@empire-builder-kit/nx 1.0.0-beta.4

package/src/foundation/aurora-logical-database.js

@@ -0,0 +1,419 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuroraLogicalDbProvider = exports.RdsDataApiExecutor = void 0;
+exports.createDatabaseSql = createDatabaseSql;
+exports.databaseExistsSql = databaseExistsSql;
+exports.roleExistsSql = roleExistsSql;
+exports.createRoleSql = createRoleSql;
+exports.alterRolePasswordSql = alterRolePasswordSql;
+exports.grantScopedAccessSql = grantScopedAccessSql;
+exports.createAuroraLogicalDbResource = createAuroraLogicalDbResource;
+const node_crypto_1 = require("node:crypto");
+const GENERATED_PASSWORD_SECRET_OUTPUTS = [
+    'readwritePassword',
+    'readonlyPassword',
+];
+const SQL_PASSWORD_LITERAL_PATTERN = /\b(PASSWORD\s+')((?:''|[^'])*)(')/gi;
+function redactSqlPasswordLiterals(message) {
+    return message.replace(SQL_PASSWORD_LITERAL_PATTERN, '$1[REDACTED]$3');
+}
+// Value-based redaction guard. Secrets shorter than this are NOT replaced by
+// value — a tiny value (e.g. a 3-char test password) is likely to appear as
+// an incidental substring of unrelated identifiers or SQL keywords and
+// global replacement would mangle the message. Short values embedded in a
+// well-formed `PASSWORD '...'` literal are still caught by the pattern pass.
+// The default generator always emits 32 chars, so real deployments never hit
+// this guard.
+const MIN_REDACTABLE_SECRET_LENGTH = 6;
+// Expands each in-scope secret into the textual variants that can appear in
+// a Data API error: the raw value and its single-quote-escaped form (the SQL
+// generators double `'` before embedding, so a Postgres echo of the
+// statement text contains the ESCAPED variant). Longest-first ordering makes
+// sure an escaped variant that contains the raw value as a substring is
+// replaced before the raw pass can split it in half.
+function secretVariants(secrets) {
+    const variants = new Set();
+    for (const secret of secrets) {
+        if (!secret || secret.length < MIN_REDACTABLE_SECRET_LENGTH)
+            continue;
+        variants.add(secret);
+        const escaped = secret.replace(/'/g, "''");
+        if (escaped !== secret) {
+            variants.add(escaped);
+        }
+    }
+    return [...variants].sort((a, b) => b.length - a.length);
+}
+function redactSecretValues(text, variants) {
+    let result = text;
+    for (const variant of variants) {
+        // split/join instead of a RegExp so secret contents never need escaping.
+        result = result.split(variant).join('[REDACTED]');
+    }
+    return result;
+}
+// Redacts secrets from an unknown thrown value and re-wraps it as a plain
+// Error carrying only `name`/`message`/`stack`. Everything else (`cause`,
+// enumerable props, AWS SDK payloads) is intentionally dropped — those
+// channels could carry unredacted copies of the statement.
+//
+// Two passes, defense in depth:
+//   1. VALUE-based: replaces every occurrence of the in-scope secret values
+//      (raw + quote-escaped variants) regardless of surrounding format —
+//      covers truncated `PASSWORD 'abc` fragments with no closing quote,
+//      Postgres `at or near "..."` echoes, and any future drift in the
+//      statement shape.
+//   2. PATTERN-based: the well-formed `PASSWORD '...'` regex — covers values
+//      NOT in scope (e.g. a stale password echoed from a previous deploy's
+//      failed statement).
+function redactDataApiError(error, secrets = []) {
+    const variants = secretVariants(secrets);
+    const redact = (text) => redactSqlPasswordLiterals(redactSecretValues(text, variants));
+    let message = redact(error instanceof Error ? error.message : String(error));
+    // Keep Data API failures debuggable: surface the (non-secret) AWS SDK
+    // request id, since the wrapper drops `$metadata` along with everything
+    // else on the original error.
+    const requestId = error
+        ?.$metadata?.requestId;
+    if (typeof requestId === 'string' && requestId.length > 0) {
+        message += ` (Data API requestId: ${requestId})`;
+    }
+    const redacted = new Error(message);
+    if (error instanceof Error) {
+        redacted.name = error.name;
+        if (error.stack) {
+            redacted.stack = redact(error.stack);
+        }
+    }
+    return redacted;
+}
+// Aurora Serverless v2 clusters configured with `min: 0 ACU` + `pauseAfter`
+// auto-pause when idle. The first ExecuteStatement after a pause fails with
+// "...resuming after being auto-paused. Please wait a few seconds and try
+// again." while the cluster warms up (typically 15-30s). Also retry on
+// transient network errors and throttles — the Data API is backed by a
+// managed HTTPS endpoint and can flake under load.
+const RESUMING_PATTERN = /resuming after being auto-paused|DatabaseResumingException|DatabaseNotFoundException|ThrottlingException|ServiceUnavailable/i;
+async function sendWithResume(send, opts = {}) {
+    const attempts = opts.attempts ?? 10;
+    const baseDelayMs = opts.baseDelayMs ?? 5_000;
+    let lastErr;
+    for (let i = 0; i < attempts; i += 1) {
+        try {
+            return await send();
+        }
+        catch (err) {
+            lastErr = err;
+            const message = err instanceof Error ? err.message : String(err);
+            if (!RESUMING_PATTERN.test(message) || i === attempts - 1)
+                throw err;
+            // Linear backoff capped at ~30s per wait. Aurora resume SLA is 15-30s
+            // total so ~5 attempts at 5-15s each typically clears it.
