@empire-builder-kit/nx 1.0.0-rc.43 → 1.0.0-rc.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.43",
+  "version": "1.0.0-rc.44",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -145,7 +145,7 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.43",
+    "@empire-builder-kit/runtime": "1.0.0-rc.44",
     "@aws-sdk/client-cloudfront": "^3.700.0",
     "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
@@ -178,5 +178,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "7703b131fbcd59bc364ce7f914a1ff22250378c9"
+  "gitHead": "37e9dfcf2fcd9561ca389019600206d05975598a"
 }

package/src/generators/preset/dependency-overrides.d.ts

@@ -3,6 +3,29 @@ export interface DependencyOverrides {
     schemaVersion: 1;
     overrides: Record<string, string>;
 }
+/**
+ * Reviewed overrides seeded into a workspace that has no
+ * `supply-chain/dependency-overrides.json` yet. Each selector names an exact
+ * transitive release that the keyed `nx` version pins and that carries a high
+ * advisory; each target is clean and older than the generated minimum release
+ * age. The overrides are derived from that one `nx` release, so a spec fails
+ * when the framework or generated `nx` pin moves and the list must be
+ * reviewed again. An existing seeded file always wins over these defaults.
+ *
+ * A `name@x.y.z` selector is not limited to the `nx` pin. pnpm rewrites every
+ * dependency whose declared range includes x.y.z (in practice a caret or tilde
+ * range on the same major), so minimatch's `brace-expansion` range `^5.0.5`
+ * also resolves 5.0.12. A declared range that excludes x.y.z keeps its own
+ * resolution.
+ */
+export declare const DEFAULT_DEPENDENCY_OVERRIDES: {
+    readonly nxVersion: "23.2.1";
+    readonly overrides: {
+        readonly 'axios@1.18.1': "1.20.0";
+        readonly 'brace-expansion@5.0.9': "5.0.12";
+        readonly 'smol-toml@1.6.1': "1.9.0";
+    };
+};
 /** Seeded pins are data, never package-manager hooks or alternate registries. */
 export declare function parseDependencyOverrides(value: unknown): DependencyOverrides;
 export declare function renderDependencyOverridesYaml(value: DependencyOverrides): string;

package/src/generators/preset/dependency-overrides.js

@@ -1,11 +1,34 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEPENDENCY_OVERRIDES_PATH = void 0;
+exports.DEFAULT_DEPENDENCY_OVERRIDES = exports.DEPENDENCY_OVERRIDES_PATH = void 0;
 exports.parseDependencyOverrides = parseDependencyOverrides;
 exports.renderDependencyOverridesYaml = renderDependencyOverridesYaml;
 const semver_1 = require("semver");
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 exports.DEPENDENCY_OVERRIDES_PATH = 'supply-chain/dependency-overrides.json';
+/**
+ * Reviewed overrides seeded into a workspace that has no
+ * `supply-chain/dependency-overrides.json` yet. Each selector names an exact
+ * transitive release that the keyed `nx` version pins and that carries a high
+ * advisory; each target is clean and older than the generated minimum release
+ * age. The overrides are derived from that one `nx` release, so a spec fails
+ * when the framework or generated `nx` pin moves and the list must be
+ * reviewed again. An existing seeded file always wins over these defaults.
+ *
+ * A `name@x.y.z` selector is not limited to the `nx` pin. pnpm rewrites every
+ * dependency whose declared range includes x.y.z (in practice a caret or tilde
+ * range on the same major), so minimatch's `brace-expansion` range `^5.0.5`
+ * also resolves 5.0.12. A declared range that excludes x.y.z keeps its own
+ * resolution.
+ */
+exports.DEFAULT_DEPENDENCY_OVERRIDES = {
+    nxVersion: '23.2.1',
+    overrides: {
+        'axios@1.18.1': '1.20.0',
+        'brace-expansion@5.0.9': '5.0.12',
+        'smol-toml@1.6.1': '1.9.0',
+    },
+};
 function isSelector(value) {
     const parts = value.split('>');
     if (parts.length > 2)

package/src/generators/preset/tool-versions.d.ts

@@ -7,7 +7,7 @@
 export declare const WORKSPACE_SST_VERSION: "4.17.1";
 export declare const WORKSPACE_NODE_VERSION: "22.23.1";
 export declare const WORKSPACE_PNPM_VERSION: "11.20.0";
-export declare const WORKSPACE_VITEST_VERSION: "4.1.4";
+export declare const WORKSPACE_VITEST_VERSION: "4.1.11";
 export declare const WORKSPACE_PNPM_SHA512: "9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 export declare const WORKSPACE_PNPM_DESCRIPTOR: "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 /**

