.policyVersion)
+    failure('deletion_workflow_invalid', 'Deletion completion lacks its exact approved execution.');
+}
+function workflowChange(workflow: Workflow, expectedVersion: number): KeyValueChange {
+  return { action: 'put', collection: 'record-deletions', id: workflow.approval.id, expectedVersion, value: workflow };
+}
+function audit(input: Command & { approvalRequestId: string }, now: string, purposeCode: string) {
+  return dataRightsAuditChange({ action: 'deletion', approvalRequestId: input.approvalRequestId,
+    principal: input.principal, recordId: input.recordId, correlationId: input.correlationId,
+    now, outcome: 'succeeded', purposeCode, summary: 'A bounded record deletion workflow transition was committed.' });
+}
+async function commit(input: Parameters<ReturnType<typeof dataStore>['commit']>[0]) {
+  try { await dataStore().commit(input); }
+  catch (error) {
+    if (error instanceof Error && error.name === 'TransactionCanceledException' &&
+        (error as Error & { CancellationReasons?: Array<{ Code?: string }> }).CancellationReasons?.some(reason => reason.Code === 'ConditionalCheckFailed'))
+      failure('deletion_conflict', 'The record, hold or approval changed concurrently; retry the exact request.');
+    throw error;
+  }
+}
+
+export async function requestRecordDeletion(input: Command & { reasonCode: string }) {
+  validateInput(input);
+  const now = canonicalDataRightsNow(input.now);
+  const row = await dataStore().get('application', 'records', input.recordId);
+  if (!row) failure('record_not_found', 'The record was not found.', 404);
+  recordAuthority(row.value, input);
+  const approval = createApprovalRequest({ ...digestInput(input.recordId, input.reasonCode),
+    author: input.principal, expiresAt: plusDataRightsDays(now, 1), now,
+    policyVersion: AUTHORIZATION_POLICY_VERSION, slice: '${name}' });
+  const lifecycle = createDataLifecycleDeletionRequest({ approvalRequirement: 'required',
+    categoryId: 'product-record', createdAt: now, downstreamCopyIds: [COPY],
+    policyVersion: DATA_RIGHTS_POLICY_VERSION, primaryLocationId: 'primary-database',
+    requestRef: approvalReference(approval.id), scopeRef: productRecordReference(input.recordId) });
+  await commit({ tenantId: 'application', changes: [
+    { action: 'check', collection: 'records', id: input.recordId, expectedVersion: row.version },
+    workflowChange({ kind: 'record-deletion', schemaVersion: 1, approval, lifecycle }, 0),
+    audit({ ...input, approvalRequestId: approval.id }, now, 'approval-pending'),
+  ] });
+  return { approvalRequestId: approval.id, expiresAt: approval.expiresAt, requestDigest: approval.requestDigest, status: 'pending' as const };
+}
+
+export async function decideRecordDeletion(input: Command & {
+  approvalRequestId: string; expectedRequestDigest: string; outcome: string; reasonReference: string;
+}) {
+  validateInput(input); requireDirectAdmin(input.principal);
+  if (input.outcome !== 'approved' && input.outcome !== 'rejected')
+    failure('approval_outcome_invalid', 'The approval outcome is invalid.', 400);
+  const { workflow, version } = await load(input);
+  const now = canonicalDataRightsNow(input.now);
+  const decision = decideApprovalRequest(workflow.approval, { approver: input.principal,
+    expectedRequestDigest: input.expectedRequestDigest, now, outcome: input.outcome,
+    reasonReference: input.reasonReference, requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION });
+  assertAuthorizationAllowed(decision.decision);
+  const next = { ...workflow, approval: decision.request,
+    lifecycle: decision.request.status === 'rejected'
+      ? transitionDataLifecycleDeletion(workflow.lifecycle, { at: now, reasonCode: 'approval-rejected', type: 'reject' })
+      : workflow.lifecycle };
+  await commit({ tenantId: 'application', changes: [workflowChange(next, version), audit(input, now, 'approval-' + input.outcome)] });
+  return { approvalRequestId: decision.request.id, status: decision.request.status as 'approved' | 'rejected' };
+}
+
+async function prepare(input: Execution) {
+  validateInput(input);
+  const now = canonicalDataRightsNow(input.now);
+  const { workflow, version } = await load(input);
+  if (digestApprovalRequest(digestInput(input.recordId, input.reasonCode)) !== workflow.approval.requestDigest)
+    failure('deletion_command_mismatch', 'The deletion command differs from the approved request.');
+  if (workflow.approval.status === 'executed' && workflow.lifecycle.status === 'completed') return 'completed';
+  if (workflow.lifecycle.primaryStatus === 'completed') {
