@empire-builder-kit/nx 1.0.0-beta.4

package/src/generators/preset/workspace-files.js

@@ -0,0 +1,895 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKSPACE_PACKAGE_MANAGER_VERSION = exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS = void 0;
+exports.renderWorkspaceFiles = renderWorkspaceFiles;
+exports.renderWorkspaceRootFilePlan = renderWorkspaceRootFilePlan;
+exports.renderFoundationFilePlan = renderFoundationFilePlan;
+const index_js_1 = require("../../ownership/index.js");
+const TOOL_VERSIONS = {
+    eslint: '^9.8.0',
+    eslintJs: '^9.8.0',
+    globals: '^16.0.0',
+    nodeTypes: '25.5.0',
+    nx: '23.1.0',
+    pnpm: '10.30.1',
+    prettier: '^3.8.2',
+    sst: '4.11.0',
+    typescript: '~5.9.2',
+    typescriptEslint: '^8.40.0',
+};
+function json(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+const FOUNDATION_ROOT = 'packages/foundation/';
+const FOUNDATION_OWNERSHIP_PATH = `${FOUNDATION_ROOT}.ebk/ownership.json`;
+const FOUNDATION_TOOL_OWNED_PATHS = new Set(['sst-env.d.ts']);
+const WORKSPACE_OWNERSHIP_PATH = '.ebk/ownership.json';
+const WORKSPACE_SEEDED_PATHS = new Set([
+    'README.md',
+    'docs/architecture.md',
+    'package.json',
+]);
+exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS = [
+    '/name',
+    '/$schema',
+    '/projectType',
+    '/tags',
+    '/targets/dev',
+    '/targets/dev-doctor',
+    '/targets/dev-setup',
+    '/targets/verify',
+    '/targets/workspace-health',
+];
+const FOUNDATION_SEEDED_PATHS = new Set([
+    'README.md',
+    'docs/costs.md',
+    'docs/runbooks.md',
+    'docs/security.md',
+]);
+function createFoundationOwnership(files, frameworkVersion) {
+    const paths = Object.keys(files)
+        .filter((path) => path.startsWith(FOUNDATION_ROOT) &&
+        path !== FOUNDATION_OWNERSHIP_PATH &&
+        !FOUNDATION_TOOL_OWNED_PATHS.has(path.slice(FOUNDATION_ROOT.length)))
+        .map((path) => {
+        const relativePath = path.slice(FOUNDATION_ROOT.length);
+        return {
+            mode: FOUNDATION_SEEDED_PATHS.has(relativePath)
+                ? 'seeded'
+                : 'managed',
+            origin: 'framework',
+            path: relativePath,
+            sha256: (0, index_js_1.hashGeneratedContent)(files[path] ?? ''),
+        };
+    });
+    paths.sort((left, right) => left.path.localeCompare(right.path));
+    return {
+        frameworkVersion,
+        kind: 'foundation',
+        paths,
+        schemaVersion: index_js_1.FOUNDATION_OWNERSHIP_SCHEMA_VERSION,
+    };
+}
+function createWorkspaceOwnership(files, frameworkVersion) {
+    const paths = Object.keys(files)
+        .filter((path) => !path.startsWith(FOUNDATION_ROOT) && path !== WORKSPACE_OWNERSHIP_PATH)
+        .map((path) => {
+        const ownership = {
+            ...(path === 'project.json'
+                ? {
+                    managedJsonPointers: [...exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS],
+                }
+                : {}),
+            mode: WORKSPACE_SEEDED_PATHS.has(path)
+                ? 'seeded'
+                : 'managed',
+            origin: 'framework',
+            path,
+        };
+        return {
+            ...ownership,
+            sha256: (0, index_js_1.hashOwnedContent)(files[path] ?? '', ownership),
+        };
+    });
+    paths.sort((left, right) => left.path.localeCompare(right.path));
+    return {
+        frameworkVersion,
+        kind: 'workspace',
+        paths,
+        schemaVersion: index_js_1.WORKSPACE_OWNERSHIP_SCHEMA_VERSION,
+    };
+}
+function renderWorkspaceFiles(options) {
