@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/README.md

@@ -6,12 +6,30 @@ Generators:
 
 - `preset` (composed by `@empire-builder-kit/create`)
 - `slice`
+- `sql` (report-first additive Standard SQL requirement)
 - `function`
 - `service`
 - `job`
 - `repository-policy`
 - `upgrade`
 
+Standard starts with DynamoDB. When a feature needs relational integrity or
+joins, add SQL to its existing Slice without changing the default record store:
+
+```bash
+pnpm nx g @empire-builder-kit/nx:sql billing --reason="Invoice ledger needs relational constraints and reporting joins."
+pnpm nx g @empire-builder-kit/nx:sql billing --reason="Invoice ledger needs relational constraints and reporting joins." --apply
+```
+
+The first command reports the paired Foundation/Slice managed upgrade. The
+second applies source changes and the normal dependency installation; neither
+command calls AWS, copies data, or deploys resources. Inspect the resource/cost
+implications, then use the normal fleet and deployment lifecycle. Existing
+capacity choices and seeded features are retained. SQL remains declared even
+if its last consumer is removed; retirement is a separate explicit operation.
+External Blueprints declare requirements through their own owner, not this
+Standard-only generator. See the [database contract](../../docs/database-contract.md).
+
 The package also owns Repository Operating Policy validation and protected
 deployment planning, generated Git routing and report-first GitHub bootstrap,
 Foundation discovery/profile preflight, trusted external Blueprint execution,
@@ -21,7 +39,7 @@ Consumers should never invoke SST lifecycle commands directly.
 
 The workspace-pinned `ebk` binary is the single framework CLI. It owns local
 development, bounded Developer-Agent inspection/planning, external Blueprint
-receipt review, and the human-only personal secret ceremony. Nx remains the
+receipt review, and the personal secret commands. Nx remains the
 workspace graph and owning-target authority behind generated work.
 
 `ebk agent context --json` is the sole full structured context transport. The
@@ -59,7 +77,10 @@ recurring target only after retention and after recomputing its portable
 package authority from the protected target, manifests, and lockfile. Exact
 Node declarations and the full lockfile digest are receipt-bound as well. A
 human may invoke the structured Nx target without a receipt. Neither path is
-cryptographic or hosted attestation.
+cryptographic or hosted attestation. Until the receipt is retained, an agent
+prepares the change, asks the human to run `ebk blueprint verification-review`
+on the protected tip and land the retaining commit, and verifies its own edits
+through built-in targets.
 
 The external manifest's sole recurring root is named exactly `verify`.
 Generated project configurations are whole-file managed, canonically rooted
@@ -68,8 +89,11 @@ result. Agent inspection classifies every graph project beneath a current or
 historically external Slice ownership root as external without trusting tags
 or that publisher-authored inventory; historical roots and identities remain
 external after deletion or relabeling. Only the protected-reviewed chain is
-exposed. Read-only fleet status and logs remain available, but agent planning
-withholds local lifecycle operations for external Slices in v1.
+exposed. Read-only fleet status and logs remain available. In v1, agent
+planning withholds `ebk dev up`, `restart`, and `down` for external Slices
+because their code is not bound by a protected receipt; an agent asks the human
+to run the lifecycle command directly, then continues with status, logs, and
+the reviewed verification chain.
 
 Independently of Blueprint provenance, Developer-Agent inspection performs a
 bounded repository-wide Nx-configuration preflight before graph loading. Each
@@ -91,8 +115,11 @@ external ownership appears currently or anywhere in the bounded first-parent
 histories of HEAD, protected develop, or protected main; mutable
 `nx.json.defaultBase` cannot redirect the inventory. A missing protected ref
 makes the inventory incomplete and activates the same strict boundary; a
-shallow clone does likewise because hidden history cannot prove absence. While
-that inventory is incomplete, every graph project under `packages/` except the
+shallow clone does likewise because hidden history cannot prove absence. This
+is a recoverable state: complete the history with `git fetch --unshallow origin`
+(or a full-depth `git fetch origin develop main`) so that
+`refs/remotes/origin/develop` and `refs/remotes/origin/main` exist, then rerun
+inspection. While that inventory is incomplete, every graph project under `packages/` except the
 sole canonical `foundation` project at `packages/foundation` is treated as
 externally owned. The Foundation tag cannot create that exception: its project
 name, declared root, and canonical directory are checked together. Read-only
@@ -106,16 +133,23 @@ outside the local-evidence claim. That includes mutation between the
 repository-wide configuration inventory and Nx graph loading; the preflight is
 not an immutable repository snapshot.
 
