@empire-builder-kit/runtime 1.0.0-beta.8 → 1.0.0-rc.1

package/src/data-lifecycle/holds.js

@@ -0,0 +1,124 @@
+import { compareLifecycleStrings, failDataLifecycleRuntime, requireCanonicalTimestamp, requireDataLifecycleCode, requireDataLifecycleId, requireSafeReference, } from './contract.js';
+export const DATA_LIFECYCLE_RUNTIME_HOLD_PURPOSES = [
+    'legal',
+    'security',
+    'fraud',
+    'support',
+    'incident',
+];
+export function normalizeDataLifecycleRuntimeHold(value, index) {
+    const pointer = `/holds/${index}`;
+    if (!value ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        (Object.getPrototypeOf(value) !== Object.prototype &&
+            Object.getPrototypeOf(value) !== null)) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', pointer, 'hold must be a plain object');
+    }
+    const allowedFields = new Set([
+        'categoryId',
+        'effects',
+        'expiresAt',
+        'holdId',
+        'issuerCode',
+        'purpose',
+        'releasedAt',
+        'reviewAt',
+        'scopeRef',
+        'startsAt',
+        'status',
+    ]);
+    const unknownFields = Reflect.ownKeys(value).filter((key) => typeof key !== 'string' || !allowedFields.has(key));
+    if (unknownFields.length > 0) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', pointer, 'hold contains undeclared fields');
+    }
+    const startsAt = requireCanonicalTimestamp(value.startsAt, `${pointer}/startsAt`);
+    const reviewAt = requireCanonicalTimestamp(value.reviewAt, `${pointer}/reviewAt`);
+    const expiresAt = requireCanonicalTimestamp(value.expiresAt, `${pointer}/expiresAt`);
+    if (Date.parse(startsAt) >= Date.parse(reviewAt) ||
+        Date.parse(reviewAt) > Date.parse(expiresAt)) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', pointer, 'hold start, review, and expiry must form a bounded interval');
+    }
+    if (value.status !== 'active' && value.status !== 'released') {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', `${pointer}/status`, 'hold status must be active or released');
+    }
+    if (!Array.isArray(value.effects) ||
+        value.effects.length === 0 ||
+        value.effects.some((effect) => effect !== 'block-deletion' && effect !== 'block-export') ||
+        new Set(value.effects).size !== value.effects.length) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', `${pointer}/effects`, 'hold effects must be unique deletion/export blocks');
+    }
+    if (!DATA_LIFECYCLE_RUNTIME_HOLD_PURPOSES.includes(value.purpose)) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', `${pointer}/purpose`, 'hold purpose is unsupported');
+    }
+    const hold = {
+        categoryId: requireDataLifecycleId(value.categoryId, `${pointer}/categoryId`),
+        effects: [...value.effects].sort(compareLifecycleStrings),
+        expiresAt,
+        holdId: requireDataLifecycleId(value.holdId, `${pointer}/holdId`),
+        issuerCode: requireDataLifecycleCode(value.issuerCode, `${pointer}/issuerCode`),
+        purpose: value.purpose,
+        reviewAt,
+        scopeRef: requireSafeReference(value.scopeRef, `${pointer}/scopeRef`),
+        startsAt,
+        status: value.status,
+    };
+    if (value.releasedAt !== undefined) {
+        hold.releasedAt = requireCanonicalTimestamp(value.releasedAt, `${pointer}/releasedAt`);
+    }
+    if (hold.status === 'released' && !hold.releasedAt) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', `${pointer}/releasedAt`, 'released hold must record its release timestamp');
+    }
+    if (hold.status === 'active' && hold.releasedAt) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', `${pointer}/releasedAt`, 'active hold cannot have a release timestamp');
+    }
+    if (hold.releasedAt &&
+        (Date.parse(hold.releasedAt) < Date.parse(startsAt) ||
+            Date.parse(hold.releasedAt) > Date.parse(expiresAt))) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', `${pointer}/releasedAt`, 'release must occur within the hold interval');
+    }
+    return hold;
+}
+export function evaluateDataLifecycleHolds(options) {
+    const categoryId = requireDataLifecycleId(options.categoryId, '/categoryId');
+    const scopeRef = requireSafeReference(options.scopeRef, '/scopeRef');
+    const now = requireCanonicalTimestamp(options.now, '/now');
+    if (options.operation !== 'deletion' && options.operation !== 'export') {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', '/operation', 'must be deletion or export');
+    }
+    if (!Array.isArray(options.holds)) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', '/holds', 'holds must be a bounded array');
+    }
+    const effect = options.operation === 'deletion' ? 'block-deletion' : 'block-export';
+    const blocked = [];
+    const ids = new Set();
+    options.holds.forEach((value, index) => {
+        const hold = normalizeDataLifecycleRuntimeHold(value, index);
+        if (ids.has(hold.holdId)) {
+            failDataLifecycleRuntime('data-lifecycle-input-invalid', `/holds/${index}/holdId`, 'hold identifier is duplicated');
+        }
+        ids.add(hold.holdId);
+        if (hold.status === 'released') {
+            if (!hold.releasedAt || Date.parse(hold.releasedAt) > Date.parse(now)) {
+                failDataLifecycleRuntime('data-lifecycle-input-invalid', `/holds/${index}/releasedAt`, 'hold cannot be treated as released before its release timestamp');
+            }
+            return;
+        }
+        if (Date.parse(hold.reviewAt) <= Date.parse(now) ||
+            Date.parse(hold.expiresAt) <= Date.parse(now)) {
+            failDataLifecycleRuntime('data-lifecycle-hold-expired', `/holds/${index}`, 'active hold review or expiry is due');
+        }
+        if (Date.parse(hold.startsAt) <= Date.parse(now) &&
+            hold.categoryId === categoryId &&
+            hold.scopeRef === scopeRef &&
+            hold.effects.includes(effect)) {
+            blocked.push(hold.holdId);
+        }
+    });
+    return {
+        blocked: blocked.length > 0,
+        holdIds: blocked.sort(compareLifecycleStrings),
+        operation: options.operation,
+    };
+}
+//# sourceMappingURL=holds.js.map

