@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/README.md

@@ -6,12 +6,30 @@ Generators:
 
 - `preset` (composed by `@empire-builder-kit/create`)
 - `slice`
+- `sql` (report-first additive Standard SQL requirement)
 - `function`
 - `service`
 - `job`
 - `repository-policy`
 - `upgrade`
 
+Standard starts with DynamoDB. When a feature needs relational integrity or
+joins, add SQL to its existing Slice without changing the default record store:
+
+```bash
+pnpm nx g @empire-builder-kit/nx:sql billing --reason="Invoice ledger needs relational constraints and reporting joins."
+pnpm nx g @empire-builder-kit/nx:sql billing --reason="Invoice ledger needs relational constraints and reporting joins." --apply
+```
+
+The first command reports the paired Foundation/Slice managed upgrade. The
+second applies source changes and the normal dependency installation; neither
+command calls AWS, copies data, or deploys resources. Inspect the resource/cost
+implications, then use the normal fleet and deployment lifecycle. Existing
+capacity choices and seeded features are retained. SQL remains declared even
+if its last consumer is removed; retirement is a separate explicit operation.
+External Blueprints declare requirements through their own owner, not this
+Standard-only generator. See the [database contract](../../docs/database-contract.md).
+
 The package also owns Repository Operating Policy validation and protected
 deployment planning, generated Git routing and report-first GitHub bootstrap,
 Foundation discovery/profile preflight, trusted external Blueprint execution,

package/executors.json

@@ -38,7 +38,17 @@
     "infrastructure-plan": {
       "implementation": "./src/executors/infrastructure-plan/infrastructure-plan",
       "schema": "./src/executors/infrastructure-plan/schema.json",
-      "description": "Run a pinned SST resource diff and fail closed on unapproved, stale, locked, drifted, or unknown protected plans."
+      "description": "Stream one advisory native SST diff through the exact committed stage authority without retaining mutation authority."
+    },
+    "local-deploy": {
+      "implementation": "./src/executors/local-deploy/local-deploy",
+      "schema": "./src/executors/local-deploy/schema.json",
+      "description": "Deploy one complete active stage through ordered native SST children, exact temporary AWS authority, migrations, smoke checks, and a bounded receipt."
+    },
+    "router-waf-rehearsal": {
+      "implementation": "./src/executors/router-waf-rehearsal/router-waf-rehearsal",
+      "schema": "./src/executors/router-waf-rehearsal/schema.json",
+      "description": "Run the bounded Router WAF rate probe, correlate its exact BLOCK sample and metric, and seal the committed blocking evidence."
     },
     "work-markers": {
       "implementation": "./src/executors/work-markers/work-markers",
@@ -70,6 +80,11 @@
       "schema": "./src/executors/secret-metadata/schema.json",
       "description": "Report or explicitly apply value-blind operator-secret container metadata for one Product Slice."
     },
+    "secret-initialize": {
+      "implementation": "./src/executors/secret-initialize/secret-initialize",
+      "schema": "./src/executors/secret-initialize/schema.json",
+      "description": "Report or explicitly initialize one declared machine-generated secret without accepting or returning its value."
+    },
     "secret-guardrails": {
       "implementation": "./src/executors/secret-guardrails/secret-guardrails",
       "schema": "./src/executors/secret-guardrails/schema.json",
@@ -85,6 +100,11 @@
       "schema": "./src/executors/sst-lifecycle/schema.json",
       "description": "Run SST development mode through the workspace-pinned binary."
     },
+    "dev-task-cleanup": {
+      "implementation": "./src/executors/dev-task-cleanup/dev-task-cleanup",
+      "schema": "./src/executors/dev-task-cleanup/schema.json",
+      "description": "Internal cleanup of the current worktree's exact task Slice stack using verified development authority."
+    },
     "refresh": {
       "implementation": "./src/executors/refresh/refresh",
       "schema": "./src/executors/sst-lifecycle/schema.json",

