@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/foundation/provision-logical-database.js

@@ -2,55 +2,38 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.defaultDatabaseLinkableName = defaultDatabaseLinkableName;
 exports.provisionLogicalDatabase = provisionLogicalDatabase;
-const aurora_logical_database_js_1 = require("./aurora-logical-database.js");
 const local_database_contract_js_1 = require("./local-database-contract.js");
+const stages_js_1 = require("./stages.js");
 function classNameForDatabaseComponent(value) {
-    // 'example-primary' -> 'ExamplePrimary'. Simple normalizer; the db
-    // generator always passes already-kebab-cased segments.
     return value
         .split(/[-_]/)
         .filter(Boolean)
-        .map((p) => p.charAt(0).toUpperCase() + p.slice(1))
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
         .join('');
 }
 function defaultDatabaseLinkableName(slice, database) {
     return `${classNameForDatabaseComponent(slice)}${classNameForDatabaseComponent(database)}Database`;
 }
-// Carves out an app-scoped logical database on the shared `CoreDb` Aurora
-// cluster. Creates:
-//   * `<app>_<database>` logical Postgres database on the shared cluster
-//   * `<app>_readwrite` role (full DML + DDL) + `<app>_readonly` role (SELECT only)
-//   * AWS Secrets Manager secrets for each role at
-//     `ebk/<stage>/<app>/db/<role>` with JSON `{ host, port, database, username, password }`
-//   * An `sst.Linkable` exposing the readwrite credentials — consumers link
-//     this into their Nextjs / Service / Function stacks so runtime code sees
-//     `Resource.<Linkable>.host/port/database/username/password` unchanged
+// Declares a Slice-scoped logical database contract without executing SQL or
+// materializing a database password during infrastructure deployment.
 //
-// Passwords are generated inside the `AuroraLogicalDb` dynamic resource via
-// Node `crypto.randomBytes` and persisted in Pulumi state, so no
-// `@pulumi/random` dep is needed. They are never rotated automatically —
-// change `rotationToken` to rotate on the next deploy (see the rotation
-// runbook in this package's README).
-//
-// DO NOT pass `core.db.cluster` (the raw Aurora handle) into
-// `new sst.aws.Nextjs({ link })` — that leaks the master password. This
-// helper is the sanctioned consumer path.
+// In deployed stages this creates two empty Secrets Manager containers and a
+// Linkable carrying only connection metadata plus the read/write secret ARN.
+// The generated AWS-internal bootstrap task converges the actual database,
+// roles, and secret versions before the migration task runs.
 function provisionLogicalDatabase(foundation, options) {
-    // Resolve and validate every deployed and local PostgreSQL identifier before
-    // constructing an SST Linkable, Pulumi dynamic resource, or AWS secret.
-    // PostgreSQL truncates overlong identifiers by default; EBK fails instead so
-    // two declarations can never alias silently.
+    const consumerStage = (0, stages_js_1.requireStage)($app.stage, 'Consumer stage');
+    if (options.rotationToken !== undefined &&
+        options.rotationToken.trim() === '') {
+        throw new Error('Logical database rotationToken must be a non-empty string when supplied.');
+    }
     const identifiers = (0, local_database_contract_js_1.resolveLogicalDatabaseIdentifiers)({
         database: options.database,
         slice: options.slice,
-        stage: $app.stage,
+        stage: consumerStage,
     });
-    const linkableName = options.linkableName ??
+    const resourceName = options.linkableName ??
         defaultDatabaseLinkableName(options.slice, options.database);
-    // Local live mode needs only the workload-facing Linkable. Return before
-    // constructing the Pulumi dynamic resource or either Secrets Manager secret
-    // so `sst dev` does not provision unused AWS database resources merely to
-    // point the application at Docker Postgres.
     if ($dev && (options.localDev ?? true)) {
         const localDatabase = (0, local_database_contract_js_1.resolveLocalDatabaseContract)({
             database: options.database,
