@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/foundation/private-smoke-admission.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runnerAlreadyAllowed = runnerAlreadyAllowed;
+exports.publicRunnerIpv4 = publicRunnerIpv4;
+exports.parseSmokeAdmissionLease = parseSmokeAdmissionLease;
+exports.cleanupSmokeAdmission = cleanupSmokeAdmission;
+exports.recoverSmokeAdmission = recoverSmokeAdmission;
+exports.withPrivateSmokeAdmission = withPrivateSmokeAdmission;
+const node_crypto_1 = require("node:crypto");
+const node_net_1 = require("node:net");
+const prefix = 'ebk-smoke-v1:';
+const localPrefix = 'ebk-smoke-local-v1:';
+const sorted = (values) => [...values].sort();
+const same = (a, b) => JSON.stringify(sorted(a)) === JSON.stringify(sorted(b));
+const baselineDigest = (values) => (0, node_crypto_1.createHash)('sha256')
+    .update(JSON.stringify(sorted(values)))
+    .digest('hex');
+function requireCondition(condition, message) {
+    if (!condition)
+        throw new Error(`Private smoke access: ${message}`);
+}
+function runnerAlreadyAllowed(cidr, baseline) {
+    const address = cidr.replace(/\/32$/, '');
+    requireCondition(cidr === publicRunnerIpv4(address), 'admission is not an exact /32');
+    const numeric = (ip) => ip.split('.').reduce((value, octet) => value * 256 + Number(octet), 0) >>>
+        0;
+    return baseline.some((entry) => {
+        const [network, bits] = entry.split('/');
+        requireCondition((0, node_net_1.isIP)(network) === 4 && /^(?:[0-9]|[12][0-9]|3[0-2])$/.test(bits), 'invalid IPv4 baseline');
+        const mask = Number(bits) === 0 ? 0 : (0xffffffff << (32 - Number(bits))) >>> 0;
+        return (numeric(address) & mask) === (numeric(network) & mask);
+    });
+}
+function publicRunnerIpv4(value) {
+    requireCondition((0, node_net_1.isIP)(value) === 4, 'one exact public IPv4 runner address is required');
+    const [a, b] = value.split('.').map(Number);
+    requireCondition(a > 0 &&
+        a < 224 &&
+        a !== 10 &&
+        a !== 127 &&
+        !(a === 169 && b === 254) &&
+        !(a === 172 && b >= 16 && b <= 31) &&
+        !(a === 192 && b === 168) &&
+        !(a === 100 && b >= 64 && b <= 127) &&
+        !(a === 198 && (b === 18 || b === 19)), 'non-public runner address refused');
+    return `${value}/32`;
+}
+function parseSmokeAdmissionLease(description) {
+    if (description === '')
+        return undefined;
+    const local = description.startsWith(localPrefix);
+    const leasePrefix = local ? localPrefix : prefix;
+    requireCondition(description.startsWith(leasePrefix) && description.length <= 256, 'unrecognized IP-set description; do not overwrite it');
+    const parts = description.slice(leasePrefix.length).split(',');
+    requireCondition(parts.length === 6, 'malformed admission lease');
+    const [run, attempt, source, cidr, baseline, expires] = parts;
+    requireCondition((local ? /^[a-f0-9]{32}$/.test(run) : /^[1-9][0-9]*$/.test(run)) &&
+        /^[1-9][0-9]*$/.test(attempt) &&
+        /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(source) &&
+        /^[a-f0-9]{64}$/.test(baseline) &&
+        /^[0-9]{13}$/.test(expires), 'malformed admission identity');
+    requireCondition(cidr === publicRunnerIpv4(cidr.replace(/\/32$/, '')), 'admission is not an exact /32');
+    return {
+        ...(local ? { authority: 'local' } : {}),
+        run,
+        attempt,
+        source,
+        cidr,
+        baseline,
+        expiresAt: Number(expires),
+    };
+}
+function belongsTo(lease, context) {
+    return (lease.authority === context.authority &&
+        lease.run === context.run &&
+        lease.attempt === context.attempt &&
+        lease.source === context.source);
+}
+/** Remove only this lease's address. Never replace unrelated addresses with a baseline. */
+async function cleanupSmokeAdmission(store, context) {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const before = await store.read();
+        const lease = parseSmokeAdmissionLease(before.description);
+        if (!lease) {
+            requireCondition(same(before.addresses, context.baseline), 'allowlist differs from committed baseline; cleanup unproved');
+            return;
+        }
+        requireCondition(belongsTo(lease, context), 'another run owns the admission; use protected stale recovery');
+        requireCondition(lease.baseline === baselineDigest(context.baseline) &&
+            !context.baseline.includes(lease.cidr), 'lease baseline changed; investigate without deleting');
+        try {
+            await store.update(before, {
+                addresses: before.addresses.filter((cidr) => cidr !== lease.cidr),
+                description: '',
+            });
+        }
+        catch {
+            // An update may have succeeded remotely. Read back before retrying it.
