@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/executors/sst-lifecycle/secret-preflight.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSecretAwsContext = resolveSecretAwsContext;
+exports.createSecretMetadataControlPlane = createSecretMetadataControlPlane;
+exports.loadSliceSecretMetadata = loadSliceSecretMetadata;
+exports.preflightSliceSecretMetadata = preflightSliceSecretMetadata;
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../../secrets/index.js");
+const regionPattern = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+async function readJson(path) {
+    let source;
+    try {
+        source = await (0, promises_1.readFile)(path, 'utf8');
+    }
+    catch {
+        throw new Error(`Secret metadata input is missing: ${path}.`);
+    }
+    try {
+        return JSON.parse(source);
+    }
+    catch {
+        throw new Error(`Secret metadata input is not JSON: ${path}.`);
+    }
+}
+function resolveSecretAwsContext(options, environment = process.env) {
+    const region = (options.region ??
+        environment.AWS_REGION ??
+        environment.AWS_DEFAULT_REGION ??
+        '').trim();
+    const profile = options.profile?.trim();
+    if (!regionPattern.test(region)) {
+        throw new Error('Secret metadata operations require an explicit valid AWS Region through --region, AWS_REGION, or AWS_DEFAULT_REGION.');
+    }
+    if (options.profile !== undefined && !profile) {
+        throw new Error('Secret metadata operations received an empty AWS profile.');
+    }
+    return Object.freeze({
+        ...(profile ? { profile } : {}),
+        region,
+    });
+}
+function createSecretMetadataControlPlane(context) {
+    return (0, index_js_1.createAwsSecretsManagerMetadataControlPlane)({
+        clientConfiguration: {
+            ...(context.profile
+                ? { credentials: (0, credential_providers_1.fromIni)({ profile: context.profile }) }
+                : {}),
+            region: context.region,
+        },
+    });
+}
+async function loadSliceSecretMetadata(input) {
+    if (!input.context.projectName) {
+        throw new Error('Secret metadata operations require the exact Nx Product Slice name.');
+    }
+    const project = input.context.projectsConfigurations?.projects[input.context.projectName];
+    const tags = project?.tags ?? [];
+    if (!tags.includes('type:slice')) {
+        throw new Error(`Nx project ${input.context.projectName} is not a Product Slice.`);
+    }
+    if (!project?.root) {
+        throw new Error(`Nx project ${input.context.projectName} does not declare a project root.`);
+    }
+    const projectRoot = (0, node_path_1.isAbsolute)(project.root)
+        ? (0, node_path_1.resolve)(project.root)
+        : (0, node_path_1.resolve)(input.context.root, project.root);
+    if ((0, node_path_1.resolve)(input.cwd) !== projectRoot) {
+        throw new Error(`Secret metadata operations require the exact Nx project root ${projectRoot}.`);
+    }
+    const read = input.readJson ?? readJson;
+    const packageJson = await read((0, node_path_1.join)(input.context.root, 'package.json'));
+    if (!isRecord(packageJson) || typeof packageJson['name'] !== 'string') {
+        throw new Error('Workspace package.json must declare its exact name.');
+    }
+    const registry = (0, index_js_1.parseSecretMetadataRegistry)(await read((0, node_path_1.join)(input.cwd, index_js_1.SECRET_METADATA_REGISTRY_PATH)));
+    const scope = Object.freeze({
+        slice: input.context.projectName,
+        stage: input.stage,
+        workspace: packageJson['name'],
+    });
+    (0, index_js_1.validateSecretManagementScope)(scope);
+    return Object.freeze({
+        declarations: (0, index_js_1.operatorSecretMetadataDeclarations)(registry),
+        scope,
+    });
+}
+async function preflightSliceSecretMetadata(options, context, invocation, dependencies = {}) {
+    const tags = context.projectsConfigurations?.projects[context.projectName ?? '']?.tags ??
+        [];
+    if (!tags.includes('type:slice'))
+        return;
+    const loaded = await loadSliceSecretMetadata({
+        context,
+        cwd: invocation.cwd,
+        ...(dependencies.readJson ? { readJson: dependencies.readJson } : {}),
+        stage: invocation.environment.EBK_CONSUMER_STAGE,
+    });
+    if (loaded.declarations.length === 0)
+        return;
+    const controlPlane = dependencies.controlPlane ??
+        createSecretMetadataControlPlane(resolveSecretAwsContext(options, dependencies.environment ?? process.env));
+    const result = await (0, index_js_1.runSecretDeployPreflight)({
+        action: 'deploy',
+        controlPlane,
+        declarations: loaded.declarations,
+        scope: loaded.scope,
+    });
+    if (!result.ready) {
+        throw new Error(`[secret-preflight] deploy refused before SST mutation:\n${result.findings
+            .map(({ code, name }) => `- ${code}: ${name}`)
+            .join('\n')}`);
+    }
+}
+//# sourceMappingURL=secret-preflight.js.map

