@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-secret-runtime-files.js

@@ -6,16 +6,12 @@ const tool_versions_js_1 = require("../preset/tool-versions.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 const personalStagePattern = '^personal-[a-z0-9](?:[a-z0-9-]{0,25}[a-z0-9])?$';
 /** @internal */
-function renderStandardSliceSecretRuntimeFiles(name) {
-    const pascalName = name
-        .split('-')
-        .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
-        .join('');
+function renderStandardSliceSecretRuntimeFiles(name, workspace = 'workspace') {
     return {
         'secrets/workload-access.json': (0, built_in_plan_shared_js_1.json)({
             bindings: [
                 {
-                    logicalName: `${pascalName}PerformanceLoadHmacKeys`,
+                    logicalName: 'GeneratedPerformanceLoadHmacKeys',
                     workload: `${name}.web-server`,
                 },
             ],
@@ -41,6 +37,7 @@ function declarationProjection(declaration) {
     !hasOnlyProperties(declaration, [
       'cache',
       'contractVersion',
+      'generation',
       'logicalName',
       'owner',
       'requiredStages',
@@ -56,17 +53,27 @@ function declarationProjection(declaration) {
     declaration.requiredStages.some((stage) => typeof stage !== 'string') ||
     !isRecord(declaration.rotation) ||
     !['manual', 'provider-managed'].includes(declaration.rotation.mode) ||
-    !['aws-managed', 'database-bootstrap', 'operator'].includes(
+    !['aws-managed', 'database-bootstrap', 'generated', 'operator'].includes(
       declaration.source,
     ) ||
     !isRecord(declaration.value) ||
     !hasOnlyProperties(declaration.value, ['kind', 'validate']) ||
     !['binary', 'json', 'string'].includes(declaration.value.kind) ||
-    typeof declaration.value.validate !== 'function'
+    typeof declaration.value.validate !== 'function' ||
+    (declaration.source === 'generated') !==
+      (declaration.generation !== undefined) ||
+    (declaration.generation !== undefined &&
+      (!isRecord(declaration.generation) ||
+        !hasOnlyProperties(declaration.generation, ['kind']) ||
+        declaration.generation.kind !== 'hmac-key-ring-v1' ||
+        declaration.value.kind !== 'json'))
   ) {
     throw new Error('invalid');
   }
   return {
+    ...(declaration.generation === undefined
+      ? {}
+      : { generation: { kind: declaration.generation.kind } }),
     logicalName: declaration.logicalName,
     owner: declaration.owner,
     requiredStages: [...declaration.requiredStages],
@@ -80,7 +87,7 @@ function parseMetadata(value) {
   if (
     !isRecord(value) ||
     !hasOnlyProperties(value, ['declarations', 'schemaVersion']) ||
-    value.schemaVersion !== 1 ||
+    value.schemaVersion !== 2 ||
     !Array.isArray(value.declarations)
   ) {
     throw new Error('invalid');
@@ -90,6 +97,7 @@ function parseMetadata(value) {
     if (
       !isRecord(declaration) ||
       !hasOnlyProperties(declaration, [
+        'generation',
         'logicalName',
         'owner',
         'requiredStages',
@@ -106,9 +114,16 @@ function parseMetadata(value) {
       !isRecord(declaration.rotation) ||
