@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/generators/slice/built-in-plan-authorization-files.js

@@ -2,10 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductAuthorizationFiles = renderProductAuthorizationFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const built_in_plan_authorization_storage_js_1 = require("./built-in-plan-authorization-storage.js");
 /** @internal */
 function renderProductAuthorizationFiles(name, pascalName) {
     const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
     return {
+        'authorization/record-store.ts': (0, built_in_plan_authorization_storage_js_1.renderAuthorizationRecordStore)(),
         'authorization/policy.ts': `import {
   defineAuthorizationPolicy,
   defineCoarseAdmission,
@@ -267,14 +269,18 @@ export const ${identifierPrefix}AuthorizationPolicy =
   });
 `,
         'authorization/runtime.ts': `import { createHash } from 'node:crypto';
+import { sliceAuthorizationGroupNames, sliceAuthorizationRoles } from './groups.mjs';
 import type { RuntimeHttpEvent } from '@empire-builder-kit/runtime';
 import {
   createBetterAuthConfig,
+  AuthError,
+  authErrorCodes,
   type Principal,
 } from '@empire-builder-kit/runtime/auth';
 import { createAuthGuard } from '@empire-builder-kit/runtime/auth-backend';
 import type { ApiAuthorizationInput } from '@empire-builder-kit/runtime/api-server';
 import type { ApiOperationDefinition } from '@empire-builder-kit/runtime/api-contract';
+import { ${identifierPrefix}GetRecord, ${identifierPrefix}PutRecord } from '../api/contracts/protected.js';
 import {
   createAuthorizationEvaluator,
   composeAuthorizationPrincipal,
@@ -288,7 +294,8 @@ import {
   type AuthorizationPrincipal,
 } from '@empire-builder-kit/runtime/authorization';
 import { isBoundedSafeReference } from '@empire-builder-kit/runtime/safe-reference';
-import { withPrimaryDatabase } from '../database/runtime-client.js';
+import { readAuthorizationRecord, writeAuthorizationAudit${', readRecordDeletionApproval'} } from './record-store.js';
+import { ${''}create${pascalName}DelegationStore } from './store.js';
 import {
   ${identifierPrefix}AuthorizationActions,
   ${identifierPrefix}MachineScopes,
@@ -345,7 +352,7 @@ function getGuard() {
       acceptedClientIds: [webClientId, ...machineClientIds],
     },
     policy: {
-      admin: { groups: ['${name}-admin'] },
+      admin: { groups: [sliceAuthorizationGroupNames(stage).admin] },
       agent: {
         scopes: Object.values(${identifierPrefix}MachineScopes(stage)),
       },
@@ -392,40 +399,16 @@ async function operationResource(
         'A record authorization action requires its validated record path.',
       );
     }
-    const existing = await withPrimaryDatabase(
-      { correlationId },
-      'api-database-records',
-      async (client) => {
-        const record = await client.query<{ ownerId: string }>(
-          \`SELECT owner_id AS "ownerId"
-           FROM records
-           WHERE id = $1::uuid\`,
-          [recordId],
-        );
-        if (record.rows[0]) return record.rows[0];
-
+    const existing = await (async () => {
+        const record = await readAuthorizationRecord(correlationId, recordId);
+        if (record) return record;
         const delegationId = candidate.path?.delegationId;
         if (
           operation.authorizationActions[0] ===
             ${identifierPrefix}AuthorizationActions.recordDelegationRevoke &&
           typeof delegationId === 'string'
         ) {
-          const delegation = await client.query<{
-            grantJson: {
-              delegator?: { id?: unknown };
-              resourceBoundary?: {
-                kind?: unknown;
-                resourceIds?: unknown;
-                resourceType?: unknown;
-              };
-            };
-          }>(
-            \`SELECT grant_json AS "grantJson"
-             FROM delegation_grants
-             WHERE id = $1::uuid\`,
-            [delegationId],
-          );
-          const grant = delegation.rows[0]?.grantJson;
+          const grant = await create${pascalName}DelegationStore(correlationId).read(delegationId);
           if (
             grant?.resourceBoundary?.kind === 'exact' &&
             grant.resourceBoundary.resourceType === 'record' &&
@@ -448,21 +431,11 @@ async function operationResource(
         ) {
           return undefined;
         }
-        const approval = await client.query<{ ownerId: string }>(
-          \`SELECT author_reference AS "ownerId"
-           FROM approval_requests
-           WHERE id = $1::uuid
-             AND request_json->'resource'->>'id' = $2
-             AND request_json->>'action' = $3\`,
-          [
-            approvalRequestId,
-            recordId,
-            ${identifierPrefix}AuthorizationActions.recordDelete,
-          ],
-        );
-        return approval.rows[0];
-      },
-    );
+        const approval = await ${`readRecordDeletionApproval(approvalRequestId, recordId, ${identifierPrefix}AuthorizationActions.recordDelete)`};
+        return approval?.resource.id === recordId && approval.action === ${identifierPrefix}AuthorizationActions.recordDelete
+          ? { ownerId: approval.author.effectiveHumanId ?? approval.author.actorId }
+          : undefined;
+      })();
     const missingOwnerId =
       operation.authorizationActions[0] ===
       ${identifierPrefix}AuthorizationActions.recordWrite
@@ -526,39 +499,12 @@ async function persistAuthorizationDecision<
     stage: decisionInput.context.stage,
     timestamp: decisionInput.context.now,
   });
-  await withPrimaryDatabase(
-    { correlationId },
-    workload,
-    (client) =>
-      client.query(
-        \`INSERT INTO authorization_audit
-           (action, approval_reference, authority_mode, correlation_id,
-            decision, delegation_reference, policy_version,
-            principal_kind, pseudonymous_subject_id, reason_category,
-            resource_reference, resource_type, slice, stage, subject_type)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
-                 $13, $14, $15)\`,
-        [
-          audit.action,
-          null,
-          audit.authorityMode,
-          audit.correlationId,
-          audit.decision,
-          decisionInput.principal.authority.mode === 'delegated'
-            ? decisionInput.principal.authority.delegationId
-            : null,
-          audit.policyVersion,
-          decisionInput.principal.kind,
-          audit.pseudonymousSubjectId,
-          audit.reasonCategory,
-          audit.resourceReference ?? null,
-          audit.resourceType,
-          audit.slice,
-          audit.stage,
-          decisionInput.principal.actor.type,
-        ],
-      ),
-  );
+  await writeAuthorizationAudit({
+    ...audit,
+    ...(decisionInput.principal.authority.mode === 'delegated'
+      ? { delegationReference: decisionInput.principal.authority.delegationId }
+      : {}),
+  }, workload);
   return audit;
 }
 
