ankka-console 0.15.0 → 0.16.0

package/dist/client/control-plane.d.ts

@@ -1,4 +1,4 @@
-import { type AuthDiscovery, type BrokerDeclarationRequest, type ByteRatesRequest, type CreateDeployToken, type CreateOrganization, type DeployTokenCreated, type DeployTokenSummary, type GrantDetail, type GrantRequest, type HistoryEntry, type LogsResponse, type MachineRegistered, type MachineSummary, type MembersResponse, type OrganizationSummary, type ProjectBroker, type ProjectStatus, type CredentialReissued, type DatabaseSetting, type InstallationStatus, type ProjectHistoryView, type RestoreHoldStatus, type RehearsalView, type RestoreView, type ProjectDetail, type ProjectSecretSummary, type ProjectSummary, type ProjectTopic, type Quota, type ReceivedGrantDetail, type Role, type RolledBack, type ServiceStatus, type ServiceTopology, type SetRegistry, type TopicDeclarationRequest, type Whoami, type Installation } from "./schemas.ts";
+import { type AuthDiscovery, type BrokerDeclarationRequest, type ByteRatesRequest, type CreateDeployToken, type CreateOrganization, type DeployTokenCreated, type DeployTokenSummary, type GrantDetail, type GrantRequest, type HistoryEntry, type LogsResponse, type MachineRegistered, type MachineSummary, type MembersResponse, type OrganizationSummary, type ProjectBroker, type ProjectStatus, type CredentialReissued, type DatabaseSetting, type InstallationStatus, type ProjectHistoryView, type RestoreHoldStatus, type RehearsalView, type RestoreView, type ProjectDetail, type ProjectSecretSummary, type ProjectSummary, type ProjectTopic, type Quota, type ReceivedGrantDetail, type Role, type RolledBack, type ServiceStatus, type ServiceTopology, type SetRegistry, type TopicDeclarationRequest, type Whoami, type Installation, type ErasureAsk, type ErasureCertificate, type ErasureReplace, type ErasureRequestSummary, type ErasureRequestView } from "./schemas.ts";
 /** `fetch`'s shape; the server supplies one that presents the console's certificate. */
 export type Transport = (url: string, init: RequestInit) => Promise<Response>;
 /**
@@ -127,6 +127,24 @@ export declare class ControlPlaneClient {
     receivedGrants(id: string): Promise<ReceivedGrantDetail[]>;
     /** Ends a grant from the grantor's side: a pending one is withdrawn, an accepted one revoked. */
     endGrant(id: string, grantId: string): Promise<void>;
+    /** Asks for the erasure of a data subject's personal data; an applied request for them already is answered as it is. */
+    askErasure(id: string, ask: ErasureAsk): Promise<ErasureRequestView>;
+    /** The project's erasure requests, newest first. */
+    listErasures(id: string, query?: {
+        subject?: string;
+        state?: string;
+        correlation?: string;
+    }): Promise<ErasureRequestSummary[]>;
+    /** One erasure request, with each service's completion and why the last attempt to apply it failed. */
+    getErasure(id: string, requestId: string): Promise<ErasureRequestView>;
+    /** Replaces a held request's not-before date and reason. */
+    replaceErasure(id: string, requestId: string, replace: ErasureReplace): Promise<ErasureRequestView>;
+    /** Withdraws a held request. */
+    withdrawErasure(id: string, requestId: string): Promise<ErasureRequestView>;
+    /** An owner's override of a hold, with a reason: the request is applied at once. */
+    overrideErasureHold(id: string, requestId: string, reason: string): Promise<ErasureRequestView>;
+    /** The erasure certificate of an applied request; refused (409) before it is applied. */
+    erasureCertificate(id: string, requestId: string): Promise<ErasureCertificate>;
     listServices(projectId: string): Promise<ServiceStatus[]>;
     getService(projectId: string, name: string): Promise<ServiceStatus>;
     /** The descriptor is sent as the text the person gave; the control plane is the one that validates it. */

