@empire-builder-kit/nx 1.0.0-beta.10

package/src/executors/fleet/schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit local fleet",
+  "description": "Run selected Product Slices locally behind one checkout-isolated HTTPS origin and route the rest to the development Foundation.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "appData": { "type": "string" },
+    "developmentRouterUrl": { "type": "string" },
+    "hostSuffix": { "type": "string", "default": "ebk.localhost" },
+    "maxRestartAttempts": {
+      "description": "Maximum automatic restarts for a repeatedly failing selected Slice.",
+      "type": "integer",
+      "minimum": 0,
+      "default": 3
+    },
+    "profile": { "type": "string" },
+    "region": { "type": "string" },
+    "safeMethodFallback": { "type": "boolean", "default": false },
+    "slices": {
+      "description": "Comma-separated Product Slice names to run locally.",
+      "type": "string"
+    },
+    "sstMode": {
+      "description": "SST dev presentation mode for fleet-launched Slices. mono is safe for agents and non-cursor-addressable terminals; multiplexer opts into SST's interactive default.",
+      "type": "string",
+      "enum": ["mono", "multiplexer"],
+      "default": "mono"
+    },
+    "stage": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$"
+    }
+  },
+  "required": ["slices", "stage"]
+}

package/src/executors/foundation-preflight/foundation-preflight.d.ts

@@ -0,0 +1,15 @@
+import { type PromiseExecutor } from '@nx/devkit';
+import type { FoundationRequirement } from '../../foundation/requirements.js';
+interface FoundationPreflightOptions {
+    advisory?: boolean;
+    capabilities?: FoundationRequirement['capabilities'];
+    contract?: string;
+    deployIfMissing?: boolean;
+    foundationProject?: string;
+    foundationStage?: string;
+    profile?: string;
+    region?: string;
+    stage: string;
+}
+declare const executor: PromiseExecutor<FoundationPreflightOptions>;
+export default executor;

