@empire-builder-kit/nx 1.0.0-beta.4

package/src/generators/slice/slice.js

@@ -0,0 +1,1676 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STANDARD_LOCAL_DEV_ADAPTER = exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = void 0;
+exports.createBuiltInSlicePlan = createBuiltInSlicePlan;
+exports.sliceGenerator = sliceGenerator;
+const devkit_1 = require("@nx/devkit");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../../blueprints/index.js");
+const index_js_2 = require("../../foundation/index.js");
+const index_js_3 = require("../../ownership/index.js");
+const PRODUCT_VERSIONS = {
+    awsCognito: '^3.700.0',
+    awsEventBridge: '^3.700.0',
+    awsRdsData: '^3.700.0',
+    awsSecretsManager: '^3.700.0',
+    awsSsm: '^3.700.0',
+    drizzle: '^0.45.1',
+    drizzleKit: '^0.31.4',
+    next: '16.2.3',
+    pg: '^8.22.0',
+    playwright: '^1.59.1',
+    react: '19.2.4',
+    reactDom: '19.2.4',
+    typesNode: '25.5.0',
+    typesReact: '19.2.14',
+    typesReactDom: '19.2.3',
+    vitest: '4.1.4',
+};
+exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = [
+    '/name',
+    '/version',
+    '/private',
+    '/dependencies/@aws-sdk~1client-cognito-identity-provider',
+    '/dependencies/@aws-sdk~1client-eventbridge',
+    '/dependencies/@aws-sdk~1client-rds-data',
+    '/dependencies/@aws-sdk~1client-secrets-manager',
+    '/dependencies/@aws-sdk~1client-ssm',
+    '/dependencies/@empire-builder-kit~1runtime',
+    '/dependencies/drizzle-orm',
+    '/dependencies/next',
+    '/dependencies/react',
+    '/dependencies/react-dom',
+    '/devDependencies/@playwright~1test',
+    '/devDependencies/@types~1node',
+    '/devDependencies/@types~1react',
+    '/devDependencies/@types~1react-dom',
+    '/devDependencies/drizzle-kit',
+    '/devDependencies/pg',
+    '/devDependencies/vitest',
+    '/exports/.~1contracts',
+];
+const STANDARD_LOCAL_DEV_ADAPTER = (name) => ({
+    adapterVersion: 1,
+    auth: {
+        callbackPaths: [`/${name}/api/auth/callback`],
+        logoutPaths: [`/${name}/api/auth/sign-out`],
+    },
+    databaseMode: 'local',
+    healthPath: `/${name}/api/health`,
+    kind: 'web',
+    portEnvironment: 'EBK_DEV_PORT',
+    routePrefix: `/${name}`,
+    target: 'dev',
+    websocket: true,
+});
+exports.STANDARD_LOCAL_DEV_ADAPTER = STANDARD_LOCAL_DEV_ADAPTER;
+function readJson(tree, path, label) {
+    const contents = tree.read(path, 'utf8');
+    if (contents === null) {
+        throw new Error(`${label} does not exist at ${path}.`);
+    }
+    try {
+        return JSON.parse(contents);
+    }
+    catch (error) {
+        throw new Error(`${label} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function requireSliceName(name) {
+    const value = name.trim();
+    if (value.length > 63 || !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(value)) {
+        throw new Error('Slice name must start with a lowercase letter, contain at most 63 characters, and use only lowercase letters, numbers, and hyphens.');
+    }
+    return value;
+}
+function workspaceScope(packageJson) {
+    const name = packageJson.name?.trim();
+    if (!name || !/^[a-z0-9][a-z0-9-]*$/.test(name)) {
+        throw new Error('Workspace package.json must have an unscoped lowercase name before generating a slice.');
+    }
+    return `@${name}`;
+}
+function json(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function parseBlueprintInputs(inputs) {
+    if (inputs === undefined) {
+        return {};
+    }
+    if (typeof inputs !== 'string') {
+        return inputs;
+    }
+    try {
+        const parsed = JSON.parse(inputs);
+        if (typeof parsed !== 'object' ||
+            parsed === null ||
+            Array.isArray(parsed)) {
+            throw new Error('value must be a JSON object');
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new Error(`Blueprint --inputs must be valid JSON object syntax: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function renderStandardProductFiles(name, pascalName) {
+    return {
+        'database/bindings.json': json({
+            primary: {
+                active: 'primary',
+                provisioned: ['primary'],
+            },
+        }),
+        'contracts/events.ts': `export interface ${pascalName}CreatedData {
+  id: string;
+  occurredBy: string;
+}
+
+export const ${pascalName}Created = {
+  detailType: '${pascalName}Created',
+  schemaVersion: 1,
+  source: '${name}',
+} as const;
+`,
+        'database/schema.ts': `import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+
+export const records = pgTable('records', {
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  id: uuid('id').defaultRandom().primaryKey(),
+  name: text('name').notNull(),
+});
+`,
+        'database/migrations/0000_initial.sql': `CREATE TABLE IF NOT EXISTS "records" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "name" text NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now()
+);
+`,
+        'database/migrations/meta/_journal.json': json({
+            dialect: 'postgresql',
+            entries: [
+                {
+                    idx: 0,
+                    tag: '0000_initial',
+                    version: '7',
+                    when: 0,
+                    breakpoints: true,
+                },
+            ],
+            version: '7',
+        }),
+        'database/migrations/meta/0000_snapshot.json': json({
+            id: 'fdcf5ce3-ada5-44bf-bd9e-e01f2abe3bc4',
+            prevId: '00000000-0000-0000-0000-000000000000',
+            version: '7',
+            dialect: 'postgresql',
+            tables: {
+                'public.records': {
+                    name: 'records',
+                    schema: '',
+                    columns: {
+                        created_at: {
+                            name: 'created_at',
+                            type: 'timestamp with time zone',
+                            primaryKey: false,
+                            notNull: true,
+                            default: 'now()',
+                        },
+                        id: {
+                            name: 'id',
+                            type: 'uuid',
+                            primaryKey: true,
+                            notNull: true,
+                            default: 'gen_random_uuid()',
+                        },
+                        name: {
+                            name: 'name',
+                            type: 'text',
+                            primaryKey: false,
+                            notNull: true,
+                        },
+                    },
+                    indexes: {},
+                    foreignKeys: {},
+                    compositePrimaryKeys: {},
+                    uniqueConstraints: {},
+                    policies: {},
+                    checkConstraints: {},
+                    isRLSEnabled: false,
+                },
+            },
+            enums: {},
+            schemas: {},
+            sequences: {},
+            roles: {},
+            policies: {},
+            views: {},
+            _meta: { columns: {}, schemas: {}, tables: {} },
+        }),
+        'database/drizzle.config.ts': `import { createDatabaseBindingPlan, resolveLocalDatabaseContract } from '@empire-builder-kit/nx/foundation';
+import { defineConfig } from 'drizzle-kit';
+import databaseBindings from './bindings.json';
+
+const plan = createDatabaseBindingPlan(databaseBindings, {
+  slice: '${name}',
+  stage: 'development',
+});
+const activeDatabase = plan.active.primary;
+if (!activeDatabase) throw new Error('Database binding "primary" is required.');
+const localDatabase = resolveLocalDatabaseContract({
+  database: activeDatabase,
+  slice: '${name}',
+});
+
+export default defineConfig({
+  dbCredentials: {