@@ -59,104 +42,76 @@ function provisionLogicalDatabase(foundation, options) {
             slice: options.slice,
         });
         return {
-            db: new sst.Linkable(linkableName, {
-                properties: localDatabase,
+            db: new sst.Linkable(resourceName, {
+                properties: {
+                    provider: 'local',
+                    ...localDatabase,
+                },
             }),
+            databaseName: localDatabase.database,
+            migratorRole: identifiers.migratorRole,
+            readonlyRole: identifiers.readonlyRole,
+            readwriteRole: identifiers.readwriteRole,
+            resourceName,
         };
     }
-    // `<consumer_stage>_<app>_<database>` — scoped by the CONSUMER stage, not
-    // core's. Personal/preview stages (`pr-123`, `lukas`) share the shared
-    // development cluster via `EBK_CORE_STAGE=development` for cost, but their
-    // data MUST be isolated from every other stage's. Without stage-scoping, two stages
-    // pointing at the same core would stomp on each other's database rows and
-    // rotate each other's passwords via the retained-role `ALTER ROLE` path.
-    // Hyphens become underscores because Postgres identifiers reject `-`.
-    const databaseIdentifier = identifiers.database;
-    const readwriteRole = identifiers.readwriteRole;
-    const readonlyRole = identifiers.readonlyRole;
-    // Default removal policy depends on stage. Canonical persistent stages
-    // (development/staging/production) retain data — destroying a consumer stack
-    // shouldn't nuke anything anyone cares about. Ephemeral stages (preview
-    // `pr-123`, personal `lukas`, etc.) destroy — every such stage creates
-    // its own stage-scoped logical DB, and leaving it behind after the
-    // preview is torn down would leak Aurora state + roles forever.
-    // Callers can override explicitly via `options.removalPolicy`.
-    const canonicalStages = new Set(['development', 'staging', 'production']);
-    const defaultRemovalPolicy = canonicalStages.has($app.stage)
-        ? 'retain'
-        : 'destroy';
-    const logicalDb = (0, aurora_logical_database_js_1.createAuroraLogicalDbResource)({
-        name: linkableName,
-        args: {
-            clusterArn: foundation.database.clusterArn,
-            masterSecretArn: foundation.database.masterSecretArn,
-            database: databaseIdentifier,
-            readwriteRole,
-            readonlyRole,
-            removalPolicy: options.removalPolicy ?? defaultRemovalPolicy,
-            // Only include the rotation trigger when the caller set one — keeping
-            // the key out of the inputs entirely when unset avoids a spurious
-            // `undefined` diff against resources created before this option existed.
-            ...(options.rotationToken !== undefined
-                ? { rotationToken: options.rotationToken }
-                : {}),
-        },
-    });
-    // `core.db.cluster.host` auto-resolves to the proxy endpoint when proxy is
-    // enabled (production) or the cluster writer endpoint otherwise.
-    // `core.db.cluster.port` similarly resolves to either the proxy port or the
-    // cluster port.
-    const host = foundation.database.cluster.host;
-    const port = foundation.database.cluster.port;
-    // Outputs from the dynamic resource — Pulumi unwraps them on link.
-    const readwritePassword = logicalDb.readwritePassword;
-    const readonlyPassword = logicalDb.readonlyPassword;
-    const secretJsonFor = (role, password) => $interpolate `{"host":"${host}","port":${port},"database":"${databaseIdentifier}","username":"${role}","password":"${password}"}`;
-    // Secret paths are keyed by the CONSUMER's stage, not core's. Two stages
-    // pointing at the same core via `EBK_CORE_STAGE` (e.g. `pr-123` → `development`)
-    // would otherwise collide on `ebk/development/<app>/db/<db>/...`. Keying by
-    // `$app.stage` isolates each consumer's secret namespace while the actual
-    // cluster remains shared.
-    const secretBasePath = `ebk/${$app.stage}/${options.slice}/database/${options.database}`;
-    // `recoveryWindowInDays: 0` skips the default 7-day soft-delete window.
