@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-data-lifecycle-files.js

@@ -7,6 +7,9 @@ function retention(durationDays, reason, trigger, deletionMethod = 'hard-delete'
 }
 /** @internal */
 function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00.000Z') {
+    // Store IDs are logical lifecycle identities, not a choice of SQL engine.
+    // The persisted store, not the presence of optional SQL, owns these references.
+    const backupDays = 35;
     const reviewDueAt = new Date(Date.parse(reviewedAt) + 365 * 24 * 60 * 60 * 1_000).toISOString();
     const pascalName = name
         .split('-')
@@ -22,7 +25,7 @@ function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00
                 id: 'primary-database-backup',
                 restoreOnly: true,
                 restorePlanId: 'primary-database-restore',
-                retention: retention(30, 'Cover the reviewed point-in-time recovery window.', 'copy-created', 'lifecycle-expiry'),
+                retention: retention(backupDays, 'Cover the reviewed point-in-time recovery window.', 'copy-created', 'lifecycle-expiry'),
                 sourceStoreId: 'primary-database',
             },
         ],
@@ -362,11 +365,11 @@ function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00
                 encryption: {
                     atRest: 'required',
                     inTransit: 'required',
-                    keyOwner: 'foundation-data',
+                    keyOwner: name,
                 },
                 id: 'primary-database',
                 kind: 'database',
-                locationRef: 'database/bindings.json#primary',
+                locationRef: 'infra/key-value.ts#table',
                 owner: name,
                 production: true,
                 residency: ['us-east-1'],
@@ -379,15 +382,15 @@ function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00
                 encryption: {
                     atRest: 'required',
                     inTransit: 'required',
-                    keyOwner: 'foundation-data',
+                    keyOwner: name,
                 },
                 id: 'database-backup',
                 kind: 'backup',
-                locationRef: 'foundation/database-backup',
+                locationRef: 'infra/key-value.ts#pointInTimeRecovery',
                 owner: name,
                 production: true,
                 residency: ['us-east-1'],
-                retention: retention(30, 'Match the reviewed point-in-time recovery window.', 'copy-created', 'lifecycle-expiry'),
+                retention: retention(backupDays, 'Match the reviewed point-in-time recovery window.', 'copy-created', 'lifecycle-expiry'),
             },
             {
                 accessPurposes: ['restore-reconciliation', 'security-audit'],
@@ -400,7 +403,7 @@ function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00
                 },
                 id: 'lifecycle-audit',
                 kind: 'audit',
-                locationRef: 'database/data-lifecycle-audit',
+                locationRef: 'data/key-value.ts#data-lifecycle-audit',
                 owner: name,
                 production: true,
                 residency: ['us-east-1'],
@@ -421,7 +424,7 @@ function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00
                 },
                 id: 'lifecycle-control',
                 kind: 'audit',
-                locationRef: 'database/schema.ts#authorization-and-data-lifecycle-control',
+                locationRef: 'data/key-value.ts#authorization-and-data-lifecycle-control',
                 owner: name,
                 production: true,
                 residency: ['us-east-1'],
@@ -438,7 +441,7 @@ function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00
                 },
                 id: 'downstream-copy-registry',
                 kind: 'audit',
-                locationRef: 'database/schema.ts#data_lifecycle_downstream_copies',
+                locationRef: 'api/event-consumer.ts#lifecycle-receipts',
                 owner: name,
                 production: true,
                 residency: ['us-east-1'],
@@ -553,11 +556,11 @@ function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00
                 encryption: {
                     atRest: 'required',
                     inTransit: 'required',
-                    keyOwner: 'foundation-data',
+                    keyOwner: name,
                 },
                 id: 'test-record-database',
                 kind: 'database',
-                locationRef: 'database/schema.ts#records.test_expires_at',
+                locationRef: 'data/records.ts#testExpiresAt',
                 owner: name,
                 production: false,
                 residency: ['us-east-1'],
@@ -585,35 +588,35 @@ function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00
                 categoryId: 'product-record',
                 classification: 'confidential',
                 locationId: 'primary-database',
-                sourceRef: 'database/schema.ts#records',
+                sourceRef: 'data/records.ts#mutateRecord',
                 surface: 'store',
             },
             {
                 categoryId: 'product-record',
                 classification: 'confidential',
                 locationId: 'database-backup',
-                sourceRef: 'foundation/database-backup',
+                sourceRef: 'infra/key-value.ts#pointInTimeRecovery',
                 surface: 'store',
             },
             {
                 categoryId: 'product-record',
                 classification: 'confidential',
                 locationId: 'lifecycle-audit',
-                sourceRef: 'database/schema.ts#data_lifecycle_ledger',
+                sourceRef: 'data/key-value.ts#data-lifecycle-ledger',
                 surface: 'store',
             },
             {
                 categoryId: 'lifecycle-control-metadata',
                 classification: 'confidential',
                 locationId: 'lifecycle-control',
-                sourceRef: 'database/schema.ts#authorization-and-lifecycle-tables',
+                sourceRef: 'data/key-value.ts#authorization-and-lifecycle-collections',
                 surface: 'store',
             },
             {
                 categoryId: 'lifecycle-control-metadata',
                 classification: 'confidential',
                 locationId: 'downstream-copy-registry',
-                sourceRef: 'database/schema.ts#data_lifecycle_downstream_copies',
+                sourceRef: 'api/event-consumer.ts#lifecycle-receipts',
                 surface: 'store',
             },
             {
@@ -662,7 +665,7 @@ function renderProductDataLifecycleFiles(name, reviewedAt = '2026-07-27T00:00:00
                 categoryId: 'synthetic-test-data',
                 classification: 'internal',
                 locationId: 'test-record-database',
-                sourceRef: 'database/schema.ts#records.test_expires_at',
+                sourceRef: 'data/records.ts#testExpiresAt',
                 surface: 'store',
             },
             ...[
@@ -698,7 +701,7 @@ not weaken or overwrite it.
 