+    url: process.env.DATABASE_URL ?? \`postgresql://\${localDatabase.username}:\${localDatabase.password}@\${localDatabase.host}:\${localDatabase.port}/\${localDatabase.database}\`,
+  },
+  dialect: 'postgresql',
+  out: './database/migrations',
+  schema: './database/schema.ts',
+});
+`,
+        'database/docker-compose.yml': `services:
+  database:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_DB: \${EBK_LOCAL_DATABASE}
+      POSTGRES_PASSWORD: \${EBK_LOCAL_DATABASE_PASSWORD}
+      POSTGRES_USER: \${EBK_LOCAL_DATABASE_USERNAME}
+    healthcheck:
+      test: [CMD-SHELL, "pg_isready -U \${EBK_LOCAL_DATABASE_USERNAME} -d \${EBK_LOCAL_DATABASE}"]
+      interval: 2s
+      timeout: 3s
+      retries: 15
+    ports:
+      - '\${EBK_LOCAL_DATABASE_PORT}:5432'
+    volumes:
+      - database-data:/var/lib/postgresql/data
+
+volumes:
+  database-data:
+`,
+        'api/health.ts': `import { createHttpJsonHandler } from '@empire-builder-kit/runtime/lambda';
+
+export const handler = createHttpJsonHandler({
+  app: '${name}',
+  operation: 'health',
+  handle: () => ({ service: '${name}', status: 'ok' }),
+});
+`,
+        'web/src/app/api/health/route.ts': `export function GET() {
+  return Response.json({ service: '${name}-web', status: 'ok' });
+}
+`,
+        'api/protected.ts': `import { createBetterAuthConfig } from '@empire-builder-kit/runtime/auth';
+import { createAuthGuard } from '@empire-builder-kit/runtime/auth-backend';
+import { createHttpJsonHandler } from '@empire-builder-kit/runtime/lambda';
+
+let guard: ReturnType<typeof createAuthGuard> | undefined;
+function getGuard() {
+  return guard ??= createAuthGuard({
+    config: createBetterAuthConfig({
+      clientId: process.env.AUTH_CLIENT_ID ?? '',
+      region: process.env.AWS_REGION ?? '',
+      userPoolId: process.env.AUTH_USER_POOL_ID ?? '',
+    }),
+    policy: { defaultKind: 'customer' },
+  });
+}
+
+export const handler = createHttpJsonHandler({
+  app: '${name}',
+  operation: 'protected-example',
+  async handle({ event }) {
+    const principal = await getGuard().authorize(event);
+    return { message: 'Authenticated request accepted.', principal };
+  },
+});
+`,
+        'api/event-consumer.ts': `import { parseSqsEventBridgeRecords } from '@empire-builder-kit/runtime/events';
+import type { ${pascalName}CreatedData } from '../contracts/events.js';
+
+interface QueueRecord { body: string; messageId: string }
+interface QueueEvent { Records: QueueRecord[] }
+
+export async function handler(event: QueueEvent) {
+  const batch = parseSqsEventBridgeRecords<${pascalName}CreatedData>(event.Records);
+  for (const { detailType, envelope } of batch.events) {
+    console.info(JSON.stringify({
+      eventId: envelope.meta.eventId,
+      eventType: detailType,
+      message: '${name} event consumed',
+    }));
+  }
+  return {
+    batchItemFailures: batch.failures.map(({ messageId }) => ({
+      itemIdentifier: messageId ?? '',
+    })),
+  };
+}
+`,
+        'api/publish-created.ts': `import { EventBridgeClient, PutEventsCommand } from '@aws-sdk/client-eventbridge';
+import { createBetterAuthConfig } from '@empire-builder-kit/runtime/auth';
+import { createAuthGuard } from '@empire-builder-kit/runtime/auth-backend';
+import { createEventPublisher } from '@empire-builder-kit/runtime/events';
+import { createHttpJsonHandler } from '@empire-builder-kit/runtime/lambda';
+import { ${pascalName}Created } from '../contracts/events.js';
+
+const client = new EventBridgeClient({});
+let guard: ReturnType<typeof createAuthGuard> | undefined;
+let publish: ReturnType<typeof createEventPublisher> | undefined;
+function getGuard() {
+  return guard ??= createAuthGuard({
+    config: createBetterAuthConfig({
+      clientId: process.env.AUTH_CLIENT_ID ?? '',
+      region: process.env.AWS_REGION ?? '',
+      userPoolId: process.env.AUTH_USER_POOL_ID ?? '',
+    }),
+    policy: { defaultKind: 'customer' },
+  });
+}
+function getPublisher() {
+  return publish ??= createEventPublisher({
+    busName: process.env.EVENT_BUS_NAME ?? '',
+    stage: process.env.EBK_STAGE ?? '',
+    send: (entry) => client.send(new PutEventsCommand({ Entries: [{
+      Detail: entry.detail,
+      DetailType: entry.detailType,
+      EventBusName: entry.eventBusName,
+      Source: entry.source,
+    }] })),
+  });
+}
+
+export const handler = createHttpJsonHandler({
+  app: '${name}',
+  operation: 'publish-created',
+  async handle({ context, event }) {
+    const principal = await getGuard().authorize(event);
+    const publishedEvent = await getPublisher()(${pascalName}Created, {
+      id: crypto.randomUUID(),
+      occurredBy: principal.id,
+    }, { context });
+    return { eventId: publishedEvent.meta.eventId };
+  },
+});
+`,
+        'infra/product.ts': `import { provisionDatabaseBindings } from '@empire-builder-kit/nx/foundation';
+import databaseBindings from '../database/bindings.json';
+import { getFoundationInfrastructure } from './foundation.js';
+// <ebk:composition-imports:start>
+// <ebk:composition-imports:end>
+
+export function product() {
+  const devPortInput = $dev ? (process.env.EBK_DEV_PORT ?? '3000') : '3000';
+  if (!/^\\d+$/.test(devPortInput)) {
+    throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
+  }
+  const devPort = Number(devPortInput);
+  if (!Number.isSafeInteger(devPort) || devPort < 1024 || devPort > 65535) {
+    throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
+  }
+  const foundation = getFoundationInfrastructure();
+  const { db: database } = provisionDatabaseBindings(foundation, {
+    bindings: databaseBindings,
+    slice: '${name}',
+  }).primary;
+  // <ebk:workload-registrations:start>
+  // <ebk:workload-registrations:end>
+
+  const authClient = foundation.userPool.addClient('${pascalName}WebAuthClient', {
+    transform: {
+      client: {
+        explicitAuthFlows: [
+          'ALLOW_USER_PASSWORD_AUTH',
+          'ALLOW_REFRESH_TOKEN_AUTH',
+        ],
+        preventUserExistenceErrors: 'ENABLED',
+      },
+    },
+  });
+
+  const api = new sst.aws.ApiGatewayV2('${pascalName}Api');
+  api.route('GET /health', {
+    environment: { EBK_STAGE: $app.stage },
+    handler: 'api/health.handler',
+    logging: { format: 'json', retention: '1 month' },
+  });
+  api.route('GET /protected', {
+    environment: {
+      AUTH_CLIENT_ID: authClient.id,
+      AUTH_USER_POOL_ID: foundation.userPool.id,
+      EBK_STAGE: $app.stage,
+    },
+    handler: 'api/protected.handler',
+    link: [database],
+    logging: { format: 'json', retention: '1 month' },
+  });
+  api.route('POST /events/example', {
+    environment: {
+      AUTH_CLIENT_ID: authClient.id,
+      AUTH_USER_POOL_ID: foundation.userPool.id,
+      EBK_STAGE: $app.stage,
+      EVENT_BUS_NAME: foundation.discovery.eventBusName,
+    },
+    handler: 'api/publish-created.handler',
+    link: [foundation.eventBus],
+    logging: { format: 'json', retention: '1 month' },
+  });
+  // <ebk:function-registrations:start>
+  // <ebk:function-registrations:end>
+
+  const eventDlq = new sst.aws.Queue('${pascalName}EventDlq');
+  const eventQueue = new sst.aws.Queue('${pascalName}EventQueue', {
+    dlq: { queue: eventDlq.arn, retry: 5 },
+  });
+  eventQueue.subscribe({
+    environment: { EBK_STAGE: $app.stage },
+    handler: 'api/event-consumer.handler',
+    logging: { format: 'json', retention: '1 month' },
+  }, {
+    batch: { partialResponses: true },
+  });
+  foundation.eventBus.subscribeQueue(
+    '${pascalName}CreatedEventRule',
+    eventQueue,
+    {
+      pattern: {
+        detail: { meta: { stage: [$app.stage] } },
+        detailType: ['${pascalName}Created'],
+        source: ['${name}'],
+      },
+    },
+  );
+
+  const web = new sst.aws.Nextjs('${pascalName}Web', {
+    dev: {
+      command: \`pnpm exec next dev web --hostname 127.0.0.1 --port \${devPort}\`,
