@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/generators/function/function.js

@@ -2,12 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createFunctionFilePlan = createFunctionFilePlan;
 exports.functionGenerator = functionGenerator;
-const devkit_1 = require("@nx/devkit");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../ownership/index.js");
 const feature_registry_js_1 = require("../feature-registry.js");
+const formatting_js_1 = require("../formatting.js");
 const logging_registry_js_1 = require("../logging-registry.js");
 const post_generation_install_js_1 = require("../post-generation-install.js");
+const workspace_files_js_1 = require("../preset/workspace-files.js");
+const built_in_plan_js_1 = require("../slice/built-in-plan.js");
 function requireName(value, label) {
     const normalized = value.trim();
     if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(normalized)) {
@@ -37,12 +39,22 @@ function requireCompositionMarker(tree, path, marker) {
 function createFunctionFilePlan(workspace, slice, name, feature = name) {
     const symbol = `${pascal(slice)}${pascal(name)}Function`;
     const register = `register${symbol}`;
+    const infrastructurePath = `infra/functions/${name}.ts`;
+    const files = {
+        [`api/${name}.ts`]: `import { createHttpJsonHandler } from '@empire-builder-kit/runtime';\n\nexport const handler = createHttpJsonHandler({\n  component: 'function-${name}',\n  feature: '${feature}',\n  operation: '${name}',\n  slice: '${slice}',\n  workspace: '${workspace}',\n  async handle({ context }) {\n    return { actor: context.actor?.id ?? null, function: '${name}', ok: true };\n  },\n});\n`,
+        [`api/${name}.spec.ts`]: `import { describe, expect, it } from 'vitest';\nimport { handler } from './${name}.js';\n\ndescribe('${name} function', () => {\n  it('returns its generated identity', async () => {\n    const response = await handler({ requestContext: { requestId: 'test-request' } });\n    expect(response.statusCode).toBe(200);\n    expect(JSON.parse(response.body).data).toMatchObject({ function: '${name}', ok: true });\n  });\n});\n`,
+        [`infra/functions/${name}.ts`]: `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';\n\nexport function ${register}(\n  api: any,\n  router: any,\n  alertTopicArn: any,\n  role?: { role: string },\n  links: any[] = [],\n) {\n  const contract = createManagedLogGroupContract({\n    component: 'function-${name}',\n    slice: '${slice}',\n    stage: $app.stage,\n    workspace: '${workspace}',\n  });\n  const logGroup = new aws.cloudwatch.LogGroup('${pascal(slice)}${pascal(name)}Logs', {\n    logGroupClass: contract.logGroupClass,\n    name: contract.name,\n    retentionInDays: contract.retentionInDays,\n    tags: contract.tags,\n  });\n  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(\n    '${pascal(slice)}${pascal(name)}LogDataProtection',\n    {\n      logGroupName: logGroup.name,\n      policyDocument: JSON.stringify(contract.dataProtectionPolicy),\n    },\n    { dependsOn: [logGroup] },\n  );\n  const dataProtectionAlarm = new aws.cloudwatch.MetricAlarm(\n    '${pascal(slice)}${pascal(name)}LogDataProtectionFindings',\n    {\n      alarmActions: [alertTopicArn],\n      comparisonOperator: 'GreaterThanOrEqualToThreshold',\n      dimensions: { LogGroupName: logGroup.name },\n      evaluationPeriods: 1,\n      metricName: 'LogEventsWithFindings',\n      namespace: 'AWS/Logs',\n      period: 300,\n      statistic: 'Sum',\n      threshold: 1,\n      treatMissingData: 'notBreaching',\n    },\n    { dependsOn: [dataProtection] },\n  );\n  const functionPath = '/functions/${name}';\n  const routerPath = '/${slice}/api/functions/${name}';\n  api.route('ANY /functions/${name}', {\n    ...(role ?? {}),\n    ebkRouteMaterialization: 'direct',\n    environment: { EBK_STAGE: $app.stage },\n    handler: 'api/${name}.handler',\n    link: links,\n    logging: { format: 'json', logGroup: logGroup.name },\n    transform: {\n      function: {\n        loggingConfig: {\n          applicationLogLevel: 'TRACE',\n          logFormat: 'JSON',\n          logGroup: logGroup.name,\n          systemLogLevel: 'INFO',\n        },\n      },\n    },\n  });\n  router.route(routerPath, api.url, {\n    rewrite: { regex: \`^\${routerPath}$\`, to: functionPath },\n  });\n  return { dataProtection, dataProtectionAlarm, logGroup };\n}\n`,