package/src/executors/sst-lifecycle/secret-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/secret-preflight.ts"],"names":[],"mappings":";;AAyDA,0DAyBC;AAED,4EAWC;AAED,0DAkDC;AAED,oEAqCC;AA1LD,wEAAwD;AAExD,+CAA4C;AAC5C,yCAAsD;AAEtD,qDAUgC;AAsBhC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AAEtD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,GAAG,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAgB,uBAAuB,CACrC,OAAwD,EACxD,cAAiC,OAAO,CAAC,GAAG;IAE5C,MAAM,MAAM,GAAG,CACb,OAAO,CAAC,MAAM;QACd,WAAW,CAAC,UAAU;QACtB,WAAW,CAAC,kBAAkB;QAC9B,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gCAAgC,CAC9C,OAAyB;IAEzB,OAAO,IAAA,sDAA2C,EAAC;QACjD,mBAAmB,EAAE;YACnB,GAAG,CAAC,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB;KACF,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAAC,KAK7C;IACC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,cAAc,KAAK,CAAC,OAAO,CAAC,WAAW,0BAA0B,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,cAAc,KAAK,CAAC,OAAO,CAAC,WAAW,mCAAmC,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,sBAAU,EAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,CAAC,CAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,IAAI,CAAC;QACvB,CAAC,CAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAA,mBAAO,EAAC,KAAK,CAAC,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,gEAAgE,WAAW,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAA,gBAAI,EAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,sCAA2B,EAC1C,MAAM,IAAI,CAAC,IAAA,gBAAI,EAAC,KAAK,CAAC,GAAG,EAAE,wCAA6B,CAAC,CAAC,CAC3D,CAAC;IACF,MAAM,KAAK,GAA0B,MAAM,CAAC,MAAM,CAAC;QACjD,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC;KAC/B,CAAC,CAAC;IACH,IAAA,wCAA6B,EAAC,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,IAAA,6CAAkC,EAAC,QAAQ,CAAC;QAC1D,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAChD,OAA4B,EAC5B,OAAwB,EACxB,UAAgC,EAChC,eAAkD,EAAE;IAEpD,MAAM,IAAI,GACR,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,IAAI;QACzE,EAAE,CAAC;IACL,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO;IAEzC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,OAAO;QACP,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB;KACjD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE7C,MAAM,YAAY,GAChB,YAAY,CAAC,YAAY;QACzB,gCAAgC,CAC9B,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,CAC1E,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAwB,EAAC;QAC5C,MAAM,EAAE,QAAQ;QAChB,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,2DAA2D,MAAM,CAAC,QAAQ;aACvE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,IAAI,EAAE,CAAC;aAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/src/foundation/discovery.d.ts

@@ -1,19 +1,26 @@
 import { type FoundationRequirement, type StandardFoundationCapability } from './requirements.js';
 export declare const FOUNDATION_SSM_NAMESPACE: "/ebk";
-export declare const FOUNDATION_SSM_SCHEMA_VERSION: 2;
+export declare const FOUNDATION_SSM_SCHEMA_VERSION: 6;
 export declare const FOUNDATION_SSM_KEYS: {
+    readonly accountCostPolicyDigest: "accountCostPolicyDigest";
+    readonly accountMonthlyMaximumUsd: "accountMonthlyMaximumUsd";
     readonly alertTopicArn: "alertTopicArn";
     readonly capabilities: "capabilities";
     readonly clusterId: "clusterId";
     readonly contractVersion: "contractVersion";
     readonly databaseClusterArn: "databaseClusterArn";
+    readonly databaseClusterEndpoint: "databaseClusterEndpoint";
     readonly databaseClusterId: "databaseClusterId";
+    readonly databaseClusterResourceId: "databaseClusterResourceId";
+    readonly databaseHost: "databaseHost";
     readonly databaseMasterSecretArn: "databaseMasterSecretArn";
+    readonly databasePort: "databasePort";
     readonly eventBusArn: "eventBusArn";
     readonly eventBusName: "eventBusName";
     readonly hasPublicDomain: "hasPublicDomain";
     readonly identityUserPoolArn: "identityUserPoolArn";
     readonly identityUserPoolId: "identityUserPoolId";
+    readonly identityTokenEndpoint: "identityTokenEndpoint";
     readonly rootDomain: "rootDomain";
     readonly routerDistributionId: "routerDistributionId";
     readonly routerUrl: "routerUrl";
@@ -24,18 +31,25 @@ export type FoundationSsmKey = keyof typeof FOUNDATION_SSM_KEYS;
 export declare const FOUNDATION_REQUIRED_SSM_KEYS: FoundationSsmKey[];
 export declare const STANDARD_FOUNDATION_REQUIREMENT: FoundationRequirement;
 export interface FoundationDiscovery {
+    accountCostPolicyDigest: `sha256:${string}`;
+    accountMonthlyMaximumUsd: number;
     alertTopicArn: string;
     capabilities: StandardFoundationCapability[];
     clusterId: string;
     contractVersion: string;
     databaseClusterArn: string;
+    databaseClusterEndpoint: string;
     databaseClusterId: string;
+    databaseClusterResourceId: string;
+    databaseHost: string;
     databaseMasterSecretArn: string;
+    databasePort: number;
     eventBusArn: string;
     eventBusName: string;
     hasPublicDomain: boolean;
     identityUserPoolArn: string;
     identityUserPoolId: string;
+    identityTokenEndpoint: string;
     rootDomain?: string;
     routerDistributionId: string;
     routerUrl: string;
@@ -53,3 +67,5 @@ export declare function foundationSsmStageRoot(stage: string): string;
 export declare function foundationSsmPath(stage: string, key: FoundationSsmKey): string;
 export declare function productSliceRegistrationRoot(foundationStage: string): string;
 export declare function productSliceRegistrationPath(foundationStage: string, consumerStage: string, slice: string): string;
+export declare function productSliceMigrationPath(foundationStage: string, consumerStage: string, slice: string, database: string): string;
+export declare function productSliceRetentionPath(foundationStage: string, consumerStage: string, slice: string): string;

