@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-operations-files.js

@@ -6,8 +6,12 @@ const feature_registry_js_1 = require("../feature-registry.js");
 const logging_registry_js_1 = require("../logging-registry.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 /** @internal */
-function renderSliceOperationsFiles(name, workspace = 'workspace', frameworkVersion = 'workspace-installed') {
-    return {
+function renderSliceOperationsFiles(name, workspace = 'workspace', frameworkVersion = 'workspace-installed', sql = true) {
+    const pascalName = name
+        .split('-')
+        .map((segment) => segment[0]?.toUpperCase() + segment.slice(1))
+        .join('');
+    const files = {
         'operations/features.json': (0, built_in_plan_shared_js_1.json)({
             features: [
                 {
@@ -26,10 +30,14 @@ function renderSliceOperationsFiles(name, workspace = 'workspace', frameworkVers
                     description: 'Logical database health and lifecycle behavior.',
                     id: 'database',
                 },
-                {
-                    description: 'Database bootstrap, migration, and protected retirement behavior.',
-                    id: 'database-lifecycle',
-                },
+                ...(sql
+                    ? [
+                        {
+                            description: 'Database bootstrap, migration, and protected retirement behavior.',
+                            id: 'database-lifecycle',
+                        },
+                    ]
+                    : []),
                 {
                     description: 'Retention, export, correction, deletion, and hold behavior.',
                     id: 'data-lifecycle',
@@ -46,10 +54,6 @@ function renderSliceOperationsFiles(name, workspace = 'workspace', frameworkVers
                     description: 'Health and operator-facing runtime behavior.',
                     id: 'operations',
                 },
-                {
-                    description: 'Infrastructure planning, drift, approval, and convergence behavior.',
-                    id: 'infrastructure-change',
-                },
                 {
                     description: 'Performance budgets, capacity limits, protected load, cost, and resource attribution.',
                     id: 'performance',
@@ -141,6 +145,8 @@ function renderSliceOperationsFiles(name, workspace = 'workspace', frameworkVers
                 'job-data-retention-maintenance',
                 'job-data-retention-maintenance-launcher',
                 'job-data-retention-orchestration',
+                'key-value-stream-delivery',
+                'key-value-reconciliation',
                 'machine-client-provisioner',
                 'machine-authorization-proof',
                 'machine-authorization-proof-target',
@@ -148,14 +154,17 @@ function renderSliceOperationsFiles(name, workspace = 'workspace', frameworkVers
                 'next-revalidation-seeder',
                 'next-revalidation-subscriber',
                 'next-server',
+                ...(sql ? ['sql-outbox-relay'] : []),
             ],
-            databaseComponents: [
-                'database-bootstrap',
-                'database-migration',
-                'database-migration-orchestration',
-                'database-retirement',
-                'database-retirement-orchestration',
-            ],
+            databaseComponents: sql
+                ? [
+                    'database-bootstrap',
+                    'database-migration',
+                    'database-migration-orchestration',
+                    'database-retirement',
+                    'database-retirement-orchestration',
+                ]
+                : [],
             schemaVersion: logging_registry_js_1.SLICE_LOGGING_REGISTRY_SCHEMA_VERSION,
         }),
         'docs/runbooks/log-investigation.md': `# Log investigation
@@ -192,9 +201,12 @@ if (ownership.schemaVersion !== ${index_js_1.GENERATED_OWNERSHIP_SCHEMA_VERSION}
 if (!ownership.foundation.capabilities.includes('deployment')) {
   throw new Error('Slice does not declare the Foundation deployment capability.');
 }
-const databaseBindings = JSON.parse(
+${sql
+            ? `const databaseBindings = JSON.parse(
   readFileSync(new URL('../database/bindings.json', import.meta.url), 'utf8'),
 );
+`
+            : 'const databaseBindings = {};\n'}\
 const featureRegistry = JSON.parse(
   readFileSync(new URL('../operations/features.json', import.meta.url), 'utf8'),
 );
@@ -210,12 +222,6 @@ const configurationDeclarations = JSON.parse(
     'utf8',
   ),
 );
-const infrastructureChange = JSON.parse(
-  readFileSync(
-    new URL('../operations/infrastructure-change.json', import.meta.url),
-    'utf8',
-  ),
-);
 const frontend = JSON.parse(
   readFileSync(new URL('../frontend/contract.json', import.meta.url), 'utf8'),
 );
@@ -238,7 +244,6 @@ for (const [label, document] of [
   ['async work', asyncContract],
   ['configuration', configurationDeclarations],
   ['frontend', frontend],
-  ['infrastructure change', infrastructureChange],
   ['performance', performance],
   ['release', release],
   ['reliability', reliability],
@@ -282,59 +287,45 @@ if (origin) {
 process.stdout.write('${name} live-mode prerequisites verified.\\n');
 `,
         'scripts/check-database.mjs': `import { existsSync, readFileSync } from 'node:fs';
-import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';
+import { createDatabaseBindingPlan, validateDatabaseBindings } from '@empire-builder-kit/nx/foundation';
 import databaseBindings from '../database/bindings.json' with { type: 'json' };
 
 const migration = new URL('../database/migrations/0000_initial.sql', import.meta.url);
 if (!existsSync(migration) || !readFileSync(migration, 'utf8').includes('CREATE TABLE')) {
   throw new Error('The initial database migration is missing or invalid.');
 }
-const plan = createDatabaseBindingPlan(databaseBindings, {
-  slice: '${name}',
-  stage: process.env.EBK_STAGE ?? 'development',
-});
+const stage = process.env.EBK_STAGE ?? 'development';
+// Task prerequisites validate declarations before local allocation exists.
