@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-database-lifecycle-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-database-lifecycle-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-database-lifecycle-files.ts"],"names":[],"mappings":";;AA8QA,oEAkmDC;AAh3DD,uEAAiD;AACjD,yEAGyC;AAEzC,SAAS,oCAAoC;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmQR,CAAC;AACF,CAAC;AAED,gBAAgB;AAChB,SAAgB,4BAA4B,CAC1C,IAAY;IAEZ,OAAO;QACL,eAAe,EAAE;;;;;;;;CAQpB;QACG,wBAAwB,EAAE,IAAA,8BAAI,EAAC;YAC7B,OAAO,EAAE;gBACP,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,CAAC,SAAS,CAAC;aACzB;SACF,CAAC;QACF,sBAAsB,EAAE,QAAQ,mDAA6B;;;;;;;0CAOvB,wDAAkC;;;gBAG5D,IAAI,oCAAoC,IAAI;mCACzB,IAAI;8IACuG,IAAI;;OAE3I,mDAA6B;;;;kCAIF,IAAI;kCACJ,IAAI;kCACJ,IAAI;kCACJ,IAAI;kCACJ,IAAI;;;CAGrC;QACG,wBAAwB,EAAE,IAAA,8BAAI,EAAC;YAC7B,IAAI,EAAE,kBAAkB,IAAI,EAAE;YAC9B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE;gBACZ,iCAAiC,EAAE,UAAU;gBAC7C,qBAAqB,EAAE,UAAU;gBACjC,qBAAqB,EAAE,UAAU;gBACjC,EAAE,EAAE,QAAQ;aACb;SACF,CAAC;QACF,qCAAqC,EACnC,oCAAoC,EAAE;QACxC,6BAA6B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoRrB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8NjB;QACG,0BAA0B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2DA+a2B,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2H/C,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqNnB;QACG,2BAA2B,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyInB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyKjB;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-database-retirement-rehearsal-files.d.ts

@@ -0,0 +1,2 @@
+/** @internal */
+export declare function renderDatabaseRetirementRehearsalFiles(name: string): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-database-retirement-rehearsal-files.js

@@ -0,0 +1,485 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderDatabaseRetirementRehearsalFiles = renderDatabaseRetirementRehearsalFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+function renderDatabaseRetirementRehearsalCore(name) {
+    return `import {
+  DescribeExecutionCommand,
+  StartExecutionCommand,
+} from '@aws-sdk/client-sfn';
+import {
+  DatabaseRetirementContractError,
+  createProtectedDatabaseRetirementPlan,
+  proveDatabaseRetirementAbsence,
+} from '@empire-builder-kit/nx/database-retirement';
+import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';
+
+const SLICE = '${name}';
+const STAGE = 'development';
+const TERMINAL_STATUSES = new Set([
+  'ABORTED',
+  'FAILED',
+  'PENDING_REDRIVE',
+  'SUCCEEDED',
+  'TIMED_OUT',
+]);
+const FINGERPRINT_PATTERN = /^[a-f0-9]{64}$/;
+const OBSERVATION_KEYS = new Set([
+  'databaseExists',
+  'migratorRoleExists',
+  'readonlyRoleExists',
+  'readonlySecretExists',
+  'readwriteRoleExists',
+  'readwriteSecretExists',
+  'siblingFingerprints',
+]);
+const EVIDENCE_KEYS = new Set([
+  'after',
+  'beforeSiblingFingerprints',
+  'candidateIdentity',
+  'database',
+  'databaseLifecycleCorrelationId',
+  'evidenceVersion',
+  'registrationDigest',
+  'sourceCommit',
+  'stage',
+  'slice',
+]);
+
+const invalidEvidence = (message) =>
+  new DatabaseRetirementContractError(
+    'retirement-target-substitution',
+    message,
+  );
+
+const requireExactObject = (value, allowedKeys, label) => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw invalidEvidence(label + ' must be an object.');
+  }
+  const record = value;
+  const unsupported = Object.keys(record).filter(
+    (key) => !allowedKeys.has(key),
+  );
+  if (unsupported.length > 0) {
+    throw invalidEvidence(
+      label + ' contains unsupported members: ' + unsupported.join(', ') + '.',
+    );
+  }
+  return record;
+};
+
+const requireRegistrationDocument = (value) => {
+  const document = requireExactObject(
+    value,
+    new Set(['registrations', 'schemaVersion']),
+    'Database retirement rehearsal registration',
+  );
+  if (
+    document.schemaVersion !== 1 ||
