@empire-builder-kit/nx 1.0.0-beta.10

package/src/foundation/local-database-contract.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POSTGRES_IDENTIFIER_MAX_BYTES = void 0;
+exports.normalizePostgresIdentifier = normalizePostgresIdentifier;
+exports.postgresIdentifierByteLength = postgresIdentifierByteLength;
+exports.assertPostgresIdentifierLength = assertPostgresIdentifierLength;
+exports.resolveLogicalDatabaseIdentifiers = resolveLogicalDatabaseIdentifiers;
+exports.resolveLocalDatabaseContract = resolveLocalDatabaseContract;
+exports.POSTGRES_IDENTIFIER_MAX_BYTES = 63;
+function normalizePostgresIdentifier(input) {
+    const sanitized = input.replace(/[^A-Za-z0-9_]/g, '_');
+    return /^[A-Za-z_]/.test(sanitized) ? sanitized : `s_${sanitized}`;
+}
+function requireIdentifierInput(value, label) {
+    if (value.trim() === '') {
+        throw new Error(`${label} must be a non-empty string.`);
+    }
+}
+function postgresIdentifierByteLength(identifier) {
+    return new TextEncoder().encode(identifier).byteLength;
+}
+function assertPostgresIdentifierLength(identifier, label) {
+    const bytes = postgresIdentifierByteLength(identifier);
+    if (bytes > exports.POSTGRES_IDENTIFIER_MAX_BYTES) {
+        throw new Error(`${label} "${identifier}" is ${bytes} UTF-8 bytes; PostgreSQL identifiers must be ${exports.POSTGRES_IDENTIFIER_MAX_BYTES} bytes or fewer. Choose a shorter stage, Slice, or database identifier. Identifiers are never truncated.`);
+    }
+}
+function resolveLogicalDatabaseIdentifiers(options) {
+    requireIdentifierInput(options.stage, 'Consumer stage');
+    requireIdentifierInput(options.slice, 'Product Slice name');
+    requireIdentifierInput(options.database, 'Logical database identifier');
+    const database = normalizePostgresIdentifier(`${options.stage}_${options.slice}_${options.database}`);
+    const readwriteRole = `${database}_readwrite`;
+    const readonlyRole = `${database}_readonly`;
+    const localDatabase = normalizePostgresIdentifier(`${options.slice}_${options.database}`);
+    const localReadwriteRole = `${localDatabase}_readwrite`;
+    for (const [identifier, label] of [
+        [database, 'Physical database identifier'],
+        [readwriteRole, 'Physical read-write role identifier'],
+        [readonlyRole, 'Physical read-only role identifier'],
+        [localDatabase, 'Local database identifier'],
+        [localReadwriteRole, 'Local read-write role identifier'],
+    ]) {
+        assertPostgresIdentifierLength(identifier, label);
+    }
+    return {
+        database,
+        localDatabase,
+        localReadwriteRole,
+        readonlyRole,
+        readwriteRole,
+    };
+}
+function deterministicLocalDatabasePort(key) {
+    let hash = 5381;
+    for (let index = 0; index < key.length; index += 1) {
+        hash = (hash * 33) ^ key.charCodeAt(index);
+    }
+    return 54320 + (Math.abs(hash) % 100);
+}
+function resolveLocalDatabaseContract(options) {
+    const database = normalizePostgresIdentifier(`${options.slice}_${options.database}`);
+    const username = `${database}_readwrite`;
+    assertPostgresIdentifierLength(database, 'Local database identifier');
+    assertPostgresIdentifierLength(username, 'Local read-write role identifier');
+    return {
+        database,
+        host: '127.0.0.1',
+        password: options.password ?? `${options.slice}-local-dev`,
+        port: options.port ??