+      directory: '.',
+      title: '${pascalName} web',
+      url: \`http://127.0.0.1:\${devPort}/${name}\`,
+    },
+    environment: {
+      AUTH_CLIENT_ID: authClient.id,
+      AUTH_USER_POOL_ID: foundation.userPool.id,
+      EBK_STAGE: $app.stage,
+      EBK_FLEET_ORIGIN: process.env.EBK_FLEET_ORIGIN ?? '',
+      EBK_SECURE_COOKIES: process.env.EBK_SECURE_COOKIES ?? '',
+      NEXT_PUBLIC_API_URL: api.url,
+    },
+    link: [database, foundation.userPool],
+    path: 'web',
+    router: { instance: foundation.router, path: '/${name}' },
+    transform: {
+      server: {
+        logging: { format: 'json', retention: '1 month' },
+      },
+    },
+    vpc: foundation.vpc,
+  });
+
+  const apiAlarm = new aws.cloudwatch.MetricAlarm('${pascalName}ApiErrors', {
+    alarmActions: [foundation.discovery.alertTopicArn],
+    comparisonOperator: 'GreaterThanOrEqualToThreshold',
+    dimensions: { ApiId: api.id },
+    evaluationPeriods: 1,
+    metricName: '5xx',
+    namespace: 'AWS/ApiGateway',
+    period: 300,
+    statistic: 'Sum',
+    threshold: 1,
+    treatMissingData: 'notBreaching',
+  });
+  const dlqAlarm = new aws.cloudwatch.MetricAlarm('${pascalName}EventDlqDepth', {
+    alarmActions: [foundation.discovery.alertTopicArn],
+    comparisonOperator: 'GreaterThanOrEqualToThreshold',
+    dimensions: { QueueName: eventDlq.name },
+    evaluationPeriods: 1,
+    metricName: 'ApproximateNumberOfMessagesVisible',
+    namespace: 'AWS/SQS',
+    period: 300,
+    statistic: 'Maximum',
+    threshold: 1,
+    treatMissingData: 'notBreaching',
+  });
+  const dashboard = new aws.cloudwatch.Dashboard('${pascalName}Dashboard', {
+    dashboardName: '${name}-' + $app.stage,
+    dashboardBody: JSON.stringify({
+      widgets: [{
+        type: 'text', x: 0, y: 0, width: 24, height: 3,
+        properties: { markdown: '# ${pascalName}\\nOwner: product' },
+      }],
+    }),
+  });
+
+  return {
+    api,
+    authClient,
+    dashboard,
+    database,
+    dlqAlarm,
+    eventDlq,
+    eventQueue,
+    apiAlarm,
+    web,
+    // <ebk:composition-outputs:start>
+    // <ebk:composition-outputs:end>
+  };
+}
+`,
+        'web/next-env.d.ts': `/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+`,
+        'web/tsconfig.json': json({
+            extends: '../tsconfig.json',
+            compilerOptions: {
+                incremental: true,
+                plugins: [{ name: 'next' }],
+            },
+            include: ['next-env.d.ts', '.next/types/**/*.ts', '**/*.ts', '**/*.tsx'],
+            exclude: ['node_modules'],
+        }),
+        'web/next.config.ts': `import type { NextConfig } from 'next';
+
+const fleetOrigin = process.env.EBK_FLEET_ORIGIN?.trim();
+
+const config: NextConfig = {
+  ...(fleetOrigin ? { allowedDevOrigins: [new URL(fleetOrigin).hostname] } : {}),
+  basePath: '/${name}',
+  reactStrictMode: true,
+};
+
+export default config;
+`,
+        'web/open-next.config.ts': `const config = {
+  // OpenNext runs from this web directory. Point it at the slice package so it
+  // builds only this application instead of recursively invoking the Nx root.
+  buildCommand: 'pnpm exec next build web',
+  default: {},
+  packageJsonPath: '../package.json',
+};
+
+export default config;
+`,
+        'web/src/app/globals.css': `:root { color-scheme: light dark; font-family: system-ui, sans-serif; }
+body { margin: 0; background: #07111f; color: #edf6ff; }
+main { max-width: 64rem; margin: 0 auto; padding: 5rem 1.5rem; }
+.card { background: #102238; border: 1px solid #29425e; border-radius: 1rem; padding: 1.5rem; }
+a { color: #78d5ff; }
+input, button { box-sizing: border-box; display: block; margin-top: .75rem; padding: .75rem; width: 100%; }
+button { background: #48b7de; border: 0; color: #04111b; cursor: pointer; font-weight: 700; }
+`,
+        'web/src/app/layout.tsx': `import type { Metadata } from 'next';
+import type { ReactNode } from 'react';
+import './globals.css';
+
+export const metadata: Metadata = { title: '${pascalName}' };
+
+export default function Layout({ children }: Readonly<{ children: ReactNode }>) {
+  return <html lang="en"><body>{children}</body></html>;
+}
+`,
+        'web/src/app/page.tsx': `export default function Home() {
+  return <main>
+    <p>Empire Builder Kit Product Slice</p>
+    <h1>${pascalName}</h1>
+    <div className="card">
+      <p>The web app, Lambda API, logical Postgres database, Cognito client,
+      event buffer/DLQ, dashboard, and alarms are wired and owned here.</p>
+      <a href="/${name}/sign-in">Sign in</a>
+    </div>
+  </main>;
+}
+`,
+        'web/src/app/sign-in/page.tsx': `'use client';
+
+import { useState, type FormEvent } from 'react';
+
+export default function SignIn() {
+  const [message, setMessage] = useState('');
+  async function submit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const data = new FormData(event.currentTarget);
+    const response = await fetch('/${name}/api/auth/sign-in', {
+      body: JSON.stringify({ email: data.get('email'), password: data.get('password') }),
+      headers: { 'content-type': 'application/json' },
+      method: 'POST',
+    });
+    setMessage(response.ok ? 'Signed in.' : 'Sign-in failed.');
+  }
+  return <main><div className="card"><h1>Sign in</h1>
+    <form onSubmit={submit}>
+      <label>Email<input name="email" type="email" autoComplete="username" required /></label>
+      <label>Password<input name="password" type="password" autoComplete="current-password" required /></label>
+      <button type="submit">Sign in</button>
+    </form><p role="status">{message}</p>
+    <a href="/${name}/password-reset">Reset password</a>
+  </div></main>;
+}
+`,
+        'web/src/app/password-reset/page.tsx': `'use client';
+
+import { useState, type FormEvent } from 'react';
+
+export default function PasswordReset() {
+  const [message, setMessage] = useState('');
+  async function submit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const data = new FormData(event.currentTarget);
+    const response = await fetch('/${name}/api/auth/password-reset', {
+      body: JSON.stringify({ email: data.get('email') }),
+      headers: { 'content-type': 'application/json' },
+      method: 'POST',
+    });
+    setMessage(response.ok ? 'If the account exists, a reset code was sent.' : 'Request failed.');
+  }
+  return <main><div className="card"><h1>Reset password</h1>
+    <form onSubmit={submit}><label>Email<input name="email" type="email" required /></label>
+      <button type="submit">Send reset code</button></form><p role="status">{message}</p>
+  </div></main>;
+}
+`,
+        'web/src/app/api/auth/sign-in/route.ts': `import { InitiateAuthCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
+import { createSessionTokenCookiePlan } from '@empire-builder-kit/runtime/auth-session';
+import { cookies } from 'next/headers';
+import { NextResponse } from 'next/server';
+
+const cognito = new CognitoIdentityProviderClient({});
+
+export async function POST(request: Request) {
+  const body = await request.json() as { email?: string; password?: string };
+  if (!body.email || !body.password) return NextResponse.json({ ok: false }, { status: 400 });
+  const result = await cognito.send(new InitiateAuthCommand({
+    AuthFlow: 'USER_PASSWORD_AUTH',
+    ClientId: process.env.AUTH_CLIENT_ID,
+    AuthParameters: { USERNAME: body.email, PASSWORD: body.password },
+  }));
+  const auth = result.AuthenticationResult;
+  if (!auth?.AccessToken || !auth.ExpiresIn) return NextResponse.json({ ok: false }, { status: 401 });
+  const secure = process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production';
+  const store = await cookies();
+  for (const { name, value, ...options } of createSessionTokenCookiePlan({
+    accessToken: auth.AccessToken,
+    expiresAt: Math.floor(Date.now() / 1000) + auth.ExpiresIn,