+    requireCommittedExecution(workflow, input.approvalRequestId);
+    return 'pending';
+  }
+  const begun = beginApprovalExecution(workflow.approval, { ...digestInput(input.recordId, input.reasonCode),
+    executionId: 'deletion:' + input.approvalRequestId, now, requiredPolicyVersion: AUTHORIZATION_POLICY_VERSION });
+  assertAuthorizationAllowed(begun.decision);
+  const row = await dataStore().get('application', 'records', input.recordId);
+  if (!row) failure('record_not_found', 'The record was not found.', 404);
+  recordAuthority(row.value, input);
+  const holds = await loadActiveRecordHolds(input.recordId, now, 'deletion');
+  let lifecycle = transitionDataLifecycleDeletion(workflow.lifecycle, { type: 'verify', at: now,
+    authorityRef: dataRightsSubjectReference(input.principal.actor.id),
+    approvalRef: approvalReference(input.approvalRequestId), holds: holds.holds });
+  if (lifecycle.status === 'held') {
+    await commit({ tenantId: 'application', changes: [holds.check, workflowChange({ ...workflow, lifecycle }, version)] });
+    return 'held';
+  }
+  lifecycle = transitionDataLifecycleDeletion(lifecycle, { at: now, type: 'start-primary' });
+  lifecycle = transitionDataLifecycleDeletion(lifecycle, { at: now, type: 'complete-primary', outcomeCode: 'deleted' });
+  const ledger = createDataLifecycleLedgerEntry({ action: 'deletion', categoryId: 'product-record',
+    effectiveAt: now, expiresAt: plusDataRightsDays(now, 400), policyVersion: DATA_RIGHTS_POLICY_VERSION,
+    pseudonymousKey: productRecordReference(input.recordId) });
+  const entry = buildEventEntry(${pascalName}DataLifecycleChanged,
+    create${pascalName}DataLifecycleChanged({ action: 'deletion', occurredAt: now,
+      policyVersion: DATA_RIGHTS_POLICY_VERSION, recordId: input.recordId, requestRef: approvalReference(input.approvalRequestId) }),
+    { busName: process.env.EVENT_BUS_NAME ?? '', stage: process.env.EBK_STAGE ?? '',
+      context: { correlationId: input.correlationId, tenantId: 'application' },
+      eventId: input.approvalRequestId, occurredAt: now }).entry;
+  // No event can exist without its primary deletion, ledger and execution claim.
+  // The hold-set check covers both a changed hold and a concurrently inserted first hold.
+  await commit({ tenantId: 'application', changes: [
+    { action: 'delete', collection: 'records', id: input.recordId, expectedVersion: row.version },
+    holds.check,
+    workflowChange({ ...workflow, approval: begun.request, lifecycle }, version),
+    { action: 'put', collection: COMPLETIONS, id: input.approvalRequestId, expectedVersion: 0,
+      value: { kind: 'record-deletion-completion', schemaVersion: 1, recordId: input.recordId } },
+    { action: 'put', collection: 'data-lifecycle-ledger', id: input.approvalRequestId, expectedVersion: 0, value: ledger },
+    audit(input, now, 'primary-deleted'),
+  ], events: [entry], retainEventsUntilAcknowledged: true });
+  return 'pending';
+}
+
+async function finish(input: Execution, published: boolean) {
+  return finishRetained(input, await load(input), published);
+}
+async function finishRetained(input: Command & { approvalRequestId: string },
+  { workflow, version }: Awaited<ReturnType<typeof loadWorkflow>>, published: boolean) {
+  if (workflow.approval.status === 'executed' && workflow.lifecycle.status === 'completed') return;
+  requireCommittedExecution(workflow, input.approvalRequestId);
+  const completion = await dataStore().get('application', COMPLETIONS, input.approvalRequestId);
+  const pending = completion?.value as { kind?: string; schemaVersion?: number; recordId?: string } | undefined;
+  if (!completion || pending?.kind !== 'record-deletion-completion' || pending.schemaVersion !== 1 || pending.recordId !== input.recordId)
+    failure('deletion_workflow_invalid', 'Deletion completion lacks its atomic pending-work binding.');
+  const now = canonicalDataRightsNow(input.now);
+  let lifecycle = workflow.lifecycle;
+  if (lifecycle.status === 'failed') lifecycle = transitionDataLifecycleDeletion(lifecycle, { at: now, type: 'retry' });
+  lifecycle = transitionDataLifecycleDeletion(lifecycle, { at: now, copyId: COPY, type: 'start-copy' });
+  lifecycle = transitionDataLifecycleDeletion(lifecycle, published
+    ? { at: now, copyId: COPY, type: 'complete-copy', outcomeCode: 'acknowledged' }
+    : { at: now, copyId: COPY, type: 'fail-copy', errorCode: 'event-publication-failed' });
+  let approval = workflow.approval;
+  if (published) {
+    const completed = completeApprovalExecution(approval, { executionId: 'deletion:' + input.approvalRequestId,
+      now, requiredPolicyVersion: approval.policyVersion });