+            deterministicLocalDatabasePort(`${options.slice}_${options.database}`),
+        username,
+    };
+}
+//# sourceMappingURL=local-database-contract.js.map

package/src/foundation/local-database-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-database-contract.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/local-database-contract.ts"],"names":[],"mappings":";;;AAyBA,kEAGC;AAQD,oEAEC;AAED,wEAUC;AAED,8EAoCC;AAUD,oEAmBC;AAtGY,QAAA,6BAA6B,GAAG,EAAE,CAAC;AAUhD,SAAgB,2BAA2B,CAAC,KAAa;IACvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAgB,4BAA4B,CAAC,UAAkB;IAC7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC;AACzD,CAAC;AAED,SAAgB,8BAA8B,CAC5C,UAAkB,EAClB,KAAa;IAEb,MAAM,KAAK,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,KAAK,GAAG,qCAA6B,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,KAAK,UAAU,QAAQ,KAAK,gDAAgD,qCAA6B,0GAA0G,CAC5N,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,iCAAiC,CAAC,OAIjD;IACC,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACxD,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC5D,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CACxD,CAAC;IACF,MAAM,aAAa,GAAG,GAAG,QAAQ,YAAY,CAAC;IAC9C,MAAM,YAAY,GAAG,GAAG,QAAQ,WAAW,CAAC;IAC5C,MAAM,aAAa,GAAG,2BAA2B,CAC/C,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CACvC,CAAC;IACF,MAAM,kBAAkB,GAAG,GAAG,aAAa,YAAY,CAAC;IAExD,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI;QAChC,CAAC,QAAQ,EAAE,8BAA8B,CAAC;QAC1C,CAAC,aAAa,EAAE,qCAAqC,CAAC;QACtD,CAAC,YAAY,EAAE,oCAAoC,CAAC;QACpD,CAAC,aAAa,EAAE,2BAA2B,CAAC;QAC5C,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;KAChD,EAAE,CAAC;QACX,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,OAAO;QACL,QAAQ;QACR,aAAa;QACb,kBAAkB;QAClB,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,GAAW;IACjD,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,4BAA4B,CAC1C,OAAqC;IAErC,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CACvC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,YAAY,CAAC;IACzC,8BAA8B,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACtE,8BAA8B,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;IAE7E,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG,OAAO,CAAC,KAAK,YAAY;QAC1D,IAAI,EACF,OAAO,CAAC,IAAI;YACZ,8BAA8B,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACxE,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/src/foundation/preflight.d.ts

@@ -0,0 +1,31 @@
+import { type FoundationDiscovery } from './discovery.js';
+import { type FoundationRequirement } from './requirements.js';
+export interface FoundationParameterReadResult {
+    invalidNames: readonly string[];
+    values: ReadonlyMap<string, string | undefined>;
+}
+export type FoundationParameterReader = (names: readonly string[]) => Promise<FoundationParameterReadResult>;
+export interface FoundationPreflightReport {
+    consumerStage: string;
+    discovery?: FoundationDiscovery;
+    foundationStage: string;
+    issues: readonly string[];
+    ok: boolean;
+    region: string;
+    state: 'absent' | 'invalid' | 'ready';
+}
+export declare function createFoundationParameterReader(options: {
+    profile?: string;
+    region?: string;
+}): {
+    read: FoundationParameterReader;
+    resolveRegion: () => Promise<string>;
+};
+export declare function evaluateFoundationPreflight(options: {
+    consumerStage: string;
+    foundationStage?: string;
+    readParameters: FoundationParameterReader;
+    region: string;
+    requirement: FoundationRequirement;
+}): Promise<FoundationPreflightReport>;
+export declare function formatFoundationPreflightReport(report: FoundationPreflightReport): string;

package/src/foundation/preflight.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFoundationParameterReader = createFoundationParameterReader;
+exports.evaluateFoundationPreflight = evaluateFoundationPreflight;
+exports.formatFoundationPreflightReport = formatFoundationPreflightReport;
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const discovery_js_1 = require("./discovery.js");
+const requirements_js_1 = require("./requirements.js");
+const stages_js_1 = require("./stages.js");
+function chunks(values, size) {
+    const result = [];
+    for (let index = 0; index < values.length; index += size) {
+        result.push(values.slice(index, index + size));
+    }
+    return result;
+}
+function createFoundationParameterReader(options) {
+    const profile = options.profile?.trim();
+    const client = new client_ssm_1.SSMClient({
+        ...(profile ? { credentials: (0, credential_providers_1.fromIni)({ profile }), profile } : {}),
+        ...(options.region?.trim() ? { region: options.region.trim() } : {}),
+    });
+    return {
+        read: async (names) => {
+            const response = await client.send(new client_ssm_1.GetParametersCommand({ Names: [...names] }));
+            return {
+                invalidNames: response.InvalidParameters ?? [],
+                values: new Map((response.Parameters ?? []).map((parameter) => [
+                    parameter.Name ?? '',
+                    parameter.Value,
+                ])),
+            };
+        },
+        resolveRegion: () => client.config.region(),
+    };
+}
+async function evaluateFoundationPreflight(options) {
+    const { consumerStage, foundationStage } = (0, stages_js_1.resolveFoundationStages)(options);
+    const names = discovery_js_1.FOUNDATION_REQUIRED_SSM_KEYS.map((key) => (0, discovery_js_1.foundationSsmPath)(foundationStage, key));
+    const values = new Map();
+    const invalidNames = new Set();
+    for (const batch of chunks(names, 10)) {
+        const result = await options.readParameters(batch);
+        result.invalidNames.forEach((name) => invalidNames.add(name));
+        result.values.forEach((value, name) => values.set(name, value));
+    }
+    const issues = names
+        .filter((name) => invalidNames.has(name) || !values.get(name))
+        .map((name) => `missing required parameter ${name}`);
+    const allRequiredParametersMissing = names.every((name) => invalidNames.has(name) || !values.has(name));