package/dist/client/control-plane.js

@@ -1,5 +1,5 @@
 import { ControlPlaneError, ControlPlaneUnreachable, SignInRequired } from "./errors.js";
-import { authDiscoverySchema, deployTokenCreatedSchema, deployTokenSummarySchema, grantDetailSchema, historyEntrySchema, machineRegisteredSchema, machineSummarySchema, logsResponseSchema, membersResponseSchema, organizationSummarySchema, projectBrokerSchema, projectStatusSchema, credentialReissuedSchema, databaseSettingSchema, projectHistoryViewSchema, restoreHoldStatusSchema, rehearsalViewSchema, restoreViewSchema, projectDetailSchema, projectSecretSummarySchema, projectSummarySchema, projectTopicSchema, receivedGrantDetailSchema, rolledBackSchema, serviceStatusSchema, serviceTopologySchema, whoamiSchema, installationSchema, } from "./schemas.js";
+import { authDiscoverySchema, deployTokenCreatedSchema, deployTokenSummarySchema, grantDetailSchema, historyEntrySchema, machineRegisteredSchema, machineSummarySchema, logsResponseSchema, membersResponseSchema, organizationSummarySchema, projectBrokerSchema, projectStatusSchema, credentialReissuedSchema, databaseSettingSchema, projectHistoryViewSchema, restoreHoldStatusSchema, rehearsalViewSchema, restoreViewSchema, projectDetailSchema, projectSecretSummarySchema, projectSummarySchema, projectTopicSchema, receivedGrantDetailSchema, rolledBackSchema, serviceStatusSchema, serviceTopologySchema, whoamiSchema, installationSchema, erasureCertificateSchema, erasureRequestSummarySchema, erasureRequestViewSchema, } from "./schemas.js";
 /** A descriptor is passed through as the control plane wrote it, as `applyService` takes one. */
 const anyJson = { parse: (value) => value };
 const arrayOf = (schema) => ({
@@ -272,6 +272,43 @@ export class ControlPlaneClient {
     endGrant(id, grantId) {
         return this.#call("DELETE", `/projects/${segment(id)}/grants/${segment(grantId)}`);
     }
+    // ── Erasure requests (feature 042) ────────────────────────────────────────
+    /** Asks for the erasure of a data subject's personal data; an applied request for them already is answered as it is. */
+    askErasure(id, ask) {
+        return this.#call("POST", `/projects/${segment(id)}/erasures`, { body: ask, schema: erasureRequestViewSchema });
+    }
+    /** The project's erasure requests, newest first. */
+    listErasures(id, query = {}) {
+        const params = new URLSearchParams();
+        if (query.subject)
+            params.set("subject", query.subject);
+        if (query.state)
+            params.set("state", query.state);
+        if (query.correlation)
+            params.set("correlation", query.correlation);
+        const q = params.size > 0 ? `?${params}` : "";
+        return this.#call("GET", `/projects/${segment(id)}/erasures${q}`, { schema: arrayOf(erasureRequestSummarySchema) });
+    }
+    /** One erasure request, with each service's completion and why the last attempt to apply it failed. */
+    getErasure(id, requestId) {
+        return this.#call("GET", `/projects/${segment(id)}/erasures/${segment(requestId)}`, { schema: erasureRequestViewSchema });
+    }
+    /** Replaces a held request's not-before date and reason. */
+    replaceErasure(id, requestId, replace) {
+        return this.#call("PUT", `/projects/${segment(id)}/erasures/${segment(requestId)}`, { body: replace, schema: erasureRequestViewSchema });
+    }
+    /** Withdraws a held request. */
+    withdrawErasure(id, requestId) {
+        return this.#call("POST", `/projects/${segment(id)}/erasures/${segment(requestId)}/withdraw`, { schema: erasureRequestViewSchema });
+    }
+    /** An owner's override of a hold, with a reason: the request is applied at once. */
+    overrideErasureHold(id, requestId, reason) {
+        return this.#call("POST", `/projects/${segment(id)}/erasures/${segment(requestId)}/override`, { body: { reason }, schema: erasureRequestViewSchema });
+    }
+    /** The erasure certificate of an applied request; refused (409) before it is applied. */
+    erasureCertificate(id, requestId) {
+        return this.#call("GET", `/projects/${segment(id)}/erasures/${segment(requestId)}/certificate`, { schema: erasureCertificateSchema });
+    }
     // ── Services ──────────────────────────────────────────────────────────────
     listServices(projectId) {
         return this.#call("GET", `/services/${segment(projectId)}`, { schema: arrayOf(serviceStatusSchema) });