package/src/executors/foundation-preflight/foundation-preflight.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const devkit_1 = require("@nx/devkit");
+const preflight_js_1 = require("../../foundation/preflight.js");
+const discovery_js_1 = require("../../foundation/discovery.js");
+const stages_js_1 = require("../../foundation/stages.js");
+const index_js_1 = require("../../repository-policy/index.js");
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+async function deployFoundation(options, context, foundationStage) {
+    const project = options.foundationProject?.trim() || 'foundation';
+    const root = context.projectsConfigurations?.projects[project]?.root;
+    if (!root) {
+        devkit_1.logger.error(`[foundation-preflight] Foundation project ${project} is not registered in the Nx workspace.`);
+        return false;
+    }
+    devkit_1.logger.info(`[foundation-preflight] deploying ${project} at canonical stage ${foundationStage}.`);
+    const result = await (0, run_sst_command_js_1.runSstCommand)('deploy', {
+        cwd: root,
+        ...(options.profile?.trim() ? { profile: options.profile.trim() } : {}),
+        stage: foundationStage,
+        stageMode: 'foundation',
+    }, { ...context, projectName: project });
+    return result.success;
+}
+const executor = async (options, context) => {
+    let stages;
+    try {
+        stages = (0, stages_js_1.resolveFoundationStages)({
+            consumerStage: options.stage,
+            foundationStage: options.foundationStage ?? process.env.EBK_FOUNDATION_STAGE,
+        });
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+    if (stages.consumerStage === 'production') {
+        try {
+            if (!context.projectName) {
+                throw new Error('Production Foundation preflight requires an Nx Product Slice project name.');
+            }
+            (0, index_js_1.assertRepositoryPolicyRequest)(context.root, {
+                action: 'deploy',
+                projects: [{ kind: 'slice', name: context.projectName }],
+                stage: stages.consumerStage,
+            });
+        }
+        catch (error) {
+            devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+            return { success: false };
+        }
+    }
+    const requestedRegion = options.region?.trim() ||
+        process.env.AWS_REGION?.trim() ||
+        process.env.AWS_DEFAULT_REGION?.trim();
+    const reader = (0, preflight_js_1.createFoundationParameterReader)({
+        profile: options.profile,
+        region: requestedRegion,
+    });
+    let region = requestedRegion ?? 'default';
+    try {
+        region = await reader.resolveRegion();
+        let report = await (0, preflight_js_1.evaluateFoundationPreflight)({
+            consumerStage: stages.consumerStage,
+            foundationStage: stages.foundationStage,
+            readParameters: reader.read,
+            region,
+            requirement: {
+                capabilities: options.capabilities ?? discovery_js_1.STANDARD_FOUNDATION_REQUIREMENT.capabilities,
+                contract: options.contract ?? discovery_js_1.STANDARD_FOUNDATION_REQUIREMENT.contract,
+            },
+        });
+        if (report.state === 'absent' &&
+            options.deployIfMissing === true &&
+            !stages.mapped) {
+            if (stages.foundationStage === 'staging' ||
+                stages.foundationStage === 'production') {
+                devkit_1.logger.error(`[foundation-preflight] ${stages.foundationStage} Foundation is absent. Protected workflows must run the Foundation target and its profile capability preflight before Product Slices; Foundation auto-deploy is disabled for protected stages.`);
+                return { success: false };
+            }
+            const deployed = await deployFoundation(options, context, stages.foundationStage);
+            if (!deployed)
+                return { success: false };
+            report = await (0, preflight_js_1.evaluateFoundationPreflight)({
+                consumerStage: stages.consumerStage,
+                foundationStage: stages.foundationStage,
+                readParameters: reader.read,
+                region,
+                requirement: {
+                    capabilities: options.capabilities ??
+                        discovery_js_1.STANDARD_FOUNDATION_REQUIREMENT.capabilities,
+                    contract: options.contract ?? discovery_js_1.STANDARD_FOUNDATION_REQUIREMENT.contract,
+                },
+            });
+        }
+        const message = (0, preflight_js_1.formatFoundationPreflightReport)(report);
+        if (report.ok) {
+            devkit_1.logger.info(message);
+        }
+        else {
+            devkit_1.logger.error(message);
+        }
+        return { success: report.ok || options.advisory === true };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (options.advisory === true) {
+            devkit_1.logger.warn(`[foundation-preflight] consumerStage=${stages.consumerStage} foundationStage=${stages.foundationStage} region=${region}: skipped because AWS SSM lookup is unavailable. ${message}`);
+            return { success: true };
+        }
+        devkit_1.logger.error(`[foundation-preflight] consumerStage=${stages.consumerStage} foundationStage=${stages.foundationStage} region=${region}: AWS SSM lookup failed. ${message}`);
+        return { success: false };
+    }
+};
+exports.default = executor;
+//# sourceMappingURL=foundation-preflight.js.map

package/src/executors/foundation-preflight/foundation-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foundation-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-preflight/foundation-preflight.ts"],"names":[],"mappings":";;AAAA,uCAAgF;AAChF,gEAIuC;AACvC,gEAAgF;AAEhF,0DAAqE;AACrE,+DAAiF;AACjF,4EAAoE;AAcpE,KAAK,UAAU,gBAAgB,CAC7B,OAAmC,EACnC,OAAwB,EACxB,eAAuB;IAEvB,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAM,CAAC,KAAK,CACV,6CAA6C,OAAO,yCAAyC,CAC9F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAM,CAAC,IAAI,CACT,oCAAoC,OAAO,uBAAuB,eAAe,GAAG,CACrF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAa,EAChC,QAAQ,EACR;QACE,GAAG,EAAE,IAAI;QACT,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,YAAY;KACxB,EACD,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CACrC,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,QAAQ,GAAgD,KAAK,EACjE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,mCAAuB,EAAC;YAC/B,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YACD,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;gBAC1C,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GACnB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAA,8CAA+B,EAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,eAAe,IAAI,SAAS,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,MAAM;YACN,WAAW,EAAE;gBACX,YAAY,EACV,OAAO,CAAC,YAAY,IAAI,8CAA+B,CAAC,YAAY;gBACtE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;aACvE;SACF,CAAC,CAAC;QACH,IACE,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,CAAC,MAAM,CAAC,MAAM,EACd,CAAC;YACD,IACE,MAAM,CAAC,eAAe,KAAK,SAAS;gBACpC,MAAM,CAAC,eAAe,KAAK,YAAY,EACvC,CAAC;gBACD,eAAM,CAAC,KAAK,CACV,0BAA0B,MAAM,CAAC,eAAe,gMAAgM,CACjP,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,OAAO,EACP,OAAO,EACP,MAAM,CAAC,eAAe,CACvB,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzC,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;gBACzC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,cAAc,EAAE,MAAM,CAAC,IAAI;gBAC3B,MAAM;gBACN,WAAW,EAAE;oBACX,YAAY,EACV,OAAO,CAAC,YAAY;wBACpB,8CAA+B,CAAC,YAAY;oBAC9C,QAAQ,EACN,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;iBAC/D;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,8CAA+B,EAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,eAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,eAAM,CAAC,IAAI,CACT,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,oDAAoD,OAAO,EAAE,CACrL,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,eAAM,CAAC,KAAK,CACV,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,4BAA4B,OAAO,EAAE,CAC7J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/foundation-preflight/schema.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit Foundation preflight",
+  "description": "Validate the deployed Standard Foundation discovery contract before operating a Product Slice.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "stage": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "default": "development"
+    },
+    "foundationStage": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$"
+    },
+    "region": { "type": "string" },
+    "profile": { "type": "string" },
+    "contract": { "type": "string", "default": "^1.0.0" },
+    "capabilities": {
+      "type": "array",
+      "items": { "type": "string" },
+      "uniqueItems": true
+    },
+    "advisory": { "type": "boolean", "default": false },
+    "deployIfMissing": { "type": "boolean", "default": false },
+    "foundationProject": { "type": "string", "default": "foundation" }
+  },
+  "required": ["stage"]
+}

