@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-api-files.js

@@ -0,0 +1,1186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductApiFiles = renderProductApiFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+/** @internal */
+function renderProductApiFiles(name, pascalName, workspace) {
+    const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
+    return {
+        'api/health.ts': `import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import { ${identifierPrefix}Health } from './contracts/protected.js';
+
+export const handler = createContractHttpJsonHandler({
+  component: 'api-health',
+  operation: ${identifierPrefix}Health,
+  workspace: '${workspace}',
+  handle: () => ({
+    service: '${name}',
+    sourceCommit: process.env.EBK_SOURCE_COMMIT ?? 'unresolved',
+    stage: process.env.EBK_STAGE ?? 'development',
+    status: 'ok',
+  }),
+});
+`,
+        'web/src/app/api/health/route.ts': `import 'server-only';
+import { observeNextOperation } from '../../../lib/server-logging';
+
+export function GET(request: Request) {
+  return observeNextOperation({
+    feature: 'operations',
+    operation: 'health',
+    request,
+    handle: () => Response.json({
+      service: '${name}-web',
+      sourceCommit: process.env.EBK_SOURCE_COMMIT ?? 'unresolved',
+      stage: process.env.EBK_STAGE ?? 'development',
+      status: 'ok',
+    }),
+  });
+}
+`,
+        'api/protected.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import type { Principal } from '@empire-builder-kit/runtime/auth';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import { authorize${pascalName}Operation } from '../authorization/runtime.js';
+import { ${identifierPrefix}ProtectedExample } from './contracts/protected.js';
+
+export const handler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}ProtectedExample,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'api-protected',
+  operation: ${identifierPrefix}ProtectedExample,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  handle: () => ({ message: 'Authenticated request accepted.' }),
+});
+`,
+        'api/machine-authorization.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import type { Principal } from '@empire-builder-kit/runtime/auth';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import { authorize${pascalName}Operation } from '../authorization/runtime.js';
+import {
+  ${identifierPrefix}MachineAuthorizationProof,
+} from './contracts/protected.js';
+
+export const handler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}MachineAuthorizationProof,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'machine-authorization-proof-target',
+  operation: ${identifierPrefix}MachineAuthorizationProof,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  handle: () => ({ message: 'Machine authorization accepted.' }),
+});
+`,
+        'api/delegations.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import type { Principal } from '@empire-builder-kit/runtime/auth';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import {
+  issue${pascalName}RecordDelegation,
+  revoke${pascalName}RecordDelegation,
+  use${pascalName}RecordDelegation,
+} from '../authorization/workflows.js';
+import { authorize${pascalName}Operation } from '../authorization/runtime.js';
+import {
+  ${identifierPrefix}IssueRecordDelegation,
+  ${identifierPrefix}RevokeRecordDelegation,
+  ${identifierPrefix}UseRecordDelegation,
+} from './contracts/protected.js';
+
+export const issueHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}IssueRecordDelegation,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'authorization-delegations',
+  operation: ${identifierPrefix}IssueRecordDelegation,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  async handle({ context, principal, request }) {
+    const issued = await issue${pascalName}RecordDelegation({
+      correlationId: context.correlationId,
+      expiresAt: request.body.expiresAt,
+      principal,
+      purposeReference: request.body.purposeReference,
+      recordId: request.path.recordId,
+    });
+    return {
+      capability: issued.capability,
+      delegationId: issued.grant.id,
+      expiresAt: issued.grant.expiresAt,
+      status: 'active' as const,
+    };
+  },
+});
+
+export const useHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}UseRecordDelegation,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'authorization-delegations',
+  operation: ${identifierPrefix}UseRecordDelegation,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  handle: ({ context, principal, request }) =>
+    use${pascalName}RecordDelegation({
+      capability: request.body.capability,
+      correlationId: context.correlationId,