+        }
+        const after = await store.read();
+        if (!after.description && !after.addresses.includes(lease.cidr)) {
+            requireCondition(same(after.addresses, context.baseline), 'temporary admission removed but unrelated allowlist drift remains');
+            return;
+        }
+    }
+    throw new Error('Private smoke access: cleanup unproved; deployment acceptance is prohibited. ' +
+        (context.authority === 'local'
+            ? 'Preserve the private recovery receipt, stop the owning invocation, then retry ebk deploy from the same workspace and stage with its verified credential profile.'
+            : 'Run protected smoke-access cleanup before retrying.'));
+}
+/** A retained lease alone, or its expiry, is not proof that a different run ended. */
+async function recoverSmokeAdmission(store, baseline, completedRun) {
+    const current = await store.read();
+    const lease = parseSmokeAdmissionLease(current.description);
+    if (!lease) {
+        requireCondition(same(current.addresses, baseline), 'unleased allowlist drift requires investigation');
+        return;
+    }
+    requireCondition(lease.baseline === baselineDigest(baseline), 'stale lease baseline differs from committed policy');
+    requireCondition(await completedRun(lease), 'prior admission run is not confirmed complete');
+    await cleanupSmokeAdmission(store, { ...lease, baseline });
+}
+async function withPrivateSmokeAdmission(input) {
+    const { store, context, cidr } = input;
+    requireCondition(cidr === publicRunnerIpv4(cidr.replace(/\/32$/, '')), 'admission is not an exact /32');
+    const before = await store.read();
+    requireCondition(!parseSmokeAdmissionLease(before.description), 'recover the existing admission before starting smoke');
+    requireCondition(same(before.addresses, context.baseline), 'live allowlist differs from committed baseline');
+    const alreadyAllowed = runnerAlreadyAllowed(cidr, context.baseline);
+    const description = (context.authority === 'local' ? localPrefix : prefix) +
+        [
+            context.run,
+            context.attempt,
+            context.source,
+            cidr,
+            baselineDigest(context.baseline),
+            (input.now ?? Date.now)() + 40 * 60_000,
+        ].join(',');
+    const lease = parseSmokeAdmissionLease(description);
+    requireCondition(lease !== undefined, 'admission lease is unreadable');
+    const signals = input.signals ?? process;
+    let interrupted = false;
+    const admissionAbort = new AbortController();
+    const stop = () => {
+        interrupted = true;
+        admissionAbort.abort(new Error('Private smoke interrupted'));
+    };
+    signals.on('SIGINT', stop);
+    signals.on('SIGTERM', stop);
+    try {
+        if (!alreadyAllowed)
+            await store.update(before, {
+                addresses: sorted([...context.baseline, cidr]),
+                description,
+            });
+        const after = await store.read();
+        requireCondition(same(after.addresses, alreadyAllowed ? context.baseline : [...context.baseline, cidr]) && after.description === (alreadyAllowed ? '' : description), 'admission readback differs');
+        requireCondition(!interrupted, 'interrupted before admission');
+        await input.awaitAdmission(admissionAbort.signal);
+        requireCondition(!interrupted, 'interrupted before smoke');
+        const result = await input.run(lease);
+        requireCondition(!interrupted, 'smoke interrupted');
+        return result;
+    }
+    finally {
+        try {
+            await cleanupSmokeAdmission(store, context);
+            if (!alreadyAllowed)
+                await input.awaitRevocation();
+            // Signals must not abort revocation, but they must invalidate the pending
+            // return value even when smoke itself already completed successfully.