 Runtime retention, deletion, export, and restore import that same descriptor;
 policy version and retention duration are not copied constants. Checked-in
-holds and online \`data_lifecycle_holds\` rows are evaluated together, so either
+holds and online ${'`data-lifecycle-holds` items'} are evaluated together, so either
 source blocks its declared operation. The generated v1 administration API
 creates exact-record holds only. Category-, subject-, and future-record holds
 require a separately reviewed extension rather than an inferred wildcard.
@@ -715,22 +718,44 @@ event, store, or log projection. Run
 retention plan requires an approved request digest and writes content-free
 checkpoint and audit evidence.
 
-Product workloads may append and query audit rows but cannot update, truncate,
-or delete them directly. Bounded expiry runs only through the generated
-security-definer prune functions, whose execute privilege is granted during
-database migration.
+${`Generated application operations append audit items with conditional writes;
+the DynamoDB table is not an immutable audit vault. Runtime table permissions
+do not provide per-collection append-only IAM enforcement. Independent bounded
+control maintenance checks its workload identity, active holds, record versions
+and retention before deleting expired metadata. TTL is not an authorization or
+exact-deadline mechanism; application logic enforces expiry and replay rules.
+The registered maintenance Lambda resumes incomplete work from its checkpoint.
+No SQL migration or security-definer function participates in this path.`}
+
+A committed record deletion can return \`deliveryPending: true\` while another
+worker owns its event lease. The existing outbox reconciliation job finalizes
+that exact approval and its audit after acknowledged delivery, including recovery
+from interruption after publication. It cannot approve or start a deletion.
+Pausing outbox processing also delays this completion; resume it deliberately.
+The workflow's published intent has no TTL until completion and audit commit
+atomically with its acknowledgement release. Only then does the ordinary
+seven-day delivered-intent TTL start. A primary-deletion ledger is never a
+substitute for acknowledged event delivery.
 
 Production values, tokens, cookies, request bodies, and database rows are
 prohibited from source, test fixtures, prompts, logs, and evidence. Tests use
 deterministic synthetic references only. A deployed record may carry
 \`testExpiresAt\` only when the authenticated principal belongs to the generated
-\`${name}-test-writer\` group; ordinary product writes leave that column null.
+\`${name}-test-writer\` group; ordinary product writes leave that ${'field'} null.
+
+${`Confidential export execution persists its upload-relative cleanup deadline
+before any object write. Conditional record/workflow versions guard publication;
+the object write and DynamoDB transaction are not one atomic transaction.
+Bounded cleanup inventories exact object versions and delete markers before
+deleting them, then confirms absence before artifact-free completion. Failed or
+ambiguous external writes retain recovery state instead of accepting success.
 
