@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/generators/slice/built-in-plan-api-contract-files.js

@@ -4,6 +4,38 @@ exports.renderProductApiContractFiles = renderProductApiContractFiles;
 const api_contract_1 = require("@empire-builder-kit/runtime/api-contract");
 const index_js_1 = require("../../api-contract/index.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const local_source_identity_js_1 = require("./local-source-identity.js");
+// Shared by the machine-readable contract and the generated operation source.
+const KEY_VALUE_RECORD_PROBLEMS = [
+    {
+        code: 'record_input_invalid',
+        message: 'Record input is invalid.',
+        retryable: false,
+        status: 400,
+        type: 'https://empirebuilderkit.dev/problems/records/input-invalid',
+    },
+    {
+        code: 'record_idempotency_conflict',
+        message: 'The mutation receipt does not match this exact request.',
+        retryable: false,
+        status: 409,
+        type: 'https://empirebuilderkit.dev/problems/records/idempotency-conflict',
+    },
+    {
+        code: 'record_write_conflict',
+        message: 'The record changed concurrently; retry the request.',
+        retryable: true,
+        status: 409,
+        type: 'https://empirebuilderkit.dev/problems/records/write-conflict',
+    },
+    {
+        code: 'record_not_found',
+        message: 'The record was not found.',
+        retryable: false,
+        status: 404,
+        type: 'https://empirebuilderkit.dev/problems/records/not-found',
+    },
+];
 function createStandardApiContract(name, pascalName) {
     const authenticationProblems = [
         {
@@ -68,6 +100,7 @@ function createStandardApiContract(name, pascalName) {
     ];
     const recordConflictProblems = [
         ...authorizationProblems,
+        ...KEY_VALUE_RECORD_PROBLEMS,
         {
             code: 'record_conflict',
             message: 'The record identifier is owned by another principal.',
@@ -232,6 +265,7 @@ function createStandardApiContract(name, pascalName) {
         },
     ];
     const retentionProblems = [
+        ...authorizationProblems,
         {
             code: 'data_retention_approval_invalid',
             message: 'The retention approval is invalid for this report.',
@@ -782,6 +816,7 @@ function createStandardApiContract(name, pascalName) {
             body: (0, api_contract_1.apiObject)({
                 deleted: (0, api_contract_1.apiBoolean)(),
                 id: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                deliveryPending: (0, api_contract_1.apiOptional)((0, api_contract_1.apiBoolean)()),
             }),
             status: 200,
         },
@@ -995,6 +1030,7 @@ const authorizationProblems = [
 
 const recordConflictProblems = [
   ...authorizationProblems,
+  ...${JSON.stringify(KEY_VALUE_RECORD_PROBLEMS, null, 2)},
   {
     code: 'record_conflict',
     message: 'The record identifier is owned by another principal.',
@@ -1166,6 +1202,7 @@ const dataRightsProblems = [
 ] as const;
 
 const retentionProblems = [
+  ...authorizationProblems,
   {
     code: 'data_retention_approval_invalid',
     message: 'The retention approval is invalid for this report.',
@@ -1766,6 +1803,7 @@ export const ${identifierPrefix}DeleteRecord = defineApiOperation({
     body: apiObject({
       deleted: apiBoolean(),
       id: apiString({ format: 'uuid' }),
+      deliveryPending: apiOptional(apiBoolean()),
     }),
     status: 200,
   },
@@ -2349,7 +2387,7 @@ if (action === 'check') {
 }
 `,
         'scripts/api-contract.mjs': `import { createHash } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
 import {
   mkdirSync,
   readFileSync,
@@ -2395,13 +2433,10 @@ const action = process.argv[2] ?? 'check';
 const digest = (contents) =>
   'sha256:' + createHash('sha256').update(contents).digest('hex');
 
+${local_source_identity_js_1.localSourceCommitFunction}
+
 function sourceIdentity() {
-  const commit =
-    process.env.EBK_SOURCE_COMMIT ??
-    execFileSync('git', ['rev-parse', 'HEAD'], {
-      cwd: workspaceRoot,
-      encoding: 'utf8',
-    }).trim();
+  const commit = localSourceCommit();
   const frameworkCandidate =
     workspacePackage.dependencies?.['@empire-builder-kit/runtime'];
   if (typeof frameworkCandidate !== 'string' || !frameworkCandidate) {

package/src/generators/slice/built-in-plan-api-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderProductApiFiles(name: string, pascalName: string, workspace: string): Readonly<Record<string, string>>;
+export declare function renderProductApiFiles(name: string, pascalName: string, workspace: string, sql?: boolean): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-api-files.js