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.d.ts

@@ -0,0 +1,8 @@
+import { type PromiseExecutor } from '@nx/devkit';
+interface FoundationProfilePreflightOptions {
+    profile?: string;
+    region?: string;
+    stage: string;
+}
+declare const executor: PromiseExecutor<FoundationProfilePreflightOptions>;
+export default executor;

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../repository-policy/index.js");
+const stages_js_1 = require("../../foundation/stages.js");
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+const executor = async (options, context) => {
+    try {
+        const stage = (0, stages_js_1.requireFoundationStage)(options.stage);
+        if (stage === 'development') {
+            devkit_1.logger.info('[foundation-profile-preflight] development uses the generated non-production profile; no protected profile check is required.');
+            return { success: true };
+        }
+        (0, run_sst_command_js_1.assertSstLifecyclePolicy)('deploy', stage);
+        (0, index_js_1.assertRepositoryPolicyRequest)(context.root, {
+            action: 'deploy',
+            projects: [{ kind: 'foundation', name: 'foundation' }],
+            stage,
+        });
+        const requestedRegion = options.region?.trim() ||
+            process.env.AWS_REGION?.trim() ||
+            process.env.AWS_DEFAULT_REGION?.trim();
+        const reader = (0, index_js_1.createAuroraProfileCapabilityReader)({
+            ...(options.profile?.trim() ? { profile: options.profile.trim() } : {}),
+            ...(requestedRegion ? { region: requestedRegion } : {}),
+        });
+        const region = requestedRegion ?? (await reader.resolveRegion());
+        const report = (0, index_js_1.evaluateAuroraProfileCapability)(await reader.read(), region);
+        if (!report.ok) {
+            throw new Error(`Aurora ${report.engine} ${report.engineVersion} is not orderable as db.serverless in ${report.region}; protected Foundation deployment is blocked before mutation.`);
+        }
+        devkit_1.logger.info(`[foundation-profile-preflight] Aurora ${report.engine} ${report.engineVersion} is orderable as db.serverless in ${report.region}.`);
+        return { success: true };
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+};
+exports.default = executor;
+//# sourceMappingURL=foundation-profile-preflight.js.map