+    const { frameworkVersion, name } = options;
+    const files = {
+        '.github/workflows/ci.yml': `name: Verify
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: verify-\${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm nx format:check
+      - run: pnpm nx run-many -t verify --parallel=3
+`,
+        '.github/workflows/deploy.yml': `name: Deploy
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: Deployment stage
+        required: true
+        default: development
+        type: choice
+        options: [development, staging, production]
+      action:
+        description: Lifecycle action
+        required: true
+        default: deploy
+        type: choice
+        options: [deploy, refresh, unlock, remove]
+
+concurrency:
+  group: deploy-\${{ inputs.stage }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  deploy:
+    if: github.ref == 'refs/heads/main'
+    environment: \${{ inputs.stage }}
+    env:
+      EBK_ALLOW_PRODUCTION_REMOVE: \${{ vars.EBK_ALLOW_PRODUCTION_REMOVE || 'false' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          aws-region: \${{ vars.AWS_REGION || 'us-east-1' }}
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm nx run-many -t \${{ inputs.action }} --stage=\${{ inputs.stage }} --parallel=1
+`,
+        '.gitignore': `.nx/cache
+.nx/workspace-data
+.ebk/cache
+.next
+.open-next
+dist
+*.tsbuildinfo
+node_modules
+.sst
+.env
+.env.*
+!.env.example
+`,
+        '.prettierignore': `node_modules
+dist
+.nx
+.next
+.open-next
+.sst
+**/next-env.d.ts
+pnpm-lock.yaml
+`,
+        '.prettierrc.json': json({ singleQuote: true }),
+        'eslint.config.mjs': `import eslint from '@eslint/js';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+
+export default tseslint.config(
+  { ignores: ['**/.next/**', '**/.open-next/**', '**/.sst/**', '**/dist/**', '**/node_modules/**'] },
+  eslint.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    languageOptions: { globals: globals.node },
+    rules: { '@typescript-eslint/no-explicit-any': 'off' },
+  },
+);
+`,
+        'README.md': `# ${name}
+
+This workspace was created with Empire Builder Kit v1.
+
+## Start here
+
+1. Review \`docs/architecture.md\`.
+2. Review the generated Foundation before deploying it.
+3. Add product slices through the Empire Builder Kit Nx plugin.
+
+For one-origin fleet development, first run \`pnpm nx run ${name}:dev-setup\`, inspect the
+generated root certificate, then explicitly approve \`--trust --portless\`. Diagnose without
+mutation through \`pnpm nx run ${name}:dev-doctor --stage=<personal-stage>\`. Start selected
+slices with \`pnpm nx run ${name}:dev --slices=billing,accounts --stage=<personal-stage>\`.
+
+Workspace creation only writes source files. It does not create or change cloud resources.
+`,
+        'docs/architecture.md': `# Workspace architecture
+
+This workspace uses three public Empire Builder Kit packages:
+
+- \`@empire-builder-kit/create\` creates the workspace source tree.
+- \`@empire-builder-kit/nx\` owns generators and infrastructure lifecycle executors.
+- \`@empire-builder-kit/runtime\` owns application-facing runtime contracts.
+
+The Standard Foundation lives at \`packages/foundation\`. Product slices live beside it under
+\`packages/<slice-name>\` and consume versioned Foundation contracts instead of importing
+Foundation implementation files.
+
+Canonical consumer stages use the matching \`development\`, \`staging\`, or \`production\`
+Foundation. Personal and preview consumer stages may use only the \`development\` Foundation.