package/dist/client/schemas.d.ts

@@ -2196,6 +2196,222 @@ export declare const rehearsalRequestSchema: z.ZodObject<{
     line: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
 }, z.core.$strip>;
 export type RehearsalRequest = z.input<typeof rehearsalRequestSchema>;
+/** What a service's erasure handler reported for a run. */
+export declare const erasureHandlerViewSchema: z.ZodObject<{
+    objectsErased: z.ZodNumber;
+    finality: z.ZodString;
+    error: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+}, z.core.$strip>;
+export type ErasureHandlerView = z.infer<typeof erasureHandlerViewSchema>;
+/** One service's completion of an erasure. */
+export declare const erasureCompletionViewSchema: z.ZodObject<{
+    service: z.ZodString;
+    completedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    rowsRedacted: z.ZodDefault<z.ZodNumber>;
+    tokensDropped: z.ZodDefault<z.ZodNumber>;
+    sessionsEnded: z.ZodDefault<z.ZodNumber>;
+    handler: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        objectsErased: z.ZodNumber;
+        finality: z.ZodString;
+        error: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    }, z.core.$strip>>>, z.ZodTransform<{
+        objectsErased: number;
+        finality: string;
+        error: string | undefined;
+    } | undefined, {
+        objectsErased: number;
+        finality: string;
+        error: string | undefined;
+    } | null | undefined>>;
+}, z.core.$strip>;
+export type ErasureCompletionView = z.infer<typeof erasureCompletionViewSchema>;
+/** An owner's override of a hold. */
+export declare const erasureOverrideViewSchema: z.ZodObject<{
+    owner: z.ZodString;
+    reason: z.ZodString;
+    at: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+}, z.core.$strip>;
+export type ErasureOverrideView = z.infer<typeof erasureOverrideViewSchema>;
+/** Why the last attempt to apply an erasure request failed, and since when. */
+export declare const erasureFailureViewSchema: z.ZodObject<{
+    reason: z.ZodString;
+    at: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+}, z.core.$strip>;
+export type ErasureFailureView = z.infer<typeof erasureFailureViewSchema>;
+/** The words an erasure request's state is said in today; any other is shown as it is. */
+export declare const erasureStates: readonly ["held", "applying", "applied", "withdrawn"];
+/** An erasure request, as a member reads it: where it stands, its hold, and each service's completion. */
+export declare const erasureRequestViewSchema: z.ZodObject<{
+    id: z.ZodString;
+    project: z.ZodString;
+    subject: z.ZodString;
+    state: z.ZodString;
+    askedBy: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    askedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    notBefore: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    reason: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    correlation: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    lapsedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    holdOverride: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        owner: z.ZodString;
+        reason: z.ZodString;
+        at: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    }, z.core.$strip>>>, z.ZodTransform<{
+        owner: string;
+        reason: string;
+        at: string | undefined;
+    } | undefined, {
+        owner: string;
+        reason: string;
+        at: string | undefined;
+    } | null | undefined>>;
+    erasureSeq: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodNumber>>, z.ZodTransform<number | undefined, number | null | undefined>>;
+    destroyedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    completions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        service: z.ZodString;
+        completedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+        rowsRedacted: z.ZodDefault<z.ZodNumber>;
+        tokensDropped: z.ZodDefault<z.ZodNumber>;
+        sessionsEnded: z.ZodDefault<z.ZodNumber>;
+        handler: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            objectsErased: z.ZodNumber;
+            finality: z.ZodString;
+            error: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+        }, z.core.$strip>>>, z.ZodTransform<{
+            objectsErased: number;
+            finality: string;
+            error: string | undefined;
+        } | undefined, {
+            objectsErased: number;
+            finality: string;
+            error: string | undefined;
+        } | null | undefined>>;
+    }, z.core.$strip>>>;
+    objectsFinalAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    finalAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    lastFailure: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        reason: z.ZodString;
+        at: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    }, z.core.$strip>>>, z.ZodTransform<{
+        reason: string;
+        at: string | undefined;
+    } | undefined, {
+        reason: string;
+        at: string | undefined;
+    } | null | undefined>>;
+}, z.core.$strip>;
+export type ErasureRequestView = z.infer<typeof erasureRequestViewSchema>;
+/** One line of a project's erasure requests; `project` is set where a listing spans projects. */