+    const value = (key) => values.get((0, discovery_js_1.foundationSsmPath)(foundationStage, key)) ?? '';
+    const schemaVersion = Number(value('schemaVersion'));
+    if (schemaVersion !== discovery_js_1.FOUNDATION_SSM_SCHEMA_VERSION) {
+        issues.push(`Foundation discovery schema ${value('schemaVersion') || 'missing'} does not match ${discovery_js_1.FOUNDATION_SSM_SCHEMA_VERSION}`);
+    }
+    const capabilities = value('capabilities')
+        .split(',')
+        .map((capability) => capability.trim())
+        .filter(Boolean);
+    const compatibility = (0, requirements_js_1.validateFoundationCompatibility)(options.requirement, {
+        capabilities,
+        contractVersion: value('contractVersion'),
+    });
+    issues.push(...compatibility.issues.map((issue) => `${issue.path}: ${issue.message}`));
+    if (issues.length > 0 || !compatibility.valid) {
+        return {
+            consumerStage,
+            foundationStage,
+            issues: [...new Set(issues)],
+            ok: false,
+            region: options.region,
+            state: allRequiredParametersMissing ? 'absent' : 'invalid',
+        };
+    }
+    return {
+        discovery: {
+            alertTopicArn: value('alertTopicArn'),
+            capabilities: compatibility.value.capabilities,
+            clusterId: value('clusterId'),
+            contractVersion: compatibility.value.contractVersion,
+            databaseClusterArn: value('databaseClusterArn'),
+            databaseClusterId: value('databaseClusterId'),
+            databaseMasterSecretArn: value('databaseMasterSecretArn'),
+            eventBusArn: value('eventBusArn'),
+            eventBusName: value('eventBusName'),
+            hasPublicDomain: value('hasPublicDomain') === 'true',
+            identityUserPoolArn: value('identityUserPoolArn'),
+            identityUserPoolId: value('identityUserPoolId'),
+            rootDomain: value('rootDomain') === 'none' ? undefined : value('rootDomain'),
+            routerDistributionId: value('routerDistributionId'),
+            routerUrl: value('routerUrl'),
+            schemaVersion: discovery_js_1.FOUNDATION_SSM_SCHEMA_VERSION,
+            vpcId: value('vpcId'),
+        },
+        consumerStage,
+        foundationStage,
+        issues: [],
+        ok: true,
+        region: options.region,
+        state: 'ready',
+    };
+}
+function formatFoundationPreflightReport(report) {
+    const lines = [
+        `[foundation-preflight] consumerStage=${report.consumerStage} foundationStage=${report.foundationStage} region=${report.region}: ${report.ok ? 'ready' : 'NOT ready'}`,
+    ];
+    report.issues.forEach((issue) => lines.push(`  - ${issue}`));
+    if (!report.ok) {
+        lines.push(`  Deploy the Foundation first: pnpm nx run foundation:deploy --stage=${report.foundationStage}`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=preflight.js.map

package/src/foundation/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/preflight.ts"],"names":[],"mappings":";;AA0CA,0EA6BC;AAED,kEAuFC;AAED,0EAaC;AA/KD,oDAAsE;AACtE,wEAAwD;AACxD,iDAMwB;AACxB,uDAG2B;AAC3B,2CAAsD;AAqBtD,SAAS,MAAM,CAAI,MAAoB,EAAE,IAAY;IACnD,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,+BAA+B,CAAC,OAG/C;IAIC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACpB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,iCAAoB,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAChD,CAAC;YACF,OAAO;gBACL,YAAY,EAAE,QAAQ,CAAC,iBAAiB,IAAI,EAAE;gBAC9C,MAAM,EAAE,IAAI,GAAG,CACb,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;oBAC7C,SAAS,CAAC,IAAI,IAAI,EAAE;oBACpB,SAAS,CAAC,KAAK;iBAChB,CAAC,CACH;aACF,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,2BAA2B,CAAC,OAMjD;IACC,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,IAAA,mCAAuB,EAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,2CAA4B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACrD,IAAA,gCAAiB,EAAC,eAAe,EAAE,GAAG,CAAC,CACxC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,MAAM,GAAG,KAAK;SACjB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAC7D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,4BAA4B,GAAG,KAAK,CAAC,KAAK,CAC9C,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CACtD,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAqB,EAAE,EAAE,CACtC,MAAM,CAAC,GAAG,CAAC,IAAA,gCAAiB,EAAC,eAAe,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5D,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IACrD,IAAI,aAAa,KAAK,4CAA6B,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CACT,+BAA+B,KAAK,CAAC,eAAe,CAAC,IAAI,SAAS,mBAAmB,4CAA6B,EAAE,CACrH,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,cAAc,CAAC;SACvC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;SACtC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,aAAa,GAAG,IAAA,iDAA+B,EAAC,OAAO,CAAC,WAAW,EAAE;QACzE,YAAY;QACZ,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CACT,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAC1E,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC9C,OAAO;YACL,aAAa;YACb,eAAe;YACf,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,4BAA4B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE;YACT,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC;YACrC,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY;YAC9C,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC;YAC7B,eAAe,EAAE,aAAa,CAAC,KAAK,CAAC,eAAe;YACpD,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC;YAC/C,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,CAAC;YAC7C,uBAAuB,EAAE,KAAK,CAAC,yBAAyB,CAAC;YACzD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC;YACjC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC;YACnC,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC,KAAK,MAAM;YACpD,mBAAmB,EAAE,KAAK,CAAC,qBAAqB,CAAC;YACjD,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC;YAC/C,UAAU,EACR,KAAK,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YAClE,oBAAoB,EAAE,KAAK,CAAC,sBAAsB,CAAC;YACnD,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC;YAC7B,aAAa,EAAE,4CAA6B;YAC5C,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;SACtB;QACD,aAAa;QACb,eAAe;QACf,MAAM,EAAE,EAAE;QACV,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO;KACf,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAC7C,MAAiC;IAEjC,MAAM,KAAK,GAAG;QACZ,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;KACvK,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CACR,wEAAwE,MAAM,CAAC,eAAe,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/src/foundation/provision-database-bindings.d.ts