+    assertAuthorizationAllowed(completed.decision); approval = completed.request;
+  }
+  await commit({ tenantId: 'application', changes: [workflowChange({ ...workflow, approval, lifecycle }, version),
+    ...(published ? [audit(input, now, 'approval-executed'),
+      { action: 'delete' as const, collection: COMPLETIONS, id: input.approvalRequestId, expectedVersion: completion.version }] : []),
+  ], ...(published ? { acknowledgeEvents: [input.approvalRequestId] } : {}) });
+}
+
+/** Finish an already-authorized, committed primary deletion. This cannot begin
+ * a deletion or approve a request; delivery and the exact execution are re-read. */
+export async function completePendingRecordDeletion(approvalRequestId: string, expectedRecordId?: string): Promise<boolean> {
+  const row = await dataStore().get('application', 'record-deletions', approvalRequestId);
+  if (!row) {
+    if (expectedRecordId !== undefined) failure('deletion_workflow_invalid', 'Pending deletion lacks its retained workflow.');
+    return true; // Other event kinds do not have deletion workflows.
+  }
+  const recordId = (row.value as Workflow)?.approval?.resource?.id;
+  if (typeof recordId !== 'string' || expectedRecordId !== undefined && recordId !== expectedRecordId)
+    failure('deletion_workflow_invalid', 'Deletion completion lacks its exact record identity.');
+  const retained = await loadWorkflow({ recordId, approvalRequestId }, row);
+  const { workflow } = retained;
+  if (workflow.approval.status === 'executed') return true;
+  if (expectedRecordId === undefined && (workflow.approval.status !== 'executing' || workflow.lifecycle.primaryStatus !== 'completed')) return false;
+  requireCommittedExecution(workflow, approvalRequestId);
+  if (await dispatchEventIntent(approvalRequestId) !== 'published') return false;
+  const identity = '${name}:event-delivery';
+  const principal: AuthorizationPrincipal = { kind: 'agent', actor: { id: identity, type: 'service' },
+    subject: { id: identity, type: 'service' }, authority: { mode: 'machine', machineIdentityId: identity },
+    audience: identity, roles: [], scopes: [] };
+  await finishRetained({ principal, recordId, approvalRequestId, correlationId: 'deletion:' + approvalRequestId }, retained, true);
+  return true;
+}
+
+/** Recover completion even if a worker died after acknowledging publication.
+ * Published intents leave the outbox index, so use a separate bounded cursor. */
+export async function reconcileRecordDeletions() {
+  const store = dataStore(), id = 'deletion-completion';
+  const checkpoint = await store.get('system', 'event-reconciliation', id);
+  const afterId = (checkpoint?.value as { afterId?: string | null } | undefined)?.afterId;
+  if (checkpoint && afterId !== null && typeof afterId !== 'string') throw new Error('Deletion completion cursor is malformed.');
+  const page = await store.list('application', COMPLETIONS, { limit: 25, ...(afterId ? { afterId } : {}) });
+  const summary = { completed: 0, pending: 0, failed: 0, deferred: 0, remaining: false };
+  for (const row of page.records) {
+    try {
+      const pending = row.value as { kind?: string; schemaVersion?: number; recordId?: string;
+        failure?: { at: string; attempts: number; code: string; nextAttemptAt: string } };
+      if (pending.kind !== 'record-deletion-completion' || pending.schemaVersion !== 1 || typeof pending.recordId !== 'string')
+        failure('deletion_workflow_invalid', 'Deletion pending-work binding is malformed.');
+      if (pending.failure) {
+        if (pending.failure.code !== 'deletion-completion-failed' || !Number.isSafeInteger(pending.failure.attempts) ||
+            pending.failure.attempts < 1 || pending.failure.attempts > 16 ||
+            canonicalDataRightsNow(pending.failure.at) !== pending.failure.at ||
+            canonicalDataRightsNow(pending.failure.nextAttemptAt) !== pending.failure.nextAttemptAt ||
+            Date.parse(pending.failure.nextAttemptAt) <= Date.parse(pending.failure.at) ||
+            Date.parse(pending.failure.nextAttemptAt) - Date.parse(pending.failure.at) > 3_600_000)
+          failure('deletion_workflow_invalid', 'Deletion completion retry metadata is malformed.');
+        if (Date.parse(pending.failure.nextAttemptAt) > Date.now()) {
+          summary.pending++; summary.deferred++; continue;
+        }
+      }
+      if (await completePendingRecordDeletion(row.id, pending.recordId)) summary.completed++;
+      else summary.pending++;
+    } catch (error) {
+      // A concurrent caller may have atomically completed and removed this work.