+export declare const erasureRequestSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    subject: z.ZodString;
+    state: z.ZodString;
+    correlation: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    notBefore: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    askedBy: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    askedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    appliedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    finalAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    project: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+}, z.core.$strip>;
+export type ErasureRequestSummary = z.infer<typeof erasureRequestSummarySchema>;
+/** The hold an erasure waited under, and when it lapsed. */
+export declare const erasureHoldViewSchema: z.ZodObject<{
+    notBefore: z.ZodString;
+    reason: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    lapsedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+}, z.core.$strip>;
+/** A service's part of an erasure, as the certificate states it. */
+export declare const erasureCertificateServiceSchema: z.ZodObject<{
+    service: z.ZodString;
+    completedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    handler: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        objectsErased: z.ZodNumber;
+        finality: z.ZodString;
+        error: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    }, z.core.$strip>>>, z.ZodTransform<{
+        objectsErased: number;
+        finality: string;
+        error: string | undefined;
+    } | undefined, {
+        objectsErased: number;
+        finality: string;
+        error: string | undefined;
+    } | null | undefined>>;
+}, z.core.$strip>;
+/** The erasure certificate of an applied erasure request. It holds no personal field. */
+export declare const erasureCertificateSchema: z.ZodObject<{
+    request: z.ZodString;
+    project: z.ZodString;
+    subject: z.ZodString;
+    askedBy: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    askedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    hold: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        notBefore: z.ZodString;
+        reason: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+        lapsedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    }, z.core.$strip>>>, z.ZodTransform<{
+        notBefore: string;
+        reason: string | undefined;
+        lapsedAt: string | undefined;
+    } | undefined, {
+        notBefore: string;
+        reason: string | undefined;
+        lapsedAt: string | undefined;
+    } | null | undefined>>;
+    holdOverride: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        owner: z.ZodString;
+        reason: z.ZodString;
+        at: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    }, z.core.$strip>>>, z.ZodTransform<{
+        owner: string;
+        reason: string;
+        at: string | undefined;
+    } | undefined, {
+        owner: string;
+        reason: string;
+        at: string | undefined;
+    } | null | undefined>>;
+    keyDestroyedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    services: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        service: z.ZodString;
+        completedAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+        handler: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            objectsErased: z.ZodNumber;
+            finality: z.ZodString;
+            error: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+        }, z.core.$strip>>>, z.ZodTransform<{
+            objectsErased: number;
+            finality: string;
+            error: string | undefined;
+        } | undefined, {
+            objectsErased: number;
+            finality: string;
+            error: string | undefined;
+        } | null | undefined>>;
+    }, z.core.$strip>>>;
+    finalAt: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+}, z.core.$strip>;
+export type ErasureCertificate = z.infer<typeof erasureCertificateSchema>;
+/** `POST /projects/{id}/erasures`: the data subject, and an optional hold. */
+export declare const erasureAskSchema: z.ZodObject<{
+    subject: z.ZodString;
+    notBefore: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    reason: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    correlation: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+}, z.core.$strip>;
+export type ErasureAsk = z.input<typeof erasureAskSchema>;
+/** `PUT …/erasures/{rid}`: a held request's new not-before date and reason, in place of the old. */
+export declare const erasureReplaceSchema: z.ZodObject<{
+    notBefore: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+    reason: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | undefined, string | null | undefined>>;
+}, z.core.$strip>;
+export type ErasureReplace = z.input<typeof erasureReplaceSchema>;
+/** `POST …/erasures/{rid}/override`: an owner's reason for applying a held request now. */
+export declare const erasureOverrideSchema: z.ZodObject<{
+    reason: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type ErasureOverride = z.input<typeof erasureOverrideSchema>;
 export declare const credentialReissuedSchema: z.ZodObject<{
     project: z.ZodString;
     generation: z.ZodNumber;