-    // Destroy frees the secret name immediately so a subsequent create (or a
-    // redeploy after `sst remove`) doesn't hit `InvalidRequestException:
-    // ...already scheduled for deletion`. App-scoped DB role credentials are
-    // regenerated on every create() anyway — a recovery window serves no
-    // purpose here.
-    const readwriteSecret = new aws.secretsmanager.Secret(`${linkableName}ReadwriteSecret`, {
+    if (options.removalPolicy === 'destroy') {
+        throw new Error('Logical database removalPolicy "destroy" requires a reviewed AWS-internal retirement workflow and is not supported by the v1 protected bootstrap.');
+    }
+    const host = foundation.database.host;
+    const port = foundation.database.port;
+    const secretBasePath = `ebk/${consumerStage}/${options.slice}/database/${options.database}`;
+    const tags = {
+        'ebk:database': options.database,
+        'ebk:management': 'generated-database-credential',
+        'ebk:slice': options.slice,
+        'sst:stage': consumerStage,
+    };
+    // Secret containers deliberately have no SecretVersion resources. Their
+    // values are generated inside AWS and written by the exact bootstrap task.
+    const readwriteSecret = new aws.secretsmanager.Secret(`${resourceName}ReadwriteSecret`, {
+        description: `EBK generated read/write credential for ${options.slice}/${options.database}`,
         name: `${secretBasePath}/readwrite`,
         recoveryWindowInDays: 0,
-    }, { dependsOn: logicalDb });
-    const readwriteSecretVersion = new aws.secretsmanager.SecretVersion(`${linkableName}ReadwriteSecretVersion`, {
-        secretId: readwriteSecret.id,
-        secretString: secretJsonFor(readwriteRole, readwritePassword),
+        tags,
     });
-    const readonlySecret = new aws.secretsmanager.Secret(`${linkableName}ReadonlySecret`, {
+    const readonlySecret = new aws.secretsmanager.Secret(`${resourceName}ReadonlySecret`, {
+        description: `EBK generated read-only credential for ${options.slice}/${options.database}`,
         name: `${secretBasePath}/readonly`,
         recoveryWindowInDays: 0,
-    }, { dependsOn: logicalDb });
-    const readonlySecretVersion = new aws.secretsmanager.SecretVersion(`${linkableName}ReadonlySecretVersion`, {
-        secretId: readonlySecret.id,
-        secretString: secretJsonFor(readonlyRole, readonlyPassword),
+        tags,
     });
-    const linkable = new sst.Linkable(linkableName, {
+    const linkable = new sst.Linkable(resourceName, {
         properties: {
+            database: identifiers.database,
             host,
+            logicalName: `${resourceName}Credential`,
             port,
-            database: databaseIdentifier,
-            username: readwriteRole,
-            password: $util.secret(readwritePassword),
+            provider: 'aws-secrets-manager',
+            secretArn: readwriteSecret.arn,
+            username: identifiers.readwriteRole,
         },
+        include: [
+            sst.aws.permission({
+                actions: ['secretsmanager:GetSecretValue'],
+                resources: [readwriteSecret.arn],
+            }),
+        ],
     });
-    // Touch the version refs so Pulumi tracks them + keep them alive in GC.
-    void readwriteSecretVersion;
-    void readonlySecretVersion;
     return {
+        databaseName: identifiers.database,
         db: linkable,
-        logicalDb,
-        readwriteSecretArn: readwriteSecret.arn,
+        migratorRole: identifiers.migratorRole,
+        readonlyRole: identifiers.readonlyRole,
         readonlySecretArn: readonlySecret.arn,
+        readwriteRole: identifiers.readwriteRole,
+        readwriteSecretArn: readwriteSecret.arn,
+        resourceName,
+        // The cutover token forces one rotation for credentials that may still be
+        // present in historical pre-bootstrap Pulumi state. The token is stored
+        // only as non-secret metadata inside the new runtime secret version, so
+        // later bootstrap executions converge without rotating again.
+        rotationToken: options.rotationToken ?? 'aws-bootstrap-v1',
     };
 }
 //# sourceMappingURL=provision-logical-database.js.map

