@izara_project/izara-core-generate-service-code 1.0.83 → 1.0.85

package/src/emit/crud/templates/CreateLogicalLib.ejs

@@ -61,11 +61,1089 @@ const PREFIX = {
   CREATE_OBJECT_EXTERNAL_TOPIC: 'CreateExternalTopicEndpoint'
 };
 
+// ── 1. Create_Main Helpers ───────────────────────────────────────────────────
+
+/**
+ * Loads ObjectSchema and resolves submittedByUserId and targetIdentifiers
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} requestParams - Incoming request parameters
+ * @param {Array<string>} errorsFound - Array to collect validation errors
+ * @returns {Promise<{ objType: string, objectSchema: Object }>}
+ */
+export async function resolveSchemaAndIdentity(_izContext, requestParams, errorsFound) {
+  const objType = createObjType(requestParams.objectType);
+  const objectSchema = await getObjectSchema.getObjSchemaS3WithHierarchy(
+    _izContext,
+    objType
+  );
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] objectSchema:`, objectSchema);
+
+  let submittedByUserId, targetIdentifiers;
+  if (
+    objectSchema.generatedBy === 'user' ||
+    objectSchema.generatedBy === 'systemWithUser'
+  ) {
+    submittedByUserId =
+      requestParams.submittedByUserId ||
+      _izContext.correlationIds.get(coreConsts.SUBMITTED_BY_USER_ID);
+
+    targetIdentifiers = requestParams.targetIdentifiers;
+
+    if (!targetIdentifiers && submittedByUserId) {
+      targetIdentifiers = { submittedByUserId };
+    }
+
+    if (!submittedByUserId) errorsFound.push('Not have submittedByUserId');
+    if (objectSchema.hasOwnProperty('belongTo') && !targetIdentifiers)
+      errorsFound.push('not have targetIdentifiers');
+
+    if (targetIdentifiers) {
+      if (!targetIdentifiers.submittedByUserId && submittedByUserId) {
+        targetIdentifiers.submittedByUserId = submittedByUserId;
+      }
+
+      if (Array.isArray(objectSchema.identifiers)) {
+        for (const identifier of objectSchema.identifiers) {
+          if (identifier.fieldName) {
+            if (targetIdentifiers[identifier.fieldName] === undefined) {
+              targetIdentifiers[identifier.fieldName] = null;
+            }
+          } else if (Array.isArray(identifier.fieldNames)) {
+            for (const fn of identifier.fieldNames) {
+              if (targetIdentifiers[fn] === undefined) {
+                targetIdentifiers[fn] = null;
+              }
+            }
+          } else if (identifier.name) {
+            if (targetIdentifiers[identifier.name] === undefined) {
+              targetIdentifiers[identifier.name] = null;
+            }
+          }
+        }
+      }
+
+      requestParams.targetIdentifiers = targetIdentifiers;
+    }
+
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Identity & Target Context Resolved:`, {
+      submittedByUserId: requestParams.submittedByUserId,
+      targetIdentifiers: requestParams.targetIdentifiers,
+      belongTo: objectSchema.belongTo,
+      generatedBy: objectSchema.generatedBy
+    });
+  } else if (objectSchema.generatedBy === 'searchResultGenerated') {
+    submittedByUserId = requestParams.submittedByUserId;
+  }
+
+  requestParams.submittedByUserId = submittedByUserId;
+  return { objType, objectSchema };
+}
+
+/**
+ * Resolves and generates primary identifiers for the object
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} objectSchemas - Combined object schema
+ * @param {Object} requestParams - Incoming request parameters
+ * @returns {Promise<void>}
+ */
+export async function resolveAndGenerateIdentifiers(_izContext, objectSchemas, requestParams) {
+  const identifiers = await createIdentifiersByUseCase(
+    _izContext,
+    objectSchemas,
+    requestParams.fieldNames
+  );
+
+  for (const [key, value] of Object.entries(identifiers)) {
+    if (!requestParams.fieldNames.hasOwnProperty(key)) {
+      requestParams.fieldNames[key] = value;
+    }
+  }
+
+  _izContext.logger.debug(
+    `[${process.env.iz_serviceTag}:<%- flowTag %>] Identifiers generated:`,
+    identifiers
+  );
+}
+
 /**
- * Core logical processing library
+ * Validates request field names against schema definition
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} objectSchemas - Combined object schema
+ * @param {Object} requestParams - Incoming request parameters
+ * @param {Array<string>} errorsFound - Array to collect validation errors
+ */
+export function validateFieldNames(_izContext, objectSchemas, requestParams, errorsFound) {
+  const invalidFieldNames = [];
+  for (const fieldName of Object.keys(requestParams.fieldNames || {})) {
+    if (!objectSchemas.fieldNames.includes(fieldName)) {
+      invalidFieldNames.push(fieldName);
+    }
+  }
+
+  if (invalidFieldNames.length > 0) {
+    errorsFound.push(
+      `Invalid fieldName not match from Schema: ${invalidFieldNames.join(',')}`
+    );
+  }
+}
+
+// ── 2. CreateRbacCallback_Main Helpers ────────────────────────────────────────
+
+/**
+ * Checks awaiting steps status and collects returned results from App and Target RBAC
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} requestParams - Request parameters with parentFlowId
+ * @returns {Promise<{ isComplete: boolean, rbacResults?: Object, originalRequestParams?: Object, collectedErrors?: Array<string> }>}
+ */
+export async function collectRbacAwaitingResults(_izContext, requestParams) {
+  const parts = requestParams.parentFlowId.split('_');
+  const rbacType = parts.pop();
+  const rbacPendingStepId = '<%- flowTag %>RbacCallback_' + parts.join('_');
+  const currentAwaitingStepId = requestParams.parentFlowId;
+
+  _izContext.logger.debug(
+    '[<%- flowTag %>RbacCallbackMain] Parsed RBAC pending details:',
+    {
+      rbacType,
+      rbacPendingStepId,
+      currentAwaitingStepId,
+      parentFlowId: requestParams.parentFlowId
+    }
+  );
+
+  const rbacAwaitingStepsResult =
+    await asyncFlowSharedLib.checkAllAwaitingStepsFinishedWithReturnParams(
+      _izContext,
+      rbacPendingStepId,
+      currentAwaitingStepId,
+      requestParams.errorsFound,
+      {
+        returnValue: requestParams.returnValue,
+        rbacType
+      }
+    );
+
+  _izContext.logger.debug(
+    '[<%- flowTag %>RbacCallbackMain] checkAllAwaitingStepsFinishedWithReturnParams result:',
+    {
+      rbacAwaitingStepsResult
+    }
+  );
+
+  const {
+    isComplete,
+    collectedReturnValueByAwaitingStepId,
+    collectedErrors: errorsFound = [],
+    additionalAttributes
+  } = rbacAwaitingStepsResult;
+
+  if (isComplete === false) {
+    _izContext.logger.debug(
+      '[<%- flowTag %>RbacCallbackMain] Awaiting steps still pending completion:',
+      {
+        rbacPendingStepId,
+        isComplete
+      }
+    );
+    return { isComplete: false };
+  }
+
+  _izContext.logger.debug(
