@empire-builder-kit/nx 1.0.0-rc.43 → 1.0.0-rc.45

package/src/generators/slice/built-in-plan-key-value-retention-infrastructure.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderKeyValueRetentionInfrastructureFiles = renderKeyValueRetentionInfrastructureFiles;
+const built_in_plan_alarm_identity_js_1 = require("./built-in-plan-alarm-identity.js");
 /** Framework retention uses native DynamoDB regardless of optional feature SQL. */
 function renderKeyValueRetentionInfrastructureFiles(name, pascalName) {
     return {
@@ -78,8 +79,7 @@ function renderKeyValueRetentionInfrastructureFiles(name, pascalName) {
   const registration = input.register(stateMachine.arn);
   const failureAlarm = new aws.cloudwatch.MetricAlarm('${pascalName}DataRetentionFailure', {
     name: '${name}-' + $app.stage + '-retention-job-failure', alarmActions: [input.alertTopicArn],
-    alarmDescription: JSON.stringify({ schemaVersion: 1, slice: '${name}', owner: '${name}-product', route: '${name}-on-call',
-      businessSymptom: 'The native retention Job terminated unsuccessfully.', id: 'retention-job-failure', runbook: 'jobs/data-retention/README.md' }),
+    alarmDescription: JSON.stringify(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionObject)(name, 'retention-job-failure')}),
     comparisonOperator: 'GreaterThanOrEqualToThreshold', evaluationPeriods: 1, threshold: 1, treatMissingData: 'notBreaching',
     metricQueries: [...['ExecutionsFailed', 'ExecutionsTimedOut', 'ExecutionsAborted'].map((metricName, index) => ({
       id: 'm' + index, metric: { dimensions: { StateMachineArn: stateMachine.arn }, metricName, namespace: 'AWS/States', period: 60, stat: 'Sum' }, returnData: false })),

package/src/generators/slice/built-in-plan-metadata-files.js

@@ -41,6 +41,26 @@ Commit domain changes and event intents together through the DynamoDB store,
 and commit consumer effects with the inbox. Do not edit managed routing or
 assume that declaring an event implements its consumer behavior.
 
+To consume another Slice's domain event, add its \`${scope}/<producer>/contracts\`
+package to \`contracts/dependencies.json\` \`consumes\` with a \`workspace:*\`
+dependency, run \`pnpm nx run ${name}:contract-dependencies-sync\`, then declare
+the subscription in the seeded \`contracts/event-subscriptions.json\`, for example
+\`{ "source": "<producer>", "events": [{ "detailType": "<EventType>", "schemaVersions": [1] }] }\`.
+Every event of one source declares the same \`schemaVersions\`. When one event of
+a source moves to a new version, declare that version for every event of the
+source (the check accepts versions the producer does not publish yet) and widen
+the consumer's version gate to match. Managed infrastructure adds one rule per
+declared source, filtered by stage, source, detail type and schema version, to
+this Slice's existing queue, DLQ and alarm.
+\`contract-dependencies-check\` fails when the producer's \`EventContractSchema\`
+no longer publishes a declared event at one of the declared versions. Extend the
+seeded \`api/event-consumer.ts\` to accept that source and detail type, and widen
+its schema-version gate to every version you declare; otherwise the event
+reaches the DLQ. Source and detail type are delivery filters, not
+authentication: authorize every effect from this Slice's own data and policy,
+never from the event source alone. A producer's own queue rule also receives
+every event it declares, so its consumer must acknowledge them.
+
 Run \`pnpm nx run ${name}:verify\` for the non-deployed Slice checks. The policy files under
 \`frontend/\`, \`docs/reliability/\`, \`operations/\`, and \`performance/\` are seeded decisions:
 adopt real owners, journeys, thresholds, targets, and evidence sources before enabling
@@ -161,6 +181,10 @@ export const ${pascalName}ContractVersion = '1.0.0' as const;
             consumes: [],
             schemaVersion: 1,
         }),
+        'contracts/event-subscriptions.json': (0, built_in_plan_shared_js_1.json)({
+            schemaVersion: 1,
+            subscriptions: [],
+        }),
         'docs/architecture.md': `# ${name} architecture
 