+`,
+        'nx.json': json({
+            $schema: './node_modules/nx/schemas/nx-schema.json',
+            defaultBase: 'main',
+            namedInputs: {
+                default: ['{projectRoot}/**/*', 'sharedGlobals'],
+                production: [
+                    'default',
+                    '!{projectRoot}/**/?(*.)+(spec|test).[jt]s?(x)?(.snap)',
+                    '!{projectRoot}/tsconfig.spec.json',
+                ],
+                sharedGlobals: [],
+            },
+            targetDefaults: {
+                build: {
+                    cache: true,
+                    dependsOn: ['^build'],
+                    inputs: ['production', '^production'],
+                },
+                lint: {
+                    cache: true,
+                    inputs: ['default', '^production'],
+                },
+                test: {
+                    cache: true,
+                    dependsOn: ['^build'],
+                    inputs: ['default', '^production'],
+                },
+                typecheck: {
+                    cache: true,
+                    dependsOn: ['^build'],
+                    inputs: ['default', '^production'],
+                },
+            },
+            neverConnectToCloud: true,
+        }),
+        'package.json': json({
+            name,
+            version: '0.0.0',
+            private: true,
+            packageManager: `pnpm@${TOOL_VERSIONS.pnpm}`,
+            engines: {
+                node: '>=22.12.0',
+                pnpm: '>=10.0.0',
+            },
+            scripts: {
+                build: `nx run-many -t build --exclude=${name}`,
+                format: 'nx format:write',
+                'format:check': 'nx format:check',
+                graph: 'nx graph',
+                health: `nx run ${name}:workspace-health`,
+                lint: `nx run-many -t lint --exclude=${name}`,
+                test: `nx run-many -t test --exclude=${name}`,
+                typecheck: `nx run-many -t typecheck --exclude=${name}`,
+                verify: `nx run ${name}:workspace-health && nx run-many -t verify --exclude=${name}`,
+                dev: `nx run ${name}:dev`,
+            },
+            dependencies: {
+                '@empire-builder-kit/runtime': frameworkVersion,
+            },
+            devDependencies: {
+                '@eslint/js': TOOL_VERSIONS.eslintJs,
+                '@empire-builder-kit/nx': frameworkVersion,
+                '@types/node': TOOL_VERSIONS.nodeTypes,
+                eslint: TOOL_VERSIONS.eslint,
+                globals: TOOL_VERSIONS.globals,
+                nx: TOOL_VERSIONS.nx,
+                prettier: TOOL_VERSIONS.prettier,
+                sst: TOOL_VERSIONS.sst,
+                typescript: TOOL_VERSIONS.typescript,
+                'typescript-eslint': TOOL_VERSIONS.typescriptEslint,
+            },
+        }),
+        'project.json': json({
+            name,
+            $schema: './node_modules/nx/schemas/project-schema.json',
+            projectType: 'application',
+            tags: ['scope:workspace', 'layer:governance'],
+            targets: {
+                dev: {
+                    continuous: true,
+                    executor: '@empire-builder-kit/nx:fleet',
+                    options: {
+                        stage: 'personal',
+                    },
+                },
+                'dev-doctor': {
+                    executor: '@empire-builder-kit/nx:dev-doctor',
+                    options: {},
+                },
+                'dev-setup': {
+                    executor: '@empire-builder-kit/nx:dev-setup',
+                    options: {},
+                },
+                verify: {
+                    executor: 'nx:run-commands',
+                    options: { command: 'node tools/workspace-health.mjs' },
+                },
+                'workspace-health': {
+                    executor: 'nx:run-commands',
+                    options: { command: 'node tools/workspace-health.mjs' },
+                },
+            },
+        }),
+        'packages/foundation/README.md': `# Standard Foundation
+
+This project owns the workspace-wide AWS platform for each canonical \`development\`,
+\`staging\`, or \`production\` stage. It is a separate SST state boundary from product slices.
+Never deploy it at a personal or preview stage; those consumers map to \`development\`.
+
+It provides the v1 network, routing, container compute, Postgres, identity, events,
+observability, configuration, and deployment capabilities. Product slices consume its
+versioned contract; they do not import files from \`infra/\`.
+
+Workspace creation does not deploy this project. Review \`docs/costs.md\`,
+\`docs/security.md\`, and \`docs/runbooks.md\` before the first deployment.