package/dist/client/schemas.js

@@ -704,6 +704,93 @@ export const restoreRequestSchema = z.object({ moment: z.string(), line: optiona
 export const switchRequestSchema = z.object({ cluster: z.string() });
 /** `POST /projects/{id}/rehearsals`: both may be left out, for the latest restorable moment. */
 export const rehearsalRequestSchema = z.object({ moment: optional(z.string()), line: optional(z.string()) });
+// ── Erasure (feature 042), from `controlplane-api`'s `erasures.scala` ────────
+/** What a service's erasure handler reported for a run. */
+export const erasureHandlerViewSchema = z.object({
+    objectsErased: z.number().int(),
+    finality: z.string(),
+    error: optional(z.string()),
+});
+/** One service's completion of an erasure. */
+export const erasureCompletionViewSchema = z.object({
+    service: z.string(),
+    completedAt: optional(z.string()),
+    rowsRedacted: z.number().int().default(0),
+    tokensDropped: z.number().int().default(0),
+    sessionsEnded: z.number().int().default(0),
+    handler: optional(erasureHandlerViewSchema),
+});
+/** An owner's override of a hold. */
+export const erasureOverrideViewSchema = z.object({ owner: z.string(), reason: z.string(), at: optional(z.string()) });
+/** Why the last attempt to apply an erasure request failed, and since when. */
+export const erasureFailureViewSchema = z.object({ reason: z.string(), at: optional(z.string()) });
+/** The words an erasure request's state is said in today; any other is shown as it is. */
+export const erasureStates = ["held", "applying", "applied", "withdrawn"];
+/** An erasure request, as a member reads it: where it stands, its hold, and each service's completion. */
+export const erasureRequestViewSchema = z.object({
+    id: z.string(),
+    project: z.string(),
+    subject: z.string(),
+    state: z.string(),
+    askedBy: optional(z.string()),
+    askedAt: optional(z.string()),
+    notBefore: optional(z.string()),
+    reason: optional(z.string()),
+    correlation: optional(z.string()),
+    lapsedAt: optional(z.string()),
+    holdOverride: optional(erasureOverrideViewSchema),
+    erasureSeq: optional(z.number().int()),
+    destroyedAt: optional(z.string()),
+    completions: z.array(erasureCompletionViewSchema).default([]),
+    objectsFinalAt: optional(z.string()),
+    finalAt: optional(z.string()),
+    lastFailure: optional(erasureFailureViewSchema),
+});
+/** One line of a project's erasure requests; `project` is set where a listing spans projects. */
+export const erasureRequestSummarySchema = z.object({
+    id: z.string(),
+    subject: z.string(),
+    state: z.string(),
+    correlation: optional(z.string()),
+    notBefore: optional(z.string()),
+    askedBy: optional(z.string()),
+    askedAt: optional(z.string()),
+    appliedAt: optional(z.string()),
+    finalAt: optional(z.string()),
+    project: optional(z.string()),
+});
+/** The hold an erasure waited under, and when it lapsed. */
+export const erasureHoldViewSchema = z.object({ notBefore: z.string(), reason: optional(z.string()), lapsedAt: optional(z.string()) });
+/** A service's part of an erasure, as the certificate states it. */
+export const erasureCertificateServiceSchema = z.object({
+    service: z.string(),
+    completedAt: optional(z.string()),
+    handler: optional(erasureHandlerViewSchema),
+});
+/** The erasure certificate of an applied erasure request. It holds no personal field. */
+export const erasureCertificateSchema = z.object({
+    request: z.string(),
+    project: z.string(),
+    subject: z.string(),
+    askedBy: optional(z.string()),
+    askedAt: optional(z.string()),
+    hold: optional(erasureHoldViewSchema),
+    holdOverride: optional(erasureOverrideViewSchema),
+    keyDestroyedAt: optional(z.string()),
+    services: z.array(erasureCertificateServiceSchema).default([]),
+    finalAt: optional(z.string()),
+});
+/** `POST /projects/{id}/erasures`: the data subject, and an optional hold. */
+export const erasureAskSchema = z.object({
+    subject: z.string(),
+    notBefore: optional(z.string()),
+    reason: optional(z.string()),
+    correlation: optional(z.string()),
+});
+/** `PUT …/erasures/{rid}`: a held request's new not-before date and reason, in place of the old. */
+export const erasureReplaceSchema = z.object({ notBefore: optional(z.string()), reason: optional(z.string()) });
+/** `POST …/erasures/{rid}/override`: an owner's reason for applying a held request now. */
+export const erasureOverrideSchema = z.object({ reason: z.string().default("") });
 export const credentialReissuedSchema = z.object({ project: z.string(), generation: z.number().int() });
 /** What a project asks of its database, whole. */
 export const databaseSettingSchema = z.object({
@@ -875,4 +962,10 @@ export const schemasByType = {
     ByteRatesRequest: byteRatesRequestSchema,
     TokenResponse: tokenResponseSchema,
     JsonWebKeySet: jsonWebKeySetSchema,
+    ErasureAsk: erasureAskSchema,
+    ErasureReplace: erasureReplaceSchema,
+    ErasureOverride: erasureOverrideSchema,
+    ErasureRequestView: erasureRequestViewSchema,
+    ErasureRequestSummary: erasureRequestSummarySchema,
+    ErasureCertificate: erasureCertificateSchema,
 };

package/dist/extensions/types.d.ts

@@ -1,7 +1,7 @@
 import type { ComponentType } from "react";
 import type { OrganizationSummary, ProjectDetail, ServiceStatus } from "../client/schemas.ts";
 /** Every operation the console offers, by the name a host uses to add beside it or hide it. */
-export declare const operations: readonly ["organization.create", "organization.rename", "organization.delete", "organization.disable", "organization.enable", "organization.quota.set", "organization.quota.clear", "member.invite", "member.role", "member.remove", "invitation.withdraw", "member.repair", "token.create", "token.revoke", "machine.register", "machine.delete", "machine.byte-rates", "project.create", "project.rename", "project.delete", "registry.set", "registry.clear", "project-secret.set", "project-secret.unset", "project-topic.set", "project-topic.unset", "project-broker.set", "project-broker.unset", "project.restore", "project.rehearse", "project.database", "project.backup-credential", "installation.release", "service.switch", "grant.make", "grant.end", "grant.answer", "grant.relinquish", "service.apply", "service.pause", "service.resume", "service.restart", "service.rollback", "service.expose", "service.unexpose", "service-hostname.add", "service-hostname.remove", "service.delete", "service.logs", "service.storage-credential", "service.storage-move", "service.storage-settings", "project-location.set", "project-location.clear"];
+export declare const operations: readonly ["organization.create", "organization.rename", "organization.delete", "organization.disable", "organization.enable", "organization.quota.set", "organization.quota.clear", "member.invite", "member.role", "member.remove", "invitation.withdraw", "member.repair", "token.create", "token.revoke", "machine.register", "machine.delete", "machine.byte-rates", "project.create", "project.rename", "project.delete", "registry.set", "registry.clear", "project-secret.set", "project-secret.unset", "project-topic.set", "project-topic.unset", "project-broker.set", "project-broker.unset", "project.restore", "project.rehearse", "project.database", "project.backup-credential", "installation.release", "service.switch", "grant.make", "grant.end", "grant.answer", "grant.relinquish", "service.apply", "service.pause", "service.resume", "service.restart", "service.rollback", "service.expose", "service.unexpose", "service-hostname.add", "service-hostname.remove", "service.delete", "service.logs", "service.storage-credential", "service.storage-move", "service.storage-settings", "project-location.set", "project-location.clear", "erasure.ask", "erasure.replace", "erasure.withdraw", "erasure.override"];
 export type Operation = (typeof operations)[number];
 export interface PanelEntities {
     organization: OrganizationSummary;

