@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/generators/slice/built-in-plan-api-files.js

@@ -2,10 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductApiFiles = renderProductApiFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const built_in_plan_key_value_records_js_1 = require("./built-in-plan-key-value-records.js");
+const built_in_plan_key_value_consumer_js_1 = require("./built-in-plan-key-value-consumer.js");
 /** @internal */
-function renderProductApiFiles(name, pascalName, workspace) {
+function renderProductApiFiles(name, pascalName, workspace, sql = false) {
     const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
-    return {
+    const files = {
         'api/health.ts': `import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
 import { ${identifierPrefix}Health } from './contracts/protected.js';
 
@@ -206,7 +208,7 @@ async function retentionReview<Result>(
         404,
       );
     }
-    if (/direct admin/i.test(detail)) {
+    if (/^Data-rights (?:request requires a direct human principal|administration requires a direct admin)[.]$/.test(detail)) {
       mappedError(
         'authorization_denied',
         'Authorization was denied.',
@@ -367,6 +369,18 @@ function holdPurpose(
   );
 }
 
+function holdEffects(values: readonly string[]) {
+  if (values.length === 0 || new Set(values).size !== values.length)
+    return mappedError('data_rights_input_invalid', 'Hold effects must be unique.', 400);
+  return values.map(holdEffect);
+}
+
+function holdTimestamp(value: string) {
+  if (!Number.isFinite(Date.parse(value)) || new Date(value).toISOString() !== value)
+    return mappedError('data_rights_input_invalid', 'Hold times must be canonical ISO-8601 timestamps.', 400);
+  return value;
+}
+
 async function dataRights<Result>(
   kind: 'export' | 'hold',
   operation: () => Promise<Result>,
@@ -375,6 +389,12 @@ async function dataRights<Result>(
     return await operation();
   } catch (error) {
     if (error instanceof RuntimeError) throw error;
+    const provider = error as { name?: string; $metadata?: unknown; CancellationReasons?: Array<{ Code?: string }> } | null;
+    if (provider?.name === 'ConditionalCheckFailedException' || provider?.name === 'TransactionConflictException' ||
+        provider?.name === 'TransactionCanceledException' && provider.CancellationReasons?.some(reason => reason.Code === 'ConditionalCheckFailed' || reason.Code === 'TransactionConflict'))
+      mappedError('data_rights_conflict', 'The data-rights state changed concurrently; retry the exact request.', 409, true);
+    if (provider?.$metadata || provider?.name?.endsWith('Exception'))
+      mappedError('data_rights_retry_required', 'Data-rights processing requires retry.', 503, true);
     const detail = error instanceof Error ? error.message : '';
     if (/not found/i.test(detail)) {
       mappedError('record_not_found', 'The record was not found.', 404);
@@ -410,14 +430,14 @@ async function dataRights<Result>(
         409,
       );
     }
-    if (kind === 'hold') {
+    if (kind === 'hold' && /Only an unexpired active hold|Use explicit expiry|not due for expiry|64 active holds/.test(detail)) {
       mappedError(
         'record_hold_invalid',
         'The record hold cannot make the requested transition.',
         409,
       );
     }
-    if (/invalid|requires|bounded|future/i.test(detail)) {
+    if (/requires|bounded|future/i.test(detail)) {
       mappedError(
         'data_rights_input_invalid',
         'The data-rights request is invalid.',
@@ -425,8 +445,8 @@ async function dataRights<Result>(
       );
     }
     mappedError(
-      'data_export_retry_required',
-      'Confidential export processing requires retry.',
+      'data_rights_retry_required',
+      'Data-rights processing requires retry.',
       503,
       true,
     );
@@ -567,12 +587,12 @@ export const issueHoldHandler = createContractHttpJsonHandler<
     const hold = await dataRights('hold', () =>
       issueRecordHold({
         correlationId: context.correlationId,
-        effects: request.body.effects.map(holdEffect),
-        expiresAt: request.body.expiresAt,
+        effects: holdEffects(request.body.effects),