package/src/data-lifecycle/holds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holds.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/data-lifecycle/holds.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,OAAO;IACP,UAAU;IACV,OAAO;IACP,SAAS;IACT,UAAU;CACF,CAAC;AA0BX,MAAM,UAAU,iCAAiC,CAC/C,KAAiC,EACjC,KAAa;IAEb,MAAM,OAAO,GAAG,UAAU,KAAK,EAAE,CAAC;IAClC,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;YAChD,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EACxC,CAAC;QACD,wBAAwB,CACtB,8BAA8B,EAC9B,OAAO,EACP,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,WAAW;QACX,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,YAAY;QACZ,UAAU;QACV,UAAU;QACV,UAAU;QACV,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CACjD,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAC5D,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,wBAAwB,CACtB,8BAA8B,EAC9B,OAAO,EACP,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CACxC,KAAK,CAAC,QAAQ,EACd,GAAG,OAAO,WAAW,CACtB,CAAC;IACF,MAAM,QAAQ,GAAG,yBAAyB,CACxC,KAAK,CAAC,QAAQ,EACd,GAAG,OAAO,WAAW,CACtB,CAAC;IACF,MAAM,SAAS,GAAG,yBAAyB,CACzC,KAAK,CAAC,SAAS,EACf,GAAG,OAAO,YAAY,CACvB,CAAC;IACF,IACE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAC5C,CAAC;QACD,wBAAwB,CACtB,8BAA8B,EAC9B,OAAO,EACP,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC7D,wBAAwB,CACtB,8BAA8B,EAC9B,GAAG,OAAO,SAAS,EACnB,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC1B,KAAK,CAAC,OAAO,CAAC,IAAI,CAChB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,cAAc,CACrE;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EACpD,CAAC;QACD,wBAAwB,CACtB,8BAA8B,EAC9B,GAAG,OAAO,UAAU,EACpB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oCAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,wBAAwB,CACtB,8BAA8B,EAC9B,GAAG,OAAO,UAAU,EACpB,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAA+B;QACvC,UAAU,EAAE,sBAAsB,CAChC,KAAK,CAAC,UAAU,EAChB,GAAG,OAAO,aAAa,CACxB;QACD,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;QACzD,SAAS;QACT,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,OAAO,SAAS,CAAC;QACjE,UAAU,EAAE,wBAAwB,CAClC,KAAK,CAAC,UAAU,EAChB,GAAG,OAAO,aAAa,CACxB;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ;QACR,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,OAAO,WAAW,CAAC;QACrE,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,yBAAyB,CACzC,KAAK,CAAC,UAAU,EAChB,GAAG,OAAO,aAAa,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACnD,wBAAwB,CACtB,8BAA8B,EAC9B,GAAG,OAAO,aAAa,EACvB,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,wBAAwB,CACtB,8BAA8B,EAC9B,GAAG,OAAO,aAAa,EACvB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,UAAU;QACf,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACtD,CAAC;QACD,wBAAwB,CACtB,8BAA8B,EAC9B,GAAG,OAAO,aAAa,EACvB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAM1C;IACC,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACvE,wBAAwB,CACtB,8BAA8B,EAC9B,YAAY,EACZ,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,wBAAwB,CACtB,8BAA8B,EAC9B,QAAQ,EACR,+BAA+B,CAChC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,OAAO,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC;IACvE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,iCAAiC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,wBAAwB,CACtB,8BAA8B,EAC9B,UAAU,KAAK,SAAS,EACxB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtE,wBAAwB,CACtB,8BAA8B,EAC9B,UAAU,KAAK,aAAa,EAC5B,iEAAiE,CAClE,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IACE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAC7C,CAAC;YACD,wBAAwB,CACtB,6BAA6B,EAC7B,UAAU,KAAK,EAAE,EACjB,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,IACE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5C,IAAI,CAAC,UAAU,KAAK,UAAU;YAC9B,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAC1B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC7B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC;QAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC"}

