@empire-builder-kit/nx 1.0.0-rc.37 → 1.0.0-rc.39

package/README.md

@@ -6,12 +6,30 @@ Generators:
 
 - `preset` (composed by `@empire-builder-kit/create`)
 - `slice`
+- `sql` (report-first additive Standard SQL requirement)
 - `function`
 - `service`
 - `job`
 - `repository-policy`
 - `upgrade`
 
+Standard starts with DynamoDB. When a feature needs relational integrity or
+joins, add SQL to its existing Slice without changing the default record store:
+
+```bash
+pnpm nx g @empire-builder-kit/nx:sql billing --reason="Invoice ledger needs relational constraints and reporting joins."
+pnpm nx g @empire-builder-kit/nx:sql billing --reason="Invoice ledger needs relational constraints and reporting joins." --apply
+```
+
+The first command reports the paired Foundation/Slice managed upgrade. The
+second applies source changes and the normal dependency installation; neither
+command calls AWS, copies data, or deploys resources. Inspect the resource/cost
+implications, then use the normal fleet and deployment lifecycle. Existing
+capacity choices and seeded features are retained. SQL remains declared even
+if its last consumer is removed; retirement is a separate explicit operation.
+External Blueprints declare requirements through their own owner, not this
+Standard-only generator. See the [database contract](../../docs/database-contract.md).
+
 The package also owns Repository Operating Policy validation and protected
 deployment planning, generated Git routing and report-first GitHub bootstrap,
 Foundation discovery/profile preflight, trusted external Blueprint execution,

package/executors.json

@@ -100,6 +100,11 @@
       "schema": "./src/executors/sst-lifecycle/schema.json",
       "description": "Run SST development mode through the workspace-pinned binary."
     },
+    "dev-task-cleanup": {
+      "implementation": "./src/executors/dev-task-cleanup/dev-task-cleanup",
+      "schema": "./src/executors/dev-task-cleanup/schema.json",
+      "description": "Internal cleanup of the current worktree's exact task Slice stack using verified development authority."
+    },
     "refresh": {
       "implementation": "./src/executors/refresh/refresh",
       "schema": "./src/executors/sst-lifecycle/schema.json",

package/generators.json

@@ -1,5 +1,10 @@
 {
   "generators": {
+    "blueprint": {
+      "factory": "./src/generators/blueprint/blueprint",
+      "schema": "./src/generators/blueprint/schema.json",
+      "description": "Scaffold an adopter-owned Blueprint package, templates and verification without executing publisher code or granting protected trust."
+    },
     "function": {
       "factory": "./src/generators/function/function",
       "schema": "./src/generators/function/schema.json",
@@ -20,6 +25,11 @@
       "schema": "./src/generators/slice/schema.json",
       "description": "Generate an EBK v1 product slice from the built-in or a trusted external Blueprint."
     },
+    "sql": {
+      "factory": "./src/generators/sql/sql",
+      "schema": "./src/generators/sql/schema.json",
+      "description": "Report or apply an additive SQL requirement to a Standard Slice and its Foundation; never deploy or move existing data."
+    },
     "repository-policy": {
       "factory": "./src/generators/repository-policy/repository-policy",
       "schema": "./src/generators/repository-policy/schema.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.37",
+  "version": "1.0.0-rc.39",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -16,6 +16,21 @@
   "author": "Gupta-Leary Technology Consulting LLC",
   "license": "Apache-2.0",
   "type": "commonjs",
+  "files": [
+    "src/**/*.js",
+    "src/**/*.d.ts",
+    "src/schemas/*.json",
+    "src/generators/*/schema.json",
+    "src/executors/*/schema.json",
+    "generators.json",
+    "executors.json",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "!**/*.{spec,test,fixtures}.{js,d.ts}",
+    "!src/performance/test-fixtures.{js,d.ts}",
+    "!**/{fixtures,__fixtures__,tests,__tests__}/**"
+  ],
   "bin": {
     "ebk": "./src/cli/bootstrap.js"
   },
@@ -130,7 +145,7 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.37",
+    "@empire-builder-kit/runtime": "1.0.0-rc.39",
     "@aws-sdk/client-cloudfront": "^3.700.0",
     "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
@@ -144,9 +159,11 @@
     "@aws-sdk/client-wafv2": "^3.700.0",
     "@aws-sdk/credential-providers": "^3.700.0",
     "ajv": "8.20.0",
+    "nx": "23.1.0",
     "prettier": "^3.8.2",
     "semver": "7.7.4",
     "tslib": "^2.3.0",
+    "typescript": "~5.9.2",
     "yaml": "2.9.0"
   },
   "repository": {
@@ -161,5 +178,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "2db86ae81a5b153584440b89e1524f549565be3d"
+  "gitHead": "2875c7b517e99e6eab20c6efa31dfeb932b410f8"
 }