@@ -2,10 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductApiFiles = renderProductApiFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const built_in_plan_key_value_records_js_1 = require("./built-in-plan-key-value-records.js");
+const built_in_plan_key_value_consumer_js_1 = require("./built-in-plan-key-value-consumer.js");
 /** @internal */
-function renderProductApiFiles(name, pascalName, workspace) {
+function renderProductApiFiles(name, pascalName, workspace, sql = false) {
     const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
-    return {
+    const files = {
         'api/health.ts': `import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
 import { ${identifierPrefix}Health } from './contracts/protected.js';
 
@@ -206,7 +208,7 @@ async function retentionReview<Result>(
         404,
       );
     }
-    if (/direct admin/i.test(detail)) {
+    if (/^Data-rights (?:request requires a direct human principal|administration requires a direct admin)[.]$/.test(detail)) {
       mappedError(
         'authorization_denied',
         'Authorization was denied.',
@@ -367,6 +369,18 @@ function holdPurpose(
   );
 }
 
+function holdEffects(values: readonly string[]) {
+  if (values.length === 0 || new Set(values).size !== values.length)
+    return mappedError('data_rights_input_invalid', 'Hold effects must be unique.', 400);
+  return values.map(holdEffect);
+}
+
+function holdTimestamp(value: string) {
+  if (!Number.isFinite(Date.parse(value)) || new Date(value).toISOString() !== value)
+    return mappedError('data_rights_input_invalid', 'Hold times must be canonical ISO-8601 timestamps.', 400);
+  return value;
+}
+
 async function dataRights<Result>(
   kind: 'export' | 'hold',
   operation: () => Promise<Result>,
@@ -375,6 +389,12 @@ async function dataRights<Result>(
     return await operation();
   } catch (error) {
     if (error instanceof RuntimeError) throw error;
+    const provider = error as { name?: string; $metadata?: unknown; CancellationReasons?: Array<{ Code?: string }> } | null;
+    if (provider?.name === 'ConditionalCheckFailedException' || provider?.name === 'TransactionConflictException' ||
+        provider?.name === 'TransactionCanceledException' && provider.CancellationReasons?.some(reason => reason.Code === 'ConditionalCheckFailed' || reason.Code === 'TransactionConflict'))
+      mappedError('data_rights_conflict', 'The data-rights state changed concurrently; retry the exact request.', 409, true);
+    if (provider?.$metadata || provider?.name?.endsWith('Exception'))
+      mappedError('data_rights_retry_required', 'Data-rights processing requires retry.', 503, true);
     const detail = error instanceof Error ? error.message : '';
     if (/not found/i.test(detail)) {
       mappedError('record_not_found', 'The record was not found.', 404);
@@ -410,14 +430,14 @@ async function dataRights<Result>(
         409,
       );
     }
-    if (kind === 'hold') {
+    if (kind === 'hold' && /Only an unexpired active hold|Use explicit expiry|not due for expiry|64 active holds/.test(detail)) {
       mappedError(
         'record_hold_invalid',
         'The record hold cannot make the requested transition.',
         409,
       );
     }
-    if (/invalid|requires|bounded|future/i.test(detail)) {
+    if (/requires|bounded|future/i.test(detail)) {
       mappedError(
         'data_rights_input_invalid',
         'The data-rights request is invalid.',
@@ -425,8 +445,8 @@ async function dataRights<Result>(
       );
     }
     mappedError(
-      'data_export_retry_required',
-      'Confidential export processing requires retry.',
+      'data_rights_retry_required',
+      'Data-rights processing requires retry.',
       503,
       true,
     );
@@ -567,12 +587,12 @@ export const issueHoldHandler = createContractHttpJsonHandler<
     const hold = await dataRights('hold', () =>
       issueRecordHold({
         correlationId: context.correlationId,
-        effects: request.body.effects.map(holdEffect),
-        expiresAt: request.body.expiresAt,
+        effects: holdEffects(request.body.effects),
+        expiresAt: holdTimestamp(request.body.expiresAt),
         principal,
         purpose: holdPurpose(request.body.purpose),
         recordId: request.path.recordId,
-        reviewAt: request.body.reviewAt,
+        reviewAt: holdTimestamp(request.body.reviewAt),
       }),
     );
     return holdResponse(hold);
@@ -592,11 +612,11 @@ export const reviewHoldHandler = createContractHttpJsonHandler<
     const hold = await dataRights('hold', () =>
       reviewRecordHold({
         correlationId: context.correlationId,
-        expiresAt: request.body.expiresAt,
+        expiresAt: holdTimestamp(request.body.expiresAt),
         holdId: request.path.holdId,
         principal,
         recordId: request.path.recordId,
-        reviewAt: request.body.reviewAt,
+        reviewAt: holdTimestamp(request.body.reviewAt),
       }),
     );
     return holdResponse(hold);
@@ -760,7 +780,7 @@ import type { Principal } from '@empire-builder-kit/runtime/auth';
 import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
 import { ${identifierPrefix}DatabaseHealth } from '../api/contracts/protected.js';
 import { authorize${pascalName}Operation } from '../authorization/runtime.js';
-import { withPrimaryDatabase } from './runtime-client.js';
+${"import { dataStore } from '../data/key-value.js';"}
 
