@empire-builder-kit/nx 1.0.0-beta.10

package/src/executors/sst-lifecycle/run-sst-command.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSstChildEnvironment = createSstChildEnvironment;
+exports.assertSafeSstForwardedArguments = assertSafeSstForwardedArguments;
+exports.resolveSstDevMode = resolveSstDevMode;
+exports.assertSstLifecyclePolicy = assertSstLifecyclePolicy;
+exports.resolveSstLifecycleStages = resolveSstLifecycleStages;
+exports.buildSstCommandInvocation = buildSstCommandInvocation;
+exports.runSstCommand = runSstCommand;
+const devkit_1 = require("@nx/devkit");
+const node_child_process_1 = require("node:child_process");
+const node_path_1 = require("node:path");
+const stages_js_1 = require("../../foundation/stages.js");
+const index_js_1 = require("../../repository-policy/index.js");
+const index_js_2 = require("../../work-markers/index.js");
+const PROTECTED_STAGES = new Set(['staging', 'production']);
+const RESERVED_FORWARDED_OPTIONS = new Set([
+    '--config',
+    '--profile',
+    '--stage',
+    '--target',
+]);
+const SST_DEV_MODES = new Set(['basic', 'mono']);
+function projectKind(context) {
+    if (!context.projectName) {
+        throw new Error('SST lifecycle requires an Nx project name for tag-derived Repository Operating Policy evaluation.');
+    }
+    const tags = context.projectsConfigurations?.projects[context.projectName]?.tags ?? [];
+    const foundation = tags.includes('scope:foundation');
+    const slice = tags.includes('type:slice');
+    if (foundation === slice) {
+        throw new Error(`Nx project ${context.projectName} must declare exactly one lifecycle kind tag: scope:foundation or type:slice.`);
+    }
+    return foundation ? 'foundation' : 'slice';
+}
+function createSstChildEnvironment(ambient, invocation) {
+    const sanitized = { ...ambient };
+    delete sanitized.EBK_PRODUCTION_FOUNDATION_PROFILE;
+    return { ...sanitized, ...invocation };
+}
+function assertSafeSstForwardedArguments(args) {
+    const reserved = args.find((argument) => {
+        const option = argument.split('=', 1)[0].toLowerCase();
+        return RESERVED_FORWARDED_OPTIONS.has(option);
+    });
+    if (reserved) {
+        const option = reserved.split('=', 1)[0].toLowerCase();
+        throw new Error(`SST forwarded arguments cannot override lifecycle option ${option}. Use the corresponding Nx executor option instead.`);
+    }
+}
+function resolveSstDevMode(environment, forwardedArguments = []) {
+    if (forwardedArguments.some((argument) => argument.split('=', 1)[0].toLowerCase() === '--mode')) {
+        return undefined;
+    }
+    const requested = environment.EBK_SST_DEV_MODE?.trim().toLowerCase();
+    if (!requested || requested === 'multiplexer')
+        return undefined;
+    if (!SST_DEV_MODES.has(requested)) {
+        throw new Error('EBK_SST_DEV_MODE must be mono, basic, or multiplexer when set.');
+    }
+    return requested;
+}
+function assertSstLifecyclePolicy(command, stage, environment = process.env) {
+    if (!PROTECTED_STAGES.has(stage))
+        return;
+    if (command === 'dev') {
+        throw new Error(`SST dev is not permitted for protected stage ${stage}.`);
+    }
+    const repository = environment.GITHUB_REPOSITORY;
+    const expectedBranch = stage === 'staging' ? 'develop' : 'main';
+    const expectedRef = `refs/heads/${expectedBranch}`;
+    const expectedWorkflowRef = repository
+        ? `${repository}/.github/workflows/deploy.yml@${expectedRef}`
+        : undefined;
+    const eventName = environment.GITHUB_EVENT_NAME;
+    const allowedEvent = eventName === 'workflow_dispatch' ||
+        (eventName === 'push' && command === 'deploy');
+    const trustedWorkflow = Boolean(repository) &&
+        environment.GITHUB_ACTIONS === 'true' &&
+        allowedEvent &&
+        environment.GITHUB_REF === expectedRef &&
+        environment.GITHUB_WORKFLOW_REF === expectedWorkflowRef;
+    if (!trustedWorkflow) {
+        throw new Error(`SST ${command} for protected stage ${stage} must run from the ${expectedBranch}-branch deploy workflow; pushes may run only deploy and other lifecycle actions require workflow_dispatch.`);
+    }
+    if (command === 'remove' &&
+        stage === 'production' &&
+        environment.EBK_ALLOW_PRODUCTION_REMOVE !== 'true') {
+        throw new Error('Production removal requires EBK_ALLOW_PRODUCTION_REMOVE=true in the protected production environment.');
+    }
+}
+function resolveSstLifecycleStages(options, environment = process.env) {
+    if (options.stageMode === 'foundation') {
+        const stage = (0, stages_js_1.requireFoundationStage)(options.stage);
+        if (options.foundationStage?.trim() &&
+            (0, stages_js_1.requireFoundationStage)(options.foundationStage) !== stage) {
+            throw new Error(`Foundation lifecycle stage ${stage} cannot target Foundation stage ${options.foundationStage.trim()}.`);
+        }
+        return {
+            consumerStage: stage,
+            foundationStage: stage,
+            mapped: false,
+        };
+    }