package/generators.json

@@ -1,5 +1,10 @@
 {
   "generators": {
+    "blueprint": {
+      "factory": "./src/generators/blueprint/blueprint",
+      "schema": "./src/generators/blueprint/schema.json",
+      "description": "Scaffold an adopter-owned Blueprint package, templates and verification without executing publisher code or granting protected trust."
+    },
     "function": {
       "factory": "./src/generators/function/function",
       "schema": "./src/generators/function/schema.json",
@@ -20,6 +25,11 @@
       "schema": "./src/generators/slice/schema.json",
       "description": "Generate an EBK v1 product slice from the built-in or a trusted external Blueprint."
     },
+    "sql": {
+      "factory": "./src/generators/sql/sql",
+      "schema": "./src/generators/sql/schema.json",
+      "description": "Report or apply an additive SQL requirement to a Standard Slice and its Foundation; never deploy or move existing data."
+    },
     "repository-policy": {
       "factory": "./src/generators/repository-policy/repository-policy",
       "schema": "./src/generators/repository-policy/schema.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.4",
+  "version": "1.0.0-rc.40",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -16,6 +16,21 @@
   "author": "Gupta-Leary Technology Consulting LLC",
   "license": "Apache-2.0",
   "type": "commonjs",
+  "files": [
+    "src/**/*.js",
+    "src/**/*.d.ts",
+    "src/schemas/*.json",
+    "src/generators/*/schema.json",
+    "src/executors/*/schema.json",
+    "generators.json",
+    "executors.json",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "!**/*.{spec,test,fixtures}.{js,d.ts}",
+    "!src/performance/test-fixtures.{js,d.ts}",
+    "!**/{fixtures,__fixtures__,tests,__tests__}/**"
+  ],
   "bin": {
     "ebk": "./src/cli/bootstrap.js"
   },
@@ -39,6 +54,10 @@
       "types": "./src/authorization/index.d.ts",
       "default": "./src/authorization/index.js"
     },
+    "./aws-authority": {
+      "types": "./src/aws-authority/index.d.ts",
+      "default": "./src/aws-authority/index.js"
+    },
     "./database-retirement": {
       "types": "./src/database-retirement/index.d.ts",
       "default": "./src/database-retirement/index.js"
@@ -59,10 +78,6 @@
       "types": "./src/git-policy/index.d.ts",
       "default": "./src/git-policy/index.js"
     },
-    "./infrastructure-change": {
-      "types": "./src/infrastructure-change/index.d.ts",
-      "default": "./src/infrastructure-change/index.js"
-    },
     "./local-dev": {
       "types": "./src/local-dev/index.d.ts",
       "default": "./src/local-dev/index.js"
@@ -103,6 +118,10 @@
       "types": "./src/workload-roles/index.d.ts",
       "default": "./src/workload-roles/index.js"
     },
+    "./workspace-deployment": {
+      "types": "./src/workspace-deployment/index.d.ts",
+      "default": "./src/workspace-deployment/index.js"
+    },
     "./schemas/blueprint-v1.json": "./src/schemas/blueprint-v1.json",
     "./schemas/aggregate-count-evidence-v1.json": "./src/schemas/aggregate-count-evidence-v1.json",
     "./schemas/blueprint-input-schema-v1.json": "./src/schemas/blueprint-input-schema-v1.json",
@@ -126,7 +145,9 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.4",
+    "@empire-builder-kit/runtime": "1.0.0-rc.40",
+    "@aws-sdk/client-cloudfront": "^3.700.0",
+    "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
     "@aws-sdk/client-iam": "^3.700.0",
     "@nx/devkit": "23.1.0",
@@ -135,11 +156,14 @@
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-ssm": "^3.700.0",
     "@aws-sdk/client-sts": "^3.700.0",
+    "@aws-sdk/client-wafv2": "^3.700.0",
     "@aws-sdk/credential-providers": "^3.700.0",
     "ajv": "8.20.0",
+    "nx": "23.1.0",
     "prettier": "^3.8.2",
     "semver": "7.7.4",
     "tslib": "^2.3.0",
+    "typescript": "~5.9.2",
     "yaml": "2.9.0"
   },
   "repository": {
@@ -154,5 +178,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "c29757a0dc5efb67eb10c3c8aa1f09b967ec10ca"
+  "gitHead": "56a2e45b04b8ce8849990baba025cecb5909f8c7"
 }

