@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/executors/local-deploy/schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit local deployment lifecycle",
+  "description": "Deploy Foundation and eligible Product Slices in order through pinned native SST using one temporary federated role.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "stage": {
+      "type": "string",
+      "enum": ["development", "staging", "production"],
+      "description": "Active canonical stage to deploy. Starter admits development and production; isolated profiles follow their committed authority matrix."
+    },
+    "expectedRoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$"
+    },
+    "profile": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "slices": {
+      "type": "array",
+      "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,62}$" },
+      "minItems": 1,
+      "maxItems": 64,
+      "uniqueItems": true,
+      "description": "Local-only explicit Slice selection. Foundation still deploys first; omitted means every eligible Slice. A selected deployment is not full-stage acceptance."
+    },
+    "lifecycleScope": {
+      "type": "string",
+      "enum": ["affected", "full"],
+      "description": "affected skips Product Slices unchanged since the baseline deployment receipt; full (default) deploys every ordered project."
+    },
+    "baselineReceipt": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 4096,
+      "description": "Path to the newest successful deployment receipt for this stage and branch, restored by the protected workflow."
+    },
+    "baselineRunId": {
+      "oneOf": [
+        {
+          "type": "string",
+          "pattern": "^[1-9][0-9]*$"
+        },
+        {
+          "type": "integer",
+          "minimum": 1
+        }
+      ],
+      "description": "Workflow run id that produced the baseline receipt. Accepted as digits or as the number the workflow argument parser produces (EBK-INT-2026-084)."
+    },
+    "baselineRunAttempt": {
+      "oneOf": [
+        {
+          "type": "string",
+          "pattern": "^[1-9][0-9]*$"
+        },
+        {
+          "type": "integer",
+          "minimum": 1
+        }
+      ],
+      "description": "Workflow run attempt that produced the baseline receipt. Accepted as digits or as the number the workflow argument parser produces (EBK-INT-2026-084)."
+    }
+  },
+  "required": ["stage", "expectedRoleArn"]
+}

package/src/executors/refresh/refresh.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
-const executor = (options, context) => (0, run_sst_command_js_1.runSstCommand)('refresh', options, context);
+const governed_native_operation_js_1 = require("../sst-lifecycle/governed-native-operation.js");
+const executor = (options, context) => (0, governed_native_operation_js_1.runGovernedNativeOperation)('refresh', options, context);
 exports.default = executor;
 //# sourceMappingURL=refresh.js.map

package/src/executors/remove/remove.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
-const executor = (options, context) => (0, run_sst_command_js_1.runSstCommand)('remove', options, context);
+const governed_native_operation_js_1 = require("../sst-lifecycle/governed-native-operation.js");
+const executor = (options, context) => (0, governed_native_operation_js_1.runGovernedNativeOperation)('remove', options, context);
 exports.default = executor;
 //# sourceMappingURL=remove.js.map

package/src/executors/router-waf-rehearsal/router-waf-rehearsal.d.ts

@@ -0,0 +1,42 @@
+import { CloudWatchClient, type CloudWatchClientConfig } from '@aws-sdk/client-cloudwatch';
+import { CloudWatchLogsClient, type CloudWatchLogsClientConfig } from '@aws-sdk/client-cloudwatch-logs';
+import { CloudFrontClient, type CloudFrontClientConfig } from '@aws-sdk/client-cloudfront';
+import { STSClient } from '@aws-sdk/client-sts';
+import { WAFV2Client, type WAFV2ClientConfig } from '@aws-sdk/client-wafv2';
+import { type PromiseExecutor } from '@nx/devkit';
+import { runRouterWafRateRehearsal } from '../../foundation/router-waf-rate-rehearsal.js';
+import { runGithubPrivateSmoke } from '../../foundation/private-smoke-access.js';
+import { assertWorkspaceStageOwnershipForWorkspace } from '../../workspace-deployment/index.js';
+interface RouterWafRehearsalOptions {
+    probeUrl: string;
+    profile?: string;
+    /**
+     * Managed rehearsal (protected GitHub dispatch only): perform the
+     * non-allowlisted and managed-rule operator probes from the runner, seed the
+     * live evidence, and seal inside the runner's temporary allowlist admission.
+     */
+    seedProbes?: boolean;
+}
+interface RawGetResponse {
+    status: number;
+}
+interface RouterWafRehearsalDependencies {
+    createCloudFrontClient?: (configuration: CloudFrontClientConfig) => Pick<CloudFrontClient, 'send'>;
+    createCloudWatchClient?: (configuration: CloudWatchClientConfig) => Pick<CloudWatchClient, 'send'>;
+    createCloudWatchLogsClient?: (configuration: CloudWatchLogsClientConfig) => Pick<CloudWatchLogsClient, 'send'>;
+    createStsClient?: (configuration: ConstructorParameters<typeof STSClient>[0]) => Pick<STSClient, 'send'>;
+    createWafClient?: (configuration: WAFV2ClientConfig) => Pick<WAFV2Client, 'send'>;
+    createNonce?: () => string;
+    environment?: NodeJS.ProcessEnv;
+    fetch?: typeof fetch;
+    now?: () => Date;
+    ownership?: typeof assertWorkspaceStageOwnershipForWorkspace;
+    privateSmoke?: typeof runGithubPrivateSmoke;
+    /** Raw GET without an implicit User-Agent; the managed-rule probe needs one. */
+    rawGet?: (url: URL, headers: Record<string, string>) => Promise<RawGetResponse>;
+    runRateRehearsal?: typeof runRouterWafRateRehearsal;
+    sleep?: (milliseconds: number) => Promise<void>;
+}
+export declare function createRouterWafRehearsalExecutor(dependencies?: RouterWafRehearsalDependencies): PromiseExecutor<RouterWafRehearsalOptions>;
+declare const executor: PromiseExecutor<RouterWafRehearsalOptions>;
+export default executor;