 ## Boundary
@@ -265,7 +289,7 @@ retain record bodies, credentials or raw provider state.
 
 ## DynamoDB
 
-For \`database-errors\`, inspect both table and PendingEvents index read/write
+For \`database-capacity\`, inspect both table and PendingEvents index read/write
 throttle metrics. Check hot keys, account/service quotas, retries and backlog;
 do not treat a missing RDS signal as proof that the table is healthy. Check the
 outbox schedule and stream mapping against their deliberate maintenance state.
@@ -304,6 +328,14 @@ as an incidental repair.
             : `SQL is not declared. No Aurora investigation or SQL migration command is
 required for this Slice's DynamoDB recovery.
 `}
+## Retention Job failure
+
+For \`retention-job-failure\`, the exact retention Step Functions workflow
+failed, timed out or was aborted without accepted evidence. Follow the run
+procedure in [the data-retention Job README](../../jobs/data-retention/README.md):
+keep the source checkout, continue an interrupted report with its run
+reference, and retry the same approved run. Never delete its checkpoint,
+pending deletion work or retained evidence to silence the alarm.
 `,
         'ebk-globals.d.ts': `import 'sst/resource';
 

package/src/generators/slice/built-in-plan-operations-files.js

@@ -760,10 +760,15 @@ try {
 }
 `,
         'tools/ebk-next-build-environment.mjs': `import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import {
   chmodSync,
+  closeSync,
   existsSync,
+  fstatSync,
   lstatSync,
+  openSync,
+  readSync,
   readFileSync,
   readdirSync,
   realpathSync,
@@ -922,12 +927,46 @@ const environment = Object.fromEntries(
     )
     .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
 );
-const windows = process.platform === 'win32';
+// Resolve through this managed Slice, never an ephemeral npx/dlx install.
+const sliceRoot = realpathSync(resolve(dirname(fileURLToPath(import.meta.url)), '..'));
+const sliceManifestPath = join(sliceRoot, 'package.json');
+const sliceManifestIdentity = lstatSync(sliceManifestPath, { throwIfNoEntry: false });
+if (!sliceManifestIdentity?.isFile() || sliceManifestIdentity.size > 1_048_576 ||
+    realpathSync(sliceManifestPath) !== sliceManifestPath ||
+    JSON.parse(readFileSync(sliceManifestPath, 'utf8')).devDependencies?.['@opennextjs/aws'] !== '${built_in_plan_shared_js_1.OPEN_NEXT_AWS_VERSION}') {
+  throw new Error('The Slice must declare the exact managed OpenNext dependency.');
+}
+// Only this declared Slice slot is authority. Canonicalizing it supports pnpm
+// links without searching NODE_PATH, ancestor/global packages, or PATH shims.
+const managedSlot = join(sliceRoot, 'node_modules/@opennextjs/aws');
+if (!existsSync(managedSlot)) {
+  throw new Error(
+    'The managed OpenNext ${built_in_plan_shared_js_1.OPEN_NEXT_AWS_VERSION} builder is not installed in this Slice. ' +
+      'Install the workspace dependencies, including development dependencies ' +
+      '(pnpm install --frozen-lockfile), before building.',
+  );
+}
+const builderRoot = realpathSync(managedSlot);
+const localCli = join(builderRoot, 'dist/index.js');
+const builderManifestPath = join(builderRoot, 'package.json');
+const builderManifestIdentity = lstatSync(builderManifestPath, { throwIfNoEntry: false });
+if (!builderManifestIdentity?.isFile() || builderManifestIdentity.size > 65_536) {
+  throw new Error('The managed OpenNext package metadata has an invalid identity.');
+}
+const builder = JSON.parse(readFileSync(builderManifestPath, 'utf8'));
+if (
+  builder.name !== '@opennextjs/aws' ||
+  builder.version !== '${built_in_plan_shared_js_1.OPEN_NEXT_AWS_VERSION}' ||
+  builder.bin?.['open-next'] !== './dist/index.js' ||
+  !lstatSync(localCli, { throwIfNoEntry: false })?.isFile() ||
+  realpathSync(localCli) !== localCli ||
+  realpathSync(builderManifestPath) !== builderManifestPath
+) {
+  throw new Error('The managed OpenNext builder must be exactly ${built_in_plan_shared_js_1.OPEN_NEXT_AWS_VERSION}.');
+}
 const result = spawnSync(
-  windows ? 'cmd.exe' : 'npx',
-  windows
-    ? ['/d', '/s', '/c', 'npx --yes @opennextjs/aws@3.9.14 build']
-    : ['--yes', '@opennextjs/aws@3.9.14', 'build'],
+  process.execPath,
+  [localCli, 'build'],
   {
     cwd: process.cwd(),
     env: environment,
@@ -1000,7 +1039,7 @@ if (result.status !== 0) {
     }
   }
 