+    };
+    const infrastructureSource = files[infrastructurePath] ?? '';
+    if (!infrastructureSource.includes('  role?: { role: string },') ||
+        !infrastructureSource.includes('    ...(role ?? {}),')) {
+        throw new Error('Built-in Function infrastructure is missing its native permission integration point.');
+    }
+    files[infrastructurePath] = infrastructureSource
+        .replace('  role?: { role: string },', '  permissions: any,')
+        .replace('    ...(role ?? {}),', '    permissions,');
     return {
-        files: {
-            [`api/${name}.ts`]: `import { createHttpJsonHandler } from '@empire-builder-kit/runtime';\n\nexport const handler = createHttpJsonHandler({\n  component: 'function-${name}',\n  feature: '${feature}',\n  operation: '${name}',\n  slice: '${slice}',\n  workspace: '${workspace}',\n  async handle({ context }) {\n    return { actor: context.actor?.id ?? null, function: '${name}', ok: true };\n  },\n});\n`,
-            [`api/${name}.spec.ts`]: `import { describe, expect, it } from 'vitest';\nimport { handler } from './${name}.js';\n\ndescribe('${name} function', () => {\n  it('returns its generated identity', async () => {\n    const response = await handler({ requestContext: { requestId: 'test-request' } });\n    expect(response.statusCode).toBe(200);\n    expect(JSON.parse(response.body).data).toMatchObject({ function: '${name}', ok: true });\n  });\n});\n`,
-            [`infra/functions/${name}.ts`]: `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';\n\nexport function ${register}(\n  api: any,\n  alertTopicArn: any,\n  role?: { role: string },\n  links: any[] = [],\n) {\n  const contract = createManagedLogGroupContract({\n    component: 'function-${name}',\n    slice: '${slice}',\n    stage: $app.stage,\n    workspace: '${workspace}',\n  });\n  const logGroup = new aws.cloudwatch.LogGroup('${pascal(slice)}${pascal(name)}Logs', {\n    logGroupClass: contract.logGroupClass,\n    name: contract.name,\n    retentionInDays: contract.retentionInDays,\n    tags: contract.tags,\n  });\n  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(\n    '${pascal(slice)}${pascal(name)}LogDataProtection',\n    {\n      logGroupName: logGroup.name,\n      policyDocument: JSON.stringify(contract.dataProtectionPolicy),\n    },\n    { dependsOn: [logGroup] },\n  );\n  const dataProtectionAlarm = new aws.cloudwatch.MetricAlarm(\n    '${pascal(slice)}${pascal(name)}LogDataProtectionFindings',\n    {\n      alarmActions: [alertTopicArn],\n      comparisonOperator: 'GreaterThanOrEqualToThreshold',\n      dimensions: { LogGroupName: logGroup.name },\n      evaluationPeriods: 1,\n      metricName: 'LogEventsWithFindings',\n      namespace: 'AWS/Logs',\n      period: 300,\n      statistic: 'Sum',\n      threshold: 1,\n      treatMissingData: 'notBreaching',\n    },\n    { dependsOn: [dataProtection] },\n  );\n  api.route('ANY /functions/${name}', {\n    ...(role ?? {}),\n    environment: { EBK_STAGE: $app.stage },\n    handler: 'api/${name}.handler',\n    link: links,\n    logging: { format: 'json', logGroup: logGroup.name },\n    transform: {\n      function: {\n        loggingConfig: {\n          applicationLogLevel: 'TRACE',\n          logFormat: 'JSON',\n          logGroup: logGroup.name,\n          systemLogLevel: 'INFO',\n        },\n      },\n    },\n  });\n  return { dataProtection, dataProtectionAlarm, logGroup };\n}\n`,
-        },
+        files,
         paths: [
             { mode: 'seeded', path: `api/${name}.ts` },
             { mode: 'seeded', path: `api/${name}.spec.ts` },
@@ -71,16 +83,16 @@ async function functionGenerator(tree, options) {
     const handlerPath = node_path_1.posix.join(sliceRoot, 'api', `${name}.ts`);
     const infraPath = node_path_1.posix.join(sliceRoot, 'infra/functions', `${name}.ts`);