+            const delay = Math.min(baseDelayMs * (i + 1), 30_000);
+            await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+    }
+    throw lastErr;
+}
+class RdsDataApiExecutor {
+    client;
+    resourceArn;
+    secretArn;
+    ExecuteStatementCommand;
+    constructor(client, resourceArn, secretArn, ExecuteStatementCommand) {
+        this.client = client;
+        this.resourceArn = resourceArn;
+        this.secretArn = secretArn;
+        this.ExecuteStatementCommand = ExecuteStatementCommand;
+    }
+    async execute(database, sql) {
+        await sendWithResume(() => this.client.send(new this.ExecuteStatementCommand({
+            resourceArn: this.resourceArn,
+            secretArn: this.secretArn,
+            database,
+            sql,
+        })));
+    }
+    async exists(database, existsSql) {
+        const res = await sendWithResume(() => this.client.send(new this.ExecuteStatementCommand({
+            resourceArn: this.resourceArn,
+            secretArn: this.secretArn,
+            database,
+            sql: existsSql,
+        })));
+        const records = res.records ?? [];
+        return records.length > 0;
+    }
+}
+exports.RdsDataApiExecutor = RdsDataApiExecutor;
+// SQL generators. Exposed for tests so we can assert on the exact strings
+// the provider emits.
+function createDatabaseSql(database) {
+    return `CREATE DATABASE "${database}"`;
+}
+function databaseExistsSql(database) {
+    return `SELECT 1 FROM pg_database WHERE datname = '${database.replace(/'/g, "''")}'`;
+}
+function roleExistsSql(role) {
+    return `SELECT 1 FROM pg_roles WHERE rolname = '${role.replace(/'/g, "''")}'`;
+}
+function createRoleSql(role, password) {
+    // Password embedded literally — escape single quotes. The provider runs
+    // once per resource; Pulumi ensures stable state so this doesn't leak to
+    // logs on repeated apply cycles when the role already exists.
+    const escapedPassword = password.replace(/'/g, "''");
+    return `CREATE ROLE "${role}" WITH LOGIN PASSWORD '${escapedPassword}'`;
+}
+function alterRolePasswordSql(role, password) {
+    const escapedPassword = password.replace(/'/g, "''");
+    return `ALTER ROLE "${role}" WITH PASSWORD '${escapedPassword}'`;
+}
+function grantScopedAccessSql(database, readwriteRole, readonlyRole) {
+    // Revoke default public, grant connect to both roles, grant DML/DDL to RW,
+    // and set default privileges so every table/sequence the RW role creates
+    // via migrations is immediately readable by the RO role.
+    //
+    // `GRANT "<rw>" TO CURRENT_USER` is required before `ALTER DEFAULT
+    // PRIVILEGES FOR ROLE "<rw>"` — Postgres only lets you set default
+    // privileges for roles you are a member of (error 42501 otherwise).
+    // `CURRENT_USER` here resolves to Aurora's master user that the Data API
+    // authenticates as (default `postgres`).
+    //
+    // Returned as individual statements — the RDS Data API's ExecuteStatement
+    // only accepts one SQL statement per call ("Multistatements aren't
+    // supported"), so the provider iterates this list.
+    return [
+        `REVOKE ALL ON DATABASE "${database}" FROM PUBLIC`,
+        `GRANT CONNECT ON DATABASE "${database}" TO "${readwriteRole}", "${readonlyRole}"`,
+        // Database-level CREATE lets the RW role create new schemas. Drizzle's
+        // Postgres migrator starts with `CREATE SCHEMA IF NOT EXISTS "drizzle"`
+        // for its `__drizzle_migrations` bookkeeping table; without this grant
+        // every fresh `db-migrate` would bail with `permission denied for
+        // database ...` before any user migration runs.
+        `GRANT CREATE ON DATABASE "${database}" TO "${readwriteRole}"`,
+        `GRANT ALL ON SCHEMA public TO "${readwriteRole}"`,
+        `GRANT USAGE ON SCHEMA public TO "${readonlyRole}"`,
+        `GRANT "${readwriteRole}" TO CURRENT_USER`,
+        `ALTER DEFAULT PRIVILEGES FOR ROLE "${readwriteRole}" IN SCHEMA public GRANT ALL ON TABLES TO "${readwriteRole}"`,
+        `ALTER DEFAULT PRIVILEGES FOR ROLE "${readwriteRole}" IN SCHEMA public GRANT SELECT ON TABLES TO "${readonlyRole}"`,
+        `ALTER DEFAULT PRIVILEGES FOR ROLE "${readwriteRole}" IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO "${readonlyRole}"`,
+    ];
+}
+// 32 chars of url-safe alphanumerics. Postgres handles this literal safely in
+// a single-quoted password string (no escape needed) and it's strong enough
+// for an app-scoped role in an RDS-Proxy-fronted cluster.