@@ -618,17 +564,24 @@ export async function authorize${pascalName}InternalOperation(input: {
   await evaluator.authorize(authorizationInput);
 }
 
-async function evaluate${pascalName}Operation<
+type ${pascalName}AuthorizedOperationInput<Operation extends ApiOperationDefinition> = Pick<
+  ApiAuthorizationInput<Operation, RuntimeHttpEvent>,
+  'context' | 'logger' | 'operation' | 'request'
+>;
+
+async function evaluate${pascalName}AuthenticatedOperation<
   Operation extends ApiOperationDefinition,
 >(
-  input: ApiAuthorizationInput<Operation, RuntimeHttpEvent>,
+  input: ${pascalName}AuthorizedOperationInput<Operation>,
+  verified: Principal,
 ): Promise<{
   authenticated: Principal;
   principal: AuthorizationPrincipal;
 }> {
-  const authenticated = await getGuard().authorize(input.event, {
-    logger: input.logger,
-  });
+  const authenticated = {
+    ...verified,
+    roles: sliceAuthorizationRoles(process.env.EBK_STAGE ?? '', verified.roles),
+  };
   const action = operationAction(input.operation);
   const recognizedMachineScopes = Object.values(
     ${identifierPrefix}MachineScopes(process.env.EBK_STAGE ?? ''),
@@ -696,6 +649,34 @@ async function evaluate${pascalName}Operation<
   return { authenticated, principal };
 }
 
