@empire-builder-kit/nx 1.0.0-rc.13 → 1.0.0-rc.17

package/src/generators/function/function.js

@@ -41,7 +41,7 @@ function createFunctionFilePlan(workspace, slice, name, feature = name) {
         files: {
             [`api/${name}.ts`]: `import { createHttpJsonHandler } from '@empire-builder-kit/runtime';\n\nexport const handler = createHttpJsonHandler({\n  component: 'function-${name}',\n  feature: '${feature}',\n  operation: '${name}',\n  slice: '${slice}',\n  workspace: '${workspace}',\n  async handle({ context }) {\n    return { actor: context.actor?.id ?? null, function: '${name}', ok: true };\n  },\n});\n`,
             [`api/${name}.spec.ts`]: `import { describe, expect, it } from 'vitest';\nimport { handler } from './${name}.js';\n\ndescribe('${name} function', () => {\n  it('returns its generated identity', async () => {\n    const response = await handler({ requestContext: { requestId: 'test-request' } });\n    expect(response.statusCode).toBe(200);\n    expect(JSON.parse(response.body).data).toMatchObject({ function: '${name}', ok: true });\n  });\n});\n`,
-            [`infra/functions/${name}.ts`]: `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';\n\nexport function ${register}(\n  api: any,\n  alertTopicArn: any,\n  role?: { role: string },\n  links: any[] = [],\n) {\n  const contract = createManagedLogGroupContract({\n    component: 'function-${name}',\n    slice: '${slice}',\n    stage: $app.stage,\n    workspace: '${workspace}',\n  });\n  const logGroup = new aws.cloudwatch.LogGroup('${pascal(slice)}${pascal(name)}Logs', {\n    logGroupClass: contract.logGroupClass,\n    name: contract.name,\n    retentionInDays: contract.retentionInDays,\n    tags: contract.tags,\n  });\n  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(\n    '${pascal(slice)}${pascal(name)}LogDataProtection',\n    {\n      logGroupName: logGroup.name,\n      policyDocument: JSON.stringify(contract.dataProtectionPolicy),\n    },\n    { dependsOn: [logGroup] },\n  );\n  const dataProtectionAlarm = new aws.cloudwatch.MetricAlarm(\n    '${pascal(slice)}${pascal(name)}LogDataProtectionFindings',\n    {\n      alarmActions: [alertTopicArn],\n      comparisonOperator: 'GreaterThanOrEqualToThreshold',\n      dimensions: { LogGroupName: logGroup.name },\n      evaluationPeriods: 1,\n      metricName: 'LogEventsWithFindings',\n      namespace: 'AWS/Logs',\n      period: 300,\n      statistic: 'Sum',\n      threshold: 1,\n      treatMissingData: 'notBreaching',\n    },\n    { dependsOn: [dataProtection] },\n  );\n  api.route('ANY /functions/${name}', {\n    ...(role ?? {}),\n    environment: { EBK_STAGE: $app.stage },\n    handler: 'api/${name}.handler',\n    link: links,\n    logging: { format: 'json', logGroup: logGroup.name },\n    transform: {\n      function: {\n        loggingConfig: {\n          applicationLogLevel: 'TRACE',\n          logFormat: 'JSON',\n          logGroup: logGroup.name,\n          systemLogLevel: 'INFO',\n        },\n      },\n    },\n  });\n  return { dataProtection, dataProtectionAlarm, logGroup };\n}\n`,
+            [`infra/functions/${name}.ts`]: `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';\n\nexport function ${register}(\n  api: any,\n  router: any,\n  alertTopicArn: any,\n  role?: { role: string },\n  links: any[] = [],\n) {\n  const contract = createManagedLogGroupContract({\n    component: 'function-${name}',\n    slice: '${slice}',\n    stage: $app.stage,\n    workspace: '${workspace}',\n  });\n  const logGroup = new aws.cloudwatch.LogGroup('${pascal(slice)}${pascal(name)}Logs', {\n    logGroupClass: contract.logGroupClass,\n    name: contract.name,\n    retentionInDays: contract.retentionInDays,\n    tags: contract.tags,\n  });\n  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(\n    '${pascal(slice)}${pascal(name)}LogDataProtection',\n    {\n      logGroupName: logGroup.name,\n      policyDocument: JSON.stringify(contract.dataProtectionPolicy),\n    },\n    { dependsOn: [logGroup] },\n  );\n  const dataProtectionAlarm = new aws.cloudwatch.MetricAlarm(\n    '${pascal(slice)}${pascal(name)}LogDataProtectionFindings',\n    {\n      alarmActions: [alertTopicArn],\n      comparisonOperator: 'GreaterThanOrEqualToThreshold',\n      dimensions: { LogGroupName: logGroup.name },\n      evaluationPeriods: 1,\n      metricName: 'LogEventsWithFindings',\n      namespace: 'AWS/Logs',\n      period: 300,\n      statistic: 'Sum',\n      threshold: 1,\n      treatMissingData: 'notBreaching',\n    },\n    { dependsOn: [dataProtection] },\n  );\n  const functionPath = '/functions/${name}';\n  const routerPath = '/${slice}/api/functions/${name}';\n  api.route('ANY /functions/${name}', {\n    ...(role ?? {}),\n    ebkRouteMaterialization: 'direct',\n    environment: { EBK_STAGE: $app.stage },\n    handler: 'api/${name}.handler',\n    link: links,\n    logging: { format: 'json', logGroup: logGroup.name },\n    transform: {\n      function: {\n        loggingConfig: {\n          applicationLogLevel: 'TRACE',\n          logFormat: 'JSON',\n          logGroup: logGroup.name,\n          systemLogLevel: 'INFO',\n        },\n      },\n    },\n  });\n  router.route(routerPath, api.url, {\n    rewrite: { regex: \`^\${routerPath}$\`, to: functionPath },\n  });\n  return { dataProtection, dataProtectionAlarm, logGroup };\n}\n`,
         },
         paths: [
             { mode: 'seeded', path: `api/${name}.ts` },
@@ -92,6 +92,7 @@ async function functionGenerator(tree, options) {
     replaceMarker(tree, productPath, '// <ebk:composition-imports:end>', `import { ${plan.register} } from './functions/${name}.js';`);
     replaceMarker(tree, productPath, '// <ebk:function-registrations:end>', `  ${plan.register}(
     api,
+    foundation.router,
     foundation.discovery.alertTopicArn,
     workloadRoleBindings?.extension.function('${name}'),
     secretLinksFor('${name}-function'),