+    !Array.isArray(document.registrations)
+  ) {
+    throw new DatabaseRetirementContractError(
+      'retirement-registration-invalid',
+      'Database retirement rehearsal registration must use schemaVersion 1 and a registrations array.',
+    );
+  }
+  return document.registrations;
+};
+
+const requireFingerprintMap = (value, siblings, label) => {
+  const record = requireExactObject(value, new Set(siblings), label);
+  const keys = Object.keys(record).sort();
+  const expected = [...siblings].sort();
+  if (
+    keys.length !== expected.length ||
+    keys.some((key, index) => key !== expected[index])
+  ) {
+    throw invalidEvidence(
+      label + ' must cover the exact retained sibling set.',
+    );
+  }
+  for (const sibling of expected) {
+    if (
+      typeof record[sibling] !== 'string' ||
+      !FINGERPRINT_PATTERN.test(record[sibling])
+    ) {
+      throw invalidEvidence(
+        label + ' must contain a SHA-256 fingerprint for ' + sibling + '.',
+      );
+    }
+  }
+  return record;
+};
+
+const requireExecutionEvidence = (value, plan, correlationId) => {
+  const evidence = requireExactObject(
+    value,
+    EVIDENCE_KEYS,
+    'Database retirement execution evidence',
+  );
+  if (
+    evidence.evidenceVersion !== 1 ||
+    evidence.candidateIdentity !== plan.executionInput.candidateIdentity ||
+    evidence.database !== plan.database ||
+    evidence.databaseLifecycleCorrelationId !== correlationId ||
+    evidence.registrationDigest !== plan.registrationDigest ||
+    evidence.sourceCommit !== plan.executionInput.sourceCommit ||
+    evidence.stage !== plan.stage ||
+    evidence.slice !== plan.slice
+  ) {
+    throw invalidEvidence(
+      'Database retirement execution evidence differs from the reviewed registration.',
+    );
+  }
+
+  const beforeSiblingFingerprints = requireFingerprintMap(
+    evidence.beforeSiblingFingerprints,
+    plan.retainedSiblings,
+    'Pre-retirement sibling fingerprints',
+  );
+  const after = requireExactObject(
+    evidence.after,
+    OBSERVATION_KEYS,
+    'Post-retirement absence observation',
+  );
+  for (const key of [
+    'databaseExists',
+    'migratorRoleExists',
+    'readonlyRoleExists',
+    'readonlySecretExists',
+    'readwriteRoleExists',
+    'readwriteSecretExists',
+  ]) {
+    if (typeof after[key] !== 'boolean') {
+      throw invalidEvidence(
+        'Post-retirement absence observation ' + key + ' must be boolean.',
+      );
+    }
+  }
+  return {
+    after: {
+      databaseExists: after.databaseExists,
+      migratorRoleExists: after.migratorRoleExists,
+      readonlyRoleExists: after.readonlyRoleExists,
+      readonlySecretExists: after.readonlySecretExists,
+      readwriteRoleExists: after.readwriteRoleExists,
+      readwriteSecretExists: after.readwriteSecretExists,
+      siblingFingerprints: requireFingerprintMap(
+        after.siblingFingerprints,
+        plan.retainedSiblings,
+        'Post-retirement sibling fingerprints',
+      ),
+    },
+    beforeSiblingFingerprints,
+  };
+};
+
+const executionArnFor = (stateMachineArn, executionName) =>
+  stateMachineArn.replace(':stateMachine:', ':execution:') +
+  ':' +
+  executionName;
+
+const executionDoesNotExist = (error) =>
+  error &&
+  typeof error === 'object' &&
+  error.name === 'ExecutionDoesNotExist';
+
+const executionAlreadyExists = (error) =>
+  error &&
+  typeof error === 'object' &&
+  error.name === 'ExecutionAlreadyExists';
+
+export async function runProtectedDatabaseRetirementRehearsal({
+  arguments: workflowArguments = [],
+  bindings,
+  now = () => Date.now(),
+  pollIntervalMs = 5_000,
+  registrationDocument,
+  sfn,
+  sleep = (duration) =>
+    new Promise((resolve) => setTimeout(resolve, duration)),
+  timeoutMs = 50 * 60 * 1_000,
+}) {
+  if (!Array.isArray(workflowArguments)) {
+    throw new DatabaseRetirementContractError(
+      'retirement-workflow-selection-forbidden',