+      delegationId: request.path.delegationId,
+      principal,
+      recordId: request.path.recordId,
+    }),
+});
+
+export const revokeHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}RevokeRecordDelegation,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'authorization-delegations',
+  operation: ${identifierPrefix}RevokeRecordDelegation,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  async handle({ context, principal, request }) {
+    const grant = await revoke${pascalName}RecordDelegation({
+      correlationId: context.correlationId,
+      delegationId: request.path.delegationId,
+      principal,
+      recordId: request.path.recordId,
+    });
+    return { delegationId: grant.id, status: 'revoked' as const };
+  },
+});
+`,
+        'api/data-retention.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
+import { RuntimeError } from '@empire-builder-kit/runtime/response';
+import {
+  authorize${pascalName}DataRightsOperation,
+} from '../authorization/runtime.js';
+import { requireDirectAdmin } from '../data/data-rights-shared.js';
+import {
+  decide${pascalName}RetentionApproval,
+  request${pascalName}RetentionApproval,
+} from '../data/retention-control.js';
+import {
+  ${identifierPrefix}DecideRetentionApproval,
+  ${identifierPrefix}RequestRetentionApproval,
+} from './contracts/protected.js';
+
+function mappedError(
+  code: string,
+  message: string,
+  status: number,
+  retryable = false,
+): never {
+  throw new RuntimeError({ code, message, retryable, status });
+}
+
+function approvalOutcome(value: string): 'approved' | 'rejected' {
+  if (value === 'approved' || value === 'rejected') return value;
+  return mappedError(
+    'data_retention_input_invalid',
+    'The retention review request is invalid.',
+    400,
+  );
+}
+
+async function retentionReview<Result>(
+  operation: () => Promise<Result>,
+): Promise<Result> {
+  try {
+    return await operation();
+  } catch (error) {
+    if (error instanceof RuntimeError) throw error;
+    const detail = error instanceof Error ? error.message : '';
+    if (/not found/i.test(detail)) {
+      mappedError(
+        'data_retention_report_not_found',
+        'The retention report was not found.',
+        404,
+      );
+    }
+    if (/direct admin/i.test(detail)) {
+      mappedError(
+        'authorization_denied',
+        'Authorization was denied.',
+        403,
+      );
+    }
+    if (/no longer reviewable|already has an approval/i.test(detail)) {
+      mappedError(
+        'data_retention_not_reviewable',
+        'The retention report is no longer reviewable.',
+        409,
+      );
+    }
+    if (/approval|bound to the report|does not match/i.test(detail)) {
+      mappedError(
+        'data_retention_approval_invalid',
+        'The retention approval is invalid for this report.',
+        409,
+      );
+    }
+    if (/invalid|requires/i.test(detail)) {
+      mappedError(
+        'data_retention_input_invalid',
+        'The retention review request is invalid.',
+        400,
+      );
+    }
+    mappedError(
+      'data_retention_retry_required',
+      'Retention review persistence requires retry.',
+      503,
+      true,
+    );
+  }
+}
+
+export const requestRetentionApprovalHandler =
+  createContractHttpJsonHandler<
+    typeof ${identifierPrefix}RequestRetentionApproval,
+    RuntimeHttpEvent,
+    AuthorizationPrincipal
+  >({
+    component: 'data-retention-review',
+    operation: ${identifierPrefix}RequestRetentionApproval,
+    workspace: '${workspace}',
+    authorize: authorize${pascalName}DataRightsOperation,
+    handle: ({ context, principal, request }) =>
+      retentionReview(() =>
+        request${pascalName}RetentionApproval({
+          correlationId: context.correlationId,
+          now: new Date().toISOString(),
+          principal: requireDirectAdmin(principal),
+          runId: request.path.runId,
+        }),
+      ),
+  });
+
+export const decideRetentionApprovalHandler =
+  createContractHttpJsonHandler<
+    typeof ${identifierPrefix}DecideRetentionApproval,
+    RuntimeHttpEvent,
+    AuthorizationPrincipal
+  >({
+    component: 'data-retention-review',
+    operation: ${identifierPrefix}DecideRetentionApproval,
+    workspace: '${workspace}',
+    authorize: authorize${pascalName}DataRightsOperation,
+    handle: ({ context, principal, request }) =>
+      retentionReview(() =>
+        decide${pascalName}RetentionApproval({
+          approvalRequestId: request.path.approvalRequestId,
+          correlationId: context.correlationId,
+          expectedRequestDigest: request.body.expectedRequestDigest,
+          now: new Date().toISOString(),
+          outcome: approvalOutcome(request.body.outcome),
