@empire-builder-kit/nx 1.0.0-beta.4 → 1.0.0-beta.6

package/README.md

@@ -9,12 +9,21 @@ Generators:
 - `function`
 - `service`
 - `job`
+- `repository-policy`
 - `upgrade`
 
-The package also owns Foundation discovery and preflight, trusted external
-Blueprint execution, Standard Foundation and Product Slice generated-file
-ownership, and Nx-wrapped SST lifecycle executors. Consumers should never
-invoke SST lifecycle commands directly.
+The package also owns Repository Operating Policy validation and protected
+deployment planning, generated Git routing and report-first GitHub bootstrap,
+Foundation discovery/profile preflight, trusted external Blueprint execution,
+generated-file ownership, ownership-aware agent work-marker reporting and
+protected-promotion enforcement, and Nx-wrapped SST lifecycle executors.
+Consumers should never invoke SST lifecycle commands directly.
+
+Generated workspaces expose `work-markers` as both a direct target and part of
+workspace health. The generated `AGENTS.md`, `CLAUDE.md`, and runbook define how
+deterministic generators and updates can hand contextual work to agents without
+placing markers in managed output. The public `formatWorkMarkerComment` helper
+keeps Blueprint and repository-update handoffs on the same canonical syntax.
 
 External Blueprints must be exact-version packages allowed by the workspace
 trust policy. Their generator runs in a bounded child process, which is a

package/executors.json

@@ -15,11 +15,31 @@
       "schema": "./src/executors/dev-setup/schema.json",
       "description": "Explicitly create, trust, upgrade, or remove the per-user local HTTPS gateway."
     },
+    "deployment-plan": {
+      "implementation": "./src/executors/deployment-plan/deployment-plan",
+      "schema": "./src/executors/deployment-plan/schema.json",
+      "description": "Atomically validate and select the complete protected deployment set before AWS access."
+    },
+    "work-markers": {
+      "implementation": "./src/executors/work-markers/work-markers",
+      "schema": "./src/executors/work-markers/schema.json",
+      "description": "Report ownership-aware source work markers and enforce protected-promotion blockers."
+    },
+    "github-bootstrap": {
+      "implementation": "./src/executors/github-bootstrap/github-bootstrap",
+      "schema": "./src/executors/github-bootstrap/schema.json",
+      "description": "Report or explicitly apply protected GitHub rulesets and environments without creating secrets."
+    },
     "foundation-preflight": {
       "implementation": "./src/executors/foundation-preflight/foundation-preflight",
       "schema": "./src/executors/foundation-preflight/schema.json",
       "description": "Validate the deployed Standard Foundation contract before operating a Product Slice."
     },
+    "foundation-profile-preflight": {
+      "implementation": "./src/executors/foundation-profile-preflight/foundation-profile-preflight",
+      "schema": "./src/executors/foundation-profile-preflight/schema.json",
+      "description": "Verify the pinned Aurora profile capability before a protected Foundation mutation."
+    },
     "foundation-remove-preflight": {
       "implementation": "./src/executors/foundation-remove-preflight/foundation-remove-preflight",
       "schema": "./src/executors/foundation-remove-preflight/schema.json",

package/generators.json

@@ -20,6 +20,11 @@
       "schema": "./src/generators/slice/schema.json",
       "description": "Generate an EBK v1 product slice from the built-in or a trusted external Blueprint."
     },
+    "repository-policy": {
+      "factory": "./src/generators/repository-policy/repository-policy",
+      "schema": "./src/generators/repository-policy/schema.json",
+      "description": "Report or apply an explicit source-controlled Repository Operating Policy change without touching AWS or GitHub."
+    },
     "upgrade": {
       "factory": "./src/generators/upgrade/upgrade",
       "schema": "./src/generators/upgrade/schema.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "license": "Apache-2.0",
   "type": "commonjs",
@@ -20,6 +20,10 @@
       "types": "./src/foundation/index.d.ts",
       "default": "./src/foundation/index.js"
     },
+    "./git-policy": {
+      "types": "./src/git-policy/index.d.ts",
+      "default": "./src/git-policy/index.js"
+    },
     "./local-dev": {
       "types": "./src/local-dev/index.d.ts",
       "default": "./src/local-dev/index.js"
@@ -28,11 +32,20 @@
       "types": "./src/ownership/index.d.ts",
       "default": "./src/ownership/index.js"
     },
+    "./repository-policy": {
+      "types": "./src/repository-policy/index.d.ts",
+      "default": "./src/repository-policy/index.js"
+    },
+    "./work-markers": {
+      "types": "./src/work-markers/index.d.ts",
+      "default": "./src/work-markers/index.js"
+    },
     "./schemas/blueprint-v1.json": "./src/schemas/blueprint-v1.json",
     "./schemas/blueprint-input-schema-v1.json": "./src/schemas/blueprint-input-schema-v1.json",
     "./schemas/foundation-requirement-v1.json": "./src/schemas/foundation-requirement-v1.json",
     "./schemas/foundation-ownership-v2.json": "./src/schemas/foundation-ownership-v2.json",
     "./schemas/generated-ownership-v2.json": "./src/schemas/generated-ownership-v2.json",
+    "./schemas/repository-policy-v1.json": "./src/schemas/repository-policy-v1.json",
     "./schemas/workspace-ownership-v2.json": "./src/schemas/workspace-ownership-v2.json"
   },
   "generators": "./generators.json",
@@ -43,6 +56,7 @@
   },
   "dependencies": {
     "@nx/devkit": "23.1.0",
+    "@aws-sdk/client-rds": "^3.700.0",
     "@aws-sdk/client-rds-data": "^3.700.0",
     "@aws-sdk/client-ssm": "^3.700.0",
     "@aws-sdk/credential-providers": "^3.700.0",

