@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-database-lifecycle-files.js

@@ -300,7 +300,7 @@ RUN --network=none pnpm --config.inject-workspace-packages=true --config.store-d
 
 FROM ${frozen_container_js_1.WORKLOAD_CONTAINER_NODE_IMAGE}
 WORKDIR /app
-ADD --checksum=sha256:e5bb2084ccf45087bda1c9bffdea0eb15ee67f0b91646106e466714f9de3c7e3 https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem ./rds-global-bundle.pem
+ADD --chown=node:node --chmod=0444 --checksum=sha256:fe45bbebf92ad3e27a583bbb2ddd1553c521ed4d49af5514dc0a40372ea5395c https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem ./rds-global-bundle.pem
 COPY --from=build --chown=node:node /opt/migration ./
 COPY --chown=node:node packages/${name}/jobs/database-lifecycle-logging.mjs ./jobs/database-lifecycle-logging.mjs
 COPY --chown=node:node packages/${name}/jobs/bootstrap-database.mjs ./jobs/bootstrap-database.mjs
@@ -1253,6 +1253,11 @@ const waitForSecretAbsence = async ({
   }
 };
 const requiredConfiguration = (environment) => {
+  const retirementId = requiredPattern(
+    environment,
+    'EBK_RETIREMENT_ID',
+    /^[A-Za-z0-9._:/-]{1,128}$/,
+  );
   const slice = requiredExact(environment, 'EBK_SLICE', '${name}');
   const databaseIdentifier = requiredExact(
     environment,
@@ -1327,11 +1332,7 @@ const requiredConfiguration = (environment) => {
       'EBK_REGISTRATION_DIGEST',
       DIGEST_PATTERN,
     ),
-    retirementId: requiredPattern(
-      environment,
-      'EBK_RETIREMENT_ID',
-      /^[A-Za-z0-9._:/-]{1,128}$/,
-    ),
+    retirementId,
     retainedSiblings: requireRetainedSiblings(environment, slice),
     readwriteRole,
     readwriteSecretArn,
@@ -1585,7 +1586,13 @@ if (
   process.argv[1] &&
   import.meta.url === pathToFileURL(process.argv[1]).href
 ) {
-  runDatabaseRetirementRehearsal().catch(() => {
+  runDatabaseRetirementRehearsal().catch((error) => {
+    if (
+      error instanceof Error &&
+      error.message === 'EBK_RETIREMENT_ID is required.'
+    ) {
+      process.stderr.write('EBK_RETIREMENT_ID is required.\\n');
+    }
     process.exitCode = 1;
   });
 }
@@ -1609,9 +1616,9 @@ const requiredIdentifier = (name) => {
   }
   return value;
 };
-const quoteIdentifier = (value) => '"' + value.replaceAll('"', '""') + '"';
 let migrationId = 'unresolved';
 let migrationPhase = 'configuration';
+let failedMigrationPhase;
 let lifecycleLogger;
 
 const log = (event, fields = {}) => lifecycleLogger?.emit(event, fields);
@@ -1734,7 +1741,7 @@ async function main() {
   const host = required('EBK_DATABASE_HOST');
   const database = required('EBK_DATABASE_NAME');
   const username = required('EBK_DATABASE_USERNAME');
-  const readwriteRole = requiredIdentifier('EBK_DATABASE_READWRITE_ROLE');
+  requiredIdentifier('EBK_DATABASE_READWRITE_ROLE');
   const region = required('AWS_REGION');
   const caBundlePath = required('EBK_RDS_CA_BUNDLE');
   const port = Number(required('EBK_DATABASE_PORT'));
@@ -1794,6 +1801,8 @@ async function main() {
   });
 