package/src/generators/function/function.js.map

@@ -1 +1 @@
-{"version":3,"file":"function.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/function/function.ts"],"names":[],"mappings":";;AA8DA,wDAqBC;AAED,8CAwHC;AA7MD,uCAAoD;AACpD,yCAAkC;AAClC,uDAAsE;AACtE,gEAAuE;AACvE,gEAGgC;AAChC,8EAA8F;AAG9F,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,2FAA2F,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3D,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACpB,IAAU,EACV,IAAY,EACZ,MAAc,EACd,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,oBAAoB,IAAI,GAAG,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAU,EACV,IAAY,EACZ,MAAc;IAEd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,oBAAoB,IAAI,GAAG,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,SAAgB,sBAAsB,CACpC,SAAiB,EACjB,KAAa,EACb,IAAY,EACZ,OAAO,GAAG,IAAI;IAEd,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;IACzD,MAAM,QAAQ,GAAG,WAAW,MAAM,EAAE,CAAC;IACrC,OAAO;QACL,KAAK,EAAE;YACL,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,kJAAkJ,IAAI,mBAAmB,OAAO,qBAAqB,IAAI,iBAAiB,KAAK,qBAAqB,SAAS,gGAAgG,IAAI,6BAA6B;YAClZ,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,8EAA8E,IAAI,sBAAsB,IAAI,wRAAwR,IAAI,+BAA+B;YAChc,CAAC,mBAAmB,IAAI,KAAK,CAAC,EAAE,yGAAyG,QAAQ,8KAA8K,IAAI,mBAAmB,KAAK,+CAA+C,SAAS,8DAA8D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,+OAA+O,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,2PAA2P,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,+dAA+d,IAAI,8FAA8F,IAAI,6YAA6Y;SACl+D;QACD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE;YAC1C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,IAAI,UAAU,EAAE;YAC/C,EAAE,IAAI,EAAE,mBAAmB,IAAI,KAAK,EAAE;SACvC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,IAAU,EACV,OAAgC;IAEhC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAwB,CAAC,IAAI,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAC3B,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAClD,gBAAgB,CACjB,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACxD,IAAA,0EAA6C,EAC3C,IAAI,EACJ,sBAAsB,KAAK,IAAI,IAAI,EAAE,CACtC,CAAC;IACF,MAAM,SAAS,GAAG,iBAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,iBAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,iBAAK,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,iBAAK,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,iBAAK,CAAC,IAAI,CAC9B,SAAS,EACT,mCAAmC,CACpC,CAAC;IACF,MAAM,UAAU,GAAG,iBAAK,CAAC,IAAI,CAC3B,SAAS,EACT,0CAA0C,CAC3C,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,oCAAoC,KAAK,GAAG,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,mDAA6B,EAC3C,IAAI,EACJ,SAAS,EACT,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,wBAAwB,CACtB,IAAI,EACJ,aAAa,EACb,uCAAuC,CACxC,CAAC;IACF,wBAAwB,CACtB,IAAI,EACJ,UAAU,EACV,iDAAiD,CAClD,CAAC;IACF,wBAAwB,CACtB,IAAI,EACJ,WAAW,EACX,kCAAkC,CACnC,CAAC;IACF,wBAAwB,CACtB,IAAI,EACJ,WAAW,EACX,qCAAqC,CACtC,CAAC;IACF,MAAM,mBAAmB,GAAG,IAAA,2DAAqC,EAC/D,IAAI,EACJ,SAAS,EACT,YAAY,IAAI,EAAE,CACnB,CAAC;IACF,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,iBAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnE,aAAa,CACX,IAAI,EACJ,WAAW,EACX,kCAAkC,EAClC,YAAY,IAAI,CAAC,QAAQ,wBAAwB,IAAI,OAAO,CAC7D,CAAC;IACF,aAAa,CACX,IAAI,EACJ,WAAW,EACX,qCAAqC,EACrC,KAAK,IAAI,CAAC,QAAQ;;;gDAG0B,IAAI;sBAC9B,IAAI;KACrB,CACF,CAAC;IACF,aAAa,CACX,IAAI,EACJ,aAAa,EACb,uCAAuC,EACvC,YAAY,IAAI,wBAAwB,CACzC,CAAC;IACF,aAAa,CACX,IAAI,EACJ,UAAU,EACV,iDAAiD,EACjD,uEAAuE,IAAI,iBAAiB,CAC7F,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IACjD,IAAA,qCAA0B,EAAC,IAAI,EAAE;QAC/B,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACnD,KAAK,EAAE;YACL,GAAG,IAAI,CAAC,KAAK;YACb,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAC5B,EAAE,IAAI,EAAE,mCAAmC,EAAE;YAC7C,EAAE,IAAI,EAAE,0CAA0C,EAAE;YACpD,EAAE,IAAI,EAAE,iDAA2B,EAAE;SACtC;QACD,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,kBAAe,iBAAiB,CAAC"}