+
+Set \`EBK_ROOT_DOMAIN\` before deploying when Route 53 in the target account owns a public
+domain. Without it, the shared Router uses its functional provider URL.
+`,
+        'packages/foundation/contracts/foundation.json': json({
+            contractVersion: '1.0.0',
+            capabilities: [
+                'network',
+                'routing',
+                'container-compute',
+                'postgres',
+                'identity',
+                'events',
+                'observability',
+                'configuration',
+                'deployment',
+            ],
+        }),
+        'packages/foundation/contracts/costs.json': json({
+            schemaVersion: 1,
+            stages: {
+                development: {
+                    aurora: 'scale-to-zero',
+                    dataRetention: 'retained',
+                    nat: 'ec2',
+                },
+                staging: {
+                    aurora: 'scale-to-zero',
+                    dataRetention: 'retained',
+                    nat: 'ec2',
+                },
+                production: {
+                    aurora: 'always-warm',
+                    dataRetention: 'retained-and-protected',
+                    nat: 'managed',
+                },
+            },
+            usagePriced: [
+                'cloudwatch',
+                'cognito',
+                'ecs-workloads',
+                'eventbridge',
+                'sns',
+                'ssm',
+            ],
+        }),
+        'packages/foundation/docs/costs.md': `# Foundation cost contract
+
+The VPC NAT path and Aurora capacity are the main fixed-cost decisions.
+The machine-readable stage inventory is \`../contracts/costs.json\`; keep this
+seeded decision record aligned with organization-specific budgets and alerts.
+
+- Development uses EC2 NAT, a development bastion, and Aurora scale-to-zero.
+- Staging uses EC2 NAT and Aurora scale-to-zero by default.
+- Production uses managed NAT and an always-warm Aurora baseline.
+- ECS, EventBridge, Cognito, SNS, SSM, and CloudWatch are primarily usage-priced; logs,
+  metrics, alarms, and retained data still require active cost review.
+
+Run \`foundation:remove\` only for disposable stages. Production is retained and protected by
+the SST configuration.
+`,
+        'packages/foundation/docs/runbooks.md': `# Foundation runbooks
+
+## Deployment
+
+Use Nx for every supported lifecycle action:
+
+- \`pnpm nx run foundation:deploy --stage=development\`
+- \`pnpm nx run foundation:refresh --stage=development\`
+- \`pnpm nx run foundation:unlock --stage=development\`
+- \`pnpm nx run foundation:remove --stage=development\`
+
+Do not invoke SST lifecycle commands directly. Production deployment belongs in the trusted
+CI path.
+
+Foundation stages are canonical. Run a Product Slice with \`--stage=<personal-name>\` to map
+that consumer to the development Foundation. The slice preflight reports both stages; it
+does not deploy a personal Foundation. Full mapped personal-stage deploys fail closed.
+
+## Database restore
+
+Production Aurora retains 30 days of automated backups; non-production retains 7 days.
+Restore into a new cluster, validate application migrations and data integrity, then cut over
+consumers deliberately. Never expose the Foundation master credential to a product slice.
+`,
+        'packages/foundation/docs/security.md': `# Foundation security contract
+
+- Production resources are retained and protected.
+- The shared Aurora master credential is Foundation-internal.
+- Product slices receive scoped logical-database credentials through the provisioning contract.
+- Cognito owns authentication; product slices own authorization policy and app clients.
+- Lambda and server-side web workloads use resource linking. Containers use the documented
+  stage-scoped SSM/secret path and least-privilege IAM.
+- Public domains are configured explicitly through \`EBK_ROOT_DOMAIN\`; generated source never
+  contains credentials or customer domain assumptions.
+`,
+        'packages/foundation/ebk-globals.d.ts': `// SST and Pulumi inject these globals while evaluating sst.config.ts.