-The human-only personal secret commands are:
+The personal secret commands are:
 
 ```bash
 ebk secret set <slice> <logical-name>
 ebk secret remove <slice> <logical-name>
 ```
 
-These commands derive the personal stage, use the profile and Region saved by
-`ebk dev configure`, verify the development Foundation account, and accept
-values only from a hidden local TTY. Agents and CI must never invoke them.
+Both commands derive the personal stage, use the profile and Region saved by
+`ebk dev configure`, verify the development Foundation account, and refuse
+canonical stages. `set` accepts the value only from a hidden local TTY, never
+from argv, environment, or files, and refuses agent and CI environments,
+because a hidden prompt does not hide the value from the process that owns the
+terminal: a human runs it in a terminal no agent spawned, and the agent
+verifies afterwards with the value-blind `secret-metadata` and status targets.
+`remove` carries no value. An agent may start it; it still needs a local
+interactive terminal where the human types the hidden `REMOVE <logical-name>`
+confirmation.
 
 Generated workspaces expose `work-markers` as both a direct target and part of
 workspace health. The generated `AGENTS.md`, `CLAUDE.md`, and runbook define how

package/executors.json

@@ -38,7 +38,17 @@
     "infrastructure-plan": {
       "implementation": "./src/executors/infrastructure-plan/infrastructure-plan",
       "schema": "./src/executors/infrastructure-plan/schema.json",
-      "description": "Run a pinned SST resource diff and fail closed on unapproved, stale, locked, drifted, or unknown protected plans."
+      "description": "Stream one advisory native SST diff through the exact committed stage authority without retaining mutation authority."
+    },
+    "local-deploy": {
+      "implementation": "./src/executors/local-deploy/local-deploy",
+      "schema": "./src/executors/local-deploy/schema.json",
+      "description": "Deploy one complete active stage through ordered native SST children, exact temporary AWS authority, migrations, smoke checks, and a bounded receipt."
+    },
+    "router-waf-rehearsal": {
+      "implementation": "./src/executors/router-waf-rehearsal/router-waf-rehearsal",
+      "schema": "./src/executors/router-waf-rehearsal/schema.json",
+      "description": "Run the bounded Router WAF rate probe, correlate its exact BLOCK sample and metric, and seal the committed blocking evidence."
     },
     "work-markers": {
       "implementation": "./src/executors/work-markers/work-markers",
@@ -70,6 +80,11 @@
       "schema": "./src/executors/secret-metadata/schema.json",
       "description": "Report or explicitly apply value-blind operator-secret container metadata for one Product Slice."
     },
+    "secret-initialize": {
+      "implementation": "./src/executors/secret-initialize/secret-initialize",
+      "schema": "./src/executors/secret-initialize/schema.json",
+      "description": "Report or explicitly initialize one declared machine-generated secret without accepting or returning its value."
+    },
     "secret-guardrails": {
       "implementation": "./src/executors/secret-guardrails/secret-guardrails",
       "schema": "./src/executors/secret-guardrails/schema.json",
@@ -85,6 +100,11 @@
       "schema": "./src/executors/sst-lifecycle/schema.json",
       "description": "Run SST development mode through the workspace-pinned binary."
     },
+    "dev-task-cleanup": {
+      "implementation": "./src/executors/dev-task-cleanup/dev-task-cleanup",
+      "schema": "./src/executors/dev-task-cleanup/schema.json",
+      "description": "Internal cleanup of the current worktree's exact task Slice stack using verified development authority."
+    },
     "refresh": {
       "implementation": "./src/executors/refresh/refresh",
       "schema": "./src/executors/sst-lifecycle/schema.json",