+{"version":3,"file":"function.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/function/function.ts"],"names":[],"mappings":";;AA8DA,wDAqBC;AAED,8CAyHC;AA9MD,uCAAoD;AACpD,yCAAkC;AAClC,uDAAsE;AACtE,gEAAuE;AACvE,gEAGgC;AAChC,8EAA8F;AAG9F,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,2FAA2F,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3D,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACpB,IAAU,EACV,IAAY,EACZ,MAAc,EACd,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,oBAAoB,IAAI,GAAG,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAU,EACV,IAAY,EACZ,MAAc;IAEd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,oBAAoB,IAAI,GAAG,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,SAAgB,sBAAsB,CACpC,SAAiB,EACjB,KAAa,EACb,IAAY,EACZ,OAAO,GAAG,IAAI;IAEd,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;IACzD,MAAM,QAAQ,GAAG,WAAW,MAAM,EAAE,CAAC;IACrC,OAAO;QACL,KAAK,EAAE;YACL,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,kJAAkJ,IAAI,mBAAmB,OAAO,qBAAqB,IAAI,iBAAiB,KAAK,qBAAqB,SAAS,gGAAgG,IAAI,6BAA6B;YAClZ,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,8EAA8E,IAAI,sBAAsB,IAAI,wRAAwR,IAAI,+BAA+B;YAChc,CAAC,mBAAmB,IAAI,KAAK,CAAC,EAAE,yGAAyG,QAAQ,8LAA8L,IAAI,mBAAmB,KAAK,+CAA+C,SAAS,8DAA8D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,+OAA+O,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,2PAA2P,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,seAAse,IAAI,8BAA8B,KAAK,kBAAkB,IAAI,mCAAmC,IAAI,sIAAsI,IAAI,4fAA4f;SAChvE;QACD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE;YAC1C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,IAAI,UAAU,EAAE;YAC/C,EAAE,IAAI,EAAE,mBAAmB,IAAI,KAAK,EAAE;SACvC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,IAAU,EACV,OAAgC;IAEhC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAwB,CAAC,IAAI,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAC3B,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAClD,gBAAgB,CACjB,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACxD,IAAA,0EAA6C,EAC3C,IAAI,EACJ,sBAAsB,KAAK,IAAI,IAAI,EAAE,CACtC,CAAC;IACF,MAAM,SAAS,GAAG,iBAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,iBAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,iBAAK,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,iBAAK,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,iBAAK,CAAC,IAAI,CAC9B,SAAS,EACT,mCAAmC,CACpC,CAAC;IACF,MAAM,UAAU,GAAG,iBAAK,CAAC,IAAI,CAC3B,SAAS,EACT,0CAA0C,CAC3C,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,oCAAoC,KAAK,GAAG,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,mDAA6B,EAC3C,IAAI,EACJ,SAAS,EACT,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,wBAAwB,CACtB,IAAI,EACJ,aAAa,EACb,uCAAuC,CACxC,CAAC;IACF,wBAAwB,CACtB,IAAI,EACJ,UAAU,EACV,iDAAiD,CAClD,CAAC;IACF,wBAAwB,CACtB,IAAI,EACJ,WAAW,EACX,kCAAkC,CACnC,CAAC;IACF,wBAAwB,CACtB,IAAI,EACJ,WAAW,EACX,qCAAqC,CACtC,CAAC;IACF,MAAM,mBAAmB,GAAG,IAAA,2DAAqC,EAC/D,IAAI,EACJ,SAAS,EACT,YAAY,IAAI,EAAE,CACnB,CAAC;IACF,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,iBAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnE,aAAa,CACX,IAAI,EACJ,WAAW,EACX,kCAAkC,EAClC,YAAY,IAAI,CAAC,QAAQ,wBAAwB,IAAI,OAAO,CAC7D,CAAC;IACF,aAAa,CACX,IAAI,EACJ,WAAW,EACX,qCAAqC,EACrC,KAAK,IAAI,CAAC,QAAQ;;;;gDAI0B,IAAI;sBAC9B,IAAI;KACrB,CACF,CAAC;IACF,aAAa,CACX,IAAI,EACJ,aAAa,EACb,uCAAuC,EACvC,YAAY,IAAI,wBAAwB,CACzC,CAAC;IACF,aAAa,CACX,IAAI,EACJ,UAAU,EACV,iDAAiD,EACjD,uEAAuE,IAAI,iBAAiB,CAC7F,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IACjD,IAAA,qCAA0B,EAAC,IAAI,EAAE;QAC/B,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACnD,KAAK,EAAE;YACL,GAAG,IAAI,CAAC,KAAK;YACb,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAC5B,EAAE,IAAI,EAAE,mCAAmC,EAAE;YAC7C,EAAE,IAAI,EAAE,0CAA0C,EAAE;YACpD,EAAE,IAAI,EAAE,iDAA2B,EAAE;SACtC;QACD,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,kBAAe,iBAAiB,CAAC"}