+            requireCondition(!interrupted, 'smoke interrupted during cleanup');
+        }
+        finally {
+            signals.removeListener('SIGINT', stop);
+            signals.removeListener('SIGTERM', stop);
+        }
+    }
+}
+//# sourceMappingURL=private-smoke-admission.js.map

package/src/foundation/private-smoke-control-plane.d.ts

@@ -0,0 +1,18 @@
+import { WAFV2Client } from '@aws-sdk/client-wafv2';
+import { CloudFrontClient } from '@aws-sdk/client-cloudfront';
+import type { SmokeIpSetStore } from './private-smoke-admission.js';
+import type { CanonicalDeploymentStage } from '../repository-policy/index.js';
+export interface PrivateSmokeResourceIdentity {
+    account: string;
+    stage: CanonicalDeploymentStage;
+    workspace: string;
+    policyDigest: string;
+}
+export interface PrivateSmokeClients {
+    waf: Pick<WAFV2Client, 'send'>;
+    cloudfront: Pick<CloudFrontClient, 'send'>;
+}
+/** Only global WAF resources attached to the exact generated Router are eligible. */
+export declare function openPrivateSmokeControlPlane(identity: PrivateSmokeResourceIdentity, smokeUrl: string | undefined, clients?: PrivateSmokeClients): Promise<SmokeIpSetStore & {
+    arn: string;
+}>;

package/src/foundation/private-smoke-control-plane.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openPrivateSmokeControlPlane = openPrivateSmokeControlPlane;
+const client_wafv2_1 = require("@aws-sdk/client-wafv2");
+const client_cloudfront_1 = require("@aws-sdk/client-cloudfront");
+function check(condition, message) {
+    if (!condition)
+        throw new Error(`Private smoke access: ${message}`);
+}
+/** Only global WAF resources attached to the exact generated Router are eligible. */
+async function openPrivateSmokeControlPlane(identity, smokeUrl, clients = {
+    waf: new client_wafv2_1.WAFV2Client({
+        region: 'us-east-1',
+        endpoint: 'https://wafv2.us-east-1.amazonaws.com',
+        maxAttempts: 3,
+        requestHandler: { connectionTimeout: 10_000, requestTimeout: 30_000 },
+    }),
+    cloudfront: new client_cloudfront_1.CloudFrontClient({
+        region: 'us-east-1',
+        endpoint: 'https://cloudfront.amazonaws.com',
+        maxAttempts: 3,
+        requestHandler: { connectionTimeout: 10_000, requestTimeout: 30_000 },
+    }),
+}) {
+    check(/^\d{12}$/.test(identity.account) &&
+        /^[a-z0-9][a-z0-9-]{0,62}$/.test(identity.workspace) &&
+        ['development', 'staging', 'production'].includes(identity.stage) &&
+        /^sha256:[a-f0-9]{64}$/.test(identity.policyDigest), 'invalid committed resource identity');
+    const url = smokeUrl === undefined ? undefined : new URL(smokeUrl);
+    if (url)
+        check(url.protocol === 'https:' && !url.username && !url.password && !url.port, 'credential-free HTTPS Router required');
+    const name = `foundation-${identity.stage}-router-smoke-access`;
+    const ipSets = [];
+    let marker;
+    const seen = new Set();