+      // Re-read only on an optimistic conflict; never resurrect the old row or
+      // accept an unrelated/malformed terminal workflow as successful completion.
+      if (error instanceof RuntimeError && error.code === 'deletion_conflict') {
+        const pending = row.value as { recordId?: string };
+        if (typeof pending.recordId === 'string') {
+          const latest = await loadWorkflow({ recordId: pending.recordId, approvalRequestId: row.id });
+          if (latest.workflow.approval.status === 'executed' &&
+              !await store.get('application', COMPLETIONS, row.id)) {
+            summary.completed++;
+            continue;
+          }
+        }
+      }
+      summary.failed++;
+      // Durable, content-free operational evidence remains on the pending item.
+      // A failed conditional write also fails the invocation; never silently skip it.
+      const previousAttempts = (row.value as { failure?: { attempts?: number } }).failure?.attempts;
+      const attempts = Math.min(Number.isSafeInteger(previousAttempts) && previousAttempts! > 0 ? previousAttempts! + 1 : 1, 16);
+      const at = canonicalDataRightsNow();
+      const nextAttemptAt = new Date(Date.parse(at) + Math.min(60_000 * 2 ** (attempts - 1), 3_600_000)).toISOString();
+      await store.commit({ tenantId: 'application', changes: [{ action: 'put', collection: COMPLETIONS,
+        id: row.id, expectedVersion: row.version, value: { ...(row.value as object),
+          failure: { code: 'deletion-completion-failed', at, attempts, nextAttemptAt } } }] });
+    }
+  }
+  await store.commit({ tenantId: 'system', changes: [{ action: 'put', collection: 'event-reconciliation', id,
+    expectedVersion: checkpoint?.version ?? 0, value: { afterId: page.nextId ?? null } }] });
+  // Page counters are not global health. A one-row strongly consistent probe
+  // keeps earlier failed/deferred obligations visible after the cursor moves.
+  summary.remaining = (await store.list('application', COMPLETIONS, { limit: 1 })).records.length > 0;
+  if (summary.failed) failure('deletion_reconciliation_failed', 'Deletion completion failed; inspect the retained pending-work failure markers and retry reconciliation.', 503);
+  return summary;
+}
+
+export async function deleteRecord(input: Execution) {
+  const prepared = await prepare(input);
+  if (prepared === 'held') failure('data_deletion_held', 'Deletion is blocked by an active hold.');
+  if (prepared === 'completed') return { deleted: true, id: input.recordId };
+  let delivery: Awaited<ReturnType<typeof dispatchEventIntent>> = 'retry-required';
+  try { delivery = await dispatchEventIntent(input.approvalRequestId); } catch { /* durable intent remains retryable */ }
+  // The primary transaction is committed. A competing delivery owner is not a
+  // failed copy and cannot supply publication/completed-approval evidence.