package/src/aws/child-environment.d.ts

@@ -0,0 +1,10 @@
+export interface GovernedAwsChildEnvironmentOptions {
+    /** GitHub's configure-aws-credentials action replaces ambient AWS
+     * credentials with one exact temporary role session. That verified session
+     * is the only raw credential environment admitted to a protected child. */
+    preserveVerifiedGithubCredentials?: boolean;
+}
+/** Remove ambient authority inputs that could redirect AWS calls, replace
+ * trust roots, mint another OIDC credential, or select an unverified AWS
+ * principal. Normal non-secret GitHub provenance remains available. */
+export declare function sanitizeGovernedAwsChildEnvironment(ambient: NodeJS.ProcessEnv, options?: GovernedAwsChildEnvironmentOptions): NodeJS.ProcessEnv;

package/src/aws/child-environment.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeGovernedAwsChildEnvironment = sanitizeGovernedAwsChildEnvironment;
+const RAW_AWS_CREDENTIAL_VARIABLES = new Set([
+    'AWS_ACCESS_KEY_ID',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE',
+    'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+    'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
+    'AWS_CREDENTIAL_EXPIRATION',
+    'AWS_ROLE_ARN',
+    'AWS_ROLE_SESSION_NAME',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SECURITY_TOKEN',
+    'AWS_SESSION_TOKEN',
+    'AWS_WEB_IDENTITY_TOKEN_FILE',
+]);
+const VERIFIED_GITHUB_CREDENTIAL_VARIABLES = new Set([
+    'AWS_ACCESS_KEY_ID',
+    'AWS_CREDENTIAL_EXPIRATION',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+]);
+const AUTHORITY_OVERRIDE_VARIABLES = new Set([
+    'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
+    'ACTIONS_ID_TOKEN_REQUEST_URL',
+    'ACTIONS_RESULTS_URL',
+    'ACTIONS_RUNTIME_TOKEN',
+    'ACTIONS_RUNTIME_URL',
+    'ALL_PROXY',
+    'AWS_CA_BUNDLE',
+    'AWS_EC2_METADATA_SERVICE_ENDPOINT',
+    'AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE',
+    'AWS_USE_DUALSTACK_ENDPOINT',
+    'AWS_USE_FIPS_ENDPOINT',
+    'CURL_CA_BUNDLE',
+    'GH_TOKEN',
+    'GITHUB_TOKEN',
+    'GIT_SSL_CAINFO',
+    'GIT_SSL_NO_VERIFY',
+    'GLOBAL_AGENT_HTTP_PROXY',
+    'GLOBAL_AGENT_HTTPS_PROXY',
+    'HTTPS_PROXY',
+    'HTTP_PROXY',
+    'NODE_EXTRA_CA_CERTS',
+    'NODE_TLS_REJECT_UNAUTHORIZED',
+    'NO_PROXY',
+    'NPM_CONFIG_CAFILE',
+    'NPM_CONFIG_HTTPS_PROXY',
+    'NPM_CONFIG_PROXY',
+    'REQUESTS_CA_BUNDLE',
+    'SSL_CERT_DIR',
+    'SSL_CERT_FILE',
+]);
+/** Remove ambient authority inputs that could redirect AWS calls, replace
+ * trust roots, mint another OIDC credential, or select an unverified AWS
+ * principal. Normal non-secret GitHub provenance remains available. */
+function sanitizeGovernedAwsChildEnvironment(ambient, options = {}) {
+    const environment = { ...ambient };
+    for (const name of Object.keys(environment)) {
+        const canonical = name.toUpperCase();
+        const endpointOverride = canonical === 'AWS_ENDPOINT_URL' ||
+            canonical.startsWith('AWS_ENDPOINT_URL_');
+        const authorityOverride = AUTHORITY_OVERRIDE_VARIABLES.has(canonical);
+        const rawCredential = RAW_AWS_CREDENTIAL_VARIABLES.has(canonical);
+        const exactGithubCredential = options.preserveVerifiedGithubCredentials === true &&
+            name === canonical &&
+            VERIFIED_GITHUB_CREDENTIAL_VARIABLES.has(canonical);
+        if (endpointOverride ||
+            authorityOverride ||
+            (rawCredential && !exactGithubCredential)) {
+            delete environment[name];
+        }
+    }
+    return environment;
+}
+//# sourceMappingURL=child-environment.js.map