package/src/generators/preset/tool-versions.js

@@ -10,7 +10,7 @@ exports.WORKSPACE_SST_NPM_INTEGRITY = exports.WORKSPACE_PNPM_DESCRIPTOR = export
 exports.WORKSPACE_SST_VERSION = '4.17.1';
 exports.WORKSPACE_NODE_VERSION = '22.23.1';
 exports.WORKSPACE_PNPM_VERSION = '11.20.0';
-exports.WORKSPACE_VITEST_VERSION = '4.1.4';
+exports.WORKSPACE_VITEST_VERSION = '4.1.11';
 exports.WORKSPACE_PNPM_SHA512 = '9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee';
 exports.WORKSPACE_PNPM_DESCRIPTOR = `pnpm@${exports.WORKSPACE_PNPM_VERSION}+sha512.${exports.WORKSPACE_PNPM_SHA512}`;
 /**

package/src/generators/preset/workspace-files.d.ts

@@ -8,6 +8,8 @@ export interface WorkspaceFileOptions {
     /** trunk (starter only) protects main alone and delivers production from
      * every merged main push; protected-pair keeps develop and main. */
     deliveryLane?: DeliveryLane;
+    /** Seeded supply-chain/dependency-overrides.json data. When absent, the
+     * workspace is seeded with DEFAULT_DEPENDENCY_OVERRIDES. */
     dependencyOverrides?: unknown;
     deploymentAccounts?: ConfiguredDeploymentAccounts;
     deploymentProfile?: DeploymentProfile;

package/src/generators/preset/workspace-files.js

@@ -1183,7 +1183,10 @@ function renderWorkspaceFiles(options) {
         requirements: options.foundationRequirements ?? [],
     });
     const dependencyOverrides = (0, dependency_overrides_js_1.parseDependencyOverrides)(options.dependencyOverrides === undefined
-        ? { schemaVersion: 1, overrides: {} }
+        ? {
+            schemaVersion: 1,
+            overrides: { ...dependency_overrides_js_1.DEFAULT_DEPENDENCY_OVERRIDES.overrides },
+        }
         : options.dependencyOverrides);
     const deploymentProfile = options.deploymentProfile ?? 'starter';
     const deliveryLane = options.deliveryLane ?? 'protected-pair';

package/src/generators/slice/built-in-plan-shared.d.ts

@@ -17,7 +17,7 @@ export declare const PRODUCT_VERSIONS: {
     readonly awsSts: "^3.700.0";
     readonly drizzle: "^0.45.2";
     readonly drizzleKit: "^0.31.4";
-    readonly next: "16.3.6";
+    readonly next: "16.3.8";
     readonly pg: "^8.22.0";
     readonly playwright: "^1.59.1";
     readonly react: "19.2.8";
@@ -27,7 +27,7 @@ export declare const PRODUCT_VERSIONS: {
     readonly typesPg: "^8.15.5";
     readonly typesReact: "19.2.17";
     readonly typesReactDom: "19.2.3";
-    readonly vitest: "4.1.4";
+    readonly vitest: "4.1.11";
 };
 export declare const PRODUCT_PACKAGE_MANAGED_JSON_POINTERS: readonly ["/name", "/version", "/private", "/dependencies/@aws-sdk~1client-appconfigdata", "/dependencies/@aws-sdk~1client-cloudwatch", "/dependencies/@aws-sdk~1client-cloudwatch-logs", "/dependencies/@aws-sdk~1client-cost-explorer", "/dependencies/@aws-sdk~1client-cognito-identity-provider", "/dependencies/@aws-sdk~1client-dynamodb", "/dependencies/@aws-sdk~1client-ecs", "/dependencies/@aws-sdk~1client-eventbridge", "/dependencies/@aws-sdk~1client-s3", "/dependencies/@aws-sdk~1client-secrets-manager", "/dependencies/@aws-sdk~1client-sfn", "/dependencies/@aws-sdk~1client-sqs", "/dependencies/@aws-sdk~1rds-signer", "/dependencies/@aws-sdk~1client-ssm", "/dependencies/@aws-sdk~1client-sts", "/dependencies/@empire-builder-kit~1runtime", "/dependencies/drizzle-orm", "/dependencies/next", "/dependencies/pg", "/dependencies/react", "/dependencies/react-dom", "/dependencies/server-only", "/devDependencies/@axe-core~1playwright", "/devDependencies/@playwright~1test", "/devDependencies/@types~1node", "/devDependencies/@types~1pg", "/devDependencies/@types~1react", "/devDependencies/@types~1react-dom", "/devDependencies/drizzle-kit", "/devDependencies/vitest", "/exports/.~1api-client", "/exports/.~1api-contract", "/exports/.~1contracts"];
 export declare function standardPackageManagedJsonPointers(sql: boolean): string[];

