@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/slice.js

@@ -1,70 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.STANDARD_LOCAL_DEV_ADAPTER = exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = void 0;
-exports.createBuiltInSlicePlan = createBuiltInSlicePlan;
+exports.createBuiltInSlicePlan = exports.STANDARD_LOCAL_DEV_ADAPTER = exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = void 0;
 exports.sliceGenerator = sliceGenerator;
+const deterministic_order_js_1 = require("../../deterministic-order.js");
 const devkit_1 = require("@nx/devkit");
 const node_path_1 = require("node:path");
+const node_util_1 = require("node:util");
 const index_js_1 = require("../../blueprints/index.js");
 const index_js_2 = require("../../foundation/index.js");
 const index_js_3 = require("../../ownership/index.js");
 const index_js_4 = require("../../repository-policy/index.js");
-const PRODUCT_VERSIONS = {
-    awsCognito: '^3.700.0',
-    awsEventBridge: '^3.700.0',
-    awsRdsData: '^3.700.0',
-    awsSecretsManager: '^3.700.0',
-    awsSsm: '^3.700.0',
-    drizzle: '^0.45.1',
-    drizzleKit: '^0.31.4',
-    next: '16.2.3',
-    pg: '^8.22.0',
-    playwright: '^1.59.1',
-    react: '19.2.4',
-    reactDom: '19.2.4',
-    typesNode: '25.5.0',
-    typesReact: '19.2.14',
-    typesReactDom: '19.2.3',
-    vitest: '4.1.4',
-};
-exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = [
-    '/name',
-    '/version',
-    '/private',
-    '/dependencies/@aws-sdk~1client-cognito-identity-provider',
-    '/dependencies/@aws-sdk~1client-eventbridge',
-    '/dependencies/@aws-sdk~1client-rds-data',
-    '/dependencies/@aws-sdk~1client-secrets-manager',
-    '/dependencies/@aws-sdk~1client-ssm',
-    '/dependencies/@empire-builder-kit~1runtime',
-    '/dependencies/drizzle-orm',
-    '/dependencies/next',
-    '/dependencies/react',
-    '/dependencies/react-dom',
-    '/devDependencies/@playwright~1test',
-    '/devDependencies/@types~1node',
-    '/devDependencies/@types~1react',
-    '/devDependencies/@types~1react-dom',
-    '/devDependencies/drizzle-kit',
-    '/devDependencies/pg',
-    '/devDependencies/vitest',
-    '/exports/.~1contracts',
-];
-const STANDARD_LOCAL_DEV_ADAPTER = (name) => ({
-    adapterVersion: 1,
-    auth: {
-        callbackPaths: [`/${name}/api/auth/callback`],
-        logoutPaths: [`/${name}/api/auth/sign-out`],
-    },
-    databaseMode: 'local',
-    healthPath: `/${name}/api/health`,
-    kind: 'web',
-    portEnvironment: 'EBK_DEV_PORT',
-    routePrefix: `/${name}`,
-    target: 'dev',
-    websocket: true,
-});
-exports.STANDARD_LOCAL_DEV_ADAPTER = STANDARD_LOCAL_DEV_ADAPTER;
+const blueprint_verification_authority_js_1 = require("../../supply-chain/blueprint-verification-authority.js");
+const blueprint_trust_js_1 = require("../../supply-chain/blueprint-trust.js");
+const post_generation_install_js_1 = require("../post-generation-install.js");
+const built_in_plan_js_1 = require("./built-in-plan.js");
+var built_in_plan_js_2 = require("./built-in-plan.js");
+Object.defineProperty(exports, "PRODUCT_PACKAGE_MANAGED_JSON_POINTERS", { enumerable: true, get: function () { return built_in_plan_js_2.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS; } });
+Object.defineProperty(exports, "STANDARD_LOCAL_DEV_ADAPTER", { enumerable: true, get: function () { return built_in_plan_js_2.STANDARD_LOCAL_DEV_ADAPTER; } });
+Object.defineProperty(exports, "createBuiltInSlicePlan", { enumerable: true, get: function () { return built_in_plan_js_2.createBuiltInSlicePlan; } });
 function readJson(tree, path, label) {
     const contents = tree.read(path, 'utf8');