package/src/aws/identity.d.ts

@@ -0,0 +1,13 @@
+export type CanonicalAwsRegionalService = 'rds' | 'secretsmanager' | 'ssm' | 'sts';
+/** Bind security-sensitive AWS SDK reads to the canonical regional service
+ * endpoint rather than an ambient or shared-config endpoint override. */
+export declare function canonicalAwsRegionalEndpoint(service: CanonicalAwsRegionalService, region: string): string;
+/** Bind identity verification to AWS's canonical regional STS service rather
+ * than an ambient or shared-config endpoint override. */
+export declare function canonicalStsEndpoint(region: string): string;
+/**
+ * AWS STS omits an IAM role path from an assumed-role ARN. Match the exact
+ * account, partition, and terminal role name while accepting that documented
+ * AWS representation difference.
+ */
+export declare function matchesExpectedAssumedRoleArn(expectedAccount: string, callerArn: string, expectedRoleArn: string): boolean;

package/src/aws/identity.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalAwsRegionalEndpoint = canonicalAwsRegionalEndpoint;
+exports.canonicalStsEndpoint = canonicalStsEndpoint;
+exports.matchesExpectedAssumedRoleArn = matchesExpectedAssumedRoleArn;
+const IAM_ROLE_ARN = /^arn:([^:]+):iam::(\d{12}):role\/(.+)$/u;
+const STS_ASSUMED_ROLE_ARN = /^arn:([^:]+):sts::(\d{12}):assumed-role\/(.+)\/([^/]+)$/u;
+const AWS_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/u;
+/** Bind security-sensitive AWS SDK reads to the canonical regional service
+ * endpoint rather than an ambient or shared-config endpoint override. */
+function canonicalAwsRegionalEndpoint(service, region) {
+    if (!AWS_REGION.test(region)) {
+        throw new Error(`${service.toUpperCase()} verification requires an exact AWS Region.`);
+    }
+    return region.startsWith('cn-')
+        ? `https://${service}.${region}.amazonaws.com.cn`
+        : `https://${service}.${region}.amazonaws.com`;
+}
+/** Bind identity verification to AWS's canonical regional STS service rather
+ * than an ambient or shared-config endpoint override. */
+function canonicalStsEndpoint(region) {
+    return canonicalAwsRegionalEndpoint('sts', region);
+}
+/**
+ * AWS STS omits an IAM role path from an assumed-role ARN. Match the exact
+ * account, partition, and terminal role name while accepting that documented
+ * AWS representation difference.
+ */
+function matchesExpectedAssumedRoleArn(expectedAccount, callerArn, expectedRoleArn) {
+    const expected = IAM_ROLE_ARN.exec(expectedRoleArn);
+    const caller = STS_ASSUMED_ROLE_ARN.exec(callerArn);
+    if (!expected || !caller)
+        return false;
+    const expectedRoleName = expected[3]?.split('/').at(-1);
+    return (expected[1] === caller[1] &&
+        expected[2] === expectedAccount &&
+        caller[2] === expectedAccount &&
+        expectedRoleName !== undefined &&
+        expectedRoleName === caller[3]);
+}
+//# sourceMappingURL=identity.js.map

package/src/aws-authority/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lambda-policy-ordering.js';
+export * from './stage-authority.js';

package/src/aws-authority/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./lambda-policy-ordering.js"), exports);
+tslib_1.__exportStar(require("./stage-authority.js"), exports);
+//# sourceMappingURL=index.js.map