+      'Protected database retirement accepts no command arguments.',
+    );
+  }
+  if (workflowArguments.length > 0) {
+    throw new DatabaseRetirementContractError(
+      'retirement-workflow-selection-forbidden',
+      'Protected database retirement accepts no target or workflow arguments.',
+    );
+  }
+  if (!sfn || typeof sfn.send !== 'function') {
+    throw new TypeError('An SFN client is required.');
+  }
+  if (
+    !Number.isSafeInteger(pollIntervalMs) ||
+    pollIntervalMs < 0 ||
+    !Number.isSafeInteger(timeoutMs) ||
+    timeoutMs < 1
+  ) {
+    throw new TypeError(
+      'Database retirement polling and timeout values must be bounded integers.',
+    );
+  }
+
+  const bindingPlan = createDatabaseBindingPlan(bindings, {
+    slice: SLICE,
+    stage: STAGE,
+  });
+  const plan = createProtectedDatabaseRetirementPlan({
+    bindings: {
+      active: bindingPlan.active.primary,
+      provisioned: bindingPlan.provisioned,
+    },
+    registrations: requireRegistrationDocument(registrationDocument),
+    workflowArguments,
+  });
+  if (plan.slice !== SLICE || plan.stage !== STAGE) {
+    throw invalidEvidence(
+      'Database retirement registration differs from the generated Slice or development stage.',
+    );
+  }
+
+  const databaseLifecycleCorrelationId =
+    'dbr-' + plan.registrationDigest.slice(0, 32);
+  const executionArn = executionArnFor(
+    plan.stateMachineArn,
+    plan.executionName,
+  );
+  let execution;
+  try {
+    execution = await sfn.send(
+      new DescribeExecutionCommand({ executionArn }),
+    );
+  } catch (error) {
+    if (!executionDoesNotExist(error)) throw error;
+  }
+  if (!execution) {
+    try {
+      await sfn.send(
+        new StartExecutionCommand({
+          input: JSON.stringify({
+            ...plan.executionInput,
+            databaseLifecycleCorrelationId,
+          }),
+          name: plan.executionName,
+          stateMachineArn: plan.stateMachineArn,
+        }),
+      );
+    } catch (error) {
+      if (!executionAlreadyExists(error)) throw error;
+    }
+  }
+
+  const deadline = now() + timeoutMs;
+  let status = execution?.status ?? 'RUNNING';
+  while (!TERMINAL_STATUSES.has(status)) {
+    if (now() >= deadline) {
+      throw new Error(
+        'Timed out waiting for protected database retirement execution ' +
+          executionArn +
+          '.',
+      );
+    }
+    if (pollIntervalMs > 0) await sleep(pollIntervalMs);
+    execution = await sfn.send(
+      new DescribeExecutionCommand({ executionArn }),
+    );
+    status = execution.status ?? 'UNKNOWN';
+  }
+  if (status !== 'SUCCEEDED') {
+    throw new Error(
+      'Protected database retirement execution ' +
+        executionArn +
+        ' ended with status ' +
+        status +
+        '.',
+    );
+  }
+  if (!execution || typeof execution.output !== 'string') {
+    throw invalidEvidence(
+      'Successful database retirement execution is missing exact absence evidence.',
+    );
+  }
+
+  let evidence;
+  try {
+    evidence = JSON.parse(execution.output);
+  } catch {
+    throw invalidEvidence(
+      'Successful database retirement execution returned invalid absence evidence.',
+    );
+  }
+  const observation = requireExecutionEvidence(
+    evidence,
+    plan,
+    databaseLifecycleCorrelationId,
+  );
+  const proof = proveDatabaseRetirementAbsence({
+    ...observation,
+    plan,
+  });
+
+  return {
+    candidateIdentity: plan.executionInput.candidateIdentity,
+    database: plan.database,
+    databaseLifecycleCorrelationId,
+    evidenceVersion: 1,
+    executionArn,
+    executionName: plan.executionName,
+    proof,
+    registrationDigest: plan.registrationDigest,
+    sourceCommit: plan.executionInput.sourceCommit,
+    stage: plan.stage,
+    slice: plan.slice,
+    stateMachineArn: plan.stateMachineArn,
+    status: 'SUCCEEDED',
+  };
+}
+`;
+}
+function renderDatabaseRetirementRehearsalEntry() {