@@ -0,0 +1,30 @@
+import { type LogicalDatabaseIdentifiers } from './local-database-contract.js';
+import { type FoundationInfrastructure, type ProvisionLogicalDatabaseOptions, type ProvisionLogicalDatabaseResult } from './provision-logical-database.js';
+export interface DatabaseBinding {
+    active: string;
+    provisioned: readonly string[];
+}
+export type DatabaseBindingDeclaration = Readonly<Record<string, DatabaseBinding>>;
+export interface DatabaseBindingPlan {
+    active: Readonly<Record<string, string>>;
+    identifiers: Readonly<Record<string, LogicalDatabaseIdentifiers>>;
+    provisioned: readonly string[];
+}
+export interface ProvisionDatabaseBindingsOptions {
+    bindings: DatabaseBindingDeclaration;
+    localDev?: boolean;
+    localDevPassword?: string;
+    removalPolicy?: ProvisionLogicalDatabaseOptions['removalPolicy'];
+    rotationTokens?: Readonly<Record<string, string>>;
+    slice: string;
+}
+export type ProvisionedDatabaseBindings<TBindings extends DatabaseBindingDeclaration> = {
+    [TBinding in keyof TBindings]: ProvisionLogicalDatabaseResult;
+};
+export declare function createDatabaseBindingPlan(bindings: DatabaseBindingDeclaration, context: {
+    slice: string;
+    stage: string;
+}): DatabaseBindingPlan;
+export declare function provisionDatabaseBindings<TBindings extends DatabaseBindingDeclaration>(foundation: FoundationInfrastructure, options: ProvisionDatabaseBindingsOptions & {
+    bindings: TBindings;
+}): ProvisionedDatabaseBindings<TBindings>;

package/src/foundation/provision-database-bindings.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDatabaseBindingPlan = createDatabaseBindingPlan;
+exports.provisionDatabaseBindings = provisionDatabaseBindings;
+const local_database_contract_js_1 = require("./local-database-contract.js");
+const provision_logical_database_js_1 = require("./provision-logical-database.js");
+const databaseIdentifierPattern = /^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/;
+function collisionKey(value) {
+    return (0, local_database_contract_js_1.normalizePostgresIdentifier)(value).normalize('NFKC').toLowerCase();
+}
+function createDatabaseBindingPlan(bindings, context) {
+    if (typeof bindings !== 'object' ||
+        bindings === null ||
+        Array.isArray(bindings)) {
+        throw new Error('Database bindings must be an object.');
+    }
+    const entries = Object.entries(bindings);
+    if (entries.length === 0) {
+        throw new Error('Database bindings must declare at least one stable role.');
+    }
+    const active = {};
+    const identifiers = {};
+    const declared = new Set();
+    const normalized = new Map();
+    const componentNames = new Map();
+    for (const [role, binding] of entries) {
+        if (!/^[a-z][a-z0-9-]*$/.test(role)) {
+            throw new Error(`Database binding role "${role}" must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens.`);
+        }
+        if (typeof binding !== 'object' ||
+            binding === null ||
+            Array.isArray(binding)) {
+            throw new Error(`Database binding "${role}" must be an object.`);
+        }
+        const unexpectedMembers = Object.keys(binding).filter((key) => key !== 'active' && key !== 'provisioned');
+        if (unexpectedMembers.length > 0) {
+            throw new Error(`Database binding "${role}" contains unsupported member${unexpectedMembers.length === 1 ? '' : 's'}: ${unexpectedMembers.join(', ')}. Only active and provisioned are allowed.`);
+        }
+        if (typeof binding.active !== 'string' || binding.active.trim() === '') {
+            throw new Error(`Database binding "${role}" must select a non-empty active identifier.`);
+        }
+        if (!Array.isArray(binding.provisioned) ||
+            binding.provisioned.length === 0) {
+            throw new Error(`Database binding "${role}" must provision at least one identifier.`);
+        }
+        if (!binding.provisioned.includes(binding.active)) {
+            throw new Error(`Database binding "${role}" selects "${binding.active}", but that identifier is not provisioned.`);
+        }
+        active[role] = binding.active;
+        for (const identifier of binding.provisioned) {
+            if (typeof identifier !== 'string' || identifier.trim() === '') {
+                throw new Error(`Database binding "${role}" contains an invalid empty identifier.`);
+            }
+            if (!databaseIdentifierPattern.test(identifier)) {
+                throw new Error(`Database identifier "${identifier}" must start with a lowercase letter and contain only lowercase letters, numbers, single hyphens, or single underscores.`);
+            }
+            if (declared.has(identifier)) {
+                throw new Error(`Database identifier "${identifier}" is declared more than once. Each provisioned identifier must be unique across the binding set.`);
+            }
+            const resolved = (0, local_database_contract_js_1.resolveLogicalDatabaseIdentifiers)({
+                database: identifier,
+                slice: context.slice,
+                stage: context.stage,
+            });
+            const key = collisionKey(resolved.database);
+            const previous = normalized.get(key);
+            if (previous !== undefined) {
+                throw new Error(`Database identifiers "${previous}" and "${identifier}" collide after PostgreSQL normalization. Rename one identifier; EBK never truncates or aliases database bindings.`);
+            }
+            const componentName = (0, provision_logical_database_js_1.defaultDatabaseLinkableName)(context.slice, identifier);
+            const previousComponent = componentNames.get(componentName);
+            if (previousComponent !== undefined) {