package/src/data-lifecycle/index.d.ts

@@ -0,0 +1,8 @@
+export * from './contract.js';
+export * from './evidence.js';
+export * from './event.js';
+export * from './holds.js';
+export * from './policy.js';
+export * from './retention.js';
+export * from './restore.js';
+export * from './rights.js';

package/src/data-lifecycle/index.js

@@ -0,0 +1,9 @@
+export * from './contract.js';
+export * from './evidence.js';
+export * from './event.js';
+export * from './holds.js';
+export * from './policy.js';
+export * from './retention.js';
+export * from './restore.js';
+export * from './rights.js';
+//# sourceMappingURL=index.js.map

package/src/data-lifecycle/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/data-lifecycle/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/src/data-lifecycle/policy.d.ts

@@ -0,0 +1,16 @@
+import { type DataLifecycleRuntimeHoldV1 } from './holds.js';
+export interface DataLifecycleRuntimePolicyV1 {
+    declaredHolds: readonly DataLifecycleRuntimeHoldV1[];
+    policyVersion: string;
+    retentionDays: number;
+}
+/**
+ * Binds one generated runtime enforcement path directly to the adopter-owned
+ * descriptor shipped in the same Slice artifact. Policy drift therefore fails
+ * at process initialization instead of leaving deletion behavior on stale
+ * generated constants.
+ */
+export declare function resolveDataLifecycleRuntimePolicy(descriptorValue: unknown, selection: {
+    categoryId: string;
+    locationId: string;
+}): DataLifecycleRuntimePolicyV1;