+    '[<%- flowTag %>RbacCallbackMain] All awaiting steps completed — clearing awaiting steps:',
+    {
+      rbacPendingStepId
+    }
+  );
+
+  await asyncFlowSharedLib.clearAllAwaitingSteps(
+    _izContext,
+    rbacPendingStepId
+  );
+
+  const originalRequestParams = additionalAttributes?.requestParams || {};
+  const rbacResults = Object.fromEntries(
+    Object.entries(collectedReturnValueByAwaitingStepId || {}).map(
+      ([stepId, attrs]) => {
+        const type = stepId.split('_').pop();
+        return [type, attrs];
+      }
+    )
+  );
+
+  return {
+    isComplete: true,
+    rbacResults,
+    originalRequestParams,
+    collectedErrors: errorsFound
+  };
+}
+
+/**
+ * Asserts RBAC permission and publishes rejected response if unauthorized
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} options - Validation options
+ * @returns {Promise<{ hasError: boolean, errorResult?: Object, rbacCallbackResults: Object }>}
+ */
+export async function assertRbacPermission(_izContext, { rbacResults, originalRequestParams, errorsFound }) {
+  const rbacCallbackResults = {};
+  const hasError = Object.entries(rbacResults).some(([type, result]) => {
+    if (result && result.error) {
+      errorsFound.push(result.error);
+      return true;
+    }
+    rbacCallbackResults[type] = result;
+    return false;
+  });
+
+  const isAllowed = Object.values(rbacCallbackResults).some(
+    item => item?.returnValue?.permission === true
+  );
+
+  if (!isAllowed) {
+    errorsFound.push('Permission denied');
+  }
+
+  _izContext.logger.debug(
+    '[<%- flowTag %>RbacCallbackMain] Final rbacCallbackResults before calling <%- flowTag %>MainLogical:',
+    {
+      rbacCallbackResults,
+      isAllowed,
+      errorsFound
+    }
+  );
+
+  if (hasError || errorsFound.length > 0) {
+    const errorResult = {
+      errorsFound,
+      status: 'rejected',
+      requestParams: originalRequestParams
+    };
+
+    _izContext.logger.debug(
+      '[<%- flowTag %>RbacCallbackMain] RBAC check failed, publishing rejected status:',
+      errorResult
+    );
+
+    await sns.publishAsync(_izContext, {
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        '<%- upperCaseFlowTag %>_Out',
+        process.env.iz_serviceTag
+      ),
+      Message: JSON.stringify(errorResult)
+    });
+
+    return { hasError: true, errorResult, rbacCallbackResults };
+  }
+
+  return { hasError: false, rbacCallbackResults };
+}
+
+// ── 3. CreateNodeCallback_Main Helpers ────────────────────────────────────────
+
+/**
+ * Saves DynamoDB records from listOfRecords
+ * @param {Object} _izContext - Izara context object
+ * @param {Array<Object>} listOfRecords - Records to persist
+ * @returns {Promise<void>}
+ */
+export async function saveDynamoDbRecords(_izContext, listOfRecords) {
+  if (!Array.isArray(listOfRecords) || listOfRecords.length === 0) {
+    return;
+  }
+
+  await Promise.all(
+    listOfRecords.flatMap((records) =>
+      Object.values(records).map(async (record) =>
+        dynamodbSharedLib.putItem(
+          _izContext,
+          await dynamodbSharedLib.tableName(
+            _izContext,
+            record.tableName,
+            record.serviceTag
+          ),
+          {
+            ...record.objInstanceFull.identifiers,
+            ...record.objInstanceFull.fields
+          }
+        )
+      )
+    )
+  );
+}
+
+/**
+ * Auto-provisions owner TargetRole for Root RBAC object after Graph and DynamoDB write
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} options - Target node and submitter details
+ * @returns {Promise<void>}
+ */
+export async function autoProvisionOwnerTargetRole(_izContext, { node, submittedByUserId }) {
+  try {
+    if (!submittedByUserId || !node?.objInstanceFull?.identifiers) {
+      return;
+    }
+
+    const identifiers = node.objInstanceFull.identifiers;
+    const targetIdentKeys = Object.entries(identifiers)
+      .filter(([k]) => k !== 'submittedByUserId')
+      .map(([k, v]) => `${k}#${v}`)
+      .join('|');
+
+    const targetIdentifiersConcat =
+      targetIdentKeys ||
+      (identifiers[Object.keys(identifiers)[0]]
+        ? `${Object.keys(identifiers)[0]}#${identifiers[Object.keys(identifiers)[0]]}`
+        : '');
+
+    if (!targetIdentifiersConcat) {
+      return;
+    }
+
+    const roleIdKey = `${targetIdentifiersConcat}_owner`;
+    _izContext.logger.debug(
+      '[CreateNodeCallback] Auto-provisioning owner TargetRole:',
+      {
+        identifiersConcat: targetIdentifiersConcat,
+        roleIdKey,
+        submittedByUserId,
+        roleName: 'owner'
+      }
+    );
+
+    await dynamodbSharedLib.putItem(
+      _izContext,
+      dynamodbSharedLib.tableName(_izContext, 'TargetRoles'),
+      {
+        identifiersConcat: targetIdentifiersConcat,
+        roleIdKey,
+        submittedByUserId,
+        roleName: 'owner',
+        assignedAt: new Date().toISOString()
+      }
+    );
+
+    await dynamodbSharedLib.transactWriteItems(_izContext, [
+      {
+        action: 'put',
+        params: {
+          tableName: dynamodbSharedLib.tableName(
+            _izContext,
+            'RoleUsers'
+          ),
+          attributes: {
+            roleIdKey,
+            userId: submittedByUserId,
+            submittedByUserId
+          }
+        }
+      },
+      {
+        action: 'put',
+        params: {
+          tableName: dynamodbSharedLib.tableName(
+            _izContext,
+            'UserRoles'
+          ),
+          attributes: {
+            userId: submittedByUserId,
+            roleIdKey,
+            submittedByUserId
+          }
+        }
+      },
+      {
+        action: 'put',
+        params: {
+          tableName: dynamodbSharedLib.tableName(
+            _izContext,
+            'RolePermissions'
+          ),
+          attributes: {
+            roleIdKey,
+            flowTypeConcat: `${process.env.iz_serviceTag}_Update`,
+            permission: true,
+            allow: 'accept',
+            parameterGroups: {},
+            submittedByUserId
+          }
+        }
+      },
+      {
+        action: 'put',
+        params: {
+          tableName: dynamodbSharedLib.tableName(
+            _izContext,
+            'RolePermissions'
+          ),
+          attributes: {
+            roleIdKey,
+            flowTypeConcat: `${process.env.iz_serviceTag}_Delete`,
+            permission: true,
+            allow: 'accept',
+            parameterGroups: {},
+            submittedByUserId
+          }
+        }
+      }
+    ]);
+  } catch (roleError) {
+    _izContext.logger.error(
+      '[CreateNodeCallback] Failed to auto-provision owner TargetRole:',
+      { roleError }
+    );
+  }
+}
+
+/**
+ * Resolves keys and identifiers for Quota Deduction / Confirmation