-Confidential export execution persists its cleanup deadline before any object
-write and holds the workflow plus record locks through the versioned write and
-publication commit. The hourly cleanup also claims expired \`gathering\`
-workflows, discovers every exact object version and delete marker, and records
-artifact-free completion after recovering a post-write database failure.
+The default records, authorization, outbox/inbox and lifecycle collections remain
+DynamoDB-backed when optional SQL is declared. The logical IDs such as
+\`primary-database\` remain stable; physical references identify the Slice table,
+not a Foundation Aurora database. Its configured PITR window is 35 days.
+Relational feature migrations and their transaction-local event intents are
+separate; no transaction spanning SQL and DynamoDB is promised.`}
 `,
         'docs/runbooks/data-restore-reconciliation.md': `# Data restore reconciliation
 

package/src/generators/slice/built-in-plan-data-lifecycle-runtime-files.js

@@ -23,6 +23,13 @@ export const ${pascalName}DataLifecycleRuntimePolicy =
     categoryId: 'product-record',
     locationId: 'primary-database',
   });
+
+/** Control maintenance must not reuse the product-record-filtered hold set. */
+export const ${pascalName}ControlMetadataRuntimePolicy =
+  resolveDataLifecycleRuntimePolicy(policy, {
+    categoryId: 'lifecycle-control-metadata',
+    locationId: 'lifecycle-control',
+  });
 `,
         'data/lifecycle-event.ts': `import {
   createDataLifecycleChangeEvent,
@@ -390,8 +397,17 @@ process.stdout.write(
   DataLifecycleRestoreControlsV1,
 } from '@empire-builder-kit/runtime/data-lifecycle';
 import {
-  ${pascalName}DataLifecycleRuntimePolicy,
-} from './runtime-policy.cjs';
+  resolveDataLifecycleRuntimePolicy,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import policy from './policy.json' with { type: 'json' };
+
+// The restore command uses native Node TypeScript stripping, not a bundler.
+// Derive the same checked-in policy without requiring emitted .cjs siblings.
+const ${pascalName}DataLifecycleRuntimePolicy =
+  resolveDataLifecycleRuntimePolicy(policy, {
+    categoryId: 'product-record',
+    locationId: 'primary-database',
+  });
 
 export interface ${name
             .split('-')
@@ -463,6 +479,7 @@ import {
   requireDataLifecycleRestoreCutover,
   runDataLifecycleRestoreReconciliation,
 } from '@empire-builder-kit/runtime/data-lifecycle';
+import { assertWorkspaceStageOwnershipForWorkspace } from '@empire-builder-kit/nx/workspace-deployment';
 import {
   createConfigured${name
             .split('-')
@@ -511,6 +528,24 @@ const escaped = relative(process.cwd(), resolvedModule);
 if (escaped.startsWith('..') || isAbsolute(escaped)) {
   throw new Error('Restore adapter module must remain inside the Slice.');
 }
+const stage = process.env.EBK_STAGE;
+if (!['development', 'staging', 'production'].includes(stage)) {
+  throw new Error('Restore reconciliation requires one canonical EBK_STAGE.');
+}
+const ownership = await assertWorkspaceStageOwnershipForWorkspace(
+  resolve(import.meta.dirname, '../../..'),
+  stage,
+  {
+    ...(process.env.AWS_PROFILE ? { profile: process.env.AWS_PROFILE } : {}),
+    ...(process.env.AWS_CONFIG_FILE ? { configFilepath: process.env.AWS_CONFIG_FILE } : {}),
+    ...(process.env.AWS_SHARED_CREDENTIALS_FILE
+      ? { credentialsFilepath: process.env.AWS_SHARED_CREDENTIALS_FILE }
+      : {}),
+  },
+);
+if (process.env.AWS_REGION?.trim() !== ownership.region) {
+  throw new Error('Restore reconciliation Region differs from its exact workspace owner tuple.');
+}
 const configuredModule = await import(pathToFileURL(resolvedModule).href);
 if (typeof configuredModule.createDataRestoreAdapter !== 'function') {
   throw new Error(