package/src/foundation/discovery.js

@@ -5,23 +5,32 @@ exports.foundationSsmStageRoot = foundationSsmStageRoot;
 exports.foundationSsmPath = foundationSsmPath;
 exports.productSliceRegistrationRoot = productSliceRegistrationRoot;
 exports.productSliceRegistrationPath = productSliceRegistrationPath;
+exports.productSliceMigrationPath = productSliceMigrationPath;
+exports.productSliceRetentionPath = productSliceRetentionPath;
 const requirements_js_1 = require("./requirements.js");
 const stages_js_1 = require("./stages.js");
 exports.FOUNDATION_SSM_NAMESPACE = '/ebk';
-exports.FOUNDATION_SSM_SCHEMA_VERSION = 2;
+exports.FOUNDATION_SSM_SCHEMA_VERSION = 6;
 exports.FOUNDATION_SSM_KEYS = {
+    accountCostPolicyDigest: 'accountCostPolicyDigest',
+    accountMonthlyMaximumUsd: 'accountMonthlyMaximumUsd',
     alertTopicArn: 'alertTopicArn',
     capabilities: 'capabilities',
     clusterId: 'clusterId',
     contractVersion: 'contractVersion',
     databaseClusterArn: 'databaseClusterArn',
+    databaseClusterEndpoint: 'databaseClusterEndpoint',
     databaseClusterId: 'databaseClusterId',
+    databaseClusterResourceId: 'databaseClusterResourceId',
+    databaseHost: 'databaseHost',
     databaseMasterSecretArn: 'databaseMasterSecretArn',
+    databasePort: 'databasePort',
     eventBusArn: 'eventBusArn',
     eventBusName: 'eventBusName',
     hasPublicDomain: 'hasPublicDomain',
     identityUserPoolArn: 'identityUserPoolArn',
     identityUserPoolId: 'identityUserPoolId',
+    identityTokenEndpoint: 'identityTokenEndpoint',
     rootDomain: 'rootDomain',
     routerDistributionId: 'routerDistributionId',
     routerUrl: 'routerUrl',
@@ -52,4 +61,10 @@ function productSliceRegistrationRoot(foundationStage) {
 function productSliceRegistrationPath(foundationStage, consumerStage, slice) {
     return `${productSliceRegistrationRoot(foundationStage)}/${(0, stages_js_1.requireStage)(consumerStage, 'Consumer stage')}/${requirePathSegment(slice, 'Product Slice name')}`;
 }
+function productSliceMigrationPath(foundationStage, consumerStage, slice, database) {
+    return `${productSliceRegistrationPath(foundationStage, consumerStage, slice)}/databases/${requirePathSegment(database, 'Logical database name')}/migrationStateMachineArn`;
+}
+function productSliceRetentionPath(foundationStage, consumerStage, slice) {
+    return `${productSliceRegistrationPath(foundationStage, consumerStage, slice)}/dataRetentionStateMachineArn`;
+}
 //# sourceMappingURL=discovery.js.map