+    refreshToken: auth.RefreshToken,
+  }, { namespace: '${name}', secure })) store.set(name, value, options);
+  return NextResponse.json({ ok: true });
+}
+`,
+        'web/src/app/api/auth/refresh/route.ts': `import { InitiateAuthCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
+import { createSessionTokenCookiePlan, getSessionTokenCookieNames } from '@empire-builder-kit/runtime/auth-session';
+import { cookies } from 'next/headers';
+import { NextResponse } from 'next/server';
+
+const cognito = new CognitoIdentityProviderClient({});
+
+export async function POST() {
+  const store = await cookies();
+  const secure = process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production';
+  const names = getSessionTokenCookieNames({ namespace: '${name}', secure });
+  const refreshToken = store.get(names.refresh)?.value;
+  if (!refreshToken) return NextResponse.json({ ok: false }, { status: 401 });
+  const result = await cognito.send(new InitiateAuthCommand({
+    AuthFlow: 'REFRESH_TOKEN_AUTH', ClientId: process.env.AUTH_CLIENT_ID,
+    AuthParameters: { REFRESH_TOKEN: refreshToken },
+  }));
+  const auth = result.AuthenticationResult;
+  if (!auth?.AccessToken || !auth.ExpiresIn) return NextResponse.json({ ok: false }, { status: 401 });
+  for (const { name, value, ...options } of createSessionTokenCookiePlan({
+    accessToken: auth.AccessToken,
+    expiresAt: Math.floor(Date.now() / 1000) + auth.ExpiresIn,
+    refreshToken: auth.RefreshToken ?? refreshToken,
+  }, { namespace: '${name}', secure })) store.set(name, value, options);
+  return NextResponse.json({ ok: true });
+}
+`,
+        'web/src/app/api/auth/sign-out/route.ts': `import { createSessionTokenCookieDeletionPlan } from '@empire-builder-kit/runtime/auth-session';
+import { cookies } from 'next/headers';
+import { NextResponse } from 'next/server';
+
+export async function POST() {
+  const store = await cookies();
+  const secure = process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production';
+  for (const { name, value, ...options } of createSessionTokenCookieDeletionPlan({
+    namespace: '${name}',
+    secure,
+  })) store.set(name, value, options);
+  return NextResponse.json({ ok: true });
+}
+`,
+        'web/src/app/api/auth/password-reset/route.ts': `import { ForgotPasswordCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
+import { NextResponse } from 'next/server';
+
+const cognito = new CognitoIdentityProviderClient({});
+export async function POST(request: Request) {
+  const body = await request.json() as { email?: string };
+  if (body.email) await cognito.send(new ForgotPasswordCommand({
+    ClientId: process.env.AUTH_CLIENT_ID, Username: body.email,
+  }));
+  return NextResponse.json({ ok: true });
+}
+`,
+        'web/src/app/api/auth/callback/route.ts': `import { NextResponse } from 'next/server';
+
+export function GET() {
+  return NextResponse.json({
+    message: 'The Standard Blueprint uses server-side Cognito password auth; OAuth Blueprints may replace this callback.',
+  });
+}
+`,
+        'web/src/app/api/protected/route.ts': `import { getSessionTokenCookieNames } from '@empire-builder-kit/runtime/auth-session';
+import { cookies } from 'next/headers';
+import { NextResponse } from 'next/server';
+
+export async function GET() {
+  const store = await cookies();
+  const names = getSessionTokenCookieNames({
+    namespace: '${name}',
+    secure: process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production',
+  });
+  const accessToken = store.get(names.access)?.value;
+  if (!accessToken) return NextResponse.json({ ok: false }, { status: 401 });
+  const response = await fetch((process.env.NEXT_PUBLIC_API_URL ?? '') + '/protected', {
+    headers: { authorization: 'Bearer ' + accessToken },
+  });
+  return new NextResponse(await response.text(), {
+    headers: { 'content-type': 'application/json' },
+    status: response.status,
+  });
+}
+`,
+        'web/src/app/page.spec.tsx': `import { renderToStaticMarkup } from 'react-dom/server';
+import { describe, expect, it } from 'vitest';
+import Home from './page.js';
+
+describe('home page', () => {
+  it('renders the Product Slice identity and sign-in path', () => {
+    const html = renderToStaticMarkup(<Home />);
+    expect(html).toContain('${pascalName}');
+    expect(html).toContain('/sign-in');
+  });
+});
+`,
+        'vitest.config.ts': `import { configDefaults, defineConfig } from 'vitest/config';
+export default defineConfig({
+  test: {
+    environment: 'node',
+    env: { EBK_STAGE: 'development' },
+    exclude: [...configDefaults.exclude, '**/dist/**', 'e2e/**'],
+  },
+});
+`,
+        'e2e/product.spec.ts': `import { expect, test } from '@playwright/test';
+
+test('renders the product and sign-in journey', async ({ page }) => {
+  await page.goto(process.env.EBK_SMOKE_URL ?? 'http://localhost:3000/${name}');
+  await expect(page.getByRole('heading', { name: '${pascalName}' })).toBeVisible();
+  await page.getByRole('link', { name: 'Sign in' }).click();
+  await expect(page.getByRole('heading', { name: 'Sign in' })).toBeVisible();
+});
+`,
+        'playwright.config.ts': `import { defineConfig } from '@playwright/test';
+export default defineConfig({
+  testDir: './e2e',
+  use: { trace: 'retain-on-failure' },
+});
+`,
+    };
+}
+function renderSliceFiles(name, scope, runtimeVersion, ownership) {
+    const pascalName = name
+        .split('-')
+        .map((segment) => segment[0]?.toUpperCase() + segment.slice(1))
+        .join('');
+    return {
+        '.ebk/ownership.json': json(ownership),
+        'README.md': `# ${name}
+
+This Product Slice is an independent business and deployment boundary generated from the
+built-in Empire Builder Kit Standard Blueprint.
+
+It consumes the Standard Foundation through its versioned capability contract. Do not import
+files from \`packages/foundation/infra\` or from another slice's internals.
+
+## Included product baseline
+
+- Next.js web application with sign-in, refresh, sign-out, callback, and password-reset paths
+- Lambda HTTP API with health and JWT-protected routes
+- stage- and slice-scoped logical Postgres database plus migration history
+- typed EventBridge publisher and SQS/DLQ-backed consumer
+- Product Slice dashboard and API/DLQ alarms routed through Foundation alerts
+- Vitest source test and Playwright deployed-smoke path
+
+Keep business contracts in \`contracts/\`. Add long-running Services and finite Jobs only when
+the product needs them.
+
+Add product dependencies with \`pnpm --filter ${scope}/${name} add <package>\`. EBK owns only
+its recorded framework keys in this package manifest, so health checks and upgrades preserve
+dependencies, scripts, and other keys added by the product team.
+
+## Local database
+
+Run \`pnpm nx run ${name}:dev --stage=development\`. The target starts Docker Postgres,
+applies local migrations, and then starts SST live mode. Set \`EBK_DEV_PORT\` to choose the
+Next.js port; it defaults to \`3000\`. The web readiness endpoint is
+\`http://127.0.0.1:<port>/${name}/api/health\`.
+
+The workspace fleet target discovers this slice through its versioned
+\`metadata.ebk.localDev\` adapter. It supplies the exact HTTPS fleet origin, secure-cookie
+signal, callback/logout URLs, and allocated internal port; do not persist a developer port in
+this project.
+
+\`database/bindings.json\` is the adopter-owned database selection contract. Add a candidate
+identifier to \`primary.provisioned\` to provision it without moving workload traffic. After the
+candidate is migrated and verified through the database-replacement runbook, change only
+\`primary.active\` to select it on the next reviewed deployment. Do not edit managed
+\`infra/product.ts\` or provision databases with Foundation master credentials.