+// Canonical stages retain the complete deployed identifier/length validation.
+const plan = /^personal-[a-f0-9]{24}$/.test(stage)
+  ? validateDatabaseBindings(databaseBindings, { slice: '${name}' })
+  : createDatabaseBindingPlan(databaseBindings, { slice: '${name}', stage });
 if (!plan.active.primary) throw new Error('Database binding "primary" is required.');
 process.stdout.write('${name} database history verified.\\n');
 `,
-        'scripts/local-database.mjs': `import { spawnSync } from 'node:child_process';
-import { createDatabaseBindingPlan, resolveLocalDatabaseContract } from '@empire-builder-kit/nx/foundation';
+        'scripts/local-database.mjs': `import { fileURLToPath } from 'node:url';
+import { validateDatabaseBindings, runLocalDatabaseLifecycle } from '@empire-builder-kit/nx/foundation';
 import databaseBindings from '../database/bindings.json' with { type: 'json' };
 
 const action = process.argv[2];
 if (action !== 'up' && action !== 'down') {
   throw new Error('Usage: node scripts/local-database.mjs <up|down>');
 }
-const plan = createDatabaseBindingPlan(databaseBindings, {
+const plan = validateDatabaseBindings(databaseBindings, {
   slice: '${name}',
-  stage: 'development',
 });
 const activeDatabase = plan.active.primary;
 if (!activeDatabase) throw new Error('Database binding "primary" is required.');
-const local = resolveLocalDatabaseContract({
+await runLocalDatabaseLifecycle({
+  action,
+  composeFile: fileURLToPath(new URL('../database/docker-compose.yml', import.meta.url)),
   database: activeDatabase,
   slice: '${name}',
 });
-const project = process.env.COMPOSE_PROJECT_NAME ?? ('ebk-${name}-' + activeDatabase)
-  .replace(/[^a-z0-9_-]/g, '_')
-  .toLowerCase();
-const args = ['compose', '--project-name', project, '-f', 'database/docker-compose.yml'];
-args.push(...(action === 'up' ? ['up', '-d', '--wait'] : ['down']));
-const result = spawnSync('docker', args, {
-  env: {
-    ...process.env,
-    EBK_LOCAL_DATABASE: local.database,
-    EBK_LOCAL_DATABASE_PASSWORD: local.password,
-    EBK_LOCAL_DATABASE_PORT: String(local.port),
-    EBK_LOCAL_DATABASE_USERNAME: local.username,
-  },
-  stdio: 'inherit',
-});
-if (result.error) throw result.error;
-if (result.status !== 0) process.exit(result.status ?? 1);
 `,
         'scripts/confirm-deploy.mjs': `const stageArg = process.argv.find((value) => value.startsWith('--stage='));
 const stage = stageArg?.slice('--stage='.length) ?? 'development';
-process.stdout.write('${name} infrastructure and database migrations completed for ' + stage + '.\\n');
+process.stdout.write('${name} infrastructure${sql ? ' and database migrations' : ''} completed for ' + stage + '.\\n');
 `,
         'scripts/migrate-database.mjs': `import { createHash } from 'node:crypto';
 import {
@@ -343,6 +334,8 @@ import {
   StartExecutionCommand,
 } from '@aws-sdk/client-sfn';
 import { GetParameterCommand, SSMClient } from '@aws-sdk/client-ssm';
+import { assertWorkspaceStageOwnershipForWorkspace } from '@empire-builder-kit/nx/workspace-deployment';
+import { resolve } from 'node:path';
 import {
   createDatabaseBindingPlan,
   productSliceMigrationPath,
@@ -372,13 +365,31 @@ const selectedDatabase = selectDatabaseTarget(bindingPlan, {
   database: databaseArg?.slice('--database='.length),
 });
 
+const ownership = await assertWorkspaceStageOwnershipForWorkspace(
+  resolve(import.meta.dirname, '../../..'),
+  stage,
+  {
+    ...(process.env.AWS_PROFILE ? { profile: process.env.AWS_PROFILE } : {}),