+          principal: requireDirectAdmin(principal),
+          reasonReference: request.body.reasonReference,
+          runId: request.path.runId,
+        }),
+      ),
+  });
+`,
+        'api/data-rights.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
+import { RuntimeError } from '@empire-builder-kit/runtime/response';
+import { authorize${pascalName}DataRightsOperation } from '../authorization/runtime.js';
+import {
+  cleanupExpiredRecordExport,
+  decideRecordExport,
+  deliverReadyRecordExport,
+  executeApprovedRecordExport,
+  requestAuthorizedRecordExport,
+} from '../data/record-export.js';
+import {
+  expireRecordHold,
+  issueRecordHold,
+  releaseRecordHold,
+  reviewRecordHold,
+} from '../data/record-holds.js';
+import {
+  ${identifierPrefix}CleanupRecordExport,
+  ${identifierPrefix}DecideRecordExport,
+  ${identifierPrefix}DeliverRecordExport,
+  ${identifierPrefix}ExecuteRecordExport,
+  ${identifierPrefix}ExpireRecordHold,
+  ${identifierPrefix}IssueRecordHold,
+  ${identifierPrefix}ReleaseRecordHold,
+  ${identifierPrefix}RequestRecordExport,
+  ${identifierPrefix}ReviewRecordHold,
+} from './contracts/protected.js';
+
+function mappedError(
+  code: string,
+  message: string,
+  status: number,
+  retryable = false,
+): never {
+  throw new RuntimeError({ code, message, retryable, status });
+}
+
+function approvalOutcome(value: string): 'approved' | 'rejected' {
+  if (value === 'approved' || value === 'rejected') return value;
+  return mappedError(
+    'data_rights_input_invalid',
+    'The data-rights request is invalid.',
+    400,
+  );
+}
+
+function holdEffect(
+  value: string,
+): 'block-deletion' | 'block-export' {
+  if (value === 'block-deletion' || value === 'block-export') return value;
+  return mappedError(
+    'data_rights_input_invalid',
+    'The data-rights request is invalid.',
+    400,
+  );
+}
+
+function holdPurpose(
+  value: string,
+): 'fraud' | 'incident' | 'legal' | 'security' | 'support' {
+  if (
+    value === 'fraud' ||
+    value === 'incident' ||
+    value === 'legal' ||
+    value === 'security' ||
+    value === 'support'
+  ) {
+    return value;
+  }
+  return mappedError(
+    'data_rights_input_invalid',
+    'The data-rights request is invalid.',
+    400,
+  );
+}
+
+async function dataRights<Result>(
+  kind: 'export' | 'hold',
+  operation: () => Promise<Result>,
+): Promise<Result> {
+  try {
+    return await operation();
+  } catch (error) {
+    if (error instanceof RuntimeError) throw error;
+    const detail = error instanceof Error ? error.message : '';
+    if (/not found/i.test(detail)) {
+      mappedError('record_not_found', 'The record was not found.', 404);
+    }
+    if (/rate/i.test(detail)) {
+      mappedError(
+        'data_export_rate_limited',
+        'The bounded confidential export rate was exceeded.',
+        429,
+      );
+    }
+    if (/hold.*block|blocked.*hold/i.test(detail)) {
+      mappedError(
+        'data_export_held',
+        'An active hold blocks the confidential export.',
+        409,
+      );
+    }
+    if (kind === 'export' && /expired/i.test(detail)) {
+      mappedError(
+        'data_export_expired',
+        'The confidential export has expired.',
+        410,
+      );
+    }
+    if (
+      kind === 'export' &&
+      /not ready|not executable|approval|executing export/i.test(detail)
+    ) {
+      mappedError(
+        'data_export_not_ready',
+        'The confidential export is not ready.',
+        409,
+      );
+    }
+    if (kind === 'hold') {
+      mappedError(
+        'record_hold_invalid',
+        'The record hold cannot make the requested transition.',
+        409,
+      );
+    }
+    if (/invalid|requires|bounded|future/i.test(detail)) {
+      mappedError(
+        'data_rights_input_invalid',
+        'The data-rights request is invalid.',
+        400,
+      );
+    }
+    mappedError(
+      'data_export_retry_required',
+      'Confidential export processing requires retry.',
+      503,
+      true,
+    );
+  }
+}
+
+function holdResponse(hold: {
+  expiresAt: string;
+  holdId: string;
+  reviewAt: string;
+  status: 'active' | 'released';
+}) {
+  return {
+    expiresAt: hold.expiresAt,
+    holdId: hold.holdId,
+    reviewAt: hold.reviewAt,
+    status: hold.status,
+  };
+}
+
+export const requestExportHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}RequestRecordExport,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'data-rights',
+  operation: ${identifierPrefix}RequestRecordExport,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  handle: ({ context, principal, request }) =>
+    dataRights('export', () =>
+      requestAuthorizedRecordExport({