package/src/foundation/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/discovery.ts"],"names":[],"mappings":";;;AA+EA,wDAEC;AAED,8CAKC;AAED,oEAEC;AAED,oEAMC;AApGD,uDAI2B;AAC3B,2CAAmE;AAEtD,QAAA,wBAAwB,GAAG,MAAe,CAAC;AAC3C,QAAA,6BAA6B,GAAG,CAAU,CAAC;AAE3C,QAAA,mBAAmB,GAAG;IACjC,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,SAAS,EAAE,WAAW;IACtB,eAAe,EAAE,iBAAiB;IAClC,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,mBAAmB;IACtC,uBAAuB,EAAE,yBAAyB;IAClD,WAAW,EAAE,aAAa;IAC1B,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,UAAU,EAAE,YAAY;IACxB,oBAAoB,EAAE,sBAAsB;IAC5C,SAAS,EAAE,WAAW;IACtB,aAAa,EAAE,eAAe;IAC9B,KAAK,EAAE,OAAO;CACN,CAAC;AAIE,QAAA,4BAA4B,GAAG,MAAM,CAAC,IAAI,CACrD,2BAAmB,CACE,CAAC;AAEX,QAAA,+BAA+B,GAA0B;IACpE,YAAY,EAAE,CAAC,GAAG,kDAAgC,CAAC;IACnD,QAAQ,EAAE,QAAQ;CACnB,CAAC;AA8BF,SAAS,kBAAkB,CAAC,KAAa,EAAE,KAAa;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,oDAAoD,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAa;IAClD,OAAO,GAAG,gCAAwB,IAAI,IAAA,kCAAsB,EAAC,KAAK,CAAC,aAAa,CAAC;AACnF,CAAC;AAED,SAAgB,iBAAiB,CAC/B,KAAa,EACb,GAAqB;IAErB,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,2BAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAgB,4BAA4B,CAAC,eAAuB;IAClE,OAAO,GAAG,sBAAsB,CAAC,eAAe,CAAC,iBAAiB,CAAC;AACrE,CAAC;AAED,SAAgB,4BAA4B,CAC1C,eAAuB,EACvB,aAAqB,EACrB,KAAa;IAEb,OAAO,GAAG,4BAA4B,CAAC,eAAe,CAAC,IAAI,IAAA,wBAAY,EAAC,aAAa,EAAE,gBAAgB,CAAC,IAAI,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;AAChK,CAAC"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/discovery.ts"],"names":[],"mappings":";;;AA6FA,wDAEC;AAED,8CAKC;AAED,oEAEC;AAED,oEAMC;AAED,8DAcC;AAED,8DAUC;AA9ID,uDAI2B;AAC3B,2CAAmE;AAEtD,QAAA,wBAAwB,GAAG,MAAe,CAAC;AAC3C,QAAA,6BAA6B,GAAG,CAAU,CAAC;AAE3C,QAAA,mBAAmB,GAAG;IACjC,uBAAuB,EAAE,yBAAyB;IAClD,wBAAwB,EAAE,0BAA0B;IACpD,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,SAAS,EAAE,WAAW;IACtB,eAAe,EAAE,iBAAiB;IAClC,kBAAkB,EAAE,oBAAoB;IACxC,uBAAuB,EAAE,yBAAyB;IAClD,iBAAiB,EAAE,mBAAmB;IACtC,yBAAyB,EAAE,2BAA2B;IACtD,YAAY,EAAE,cAAc;IAC5B,uBAAuB,EAAE,yBAAyB;IAClD,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,qBAAqB,EAAE,uBAAuB;IAC9C,UAAU,EAAE,YAAY;IACxB,oBAAoB,EAAE,sBAAsB;IAC5C,SAAS,EAAE,WAAW;IACtB,aAAa,EAAE,eAAe;IAC9B,KAAK,EAAE,OAAO;CACN,CAAC;AAIE,QAAA,4BAA4B,GAAG,MAAM,CAAC,IAAI,CACrD,2BAAmB,CACE,CAAC;AAEX,QAAA,+BAA+B,GAA0B;IACpE,YAAY,EAAE,CAAC,GAAG,kDAAgC,CAAC;IACnD,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAqCF,SAAS,kBAAkB,CAAC,KAAa,EAAE,KAAa;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,oDAAoD,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAa;IAClD,OAAO,GAAG,gCAAwB,IAAI,IAAA,kCAAsB,EAAC,KAAK,CAAC,aAAa,CAAC;AACnF,CAAC;AAED,SAAgB,iBAAiB,CAC/B,KAAa,EACb,GAAqB;IAErB,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,2BAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAgB,4BAA4B,CAAC,eAAuB;IAClE,OAAO,GAAG,sBAAsB,CAAC,eAAe,CAAC,iBAAiB,CAAC;AACrE,CAAC;AAED,SAAgB,4BAA4B,CAC1C,eAAuB,EACvB,aAAqB,EACrB,KAAa;IAEb,OAAO,GAAG,4BAA4B,CAAC,eAAe,CAAC,IAAI,IAAA,wBAAY,EAAC,aAAa,EAAE,gBAAgB,CAAC,IAAI,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;AAChK,CAAC;AAED,SAAgB,yBAAyB,CACvC,eAAuB,EACvB,aAAqB,EACrB,KAAa,EACb,QAAgB;IAEhB,OAAO,GAAG,4BAA4B,CACpC,eAAe,EACf,aAAa,EACb,KAAK,CACN,cAAc,kBAAkB,CAC/B,QAAQ,EACR,uBAAuB,CACxB,2BAA2B,CAAC;AAC/B,CAAC;AAED,SAAgB,yBAAyB,CACvC,eAAuB,EACvB,aAAqB,EACrB,KAAa;IAEb,OAAO,GAAG,4BAA4B,CACpC,eAAe,EACf,aAAa,EACb,KAAK,CACN,+BAA+B,CAAC;AACnC,CAAC"}

package/src/foundation/index.d.ts

@@ -1,6 +1,9 @@
 export * from './discovery.js';
 export * from './local-database-contract.js';
+export * from './logging.js';
+export * from './logging-preflight.js';
 export * from './provision-database-bindings.js';
 export * from './provision-logical-database.js';
 export * from './requirements.js';
+export * from './router-origin-proof.js';
 export * from './stages.js';