+    ...(process.env.AWS_CONFIG_FILE ? { configFilepath: process.env.AWS_CONFIG_FILE } : {}),
+    ...(process.env.AWS_SHARED_CREDENTIALS_FILE
+      ? { credentialsFilepath: process.env.AWS_SHARED_CREDENTIALS_FILE }
+      : {}),
+  },
+);
+if (
+  process.env.AWS_REGION?.trim() &&
+  process.env.AWS_REGION.trim() !== ownership.region
+) {
+  throw new Error('Database migration Region differs from its exact workspace owner tuple.');
+}
+
 const parameterName = productSliceMigrationPath(
   foundationStage,
   stage,
   '${name}',
   selectedDatabase,
 );
-const parameter = await new SSMClient({}).send(
+const parameter = await new SSMClient({ region: ownership.region }).send(
   new GetParameterCommand({ Name: parameterName }),
 );
 const stateMachineArn = parameter.Parameter?.Value;
@@ -428,28 +439,12 @@ const baseExecutionName = [
 ].join('-').slice(0, 80);
 const databaseLifecycleCorrelationId =
   'dbm-' + executionIdentity + '-' + runAttempt;
-const sfn = new SFNClient({});
+const sfn = new SFNClient({ region: ownership.region });
 const executionArnFor = (name) =>
   stateMachineArn.replace(':stateMachine:', ':execution:') + ':' + name;
-const describeExecution = async (name) => {
+const startOrDescribeExecution = async (name) => {
   try {
-    return await sfn.send(
-      new DescribeExecutionCommand({ executionArn: executionArnFor(name) }),
-    );
-  } catch (error) {
-    if (
-      error &&
-      typeof error === 'object' &&
-      error.name === 'ExecutionDoesNotExist'
-    ) {
-      return undefined;
-    }
-    throw error;
-  }
-};
-const startExecution = async (name) => {
-  try {
-    await sfn.send(
+    const started = await sfn.send(
       new StartExecutionCommand({
         input: JSON.stringify({
           databaseLifecycleCorrelationId,
@@ -464,6 +459,10 @@ const startExecution = async (name) => {
         stateMachineArn,
       }),
     );
+    return {
+      executionArn: started.executionArn ?? executionArnFor(name),
+      status: 'RUNNING',
+    };
   } catch (error) {
     if (
       !error ||
@@ -472,6 +471,9 @@ const startExecution = async (name) => {
     ) {
       throw error;
     }
+    return await sfn.send(
+      new DescribeExecutionCommand({ executionArn: executionArnFor(name) }),
+    );
   }
 };
 const terminal = new Set([
@@ -482,9 +484,8 @@ const terminal = new Set([
 ]);
 
 let executionName = baseExecutionName;
-let execution = await describeExecution(executionName);
+let execution = await startOrDescribeExecution(executionName);
 if (
-  execution &&
   terminal.has(execution.status ?? 'UNKNOWN') &&
   execution.status !== 'SUCCEEDED' &&
   parsedRunAttempt > 1
@@ -492,14 +493,11 @@ if (
   const retrySuffix = '-retry-' + runAttempt;
   executionName =
     baseExecutionName.slice(0, 80 - retrySuffix.length) + retrySuffix;
-  execution = await describeExecution(executionName);
-}
-if (!execution) {
-  await startExecution(executionName);
+  execution = await startOrDescribeExecution(executionName);
 }
 
-const executionArn = executionArnFor(executionName);
-let status = execution?.status ?? 'RUNNING';
+const executionArn = execution.executionArn ?? executionArnFor(executionName);
+let status = execution.status ?? 'RUNNING';
 process.stdout.write(
   '[database-migration] execution=' + executionArn + ' status=' + status + '\\n',
 );
@@ -532,7 +530,139 @@ process.stdout.write(
         'sst-env.d.ts': `// Bootstrap placeholder. SST overwrites this file after install, dev, or deploy.