   let locked = false;
+  let migrationCount = 0;
+  let cleanupFailure;
   try {
     migrationPhase = 'lock';
     await client.query("SET lock_timeout = '5min'");
@@ -1863,37 +1872,47 @@ async function main() {
         throw error;
       }
     }
-    migrationPhase = 'audit-capability';
-    await client.query(
-      'REVOKE UPDATE, DELETE, TRUNCATE ON TABLE ' +
-        'authorization_audit, data_lifecycle_audit FROM ' +
-        quoteIdentifier(readwriteRole),
-    );
-    await client.query(
-      'GRANT EXECUTE ON FUNCTION ' +
-        'ebk_prune_authorization_audit(timestamptz, integer), ' +
-        'ebk_prune_data_lifecycle_audit(timestamptz, integer) TO ' +
-        quoteIdentifier(readwriteRole),
-    );
+    // Optional SQL owns only declared feature migrations. Framework audit,
+    // authorization, inbox and retention stay on their DynamoDB adapters.
     if (clientFailure) throw clientFailure;
-    log('migration_completed', { count: files.length });
+    migrationCount = files.length;
+  } catch (error) {
+    failedMigrationPhase = migrationPhase;
+    throw error;
   } finally {
     migrationPhase = 'cleanup';
     if (locked) {
       await client.query(
         'SELECT pg_advisory_unlock(hashtextextended($1, 0))',
         [migrationId],
-      ).catch(() => undefined);
+      ).catch((error) => { cleanupFailure = error; });
+    }
+    await client.end().catch((error) => { cleanupFailure ??= error; });
+    if (cleanupFailure) {
+      log('database_client_error', {
+        phase: 'cleanup',
+        ...safeErrorFields(cleanupFailure),
+      });
     }
-    await client.end().catch(() => undefined);
   }
+  // A primary failure propagates through finally; only successful work reaches
+  // this point, where cleanup failure still prevents accepted completion.
+  if (cleanupFailure) throw cleanupFailure;
+  log('migration_completed', { count: migrationCount });
 }
 
 await main().catch((error) => {
   log('migration_failed', {
-    phase: migrationPhase,
+    phase: failedMigrationPhase ?? migrationPhase,
     ...safeErrorFields(error),
   });
+  if (
+    !lifecycleLogger &&
+    error instanceof Error &&
+    error.message === 'EBK_MIGRATION_ID is required.'
+  ) {
+    process.stderr.write('EBK_MIGRATION_ID is required.\\n');
+  }
   process.exitCode = 1;
 });
 `,

package/src/generators/slice/built-in-plan-database-retirement-rehearsal-files.js

@@ -344,15 +344,34 @@ export async function runProtectedDatabaseRetirementRehearsal({
 }
 function renderDatabaseRetirementRehearsalEntry() {
     return `import { SFNClient } from '@aws-sdk/client-sfn';
+import { assertWorkspaceStageOwnershipForWorkspace } from '@empire-builder-kit/nx/workspace-deployment';
+import { resolve } from 'node:path';
 import databaseBindings from '../database/bindings.json' with { type: 'json' };
 import registrationDocument from '../operations/database-retirement-rehearsal.json' with { type: 'json' };
 import { runProtectedDatabaseRetirementRehearsal } from './database-retirement-rehearsal.mjs';
 
+const ownership = await assertWorkspaceStageOwnershipForWorkspace(
+  resolve(import.meta.dirname, '../../..'),
+  'development',
+  {
+    ...(process.env.AWS_PROFILE ? { profile: process.env.AWS_PROFILE } : {}),
+    ...(process.env.AWS_CONFIG_FILE ? { configFilepath: process.env.AWS_CONFIG_FILE } : {}),
+    ...(process.env.AWS_SHARED_CREDENTIALS_FILE
+      ? { credentialsFilepath: process.env.AWS_SHARED_CREDENTIALS_FILE }
+      : {}),
+  },
+);
+if (
+  process.env.AWS_REGION?.trim() &&
+  process.env.AWS_REGION.trim() !== ownership.region
+) {
+  throw new Error('Database retirement Region differs from its exact workspace owner tuple.');
+}
 const result = await runProtectedDatabaseRetirementRehearsal({
   arguments: process.argv.slice(2),
   bindings: databaseBindings,
   registrationDocument,
-  sfn: new SFNClient({}),
+  sfn: new SFNClient({ region: ownership.region }),
 });
 process.stdout.write(JSON.stringify(result) + '\\n');
 `;
@@ -409,7 +428,11 @@ The command accepts no arguments, so an operator cannot supply a stage, Slice,
 database, state machine, task, role, network, image, or command override.
 
 Run the generated \`db-retirement-rehearsal\` target only through the protected
-workflow. The deployment role needs
+workflow: the run binds the reviewed candidate image digest and a deployment role
+scoped to the one registered state machine, and those exist only there. Locally,
+an agent may complete the registration and binding edits above, prepare them
+for review, and propose the workflow run; it does not start the state machine
+from a workstation. The deployment role needs
 \`states:StartExecution\` on the exact registered state machine and
 \`states:DescribeExecution\` on its exact execution namespace. It receives no
 database credential, secret-value, SQL, \`rds-db:connect\`, or arbitrary ECS

package/src/generators/slice/built-in-plan-foundation-files.d.ts

@@ -1,2 +1,3 @@
+import { type FoundationCapability } from '../../foundation/capability-plan.js';
 /** @internal */
-export declare function renderSliceFoundationFiles(name: string, pascalName: string): Readonly<Record<string, string>>;
+export declare function renderSliceFoundationFiles(name: string, pascalName: string, capabilities?: readonly FoundationCapability[]): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-foundation-files.js