package/src/executors/deployment-plan/deployment-plan.d.ts

@@ -0,0 +1,9 @@
+import { type PromiseExecutor } from '@nx/devkit';
+import { type ProtectedDeploymentAction, type ProtectedDeploymentStage } from '../../repository-policy/index.js';
+interface DeploymentPlanOptions {
+    action: ProtectedDeploymentAction;
+    project?: string;
+    stage: ProtectedDeploymentStage;
+}
+declare const executor: PromiseExecutor<DeploymentPlanOptions>;
+export default executor;

package/src/executors/deployment-plan/deployment-plan.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../repository-policy/index.js");
+const index_js_2 = require("../../work-markers/index.js");
+function writeGithubOutputs(plan) {
+    const output = process.env.GITHUB_OUTPUT?.trim();
+    if (!output)
+        return;
+    (0, node_fs_1.appendFileSync)(output, [
+        `foundation_project=${plan.foundationProject ?? ''}`,
+        `foundation_profile=${plan.effectiveProductionProfile ?? ''}`,
+        `has_slices=${plan.sliceProjects.length > 0 ? 'true' : 'false'}`,
+        `ordered_projects=${plan.orderedProjects.join(',')}`,
+        `slice_projects=${plan.sliceProjects.join(',')}`,
+        '',
+    ].join('\n'), 'utf8');
+}
+const executor = async (options, context) => {
+    try {
+        if (options.action === 'deploy' || options.action === 'refresh') {
+            const markerReport = (0, index_js_2.scanWorkMarkers)(context.root);
+            devkit_1.logger.info((0, index_js_2.formatWorkMarkerReport)(markerReport));
+            (0, index_js_2.assertWorkMarkerReport)(markerReport, { protectedPromotion: true });
+        }
+        const policy = (0, index_js_1.readRepositoryOperatingPolicy)(context.root);
+        const plan = (0, index_js_1.createProtectedDeploymentPlan)(policy, {
+            action: options.action,
+            projects: Object.entries(context.projectsConfigurations?.projects ?? {}).map(([name, project]) => ({
+                name,
+                tags: project.tags,
+                targets: project.targets,
+            })),
+            ...(options.project?.trim()
+                ? { requestedProject: options.project.trim() }
+                : {}),
+            stage: options.stage,
+        });
+        devkit_1.logger.info(`[ebk-deployment-plan] validated before AWS access\n${JSON.stringify(plan, null, 2)}`);
+        writeGithubOutputs(plan);
+        return { success: true };
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+};
+exports.default = executor;
+//# sourceMappingURL=deployment-plan.js.map

package/src/executors/deployment-plan/deployment-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-plan.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/deployment-plan/deployment-plan.ts"],"names":[],"mappings":";;AAAA,qCAAyC;AACzC,uCAA0D;AAC1D,+DAK0C;AAC1C,0DAIqC;AAQrC,SAAS,kBAAkB,CAAC,IAK3B;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAA,wBAAc,EACZ,MAAM,EACN;QACE,sBAAsB,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE;QACpD,sBAAsB,IAAI,CAAC,0BAA0B,IAAI,EAAE,EAAE;QAC7D,cAAc,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAChE,oBAAoB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,kBAAkB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAA2C,KAAK,EAC5D,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,YAAY,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,eAAM,CAAC,IAAI,CAAC,IAAA,iCAAsB,EAAC,YAAY,CAAC,CAAC,CAAC;YAClD,IAAA,iCAAsB,EAAC,YAAY,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAA,wCAA6B,EAAC,MAAM,EAAE;YACjD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,MAAM,CAAC,OAAO,CACtB,OAAO,CAAC,sBAAsB,EAAE,QAAQ,IAAI,EAAE,CAC/C,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE;gBACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,eAAM,CAAC,IAAI,CACT,sDAAsD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CACtF,CAAC;QACF,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/deployment-plan/schema.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit protected deployment plan",
+  "description": "Validate the complete protected project set before any AWS credentials or mutation are available.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "action": {
+      "type": "string",
+      "enum": ["deploy", "refresh", "remove", "unlock"]
+    },
+    "stage": {
+      "type": "string",
+      "enum": ["staging", "production"]
+    },
+    "project": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "description": "Required only for explicit remove or unlock recovery. Deploy and refresh derive their complete set from policy."
+    }
+  },
+  "required": ["action", "stage"]
+}