package/src/generators/preset/generator.js

@@ -3,7 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.frameworkPackageVersion = frameworkPackageVersion;
 exports.presetGenerator = presetGenerator;
 const prettier_1 = require("prettier");
-const index_js_1 = require("../../ownership/index.js");
+const index_js_1 = require("../../repository-policy/index.js");
+const index_js_2 = require("../../ownership/index.js");
 const workspace_files_1 = require("./workspace-files");
 function frameworkPackageVersion() {
     const manifest = require('../../../package.json');
@@ -13,7 +14,26 @@ function frameworkPackageVersion() {
     return manifest.version;
 }
 async function presetGenerator(tree, options) {
+    const suppliedAccounts = [
+        options.developmentAccountId,
+        options.stagingAccountId,
+        options.productionAccountId,
+    ];
+    if (suppliedAccounts.some((value) => value !== undefined) &&
+        suppliedAccounts.some((value) => value === undefined)) {
+        throw new Error('Preset deployment topology requires all three exact stage account IDs together.');
+    }
+    const deploymentAccounts = suppliedAccounts.every((value) => value !== undefined)
+        ? (0, index_js_1.validateDeploymentAccountTopology)(options.deploymentProfile ?? 'starter', {
+            development: (0, index_js_1.normalizeDeploymentAccountId)(options.developmentAccountId, 'Development deployment account'),
+            production: (0, index_js_1.normalizeDeploymentAccountId)(options.productionAccountId, 'Production deployment account'),
+            staging: (0, index_js_1.normalizeDeploymentAccountId)(options.stagingAccountId, 'Staging deployment account'),
+        })
+        : { development: null, production: null, staging: null };
     const renderedFiles = (0, workspace_files_1.renderWorkspaceFiles)({
+        deploymentAccounts,
+        deploymentProfile: options.deploymentProfile ?? 'starter',
+        deploymentRegion: options.deploymentRegion ?? null,
         frameworkVersion: options.frameworkVersion ?? frameworkPackageVersion(),
         name: options.name,
     });
@@ -37,8 +57,8 @@ async function presetGenerator(tree, options) {
     for (const [path, contents] of Object.entries(files)) {
         tree.write(path, contents);
     }
-    (0, index_js_1.restampFoundationOwnership)(tree);
-    (0, index_js_1.restampWorkspaceOwnership)(tree);
+    (0, index_js_2.restampFoundationOwnership)(tree);
+    (0, index_js_2.restampWorkspaceOwnership)(tree);
 }
 exports.default = presetGenerator;
 //# sourceMappingURL=generator.js.map

package/src/generators/preset/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/generator.ts"],"names":[],"mappings":";;AAYA,0DAQC;AAED,0CAmCC;AAxDD,uCAAoD;AAEpD,uDAGkC;AAClC,uDAG2B;AAE3B,SAAgB,uBAAuB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,uBAAuB,CAA0B,CAAC;IAC3E,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,IAAU,EACV,OAA8B;IAE9B,MAAM,aAAa,GAAG,IAAA,sCAAoB,EAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,EAAE;QACvE,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;QAC3D,IAAI,IAAA,6CAA2B,EAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAU,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACH,OAAO;gBACL,IAAI;gBACJ,MAAM,IAAA,iBAAc,EAAC,QAAQ,EAAE;oBAC7B,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAE,IAAI;iBAClB,CAAC;aACM,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAU,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CACH,CACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,IAAA,qCAA0B,EAAC,IAAI,CAAC,CAAC;IACjC,IAAA,oCAAyB,EAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,kBAAe,eAAe,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/generator.ts"],"names":[],"mappings":";;AAiBA,0DAQC;AAED,0CAuEC;AAjGD,uCAAoD;AAEpD,+DAI0C;AAC1C,uDAGkC;AAClC,uDAG2B;AAE3B,SAAgB,uBAAuB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,uBAAuB,CAA0B,CAAC;IAC3E,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,IAAU,EACV,OAA8B;IAE9B,MAAM,gBAAgB,GAAG;QACvB,OAAO,CAAC,oBAAoB;QAC5B,OAAO,CAAC,gBAAgB;QACxB,OAAO,CAAC,mBAAmB;KAC5B,CAAC;IACF,IACE,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACrD,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,EACrD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GACtB,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACpD,CAAC,CAAC,IAAA,4CAAiC,EAC/B,OAAO,CAAC,iBAAiB,IAAI,SAAS,EACtC;YACE,WAAW,EAAE,IAAA,uCAA4B,EACvC,OAAO,CAAC,oBAAuC,EAC/C,gCAAgC,CACjC;YACD,UAAU,EAAE,IAAA,uCAA4B,EACtC,OAAO,CAAC,mBAAsC,EAC9C,+BAA+B,CAChC;YACD,OAAO,EAAE,IAAA,uCAA4B,EACnC,OAAO,CAAC,gBAAmC,EAC3C,4BAA4B,CAC7B;SACF,CACF;QACH,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,aAAa,GAAG,IAAA,sCAAoB,EAAC;QACzC,kBAAkB;QAClB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,SAAS;QACzD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QAClD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,EAAE;QACvE,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;QAC3D,IAAI,IAAA,6CAA2B,EAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAU,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACH,OAAO;gBACL,IAAI;gBACJ,MAAM,IAAA,iBAAc,EAAC,QAAQ,EAAE;oBAC7B,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAE,IAAI;iBAClB,CAAC;aACM,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAU,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CACH,CACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,IAAA,qCAA0B,EAAC,IAAI,CAAC,CAAC;IACjC,IAAA,oCAAyB,EAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,kBAAe,eAAe,CAAC"}