       !hasOnlyProperties(declaration.rotation, ['mode']) ||
       !['manual', 'provider-managed'].includes(declaration.rotation.mode) ||
-      !['aws-managed', 'database-bootstrap', 'operator'].includes(
+      !['aws-managed', 'database-bootstrap', 'generated', 'operator'].includes(
         declaration.source,
       ) ||
+      (declaration.source === 'generated') !==
+        (declaration.generation !== undefined) ||
+      (declaration.generation !== undefined &&
+        (!isRecord(declaration.generation) ||
+          !hasOnlyProperties(declaration.generation, ['kind']) ||
+          declaration.generation.kind !== 'hmac-key-ring-v1' ||
+          declaration.valueKind !== 'json')) ||
       !['binary', 'json', 'string'].includes(declaration.valueKind) ||
       logicalNames.has(declaration.logicalName)
     ) {
@@ -116,6 +131,9 @@ function parseMetadata(value) {
     }
     logicalNames.add(declaration.logicalName);
     return {
+      ...(declaration.generation === undefined
+        ? {}
+        : { generation: { kind: declaration.generation.kind } }),
       logicalName: declaration.logicalName,
       owner: declaration.owner,
       requiredStages: [...declaration.requiredStages],
@@ -244,6 +262,7 @@ import {
   createPersonalSecretLedgerRecord,
   isExactSstSecretAlreadyAbsent,
 } from '@empire-builder-kit/nx/secrets';
+import { assertWorkspaceStageOwnershipForWorkspace } from '@empire-builder-kit/nx/workspace-deployment';
 import { execFile } from 'node:child_process';
 import { readFile, realpath } from 'node:fs/promises';
 import { dirname, isAbsolute, relative, resolve } from 'node:path';
@@ -489,6 +508,18 @@ async function main() {
   await verifyDeclarations(projectRoot, environment);
   const binary = await workspaceSstRuntime(workspaceRoot);
   const accountId = await requiredAwsContext(environment, profile, region);
+  const ownership = await assertWorkspaceStageOwnershipForWorkspace(
+    workspaceRoot,
+    'development',
+    {
+      configFilepath: environment.AWS_CONFIG_FILE,
+      credentialsFilepath: environment.AWS_SHARED_CREDENTIALS_FILE,
+      profile,
+    },
+  );
+  if (ownership.region !== region) {
+    throw new Error('Personal secret cleanup Region differs from its exact workspace owner tuple.');
+  }
   const identity = {
     accountId,
     region,
@@ -717,15 +748,15 @@ export function createStandardSliceSecretRuntime(
 }
 `,
         'infra/personal-secrets.ts': `import {
+  canonicalOperatorSecretName,
   parseSecretMetadataRegistry,
   parseSecretWorkloadAccessRegistry,
   personalSecretNamesForWorkload,
-  type SecretWorkloadAccessPlanEntry,
 } from '@empire-builder-kit/nx/secrets';
 import secretMetadataDocument from '../secrets/metadata.json';
 import secretWorkloadAccessDocument from '../secrets/workload-access.json';
-import { createStandardSliceWorkloadRoleTopology } from './workload-roles/candidate.js';
-import { standardSliceBoundOperatorSecretDeclarations } from './workload-roles/effective-intent.js';
+import { createStandardSliceRuntimeTopology } from './native-runtime-authority/topology.js';
+import { standardSliceBoundOperatorSecretDeclarations } from './native-runtime-authority/effective-intent.js';
 