package/src/generators/slice/built-in-plan-shared.js

@@ -27,7 +27,7 @@ exports.PRODUCT_VERSIONS = {
     awsSts: '^3.700.0',
     drizzle: '^0.45.2',
     drizzleKit: '^0.31.4',
-    next: '16.3.6',
+    next: '16.3.8',
     pg: '^8.22.0',
     playwright: '^1.59.1',
     react: '19.2.8',

package/src/generators/workload/service-performance-files.js

@@ -1654,9 +1654,21 @@ describe('${input.workload} protected Service performance runtime', () => {
     );
     try {
       if (!server.listening) await once(server, 'listening');
+      // start() keeps the production dual-stack wildcard bind. A wildcard
+      // port can coincide with a foreign 127.0.0.1 listener that the loopback
+      // probe would reach instead, so rebind this test server on 127.0.0.1.
+      await new Promise<void>((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      );
+      server.listen({ host: '127.0.0.1', port: 0 });
+      await once(server, 'listening');
       const address = server.address();
-      if (!address || typeof address === 'string') {
-        throw new Error('Generated Service did not bind a TCP port.');
+      if (
+        !address ||
+        typeof address === 'string' ||
+        address.address !== '127.0.0.1'
+      ) {
+        throw new Error('Generated Service did not bind a loopback TCP port.');
       }
       process.env.PORT = String(address.port);
       await expect(
@@ -1699,9 +1711,14 @@ describe('${input.workload} protected Service performance runtime', () => {
         saturation: { percent: 25 },
       });
     } finally {
-      await new Promise<void>((resolve, reject) =>
-        server.close((error) => (error ? reject(error) : resolve())),
-      );
+      // A failed rebind (for example EADDRNOTAVAIL on a host without IPv4
+      // loopback) leaves the server closed; closing it again would reject with
+      // ERR_SERVER_NOT_RUNNING and hide the original error.
+      if (server.listening) {
+        await new Promise<void>((resolve, reject) =>
+          server.close((error) => (error ? reject(error) : resolve())),
+        );
+      }
       if (previousPort === undefined) delete process.env.PORT;
       else process.env.PORT = previousPort;
       if (previousIngressProof === undefined) {

package/src/local-dev/ports.d.ts

@@ -6,11 +6,21 @@ export interface TcpPortRange {
     first: number;
     last: number;
 }
-/** Read only. Never change sysctl/netsh or assume a custom range is default. */
+/**
+ * Read only. Never change sysctl/netsh or assume a custom range is default.
+ *
+ * A supported platform is read at most three times, pausing 250 ms x attempt
+ * between reads (250 ms, then 500 ms). Each native command read is bounded by a
+ * 5 s timeout, so the worst-case failure on Windows or macOS takes about
+ * 3 x 5 s + 250 ms + 500 ms = 15.75 s before the
+ * `prerequisite-unavailable` error. An unsupported platform fails at once,
+ * without a read or a pause, and the error names it as unsupported.
+ */
 export declare function readAutomaticTcpPortRange(effects?: {
     platform?: NodeJS.Platform;
     read?: (path: string) => string;
     execute?: (command: string, args: string[]) => string;
+    pause?: (milliseconds: number) => void;
 }): TcpPortRange;
 export declare function preferredFleetPort(key: string): number;
 export declare function canBindLoopbackPort(port: number): Promise<boolean>;