package/src/executors/foundation-preflight/foundation-preflight.js

@@ -4,6 +4,7 @@ const devkit_1 = require("@nx/devkit");
 const preflight_js_1 = require("../../foundation/preflight.js");
 const discovery_js_1 = require("../../foundation/discovery.js");
 const stages_js_1 = require("../../foundation/stages.js");
+const index_js_1 = require("../../repository-policy/index.js");
 const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
 async function deployFoundation(options, context, foundationStage) {
     const project = options.foundationProject?.trim() || 'foundation';
@@ -33,6 +34,22 @@ const executor = async (options, context) => {
         devkit_1.logger.error(error instanceof Error ? error.message : String(error));
         return { success: false };
     }
+    if (stages.consumerStage === 'production') {
+        try {
+            if (!context.projectName) {
+                throw new Error('Production Foundation preflight requires an Nx Product Slice project name.');
+            }
+            (0, index_js_1.assertRepositoryPolicyRequest)(context.root, {
+                action: 'deploy',
+                projects: [{ kind: 'slice', name: context.projectName }],
+                stage: stages.consumerStage,
+            });
+        }
+        catch (error) {
+            devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+            return { success: false };
+        }
+    }
     const requestedRegion = options.region?.trim() ||
         process.env.AWS_REGION?.trim() ||
         process.env.AWS_DEFAULT_REGION?.trim();
@@ -56,6 +73,11 @@ const executor = async (options, context) => {
         if (report.state === 'absent' &&
             options.deployIfMissing === true &&
             !stages.mapped) {
+            if (stages.foundationStage === 'staging' ||
+                stages.foundationStage === 'production') {
+                devkit_1.logger.error(`[foundation-preflight] ${stages.foundationStage} Foundation is absent. Protected workflows must run the Foundation target and its profile capability preflight before Product Slices; Foundation auto-deploy is disabled for protected stages.`);
+                return { success: false };
+            }
             const deployed = await deployFoundation(options, context, stages.foundationStage);
             if (!deployed)
                 return { success: false };

package/src/executors/foundation-preflight/foundation-preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"foundation-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-preflight/foundation-preflight.ts"],"names":[],"mappings":";;AAAA,uCAAgF;AAChF,gEAIuC;AACvC,gEAAgF;AAEhF,0DAAqE;AACrE,4EAAoE;AAcpE,KAAK,UAAU,gBAAgB,CAC7B,OAAmC,EACnC,OAAwB,EACxB,eAAuB;IAEvB,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAM,CAAC,KAAK,CACV,6CAA6C,OAAO,yCAAyC,CAC9F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAM,CAAC,IAAI,CACT,oCAAoC,OAAO,uBAAuB,eAAe,GAAG,CACrF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAa,EAChC,QAAQ,EACR;QACE,GAAG,EAAE,IAAI;QACT,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,YAAY;KACxB,EACD,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CACrC,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,QAAQ,GAAgD,KAAK,EACjE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,mCAAuB,EAAC;YAC/B,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,eAAe,GACnB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAA,8CAA+B,EAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,eAAe,IAAI,SAAS,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,MAAM;YACN,WAAW,EAAE;gBACX,YAAY,EACV,OAAO,CAAC,YAAY,IAAI,8CAA+B,CAAC,YAAY;gBACtE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;aACvE;SACF,CAAC,CAAC;QACH,IACE,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,CAAC,MAAM,CAAC,MAAM,EACd,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,OAAO,EACP,OAAO,EACP,MAAM,CAAC,eAAe,CACvB,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzC,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;gBACzC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,cAAc,EAAE,MAAM,CAAC,IAAI;gBAC3B,MAAM;gBACN,WAAW,EAAE;oBACX,YAAY,EACV,OAAO,CAAC,YAAY;wBACpB,8CAA+B,CAAC,YAAY;oBAC9C,QAAQ,EACN,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;iBAC/D;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,8CAA+B,EAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,eAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,eAAM,CAAC,IAAI,CACT,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,oDAAoD,OAAO,EAAE,CACrL,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,eAAM,CAAC,KAAK,CACV,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,4BAA4B,OAAO,EAAE,CAC7J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}
+{"version":3,"file":"foundation-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-preflight/foundation-preflight.ts"],"names":[],"mappings":";;AAAA,uCAAgF;AAChF,gEAIuC;AACvC,gEAAgF;AAEhF,0DAAqE;AACrE,+DAAiF;AACjF,4EAAoE;AAcpE,KAAK,UAAU,gBAAgB,CAC7B,OAAmC,EACnC,OAAwB,EACxB,eAAuB;IAEvB,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAM,CAAC,KAAK,CACV,6CAA6C,OAAO,yCAAyC,CAC9F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAM,CAAC,IAAI,CACT,oCAAoC,OAAO,uBAAuB,eAAe,GAAG,CACrF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAa,EAChC,QAAQ,EACR;QACE,GAAG,EAAE,IAAI;QACT,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,YAAY;KACxB,EACD,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CACrC,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,QAAQ,GAAgD,KAAK,EACjE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,mCAAuB,EAAC;YAC/B,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YACD,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;gBAC1C,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GACnB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAA,8CAA+B,EAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,eAAe,IAAI,SAAS,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,MAAM;YACN,WAAW,EAAE;gBACX,YAAY,EACV,OAAO,CAAC,YAAY,IAAI,8CAA+B,CAAC,YAAY;gBACtE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;aACvE;SACF,CAAC,CAAC;QACH,IACE,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,CAAC,MAAM,CAAC,MAAM,EACd,CAAC;YACD,IACE,MAAM,CAAC,eAAe,KAAK,SAAS;gBACpC,MAAM,CAAC,eAAe,KAAK,YAAY,EACvC,CAAC;gBACD,eAAM,CAAC,KAAK,CACV,0BAA0B,MAAM,CAAC,eAAe,gMAAgM,CACjP,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,OAAO,EACP,OAAO,EACP,MAAM,CAAC,eAAe,CACvB,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzC,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;gBACzC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,cAAc,EAAE,MAAM,CAAC,IAAI;gBAC3B,MAAM;gBACN,WAAW,EAAE;oBACX,YAAY,EACV,OAAO,CAAC,YAAY;wBACpB,8CAA+B,CAAC,YAAY;oBAC9C,QAAQ,EACN,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;iBAC/D;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,8CAA+B,EAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,eAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,eAAM,CAAC,IAAI,CACT,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,oDAAoD,OAAO,EAAE,CACrL,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,eAAM,CAAC,KAAK,CACV,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,4BAA4B,OAAO,EAAE,CAC7J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.d.ts