package/src/foundation/index.js

@@ -3,8 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./discovery.js"), exports);
 tslib_1.__exportStar(require("./local-database-contract.js"), exports);
+tslib_1.__exportStar(require("./logging.js"), exports);
+tslib_1.__exportStar(require("./logging-preflight.js"), exports);
 tslib_1.__exportStar(require("./provision-database-bindings.js"), exports);
 tslib_1.__exportStar(require("./provision-logical-database.js"), exports);
 tslib_1.__exportStar(require("./requirements.js"), exports);
+tslib_1.__exportStar(require("./router-origin-proof.js"), exports);
 tslib_1.__exportStar(require("./stages.js"), exports);
 //# sourceMappingURL=index.js.map

package/src/foundation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/index.ts"],"names":[],"mappings":";;;AAAA,yDAA+B;AAC/B,uEAA6C;AAC7C,2EAAiD;AACjD,0EAAgD;AAChD,4DAAkC;AAClC,sDAA4B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/index.ts"],"names":[],"mappings":";;;AAAA,yDAA+B;AAC/B,uEAA6C;AAC7C,uDAA6B;AAC7B,iEAAuC;AACvC,2EAAiD;AACjD,0EAAgD;AAChD,4DAAkC;AAClC,mEAAyC;AACzC,sDAA4B"}

package/src/foundation/local-database-contract.d.ts

@@ -16,6 +16,7 @@ export interface LogicalDatabaseIdentifiers {
     database: string;
     localDatabase: string;
     localReadwriteRole: string;
+    migratorRole: string;
     readonlyRole: string;
     readwriteRole: string;
 }

package/src/foundation/local-database-contract.js

@@ -32,12 +32,14 @@ function resolveLogicalDatabaseIdentifiers(options) {
     const database = normalizePostgresIdentifier(`${options.stage}_${options.slice}_${options.database}`);
     const readwriteRole = `${database}_readwrite`;
     const readonlyRole = `${database}_readonly`;
+    const migratorRole = `${database}_migrator`;
     const localDatabase = normalizePostgresIdentifier(`${options.slice}_${options.database}`);
     const localReadwriteRole = `${localDatabase}_readwrite`;
     for (const [identifier, label] of [
         [database, 'Physical database identifier'],
         [readwriteRole, 'Physical read-write role identifier'],
         [readonlyRole, 'Physical read-only role identifier'],
+        [migratorRole, 'Physical migrator role identifier'],
         [localDatabase, 'Local database identifier'],
         [localReadwriteRole, 'Local read-write role identifier'],
     ]) {
@@ -47,6 +49,7 @@ function resolveLogicalDatabaseIdentifiers(options) {
         database,
         localDatabase,
         localReadwriteRole,
+        migratorRole,
         readonlyRole,
         readwriteRole,
     };