+function defaultPasswordGenerator() {
+    return (0, node_crypto_1.randomBytes)(24)
+        .toString('base64')
+        .replace(/[^A-Za-z0-9]/g, '')
+        .slice(0, 32)
+        .padEnd(32, 'a');
+}
+class AuroraLogicalDbProvider {
+    executorFactory;
+    passwordGenerator;
+    constructor(options = {}) {
+        this.executorFactory = options.executorFactory;
+        this.passwordGenerator =
+            options.passwordGenerator ?? defaultPasswordGenerator;
+    }
+    async buildExecutor(inputs) {
+        if (this.executorFactory)
+            return this.executorFactory(inputs);
+        // Pulumi serializes the complete dynamic-provider closure before running
+        // any lifecycle method. A static AWS SDK value here pulls the SDK's
+        // transpiled tslib helpers into that closure; Node 24 exposes a free
+        // AsyncIterator reference that Pulumi cannot serialize. The Nx package is
+        // emitted at ES2022 so this method remains native async, and the SDK is
+        // resolved only while the provider executes. TypeScript rewrites a native
+        // dynamic import to require() for this CommonJS package, and SST then wraps
+        // that require in an unserializable bundle helper. Constructing the import
+        // expression at runtime preserves the module boundary through both builds.
+        // The serialized closure contains only this string and a standard global.
+        const importModule = Function('specifier', 'return import(specifier);');
+        const { ExecuteStatementCommand, RDSDataClient } = await importModule('@aws-sdk/client-rds-data');
+        const client = new RDSDataClient({});
+        return new RdsDataApiExecutor(client, inputs.clusterArn, inputs.masterSecretArn, ExecuteStatementCommand);
+    }
+    // Generates a password and registers it with the caller's in-scope secret
+    // collector so `redactDataApiError` can redact it by VALUE if any later
+    // Data API call in the same lifecycle method throws.
+    generateSecret(secretsInScope) {
+        const value = this.passwordGenerator();
+        secretsInScope.push(value);
+        return value;
+    }
+    async create(inputs) {
+        const secretsInScope = [];
+        try {
+            return await this.createInternal(inputs, secretsInScope);
+        }
+        catch (error) {
+            throw redactDataApiError(error, secretsInScope);
+        }
+    }
+    async createInternal(inputs, secretsInScope) {
+        const executor = await this.buildExecutor(inputs);
+        const { database, readwriteRole, readonlyRole } = inputs;
+        // Generate passwords INSIDE the provider and persist them in `outs`. Pulumi
+        // stores outs in state, so on subsequent applies we surface the same
+        // values via `update`'s `olds`. This avoids a hard dep on `@pulumi/random`.
+        const readwritePassword = this.generateSecret(secretsInScope);
+        const readonlyPassword = this.generateSecret(secretsInScope);
+        // CREATE DATABASE can't run in a transaction — issue via Data API
+        // ExecuteStatement which auto-commits each call.
+        const dbExists = await executor.exists('postgres', databaseExistsSql(database));
+        if (!dbExists) {
+            await executor.execute('postgres', createDatabaseSql(database));
+        }
+        // Role creation inside the new database. When the role doesn't exist we
+        // issue CREATE ROLE with the freshly generated password. When it DOES
+        // exist (retained from a previous deploy, or state was lost and this is
+        // a re-create against retained resources) we MUST issue ALTER ROLE so
+        // Postgres matches the password we're about to return in outs +
+        // advertise through Secrets Manager + the Linkable. Without this,
+        // pg_authid keeps the old hash while everything downstream advertises
+        // the new one — authentication fails permanently.
+        const rwExists = await executor.exists(database, roleExistsSql(readwriteRole));
+        if (rwExists) {
+            await executor.execute(database, alterRolePasswordSql(readwriteRole, readwritePassword));
+        }
+        else {
+            await executor.execute(database, createRoleSql(readwriteRole, readwritePassword));
+        }
+        const roExists = await executor.exists(database, roleExistsSql(readonlyRole));
+        if (roExists) {
+            await executor.execute(database, alterRolePasswordSql(readonlyRole, readonlyPassword));
+        }
+        else {
+            await executor.execute(database, createRoleSql(readonlyRole, readonlyPassword));
+        }
+        for (const stmt of grantScopedAccessSql(database, readwriteRole, readonlyRole)) {
+            await executor.execute(database, stmt);
+        }
+        return {
+            id: `${inputs.clusterArn}:${database}`,
+            outs: {
+                ...inputs,
+                readwritePassword,
+                readonlyPassword,
+            },
+        };
+    }
+    async update(_id, olds, news) {
+        // Stored state passwords are in scope for redaction: a failing statement
+        // (or a Postgres echo of one) can reference the previous values as well
+        // as any freshly regenerated ones.
+        const secretsInScope = [
+            olds.readwritePassword,
+            olds.readonlyPassword,
+        ].filter((value) => typeof value === 'string');
+        try {
+            return await this.updateInternal(olds, news, secretsInScope);
+        }
+        catch (error) {
+            throw redactDataApiError(error, secretsInScope);
+        }
+    }
+    async updateInternal(olds, news, secretsInScope) {
+        const executor = await this.buildExecutor(news);
+        // Passwords are not re-keyed on a normal update. Carry them forward from
+        // state so the resource output surface stays stable.