 export const handler = createContractHttpJsonHandler<
   typeof ${identifierPrefix}DatabaseHealth,
@@ -772,351 +792,21 @@ export const handler = createContractHttpJsonHandler<
   workspace: '${workspace}',
   authorize: authorize${pascalName}Operation,
   async handle({ context }) {
-    await withPrimaryDatabase(
-      context,
-      'api-database-health',
-      (client) => client.query('SELECT 1'),
-    );
+${`    void context;
+    await dataStore().get('application', 'health', 'connectivity-probe');
+`}\
     return { service: '${name}', status: 'ok' };
   },
 });
 `,
-        'database/records.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
-import type { Principal } from '@empire-builder-kit/runtime/auth';
-import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
-import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
-import { RuntimeError } from '@empire-builder-kit/runtime/response';
-import {
-  ${identifierPrefix}GetRecord,
-  ${identifierPrefix}PutRecord,
-} from '../api/contracts/protected.js';
-import {
-  authorize${pascalName}DataRightsOperation,
-  authorize${pascalName}Operation,
-} from '../authorization/runtime.js';
-import {
-  correctRecordWithLifecycle,
-  publishRecordCorrection,
-} from '../data/record-correction.js';
-import { effectiveRecordOwner } from '../data/data-rights-shared.js';
-import { withPrimaryDatabase } from './runtime-client.js';
-
-function canonicalTestExpiresAt(value: string | undefined): string | undefined {
-  if (value === undefined) return undefined;
-  const expiresAt = Date.parse(value);
-  const now = Date.now();
-  if (
-    !Number.isFinite(expiresAt) ||
-    new Date(expiresAt).toISOString() !== value ||
-    expiresAt <= now ||
-    expiresAt - now > 48 * 60 * 60 * 1_000
-  ) {
-    throw new RuntimeError({
-      code: 'test_data_expiry_invalid',
-      message:
-        'Test data expiry must be a canonical future timestamp within 48 hours.',
-      retryable: false,
-      status: 400,
-    });
-  }
-  return value;
-}
-
-function notFound(): never {
-  throw new RuntimeError({
-    code: 'record_not_found',
-    message: 'The record was not found.',
-    retryable: false,
-    status: 404,
-  });
-}
-
-export const putHandler = createContractHttpJsonHandler<
-  typeof ${identifierPrefix}PutRecord,
-  RuntimeHttpEvent,
-  AuthorizationPrincipal
->({
-  component: 'database-records',
-  operation: ${identifierPrefix}PutRecord,
-  workspace: '${workspace}',
-  authorize: authorize${pascalName}DataRightsOperation,
-  async handle({ context, principal, request }) {
-    const testExpiresAt = canonicalTestExpiresAt(request.body.testExpiresAt);
-    const ownerId = effectiveRecordOwner(principal);
-    const result = await withPrimaryDatabase(context, 'api-database-records', (client) =>
-      client.query<{
-        id: string;
-        name: string;
-        runScope: string;
-      }>(
-        \`INSERT INTO records
-           (id, name, owner_id, run_scope, test_expires_at)
-         VALUES ($1::uuid, $2, $3, $4, $5::timestamptz)
-         ON CONFLICT (id) DO NOTHING
-         RETURNING id::text, name, run_scope AS "runScope"\`,
-        [
-          request.path.recordId,
-          request.body.name,
-          ownerId,
-          request.body.runScope,
-          testExpiresAt ?? null,
-        ],
-      ),
-    );
-    const created = result.rows[0];
-    if (created) return created;
-    const ownership = await withPrimaryDatabase(
-      context,
-      'api-database-records',
-      (client) =>
-        client.query<{ ownerId: string }>(
-          \`SELECT owner_id AS "ownerId"
-           FROM records
-           WHERE id = $1::uuid\`,
-          [request.path.recordId],
-        ),
-    );
-    if (ownership.rows[0]?.ownerId !== ownerId) {
-      throw new RuntimeError({
-        code: 'record_conflict',
-        message: 'The record identifier is owned by another principal.',
-        retryable: false,
-        status: 409,
-      });
-    }
-    const corrected = await correctRecordWithLifecycle({
-      correlationId: context.correlationId,
-      name: request.body.name,
-      principal,
-      recordId: request.path.recordId,