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foundation-profile-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-profile-preflight/foundation-profile-preflight.ts"],"names":[],"mappings":";;AAAA,uCAA0D;AAC1D,+DAI0C;AAC1C,0DAAoE;AACpE,4EAA+E;AAQ/E,MAAM,QAAQ,GAAuD,KAAK,EACxE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,eAAM,CAAC,IAAI,CACT,+HAA+H,CAChI,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,IAAA,6CAAwB,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACtD,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,eAAe,GACnB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;YACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;YAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAA,8CAAmC,EAAC;YACjD,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,IAAI,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAA,0CAA+B,EAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,yCAAyC,MAAM,CAAC,MAAM,+DAA+D,CACrK,CAAC;QACJ,CAAC;QACD,eAAM,CAAC,IAAI,CACT,yCAAyC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,qCAAqC,MAAM,CAAC,MAAM,GAAG,CACpI,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/foundation-profile-preflight/schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit production Foundation profile preflight",
+  "description": "Verify the pinned Aurora Serverless engine is orderable in the selected Region before Foundation mutation.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "stage": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "default": "development"
+    },
+    "profile": {
+      "type": "string",
+      "description": "Optional local AWS profile. Protected stages are still restricted to the generated GitHub workflow."
+    },
+    "region": { "type": "string" }
+  },
+  "required": ["stage"]
+}

package/src/executors/foundation-remove-preflight/foundation-remove-preflight.d.ts

@@ -0,0 +1,13 @@
+import { type PromiseExecutor } from '@nx/devkit';
+interface FoundationRemovePreflightOptions {
+    profile?: string;
+    region?: string;
+    stage: string;
+}
+export declare function evaluateFoundationRemoval(foundationStage: string, registrationNames: readonly string[]): {
+    message: string;
+    success: boolean;
+};
+export declare function productSliceRegistrationName(foundationStage: string, parameterName: string | undefined): string;
+declare const executor: PromiseExecutor<FoundationRemovePreflightOptions>;
+export default executor;

package/src/executors/foundation-remove-preflight/foundation-remove-preflight.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateFoundationRemoval = evaluateFoundationRemoval;
+exports.productSliceRegistrationName = productSliceRegistrationName;
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const devkit_1 = require("@nx/devkit");
+const discovery_js_1 = require("../../foundation/discovery.js");
+function evaluateFoundationRemoval(foundationStage, registrationNames) {
+    if (registrationNames.length === 0) {
+        return {
+            message: `[foundation-remove-preflight] foundationStage=${foundationStage}: no Product Slice registrations remain.`,
+            success: true,
+        };
+    }
+    return {
+        message: `[foundation-remove-preflight] foundationStage=${foundationStage}: Foundation removal is blocked by Product Slice registration records: ${registrationNames.join(', ')}. Remove known consumer-stage slice stacks first; investigate every unrecognized record before retrying.`,
+        success: false,
+    };
+}
+function productSliceRegistrationName(foundationStage, parameterName) {
+    const prefix = `${(0, discovery_js_1.productSliceRegistrationRoot)(foundationStage)}/`;
+    if (!parameterName?.startsWith(prefix)) {
+        return `[unrecognized registration] ${parameterName ?? '<missing parameter name>'}`;
+    }
+    const relativeName = parameterName.slice(prefix.length);
+    return /^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/.test(relativeName)
+        ? relativeName
+        : `[unrecognized registration] ${parameterName}`;
+}
+const executor = async (options) => {
+    const region = options.region?.trim() ||
+        process.env.AWS_REGION?.trim() ||
+        process.env.AWS_DEFAULT_REGION?.trim();
+    const client = new client_ssm_1.SSMClient({
+        ...(options.profile
+            ? { credentials: (0, credential_providers_1.fromIni)({ profile: options.profile }) }
+            : {}),
+        ...(region ? { region } : {}),
+    });
+    const registrations = [];
+    let nextToken;
+    try {
+        do {
+            const response = await client.send(new client_ssm_1.GetParametersByPathCommand({
+                NextToken: nextToken,
+                Path: (0, discovery_js_1.productSliceRegistrationRoot)(options.stage),
+                Recursive: true,
+            }));
+            registrations.push(...(response.Parameters ?? []).map(({ Name }) => productSliceRegistrationName(options.stage, Name)));
+            nextToken = response.NextToken;
+        } while (nextToken);
+    }
+    catch (error) {
+        devkit_1.logger.error(`[foundation-remove-preflight] foundationStage=${options.stage}: unable to inspect Product Slice registrations. ${error instanceof Error ? error.message : String(error)}`);
+        return { success: false };
+    }
+    finally {
+        client.destroy();
+    }
+    const result = evaluateFoundationRemoval(options.stage, registrations.sort());
+    if (result.success)
+        devkit_1.logger.info(result.message);
+    else
+        devkit_1.logger.error(result.message);
+    return { success: result.success };
+};
+exports.default = executor;
+//# sourceMappingURL=foundation-remove-preflight.js.map