+  if (delivery === 'delivery-pending') return { deleted: true, id: input.recordId, deliveryPending: true };
+  const published = delivery === 'published';
+  await finish(input, published);
+  if (!published) failure('data_deletion_retry_required', 'Deletion propagation requires retry.', 503);
+  return { deleted: true, id: input.recordId };
+}
+`,
+        'database/deletions.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import { ${prefix}RequestRecordDeletion, ${prefix}DecideRecordDeletion, ${prefix}DeleteRecord } from '../api/contracts/protected.js';
+import { authorize${pascalName}DataRightsOperation } from '../authorization/runtime.js';
+import { requestRecordDeletion, decideRecordDeletion, deleteRecord } from '../data/record-deletion.js';
+
+export const requestDeletionHandler = createContractHttpJsonHandler<typeof ${prefix}RequestRecordDeletion, RuntimeHttpEvent, AuthorizationPrincipal>({
+  component: 'database-records', operation: ${prefix}RequestRecordDeletion, workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  handle: ({ context, principal, request }) => requestRecordDeletion({ principal, correlationId: context.correlationId,
+    recordId: request.path.recordId, reasonCode: request.body.reasonCode }),
+});
+export const decideDeletionHandler = createContractHttpJsonHandler<typeof ${prefix}DecideRecordDeletion, RuntimeHttpEvent, AuthorizationPrincipal>({
+  component: 'database-records', operation: ${prefix}DecideRecordDeletion, workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  handle: ({ context, principal, request }) => decideRecordDeletion({ principal, correlationId: context.correlationId,
+    recordId: request.path.recordId, approvalRequestId: request.path.approvalRequestId,
+    expectedRequestDigest: request.body.expectedRequestDigest, outcome: request.body.outcome, reasonReference: request.body.reasonReference }),
+});
+export const deleteHandler = createContractHttpJsonHandler<typeof ${prefix}DeleteRecord, RuntimeHttpEvent, AuthorizationPrincipal>({
+  component: 'database-records', operation: ${prefix}DeleteRecord, workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  handle: ({ context, principal, request }) => deleteRecord({ principal, correlationId: context.correlationId,
+    recordId: request.path.recordId, approvalRequestId: request.query.approvalRequestId, reasonCode: request.query.reasonCode }),
+});
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-key-value-deletion.js.map

package/src/generators/slice/built-in-plan-key-value-delivery.d.ts

@@ -0,0 +1,2 @@
+/** Streams are prompt delivery; retained intents and persisted cursors are the recovery path. */
+export declare function renderKeyValueDeliverySource(name: string): string;

package/src/generators/slice/built-in-plan-key-value-delivery.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderKeyValueDeliverySource = renderKeyValueDeliverySource;
+/** Streams are prompt delivery; retained intents and persisted cursors are the recovery path. */
+function renderKeyValueDeliverySource(name) {
+    return `import { EventBridgeClient, PutEventsCommand } from '@aws-sdk/client-eventbridge';
+import { DYNAMO_OUTBOX_SHARDS } from '@empire-builder-kit/runtime/key-value';
+import type { PublishableEventEntry } from '@empire-builder-kit/runtime/events';
+import { dataStore } from '../data/key-value.js';
+import { reconcileRecordDeletions } from '../data/record-deletion.js';
+
+const client = new EventBridgeClient({ maxAttempts: 2 });
+type Store = ReturnType<typeof dataStore>;
+type Cursor = NonNullable<Awaited<ReturnType<Store['listPending']>>['cursor']>;
+// Only the provider fields consumed below are part of this handler's input.
+// No ambient aws-lambda package is required by the generated application.
+interface DynamoDBStreamEvent {
+  Records: Array<{
+    eventName?: string; eventSource?: string; eventSourceARN?: string;
+    dynamodb?: {
+      SequenceNumber?: string;
+      Keys?: Record<string, { S?: string }>;
+      NewImage?: Record<string, { S?: string }>;
+    };
+  }>;
+}
+
+async function publish(entry: PublishableEventEntry): Promise<void> {
+  const result = await client.send(new PutEventsCommand({ Entries: [{
+    Source: entry.source, DetailType: entry.detailType, Detail: entry.detail,
+    EventBusName: entry.eventBusName,
+  }] }), { abortSignal: AbortSignal.timeout(25_000) });
+  if (result.FailedEntryCount !== 0 || result.Entries?.length !== 1 ||
+      result.Entries[0]?.ErrorCode || !result.Entries[0]?.EventId)
+    throw new Error('EventBridge did not acknowledge this event intent.');
+}
+
+const delivered = (result: Awaited<ReturnType<Store['dispatch']>>) =>
+  result === 'published' || result === 'already-published';
+
+/** The API and background workers share the same durable lease/acknowledgement path. */
+export async function dispatchEventIntent(id: string): Promise<'published' | 'delivery-pending' | 'retry-required'> {
+  const result = await dataStore().dispatch(id, publish);
+  return delivered(result) ? 'published' : result === 'busy' ? 'delivery-pending' : 'retry-required';
+}
+
+export async function stream(event: DynamoDBStreamEvent) {
+  const streamArn = process.env.EBK_KEY_VALUE_STREAM_ARN;
+  if (!streamArn || !Array.isArray(event?.Records) || event.Records.length > 100 ||
+      event.Records.some((record) => record.eventSource !== 'aws:dynamodb' ||
+        record.eventSourceARN !== streamArn ||
+        !/^[0-9]{1,128}$/.test(record.dynamodb?.SequenceNumber ?? '')))
+    throw new Error('DynamoDB delivery requires the exact configured stream and bounded sequence records.');
+  const store = dataStore();
+  const batchItemFailures: Array<{ itemIdentifier: string }> = [];
+  for (const record of event.Records) {
+    const image = record.dynamodb?.NewImage;
+    // The provider filter is an efficiency aid, not an authorization boundary.