+async function evaluate${pascalName}Operation<
+  Operation extends ApiOperationDefinition,
+>(input: ApiAuthorizationInput<Operation, RuntimeHttpEvent>): Promise<{
+  authenticated: Principal;
+  principal: AuthorizationPrincipal;
+}> {
+  const verified = await getGuard().authorize(input.event, {
+    logger: input.logger,
+  });
+  return evaluate${pascalName}AuthenticatedOperation(input, verified);
+}
+
+/** Fleet-only native Next transport; Lambda continues using the same evaluator. */
+export async function authorize${pascalName}FleetRecordOperation<
+  Operation extends ApiOperationDefinition,
+>(input: ${pascalName}AuthorizedOperationInput<Operation> & { accessToken: string | null }): Promise<AuthorizationPrincipal> {
+  if (!Object.is(input.operation, ${identifierPrefix}GetRecord) &&
+      !Object.is(input.operation, ${identifierPrefix}PutRecord))
+    throw new Error('Fleet record authorization requires the exact generated record operation.');
+  const verified = await getGuard().authorizeToken(input.accessToken, { logger: input.logger });
+  const webClientId = process.env.AUTH_CLIENT_ID;
+  if (!webClientId || verified.audience !== webClientId ||
+      verified.session.subject.type !== 'user' || verified.kind !== 'customer')
+    throw new AuthError({ code: authErrorCodes.invalidToken,
+      message: 'The access token is not a task web-client human token.', status: 401 });
+  return (await evaluate${pascalName}AuthenticatedOperation(input, verified)).principal;
+}
+
 export async function authorize${pascalName}Operation<
   Operation extends ApiOperationDefinition,
 >(
@@ -716,184 +697,7 @@ export async function authorize${pascalName}DataRightsOperation<
   return (await evaluate${pascalName}Operation(input)).principal;
 }
 `,
-        'authorization/store.ts': `import type {
-  ApprovalRequest,
-  DelegationGrant,
-  DelegationStore,
-} from '@empire-builder-kit/runtime/authorization';
-import { withPrimaryDatabase } from '../database/runtime-client.js';
-import type { ${pascalName}AuthorizationAction } from './policy.js';
-
-/**
- * Slice-owned online delegation state. The opaque capability is never stored;
- * grantJson contains only the runtime's digest-bearing safe grant record.
- */
-export function create${pascalName}DelegationStore(
-  correlationId: string,
-): DelegationStore<${pascalName}AuthorizationAction> {
-  return {
-    async create(grant) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query(
-            \`INSERT INTO delegation_grants
-               (id, capability_digest, expires_at, grant_json, issued_at,
-                policy_version, revision, status)
-             VALUES ($1::uuid, $2, $3, $4::jsonb, $5, $6, $7, $8)
-             ON CONFLICT (id) DO NOTHING\`,
-            [
-              grant.id,
-              grant.capabilityDigest,
-              grant.expiresAt,
-              JSON.stringify(grant),
-              grant.issuedAt,
-              grant.issuedUnderPolicyVersion,
-              grant.revision,
-              grant.status,
-            ],
-          ),
-      );
-      return result.rowCount === 1;
-    },
-    async read(delegationId) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query<{ grantJson: DelegationGrant<${pascalName}AuthorizationAction> }>(
-            \`SELECT grant_json AS "grantJson"
-             FROM delegation_grants
-             WHERE id = $1::uuid\`,
-            [delegationId],
-          ),
-      );
-      return result.rows[0]?.grantJson;
-    },
-    async write(delegationId, expectedRevision, grant) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query(
-            \`UPDATE delegation_grants
-             SET capability_digest = $3,
-                 expires_at = $4,
-                 grant_json = $5::jsonb,
-                 policy_version = $6,
-                 revision = $7,
-                 status = $8
-             WHERE id = $1::uuid AND revision = $2\`,
-            [
-              delegationId,
-              expectedRevision,
-              grant.capabilityDigest,
-              grant.expiresAt,
-              JSON.stringify(grant),
-              grant.issuedUnderPolicyVersion,
-              grant.revision,
-              grant.status,
-            ],
-          ),
-      );
-      return result.rowCount === 1;
-    },
-  };
-}
-
-export interface ${pascalName}ApprovalStore {
-  create(
-    request: ApprovalRequest<${pascalName}AuthorizationAction>,
-  ): Promise<boolean>;
-  read(
-    requestId: string,
-  ): Promise<ApprovalRequest<${pascalName}AuthorizationAction> | undefined>;
-  write(
-    requestId: string,
-    expectedRevision: number,
-    request: ApprovalRequest<${pascalName}AuthorizationAction>,
-  ): Promise<boolean>;
-}
-
-/**
- * Approval transitions are persisted with the same compare-and-set boundary
- * used by delegation, so two reviewers or executors cannot claim one request.
- */
-export function create${pascalName}ApprovalStore(