package/src/foundation/provision-logical-database.js.map

@@ -1 +1 @@
-{"version":3,"file":"provision-logical-database.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/provision-logical-database.ts"],"names":[],"mappings":";;AA+GA,kEAKC;AAqBD,4DA0JC;AAnSD,6EAA6E;AAC7E,6EAGsC;AAiGtC,SAAS,6BAA6B,CAAC,KAAa;IAClD,mEAAmE;IACnE,wDAAwD;IACxD,OAAO,KAAK;SACT,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAAa,EACb,QAAgB;IAEhB,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,6BAA6B,CAAC,QAAQ,CAAC,UAAU,CAAC;AACrG,CAAC;AAED,0EAA0E;AAC1E,oBAAoB;AACpB,yEAAyE;AACzE,oFAAoF;AACpF,mDAAmD;AACnD,6FAA6F;AAC7F,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,iEAAiE;AACjE,yEAAyE;AACzE,wEAAwE;AACxE,qCAAqC;AACrC,EAAE;AACF,6DAA6D;AAC7D,wEAAwE;AACxE,0CAA0C;AAC1C,SAAgB,wBAAwB,CACtC,UAAoC,EACpC,OAAwC;IAExC,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAA,8DAAiC,EAAC;QACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,2BAA2B,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/D,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4CAA4C;IAC5C,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAA,yDAA4B,EAAC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,gBAAgB;YAClC,IAAI,EAAE,OAAO,CAAC,YAAY;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE;gBACjC,UAAU,EAAE,aAAa;aAC1B,CAAC;SACH,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,oFAAoF;IACpF,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,kBAAkB,GAAG,WAAW,CAAC,QAAQ,CAAC;IAChD,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;IAChD,MAAM,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;IAE9C,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1E,MAAM,oBAAoB,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAC1D,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,IAAA,0DAA6B,EAAC;QAC9C,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU;YAC1C,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;YACpD,QAAQ,EAAE,kBAAkB;YAC5B,aAAa;YACb,YAAY;YACZ,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,oBAAoB;YAC5D,sEAAsE;YACtE,kEAAkE;YAClE,yEAAyE;YACzE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC,CAAC;IAEH,2EAA2E;IAC3E,iEAAiE;IACjE,4EAA4E;IAC5E,gBAAgB;IAChB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC;IACtD,MAAM,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC;IAEpD,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,QAAiB,EAAE,EAAE,CACxD,YAAY,CAAA,YAAY,IAAI,YAAY,IAAI,gBAAgB,kBAAkB,iBAAiB,IAAI,iBAAiB,QAAQ,IAAI,CAAC;IAEnI,yEAAyE;IACzE,iFAAiF;IACjF,4EAA4E;IAC5E,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,cAAc,GAAG,OAAO,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC;IAEzF,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,gBAAgB;IAChB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CACnD,GAAG,YAAY,iBAAiB,EAChC;QACE,IAAI,EAAE,GAAG,cAAc,YAAY;QACnC,oBAAoB,EAAE,CAAC;KACxB,EACD,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;IACF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,aAAa,CACjE,GAAG,YAAY,wBAAwB,EACvC;QACE,QAAQ,EAAE,eAAe,CAAC,EAAE;QAC5B,YAAY,EAAE,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC;KAC9D,CACF,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAClD,GAAG,YAAY,gBAAgB,EAC/B;QACE,IAAI,EAAE,GAAG,cAAc,WAAW;QAClC,oBAAoB,EAAE,CAAC;KACxB,EACD,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,aAAa,CAChE,GAAG,YAAY,uBAAuB,EACtC;QACE,QAAQ,EAAE,cAAc,CAAC,EAAE;QAC3B,YAAY,EAAE,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC;KAC5D,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE;QAC9C,UAAU,EAAE;YACV,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC1C;KACF,CAAC,CAAC;IAEH,wEAAwE;IACxE,KAAK,sBAAsB,CAAC;IAC5B,KAAK,qBAAqB,CAAC;IAE3B,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,SAAS;QACT,kBAAkB,EAAE,eAAe,CAAC,GAAG;QACvC,iBAAiB,EAAE,cAAc,CAAC,GAAG;KACtC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"provision-logical-database.