     if (contents === null) {
@@ -94,6 +47,84 @@ function workspaceScope(packageJson) {
 function json(value) {
     return `${JSON.stringify(value, null, 2)}\n`;
 }
+function assertExternalBlueprintVerificationProgram(input) {
+    (0, blueprint_verification_authority_js_1.assertExternalBlueprintGeneratedNxProjectConfinement)({
+        files: input.files,
+        root: input.root,
+    });
+    const projectFiles = input.files.filter(({ path }) => path === 'project.json' || path.endsWith('/project.json'));
+    const rootProjectFile = projectFiles.find(({ path }) => path === 'project.json');
+    if (!rootProjectFile) {
+        throw new Error('External Blueprint must generate one authoritative Slice project.json before workspace writes.');
+    }
+    const projectNames = new Set();
+    let rootProject;
+    for (const file of projectFiles) {
+        if (file.mode !== 'managed' || file.managedJsonPointers !== undefined) {
+            throw new Error(`External Blueprint ${file.path} must be whole-file managed.`);
+        }
+        let project;
+        try {
+            project = JSON.parse(file.contents);
+        }
+        catch (error) {
+            throw new Error(`External Blueprint ${file.path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const expectedRoot = file.path === 'project.json'
+            ? input.root
+            : node_path_1.posix.join(input.root, node_path_1.posix.dirname(file.path));
+        const projectName = project && typeof project === 'object' && !Array.isArray(project)
+            ? project.name
+            : undefined;
+        const targets = project && typeof project === 'object' && !Array.isArray(project)
+            ? project.targets
+            : undefined;
+        if (typeof projectName !== 'string' ||
+            !/^(?:[a-z0-9][a-z0-9._-]{0,127}|@[a-z0-9][a-z0-9._-]{0,62}\/[a-z0-9][a-z0-9._-]{0,63})$/.test(projectName) ||
+            projectNames.has(projectName) ||
+            project.root !== expectedRoot ||
+            !targets ||
+            typeof targets !== 'object' ||
+            Array.isArray(targets)) {
+            throw new Error(`External Blueprint ${file.path} must identify its exact canonical project root, unique normalized name, and target map.`);
+        }
+        projectNames.add(projectName);
+        if (file === rootProjectFile)
+            rootProject = project;
+    }
+    if (!rootProject ||
+        rootProject.name !== input.name ||
+        !(0, node_util_1.isDeepStrictEqual)([...projectNames].sort(), [...input.projects].sort())) {
+        throw new Error('External Blueprint generator result.projects must exactly identify every generated project.json.');
+    }
+    (0, blueprint_trust_js_1.blueprintVerificationTargetClosure)({
+        projectRoot: input.root,
+        roots: input.verification,
+        targets: rootProject.targets,
+    });
+}
+const FORMAT_SENSITIVE_BUILT_IN_PATHS = new Set([
+    'api/generated/contract.json',
+    'api/generated/openapi.json',
+    'web/next-env.d.ts',
+]);
+function dataPolicyReviewSeed(tree, root) {
+    const path = node_path_1.posix.join(root, 'data/policy.json');
+    const existing = tree.read(path, 'utf8');
+    if (existing !== null) {
+        try {
+            const reviewedAt = JSON.parse(existing).governance?.reviewedAt;
+            if (typeof reviewedAt === 'string' &&
+                new Date(reviewedAt).toISOString() === reviewedAt) {
+                return reviewedAt;
+            }
+        }
+        catch {
+            // The generated ownership/reconciliation path reports malformed policy.