package/src/foundation/local-database-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-database-contract.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/local-database-contract.ts"],"names":[],"mappings":";;;AAyBA,kEAGC;AAQD,oEAEC;AAED,wEAUC;AAED,8EAoCC;AAUD,oEAmBC;AAtGY,QAAA,6BAA6B,GAAG,EAAE,CAAC;AAUhD,SAAgB,2BAA2B,CAAC,KAAa;IACvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAgB,4BAA4B,CAAC,UAAkB;IAC7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC;AACzD,CAAC;AAED,SAAgB,8BAA8B,CAC5C,UAAkB,EAClB,KAAa;IAEb,MAAM,KAAK,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,KAAK,GAAG,qCAA6B,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,KAAK,UAAU,QAAQ,KAAK,gDAAgD,qCAA6B,0GAA0G,CAC5N,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,iCAAiC,CAAC,OAIjD;IACC,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACxD,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC5D,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CACxD,CAAC;IACF,MAAM,aAAa,GAAG,GAAG,QAAQ,YAAY,CAAC;IAC9C,MAAM,YAAY,GAAG,GAAG,QAAQ,WAAW,CAAC;IAC5C,MAAM,aAAa,GAAG,2BAA2B,CAC/C,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CACvC,CAAC;IACF,MAAM,kBAAkB,GAAG,GAAG,aAAa,YAAY,CAAC;IAExD,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI;QAChC,CAAC,QAAQ,EAAE,8BAA8B,CAAC;QAC1C,CAAC,aAAa,EAAE,qCAAqC,CAAC;QACtD,CAAC,YAAY,EAAE,oCAAoC,CAAC;QACpD,CAAC,aAAa,EAAE,2BAA2B,CAAC;QAC5C,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;KAChD,EAAE,CAAC;QACX,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,OAAO;QACL,QAAQ;QACR,aAAa;QACb,kBAAkB;QAClB,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,GAAW;IACjD,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,4BAA4B,CAC1C,OAAqC;IAErC,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CACvC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,YAAY,CAAC;IACzC,8BAA8B,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACtE,8BAA8B,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;IAE7E,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG,OAAO,CAAC,KAAK,YAAY;QAC1D,IAAI,EACF,OAAO,CAAC,IAAI;YACZ,8BAA8B,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACxE,QAAQ;KACT,CAAC;AACJ,CAAC"}
+{"version":3,"file":"local-database-contract.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/local-database-contract.ts"],"names":[],"mappings":";;;AA0BA,kEAGC;AAQD,oEAEC;AAED,wEAUC;AAED,8EAuCC;AAUD,oEAmBC;AA1GY,QAAA,6BAA6B,GAAG,EAAE,CAAC;AAWhD,SAAgB,2BAA2B,CAAC,KAAa;IACvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAgB,4BAA4B,CAAC,UAAkB;IAC7D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC;AACzD,CAAC;AAED,SAAgB,8BAA8B,CAC5C,UAAkB,EAClB,KAAa;IAEb,MAAM,KAAK,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,KAAK,GAAG,qCAA6B,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,KAAK,UAAU,QAAQ,KAAK,gDAAgD,qCAA6B,0GAA0G,CAC5N,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,iCAAiC,CAAC,OAIjD;IACC,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACxD,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC5D,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CACxD,CAAC;IACF,MAAM,aAAa,GAAG,GAAG,QAAQ,YAAY,CAAC;IAC9C,MAAM,YAAY,GAAG,GAAG,QAAQ,WAAW,CAAC;IAC5C,MAAM,YAAY,GAAG,GAAG,QAAQ,WAAW,CAAC;IAC5C,MAAM,aAAa,GAAG,2BAA2B,CAC/C,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CACvC,CAAC;IACF,MAAM,kBAAkB,GAAG,GAAG,aAAa,YAAY,CAAC;IAExD,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI;QAChC,CAAC,QAAQ,EAAE,8BAA8B,CAAC;QAC1C,CAAC,aAAa,EAAE,qCAAqC,CAAC;QACtD,CAAC,YAAY,EAAE,oCAAoC,CAAC;QACpD,CAAC,YAAY,EAAE,mCAAmC,CAAC;QACnD,CAAC,aAAa,EAAE,2BAA2B,CAAC;QAC5C,CAAC,kBAAkB,EAAE,kCAAkC,CAAC;KAChD,EAAE,CAAC;QACX,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,OAAO;QACL,QAAQ;QACR,aAAa;QACb,kBAAkB;QAClB,YAAY;QACZ,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,GAAW;IACjD,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,4BAA4B,CAC1C,OAAqC;IAErC,MAAM,QAAQ,GAAG,2BAA2B,CAC1C,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CACvC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,YAAY,CAAC;IACzC,8BAA8B,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACtE,8BAA8B,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;IAE7E,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG,OAAO,CAAC,KAAK,YAAY;QAC1D,IAAI,EACF,OAAO,CAAC,IAAI;YACZ,8BAA8B,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACxE,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/src/foundation/logging-preflight.d.ts

@@ -0,0 +1,30 @@
+import { type ManagedLogGroupContract } from './logging.js';
+export declare const SST_LOG_GROUP_RESOURCE_TYPE: "aws:cloudwatch/logGroup:LogGroup";
+export interface ExistingManagedLogGroup {
+    hasGroupIndexPolicy: boolean;
+    name: string;
+    tags: Readonly<Record<string, string>>;
+}
+export interface SstStateLogGroupOwnership {
+    logicalResource: string;
+    physicalName: string;
+    stackIdentity: string;
+}
+export interface ManagedLogGroupPreflightIssue {
+    classification: 'log-group-index-policy-unexpected' | 'log-group-ownership-ambiguous' | 'log-group-workspace-collision';
+    expectedStackIdentity?: string;
+    logGroupName: string;
+}
+export interface ManagedLogGroupPreflightReport {
+    issues: ManagedLogGroupPreflightIssue[];
+    ok: boolean;
+    plannedCreates: string[];
+    plannedUpdates: string[];
+}
+export declare function readSstStateLogGroupOwnership(state: unknown): SstStateLogGroupOwnership[];
+export declare function evaluateManagedLogGroupPreflight(input: {
+    contracts: readonly ManagedLogGroupContract[];
+    existing: readonly ExistingManagedLogGroup[];
+    expectedStackIdentity: string;
+    stateOwnership: readonly SstStateLogGroupOwnership[];
+}): ManagedLogGroupPreflightReport;