package/src/executors/foundation-remove-preflight/foundation-remove-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foundation-remove-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-remove-preflight/foundation-remove-preflight.ts"],"names":[],"mappings":";;AAWA,8DAcC;AAED,oEAYC;AAvCD,oDAA4E;AAC5E,wEAAwD;AACxD,uCAA0D;AAC1D,gEAA6E;AAQ7E,SAAgB,yBAAyB,CACvC,eAAuB,EACvB,iBAAoC;IAEpC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,iDAAiD,eAAe,0CAA0C;YACnH,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,iDAAiD,eAAe,0EAA0E,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,0GAA0G;QACzR,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAC1C,eAAuB,EACvB,aAAiC;IAEjC,MAAM,MAAM,GAAG,GAAG,IAAA,2CAA4B,EAAC,eAAe,CAAC,GAAG,CAAC;IACnE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,+BAA+B,aAAa,IAAI,0BAA0B,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,0CAA0C,CAAC,IAAI,CAAC,YAAY,CAAC;QAClE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,+BAA+B,aAAa,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,QAAQ,GAAsD,KAAK,EACvE,OAAO,EACP,EAAE;IACF,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,GAAG,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,uCAA0B,CAAC;gBAC7B,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,IAAA,2CAA4B,EAAC,OAAO,CAAC,KAAK,CAAC;gBACjD,SAAS,EAAE,IAAI;aAChB,CAAC,CACH,CAAC;YACF,aAAa,CAAC,IAAI,CAChB,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9C,4BAA4B,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAClD,CACF,CAAC;YACF,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACjC,CAAC,QAAQ,SAAS,EAAE;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CACV,iDAAiD,OAAO,CAAC,KAAK,oDAAoD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3K,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,OAAO;QAAE,eAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;;QAC3C,eAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACrC,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/foundation-remove-preflight/schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit Foundation removal preflight",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "stage": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "default": "development"
+    },
+    "region": { "type": "string" },
+    "profile": { "type": "string" }
+  },
+  "required": ["stage"]
+}

package/src/executors/github-bootstrap/github-bootstrap.d.ts

@@ -0,0 +1,8 @@
+import { type PromiseExecutor } from '@nx/devkit';
+interface GitHubBootstrapExecutorOptions {
+    apply?: boolean;
+    productionReviewerIds?: string;
+    repository?: string;
+}
+declare const executor: PromiseExecutor<GitHubBootstrapExecutorOptions>;
+export default executor;

package/src/executors/github-bootstrap/github-bootstrap.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../git-policy/index.js");
+const index_js_2 = require("../../repository-policy/index.js");
+function parseReviewerIds(value) {
+    if (!value?.trim())
+        return [];
+    return value.split(',').map((item) => Number(item.trim()));
+}
+const executor = async (options, context) => {
+    try {
+        const policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
+        const report = await (0, index_js_1.runGitHubBootstrap)({
+            apply: options.apply === true,
+            productionApprovalMode: policy.productionApproval.mode,
+            productionReviewerIds: parseReviewerIds(options.productionReviewerIds),
+            repository: options.repository?.trim() || process.env.GH_REPO?.trim() || '',
+            token: process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || '',
+        });
+        devkit_1.logger.info(JSON.stringify(report, null, 2));
+        return { success: options.apply ? report.ready : true };
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+};
+exports.default = executor;
+//# sourceMappingURL=github-bootstrap.js.map