+    do {
+        const page = await clients.waf.send(new client_wafv2_1.ListIPSetsCommand({
+            Scope: 'CLOUDFRONT',
+            Limit: 100,
+            NextMarker: marker,
+        }));
+        ipSets.push(...(page.IPSets ?? []));
+        marker = page.NextMarker;
+        check(!marker || !seen.has(marker), 'IP-set pagination did not advance');
+        if (marker)
+            seen.add(marker);
+        check(seen.size <= 100, 'IP-set inventory exceeds bounded inspection');
+    } while (marker);
+    const matches = ipSets.filter((set) => set.Name === name);
+    check(matches.length === 1 && matches[0].Id, 'exact stage smoke-access IP set missing or ambiguous; deploy the upgraded Foundation before private smoke');
+    const selected = matches[0];
+    const arn = `arn:aws:wafv2:us-east-1:${identity.account}:global/ipset/${name}/${selected.Id}`;
+    check(selected.ARN === arn, 'IP-set account/scope/identity mismatch');
+    const expectedTags = {
+        'ebk:managed-by': 'empire-builder-kit',
+        'ebk:owner': 'foundation',
+        'ebk:stage': identity.stage,
+        'ebk:workspace': identity.workspace,
+    };
+    async function attestTags(resourceArn) {
+        const tags = {};
+        let tagMarker;
+        const markers = new Set();
+        do {
+            const page = await clients.waf.send(new client_wafv2_1.ListTagsForResourceCommand({
+                ResourceARN: resourceArn,
+                NextMarker: tagMarker,
+                Limit: 100,
+            }));
+            for (const tag of page.TagInfoForResource?.TagList ?? []) {
+                if (tag.Key && tag.Value)
+                    tags[tag.Key] = tag.Value;
+            }
+            tagMarker = page.NextMarker;
+            check(!tagMarker || !markers.has(tagMarker), 'tag pagination did not advance');
+            if (tagMarker)
+                markers.add(tagMarker);
+            check(markers.size <= 10, 'tag inventory exceeds bounded inspection');
+        } while (tagMarker);
+        for (const [key, value] of Object.entries(expectedTags))
+            check(tags[key] === value, 'WAF ownership or committed policy differs');
+        if (resourceArn === arn) {
+            // The dedicated smoke set has stable ownership, not mutable WAF policy.
+            // An older creation-time digest tag is inert. Policy binding is checked
+            // on the attached Web ACL before any admission, never during revocation.
+            check(tags['ebk:purpose'] === 'private-smoke-access', 'IP set is not owned exclusively by private smoke');
+        }
+        else {
+            check(tags['ebk:policy-digest'] === identity.policyDigest, 'WAF ownership or committed policy differs');
+        }
+    }
+    await attestTags(arn);
+    // Cleanup never expands access; exact tagged IP-set identity and lease are sufficient.
+    // Admission additionally proves the Router-to-ACL-to-IP-set attachment.