package/generators.json

@@ -1,5 +1,10 @@
 {
   "generators": {
+    "blueprint": {
+      "factory": "./src/generators/blueprint/blueprint",
+      "schema": "./src/generators/blueprint/schema.json",
+      "description": "Scaffold an adopter-owned Blueprint package, templates and verification without executing publisher code or granting protected trust."
+    },
     "function": {
       "factory": "./src/generators/function/function",
       "schema": "./src/generators/function/schema.json",
@@ -20,6 +25,11 @@
       "schema": "./src/generators/slice/schema.json",
       "description": "Generate an EBK v1 product slice from the built-in or a trusted external Blueprint."
     },
+    "sql": {
+      "factory": "./src/generators/sql/sql",
+      "schema": "./src/generators/sql/schema.json",
+      "description": "Report or apply an additive SQL requirement to a Standard Slice and its Foundation; never deploy or move existing data."
+    },
     "repository-policy": {
       "factory": "./src/generators/repository-policy/repository-policy",
       "schema": "./src/generators/repository-policy/schema.json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.4",
+  "version": "1.0.0-rc.41",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -16,6 +16,21 @@
   "author": "Gupta-Leary Technology Consulting LLC",
   "license": "Apache-2.0",
   "type": "commonjs",
+  "files": [
+    "src/**/*.js",
+    "src/**/*.d.ts",
+    "src/schemas/*.json",
+    "src/generators/*/schema.json",
+    "src/executors/*/schema.json",
+    "generators.json",
+    "executors.json",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "!**/*.{spec,test,fixtures}.{js,d.ts}",
+    "!src/performance/test-fixtures.{js,d.ts}",
+    "!**/{fixtures,__fixtures__,tests,__tests__}/**"
+  ],
   "bin": {
     "ebk": "./src/cli/bootstrap.js"
   },
@@ -39,6 +54,10 @@
       "types": "./src/authorization/index.d.ts",
       "default": "./src/authorization/index.js"
     },
+    "./aws-authority": {
+      "types": "./src/aws-authority/index.d.ts",
+      "default": "./src/aws-authority/index.js"
+    },
     "./database-retirement": {
       "types": "./src/database-retirement/index.d.ts",
       "default": "./src/database-retirement/index.js"
@@ -59,10 +78,6 @@
       "types": "./src/git-policy/index.d.ts",
       "default": "./src/git-policy/index.js"
     },
-    "./infrastructure-change": {
-      "types": "./src/infrastructure-change/index.d.ts",
-      "default": "./src/infrastructure-change/index.js"
-    },
     "./local-dev": {
       "types": "./src/local-dev/index.d.ts",
       "default": "./src/local-dev/index.js"
@@ -103,6 +118,10 @@
       "types": "./src/workload-roles/index.d.ts",
       "default": "./src/workload-roles/index.js"
     },
+    "./workspace-deployment": {
+      "types": "./src/workspace-deployment/index.d.ts",
+      "default": "./src/workspace-deployment/index.js"
+    },
     "./schemas/blueprint-v1.json": "./src/schemas/blueprint-v1.json",
     "./schemas/aggregate-count-evidence-v1.json": "./src/schemas/aggregate-count-evidence-v1.json",
     "./schemas/blueprint-input-schema-v1.json": "./src/schemas/blueprint-input-schema-v1.json",
@@ -126,7 +145,9 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.4",
+    "@empire-builder-kit/runtime": "1.0.0-rc.41",
+    "@aws-sdk/client-cloudfront": "^3.700.0",
+    "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
     "@aws-sdk/client-iam": "^3.700.0",
     "@nx/devkit": "23.1.0",
@@ -135,11 +156,14 @@
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-ssm": "^3.700.0",
     "@aws-sdk/client-sts": "^3.700.0",
+    "@aws-sdk/client-wafv2": "^3.700.0",
     "@aws-sdk/credential-providers": "^3.700.0",
     "ajv": "8.20.0",
+    "nx": "23.1.0",
     "prettier": "^3.8.2",
     "semver": "7.7.4",
     "tslib": "^2.3.0",
+    "typescript": "~5.9.2",
     "yaml": "2.9.0"
   },
   "repository": {
@@ -154,5 +178,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "c29757a0dc5efb67eb10c3c8aa1f09b967ec10ca"
+  "gitHead": "6c8e932ac3acf0a1e124f7687cd7b8582b864c49"
 }