+        //
+        // Rotation: when `rotationToken` CHANGES between deploys, drop the stored
+        // values so the branches below regenerate both passwords and force
+        // Postgres to match via ALTER ROLE. This is the sanctioned one-line-diff
+        // rotation path (see the runbook in `packages/data/README.md`) — required
+        // for stages deployed before generated passwords were marked as Pulumi
+        // secret outputs, whose state history/backups may hold plaintext values.
+        //
+        // Self-heal for the state-loss edge case: if `olds.*Password` is missing
+        // (resource originally created without the output placeholders in args,
+        // so Pulumi never serialized the generated passwords to state), we
+        // regenerate and force Postgres to match via ALTER ROLE. Without this
+        // branch the Linkable + Secret would advertise an empty password while
+        // pg_authid still has the original — authentication fails permanently.
+        const rotationRequested = (olds.rotationToken ?? '') !== (news.rotationToken ?? '');
+        let readwritePassword = rotationRequested ? '' : olds.readwritePassword;
+        let readonlyPassword = rotationRequested ? '' : olds.readonlyPassword;
+        if (!readwritePassword) {
+            readwritePassword = this.generateSecret(secretsInScope);
+            await executor.execute(news.database, alterRolePasswordSql(news.readwriteRole, readwritePassword));
+        }
+        if (!readonlyPassword) {
+            readonlyPassword = this.generateSecret(secretsInScope);
+            await executor.execute(news.database, alterRolePasswordSql(news.readonlyRole, readonlyPassword));
+        }
+        // Re-apply the grant block — idempotent on Postgres and protects against
+        // drift if someone touched privileges out-of-band.
+        for (const stmt of grantScopedAccessSql(news.database, news.readwriteRole, news.readonlyRole)) {
+            await executor.execute(news.database, stmt);
+        }
+        return {
+            outs: {
+                ...news,
+                readwritePassword,
+                readonlyPassword,
+            },
+        };
+    }
+    async delete(_id, props) {
+        const secretsInScope = [
+            props.readwritePassword,
+            props.readonlyPassword,
+        ].filter((value) => typeof value === 'string');
+        try {
+            await this.deleteInternal(props);
+        }
+        catch (error) {
+            throw redactDataApiError(error, secretsInScope);
+        }
+    }
+    async deleteInternal(props) {
+        if (props.removalPolicy !== 'destroy') {
+            // Default retain — no-op. Resource is removed from Pulumi state but
+            // the database + roles stay in the cluster. Safety default for production.
+            return;
+        }
+        const executor = await this.buildExecutor(props);
+        // Drop in reverse order of create. FORCE disconnects active sessions.
+        await executor.execute('postgres', `REVOKE ALL ON DATABASE "${props.database}" FROM "${props.readwriteRole}", "${props.readonlyRole}"`);
+        await executor.execute('postgres', `DROP DATABASE IF EXISTS "${props.database}" WITH (FORCE)`);
+        // create() did `GRANT "<rw>" TO CURRENT_USER` so the master user could
+        // ALTER DEFAULT PRIVILEGES on that role. That membership has to be
+        // revoked before DROP ROLE — Postgres refuses to drop a role that still
+        // has dependent privileges. IF EXISTS on REVOKE keeps this idempotent
+        // for retained-create paths that never hit the grant.
+        await executor.execute('postgres', `REVOKE "${props.readwriteRole}" FROM CURRENT_USER`);
+        await executor.execute('postgres', `DROP ROLE IF EXISTS "${props.readwriteRole}"`);
+        await executor.execute('postgres', `DROP ROLE IF EXISTS "${props.readonlyRole}"`);
+    }
+}
+exports.AuroraLogicalDbProvider = AuroraLogicalDbProvider;
+function createAuroraLogicalDbResource(options) {
+    const Resource = $util.dynamic.Resource;
+    const additionalSecretOutputs = [
+        ...new Set([
+            ...(options.opts?.additionalSecretOutputs ?? []),
+            ...GENERATED_PASSWORD_SECRET_OUTPUTS,
+        ]),
+    ];
+    // Pulumi convention for dynamic.Resource: fields that are produced by the
+    // provider's create() (i.e. in `outs` but not in caller-supplied `args`)
+    // must be declared on the constructor args as `undefined` placeholders —
+    // otherwise Pulumi doesn't surface them as `Output<T>` on the resource,
+    // and consumers that read them (e.g. `logicalDb.readwritePassword`) get
+    // unresolved wrappers instead of the resolved strings.
+    //
+    // See SST platform's own providers (e.g. cloudflare/worker-url.ts) for the
+    // same pattern: `{ ...args, url: undefined }`.