@@ -1,8 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderSliceFoundationFiles = renderSliceFoundationFiles;
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
 /** @internal */
-function renderSliceFoundationFiles(name, pascalName) {
+function renderSliceFoundationFiles(name, pascalName, capabilities = capability_plan_js_1.LEGACY_STANDARD_FOUNDATION_CAPABILITIES) {
+    const network = capabilities.includes('network');
+    const containers = capabilities.includes('container-compute');
+    const postgres = capabilities.includes('postgres');
+    if ((postgres && (!network || !containers)) || (containers && !network))
+        throw new Error('Slice Foundation requirements must include complete network/container/SQL dependencies.');
     return {
         'infra/foundation.ts': `import {
   foundationSsmPath,
@@ -10,7 +16,6 @@ function renderSliceFoundationFiles(name, pascalName) {
   productSliceRegistrationPath,
   productSliceRetentionPath,
   resolveFoundationStages,
-  type FoundationDiscovery,
 } from '@empire-builder-kit/nx/foundation';
 
 const stages = resolveFoundationStages({
@@ -24,7 +29,7 @@ function foundationParameter(name: Parameters<typeof foundationSsmPath>[1]) {
   }).value;
 }
 
-export function getFoundation(): FoundationDiscovery {
+export function getFoundation() {
   return {
     accountCostPolicyDigest: foundationParameter('accountCostPolicyDigest'),
     accountMonthlyMaximumUsd: foundationParameter(
@@ -34,9 +39,13 @@ export function getFoundation(): FoundationDiscovery {
     capabilities: foundationParameter('capabilities').apply((value: string) =>
       value.split(',').map((capability) => capability.trim()),
     ),
-    clusterId: foundationParameter('clusterId'),
+${containers
+            ? `    clusterId: foundationParameter('clusterId'),
+`
+            : ''}\
     contractVersion: foundationParameter('contractVersion'),
-    databaseClusterArn: foundationParameter('databaseClusterArn'),
+${postgres
+            ? `    databaseClusterArn: foundationParameter('databaseClusterArn'),
     databaseClusterEndpoint: foundationParameter('databaseClusterEndpoint'),
     databaseClusterId: foundationParameter('databaseClusterId'),
     databaseClusterResourceId: foundationParameter(
@@ -45,6 +54,8 @@ export function getFoundation(): FoundationDiscovery {
     databaseHost: foundationParameter('databaseHost'),
     databaseMasterSecretArn: foundationParameter('databaseMasterSecretArn'),
     databasePort: foundationParameter('databasePort').apply(Number),
+`
+            : ''}\
     eventBusArn: foundationParameter('eventBusArn'),
     eventBusName: foundationParameter('eventBusName'),
     hasPublicDomain: foundationParameter('hasPublicDomain').apply(
@@ -59,17 +70,26 @@ export function getFoundation(): FoundationDiscovery {
     routerDistributionId: foundationParameter('routerDistributionId'),
     routerUrl: foundationParameter('routerUrl'),
     schemaVersion: foundationParameter('schemaVersion').apply(Number),
-    vpcId: foundationParameter('vpcId'),
-  } as FoundationDiscovery;
+${network
+            ? `    vpcId: foundationParameter('vpcId'),
+`
+            : ''}\
+  };
 }
 
 export function getFoundationInfrastructure() {
   const discovery = getFoundation();
-  const vpc = sst.aws.Vpc.get('FoundationVpc', discovery.vpcId);
-  const cluster = sst.aws.Cluster.get('FoundationCluster', {
+${network
+            ? `  const vpc = sst.aws.Vpc.get('FoundationVpc', discovery.vpcId);
+`
+            : ''}\
+${containers
+            ? `  const cluster = sst.aws.Cluster.get('FoundationCluster', {
     id: discovery.clusterId,
     vpc,
   });
+`
+            : ''}\
   const router = sst.aws.Router.get(
     'FoundationRouter',
     discovery.routerDistributionId,
@@ -83,8 +103,9 @@ export function getFoundationInfrastructure() {
     discovery.eventBusName,
   );
   return {
-    cluster,
-    database: {
+${containers ? '    cluster,\n' : ''}\
+${postgres
+            ? `    database: {
       clusterArn: discovery.databaseClusterArn,
       clusterEndpoint: discovery.databaseClusterEndpoint,
       clusterResourceId: discovery.databaseClusterResourceId,
@@ -92,11 +113,13 @@ export function getFoundationInfrastructure() {
       masterSecretArn: discovery.databaseMasterSecretArn,
       port: discovery.databasePort,
     },
+`
+            : ''}\
     discovery,
     eventBus,
     router,
     userPool,
-    vpc,
+${network ? '    vpc,\n' : ''}\
   };
 }
 