@@ -0,0 +1,8 @@
+import { type PromiseExecutor } from '@nx/devkit';
+interface FoundationProfilePreflightOptions {
+    profile?: string;
+    region?: string;
+    stage: string;
+}
+declare const executor: PromiseExecutor<FoundationProfilePreflightOptions>;
+export default executor;

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../repository-policy/index.js");
+const stages_js_1 = require("../../foundation/stages.js");
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+const executor = async (options, context) => {
+    try {
+        const stage = (0, stages_js_1.requireFoundationStage)(options.stage);
+        if (stage === 'development') {
+            devkit_1.logger.info('[foundation-profile-preflight] development uses the generated non-production profile; no protected profile check is required.');
+            return { success: true };
+        }
+        (0, run_sst_command_js_1.assertSstLifecyclePolicy)('deploy', stage);
+        (0, index_js_1.assertRepositoryPolicyRequest)(context.root, {
+            action: 'deploy',
+            projects: [{ kind: 'foundation', name: 'foundation' }],
+            stage,
+        });
+        const requestedRegion = options.region?.trim() ||
+            process.env.AWS_REGION?.trim() ||
+            process.env.AWS_DEFAULT_REGION?.trim();
+        const reader = (0, index_js_1.createAuroraProfileCapabilityReader)({
+            ...(options.profile?.trim() ? { profile: options.profile.trim() } : {}),
+            ...(requestedRegion ? { region: requestedRegion } : {}),
+        });
+        const region = requestedRegion ?? (await reader.resolveRegion());
+        const report = (0, index_js_1.evaluateAuroraProfileCapability)(await reader.read(), region);
+        if (!report.ok) {
+            throw new Error(`Aurora ${report.engine} ${report.engineVersion} is not orderable as db.serverless in ${report.region}; protected Foundation deployment is blocked before mutation.`);
+        }
+        devkit_1.logger.info(`[foundation-profile-preflight] Aurora ${report.engine} ${report.engineVersion} is orderable as db.serverless in ${report.region}.`);
+        return { success: true };
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+};
+exports.default = executor;
+//# sourceMappingURL=foundation-profile-preflight.js.map

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foundation-profile-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-profile-preflight/foundation-profile-preflight.ts"],"names":[],"mappings":";;AAAA,uCAA0D;AAC1D,+DAI0C;AAC1C,0DAAoE;AACpE,4EAA+E;AAQ/E,MAAM,QAAQ,GAAuD,KAAK,EACxE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,eAAM,CAAC,IAAI,CACT,+HAA+H,CAChI,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,IAAA,6CAAwB,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACtD,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,eAAe,GACnB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;YACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;YAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAA,8CAAmC,EAAC;YACjD,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,IAAI,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAA,0CAA+B,EAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,yCAAyC,MAAM,CAAC,MAAM,+DAA+D,CACrK,CAAC;QACJ,CAAC;QACD,eAAM,CAAC,IAAI,CACT,yCAAyC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,qCAAqC,MAAM,CAAC,MAAM,GAAG,CACpI,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/foundation-profile-preflight/schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit production Foundation profile preflight",
+  "description": "Verify the pinned Aurora Serverless engine is orderable in the selected Region before Foundation mutation.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "stage": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "default": "development"
+    },
+    "profile": {
+      "type": "string",
+      "description": "Optional local AWS profile. Protected stages are still restricted to the generated GitHub workflow."
+    },
+    "region": { "type": "string" }
+  },
+  "required": ["stage"]
+}

