@empire-builder-kit/nx 1.0.0-rc.2 → 1.0.0-rc.21

package/src/generators/slice/built-in-plan-infrastructure-safety-files.js

@@ -47,11 +47,11 @@ function renderProductInfrastructureSafetyFiles(name) {
                 authoritativeRefreshForbiddenForDetection: true,
                 previewEnvironment: {
                     PULUMI_OPTION_REFRESH: 'true',
-                    PULUMI_OPTION_RUN_PROGRAM: 'true',
+                    PULUMI_OPTION_RUN_PROGRAM: 'false',
                 },
             },
             planner: {
-                command: 'sst diff --json plus same-command read-only refresh preview',
+                command: 'sst diff --json plus same-command separated refresh preview',
                 executor: '@empire-builder-kit/nx:infrastructure-plan',
                 scope: 'product-slice',
                 sourceBoundary: 'desired-source-versus-recorded-sst-state',
@@ -60,16 +60,62 @@ function renderProductInfrastructureSafetyFiles(name) {
                 version: '4.17.1',
             },
             policy: {
+                adoptedImports: [],
                 additiveLowRiskTypes: [
                     'aws:cloudwatch/dashboard:Dashboard',
+                    'aws:cloudwatch/logDataProtectionPolicy:LogDataProtectionPolicy',
                     'aws:cloudwatch/logGroup:LogGroup',
                     'aws:cloudwatch/metricAlarm:MetricAlarm',
                     'random:index/randomPassword:RandomPassword',
                 ],
+                additiveReviewedTypes: [
+                    'aws:appconfig/application:Application',
+                    'aws:appconfig/configurationProfile:ConfigurationProfile',
+                    'aws:appconfig/deploymentStrategy:DeploymentStrategy',
+                    'aws:appconfig/environment:Environment',
+                    'aws:cloudwatch/eventRule:EventRule',
+                    'aws:cloudwatch/eventTarget:EventTarget',
+                    'aws:ecs/taskDefinition:TaskDefinition',
+                    'aws:lambda/functionEventInvokeConfig:FunctionEventInvokeConfig',
+                    'aws:lambda/permission:Permission',
+                    'aws:s3/bucketCorsConfiguration:BucketCorsConfiguration',
+                    'aws:s3/bucketLifecycleConfigurationV2:BucketLifecycleConfigurationV2',
+                    'aws:s3/bucketOwnershipControls:BucketOwnershipControls',
+                    'aws:s3/bucketObjectv2:BucketObjectv2',
+                    'aws:s3/bucketPolicy:BucketPolicy',
+                    'aws:s3/bucketPublicAccessBlock:BucketPublicAccessBlock',
+                    'aws:s3/bucketServerSideEncryptionConfigurationV2:BucketServerSideEncryptionConfigurationV2',
+                    'aws:s3/bucketVersioningV2:BucketVersioningV2',
+                    'aws:sqs/queuePolicy:QueuePolicy',
+                    'pulumi-nodejs:dynamic:Resource',
+                    'pulumi:providers:aws',
+                    'pulumi:providers:pulumi-nodejs',
+                    'pulumi:providers:random',
+                    'pulumi:pulumi:Stack',
+                    'sst:aws:ApiGatewayV2',
+                    'sst:aws:ApiGatewayV2LambdaRoute',
+                    'sst:aws:Bucket',
+                    'sst:aws:Bus',
+                    'sst:aws:BusQueueSubscriber',
+                    'sst:aws:CDN',
+                    'sst:aws:Cluster',
+                    'sst:aws:CognitoUserPool',
+                    'sst:aws:CognitoUserPoolClient',
+                    'sst:aws:Function',
+                    'sst:aws:Nextjs',
+                    'sst:aws:Queue',
+                    'sst:aws:Router',
+                    'sst:aws:Task',
+                    'sst:aws:Vpc',
+                    'sst:sst:LinkRef',
+                    'sst:sst:Linkable',
+                    'sst:sst:Version',
+                ],
                 costOrQuotaTypes: [
                     'aws:apigatewayv2/api:Api',
                     'aws:apigatewayv2/integration:Integration',