+    if (options.stageMode !== 'consumer') {
+        throw new Error('SST lifecycle stageMode must be consumer or foundation.');
+    }
+    return (0, stages_js_1.resolveFoundationStages)({
+        consumerStage: options.stage,
+        foundationStage: options.foundationStage ?? environment.EBK_FOUNDATION_STAGE,
+    });
+}
+function buildSstCommandInvocation(command, options, context, environment = process.env) {
+    const kind = projectKind(context);
+    const expectedStageMode = kind === 'foundation' ? 'foundation' : 'consumer';
+    if (options.stageMode !== expectedStageMode) {
+        throw new Error(`Nx project ${context.projectName} is tagged as ${kind} and requires stageMode ${expectedStageMode}; executor options cannot change project kind.`);
+    }
+    const configuredRoot = context.projectName
+        ? context.projectsConfigurations?.projects[context.projectName]?.root
+        : undefined;
+    const configuredCwd = options.cwd ?? configuredRoot ?? context.root;
+    const cwd = (0, node_path_1.isAbsolute)(configuredCwd)
+        ? configuredCwd
+        : (0, node_path_1.join)(context.root, configuredCwd);
+    const stages = resolveSstLifecycleStages(options, environment);
+    if (options.stageMode === 'consumer' &&
+        command === 'deploy' &&
+        stages.mapped) {
+        throw new Error(`Full deploy is not permitted for mapped consumer stage ${stages.consumerStage}. Use dev against the ${stages.foundationStage} Foundation until preview routing is supported.`);
+    }
+    assertSstLifecyclePolicy(command, stages.consumerStage, environment);
+    if (PROTECTED_STAGES.has(stages.consumerStage) &&
+        (command === 'deploy' || command === 'refresh')) {
+        (0, index_js_2.assertWorkMarkerReport)((0, index_js_2.scanWorkMarkers)(context.root), {
+            protectedPromotion: true,
+        });
+    }
+    const policyDecision = stages.consumerStage === 'production'
+        ? (0, index_js_1.assertRepositoryPolicyRequest)(context.root, {
+            action: command,
+            projects: [
+                {
+                    kind,
+                    name: context.projectName ?? '',
+                },
+            ],
+            stage: stages.consumerStage,
+        })
+        : undefined;
+    const args = [command, '--stage', stages.consumerStage];
+    if (options.profile) {
+        args.push('--profile', options.profile);
+    }
+    if (options.target) {
+        args.push('--target', options.target);
+    }
+    if (command === 'dev') {
+        const mode = resolveSstDevMode(environment, options.args);
+        if (mode)
+            args.push(`--mode=${mode}`);
+    }
+    if (options.args) {
+        assertSafeSstForwardedArguments(options.args);
+        args.push(...options.args);
+    }
+    return {
+        args: [
+            (0, node_path_1.join)(context.root, 'node_modules', 'sst', 'bin', 'sst.mjs'),
+            ...args,
+        ],
+        cwd,
+        environment: {
+            EBK_CONSUMER_STAGE: stages.consumerStage,
+            EBK_FOUNDATION_STAGE: stages.foundationStage,
+            ...(policyDecision?.effectiveProductionProfile
+                ? {
+                    EBK_PRODUCTION_FOUNDATION_PROFILE: policyDecision.effectiveProductionProfile,
+                }
+                : {}),
+        },
+        executable: process.execPath,
+    };
+}
+async function runSstCommand(command, options, context) {
+    let invocation;
+    try {
+        invocation = buildSstCommandInvocation(command, options, context);
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+    devkit_1.logger.info(`Running workspace SST: ${command} --stage ${invocation.environment.EBK_CONSUMER_STAGE} foundationStage=${invocation.environment.EBK_FOUNDATION_STAGE} (${invocation.cwd})`);
+    return new Promise((resolve) => {
+        const child = (0, node_child_process_1.spawn)(invocation.executable, invocation.args, {
+            cwd: invocation.cwd,
+            env: createSstChildEnvironment(process.env, invocation.environment),
+            shell: false,
+            stdio: 'inherit',
+        });
+        let settled = false;
+        const settle = (success) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve({ success });
+        };
+        child.on('error', (error) => {
+            devkit_1.logger.error(`Failed to start workspace SST: ${error.message}`);
+            settle(false);
+        });
+        child.on('close', (code, signal) => {
+            if (code !== 0) {
+                devkit_1.logger.error(signal
+                    ? `SST ${command} terminated with signal ${signal}.`
+                    : `SST ${command} exited with status ${code ?? 'unknown'}.`);
+                if (command === 'deploy' || command === 'remove') {
+                    devkit_1.logger.error(`If the stack is locked, run pnpm nx run ${context.projectName ?? '<project>'}:unlock --stage=${options.stage}.`);
+                }
+            }
+            settle(code === 0);
+        });
+    });
+}
+//# sourceMappingURL=run-sst-command.js.map