+        }
+    }
+    return new Date().toISOString();
+}
 function reportSlicePolicyPosture(tree, name) {
     const contents = tree.read(index_js_4.REPOSITORY_POLICY_FILE, 'utf8');
     if (contents === null) {
@@ -133,1462 +164,49 @@ function parseBlueprintInputs(inputs) {
         throw new Error(`Blueprint --inputs must be valid JSON object syntax: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
-function renderStandardProductFiles(name, pascalName) {
-    return {
-        'database/bindings.json': json({
-            primary: {
-                active: 'primary',
-                provisioned: ['primary'],
-            },
-        }),
-        'contracts/events.ts': `export interface ${pascalName}CreatedData {
-  id: string;
-  occurredBy: string;
-}
-
-export const ${pascalName}Created = {
-  detailType: '${pascalName}Created',
-  schemaVersion: 1,
-  source: '${name}',
-} as const;
-`,
-        'database/schema.ts': `import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
-
-export const records = pgTable('records', {
-  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
-  id: uuid('id').defaultRandom().primaryKey(),
-  name: text('name').notNull(),
-});
-`,
-        'database/migrations/0000_initial.sql': `CREATE TABLE IF NOT EXISTS "records" (
-  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  "name" text NOT NULL,
-  "created_at" timestamptz NOT NULL DEFAULT now()
-);
-`,
-        'database/migrations/meta/_journal.json': json({
-            dialect: 'postgresql',
-            entries: [
-                {
-                    idx: 0,
-                    tag: '0000_initial',
-                    version: '7',
-                    when: 0,
-                    breakpoints: true,
-                },
-            ],
-            version: '7',
-        }),
-        'database/migrations/meta/0000_snapshot.json': json({
-            id: 'fdcf5ce3-ada5-44bf-bd9e-e01f2abe3bc4',
-            prevId: '00000000-0000-0000-0000-000000000000',
-            version: '7',
-            dialect: 'postgresql',
-            tables: {
-                'public.records': {
-                    name: 'records',
-                    schema: '',
-                    columns: {
-                        created_at: {
-                            name: 'created_at',
-                            type: 'timestamp with time zone',
-                            primaryKey: false,
-                            notNull: true,
-                            default: 'now()',
-                        },
-                        id: {
-                            name: 'id',
-                            type: 'uuid',
-                            primaryKey: true,
-                            notNull: true,
-                            default: 'gen_random_uuid()',
-                        },
-                        name: {
-                            name: 'name',
-                            type: 'text',
-                            primaryKey: false,
-                            notNull: true,
-                        },
-                    },
-                    indexes: {},
-                    foreignKeys: {},
-                    compositePrimaryKeys: {},
-                    uniqueConstraints: {},
-                    policies: {},
-                    checkConstraints: {},
-                    isRLSEnabled: false,
-                },
-            },
-            enums: {},
-            schemas: {},
-            sequences: {},
-            roles: {},
-            policies: {},
-            views: {},
-            _meta: { columns: {}, schemas: {}, tables: {} },
-        }),
-        'database/drizzle.config.ts': `import { createDatabaseBindingPlan, resolveLocalDatabaseContract } from '@empire-builder-kit/nx/foundation';
-import { defineConfig } from 'drizzle-kit';