+        expiresAt: holdTimestamp(request.body.expiresAt),
         principal,
         purpose: holdPurpose(request.body.purpose),
         recordId: request.path.recordId,
-        reviewAt: request.body.reviewAt,
+        reviewAt: holdTimestamp(request.body.reviewAt),
       }),
     );
     return holdResponse(hold);
@@ -592,11 +612,11 @@ export const reviewHoldHandler = createContractHttpJsonHandler<
     const hold = await dataRights('hold', () =>
       reviewRecordHold({
         correlationId: context.correlationId,
-        expiresAt: request.body.expiresAt,
+        expiresAt: holdTimestamp(request.body.expiresAt),
         holdId: request.path.holdId,
         principal,
         recordId: request.path.recordId,
-        reviewAt: request.body.reviewAt,
+        reviewAt: holdTimestamp(request.body.reviewAt),
       }),
     );
     return holdResponse(hold);
@@ -649,7 +669,11 @@ export const expireHoldHandler = createContractHttpJsonHandler<
 `,
         'database/runtime-client.ts': `import {
   databaseTlsOptions,
+  isDatabaseConnectFailure,
   runWithDatabaseCredential,
+  toNodePostgresConnectionOptions,
+  withDatabaseClient,
+  type DatabaseConnectRetry,
   type LinkedDatabaseResource,
 } from '@empire-builder-kit/runtime/database';
 import { createLogger } from '@empire-builder-kit/runtime/logging';
@@ -708,21 +732,72 @@ function linkedDatabase(): LinkedDatabaseResource {
   return resource as LinkedDatabaseResource;
 }
 
+type PrimaryDatabaseWorkload =
+  | 'api-database-health'
+  | 'api-database-records'
+  | 'api-publish-created'
+  | 'async-inbox-cleanup'
+  | 'async-outbox-relay'
+  | 'async-provider-worker'
+  | 'data-export-cleanup'
+  | 'data-retention-job'
+  | 'event-consumer'
+  | 'web-server';
+
+// Aurora Serverless v2 resume can take 15-30 s or longer. Only connect()
+// retries, within a per-call wall-clock budget that leaves room for the
+// operation: HTTP routes and the web server run on SST's 20 s default
+// timeout, workers and the outbox relay on 1 minute, and jobs on 5 minutes.
+// HTTP attempts are short so a held or slow resume connect is retried
+// inside the budget instead of consuming it in a single attempt.
+const connectPolicy: Record<
+  PrimaryDatabaseWorkload,
+  { attemptTimeoutMs: number; budgetMs: number }
+> = {
+  'api-database-health': { attemptTimeoutMs: 5_000, budgetMs: 15_000 },
+  'api-database-records': { attemptTimeoutMs: 5_000, budgetMs: 15_000 },
+  'api-publish-created': { attemptTimeoutMs: 5_000, budgetMs: 15_000 },
+  'async-inbox-cleanup': { attemptTimeoutMs: 15_000, budgetMs: 120_000 },
+  'async-outbox-relay': { attemptTimeoutMs: 15_000, budgetMs: 40_000 },
+  'async-provider-worker': { attemptTimeoutMs: 15_000, budgetMs: 40_000 },
+  'data-export-cleanup': { attemptTimeoutMs: 15_000, budgetMs: 120_000 },
+  'data-retention-job': { attemptTimeoutMs: 15_000, budgetMs: 120_000 },
+  'event-consumer': { attemptTimeoutMs: 15_000, budgetMs: 40_000 },
+  'web-server': { attemptTimeoutMs: 5_000, budgetMs: 15_000 },
+};
+
+function logConnectionRetry(
+  context: { correlationId: string },
+  workload: PrimaryDatabaseWorkload,
+  retry: DatabaseConnectRetry,
+): void {
+  createLogger({
+    component: workload,
+    feature: 'database',
+    operation: 'database.connect',
+    slice: '${name}',
+    stage: process.env.EBK_STAGE ?? '',
+    workspace: '${workspace}',
+  }).warn('Retrying database connection', {
+    attributes: {
+      databaseEvent: 'database_runtime_connection_retry',
+      ...retry,
+    },
+    context: { correlationId: context.correlationId },
+    outcome: 'unknown',
+  });
+}
+
 export async function withPrimaryDatabase<Result>(
   context: { correlationId: string },
-  workload:
-    | 'api-database-health'
-    | 'api-database-records'
-    | 'async-inbox-cleanup'
-    | 'async-outbox-relay'
-    | 'async-provider-worker'
-    | 'data-export-cleanup'
-    | 'data-retention-job'
-    | 'event-consumer'
-    | 'web-server',
+  workload: PrimaryDatabaseWorkload,
   operation: (client: PgClient) => Promise<Result>,
 ): Promise<Result> {
   const resource = linkedDatabase();
+  const policy = connectPolicy[workload];
+  // One per-call deadline spans credential resolution and any 28P01 refresh.