+    if (url) {
+        const distributions = [];
+        marker = undefined;
+        seen.clear();
+        do {
+            const page = await clients.cloudfront.send(new client_cloudfront_1.ListDistributionsCommand({ Marker: marker }));
+            distributions.push(...(page.DistributionList?.Items ?? []));
+            marker = page.DistributionList?.NextMarker;
+            check(!page.DistributionList?.IsTruncated || marker, 'truncated Router inventory has no continuation');
+            check(!marker || !seen.has(marker), 'Router pagination did not advance');
+            if (marker)
+                seen.add(marker);
+            check(seen.size <= 100, 'Router inventory exceeds bounded inspection');
+        } while (marker);
+        const routers = distributions.filter((router) => router.DomainName === url.hostname ||
+            router.Aliases?.Items?.includes(url.hostname));
+        check(routers.length === 1 &&
+            routers[0].Enabled &&
+            routers[0].ARN?.startsWith(`arn:aws:cloudfront::${identity.account}:distribution/`), 'exact account Router missing, disabled, or ambiguous');
+        const acls = [];
+        marker = undefined;
+        seen.clear();
+        do {
+            const page = await clients.waf.send(new client_wafv2_1.ListWebACLsCommand({
+                Scope: 'CLOUDFRONT',
+                Limit: 100,
+                NextMarker: marker,
+            }));
+            acls.push(...(page.WebACLs ?? []));
+            marker = page.NextMarker;
+            check(!marker || !seen.has(marker), 'Web ACL pagination did not advance');
+            if (marker)
+                seen.add(marker);
+            check(seen.size <= 100, 'Web ACL inventory exceeds bounded inspection');
+        } while (marker);
+        const attached = acls.filter((acl) => acl.ARN === routers[0].WebACLId);
+        check(attached.length === 1 &&
+            attached[0].Id &&
+            attached[0].Name &&
+            attached[0].ARN?.startsWith(`arn:aws:wafv2:us-east-1:${identity.account}:global/webacl/`), 'Router Web ACL is outside the exact account/scope');
+        const acl = attached[0];
+        await attestTags(acl.ARN);
+        const { WebACL } = await clients.waf.send(new client_wafv2_1.GetWebACLCommand({ Scope: 'CLOUDFRONT', Name: acl.Name, Id: acl.Id }));
+        check(WebACL?.ARN === acl.ARN, 'Web ACL readback identity differs');
+        const rules = WebACL?.Rules?.filter((rule) => rule.Name === 'StageIpAllowlist') ?? [];
+        const statement = rules[0]?.Statement?.NotStatement?.Statement;
+        const refs = statement?.IPSetReferenceStatement
+            ? [statement.IPSetReferenceStatement]
+            : statement?.OrStatement?.Statements?.map((item) => item.IPSetReferenceStatement);
+        check(rules.length === 1 &&
+            rules[0].Action?.Block &&
+            refs &&
+            refs.length >= 2 &&
+            refs.length <= 3 &&
+            refs.every((ref) => ref?.ARN) &&
+            new Set(refs.map((ref) => ref?.ARN)).size === refs.length &&
+            refs.filter((ref) => ref?.ARN === arn).length === 1, 'Router blocking rule does not reference the exact IP set');
+        // Only the unchanged same-stage baseline sets may accompany the smoke set.
+        check(refs.every((ref) => ref?.ARN === arn ||
+            ['ipv4', 'ipv6'].some((family) => ref?.ARN?.startsWith(`arn:aws:wafv2:us-east-1:${identity.account}:global/ipset/foundation-${identity.stage}-router-${family}-allowlist/`))), 'Router allowlist contains an out-of-stage reference');
+    }
+    const key = { Name: name, Id: selected.Id, Scope: 'CLOUDFRONT' };
+    return {
+        arn,
+        async read() {
+            await attestTags(arn);
+            const { IPSet, LockToken } = await clients.waf.send(new client_wafv2_1.GetIPSetCommand(key));
+            check(IPSet?.ARN === arn &&
+                IPSet.Name === name &&
+                IPSet.IPAddressVersion === 'IPV4' &&
+                LockToken &&
+                Array.isArray(IPSet.Addresses), 'live IP-set identity mismatch');
+            return {
+                addresses: IPSet.Addresses,
+                description: IPSet.Description ?? '',
+                lockToken: LockToken,
+            };