+ * @param {Object} requestParams - Request parameters
+ * @param {Object} passBackProperties - Pass back properties
+ * @param {Object} returnValue - Return value from graph service
+ * @param {Object} callingFlowConfig - Calling flow configuration
+ * @param {Object} _izContext - Izara context object
+ * @returns {Object} Quota deduction keys
+ */
+export function resolveQuotaDeductionKeys(
+  requestParams,
+  passBackProperties,
+  returnValue,
+  callingFlowConfig,
+  _izContext
+) {
+  const targetIdentifiers =
+    requestParams?.passBackProperties?.targetIdentifiers ||
+    passBackProperties?.passBackProperties?.targetIdentifiers ||
+    passBackProperties?.targetIdentifiers ||
+    returnValue?.requestParams?.targetIdentifiers;
+
+  const submittedByUserId =
+    returnValue?.requestParams?.submittedByUserId ||
+    targetIdentifiers?.submittedByUserId ||
+    requestParams?.submittedByUserId ||
+    requestParams?.passBackProperties?.submittedByUserId ||
+    passBackProperties?.passBackProperties?.submittedByUserId ||
+    passBackProperties?.submittedByUserId ||
+    _izContext.correlationIds?.get(coreConsts.SUBMITTED_BY_USER_ID) ||
+    _izContext.correlationIds?.get('submittedByUserId') ||
+    _izContext.correlationIds?.get('userId');
+
+  let identifiersConcat =
+    requestParams?.passBackProperties?.identifiersConcat ||
+    passBackProperties?.passBackProperties?.identifiersConcat ||
+    passBackProperties?.identifiersConcat ||
+    null;
+
+  if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
+    if (targetIdentifiers.identifierConcat) {
+      identifiersConcat = targetIdentifiers.identifierConcat;
+    } else {
+      const sortedKeys = Object.keys(targetIdentifiers).sort();
+      const parts = [];
+      for (const key of sortedKeys) {
+        const value = targetIdentifiers[key];
+        if (
+          key !== 'submittedByUserId' &&
+          key !== 'identifierConcat' &&
+          value !== undefined &&
+          value !== null
+        ) {
+          parts.push(`${key}#${value}`);
+        }
+      }
+      if (parts.length > 0) {
+        identifiersConcat = parts.join('|');
+      }
+    }
+  }
+  if (!identifiersConcat) {
+    identifiersConcat = submittedByUserId;
+  }
+
+  const limitTag =
+    requestParams?.passBackProperties?.limitTag ||
+    passBackProperties?.passBackProperties?.limitTag ||
+    passBackProperties?.limitTag ||
+    callingFlowConfig?.limitTag ||
+    requestParams?.passBackProperties?.flowTypeConcat ||
+    passBackProperties?.passBackProperties?.flowTypeConcat ||
+    passBackProperties?.flowTypeConcat ||
+    callingFlowConfig?.flowTypeConcat ||
+    `${process.env.iz_serviceTag}_<%- flowTag %>`;
+
+  const flowTypeConcat = limitTag;
+
+  const uniqueIdentify =
+    requestParams?.passBackProperties?.uniqueIdentify ||
+    passBackProperties?.passBackProperties?.uniqueIdentify ||
+    passBackProperties?.uniqueIdentify ||
+    callingFlowConfig?.uniqueIdentify ||
+    _izContext.uniqueRequestId;
+
+  const usedTimestampId = uniqueIdentify;
+
+  const runningTotalReservedId =
+    requestParams?.passBackProperties?.runningTotalReservedId ||
+    passBackProperties?.passBackProperties?.runningTotalReservedId ||
+    passBackProperties?.runningTotalReservedId ||
+    callingFlowConfig?.runningTotalReservedId ||
+    (identifiersConcat && limitTag
+      ? `${identifiersConcat}_${limitTag}`
+      : null);
+
+  const rbacType =
+    requestParams?.passBackProperties?.rbacType ||
+    passBackProperties?.passBackProperties?.rbacType ||
+    passBackProperties?.rbacType ||
+    callingFlowConfig?.rbacType;
+
+  return {
+    limitTag,
+    flowTypeConcat,
+    uniqueIdentify,
+    usedTimestampId,
+    runningTotalReservedId,
+    identifiersConcat,
+    targetIdentifiers,
+    rbacType
+  };
+}
+
+/**
+ * Forwards quota confirmation message to ConfirmUsage_In or CancelUsage_In
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} options - Message forwarding options
+ * @returns {Promise<void>}
+ */
+export async function forwardToQuotaConfirmation(
+  _izContext,
+  {
+    status,
+    errorsFound,
+    quotaKeys,
+    actionData,
+    callingFlowConfig
+  }
+) {
+  const nextTargetTopic =
+    status === 'complete' && errorsFound.length === 0
+      ? 'ConfirmUsage_In'
+      : 'CancelUsage_In';
+
+  const forwardMessage =
+    callingFlowSharedLib.addCallingFlowToSnsRequestMessageObject(
+      {
+        ...quotaKeys,
+        parentPassBackProperties: actionData
+      },
+      callingFlowSharedLib.addParentCallingFlowConfig(
+        callingFlowConfig,
+        callingFlowSharedLib.createCallingFlowConfig(
+          await lambdaSharedLib.lambdaFunctionName(
+            _izContext,
+            'CreateCompleteHdrSqs'
+          ),
+          {}
+        )
+      )
+    );
+
+  const topicArn = snsSharedLib.snsTopicArnByFlowSchema(
+    _izContext,
+    nextTargetTopic,
+    'Rbac'
+  );
+
+  _izContext.logger.debug('[CreateNodeCallback] forwarding to RBAC', {
+    nextTargetTopic,
+    TopicArn: topicArn,
+    forwardMessage
+  });
+
+  await sns.publishAsync(_izContext, {
+    Message: JSON.stringify(forwardMessage),
+    TopicArn: topicArn
+  });
+}
+
+// ── 4. CreateComplete_Main Helpers ───────────────────────────────────────────
+
+/**
+ * Builds response payload and message attributes for Calling Flow
+ * @param {Object} callingFlowConfig - Calling flow configuration
+ * @param {Object} parentPassBack - Parent pass-back data
+ * @returns {{ message: Object, messageAttributes: Object }}
+ */
+export function buildCompletionPayload(callingFlowConfig, parentPassBack) {
+  const message =
+    callingFlowSharedLib.addParentPassBackPropertiesToSnsResponseMessageObject(
+      callingFlowConfig,
+      parentPassBack
+    );
+
+  const messageAttributes =
+    callingFlowSharedLib.addParentPassBackCallingFlowToSnsResponseMessageAttributes(
+      callingFlowConfig,
+      {}
+    );
+
+  return { message, messageAttributes };
+}
+
+/**
+ * Publishes completion response message to outCreateNodeComplete
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} message - SNS message payload
+ * @param {Object} messageAttributes - SNS message attributes
+ * @returns {Promise<void>}
+ */
+export async function publishCompletionMessage(_izContext, message, messageAttributes) {
+  const topicArn = snsSharedLib.snsTopicArnByFlowSchema(
+    _izContext,
+    TOPIC_NAME_GENERATE_CODE.outCreateNodeComplete
+  );
+
+  _izContext.logger.debug('[CreateComplete] publishing to SNS', {
+    TopicArn: topicArn,
+    message
+  });
+
+  await sns.publishAsync(_izContext, {
+    Message: JSON.stringify(message),
+    MessageAttributes: sns.createStringMessageAttributes(
+      _izContext,
+      messageAttributes
+    ),