package/src/executors/sst-lifecycle/run-sst-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-sst-command.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/run-sst-command.ts"],"names":[],"mappings":";;AAiEA,8DAOC;AAED,0EAWC;AAED,8CAmBC;AAED,4DAuCC;AAED,8DA4BC;AAED,8DAuFC;AAED,sCAoDC;AAhUD,uCAA0D;AAC1D,2DAA2C;AAC3C,yCAA6C;AAC7C,0DAIoC;AACpC,+DAAiF;AACjF,0DAGqC;AA0BrC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjD,SAAS,WAAW,CAAC,OAAwB;IAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,+EAA+E,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA0B,EAC1B,UAA+C;IAE/C,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACjC,OAAO,SAAS,CAAC,iCAAiC,CAAC;IACnD,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,SAAgB,+BAA+B,CAAC,IAAuB;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,qDAAqD,CACxH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,iBAAiB,CAC/B,WAA8B,EAC9B,qBAAwC,EAAE;IAE1C,IACE,kBAAkB,CAAC,IAAI,CACrB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CACnE,EACD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAChE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,SAA6B,CAAC;AACvC,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAA4B,EAC5B,KAAa,EACb,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IACzC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACjD,MAAM,cAAc,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,WAAW,GAAG,cAAc,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAG,UAAU;QACpC,CAAC,CAAC,GAAG,UAAU,iCAAiC,WAAW,EAAE;QAC7D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,WAAW,CAAC,iBAAiB,CAAC;IAChD,MAAM,YAAY,GAChB,SAAS,KAAK,mBAAmB;QACjC,CAAC,SAAS,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC;IACjD,MAAM,eAAe,GACnB,OAAO,CAAC,UAAU,CAAC;QACnB,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,YAAY;QACZ,WAAW,CAAC,UAAU,KAAK,WAAW;QACtC,WAAW,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;IAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,wBAAwB,KAAK,sBAAsB,cAAc,4GAA4G,CAC5L,CAAC;IACJ,CAAC;IACD,IACE,OAAO,KAAK,QAAQ;QACpB,KAAK,KAAK,YAAY;QACtB,WAAW,CAAC,2BAA2B,KAAK,MAAM,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,OAAO,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IACE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE;YAC/B,IAAA,kCAAsB,EAAC,OAAO,CAAC,eAAe,CAAC,KAAK,KAAK,EACzD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,mCAAmC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CACxG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAA,mCAAuB,EAAC;QAC7B,aAAa,EAAE,OAAO,CAAC,KAAK;QAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC,oBAAoB;KAC9D,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB,EACxB,cAAiC,OAAO,CAAC,GAAG;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,iBAAiB,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5E,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,iBAAiB,IAAI,2BAA2B,iBAAiB,gDAAgD,CACnJ,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW;QACxC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI;QACrE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IACpE,MAAM,GAAG,GAAG,IAAA,sBAAU,EAAC,aAAa,CAAC;QACnC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/D,IACE,OAAO,CAAC,SAAS,KAAK,UAAU;QAChC,OAAO,KAAK,QAAQ;QACpB,MAAM,CAAC,MAAM,EACb,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,aAAa,yBAAyB,MAAM,CAAC,eAAe,iDAAiD,CAC/K,CAAC;IACJ,CAAC;IACD,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACrE,IACE,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAC1C,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,CAAC,EAC/C,CAAC;QACD,IAAA,iCAAsB,EAAC,IAAA,0BAAe,EAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACpD,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAClB,MAAM,CAAC,aAAa,KAAK,YAAY;QACnC,CAAC,CAAC,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE;gBACR;oBACE,IAAI;oBACJ,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;iBAChC;aACF;YACD,KAAK,EAAE,MAAM,CAAC,aAAa;SAC5B,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAExD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,+BAA+B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;YAC3D,GAAG,IAAI;SACR;QACD,GAAG;QACH,WAAW,EAAE;YACX,kBAAkB,EAAE,MAAM,CAAC,aAAa;YACxC,oBAAoB,EAAE,MAAM,CAAC,eAAe;YAC5C,GAAG,CAAC,cAAc,EAAE,0BAA0B;gBAC5C,CAAC,CAAC;oBACE,iCAAiC,EAC/B,cAAc,CAAC,0BAA0B;iBAC5C;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,UAAU,EAAE,OAAO,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB;IAExB,IAAI,UAAgC,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,eAAM,CAAC,IAAI,CACT,0BAA0B,OAAO,YAAY,UAAU,CAAC,WAAW,CAAC,kBAAkB,oBAAoB,UAAU,CAAC,WAAW,CAAC,oBAAoB,KAAK,UAAU,CAAC,GAAG,GAAG,CAC5K,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC1D,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC;YACnE,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,eAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,eAAM,CAAC,KAAK,CACV,MAAM;oBACJ,CAAC,CAAC,OAAO,OAAO,2BAA2B,MAAM,GAAG;oBACpD,CAAC,CAAC,OAAO,OAAO,uBAAuB,IAAI,IAAI,SAAS,GAAG,CAC9D,CAAC;gBACF,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACjD,eAAM,CAAC,KAAK,CACV,2CAA2C,OAAO,CAAC,WAAW,IAAI,WAAW,mBAAmB,OAAO,CAAC,KAAK,GAAG,CACjH,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/src/executors/sst-lifecycle/schema.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit SST lifecycle executor",
+  "description": "Run a supported SST lifecycle action through the workspace-pinned binary.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "cwd": {
+      "type": "string",
+      "description": "Working directory containing sst.config.ts. Defaults to the Nx project root."
+    },
+    "stage": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "description": "SST stage name.",
+      "default": "development"
+    },
+    "stageMode": {
+      "type": "string",
+      "enum": ["consumer", "foundation"],
+      "description": "Whether --stage names a Product Slice consumer stage or a canonical Foundation stage."
+    },
+    "foundationStage": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "description": "Optional explicit Foundation stage. Consumer personal/preview stages may use only development."
+    },
+    "profile": {
+      "type": "string",
+      "description": "Optional AWS profile passed to SST."
+    },
+    "target": {
+      "type": "string",
+      "description": "Optional SST target selector."
+    },
+    "args": {
+      "type": "array",
+      "description": "Additional arguments passed to SST. Cannot override --stage, --profile, --target, or --config; use the executor options instead.",
+      "items": { "type": "string" },
+      "default": []
+    }
+  },
+  "required": ["stage", "stageMode"]
+}