package/src/executors/github-bootstrap/github-bootstrap.d.ts

@@ -0,0 +1,8 @@
+import { type PromiseExecutor } from '@nx/devkit';
+interface GitHubBootstrapExecutorOptions {
+    apply?: boolean;
+    productionReviewerIds?: string;
+    repository?: string;
+}
+declare const executor: PromiseExecutor<GitHubBootstrapExecutorOptions>;
+export default executor;

package/src/executors/github-bootstrap/github-bootstrap.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../git-policy/index.js");
+function parseReviewerIds(value) {
+    if (!value?.trim())
+        return [];
+    return value.split(',').map((item) => Number(item.trim()));
+}
+const executor = async (options) => {
+    try {
+        const report = await (0, index_js_1.runGitHubBootstrap)({
+            apply: options.apply === true,
+            productionReviewerIds: parseReviewerIds(options.productionReviewerIds),
+            repository: options.repository?.trim() || process.env.GH_REPO?.trim() || '',
+            token: process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || '',
+        });
+        devkit_1.logger.info(JSON.stringify(report, null, 2));
+        return { success: options.apply ? report.ready : true };
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+};
+exports.default = executor;
+//# sourceMappingURL=github-bootstrap.js.map

package/src/executors/github-bootstrap/github-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-bootstrap.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/github-bootstrap/github-bootstrap.ts"],"names":[],"mappings":";;AAAA,uCAA0D;AAC1D,wDAA+D;AAQ/D,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,QAAQ,GAAoD,KAAK,EACrE,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAkB,EAAC;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;YAC7B,qBAAqB,EAAE,gBAAgB,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACtE,UAAU,EACR,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;YACjE,KAAK,EACH,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE;SACzE,CAAC,CAAC;QACH,eAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/github-bootstrap/schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit GitHub bootstrap",
+  "description": "Report or explicitly apply protected repository rules and environments without creating secrets, branches, or credentials.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "repository": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+      "description": "Explicit GitHub owner/repository target."
+    },
+    "apply": {
+      "type": "boolean",
+      "default": false,
+      "description": "Apply the reported GitHub settings. Omit for the default read-only report."
+    },
+    "productionReviewerIds": {
+      "type": "string",
+      "pattern": "^[1-9][0-9]*(,[1-9][0-9]*)*$",
+      "description": "Optional comma-separated GitHub user IDs for production approval. Existing reviewers are preserved when omitted."
+    }
+  }
+}

package/src/executors/sst-lifecycle/run-sst-command.d.ts

@@ -16,9 +16,11 @@ export interface SstCommandInvocation {
     environment: {
         EBK_CONSUMER_STAGE: string;
         EBK_FOUNDATION_STAGE: string;
+        EBK_PRODUCTION_FOUNDATION_PROFILE?: string;
     };
     executable: string;
 }
+export declare function createSstChildEnvironment(ambient: NodeJS.ProcessEnv, invocation: SstCommandInvocation['environment']): NodeJS.ProcessEnv;
 export declare function assertSafeSstForwardedArguments(args: readonly string[]): void;
 export declare function assertSstLifecyclePolicy(command: SstLifecycleCommand, stage: string, environment?: NodeJS.ProcessEnv): void;
 export declare function resolveSstLifecycleStages(options: SstLifecycleOptions, environment?: NodeJS.ProcessEnv): FoundationStageResolution;