package/src/aws/child-environment.d.ts

@@ -0,0 +1,10 @@
+export interface GovernedAwsChildEnvironmentOptions {
+    /** GitHub's configure-aws-credentials action replaces ambient AWS
+     * credentials with one exact temporary role session. That verified session
+     * is the only raw credential environment admitted to a protected child. */
+    preserveVerifiedGithubCredentials?: boolean;
+}
+/** Remove ambient authority inputs that could redirect AWS calls, replace
+ * trust roots, mint another OIDC credential, or select an unverified AWS
+ * principal. Normal non-secret GitHub provenance remains available. */
+export declare function sanitizeGovernedAwsChildEnvironment(ambient: NodeJS.ProcessEnv, options?: GovernedAwsChildEnvironmentOptions): NodeJS.ProcessEnv;

package/src/aws/child-environment.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeGovernedAwsChildEnvironment = sanitizeGovernedAwsChildEnvironment;
+const RAW_AWS_CREDENTIAL_VARIABLES = new Set([
+    'AWS_ACCESS_KEY_ID',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE',
+    'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+    'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
+    'AWS_CREDENTIAL_EXPIRATION',
+    'AWS_ROLE_ARN',
+    'AWS_ROLE_SESSION_NAME',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SECURITY_TOKEN',
+    'AWS_SESSION_TOKEN',
+    'AWS_WEB_IDENTITY_TOKEN_FILE',
+]);
+const VERIFIED_GITHUB_CREDENTIAL_VARIABLES = new Set([
+    'AWS_ACCESS_KEY_ID',
+    'AWS_CREDENTIAL_EXPIRATION',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+]);
+const AUTHORITY_OVERRIDE_VARIABLES = new Set([
+    'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
+    'ACTIONS_ID_TOKEN_REQUEST_URL',
+    'ACTIONS_RESULTS_URL',
+    'ACTIONS_RUNTIME_TOKEN',
+    'ACTIONS_RUNTIME_URL',
+    'ALL_PROXY',
+    'AWS_CA_BUNDLE',
+    'AWS_EC2_METADATA_SERVICE_ENDPOINT',
+    'AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE',
+    'AWS_USE_DUALSTACK_ENDPOINT',
+    'AWS_USE_FIPS_ENDPOINT',
+    'CURL_CA_BUNDLE',
+    'GH_TOKEN',
+    'GITHUB_TOKEN',
+    'GIT_SSL_CAINFO',
+    'GIT_SSL_NO_VERIFY',
+    'GLOBAL_AGENT_HTTP_PROXY',
+    'GLOBAL_AGENT_HTTPS_PROXY',
+    'HTTPS_PROXY',
+    'HTTP_PROXY',
+    'NODE_EXTRA_CA_CERTS',
+    'NODE_TLS_REJECT_UNAUTHORIZED',
+    'NO_PROXY',
+    'NPM_CONFIG_CAFILE',
+    'NPM_CONFIG_HTTPS_PROXY',
+    'NPM_CONFIG_PROXY',
+    'REQUESTS_CA_BUNDLE',
+    'SSL_CERT_DIR',
+    'SSL_CERT_FILE',
+]);
+/** Remove ambient authority inputs that could redirect AWS calls, replace
+ * trust roots, mint another OIDC credential, or select an unverified AWS
+ * principal. Normal non-secret GitHub provenance remains available. */
+function sanitizeGovernedAwsChildEnvironment(ambient, options = {}) {
+    const environment = { ...ambient };
+    for (const name of Object.keys(environment)) {
+        const canonical = name.toUpperCase();
+        const endpointOverride = canonical === 'AWS_ENDPOINT_URL' ||
+            canonical.startsWith('AWS_ENDPOINT_URL_');
+        const authorityOverride = AUTHORITY_OVERRIDE_VARIABLES.has(canonical);
+        const rawCredential = RAW_AWS_CREDENTIAL_VARIABLES.has(canonical);
+        const exactGithubCredential = options.preserveVerifiedGithubCredentials === true &&
+            name === canonical &&
+            VERIFIED_GITHUB_CREDENTIAL_VARIABLES.has(canonical);
+        if (endpointOverride ||
+            authorityOverride ||
+            (rawCredential && !exactGithubCredential)) {
+            delete environment[name];
+        }
+    }
+    return environment;
+}
+//# sourceMappingURL=child-environment.js.map