     const productPath = node_path_1.posix.join(sliceRoot, 'infra/product.ts');
-    const candidatePath = node_path_1.posix.join(sliceRoot, 'infra/workload-roles/candidate.ts');
-    const intentPath = node_path_1.posix.join(sliceRoot, 'infra/workload-roles/effective-intent.ts');
+    const topologyPath = node_path_1.posix.join(sliceRoot, 'infra/native-runtime-authority/topology.ts');
+    const intentPath = node_path_1.posix.join(sliceRoot, 'infra/native-runtime-authority/effective-intent.ts');
     if (!tree.exists(productPath))
         throw new Error(`${slice} is not an EBK v1 Product Slice.`);
     if (tree.exists(handlerPath) || tree.exists(infraPath)) {
         throw new Error(`Function ${name} already exists in Product Slice ${slice}.`);
     }
     const feature = (0, feature_registry_js_1.requireRegisteredSliceFeature)(tree, sliceRoot, options.feature);
-    requireCompositionMarker(tree, candidatePath, '// <ebk:workload-role-extensions:end>');
-    requireCompositionMarker(tree, intentPath, '// <ebk:workload-role-intent-contributions:end>');
+    requireCompositionMarker(tree, topologyPath, '// <ebk:native-runtime-extensions:end>');
+    requireCompositionMarker(tree, intentPath, '// <ebk:native-runtime-intent-contributions:end>');
     requireCompositionMarker(tree, productPath, '// <ebk:composition-imports:end>');
     requireCompositionMarker(tree, productPath, '// <ebk:function-registrations:end>');
     const loggingRegistration = (0, logging_registry_js_1.planSliceLoggingComponentRegistration)(tree, sliceRoot, `function-${name}`);
@@ -92,25 +104,34 @@ async function functionGenerator(tree, options) {
     replaceMarker(tree, productPath, '// <ebk:composition-imports:end>', `import { ${plan.register} } from './functions/${name}.js';`);
     replaceMarker(tree, productPath, '// <ebk:function-registrations:end>', `  ${plan.register}(
     api,
+    foundation.router,
     foundation.discovery.alertTopicArn,
-    workloadRoleBindings?.extension.function('${name}'),
+    nativeAuthority.permissions('${name}-function'),
     secretLinksFor('${name}-function'),
   );`);
-    replaceMarker(tree, candidatePath, '// <ebk:workload-role-extensions:end>', `  { id: '${name}', kind: 'function' },`);
-    replaceMarker(tree, intentPath, '// <ebk:workload-role-intent-contributions:end>', `    ...extensionWorkloadRoleIntentContributions(context, topology, '${name}', 'function'),`);
-    if (!options.skipFormat)
-        await (0, devkit_1.formatFiles)(tree);
+    replaceMarker(tree, topologyPath, '// <ebk:native-runtime-extensions:end>', `  { id: '${name}', kind: 'function' },`);
+    replaceMarker(tree, intentPath, '// <ebk:native-runtime-intent-contributions:end>', `    ...extensionWorkloadRoleIntentContributions(context, topology, '${name}', 'function'),`);
+    if (!options.skipFormat) {
+        const slicePrefix = `${sliceRoot}/`;
+        const restoreProtectedFiles = (0, formatting_js_1.createTreeFileRestorer)(tree, (path) => (0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(path) ||
+            (path.startsWith(slicePrefix) &&
+                (0, built_in_plan_js_1.isBuiltInSliceFormatSensitivePath)(path.slice(slicePrefix.length))));
+        await (0, formatting_js_1.formatChangedTreeToFixedPoint)(tree, restoreProtectedFiles);
+    }
     (0, index_js_1.recordCompositionOwnership)(tree, {
         compositions: [{ feature, kind: 'function', name }],
         paths: [
             ...plan.paths,
             { path: 'infra/product.ts' },
-            { path: 'infra/workload-roles/candidate.ts' },
-            { path: 'infra/workload-roles/effective-intent.ts' },
+            { path: 'infra/native-runtime-authority/topology.ts' },
+            { path: 'infra/native-runtime-authority/effective-intent.ts' },
             { path: logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH },
         ],
         slice,
     });
+    if (!options.skipFormat) {
+        await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, node_path_1.posix.join(sliceRoot, '.ebk/ownership.json'));
+    }
 }
 exports.default = functionGenerator;
 //# sourceMappingURL=function.js.map