package/dist/extensions/types.js

@@ -56,4 +56,9 @@ export const operations = [
     "service.storage-settings",
     "project-location.set",
     "project-location.clear",
+    // Feature 042: a project's erasure requests. An override is an owner's; the control plane refuses a member's.
+    "erasure.ask",
+    "erasure.replace",
+    "erasure.withdraw",
+    "erasure.override",
 ];

package/dist/routes/erasure.certificate.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `GET <mount>/projects/:projectId/erasures/:requestId/certificate`: an applied erasure request's
+ * erasure certificate, as a JSON file to keep. Read as the person; refused as the control plane
+ * refuses it (409 before the request is applied).
+ */
+import type { LoaderFunctionArgs } from "react-router";
+export declare function loader({ params, context }: LoaderFunctionArgs): Promise<Response>;

package/dist/routes/erasure.certificate.js

@@ -0,0 +1,12 @@
+import { guard, useConsoleContext } from "../context.js";
+export async function loader({ params, context }) {
+    const ctx = useConsoleContext(context);
+    const { projectId, requestId } = params;
+    return guard(ctx, async () => {
+        const certificate = await ctx.client.erasureCertificate(projectId, requestId);
+        const file = `erasure-certificate-${requestId.replace(/[^A-Za-z0-9_-]/g, "")}.json`;
+        return new Response(JSON.stringify(certificate, null, 2) + "\n", {
+            headers: { "content-type": "application/json; charset=utf-8", "content-disposition": `attachment; filename="${file}"`, "cache-control": "no-store" },
+        });
+    });
+}

package/dist/routes/erasure.d.ts

@@ -0,0 +1,53 @@
+/**
+ * An erasure request (feature 042): its data subject, where it stands, its hold and who changed it,
+ * why the last attempt to apply it failed, and each service's completion. A held request's not-before
+ * date can be changed, the request withdrawn, or its hold overridden by an owner with a reason; an
+ * applied one gives its erasure certificate to download. Reached by id from the project's page.
+ */
+import { type ActionFunctionArgs, type LoaderFunctionArgs, type MetaFunction } from "react-router";
+import { ConsoleErrorBoundary } from "../ui/errors.tsx";
+export declare const meta: MetaFunction<typeof loader>;
+export declare function loader({ params, context }: LoaderFunctionArgs): Promise<{
+    console: import("../context.ts").ConsolePageData;
+    projectId: string;
+    request: {
+        id: string;
+        project: string;
+        subject: string;
+        state: string;
+        askedBy: string | undefined;
+        askedAt: string | undefined;
+        notBefore: string | undefined;
+        reason: string | undefined;
+        correlation: string | undefined;
+        lapsedAt: string | undefined;
+        holdOverride: {
+            owner: string;
+            reason: string;
+            at: string | undefined;
+        } | undefined;
+        erasureSeq: number | undefined;
+        destroyedAt: string | undefined;
+        completions: {
+            service: string;
+            completedAt: string | undefined;
+            rowsRedacted: number;
+            tokensDropped: number;
+            sessionsEnded: number;
+            handler: {
+                objectsErased: number;
+                finality: string;
+                error: string | undefined;
+            } | undefined;
+        }[];
+        objectsFinalAt: string | undefined;
+        finalAt: string | undefined;
+        lastFailure: {
+            reason: string;
+            at: string | undefined;
+        } | undefined;
+    };
+}>;
+export declare function action({ request, params, context }: ActionFunctionArgs): Promise<import("react-router").UNSAFE_DataWithResponseInit<import("../context.ts").ActionRefusal> | Response>;
+export default function Erasure(): import("react").JSX.Element;
+export declare const ErrorBoundary: typeof ConsoleErrorBoundary;