package/src/aws/identity.d.ts

@@ -0,0 +1,13 @@
+export type CanonicalAwsRegionalService = 'rds' | 'secretsmanager' | 'ssm' | 'sts';
+/** Bind security-sensitive AWS SDK reads to the canonical regional service
+ * endpoint rather than an ambient or shared-config endpoint override. */
+export declare function canonicalAwsRegionalEndpoint(service: CanonicalAwsRegionalService, region: string): string;
+/** Bind identity verification to AWS's canonical regional STS service rather
+ * than an ambient or shared-config endpoint override. */
+export declare function canonicalStsEndpoint(region: string): string;
+/**
+ * AWS STS omits an IAM role path from an assumed-role ARN. Match the exact
+ * account, partition, and terminal role name while accepting that documented
+ * AWS representation difference.
+ */
+export declare function matchesExpectedAssumedRoleArn(expectedAccount: string, callerArn: string, expectedRoleArn: string): boolean;

package/src/aws/identity.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalAwsRegionalEndpoint = canonicalAwsRegionalEndpoint;
+exports.canonicalStsEndpoint = canonicalStsEndpoint;
+exports.matchesExpectedAssumedRoleArn = matchesExpectedAssumedRoleArn;
+const IAM_ROLE_ARN = /^arn:([^:]+):iam::(\d{12}):role\/(.+)$/u;
+const STS_ASSUMED_ROLE_ARN = /^arn:([^:]+):sts::(\d{12}):assumed-role\/(.+)\/([^/]+)$/u;
+const AWS_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/u;
+/** Bind security-sensitive AWS SDK reads to the canonical regional service
+ * endpoint rather than an ambient or shared-config endpoint override. */
+function canonicalAwsRegionalEndpoint(service, region) {
+    if (!AWS_REGION.test(region)) {
+        throw new Error(`${service.toUpperCase()} verification requires an exact AWS Region.`);
+    }
+    return region.startsWith('cn-')
+        ? `https://${service}.${region}.amazonaws.com.cn`
+        : `https://${service}.${region}.amazonaws.com`;
+}
+/** Bind identity verification to AWS's canonical regional STS service rather
+ * than an ambient or shared-config endpoint override. */
+function canonicalStsEndpoint(region) {
+    return canonicalAwsRegionalEndpoint('sts', region);
+}
+/**
+ * AWS STS omits an IAM role path from an assumed-role ARN. Match the exact
+ * account, partition, and terminal role name while accepting that documented
+ * AWS representation difference.
+ */
+function matchesExpectedAssumedRoleArn(expectedAccount, callerArn, expectedRoleArn) {
+    const expected = IAM_ROLE_ARN.exec(expectedRoleArn);
+    const caller = STS_ASSUMED_ROLE_ARN.exec(callerArn);
+    if (!expected || !caller)
+        return false;
+    const expectedRoleName = expected[3]?.split('/').at(-1);
+    return (expected[1] === caller[1] &&
+        expected[2] === expectedAccount &&
+        caller[2] === expectedAccount &&
+        expectedRoleName !== undefined &&
+        expectedRoleName === caller[3]);
+}
+//# sourceMappingURL=identity.js.map

package/src/aws-authority/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lambda-policy-ordering.js';
+export * from './stage-authority.js';

package/src/aws-authority/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./lambda-policy-ordering.js"), exports);
+tslib_1.__exportStar(require("./stage-authority.js"), exports);
+//# sourceMappingURL=index.js.map