-  // OpenNext 3.9.14 installs the image optimizer dependencies in an npm
+  // OpenNext installs the image optimizer dependencies in an npm
   // mkdtemp directory and copies npm's hidden package lock into the deployed
   // bundle. npm records that random directory basename as the lock name. The
   // name has no runtime meaning, but without this exact normalization two
@@ -1048,6 +1087,67 @@ if (result.status !== 0) {
   ) {
     throw new Error('The OpenNext image optimizer package lock shape is unsupported.');
   }
+  // An upstream install failure can still exit zero. Require the actual
+  // deployment target before normalizing or accepting the bundle. This is a
+  // bounded metadata/ELF check, not execution of Linux code on the build host.
+  const nativeFile = (entry, maximum, header = false) => {
+    const path = join(lockParent, entry);
+    const identity = lstatSync(path, { bigint: true, throwIfNoEntry: false });
+    if (identity === undefined) {
+      throw new Error('The OpenNext Sharp bundle is missing ' + entry +
+        '; npm did not install the managed Linux arm64 glibc target.');
+    }
+    if (!identity.isFile() || identity.isSymbolicLink() || identity.nlink !== 1n ||
+        identity.size < (header ? 64n : 1n) || identity.size > BigInt(maximum) ||
+        realpathSync(path) !== path) {
+      throw new Error('The OpenNext Sharp bundle file has an invalid identity.');
+    }
+    const descriptor = openSync(path, 'r');
+    try {
+      const opened = fstatSync(descriptor, { bigint: true });
+      const length = header ? 64 : Number(identity.size);
+      const bytes = Buffer.alloc(length);
+      if (opened.dev !== identity.dev || opened.ino !== identity.ino ||
+          opened.size !== identity.size || readSync(descriptor, bytes, 0, length, 0) !== length) {
+        throw new Error('The OpenNext Sharp bundle file changed identity.');
+      }
+      if (!header) return bytes.toString('utf8');
+      if (bytes.subarray(0, 4).toString('hex') !== '7f454c46' ||
+          bytes[4] !== 2 || bytes[5] !== 1 || bytes[6] !== 1 ||
+          bytes.readUInt16LE(16) !== 3 || bytes.readUInt16LE(18) !== 183) {
+        throw new Error('The OpenNext Sharp native file must be Linux arm64 ELF64.');
+      }
+    } finally { closeSync(descriptor); }
+  };
+  const sharpPackage = (name, version, native = false) => {
+    const metadata = JSON.parse(nativeFile(name + '/package.json', 65_536));
+    const locked = parsed.packages['node_modules/' + name];
+    if (metadata?.name !== name || metadata.version !== version ||
+        locked?.version !== version ||
+        (native && (JSON.stringify(metadata.os) !== '["linux"]' ||
+          JSON.stringify(metadata.cpu) !== '["arm64"]' ||
+          JSON.stringify(metadata.libc) !== '["glibc"]'))) {
+      throw new Error('The OpenNext Sharp package metadata does not match the managed target.');
+    }
+    return metadata;
+  };
+  const sharp = sharpPackage('sharp', '${built_in_plan_shared_js_1.OPEN_NEXT_IMAGE_OPTIMIZATION_SHARP_VERSION}');
+  const addon = sharpPackage('@img/sharp-linux-arm64', '${built_in_plan_shared_js_1.OPEN_NEXT_IMAGE_OPTIMIZATION_SHARP_VERSION}', true);
+  const libvips = sharpPackage('@img/sharp-libvips-linux-arm64', '${built_in_plan_shared_js_1.OPEN_NEXT_IMAGE_OPTIMIZATION_LIBVIPS_VERSION}', true);
+  if (sharp.optionalDependencies?.['@img/sharp-linux-arm64'] !== addon.version ||
+      sharp.optionalDependencies?.['@img/sharp-libvips-linux-arm64'] !== libvips.version ||
+      addon.optionalDependencies?.['@img/sharp-libvips-linux-arm64'] !== libvips.version ||
+      libvips.exports?.['./binary'] !== './lib/${built_in_plan_shared_js_1.OPEN_NEXT_IMAGE_OPTIMIZATION_LIBVIPS_LIBRARY}') {
+    throw new Error('The OpenNext Sharp native dependency metadata is incomplete.');
+  }
+  nativeFile('@img/sharp-linux-arm64/lib/sharp-linux-arm64-${built_in_plan_shared_js_1.OPEN_NEXT_IMAGE_OPTIMIZATION_SHARP_VERSION}.node', 32 * 1024 * 1024, true);
+  nativeFile('@img/sharp-libvips-linux-arm64/lib/${built_in_plan_shared_js_1.OPEN_NEXT_IMAGE_OPTIMIZATION_LIBVIPS_LIBRARY}', 32 * 1024 * 1024, true);
+  const imagePackages = readdirSync(join(lockParent, '@img'));
+  if (imagePackages.length > 64 || imagePackages.some(name =>
+    /^sharp(?:-libvips)?-(?:linux|darwin|win32)/u.test(name) &&
+    !['sharp-linux-arm64', 'sharp-libvips-linux-arm64'].includes(name))) {
+    throw new Error('The OpenNext Sharp bundle contains a foreign native platform.');
+  }
   parsed.name = 'open-next-image-optimization-function';
   const normalized = JSON.stringify(parsed, null, 2) + '\\n';
   const temporaryPath = join(lockParent, '.package-lock.json.ebk-normalized');