+    return `import { SFNClient } from '@aws-sdk/client-sfn';
+import databaseBindings from '../database/bindings.json' with { type: 'json' };
+import registrationDocument from '../operations/database-retirement-rehearsal.json' with { type: 'json' };
+import { runProtectedDatabaseRetirementRehearsal } from './database-retirement-rehearsal.mjs';
+
+const result = await runProtectedDatabaseRetirementRehearsal({
+  arguments: process.argv.slice(2),
+  bindings: databaseBindings,
+  registrationDocument,
+  sfn: new SFNClient({}),
+});
+process.stdout.write(JSON.stringify(result) + '\\n');
+`;
+}
+function renderDatabaseRetirementRehearsalRunbook(name) {
+    return `# ${name} database retirement rehearsal
+
+This is a protected live-evidence control for exactly one reviewed, disposable
+logical database in the \`development\` stage. It is independent of ordinary
+Slice removal. The \`remove\` target must not depend on this rehearsal, and
+canonical retained databases remain non-destructive. Stable v1 has no generic
+or personal database-retirement target.
+
+## Prepare the reviewed registration
+
+1. Add \`retirement_rehearsal\` to one \`provisioned\` array in
+   \`database/bindings.json\` without making it an active database.
+2. From the exact reviewed staging candidate, retain its complete container
+   binding, a distinct release-bound copy of that binding, and every referenced
+   native-run and platform-SBOM file. In the independently protected
+   development account, run both native platform targets and then assemble the
+   index. Each platform target copies the exact staging child manifest into the
+   development repository before re-running the native retirement refusal and
+   closure proof; it never rebuilds the image. Assembly copies the exact staging
+   OCI index rather than synthesizing a new one:
+
+   \`EBK_STAGE=development pnpm nx run ${name}:container-release-amd64\`
+
+   \`EBK_STAGE=development pnpm nx run ${name}:container-release-arm64\`
+
+   \`EBK_STAGE=development pnpm nx run ${name}:container-release-assemble\`
+
+   Set \`EBK_SOURCE_COMMIT\`, \`EBK_RELEASE_SOURCE_COMMIT\`,
+   \`AWS_EXPECTED_ACCOUNT_ID\`, \`AWS_REGION\`, the protected \`GITHUB_*\` run
+   identity, \`EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID\`,
+   \`EBK_STAGING_PROMOTION_REGION\`, and
+   \`EBK_CONTAINER_PROMOTION_SOURCE_BINDING_PATH\` plus the distinct
+   \`EBK_CONTAINER_PROMOTION_SOURCE_SIDECAR_PATH\`. The two promoted development
+   child manifest digests and promoted index digest must equal staging exactly.
+   The result is one binding at
+   \`.ebk/evidence/container-release/development/packages/${name}/binding.json\`
+   containing only \`${name}.job.database-retirement\`.
+3. Deploy the fixed retirement-and-verification workflow for that identifier.
+   Synthesis fails before SST can mutate AWS if the exact development binding,
+   candidate, Dockerfile, AWS target, or source commit is missing or stale.
+4. Replace the empty provenance and state-machine fields in
+   \`operations/database-retirement-rehearsal.json\` with the exact reviewed
+   candidate identity, 40-character source commit, and state-machine ARN.
+5. Review the registration and binding change together. The registration must
+   contain exactly one entry and its Slice and both stages must remain fixed.
+
+The empty generated fields intentionally fail before the first AWS request.
+The command accepts no arguments, so an operator cannot supply a stage, Slice,
+database, state machine, task, role, network, image, or command override.
+
+Run the generated \`db-retirement-rehearsal\` target only through the protected
+workflow. The deployment role needs
+\`states:StartExecution\` on the exact registered state machine and
+\`states:DescribeExecution\` on its exact execution namespace. It receives no
+database credential, secret-value, SQL, \`rds-db:connect\`, or arbitrary ECS
+authority.