package/src/aws-authority/index.d.ts

@@ -1 +1,2 @@
+export * from './lambda-policy-ordering.js';
 export * from './stage-authority.js';

package/src/aws-authority/index.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./lambda-policy-ordering.js"), exports);
 tslib_1.__exportStar(require("./stage-authority.js"), exports);
 //# sourceMappingURL=index.js.map

package/src/aws-authority/lambda-policy-ordering.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Orders Lambda resource-policy writes that the pinned providers otherwise race.
+ *
+ * Creating a Function URL with `NONE` authorization makes the pinned AWS
+ * provider add a public-access statement to the function policy without the
+ * per-function lock that serializes standalone `lambda.Permission` writes. The
+ * pinned SST Function and SSR site components create those permissions next
+ * to the URL with no ordering, so Lambda can reject the URL's write with a
+ * `ResourceConflictException` ("concurrent update operation"). Each Function
+ * URL and Permission registered under the same top-level component therefore
+ * depends on the previous one. `dependsOn` adds no property diff, so existing
+ * stacks are neither replaced nor updated by this ordering.
+ */
+export declare const LAMBDA_POLICY_WRITE_TYPES: readonly ["aws:lambda/functionUrl:FunctionUrl", "aws:lambda/permission:Permission"];
+export interface LambdaPolicyTransformationArgs {
+    resource: object;
+    type: string;
+    name: string;
+    props: Record<string, unknown>;
+    opts?: {
+        parent?: object;
+    };
+}
+export interface LambdaPolicyTransformationResult {
+    props: Record<string, unknown>;
+    opts: object;
+}
+export interface LambdaPolicyWriteOrderingInput {
+    /** Pulumi `runtime.registerStackTransformation` (SST: `$util.runtime`). */
+    registerStackTransformation: (transformation: (args: LambdaPolicyTransformationArgs) => LambdaPolicyTransformationResult | undefined) => void;
+    /** Pulumi `mergeOptions` (SST: `$util.mergeOptions`). */
+    mergeOptions: (first: object | undefined, second: object | undefined) => object;
+}
+export interface LambdaPolicyWriteOrderingContract {
+    orderedTypes: readonly string[];
+    scope: 'top-level-component';
+}
+export declare function installLambdaPolicyWriteOrdering(input: LambdaPolicyWriteOrderingInput): LambdaPolicyWriteOrderingContract;