+        correlationId: context.correlationId,
+        principal,
+        recordId: request.path.recordId,
+      }),
+    ),
+});
+
+export const decideExportHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}DecideRecordExport,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'data-rights',
+  operation: ${identifierPrefix}DecideRecordExport,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  async handle({ context, principal, request }) {
+    const result = await dataRights('export', () =>
+      decideRecordExport({
+        approvalRequestId: request.path.approvalRequestId,
+        correlationId: context.correlationId,
+        expectedRequestDigest: request.body.expectedRequestDigest,
+        outcome: approvalOutcome(request.body.outcome),
+        principal,
+        reasonReference: request.body.reasonReference,
+        recordId: request.path.recordId,
+      }),
+    );
+    return {
+      approvalRequestId: request.path.approvalRequestId,
+      status: result.status,
+    };
+  },
+});
+
+export const executeExportHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}ExecuteRecordExport,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'data-rights',
+  operation: ${identifierPrefix}ExecuteRecordExport,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  handle: ({ context, principal, request }) =>
+    dataRights('export', () =>
+      executeApprovedRecordExport({
+        approvalRequestId: request.path.approvalRequestId,
+        correlationId: context.correlationId,
+        principal,
+        recordId: request.path.recordId,
+      }),
+    ),
+});
+
+export const deliverExportHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}DeliverRecordExport,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'data-rights',
+  operation: ${identifierPrefix}DeliverRecordExport,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  handle: ({ context, principal, request }) =>
+    dataRights('export', () =>
+      deliverReadyRecordExport({
+        approvalRequestId: request.path.approvalRequestId,
+        correlationId: context.correlationId,
+        principal,
+        recordId: request.path.recordId,
+      }),
+    ),
+});
+
+export const cleanupExportHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}CleanupRecordExport,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'data-rights',
+  operation: ${identifierPrefix}CleanupRecordExport,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  handle: ({ context, principal, request }) =>
+    dataRights('export', () =>
+      cleanupExpiredRecordExport({
+        approvalRequestId: request.path.approvalRequestId,
+        correlationId: context.correlationId,
+        principal,
+        recordId: request.path.recordId,
+      }),
+    ),
+});
+
+export const issueHoldHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}IssueRecordHold,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'data-rights',
+  operation: ${identifierPrefix}IssueRecordHold,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  async handle({ context, principal, request }) {
+    const hold = await dataRights('hold', () =>
+      issueRecordHold({
+        correlationId: context.correlationId,
+        effects: request.body.effects.map(holdEffect),
+        expiresAt: request.body.expiresAt,
+        principal,
+        purpose: holdPurpose(request.body.purpose),
+        recordId: request.path.recordId,
+        reviewAt: request.body.reviewAt,
+      }),
+    );
+    return holdResponse(hold);
+  },
+});
+
+export const reviewHoldHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}ReviewRecordHold,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'data-rights',
+  operation: ${identifierPrefix}ReviewRecordHold,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  async handle({ context, principal, request }) {
+    const hold = await dataRights('hold', () =>
+      reviewRecordHold({
+        correlationId: context.correlationId,
+        expiresAt: request.body.expiresAt,
+        holdId: request.path.holdId,
+        principal,
+        recordId: request.path.recordId,
+        reviewAt: request.body.reviewAt,
+      }),
+    );
+    return holdResponse(hold);
+  },
+});
+
+export const releaseHoldHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}ReleaseRecordHold,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'data-rights',
+  operation: ${identifierPrefix}ReleaseRecordHold,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  async handle({ context, principal, request }) {
+    const hold = await dataRights('hold', () =>
+      releaseRecordHold({
+        correlationId: context.correlationId,
+        holdId: request.path.holdId,
+        principal,