-import databaseBindings from './bindings.json';
-
-const plan = createDatabaseBindingPlan(databaseBindings, {
-  slice: '${name}',
-  stage: 'development',
-});
-const activeDatabase = plan.active.primary;
-if (!activeDatabase) throw new Error('Database binding "primary" is required.');
-const localDatabase = resolveLocalDatabaseContract({
-  database: activeDatabase,
-  slice: '${name}',
-});
-
-export default defineConfig({
-  dbCredentials: {
-    url: process.env.DATABASE_URL ?? \`postgresql://\${localDatabase.username}:\${localDatabase.password}@\${localDatabase.host}:\${localDatabase.port}/\${localDatabase.database}\`,
-  },
-  dialect: 'postgresql',
-  out: './database/migrations',
-  schema: './database/schema.ts',
-});
-`,
-        'database/docker-compose.yml': `services:
-  database:
-    image: postgres:17-alpine
-    environment:
-      POSTGRES_DB: \${EBK_LOCAL_DATABASE}
-      POSTGRES_PASSWORD: \${EBK_LOCAL_DATABASE_PASSWORD}
-      POSTGRES_USER: \${EBK_LOCAL_DATABASE_USERNAME}
-    healthcheck:
-      test: [CMD-SHELL, "pg_isready -U \${EBK_LOCAL_DATABASE_USERNAME} -d \${EBK_LOCAL_DATABASE}"]
-      interval: 2s
-      timeout: 3s
-      retries: 15
-    ports:
-      - '\${EBK_LOCAL_DATABASE_PORT}:5432'
-    volumes:
-      - database-data:/var/lib/postgresql/data
-
-volumes:
-  database-data:
-`,
-        'api/health.ts': `import { createHttpJsonHandler } from '@empire-builder-kit/runtime/lambda';
-
-export const handler = createHttpJsonHandler({
-  app: '${name}',
-  operation: 'health',
-  handle: () => ({ service: '${name}', status: 'ok' }),
-});
-`,
-        'web/src/app/api/health/route.ts': `export function GET() {
-  return Response.json({ service: '${name}-web', status: 'ok' });
-}
-`,
-        'api/protected.ts': `import { createBetterAuthConfig } from '@empire-builder-kit/runtime/auth';
-import { createAuthGuard } from '@empire-builder-kit/runtime/auth-backend';
-import { createHttpJsonHandler } from '@empire-builder-kit/runtime/lambda';
-
-let guard: ReturnType<typeof createAuthGuard> | undefined;
-function getGuard() {
-  return guard ??= createAuthGuard({
-    config: createBetterAuthConfig({
-      clientId: process.env.AUTH_CLIENT_ID ?? '',
-      region: process.env.AWS_REGION ?? '',
-      userPoolId: process.env.AUTH_USER_POOL_ID ?? '',
-    }),
-    policy: { defaultKind: 'customer' },
-  });
-}
-
-export const handler = createHttpJsonHandler({
-  app: '${name}',
-  operation: 'protected-example',
-  async handle({ event }) {
-    const principal = await getGuard().authorize(event);
-    return { message: 'Authenticated request accepted.', principal };
-  },
-});
-`,
-        'api/event-consumer.ts': `import { parseSqsEventBridgeRecords } from '@empire-builder-kit/runtime/events';
-import type { ${pascalName}CreatedData } from '../contracts/events.js';
-
-interface QueueRecord { body: string; messageId: string }
-interface QueueEvent { Records: QueueRecord[] }
-
-export async function handler(event: QueueEvent) {
-  const batch = parseSqsEventBridgeRecords<${pascalName}CreatedData>(event.Records);
-  for (const { detailType, envelope } of batch.events) {
-    console.info(JSON.stringify({
-      eventId: envelope.meta.eventId,
-      eventType: detailType,
-      message: '${name} event consumed',
-    }));
-  }
-  return {
-    batchItemFailures: batch.failures.map(({ messageId }) => ({
-      itemIdentifier: messageId ?? '',
-    })),
-  };
-}
-`,
-        'api/publish-created.ts': `import { EventBridgeClient, PutEventsCommand } from '@aws-sdk/client-eventbridge';
-import { createBetterAuthConfig } from '@empire-builder-kit/runtime/auth';
-import { createAuthGuard } from '@empire-builder-kit/runtime/auth-backend';
-import { createEventPublisher } from '@empire-builder-kit/runtime/events';
-import { createHttpJsonHandler } from '@empire-builder-kit/runtime/lambda';