+  // Handlers that make several sequential calls bound their own total work.
+  const deadline = Date.now() + policy.budgetMs;
   return runWithDatabaseCredential(
     resource,
     resource.provider === 'aws-secrets-manager'
@@ -732,22 +807,25 @@ export async function withPrimaryDatabase<Result>(
           resolver: getSecretResolver(workload),
         }
       : undefined,
-    async (credential) => {
-      const client = new Client({
-        ...credential,
-        connectionTimeoutMillis: 10_000,
-        ssl: databaseTlsOptions(resource),
-      });
-      try {
-        await client.connect();
-        return await operation(client);
-      } finally {
-        await client.end().catch(() => undefined);
-      }
-    },
+    (credential) =>
+      withDatabaseClient(
+        {
+          attemptTimeoutMs: policy.attemptTimeoutMs,
+          createClient: (connectionTimeoutMillis) =>
+            new Client({
+              ...toNodePostgresConnectionOptions(credential),
+              connectionTimeoutMillis,
+              ssl: databaseTlsOptions(resource),
+            }),
+          deadline,
+          onRetry: (retry) => logConnectionRetry(context, workload, retry),
+        },
+        operation,
+      ),
+    // Refresh credentials only when connect() itself failed authentication,
+    // so a started operation is never run a second time.
     (error) =>
-      error !== null &&
-      typeof error === 'object' &&
+      isDatabaseConnectFailure(error) &&
       'code' in error &&
       error.code === '28P01',
   );
@@ -758,7 +836,7 @@ import type { Principal } from '@empire-builder-kit/runtime/auth';
 import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
 import { ${identifierPrefix}DatabaseHealth } from '../api/contracts/protected.js';
 import { authorize${pascalName}Operation } from '../authorization/runtime.js';
-import { withPrimaryDatabase } from './runtime-client.js';
+${"import { dataStore } from '../data/key-value.js';"}
 
 export const handler = createContractHttpJsonHandler<
   typeof ${identifierPrefix}DatabaseHealth,
@@ -770,351 +848,21 @@ export const handler = createContractHttpJsonHandler<
   workspace: '${workspace}',
   authorize: authorize${pascalName}Operation,
   async handle({ context }) {
-    await withPrimaryDatabase(
-      context,
-      'api-database-health',
-      (client) => client.query('SELECT 1'),
-    );
+${`    void context;
+    await dataStore().get('application', 'health', 'connectivity-probe');
+`}\
     return { service: '${name}', status: 'ok' };
   },
 });
 `,
-        'database/records.ts': `import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
-import type { Principal } from '@empire-builder-kit/runtime/auth';
-import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
-import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
-import { RuntimeError } from '@empire-builder-kit/runtime/response';
-import {
-  ${identifierPrefix}GetRecord,
-  ${identifierPrefix}PutRecord,
-} from '../api/contracts/protected.js';
-import {
-  authorize${pascalName}DataRightsOperation,
-  authorize${pascalName}Operation,
-} from '../authorization/runtime.js';
-import {
-  correctRecordWithLifecycle,
-  publishRecordCorrection,
-} from '../data/record-correction.js';
-import { effectiveRecordOwner } from '../data/data-rights-shared.js';
-import { withPrimaryDatabase } from './runtime-client.js';
-
-function canonicalTestExpiresAt(value: string | undefined): string | undefined {
-  if (value === undefined) return undefined;
-  const expiresAt = Date.parse(value);
-  const now = Date.now();
-  if (
-    !Number.isFinite(expiresAt) ||
-    new Date(expiresAt).toISOString() !== value ||
-    expiresAt <= now ||
-    expiresAt - now > 48 * 60 * 60 * 1_000
-  ) {
-    throw new RuntimeError({
-      code: 'test_data_expiry_invalid',
-      message:
-        'Test data expiry must be a canonical future timestamp within 48 hours.',
-      retryable: false,
-      status: 400,
-    });
-  }
-  return value;
-}
-
-function notFound(): never {
-  throw new RuntimeError({
-    code: 'record_not_found',
-    message: 'The record was not found.',
-    retryable: false,
-    status: 404,
-  });
-}
-
-export const putHandler = createContractHttpJsonHandler<
-  typeof ${identifierPrefix}PutRecord,
-  RuntimeHttpEvent,