+    TopicArn: topicArn
+  });
+}
+
+// ── 5. CreateLogicalLib Internal Helpers ──────────────────────────────────────
+
+/**
+ * Resolves and combines object schemas from S3/hierarchy
+ * @param {Object} _izContext - Izara context object
+ * @param {string} objectType - Object type identifier
+ * @returns {Promise<{ objType: Object, objectSchema: Object, objectSchemas: Object, parentObject?: Object }>}
+ */
+export async function resolveObjectSchemas(_izContext, objectType) {
+  const objType = createObjType(objectType);
+  const objectSchema = await getObjectSchema.getObjSchemaS3WithHierarchy(
+    _izContext,
+    objType
+  );
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] objectSchema:`, objectSchema);
+
+  const objectSchemas =
+    uploadUseCase.generateObjectSchemaForCombineFieldNames(
+      _izContext,
+      objectSchema
+    );
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] objectSchemas:`, objectSchemas);
+
+  let parentObject;
+  if (objectSchemas.hasOwnProperty('extendObjType')) {
+    parentObject = await getObjectSchema.getObjSchemaS3WithHierarchy(
+      _izContext,
+      objectSchema.extendObjType
+    );
+  }
+
+  return { objType, objectSchema, objectSchemas, parentObject };
+}
+
+/**
+ * Extracts field values matching storage resource specifications
+ * @param {Object} _izContext - Izara context object
+ * @param {string} storageTag - Storage resource tag
+ * @param {Object} createDataDetails - Complete data details map
+ * @param {Object} createDataDetail - Current storage data detail
+ * @param {Object} requestParams - Request parameters
+ * @param {Object} objInstanceFull - Full object instance with identifiers
+ * @returns {Object} Extracted fields object
+ */
+export function extractFieldsByStorageTag(
+  _izContext,
+  storageTag,
+  createDataDetails,
+  createDataDetail,
+  requestParams,
+  objInstanceFull
+) {
+  const fields = {};
+  for (const fieldName of Object.keys(requestParams.fieldNames || {})) {
+    if (
+      createDataDetails[storageTag].fieldNames.includes(fieldName) &&
+      createDataDetail.fieldNames.includes(fieldName) &&
+      !objInstanceFull.identifiers.hasOwnProperty(fieldName) &&
+      !fields.hasOwnProperty(fieldName)
+    ) {
+      Object.assign(fields, {
+        [fieldName]: requestParams.fieldNames[fieldName]
+      });
+    }
+  }
+  return fields;
+}
+
+/**
+ * Auto-provisions owner TargetRole for DynamoDB-only objects (no Graph)
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} options - Schema and identity parameters
+ * @returns {Promise<void>}
+ */
+export async function autoProvisionOwnerTargetRoleForDynamoOnly(
+  _izContext,
+  { objectSchema, identifiersForCreateData, requestParams }
+) {
+  const hasRbacAddOn =
+    Array.isArray(objectSchema?.addOnDataStructure) &&
+    objectSchema.addOnDataStructure.some(addOn => addOn?.type === 'rbac');
+
+  const isRootRbacObject =
+    hasRbacAddOn &&
+    !objectSchema?.belongTo &&
+    objectSchema?.objectType !== 'user' &&
+    objectSchema?.generatedBy !== 'systemNoUser';
+
+  if (!isRootRbacObject) {
+    return;
+  }
+
+  try {
+    const submittedByUserId =
+      requestParams.submittedByUserId ||
+      _izContext.correlationIds?.get(coreConsts.SUBMITTED_BY_USER_ID);
+
+    if (submittedByUserId) {
+      const targetIdentKeys = Object.entries(identifiersForCreateData)
+        .map(([k, v]) => `${k}#${v}`)
+        .join('|');
+      const targetIdentifiersConcat =
+        targetIdentKeys ||
+        (identifiersForCreateData[Object.keys(identifiersForCreateData)[0]]
+          ? `${Object.keys(identifiersForCreateData)[0]}#${identifiersForCreateData[Object.keys(identifiersForCreateData)[0]]}`
+          : '');
+
+      if (targetIdentifiersConcat) {
+        const roleIdKey = `${targetIdentifiersConcat}_owner`;
+        _izContext.logger.debug(
+          '[<%- flowTag %>LogicalLib] Auto-provisioning owner TargetRole for DynamoDB-only:',
+          {
+            identifiersConcat: targetIdentifiersConcat,
+            roleIdKey,
+            submittedByUserId,
+            roleName: 'owner'
+          }
+        );
+
+        await dynamodbSharedLib.putItem(
+          _izContext,
+          dynamodbSharedLib.tableName(_izContext, 'TargetRoles'),
+          {
+            identifiersConcat: targetIdentifiersConcat,
+            roleIdKey,
+            submittedByUserId,
+            roleName: 'owner',
+            assignedAt: new Date().toISOString()
+          }
+        );
+
+        await dynamodbSharedLib.transactWriteItems(_izContext, [
+          {
+            action: 'put',
+            params: {
+              tableName: dynamodbSharedLib.tableName(
+                _izContext,
+                'RoleUsers'
+              ),
+              attributes: {
+                roleIdKey,
+                userId: submittedByUserId,
+                submittedByUserId
+              }
+            }
+          },
+          {
+            action: 'put',
+            params: {
+              tableName: dynamodbSharedLib.tableName(
+                _izContext,
+                'UserRoles'
+              ),
+              attributes: {
+                userId: submittedByUserId,
+                roleIdKey,
+                submittedByUserId
+              }
+            }
+          },
+          {
+            action: 'put',
+            params: {
+              tableName: dynamodbSharedLib.tableName(
+                _izContext,
+                'RolePermissions'
+              ),
+              attributes: {
+                roleIdKey,
+                flowTypeConcat: `${process.env.iz_serviceTag}_Update`,
+                permission: true,
+                allow: 'accept',
+                parameterGroups: {},
+                submittedByUserId
+              }
+            }
+          },
+          {
+            action: 'put',
+            params: {
+              tableName: dynamodbSharedLib.tableName(
+                _izContext,
+                'RolePermissions'
+              ),
+              attributes: {
+                roleIdKey,
+                flowTypeConcat: `${process.env.iz_serviceTag}_Delete`,
+                permission: true,
+                allow: 'accept',
+                parameterGroups: {},
+                submittedByUserId
+              }
+            }
+          }
+        ]);
+      }
+    }
+  } catch (roleError) {
+    _izContext.logger.error(
+      '[<%- flowTag %>LogicalLib] Failed to auto-provision owner TargetRole for DynamoDB-only:',
+      { roleError }
+    );
+  }
+}
+
+/**
+ * Resolves callback properties to attach to Graph dispatch message
+ * @param {Object} phaseResults - Results from previous phases
+ * @param {Object} requestParams - Request parameters