package/src/data-lifecycle/policy.js

@@ -0,0 +1,79 @@
+import { failDataLifecycleRuntime, requireBoundedInteger, requireDataLifecycleCode, requireDataLifecycleId, requirePolicyVersion, requireSafeReference, } from './contract.js';
+import { normalizeDataLifecycleRuntimeHold, } from './holds.js';
+function record(value, pointer) {
+    if (!value ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        (Object.getPrototypeOf(value) !== Object.prototype &&
+            Object.getPrototypeOf(value) !== null)) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', pointer, 'must be a plain object');
+    }
+    return value;
+}
+function values(value, pointer) {
+    if (!Array.isArray(value) || value.length > 1000) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', pointer, 'must be a bounded array');
+    }
+    return value;
+}
+function holdEffects(value, pointer) {
+    const effects = values(value, pointer);
+    if (effects.some((effect) => effect !== 'block-deletion' && effect !== 'block-export')) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', pointer, 'contains an unsupported hold effect');
+    }
+    return effects;
+}
+function holdPurpose(value, pointer) {
+    if (value !== 'legal' &&
+        value !== 'security' &&
+        value !== 'fraud' &&
+        value !== 'support' &&
+        value !== 'incident') {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', pointer, 'contains an unsupported hold purpose');
+    }
+    return value;
+}
+/**
+ * Binds one generated runtime enforcement path directly to the adopter-owned
+ * descriptor shipped in the same Slice artifact. Policy drift therefore fails
+ * at process initialization instead of leaving deletion behavior on stale
+ * generated constants.
+ */
+export function resolveDataLifecycleRuntimePolicy(descriptorValue, selection) {
+    var _a, _b, _c;
+    const descriptor = record(descriptorValue, '/policy');
+    const categoryId = requireDataLifecycleId(selection.categoryId, '/selection/categoryId');
+    const locationId = requireDataLifecycleId(selection.locationId, '/selection/locationId');
+    const stores = values(descriptor['stores'], '/policy/stores');
+    const matchingStores = stores
+        .map((value, index) => ({
+        index,
+        value: record(value, `/policy/stores/${index}`),
+    }))
+        .filter(({ value }) => value['id'] === locationId);
+    if (matchingStores.length !== 1) {
+        failDataLifecycleRuntime('data-lifecycle-input-invalid', '/policy/stores', 'must contain the selected runtime location exactly once');
+    }
+    const retention = record((_a = matchingStores[0]) === null || _a === void 0 ? void 0 : _a.value['retention'], `/policy/stores/${(_b = matchingStores[0]) === null || _b === void 0 ? void 0 : _b.index}/retention`);
+    const holds = values(descriptor['holds'], '/policy/holds').flatMap((value, index) => {
+        var _a, _b, _c;
+        const source = record(value, `/policy/holds/${index}`);
+        const categoryIds = values(source['categoryIds'], `/policy/holds/${index}/categoryIds`);
+        if (!categoryIds.includes(categoryId))
+            return [];
+        const status = source['status'];
+        if (status !== 'active' && status !== 'released') {
+            failDataLifecycleRuntime('data-lifecycle-input-invalid', `/policy/holds/${index}/status`, 'must be active or released');
+        }
+        const runtimeHold = Object.assign({ categoryId, effects: holdEffects(source['effects'], `/policy/holds/${index}/effects`), expiresAt: String((_a = source['expiresAt']) !== null && _a !== void 0 ? _a : ''), holdId: requireDataLifecycleId(source['id'], `/policy/holds/${index}/id`), issuerCode: requireDataLifecycleCode(source['issuerRef'], `/policy/holds/${index}/issuerRef`), purpose: holdPurpose(source['purpose'], `/policy/holds/${index}/purpose`), reviewAt: String((_b = source['reviewAt']) !== null && _b !== void 0 ? _b : ''), scopeRef: requireSafeReference(source['scopeRef'], `/policy/holds/${index}/scopeRef`), startsAt: String((_c = source['startsAt']) !== null && _c !== void 0 ? _c : ''), status }, (source['releasedAt'] === undefined
+            ? {}
+            : { releasedAt: String(source['releasedAt']) }));
+        return [normalizeDataLifecycleRuntimeHold(runtimeHold, index)];
+    });
+    return Object.freeze({
+        declaredHolds: Object.freeze(holds),
+        policyVersion: requirePolicyVersion(descriptor['policyVersion'], '/policy/policyVersion'),
+        retentionDays: requireBoundedInteger(retention['durationDays'], `/policy/stores/${(_c = matchingStores[0]) === null || _c === void 0 ? void 0 : _c.index}/retention/durationDays`, 1, 36500),
+    });
+}
+//# sourceMappingURL=policy.js.map