+        recordId: request.path.recordId,
+      }),
+    );
+    return holdResponse(hold);
+  },
+});
+
+export const expireHoldHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}ExpireRecordHold,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'data-rights',
+  operation: ${identifierPrefix}ExpireRecordHold,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  async handle({ context, principal, request }) {
+    const hold = await dataRights('hold', () =>
+      expireRecordHold({
+        correlationId: context.correlationId,
+        holdId: request.path.holdId,
+        principal,
+        recordId: request.path.recordId,
+      }),
+    );
+    return holdResponse(hold);
+  },
+});
+`,
+        'database/runtime-client.ts': `import {
+  databaseTlsOptions,
+  runWithDatabaseCredential,
+  type LinkedDatabaseResource,
+} from '@empire-builder-kit/runtime/database';
+import { createLogger } from '@empire-builder-kit/runtime/logging';
+import { createMetricEmitter } from '@empire-builder-kit/runtime/observability';
+import {
+  bindServerSecretRuntime,
+  createAwsSecretsManagerSource,
+  createSecretResolverObservability,
+  createServerSecretResolver,
+} from '@empire-builder-kit/runtime/secrets';
+import pg, { type Client as PgClient } from 'pg';
+import { Resource } from 'sst/resource';
+import { Secrets } from '../secrets/declarations';
+
+const { Client } = pg;
+const secretResolvers = new Map<
+  string,
+  ReturnType<typeof createServerSecretResolver>
+>();
+
+function getSecretResolver(workload: string) {
+  const existing = secretResolvers.get(workload);
+  if (existing) return existing;
+  const stage = process.env.EBK_STAGE ?? '';
+  const logger = createLogger({
+    component: workload,
+    feature: 'secret-management',
+    operation: 'secret.resolve',
+    slice: '${name}',
+    stage,
+    workspace: '${workspace}',
+  });
+  const resolver = createServerSecretResolver({
+    binding: bindServerSecretRuntime({
+      stage,
+      workload: '${name}.' + workload,
+    }),
+    hooks: createSecretResolverObservability({
+      logger,
+      metrics: createMetricEmitter(),
+      slice: '${name}',
+      stage,
+    }),
+    source: createAwsSecretsManagerSource(),
+  });
+  secretResolvers.set(workload, resolver);
+  return resolver;
+}
+
+function linkedDatabase(): LinkedDatabaseResource {
+  const resource = (Resource as unknown as Record<string, unknown>)
+    .${pascalName}PrimaryDatabase;
+  if (!resource || typeof resource !== 'object') {
+    throw new Error('Primary database resource is not linked.');
+  }
+  return resource as LinkedDatabaseResource;
+}
+
+export async function withPrimaryDatabase<Result>(
+  context: { correlationId: string },
+  workload:
+    | 'api-database-health'
+    | 'api-database-records'
+    | 'async-inbox-cleanup'
+    | 'async-outbox-relay'
+    | 'async-provider-worker'
+    | 'data-export-cleanup'
+    | 'data-retention-job'
+    | 'event-consumer'
+    | 'web-server',
+  operation: (client: PgClient) => Promise<Result>,
+): Promise<Result> {
+  const resource = linkedDatabase();
+  return runWithDatabaseCredential(
+    resource,
+    resource.provider === 'aws-secrets-manager'
+      ? {
+          context,
+          declaration: Secrets.${pascalName}PrimaryDatabaseCredential,
+          resolver: getSecretResolver(workload),
+        }
+      : undefined,
+    async (credential) => {
+      const client = new Client({
+        ...credential,
+        connectionTimeoutMillis: 10_000,
+        ssl: databaseTlsOptions(resource),
+      });
+      try {
+        await client.connect();
+        return await operation(client);
+      } finally {
+        await client.end().catch(() => undefined);
+      }
+    },
+    (error) =>
+      error !== null &&
+      typeof error === 'object' &&
+      'code' in error &&
+      error.code === '28P01',
+  );
+}
+`,
+        'database/runtime-health.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import type { Principal } from '@empire-builder-kit/runtime/auth';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import { ${identifierPrefix}DatabaseHealth } from '../api/contracts/protected.js';
+import { authorize${pascalName}Operation } from '../authorization/runtime.js';
+import { withPrimaryDatabase } from './runtime-client.js';
+
+export const handler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}DatabaseHealth,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'database-health',
+  operation: ${identifierPrefix}DatabaseHealth,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  async handle({ context }) {
+    await withPrimaryDatabase(
+      context,
+      'api-database-health',
+      (client) => client.query('SELECT 1'),
+    );