-import { ${pascalName}Created } from '../contracts/events.js';
-
-const client = new EventBridgeClient({});
-let guard: ReturnType<typeof createAuthGuard> | undefined;
-let publish: ReturnType<typeof createEventPublisher> | undefined;
-function getGuard() {
-  return guard ??= createAuthGuard({
-    config: createBetterAuthConfig({
-      clientId: process.env.AUTH_CLIENT_ID ?? '',
-      region: process.env.AWS_REGION ?? '',
-      userPoolId: process.env.AUTH_USER_POOL_ID ?? '',
-    }),
-    policy: { defaultKind: 'customer' },
-  });
-}
-function getPublisher() {
-  return publish ??= createEventPublisher({
-    busName: process.env.EVENT_BUS_NAME ?? '',
-    stage: process.env.EBK_STAGE ?? '',
-    send: (entry) => client.send(new PutEventsCommand({ Entries: [{
-      Detail: entry.detail,
-      DetailType: entry.detailType,
-      EventBusName: entry.eventBusName,
-      Source: entry.source,
-    }] })),
-  });
-}
-
-export const handler = createHttpJsonHandler({
-  app: '${name}',
-  operation: 'publish-created',
-  async handle({ context, event }) {
-    const principal = await getGuard().authorize(event);
-    const publishedEvent = await getPublisher()(${pascalName}Created, {
-      id: crypto.randomUUID(),
-      occurredBy: principal.id,
-    }, { context });
-    return { eventId: publishedEvent.meta.eventId };
-  },
-});
-`,
-        'infra/product.ts': `import { provisionDatabaseBindings } from '@empire-builder-kit/nx/foundation';
-import databaseBindings from '../database/bindings.json';
-import { getFoundationInfrastructure } from './foundation.js';
-// <ebk:composition-imports:start>
-// <ebk:composition-imports:end>
-
-export function product() {
-  const devPortInput = $dev ? (process.env.EBK_DEV_PORT ?? '3000') : '3000';
-  if (!/^\\d+$/.test(devPortInput)) {
-    throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
-  }
-  const devPort = Number(devPortInput);
-  if (!Number.isSafeInteger(devPort) || devPort < 1024 || devPort > 65535) {
-    throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
-  }
-  const foundation = getFoundationInfrastructure();
-  const { db: database } = provisionDatabaseBindings(foundation, {
-    bindings: databaseBindings,
-    slice: '${name}',
-  }).primary;
-  // <ebk:workload-registrations:start>
-  // <ebk:workload-registrations:end>
-
-  const authClient = foundation.userPool.addClient('${pascalName}WebAuthClient', {
-    transform: {
-      client: {
-        explicitAuthFlows: [
-          'ALLOW_USER_PASSWORD_AUTH',
-          'ALLOW_REFRESH_TOKEN_AUTH',
-        ],
-        preventUserExistenceErrors: 'ENABLED',
-      },
-    },
-  });
-
-  const api = new sst.aws.ApiGatewayV2('${pascalName}Api');
-  api.route('GET /health', {
-    environment: { EBK_STAGE: $app.stage },
-    handler: 'api/health.handler',
-    logging: { format: 'json', retention: '1 month' },
-  });
-  api.route('GET /protected', {
-    environment: {
-      AUTH_CLIENT_ID: authClient.id,
-      AUTH_USER_POOL_ID: foundation.userPool.id,
-      EBK_STAGE: $app.stage,
-    },
-    handler: 'api/protected.handler',
-    link: [database],
-    logging: { format: 'json', retention: '1 month' },
-  });
-  api.route('POST /events/example', {
-    environment: {
-      AUTH_CLIENT_ID: authClient.id,
-      AUTH_USER_POOL_ID: foundation.userPool.id,
-      EBK_STAGE: $app.stage,
-      EVENT_BUS_NAME: foundation.discovery.eventBusName,
-    },
-    handler: 'api/publish-created.handler',
-    link: [foundation.eventBus],
-    logging: { format: 'json', retention: '1 month' },
-  });
-  // <ebk:function-registrations:start>
-  // <ebk:function-registrations:end>
-
-  const eventDlq = new sst.aws.Queue('${pascalName}EventDlq');
-  const eventQueue = new sst.aws.Queue('${pascalName}EventQueue', {