+declare const sst: any;
+declare const aws: any;
+declare const $config: any;
+declare const $app: {
+  name: string;
+  stage: string;
+  removal: 'remove' | 'retain' | 'retain-all';
+  protect: boolean;
+};
+`,
+        'packages/foundation/infra/foundation.ts': `import {
+  FOUNDATION_SSM_SCHEMA_VERSION,
+  STANDARD_FOUNDATION_CAPABILITIES,
+  foundationSsmPath,
+  type FoundationSsmKey,
+} from '@empire-builder-kit/nx/foundation';
+
+function publishFoundation(values: Record<FoundationSsmKey, any>) {
+  return Object.fromEntries(
+    Object.entries(values).map(([key, value]) => [
+      key,
+      new aws.ssm.Parameter('FoundationSsm_' + key, {
+        name: foundationSsmPath($app.stage, key as FoundationSsmKey),
+        type: 'String',
+        value,
+      }),
+    ]),
+  );
+}
+
+export function foundation() {
+  const isProduction = $app.stage === 'production';
+  const isStaging = $app.stage === 'staging';
+  const rootDomain = process.env.EBK_ROOT_DOMAIN?.trim();
+
+  const vpc = new sst.aws.Vpc('FoundationVpc', {
+    az: 2,
+    bastion: $app.stage === 'development',
+    nat: isProduction ? 'managed' : 'ec2',
+  });
+  const cluster = new sst.aws.Cluster('FoundationCluster', { vpc });
+  const router = new sst.aws.Router('FoundationRouter', {
+    ...(rootDomain
+      ? {
+          domain: {
+            name: rootDomain,
+            aliases: ['*.' + rootDomain],
+            dns: sst.aws.dns(),
+          },
+        }
+      : {}),
+  });
+  const database = new sst.aws.Aurora('FoundationDatabase', {
+    dataApi: true,
+    engine: 'postgres',
+    scaling: isProduction
+      ? { min: '2 ACU', max: '16 ACU' }
+      : isStaging
+        ? { min: '0 ACU', max: '4 ACU', pauseAfter: '5 minutes' }
+        : { min: '0 ACU', max: '2 ACU', pauseAfter: '5 minutes' },
+    transform: {
+      cluster: {
+        backupRetentionPeriod: isProduction ? 30 : 7,
+        deletionProtection: isProduction,
+      },
+    },
+    vpc,
+  });
+  const userPool = new sst.aws.CognitoUserPool('FoundationIdentity', {
+    usernames: ['email'],
+  });
+  const eventBus = new sst.aws.Bus('FoundationEventBus');
+  const alertTopic = new sst.aws.SnsTopic('FoundationAlerts');
+  const dashboard = new aws.cloudwatch.Dashboard('FoundationDashboard', {
+    dashboardName: 'ebk-' + $app.stage + '-foundation',
+    dashboardBody: JSON.stringify({
+      widgets: [
+        {
+          type: 'text',
+          x: 0,
+          y: 0,
+          width: 24,
+          height: 3,
+          properties: {
+            markdown: '# Empire Builder Kit Foundation\\nStage: ' + $app.stage,
+          },
+        },
+      ],
+    }),
+  });
+
+  if (new Set(['development', 'staging', 'production']).has($app.stage)) {
+    new aws.cloudwatch.EventArchive('FoundationEventArchive', {
+      eventSourceArn: eventBus.arn,
+      retentionDays: 30,
+    });
+  }
+
+  publishFoundation({
+    alertTopicArn: alertTopic.arn,
+    capabilities: STANDARD_FOUNDATION_CAPABILITIES.join(','),
+    clusterId: cluster.id,
+    contractVersion: '1.0.0',
+    databaseClusterArn: database.clusterArn,
+    databaseClusterId: database.id,
+    databaseMasterSecretArn: database.secretArn,
+    eventBusArn: eventBus.arn,
+    eventBusName: eventBus.name,
+    hasPublicDomain: rootDomain ? 'true' : 'false',
+    identityUserPoolArn: userPool.arn,
+    identityUserPoolId: userPool.id,
+    rootDomain: rootDomain ?? 'none',
+    routerDistributionId: router.distributionID,
+    routerUrl: router.url,
+    schemaVersion: String(FOUNDATION_SSM_SCHEMA_VERSION),
+    vpcId: vpc.id,
+  });
+
+  return {
+    alertTopicArn: alertTopic.arn,
+    capabilities: STANDARD_FOUNDATION_CAPABILITIES,
+    clusterId: cluster.id,
+    contractVersion: '1.0.0',
+    dashboardName: dashboard.dashboardName,
+    databaseClusterId: database.id,
+    eventBusName: eventBus.name,
+    identityUserPoolId: userPool.id,
+    name: 'foundation',
+    rootDomain,
+    routerUrl: router.url,
+    vpcId: vpc.id,
+  };
+}
+`,
+        'packages/foundation/infra/index.ts': `export { foundation as app } from './foundation.js';
+`,
+        'packages/foundation/package.json': json({
+            name: `@${name}/foundation`,
+            version: '0.0.0',
+            private: true,
+        }),
+        'packages/foundation/project.json': json({
+            name: 'foundation',