package/src/executors/sst-lifecycle/run-sst-command.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSstChildEnvironment = createSstChildEnvironment;
 exports.assertSafeSstForwardedArguments = assertSafeSstForwardedArguments;
 exports.assertSstLifecyclePolicy = assertSstLifecyclePolicy;
 exports.resolveSstLifecycleStages = resolveSstLifecycleStages;
@@ -9,6 +10,8 @@ const devkit_1 = require("@nx/devkit");
 const node_child_process_1 = require("node:child_process");
 const node_path_1 = require("node:path");
 const stages_js_1 = require("../../foundation/stages.js");
+const index_js_1 = require("../../repository-policy/index.js");
+const index_js_2 = require("../../work-markers/index.js");
 const PROTECTED_STAGES = new Set(['staging', 'production']);
 const RESERVED_FORWARDED_OPTIONS = new Set([
     '--config',
@@ -16,6 +19,23 @@ const RESERVED_FORWARDED_OPTIONS = new Set([
     '--stage',
     '--target',
 ]);
+function projectKind(context) {
+    if (!context.projectName) {
+        throw new Error('SST lifecycle requires an Nx project name for tag-derived Repository Operating Policy evaluation.');
+    }
+    const tags = context.projectsConfigurations?.projects[context.projectName]?.tags ?? [];
+    const foundation = tags.includes('scope:foundation');
+    const slice = tags.includes('type:slice');
+    if (foundation === slice) {
+        throw new Error(`Nx project ${context.projectName} must declare exactly one lifecycle kind tag: scope:foundation or type:slice.`);
+    }
+    return foundation ? 'foundation' : 'slice';
+}
+function createSstChildEnvironment(ambient, invocation) {
+    const sanitized = { ...ambient };
+    delete sanitized.EBK_PRODUCTION_FOUNDATION_PROFILE;
+    return { ...sanitized, ...invocation };
+}
 function assertSafeSstForwardedArguments(args) {
     const reserved = args.find((argument) => {
         const option = argument.split('=', 1)[0].toLowerCase();
@@ -33,16 +53,21 @@ function assertSstLifecyclePolicy(command, stage, environment = process.env) {
         throw new Error(`SST dev is not permitted for protected stage ${stage}.`);
     }
     const repository = environment.GITHUB_REPOSITORY;
+    const expectedBranch = stage === 'staging' ? 'develop' : 'main';
+    const expectedRef = `refs/heads/${expectedBranch}`;
     const expectedWorkflowRef = repository
-        ? `${repository}/.github/workflows/deploy.yml@refs/heads/main`
+        ? `${repository}/.github/workflows/deploy.yml@${expectedRef}`
         : undefined;
+    const eventName = environment.GITHUB_EVENT_NAME;
+    const allowedEvent = eventName === 'workflow_dispatch' ||
+        (eventName === 'push' && command === 'deploy');
     const trustedWorkflow = Boolean(repository) &&
         environment.GITHUB_ACTIONS === 'true' &&
-        environment.GITHUB_EVENT_NAME === 'workflow_dispatch' &&
-        environment.GITHUB_REF === 'refs/heads/main' &&
+        allowedEvent &&
+        environment.GITHUB_REF === expectedRef &&
         environment.GITHUB_WORKFLOW_REF === expectedWorkflowRef;
     if (!trustedWorkflow) {
-        throw new Error(`SST ${command} for protected stage ${stage} must run from the main-branch deploy workflow.`);
+        throw new Error(`SST ${command} for protected stage ${stage} must run from the ${expectedBranch}-branch deploy workflow; pushes may run only deploy and other lifecycle actions require workflow_dispatch.`);
     }
     if (command === 'remove' &&
         stage === 'production' &&
@@ -72,6 +97,11 @@ function resolveSstLifecycleStages(options, environment = process.env) {
     });
 }
 function buildSstCommandInvocation(command, options, context, environment = process.env) {
+    const kind = projectKind(context);
+    const expectedStageMode = kind === 'foundation' ? 'foundation' : 'consumer';
+    if (options.stageMode !== expectedStageMode) {
+        throw new Error(`Nx project ${context.projectName} is tagged as ${kind} and requires stageMode ${expectedStageMode}; executor options cannot change project kind.`);
+    }
     const configuredRoot = context.projectName
         ? context.projectsConfigurations?.projects[context.projectName]?.root
         : undefined;
@@ -86,6 +116,24 @@ function buildSstCommandInvocation(command, options, context, environment = proc
         throw new Error(`Full deploy is not permitted for mapped consumer stage ${stages.consumerStage}. Use dev against the ${stages.foundationStage} Foundation until preview routing is supported.`);
     }
     assertSstLifecyclePolicy(command, stages.consumerStage, environment);
+    if (PROTECTED_STAGES.has(stages.consumerStage) &&
+        (command === 'deploy' || command === 'refresh')) {
+        (0, index_js_2.assertWorkMarkerReport)((0, index_js_2.scanWorkMarkers)(context.root), {
+            protectedPromotion: true,
+        });
+    }
+    const policyDecision = stages.consumerStage === 'production'
+        ? (0, index_js_1.assertRepositoryPolicyRequest)(context.root, {
+            action: command,
+            projects: [
+                {
+                    kind,
+                    name: context.projectName ?? '',
+                },
+            ],
+            stage: stages.consumerStage,
+        })
+        : undefined;
     const args = [command, '--stage', stages.consumerStage];
     if (options.profile) {
         args.push('--profile', options.profile);
@@ -106,6 +154,11 @@ function buildSstCommandInvocation(command, options, context, environment = proc
         environment: {
             EBK_CONSUMER_STAGE: stages.consumerStage,
             EBK_FOUNDATION_STAGE: stages.foundationStage,
+            ...(policyDecision?.effectiveProductionProfile
+                ? {
+                    EBK_PRODUCTION_FOUNDATION_PROFILE: policyDecision.effectiveProductionProfile,
+                }
+                : {}),
         },
         executable: process.execPath,
     };
@@ -123,7 +176,7 @@ async function runSstCommand(command, options, context) {
     return new Promise((resolve) => {
         const child = (0, node_child_process_1.spawn)(invocation.executable, invocation.args, {
             cwd: invocation.cwd,
-            env: { ...process.env, ...invocation.environment },
+            env: createSstChildEnvironment(process.env, invocation.environment),
             shell: false,
             stdio: 'inherit',
         });