+    return { service: '${name}', status: 'ok' };
+  },
+});
+`,
+        'database/records.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import type { Principal } from '@empire-builder-kit/runtime/auth';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
+import { RuntimeError } from '@empire-builder-kit/runtime/response';
+import {
+  ${identifierPrefix}GetRecord,
+  ${identifierPrefix}PutRecord,
+} from '../api/contracts/protected.js';
+import {
+  authorize${pascalName}DataRightsOperation,
+  authorize${pascalName}Operation,
+} from '../authorization/runtime.js';
+import {
+  correctRecordWithLifecycle,
+  publishRecordCorrection,
+} from '../data/record-correction.js';
+import { effectiveRecordOwner } from '../data/data-rights-shared.js';
+import { withPrimaryDatabase } from './runtime-client.js';
+
+function canonicalTestExpiresAt(value: string | undefined): string | undefined {
+  if (value === undefined) return undefined;
+  const expiresAt = Date.parse(value);
+  const now = Date.now();
+  if (
+    !Number.isFinite(expiresAt) ||
+    new Date(expiresAt).toISOString() !== value ||
+    expiresAt <= now ||
+    expiresAt - now > 48 * 60 * 60 * 1_000
+  ) {
+    throw new RuntimeError({
+      code: 'test_data_expiry_invalid',
+      message:
+        'Test data expiry must be a canonical future timestamp within 48 hours.',
+      retryable: false,
+      status: 400,
+    });
+  }
+  return value;
+}
+
+function notFound(): never {
+  throw new RuntimeError({
+    code: 'record_not_found',
+    message: 'The record was not found.',
+    retryable: false,
+    status: 404,
+  });
+}
+
+export const putHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}PutRecord,
+  RuntimeHttpEvent,
+  AuthorizationPrincipal
+>({
+  component: 'database-records',
+  operation: ${identifierPrefix}PutRecord,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}DataRightsOperation,
+  async handle({ context, principal, request }) {
+    const testExpiresAt = canonicalTestExpiresAt(request.body.testExpiresAt);
+    const ownerId = effectiveRecordOwner(principal);
+    const result = await withPrimaryDatabase(context, 'api-database-records', (client) =>
+      client.query<{
+        id: string;
+        name: string;
+        runScope: string;
+      }>(
+        \`INSERT INTO records
+           (id, name, owner_id, run_scope, test_expires_at)
+         VALUES ($1::uuid, $2, $3, $4, $5::timestamptz)
+         ON CONFLICT (id) DO NOTHING
+         RETURNING id::text, name, run_scope AS "runScope"\`,
+        [
+          request.path.recordId,
+          request.body.name,
+          ownerId,
+          request.body.runScope,
+          testExpiresAt ?? null,
+        ],
+      ),
+    );
+    const created = result.rows[0];
+    if (created) return created;
+    const ownership = await withPrimaryDatabase(
+      context,
+      'api-database-records',
+      (client) =>
+        client.query<{ ownerId: string }>(
+          \`SELECT owner_id AS "ownerId"
+           FROM records
+           WHERE id = $1::uuid\`,
+          [request.path.recordId],
+        ),
+    );
+    if (ownership.rows[0]?.ownerId !== ownerId) {
+      throw new RuntimeError({
+        code: 'record_conflict',
+        message: 'The record identifier is owned by another principal.',
+        retryable: false,
+        status: 409,
+      });
+    }
+    const corrected = await correctRecordWithLifecycle({
+      correlationId: context.correlationId,
+      name: request.body.name,
+      principal,
+      recordId: request.path.recordId,
+      runScope: request.body.runScope,
+      testExpiresAt,
+    });
+    const propagation = await publishRecordCorrection(
+      context.correlationId,
+      corrected.requestRef,
+    );
+    if (propagation === 'retry-required') {
+      throw new RuntimeError({
+        code: 'record_correction_retry_required',
+        message: 'Record correction propagation requires retry.',
+        retryable: true,
+        status: 503,
+      });
+    }
+    return {
+      id: corrected.id,
+      name: corrected.name,
+      runScope: corrected.runScope,
+    };
+  },
+});
+
+export const getHandler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}GetRecord,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'database-records',
+  operation: ${identifierPrefix}GetRecord,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  async handle({ context, principal, request }) {
+    const result = await withPrimaryDatabase(context, 'api-database-records', (client) =>
+      client.query<{ id: string; name: string; runScope: string }>(
+        \`SELECT id::text, name, run_scope AS "runScope"
+         FROM records
+         WHERE id = $1::uuid AND owner_id = $2\`,