@@ -110,7 +133,7 @@ export function registerProductSlice() {
     type: 'String',
     value: JSON.stringify({
       consumerStage: stages.consumerStage,
-      foundationContract: '^1.0.0',
+      foundationContract: '^2.0.0',
       foundationStage: stages.foundationStage,
       name: '${name}',
       registrationVersion: 1,
@@ -150,15 +173,15 @@ export function registerProductRetention(stateMachineArn: any) {
 `,
         'infra/index.ts': `import { getFoundation, registerProductSlice } from './foundation.js';
 import { product } from './product.js';
-import type { StandardSliceWorkloadRolePreflight } from './workload-roles/preflight.js';
 
-export function app(workloadRoles?: StandardSliceWorkloadRolePreflight) {
+export function app() {
   const foundation = getFoundation();
   const registration = registerProductSlice();
-  const resources = product(workloadRoles);
+  const resources = product();
   return {
     apiUrl: resources.api.url,
     authClientId: resources.authClient.id,
+    authUserPoolId: foundation.identityUserPoolId,
     configurationApplicationId:
       resources.configurationApplication?.id ?? 'local-only',
     configurationEnvironmentId:
@@ -173,8 +196,6 @@ export function app(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     performanceEndpoint: resources.performanceEndpoint ?? 'disabled',
     registration: registration.name,
     stage: $app.stage,
-    workloadRoleManifestDigest:
-      workloadRoles?.registry.manifestDigest ?? 'local-dev-ephemeral',
     webUrl: resources.web.url,
   };
 }

package/src/generators/slice/built-in-plan-frontend-files.js

@@ -47,7 +47,7 @@ function renderProductFrontendFiles(name, pascalName) {
             },
             deploymentProof: {
                 generatedStandardProfile: 'server-rendered-opennext',
-                privateStaticFirstProfile: 'gupta-leary-site',
+                privateStaticFirstProfile: 'reference-static-site',
                 staticExportSliceGeneration: 'post-1.0',
             },
             evidence: {
@@ -185,7 +185,7 @@ interaction boundary and may receive only intentional serializable view models.
 Application policy, validation, and mutations remain server-authoritative.
 
 The generated Standard profile proves server-rendered OpenNext behavior. The
-required static-first proof belongs to the private \`gupta-leary-site\`
+required static-first proof belongs to the private \`reference-static-site\`
 application. Static-export Slice generation and an organization design-system
 generator are post-1.0 work; do not imitate either contract inside this Slice.
 
@@ -309,6 +309,13 @@ looks reusable.
 
 ## Manual review
 
+An agent driving a real browser may perform and record the keyboard, focus,
+zoom/reflow, reduced-motion, and announcement checks below and attach them to
+the visual report. A human using actual assistive technology (screen reader,
+switch access, or magnifier) completes the assistive-technology pass and is
+recorded as the reviewer for that pass; the quarantine approver must still be
+distinct from the owner.
+
 Confirm, at minimum:
 
 1. landmark and heading order, names, roles, descriptions, and state;
@@ -389,6 +396,10 @@ export function requireServerWebConfiguration(
   padding: 1.5rem;
 }
 
+.fixturePage {
+  overflow-wrap: anywhere;
+}
+
 .fixture a {
   color: #0645ad;
   text-decoration-thickness: .12em;
@@ -702,7 +713,7 @@ export default async function FrontendStates({
   searchParams,
 }: Readonly<{ searchParams: Promise<{ state?: string }> }>) {
   const state = fixtureState((await searchParams).state);
-  return <main>
+  return <main className={styles.fixturePage}>
     <h1>${pascalName} neutral frontend states</h1>
     <p>
       This managed route contains synthetic accessibility evidence, not product

package/src/generators/slice/built-in-plan-infrastructure-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderProductInfrastructureFiles(name: string, pascalName: string, workspace: string): Readonly<Record<string, string>>;
+export declare function renderProductInfrastructureFiles(name: string, pascalName: string, workspace: string, protectedRuntimeStages?: readonly ('development' | 'production' | 'staging')[], sql?: boolean, network?: boolean): Readonly<Record<string, string>>;