-  correlationId: string,
-): ${pascalName}ApprovalStore {
-  return {
-    async create(request) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query(
-            \`INSERT INTO approval_requests
-               (id, author_reference, expires_at, policy_version,
-                request_digest, request_json, revision, status)
-             VALUES ($1::uuid, $2, $3, $4, $5, $6::jsonb, $7, $8)
-             ON CONFLICT (id) DO NOTHING\`,
-            [
-              request.id,
-              request.author.effectiveHumanId ?? request.author.actorId,
-              request.expiresAt,
-              request.policyVersion,
-              request.requestDigest,
-              JSON.stringify(request),
-              request.revision,
-              request.status,
-            ],
-          ),
-      );
-      return result.rowCount === 1;
-    },
-    async read(requestId) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query<{ requestJson: ApprovalRequest<${pascalName}AuthorizationAction> }>(
-            \`SELECT request_json AS "requestJson"
-             FROM approval_requests
-             WHERE id = $1::uuid\`,
-            [requestId],
-          ),
-      );
-      return result.rows[0]?.requestJson;
-    },
-    async write(requestId, expectedRevision, request) {
-      const result = await withPrimaryDatabase(
-        { correlationId },
-        'api-database-records',
-        (client) =>
-          client.query(
-            \`UPDATE approval_requests
-             SET expires_at = $3,
-                 policy_version = $4,
-                 request_digest = $5,
-                 request_json = $6::jsonb,
-                 revision = $7,
-                 status = $8
-             WHERE id = $1::uuid AND revision = $2\`,
-            [
-              requestId,
-              expectedRevision,
-              request.expiresAt,
-              request.policyVersion,
-              request.requestDigest,
-              JSON.stringify(request),
-              request.revision,
-              request.status,
-            ],
-          ),
-      );
-      return result.rowCount === 1;
-    },
-  };
-}
-`,
+        'authorization/store.ts': (0, built_in_plan_authorization_storage_js_1.renderDynamoAuthorizationStore)(pascalName),
         'authorization/workflows.ts': `import { createHash } from 'node:crypto';
 import type { Principal } from '@empire-builder-kit/runtime/auth';
 import {
@@ -911,7 +715,7 @@ import {
 } from '@empire-builder-kit/runtime/authorization';
 import { RuntimeError } from '@empire-builder-kit/runtime/response';
 import { isBoundedSafeReference } from '@empire-builder-kit/runtime/safe-reference';
-import { withPrimaryDatabase } from '../database/runtime-client.js';
+import { readAuthorizationRecord, writeAuthorizationAudit } from './record-store.js';
 import {
   ${identifierPrefix}AuthorizationActions,
   ${identifierPrefix}AuthorizationPolicy,
@@ -1052,35 +856,23 @@ async function writeDelegationAudit(input: {
   recordId: string;
   reasonCategory: string;
 }): Promise<void> {
-  await withPrimaryDatabase(
-    { correlationId: input.correlationId },
-    'api-database-records',
-    (client) =>
-      client.query(
-        \`INSERT INTO authorization_audit
-           (action, approval_reference, authority_mode, correlation_id,
-            decision, delegation_reference, policy_version, principal_kind,
-            pseudonymous_subject_id, reason_category, resource_reference,
-            resource_type, slice, stage, subject_type)
-         VALUES ($1, NULL, $2, $3, $4, $5, $6, $7, $8, $9, $10,
-                 'record', $11, $12, $13)\`,
-        [
-          input.action,
-          input.principal.authority.mode,
-          input.correlationId,
-          input.decision.decision,
-          pseudonymousReference('delegation', input.delegationId),
-          input.decision.policyVersion,
-          input.principal.kind,
-          pseudonymousReference('subject', input.principal.actor.id),
-          input.reasonCategory,
-          pseudonymousReference('record', input.recordId),
-          '${name}',
-          stage(),
-          input.principal.actor.type,
-        ],
-      ),
-  );
+  await writeAuthorizationAudit({
+    action: input.action,
+    authorityMode: input.principal.authority.mode,
+    correlationId: input.correlationId,
+    decision: input.decision.decision,
+    delegationReference: pseudonymousReference('delegation', input.delegationId),
+    policyVersion: input.decision.policyVersion,
+    principalKind: input.principal.kind,
+    pseudonymousSubjectId: pseudonymousReference('subject', input.principal.actor.id),
+    reasonCategory: input.reasonCategory,
+    resourceReference: pseudonymousReference('record', input.recordId),
+    resourceType: 'record',
+    slice: '${name}',
+    stage: stage(),
+    subjectType: input.principal.actor.type,
+    timestamp: new Date().toISOString(),
+  }, 'api-database-records');
 }
 