package/src/foundation/logging-preflight.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SST_LOG_GROUP_RESOURCE_TYPE = void 0;
+exports.readSstStateLogGroupOwnership = readSstStateLogGroupOwnership;
+exports.evaluateManagedLogGroupPreflight = evaluateManagedLogGroupPreflight;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const logging_js_1 = require("./logging.js");
+exports.SST_LOG_GROUP_RESOURCE_TYPE = 'aws:cloudwatch/logGroup:LogGroup';
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function stateResources(value) {
+    const root = record(value);
+    const deployment = record(root?.deployment);
+    const resources = deployment?.resources ?? root?.resources;
+    if (!Array.isArray(resources)) {
+        throw new Error('SST state export does not contain a Pulumi deployment resource list.');
+    }
+    return resources.filter((resource) => typeof resource === 'object' &&
+        resource !== null &&
+        !Array.isArray(resource));
+}
+function ownershipFromUrn(urn, physicalName) {
+    const parts = urn.split('::');
+    if (parts.length < 4 ||
+        !parts[0]?.startsWith('urn:pulumi:') ||
+        parts[1]?.length === 0 ||
+        parts.at(-1)?.length === 0) {
+        return undefined;
+    }
+    const stack = parts[0].slice('urn:pulumi:'.length);
+    const project = parts[1];
+    if (!stack || !project)
+        return undefined;
+    return {
+        logicalResource: parts.at(-1),
+        physicalName,
+        stackIdentity: `${project}/${stack}`,
+    };
+}
+function readSstStateLogGroupOwnership(state) {
+    const ownership = [];
+    for (const resource of stateResources(state)) {
+        if (resource.type !== exports.SST_LOG_GROUP_RESOURCE_TYPE)
+            continue;
+        const outputs = record(resource.outputs);
+        const inputs = record(resource.inputs);
+        const physicalName = typeof outputs?.name === 'string'
+            ? outputs.name
+            : typeof inputs?.name === 'string'
+                ? inputs.name
+                : undefined;
+        if (!physicalName || typeof resource.urn !== 'string')
+            continue;
+        const parsed = ownershipFromUrn(resource.urn, physicalName);
+        if (parsed)
+            ownership.push(parsed);
+    }
+    return ownership.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.physicalName, right.physicalName));
+}
+function evaluateManagedLogGroupPreflight(input) {
+    const contracts = new Map();
+    for (const contract of input.contracts) {
+        if (contracts.has(contract.name)) {
+            throw new Error(`Managed log-group preflight received duplicate contract ${contract.name}.`);
+        }
+        contracts.set(contract.name, contract);
+    }
+    const existing = new Map();
+    for (const group of input.existing) {
+        if (existing.has(group.name)) {
+            throw new Error(`Managed log-group inventory contains duplicate group ${group.name}.`);
+        }
+        existing.set(group.name, group);
+    }
+    const stateByName = new Map();
+    for (const ownership of input.stateOwnership) {
+        const candidates = stateByName.get(ownership.physicalName) ?? [];
+        candidates.push(ownership);
+        stateByName.set(ownership.physicalName, candidates);
+    }
+    const issues = [];
+    const plannedCreates = [];
+    const plannedUpdates = [];
+    for (const contract of [...contracts.values()].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name))) {
+        const observedGroup = existing.get(contract.name);
+        if (!observedGroup) {
+            plannedCreates.push(contract.name);
+            continue;
+        }
+        if (observedGroup.hasGroupIndexPolicy) {
+            issues.push({
+                classification: 'log-group-index-policy-unexpected',
+                logGroupName: contract.name,
+            });
+            continue;
+        }
+        const stateCandidates = stateByName.get(contract.name) ?? [];
+        const stateOwnership = stateCandidates.length === 1 ? stateCandidates[0] : undefined;
+        const observed = {
+            exists: true,
+            ...(stateOwnership
+                ? {
+                    stack: {
+                        identity: stateOwnership.stackIdentity,
+                        logicalResource: stateOwnership.logicalResource,
+                        physicalName: stateOwnership.physicalName,
+                    },
+                }
+                : {}),
+            tags: observedGroup.tags,
+        };
+        const disposition = (0, logging_js_1.classifyManagedLogGroupOwnership)(contract, observed, {
+            stackIdentity: input.expectedStackIdentity,
+        });
+        if (disposition.action === 'update-current-candidate') {
+            plannedUpdates.push(contract.name);
+            continue;
+        }
+        if (disposition.action === 'create') {
+            throw new Error(`Managed log-group preflight observed ${contract.name} but classified it as missing.`);
+        }
+        issues.push({
+            classification: disposition.classification,
+            expectedStackIdentity: input.expectedStackIdentity,
+            logGroupName: contract.name,
+        });
+    }
+    return {
+        issues,
+        ok: issues.length === 0,
+        plannedCreates,
+        plannedUpdates,
+    };
+}
+//# sourceMappingURL=logging-preflight.js.map