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/provision-logical-database.ts"],"names":[],"mappings":";;AA8EA,kEAKC;AASD,4DAmHC;AA/MD,6EAGsC;AACtC,2CAA2C;AAkE3C,SAAS,6BAA6B,CAAC,KAAa;IAClD,OAAO,KAAK;SACT,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3D,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,SAAgB,2BAA2B,CACzC,KAAa,EACb,QAAgB;IAEhB,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,6BAA6B,CAAC,QAAQ,CAAC,UAAU,CAAC;AACrG,CAAC;AAED,6EAA6E;AAC7E,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,6DAA6D;AAC7D,SAAgB,wBAAwB,CACtC,UAAoC,EACpC,OAAwC;IAExC,MAAM,aAAa,GAAG,IAAA,wBAAY,EAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACjE,IACE,OAAO,CAAC,aAAa,KAAK,SAAS;QACnC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EACnC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,8DAAiC,EAAC;QACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,2BAA2B,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/D,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAA,yDAA4B,EAAC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,gBAAgB;YAClC,IAAI,EAAE,OAAO,CAAC,YAAY;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE;gBACjC,UAAU,EAAE;oBACV,QAAQ,EAAE,OAAO;oBACjB,GAAG,aAAa;iBACjB;aACF,CAAC;YACF,YAAY,EAAE,aAAa,CAAC,QAAQ;YACpC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,YAAY;SACb,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtC,MAAM,cAAc,GAAG,OAAO,aAAa,IAAI,OAAO,CAAC,KAAK,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG;QACX,cAAc,EAAE,OAAO,CAAC,QAAQ;QAChC,gBAAgB,EAAE,+BAA+B;QACjD,WAAW,EAAE,OAAO,CAAC,KAAK;QAC1B,WAAW,EAAE,aAAa;KAC3B,CAAC;IAEF,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CACnD,GAAG,YAAY,iBAAiB,EAChC;QACE,WAAW,EAAE,2CAA2C,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE;QAC3F,IAAI,EAAE,GAAG,cAAc,YAAY;QACnC,oBAAoB,EAAE,CAAC;QACvB,IAAI;KACL,CACF,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAClD,GAAG,YAAY,gBAAgB,EAC/B;QACE,WAAW,EAAE,0CAA0C,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE;QAC1F,IAAI,EAAE,GAAG,cAAc,WAAW;QAClC,oBAAoB,EAAE,CAAC;QACvB,IAAI;KACL,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE;QAC9C,UAAU,EAAE;YACV,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,IAAI;YACJ,WAAW,EAAE,GAAG,YAAY,YAAY;YACxC,IAAI;YACJ,QAAQ,EAAE,qBAAqB;YAC/B,SAAS,EAAE,eAAe,CAAC,GAAG;YAC9B,QAAQ,EAAE,WAAW,CAAC,aAAa;SACpC;QACD,OAAO,EAAE;YACP,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;gBACjB,OAAO,EAAE,CAAC,+BAA+B,CAAC;gBAC1C,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC;aACjC,CAAC;SACH;KACF,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,QAAQ;QAClC,EAAE,EAAE,QAAQ;QACZ,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,iBAAiB,EAAE,cAAc,CAAC,GAAG;QACrC,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,kBAAkB,EAAE,eAAe,CAAC,GAAG;QACvC,YAAY;QACZ,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,8DAA8D;QAC9D,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,kBAAkB;KAC3D,CAAC;AACJ,CAAC"}