 const metadata = parseSecretMetadataRegistry(secretMetadataDocument);
 const access = parseSecretWorkloadAccessRegistry(
@@ -806,84 +837,66 @@ function expectedBindingKeys(stage: string) {
   );
 }
 
-function createProtectedLinks(
-  protectedAccess: readonly SecretWorkloadAccessPlanEntry[],
-  stage: string,
-) {
+function createProtectedLinks(stage: string) {
   const expected = expectedBindingKeys(stage);
   const observed = new Set<string>();
-  const linksByName = new Map<
-    string,
-    { arn: string; resource: any }
-  >();
+  const linksByName = new Map<string, { resource: any }>();
   const linksByWorkload = new Map<
     string,
     Array<{ logicalName: string; resource: any }>
   >();
+  const declarationsByName = new Map(
+    metadata.declarations.map((declaration) => [
+      declaration.logicalName,
+      declaration,
+    ]),
+  );
 
-  for (const entry of protectedAccess) {
+  for (const entry of access.bindings) {
+    const declaration = declarationsByName.get(entry.logicalName);
+    if (!declaration?.requiredStages.includes(stage)) continue;
     if (
-      entry.workload !== entry.intent.workload ||
-      linksByWorkload.has(entry.workload) ||
-      entry.references.length !== entry.intent.links.length
+      (declaration.source !== 'operator' &&
+        declaration.source !== 'generated') ||
+      !entry.workload.startsWith(workloadPrefix)
     ) {
       throw new Error(
         'Protected secret access differs from the declared workload registry.',
       );
     }
-    const resources: Array<{ logicalName: string; resource: any }> = [];
-    for (const reference of entry.references) {
-      const bindingKey = entry.workload + '\\0' + reference.logicalName;
-      const link = entry.intent.links.find(
-        (candidate) =>
-          candidate.link.properties.logicalName === reference.logicalName,
+    const bindingKey = entry.workload + '\\0' + entry.logicalName;
+    if (!expected.has(bindingKey) || observed.has(bindingKey)) {
+      throw new Error(
+        'Protected secret access differs from the declared workload registry.',
       );
-      if (
-        !expected.has(bindingKey) ||
-        observed.has(bindingKey) ||
-        reference.provider !== 'aws-secrets-manager' ||
-        !link ||
-        link.link.resourceName !== reference.logicalName ||
-        link.link.properties.provider !== 'aws-secrets-manager' ||
-        link.link.properties.secretArn !== reference.secretArn ||
-        link.permission.Effect !== 'Allow' ||
-        link.permission.Action.length !== 1 ||
-        link.permission.Action[0] !== 'secretsmanager:GetSecretValue' ||
-        link.permission.Resource.length !== 1 ||
-        link.permission.Resource[0] !== reference.secretArn
-      ) {
-        throw new Error(
-          'Protected secret access differs from the declared workload registry.',
-        );
-      }
-      observed.add(bindingKey);
-      const existing = linksByName.get(reference.logicalName);
-      if (existing && existing.arn !== reference.secretArn) {
-        throw new Error(
-          'A declared secret resolved to conflicting protected references.',
+    }
+    observed.add(bindingKey);
+    const existing = linksByName.get(entry.logicalName);
+    const resource =
+      existing?.resource ??
+      (() => {
+        const name = canonicalOperatorSecretName(
+          { slice: '${name}', stage, workspace: '${workspace}' },
+          entry.logicalName,
         );
-      }
-      const resource =
-        existing?.resource ??
-        new sst.Linkable(reference.logicalName, {
+        const secret = aws.secretsmanager.getSecretOutput({ name });
+        return new sst.Linkable(entry.logicalName, {
           properties: {
-            logicalName: reference.logicalName,
+            logicalName: entry.logicalName,
             provider: 'aws-secrets-manager',
-            secretArn: reference.secretArn,
+            secretArn: secret.arn,
           },
           include: [
             sst.aws.permission({
               actions: ['secretsmanager:GetSecretValue'],
-              resources: [reference.secretArn],
+              resources: [secret.arn],
             }),
           ],
         });
-      linksByName.set(reference.logicalName, {
-        arn: reference.secretArn,
-        resource,
-      });
-      resources.push({ logicalName: reference.logicalName, resource });
-    }
+      })();
+    linksByName.set(entry.logicalName, { resource });
+    const resources = linksByWorkload.get(entry.workload) ?? [];
+    resources.push({ logicalName: entry.logicalName, resource });
     linksByWorkload.set(entry.workload, resources);
   }
   if (
@@ -898,13 +911,11 @@ function createProtectedLinks(
 }
 