package/src/aws-authority/lambda-policy-ordering.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Orders Lambda resource-policy writes that the pinned providers otherwise race.
+ *
+ * Creating a Function URL with `NONE` authorization makes the pinned AWS
+ * provider add a public-access statement to the function policy without the
+ * per-function lock that serializes standalone `lambda.Permission` writes. The
+ * pinned SST Function and SSR site components create those permissions next
+ * to the URL with no ordering, so Lambda can reject the URL's write with a
+ * `ResourceConflictException` ("concurrent update operation"). Each Function
+ * URL and Permission registered under the same top-level component therefore
+ * depends on the previous one. `dependsOn` adds no property diff, so existing
+ * stacks are neither replaced nor updated by this ordering.
+ */
+export declare const LAMBDA_POLICY_WRITE_TYPES: readonly ["aws:lambda/functionUrl:FunctionUrl", "aws:lambda/permission:Permission"];
+export interface LambdaPolicyTransformationArgs {
+    resource: object;
+    type: string;
+    name: string;
+    props: Record<string, unknown>;
+    opts?: {
+        parent?: object;
+    };
+}
+export interface LambdaPolicyTransformationResult {
+    props: Record<string, unknown>;
+    opts: object;
+}
+export interface LambdaPolicyWriteOrderingInput {
+    /** Pulumi `runtime.registerStackTransformation` (SST: `$util.runtime`). */
+    registerStackTransformation: (transformation: (args: LambdaPolicyTransformationArgs) => LambdaPolicyTransformationResult | undefined) => void;
+    /** Pulumi `mergeOptions` (SST: `$util.mergeOptions`). */
+    mergeOptions: (first: object | undefined, second: object | undefined) => object;
+}
+export interface LambdaPolicyWriteOrderingContract {
+    orderedTypes: readonly string[];
+    scope: 'top-level-component';
+}
+export declare function installLambdaPolicyWriteOrdering(input: LambdaPolicyWriteOrderingInput): LambdaPolicyWriteOrderingContract;

package/src/aws-authority/lambda-policy-ordering.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * Orders Lambda resource-policy writes that the pinned providers otherwise race.
+ *
+ * Creating a Function URL with `NONE` authorization makes the pinned AWS
+ * provider add a public-access statement to the function policy without the
+ * per-function lock that serializes standalone `lambda.Permission` writes. The
+ * pinned SST Function and SSR site components create those permissions next
+ * to the URL with no ordering, so Lambda can reject the URL's write with a
+ * `ResourceConflictException` ("concurrent update operation"). Each Function
+ * URL and Permission registered under the same top-level component therefore
+ * depends on the previous one. `dependsOn` adds no property diff, so existing
+ * stacks are neither replaced nor updated by this ordering.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LAMBDA_POLICY_WRITE_TYPES = void 0;
+exports.installLambdaPolicyWriteOrdering = installLambdaPolicyWriteOrdering;
+exports.LAMBDA_POLICY_WRITE_TYPES = [
+    'aws:lambda/functionUrl:FunctionUrl',
+    'aws:lambda/permission:Permission',
+];
+const orderedTypes = new Set(exports.LAMBDA_POLICY_WRITE_TYPES);
+function installLambdaPolicyWriteOrdering(input) {
+    if (typeof input?.registerStackTransformation !== 'function' ||
+        typeof input.mergeOptions !== 'function') {
+        throw new Error('Lambda policy write ordering requires the Pulumi stack transformation and option merge functions.');
+    }
+    const parents = new WeakMap();
+    const previousInScope = new Map();
+    // Parentless policy writes share one scope rather than racing each other.
+    const stackScope = {};
+    input.registerStackTransformation((args) => {
+        const parent = args.opts?.parent;
+        parents.set(args.resource, parent);
+        if (!orderedTypes.has(args.type))
+            return undefined;
+        let scope = stackScope;
+        for (let current = parent; current !== undefined;) {
+            scope = current;
+            current = parents.get(current);
+        }
+        const previous = previousInScope.get(scope);
+        previousInScope.set(scope, args.resource);
+        if (previous === undefined)
+            return undefined;
+        return {
+            props: args.props,
+            opts: input.mergeOptions(args.opts, { dependsOn: [previous] }),
+        };
+    });
+    return {
+        orderedTypes: exports.LAMBDA_POLICY_WRITE_TYPES,
+        scope: 'top-level-component',
+    };
+}
+//# sourceMappingURL=lambda-policy-ordering.js.map