 export async function issue${pascalName}RecordDelegation(input: {
@@ -1100,18 +892,8 @@ export async function issue${pascalName}RecordDelegation(input: {
   ) {
     invalidInput();
   }
-  const ownership = await withPrimaryDatabase(
-    { correlationId: input.correlationId },
-    'api-database-records',
-    (client) =>
-      client.query<{ ownerId: string }>(
-        \`SELECT owner_id AS "ownerId"
-         FROM records
-         WHERE id = $1::uuid\`,
-        [input.recordId],
-      ),
-  );
-  if (ownership.rows[0]?.ownerId !== input.principal.id) denied();
+  const ownership = await readAuthorizationRecord(input.correlationId, input.recordId);
+  if (ownership?.ownerId !== input.principal.id) denied();
   const delegator = createDirectAuthorizationPrincipal(input.principal);
   let issued: IssuedDelegation<${pascalName}AuthorizationAction>;
   try {
@@ -1183,20 +965,10 @@ export async function use${pascalName}RecordDelegation(input: {
   } catch {
     denied();
   }
-  const owner = await withPrimaryDatabase(
-    { correlationId: input.correlationId },
-    'api-database-records',
-    (client) =>
-      client.query<{ ownerId: string }>(
-        \`SELECT owner_id AS "ownerId"
-         FROM records
-         WHERE id = $1::uuid\`,
-        [input.recordId],
-      ),
-  );
+  const owner = await readAuthorizationRecord(input.correlationId, input.recordId);
   const resource = {
     attributes: {
-      ownerId: owner.rows[0]?.ownerId ?? 'missing-resource-owner',
+      ownerId: owner?.ownerId ?? 'missing-resource-owner',
     },
     id: input.recordId,
     type: 'record' as const,
@@ -1246,20 +1018,11 @@ export async function use${pascalName}RecordDelegation(input: {
         : result.decision.category,
   });
   assertAuthorizationAllowed(result.decision);
-  if (!result.grant || !owner.rows[0]) notFound();
-
-  const record = await withPrimaryDatabase(
-    { correlationId: input.correlationId },
-    'api-database-records',
-    (client) =>
-      client.query<RecordResult>(
-        \`SELECT id::text, name, run_scope AS "runScope"
-         FROM records
-         WHERE id = $1::uuid AND owner_id = $2\`,
-        [input.recordId, result.grant?.delegator.id],
-      ),
-  );
-  return record.rows[0] ?? notFound();
+  if (!result.grant || !owner) notFound();
+
+  const record = await readAuthorizationRecord(input.correlationId, input.recordId, result.grant.delegator.id);
+  if (!record) notFound();
+  return { id: record.id, name: record.name, runScope: record.runScope };
 }
 