package/src/foundation/logging-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-preflight.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/logging-preflight.ts"],"names":[],"mappings":";;;AA2FA,sEAqBC;AAED,4EAyFC;AA3MD,sEAAyD;AACzD,6CAIsB;AAET,QAAA,2BAA2B,GACtC,kCAA2C,CAAC;AAqC9C,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAA2C;QAC9C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CACrB,CAAC,QAAQ,EAAmC,EAAE,CAC5C,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAW,EACX,YAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,IACE,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC;QACpC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC;QACtB,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO;QACL,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAW;QACvC,YAAY;QACZ,aAAa,EAAE,GAAG,OAAO,IAAI,KAAK,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAC3C,KAAc;IAEd,MAAM,SAAS,GAAgC,EAAE,CAAC;IAClD,KAAK,MAAM,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,IAAI,QAAQ,CAAC,IAAI,KAAK,mCAA2B;YAAE,SAAS;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,YAAY,GAChB,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ;YAC/B,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ;gBAChC,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,CAAC,YAAY,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAAE,SAAS;QAChE,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,MAAM;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpC,IAAA,qCAAY,EAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,SAAgB,gCAAgC,CAAC,KAKhD;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC7D,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,2DAA2D,QAAQ,CAAC,IAAI,GAAG,CAC5E,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,wDAAwD,KAAK,CAAC,IAAI,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuC,CAAC;IACnE,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACjE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClE,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CACpC,EAAE,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,mBAAmB,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC;gBACV,cAAc,EAAE,mCAAmC;gBACnD,YAAY,EAAE,QAAQ,CAAC,IAAI;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,cAAc,GAClB,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,QAAQ,GAA4B;YACxC,MAAM,EAAE,IAAI;YACZ,GAAG,CAAC,cAAc;gBAChB,CAAC,CAAC;oBACE,KAAK,EAAE;wBACL,QAAQ,EAAE,cAAc,CAAC,aAAa;wBACtC,eAAe,EAAE,cAAc,CAAC,eAAe;wBAC/C,YAAY,EAAE,cAAc,CAAC,YAAY;qBAC1C;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,EAAE,aAAa,CAAC,IAAI;SACzB,CAAC;QACF,MAAM,WAAW,GAAG,IAAA,6CAAgC,EAAC,QAAQ,EAAE,QAAQ,EAAE;YACvE,aAAa,EAAE,KAAK,CAAC,qBAAqB;SAC3C,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;YACtD,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,CAAC,IAAI,gCAAgC,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,YAAY,EAAE,QAAQ,CAAC,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,MAAM;QACN,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QACvB,cAAc;QACd,cAAc;KACf,CAAC;AACJ,CAAC"}

package/src/foundation/logging.d.ts

@@ -0,0 +1,70 @@
+export declare const MANAGED_LOG_GROUP_CLASS: "STANDARD";
+export declare const MANAGED_LOG_GROUP_RETENTION_DAYS: 30;
+export declare const MANAGED_LOG_GROUP_TAG_KEYS: {
+    readonly component: "ebk:component";
+    readonly managed: "ebk:managed";
+    readonly slice: "ebk:slice";
+    readonly stage: "ebk:stage";
+    readonly workspace: "ebk:workspace";
+};
+export declare const MANAGED_LOG_DATA_IDENTIFIERS: readonly ["arn:aws:dataprotection::aws:data-identifier/AwsSecretKey", "arn:aws:dataprotection::aws:data-identifier/EmailAddress", "arn:aws:dataprotection::aws:data-identifier/IpAddress"];
+export declare const FORBIDDEN_DEPLOYMENT_LOG_POLICY_ACTIONS: readonly ["logs:DeleteIndexPolicy", "logs:PutAccountPolicy", "logs:PutIndexPolicy", "logs:Unmask"];
+export interface ManagedLogGroupInput {
+    component: string;
+    resource?: string;
+    slice: string;
+    stage: string;
+    workspace: string;
+}
+export interface ManagedLogGroupContract {
+    dataProtectionPolicy: {
+        Description: string;
+        Name: string;
+        Statement: [
+            {
+                DataIdentifier: string[];
+                Operation: {
+                    Audit: Record<string, never>;
+                };
+                Sid: 'AuditSensitiveData';
+            },
+            {
+                DataIdentifier: string[];
+                Operation: {
+                    Deidentify: {
+                        MaskConfig: Record<string, never>;
+                    };
+                };
+                Sid: 'MaskSensitiveData';
+            }
+        ];
+        Version: '2021-06-01';
+    };
+    logGroupClass: typeof MANAGED_LOG_GROUP_CLASS;
+    name: string;
+    retentionInDays: typeof MANAGED_LOG_GROUP_RETENTION_DAYS;
+    tags: Record<string, string>;
+}
+export interface ObservedManagedLogGroup {
+    exists: boolean;
+    stack?: {
+        identity: string;
+        logicalResource: string;
+        physicalName: string;
+    };
+    tags?: Readonly<Record<string, string>>;
+}
+export interface ExpectedManagedLogGroupOwnership {
+    stackIdentity: string;
+}
+export type ManagedLogGroupOwnershipDisposition = {
+    action: 'create';
+} | {
+    action: 'update-current-candidate';
+} | {
+    action: 'refuse';
+    classification: 'log-group-ownership-ambiguous' | 'log-group-workspace-collision';
+};
+export declare function createManagedLogGroupContract(input: ManagedLogGroupInput): ManagedLogGroupContract;
+export declare function classifyManagedLogGroupOwnership(contract: ManagedLogGroupContract, observed: ObservedManagedLogGroup, expected: ExpectedManagedLogGroupOwnership): ManagedLogGroupOwnershipDisposition;
+export declare function validateDeploymentLogPolicyActions(actions: readonly string[]): void;