 export {};
 `,
-        'sst.config.ts': `export default $config({
+        'sst.config.ts': `const ebkNextBuildEnvironmentKeys = new Set([
+  'AUTH_CLIENT_ID',
+  'AUTH_USER_POOL_ID',
+  'CI',
+  'EBK_APPCONFIG_APPLICATION_ID',
+  'EBK_APPCONFIG_ENVIRONMENT_ID',
+  'EBK_APPCONFIG_PROFILE_ID',
+  'EBK_FLEET_ORIGIN',
+  'EBK_KEY_VALUE_TABLE',
+  'EBK_LOCAL_SOURCE_TREE',
+  'EBK_PERFORMANCE_ACCOUNT_FINGERPRINT',
+  'EBK_PERFORMANCE_CANDIDATE_DIGEST',
+  'EBK_PERFORMANCE_LOAD_ENABLED',
+  'EBK_PERFORMANCE_ORIGIN',
+  'EBK_PERFORMANCE_REGION',
+  'EBK_PERFORMANCE_RELEASE_ID',
+  'EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST',
+  'EBK_PERFORMANCE_SLICE',
+  'EBK_SECURE_COOKIES',
+  'EBK_SOURCE_COMMIT',
+  'EBK_STAGE',
+  'EVENT_BUS_NAME',
+  'NEXT_PUBLIC_API_URL',
+  'NEXT_TELEMETRY_DISABLED',
+  'SST',
+  'SST_RESOURCE_App',
+  'SST_RESOURCE_${pascalName}KeyValueAccess',
+${sql ? `  'SST_RESOURCE_${pascalName}PrimaryDatabase',\n` : ''}\
+  'SST_RESOURCE_FoundationIdentity',
+]);
+
+const ebkRequiredNextBuildEnvironmentKeys = [
+  'AUTH_CLIENT_ID',
+  'AUTH_USER_POOL_ID',
+  'CI',
+  'EBK_FLEET_ORIGIN',
+  'EBK_KEY_VALUE_TABLE',
+  'EBK_LOCAL_SOURCE_TREE',
+  'EBK_PERFORMANCE_ACCOUNT_FINGERPRINT',
+  'EBK_PERFORMANCE_CANDIDATE_DIGEST',
+  'EBK_PERFORMANCE_LOAD_ENABLED',
+  'EBK_PERFORMANCE_ORIGIN',
+  'EBK_PERFORMANCE_REGION',
+  'EBK_PERFORMANCE_RELEASE_ID',
+  'EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST',
+  'EBK_PERFORMANCE_SLICE',
+  'EBK_SECURE_COOKIES',
+  'EBK_SOURCE_COMMIT',
+  'EBK_STAGE',
+  'EVENT_BUS_NAME',
+  'NEXT_PUBLIC_API_URL',
+  'NEXT_TELEMETRY_DISABLED',
+  'SST',
+  'SST_RESOURCE_App',
+  'SST_RESOURCE_${pascalName}KeyValueAccess',
+${sql ? `  'SST_RESOURCE_${pascalName}PrimaryDatabase',\n` : ''}\
+  'SST_RESOURCE_FoundationIdentity',
+] as const;
+
+const ebkLocalCommandResource = {
+  __pulumiType: 'command:local:Command',
+} as unknown as new (
+  name: string,
+  args: { environment?: unknown; triggers?: unknown },
+  options?: unknown,
+) => unknown;
+
+const ebkSourceCommitPattern = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const ebkSourceTreePattern = /^[a-f0-9]{64}$/;
+
+function exactNextBuildEnvironment(value: unknown): Record<string, string> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    throw new Error('The Next build environment must resolve to one object.');
+  }
+  const environment = value as Record<string, unknown>;
+  const retained = Object.fromEntries(
+    Object.entries(environment)
+      .filter(([key]) => ebkNextBuildEnvironmentKeys.has(key))
+      .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+  );
+  for (const key of ebkRequiredNextBuildEnvironmentKeys) {
+    if (typeof retained[key] !== 'string') {
+      throw new Error('The Next build environment omitted ' + key + '.');
+    }
+  }
+  return retained as Record<string, string>;
+}
+
+// SST 4.17.1 installs its transform globals only while evaluating $config.run.
+// Register there, before infrastructure construction, rather than at module
+// load. The explicit Slice buildCommand separately routes diff/refresh invokes
+// through the wrapper.