 export function createStandardSliceSecretLinks(
-  input: {
-    protectedAccess?: readonly SecretWorkloadAccessPlanEntry[];
-  } = {},
+  input: Record<string, never> = {},
 ): StandardSliceSecretLinks {
   if ($dev) {
     if (
-      input.protectedAccess !== undefined ||
+      Object.keys(input).length !== 0 ||
       !personalStagePattern.test($app.stage)
     ) {
       throw new Error(
@@ -913,7 +924,7 @@ export function createStandardSliceSecretLinks(
     }
     standardSliceBoundOperatorSecretDeclarations(
       'development',
-      createStandardSliceWorkloadRoleTopology('development'),
+      createStandardSliceRuntimeTopology('development'),
     );
     const resources = new Map(
       metadata.declarations
@@ -968,10 +979,10 @@ export function createStandardSliceSecretLinks(
       'A personal stage may run only under the SST development adapter.',
     );
   }
-  const linksByWorkload = createProtectedLinks(
-    input.protectedAccess ?? [],
-    $app.stage,
-  );
+  if (Object.keys(input).length !== 0) {
+    throw new Error('Protected secret link input must be empty.');
+  }
+  const linksByWorkload = createProtectedLinks($app.stage);
   return {
     linksForWorkload(
       workload: string,

package/src/generators/slice/built-in-plan-shared.d.ts

@@ -17,7 +17,7 @@ export declare const PRODUCT_VERSIONS: {
     readonly awsSts: "^3.700.0";
     readonly drizzle: "^0.45.1";
     readonly drizzleKit: "^0.31.4";
-    readonly next: "16.2.11";
+    readonly next: "16.3.4";
     readonly pg: "^8.22.0";
     readonly playwright: "^1.59.1";
     readonly react: "19.2.8";
@@ -30,7 +30,9 @@ export declare const PRODUCT_VERSIONS: {
     readonly vitest: "4.1.4";
 };
 export declare const PRODUCT_PACKAGE_MANAGED_JSON_POINTERS: readonly ["/name", "/version", "/private", "/dependencies/@aws-sdk~1client-appconfigdata", "/dependencies/@aws-sdk~1client-cloudwatch", "/dependencies/@aws-sdk~1client-cloudwatch-logs", "/dependencies/@aws-sdk~1client-cost-explorer", "/dependencies/@aws-sdk~1client-cognito-identity-provider", "/dependencies/@aws-sdk~1client-dynamodb", "/dependencies/@aws-sdk~1client-ecs", "/dependencies/@aws-sdk~1client-eventbridge", "/dependencies/@aws-sdk~1client-s3", "/dependencies/@aws-sdk~1client-secrets-manager", "/dependencies/@aws-sdk~1client-sfn", "/dependencies/@aws-sdk~1client-sqs", "/dependencies/@aws-sdk~1rds-signer", "/dependencies/@aws-sdk~1client-ssm", "/dependencies/@aws-sdk~1client-sts", "/dependencies/@empire-builder-kit~1runtime", "/dependencies/drizzle-orm", "/dependencies/next", "/dependencies/pg", "/dependencies/react", "/dependencies/react-dom", "/dependencies/server-only", "/devDependencies/@axe-core~1playwright", "/devDependencies/@playwright~1test", "/devDependencies/@types~1node", "/devDependencies/@types~1pg", "/devDependencies/@types~1react", "/devDependencies/@types~1react-dom", "/devDependencies/drizzle-kit", "/devDependencies/vitest", "/exports/.~1api-client", "/exports/.~1api-contract", "/exports/.~1contracts"];
-export declare const STANDARD_LOCAL_DEV_ADAPTER: (name: string) => {
+export declare function standardPackageManagedJsonPointers(sql: boolean): string[];
+export declare const STANDARD_LOCAL_DEV_ADAPTER: (name: string, dependencySlices?: unknown, sql?: boolean) => {
+    dependencySlices: string[];
     adapterVersion: number;
     auth: {
         callbackPaths: string[];