+
+Ordinary development and personal stages remain SST context-built. Exact image
+evidence is required only when the literal \`development\` stage provisions the
+fixed \`retirement_rehearsal\` database.
+
+## Exact workflow evidence
+
+The fixed AWS-internal workflow must return one JSON object with
+\`evidenceVersion: 1\`; the registered candidate, database, source commit,
+stage, Slice, registration digest, and
+\`databaseLifecycleCorrelationId\`; pre-retirement sibling fingerprints; and a
+post-retirement observation. The observation reports whether the exact
+database, migrator role, read-only role, read/write role, read-only secret, and
+read/write secret still exist, plus the post-retirement sibling fingerprints.
+
+The state machine injects its task token and reviewed execution provenance into
+the fixed container environment. The task accepts no command or target
+override, emits at most 64 KiB of evidence through \`SendTaskSuccess\`, and
+emits only a bounded error name, phase, and safe code through
+\`SendTaskFailure\`. The state-machine task has a fixed 45-minute timeout and
+bounded retry policy; neither the task token nor secret values appear in logs
+or callback evidence.
+
+Sibling fingerprints are lowercase SHA-256 digests of stable, non-secret
+identity and version metadata. They never contain secret values. The task that
+uses the Foundation master-secret reference and the exact runtime-secret
+references remains inside the fixed AWS workflow. The invocation process sees
+only the registered state-machine ARN and the non-secret evidence result.
+
+The runner rejects malformed or substituted evidence, any residual target
+resource, or a missing or changed sibling. Preserve its successful JSON result,
+the Step Functions execution history, canonical database-lifecycle logs, source
+commit, candidate identity, and reviewed registration as the retirement
+evidence bundle.
+
+## Recovery
+
+If the bounded workflow retry fails terminally, inspect the execution and
+canonical logs, repair the generated AWS-internal control, and create a newly
+reviewed candidate registration so its digest produces a new execution
+identity. Never select a sibling as a substitute and never make ordinary Slice
+removal destructive to bypass this proof.
+`;
+}
+/** @internal */
+function renderDatabaseRetirementRehearsalFiles(name) {
+    return {
+        'docs/database-retirement-rehearsal.md': renderDatabaseRetirementRehearsalRunbook(name),
+        'operations/database-retirement-rehearsal.json': (0, built_in_plan_shared_js_1.json)({
+            registrations: [
+                {
+                    candidateIdentity: '',
+                    database: 'retirement_rehearsal',
+                    disposition: 'disposable',
+                    foundationStage: 'development',
+                    registrationVersion: 1,
+                    slice: name,
+                    sourceCommit: '',
+                    stage: 'development',
+                    stateMachineArn: '',
+                },
+            ],
+            schemaVersion: 1,
+        }),
+        'scripts/database-retirement-rehearsal.mjs': renderDatabaseRetirementRehearsalCore(name),
+        'scripts/rehearse-database-retirement.mjs': renderDatabaseRetirementRehearsalEntry(),
+    };
+}
+//# sourceMappingURL=built-in-plan-database-retirement-rehearsal-files.js.map