+                throw new Error(`Database identifiers "${previousComponent}" and "${identifier}" collide after SST logical-name normalization as "${componentName}". Rename one identifier so every resource name is unique before deployment.`);
+            }
+            declared.add(identifier);
+            normalized.set(key, identifier);
+            componentNames.set(componentName, identifier);
+            identifiers[identifier] = resolved;
+        }
+    }
+    return {
+        active,
+        identifiers,
+        provisioned: [...declared],
+    };
+}
+function provisionDatabaseBindings(foundation, options) {
+    // Validate the complete set before the first provisioner call. This is what
+    // makes a collision or overlong identifier fail before any local Linkable,
+    // Pulumi dynamic resource, Secrets Manager secret, or SQL mutation exists.
+    const plan = createDatabaseBindingPlan(options.bindings, {
+        slice: options.slice,
+        stage: $app.stage,
+    });
+    const provisioned = new Map();
+    for (const database of plan.provisioned) {
+        provisioned.set(database, (0, provision_logical_database_js_1.provisionLogicalDatabase)(foundation, {
+            database,
+            localDev: options.localDev,
+            localDevPassword: options.localDevPassword,
+            removalPolicy: options.removalPolicy,
+            ...(options.rotationTokens?.[database] !== undefined
+                ? { rotationToken: options.rotationTokens[database] }
+                : {}),
+            slice: options.slice,
+        }));
+    }
+    return Object.fromEntries(Object.entries(plan.active).map(([role, database]) => [
+        role,
+        provisioned.get(database),
+    ]));
+}
+//# sourceMappingURL=provision-database-bindings.js.map

package/src/foundation/provision-database-bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-database-bindings.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/provision-database-bindings.ts"],"names":[],"mappings":";;AAmDA,8DAoHC;AAED,8DAqCC;AA9MD,6EAIsC;AACtC,mFAMyC;AAkCzC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAEvE,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,IAAA,wDAA2B,EAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5E,CAAC;AAED,SAAgB,yBAAyB,CACvC,QAAoC,EACpC,OAAyC;IAEzC,IACE,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,WAAW,GAA+C,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,gGAAgG,CAC/H,CAAC;QACJ,CAAC;QACD,IACE,OAAO,OAAO,KAAK,QAAQ;YAC3B,OAAO,KAAK,IAAI;YAChB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,sBAAsB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACnD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,aAAa,CACnD,CAAC;QACF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,gCAAgC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAChL,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,8CAA8C,CACxE,CAAC;QACJ,CAAC;QACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YACnC,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,2CAA2C,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,cAAc,OAAO,CAAC,MAAM,4CAA4C,CAClG,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,yCAAyC,CACnE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CACb,wBAAwB,UAAU,0HAA0H,CAC7J,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,wBAAwB,UAAU,kGAAkG,CACrI,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,8DAAiC,EAAC;gBACjD,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,UAAU,UAAU,oHAAoH,CAC1K,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,IAAA,2DAA2B,EAC/C,OAAO,CAAC,KAAK,EACb,UAAU,CACX,CAAC;YACF,MAAM,iBAAiB,GAAG,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,yBAAyB,iBAAiB,UAAU,UAAU,sDAAsD,aAAa,8EAA8E,CAChN,CAAC;YACJ,CAAC;YAED,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzB,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAChC,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC9C,WAAW,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,WAAW;QACX,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,SAAgB,yBAAyB,CAGvC,UAAoC,EACpC,OAAmE;IAEnE,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,CAAC,QAAQ,EAAE;QACvD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0C,CAAC;IAEtE,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,WAAW,CAAC,GAAG,CACb,QAAQ,EACR,IAAA,wDAAwB,EAAC,UAAU,EAAE;YACnC,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,KAAK,SAAS;gBAClD,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACpD,IAAI;QACJ,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAmC;KAC5D,CAAC,CACuC,CAAC;AAC9C,CAAC"}

package/src/foundation/provision-logical-database.d.ts

@@ -0,0 +1,26 @@
+export interface FoundationDatabaseCapacity {
+    cluster: any;
+    clusterArn: string;
+    masterSecretArn: string;
+}
+export interface FoundationInfrastructure {
+    database: FoundationDatabaseCapacity;
+}
+export interface ProvisionLogicalDatabaseOptions {
+    slice: string;
+    database: string;
+    localDev?: boolean;
+    localDevPassword?: string;
+    localDevPort?: number;
+    linkableName?: string;
+    removalPolicy?: 'retain' | 'destroy';
+    rotationToken?: string;
+}
+export interface ProvisionLogicalDatabaseResult {
+    db: any;
+    logicalDb?: any;
+    readwriteSecretArn?: any;
+    readonlySecretArn?: any;
+}
+export declare function defaultDatabaseLinkableName(slice: string, database: string): string;
+export declare function provisionLogicalDatabase(foundation: FoundationInfrastructure, options: ProvisionLogicalDatabaseOptions): ProvisionLogicalDatabaseResult;

package/src/foundation/provision-logical-database.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultDatabaseLinkableName = defaultDatabaseLinkableName;
+exports.provisionLogicalDatabase = provisionLogicalDatabase;
+const aurora_logical_database_js_1 = require("./aurora-logical-database.js");
+const local_database_contract_js_1 = require("./local-database-contract.js");
+function classNameForDatabaseComponent(value) {
+    // 'example-primary' -> 'ExamplePrimary'. Simple normalizer; the db
+    // generator always passes already-kebab-cased segments.