package/src/executors/sst-lifecycle/run-sst-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-sst-command.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/run-sst-command.ts"],"names":[],"mappings":";;AAwCA,0EAWC;AAED,4DAiCC;AAED,8DA4BC;AAED,8DAiDC;AAED,sCAoDC;AA7ND,uCAA0D;AAC1D,2DAA2C;AAC3C,yCAA6C;AAC7C,0DAIoC;AAyBpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,SAAgB,+BAA+B,CAAC,IAAuB;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,qDAAqD,CACxH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAA4B,EAC5B,KAAa,EACb,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IACzC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACjD,MAAM,mBAAmB,GAAG,UAAU;QACpC,CAAC,CAAC,GAAG,UAAU,+CAA+C;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,eAAe,GACnB,OAAO,CAAC,UAAU,CAAC;QACnB,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,WAAW,CAAC,iBAAiB,KAAK,mBAAmB;QACrD,WAAW,CAAC,UAAU,KAAK,iBAAiB;QAC5C,WAAW,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;IAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,wBAAwB,KAAK,iDAAiD,CAC7F,CAAC;IACJ,CAAC;IACD,IACE,OAAO,KAAK,QAAQ;QACpB,KAAK,KAAK,YAAY;QACtB,WAAW,CAAC,2BAA2B,KAAK,MAAM,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,OAAO,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IACE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE;YAC/B,IAAA,kCAAsB,EAAC,OAAO,CAAC,eAAe,CAAC,KAAK,KAAK,EACzD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,mCAAmC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CACxG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAA,mCAAuB,EAAC;QAC7B,aAAa,EAAE,OAAO,CAAC,KAAK;QAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC,oBAAoB;KAC9D,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB,EACxB,cAAiC,OAAO,CAAC,GAAG;IAE5C,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW;QACxC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI;QACrE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IACpE,MAAM,GAAG,GAAG,IAAA,sBAAU,EAAC,aAAa,CAAC;QACnC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/D,IACE,OAAO,CAAC,SAAS,KAAK,UAAU;QAChC,OAAO,KAAK,QAAQ;QACpB,MAAM,CAAC,MAAM,EACb,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,aAAa,yBAAyB,MAAM,CAAC,eAAe,iDAAiD,CAC/K,CAAC;IACJ,CAAC;IACD,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAExD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,+BAA+B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;YAC3D,GAAG,IAAI;SACR;QACD,GAAG;QACH,WAAW,EAAE;YACX,kBAAkB,EAAE,MAAM,CAAC,aAAa;YACxC,oBAAoB,EAAE,MAAM,CAAC,eAAe;SAC7C;QACD,UAAU,EAAE,OAAO,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB;IAExB,IAAI,UAAgC,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,eAAM,CAAC,IAAI,CACT,0BAA0B,OAAO,YAAY,UAAU,CAAC,WAAW,CAAC,kBAAkB,oBAAoB,UAAU,CAAC,WAAW,CAAC,oBAAoB,KAAK,UAAU,CAAC,GAAG,GAAG,CAC5K,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC1D,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,EAAE;YAClD,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,eAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,eAAM,CAAC,KAAK,CACV,MAAM;oBACJ,CAAC,CAAC,OAAO,OAAO,2BAA2B,MAAM,GAAG;oBACpD,CAAC,CAAC,OAAO,OAAO,uBAAuB,IAAI,IAAI,SAAS,GAAG,CAC9D,CAAC;gBACF,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACjD,eAAM,CAAC,KAAK,CACV,2CAA2C,OAAO,CAAC,WAAW,IAAI,WAAW,mBAAmB,OAAO,CAAC,KAAK,GAAG,CACjH,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"run-sst-command.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/run-sst-command.ts"],"names":[],"mappings":";;AAgEA,8DAOC;AAED,0EAWC;AAED,4DAuCC;AAED,8DA4BC;AAED,8DAmFC;AAED,sCAoDC;AAtSD,uCAA0D;AAC1D,2DAA2C;AAC3C,yCAA6C;AAC7C,0DAIoC;AACpC,+DAAiF;AACjF,0DAGqC;AA0BrC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,OAAwB;IAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,+EAA+E,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA0B,EAC1B,UAA+C;IAE/C,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACjC,OAAO,SAAS,CAAC,iCAAiC,CAAC;IACnD,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,SAAgB,+BAA+B,CAAC,IAAuB;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,qDAAqD,CACxH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAA4B,EAC5B,KAAa,EACb,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IACzC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACjD,MAAM,cAAc,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,WAAW,GAAG,cAAc,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAG,UAAU;QACpC,CAAC,CAAC,GAAG,UAAU,iCAAiC,WAAW,EAAE;QAC