package/src/generators/preset/schema.d.ts

@@ -1,4 +1,11 @@
+import type { DeploymentProfile } from '../../repository-policy/index.js';
+
 export interface PresetGeneratorSchema {
+  deploymentProfile?: DeploymentProfile;
+  deploymentRegion?: string;
+  developmentAccountId?: string | number;
   frameworkVersion?: string;
   name: string;
+  productionAccountId?: string | number;
+  stagingAccountId?: string | number;
 }

package/src/generators/preset/schema.json

@@ -4,6 +4,29 @@
   "title": "Empire Builder Kit workspace preset",
   "type": "object",
   "properties": {
+    "deploymentProfile": {
+      "type": "string",
+      "enum": ["starter", "production-isolated", "fully-isolated"],
+      "default": "starter",
+      "description": "AWS account and deployment-authority topology."
+    },
+    "deploymentRegion": {
+      "type": "string",
+      "pattern": "^[a-z]{2}(-gov)?-[a-z]+(-[a-z]+)*-[0-9]$",
+      "description": "Optional exact shared AWS Region for all canonical stages."
+    },
+    "developmentAccountId": {
+      "anyOf": [
+        { "type": "string", "pattern": "^[0-9]{12}$" },
+        {
+          "type": "number",
+          "minimum": 100000000000,
+          "maximum": 999999999999,
+          "multipleOf": 1
+        }
+      ],
+      "description": "Optional exact development AWS account ID. Supply all three stage accounts together."
+    },
     "name": {
       "type": "string",
       "description": "Workspace name.",
@@ -16,6 +39,30 @@
     "frameworkVersion": {
       "type": "string",
       "description": "Framework package version written to the generated workspace. Defaults to the preset package version."
+    },
+    "stagingAccountId": {
+      "anyOf": [
+        { "type": "string", "pattern": "^[0-9]{12}$" },
+        {
+          "type": "number",
+          "minimum": 100000000000,
+          "maximum": 999999999999,
+          "multipleOf": 1
+        }
+      ],
+      "description": "Optional exact staging AWS account ID. Supply all three stage accounts together."
+    },
+    "productionAccountId": {
+      "anyOf": [
+        { "type": "string", "pattern": "^[0-9]{12}$" },
+        {
+          "type": "number",
+          "minimum": 100000000000,
+          "maximum": 999999999999,
+          "multipleOf": 1
+        }
+      ],
+      "description": "Optional exact production AWS account ID. Supply all three stage accounts together."
     }
   },
   "required": ["name"]

package/src/generators/preset/workspace-files-ci-acceptance.js

@@ -19,9 +19,22 @@ import { pathToFileURL } from 'node:url';
 import { inflateRawSync } from 'node:zlib';
 
 const WORKFLOW = '.github/workflows/ci.yml';
-const KIND = 'ebk-workspace-protected-promotion-acceptance';
+const KIND = 'ebk-workspace-protected-route-acceptance';
+const SCHEMA_VERSION = 2;
 const MAX_ARCHIVE_BYTES = 1024 * 1024;
 const MAX_MANIFEST_BYTES = 256 * 1024;
+const ROUTES = Object.freeze({
+  'protected-develop-promotion': Object.freeze({
+    base: 'main',
+    head: 'develop',
+    historyOnly: false,
+  }),
+  'protected-main-sync': Object.freeze({
+    base: 'develop',
+    head: 'main',
+    historyOnly: true,
+  }),
+});
 const INPUTS = Object.freeze([
   WORKFLOW,
   '.node-version',
@@ -115,6 +128,13 @@ function integer(value, label) {
   return value;
 }
 