package/src/generators/logging-registry.d.ts

@@ -11,3 +11,5 @@ export declare function planSliceLoggingComponentRegistration(tree: Tree, sliceR
     contents: string;
     path: string;
 };
+/** Append generated mechanics while preserving adopter-owned component entries. */
+export declare function planRequiredSliceLoggingComponents(currentSource: string | null, generatedSource: string): string | null;

package/src/generators/logging-registry.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SLICE_LOGGING_REGISTRY_SCHEMA_VERSION = exports.SLICE_LOGGING_REGISTRY_PATH = void 0;
 exports.parseSliceLoggingRegistry = parseSliceLoggingRegistry;
 exports.planSliceLoggingComponentRegistration = planSliceLoggingComponentRegistration;
+exports.planRequiredSliceLoggingComponents = planRequiredSliceLoggingComponents;
 const node_path_1 = require("node:path");
 exports.SLICE_LOGGING_REGISTRY_PATH = 'operations/logging-components.json';
 exports.SLICE_LOGGING_REGISTRY_SCHEMA_VERSION = 1;
@@ -59,4 +60,25 @@ function planSliceLoggingComponentRegistration(tree, sliceRoot, component) {
         path,
     };
 }
+/** Append generated mechanics while preserving adopter-owned component entries. */
+function planRequiredSliceLoggingComponents(currentSource, generatedSource) {
+    if (currentSource === null)
+        return null;
+    const current = parseSliceLoggingRegistry(JSON.parse(currentSource));
+    const generated = parseSliceLoggingRegistry(JSON.parse(generatedSource));
+    const components = [
+        ...new Set([...current.components, ...generated.components]),
+    ].sort();
+    const databaseComponents = [
+        ...new Set([
+            ...current.databaseComponents,
+            ...generated.databaseComponents,
+        ]),
+    ].sort();
+    if (components.length === current.components.length &&
+        databaseComponents.length === current.databaseComponents.length)
+        return null;
+    return (JSON.stringify({ ...current, components, databaseComponents }, null, 2) +
+        '\n');
+}
 //# sourceMappingURL=logging-registry.js.map

package/src/generators/post-generation-install.js

@@ -3022,7 +3022,7 @@ function runFrozenAttempt(workspaceRoot, markerPath, record, lease, dependencies
         const reviewed = reviewedRecord(workspaceRoot, markerPath, record, lease, 'frozen-retry-exhausted');
         throw new Error(`Post-generation install requires reviewed cleanup/recovery at ${markerPath} after ${reviewed.attempts.frozen} frozen attempts.`);
     }
-    throw new Error(`Post-generation install remains generated-source-complete/install-pending; rerun the exact generator request retained at ${markerPath}.`);
+    throw new Error(`Post-generation install remains generated-source-complete/install-pending; rerun the same generator through the retained recovery form "pnpm --config.verify-deps-before-run=warn nx generate ..." bound at ${markerPath}. The scoped warning only lets Nx reach EBK's marker-bound installer; do not run pnpm install manually.`);
 }
 function runNonFrozenAttempt(workspaceRoot, markerPath, record, lease, dependencies) {
     record = requireStableIntegrity(workspaceRoot, markerPath, record, lease);
@@ -3133,7 +3133,7 @@ function runNonFrozenAttempt(workspaceRoot, markerPath, record, lease, dependenc
         const reviewed = reviewedRecord(workspaceRoot, markerPath, record, lease, 'non-frozen-retry-exhausted');
         throw new Error(`Post-generation install requires reviewed cleanup/recovery at ${markerPath} after ${reviewed.attempts.initial} non-frozen attempts.`);
     }
-    throw new Error(`Post-generation install remains generated-source-complete/install-pending before lockfile convergence; rerun the exact generator request retained at ${markerPath}.`);
+    throw new Error(`Post-generation install remains generated-source-complete/install-pending before lockfile convergence; rerun the same generator through the retained recovery form "pnpm --config.verify-deps-before-run=warn nx generate ..." bound at ${markerPath}. The scoped warning only lets Nx reach EBK's marker-bound installer; do not run pnpm install manually.`);
 }
 function diskPendingMarkerPaths(workspaceRoot) {
     const directory = ensureSafeDirectory(workspaceRoot, INSTALL_RECORD_DIRECTORY);