-      runScope: request.body.runScope,
-      testExpiresAt,
-    });
-    const propagation = await publishRecordCorrection(
-      context.correlationId,
-      corrected.requestRef,
-    );
-    if (propagation === 'retry-required') {
-      throw new RuntimeError({
-        code: 'record_correction_retry_required',
-        message: 'Record correction propagation requires retry.',
-        retryable: true,
-        status: 503,
-      });
-    }
-    return {
-      id: corrected.id,
-      name: corrected.name,
-      runScope: corrected.runScope,
-    };
-  },
-});
-
-export const getHandler = createContractHttpJsonHandler<
-  typeof ${identifierPrefix}GetRecord,
-  RuntimeHttpEvent,
-  Principal
->({
-  component: 'database-records',
-  operation: ${identifierPrefix}GetRecord,
-  workspace: '${workspace}',
-  authorize: authorize${pascalName}Operation,
-  async handle({ context, principal, request }) {
-    const result = await withPrimaryDatabase(context, 'api-database-records', (client) =>
-      client.query<{ id: string; name: string; runScope: string }>(
-        \`SELECT id::text, name, run_scope AS "runScope"
-         FROM records
-         WHERE id = $1::uuid AND owner_id = $2\`,
-        [request.path.recordId, principal.id],
-      ),
-    );
-    return result.rows[0] ?? notFound();
-  },
-});
-
-`,
-        'api/event-consumer.ts': `import { parseDataLifecycleChangeEvent } from '@empire-builder-kit/runtime/data-lifecycle';
-import { parseSqsEventBridgeRecords, toEventLogContext } from '@empire-builder-kit/runtime/events';
-import { createLogger } from '@empire-builder-kit/runtime/logging';
-import type {
-  ${pascalName}CreatedData,
-  ${pascalName}DataLifecycleChangedData,
-} from '../contracts/events.js';
-import {
-  ${identifierPrefix}AuthorizationActions,
-} from '../authorization/policy.js';
-import {
-  authorize${pascalName}InternalOperation,
-} from '../authorization/runtime.js';
-import lifecycleConsumers from '../data/lifecycle-consumers.json';
-import { withPrimaryDatabase } from '../database/runtime-client.js';
-
-interface QueueRecord { body: string; messageId: string }
-interface QueueEvent { Records: QueueRecord[] }
-
-function acceptedLifecycleSources(): Set<string> {
-  const sources = lifecycleConsumers.acceptedSources;
-  if (
-    lifecycleConsumers.schemaVersion !== 1 ||
-    !Array.isArray(sources) ||
-    sources.length === 0 ||
-    sources.length > 32 ||
-    new Set(sources).size !== sources.length ||
-    sources.some((source) => !/^[a-z][a-z0-9-]{0,62}$/.test(source))
-  ) {
-    throw new Error(
-      'Lifecycle consumer configuration must contain unique bounded Slice sources.',
-    );
-  }
-  return new Set(sources);
-}
-
-const lifecycleSources = acceptedLifecycleSources();
-
-function requiredEventConsumerWorkloadIdentity(): string {
-  const configured = process.env.EBK_WORKLOAD_IDENTITY?.trim();
-  if (configured !== '${name}:event-consumer') {
-    throw new Error('Event consumer workload identity is invalid.');
-  }
-  return configured;
-}
-
-function lifecycleReconciliationExpiresAt(occurredAt: string): string {
-  const expiresAt = new Date(occurredAt);
-  expiresAt.setUTCDate(expiresAt.getUTCDate() + 400);
-  return expiresAt.toISOString();
-}
-
-export async function handler(event: QueueEvent) {
-  const workloadIdentity = requiredEventConsumerWorkloadIdentity();
-  const logger = createLogger({
-    component: 'event-consumer',
-    feature: 'events',
-    operation: 'consume-created',
-    slice: '${name}',
-    stage: process.env.EBK_STAGE ?? '',
-    workspace: '${workspace}',
-  });
-  const batch = parseSqsEventBridgeRecords<
-    ${pascalName}CreatedData | ${pascalName}DataLifecycleChangedData
-  >(event.Records);
-  const failures = [...batch.failures];
-  for (const { detailType, envelope, messageId, source } of batch.events) {
-    if (messageId === undefined) {
-      failures.push({
-        error: 'Event processing failed without retaining payload data.',
-        messageId: 'missing-message-id',
-      });
-      continue;
-    }
-    try {
-      if (detailType === 'DataLifecycleChanged') {