+function commit(value, label) {
+  if (typeof value !== 'string' || !/^[a-f0-9]{40}$/u.test(value)) {
+    throw new Error(\`Workspace acceptance \${label} commit is invalid.\`);
+  }
+  return value;
+}
+
 function repository(value) {
   if (
     typeof value !== 'string' ||
@@ -129,7 +149,7 @@ function repository(value) {
 // GitHub resolves pull_request workflows through an ephemeral merge ref. The
 // workflow bytes and exact source tree are bound independently in the sealed
 // manifest, while this check binds the observable GitHub route.
-function isPromotionWorkflowRef(value, expectedRepository) {
+function isPullRequestWorkflowRef(value, expectedRepository) {
   const prefix = \`\${expectedRepository}/\${WORKFLOW}@refs/pull/\`;
   return (
     typeof value === 'string' &&
@@ -138,6 +158,39 @@ function isPromotionWorkflowRef(value, expectedRepository) {
   );
 }
 
+function routeDefinition(value) {
+  if (typeof value !== 'string' || !Object.hasOwn(ROUTES, value)) {
+    throw new Error('Workspace acceptance route is invalid.');
+  }
+  return ROUTES[value];
+}
+
+function routeForBranches(base, head) {
+  const matches = Object.entries(ROUTES).filter(
+    ([, route]) => route.base === base && route.head === head,
+  );
+  if (matches.length !== 1) {
+    throw new Error('Workspace acceptance branch route is invalid.');
+  }
+  return { name: matches[0][0], ...matches[0][1] };
+}
+
+function routeForProtectedPush(ref) {
+  if (ref === 'refs/heads/main') {
+    return {
+      name: 'protected-develop-promotion',
+      ...ROUTES['protected-develop-promotion'],
+    };
+  }
+  if (ref === 'refs/heads/develop') {
+    return {
+      name: 'protected-main-sync',
+      ...ROUTES['protected-main-sync'],
+    };
+  }
+  throw new Error('Workspace merge lookup lacks protected branch authority.');
+}
+
 function canonical(value) {
   if (Array.isArray(value)) return value.map(canonical);
   if (value !== null && typeof value === 'object') {
@@ -159,36 +212,50 @@ export function sealWorkspaceAcceptance({
   const expectedRepository = repository(environment.GITHUB_REPOSITORY);
   const runId = integer(environment.GITHUB_RUN_ID, 'run id');
   const runAttempt = integer(environment.GITHUB_RUN_ATTEMPT, 'run attempt');
+  const route = routeForBranches(
+    environment.GITHUB_BASE_REF,
+    environment.GITHUB_HEAD_REF,
+  );
+  const baseCommit = commit(environment.EBK_BASE_COMMIT, 'base');
+  const baseTree = git(root, ['rev-parse', \`\${baseCommit}^{tree}\`]);
   if (
     environment.GITHUB_EVENT_NAME !== 'pull_request' ||
     environment.EBK_HEAD_REPOSITORY !== expectedRepository ||
-    environment.GITHUB_BASE_REF !== 'main' ||
-    environment.GITHUB_HEAD_REF !== 'develop' ||
-    !isPromotionWorkflowRef(
+    !isPullRequestWorkflowRef(
       environment.GITHUB_WORKFLOW_REF,
       expectedRepository,
     ) ||
     environment.EBK_CI_CANDIDATE_SHA !== source.commit
   ) {
-    throw new Error(
-      'Workspace acceptance is not the protected develop-to-main route.',
-    );
+    throw new Error('Workspace acceptance is not an exact protected route.');
   }
   if (existsSync(output)) {
     throw new Error('Workspace acceptance output already exists.');
   }
+  if (route.historyOnly && baseTree !== source.tree) {
+    return Object.freeze({
+      base: route.base,
+      head: route.head,
+      historyOnly: true,
+      reason: 'protected main sync changes protected source',
+      route: route.name,
+      sealed: false,
+    });
+  }
   const manifest = {
-    base: 'main',
+    base: route.base,
+    baseSource: { commit: baseCommit, tree: baseTree },
     eventName: 'pull_request',
-    head: 'develop',
+    head: route.head,
     headRepository: expectedRepository,
+    historyOnly: route.historyOnly,
     inputs: digests(root),
     kind: KIND,
     repository: expectedRepository,
-    route: 'protected-develop-promotion',
+    route: route.name,
     runAttempt,
     runId,
-    schemaVersion: 1,
+    schemaVersion: SCHEMA_VERSION,
     source,
     workflow: WORKFLOW,
   };
@@ -201,26 +268,35 @@ export function sealWorkspaceAcceptance({
 }
 