package/src/local-dev/ports.js

@@ -21,7 +21,33 @@ function validRange(range) {
         range.first <= range.last &&
         range.last <= 65_535);
 }
-/** Read only. Never change sysctl/netsh or assume a custom range is default. */
+/**
+ * Bounded attempts for the host range read. A loaded Windows host can fail a
+ * single netsh read transiently; three attempts with a short pause absorb that
+ * without hiding a persistent failure. Module-private: the specs observe the
+ * bound through the injected effects, and the public ./local-dev subpath does
+ * not export it.
+ */
+const AUTOMATIC_TCP_PORT_RANGE_READ_ATTEMPTS = 3;
+const AUTOMATIC_TCP_PORT_RANGE_RETRY_PAUSE_MS = 250;
+const SUPPORTED_RANGE_PLATFORMS = [
+    'linux',
+    'darwin',
+    'win32',
+];
+function pauseSynchronously(milliseconds) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+/**
+ * Read only. Never change sysctl/netsh or assume a custom range is default.
+ *
+ * A supported platform is read at most three times, pausing 250 ms x attempt
+ * between reads (250 ms, then 500 ms). Each native command read is bounded by a
+ * 5 s timeout, so the worst-case failure on Windows or macOS takes about
+ * 3 x 5 s + 250 ms + 500 ms = 15.75 s before the
+ * `prerequisite-unavailable` error. An unsupported platform fails at once,
+ * without a read or a pause, and the error names it as unsupported.
+ */
 function readAutomaticTcpPortRange(effects = {}) {
     const platform = effects.platform ?? process.platform;
     const execute = effects.execute ??
@@ -32,48 +58,62 @@ function readAutomaticTcpPortRange(effects = {}) {
             windowsHide: true,
             stdio: ['ignore', 'pipe', 'pipe'],
         }));
-    try {
-        let values;
-        if (platform === 'linux') {
-            const text = (effects.read ?? ((path) => (0, node_fs_1.readFileSync)(path, 'utf8')))('/proc/sys/net/ipv4/ip_local_port_range');
-            if (!/^\s*\d+\s+\d+\s*$/.test(text))
-                throw new Error('Invalid range');
-            values = text.trim().split(/\s+/).map(Number);
-        }
-        else if (platform === 'darwin') {
-            const text = execute('/usr/sbin/sysctl', [
-                '-n',
-                'net.inet.ip.portrange.first',
-                'net.inet.ip.portrange.last',
-            ]);
-            if (!/^\s*\d+\s+\d+\s*$/.test(text))
-                throw new Error('Invalid range');
-            values = text.trim().split(/\s+/).map(Number);
+    const read = effects.read ?? ((path) => (0, node_fs_1.readFileSync)(path, 'utf8'));
+    const pause = effects.pause ?? pauseSynchronously;
+    // An unsupported platform is not transient: fail before any read.
+    if (!SUPPORTED_RANGE_PLATFORMS.includes(platform)) {
+        throw new errors_js_1.LocalDevContractError('prerequisite-unavailable', `The host platform ${platform} is not supported for the automatic TCP client-port range read; ebk dev up supports Linux, macOS and Windows. No network setting was changed.`);
+    }
+    const attempts = AUTOMATIC_TCP_PORT_RANGE_READ_ATTEMPTS;
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        try {
+            return readAutomaticTcpPortRangeOnce(platform, read, execute);
         }
-        else if (platform === 'win32') {
-            const text = execute('netsh.exe', [
-                'int',
-                'ipv4',
-                'show',
-                'dynamicport',
-                'tcp',
-            ]);
-            // Labels are localized; the two numeric colon-delimited values are not.
-            values = [...text.matchAll(/:\s*(\d+)\s*$/gm)].map((match) => Number(match[1]));
-            if (values.length !== 2 || values[1] < 1)
-                throw new Error('Invalid range');
-            values[1] = values[0] + values[1] - 1;
+        catch {
+            if (attempt < attempts)
+                pause(AUTOMATIC_TCP_PORT_RANGE_RETRY_PAUSE_MS * attempt);
         }
-        else
-            throw new Error('Unsupported platform');
-        const range = { first: values[0], last: values[1] };
-        if (!validRange(range))
+    }
+    throw new errors_js_1.LocalDevContractError('prerequisite-unavailable', `Cannot read the host automatic TCP client-port range after ${attempts} ${attempts === 1 ? 'attempt' : 'attempts'}. Verify the native network configuration is readable before retrying ebk dev up; no network setting was changed.`);
+}
+function readAutomaticTcpPortRangeOnce(platform, read, execute) {
+    let values;
+    if (platform === 'linux') {
+        const text = read('/proc/sys/net/ipv4/ip_local_port_range');
+        if (!/^\s*\d+\s+\d+\s*$/.test(text))
+            throw new Error('Invalid range');
+        values = text.trim().split(/\s+/).map(Number);
+    }
+    else if (platform === 'darwin') {
+        const text = execute('/usr/sbin/sysctl', [
+            '-n',
+            'net.inet.ip.portrange.first',
+            'net.inet.ip.portrange.last',
+        ]);
+        if (!/^\s*\d+\s+\d+\s*$/.test(text))
             throw new Error('Invalid range');
-        return range;
+        values = text.trim().split(/\s+/).map(Number);
     }
-    catch {
-        throw new errors_js_1.LocalDevContractError('prerequisite-unavailable', 'Cannot read the host automatic TCP client-port range. Verify the native network configuration is readable before retrying ebk dev up; no network setting was changed.');
+    else if (platform === 'win32') {
+        const text = execute('netsh.exe', [
+            'int',
+            'ipv4',
+            'show',
+            'dynamicport',
+            'tcp',
+        ]);
+        // Labels are localized; the two numeric colon-delimited values are not.
+        values = [...text.matchAll(/:\s*(\d+)\s*$/gm)].map((match) => Number(match[1]));
+        if (values.length !== 2 || values[1] < 1)
+            throw new Error('Invalid range');
+        values[1] = values[0] + values[1] - 1;
     }
+    else
+        throw new Error('Unsupported platform');
+    const range = { first: values[0], last: values[1] };
+    if (!validRange(range))
+        throw new Error('Invalid range');
+    return range;
 }
 function preferredFleetPort(key) {
     const digest = (0, node_crypto_1.createHash)('sha256').update(key).digest();