+    return new Resource(new AuroraLogicalDbProvider(), options.name, {
+        ...options.args,
+        readwritePassword: undefined,
+        readonlyPassword: undefined,
+    }, {
+        ...options.opts,
+        additionalSecretOutputs,
+    });
+}
+//# sourceMappingURL=aurora-logical-database.js.map

package/src/foundation/aurora-logical-database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aurora-logical-database.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/aurora-logical-database.ts"],"names":[],"mappings":";;;AAwOA,8CAEC;AAED,8CAEC;AAED,sCAEC;AAED,sCAMC;AAED,oDAGC;AAED,oDAkCC;AAkUD,sEAqCC;AA1oBD,6CAA0C;AAuE1C,MAAM,iCAAiC,GAAG;IACxC,mBAAmB;IACnB,kBAAkB;CACV,CAAC;AAEX,MAAM,4BAA4B,GAAG,qCAAqC,CAAC;AAE3E,SAAS,yBAAyB,CAAC,OAAe;IAChD,OAAO,OAAO,CAAC,OAAO,CAAC,4BAA4B,EAAE,gBAAgB,CAAC,CAAC;AACzE,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,cAAc;AACd,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAEvC,4EAA4E;AAC5E,6EAA6E;AAC7E,oEAAoE;AACpE,6EAA6E;AAC7E,wEAAwE;AACxE,qDAAqD;AACrD,SAAS,cAAc,CAAC,OAA0B;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,4BAA4B;YAAE,SAAS;QACtE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAA2B;IACnE,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,yEAAyE;QACzE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,2DAA2D;AAC3D,EAAE;AACF,gCAAgC;AAChC,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,wBAAwB;AACxB,6EAA6E;AAC7E,2EAA2E;AAC3E,0BAA0B;AAC1B,SAAS,kBAAkB,CACzB,KAAc,EACd,UAA6B,EAAE;IAE/B,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9B,yBAAyB,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEhE,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,sEAAsE;IACtE,wEAAwE;IACxE,8BAA8B;IAC9B,MAAM,SAAS,GAAI,KAAwD;QACzE,EAAE,SAAS,EAAE,SAAS,CAAC;IACzB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,yBAAyB,SAAS,GAAG,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,uEAAuE;AACvE,mDAAmD;AACnD,MAAM,gBAAgB,GACpB,8HAA8H,CAAC;AAEjI,KAAK,UAAU,cAAc,CAC3B,IAAsB,EACtB,OAAoD,EAAE;IAEtD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC;IAC9C,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;YACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACrE,sEAAsE;YACtE,0DAA0D;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC;AAChB,CAAC;AAED,MAAa,kBAAkB;IAEV;IACA;IACA;IACA;IAJnB,YACmB,MAAqB,EACrB,WAAmB,EACnB,SAAiB,EACjB,uBAA2D;QAH3D,WAAM,GAAN,MAAM,CAAe;QACrB,gBAAW,GAAX,WAAW,CAAQ;QACnB,cAAS,GAAT,SAAS,CAAQ;QACjB,4BAAuB,GAAvB,uBAAuB,CAAoC;IAC3E,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,GAAW;QACzC,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,IAAI,IAAI,CAAC,uBAAuB,CAAC;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ;YACR,GAAG;SACJ,CAAC,CACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAiB;QAC9C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,IAAI,IAAI,CAAC,uBAAuB,CAAC;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ;YACR,GAAG,EAAE,SAAS;SACf,CAAC,CACH,CACF,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF;AAnCD,gDAmCC;AAED,0EAA0E;AAC1E,sBAAsB;AACtB,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,OAAO,oBAAoB,QAAQ,GAAG,CAAC;AACzC,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,OAAO,8CAA8C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACvF,CAAC;AAED,SAAgB,aAAa,CAAC,IAAY;IACxC,OAAO,2CAA2C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAChF,CAAC;AAED,SAAgB,aAAa,CAAC,IAAY,EAAE,QAAgB;IAC1D,wEAAwE;IACxE,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,gBAAgB,IAAI,0BAA0B,eAAe,GAAG,CAAC;AAC1E,CAAC;AAED,SAAgB,oBAAoB,CAAC,IAAY,EAAE,QAAgB;IACjE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,eAAe,IAAI,oBAAoB,eAAe,GAAG,CAAC;AACnE,CAAC;AAED,SAAgB,oBAAoB,CAClC,QAAgB,EAChB,aAAqB,EACrB,YAAoB;IAEpB,2EAA2E;IAC3E,yEAAyE;IACzE,yDAAyD;IACzD,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,oEAAoE;IACpE,yEAAyE;IACzE,yCAAyC;IACzC,EAAE;IACF,0EAA0E;IAC1E,mEAAmE;IACnE,mDAAmD;IACnD,OAAO;QACL,2BAA2B,QAAQ,eAAe;QAClD,8BAA8B,QAAQ,SAAS,aAAa,OAAO,YAAY,GAAG;QAClF,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,kEAAkE;QAClE,gDAAgD;QAChD,6BAA6B,QAAQ,SAAS,aAAa,GAAG;QAC9D,kCAAkC,aAAa,GAAG;QAClD,oCAAoC,YAAY,GAAG;QACnD,UAAU,aAAa,mBAAmB;QAC1C,sCAAsC,aAAa,8CAA8C,aAAa,GAAG;QACjH,sCAAsC,aAAa,iDAAiD,YAAY,GAAG;QACnH,sCAAsC,aAAa,2DAA2D,YAAY,GAAG;KAC9H,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,0DAA0D;AAC1D,SAAS,wBAAwB;IAC/B,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC;SACnB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AACrB,CAAC;AAsBD,MAAa,uBAAuB;IACjB,eAAe,CAEX;IACJ,iBAAiB,CAAoB;IAEtD,YAAY,UAA0C,EAAE;QACtD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,iBAAiB;YACpB,OAAO,CAAC,iBAAiB,IAAI,wBAAwB,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAA6B;QAE7B,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9D,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAExC,CAAC;QAC/B,MAAM,EAAE,uBAAuB,EAAE,aAAa,EAAE,GAAG,MAAM,YAAY,CACnE,0BAA0B,CAC3B,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;QACrC,OAAO,IAAI,kBAAkB,CAC3B,MAAM,EACN,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,eAAe,EACtB,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,qDAAqD;IAC7C,cAAc,CAAC,cAAwB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA6B;QACxC,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAA6B,EAC7B,cAAwB;QAExB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;QAEzD,4EAA4E;QAC5E,qEAAqE;QACrE,4EAA4E;QAC5E,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;QAE7D,kEAAkE;QAClE,iDAAiD;QACjD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CACpC,UAAU,EACV,iBAAiB,CAAC,QAAQ,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,gEAAgE;QAChE,kEAAkE;QAClE,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CACpC,QAAQ,EACR,aAAa,CAAC,aAAa,CAAC,CAC7B,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,CACpB,QAAQ,EACR,oBAAoB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CACvD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,OAAO,CACpB,QAAQ,EACR,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CACpC,QAAQ,EACR,aAAa,CAAC,YAAY,CAAC,CAC5B,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,CACpB,QAAQ,EACR,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CACrD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,OAAO,CACpB,QAAQ,EACR,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAC9C,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,oBAAoB,CACrC,QAAQ,EACR,aAAa,EACb,YAAY,CACb,EAAE,CAAC;YACF,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,OAAO;YACL,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE;YACtC,IAAI,EAAE;gBACJ,GAAG,MAAM;gBACT,iBAAiB;gBACjB,gBAAgB;aACjB;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,GAAW,EACX,IAA0B,EAC1B,IAA2B;QAE3B,yEAAyE;QACzE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,cAAc,GAAa;YAC/B,IAAI,CAAC,iBAAiB;YACtB,IAAI,CAAC,gBAAgB;SACtB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,IAA0B,EAC1B,IAA2B,EAC3B,cAAwB;QAExB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAEhD,yEAAyE;QACzE,qDAAqD;QACrD,EAAE;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,iBAAiB,GACrB,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,iBAAiB,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACxE,IAAI,gBAAgB,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,QAAQ,CAAC,OAAO,CACpB,IAAI,CAAC,QAAQ,EACb,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,QAAQ,CAAC,OAAO,CACpB,IAAI,CAAC,QAAQ,EACb,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAC1D,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,mDAAmD;QACnD,KAAK,MAAM,IAAI,IAAI,oBAAoB,CACrC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,YAAY,CAClB,EAAE,CAAC;YACF,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO;YACL,IAAI,EAAE;gBACJ,GAAG,IAAI;gBACP,iBAAiB;gBACjB,gBAAgB;aACjB;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAA2B;QACnD,MAAM,cAAc,GAAG;YACrB,KAAK,CAAC,iBAAiB;YACvB,KAAK,CAAC,gBAAgB;SACvB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAA2B;QACtD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,oEAAoE;YACpE,2EAA2E;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjD,sEAAsE;QACtE,MAAM,QAAQ,CAAC,OAAO,CACpB,UAAU,EACV,2BAA2B,KAAK,CAAC,QAAQ,WAAW,KAAK,CAAC,aAAa,OAAO,KAAK,CAAC,YAAY,GAAG,CACpG,CAAC;QACF,MAAM,QAAQ,CAAC,OAAO,CACpB,UAAU,EACV,4BAA4B,KAAK,CAAC,QAAQ,gBAAgB,CAC3D,CAAC;QACF,uEAAuE;QACvE,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,QAAQ,CAAC,OAAO,CACpB,UAAU,EACV,WAAW,KAAK,CAAC,aAAa,qBAAqB,CACpD,CAAC;QACF,MAAM,QAAQ,CAAC,OAAO,CACpB,UAAU,EACV,wBAAwB,KAAK,CAAC,aAAa,GAAG,CAC/C,CAAC;QACF,MAAM,QAAQ,CAAC,OAAO,CACpB,UAAU,EACV,wBAAwB,KAAK,CAAC,YAAY,GAAG,CAC9C,CAAC;IACJ,CAAC;CACF;AA1QD,0DA0QC;AAuBD,SAAgB,6BAA6B,CAC3C,OAAqC;IAErC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAKH,CAAC;IAC7B,MAAM,uBAAuB,GAAG;QAC9B,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,uBAAuB,IAAI,EAAE,CAAC;YAChD,GAAG,iCAAiC;SACrC,CAAC;KACH,CAAC;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,uDAAuD;IACvD,EAAE;IACF,2EAA2E;IAC3E,+CAA+C;IAC/C,OAAO,IAAI,QAAQ,CACjB,IAAI,uBAAuB,EAAE,EAC7B,OAAO,CAAC,IAAI,EACZ;QACE,GAAG,OAAO,CAAC,IAAI;QACf,iBAAiB,EAAE,SAAS;QAC5B,gBAAgB,EAAE,SAAS;KAC5B,EACD;QACE,GAAG,OAAO,CAAC,IAAI;QACf,uBAAuB;KACxB,CACF,CAAC;AACJ,CAAC"}