+    return value
+        .split(/[-_]/)
+        .filter(Boolean)
+        .map((p) => p.charAt(0).toUpperCase() + p.slice(1))
+        .join('');
+}
+function defaultDatabaseLinkableName(slice, database) {
+    return `${classNameForDatabaseComponent(slice)}${classNameForDatabaseComponent(database)}Database`;
+}
+// Carves out an app-scoped logical database on the shared `CoreDb` Aurora
+// cluster. Creates:
+//   * `<app>_<database>` logical Postgres database on the shared cluster
+//   * `<app>_readwrite` role (full DML + DDL) + `<app>_readonly` role (SELECT only)
+//   * AWS Secrets Manager secrets for each role at
+//     `ebk/<stage>/<slice>/database/<database>/<access-mode>` with JSON
+//     `{ host, port, database, username, password }`
+//   * An `sst.Linkable` exposing the readwrite credentials — consumers link
+//     this into their Nextjs / Service / Function stacks so runtime code sees
+//     `Resource.<Linkable>.host/port/database/username/password` unchanged
+//
+// Passwords are generated inside the `AuroraLogicalDb` dynamic resource via
+// Node `crypto.randomBytes` and persisted in Pulumi state, so no
+// `@pulumi/random` dep is needed. They are never rotated automatically —
+// change `rotationToken` to rotate on the next deploy (see the rotation
+// runbook in this package's README).
+//
+// DO NOT pass `core.db.cluster` (the raw Aurora handle) into
+// `new sst.aws.Nextjs({ link })` — that leaks the master password. This
+// helper is the sanctioned consumer path.
+function provisionLogicalDatabase(foundation, options) {
+    // Resolve and validate every deployed and local PostgreSQL identifier before
+    // constructing an SST Linkable, Pulumi dynamic resource, or AWS secret.
+    // PostgreSQL truncates overlong identifiers by default; EBK fails instead so
+    // two declarations can never alias silently.
+    const identifiers = (0, local_database_contract_js_1.resolveLogicalDatabaseIdentifiers)({
+        database: options.database,
+        slice: options.slice,
+        stage: $app.stage,
+    });
+    const linkableName = options.linkableName ??
+        defaultDatabaseLinkableName(options.slice, options.database);
+    // Local live mode needs only the workload-facing Linkable. Return before
+    // constructing the Pulumi dynamic resource or either Secrets Manager secret
+    // so `sst dev` does not provision unused AWS database resources merely to
+    // point the application at Docker Postgres.
+    if ($dev && (options.localDev ?? true)) {
+        const localDatabase = (0, local_database_contract_js_1.resolveLocalDatabaseContract)({
+            database: options.database,
+            password: options.localDevPassword,
+            port: options.localDevPort,
+            slice: options.slice,
+        });
+        return {
+            db: new sst.Linkable(linkableName, {
+                properties: localDatabase,
+            }),
+        };
+    }
+    // `<consumer_stage>_<app>_<database>` — scoped by the CONSUMER stage, not
+    // core's. Personal/preview stages (`pr-123`, `lukas`) share the shared
+    // development cluster via `EBK_CORE_STAGE=development` for cost, but their
+    // data MUST be isolated from every other stage's. Without stage-scoping, two stages
+    // pointing at the same core would stomp on each other's database rows and
+    // rotate each other's passwords via the retained-role `ALTER ROLE` path.
+    // Hyphens become underscores because Postgres identifiers reject `-`.
+    const databaseIdentifier = identifiers.database;
+    const readwriteRole = identifiers.readwriteRole;
+    const readonlyRole = identifiers.readonlyRole;
+    // Default removal policy depends on stage. Canonical persistent stages
+    // (development/staging/production) retain data — destroying a consumer stack
+    // shouldn't nuke anything anyone cares about. Ephemeral stages (preview
+    // `pr-123`, personal `lukas`, etc.) destroy — every such stage creates
+    // its own stage-scoped logical DB, and leaving it behind after the
+    // preview is torn down would leak Aurora state + roles forever.