package/src/foundation/router-origin-proof.d.ts

@@ -0,0 +1,2 @@
+export declare const ROUTER_ORIGIN_PROOF_HEADER: "x-ebk-router-origin-proof";
+export declare function createRouterOriginProofInjection(slice: string, proof: string): string;

package/src/foundation/router-origin-proof.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROUTER_ORIGIN_PROOF_HEADER = void 0;
+exports.createRouterOriginProofInjection = createRouterOriginProofInjection;
+exports.ROUTER_ORIGIN_PROOF_HEADER = 'x-ebk-router-origin-proof';
+const ROUTER_ORIGIN_PROOF = /^[A-Za-z0-9]{43}$/;
+const SLICE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+function createRouterOriginProofInjection(slice, proof) {
+    if (!SLICE.test(slice)) {
+        throw new Error('Performance Router origin proof requires one exact Slice.');
+    }
+    if (!ROUTER_ORIGIN_PROOF.test(proof)) {
+        throw new Error('Performance Router origin proof must be a 43-character alphanumeric secret.');
+    }
+    const executePath = `/${slice}/__ebk/performance/service`;
+    const cleanupPath = `${executePath}/cleanup`;
+    return [
+        `if (event.request.uri === ${JSON.stringify(executePath)} || event.request.uri === ${JSON.stringify(cleanupPath)}) {`,
+        `  event.request.headers[${JSON.stringify(exports.ROUTER_ORIGIN_PROOF_HEADER)}] = { value: ${JSON.stringify(proof)} };`,
+        '} else {',
+        `  delete event.request.headers[${JSON.stringify(exports.ROUTER_ORIGIN_PROOF_HEADER)}];`,
+        '}',
+    ].join('\n');
+}
+//# sourceMappingURL=router-origin-proof.js.map

package/src/foundation/router-origin-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router-origin-proof.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/router-origin-proof.ts"],"names":[],"mappings":";;;AAKA,4EAuBC;AA5BY,QAAA,0BAA0B,GAAG,2BAAoC,CAAC;AAE/E,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAChD,MAAM,KAAK,GAAG,iCAAiC,CAAC;AAEhD,SAAgB,gCAAgC,CAC9C,KAAa,EACb,KAAa;IAEb,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,KAAK,4BAA4B,CAAC;IAC1D,MAAM,WAAW,GAAG,GAAG,WAAW,UAAU,CAAC;IAC7C,OAAO;QACL,6BAA6B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK;QACrH,2BAA2B,IAAI,CAAC,SAAS,CAAC,kCAA0B,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK;QAC/G,UAAU;QACV,kCAAkC,IAAI,CAAC,SAAS,CAAC,kCAA0B,CAAC,IAAI;QAChF,GAAG;KACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/src/foundation/stages.d.ts

@@ -7,6 +7,7 @@ export interface FoundationStageResolution {
 }
 export declare function requireStage(value: string, label?: string): string;
 export declare function isFoundationStage(stage: string): stage is FoundationStage;
+export declare function isPersonalStage(stage: string): boolean;
 export declare function requireFoundationStage(stage: string): FoundationStage;
 export declare function resolveFoundationStages(options: {
     consumerStage: string;