-  AuthorizationPrincipal
->({
-  component: 'database-records',
-  operation: ${identifierPrefix}PutRecord,
-  workspace: '${workspace}',
-  authorize: authorize${pascalName}DataRightsOperation,
-  async handle({ context, principal, request }) {
-    const testExpiresAt = canonicalTestExpiresAt(request.body.testExpiresAt);
-    const ownerId = effectiveRecordOwner(principal);
-    const result = await withPrimaryDatabase(context, 'api-database-records', (client) =>
-      client.query<{
-        id: string;
-        name: string;
-        runScope: string;
-      }>(
-        \`INSERT INTO records
-           (id, name, owner_id, run_scope, test_expires_at)
-         VALUES ($1::uuid, $2, $3, $4, $5::timestamptz)
-         ON CONFLICT (id) DO NOTHING
-         RETURNING id::text, name, run_scope AS "runScope"\`,
-        [
-          request.path.recordId,
-          request.body.name,
-          ownerId,
-          request.body.runScope,
-          testExpiresAt ?? null,
-        ],
-      ),
-    );
-    const created = result.rows[0];
-    if (created) return created;
-    const ownership = await withPrimaryDatabase(
-      context,
-      'api-database-records',
-      (client) =>
-        client.query<{ ownerId: string }>(
-          \`SELECT owner_id AS "ownerId"
-           FROM records
-           WHERE id = $1::uuid\`,
-          [request.path.recordId],
-        ),
-    );
-    if (ownership.rows[0]?.ownerId !== ownerId) {
-      throw new RuntimeError({
-        code: 'record_conflict',
-        message: 'The record identifier is owned by another principal.',
-        retryable: false,
-        status: 409,
-      });
-    }
-    const corrected = await correctRecordWithLifecycle({
-      correlationId: context.correlationId,
-      name: request.body.name,
-      principal,
-      recordId: request.path.recordId,
-      runScope: request.body.runScope,
-      testExpiresAt,
-    });
-    const propagation = await publishRecordCorrection(
-      context.correlationId,
-      corrected.requestRef,
-    );
-    if (propagation === 'retry-required') {
-      throw new RuntimeError({
-        code: 'record_correction_retry_required',
-        message: 'Record correction propagation requires retry.',
-        retryable: true,
-        status: 503,
-      });
-    }
-    return {
-      id: corrected.id,
-      name: corrected.name,
-      runScope: corrected.runScope,
-    };
-  },
-});
-
-export const getHandler = createContractHttpJsonHandler<
-  typeof ${identifierPrefix}GetRecord,
-  RuntimeHttpEvent,
-  Principal
->({
-  component: 'database-records',
-  operation: ${identifierPrefix}GetRecord,
-  workspace: '${workspace}',
-  authorize: authorize${pascalName}Operation,
-  async handle({ context, principal, request }) {
-    const result = await withPrimaryDatabase(context, 'api-database-records', (client) =>
-      client.query<{ id: string; name: string; runScope: string }>(
-        \`SELECT id::text, name, run_scope AS "runScope"
-         FROM records
-         WHERE id = $1::uuid AND owner_id = $2\`,
-        [request.path.recordId, principal.id],
-      ),
-    );
-    return result.rows[0] ?? notFound();
-  },
-});
-
-`,
-        'api/event-consumer.ts': `import { parseDataLifecycleChangeEvent } from '@empire-builder-kit/runtime/data-lifecycle';
-import { parseSqsEventBridgeRecords, toEventLogContext } from '@empire-builder-kit/runtime/events';
-import { createLogger } from '@empire-builder-kit/runtime/logging';
-import type {
-  ${pascalName}CreatedData,
-  ${pascalName}DataLifecycleChangedData,
-} from '../contracts/events.js';
-import {
-  ${identifierPrefix}AuthorizationActions,
-} from '../authorization/policy.js';
-import {
-  authorize${pascalName}InternalOperation,
-} from '../authorization/runtime.js';
-import lifecycleConsumers from '../data/lifecycle-consumers.json';
-import { withPrimaryDatabase } from '../database/runtime-client.js';
-
-interface QueueRecord { body: string; messageId: string }
-interface QueueEvent { Records: QueueRecord[] }
-
-function acceptedLifecycleSources(): Set<string> {
-  const sources = lifecycleConsumers.acceptedSources;
-  if (
-    lifecycleConsumers.schemaVersion !== 1 ||
-    !Array.isArray(sources) ||
-    sources.length === 0 ||
-    sources.length > 32 ||
-    new Set(sources).size !== sources.length ||