 export function verifyWorkspaceAcceptance({
+  baseCommit: requestedBaseCommit,
   headCommit,
   manifestPath,
   repository: requestedRepository,
   root: requested,
+  route: requestedRoute,
   runAttempt,
   runId,
 }) {
   const { root, source } = rootIdentity(requested);
   const expectedRepository = repository(requestedRepository);
+  const route = {
+    name: requestedRoute,
+    ...routeDefinition(requestedRoute),
+  };
   runId = integer(runId, 'run id');
   runAttempt = integer(runAttempt, 'run attempt');
-  if (!/^[a-f0-9]{40}$/u.test(headCommit)) {
-    throw new Error('Workspace acceptance head commit is invalid.');
-  }
+  const baseCommit = commit(requestedBaseCommit, 'base');
+  headCommit = commit(headCommit, 'head');
+  const baseTree = git(root, ['rev-parse', \`\${baseCommit}^{tree}\`]);
   const headTree = git(root, ['rev-parse', \`\${headCommit}^{tree}\`]);
   if (headTree !== source.tree) {
     throw new Error(
       'Workspace acceptance head tree differs from the merged tree.',
     );
   }
+  if (route.historyOnly && baseTree !== headTree) {
+    throw new Error('Workspace acceptance sync changes protected source.');
+  }
   const manifest = JSON.parse(
     file(
       path.dirname(manifestPath),
@@ -228,18 +304,31 @@ export function verifyWorkspaceAcceptance({
       256 * 1024,
     ).toString('utf8'),
   );
+  if (manifest?.kind !== KIND) {
+    throw new Error('Workspace acceptance kind is unsupported.');
+  }
+  if (manifest.schemaVersion !== SCHEMA_VERSION) {
+    throw new Error(
+      \`Workspace acceptance schema is unsupported; expected schema v\${SCHEMA_VERSION}.\`,
+    );
+  }
+  if (manifest.route !== route.name) {
+    throw new Error('Workspace acceptance route differs from the merged route.');
+  }
   const expected = {
-    base: 'main',
+    base: route.base,
+    baseSource: { commit: baseCommit, tree: baseTree },
     eventName: 'pull_request',
-    head: 'develop',
+    head: route.head,
     headRepository: expectedRepository,
+    historyOnly: route.historyOnly,
     inputs: digests(root),
     kind: KIND,
     repository: expectedRepository,
-    route: 'protected-develop-promotion',
+    route: route.name,
     runAttempt,
     runId,
-    schemaVersion: 1,
+    schemaVersion: SCHEMA_VERSION,
     source: { commit: headCommit, tree: headTree },
     workflow: WORKFLOW,
   };
@@ -450,7 +539,7 @@ export async function downloadWorkspaceAcceptance({
 }
 