package/src/executors/github-bootstrap/github-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-bootstrap.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/github-bootstrap/github-bootstrap.ts"],"names":[],"mappings":";;AAAA,uCAA0D;AAC1D,wDAA+D;AAC/D,+DAAiF;AAQjF,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,QAAQ,GAAoD,KAAK,EACrE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAkB,EAAC;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;YAC7B,sBAAsB,EAAE,MAAM,CAAC,kBAAkB,CAAC,IAAI;YACtD,qBAAqB,EAAE,gBAAgB,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACtE,UAAU,EACR,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;YACjE,KAAK,EACH,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE;SACzE,CAAC,CAAC;QACH,eAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/github-bootstrap/schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit GitHub bootstrap",
+  "description": "Report or explicitly apply protected repository rules and environments without creating secrets, branches, or credentials.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "repository": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+      "description": "Explicit GitHub owner/repository target."
+    },
+    "apply": {
+      "type": "boolean",
+      "default": false,
+      "description": "Apply the reported GitHub settings. Omit for the default read-only report."
+    },
+    "productionReviewerIds": {
+      "type": "string",
+      "pattern": "^[1-9][0-9]*(,[1-9][0-9]*)*$",
+      "description": "Optional comma-separated GitHub user IDs when committed Repository Operating Policy selects environment-reviewer mode. Existing reviewers are preserved when omitted."
+    }
+  }
+}

package/src/executors/refresh/refresh.d.ts

@@ -0,0 +1,4 @@
+import type { PromiseExecutor } from '@nx/devkit';
+import { type SstLifecycleOptions } from '../sst-lifecycle/run-sst-command.js';
+declare const executor: PromiseExecutor<SstLifecycleOptions>;
+export default executor;

package/src/executors/refresh/refresh.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+const executor = (options, context) => (0, run_sst_command_js_1.runSstCommand)('refresh', options, context);
+exports.default = executor;
+//# sourceMappingURL=refresh.js.map

package/src/executors/refresh/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/refresh/refresh.ts"],"names":[],"mappings":";;AACA,4EAG6C;AAE7C,MAAM,QAAQ,GAAyC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAC1E,IAAA,kCAAa,EAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE7C,kBAAe,QAAQ,CAAC"}

package/src/executors/remove/remove.d.ts

@@ -0,0 +1,4 @@
+import type { PromiseExecutor } from '@nx/devkit';
+import { type SstLifecycleOptions } from '../sst-lifecycle/run-sst-command.js';
+declare const executor: PromiseExecutor<SstLifecycleOptions>;
+export default executor;

package/src/executors/remove/remove.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+const executor = (options, context) => (0, run_sst_command_js_1.runSstCommand)('remove', options, context);
+exports.default = executor;
+//# sourceMappingURL=remove.js.map

package/src/executors/remove/remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/remove/remove.ts"],"names":[],"mappings":";;AACA,4EAG6C;AAE7C,MAAM,QAAQ,GAAyC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAC1E,IAAA,kCAAa,EAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE5C,kBAAe,QAAQ,CAAC"}

package/src/executors/sst-lifecycle/run-sst-command.d.ts

@@ -0,0 +1,31 @@
+import { type ExecutorContext } from '@nx/devkit';
+import { type FoundationStageResolution } from '../../foundation/stages.js';
+export type SstLifecycleCommand = 'deploy' | 'dev' | 'refresh' | 'remove' | 'unlock';
+export interface SstLifecycleOptions {
+    args?: string[];
+    cwd?: string;
+    foundationStage?: string;
+    profile?: string;
+    stage: string;
+    stageMode: 'consumer' | 'foundation';
+    target?: string;
+}
+export interface SstCommandInvocation {
+    args: string[];
+    cwd: string;
+    environment: {
+        EBK_CONSUMER_STAGE: string;
+        EBK_FOUNDATION_STAGE: string;
+        EBK_PRODUCTION_FOUNDATION_PROFILE?: string;
+    };
+    executable: string;
+}
+export declare function createSstChildEnvironment(ambient: NodeJS.ProcessEnv, invocation: SstCommandInvocation['environment']): NodeJS.ProcessEnv;
+export declare function assertSafeSstForwardedArguments(args: readonly string[]): void;
+export declare function resolveSstDevMode(environment: NodeJS.ProcessEnv, forwardedArguments?: readonly string[]): 'basic' | 'mono' | undefined;
+export declare function assertSstLifecyclePolicy(command: SstLifecycleCommand, stage: string, environment?: NodeJS.ProcessEnv): void;
+export declare function resolveSstLifecycleStages(options: SstLifecycleOptions, environment?: NodeJS.ProcessEnv): FoundationStageResolution;
+export declare function buildSstCommandInvocation(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv): SstCommandInvocation;
+export declare function runSstCommand(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext): Promise<{
+    success: boolean;
+}>;