+
+The readiness route is framework-managed for local orchestration. Put product-specific
+dependency and status checks under \`/${name}/api/status\` rather than editing that route.
+
+Run \`pnpm nx run ${name}:db-local-down\` when finished. The named volume preserves local data
+between sessions.
+
+Use \`pnpm nx run ${name}:dev --stage=<personal-name>\` for a personal live relay. The target
+maps that consumer stage to the \`development\` Foundation and reports both stages during
+preflight. It never deploys a personal Foundation. A normal full deploy at a mapped personal
+stage fails closed; use a canonical stage for \`${name}:deploy\`.
+`,
+        'contracts/index.ts': `export const ${pascalName}ContractVersion = '1.0.0' as const;
+
+// Export transport-neutral commands, events, DTOs, and clients from this package surface.
+`,
+        'docs/architecture.md': `# ${name} architecture
+
+## Boundary
+
+This slice owns its product behavior, routes, app clients, logical databases, event rules,
+queues, alarms, dashboards, and runbooks. The Foundation owns shared capacity and policy.
+
+## Dependencies
+
+- Foundation contract: \`^1\`
+- Canonical stages map to the same Foundation stage; personal/preview stages map only to
+  \`development\`
+- Other slices: contracts-only imports
+`,
+        'docs/contracts.md': `# ${name} contracts
+
+Published contracts belong in \`contracts/\`. Keep them transport-neutral and versioned.
+Record consumed slice contracts here before adding a source dependency.
+`,
+        'docs/runbooks.md': `# ${name} runbooks
+
+Document deployment smoke checks, alarms, rollback, event redrive, database migration, and
+Service or Job recovery procedures as those capabilities are added.
+`,
+        'ebk-globals.d.ts': `declare const sst: any;
+declare const aws: any;
+declare const $app: { name: string; stage: string };
+declare const $config: any;
+declare const $dev: boolean;
+declare const $interpolate: (
+  strings: TemplateStringsArray,
+  ...values: unknown[]
+) => unknown;
+declare const $util: any;
+`,
+        'infra/foundation.ts': `import {
+  foundationSsmPath,
+  productSliceRegistrationPath,
+  resolveFoundationStages,
+  type FoundationDiscovery,
+} from '@empire-builder-kit/nx/foundation';
+
+const stages = resolveFoundationStages({
+  consumerStage: $app.stage,
+  foundationStage: process.env.EBK_FOUNDATION_STAGE,
+});
+
+function foundationParameter(name: Parameters<typeof foundationSsmPath>[1]) {
+  return aws.ssm.getParameterOutput({
+    name: foundationSsmPath(stages.foundationStage, name),
+  }).value;
+}
+
+export function getFoundation(): FoundationDiscovery {
+  return {
+    alertTopicArn: foundationParameter('alertTopicArn'),
+    capabilities: foundationParameter('capabilities').apply((value: string) =>
+      value.split(',').map((capability) => capability.trim()),
+    ),
+    clusterId: foundationParameter('clusterId'),
+    contractVersion: foundationParameter('contractVersion'),
+    databaseClusterArn: foundationParameter('databaseClusterArn'),
+    databaseClusterId: foundationParameter('databaseClusterId'),
+    databaseMasterSecretArn: foundationParameter('databaseMasterSecretArn'),
+    eventBusArn: foundationParameter('eventBusArn'),
+    eventBusName: foundationParameter('eventBusName'),
+    hasPublicDomain: foundationParameter('hasPublicDomain').apply(
+      (value: string) => value === 'true',
+    ),
+    identityUserPoolArn: foundationParameter('identityUserPoolArn'),
+    identityUserPoolId: foundationParameter('identityUserPoolId'),
+    rootDomain: foundationParameter('rootDomain').apply((value: string) =>
+      value === 'none' ? undefined : value,
+    ),
+    routerDistributionId: foundationParameter('routerDistributionId'),
+    routerUrl: foundationParameter('routerUrl'),
+    schemaVersion: foundationParameter('schemaVersion').apply(Number),
+    vpcId: foundationParameter('vpcId'),
+  } as FoundationDiscovery;
+}
+
+export function getFoundationInfrastructure() {
+  const discovery = getFoundation();
+  const vpc = sst.aws.Vpc.get('FoundationVpc', discovery.vpcId);
+  const cluster = sst.aws.Cluster.get('FoundationCluster', {
+    id: discovery.clusterId,
+    vpc,
+  });
+  const router = sst.aws.Router.get(
+    'FoundationRouter',
+    discovery.routerDistributionId,
+  );
+  const userPool = sst.aws.CognitoUserPool.get(
+    'FoundationIdentity',
+    discovery.identityUserPoolId,
+  );
+  const eventBus = sst.aws.Bus.get(
+    'FoundationEventBus',
+    discovery.eventBusName,
+  );
+  const database = sst.aws.Aurora.get(
+    'FoundationDatabase',
+    discovery.databaseClusterId,
+  );
+
+  return {
+    cluster,
+    database: {
+      cluster: database,
+      clusterArn: discovery.databaseClusterArn,
+      masterSecretArn: discovery.databaseMasterSecretArn,
+    },
+    discovery,
+    eventBus,
+    router,
+    userPool,
+    vpc,
+  };
+}
+
+export function registerProductSlice() {
+  return new aws.ssm.Parameter('${pascalName}ProductSliceRegistration', {
+    name: productSliceRegistrationPath(
+      stages.foundationStage,
+      stages.consumerStage,
+      '${name}',
+    ),
+    type: 'String',
+    value: JSON.stringify({
+      consumerStage: stages.consumerStage,
+      foundationContract: '^1.0.0',
+      foundationStage: stages.foundationStage,
+      name: '${name}',
+      registrationVersion: 1,
+    }),
+  });
+}
+`,
+        'infra/index.ts': `import { getFoundation, registerProductSlice } from './foundation.js';
+import { product } from './product.js';
+
+export function app() {
+  const foundation = getFoundation();
+  const registration = registerProductSlice();
+  const resources = product();
+  return {
+    apiUrl: resources.api.url,
+    authClientId: resources.authClient.id,
+    foundationContractVersion: foundation.contractVersion,
+    name: '${name}',
+    registration: registration.name,
+    stage: $app.stage,
+    webUrl: resources.web.url,
+  };
+}
+`,
+        'package.json': json({
+            name: `${scope}/${name}`,
+            version: '0.0.0',
+            private: true,
+            dependencies: {
+                '@aws-sdk/client-cognito-identity-provider': PRODUCT_VERSIONS.awsCognito,
+                '@aws-sdk/client-eventbridge': PRODUCT_VERSIONS.awsEventBridge,
+                '@aws-sdk/client-rds-data': PRODUCT_VERSIONS.awsRdsData,
+                '@aws-sdk/client-secrets-manager': PRODUCT_VERSIONS.awsSecretsManager,
+                '@aws-sdk/client-ssm': PRODUCT_VERSIONS.awsSsm,
+                '@empire-builder-kit/runtime': runtimeVersion,
+                'drizzle-orm': PRODUCT_VERSIONS.drizzle,
+                next: PRODUCT_VERSIONS.next,
+                react: PRODUCT_VERSIONS.react,
+                'react-dom': PRODUCT_VERSIONS.reactDom,
+            },
+            devDependencies: {
+                '@playwright/test': PRODUCT_VERSIONS.playwright,
+                '@types/node': PRODUCT_VERSIONS.typesNode,
+                '@types/react': PRODUCT_VERSIONS.typesReact,
+                '@types/react-dom': PRODUCT_VERSIONS.typesReactDom,
+                'drizzle-kit': PRODUCT_VERSIONS.drizzleKit,
+                pg: PRODUCT_VERSIONS.pg,
+                vitest: PRODUCT_VERSIONS.vitest,
+            },
+            exports: {
+                './contracts': {
+                    types: './contracts/index.ts',
+                    default: './contracts/index.ts',
+                },
+            },
+        }),
+        'project.json': json({
+            name,
+            $schema: '../../node_modules/nx/schemas/project-schema.json',
+            projectType: 'application',
+            sourceRoot: `packages/${name}/infra`,
+            implicitDependencies: ['foundation'],
+            tags: [
+                `scope:${name}`,
+                'type:slice',
+                'type:sst',
+                'layer:product',
+                'visibility:internal',
+            ],
+            metadata: {