+ * @returns {Object} Formatted callback properties
+ */
+export function resolveCallbackRbacProperties(phaseResults, requestParams) {
+  const uniqueIdentify =
+    phaseResults?.uniqueIdentify ||
+    Object.values(phaseResults || {}).find(
+      (r) => r?.returnValue?.uniqueIdentify
+    )?.returnValue?.uniqueIdentify;
+
+  const rbacType =
+    phaseResults?.rbacType ||
+    phaseResults?.target?.rbacType ||
+    phaseResults?.target?.returnValue?.rbacType ||
+    phaseResults?.app?.rbacType ||
+    phaseResults?.app?.returnValue?.rbacType ||
+    Object.values(phaseResults || {}).find(
+      (r) => r?.rbacType || r?.returnValue?.rbacType
+    )?.rbacType;
+
+  return {
+    uniqueIdentify,
+    targetIdentifiers: requestParams?.targetIdentifiers,
+    rbacType,
+    phaseResults
+  };
+}
+
+/**
+ * Dispatches node creation request to Graph Service
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} options - Graph dispatch configuration
+ * @returns {Promise<void>}
+ */
+export async function dispatchToGraphEngine(
+  _izContext,
+  {
+    objType,
+    objectForCreate,
+    graphServiceName,
+    requestParams,
+    parentFlowId,
+    callingFlowConfig,
+    phaseResults
+  }
+) {
+  let messageObject = {
+    objType,
+    objInstanceFull: objectForCreate.objInstanceFull,
+    deepPathConditional: requestParams.deepPathConditional || [],
+    setFieldConditionals: requestParams.setFieldConditionals || [],
+    relationships: requestParams.relationships || [],
+    targetIdentifiers: requestParams.targetIdentifiers,
+    parentFlowId: parentFlowId,
+    settings: { updatePropertiesOnMatch: false },
+    originTimestamp: Date.now()
+  };
+
+  const callbackProps = resolveCallbackRbacProperties(
+    phaseResults,
+    requestParams
+  );
+
+  messageObject =
+    callingFlowSharedLib.addCallingFlowToSnsRequestMessageObject(
+      messageObject,
+      callingFlowSharedLib.addParentCallingFlowConfig(
+        callingFlowConfig,
+        callingFlowSharedLib.createCallingFlowConfig(
+          //(<callingFlowProperties>)
+          await lambdaSharedLib.lambdaFunctionName(
+            _izContext,
+<% if (plan.hasCreateNodeCallback) { -%>
+            'CreateNodeCallbackHdrSqs'
+<% } else { -%>
+            TOPIC_NAME_GENERATE_CODE.createNodeComplete
+<% } -%>
+          ),
+<% if (plan.hasCreateNodeCallback) { -%>
+          callbackProps
+<% } else { -%>
+          {}
+<% } -%>
+          //(</callingFlowProperties>)
+        )
+      )
+    );
+
+  _izContext.logger.debug(
+    `[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] message to graph:`,
+    {
+      graphServiceName,
+      messageObject
+    }
+  );
+
+  await sns.publishAsync(_izContext, {
+    Message: JSON.stringify(messageObject),
+    TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+      _izContext,
+      TOPIC_NAME_GRAPH_HANDLER.inCreateNode,
+      graphServiceName
+    )
+  });
+}
+
+/**
+ * Handles creation errors and publishes error response
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} options - Error context details
+ * @returns {Promise<Object>} Error status result
+ */
+export async function handleCreateError(
+  _izContext,
+  {
+    objType,
+    objInstanceFull,
+    requestParams,
+    callingFlowConfig,
+    errorsFound
+  }
+) {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] errorsFound:`, errorsFound);
+
+  await asyncFlowSharedLib.clearAllAwaitingSteps(
+    _izContext,
+    asyncFlowSharedLib.createPendingStepId(
+      _izContext.uniqueRequestId,
+      PREFIX.CREATE_OBJECT_ASYNC_COMPLETE
+    )
+  );
+
+  const messageObject =
+    callingFlowSharedLib.addPassBackPropertiesToSnsResponseMessageObject(
+      callingFlowConfig,
+      { objType, identifiers: null, errorsFound }
+    );
+
+  await sns.publishAsync(_izContext, {
+    Message: JSON.stringify(messageObject),
+    MessageAttributes: sns.createStringMessageAttributes(
+      _izContext,
+      callingFlowSharedLib.addCallingFlowToSnsResponseMessageAttributes(
+        callingFlowConfig,
+        {}
+      )
+    ),
+    TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+      _izContext,
+      TOPIC_NAME_GENERATE_CODE.outCreateNodeComplete
+    )
+  });
+
+  return {
+    objType,
+    objInstanceFull,
+    relationships: requestParams.relationships || [],
+    targetIdentifiers: requestParams.targetIdentifiers,
+    status: 'error',
+    errorsFound
+  };
+}
+
+/**
+ * Handles DynamoDB-only complete notification when no Graph callback is required
+ * @param {Object} _izContext - Izara context object
+ * @param {Object} options - Completion parameters
+ * @returns {Promise<void>}
+ */
+export async function handleDynamoDbOnlyComplete(
+  _izContext,
+  {
+    objType,
+    objInstanceFullForDynamoDb,
+    callingFlowConfig
+  }
+) {
+  const outMessage =
+    callingFlowSharedLib.addPassBackPropertiesToSnsResponseMessageObject(
+      callingFlowConfig,
+      {
+        objType: objType,
+        objInstanceFull: {
+          identifiers: objInstanceFullForDynamoDb.identifiers,
+          fields: objInstanceFullForDynamoDb.fields
+        }
+      }
+    );
+
+  if (
+    callingFlowConfig[callingFlowSharedLib.consts.CALLINGFLOW_PROPERTYNAME]
+  ) {
+    _izContext.logger.debug('HAVE CallingFlow');
+    await sns.publishAsync(_izContext, {
+      Message: JSON.stringify(outMessage),
+      MessageAttributes: sns.createStringMessageAttributes(
+        _izContext,
+        callingFlowSharedLib.addCallingFlowToSnsResponseMessageAttributes(
+          callingFlowConfig,
+          {}
+        )
+      ),
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        TOPIC_NAME_GENERATE_CODE.outCreateNodeComplete
+      )
+    });
+  }
+}
+
+// ── 6. Main Logical Function ──────────────────────────────────────────────────
+
+/**
+ * Core logical processing library for <%- flowTag %> flow
  * @param {Object} _izContext - Context object with logger
- * @param {Object} requestParams - { fieldNames, relationships[] }
+ * @param {Object} requestParams - Request parameters { fieldNames, relationships[] }
  * @param {Object} callingFlowConfig - Calling flow configuration
+ * @param {Array<string>} errorsFound - Array of preceding errors
  * @param {Object} phaseResults - Results from preceding phases
  * @returns {Promise<Object>} Result with objType, objInstanceFull, relationships, status, errorsFound
  */
@@ -77,56 +1155,33 @@ export async function <%- flowTag %>LogicalLib(
   phaseResults = {}
 ) {
   try {
-    _izContext.logger.debug('[<%- flowTag %>LogicalLib] started', {
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] started`, {
       requestParams,
       callingFlowConfig,
-      phaseResults
+      phaseResults,
+      targetIdentifiers: requestParams.targetIdentifiers
     });
 