 function grantMatchesRecord(

package/src/generators/slice/built-in-plan-authorization-infrastructure-files.js

@@ -229,7 +229,58 @@ def handler(event,context):
 function renderStandardSliceAuthorizationInfrastructureFiles(name, pascalName) {
     return {
         'authorization/machine-client-provisioner.py': MACHINE_CLIENT_PROVISIONER_SOURCE,
+        'pyproject.toml': `[project]
+name = "ebk-${name}-python-runtime"
+version = "0.0.0"
+requires-python = ">=3.12"
+dependencies = []
+
+[tool.uv]
+package = false
+`,
+        'uv.lock': `version = 1
+revision = 3
+requires-python = ">=3.12"
+
+[[package]]
+name = "ebk-${name}-python-runtime"
+version = "0.0.0"
+source = { virtual = "." }
+`,
+        'authorization/groups.mjs': `/** Exact physical Cognito identities; product policy keeps its logical roles. */
+export function sliceAuthorizationGroupNames(stage) {
+  if (['development', 'staging', 'production'].includes(stage)) {
+    return { admin: '${name}-admin', testWriter: '${name}-test-writer' };
+  }
+  if (!/^personal-[a-f0-9]{24}$/.test(stage)) {
+    throw new Error('Slice authorization requires a canonical or exact task stage.');
+  }
+  return {
+    admin: '${name}-' + stage + '-admin',
+    testWriter: '${name}-' + stage + '-test-writer',
+  };
+}
+
+export function sliceAuthorizationRoles(stage, roles) {
+  const groups = sliceAuthorizationGroupNames(stage);
+  if (groups.admin === '${name}-admin') return [...roles];
+  // Canonical claims must not grant task authority. Never strip a foreign
+  // task suffix: only this task's exact physical names become logical roles.
+  return roles
+    .filter((role) => role !== '${name}-admin' && role !== '${name}-test-writer')
+    .map((role) => role === groups.admin
+      ? '${name}-admin'
+      : role === groups.testWriter ? '${name}-test-writer' : role);
+}
+`,
+        'authorization/groups.d.mts': `export function sliceAuthorizationGroupNames(stage: string): {
+  admin: string;
+  testWriter: string;
+};
+export function sliceAuthorizationRoles(stage: string, roles: readonly string[]): string[];
+`,
         'infra/authorization.ts': `import { createHash } from 'node:crypto';
+import { sliceAuthorizationGroupNames } from '../authorization/groups.mjs';
 
 const MACHINE_AUTHORIZATION_SCOPE_NAMES = [
   'delegation-use',
@@ -326,6 +377,7 @@ export function createStandardSliceMachineAuthorization(
     options.credentialGeneration,
   );
   const resourceServerIdentifier = '${name}-' + $app.stage;
+  const groups = sliceAuthorizationGroupNames($app.stage);
   const template = {
     AWSTemplateFormatVersion: '2010-09-09',
     Description:
@@ -351,7 +403,7 @@ export function createStandardSliceMachineAuthorization(
         Properties: {
           Description:
             'Direct human recovery and non-author review authority for ${name}.',
-          GroupName: '${name}-admin',
+          GroupName: groups.admin,
           Precedence: 10,
           UserPoolId: { Ref: 'UserPoolId' },
         },
@@ -361,7 +413,7 @@ export function createStandardSliceMachineAuthorization(
         Properties: {
           Description:
             'Run-scoped synthetic-write authority for ${name} deployed proof.',
-          GroupName: '${name}-test-writer',
+          GroupName: groups.testWriter,
           Precedence: 20,
           UserPoolId: { Ref: 'UserPoolId' },
         },
@@ -373,8 +425,10 @@ export function createStandardSliceMachineAuthorization(
             'EBK generated ${name} confidential machine-client credential.',
           Name: { Ref: 'SecretName' },
           Tags: [
+            { Key: 'ebk:managed-by', Value: 'empire-builder-kit' },
             { Key: 'ebk:management', Value: 'generated-machine-credential' },
             { Key: 'ebk:slice', Value: '${name}' },
+            { Key: 'ebk:stage', Value: $app.stage },
             { Key: 'sst:stage', Value: $app.stage },
           ],
         },
@@ -459,6 +513,10 @@ export function createStandardSliceMachineAuthorization(
           '/${name}/authorization/machine-client',
         UserPoolId: options.userPoolId,
       },
+      tags: {
+        'ebk:managed-by': 'empire-builder-kit',
+        'ebk:stage': $app.stage,
+      },
       templateBody: JSON.stringify(template),
     },
   );

package/src/generators/slice/built-in-plan-authorization-storage.d.ts

@@ -0,0 +1,3 @@
+/** Storage mechanics stay generated; policy, features and delegation decisions stay seeded. */
+export declare function renderAuthorizationRecordStore(): string;
+export declare function renderDynamoAuthorizationStore(pascalName: string): string;