+                ebk: {
+                    localDev: (0, exports.STANDARD_LOCAL_DEV_ADAPTER)(name),
+                },
+            },
+            targets: {
+                build: {
+                    executor: 'nx:run-commands',
+                    dependsOn: ['typecheck'],
+                    options: {
+                        command: 'next build web',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                'db-check': {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'node scripts/check-database.mjs',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                'db-generate': {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'drizzle-kit generate --config=database/drizzle.config.ts',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                'db-migrate': {
+                    executor: 'nx:run-commands',
+                    dependsOn: [{ target: 'deploy-infrastructure', params: 'forward' }],
+                    options: {
+                        command: 'node scripts/migrate-database.mjs',
+                        cwd: `packages/${name}`,
+                        forwardAllArgs: true,
+                    },
+                },
+                'db-local-down': {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'node scripts/local-database.mjs down',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                'db-local-migrate': {
+                    executor: 'nx:run-commands',
+                    dependsOn: ['db-local-up'],
+                    options: {
+                        command: 'drizzle-kit migrate --config=database/drizzle.config.ts',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                'db-local-up': {
+                    executor: 'nx:run-commands',
+                    dependsOn: ['db-check'],
+                    options: {
+                        command: 'node scripts/local-database.mjs up',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                deploy: {
+                    executor: 'nx:run-commands',
+                    dependsOn: [{ target: 'db-migrate', params: 'forward' }],
+                    options: {
+                        command: 'node scripts/confirm-deploy.mjs',
+                        cwd: `packages/${name}`,
+                        forwardAllArgs: true,
+                    },
+                },
+                'deploy-infrastructure': {
+                    executor: '@empire-builder-kit/nx:deploy',
+                    dependsOn: [
+                        'verify',
+                        { target: 'foundation-ready', params: 'forward' },
+                    ],
+                    options: {
+                        cwd: `packages/${name}`,
+                        stage: 'development',
+                        stageMode: 'consumer',
+                    },
+                },
+                dev: {
+                    executor: '@empire-builder-kit/nx:dev',
+                    dependsOn: [
+                        'dev-prerequisite',
+                        'db-local-migrate',
+                        { target: 'foundation-preflight', params: 'forward' },
+                    ],
+                    options: {
+                        cwd: `packages/${name}`,
+                        stage: 'development',
+                        stageMode: 'consumer',
+                    },
+                },
+                'dev-prerequisite': {
+                    executor: 'nx:run-commands',
+                    dependsOn: ['db-check', 'typecheck'],
+                    options: {
+                        command: 'node scripts/verify-live-mode.mjs',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                lint: {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'eslint .',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                'foundation-preflight': {
+                    executor: '@empire-builder-kit/nx:foundation-preflight',
+                    options: {
+                        capabilities: [...ownership.foundation.capabilities],
+                        contract: ownership.foundation.contract,
+                        stage: 'development',
+                    },
+                },
+                'foundation-ready': {
+                    executor: '@empire-builder-kit/nx:foundation-preflight',
+                    dependsOn: [
+                        { projects: ['foundation'], target: 'verify', params: 'ignore' },
+                    ],
+                    options: {
+                        capabilities: [...ownership.foundation.capabilities],
+                        contract: ownership.foundation.contract,
+                        deployIfMissing: true,
+                        foundationProject: 'foundation',
+                        stage: 'development',
+                    },
+                },
+                refresh: {
+                    executor: '@empire-builder-kit/nx:refresh',
+                    options: {
+                        cwd: `packages/${name}`,
+                        stage: 'development',
+                        stageMode: 'consumer',
+                    },
+                },
+                remove: {
+                    executor: '@empire-builder-kit/nx:remove',
+                    options: {
+                        cwd: `packages/${name}`,
+                        stage: 'development',
+                        stageMode: 'consumer',
+                    },
+                },
+                'smoke-deployed': {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'playwright install chromium && playwright test',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                'smoke-deployed-check': {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'playwright test --list',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                test: {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'vitest run',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                typecheck: {
+                    executor: 'nx:run-commands',
+                    options: {
+                        command: 'tsc --noEmit -p tsconfig.json',
+                        cwd: `packages/${name}`,
+                    },
+                },
+                unlock: {
+                    executor: '@empire-builder-kit/nx:unlock',
+                    options: {
+                        cwd: `packages/${name}`,
+                        stage: 'development',
+                        stageMode: 'consumer',
+                    },
+                },
+                verify: {
+                    executor: 'nx:run-commands',
+                    dependsOn: [
+                        'build',
+                        'db-check',
+                        'lint',
+                        'smoke-deployed-check',
+                        'test',
+                        'typecheck',
+                    ],
+                    options: {
+                        command: 'node scripts/verify-slice.mjs',
+                        cwd: `packages/${name}`,
+                    },
+                },
+            },
+        }),
+        'scripts/verify-slice.mjs': `import { readFileSync } from 'node:fs';
+
+const ownership = JSON.parse(
+  readFileSync(new URL('../.ebk/ownership.json', import.meta.url), 'utf8'),
+);
+if (ownership.schemaVersion !== ${index_js_3.GENERATED_OWNERSHIP_SCHEMA_VERSION} || ownership.slice !== '${name}') {
+  throw new Error('Slice ownership metadata is missing or incompatible.');
+}
+if (!ownership.foundation.capabilities.includes('deployment')) {
+  throw new Error('Slice does not declare the Foundation deployment capability.');
+}
+process.stdout.write('${name} slice source contract verified.\\n');
+`,
+        'scripts/verify-live-mode.mjs': `const origin = process.env.EBK_FLEET_ORIGIN?.trim();
+if (origin) {
+  const parsed = new URL(origin);
+  const supportedHostname = parsed.hostname.endsWith('.ebk.localhost') || parsed.hostname.endsWith('.test');