+            $schema: '../../node_modules/nx/schemas/project-schema.json',
+            projectType: 'application',
+            sourceRoot: 'packages/foundation/infra',
+            tags: [
+                'scope:foundation',
+                'type:sst',
+                'layer:platform',
+                'visibility:internal',
+            ],
+            targets: {
+                deploy: {
+                    executor: '@empire-builder-kit/nx:deploy',
+                    dependsOn: ['verify'],
+                    options: {
+                        cwd: 'packages/foundation',
+                        stage: 'development',
+                        stageMode: 'foundation',
+                    },
+                },
+                dev: {
+                    executor: '@empire-builder-kit/nx:dev',
+                    dependsOn: ['verify'],
+                    options: {
+                        cwd: 'packages/foundation',
+                        stage: 'development',
+                        stageMode: 'foundation',
+                    },
+                },
+                lint: {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'eslint .',
+                        cwd: 'packages/foundation',
+                    },
+                },
+                refresh: {
+                    executor: '@empire-builder-kit/nx:refresh',
+                    options: {
+                        cwd: 'packages/foundation',
+                        stage: 'development',
+                        stageMode: 'foundation',
+                    },
+                },
+                remove: {
+                    executor: '@empire-builder-kit/nx:remove',
+                    dependsOn: [{ target: 'remove-preflight', params: 'forward' }],
+                    options: {
+                        cwd: 'packages/foundation',
+                        stage: 'development',
+                        stageMode: 'foundation',
+                    },
+                },
+                'remove-preflight': {
+                    executor: '@empire-builder-kit/nx:foundation-remove-preflight',
+                    options: { stage: 'development' },
+                },
+                typecheck: {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'tsc --noEmit -p tsconfig.json',
+                        cwd: 'packages/foundation',
+                    },
+                },
+                unlock: {
+                    executor: '@empire-builder-kit/nx:unlock',
+                    options: {
+                        cwd: 'packages/foundation',
+                        stage: 'development',
+                        stageMode: 'foundation',
+                    },
+                },
+                verify: {
+                    executor: 'nx:run-commands',
+                    dependsOn: ['lint', 'typecheck'],
+                    options: {
+                        command: 'node scripts/verify-foundation.mjs',
+                        cwd: 'packages/foundation',
+                    },
+                },
+            },
+        }),
+        'packages/foundation/scripts/verify-foundation.mjs': `import { readFileSync } from 'node:fs';
+
+const descriptor = JSON.parse(
+  readFileSync(new URL('../contracts/foundation.json', import.meta.url), 'utf8'),
+);
+const costs = JSON.parse(
+  readFileSync(new URL('../contracts/costs.json', import.meta.url), 'utf8'),
+);
+const expectedCapabilities = [
+  'network',
+  'routing',
+  'container-compute',
+  'postgres',
+  'identity',
+  'events',
+  'observability',
+  'configuration',
+  'deployment',
+];
+
+if (descriptor.contractVersion !== '1.0.0') {
+  throw new Error('Foundation contractVersion must be 1.0.0.');
+}
+if (JSON.stringify(descriptor.capabilities) !== JSON.stringify(expectedCapabilities)) {
+  throw new Error('Foundation capability descriptor does not match the v1 standard.');
+}
+if (
+  costs.schemaVersion !== 1 ||
+  !costs.stages?.development ||
+  !costs.stages?.staging ||
+  costs.stages?.production?.dataRetention !== 'retained-and-protected'
+) {
+  throw new Error('Foundation cost manifest does not match the v1 stage contract.');
+}
+
+process.stdout.write('Foundation source contract verified.\\n');
+`,
+        'packages/foundation/sst-env.d.ts': `// Bootstrap placeholder. SST overwrites this file after install, dev, or deploy.