+        },
+        async update(previous, next) {
+            await attestTags(arn);
+            await clients.waf.send(new client_wafv2_1.UpdateIPSetCommand({
+                ...key,
+                LockToken: previous.lockToken,
+                Addresses: [...next.addresses],
+                Description: next.description || undefined,
+            }));
+        },
+    };
+}
+//# sourceMappingURL=private-smoke-control-plane.js.map

package/src/foundation/provision-database-bindings.d.ts

@@ -32,7 +32,12 @@ export type ProvisionedDatabaseBindings<TBindings extends DatabaseBindingDeclara
 export declare function createDatabaseBindingPlan(bindings: DatabaseBindingDeclaration, context: {
     slice: string;
     stage: string;
+    localDev?: boolean;
 }): DatabaseBindingPlan;
+/** Validate declaration shape/collisions without planning deployment or connection coordinates. */
+export declare function validateDatabaseBindings(bindings: DatabaseBindingDeclaration, context: {
+    slice: string;
+}): Pick<DatabaseBindingPlan, 'active' | 'provisioned'>;
 export declare function provisionDatabaseBindings<TBindings extends DatabaseBindingDeclaration>(foundation: FoundationInfrastructure, options: ProvisionDatabaseBindingsOptions & {
     bindings: TBindings;
 }): ProvisionedDatabaseBindings<TBindings>;

package/src/foundation/provision-database-bindings.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.selectDatabaseTarget = selectDatabaseTarget;
 exports.createDatabaseBindingPlan = createDatabaseBindingPlan;
+exports.validateDatabaseBindings = validateDatabaseBindings;
 exports.provisionDatabaseBindings = provisionDatabaseBindings;
 const local_database_contract_js_1 = require("./local-database-contract.js");
 const provision_logical_database_js_1 = require("./provision-logical-database.js");
@@ -25,6 +26,40 @@ function collisionKey(value) {
     return (0, local_database_contract_js_1.normalizePostgresIdentifier)(value).normalize('NFKC').toLowerCase();
 }
 function createDatabaseBindingPlan(bindings, context) {
+    return inspectDatabaseBindings(bindings, context.slice, (identifier) => {
+        if (!context.localDev)
+            return (0, local_database_contract_js_1.resolveLogicalDatabaseIdentifiers)({
+                database: identifier,
+                slice: context.slice,
+                stage: context.stage,
+            });
+        const local = (0, local_database_contract_js_1.resolveLocalDatabaseContract)({
+            database: identifier,
+            slice: context.slice,
+            stage: context.stage,
+        });
+        const resolved = {
+            database: local.database,
+            localDatabase: local.database,
+            localReadwriteRole: local.username,
+            readwriteRole: local.username,
+            readonlyRole: `${local.database}_readonly`,
+            migratorRole: `${local.database}_migrator`,
+        };
+        for (const [role, value] of Object.entries(resolved))
+            (0, local_database_contract_js_1.assertPostgresIdentifierLength)(value, `Local ${role} identifier`);
+        return resolved;
+    });
+}
+/** Validate declaration shape/collisions without planning deployment or connection coordinates. */
+function validateDatabaseBindings(bindings, context) {
+    const { active, provisioned } = inspectDatabaseBindings(bindings, context.slice);
+    return { active, provisioned };
+}
+function inspectDatabaseBindings(bindings, slice, resolveIdentifiers) {
+    if (typeof slice !== 'string' || slice.trim() === '') {
+        throw new Error('Product Slice name must be a non-empty string.');
+    }
     if (typeof bindings !== 'object' ||
         bindings === null ||
         Array.isArray(bindings)) {
@@ -73,17 +108,13 @@ function createDatabaseBindingPlan(bindings, context) {
             if (declared.has(identifier)) {
                 throw new Error(`Database identifier "${identifier}" is declared more than once. Each provisioned identifier must be unique across the binding set.`);
             }
-            const resolved = (0, local_database_contract_js_1.resolveLogicalDatabaseIdentifiers)({
-                database: identifier,
-                slice: context.slice,
-                stage: context.stage,
-            });