                     'aws:apigatewayv2/route:Route',
+                    'aws:apigatewayv2/stage:Stage',
                     'aws:apigatewayv2/vpcLink:VpcLink',
                     'aws:appconfig/deployment:Deployment',
                     'aws:budgets/budget:Budget',
@@ -77,12 +123,11 @@ function renderProductInfrastructureSafetyFiles(name) {
                     'aws:cloudfront/distribution:Distribution',
                     'aws:cloudfront/function:Function',
                     'aws:cloudfront/keyValueStore:KeyValueStore',
-                    'aws:costexplorer/anomalyMonitor:AnomalyMonitor',
-                    'aws:costexplorer/anomalySubscription:AnomalySubscription',
                     'aws:dynamodb/table:Table',
                     'aws:ecs/service:Service',
                     'aws:lambda/function:Function',
                     'aws:rds/cluster:Cluster',
+                    'aws:sfn/stateMachine:StateMachine',
                 ],
                 failClosedOnUnknown: true,
                 iamAccessAnalyzer: 'in-process-validate-policy-for-proposed-policy-documents',
@@ -93,12 +138,18 @@ function renderProductInfrastructureSafetyFiles(name) {
                 redactBeforeReview: true,
                 standingPolicyRiskClasses: ['no-change', 'additive-low-risk'],
                 statefulTypes: [
+                    'aws:appconfig/hostedConfigurationVersion:HostedConfigurationVersion',
+                    'aws:cloudformation/stack:Stack',
+                    'aws:cognito/userPoolClient:UserPoolClient',
                     'aws:dynamodb/table:Table',
+                    'aws:kms/alias:Alias',
                     'aws:kms/key:Key',
                     'aws:rds/cluster:Cluster',
                     'aws:s3/bucket:Bucket',
+                    'aws:secretsmanager/secret:Secret',
                     'aws:sqs/queue:Queue',
                     'aws:ssm/parameter:Parameter',
+                    'random:index/randomBytes:RandomBytes',
                     'random:index/randomPassword:RandomPassword',
                 ],
             },
@@ -246,9 +297,11 @@ if (
 \`pnpm nx run <slice>:infrastructure-plan --stage=<protected-stage>\` runs the
 workspace-pinned SST 4.17.1 \`sst diff --json\` contract through the framework
 executor. It first compares desired source with SST's recorded engine state,
-then repeats the same preview with the pinned Pulumi read-only refresh and
-run-program options. Refresh-phase events are separated from desired operations
-in memory. Raw state, policy documents, provider values, and secret-adjacent
+then repeats that non-writing diff with Pulumi's refresh option. The executor
+separates provider refresh records from the subsequent desired-preview records,
+validates both partitions, and uses only the refresh partition as drift
+authority. The first ordinary preview remains the sole desired-update
+authority. Raw state, policy documents, provider values, and secret-adjacent
 material are never written to review evidence.
 
 Unknown, destructive, stateful, security-expanding, protection-reducing, and
@@ -259,10 +312,13 @@ still independently revalidated before apply.
 
 Use only the bounded read-only preview for drift. Never invoke authoritative
 \`sst refresh\`, write state, unlock state, or mutate cloud resources to detect
-drift. A refresh preview is complete only when its desired phase materially
-equals the ordinary diff, its exact existing-resource inventory matches the
-full canonical state export, and all material properties have supported
-coverage. Generated non-secret String SSM parameter values are compared only in
+drift. A refresh preview is complete only when desired-program execution
+is disabled during the provider refresh subphase, refresh and desired events
+remain structurally separable, its exact existing-resource inventory matches
+the full canonical state export, and all material properties have supported