     //(<beforeCreateMainLogical>)
     //(</beforeCreateMainLogical>)
 
-    const objType = createObjType(requestParams.objectType);
-
-    // ── Load schema ───────────────────────────────────────────────────────────
-    const objectSchema = await getObjectSchema.getObjSchemaS3WithHierarchy(
-      _izContext,
-      objType
-    );
-    _izContext.logger.debug('objectSchema', objectSchema);
+    // 1. Load and resolve Schema
+    const { objType, objectSchema, objectSchemas, parentObject } =
+      await resolveObjectSchemas(_izContext, requestParams.objectType);
 
-    const objectSchemas =
-      uploadUseCase.generateObjectSchemaForCombineFieldNames(
-        _izContext,
-        objectSchema
-      );
-    _izContext.logger.debug('objectSchemas', objectSchemas);
-
-    // ── Parent object ─────────────────────────────────────────────────────────
-    let parentObject;
-    if (objectSchemas.hasOwnProperty('extendObjType')) {
-      parentObject = await getObjectSchema.getObjSchemaS3WithHierarchy(
-        _izContext,
-        objectSchema.extendObjType
-      );
-    }
-
-    // ── Detect invocation type ────────────────────────────────────────────────
     const directInvoke =
       requestParams.hasOwnProperty('__context__') &&
       requestParams.izEventSource?.eventSourceTag === 'DirectInvoke';
 