package/src/generators/slice/built-in-plan-database-retirement-rehearsal-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-database-retirement-rehearsal-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-database-retirement-rehearsal-files.ts"],"names":[],"mappings":";;AA8cA,wFA2BC;AAzeD,uEAAiD;AAEjD,SAAS,qCAAqC,CAAC,IAAY;IACzD,OAAO;;;;;;;;;;;iBAWQ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsUpB,CAAC;AACF,CAAC;AAED,SAAS,sCAAsC;IAC7C,OAAO;;;;;;;;;;;;CAYR,CAAC;AACF,CAAC;AAED,SAAS,wCAAwC,CAAC,IAAY;IAC5D,OAAO,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;yCAqBuB,IAAI;;yCAEJ,IAAI;;yCAEJ,IAAI;;;;;;;;;;4DAUe,IAAI;uBACzC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8D1B,CAAC;AACF,CAAC;AAED,gBAAgB;AAChB,SAAgB,sCAAsC,CACpD,IAAY;IAEZ,OAAO;QACL,uCAAuC,EACrC,wCAAwC,CAAC,IAAI,CAAC;QAChD,+CAA+C,EAAE,IAAA,8BAAI,EAAC;YACpD,aAAa,EAAE;gBACb;oBACE,iBAAiB,EAAE,EAAE;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,WAAW,EAAE,YAAY;oBACzB,eAAe,EAAE,aAAa;oBAC9B,mBAAmB,EAAE,CAAC;oBACtB,KAAK,EAAE,IAAI;oBACX,YAAY,EAAE,EAAE;oBAChB,KAAK,EAAE,aAAa;oBACpB,eAAe,EAAE,EAAE;iBACpB;aACF;YACD,aAAa,EAAE,CAAC;SACjB,CAAC;QACF,2CAA2C,EACzC,qCAAqC,CAAC,IAAI,CAAC;QAC7C,0CAA0C,EACxC,sCAAsC,EAAE;KAC3C,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-foundation-files.d.ts

@@ -0,0 +1,2 @@
+/** @internal */
+export declare function renderSliceFoundationFiles(name: string, pascalName: string): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-foundation-files.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderSliceFoundationFiles = renderSliceFoundationFiles;
+/** @internal */
+function renderSliceFoundationFiles(name, pascalName) {
+    return {
+        'infra/foundation.ts': `import {
+  foundationSsmPath,
+  productSliceMigrationPath,
+  productSliceRegistrationPath,
+  productSliceRetentionPath,
+  resolveFoundationStages,
+  type FoundationDiscovery,
+} from '@empire-builder-kit/nx/foundation';
+
+const stages = resolveFoundationStages({
+  consumerStage: $app.stage,
+  foundationStage: process.env.EBK_FOUNDATION_STAGE,
+});
+
+function foundationParameter(name: Parameters<typeof foundationSsmPath>[1]) {
+  return aws.ssm.getParameterOutput({
+    name: foundationSsmPath(stages.foundationStage, name),
+  }).value;
+}
+
+export function getFoundation(): FoundationDiscovery {
+  return {
+    accountCostPolicyDigest: foundationParameter('accountCostPolicyDigest'),
+    accountMonthlyMaximumUsd: foundationParameter(
+      'accountMonthlyMaximumUsd',
+    ).apply(Number),
+    alertTopicArn: foundationParameter('alertTopicArn'),
+    capabilities: foundationParameter('capabilities').apply((value: string) =>
+      value.split(',').map((capability) => capability.trim()),
+    ),
+    clusterId: foundationParameter('clusterId'),
+    contractVersion: foundationParameter('contractVersion'),
+    databaseClusterArn: foundationParameter('databaseClusterArn'),
+    databaseClusterEndpoint: foundationParameter('databaseClusterEndpoint'),
+    databaseClusterId: foundationParameter('databaseClusterId'),
+    databaseClusterResourceId: foundationParameter(
+      'databaseClusterResourceId',
+    ),
+    databaseHost: foundationParameter('databaseHost'),
+    databaseMasterSecretArn: foundationParameter('databaseMasterSecretArn'),
+    databasePort: foundationParameter('databasePort').apply(Number),
+    eventBusArn: foundationParameter('eventBusArn'),
+    eventBusName: foundationParameter('eventBusName'),
+    hasPublicDomain: foundationParameter('hasPublicDomain').apply(
+      (value: string) => value === 'true',
+    ),
+    identityUserPoolArn: foundationParameter('identityUserPoolArn'),
+    identityUserPoolId: foundationParameter('identityUserPoolId'),
+    identityTokenEndpoint: foundationParameter('identityTokenEndpoint'),
+    rootDomain: foundationParameter('rootDomain').apply((value: string) =>
+      value === 'none' ? undefined : value,
+    ),
+    routerDistributionId: foundationParameter('routerDistributionId'),
+    routerUrl: foundationParameter('routerUrl'),
+    schemaVersion: foundationParameter('schemaVersion').apply(Number),
+    vpcId: foundationParameter('vpcId'),
+  } as FoundationDiscovery;
+}
+
+export function getFoundationInfrastructure() {
+  const discovery = getFoundation();
+  const vpc = sst.aws.Vpc.get('FoundationVpc', discovery.vpcId);
+  const cluster = sst.aws.Cluster.get('FoundationCluster', {
+    id: discovery.clusterId,
+    vpc,
+  });
+  const router = sst.aws.Router.get(
+    'FoundationRouter',