package/src/foundation/discovery.d.ts

@@ -0,0 +1,55 @@
+import { type FoundationRequirement, type StandardFoundationCapability } from './requirements.js';
+export declare const FOUNDATION_SSM_NAMESPACE: "/ebk";
+export declare const FOUNDATION_SSM_SCHEMA_VERSION: 2;
+export declare const FOUNDATION_SSM_KEYS: {
+    readonly alertTopicArn: "alertTopicArn";
+    readonly capabilities: "capabilities";
+    readonly clusterId: "clusterId";
+    readonly contractVersion: "contractVersion";
+    readonly databaseClusterArn: "databaseClusterArn";
+    readonly databaseClusterId: "databaseClusterId";
+    readonly databaseMasterSecretArn: "databaseMasterSecretArn";
+    readonly eventBusArn: "eventBusArn";
+    readonly eventBusName: "eventBusName";
+    readonly hasPublicDomain: "hasPublicDomain";
+    readonly identityUserPoolArn: "identityUserPoolArn";
+    readonly identityUserPoolId: "identityUserPoolId";
+    readonly rootDomain: "rootDomain";
+    readonly routerDistributionId: "routerDistributionId";
+    readonly routerUrl: "routerUrl";
+    readonly schemaVersion: "schemaVersion";
+    readonly vpcId: "vpcId";
+};
+export type FoundationSsmKey = keyof typeof FOUNDATION_SSM_KEYS;
+export declare const FOUNDATION_REQUIRED_SSM_KEYS: FoundationSsmKey[];
+export declare const STANDARD_FOUNDATION_REQUIREMENT: FoundationRequirement;
+export interface FoundationDiscovery {
+    alertTopicArn: string;
+    capabilities: StandardFoundationCapability[];
+    clusterId: string;
+    contractVersion: string;
+    databaseClusterArn: string;
+    databaseClusterId: string;
+    databaseMasterSecretArn: string;
+    eventBusArn: string;
+    eventBusName: string;
+    hasPublicDomain: boolean;
+    identityUserPoolArn: string;
+    identityUserPoolId: string;
+    rootDomain?: string;
+    routerDistributionId: string;
+    routerUrl: string;
+    schemaVersion: typeof FOUNDATION_SSM_SCHEMA_VERSION;
+    vpcId: string;
+}
+export interface ProductSliceRegistration {
+    consumerStage: string;
+    foundationContract: string;
+    foundationStage: string;
+    name: string;
+    registrationVersion: 1;
+}
+export declare function foundationSsmStageRoot(stage: string): string;
+export declare function foundationSsmPath(stage: string, key: FoundationSsmKey): string;
+export declare function productSliceRegistrationRoot(foundationStage: string): string;
+export declare function productSliceRegistrationPath(foundationStage: string, consumerStage: string, slice: string): string;

package/src/foundation/discovery.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STANDARD_FOUNDATION_REQUIREMENT = exports.FOUNDATION_REQUIRED_SSM_KEYS = exports.FOUNDATION_SSM_KEYS = exports.FOUNDATION_SSM_SCHEMA_VERSION = exports.FOUNDATION_SSM_NAMESPACE = void 0;
+exports.foundationSsmStageRoot = foundationSsmStageRoot;
+exports.foundationSsmPath = foundationSsmPath;
+exports.productSliceRegistrationRoot = productSliceRegistrationRoot;
+exports.productSliceRegistrationPath = productSliceRegistrationPath;
+const requirements_js_1 = require("./requirements.js");
+const stages_js_1 = require("./stages.js");
+exports.FOUNDATION_SSM_NAMESPACE = '/ebk';
+exports.FOUNDATION_SSM_SCHEMA_VERSION = 2;
+exports.FOUNDATION_SSM_KEYS = {
+    alertTopicArn: 'alertTopicArn',
+    capabilities: 'capabilities',
+    clusterId: 'clusterId',
+    contractVersion: 'contractVersion',
+    databaseClusterArn: 'databaseClusterArn',
+    databaseClusterId: 'databaseClusterId',
+    databaseMasterSecretArn: 'databaseMasterSecretArn',
+    eventBusArn: 'eventBusArn',
+    eventBusName: 'eventBusName',
+    hasPublicDomain: 'hasPublicDomain',
+    identityUserPoolArn: 'identityUserPoolArn',
+    identityUserPoolId: 'identityUserPoolId',
+    rootDomain: 'rootDomain',
+    routerDistributionId: 'routerDistributionId',
+    routerUrl: 'routerUrl',
+    schemaVersion: 'schemaVersion',
+    vpcId: 'vpcId',
+};
+exports.FOUNDATION_REQUIRED_SSM_KEYS = Object.keys(exports.FOUNDATION_SSM_KEYS);
+exports.STANDARD_FOUNDATION_REQUIREMENT = {
+    capabilities: [...requirements_js_1.STANDARD_FOUNDATION_CAPABILITIES],
+    contract: '^1.0.0',
+};
+function requirePathSegment(value, label) {
+    const normalized = value.trim();
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(normalized)) {