-    // ── Build createDataDetails ───────────────────────────────────────────────
     const createDataDetails = await createDataDetailsLib(
       _izContext,
       objectSchemas
     );
-    _izContext.logger.debug('createDataDetails:', createDataDetails);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] createDataDetails:`, createDataDetails);
 
-    // ── Build objInstanceFull identifiers ─────────────────────────────────────
+    // 2. Prepare objInstanceFull
     const objInstanceFull = { identifiers: {}, fields: {} };
-
-    for (const fieldName of Object.keys(requestParams.fieldNames)) {
+    for (const fieldName of Object.keys(requestParams.fieldNames || {})) {
       if (objectSchemas.identifierFieldNames.includes(fieldName)) {
         Object.assign(objInstanceFull.identifiers, {
           [fieldName]: requestParams.fieldNames[fieldName]
@@ -134,29 +1189,6 @@ export async function <%- flowTag %>LogicalLib(
       }
     }
 
-    // ── Helper: extract fields per storageTag ─────────────────────────────────
-    function createObjInstanceFullFieldsByStorageTag(
-      _izContext,
-      storageTag,
-      createDataDetail
-    ) {
-      const fields = {};
-      for (const fieldName of Object.keys(requestParams.fieldNames)) {
-        if (
-          createDataDetails[storageTag].fieldNames.includes(fieldName) &&
-          createDataDetail.fieldNames.includes(fieldName) &&
-          !objInstanceFull.identifiers.hasOwnProperty(fieldName) &&
-          !fields.hasOwnProperty(fieldName)
-        ) {
-          Object.assign(fields, {
-            [fieldName]: requestParams.fieldNames[fieldName]
-          });
-        }
-      }
-      return fields;
-    }
-
-    // ── Process storage resources ─────────────────────────────────────────────
     const objInstanceFullForDynamoDb = structuredClone(objInstanceFull);
     const objInstanceFullForGraph = structuredClone(objInstanceFull);
     const objInstanceFullForExternalTopic = structuredClone(objInstanceFull);
@@ -165,19 +1197,22 @@ export async function <%- flowTag %>LogicalLib(
     const listOfObjectForCreates = [];
     const listOfRecords = [];
 
+    // 3. Process storage resources
     if (errorsFound.length === 0) {
       //(<validateBeforeCreate>)
       //(</validateBeforeCreate>)
 
-      for (const [storageTag, createDataDetail] of Object.entries(
-        createDataDetails
-      )) {
+      const hasGraphStorage = Object.values(createDataDetails).some(
+        (detail) => detail.storageType === consts.STORAGE_TYPES.graph
+      );
+
+      for (const [storageTag, createDataDetail] of Object.entries(createDataDetails)) {
         //(<beforeCreate>)
         //(</beforeCreate>)
 
-        // ── DynamoDB ──────────────────────────────────────────────────────────
+        // ── DynamoDB ──
         if (createDataDetail.storageType === consts.STORAGE_TYPES.dynamoDB) {
-          _izContext.logger.debug('::::::DynamoDB::::::', {
+          _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] DynamoDB:`, {
             storageTag,
             objInstanceFull
           });
@@ -196,18 +1231,16 @@ export async function <%- flowTag %>LogicalLib(
 
           Object.assign(
             objInstanceFullForDynamoDb.fields,
-            createObjInstanceFullFieldsByStorageTag(
+            extractFieldsByStorageTag(
               _izContext,
               storageTag,
-              createDataDetail
+              createDataDetails,
+              createDataDetail,
+              requestParams,
+              objInstanceFull
             )
           );
 
-          _izContext.logger.debug(
-            'objInstanceFull before create item in dynamoDB',
-            objInstanceFullForDynamoDb
-          );
-
           const identifiersForCreateData =
             await dynamoDbIdentifiersByStorageResource(
               _izContext,
@@ -215,20 +1248,11 @@ export async function <%- flowTag %>LogicalLib(
               createDataDetails,
               objInstanceFullForDynamoDb.identifiers
             );
-          _izContext.logger.debug(
-            'identifiersForCreateData',
-            identifiersForCreateData
-          );
 
           //(<beforeCreateRecordDynamo>)
           //(</beforeCreateRecordDynamo>)
 
-          if (
-            Object.values(createDataDetails).some(
-              (createDataDetail) =>
-                createDataDetail.storageType === consts.STORAGE_TYPES.graph
-            )
-          ) {
+          if (hasGraphStorage) {
             _izContext.logger.debug('must process graph first');
             listOfRecords.push({
               [storageTag]: {
@@ -256,34 +1280,39 @@ export async function <%- flowTag %>LogicalLib(
             );
 
             objInstanceFullForDynamoDb.fields = {};
+
+            // Auto-provision owner TargetRole for DynamoDB-only
+            await autoProvisionOwnerTargetRoleForDynamoOnly(_izContext, {
+              objectSchema,
+              identifiersForCreateData,
+              requestParams
+            });
           }
 
           //(<afterCreateRecordDynamo>)
           //(</afterCreateRecordDynamo>)
 
-          // ── Graph ─────────────────────────────────────────────────────────────
-        } else if (
-          createDataDetail.storageType === consts.STORAGE_TYPES.graph
-        ) {
+        // ── Graph ──
+        } else if (createDataDetail.storageType === consts.STORAGE_TYPES.graph) {
           //(<beforeCreateNode>)
           //(</beforeCreateNode>)
-          _izContext.logger.debug('::::::Graph::::::', {
+
+          _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] Graph:`, {
             storageTag,
             objInstanceFull
           });
 
           Object.assign(
             objInstanceFullForGraph.fields,
-            createObjInstanceFullFieldsByStorageTag(
+            extractFieldsByStorageTag(
               _izContext,
               storageTag,
-              createDataDetail
+              createDataDetails,
+              createDataDetail,
+              requestParams,
+              objInstanceFull
             )
           );
-          _izContext.logger.debug(
-            'objInstanceFull before send to Graph',
-            objInstanceFullForGraph
-          );
 
           //(<additionalAttributeCreateNode>)
           const additionalAttributes = {};
@@ -311,29 +1340,22 @@ export async function <%- flowTag %>LogicalLib(
             }
           });
 
-          // ── External Topic ────────────────────────────────────────────────────
-        } else if (
-          createDataDetail.storageType === consts.STORAGE_TYPES.externalTopic
-        ) {
-          _izContext.logger.debug('::::::externalTopic::::::', {
-            storageTag,
-            createDataDetail
-          });
+        // ── External Topic ──
+        } else if (createDataDetail.storageType === consts.STORAGE_TYPES.externalTopic) {
           //(<beforeSendMessageToExternalTopic>)
           //(</beforeSendMessageToExternalTopic>)
 
           Object.assign(
             objInstanceFullForExternalTopic.fields,
-            createObjInstanceFullFieldsByStorageTag(
+            extractFieldsByStorageTag(
               _izContext,
               storageTag,
-              createDataDetail
+              createDataDetails,
+              createDataDetail,
+              requestParams,
+              objInstanceFull
             )
           );
-          _izContext.logger.debug(
-            'objInstanceFull before send to external topic',
-            objInstanceFullForExternalTopic
-          );
 
           allAwaitingStepsId.push({
             awaitingStepId: await asyncFlowSharedLib.createAwaitingStepId(
@@ -355,9 +1377,8 @@ export async function <%- flowTag %>LogicalLib(
       }
     }
 
-    // ── Create awaiting multiple steps ────────────────────────────────────────
+    // 4. Create awaiting multiple steps
     if (allAwaitingStepsId.length > 0) {
-      _izContext.logger.debug('not api will create awaitingStep');
       await asyncFlowSharedLib.createAwaitingMultipleSteps(
         _izContext,
         asyncFlowSharedLib.createPendingStepId(
@@ -373,153 +1394,57 @@ export async function <%- flowTag %>LogicalLib(
       );
     }
 