+function registerExactNextBuildEnvironmentTransform(): void {
+  $transform(
+    ebkLocalCommandResource,
+    (
+      args: { environment?: unknown; triggers?: unknown },
+      _options: unknown,
+      resourceName: string,
+    ) => {
+      if (resourceName !== '${pascalName}WebBuilder') return;
+      const unresolvedEnvironment = args.environment as Record<
+        string,
+        unknown
+      >;
+      const resolveEnvironment = (environment: Record<string, unknown>) => {
+        const resolved = exactNextBuildEnvironment({
+          ...environment,
+          CI: 'true',
+          NEXT_TELEMETRY_DISABLED: '1',
+        });
+        const sourceCommit = resolved.EBK_SOURCE_COMMIT.trim();
+        const sourceTree = resolved.EBK_LOCAL_SOURCE_TREE.trim();
+        if (
+          !ebkSourceCommitPattern.test(sourceCommit) ||
+          !ebkSourceTreePattern.test(sourceTree)
+        ) {
+          throw new Error(
+            'The Next builder requires exact EBK commit and working-tree identities.',
+          );
+        }
+        return resolved;
+      };
+      args.environment = $output(unresolvedEnvironment).apply(
+        resolveEnvironment,
+      );
+      // Preserve SST's native per-invocation build trigger. Replacing it with
+      // source identity skips OpenNext on same-source retries on fresh runners.
+    },
+  );
+}
+
+export default $config({
   app(input: { stage?: string } | undefined) {
     const stage = input?.stage ?? 'development';
     const production = input?.stage === 'production';
@@ -544,16 +674,17 @@ export {};
       providers: {
         aws: {
           defaultTags: {
+            // SST contributes sst:app and sst:stage. Keep the provider baseline
+            // at eight tags so generated S3 asset objects remain within AWS's
+            // hard ten-tag object limit. Performance coverage requires this
+            // provider baseline; repository and production-profile identity is
+            // supplementary on resources using createStandardResourceTags.
             tags: {
               'ebk:cost-allocation': 'unallocated',
               'ebk:cost-scope': '${workspace}/${name}/' + stage,
               'ebk:framework-version': '${frameworkVersion}',
               'ebk:managed-by': 'empire-builder-kit',
               'ebk:owner': '${name}-product',
-              'ebk:production-profile':
-                process.env.EBK_PRODUCTION_PROFILE ?? 'standard',
-              'ebk:repository':
-                process.env.GITHUB_REPOSITORY ?? '${workspace}',
               'ebk:slice': '${name}',
               'ebk:stage': stage,
               'ebk:workspace': '${workspace}',
@@ -565,29 +696,379 @@ export {};
     };
   },
   async run() {
-    const personalStagePattern = /^personal-[a-z0-9](?:[a-z0-9-]{0,34}[a-z0-9])?$/;
+    const personalStagePattern = /^personal-[a-f0-9]{24}$/;
     if ($dev && !personalStagePattern.test($app.stage)) {
       throw new Error(
         'SST dev requires the framework-derived personal stage. Use ebk dev.',
       );
     }
-    if (!$dev && personalStagePattern.test($app.stage)) {
+    if (!$dev && $app.stage.startsWith('personal-')) {
+      // The task-only Nx cleanup executor derives and verifies this exact ID.
+      // It invokes native SST remove, never deploy/refresh. Pulumi destroy owns
+      // the retained resource graph; do not materialize a production graph here.
+      const cleanupTask = process.env.EBK_NX_TASK_CLEANUP;
+      if (/^[a-f0-9]{24}$/.test(cleanupTask ?? '') && $app.stage === 'personal-' + cleanupTask) {
+        return {};
+      }
       throw new Error(
         'A personal stage may run only through the framework development adapter.',
       );
     }
-    const workloadRoles = $dev
-      ? undefined
-      : await (async () => {
-          const { preflightStandardSliceWorkloadRoles } = await import(
-            './infra/workload-roles/preflight.js'
-          );
-          return preflightStandardSliceWorkloadRoles($app.stage);
-        })();
+    const {
+      installLambdaPolicyWriteOrdering,
+      installStageIamBoundaryTransforms,
+    } = await import('@empire-builder-kit/nx/aws-authority');
+    registerExactNextBuildEnvironmentTransform();
+    const accountId = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+    if (!/^[0-9]{12}$/.test(accountId)) {
+      throw new Error(
+        'Native Slice IAM boundary injection requires AWS_EXPECTED_ACCOUNT_ID.',
+      );
+    }
+    installStageIamBoundaryTransforms({
+      accountId,
+      instanceProfileResource: aws.iam.InstanceProfile,
+      registerTransform: $transform,
+      roleResource: aws.iam.Role,
+      resourceStage: $app.stage,
+      stage: ($dev ? 'development' : $app.stage) as
+        | 'development'
+        | 'staging'
+        | 'production',
+    });
+    // Order Function URL and Lambda permission policy writes before any
+    // resource registers; the pinned providers otherwise race them.