 // Declining reuse is always safe: the complete verification lane runs. Reuse
-// is claimed only when one protected promotion, the identical reviewed tree,
+// is claimed only when one exact protected route, the identical reviewed tree,
 // one successful workflow run, and one retained artifact all agree.
 export async function resolveWorkspaceAcceptance({
   environment,
@@ -460,14 +549,14 @@ export async function resolveWorkspaceAcceptance({
   const { root, source } = rootIdentity(requested);
   const expectedRepository = repository(environment.GITHUB_REPOSITORY);
   const token = environment.GH_TOKEN;
+  const route = routeForProtectedPush(environment.GITHUB_REF);
   if (
     typeof token !== 'string' ||
     token.length < 1 ||
     environment.GITHUB_EVENT_NAME !== 'push' ||
-    environment.GITHUB_REF !== 'refs/heads/main' ||
     environment.GITHUB_SHA !== source.commit
   ) {
-    throw new Error('Workspace merge lookup lacks protected-main authority.');
+    throw new Error('Workspace merge lookup lacks protected-push authority.');
   }
   const api = environment.GITHUB_API_URL ?? 'https://api.github.com';
   try {
@@ -480,24 +569,56 @@ export async function resolveWorkspaceAcceptance({
       (pull) =>
         pull?.merged_at &&
         pull?.merge_commit_sha === source.commit &&
-        pull?.base?.ref === 'main' &&
-        pull?.head?.ref === 'develop' &&
+        pull?.base?.ref === route.base &&
+        pull?.head?.ref === route.head &&
         pull?.head?.repo?.full_name === expectedRepository,
     );
     if (eligible.length !== 1) {
       return {
-        reason: \`eligible protected promotions: \${eligible.length}\`,
+        reason: \`eligible \${route.name} merges: \${eligible.length}\`,
         reused: false,
       };
     }
     const pull = eligible[0];
     const headCommit = pull.head?.sha;
-    if (typeof headCommit !== 'string' || !/^[a-f0-9]{40}$/u.test(headCommit)) {
-      return { reason: 'promotion head commit is not exact', reused: false };
+    if (
+      typeof headCommit !== 'string' ||
+      !/^[a-f0-9]{40}$/u.test(headCommit)
+    ) {
+      return {
+        reason: 'protected-route head commit is not exact',
+        reused: false,
+      };
     }
-    if (git(root, ['rev-parse', \`\${headCommit}^{tree}\`]) !== source.tree) {
+    const mergeParents = git(root, [
+      'rev-list',
+      '--parents',
+      '-n',
+      '1',
+      source.commit,
+    ]).split(' ');
+    if (
+      mergeParents.length !== 3 ||
+      mergeParents[0] !== source.commit ||
+      mergeParents[2] !== headCommit
+    ) {
       return {
-        reason: 'merged tree differs from the reviewed promotion tree',
+        reason: 'protected-route merge parents are not exact',
+        reused: false,
+      };
+    }
+    const baseCommit = mergeParents[1];
+    const baseTree = git(root, ['rev-parse', \`\${baseCommit}^{tree}\`]);
+    const headTree = git(root, ['rev-parse', \`\${headCommit}^{tree}\`]);
+    if (headTree !== source.tree) {
+      return {
+        reason: 'merged tree differs from the reviewed protected-route tree',
+        reused: false,
+      };
+    }
+    if (route.historyOnly && baseTree !== headTree) {
+      return {
+        reason: 'protected-main-sync changes protected source',
         reused: false,
       };
     }
@@ -518,7 +639,7 @@ export async function resolveWorkspaceAcceptance({
         run?.conclusion === 'success' &&
         run?.event === 'pull_request' &&
         run?.head_sha === headCommit &&
-        run?.head_branch === 'develop' &&
+        run?.head_branch === route.head &&
         run?.head_repository?.full_name === expectedRepository &&
         run?.path === WORKFLOW &&
         Number.isSafeInteger(run.id) &&
@@ -559,15 +680,19 @@ export async function resolveWorkspaceAcceptance({
           artifactId: id,
           artifactName,
           artifactSize: size,
+          baseCommit,
           headCommit,
+          historyOnly: route.historyOnly,
           reused: true,
+          route: route.name,
           runAttempt: String(run.run_attempt),
           runId: String(run.id),
         };
       }
     }
     return {
-      reason: 'no successful promotion run retains the acceptance artifact',
+      reason:
+        'no successful protected-route run retains the acceptance artifact',
       reused: false,
     };
   } catch (error) {
@@ -581,21 +706,33 @@ export async function resolveWorkspaceAcceptance({
 async function main(argv) {
   const [operation, ...args] = argv;
   if (operation === 'seal' && args.length === 1) {
-    sealWorkspaceAcceptance({
+    const result = sealWorkspaceAcceptance({
       environment: process.env,
       output: path.resolve(args[0]),
       root: process.cwd(),
     });
+    const output = process.env.GITHUB_OUTPUT;
+    if (typeof output !== 'string' || !path.isAbsolute(output)) {
+      throw new Error('Workspace acceptance output authority is missing.');
+    }
+    appendFileSync(output, \`sealed=\${String(result.sealed !== false)}\\n\`, 'utf8');
+    if (result.sealed === false) {
+      console.log(
+        \`::warning title=Protected sync evidence declined::\${result.reason}; no reusable acceptance artifact was sealed.\`,
+      );
+    }
     return;
   }
-  if (operation === 'verify' && args.length === 4) {
+  if (operation === 'verify' && args.length === 6) {
     verifyWorkspaceAcceptance({
+      baseCommit: args[2],
       headCommit: args[1],
       manifestPath: path.resolve(args[0]),
       repository: process.env.GITHUB_REPOSITORY,
       root: process.cwd(),
-      runAttempt: args[3],
-      runId: args[2],
+      route: args[3],
+      runAttempt: args[5],
+      runId: args[4],
     });
     return;
   }
@@ -628,8 +765,11 @@ async function main(argv) {
       artifact_id: result.artifactId ?? '',
       artifact_name: result.artifactName ?? '',
       artifact_size: result.artifactSize ?? '',
+      base_commit: result.baseCommit ?? '',
       head_commit: result.headCommit ?? '',
+      history_only: String(result.historyOnly === true),
       reused: String(result.reused),
+      route: result.route ?? '',
       run_attempt: result.runAttempt ?? '',
       run_id: result.runId ?? '',
     })) {
@@ -638,7 +778,7 @@ async function main(argv) {
     return;
   }
   throw new Error(
-    'Usage: workspace-acceptance.mjs seal <manifest> | download <output> <artifact-id> <artifact-digest> <artifact-size> | verify <manifest> <head> <run> <attempt> | resolve',
+    'Usage: workspace-acceptance.mjs seal <manifest> | download <output> <artifact-id> <artifact-digest> <artifact-size> | verify <manifest> <head> <base> <route> <run> <attempt> | resolve',
   );
 }
 

package/src/generators/preset/workspace-files-ci-acceptance.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-files-ci-acceptance.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-ci-acceptance.ts"],"names":[],"mappings":";;AAAA,4EAwoBC;AAxoBD,SAAgB,gCAAgC;IAG9C,OAAO;QACL,mCAAmC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkoBxC;KACE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-files-ci-acceptance.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-ci-acceptance.ts"],"names":[],"mappings":";;AAAA,4EAoxBC;AApxBD,SAAgB,gCAAgC;IAG9C,OAAO;QACL,mCAAmC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8wBxC;KACE,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-developer-agent.d.ts

@@ -1,8 +1,10 @@
+import type { DeploymentProfile } from '../../repository-policy/index.js';
 export declare const DEVELOPER_AGENT_RUNBOOK_PATH: "docs/developer-agent.md";
 export declare const DEVELOPER_AGENT_HANDOFF_TEMPLATE_PATH: "docs/developer-agent-handoff.template.json";
 export declare const DEVELOPER_AGENT_ADAPTER_EVALUATION_PATH: "docs/developer-agent-adapters.md";
 export declare const DEVELOPER_AGENT_WORKSPACE_SEEDED_PATHS: readonly ["docs/developer-agent.md", "docs/developer-agent-handoff.template.json", "docs/developer-agent-adapters.md"];
 export interface DeveloperAgentWorkspaceFileOptions {
+    deploymentProfile: DeploymentProfile;
     frameworkVersion: string;
     name: string;
 }