+  if (parsed.protocol !== 'https:' || parsed.origin !== origin || !supportedHostname) {
+    throw new Error('EBK_FLEET_ORIGIN must be an exact HTTPS *.ebk.localhost or adopter-managed *.test origin.');
+  }
+  if (process.env.EBK_SECURE_COOKIES !== 'true') {
+    throw new Error('Fleet development requires EBK_SECURE_COOKIES=true.');
+  }
+}
+process.stdout.write('${name} live-mode prerequisites verified.\\n');
+`,
+        'scripts/check-database.mjs': `import { existsSync, readFileSync } from 'node:fs';
+import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';
+import databaseBindings from '../database/bindings.json' with { type: 'json' };
+
+const migration = new URL('../database/migrations/0000_initial.sql', import.meta.url);
+if (!existsSync(migration) || !readFileSync(migration, 'utf8').includes('CREATE TABLE')) {
+  throw new Error('The initial database migration is missing or invalid.');
+}
+const plan = createDatabaseBindingPlan(databaseBindings, {
+  slice: '${name}',
+  stage: process.env.EBK_STAGE ?? 'development',
+});
+if (!plan.active.primary) throw new Error('Database binding "primary" is required.');
+process.stdout.write('${name} database history verified.\\n');
+`,
+        'scripts/local-database.mjs': `import { spawnSync } from 'node:child_process';
+import { createDatabaseBindingPlan, resolveLocalDatabaseContract } from '@empire-builder-kit/nx/foundation';
+import databaseBindings from '../database/bindings.json' with { type: 'json' };
+
+const action = process.argv[2];
+if (action !== 'up' && action !== 'down') {
+  throw new Error('Usage: node scripts/local-database.mjs <up|down>');
+}
+const plan = createDatabaseBindingPlan(databaseBindings, {
+  slice: '${name}',
+  stage: 'development',
+});
+const activeDatabase = plan.active.primary;
+if (!activeDatabase) throw new Error('Database binding "primary" is required.');
+const local = resolveLocalDatabaseContract({
+  database: activeDatabase,
+  slice: '${name}',
+});
+const project = process.env.COMPOSE_PROJECT_NAME ?? ('ebk-${name}-' + activeDatabase)
+  .replace(/[^a-z0-9_-]/g, '_')
+  .toLowerCase();
+const args = ['compose', '--project-name', project, '-f', 'database/docker-compose.yml'];
+args.push(...(action === 'up' ? ['up', '-d', '--wait'] : ['down']));
+const result = spawnSync('docker', args, {
+  env: {
+    ...process.env,
+    EBK_LOCAL_DATABASE: local.database,
+    EBK_LOCAL_DATABASE_PASSWORD: local.password,
+    EBK_LOCAL_DATABASE_PORT: String(local.port),
+    EBK_LOCAL_DATABASE_USERNAME: local.username,
+  },
+  stdio: 'inherit',
+});
+if (result.error) throw result.error;
+if (result.status !== 0) process.exit(result.status ?? 1);
+`,
+        'scripts/confirm-deploy.mjs': `const stageArg = process.argv.find((value) => value.startsWith('--stage='));
+const stage = stageArg?.slice('--stage='.length) ?? 'development';
+process.stdout.write('${name} infrastructure and database migrations completed for ' + stage + '.\\n');
+`,
+        'scripts/migrate-database.mjs': `import { createHash } from 'node:crypto';
+import { readdir, readFile } from 'node:fs/promises';
+import { createDatabaseBindingPlan, resolveFoundationStages } from '@empire-builder-kit/nx/foundation';
+import {
+  BeginTransactionCommand,
+  CommitTransactionCommand,
+  ExecuteStatementCommand,
+  RDSDataClient,
+  RollbackTransactionCommand,
+} from '@aws-sdk/client-rds-data';
+import { DescribeSecretCommand, SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
+import { GetParameterCommand, SSMClient } from '@aws-sdk/client-ssm';
+import databaseBindings from '../database/bindings.json' with { type: 'json' };
+
+const stageArg = process.argv.find((value) => value.startsWith('--stage='));
+const foundationStageArg = process.argv.find((value) => value.startsWith('--foundationStage='));
+const { consumerStage: stage, foundationStage } = resolveFoundationStages({
+  consumerStage: stageArg?.slice('--stage='.length) ?? 'development',
+  foundationStage: foundationStageArg?.slice('--foundationStage='.length) ?? process.env.EBK_FOUNDATION_STAGE,
+});
+const bindingPlan = createDatabaseBindingPlan(databaseBindings, {
+  slice: '${name}',
+  stage,
+});
+const activeDatabase = bindingPlan.active.primary;
+if (!activeDatabase) throw new Error('Database binding "primary" is required.');
+const database = bindingPlan.identifiers[activeDatabase].database;
+const clusterParameter = '/ebk/' + foundationStage + '/foundation/databaseClusterArn';
+const clusterResponse = await new SSMClient({}).send(
+  new GetParameterCommand({ Name: clusterParameter }),
+);
+const resourceArn = clusterResponse.Parameter?.Value;
+if (!resourceArn) throw new Error('Foundation database cluster ARN is missing at ' + clusterParameter + '.');
+const secretId = 'ebk/' + stage + '/${name}/database/' + activeDatabase + '/readwrite';
+const secretResponse = await new SecretsManagerClient({}).send(
+  new DescribeSecretCommand({ SecretId: secretId }),
+);
+const secretArn = secretResponse.ARN;
+if (!secretArn) throw new Error('Logical database secret ARN is missing for ' + secretId + '.');
+
+const client = new RDSDataClient({});
+const resumeRetryDelaysMs = [1_000, 2_000, 4_000, 8_000, 16_000];
+const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+const send = async (command) => {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return await client.send(command);
+    } catch (error) {
+      const resumable = error && typeof error === 'object' && error.name === 'DatabaseResumingException';
+      if (!resumable || attempt >= resumeRetryDelaysMs.length) throw error;
+      await sleep(resumeRetryDelaysMs[attempt]);
+    }
+  }
+};
+const execute = (sql, parameters = [], transactionId) => send(
+  new ExecuteStatementCommand({
+    database,
+    parameters,
+    resourceArn,
+    secretArn,
+    sql,
+    transactionId,
+  }),
+);
+
+await execute('CREATE TABLE IF NOT EXISTS _ebk_migrations (name text PRIMARY KEY, checksum text NOT NULL, applied_at timestamptz NOT NULL DEFAULT now())');
+const directory = new URL('../database/migrations/', import.meta.url);
+const files = (await readdir(directory)).filter((file) => file.endsWith('.sql')).sort();
+for (const name of files) {
+  const sql = await readFile(new URL(name, directory), 'utf8');
+  const checksum = createHash('sha256').update(sql).digest('hex');
+  const existing = await execute(
+    'SELECT checksum FROM _ebk_migrations WHERE name = :name',
+    [{ name: 'name', value: { stringValue: name } }],
+  );
+  const appliedChecksum = existing.records?.[0]?.[0]?.stringValue;
+  if (appliedChecksum === checksum) continue;
+  if (appliedChecksum) throw new Error('Applied migration changed: ' + name);
+
+  const transaction = await send(new BeginTransactionCommand({
+    database,
+    resourceArn,
+    secretArn,
+  }));
+  if (!transaction.transactionId) throw new Error('Data API did not return a transaction id.');
+  try {
+    const statements = sql.split(/^--> statement-breakpoint\\s*$/m).map((value) => value.trim()).filter(Boolean);
+    for (const statement of statements) await execute(statement, [], transaction.transactionId);
+    await execute(
+      'INSERT INTO _ebk_migrations (name, checksum) VALUES (:name, :checksum)',
+      [
+        { name: 'name', value: { stringValue: name } },
+        { name: 'checksum', value: { stringValue: checksum } },
+      ],
+      transaction.transactionId,
+    );
+    await send(new CommitTransactionCommand({
+      resourceArn,
+      secretArn,
+      transactionId: transaction.transactionId,
+    }));
+  } catch (error) {
+    await send(new RollbackTransactionCommand({
+      resourceArn,
+      secretArn,
+      transactionId: transaction.transactionId,
+    }));
+    throw error;
+  }
+}
+process.stdout.write('${name} database migrations completed for ' + stage + '.\\n');
+`,
+        'sst-env.d.ts': `// Bootstrap placeholder. SST overwrites this file after install, dev, or deploy.