+export {};
+`,
+        'packages/foundation/sst.config.ts': `// SST/Pulumi ambient globals are declared in ebk-globals.d.ts.
+export default $config({
+  app(input: { stage?: string } | undefined) {
+    const stage = input?.stage ?? 'development';
+    if (!['development', 'staging', 'production'].includes(stage)) {
+      throw new Error(
+        'Foundation stage ' + stage + ' is not canonical. Use development, staging, or production.',
+      );
+    }
+    const production = stage === 'production';
+    return {
+      name: 'foundation',
+      removal: production ? 'retain' : 'remove',
+      protect: production,
+      home: 'aws',
+      providers: {
+        aws: {
+          region: process.env.AWS_REGION ?? 'us-east-1',
+        },
+      },
+    };
+  },
+  async run() {
+    const { app } = await import('./infra/index.js');
+    return app();
+  },
+});
+`,
+        'packages/foundation/tsconfig.json': json({
+            extends: '../../tsconfig.base.json',
+            compilerOptions: { types: ['node'] },
+            include: [
+                'infra/**/*.ts',
+                'sst.config.ts',
+                'sst-env.d.ts',
+                'ebk-globals.d.ts',
+            ],
+            exclude: ['.sst', 'dist', 'node_modules'],
+        }),
+        'pnpm-workspace.yaml': `packages:
+  - 'packages/*'
+  - 'packages/*/apps/*'
+  - 'packages/*/jobs/*'
+  - 'packages/*/libs/*'
+  - 'packages/*/services/*'
+`,
+        'tsconfig.base.json': json({
+            compilerOptions: {
+                composite: true,
+                declarationMap: true,
+                forceConsistentCasingInFileNames: true,
+                isolatedModules: true,
+                lib: ['es2022'],
+                module: 'nodenext',
+                moduleResolution: 'nodenext',
+                noEmitOnError: true,
+                noFallthroughCasesInSwitch: true,
+                noImplicitOverride: true,
+                noImplicitReturns: true,
+                noUnusedLocals: true,
+                skipLibCheck: true,
+                strict: true,
+                target: 'es2022',
+            },
+        }),
+        'tsconfig.json': json({
+            extends: './tsconfig.base.json',
+            files: [],
+            references: [],
+        }),
+        'tools/workspace-health.mjs': `import { createHash } from 'node:crypto';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const parseJson = (contents, label) => {
+  try {
+    return JSON.parse(contents);
+  } catch (error) {
+    throw new Error(label + ' is not valid JSON: ' + (error instanceof Error ? error.message : String(error)));
+  }
+};
+const readJson = (path) => parseJson(readFileSync(path, 'utf8'), path);
+const sha256 = (contents) => createHash('sha256').update(contents, 'utf8').digest('hex');
+const stableValue = (value) => {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])]));
+};
+const pointerValue = (document, pointer) => {
+  let current = document;
+  for (const segment of pointer.slice(1).split('/').map((part) => part.replaceAll('~1', '/').replaceAll('~0', '~'))) {
+    if (!current || typeof current !== 'object' || !Object.hasOwn(current, segment)) {
+      return { exists: false };
+    }
+    current = current[segment];
+  }