+    installLambdaPolicyWriteOrdering({
+      mergeOptions: $util.mergeOptions,
+      registerStackTransformation: $util.runtime.registerStackTransformation,
+    });
     const { app } = await import('./infra/index.js');
-    return app(workloadRoles);
+    return app();
   },
 });
+`,
+        'tools/ebk-next-dev.mjs': `import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+const require = createRequire(import.meta.url);
+const packageRoot = dirname(require.resolve('@empire-builder-kit/nx/package.json'));
+const { runNativeWebCommand } = require(join(packageRoot, 'src/local-dev/web-launch.js'));
+try {
+  process.exitCode = await runNativeWebCommand('${name}');
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}
+`,
+        'tools/ebk-next-build-environment.mjs': `import { spawnSync } from 'node:child_process';
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+
+// SST diff/refresh invokes the build outside the Command resource transform.
+// Reconstruct the child environment here so every builder path has one policy.
+const applicationKeys = new Set(${JSON.stringify([
+            'AUTH_CLIENT_ID',
+            'AUTH_USER_POOL_ID',
+            'CI',
+            'EBK_APPCONFIG_APPLICATION_ID',
+            'EBK_APPCONFIG_ENVIRONMENT_ID',
+            'EBK_APPCONFIG_PROFILE_ID',
+            'EBK_FLEET_ORIGIN',
+            'EBK_KEY_VALUE_TABLE',
+            'EBK_LOCAL_SOURCE_TREE',
+            'EBK_PERFORMANCE_ACCOUNT_FINGERPRINT',
+            'EBK_PERFORMANCE_CANDIDATE_DIGEST',
+            'EBK_PERFORMANCE_LOAD_ENABLED',
+            'EBK_PERFORMANCE_ORIGIN',
+            'EBK_PERFORMANCE_REGION',
+            'EBK_PERFORMANCE_RELEASE_ID',
+            'EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST',
+            'EBK_PERFORMANCE_SLICE',
+            'EBK_SECURE_COOKIES',
+            'EBK_SOURCE_COMMIT',
+            'EBK_STAGE',
+            'EVENT_BUS_NAME',
+            'NEXT_PUBLIC_API_URL',
+            'NEXT_TELEMETRY_DISABLED',
+            'SST',
+            'SST_RESOURCE_App',
+            `SST_RESOURCE_${pascalName}KeyValueAccess`,
+            ...(sql ? [`SST_RESOURCE_${pascalName}PrimaryDatabase`] : []),
+            'SST_RESOURCE_FoundationIdentity',
+        ], null, 2)});
+const operatingKeys = new Set(
+  [
+    'APPDATA',
+    'COMSPEC',
+    'HOME',
+    'LANG',
+    'LC_ALL',
+    'LOCALAPPDATA',
+    'PATH',
+    'PATHEXT',
+    'PROGRAMDATA',
+    'SHELL',
+    'SYSTEMROOT',
+    'TEMP',
+    'TERM',
+    'TMP',
+    'TMPDIR',
+    'TZ',
+    'USERPROFILE',
+  ].map((key) => key.toLowerCase()),
+);
+
+if (process.argv.length !== 2) {
+  throw new Error('The Next build wrapper does not accept arguments.');
+}
+
+const root = realpathSync(process.cwd());
+const openNextRoot = resolve(root, '.open-next');
+const priorSealedFunctionBundles = [
+  resolve(root, '.open-next/image-optimization-function'),
+  resolve(root, '.open-next/server-functions/default'),
+];
+if (process.platform === 'darwin') {
+  for (const priorBundle of priorSealedFunctionBundles) {
+    if (!existsSync(priorBundle)) continue;
+    if (realpathSync(priorBundle) !== priorBundle) {
+      throw new Error(
+        'The prior sealed OpenNext Function bundle has an invalid identity.',
+      );
+    }
+    const pendingDirectories = [{ depth: 0, path: priorBundle }];
+    let observedDirectories = 0;
+    while (pendingDirectories.length > 0) {
+      const current = pendingDirectories.pop();
+      if (!current) break;
+      if (current.depth > 64) {
+        throw new Error(
+          'The prior sealed OpenNext Function bundle exceeds its depth bound.',
+        );
+      }
+      observedDirectories += 1;
+      if (observedDirectories > 65_536) {
+        throw new Error(
+          'The prior sealed OpenNext Function bundle exceeds its directory bound.',
+        );
+      }
+      const identity = lstatSync(current.path, { bigint: true });
+      if (!identity.isDirectory() || identity.isSymbolicLink()) {
+        throw new Error(
+          'The prior sealed OpenNext Function directory changed identity.',
+        );
+      }
+      if ((identity.mode & 0o200n) === 0n) {
+        chmodSync(current.path, Number((identity.mode & 0o7_777n) | 0o200n));
+      }
+      for (const entry of readdirSync(current.path, {
+        withFileTypes: true,
+      }).sort((left, right) =>
+        left.name < right.name ? -1 : left.name > right.name ? 1 : 0,
+      )) {
+        if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+        const entryPath = join(current.path, entry.name);
+        const confined = relative(priorBundle, entryPath);