package/src/foundation/stages.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FOUNDATION_STAGES = void 0;
 exports.requireStage = requireStage;
 exports.isFoundationStage = isFoundationStage;
+exports.isPersonalStage = isPersonalStage;
 exports.requireFoundationStage = requireFoundationStage;
 exports.resolveFoundationStages = resolveFoundationStages;
 exports.FOUNDATION_STAGES = [
@@ -11,6 +12,7 @@ exports.FOUNDATION_STAGES = [
     'production',
 ];
 const FOUNDATION_STAGE_SET = new Set(exports.FOUNDATION_STAGES);
+const PERSONAL_STAGE_PATTERN = /^personal-[a-z0-9](?:[a-z0-9-]{0,25}[a-z0-9])?$/;
 function requireStage(value, label = 'Stage') {
     const normalized = value.trim();
     if (!/^[a-z0-9][a-z0-9-]*$/.test(normalized)) {
@@ -21,6 +23,9 @@ function requireStage(value, label = 'Stage') {
 function isFoundationStage(stage) {
     return FOUNDATION_STAGE_SET.has(stage);
 }
+function isPersonalStage(stage) {
+    return PERSONAL_STAGE_PATTERN.test(stage);
+}
 function requireFoundationStage(stage) {
     const normalized = requireStage(stage, 'Foundation stage');
     if (!isFoundationStage(normalized)) {
@@ -30,6 +35,9 @@ function requireFoundationStage(stage) {
 }
 function resolveFoundationStages(options) {
     const consumerStage = requireStage(options.consumerStage, 'Consumer stage');
+    if (!isFoundationStage(consumerStage) && !isPersonalStage(consumerStage)) {
+        throw new Error(`Consumer stage ${consumerStage} is neither canonical nor a framework-derived personal stage.`);
+    }
     const expectedFoundationStage = isFoundationStage(consumerStage)
         ? consumerStage
         : 'development';
@@ -40,7 +48,7 @@ function resolveFoundationStages(options) {
         if (isFoundationStage(consumerStage)) {
             throw new Error(`Consumer stage ${consumerStage} must use Foundation stage ${consumerStage}.`);
         }
-        throw new Error(`Personal or preview consumer stage ${consumerStage} may use only the development Foundation.`);
+        throw new Error(`Personal consumer stage ${consumerStage} may use only the development Foundation.`);
     }
     return {
         consumerStage,

package/src/foundation/stages.js.map

@@ -1 +1 @@
-{"version":3,"file":"stages.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/stages.ts"],"names":[],"mappings":";;;AAgBA,oCAQC;AAED,8CAEC;AAED,wDAQC;AAED,0DA4BC;AApEY,QAAA,iBAAiB,GAAG;IAC/B,aAAa;IACb,SAAS;IACT,YAAY;CACJ,CAAC;AAUX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS,yBAAiB,CAAC,CAAC;AAEhE,SAAgB,YAAY,CAAC,KAAa,EAAE,KAAK,GAAG,OAAO;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,oDAAoD,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAa;IAClD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC3D,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,6DAA6D,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAGvC;IACC,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC5E,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,aAAa,CAAC;QAC9D,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE;QACrD,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC;QACjD,CAAC,CAAC,uBAAuB,CAAC;IAE5B,IAAI,eAAe,KAAK,uBAAuB,EAAE,CAAC;QAChD,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,8BAA8B,aAAa,GAAG,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sCAAsC,aAAa,2CAA2C,CAC/F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa;QACb,eAAe;QACf,MAAM,EAAE,aAAa,KAAK,eAAe;KAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"stages.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/stages.ts"],"names":[],"mappings":";;;AAkBA,oCAQC;AAED,8CAEC;AAED,0CAEC;AAED,wDAQC;AAED,0DAiCC;AA/EY,QAAA,iBAAiB,GAAG;IAC/B,aAAa;IACb,SAAS;IACT,YAAY;CACJ,CAAC;AAUX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS,yBAAiB,CAAC,CAAC;AAChE,MAAM,sBAAsB,GAC1B,iDAAiD,CAAC;AAEpD,SAAgB,YAAY,CAAC,KAAa,EAAE,KAAK,GAAG,OAAO;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,oDAAoD,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,eAAe,CAAC,KAAa;IAC3C,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAa;IAClD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC3D,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,6DAA6D,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAGvC;IACC,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC5E,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,+DAA+D,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,aAAa,CAAC;QAC9D,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE;QACrD,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC;QACjD,CAAC,CAAC,uBAAuB,CAAC;IAE5B,IAAI,eAAe,KAAK,uBAAuB,EAAE,CAAC;QAChD,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,kBAAkB,aAAa,8BAA8B,aAAa,GAAG,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2BAA2B,aAAa,2CAA2C,CACpF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa;QACb,eAAe;QACf,MAAM,EAAE,aAAa,KAAK,eAAe;KAC1C,CAAC;AACJ,CAAC"}