+coverage. The preceding ordinary diff is the sole desired-update authority;
+any ordinary preview failure or malformed post-refresh desired event fails
+closed. Generated non-secret String SSM parameter values are compared only in
 memory; secret payloads remain unsupported and block.
 
 The generated contract is Slice-scoped and protected planning runs under the

package/src/generators/slice/built-in-plan-infrastructure-safety-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"built-in-plan-infrastructure-safety-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-infrastructure-safety-files.ts"],"names":[],"mappings":";;AAGA,wFAoTC;AAvTD,uEAAiD;AAEjD,gBAAgB;AAChB,SAAgB,sCAAsC,CACpD,IAAY;IAEZ,OAAO;QACL,uCAAuC,EAAE,IAAA,8BAAI,EAAC;YAC5C,SAAS,EAAE;gBACT,aAAa,EAAE,KAAK;gBACpB,sBAAsB,EAAE;oBACtB,UAAU;oBACV,WAAW;oBACX,aAAa;oBACb,YAAY;oBACZ,cAAc;iBACf;gBACD,4BAA4B,EAAE,IAAI;gBAClC,wBAAwB,EAAE,IAAI;gBAC9B,sBAAsB,EAAE,IAAI;aAC7B;YACD,KAAK,EAAE;gBACL,QAAQ,EAAE;oBACR;wBACE,SAAS,EAAE,mDAAmD;wBAC9D,EAAE,EAAE,4BAA4B;wBAChC,OAAO,EAAE,0BAA0B;qBACpC;oBACD;wBACE,SAAS,EAAE,iCAAiC;wBAC5C,EAAE,EAAE,4BAA4B;wBAChC,OAAO,EAAE,yBAAyB;qBACnC;oBACD;wBACE,SAAS,EAAE,uCAAuC;wBAClD,EAAE,EAAE,iCAAiC;wBACrC,OAAO,EAAE,oBAAoB;qBAC9B;oBACD;wBACE,SAAS,EAAE,MAAM;wBACjB,EAAE,EAAE,2BAA2B;wBAC/B,OAAO,EAAE,+BAA+B;qBACzC;iBACF;gBACD,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,aAAa,CAAC;gBACjE,iBAAiB,EAAE,cAAc;gBACjC,yCAAyC,EAAE,IAAI;gBAC/C,kBAAkB,EAAE;oBAClB,qBAAqB,EAAE,MAAM;oBAC7B,yBAAyB,EAAE,MAAM;iBAClC;aACF;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,6DAA6D;gBACtE,QAAQ,EAAE,4CAA4C;gBACtD,KAAK,EAAE,eAAe;gBACtB,cAAc,EAAE,0CAA0C;gBAC1D,aAAa,EAAE,uDAAuD;gBACtE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,QAAQ;aAClB;YACD,MAAM,EAAE;gBACN,oBAAoB,EAAE;oBACpB,oCAAoC;oBACpC,kCAAkC;oBAClC,wCAAwC;oBACxC,4CAA4C;iBAC7C;gBACD,gBAAgB,EAAE;oBAChB,0BAA0B;oBAC1B,0CAA0C;oBAC1C,8BAA8B;oBAC9B,kCAAkC;oBAClC,qCAAqC;oBACrC,2BAA2B;oBAC3B,wCAAwC;oBACxC,0CAA0C;oBAC1C,kCAAkC;oBAClC,4CAA4C;oBAC5C,gDAAgD;oBAChD,0DAA0D;oBAC1D,0BAA0B;oBAC1B,yBAAyB;oBACzB,8BAA8B;oBAC9B,yBAAyB;iBAC1B;gBACD,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EACf,0DAA0D;gBAC5D,iBAAiB,EAAE,gDAAgD;gBACnE,cAAc,EAAE,iCAAiC;gBACjD,sBAAsB,EAAE,+BAA+B;gBACvD,wBAAwB,EAAE,IAAI;gBAC9B,kBAAkB,EAAE,IAAI;gBACxB,yBAAyB,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;gBAC7D,aAAa,EAAE;oBACb,0BAA0B;oBAC1B,iBAAiB;oBACjB,yBAAyB;oBACzB,sBAAsB;oBACtB,qBAAqB;oBACrB,6BAA6B;oBAC7B,4CAA4C;iBAC7C;aACF;YACD,wBAAwB,EAAE;gBACxB,uCAAuC;gBACvC,oCAAoC;aACrC;YACD,SAAS,EAAE;gBACT,gCAAgC;gBAChC,qCAAqC;aACtC;YACD,WAAW,EAAE;gBACX,WAAW;gBACX,mBAAmB;gBACnB,mBAAmB;gBACnB,uBAAuB;gBACvB,yBAAyB;gBACzB,oBAAoB;gBACpB,sBAAsB;gBACtB,wBAAwB;gBACxB,SAAS;aACV;YACD,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC;QACF,iCAAiC,EAAE;;;;;;;;;;;;;;;;;;;;;6BAqBV,IAAI;;;;;;;;;;;;;;;;;;;;;CAqBhC;QACG,kCAAkC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyEvC;QACG,wCAAwC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiE7C;KACE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"built-in-plan-infrastructure-safety-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-infrastructure-safety-files.ts"],"names":[],"mappings":";;AAGA,wFA4WC;AA/WD,uEAAiD;AAEjD,gBAAgB;AAChB,SAAgB,sCAAsC,CACpD,IAAY;IAEZ,OAAO;QACL,uCAAuC,EAAE,IAAA,8BAAI,EAAC;YAC5C,SAAS,EAAE;gBACT,aAAa,EAAE,KAAK;gBACpB,sBAAsB,EAAE;oBACtB,UAAU;oBACV,WAAW;oBACX,aAAa;oBACb,YAAY;oBACZ,cAAc;iBACf;gBACD,4BAA4B,EAAE,IAAI;gBAClC,wBAAwB,EAAE,IAAI;gBAC9B,sBAAsB,EAAE,IAAI;aAC7B;YACD,KAAK,EAAE;gBACL,QAAQ,EAAE;oBACR;wBACE,SAAS,EAAE,mDAAmD;wBAC9D,EAAE,EAAE,4BAA4B;wBAChC,OAAO,EAAE,0BAA0B;qBACpC;oBACD;wBACE,SAAS,EAAE,iCAAiC;wBAC5C,EAAE,EAAE,4BAA4B;wBAChC,OAAO,EAAE,yBAAyB;qBACnC;oBACD;wBACE,SAAS,EAAE,uCAAuC;wBAClD,EAAE,EAAE,iCAAiC;wBACrC,OAAO,EAAE,oBAAoB;qBAC9B;oBACD;wBACE,SAAS,EAAE,MAAM;wBACjB,EAAE,EAAE,2BAA2B;wBAC/B,OAAO,EAAE,+BAA+B;qBACzC;iBACF;gBACD,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,aAAa,CAAC;gBACjE,iBAAiB,EAAE,cAAc;gBACjC,yCAAyC,EAAE,IAAI;gBAC/C,kBAAkB,EAAE;oBAClB,qBAAqB,EAAE,MAAM;oBAC7B,yBAAyB,EAAE,OAAO;iBACnC;aACF;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,6DAA6D;gBACtE,QAAQ,EAAE,4CAA4C;gBACtD,KAAK,EAAE,eAAe;gBACtB,cAAc,EAAE,0CAA0C;gBAC1D,aAAa,EAAE,uDAAuD;gBACtE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,QAAQ;aAClB;YACD,MAAM,EAAE;gBACN,cAAc,EAAE,EAAE;gBAClB,oBAAoB,EAAE;oBACpB,oCAAoC;oBACpC,gEAAgE;oBAChE,kCAAkC;oBAClC,wCAAwC;oBACxC,4CAA4C;iBAC7C;gBACD,qBAAqB,EAAE;oBACrB,uCAAuC;oBACvC,yDAAyD;oBACzD,qDAAqD;oBACrD,uCAAuC;oBACvC,oCAAoC;oBACpC,wCAAwC;oBACxC,uCAAuC;oBACvC,gEAAgE;oBAChE,kCAAkC;oBAClC,wDAAwD;oBACxD,sEAAsE;oBACtE,wDAAwD;oBACxD,sCAAsC;oBACtC,kCAAkC;oBAClC,wDAAwD;oBACxD,4FAA4F;oBAC5F,8CAA8C;oBAC9C,iCAAiC;oBACjC,gCAAgC;oBAChC,sBAAsB;oBACtB,gCAAgC;oBAChC,yBAAyB;oBACzB,qBAAqB;oBACrB,sBAAsB;oBACtB,iCAAiC;oBACjC,gBAAgB;oBAChB,aAAa;oBACb,4BAA4B;oBAC5B,aAAa;oBACb,iBAAiB;oBACjB,yBAAyB;oBACzB,+BAA+B;oBAC/B,kBAAkB;oBAClB,gBAAgB;oBAChB,eAAe;oBACf,gBAAgB;oBAChB,cAAc;oBACd,aAAa;oBACb,iBAAiB;oBACjB,kBAAkB;oBAClB,iBAAiB;iBAClB;gBACD,gBAAgB,EAAE;oBAChB,0BAA0B;oBAC1B,0CAA0C;oBAC1C,8BAA8B;oBAC9B,8BAA8B;oBAC9B,kCAAkC;oBAClC,qCAAqC;oBACrC,2BAA2B;oBAC3B,wCAAwC;oBACxC,0CAA0C;oBAC1C,kCAAkC;oBAClC,4CAA4C;oBAC5C,0BAA0B;oBAC1B,yBAAyB;oBACzB,8BAA8B;oBAC9B,yBAAyB;oBACzB,mCAAmC;iBACpC;gBACD,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EACf,0DAA0D;gBAC5D,iBAAiB,EAAE,gDAAgD;gBACnE,cAAc,EAAE,iCAAiC;gBACjD,sBAAsB,EAAE,+BAA+B;gBACvD,wBAAwB,EAAE,IAAI;gBAC9B,kBAAkB,EAAE,IAAI;gBACxB,yBAAyB,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;gBAC7D,aAAa,EAAE;oBACb,qEAAqE;oBACrE,gCAAgC;oBAChC,2CAA2C;oBAC3C,0BAA0B;oBAC1B,qBAAqB;oBACrB,iBAAiB;oBACjB,yBAAyB;oBACzB,sBAAsB;oBACtB,kCAAkC;oBAClC,qBAAqB;oBACrB,6BAA6B;oBAC7B,sCAAsC;oBACtC,4CAA4C;iBAC7C;aACF;YACD,wBAAwB,EAAE;gBACxB,uCAAuC;gBACvC,oCAAoC;aACrC;YACD,SAAS,EAAE;gBACT,gCAAgC;gBAChC,qCAAqC;aACtC;YACD,WAAW,EAAE;gBACX,WAAW;gBACX,mBAAmB;gBACnB,mBAAmB;gBACnB,uBAAuB;gBACvB,yBAAyB;gBACzB,oBAAoB;gBACpB,sBAAsB;gBACtB,wBAAwB;gBACxB,SAAS;aACV;YACD,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC;QACF,iCAAiC,EAAE;;;;;;;;;;;;;;;;;;;;;6BAqBV,IAAI;;;;;;;;;;;;;;;;;;;;;CAqBhC;QACG,kCAAkC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyEvC;QACG,wCAAwC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsE7C;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-metadata-files.js

@@ -202,6 +202,7 @@ declare global {
     ...values: unknown[]
   ) => unknown;
   const $jsonStringify: (value: unknown) => unknown;
+  const $output: (value: unknown) => any;
   const $transform: any;
   const $util: any;
 }

package/src/generators/slice/built-in-plan-metadata-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"built-in-plan-metadata-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-metadata-files.ts"],"names":[],"mappings":";;AAIA,4DAyNC;AA5ND,uEAAiD;AAEjD,gBAAgB;AAChB,SAAgB,wBAAwB,CACtC,IAAY,EACZ,KAAa,EACb,UAAkB,EAClB,SAAmC;IAEnC,OAAO;QACL,qBAAqB,EAAE,IAAA,8BAAI,EAAC,SAAS,CAAC;QACtC,WAAW,EAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;oBAyBN,IAAI;;;IAGpB,IAAI;;;;;gDAKwC,KAAK,IAAI,IAAI;;;;;;mBAM1C,IAAI;;;;;;;;;;;;;;gBAcP,IAAI;;;;;;wCAMoB,IAAI;;qBAEvB,IAAI;;;oCAGW,IAAI;;;;;;;;;;;;;;;;;;;;;;CAsBvC;QACG,oBAAoB,EAAE;IACtB,UAAU;IACV,UAAU;SACL,UAAU;SACV,UAAU;;;eAGJ,UAAU;CACxB;QACG,6BAA6B,EAAE,IAAA,8BAAI,EAAC;YAClC,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,CAAC;SACjB,CAAC;QACF,sBAAsB,EAAE,KAAK,IAAI;;;;;;;;;;;;;CAapC;QACG,mBAAmB,EAAE,KAAK,IAAI;;;;;gBAKlB,IAAI;;;CAGnB;QACG,kBAAkB,EAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DhC;QACG,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;;MAmBlB,UAAU;;;;;CAKf;KACE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"built-in-plan-metadata-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-metadata-files.ts"],"names":[],"mappings":";;AAIA,4DA0NC;AA7ND,uEAAiD;AAEjD,gBAAgB;AAChB,SAAgB,wBAAwB,CACtC,IAAY,EACZ,KAAa,EACb,UAAkB,EAClB,SAAmC;IAEnC,OAAO;QACL,qBAAqB,EAAE,IAAA,8BAAI,EAAC,SAAS,CAAC;QACtC,WAAW,EAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;oBAyBN,IAAI;;;IAGpB,IAAI;;;;;