package/src/executors/unlock/unlock.d.ts

@@ -0,0 +1,4 @@
+import type { PromiseExecutor } from '@nx/devkit';
+import { type SstLifecycleOptions } from '../sst-lifecycle/run-sst-command.js';
+declare const executor: PromiseExecutor<SstLifecycleOptions>;
+export default executor;

package/src/executors/unlock/unlock.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+const executor = (options, context) => (0, run_sst_command_js_1.runSstCommand)('unlock', options, context);
+exports.default = executor;
+//# sourceMappingURL=unlock.js.map

package/src/executors/unlock/unlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlock.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/unlock/unlock.ts"],"names":[],"mappings":";;AACA,4EAG6C;AAE7C,MAAM,QAAQ,GAAyC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAC1E,IAAA,kCAAa,EAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE5C,kBAAe,QAAQ,CAAC"}

package/src/executors/work-markers/schema.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit work markers",
+  "description": "Report source work markers and enforce syntax, generated-file ownership, and optional protected-promotion blockers.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "protected": {
+      "type": "boolean",
+      "description": "Fail when unresolved EBK-SECURITY or EBK-BLOCKER markers are present. Protected deploy and refresh set this automatically."
+    }
+  }
+}

package/src/executors/work-markers/work-markers.d.ts

@@ -0,0 +1,6 @@
+import { type PromiseExecutor } from '@nx/devkit';
+interface WorkMarkersOptions {
+    protected?: boolean;
+}
+declare const executor: PromiseExecutor<WorkMarkersOptions>;
+export default executor;