+        throw new Error(`${label} must use lowercase letters, numbers, and hyphens.`);
+    }
+    return normalized;
+}
+function foundationSsmStageRoot(stage) {
+    return `${exports.FOUNDATION_SSM_NAMESPACE}/${(0, stages_js_1.requireFoundationStage)(stage)}/foundation`;
+}
+function foundationSsmPath(stage, key) {
+    return `${foundationSsmStageRoot(stage)}/${exports.FOUNDATION_SSM_KEYS[key]}`;
+}
+function productSliceRegistrationRoot(foundationStage) {
+    return `${foundationSsmStageRoot(foundationStage)}/product-slices`;
+}
+function productSliceRegistrationPath(foundationStage, consumerStage, slice) {
+    return `${productSliceRegistrationRoot(foundationStage)}/${(0, stages_js_1.requireStage)(consumerStage, 'Consumer stage')}/${requirePathSegment(slice, 'Product Slice name')}`;
+}
+//# sourceMappingURL=discovery.js.map

package/src/foundation/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/discovery.ts"],"names":[],"mappings":";;;AA+EA,wDAEC;AAED,8CAKC;AAED,oEAEC;AAED,oEAMC;AApGD,uDAI2B;AAC3B,2CAAmE;AAEtD,QAAA,wBAAwB,GAAG,MAAe,CAAC;AAC3C,QAAA,6BAA6B,GAAG,CAAU,CAAC;AAE3C,QAAA,mBAAmB,GAAG;IACjC,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,SAAS,EAAE,WAAW;IACtB,eAAe,EAAE,iBAAiB;IAClC,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,mBAAmB;IACtC,uBAAuB,EAAE,yBAAyB;IAClD,WAAW,EAAE,aAAa;IAC1B,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,UAAU,EAAE,YAAY;IACxB,oBAAoB,EAAE,sBAAsB;IAC5C,SAAS,EAAE,WAAW;IACtB,aAAa,EAAE,eAAe;IAC9B,KAAK,EAAE,OAAO;CACN,CAAC;AAIE,QAAA,4BAA4B,GAAG,MAAM,CAAC,IAAI,CACrD,2BAAmB,CACE,CAAC;AAEX,QAAA,+BAA+B,GAA0B;IACpE,YAAY,EAAE,CAAC,GAAG,kDAAgC,CAAC;IACnD,QAAQ,EAAE,QAAQ;CACnB,CAAC;AA8BF,SAAS,kBAAkB,CAAC,KAAa,EAAE,KAAa;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,oDAAoD,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAa;IAClD,OAAO,GAAG,gCAAwB,IAAI,IAAA,kCAAsB,EAAC,KAAK,CAAC,aAAa,CAAC;AACnF,CAAC;AAED,SAAgB,iBAAiB,CAC/B,KAAa,EACb,GAAqB;IAErB,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,2BAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAgB,4BAA4B,CAAC,eAAuB;IAClE,OAAO,GAAG,sBAAsB,CAAC,eAAe,CAAC,iBAAiB,CAAC;AACrE,CAAC;AAED,SAAgB,4BAA4B,CAC1C,eAAuB,EACvB,aAAqB,EACrB,KAAa;IAEb,OAAO,GAAG,4BAA4B,CAAC,eAAe,CAAC,IAAI,IAAA,wBAAY,EAAC,aAAa,EAAE,gBAAgB,CAAC,IAAI,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;AAChK,CAAC"}

package/src/foundation/index.d.ts

@@ -0,0 +1,6 @@
+export * from './discovery.js';
+export * from './local-database-contract.js';
+export * from './provision-database-bindings.js';
+export * from './provision-logical-database.js';
+export * from './requirements.js';
+export * from './stages.js';

package/src/foundation/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./discovery.js"), exports);
+tslib_1.__exportStar(require("./local-database-contract.js"), exports);
+tslib_1.__exportStar(require("./provision-database-bindings.js"), exports);
+tslib_1.__exportStar(require("./provision-logical-database.js"), exports);
+tslib_1.__exportStar(require("./requirements.js"), exports);
+tslib_1.__exportStar(require("./stages.js"), exports);
+//# sourceMappingURL=index.js.map

package/src/foundation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/index.ts"],"names":[],"mappings":";;;AAAA,yDAA+B;AAC/B,uEAA6C;AAC7C,2EAAiD;AACjD,0EAAgD;AAChD,4DAAkC;AAClC,sDAA4B"}

package/src/foundation/local-database-contract.d.ts

@@ -0,0 +1,30 @@
+export interface LocalDatabaseContractOptions {
+    database: string;
+    password?: string;
+    port?: number;
+    slice: string;
+}
+export interface LocalDatabaseContract {
+    database: string;
+    host: '127.0.0.1';
+    password: string;
+    port: number;
+    username: string;
+}
+export declare const POSTGRES_IDENTIFIER_MAX_BYTES = 63;
+export interface LogicalDatabaseIdentifiers {
+    database: string;
+    localDatabase: string;
+    localReadwriteRole: string;
+    readonlyRole: string;
+    readwriteRole: string;
+}
+export declare function normalizePostgresIdentifier(input: string): string;
+export declare function postgresIdentifierByteLength(identifier: string): number;
+export declare function assertPostgresIdentifierLength(identifier: string, label: string): void;
+export declare function resolveLogicalDatabaseIdentifiers(options: {
+    database: string;
+    slice: string;
+    stage: string;
+}): LogicalDatabaseIdentifiers;
+export declare function resolveLocalDatabaseContract(options: LocalDatabaseContractOptions): LocalDatabaseContract;