gDAKwC,KAAK,IAAI,IAAI;;;;;;mBAM1C,IAAI;;;;;;;;;;;;;;gBAcP,IAAI;;;;;;wCAMoB,IAAI;;qBAEvB,IAAI;;;oCAGW,IAAI;;;;;;;;;;;;;;;;;;;;;;CAsBvC;QACG,oBAAoB,EAAE;IACtB,UAAU;IACV,UAAU;SACL,UAAU;SACV,UAAU;;;eAGJ,UAAU;CACxB;QACG,6BAA6B,EAAE,IAAA,8BAAI,EAAC;YAClC,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,CAAC;SACjB,CAAC;QACF,sBAAsB,EAAE,KAAK,IAAI;;;;;;;;;;;;;CAapC;QACG,mBAAmB,EAAE,KAAK,IAAI;;;;;gBAKlB,IAAI;;;CAGnB;QACG,kBAAkB,EAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DhC;QACG,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;;;MAoBlB,UAAU;;;;;CAKf;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-operations-files.js

@@ -7,6 +7,10 @@ const logging_registry_js_1 = require("../logging-registry.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 /** @internal */
 function renderSliceOperationsFiles(name, workspace = 'workspace', frameworkVersion = 'workspace-installed') {
+    const pascalName = name
+        .split('-')
+        .map((segment) => segment[0]?.toUpperCase() + segment.slice(1))
+        .join('');
     return {
         'operations/features.json': (0, built_in_plan_shared_js_1.json)({
             features: [
@@ -532,7 +536,130 @@ process.stdout.write(
         'sst-env.d.ts': `// Bootstrap placeholder. SST overwrites this file after install, dev, or deploy.
 export {};
 `,
-        'sst.config.ts': `export default $config({
+        'sst.config.ts': `const ebkNextBuildEnvironmentKeys = new Set([
+  'AUTH_CLIENT_ID',
+  'AUTH_USER_POOL_ID',
+  'CI',
+  'EBK_APPCONFIG_APPLICATION_ID',
+  'EBK_APPCONFIG_ENVIRONMENT_ID',
+  'EBK_APPCONFIG_PROFILE_ID',
+  'EBK_FLEET_ORIGIN',
+  'EBK_PERFORMANCE_ACCOUNT_FINGERPRINT',
+  'EBK_PERFORMANCE_CANDIDATE_DIGEST',
+  'EBK_PERFORMANCE_LOAD_ENABLED',
+  'EBK_PERFORMANCE_ORIGIN',
+  'EBK_PERFORMANCE_REGION',
+  'EBK_PERFORMANCE_RELEASE_ID',
+  'EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST',
+  'EBK_PERFORMANCE_SLICE',
+  'EBK_SECURE_COOKIES',
+  'EBK_SOURCE_COMMIT',
+  'EBK_STAGE',
+  'EVENT_BUS_NAME',
+  'NEXT_PUBLIC_API_URL',
+  'NEXT_TELEMETRY_DISABLED',
+  'SST',
+  'SST_RESOURCE_App',
+  'SST_RESOURCE_${pascalName}PrimaryDatabase',
+  'SST_RESOURCE_FoundationIdentity',
+]);
+
+const ebkRequiredNextBuildEnvironmentKeys = [
+  'AUTH_CLIENT_ID',
+  'AUTH_USER_POOL_ID',
+  'CI',
+  'EBK_FLEET_ORIGIN',
+  'EBK_PERFORMANCE_ACCOUNT_FINGERPRINT',
+  'EBK_PERFORMANCE_CANDIDATE_DIGEST',
+  'EBK_PERFORMANCE_LOAD_ENABLED',
+  'EBK_PERFORMANCE_ORIGIN',
+  'EBK_PERFORMANCE_REGION',
+  'EBK_PERFORMANCE_RELEASE_ID',
+  'EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST',
+  'EBK_PERFORMANCE_SLICE',
+  'EBK_SECURE_COOKIES',
+  'EBK_SOURCE_COMMIT',
+  'EBK_STAGE',
+  'EVENT_BUS_NAME',
+  'NEXT_PUBLIC_API_URL',
+  'NEXT_TELEMETRY_DISABLED',
+  'SST',
+  'SST_RESOURCE_App',
+  'SST_RESOURCE_${pascalName}PrimaryDatabase',
+  'SST_RESOURCE_FoundationIdentity',
+] as const;
+
+const ebkLocalCommandResource = {
+  __pulumiType: 'command:local:Command',
+} as unknown as new (
+  name: string,
+  args: { environment?: unknown; triggers?: unknown },
+  options?: unknown,
+) => unknown;
+
+const ebkSourceCommitPattern = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+
+function exactNextBuildEnvironment(value: unknown): Record<string, string> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    throw new Error('The Next build environment must resolve to one object.');
+  }
+  const environment = value as Record<string, unknown>;
+  const retained = Object.fromEntries(
+    Object.entries(environment)
+      .filter(([key]) => ebkNextBuildEnvironmentKeys.has(key))
+      .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+  );
+  for (const key of ebkRequiredNextBuildEnvironmentKeys) {
+    if (typeof retained[key] !== 'string') {
+      throw new Error('The Next build environment omitted ' + key + '.');
+    }
+  }
+  return retained as Record<string, string>;
+}
+
+// SST 4.17.1 installs its transform globals only while evaluating $config.run.