-        const lifecycle = parseDataLifecycleChangeEvent(envelope.data);
-        if (
-          source === undefined ||
-          lifecycle.sourceSlice !== source ||
-          !lifecycleSources.has(source)
-        ) {
-          throw new Error(
-            'Lifecycle event source is not declared by this consumer.',
-          );
-        }
-        await authorize${pascalName}InternalOperation({
-          action: ${identifierPrefix}AuthorizationActions.lifecycleConsume,
-          correlationId: envelope.meta.correlationId,
-          operationId: messageId,
-          workloadIdentity,
-        });
-        await withPrimaryDatabase(
-          { correlationId: envelope.meta.correlationId },
-          'event-consumer',
-          async (client) => {
-            await client.query('BEGIN');
-            try {
-              await client.query(
-              \`INSERT INTO data_lifecycle_receipts
-                 (source_slice, pseudonymous_key, action, request_ref,
-                  policy_version, occurred_at)
-               VALUES ($1, $2, $3, $4, $5, $6)
-               ON CONFLICT
-                 (source_slice, pseudonymous_key, action, request_ref)
-               DO NOTHING\`,
-              [
-                lifecycle.sourceSlice,
-                lifecycle.pseudonymousKey,
-                lifecycle.action,
-                lifecycle.requestRef,
-                lifecycle.policyVersion,
-                lifecycle.occurredAt,
-              ],
-              );
-              await client.query(
-                \`INSERT INTO data_lifecycle_downstream_copies
-                   (source_slice, pseudonymous_key, copy_id, recipient,
-                    purpose, expires_at, action, hold_refs, status,
-                    updated_at)
-                 VALUES ($1, $2, $3, $4, 'lifecycle-reconciliation', $5,
-                         $6, '[]'::jsonb, $7, $8)
-                 ON CONFLICT (source_slice, pseudonymous_key, copy_id)
-                 DO UPDATE SET
-                   action = EXCLUDED.action,
-                   expires_at = EXCLUDED.expires_at,
-                   hold_refs = EXCLUDED.hold_refs,
-                   status = EXCLUDED.status,
-                   updated_at = EXCLUDED.updated_at
-                 WHERE data_lifecycle_downstream_copies.updated_at
-                       <= EXCLUDED.updated_at\`,
-                [
-                  lifecycle.sourceSlice,
-                  lifecycle.pseudonymousKey,
-                  '${name}-lifecycle-consumer',
-                  '${name}',
-                  lifecycleReconciliationExpiresAt(lifecycle.occurredAt),
-                  lifecycle.action,
-                  lifecycle.action === 'deletion'
-                    ? 'deleted'
-                    : 'reconciled',
-                  lifecycle.occurredAt,
-                ],
-              );
-              await client.query('COMMIT');
-            } catch (error) {
-              await client.query('ROLLBACK').catch(() => undefined);
-              throw error;
-            }
-          },
-        );
-      }
-      logger.info('${name} event consumed', {
-        context: toEventLogContext(envelope.meta, detailType),
-        outcome: 'success',
-      });
-    } catch {
-      failures.push({
-        error: 'Event processing failed without retaining payload data.',
-        messageId,
-      });
-    }
-  }
-  logger.info('${name} event batch completed', {
-    attributes: {
-      eventCount: batch.events.length,
-      failureCount: failures.length,
-    },
-    outcome: failures.length === 0 ? 'success' : 'failure',
-  });
-  return {
-    batchItemFailures: failures.map(({ messageId }) => ({
-      itemIdentifier: messageId ?? '',
-    })),
-  };
-}
-`,
+        'database/records.ts': (0, built_in_plan_key_value_records_js_1.renderKeyValueRecordApi)(pascalName, workspace),
+        'api/event-consumer.ts': (0, built_in_plan_key_value_consumer_js_1.renderKeyValueEventConsumer)(name, pascalName, workspace),
         'testing/event-consumer-identity.spec.ts': `import { afterEach, describe, expect, it } from 'vitest';
 import { handler } from '../api/event-consumer.js';
 