package/src/generators/slice/built-in-plan-shared.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.STANDARD_LOCAL_DEV_ADAPTER = exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = exports.PRODUCT_VERSIONS = void 0;
+exports.standardPackageManagedJsonPointers = standardPackageManagedJsonPointers;
 exports.json = json;
 exports.lowerCamelIdentifier = lowerCamelIdentifier;
 exports.stableGeneratedName = stableGeneratedName;
 const node_crypto_1 = require("node:crypto");
+const contracts_js_1 = require("../../local-dev/contracts.js");
 const tool_versions_js_1 = require("../preset/tool-versions.js");
 exports.PRODUCT_VERSIONS = {
     axePlaywright: '4.12.1',
@@ -25,7 +27,7 @@ exports.PRODUCT_VERSIONS = {
     awsSts: '^3.700.0',
     drizzle: '^0.45.1',
     drizzleKit: '^0.31.4',
-    next: '16.2.11',
+    next: '16.3.4',
     pg: '^8.22.0',
     playwright: '^1.59.1',
     react: '19.2.8',
@@ -75,24 +77,44 @@ exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = [
     '/exports/.~1api-contract',
     '/exports/.~1contracts',
 ];
-const STANDARD_LOCAL_DEV_ADAPTER = (name) => ({
-    adapterVersion: 2,
-    auth: {
-        callbackPaths: [`/${name}/api/auth/callback`],
-        logoutPaths: [`/${name}/api/auth/sign-out`],
-    },
-    databaseMode: 'local',
-    healthPath: `/${name}/api/health`,
-    kind: 'web',
-    lifecycle: {
-        cleanupScope: 'checkout-local-and-personal-stage',
-        cleanupTarget: 'dev-cleanup',
-    },
-    portEnvironment: 'EBK_DEV_PORT',
-    routePrefix: `/${name}`,
-    target: 'dev',
-    websocket: true,
-});
+const SQL_PACKAGE_MANAGED_JSON_POINTERS = new Set([
+    '/dependencies/@aws-sdk~1rds-signer',
+    '/dependencies/drizzle-orm',
+    '/dependencies/pg',
+    '/devDependencies/@types~1pg',
+    '/devDependencies/drizzle-kit',
+]);
+function standardPackageManagedJsonPointers(sql) {
+    return exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS.filter((pointer) => sql || !SQL_PACKAGE_MANAGED_JSON_POINTERS.has(pointer));
+}
+const STANDARD_LOCAL_DEV_ADAPTER = (name, dependencySlices = [], sql = true) => {
+    const adapter = {
+        adapterVersion: 3,
+        dependencySlices,
+        auth: {
+            callbackPaths: [`/${name}/api/auth/callback`],
+            logoutPaths: [`/${name}/api/auth/sign-out`],
+        },
+        databaseMode: sql ? 'local' : 'none',
+        healthPath: `/${name}/api/health`,
+        kind: 'web',
+        lifecycle: {
+            cleanupScope: 'checkout-local-and-personal-stage',
+            cleanupTarget: 'dev-cleanup',
+        },
+        portEnvironment: 'EBK_DEV_PORT',
+        routePrefix: `/${name}`,
+        target: 'dev',
+        websocket: true,
+    };
+    const validated = (0, contracts_js_1.validateLocalDevAdapter)(adapter);
+    if (validated.adapterVersion !== 3)
+        throw new Error('Standard local development requires adapter v3.');
+    if (validated.dependencySlices.includes(name)) {
+        throw new Error(`Slice ${name} cannot declare itself in dependencySlices.`);
+    }
+    return { ...adapter, dependencySlices: validated.dependencySlices };
+};
 exports.STANDARD_LOCAL_DEV_ADAPTER = STANDARD_LOCAL_DEV_ADAPTER;
 function json(value) {
     return `${JSON.stringify(value, null, 2)}\n`;

package/src/generators/slice/built-in-plan-sql-events.d.ts

@@ -0,0 +1,2 @@
+/** SQL is additive: its transactions/outbox never replace the native data store. */
+export declare function renderSqlEventFiles(name: string): Readonly<Record<string, string>>;