+        if (
+          confined === '..' ||
+          confined.startsWith('../') ||
+          resolve(priorBundle, confined) !== entryPath
+        ) {
+          throw new Error(
+            'The prior sealed OpenNext Function directory escapes its root.',
+          );
+        }
+        pendingDirectories.push({ depth: current.depth + 1, path: entryPath });
+      }
+    }
+  }
+  if (existsSync(openNextRoot)) {
+    const identity = lstatSync(openNextRoot, { bigint: true });
+    if (
+      !identity.isDirectory() ||
+      identity.isSymbolicLink() ||
+      realpathSync(openNextRoot) !== openNextRoot
+    ) {
+      throw new Error('The prior OpenNext build root has an invalid identity.');
+    }
+    rmSync(openNextRoot, {
+      force: true,
+      maxRetries: 8,
+      recursive: true,
+      retryDelay: 50,
+    });
+    if (existsSync(openNextRoot)) {
+      throw new Error('The prior OpenNext build root was not removed.');
+    }
+  }
+}
+
+const environment = Object.fromEntries(
+  Object.entries(process.env)
+    .filter(
+      ([key, value]) =>
+        typeof value === 'string' &&
+        (applicationKeys.has(key) || operatingKeys.has(key.toLowerCase())),
+    )
+    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+);
+const windows = process.platform === 'win32';
+const result = spawnSync(
+  windows ? 'cmd.exe' : 'npx',
+  windows
+    ? ['/d', '/s', '/c', 'npx --yes @opennextjs/aws@3.9.14 build']
+    : ['--yes', '@opennextjs/aws@3.9.14', 'build'],
+  {
+    cwd: process.cwd(),
+    env: environment,
+    stdio: 'inherit',
+    windowsHide: true,
+  },
+);
+if (result.error) throw result.error;
+if (result.signal) {
+  throw new Error('The Next build command exited from signal ' + result.signal + '.');
+}
+if (result.status !== 0) {
+  process.exitCode = result.status ?? 1;
+} else {
+  // Finder can create .DS_Store files anywhere below OpenNext's assembled
+  // output while the macOS build is running. They have no runtime meaning,
+  // but SST includes them in Lambda archives, so their presence makes one
+  // immutable source alternate between different code object hashes. Remove
+  // only this exact derived metadata before SST archives the output.
+  if (realpathSync(openNextRoot) !== openNextRoot) {
+    throw new Error('The OpenNext build root has an invalid identity.');
+  }
+  const pendingDirectories = [{ depth: 0, path: openNextRoot }];
+  let observedEntries = 0;
+  let removedFinderMetadata = 0;
+  while (pendingDirectories.length > 0) {
+    const current = pendingDirectories.pop();
+    if (!current) break;
+    if (current.depth > 64) {
+      throw new Error('The OpenNext build tree exceeds its depth bound.');
+    }
+    for (const entry of readdirSync(current.path, { withFileTypes: true }).sort(
+      (left, right) =>
+        left.name < right.name ? -1 : left.name > right.name ? 1 : 0,
+    )) {
+      observedEntries += 1;
+      if (observedEntries > 65_536) {
+        throw new Error('The OpenNext build tree exceeds its entry bound.');
+      }
+      const entryPath = join(current.path, entry.name);
+      const identity = lstatSync(entryPath, { bigint: true });
+      if (entry.name === '.DS_Store') {
+        removedFinderMetadata += 1;
+        if (
+          removedFinderMetadata > 256 ||
+          !identity.isFile() ||
+          identity.isSymbolicLink() ||
+          identity.nlink !== 1n ||
+          identity.size > 1_048_576n
+        ) {
+          throw new Error('The OpenNext Finder metadata has an invalid identity.');
+        }
+        unlinkSync(entryPath);
+        if (existsSync(entryPath)) {
+          throw new Error('The OpenNext Finder metadata was not removed.');
+        }
+        continue;
+      }
+      if (identity.isDirectory() && !identity.isSymbolicLink()) {
+        const confined = relative(openNextRoot, entryPath);
+        if (
+          confined === '..' ||
+          confined.startsWith('../') ||
+          resolve(openNextRoot, confined) !== entryPath
+        ) {
+          throw new Error('The OpenNext build entry escapes its root.');
+        }
+        pendingDirectories.push({ depth: current.depth + 1, path: entryPath });
+      }
+    }
+  }
+
+  // OpenNext 3.9.14 installs the image optimizer dependencies in an npm
+  // mkdtemp directory and copies npm's hidden package lock into the deployed
+  // bundle. npm records that random directory basename as the lock name. The
+  // name has no runtime meaning, but without this exact normalization two
+  // builds of one source produce different Lambda ZIP bytes.