package/src/generators/preset/dependency-overrides.d.ts

@@ -0,0 +1,8 @@
+export declare const DEPENDENCY_OVERRIDES_PATH = "supply-chain/dependency-overrides.json";
+export interface DependencyOverrides {
+    schemaVersion: 1;
+    overrides: Record<string, string>;
+}
+/** Seeded pins are data, never package-manager hooks or alternate registries. */
+export declare function parseDependencyOverrides(value: unknown): DependencyOverrides;
+export declare function renderDependencyOverridesYaml(value: DependencyOverrides): string;

package/src/generators/preset/dependency-overrides.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPENDENCY_OVERRIDES_PATH = void 0;
+exports.parseDependencyOverrides = parseDependencyOverrides;
+exports.renderDependencyOverridesYaml = renderDependencyOverridesYaml;
+const semver_1 = require("semver");
+const deterministic_order_js_1 = require("../../deterministic-order.js");
+exports.DEPENDENCY_OVERRIDES_PATH = 'supply-chain/dependency-overrides.json';
+function isSelector(value) {
+    const parts = value.split('>');
+    if (parts.length > 2)
+        return false;
+    return parts.every((part) => {
+        const match = /^((?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*)(?:@(.+))?$/u.exec(part);
+        return (match !== null &&
+            (match[2] === undefined || (0, semver_1.validRange)(match[2]) !== null));
+    });
+}
+/** Seeded pins are data, never package-manager hooks or alternate registries. */
+function parseDependencyOverrides(value) {
+    const fail = () => {
+        throw new Error(`${exports.DEPENDENCY_OVERRIDES_PATH} must contain schemaVersion 1 and at most 256 npm selectors mapped to exact versions.`);
+    };
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return fail();
+    const record = value;
+    if (record.schemaVersion !== 1 ||
+        Object.keys(record).some((key) => key !== 'schemaVersion' && key !== 'overrides'))
+        return fail();
+    if (typeof record.overrides !== 'object' ||
+        record.overrides === null ||
+        Array.isArray(record.overrides))
+        return fail();
+    const entries = Object.entries(record.overrides);
+    if (entries.length > 256)
+        return fail();
+    for (const [selector, version] of entries) {
+        if (selector.length > 256 ||
+            !isSelector(selector) ||
+            typeof version !== 'string' ||
+            (0, semver_1.valid)(version) !== version)
+            return fail();
+    }
+    return {
+        schemaVersion: 1,
+        overrides: Object.fromEntries(entries.sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))),
+    };
+}
+function renderDependencyOverridesYaml(value) {
+    const entries = Object.entries(value.overrides);
+    return entries.length === 0
+        ? ''
+        : `overrides:\n${entries.map(([selector, version]) => `  ${JSON.stringify(selector)}: ${JSON.stringify(version)}`).join('\n')}\n`;
+}
+//# sourceMappingURL=dependency-overrides.js.map