-            const key = collisionKey(resolved.database);
+            const resolved = resolveIdentifiers?.(identifier);
+            const key = collisionKey(resolved?.database ?? identifier);
             const previous = normalized.get(key);
             if (previous !== undefined) {
                 throw new Error(`Database identifiers "${previous}" and "${identifier}" collide after PostgreSQL normalization. Rename one identifier; EBK never truncates or aliases database bindings.`);
             }
-            const componentName = (0, provision_logical_database_js_1.defaultDatabaseLinkableName)(context.slice, identifier);
+            const componentName = (0, provision_logical_database_js_1.defaultDatabaseLinkableName)(slice, identifier);
             const previousComponent = componentNames.get(componentName);
             if (previousComponent !== undefined) {
                 throw new Error(`Database identifiers "${previousComponent}" and "${identifier}" collide after SST logical-name normalization as "${componentName}". Rename one identifier so every resource name is unique before deployment.`);
@@ -91,7 +122,8 @@ function createDatabaseBindingPlan(bindings, context) {
             declared.add(identifier);
             normalized.set(key, identifier);
             componentNames.set(componentName, identifier);
-            identifiers[identifier] = resolved;
+            if (resolved)
+                identifiers[identifier] = resolved;
         }
     }
     return {
@@ -107,6 +139,7 @@ function provisionDatabaseBindings(foundation, options) {
     const plan = createDatabaseBindingPlan(options.bindings, {
         slice: options.slice,
         stage: $app.stage,
+        localDev: $dev && options.localDev !== false,
     });
     const provisioned = new Map();
     for (const database of plan.provisioned) {

package/src/foundation/provision-logical-database.js

@@ -27,11 +27,6 @@ function provisionLogicalDatabase(foundation, options) {
         options.rotationToken.trim() === '') {
         throw new Error('Logical database rotationToken must be a non-empty string when supplied.');
     }
-    const identifiers = (0, local_database_contract_js_1.resolveLogicalDatabaseIdentifiers)({
-        database: options.database,
-        slice: options.slice,
-        stage: consumerStage,
-    });
     const resourceName = options.linkableName ??
         defaultDatabaseLinkableName(options.slice, options.database);
     if ($dev && (options.localDev ?? true)) {
@@ -40,7 +35,12 @@ function provisionLogicalDatabase(foundation, options) {
             password: options.localDevPassword,
             port: options.localDevPort,
             slice: options.slice,
+            stage: consumerStage,
         });
+        const readonlyRole = `${localDatabase.database}_readonly`;
+        const migratorRole = `${localDatabase.database}_migrator`;
+        (0, local_database_contract_js_1.assertPostgresIdentifierLength)(readonlyRole, 'Local read-only role identifier');
+        (0, local_database_contract_js_1.assertPostgresIdentifierLength)(migratorRole, 'Local migrator role identifier');
         return {
             db: new sst.Linkable(resourceName, {
                 properties: {
@@ -49,12 +49,17 @@ function provisionLogicalDatabase(foundation, options) {
                 },
             }),
             databaseName: localDatabase.database,
-            migratorRole: identifiers.migratorRole,
-            readonlyRole: identifiers.readonlyRole,
-            readwriteRole: identifiers.readwriteRole,
+            migratorRole,
+            readonlyRole,
+            readwriteRole: localDatabase.username,
             resourceName,
         };
     }
+    const identifiers = (0, local_database_contract_js_1.resolveLogicalDatabaseIdentifiers)({
+        database: options.database,
+        slice: options.slice,
+        stage: consumerStage,
+    });
     if (options.removalPolicy === 'destroy') {
         throw new Error('Logical database removalPolicy "destroy" requires a reviewed AWS-internal retirement workflow and is not supported by the v1 protected bootstrap.');
     }
@@ -63,8 +68,10 @@ function provisionLogicalDatabase(foundation, options) {
     const secretBasePath = `ebk/${consumerStage}/${options.slice}/database/${options.database}`;