+// Register there, before infrastructure construction, rather than at module
+// load. The explicit Slice buildCommand separately routes diff/refresh invokes
+// through the wrapper.
+function registerExactNextBuildEnvironmentTransform(): void {
+  $transform(
+    ebkLocalCommandResource,
+    (
+      args: { environment?: unknown; triggers?: unknown },
+      _options: unknown,
+      resourceName: string,
+    ) => {
+      if (resourceName !== '${pascalName}WebBuilder') return;
+      const unresolvedEnvironment = args.environment as Record<
+        string,
+        unknown
+      >;
+      const resolveEnvironment = (environment: Record<string, unknown>) =>
+        exactNextBuildEnvironment({
+          ...environment,
+          CI: 'true',
+          NEXT_TELEMETRY_DISABLED: '1',
+        });
+      args.environment = $output(unresolvedEnvironment).apply(
+        resolveEnvironment,
+      );
+      args.triggers = $output(unresolvedEnvironment).apply(
+        (environment: Record<string, unknown>) => {
+        const resolved = resolveEnvironment(environment);
+        const sourceCommit = resolved.EBK_SOURCE_COMMIT.trim();
+        if (!ebkSourceCommitPattern.test(sourceCommit)) {
+          throw new Error(
+            'The Next builder requires one exact EBK source commit.',
+          );
+        }
+        return [sourceCommit];
+        },
+      );
+    },
+  );
+}
+
+export default $config({
   app(input: { stage?: string } | undefined) {
     const stage = input?.stage ?? 'development';
     const production = input?.stage === 'production';
@@ -544,16 +671,17 @@ export {};
       providers: {
         aws: {
           defaultTags: {
+            // SST contributes sst:app and sst:stage. Keep the provider baseline
+            // at eight tags so generated S3 asset objects remain within AWS's
+            // hard ten-tag object limit. Performance coverage requires this
+            // provider baseline; repository and production-profile identity is
+            // supplementary on resources using createStandardResourceTags.
             tags: {
               'ebk:cost-allocation': 'unallocated',
               'ebk:cost-scope': '${workspace}/${name}/' + stage,
               'ebk:framework-version': '${frameworkVersion}',
               'ebk:managed-by': 'empire-builder-kit',
               'ebk:owner': '${name}-product',
-              'ebk:production-profile':
-                process.env.EBK_PRODUCTION_PROFILE ?? 'standard',
-              'ebk:repository':
-                process.env.GITHUB_REPOSITORY ?? '${workspace}',
               'ebk:slice': '${name}',
               'ebk:stage': stage,
               'ebk:workspace': '${workspace}',
@@ -565,6 +693,7 @@ export {};
     };
   },
   async run() {
+    registerExactNextBuildEnvironmentTransform();
     const personalStagePattern = /^personal-[a-z0-9](?:[a-z0-9-]{0,34}[a-z0-9])?$/;
     if ($dev && !personalStagePattern.test($app.stage)) {
       throw new Error(
@@ -588,6 +717,314 @@ export {};
     return app(workloadRoles);
   },
 });
+`,
+        'tools/ebk-next-build-environment.mjs': `import { spawnSync } from 'node:child_process';
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+
+// SST diff/refresh invokes the build outside the Command resource transform.
+// Reconstruct the child environment here so every builder path has one policy.