package/src/generators/preset/generator.js

@@ -3,8 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.frameworkPackageVersion = frameworkPackageVersion;
 exports.presetGenerator = presetGenerator;
 const prettier_1 = require("prettier");
-const index_js_1 = require("../../ownership/index.js");
+const index_js_1 = require("../../repository-policy/index.js");
+const index_js_2 = require("../../ownership/index.js");
 const workspace_files_1 = require("./workspace-files");
+const formatting_js_1 = require("../formatting.js");
+const index_js_3 = require("../../workspace-deployment/index.js");
 function frameworkPackageVersion() {
     const manifest = require('../../../package.json');
     if (typeof manifest.version !== 'string') {
@@ -13,9 +16,44 @@ function frameworkPackageVersion() {
     return manifest.version;
 }
 async function presetGenerator(tree, options) {
+    const deploymentProfile = options.deploymentProfile ?? 'starter';
+    const suppliedAccounts = [
+        options.developmentAccountId,
+        options.stagingAccountId,
+        options.productionAccountId,
+    ];
+    if (deploymentProfile === 'starter' &&
+        options.stagingAccountId !== undefined) {
+        throw new Error('The starter deployment profile has no staging stage; omit --stagingAccountId.');
+    }
+    const requiredAccounts = deploymentProfile === 'starter'
+        ? [options.developmentAccountId, options.productionAccountId]
+        : suppliedAccounts;
+    if (requiredAccounts.some((value) => value !== undefined) &&
+        requiredAccounts.some((value) => value === undefined)) {
+        throw new Error(deploymentProfile === 'starter'
+            ? 'Starter preset deployment topology requires development and production account IDs together.'
+            : 'Isolated preset deployment topology requires all three exact stage account IDs together.');
+    }
+    const deploymentAccounts = requiredAccounts.every((value) => value !== undefined)
+        ? (0, index_js_1.validateDeploymentAccountTopology)(deploymentProfile, {
+            development: (0, index_js_1.normalizeDeploymentAccountId)(options.developmentAccountId, 'Development deployment account'),
+            production: (0, index_js_1.normalizeDeploymentAccountId)(options.productionAccountId, 'Production deployment account'),
+            staging: deploymentProfile === 'starter'
+                ? null
+                : (0, index_js_1.normalizeDeploymentAccountId)(options.stagingAccountId, 'Staging deployment account'),
+        })
+        : { development: null, production: null, staging: null };
+    const deploymentRegion = options.deploymentRegion === undefined
+        ? null
+        : (0, index_js_1.configuredDeploymentRegion)(options.deploymentRegion);
     const renderedFiles = (0, workspace_files_1.renderWorkspaceFiles)({
+        deploymentAccounts,
+        deploymentProfile,
+        deploymentRegion,
         frameworkVersion: options.frameworkVersion ?? frameworkPackageVersion(),
         name: options.name,
+        workspaceDeploymentId: options.workspaceDeploymentId ?? (0, index_js_3.createWorkspaceDeploymentId)(),
     });
     const files = Object.fromEntries(await Promise.all(Object.entries(renderedFiles).map(async ([path, contents]) => {
         if ((0, workspace_files_1.isRawWorkspaceAuthorityPath)(path)) {
@@ -37,8 +75,10 @@ async function presetGenerator(tree, options) {
     for (const [path, contents] of Object.entries(files)) {
         tree.write(path, contents);
     }
-    (0, index_js_1.restampFoundationOwnership)(tree);
-    (0, index_js_1.restampWorkspaceOwnership)(tree);
+    (0, index_js_2.restampFoundationOwnership)(tree);
+    (0, index_js_2.restampWorkspaceOwnership)(tree);
+    await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, 'packages/foundation/.ebk/ownership.json');
+    await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, '.ebk/ownership.json');
 }
 exports.default = presetGenerator;
 //# sourceMappingURL=generator.js.map

package/src/generators/preset/schema.d.ts

@@ -1,4 +1,14 @@
+import type { DeploymentProfile } from '../../repository-policy/index.js';
+
 export interface PresetGeneratorSchema {
+  deploymentProfile?: DeploymentProfile;
+  deploymentRegion?: string;
+  developmentAccountId?: string | number;
   frameworkVersion?: string;
   name: string;
+  productionAccountId?: string | number;
+  stagingAccountId?: string | number;
+  /** Internal deterministic-test hook. Public generation always creates a new
+   * workspace deployment identity. */
+  workspaceDeploymentId?: string;
 }