-    sources.some((source) => !/^[a-z][a-z0-9-]{0,62}$/.test(source))
-  ) {
-    throw new Error(
-      'Lifecycle consumer configuration must contain unique bounded Slice sources.',
-    );
-  }
-  return new Set(sources);
-}
-
-const lifecycleSources = acceptedLifecycleSources();
-
-function requiredEventConsumerWorkloadIdentity(): string {
-  const configured = process.env.EBK_WORKLOAD_IDENTITY?.trim();
-  if (configured !== '${name}:event-consumer') {
-    throw new Error('Event consumer workload identity is invalid.');
-  }
-  return configured;
-}
-
-function lifecycleReconciliationExpiresAt(occurredAt: string): string {
-  const expiresAt = new Date(occurredAt);
-  expiresAt.setUTCDate(expiresAt.getUTCDate() + 400);
-  return expiresAt.toISOString();
-}
-
-export async function handler(event: QueueEvent) {
-  const workloadIdentity = requiredEventConsumerWorkloadIdentity();
-  const logger = createLogger({
-    component: 'event-consumer',
-    feature: 'events',
-    operation: 'consume-created',
-    slice: '${name}',
-    stage: process.env.EBK_STAGE ?? '',
-    workspace: '${workspace}',
-  });
-  const batch = parseSqsEventBridgeRecords<
-    ${pascalName}CreatedData | ${pascalName}DataLifecycleChangedData
-  >(event.Records);
-  const failures = [...batch.failures];
-  for (const { detailType, envelope, messageId, source } of batch.events) {
-    if (messageId === undefined) {
-      failures.push({
-        error: 'Event processing failed without retaining payload data.',
-        messageId: 'missing-message-id',
-      });
-      continue;
-    }
-    try {
-      if (detailType === 'DataLifecycleChanged') {
-        const lifecycle = parseDataLifecycleChangeEvent(envelope.data);
-        if (
-          source === undefined ||
-          lifecycle.sourceSlice !== source ||
-          !lifecycleSources.has(source)
-        ) {
-          throw new Error(
-            'Lifecycle event source is not declared by this consumer.',
-          );
-        }
-        await authorize${pascalName}InternalOperation({
-          action: ${identifierPrefix}AuthorizationActions.lifecycleConsume,
-          correlationId: envelope.meta.correlationId,
-          operationId: messageId,
-          workloadIdentity,
-        });
-        await withPrimaryDatabase(
-          { correlationId: envelope.meta.correlationId },
-          'event-consumer',
-          async (client) => {
-            await client.query('BEGIN');
-            try {
-              await client.query(
-              \`INSERT INTO data_lifecycle_receipts
-                 (source_slice, pseudonymous_key, action, request_ref,
-                  policy_version, occurred_at)
-               VALUES ($1, $2, $3, $4, $5, $6)
-               ON CONFLICT
-                 (source_slice, pseudonymous_key, action, request_ref)
-               DO NOTHING\`,
-              [
-                lifecycle.sourceSlice,
-                lifecycle.pseudonymousKey,
-                lifecycle.action,
-                lifecycle.requestRef,
-                lifecycle.policyVersion,
-                lifecycle.occurredAt,
-              ],
-              );
-              await client.query(
-                \`INSERT INTO data_lifecycle_downstream_copies
-                   (source_slice, pseudonymous_key, copy_id, recipient,
-                    purpose, expires_at, action, hold_refs, status,
-                    updated_at)
-                 VALUES ($1, $2, $3, $4, 'lifecycle-reconciliation', $5,
-                         $6, '[]'::jsonb, $7, $8)
-                 ON CONFLICT (source_slice, pseudonymous_key, copy_id)
-                 DO UPDATE SET
-                   action = EXCLUDED.action,
-                   expires_at = EXCLUDED.expires_at,
-                   hold_refs = EXCLUDED.hold_refs,
-                   status = EXCLUDED.status,
-                   updated_at = EXCLUDED.updated_at
-                 WHERE data_lifecycle_downstream_copies.updated_at
-                       <= EXCLUDED.updated_at\`,
-                [
-                  lifecycle.sourceSlice,
-                  lifecycle.pseudonymousKey,
-                  '${name}-lifecycle-consumer',
-                  '${name}',
-                  lifecycleReconciliationExpiresAt(lifecycle.occurredAt),
-                  lifecycle.action,