     const tags = {
         'ebk:database': options.database,
+        'ebk:managed-by': 'empire-builder-kit',
         'ebk:management': 'generated-database-credential',
         'ebk:slice': options.slice,
+        'ebk:stage': consumerStage,
         'sst:stage': consumerStage,
     };
     // Secret containers deliberately have no SecretVersion resources. Their

package/src/foundation/requirements.d.ts

@@ -1,6 +1,6 @@
 import { type ValidationResult } from '../validation.js';
-export declare const STANDARD_FOUNDATION_CONTRACT_VERSION: 1;
-export declare const STANDARD_FOUNDATION_CAPABILITIES: readonly ["network", "routing", "container-compute", "postgres", "identity", "events", "observability", "configuration", "deployment"];
+export declare const STANDARD_FOUNDATION_CONTRACT_VERSION: 2;
+export declare const STANDARD_FOUNDATION_CAPABILITIES: readonly ["key-value", "routing", "identity", "events", "observability", "configuration", "deployment", "network", "container-compute", "postgres"];
 export type StandardFoundationCapability = (typeof STANDARD_FOUNDATION_CAPABILITIES)[number];
 export interface FoundationRequirement {
     capabilities: StandardFoundationCapability[];
@@ -20,7 +20,7 @@ export declare const foundationRequirementSchema: {
     readonly properties: {
         readonly capabilities: {
             readonly items: {
-                readonly enum: readonly ["network", "routing", "container-compute", "postgres", "identity", "events", "observability", "configuration", "deployment"];
+                readonly enum: readonly ["key-value", "routing", "identity", "events", "observability", "configuration", "deployment", "network", "container-compute", "postgres"];
                 readonly type: "string";
             };
             readonly type: "array";

package/src/foundation/requirements.js

@@ -6,18 +6,9 @@ exports.validateFoundationRequirement = validateFoundationRequirement;
 exports.validateFoundationCompatibility = validateFoundationCompatibility;
 const validation_js_1 = require("../validation.js");
 const semver_1 = require("semver");
-exports.STANDARD_FOUNDATION_CONTRACT_VERSION = 1;
-exports.STANDARD_FOUNDATION_CAPABILITIES = [
-    'network',
-    'routing',
-    'container-compute',
-    'postgres',
-    'identity',
-    'events',
-    'observability',
-    'configuration',
-    'deployment',
-];
+const capability_plan_js_1 = require("./capability-plan.js");
+exports.STANDARD_FOUNDATION_CONTRACT_VERSION = 2;
+exports.STANDARD_FOUNDATION_CAPABILITIES = capability_plan_js_1.FOUNDATION_CAPABILITY_VOCABULARY;
 const capabilitySet = new Set(exports.STANDARD_FOUNDATION_CAPABILITIES);
 function isStandardFoundationCapability(value) {
     return typeof value === 'string' && capabilitySet.has(value);
@@ -91,6 +82,7 @@ function validateFoundationCompatibility(requirement, foundation) {
         });
     }
     else {
+        const seen = new Set();
         foundation.capabilities.forEach((capability, index) => {
             if (!isStandardFoundationCapability(capability)) {
                 issues.push({
@@ -98,7 +90,27 @@ function validateFoundationCompatibility(requirement, foundation) {
                     path: `foundationDescriptor.capabilities[${index}]`,
                 });
             }
+            if (seen.has(capability)) {
+                issues.push({
+                    message: 'must not contain duplicate capabilities',
+                    path: `foundationDescriptor.capabilities[${index}]`,
+                });
+            }
+            seen.add(capability);
         });
+        if (foundation.contractVersion === '2.0.0') {
+            for (const [capability, dependency] of [
+                ['postgres', 'container-compute'],
+                ['container-compute', 'network'],
+            ]) {
+                if (seen.has(capability) && !seen.has(dependency)) {
+                    issues.push({
+                        message: `capability ${capability} requires ${dependency}`,
+                        path: 'foundationDescriptor.capabilities',
+                    });
+                }
+            }
+        }
     }
     if (requirementResult.valid &&
         typeof foundation.contractVersion === 'string' &&