-    dlq: { queue: eventDlq.arn, retry: 5 },
-  });
-  eventQueue.subscribe({
-    environment: { EBK_STAGE: $app.stage },
-    handler: 'api/event-consumer.handler',
-    logging: { format: 'json', retention: '1 month' },
-  }, {
-    batch: { partialResponses: true },
-  });
-  foundation.eventBus.subscribeQueue(
-    '${pascalName}CreatedEventRule',
-    eventQueue,
-    {
-      pattern: {
-        detail: { meta: { stage: [$app.stage] } },
-        detailType: ['${pascalName}Created'],
-        source: ['${name}'],
-      },
-    },
-  );
-
-  const web = new sst.aws.Nextjs('${pascalName}Web', {
-    dev: {
-      command: \`pnpm exec next dev web --hostname 127.0.0.1 --port \${devPort}\`,
-      directory: '.',
-      title: '${pascalName} web',
-      url: \`http://127.0.0.1:\${devPort}/${name}\`,
-    },
-    environment: {
-      AUTH_CLIENT_ID: authClient.id,
-      AUTH_USER_POOL_ID: foundation.userPool.id,
-      EBK_STAGE: $app.stage,
-      EBK_FLEET_ORIGIN: process.env.EBK_FLEET_ORIGIN ?? '',
-      EBK_SECURE_COOKIES: process.env.EBK_SECURE_COOKIES ?? '',
-      NEXT_PUBLIC_API_URL: api.url,
-    },
-    link: [database, foundation.userPool],
-    path: 'web',
-    router: { instance: foundation.router, path: '/${name}' },
-    transform: {
-      server: {
-        logging: { format: 'json', retention: '1 month' },
-      },
-    },
-    vpc: foundation.vpc,
-  });
-
-  const apiAlarm = new aws.cloudwatch.MetricAlarm('${pascalName}ApiErrors', {
-    alarmActions: [foundation.discovery.alertTopicArn],
-    comparisonOperator: 'GreaterThanOrEqualToThreshold',
-    dimensions: { ApiId: api.id },
-    evaluationPeriods: 1,
-    metricName: '5xx',
-    namespace: 'AWS/ApiGateway',
-    period: 300,
-    statistic: 'Sum',
-    threshold: 1,
-    treatMissingData: 'notBreaching',
-  });
-  const dlqAlarm = new aws.cloudwatch.MetricAlarm('${pascalName}EventDlqDepth', {
-    alarmActions: [foundation.discovery.alertTopicArn],
-    comparisonOperator: 'GreaterThanOrEqualToThreshold',
-    dimensions: { QueueName: eventDlq.name },
-    evaluationPeriods: 1,
-    metricName: 'ApproximateNumberOfMessagesVisible',
-    namespace: 'AWS/SQS',
-    period: 300,
-    statistic: 'Maximum',
-    threshold: 1,
-    treatMissingData: 'notBreaching',
-  });
-  const dashboard = new aws.cloudwatch.Dashboard('${pascalName}Dashboard', {
-    dashboardName: '${name}-' + $app.stage,
-    dashboardBody: JSON.stringify({
-      widgets: [{
-        type: 'text', x: 0, y: 0, width: 24, height: 3,
-        properties: { markdown: '# ${pascalName}\\nOwner: product' },
-      }],
-    }),
-  });
-
-  return {
-    api,
-    authClient,
-    dashboard,
-    database,
-    dlqAlarm,
-    eventDlq,
-    eventQueue,
-    apiAlarm,
-    web,
-    // <ebk:composition-outputs:start>
-    // <ebk:composition-outputs:end>
-  };
-}
-`,
-        'web/next-env.d.ts': `/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-`,
-        'web/tsconfig.json': json({
-            extends: '../tsconfig.json',
-            compilerOptions: {
-                incremental: true,
-                plugins: [{ name: 'next' }],
-            },
-            include: ['next-env.d.ts', '.next/types/**/*.ts', '**/*.ts', '**/*.tsx'],
-            exclude: ['node_modules'],
-        }),
-        'web/next.config.ts': `import type { NextConfig } from 'next';
-
-const fleetOrigin = process.env.EBK_FLEET_ORIGIN?.trim();
-
-const config: NextConfig = {
-  ...(fleetOrigin ? { allowedDevOrigins: [new URL(fleetOrigin).hostname] } : {}),
-  basePath: '/${name}',
-  reactStrictMode: true,
-};
-
-export default config;
-`,
-        'web/open-next.config.ts': `const config = {
-  // OpenNext runs from this web directory. Point it at the slice package so it
-  // builds only this application instead of recursively invoking the Nx root.