package/src/data-lifecycle/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/data-lifecycle/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iCAAiC,GAIlC,MAAM,YAAY,CAAC;AAQpB,SAAS,MAAM,CAAC,KAAc,EAAE,OAAe;IAC7C,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;YAChD,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EACxC,CAAC;QACD,wBAAwB,CACtB,8BAA8B,EAC9B,OAAO,EACP,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,OAAe;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAK,EAAE,CAAC;QAClD,wBAAwB,CACtB,8BAA8B,EAC9B,OAAO,EACP,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,IACE,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,cAAc,CACrE,EACD,CAAC;QACD,wBAAwB,CACtB,8BAA8B,EAC9B,OAAO,EACP,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,OAAoD,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,OAAe;IAEf,IACE,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,UAAU;QACpB,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,UAAU,EACpB,CAAC;QACD,wBAAwB,CACtB,8BAA8B,EAC9B,OAAO,EACP,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,eAAwB,EACxB,SAGC;;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,sBAAsB,CACvC,SAAS,CAAC,UAAU,EACpB,uBAAuB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,sBAAsB,CACvC,SAAS,CAAC,UAAU,EACpB,uBAAuB,CACxB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM;SAC1B,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtB,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,KAAK,EAAE,CAAC;KAChD,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;IACrD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,wBAAwB,CACtB,8BAA8B,EAC9B,gBAAgB,EAChB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CACtB,MAAA,cAAc,CAAC,CAAC,CAAC,0CAAE,KAAK,CAAC,WAAW,CAAC,EACrC,kBAAkB,MAAA,cAAc,CAAC,CAAC,CAAC,0CAAE,KAAK,YAAY,CACvD,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC,OAAO,CAChE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;;QACf,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,iBAAiB,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CACxB,MAAM,CAAC,aAAa,CAAC,EACrB,iBAAiB,KAAK,cAAc,CACrC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YACjD,wBAAwB,CACtB,8BAA8B,EAC9B,iBAAiB,KAAK,SAAS,EAC/B,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,mBACf,UAAU,EACV,OAAO,EAAE,WAAW,CAClB,MAAM,CAAC,SAAS,CAAC,EACjB,iBAAiB,KAAK,UAAU,CACjC,EACD,SAAS,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAC,EAC5C,MAAM,EAAE,sBAAsB,CAC5B,MAAM,CAAC,IAAI,CAAC,EACZ,iBAAiB,KAAK,KAAK,CAC5B,EACD,UAAU,EAAE,wBAAwB,CAClC,MAAM,CAAC,WAAW,CAAC,EACnB,iBAAiB,KAAK,YAAY,CACnC,EACD,OAAO,EAAE,WAAW,CAClB,MAAM,CAAC,SAAS,CAAC,EACjB,iBAAiB,KAAK,UAAU,CACjC,EACD,QAAQ,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,UAAU,CAAC,mCAAI,EAAE,CAAC,EAC1C,QAAQ,EAAE,oBAAoB,CAC5B,MAAM,CAAC,UAAU,CAAC,EAClB,iBAAiB,KAAK,WAAW,CAClC,EACD,QAAQ,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,UAAU,CAAC,mCAAI,EAAE,CAAC,EAC1C,MAAM,IACH,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;QACF,OAAO,CAAC,iCAAiC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC,CACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACnC,aAAa,EAAE,oBAAoB,CACjC,UAAU,CAAC,eAAe,CAAC,EAC3B,uBAAuB,CACxB;QACD,aAAa,EAAE,qBAAqB,CAClC,SAAS,CAAC,cAAc,CAAC,EACzB,kBAAkB,MAAA,cAAc,CAAC,CAAC,CAAC,0CAAE,KAAK,yBAAyB,EACnE,CAAC,EACD,KAAM,CACP;KACF,CAAC,CAAC;AACL,CAAC"}