+  return { exists: true, value: current };
+};
+const ownedSha256 = (contents, entry) => {
+  if (!entry.managedJsonPointers) return sha256(contents);
+  const document = parseJson(contents, 'Managed JSON file ' + entry.path);
+  const projection = [...entry.managedJsonPointers].sort().map((pointer) => {
+    const resolved = pointerValue(document, pointer);
+    return { exists: resolved.exists, pointer, ...(resolved.exists ? { value: resolved.value } : {}) };
+  });
+  return sha256(JSON.stringify(stableValue(projection)));
+};
+const validateOwnership = (root, record, label) => {
+  for (const entry of record.paths ?? []) {
+    if (entry.mode !== 'managed') continue;
+    const path = join(root, entry.path);
+    if (!existsSync(path)) throw new Error(label + ' managed path is missing: ' + entry.path);
+    if (ownedSha256(readFileSync(path, 'utf8'), entry) !== entry.sha256) {
+      throw new Error(label + ' managed path has drifted: ' + entry.path);
+    }
+  }
+};
+
+const workspace = readJson('.ebk/ownership.json');
+const foundation = readJson('packages/foundation/.ebk/ownership.json');
+if (
+  workspace.schemaVersion !== ${index_js_1.WORKSPACE_OWNERSHIP_SCHEMA_VERSION} ||
+  workspace.kind !== 'workspace' ||
+  foundation.schemaVersion !== ${index_js_1.FOUNDATION_OWNERSHIP_SCHEMA_VERSION} ||
+  foundation.kind !== 'foundation'
+) {
+  throw new Error('EBK workspace or Foundation ownership metadata is incompatible.');
+}
+validateOwnership('.', workspace, 'Workspace');
+validateOwnership('packages/foundation', foundation, 'Foundation');
+
+for (const name of readdirSync('packages')) {
+  if (name === 'foundation') continue;
+  const ownershipPath = join('packages', name, '.ebk/ownership.json');
+  if (!existsSync(ownershipPath)) continue;
+  const ownership = readJson(ownershipPath);
+  if (ownership.schemaVersion !== ${index_js_1.GENERATED_OWNERSHIP_SCHEMA_VERSION}) {
+    throw new Error('Product Slice ' + name + ' ownership metadata is incompatible.');
+  }
+  validateOwnership(join('packages', name), ownership, 'Product Slice ' + name);
+}
+process.stdout.write('Empire Builder Kit workspace source health is green.\\n');
+`,
+    };
+    files[FOUNDATION_OWNERSHIP_PATH] = json(createFoundationOwnership(files, frameworkVersion));
+    files[WORKSPACE_OWNERSHIP_PATH] = json(createWorkspaceOwnership(files, frameworkVersion));
+    return files;
+}
+function renderWorkspaceRootFilePlan(options) {
+    const workspaceFiles = renderWorkspaceFiles(options);
+    const files = Object.fromEntries(Object.entries(workspaceFiles).filter(([path]) => !path.startsWith(FOUNDATION_ROOT)));
+    return {
+        files,
+        ownership: JSON.parse(workspaceFiles[WORKSPACE_OWNERSHIP_PATH]),
+    };
+}
+function renderFoundationFilePlan(options) {
+    const workspaceFiles = renderWorkspaceFiles(options);
+    const files = Object.fromEntries(Object.entries(workspaceFiles)
+        .filter(([path]) => path.startsWith(FOUNDATION_ROOT))
+        .map(([path, contents]) => [
+        path.slice(FOUNDATION_ROOT.length),
+        contents,
+    ]));
+    return {
+        files,
+        ownership: JSON.parse(workspaceFiles[FOUNDATION_OWNERSHIP_PATH]),
+    };
+}
+exports.WORKSPACE_PACKAGE_MANAGER_VERSION = TOOL_VERSIONS.pnpm;
+//# sourceMappingURL=workspace-files.js.map