package/src/generators/preset/schema.json

@@ -4,6 +4,29 @@
   "title": "Empire Builder Kit workspace preset",
   "type": "object",
   "properties": {
+    "deploymentProfile": {
+      "type": "string",
+      "enum": ["starter", "production-isolated", "fully-isolated"],
+      "default": "starter",
+      "description": "AWS account and deployment-authority topology."
+    },
+    "deploymentRegion": {
+      "type": "string",
+      "pattern": "^(?!(us-iso-|us-isob-|eu-isoe-|us-isof-))[a-z]{2}(-gov)?-[a-z]+(-[a-z]+)*-[0-9]$",
+      "description": "Optional exact shared AWS Region for every stage active under the selected deployment profile."
+    },
+    "developmentAccountId": {
+      "anyOf": [
+        { "type": "string", "pattern": "^[0-9]{12}$" },
+        {
+          "type": "number",
+          "minimum": 100000000000,
+          "maximum": 999999999999,
+          "multipleOf": 1
+        }
+      ],
+      "description": "Optional exact development AWS account ID. Supply development and production together for starter; supply all three stage accounts for an isolated profile."
+    },
     "name": {
       "type": "string",
       "description": "Workspace name.",
@@ -16,6 +39,30 @@
     "frameworkVersion": {
       "type": "string",
       "description": "Framework package version written to the generated workspace. Defaults to the preset package version."
+    },
+    "stagingAccountId": {
+      "anyOf": [
+        { "type": "string", "pattern": "^[0-9]{12}$" },
+        {
+          "type": "number",
+          "minimum": 100000000000,
+          "maximum": 999999999999,
+          "multipleOf": 1
+        }
+      ],
+      "description": "Optional exact staging AWS account ID. Omit for starter; supply all three stage accounts together for an isolated profile."
+    },
+    "productionAccountId": {
+      "anyOf": [
+        { "type": "string", "pattern": "^[0-9]{12}$" },
+        {
+          "type": "number",
+          "minimum": 100000000000,
+          "maximum": 999999999999,
+          "multipleOf": 1
+        }
+      ],
+      "description": "Optional exact production AWS account ID. Supply development and production together for starter; supply all three stage accounts for an isolated profile."
     }
   },
   "required": ["name"]

package/src/generators/preset/tool-versions.d.ts

@@ -8,6 +8,8 @@ export declare const WORKSPACE_SST_VERSION: "4.17.1";
 export declare const WORKSPACE_NODE_VERSION: "22.23.1";
 export declare const WORKSPACE_PNPM_VERSION: "11.20.0";
 export declare const WORKSPACE_VITEST_VERSION: "4.1.4";
+/** Python packaging runtime required by the pinned SST-generated workloads. */
+export declare const WORKSPACE_UV_VERSION: "0.11.28";
 export declare const WORKSPACE_PNPM_SHA512: "9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 export declare const WORKSPACE_PNPM_DESCRIPTOR: "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 /**

package/src/generators/preset/tool-versions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKSPACE_SST_NPM_INTEGRITY = exports.WORKSPACE_PNPM_DESCRIPTOR = exports.WORKSPACE_PNPM_SHA512 = exports.WORKSPACE_VITEST_VERSION = exports.WORKSPACE_PNPM_VERSION = exports.WORKSPACE_NODE_VERSION = exports.WORKSPACE_SST_VERSION = void 0;
+exports.WORKSPACE_SST_NPM_INTEGRITY = exports.WORKSPACE_PNPM_DESCRIPTOR = exports.WORKSPACE_PNPM_SHA512 = exports.WORKSPACE_UV_VERSION = exports.WORKSPACE_VITEST_VERSION = exports.WORKSPACE_PNPM_VERSION = exports.WORKSPACE_NODE_VERSION = exports.WORKSPACE_SST_VERSION = void 0;
 /**
  * Framework-required tool versions written into newly generated workspaces.
  *
@@ -11,6 +11,8 @@ exports.WORKSPACE_SST_VERSION = '4.17.1';
 exports.WORKSPACE_NODE_VERSION = '22.23.1';
 exports.WORKSPACE_PNPM_VERSION = '11.20.0';
 exports.WORKSPACE_VITEST_VERSION = '4.1.4';
+/** Python packaging runtime required by the pinned SST-generated workloads. */
+exports.WORKSPACE_UV_VERSION = '0.11.28';
 exports.WORKSPACE_PNPM_SHA512 = '9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee';
 exports.WORKSPACE_PNPM_DESCRIPTOR = `pnpm@${exports.WORKSPACE_PNPM_VERSION}+sha512.${exports.WORKSPACE_PNPM_SHA512}`;
 /**

package/src/generators/preset/workspace-files-adopter-skills.d.ts

@@ -0,0 +1,7 @@
+import type { DeploymentProfile } from '../../repository-policy/index.js';
+export declare const ADOPTER_SKILL_NAMES: readonly ["ebk-orient-plan", "ebk-build-feature", "ebk-develop-verify", "ebk-deploy-operate", "ebk-upgrade-handoff", "ebk-author-blueprint"];
+export declare function renderAdopterSkillIndex(): string;
+export declare function renderAdopterSkills(options: {
+    name: string;
+    deploymentProfile: DeploymentProfile;
+}): Record<string, string>;