package/src/executors/work-markers/work-markers.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../work-markers/index.js");
+const executor = async (options, context) => {
+    try {
+        const report = (0, index_js_1.scanWorkMarkers)(context.root);
+        devkit_1.logger.info((0, index_js_1.formatWorkMarkerReport)(report));
+        (0, index_js_1.assertWorkMarkerReport)(report, {
+            protectedPromotion: options.protected === true,
+        });
+        return { success: true };
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+};
+exports.default = executor;
+//# sourceMappingURL=work-markers.js.map

package/src/executors/work-markers/work-markers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-markers.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/work-markers/work-markers.ts"],"names":[],"mappings":";;AAAA,uCAA0D;AAC1D,0DAIqC;AAMrC,MAAM,QAAQ,GAAwC,KAAK,EACzD,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,eAAM,CAAC,IAAI,CAAC,IAAA,iCAAsB,EAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,IAAA,iCAAsB,EAAC,MAAM,EAAE;YAC7B,kBAAkB,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI;SAC/C,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/foundation/aurora-logical-database.d.ts

@@ -0,0 +1,76 @@
+import type { ExecuteStatementCommand, RDSDataClient } from '@aws-sdk/client-rds-data';
+export interface AuroraLogicalDbInputs {
+    clusterArn: string;
+    masterSecretArn: string;
+    database: string;
+    readwriteRole: string;
+    readonlyRole: string;
+    removalPolicy?: 'retain' | 'destroy';
+    rotationToken?: string;
+}
+export interface AuroraLogicalDbState extends AuroraLogicalDbInputs {
+    readwritePassword: string;
+    readonlyPassword: string;
+    id: string;
+}
+export interface DataApiExecutor {
+    execute(database: string, sql: string): Promise<void>;
+    exists(database: string, existsSql: string): Promise<boolean>;
+}
+type ExecuteStatementCommandConstructor = new (input: ConstructorParameters<typeof ExecuteStatementCommand>[0]) => ExecuteStatementCommand;
+export declare class RdsDataApiExecutor implements DataApiExecutor {
+    private readonly client;
+    private readonly resourceArn;
+    private readonly secretArn;
+    private readonly ExecuteStatementCommand;
+    constructor(client: RDSDataClient, resourceArn: string, secretArn: string, ExecuteStatementCommand: ExecuteStatementCommandConstructor);
+    execute(database: string, sql: string): Promise<void>;
+    exists(database: string, existsSql: string): Promise<boolean>;
+}
+export declare function createDatabaseSql(database: string): string;
+export declare function databaseExistsSql(database: string): string;
+export declare function roleExistsSql(role: string): string;
+export declare function createRoleSql(role: string, password: string): string;
+export declare function alterRolePasswordSql(role: string, password: string): string;
+export declare function grantScopedAccessSql(database: string, readwriteRole: string, readonlyRole: string): string[];
+export type PasswordGenerator = () => string;
+export interface PulumiCreateResult {
+    id: string;
+    outs?: Record<string, unknown>;
+}
+export interface PulumiUpdateResult {
+    outs?: Record<string, unknown>;
+}
+export interface AuroraLogicalDbProviderOptions {
+    executorFactory?: (inputs: AuroraLogicalDbInputs) => DataApiExecutor;
+    passwordGenerator?: PasswordGenerator;
+}
+export declare class AuroraLogicalDbProvider {
+    private readonly executorFactory?;
+    private readonly passwordGenerator;
+    constructor(options?: AuroraLogicalDbProviderOptions);
+    private buildExecutor;
+    private generateSecret;
+    create(inputs: AuroraLogicalDbInputs): Promise<PulumiCreateResult>;
+    private createInternal;
+    update(_id: string, olds: AuroraLogicalDbState, news: AuroraLogicalDbInputs): Promise<PulumiUpdateResult>;
+    private updateInternal;
+    delete(_id: string, props: AuroraLogicalDbState): Promise<void>;
+    private deleteInternal;
+}
+export interface AuroraLogicalDbResource {
+    readwritePassword: unknown;
+    readonlyPassword: unknown;
+    [key: string]: unknown;
+}
+export interface AuroraLogicalDbResourceOptions {
+    additionalSecretOutputs?: string[];
+    [key: string]: unknown;
+}
+export interface CreateAuroraLogicalDbOptions {
+    name: string;
+    args: AuroraLogicalDbInputs | Record<string, unknown>;
+    opts?: AuroraLogicalDbResourceOptions;
+}
+export declare function createAuroraLogicalDbResource(options: CreateAuroraLogicalDbOptions): AuroraLogicalDbResource;
+export {};