+    // Callers can override explicitly via `options.removalPolicy`.
+    const canonicalStages = new Set(['development', 'staging', 'production']);
+    const defaultRemovalPolicy = canonicalStages.has($app.stage)
+        ? 'retain'
+        : 'destroy';
+    const logicalDb = (0, aurora_logical_database_js_1.createAuroraLogicalDbResource)({
+        name: linkableName,
+        args: {
+            clusterArn: foundation.database.clusterArn,
+            masterSecretArn: foundation.database.masterSecretArn,
+            database: databaseIdentifier,
+            readwriteRole,
+            readonlyRole,
+            removalPolicy: options.removalPolicy ?? defaultRemovalPolicy,
+            // Only include the rotation trigger when the caller set one — keeping
+            // the key out of the inputs entirely when unset avoids a spurious
+            // `undefined` diff against resources created before this option existed.
+            ...(options.rotationToken !== undefined
+                ? { rotationToken: options.rotationToken }
+                : {}),
+        },
+    });
+    // `core.db.cluster.host` auto-resolves to the proxy endpoint when proxy is
+    // enabled (production) or the cluster writer endpoint otherwise.
+    // `core.db.cluster.port` similarly resolves to either the proxy port or the
+    // cluster port.
+    const host = foundation.database.cluster.host;
+    const port = foundation.database.cluster.port;
+    // Outputs from the dynamic resource — Pulumi unwraps them on link.
+    const readwritePassword = logicalDb.readwritePassword;
+    const readonlyPassword = logicalDb.readonlyPassword;
+    const secretJsonFor = (role, password) => $interpolate `{"host":"${host}","port":${port},"database":"${databaseIdentifier}","username":"${role}","password":"${password}"}`;
+    // Secret paths are keyed by the CONSUMER's stage, not core's. Two stages
+    // pointing at the same core via `EBK_CORE_STAGE` (e.g. `pr-123` → `development`)
+    // would otherwise collide on `ebk/development/<app>/db/<db>/...`. Keying by
+    // `$app.stage` isolates each consumer's secret namespace while the actual
+    // cluster remains shared.
+    const secretBasePath = `ebk/${$app.stage}/${options.slice}/database/${options.database}`;
+    // `recoveryWindowInDays: 0` skips the default 7-day soft-delete window.
+    // Destroy frees the secret name immediately so a subsequent create (or a
+    // redeploy after `sst remove`) doesn't hit `InvalidRequestException:
+    // ...already scheduled for deletion`. App-scoped DB role credentials are
+    // regenerated on every create() anyway — a recovery window serves no
+    // purpose here.
+    const readwriteSecret = new aws.secretsmanager.Secret(`${linkableName}ReadwriteSecret`, {
+        name: `${secretBasePath}/readwrite`,
+        recoveryWindowInDays: 0,
+    }, { dependsOn: logicalDb });
+    const readwriteSecretVersion = new aws.secretsmanager.SecretVersion(`${linkableName}ReadwriteSecretVersion`, {
+        secretId: readwriteSecret.id,
+        secretString: secretJsonFor(readwriteRole, readwritePassword),
+    });
+    const readonlySecret = new aws.secretsmanager.Secret(`${linkableName}ReadonlySecret`, {
+        name: `${secretBasePath}/readonly`,
+        recoveryWindowInDays: 0,
+    }, { dependsOn: logicalDb });
+    const readonlySecretVersion = new aws.secretsmanager.SecretVersion(`${linkableName}ReadonlySecretVersion`, {
+        secretId: readonlySecret.id,
+        secretString: secretJsonFor(readonlyRole, readonlyPassword),
+    });
+    const linkable = new sst.Linkable(linkableName, {
+        properties: {
+            host,
+            port,
+            database: databaseIdentifier,
+            username: readwriteRole,
+            password: $util.secret(readwritePassword),
+        },
+    });
+    // Touch the version refs so Pulumi tracks them + keep them alive in GC.