package/src/aws-authority/lambda-policy-ordering.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * Orders Lambda resource-policy writes that the pinned providers otherwise race.
+ *
+ * Creating a Function URL with `NONE` authorization makes the pinned AWS
+ * provider add a public-access statement to the function policy without the
+ * per-function lock that serializes standalone `lambda.Permission` writes. The
+ * pinned SST Function and SSR site components create those permissions next
+ * to the URL with no ordering, so Lambda can reject the URL's write with a
+ * `ResourceConflictException` ("concurrent update operation"). Each Function
+ * URL and Permission registered under the same top-level component therefore
+ * depends on the previous one. `dependsOn` adds no property diff, so existing
+ * stacks are neither replaced nor updated by this ordering.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LAMBDA_POLICY_WRITE_TYPES = void 0;
+exports.installLambdaPolicyWriteOrdering = installLambdaPolicyWriteOrdering;
+exports.LAMBDA_POLICY_WRITE_TYPES = [
+    'aws:lambda/functionUrl:FunctionUrl',
+    'aws:lambda/permission:Permission',
+];
+const orderedTypes = new Set(exports.LAMBDA_POLICY_WRITE_TYPES);
+function installLambdaPolicyWriteOrdering(input) {
+    if (typeof input?.registerStackTransformation !== 'function' ||
+        typeof input.mergeOptions !== 'function') {
+        throw new Error('Lambda policy write ordering requires the Pulumi stack transformation and option merge functions.');
+    }
+    const parents = new WeakMap();
+    const previousInScope = new Map();
+    // Parentless policy writes share one scope rather than racing each other.
+    const stackScope = {};
+    input.registerStackTransformation((args) => {
+        const parent = args.opts?.parent;
+        parents.set(args.resource, parent);
+        if (!orderedTypes.has(args.type))
+            return undefined;
+        let scope = stackScope;
+        for (let current = parent; current !== undefined;) {
+            scope = current;
+            current = parents.get(current);
+        }
+        const previous = previousInScope.get(scope);
+        previousInScope.set(scope, args.resource);
+        if (previous === undefined)
+            return undefined;
+        return {
+            props: args.props,
+            opts: input.mergeOptions(args.opts, { dependsOn: [previous] }),
+        };
+    });
+    return {
+        orderedTypes: exports.LAMBDA_POLICY_WRITE_TYPES,
+        scope: 'top-level-component',
+    };
+}
+//# sourceMappingURL=lambda-policy-ordering.js.map

package/src/aws-authority/stage-authority.d.ts

@@ -11,14 +11,19 @@ export type StageAuthorityPartition = (typeof STAGE_AUTHORITY_PARTITIONS)[number
 export type StageAuthorityDeploymentPolicyKind = (typeof STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS)[number];
 type ConditionValue = string | readonly string[];
 type ConditionEntries = Readonly<Record<string, ConditionValue>>;
-export interface StageAuthorityPolicyStatement {
-    Action: readonly string[];
+export type StageAuthorityPolicyStatement = {
     Condition?: Readonly<Record<string, ConditionEntries>>;
     Effect: 'Allow' | 'Deny';
     NotResource?: readonly string[];
     Resource?: readonly string[];
     Sid: string;
-}
+} & ({
+    Action: readonly string[];
+    NotAction?: never;
+} | {
+    Action?: never;
+    NotAction: readonly string[];
+});
 export interface StageAuthorityPolicyDocument {
     Statement: readonly StageAuthorityPolicyStatement[];
     Version: '2012-10-17';
@@ -90,6 +95,8 @@ export interface StageIamBoundaryTransformInput {
     registerTransform: (resource: unknown, transform: (args: StageIamBoundaryTransformArgs) => void) => void;
     roleResource: unknown;
     stage: StageAuthorityStage;
+    /** Internal generated resource identity; never a deployment-stage override. */
+    resourceStage?: string;
 }
 /** Native lifecycle required by the generated machine-authorization nested
  * stack. Recovery-only and stack-policy mutation APIs remain ungranted. */
@@ -165,6 +172,7 @@ export declare const STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS: readonly
  * account/Region closed. They intentionally do not claim same-account stage
  * isolation, because native SST owns account-shared bootstrap resources. */
 export declare const STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES: readonly string[];
+export declare const STAGE_AUTHORITY_CLOUDCONTROL_EDGE_MUTATION_ACTIONS: readonly string[];
 /** SST 4.17.1 resolves the generated nonproduction VPC's EC2 NAT image from
  * this commercial-partition fck-nat publisher. The generated development
  * bastion reuses that NAT instance, while production uses managed NAT. No