package/src/data-lifecycle/restore.d.ts

@@ -0,0 +1,90 @@
+export declare const DATA_LIFECYCLE_LEDGER_ENTRY_VERSION: 1;
+export declare const DATA_LIFECYCLE_RESTORE_CHECKPOINT_VERSION: 1;
+export declare const DATA_LIFECYCLE_RESTORE_MAX_ITEMS = 100;
+export type DataLifecycleLedgerAction = 'correction' | 'deletion';
+export interface DataLifecycleLedgerEntryV1 {
+    action: DataLifecycleLedgerAction;
+    categoryId: string;
+    effectiveAt: string;
+    entryId: string;
+    expiresAt: string;
+    policyVersion: string;
+    pseudonymousKey: string;
+    version: typeof DATA_LIFECYCLE_LEDGER_ENTRY_VERSION;
+}
+export interface DataLifecycleRestoreControlsV1 {
+    authorizationVerified: true;
+    integrityVerified: true;
+    isolatedTarget: true;
+    retentionJobsReady: true;
+    serviceTrafficBlocked: true;
+}
+export interface DataLifecycleRestoreCheckpointV1 {
+    complete: boolean;
+    cursor?: string;
+    policyVersion: string;
+    version: typeof DATA_LIFECYCLE_RESTORE_CHECKPOINT_VERSION;
+}
+export interface DataLifecycleLedgerPageV1 {
+    entries: readonly DataLifecycleLedgerEntryV1[];
+    nextCursor?: string;
+}
+export interface DataLifecycleRestoreAdapter {
+    applyPrimary(input: {
+        entry: DataLifecycleLedgerEntryV1;
+        idempotencyKey: string;
+        targetRef: string;
+    }): Promise<'applied' | 'already-applied' | 'not-present'>;
+    reconcileDownstream(input: {
+        entry: DataLifecycleLedgerEntryV1;
+        idempotencyKey: string;
+    }): Promise<'reconciled' | 'already-reconciled'>;
+    scanLedger(input: {
+        cursor?: string;
+        limit: number;
+        now: string;
+        policyVersion: string;
+    }): Promise<DataLifecycleLedgerPageV1>;
+}
+export interface DataLifecycleRestoreRunResultV1 {
+    alreadyApplied: number;
+    applied: number;
+    checkpoint: DataLifecycleRestoreCheckpointV1;
+    downstreamAlreadyReconciled: number;
+    downstreamReconciled: number;
+    errorCode?: 'ledger-scan-failed' | 'primary-reconciliation-failed' | 'downstream-reconciliation-failed' | 'invalid-adapter-outcome';
+    notPresent: number;
+    policyVersion: string;
+    processed: number;
+    readyForCutover: boolean;
+    status: 'complete' | 'more' | 'retry-required';
+    targetRef: string;
+}
+/**
+ * The ledger deliberately stores no source record, correction value, subject
+ * profile, or human identifier—only a pseudonymous lookup key and action.
+ */
+export declare function createDataLifecycleLedgerEntry(options: {
+    action: DataLifecycleLedgerAction;
+    categoryId: string;
+    effectiveAt: string;
+    expiresAt: string;
+    policyVersion: string;
+    pseudonymousKey: string;
+}): DataLifecycleLedgerEntryV1;
+export declare function createDataLifecycleRestoreCheckpoint(policyVersion: string): DataLifecycleRestoreCheckpointV1;
+/**
+ * Replays one bounded ledger page while traffic remains blocked. A failed
+ * primary/downstream page keeps its incoming checkpoint, so stable
+ * idempotency keys safely repeat all earlier actions on retry.
+ */
+export declare function runDataLifecycleRestoreReconciliation(options: {
+    adapter: DataLifecycleRestoreAdapter;
+    checkpoint?: DataLifecycleRestoreCheckpointV1;
+    controls: DataLifecycleRestoreControlsV1;
+    limit: number;
+    now: string;
+    policyVersion: string;
+    targetRef: string;
+}): Promise<DataLifecycleRestoreRunResultV1>;
+export declare function requireDataLifecycleRestoreCutover(result: DataLifecycleRestoreRunResultV1): DataLifecycleRestoreRunResultV1;