+        [request.path.recordId, principal.id],
+      ),
+    );
+    return result.rows[0] ?? notFound();
+  },
+});
+
+`,
+        'api/event-consumer.ts': `import { parseDataLifecycleChangeEvent } from '@empire-builder-kit/runtime/data-lifecycle';
+import { parseSqsEventBridgeRecords, toEventLogContext } from '@empire-builder-kit/runtime/events';
+import { createLogger } from '@empire-builder-kit/runtime/logging';
+import type {
+  ${pascalName}CreatedData,
+  ${pascalName}DataLifecycleChangedData,
+} from '../contracts/events.js';
+import {
+  ${identifierPrefix}AuthorizationActions,
+} from '../authorization/policy.js';
+import {
+  authorize${pascalName}InternalOperation,
+} from '../authorization/runtime.js';
+import lifecycleConsumers from '../data/lifecycle-consumers.json';
+import { withPrimaryDatabase } from '../database/runtime-client.js';
+
+interface QueueRecord { body: string; messageId: string }
+interface QueueEvent { Records: QueueRecord[] }
+
+function acceptedLifecycleSources(): Set<string> {
+  const sources = lifecycleConsumers.acceptedSources;
+  if (
+    lifecycleConsumers.schemaVersion !== 1 ||
+    !Array.isArray(sources) ||
+    sources.length === 0 ||
+    sources.length > 32 ||
+    new Set(sources).size !== sources.length ||
+    sources.some((source) => !/^[a-z][a-z0-9-]{0,62}$/.test(source))
+  ) {
+    throw new Error(
+      'Lifecycle consumer configuration must contain unique bounded Slice sources.',
+    );
+  }
+  return new Set(sources);
+}
+
+const lifecycleSources = acceptedLifecycleSources();
+
+function requiredEventConsumerWorkloadIdentity(): string {
+  const configured = process.env.EBK_WORKLOAD_IDENTITY?.trim();
+  if (configured !== '${name}:event-consumer') {
+    throw new Error('Event consumer workload identity is invalid.');
+  }
+  return configured;
+}
+
+function lifecycleReconciliationExpiresAt(occurredAt: string): string {
+  const expiresAt = new Date(occurredAt);
+  expiresAt.setUTCDate(expiresAt.getUTCDate() + 400);
+  return expiresAt.toISOString();
+}
+
+export async function handler(event: QueueEvent) {
+  const workloadIdentity = requiredEventConsumerWorkloadIdentity();
+  const logger = createLogger({
+    component: 'event-consumer',
+    feature: 'events',
+    operation: 'consume-created',
+    slice: '${name}',
+    stage: process.env.EBK_STAGE ?? '',
+    workspace: '${workspace}',
+  });
+  const batch = parseSqsEventBridgeRecords<
+    ${pascalName}CreatedData | ${pascalName}DataLifecycleChangedData
+  >(event.Records);
+  const failures = [...batch.failures];
+  for (const { detailType, envelope, messageId, source } of batch.events) {
+    if (messageId === undefined) {
+      failures.push({
+        error: 'Event processing failed without retaining payload data.',
+        messageId: 'missing-message-id',
+      });
+      continue;
+    }
+    try {
+      if (detailType === 'DataLifecycleChanged') {
+        const lifecycle = parseDataLifecycleChangeEvent(envelope.data);
+        if (
+          source === undefined ||
+          lifecycle.sourceSlice !== source ||
+          !lifecycleSources.has(source)
+        ) {
+          throw new Error(
+            'Lifecycle event source is not declared by this consumer.',
+          );
+        }
+        await authorize${pascalName}InternalOperation({
+          action: ${identifierPrefix}AuthorizationActions.lifecycleConsume,
+          correlationId: envelope.meta.correlationId,
+          operationId: messageId,
+          workloadIdentity,
+        });
+        await withPrimaryDatabase(
+          { correlationId: envelope.meta.correlationId },
+          'event-consumer',
+          async (client) => {
+            await client.query('BEGIN');
+            try {
+              await client.query(
+              \`INSERT INTO data_lifecycle_receipts
+                 (source_slice, pseudonymous_key, action, request_ref,
+                  policy_version, occurred_at)
+               VALUES ($1, $2, $3, $4, $5, $6)
+               ON CONFLICT
+                 (source_slice, pseudonymous_key, action, request_ref)
+               DO NOTHING\`,
+              [
+                lifecycle.sourceSlice,
+                lifecycle.pseudonymousKey,
+                lifecycle.action,
+                lifecycle.requestRef,
+                lifecycle.policyVersion,
+                lifecycle.occurredAt,
+              ],
+              );
+              await client.query(
+                \`INSERT INTO data_lifecycle_downstream_copies
+                   (source_slice, pseudonymous_key, copy_id, recipient,
+                    purpose, expires_at, action, hold_refs, status,
+                    updated_at)