package/dist/routes/erasure.js

@@ -0,0 +1,74 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * An erasure request (feature 042): its data subject, where it stands, its hold and who changed it,
+ * why the last attempt to apply it failed, and each service's completion. A held request's not-before
+ * date can be changed, the request withdrawn, or its hold overridden by an owner with a reason; an
+ * applied one gives its erasure certificate to download. Reached by id from the project's page.
+ */
+import { redirect, useLoaderData } from "react-router";
+import { act, guard, pageData, projectShell, text, useConsoleContext } from "../context.js";
+import { ConsoleErrorBoundary } from "../ui/errors.js";
+import { ConsoleForm, Field, Submit, useConsole, when } from "../ui/console.js";
+import { Page, SectionTitle } from "../ui/shell.js";
+import { Refused, useRefusal } from "../ui/refused.js";
+import { HostActions } from "../extensions/render.js";
+import { button } from "../ui/primitives/button.js";
+import { dateOf, notBeforeOf } from "../ui/erasures.js";
+export const meta = ({ loaderData }) => [{ title: `Erasure request for ${loaderData?.request.subject ?? "a data subject"} · ankka` }];
+export async function loader({ params, context }) {
+    const ctx = useConsoleContext(context);
+    const { projectId, requestId } = params;
+    return guard(ctx, async () => {
+        const [request, project, services, page] = await Promise.all([
+            ctx.client.getErasure(projectId, requestId),
+            ctx.client.getProject(projectId),
+            ctx.client.listServices(projectId),
+            pageData(ctx),
+        ]);
+        const organization = await ctx.client.getOrganization(project.organizationId);
+        return {
+            console: projectShell(page, organization, project, services, [{ label: "Erasure request" }]),
+            projectId,
+            request,
+        };
+    });
+}
+export async function action({ request, params, context }) {
+    const ctx = useConsoleContext(context);
+    const { projectId, requestId } = params;
+    const form = await request.formData();
+    const intent = text(form, "intent");
+    const self = ctx.href(`projects/${encodeURIComponent(projectId)}/erasures/${encodeURIComponent(requestId)}`);
+    return act(ctx, intent, form, async () => {
+        switch (intent) {
+            case "erasure-replace":
+                await ctx.client.replaceErasure(projectId, requestId, {
+                    notBefore: notBeforeOf(text(form, "erasureNotBefore")),
+                    reason: text(form, "erasureReason") || undefined,
+                });
+                return redirect(self);
+            case "erasure-withdraw":
+                await ctx.client.withdrawErasure(projectId, requestId);
+                return redirect(self);
+            case "erasure-override":
+                // The reason is sent as given; an empty one is the control plane's to refuse, in its words.
+                await ctx.client.overrideErasureHold(projectId, requestId, text(form, "overrideReason"));
+                return redirect(self);
+            default:
+                throw new Response(`unknown operation '${intent}'`, { status: 400 });
+        }
+    });
+}
+export default function Erasure() {
+    const { projectId, request: r } = useLoaderData();
+    const { shows, href } = useConsole();
+    const replaceRefusal = useRefusal("erasure-replace");
+    const overrideRefusal = useRefusal("erasure-override");
+    const held = r.state === "held";
+    const path = `projects/${encodeURIComponent(projectId)}/erasures/${encodeURIComponent(r.id)}`;
+    const inspector = held ? (_jsxs(_Fragment, { children: [shows("erasure.override") ? (_jsxs("section", { className: "ac-form", "aria-labelledby": "erasure-override-title", children: [_jsx(SectionTitle, { children: _jsx("span", { id: "erasure-override-title", children: "Override hold" }) }), _jsxs(ConsoleForm, { intent: "erasure-override", className: "ac-form", children: [_jsx(Field, { label: "Reason for the override", name: "overrideReason", required: true, autoComplete: "off", defaultValue: overrideRefusal?.values.overrideReason, hint: "Owners only. The request is applied at once, and the reason is on its erasure certificate." }), _jsx(Refused, { intent: "erasure-override" }), _jsx("div", { children: _jsx(Submit, { intent: "erasure-override", danger: true, children: "Override hold" }) })] }), _jsx("div", { className: "ac-ops", children: _jsx(HostActions, { operation: "erasure.override", entity: r }) })] })) : null, shows("erasure.replace") ? (_jsxs("details", { className: "ac-more", open: replaceRefusal !