-    // ── Process graph objects ─────────────────────────────────────────────────
-    let messageObject = {};
+    // 5. Dispatch to Graph Service
     for (const objectCreate of listOfObjectForCreates) {
-      for (const [graphServiceName, objectForCreate] of Object.entries(
-        objectCreate
-      )) {
-        _izContext.logger.debug('Loop each graph:', {
-          [graphServiceName]: objectForCreate
-        });
-
-        if (!objectForCreate.allStorageTagComplete) {
+      for (const [graphServiceName, objectForCreate] of Object.entries(objectCreate)) {
+        if (!objectForCreate.allStorageTagComplete && errorsFound.length === 0) {
           //(<beforeSendMessageToGraph>)
           //(</beforeSendMessageToGraph>)
-          messageObject = {
+
+          await dispatchToGraphEngine(_izContext, {
+            objType,
+            objectForCreate,
+            graphServiceName,
+            requestParams,
+            parentFlowId,
+            callingFlowConfig,
+            phaseResults
+          });
+
+          //(<afterSendMessageToGraph>)
+          //(</afterSendMessageToGraph>)
+
+          return {
             objType,
-            objInstanceFull: objectForCreate.objInstanceFull,
-            deepPathConditional: requestParams.deepPathConditional || [],
-            setFieldConditionals: requestParams.setFieldConditionals || [],
+            objInstanceFull: objInstanceFullForGraph,
             relationships: requestParams.relationships || [],
-            parentFlowId: parentFlowId
+            targetIdentifiers: requestParams.targetIdentifiers,
+            status: 'complete',
+            errorsFound
           };
         }
-
-        if (errorsFound.length > 0) break;
-
-        Object.assign(messageObject, {
-          settings: { updatePropertiesOnMatch: false },
-          originTimestamp: Date.now()
-        });
-
-        messageObject =
-          callingFlowSharedLib.addCallingFlowToSnsRequestMessageObject(
-            messageObject,
-            callingFlowSharedLib.addParentCallingFlowConfig(
-              callingFlowConfig,
-              callingFlowSharedLib.createCallingFlowConfig(
-                //(<callingFlowProperties>)
-                await lambdaSharedLib.lambdaFunctionName(
-                  _izContext,
-                  TOPIC_NAME_GENERATE_CODE.createNodeComplete
-                ),
-                {}
-                //(</callingFlowProperties>)
-              )
-            )
-          );
-
-        await sns.publishAsync(_izContext, {
-          Message: JSON.stringify(messageObject),
-          TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
-            _izContext,
-            TOPIC_NAME_GRAPH_HANDLER.inCreateNode,
-            graphServiceName
-          )
-        });
-
-        //(<afterSendMessageToGraph>)
-        //(</afterSendMessageToGraph>)
-        return {
-          objType,
-          objInstanceFull: objInstanceFullForGraph,
-          relationships: requestParams.relationships || [],
-          status: 'complete',
-          errorsFound
-        };
       }
       if (errorsFound.length > 0) break;
     }
 
-    // ── Handle errors ─────────────────────────────────────────────────────────
+    // 6. Handle Errors
     if (errorsFound.length > 0) {
-      _izContext.logger.debug('Case have errorsFound:::', errorsFound);
-
-      await asyncFlowSharedLib.clearAllAwaitingSteps(
-        _izContext,
-        asyncFlowSharedLib.createPendingStepId(
-          _izContext.uniqueRequestId,
-          PREFIX.CREATE_OBJECT_ASYNC_COMPLETE
-        )
-      );
-
-      messageObject =
-        callingFlowSharedLib.addPassBackPropertiesToSnsResponseMessageObject(
-          callingFlowConfig,
-          { objType, identifiers: null, errorsFound }
-        );
-
-      await sns.publishAsync(_izContext, {
-        Message: JSON.stringify(messageObject),
-        MessageAttributes: sns.createStringMessageAttributes(
-          _izContext,
-          callingFlowSharedLib.addCallingFlowToSnsResponseMessageAttributes(
-            callingFlowConfig,
-            {}
-          )
-        ),
-        TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
-          _izContext,
-          TOPIC_NAME_GENERATE_CODE.outCreateNodeComplete
-        )
-      });
-
-      return {
+      return await handleCreateError(_izContext, {
         objType,
         objInstanceFull,
-        relationships: requestParams.relationships || [],
-        status: 'error',
+        requestParams,
+        callingFlowConfig,
         errorsFound
-      };
+      });
     }
 
-    // ── DynamoDB-only complete path ───────────────────────────────────────────
-    if (
-      allAwaitingStepsId.length === 0 &&
-      listOfObjectForCreates.length === 0
-    ) {
-      const outMessage =
-        callingFlowSharedLib.addPassBackPropertiesToSnsResponseMessageObject(
-          callingFlowConfig,
-          {
-            objType: objType,
-            objInstanceFull: {
-              identifiers: objInstanceFullForDynamoDb.identifiers,
-              fields: objInstanceFullForDynamoDb.fields
-            }
-          }
-        );
-
-      if (
-        callingFlowConfig[callingFlowSharedLib.consts.CALLINGFLOW_PROPERTYNAME]
-      ) {
-        _izContext.logger.debug('HAVE CallingFlow');
-        await sns.publishAsync(_izContext, {
-          Message: JSON.stringify(outMessage),
-          MessageAttributes: sns.createStringMessageAttributes(
-            _izContext,
-            callingFlowSharedLib.addCallingFlowToSnsResponseMessageAttributes(
-              callingFlowConfig,
-              {}
-            )
-          ),
-          TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
-            _izContext,
-            TOPIC_NAME_GENERATE_CODE.outCreateNodeComplete
-          )
-        });
-      }
+    // 7. Handle DynamoDB-only Complete Path
+    if (allAwaitingStepsId.length === 0 && listOfObjectForCreates.length === 0) {
+      await handleDynamoDbOnlyComplete(_izContext, {
+        objType,
+        objInstanceFullForDynamoDb,
+        callingFlowConfig
+      });
     }
 
     return {
@@ -529,10 +1454,12 @@ export async function <%- flowTag %>LogicalLib(
         fields: objInstanceFullForDynamoDb.fields
       },
       relationships: requestParams.relationships || [],
+      targetIdentifiers: requestParams.targetIdentifiers,
       status: 'complete',
       errorsFound
     };
   } catch (err) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] error:`, err);
     throw err;
   }
 }