-  buildCommand: 'pnpm exec next build web',
-  default: {},
-  packageJsonPath: '../package.json',
-};
-
-export default config;
-`,
-        'web/src/app/globals.css': `:root { color-scheme: light dark; font-family: system-ui, sans-serif; }
-body { margin: 0; background: #07111f; color: #edf6ff; }
-main { max-width: 64rem; margin: 0 auto; padding: 5rem 1.5rem; }
-.card { background: #102238; border: 1px solid #29425e; border-radius: 1rem; padding: 1.5rem; }
-a { color: #78d5ff; }
-input, button { box-sizing: border-box; display: block; margin-top: .75rem; padding: .75rem; width: 100%; }
-button { background: #48b7de; border: 0; color: #04111b; cursor: pointer; font-weight: 700; }
-`,
-        'web/src/app/layout.tsx': `import type { Metadata } from 'next';
-import type { ReactNode } from 'react';
-import './globals.css';
-
-export const metadata: Metadata = { title: '${pascalName}' };
-
-export default function Layout({ children }: Readonly<{ children: ReactNode }>) {
-  return <html lang="en"><body>{children}</body></html>;
-}
-`,
-        'web/src/app/page.tsx': `export default function Home() {
-  return <main>
-    <p>Empire Builder Kit Product Slice</p>
-    <h1>${pascalName}</h1>
-    <div className="card">
-      <p>The web app, Lambda API, logical Postgres database, Cognito client,
-      event buffer/DLQ, dashboard, and alarms are wired and owned here.</p>
-      <a href="/${name}/sign-in">Sign in</a>
-    </div>
-  </main>;
-}
-`,
-        'web/src/app/sign-in/page.tsx': `'use client';
-
-import { useState, type FormEvent } from 'react';
-
-export default function SignIn() {
-  const [message, setMessage] = useState('');
-  async function submit(event: FormEvent<HTMLFormElement>) {
-    event.preventDefault();
-    const data = new FormData(event.currentTarget);
-    const response = await fetch('/${name}/api/auth/sign-in', {
-      body: JSON.stringify({ email: data.get('email'), password: data.get('password') }),
-      headers: { 'content-type': 'application/json' },
-      method: 'POST',
-    });
-    setMessage(response.ok ? 'Signed in.' : 'Sign-in failed.');
-  }
-  return <main><div className="card"><h1>Sign in</h1>
-    <form onSubmit={submit}>
-      <label>Email<input name="email" type="email" autoComplete="username" required /></label>
-      <label>Password<input name="password" type="password" autoComplete="current-password" required /></label>
-      <button type="submit">Sign in</button>
-    </form><p role="status">{message}</p>
-    <a href="/${name}/password-reset">Reset password</a>
-  </div></main>;
-}
-`,
-        'web/src/app/password-reset/page.tsx': `'use client';
-
-import { useState, type FormEvent } from 'react';
-
-export default function PasswordReset() {
-  const [message, setMessage] = useState('');
-  async function submit(event: FormEvent<HTMLFormElement>) {
-    event.preventDefault();
-    const data = new FormData(event.currentTarget);
-    const response = await fetch('/${name}/api/auth/password-reset', {
-      body: JSON.stringify({ email: data.get('email') }),
-      headers: { 'content-type': 'application/json' },
-      method: 'POST',
-    });
-    setMessage(response.ok ? 'If the account exists, a reset code was sent.' : 'Request failed.');
-  }
-  return <main><div className="card"><h1>Reset password</h1>
-    <form onSubmit={submit}><label>Email<input name="email" type="email" required /></label>
-      <button type="submit">Send reset code</button></form><p role="status">{message}</p>