package/src/frontend-security/index.d.ts

@@ -0,0 +1 @@
+export * from './security-headers.js';

package/src/frontend-security/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./security-headers.js"), exports);
+//# sourceMappingURL=index.js.map

package/src/frontend-security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/nx/src/frontend-security/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC"}

package/src/frontend-security/security-headers.d.ts

@@ -0,0 +1,50 @@
+export declare const FRONTEND_SECURITY_HEADER_POLICY_KIND: "ebk-frontend-security-header-policy";
+export declare const FRONTEND_SECURITY_HEADER_POLICY_SCHEMA_VERSION: 1;
+export declare const FRONTEND_CSP_NONCE_PLACEHOLDER: "{{EBK_NONCE}}";
+export type FrontendSecurityHeaderProfile = 'deployed-https' | 'local-development';
+export interface FrontendSecurityHeader {
+    name: string;
+    value: string;
+}
+export interface FrontendSecurityHeaderPolicy {
+    kind: typeof FRONTEND_SECURITY_HEADER_POLICY_KIND;
+    owner: 'foundation' | 'slice';
+    profiles: Readonly<Record<FrontendSecurityHeaderProfile, {
+        headers: readonly FrontendSecurityHeader[];
+        transport: 'https' | 'loopback-http';
+    }>>;
+    schemaVersion: typeof FRONTEND_SECURITY_HEADER_POLICY_SCHEMA_VERSION;
+    slice?: string;
+}
+export interface ComposedFrontendSecurityHeader extends FrontendSecurityHeader {
+    owner: 'foundation' | 'slice';
+}
+export interface FrontendSecurityHeaderInspection {
+    findings: string[];
+    kind: 'ebk-frontend-security-header-result';
+    mode: 'absent' | 'enforced' | 'enforced-with-report-only-measurement' | 'report-only';
+    outcome: 'failed' | 'passed';
+    profile: FrontendSecurityHeaderProfile;
+    schemaVersion: 1;
+    slice: string;
+}
+export declare function validateFrontendSecurityHeaderPolicy(value: unknown, expectedOwner: 'foundation' | 'slice', expectedSlice?: string): FrontendSecurityHeaderPolicy;
+export declare function composeFrontendSecurityHeaders(input: {
+    foundation: unknown;
+    nonce?: string;
+    profile: FrontendSecurityHeaderProfile;
+    slice: unknown;
+    sliceName: string;
+}): ComposedFrontendSecurityHeader[];
+export declare function foundationFrontendSecurityHeaderPolicy(): FrontendSecurityHeaderPolicy;
+export declare function sliceFrontendSecurityHeaderPolicy(slice: string): FrontendSecurityHeaderPolicy;
+export declare function resolveFrontendSecurityHeaderProfile(environment?: Readonly<Record<string, string | undefined>>): FrontendSecurityHeaderProfile;
+export declare function inspectFrontendSecurityHeaders(input: {
+    actual: Headers | Readonly<Record<string, string>>;
+    allowLoopbackTransportProof?: boolean;
+    foundation: unknown;
+    https: boolean;
+    profile: FrontendSecurityHeaderProfile;
+    slice: unknown;
+    sliceName: string;
+}): FrontendSecurityHeaderInspection;