+    if (record.eventName !== 'INSERT' || image?.kind?.S !== 'outbox' || image.state?.S !== 'pending') continue;
+    try {
+      const id = image.sk?.S;
+      const scope = process.env.EBK_STAGE + '/${name}';
+      if (!id || image.scope?.S !== scope || record.dynamodb?.Keys?.sk?.S !== id ||
+          record.dynamodb.Keys.pk?.S !== image.pk?.S || !image.pk?.S?.startsWith(scope + '/outbox/'))
+        throw new Error('Stream intent identity differs from its table scope.');
+      // Re-read and validate the retained intent; never publish the untrusted stream image.
+      const result = await store.dispatch(id, publish);
+      // Another owner may be publishing the committed intent. Acknowledge this
+      // notification, not publication; the retained intent and sweep recover a
+      // dead owner after lease expiry.
+      if (!delivered(result) && result !== 'busy')
+        throw new Error('Durable intent needs another delivery attempt.');
+    } catch {
+      batchItemFailures.push({ itemIdentifier: record.dynamodb!.SequenceNumber! });
+    }
+  }
+  return { batchItemFailures };
+}
+
+export async function reconcile() {
+  const store = dataStore();
+  const summary = { kind: 'ebk-key-value-reconciliation', delivered: 0, deliveryPending: 0, retryRequired: 0, rejected: 0, shards: 0 };
+  // One page per shard per run bounds work and prevents a poison-filled first
+  // page from starving the remainder forever. Wrap after the final page.
+  for (let shard = 0; shard < DYNAMO_OUTBOX_SHARDS; shard++) {
+    const id = 'shard-' + shard;
+    const previous = await store.get('system', 'event-reconciliation', id);
+    const checkpoint = previous?.value as { cursor: Cursor | null } | undefined;
+    if (previous && (!checkpoint || typeof checkpoint !== 'object' || !Object.prototype.hasOwnProperty.call(checkpoint, 'cursor')))
+      throw new Error('Retained reconciliation checkpoint is malformed.');
+    const page = await store.listPending({ shard, limit: 25, cursor: checkpoint?.cursor ?? undefined });
+    summary.rejected += page.rejected.length;
+    if (page.rejected.length) console.warn(JSON.stringify({
+      kind: 'ebk-key-value-invalid-intents', shard, records: page.rejected,
+    }));
+    for (const intent of page.events) {
+      try {
+        const result = await store.dispatch(intent.id, publish);
+        if (delivered(result)) summary.delivered++;
+        else if (result === 'busy') summary.deliveryPending++;
+        else summary.retryRequired++;
+      } catch {
+        // Retain the row and advance the page. A later sweep retries it.
+        summary.retryRequired++;
+      }
+    }
+    await store.commit({ tenantId: 'system', changes: [{
+      action: 'put', collection: 'event-reconciliation', id,
+      expectedVersion: previous?.version ?? 0, value: { cursor: page.cursor ?? null },
+    }] });
+    summary.shards++;
+  }
+  const deletionCompletion = await reconcileRecordDeletions();
+  console.info(JSON.stringify({ ...summary, deletionCompletion }));
+  return { ...summary, deletionCompletion,
+    outcome: summary.rejected || summary.retryRequired || summary.deliveryPending || deletionCompletion.remaining || deletionCompletion.pending || deletionCompletion.failed ? 'partial' : 'completed' };
+}
+`;
+}
+//# sourceMappingURL=built-in-plan-key-value-delivery.js.map

package/src/generators/slice/built-in-plan-key-value-export.d.ts

@@ -0,0 +1,2 @@
+/** Native export authority, publication and cleanup; no SQL compatibility adapter. */
+export declare function renderKeyValueExportFiles(name: string, pascalName: string): Readonly<Record<string, string>>;