+                 VALUES ($1, $2, $3, $4, 'lifecycle-reconciliation', $5,
+                         $6, '[]'::jsonb, $7, $8)
+                 ON CONFLICT (source_slice, pseudonymous_key, copy_id)
+                 DO UPDATE SET
+                   action = EXCLUDED.action,
+                   expires_at = EXCLUDED.expires_at,
+                   hold_refs = EXCLUDED.hold_refs,
+                   status = EXCLUDED.status,
+                   updated_at = EXCLUDED.updated_at
+                 WHERE data_lifecycle_downstream_copies.updated_at
+                       <= EXCLUDED.updated_at\`,
+                [
+                  lifecycle.sourceSlice,
+                  lifecycle.pseudonymousKey,
+                  '${name}-lifecycle-consumer',
+                  '${name}',
+                  lifecycleReconciliationExpiresAt(lifecycle.occurredAt),
+                  lifecycle.action,
+                  lifecycle.action === 'deletion'
+                    ? 'deleted'
+                    : 'reconciled',
+                  lifecycle.occurredAt,
+                ],
+              );
+              await client.query('COMMIT');
+            } catch (error) {
+              await client.query('ROLLBACK').catch(() => undefined);
+              throw error;
+            }
+          },
+        );
+      }
+      logger.info('${name} event consumed', {
+        context: toEventLogContext(envelope.meta, detailType),
+        outcome: 'success',
+      });
+    } catch {
+      failures.push({
+        error: 'Event processing failed without retaining payload data.',
+        messageId,
+      });
+    }
+  }
+  logger.info('${name} event batch completed', {
+    attributes: {
+      eventCount: batch.events.length,
+      failureCount: failures.length,
+    },
+    outcome: failures.length === 0 ? 'success' : 'failure',
+  });
+  return {
+    batchItemFailures: failures.map(({ messageId }) => ({
+      itemIdentifier: messageId ?? '',
+    })),
+  };
+}
+`,
+        'testing/event-consumer-identity.spec.ts': `import { afterEach, describe, expect, it } from 'vitest';
+import { handler } from '../api/event-consumer.js';
+
+afterEach(() => {
+  delete process.env.EBK_WORKLOAD_IDENTITY;
+});
+
+describe('${pascalName} event-consumer identity', () => {
+  it('fails closed when workload identity is missing', async () => {
+    await expect(handler({ Records: [] })).rejects.toThrow(
+      'Event consumer workload identity is invalid.',
+    );
+  });
+
+  it('fails closed when workload identity differs', async () => {
+    process.env.EBK_WORKLOAD_IDENTITY = '${name}:ordinary-machine-client';
+    await expect(handler({ Records: [] })).rejects.toThrow(
+      'Event consumer workload identity is invalid.',
+    );
+  });
+
+  it('accepts only the exact generated identity', async () => {
+    process.env.EBK_WORKLOAD_IDENTITY = '${name}:event-consumer';
+    await expect(handler({ Records: [] })).resolves.toEqual({
+      batchItemFailures: [],
+    });
+  });
+});
+`,
+        'api/publish-created.ts': `import { EventBridgeClient, PutEventsCommand } from '@aws-sdk/client-eventbridge';
+import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
+import type { Principal } from '@empire-builder-kit/runtime/auth';
+import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
+import { createEventPublisher } from '@empire-builder-kit/runtime/events';
+import { authorize${pascalName}Operation } from '../authorization/runtime.js';
+import { ${identifierPrefix}PublishCreated } from './contracts/protected.js';
+import { ${pascalName}Created } from '../contracts/events.js';
+
+const client = new EventBridgeClient({});
+let publish: ReturnType<typeof createEventPublisher> | undefined;
+function getPublisher() {
+  return publish ??= createEventPublisher({
+    busName: process.env.EVENT_BUS_NAME ?? '',
+    stage: process.env.EBK_STAGE ?? '',
+    send: (entry) => client.send(new PutEventsCommand({ Entries: [{
+      Detail: entry.detail,
+      DetailType: entry.detailType,
+      EventBusName: entry.eventBusName,
+      Source: entry.source,
+    }] })),
+  });
+}
+
+export const handler = createContractHttpJsonHandler<
+  typeof ${identifierPrefix}PublishCreated,
+  RuntimeHttpEvent,
+  Principal
+>({
+  component: 'event-publisher',
+  operation: ${identifierPrefix}PublishCreated,
+  workspace: '${workspace}',
+  authorize: authorize${pascalName}Operation,
+  async handle({ context, principal }) {
+    const publishedEvent = await getPublisher()(${pascalName}Created, {
+      id: crypto.randomUUID(),
+      occurredBy: principal.id,
+    }, { context });
+    return { eventId: publishedEvent.meta.eventId };
+  },
+});
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-api-files.js.map