+  const lockPath = resolve(
+    process.cwd(),
+    '.open-next/image-optimization-function/node_modules/.package-lock.json',
+  );
+  const lockParent = realpathSync(dirname(lockPath));
+  const confinedParent = relative(root, lockParent);
+  if (
+    confinedParent === '..' ||
+    confinedParent.startsWith('../') ||
+    resolve(lockParent, '.package-lock.json') !== lockPath
+  ) {
+    throw new Error('The OpenNext image optimizer package lock escapes the build root.');
+  }
+  const before = lstatSync(lockPath, { bigint: true });
+  if (
+    !before.isFile() ||
+    before.isSymbolicLink() ||
+    before.nlink !== 1n ||
+    before.size < 2n ||
+    before.size > 131_072n
+  ) {
+    throw new Error('The OpenNext image optimizer package lock has an invalid identity.');
+  }
+  const raw = readFileSync(lockPath, 'utf8');
+  if (Buffer.byteLength(raw, 'utf8') !== Number(before.size)) {
+    throw new Error('The OpenNext image optimizer package lock changed while reading.');
+  }
+  const parsed = JSON.parse(raw);
+  if (
+    parsed === null ||
+    typeof parsed !== 'object' ||
+    Array.isArray(parsed) ||
+    !/^open-next-install-image-optimization-function[A-Za-z0-9]{6}$/u.test(
+      parsed.name,
+    ) ||
+    parsed.lockfileVersion !== 3 ||
+    parsed.requires !== true ||
+    parsed.packages === null ||
+    typeof parsed.packages !== 'object' ||
+    Array.isArray(parsed.packages)
+  ) {
+    throw new Error('The OpenNext image optimizer package lock shape is unsupported.');
+  }
+  parsed.name = 'open-next-image-optimization-function';
+  const normalized = JSON.stringify(parsed, null, 2) + '\\n';
+  const temporaryPath = join(lockParent, '.package-lock.json.ebk-normalized');
+  writeFileSync(temporaryPath, normalized, {
+    encoding: 'utf8',
+    flag: 'wx',
+    mode: Number(before.mode & 0o777n),
+  });
+  chmodSync(temporaryPath, Number(before.mode & 0o777n));
+  renameSync(temporaryPath, lockPath);
+  const after = lstatSync(lockPath, { bigint: true });
+  if (
+    !after.isFile() ||
+    after.isSymbolicLink() ||
+    after.nlink !== 1n ||
+    after.mode !== before.mode ||
+    readFileSync(lockPath, 'utf8') !== normalized
+  ) {
+    throw new Error('The normalized OpenNext image optimizer package lock is invalid.');
+  }
+}
 `,
         'tsconfig.json': (0, built_in_plan_shared_js_1.json)({
             extends: '../../tsconfig.base.json',
@@ -613,6 +1094,7 @@ export {};
                 'api/**/*.ts',
                 'infra/**/*.ts',
                 'jobs/**/*.ts',
+                'performance/**/*.ts',
                 'reliability/**/*.ts',
                 'secrets/**/*.ts',
                 'services/**/*.ts',
@@ -626,5 +1108,11 @@ export {};
             exclude: ['.sst', 'dist', 'node_modules'],
         }),
     };
+    const sqlOnlyPaths = new Set([
+        'scripts/check-database.mjs',
+        'scripts/local-database.mjs',
+        'scripts/migrate-database.mjs',
+    ]);
+    return Object.fromEntries(Object.entries(files).filter(([path]) => sql || !sqlOnlyPaths.has(path)));
 }
 //# sourceMappingURL=built-in-plan-operations-files.js.map