+export {};
+`,
+        'sst.config.ts': `export default $config({
+  app(input: { stage?: string } | undefined) {
+    const production = input?.stage === 'production';
+    return {
+      name: '${name}',
+      removal: production ? 'retain' : 'remove',
+      protect: production,
+      home: 'aws',
+      providers: {
+        aws: { region: process.env.AWS_REGION ?? 'us-east-1' },
+      },
+    };
+  },
+  async run() {
+    const { app } = await import('./infra/index.js');
+    return app();
+  },
+});
+`,
+        'tsconfig.json': json({
+            extends: '../../tsconfig.base.json',
+            compilerOptions: {
+                allowJs: true,
+                esModuleInterop: true,
+                jsx: 'react-jsx',
+                lib: ['dom', 'dom.iterable', 'es2022'],
+                plugins: [{ name: 'next' }],
+                resolveJsonModule: true,
+                types: ['node'],
+            },
+            include: [
+                'contracts/**/*.ts',
+                'database/**/*.ts',
+                'api/**/*.ts',
+                'infra/**/*.ts',
+                'jobs/**/*.ts',
+                'services/**/*.ts',
+                'web/**/*.ts',
+                'web/**/*.tsx',
+                'vitest.config.ts',
+                'sst.config.ts',
+                'sst-env.d.ts',
+                'ebk-globals.d.ts',
+            ],
+            exclude: ['.sst', 'dist', 'node_modules'],
+        }),
+        ...renderStandardProductFiles(name, pascalName),
+    };
+}
+function classifyPaths(files) {
+    const seededPaths = new Set([
+        'README.md',
+        'database/bindings.json',
+        'database/schema.ts',
+        'web/src/app/globals.css',
+        'web/src/app/layout.tsx',
+        'web/src/app/page.spec.tsx',
+        'web/src/app/page.tsx',
+        'web/src/app/password-reset/page.tsx',
+        'web/src/app/api/protected/route.ts',
+        'web/src/app/sign-in/page.tsx',
+    ]);
+    const seededPrefixes = [
+        'api/',
+        'contracts/',
+        'database/migrations/',
+        'docs/',
+        'e2e/',
+    ];
+    const toolOwnedPaths = new Set(['sst-env.d.ts', 'web/next-env.d.ts']);
+    return Object.entries(files)
+        .filter(([path]) => path !== '.ebk/ownership.json' && !toolOwnedPaths.has(path))
+        .map(([path, contents]) => {
+        const mode = seededPaths.has(path) ||
+            seededPrefixes.some((prefix) => path.startsWith(prefix))
+            ? 'seeded'
+            : 'managed';
+        const managedJsonPointers = path === 'package.json'
+            ? [...exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS]
+            : undefined;
+        if (managedJsonPointers) {
+            (0, index_js_3.assertManagedJsonPointersExist)(contents, managedJsonPointers, `Built-in Standard Blueprint ${path}`);
+        }
+        return {
+            ...(managedJsonPointers ? { managedJsonPointers } : {}),
+            mode,
+            origin: 'blueprint',
+            path,
+            sha256: (0, index_js_3.hashOwnedContent)(contents, { managedJsonPointers }),
+        };
+    })
+        .sort((left, right) => left.path.localeCompare(right.path));
+}
+function createBuiltInSlicePlan(name, scope, runtimeVersion, manifest, inputs) {
+    const provisionalOwnership = {
+        blueprint: { name: manifest.name, version: manifest.version },
+        contracts: { consumes: [], publishes: [`${scope}/${name}/contracts`] },
+        foundation: manifest.foundation,
+        inputs,
+        paths: [],
+        projects: [name],
+        schemaVersion: index_js_3.GENERATED_OWNERSHIP_SCHEMA_VERSION,
+        slice: name,
+        verification: manifest.verification,
+    };
+    const provisionalFiles = renderSliceFiles(name, scope, runtimeVersion, provisionalOwnership);
+    const ownership = {
+        ...provisionalOwnership,
+        paths: classifyPaths(provisionalFiles),
+    };
+    return {
+        files: renderSliceFiles(name, scope, runtimeVersion, ownership),
+        ownership,
+    };
+}
+async function sliceGenerator(tree, options) {
+    const name = requireSliceName(options.name);
+    const root = node_path_1.posix.join('packages', name);
+    if (tree.exists(root)) {
+        throw new Error(`Product Slice ${name} already exists at ${root}.`);
+    }
+    const packageJson = readJson(tree, 'package.json', 'Workspace package.json');
+    const blueprint = (0, index_js_1.resolveBlueprint)({
+        localPackages: packageJson.ebk?.blueprints?.localPackages,
+        reference: options.blueprint,
+        trust: {
+            packages: packageJson.ebk?.blueprints?.trustedPackages ?? [],
+        },
+        workspaceRoot: tree.root,
+    });
+    const inputResult = (0, index_js_1.validateBlueprintInputs)(blueprint.inputSchema, parseBlueprintInputs(options.inputs));
+    if (!inputResult.valid) {
+        throw new Error(`Blueprint inputs are invalid:\n${inputResult.issues
+            .map((issue) => `- ${issue.path}: ${issue.message}`)
+            .join('\n')}`);
+    }
+    const foundationDescriptor = readJson(tree, 'packages/foundation/contracts/foundation.json', 'Standard Foundation descriptor');
+    const compatibility = (0, index_js_2.validateFoundationCompatibility)(blueprint.manifest.foundation, foundationDescriptor);
+    if (!compatibility.valid) {
+        throw new Error(`Standard Foundation is incompatible with this Blueprint:\n${compatibility.issues
+            .map((issue) => `- ${issue.path}: ${issue.message}`)
+            .join('\n')}`);
+    }
+    const scope = workspaceScope(packageJson);
+    if (blueprint.source !== 'built-in') {
+        if (!blueprint.generatorPath) {
+            throw new Error('Resolved external Blueprint has no generator entry point.');
+        }
+        const generated = await (0, index_js_1.executeBlueprintGenerator)(blueprint.generatorPath, {
+            foundation: compatibility.value,
+            inputs: inputResult.value,
+            manifest: blueprint.manifest,
+            name,
+            root,
+            workspace: {
+                name: packageJson.name ?? '',
+                scope,
+            },
+        });
+        const ownershipPaths = generated.files.map(({ contents, managedJsonPointers, mode, path }) => ({
+            ...(managedJsonPointers ? { managedJsonPointers } : {}),
+            mode,
+            origin: 'blueprint',
+            path,
+            sha256: (0, index_js_3.hashOwnedContent)(contents, { managedJsonPointers }),
+        }));
+        ownershipPaths.sort((left, right) => left.path.localeCompare(right.path));
+        const ownership = {
+            blueprint: {
+                name: blueprint.manifest.name,
+                version: blueprint.manifest.version,
+            },
+            contracts: generated.contracts,
+            foundation: blueprint.manifest.foundation,
+            inputs: inputResult.value,
+            paths: ownershipPaths,
+            projects: generated.projects,
+            schemaVersion: index_js_3.GENERATED_OWNERSHIP_SCHEMA_VERSION,
+            slice: name,
+            verification: blueprint.manifest.verification,
+        };
+        const ownershipValidation = (0, index_js_3.validateGeneratedOwnershipRecord)(ownership);
+        if (!ownershipValidation.valid) {
+            throw new Error(`Generated ownership metadata is invalid:\n${ownershipValidation.issues
+                .map((issue) => `- ${issue.path}: ${issue.message}`)
+                .join('\n')}`);
+        }
+        for (const file of generated.files) {
+            tree.write(node_path_1.posix.join(root, file.path), file.contents);
+        }
+        tree.write(node_path_1.posix.join(root, '.ebk/ownership.json'), json(ownershipValidation.value));
+        if (blueprint.source === 'installed') {
+            packageJson.devDependencies = {
+                ...packageJson.devDependencies,
+                [blueprint.manifest.name]: blueprint.manifest.version,
+            };
+            tree.write('package.json', json(packageJson));
+        }
+        if (!options.skipFormat) {
+            await (0, devkit_1.formatFiles)(tree);
+        }
+        (0, index_js_3.restampProductSliceOwnership)(tree, name);
+        if (!options.skipFormat) {
+            await (0, devkit_1.formatFiles)(tree);
+        }
+        return options.skipInstall
+            ? undefined
+            : () => (0, devkit_1.installPackagesTask)(tree, true);
+    }
+    const runtimeVersion = packageJson.dependencies?.['@empire-builder-kit/runtime'];
+    if (!runtimeVersion) {
+        throw new Error('Workspace package.json must depend on @empire-builder-kit/runtime before generating a Product Slice.');
+    }
+    const plan = createBuiltInSlicePlan(name, scope, runtimeVersion, blueprint.manifest, inputResult.value);
+    const ownershipValidation = (0, index_js_3.validateGeneratedOwnershipRecord)(plan.ownership);
+    if (!ownershipValidation.valid) {
+        throw new Error(`Generated ownership metadata is invalid:\n${ownershipValidation.issues
+            .map((issue) => `- ${issue.path}: ${issue.message}`)
+            .join('\n')}`);
+    }
+    for (const [relativePath, contents] of Object.entries(plan.files)) {
+        tree.write(node_path_1.posix.join(root, relativePath), contents);
+    }
+    if (!options.skipFormat) {
+        await (0, devkit_1.formatFiles)(tree);
+    }
+    (0, index_js_3.restampProductSliceOwnership)(tree, name);
+    if (!options.skipFormat) {
+        await (0, devkit_1.formatFiles)(tree);
+    }
+    return options.skipInstall
+        ? undefined
+        : () => (0, devkit_1.installPackagesTask)(tree, true);
+}
+exports.default = sliceGenerator;
+//# sourceMappingURL=slice.js.map