+    discovery.routerDistributionId,
+  );
+  const userPool = sst.aws.CognitoUserPool.get(
+    'FoundationIdentity',
+    discovery.identityUserPoolId,
+  );
+  const eventBus = sst.aws.Bus.get(
+    'FoundationEventBus',
+    discovery.eventBusName,
+  );
+  return {
+    cluster,
+    database: {
+      clusterArn: discovery.databaseClusterArn,
+      clusterEndpoint: discovery.databaseClusterEndpoint,
+      clusterResourceId: discovery.databaseClusterResourceId,
+      host: discovery.databaseHost,
+      masterSecretArn: discovery.databaseMasterSecretArn,
+      port: discovery.databasePort,
+    },
+    discovery,
+    eventBus,
+    router,
+    userPool,
+    vpc,
+  };
+}
+
+export function registerProductSlice() {
+  return new aws.ssm.Parameter('${pascalName}ProductSliceRegistration', {
+    name: productSliceRegistrationPath(
+      stages.foundationStage,
+      stages.consumerStage,
+      '${name}',
+    ),
+    type: 'String',
+    value: JSON.stringify({
+      consumerStage: stages.consumerStage,
+      foundationContract: '^1.0.0',
+      foundationStage: stages.foundationStage,
+      name: '${name}',
+      registrationVersion: 1,
+    }),
+  });
+}
+
+export function registerProductMigration(
+  resourceName: string,
+  database: string,
+  stateMachineArn: any,
+) {
+  return new aws.ssm.Parameter(resourceName, {
+    name: productSliceMigrationPath(
+      stages.foundationStage,
+      stages.consumerStage,
+      '${name}',
+      database,
+    ),
+    type: 'String',
+    value: stateMachineArn,
+  });
+}
+
+export function registerProductRetention(stateMachineArn: any) {
+  return new aws.ssm.Parameter('${pascalName}DataRetentionRegistration', {
+    name: productSliceRetentionPath(
+      stages.foundationStage,
+      stages.consumerStage,
+      '${name}',
+    ),
+    type: 'String',
+    value: stateMachineArn,
+  });
+}
+
+`,
+        'infra/index.ts': `import { getFoundation, registerProductSlice } from './foundation.js';
+import { product } from './product.js';
+import type { StandardSliceWorkloadRolePreflight } from './workload-roles/preflight.js';
+
+export function app(workloadRoles?: StandardSliceWorkloadRolePreflight) {
+  const foundation = getFoundation();
+  const registration = registerProductSlice();
+  const resources = product(workloadRoles);
+  return {
+    apiUrl: resources.api.url,
+    authClientId: resources.authClient.id,
+    configurationApplicationId:
+      resources.configurationApplication?.id ?? 'local-only',
+    configurationEnvironmentId:
+      resources.configurationEnvironment?.environmentId ?? 'local-only',
+    configurationProfileId:
+      resources.configurationProfile?.configurationProfileId ?? 'local-only',
+    foundationContractVersion: foundation.contractVersion,
+    machineAuthClientId: resources.machineAuthorization.clientId,
+    machineAuthScopes: resources.machineAuthorization.scopes,
+    machineTokenEndpoint: resources.machineAuthorization.tokenEndpoint,
+    name: '${name}',
+    performanceEndpoint: resources.performanceEndpoint ?? 'disabled',
+    registration: registration.name,
+    stage: $app.stage,
+    workloadRoleManifestDigest:
+      workloadRoles?.registry.manifestDigest ?? 'local-dev-ephemeral',
+    webUrl: resources.web.url,
+  };
+}
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-foundation-files.js.map

package/src/generators/slice/built-in-plan-foundation-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-foundation-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-foundation-files.ts"],"names":[],"mappings":";;AACA,gEAqLC;AAtLD,gBAAgB;AAChB,SAAgB,0BAA0B,CACxC,IAAY,EACZ,UAAkB;IAElB,OAAO;QACL,qBAAqB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAiGO,UAAU;;;;SAInC,IAAI;;;;;;;eAOE,IAAI;;;;;;;;;;;;;;;SAeV,IAAI;;;;;;;;;kCASqB,UAAU;;;;SAInC,IAAI;;;;;;;CAOZ;QACG,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;aAqBT,IAAI;;;;;;;;;CAShB;KACE,CAAC;AACJ,CAAC"}