+    void readwriteSecretVersion;
+    void readonlySecretVersion;
+    return {
+        db: linkable,
+        logicalDb,
+        readwriteSecretArn: readwriteSecret.arn,
+        readonlySecretArn: readonlySecret.arn,
+    };
+}
+//# sourceMappingURL=provision-logical-database.js.map

package/src/foundation/provision-logical-database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-logical-database.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/provision-logical-database.ts"],"names":[],"mappings":";;AA+GA,kEAKC;AAsBD,4DA0JC;AApSD,6EAA6E;AAC7E,6EAGsC;AAiGtC,SAAS,6BAA6B,CAAC,KAAa;IAClD,mEAAmE;IACnE,wDAAwD;IACxD,OAAO,KAAK;SACT,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAAa,EACb,QAAgB;IAEhB,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,6BAA6B,CAAC,QAAQ,CAAC,UAAU,CAAC;AACrG,CAAC;AAED,0EAA0E;AAC1E,oBAAoB;AACpB,yEAAyE;AACzE,oFAAoF;AACpF,mDAAmD;AACnD,wEAAwE;AACxE,qDAAqD;AACrD,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,wEAAwE;AACxE,qCAAqC;AACrC,EAAE;AACF,6DAA6D;AAC7D,wEAAwE;AACxE,0CAA0C;AAC1C,SAAgB,wBAAwB,CACtC,UAAoC,EACpC,OAAwC;IAExC,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAA,8DAAiC,EAAC;QACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,2BAA2B,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/D,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4CAA4C;IAC5C,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAA,yDAA4B,EAAC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,gBAAgB;YAClC,IAAI,EAAE,OAAO,CAAC,YAAY;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE;gBACjC,UAAU,EAAE,aAAa;aAC1B,CAAC;SACH,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,oFAAoF;IACpF,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,kBAAkB,GAAG,WAAW,CAAC,QAAQ,CAAC;IAChD,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;IAChD,MAAM,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;IAE9C,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1E,MAAM,oBAAoB,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAC1D,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,IAAA,0DAA6B,EAAC;QAC9C,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU;YAC1C,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;YACpD,QAAQ,EAAE,kBAAkB;YAC5B,aAAa;YACb,YAAY;YACZ,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,oBAAoB;YAC5D,sEAAsE;YACtE,kEAAkE;YAClE,yEAAyE;YACzE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC,CAAC;IAEH,2EAA2E;IAC3E,iEAAiE;IACjE,4EAA4E;IAC5E,gBAAgB;IAChB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC;IACtD,MAAM,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC;IAEpD,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,QAAiB,EAAE,EAAE,CACxD,YAAY,CAAA,YAAY,IAAI,YAAY,IAAI,gBAAgB,kBAAkB,iBAAiB,IAAI,iBAAiB,QAAQ,IAAI,CAAC;IAEnI,yEAAyE;IACzE,iFAAiF;IACjF,4EAA4E;IAC5E,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,cAAc,GAAG,OAAO,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC;IAEzF,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,gBAAgB;IAChB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CACnD,GAAG,YAAY,iBAAiB,EAChC;QACE,IAAI,EAAE,GAAG,cAAc,YAAY;QACnC,oBAAoB,EAAE,CAAC;KACxB,EACD,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;IACF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,aAAa,CACjE,GAAG,YAAY,wBAAwB,EACvC;QACE,QAAQ,EAAE,eAAe,CAAC,EAAE;QAC5B,YAAY,EAAE,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC;KAC9D,CACF,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAClD,GAAG,YAAY,gBAAgB,EAC/B;QACE,IAAI,EAAE,GAAG,cAAc,WAAW;QAClC,oBAAoB,EAAE,CAAC;KACxB,EACD,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,aAAa,CAChE,GAAG,YAAY,uBAAuB,EACtC;QACE,QAAQ,EAAE,cAAc,CAAC,EAAE;QAC3B,YAAY,EAAE,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC;KAC5D,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE;QAC9C,UAAU,EAAE;YACV,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC1C;KACF,CAAC,CAAC;IAEH,wEAAwE;IACxE,KAAK,sBAAsB,CAAC;IAC5B,KAAK,qBAAqB,CAAC;IAE3B,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,SAAS;QACT,kBAAkB,EAAE,eAAe,CAAC,GAAG;QACvC,iBAAiB,EAAE,cAAc,CAAC,GAAG;KACtC,CAAC;AACJ,CAAC"}

package/src/foundation/requirements.d.ts

@@ -0,0 +1,37 @@
+import { type ValidationResult } from '../validation.js';
+export declare const STANDARD_FOUNDATION_CONTRACT_VERSION: 1;
+export declare const STANDARD_FOUNDATION_CAPABILITIES: readonly ["network", "routing", "container-compute", "postgres", "identity", "events", "observability", "configuration", "deployment"];
+export type StandardFoundationCapability = (typeof STANDARD_FOUNDATION_CAPABILITIES)[number];
+export interface FoundationRequirement {
+    capabilities: StandardFoundationCapability[];
+    contract: string;
+}
+export interface FoundationDescriptor {
+    capabilities: StandardFoundationCapability[];
+    contractVersion: string;
+}
+export declare function isStandardFoundationCapability(value: unknown): value is StandardFoundationCapability;
+export declare function validateFoundationRequirement(value: unknown, path?: string): ValidationResult<FoundationRequirement>;
+export declare function validateFoundationCompatibility(requirement: unknown, foundation: unknown): ValidationResult<FoundationDescriptor>;
+export declare const foundationRequirementSchema: {
+    readonly $id: "https://empirebuilderkit.dev/schemas/foundation-requirement-v1.json";
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly capabilities: {
+            readonly items: {
+                readonly enum: readonly ["network", "routing", "container-compute", "postgres", "identity", "events", "observability", "configuration", "deployment"];
+                readonly type: "string";
+            };
+            readonly type: "array";
+            readonly uniqueItems: true;
+        };
+        readonly contract: {
+            readonly minLength: 1;
+            readonly type: "string";
+        };
+    };
+    readonly required: readonly ["contract", "capabilities"];
+    readonly title: "Empire Builder Kit Standard Foundation Requirement v1";
+    readonly type: "object";
+};