+const applicationKeys = new Set(${JSON.stringify([
+            'AUTH_CLIENT_ID',
+            'AUTH_USER_POOL_ID',
+            'CI',
+            'EBK_APPCONFIG_APPLICATION_ID',
+            'EBK_APPCONFIG_ENVIRONMENT_ID',
+            'EBK_APPCONFIG_PROFILE_ID',
+            'EBK_FLEET_ORIGIN',
+            'EBK_PERFORMANCE_ACCOUNT_FINGERPRINT',
+            'EBK_PERFORMANCE_CANDIDATE_DIGEST',
+            'EBK_PERFORMANCE_LOAD_ENABLED',
+            'EBK_PERFORMANCE_ORIGIN',
+            'EBK_PERFORMANCE_REGION',
+            'EBK_PERFORMANCE_RELEASE_ID',
+            'EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST',
+            'EBK_PERFORMANCE_SLICE',
+            'EBK_SECURE_COOKIES',
+            'EBK_SOURCE_COMMIT',
+            'EBK_STAGE',
+            'EVENT_BUS_NAME',
+            'NEXT_PUBLIC_API_URL',
+            'NEXT_TELEMETRY_DISABLED',
+            'SST',
+            'SST_RESOURCE_App',
+            `SST_RESOURCE_${pascalName}PrimaryDatabase`,
+            'SST_RESOURCE_FoundationIdentity',
+        ], null, 2)});
+const operatingKeys = new Set(
+  [
+    'APPDATA',
+    'COMSPEC',
+    'HOME',
+    'LANG',
+    'LC_ALL',
+    'LOCALAPPDATA',
+    'PATH',
+    'PATHEXT',
+    'PROGRAMDATA',
+    'SHELL',
+    'SYSTEMROOT',
+    'TEMP',
+    'TERM',
+    'TMP',
+    'TMPDIR',
+    'TZ',
+    'USERPROFILE',
+  ].map((key) => key.toLowerCase()),
+);
+
+if (process.argv.length !== 2) {
+  throw new Error('The Next build wrapper does not accept arguments.');
+}
+
+const root = realpathSync(process.cwd());
+const openNextRoot = resolve(root, '.open-next');
+const priorSealedFunctionBundles = [
+  resolve(root, '.open-next/image-optimization-function'),
+  resolve(root, '.open-next/server-functions/default'),
+];
+if (process.platform === 'darwin') {
+  for (const priorBundle of priorSealedFunctionBundles) {
+    if (!existsSync(priorBundle)) continue;
+    if (realpathSync(priorBundle) !== priorBundle) {
+      throw new Error(
+        'The prior sealed OpenNext Function bundle has an invalid identity.',
+      );
+    }
+    const pendingDirectories = [{ depth: 0, path: priorBundle }];
+    let observedDirectories = 0;
+    while (pendingDirectories.length > 0) {
+      const current = pendingDirectories.pop();
+      if (!current) break;
+      if (current.depth > 64) {
+        throw new Error(
+          'The prior sealed OpenNext Function bundle exceeds its depth bound.',
+        );
+      }
+      observedDirectories += 1;
+      if (observedDirectories > 65_536) {
+        throw new Error(
+          'The prior sealed OpenNext Function bundle exceeds its directory bound.',
+        );
+      }
+      const identity = lstatSync(current.path, { bigint: true });
+      if (!identity.isDirectory() || identity.isSymbolicLink()) {
+        throw new Error(
+          'The prior sealed OpenNext Function directory changed identity.',
+        );
+      }
+      if ((identity.mode & 0o200n) === 0n) {
+        chmodSync(current.path, Number((identity.mode & 0o7_777n) | 0o200n));
+      }
+      for (const entry of readdirSync(current.path, {
+        withFileTypes: true,
+      }).sort((left, right) =>
+        left.name < right.name ? -1 : left.name > right.name ? 1 : 0,
+      )) {
+        if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+        const entryPath = join(current.path, entry.name);
+        const confined = relative(priorBundle, entryPath);
+        if (
+          confined === '..' ||
+          confined.startsWith('../') ||
+          resolve(priorBundle, confined) !== entryPath
+        ) {
+          throw new Error(
+            'The prior sealed OpenNext Function directory escapes its root.',
+          );
+        }
+        pendingDirectories.push({ depth: current.depth + 1, path: entryPath });
+      }
+    }
+  }
+  if (existsSync(openNextRoot)) {
+    const identity = lstatSync(openNextRoot, { bigint: true });
+    if (
+      !identity.isDirectory() ||
+      identity.isSymbolicLink() ||
+      realpathSync(openNextRoot) !== openNextRoot
+    ) {
+      throw new Error('The prior OpenNext build root has an invalid identity.');
+    }
+    rmSync(openNextRoot, {
+      force: true,
+      maxRetries: 8,
+      recursive: true,
+      retryDelay: 50,
+    });
+    if (existsSync(openNextRoot)) {
+      throw new Error('The prior OpenNext build root was not removed.');
+    }
+  }
+}
+
+const environment = Object.fromEntries(
+  Object.entries(process.env)
+    .filter(
+      ([key, value]) =>
+        typeof value === 'string' &&
+        (applicationKeys.has(key) || operatingKeys.has(key.toLowerCase())),
+    )
+    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+);
+const windows = process.platform === 'win32';
+const result = spawnSync(
+  windows ? 'cmd.exe' : 'npx',
+  windows
+    ? ['/d', '/s', '/c', 'npx --yes @opennextjs/aws@3.9.14 build']
+    : ['--yes', '@opennextjs/aws@3.9.14', 'build'],
+  {
+    cwd: process.cwd(),
+    env: environment,
+    stdio: 'inherit',
+    windowsHide: true,
+  },
+);
+if (result.error) throw result.error;
+if (result.signal) {
+  throw new Error('The Next build command exited from signal ' + result.signal + '.');
+}
+if (result.status !== 0) {
+  process.exitCode = result.status ?? 1;
+} else {
+  // Finder can create .DS_Store files anywhere below OpenNext's assembled
+  // output while the macOS build is running. They have no runtime meaning,
+  // but SST includes them in Lambda archives, so their presence makes one
+  // immutable source alternate between different code object hashes. Remove
+  // only this exact derived metadata before SST archives the output.