7D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,WAAW,CAAC,iBAAiB,CAAC;IAChD,MAAM,YAAY,GAChB,SAAS,KAAK,mBAAmB;QACjC,CAAC,SAAS,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC;IACjD,MAAM,eAAe,GACnB,OAAO,CAAC,UAAU,CAAC;QACnB,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,YAAY;QACZ,WAAW,CAAC,UAAU,KAAK,WAAW;QACtC,WAAW,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;IAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,wBAAwB,KAAK,sBAAsB,cAAc,4GAA4G,CAC5L,CAAC;IACJ,CAAC;IACD,IACE,OAAO,KAAK,QAAQ;QACpB,KAAK,KAAK,YAAY;QACtB,WAAW,CAAC,2BAA2B,KAAK,MAAM,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,OAAO,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IACE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE;YAC/B,IAAA,kCAAsB,EAAC,OAAO,CAAC,eAAe,CAAC,KAAK,KAAK,EACzD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,mCAAmC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CACxG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAA,mCAAuB,EAAC;QAC7B,aAAa,EAAE,OAAO,CAAC,KAAK;QAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC,oBAAoB;KAC9D,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB,EACxB,cAAiC,OAAO,CAAC,GAAG;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,iBAAiB,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5E,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,iBAAiB,IAAI,2BAA2B,iBAAiB,gDAAgD,CACnJ,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW;QACxC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI;QACrE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IACpE,MAAM,GAAG,GAAG,IAAA,sBAAU,EAAC,aAAa,CAAC;QACnC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/D,IACE,OAAO,CAAC,SAAS,KAAK,UAAU;QAChC,OAAO,KAAK,QAAQ;QACpB,MAAM,CAAC,MAAM,EACb,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,aAAa,yBAAyB,MAAM,CAAC,eAAe,iDAAiD,CAC/K,CAAC;IACJ,CAAC;IACD,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACrE,IACE,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAC1C,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,CAAC,EAC/C,CAAC;QACD,IAAA,iCAAsB,EAAC,IAAA,0BAAe,EAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACpD,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAClB,MAAM,CAAC,aAAa,KAAK,YAAY;QACnC,CAAC,CAAC,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE;gBACR;oBACE,IAAI;oBACJ,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;iBAChC;aACF;YACD,KAAK,EAAE,MAAM,CAAC,aAAa;SAC5B,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAExD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,+BAA+B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;YAC3D,GAAG,IAAI;SACR;QACD,GAAG;QACH,WAAW,EAAE;YACX,kBAAkB,EAAE,MAAM,CAAC,aAAa;YACxC,oBAAoB,EAAE,MAAM,CAAC,eAAe;YAC5C,GAAG,CAAC,cAAc,EAAE,0BAA0B;gBAC5C,CAAC,CAAC;oBACE,iCAAiC,EAC/B,cAAc,CAAC,0BAA0B;iBAC5C;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,UAAU,EAAE,OAAO,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB;IAExB,IAAI,UAAgC,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,eAAM,CAAC,IAAI,CACT,0BAA0B,OAAO,YAAY,UAAU,CAAC,WAAW,CAAC,kBAAkB,oBAAoB,UAAU,CAAC,WAAW,CAAC,oBAAoB,KAAK,UAAU,CAAC,GAAG,GAAG,CAC5K,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC1D,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC;YACnE,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,eAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,eAAM,CAAC,KAAK,CACV,MAAM;oBACJ,CAAC,CAAC,OAAO,OAAO,2BAA2B,MAAM,GAAG;oBACpD,CAAC,CAAC,OAAO,OAAO,uBAAuB,IAAI,IAAI,SAAS,GAAG,CAC9D,CAAC;gBACF,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACjD,eAAM,CAAC,KAAK,CACV,2CAA2C,OAAO,CAAC,WAAW,IAAI,WAAW,mBAAmB,OAAO,CAAC,KAAK,GAAG,CACjH,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/src/executors/work-markers/schema.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit work markers",
+  "description": "Report source work markers and enforce syntax, generated-file ownership, and optional protected-promotion blockers.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "protected": {
+      "type": "boolean",
+      "description": "Fail when unresolved EBK-SECURITY or EBK-BLOCKER markers are present. Protected deploy and refresh set this automatically."
+    }
+  }
+}

package/src/executors/work-markers/work-markers.d.ts

@@ -0,0 +1,6 @@
+import { type PromiseExecutor } from '@nx/devkit';
+interface WorkMarkersOptions {
+    protected?: boolean;
+}
+declare const executor: PromiseExecutor<WorkMarkersOptions>;
+export default executor;