 afterEach(() => {
   delete process.env.EBK_WORKLOAD_IDENTITY;
+  delete process.env.EBK_STAGE;
 });
 
 describe('${pascalName} event-consumer identity', () => {
@@ -1135,54 +825,22 @@ describe('${pascalName} event-consumer identity', () => {
 
   it('accepts only the exact generated identity', async () => {
     process.env.EBK_WORKLOAD_IDENTITY = '${name}:event-consumer';
+    process.env.EBK_STAGE = 'development';
     await expect(handler({ Records: [] })).resolves.toEqual({
       batchItemFailures: [],
     });
   });
-});
-`,
-        'api/publish-created.ts': `import { EventBridgeClient, PutEventsCommand } from '@aws-sdk/client-eventbridge';
-import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
-import type { Principal } from '@empire-builder-kit/runtime/auth';
-import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
-import { createEventPublisher } from '@empire-builder-kit/runtime/events';
-import { authorize${pascalName}Operation } from '../authorization/runtime.js';
-import { ${identifierPrefix}PublishCreated } from './contracts/protected.js';
-import { ${pascalName}Created } from '../contracts/events.js';
 
-const client = new EventBridgeClient({});
-let publish: ReturnType<typeof createEventPublisher> | undefined;
-function getPublisher() {
-  return publish ??= createEventPublisher({
-    busName: process.env.EVENT_BUS_NAME ?? '',
-    stage: process.env.EBK_STAGE ?? '',
-    send: (entry) => client.send(new PutEventsCommand({ Entries: [{
-      Detail: entry.detail,
-      DetailType: entry.detailType,
-      EventBusName: entry.eventBusName,
-      Source: entry.source,
-    }] })),
+  it('fails closed without an exact receiver stage', async () => {
+    process.env.EBK_WORKLOAD_IDENTITY = '${name}:event-consumer';
+    await expect(handler({ Records: [] })).rejects.toThrow(
+      'Event consumer stage is required and must be exact.',
+    );
   });
-}
-
-export const handler = createContractHttpJsonHandler<
-  typeof ${identifierPrefix}PublishCreated,
-  RuntimeHttpEvent,
-  Principal
->({
-  component: 'event-publisher',
-  operation: ${identifierPrefix}PublishCreated,
-  workspace: '${workspace}',
-  authorize: authorize${pascalName}Operation,
-  async handle({ context, principal }) {
-    const publishedEvent = await getPublisher()(${pascalName}Created, {
-      id: crypto.randomUUID(),
-      occurredBy: principal.id,
-    }, { context });
-    return { eventId: publishedEvent.meta.eventId };
-  },
 });
 `,
+        'api/publish-created.ts': (0, built_in_plan_key_value_consumer_js_1.renderKeyValueCreatedPublisher)(pascalName, workspace),
     };
+    return Object.fromEntries(Object.entries(files).filter(([path]) => sql || path !== 'database/runtime-client.ts'));
 }
 //# sourceMappingURL=built-in-plan-api-files.js.map