+  if (realpathSync(openNextRoot) !== openNextRoot) {
+    throw new Error('The OpenNext build root has an invalid identity.');
+  }
+  const pendingDirectories = [{ depth: 0, path: openNextRoot }];
+  let observedEntries = 0;
+  let removedFinderMetadata = 0;
+  while (pendingDirectories.length > 0) {
+    const current = pendingDirectories.pop();
+    if (!current) break;
+    if (current.depth > 64) {
+      throw new Error('The OpenNext build tree exceeds its depth bound.');
+    }
+    for (const entry of readdirSync(current.path, { withFileTypes: true }).sort(
+      (left, right) =>
+        left.name < right.name ? -1 : left.name > right.name ? 1 : 0,
+    )) {
+      observedEntries += 1;
+      if (observedEntries > 65_536) {
+        throw new Error('The OpenNext build tree exceeds its entry bound.');
+      }
+      const entryPath = join(current.path, entry.name);
+      const identity = lstatSync(entryPath, { bigint: true });
+      if (entry.name === '.DS_Store') {
+        removedFinderMetadata += 1;
+        if (
+          removedFinderMetadata > 256 ||
+          !identity.isFile() ||
+          identity.isSymbolicLink() ||
+          identity.nlink !== 1n ||
+          identity.size > 1_048_576n
+        ) {
+          throw new Error('The OpenNext Finder metadata has an invalid identity.');
+        }
+        unlinkSync(entryPath);
+        if (existsSync(entryPath)) {
+          throw new Error('The OpenNext Finder metadata was not removed.');
+        }
+        continue;
+      }
+      if (identity.isDirectory() && !identity.isSymbolicLink()) {
+        const confined = relative(openNextRoot, entryPath);
+        if (
+          confined === '..' ||
+          confined.startsWith('../') ||
+          resolve(openNextRoot, confined) !== entryPath
+        ) {
+          throw new Error('The OpenNext build entry escapes its root.');
+        }
+        pendingDirectories.push({ depth: current.depth + 1, path: entryPath });
+      }
+    }
+  }
+
+  // OpenNext 3.9.14 installs the image optimizer dependencies in an npm
+  // mkdtemp directory and copies npm's hidden package lock into the deployed
+  // bundle. npm records that random directory basename as the lock name. The
+  // name has no runtime meaning, but without this exact normalization two
+  // builds of one source produce different Lambda ZIP bytes.
+  const lockPath = resolve(
+    process.cwd(),
+    '.open-next/image-optimization-function/node_modules/.package-lock.json',
+  );
+  const lockParent = realpathSync(dirname(lockPath));
+  const confinedParent = relative(root, lockParent);
+  if (
+    confinedParent === '..' ||
+    confinedParent.startsWith('../') ||
+    resolve(lockParent, '.package-lock.json') !== lockPath
+  ) {
+    throw new Error('The OpenNext image optimizer package lock escapes the build root.');
+  }
+  const before = lstatSync(lockPath, { bigint: true });
+  if (
+    !before.isFile() ||
+    before.isSymbolicLink() ||
+    before.nlink !== 1n ||
+    before.size < 2n ||
+    before.size > 131_072n
+  ) {
+    throw new Error('The OpenNext image optimizer package lock has an invalid identity.');
+  }
+  const raw = readFileSync(lockPath, 'utf8');
+  if (Buffer.byteLength(raw, 'utf8') !== Number(before.size)) {
+    throw new Error('The OpenNext image optimizer package lock changed while reading.');
+  }
+  const parsed = JSON.parse(raw);
+  if (
+    parsed === null ||
+    typeof parsed !== 'object' ||
+    Array.isArray(parsed) ||
+    !/^open-next-install-image-optimization-function[A-Za-z0-9]{6}$/u.test(
+      parsed.name,
+    ) ||
+    parsed.lockfileVersion !== 3 ||
+    parsed.requires !== true ||
+    parsed.packages === null ||
+    typeof parsed.packages !== 'object' ||
+    Array.isArray(parsed.packages)
+  ) {
+    throw new Error('The OpenNext image optimizer package lock shape is unsupported.');
+  }
+  parsed.name = 'open-next-image-optimization-function';
+  const normalized = JSON.stringify(parsed, null, 2) + '\\n';
+  const temporaryPath = join(lockParent, '.package-lock.json.ebk-normalized');
+  writeFileSync(temporaryPath, normalized, {
+    encoding: 'utf8',
+    flag: 'wx',
+    mode: Number(before.mode & 0o777n),
+  });
+  chmodSync(temporaryPath, Number(before.mode & 0o777n));
+  renameSync(temporaryPath, lockPath);
+  const after = lstatSync(lockPath, { bigint: true });
+  if (
+    !after.isFile() ||
+    after.isSymbolicLink() ||
+    after.nlink !== 1n ||
+    after.mode !== before.mode ||
+    readFileSync(lockPath, 'utf8') !== normalized
+  ) {
+    throw new Error('The normalized OpenNext image optimizer package lock is invalid.');
+  }
+}
 `,
         'tsconfig.json': (0, built_in_plan_shared_js_1.json)({
             extends: '../../tsconfig.base.json',