package/src/generators/slice/built-in-plan-project-files.js

@@ -44,6 +44,7 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
             devDependencies: {
                 '@axe-core/playwright': built_in_plan_shared_js_1.PRODUCT_VERSIONS.axePlaywright,
                 '@playwright/test': built_in_plan_shared_js_1.PRODUCT_VERSIONS.playwright,
+                '@opennextjs/aws': built_in_plan_shared_js_1.OPEN_NEXT_AWS_VERSION,
                 '@types/node': built_in_plan_shared_js_1.PRODUCT_VERSIONS.typesNode,
                 ...(sql
                     ? {

package/src/generators/slice/built-in-plan-release-files.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductReleaseFiles = renderProductReleaseFiles;
+const built_in_plan_event_contract_literal_js_1 = require("./built-in-plan-event-contract-literal.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 function configurationSeedDates(seed) {
     const createdAt = new Date(seed);
@@ -2632,49 +2633,7 @@ const eventContractContent = readFileSync(
   new URL('../contracts/events.ts', import.meta.url),
   'utf8',
 );
-const eventLiteral = (node) => {
-  while (
-    ts.isAsExpression(node) ||
-    ts.isSatisfiesExpression(node) ||
-    ts.isParenthesizedExpression(node)
-  ) {
-    node = node.expression;
-  }
-  if (ts.isObjectLiteralExpression(node)) {
-    return Object.fromEntries(
-      node.properties.map((property) => {
-        if (
-          !ts.isPropertyAssignment(property) ||
-          !(
-            ts.isIdentifier(property.name) ||
-            ts.isStringLiteral(property.name)
-          )
-        ) {
-          throw new Error(
-            'EventContractSchema accepts only explicit literal properties.',
-          );
-        }
-        return [property.name.text, eventLiteral(property.initializer)];
-      }),
-    );
-  }
-  if (ts.isArrayLiteralExpression(node)) {
-    return node.elements.map(eventLiteral);
-  }
-  if (ts.isStringLiteral(node) || ts.isNumericLiteral(node)) {
-    return ts.isNumericLiteral(node) ? Number(node.text) : node.text;
-  }
-  if (
-    node.kind === ts.SyntaxKind.TrueKeyword ||
-    node.kind === ts.SyntaxKind.FalseKeyword
-  ) {
-    return node.kind === ts.SyntaxKind.TrueKeyword;
-  }
-  throw new Error(
-    'EventContractSchema must remain a canonical literal-only export.',
-  );
-};
-const parseEventContract = (source, path) => {
+${built_in_plan_event_contract_literal_js_1.EVENT_CONTRACT_LITERAL_SOURCE}const parseEventContract = (source, path) => {
   const file = ts.createSourceFile(
     path,
     source,