== undefined || undefined, children: [_jsx("summary", { children: "Change the hold" }), _jsxs(ConsoleForm, { intent: "erasure-replace", className: "ac-form", children: [_jsx(Field, { label: "Not-before date", name: "erasureNotBefore", type: "date", defaultValue: replaceRefusal?.values.erasureNotBefore ?? dateOf(r.notBefore), hint: "The start of that day, UTC. It replaces the date and the reason the request has." }), _jsx(Field, { label: "Reason", name: "erasureReason", autoComplete: "off", defaultValue: replaceRefusal?.values.erasureReason ?? r.reason }), _jsx(Refused, { intent: "erasure-replace" }), _jsx("div", { children: _jsx(Submit, { intent: "erasure-replace", children: "Change the hold" }) })] })] })) : null, shows("erasure.withdraw") ? (_jsxs(ConsoleForm, { intent: "erasure-withdraw", className: "ac-inline", children: [_jsx(Submit, { intent: "erasure-withdraw", children: "Withdraw" }), _jsx(Refused, { intent: "erasure-withdraw" })] })) : null] })) : undefined;
+    return (_jsxs(Page, { inspector: inspector, children: [_jsxs("h1", { children: ["Erasure request for ", _jsx("code", { children: r.subject })] }), _jsxs("dl", { className: "ac-card ac-facts", "data-erasure": r.id, "data-state": r.state, children: [_jsx("dt", { children: "Id" }), _jsx("dd", { children: _jsx("code", { children: r.id }) }), _jsx("dt", { children: "Data subject" }), _jsx("dd", { children: _jsx("code", { children: r.subject }) }), _jsx("dt", { children: "State" }), _jsx("dd", { "data-erasure-state": true, children: r.state }), _jsx("dt", { children: "Asked" }), _jsxs("dd", { "data-asked-by": r.askedBy, children: [r.askedAt ? when(r.askedAt) : "—", r.askedBy ? ` by ${r.askedBy}` : ""] }), _jsx("dt", { children: "Not-before date" }), _jsxs("dd", { "data-not-before": true, children: [r.notBefore ? when(r.notBefore) : "none: applied when asked", r.reason ? ` — ${r.reason}` : "", r.lapsedAt ? ` (the hold lapsed ${when(r.lapsedAt)})` : ""] }), r.holdOverride ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Hold overridden" }), _jsxs("dd", { "data-override": true, children: ["by ", r.holdOverride.owner, r.holdOverride.at ? `, ${when(r.holdOverride.at)}` : "", ": ", r.holdOverride.reason] })] })) : null, r.correlation ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Correlation" }), _jsx("dd", { children: _jsx("code", { children: r.correlation }) })] })) : null, r.destroyedAt ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Applied" }), _jsxs("dd", { children: [when(r.destroyedAt), ": the data subject's key is destroyed"] })] })) : null, r.lastFailure ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Not applied yet" }), _jsxs("dd", { "data-last-failure": true, role: "status", children: [r.lastFailure.reason, r.lastFailure.at ? `, since ${when(r.lastFailure.at)}` : "", ". The platform tries again."] })] })) : null, r.finalAt ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Final" }), _jsx("dd", { children: when(r.finalAt) })] })) : null] }), _jsxs("section", { className: "ac-card", "aria-labelledby": "completion", children: [_jsx("h2", { id: "completion", children: "Completion" }), r.completions.length === 0 ? (_jsx("p", { className: "ac-empty", children: r.state === "applied" ? "No service has reported its completion yet." : "Each service reports its completion once the request is applied." })) : (_jsx("div", { className: "ac-table-wrap", children: _jsxs("table", { className: "ac-table", "aria-describedby": "completion", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Service" }), _jsx("th", { scope: "col", children: "Completed" }), _jsx("th", { scope: "col", children: "Rows redacted" }), _jsx("th", { scope: "col", children: "Tokens dropped" }), _jsx("th", { scope: "col", children: "Sessions ended" }), _jsx("th", { scope: "col", children: "Erasure handler" })] }) }), _jsx("tbody", { children: r.completions.map((c) => (_jsxs("tr", { "data-completion": c.service, children: [_jsx("td", { children: c.service }), _jsx("td", { children: c.completedAt ? when(c.completedAt) : "not yet" }), _jsx("td", { children: c.rowsRedacted }), _jsx("td", { children: c.tokensDropped }), _jsx("td", { children: c.sessionsEnded }), _jsx("td", { children: c.handler
+                                                    ? `${c.handler.objectsErased} objects erased, ${c.handler.finality}${c.handler.error ? `; failed: ${c.handler.error}` : ""}`
+                                                    : "—" })] }, c.service))) })] }) })), r.state === "applied" ? (_jsx("p", { children: _jsx("a", { className: button(), href: href(`${path}/certificate`), download: `erasure-certificate-${r.id}.json`, children: "Download the erasure certificate" }) })) : null] })] }));
+}
+export const ErrorBoundary = ConsoleErrorBoundary;