package/src/aws-authority/lambda-policy-ordering.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Orders Lambda resource-policy writes that the pinned providers otherwise race.
+ *
+ * Creating a Function URL with `NONE` authorization makes the pinned AWS
+ * provider add a public-access statement to the function policy without the
+ * per-function lock that serializes standalone `lambda.Permission` writes. The
+ * pinned SST Function and SSR site components create those permissions next
+ * to the URL with no ordering, so Lambda can reject the URL's write with a
+ * `ResourceConflictException` ("concurrent update operation"). Each Function
+ * URL and Permission registered under the same top-level component therefore
+ * depends on the previous one. `dependsOn` adds no property diff, so existing
+ * stacks are neither replaced nor updated by this ordering.
+ */
+export declare const LAMBDA_POLICY_WRITE_TYPES: readonly ["aws:lambda/functionUrl:FunctionUrl", "aws:lambda/permission:Permission"];
+export interface LambdaPolicyTransformationArgs {
+    resource: object;
+    type: string;
+    name: string;
+    props: Record<string, unknown>;
+    opts?: {
+        parent?: object;
+    };
+}
+export interface LambdaPolicyTransformationResult {
+    props: Record<string, unknown>;
+    opts: object;
+}
+export interface LambdaPolicyWriteOrderingInput {
+    /** Pulumi `runtime.registerStackTransformation` (SST: `$util.runtime`). */
+    registerStackTransformation: (transformation: (args: LambdaPolicyTransformationArgs) => LambdaPolicyTransformationResult | undefined) => void;
+    /** Pulumi `mergeOptions` (SST: `$util.mergeOptions`). */
+    mergeOptions: (first: object | undefined, second: object | undefined) => object;
+}
+export interface LambdaPolicyWriteOrderingContract {
+    orderedTypes: readonly string[];
+    scope: 'top-level-component';
+}
+export declare function installLambdaPolicyWriteOrdering(input: LambdaPolicyWriteOrderingInput): LambdaPolicyWriteOrderingContract;

package/src/aws-authority/lambda-policy-ordering.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * Orders Lambda resource-policy writes that the pinned providers otherwise race.
+ *
+ * Creating a Function URL with `NONE` authorization makes the pinned AWS
+ * provider add a public-access statement to the function policy without the
+ * per-function lock that serializes standalone `lambda.Permission` writes. The
+ * pinned SST Function and SSR site components create those permissions next
+ * to the URL with no ordering, so Lambda can reject the URL's write with a
+ * `ResourceConflictException` ("concurrent update operation"). Each Function
+ * URL and Permission registered under the same top-level component therefore
+ * depends on the previous one. `dependsOn` adds no property diff, so existing
+ * stacks are neither replaced nor updated by this ordering.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LAMBDA_POLICY_WRITE_TYPES = void 0;
+exports.installLambdaPolicyWriteOrdering = installLambdaPolicyWriteOrdering;
+exports.LAMBDA_POLICY_WRITE_TYPES = [
+    'aws:lambda/functionUrl:FunctionUrl',
+    'aws:lambda/permission:Permission',
+];
+const orderedTypes = new Set(exports.LAMBDA_POLICY_WRITE_TYPES);
+function installLambdaPolicyWriteOrdering(input) {
+    if (typeof input?.registerStackTransformation !== 'function' ||
+        typeof input.mergeOptions !== 'function') {
+        throw new Error('Lambda policy write ordering requires the Pulumi stack transformation and option merge functions.');
+    }
+    const parents = new WeakMap();
+    const previousInScope = new Map();
+    // Parentless policy writes share one scope rather than racing each other.
+    const stackScope = {};
+    input.registerStackTransformation((args) => {
+        const parent = args.opts?.parent;
+        parents.set(args.resource, parent);
+        if (!orderedTypes.has(args.type))
+            return undefined;
+        let scope = stackScope;
+        for (let current = parent; current !== undefined;) {
+            scope = current;
+            current = parents.get(current);
+        }
+        const previous = previousInScope.get(scope);
+        previousInScope.set(scope, args.resource);
+        if (previous === undefined)
+            return undefined;
+        return {
+            props: args.props,
+            opts: input.mergeOptions(args.opts, { dependsOn: [previous] }),
+        };
+    });
+    return {
+        orderedTypes: exports.LAMBDA_POLICY_WRITE_TYPES,
+        scope: 'top-level-component',
+    };
+}
+//# sourceMappingURL=lambda-policy-ordering.js.map