-                  lifecycle.action === 'deletion'
-                    ? 'deleted'
-                    : 'reconciled',
-                  lifecycle.occurredAt,
-                ],
-              );
-              await client.query('COMMIT');
-            } catch (error) {
-              await client.query('ROLLBACK').catch(() => undefined);
-              throw error;
-            }
-          },
-        );
-      }
-      logger.info('${name} event consumed', {
-        context: toEventLogContext(envelope.meta, detailType),
-        outcome: 'success',
-      });
-    } catch {
-      failures.push({
-        error: 'Event processing failed without retaining payload data.',
-        messageId,
-      });
-    }
-  }
-  logger.info('${name} event batch completed', {
-    attributes: {
-      eventCount: batch.events.length,
-      failureCount: failures.length,
-    },
-    outcome: failures.length === 0 ? 'success' : 'failure',
-  });
-  return {
-    batchItemFailures: failures.map(({ messageId }) => ({
-      itemIdentifier: messageId ?? '',
-    })),
-  };
-}
-`,
+        'database/records.ts': (0, built_in_plan_key_value_records_js_1.renderKeyValueRecordApi)(pascalName, workspace),
+        'api/event-consumer.ts': (0, built_in_plan_key_value_consumer_js_1.renderKeyValueEventConsumer)(name, pascalName, workspace),
         'testing/event-consumer-identity.spec.ts': `import { afterEach, describe, expect, it } from 'vitest';
 import { handler } from '../api/event-consumer.js';
 
 afterEach(() => {
   delete process.env.EBK_WORKLOAD_IDENTITY;
+  delete process.env.EBK_STAGE;
 });
 
 describe('${pascalName} event-consumer identity', () => {
@@ -1133,54 +881,22 @@ describe('${pascalName} event-consumer identity', () => {
 
   it('accepts only the exact generated identity', async () => {
     process.env.EBK_WORKLOAD_IDENTITY = '${name}:event-consumer';
+    process.env.EBK_STAGE = 'development';
     await expect(handler({ Records: [] })).resolves.toEqual({
       batchItemFailures: [],
     });
   });
-});
-`,
-        'api/publish-created.ts': `import { EventBridgeClient, PutEventsCommand } from '@aws-sdk/client-eventbridge';
-import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
-import type { Principal } from '@empire-builder-kit/runtime/auth';
-import { createContractHttpJsonHandler } from '@empire-builder-kit/runtime/api-server';
-import { createEventPublisher } from '@empire-builder-kit/runtime/events';
-import { authorize${pascalName}Operation } from '../authorization/runtime.js';
-import { ${identifierPrefix}PublishCreated } from './contracts/protected.js';
-import { ${pascalName}Created } from '../contracts/events.js';
 
-const client = new EventBridgeClient({});
-let publish: ReturnType<typeof createEventPublisher> | undefined;
-function getPublisher() {
-  return publish ??= createEventPublisher({
-    busName: process.env.EVENT_BUS_NAME ?? '',
-    stage: process.env.EBK_STAGE ?? '',
-    send: (entry) => client.send(new PutEventsCommand({ Entries: [{
-      Detail: entry.detail,
-      DetailType: entry.detailType,
-      EventBusName: entry.eventBusName,
-      Source: entry.source,
-    }] })),
+  it('fails closed without an exact receiver stage', async () => {
+    process.env.EBK_WORKLOAD_IDENTITY = '${name}:event-consumer';
+    await expect(handler({ Records: [] })).rejects.toThrow(
+      'Event consumer stage is required and must be exact.',
+    );
   });
-}
-
-export const handler = createContractHttpJsonHandler<
-  typeof ${identifierPrefix}PublishCreated,
-  RuntimeHttpEvent,
-  Principal
->({
-  component: 'event-publisher',
-  operation: ${identifierPrefix}PublishCreated,
-  workspace: '${workspace}',
-  authorize: authorize${pascalName}Operation,
-  async handle({ context, principal }) {
-    const publishedEvent = await getPublisher()(${pascalName}Created, {
-      id: crypto.randomUUID(),
-      occurredBy: principal.id,
-    }, { context });
-    return { eventId: publishedEvent.meta.eventId };
-  },
 });
 `,
+        'api/publish-created.ts': (0, built_in_plan_key_value_consumer_js_1.renderKeyValueCreatedPublisher)(pascalName, workspace),
     };
+    return Object.fromEntries(Object.entries(files).filter(([path]) => sql || path !== 'database/runtime-client.ts'));
 }
 //# sourceMappingURL=built-in-plan-api-files.js.map