-  </div></main>;
-}
-`,
-        'web/src/app/api/auth/sign-in/route.ts': `import { InitiateAuthCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
-import { createSessionTokenCookiePlan } from '@empire-builder-kit/runtime/auth-session';
-import { cookies } from 'next/headers';
-import { NextResponse } from 'next/server';
-
-const cognito = new CognitoIdentityProviderClient({});
-
-export async function POST(request: Request) {
-  const body = await request.json() as { email?: string; password?: string };
-  if (!body.email || !body.password) return NextResponse.json({ ok: false }, { status: 400 });
-  const result = await cognito.send(new InitiateAuthCommand({
-    AuthFlow: 'USER_PASSWORD_AUTH',
-    ClientId: process.env.AUTH_CLIENT_ID,
-    AuthParameters: { USERNAME: body.email, PASSWORD: body.password },
-  }));
-  const auth = result.AuthenticationResult;
-  if (!auth?.AccessToken || !auth.ExpiresIn) return NextResponse.json({ ok: false }, { status: 401 });
-  const secure = process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production';
-  const store = await cookies();
-  for (const { name, value, ...options } of createSessionTokenCookiePlan({
-    accessToken: auth.AccessToken,
-    expiresAt: Math.floor(Date.now() / 1000) + auth.ExpiresIn,
-    refreshToken: auth.RefreshToken,
-  }, { namespace: '${name}', secure })) store.set(name, value, options);
-  return NextResponse.json({ ok: true });
-}
-`,
-        'web/src/app/api/auth/refresh/route.ts': `import { InitiateAuthCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
-import { createSessionTokenCookiePlan, getSessionTokenCookieNames } from '@empire-builder-kit/runtime/auth-session';
-import { cookies } from 'next/headers';
-import { NextResponse } from 'next/server';
-
-const cognito = new CognitoIdentityProviderClient({});
-
-export async function POST() {
-  const store = await cookies();
-  const secure = process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production';
-  const names = getSessionTokenCookieNames({ namespace: '${name}', secure });
-  const refreshToken = store.get(names.refresh)?.value;
-  if (!refreshToken) return NextResponse.json({ ok: false }, { status: 401 });
-  const result = await cognito.send(new InitiateAuthCommand({
-    AuthFlow: 'REFRESH_TOKEN_AUTH', ClientId: process.env.AUTH_CLIENT_ID,
-    AuthParameters: { REFRESH_TOKEN: refreshToken },
-  }));
-  const auth = result.AuthenticationResult;
-  if (!auth?.AccessToken || !auth.ExpiresIn) return NextResponse.json({ ok: false }, { status: 401 });
-  for (const { name, value, ...options } of createSessionTokenCookiePlan({
-    accessToken: auth.AccessToken,
-    expiresAt: Math.floor(Date.now() / 1000) + auth.ExpiresIn,
-    refreshToken: auth.RefreshToken ?? refreshToken,
-  }, { namespace: '${name}', secure })) store.set(name, value, options);
-  return NextResponse.json({ ok: true });
-}
-`,
-        'web/src/app/api/auth/sign-out/route.ts': `import { createSessionTokenCookieDeletionPlan } from '@empire-builder-kit/runtime/auth-session';
-import { cookies } from 'next/headers';
-import { NextResponse } from 'next/server';
-
-export async function POST() {
-  const store = await cookies();
-  const secure = process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production';
-  for (const { name, value, ...options } of createSessionTokenCookieDeletionPlan({
-    namespace: '${name}',
-    secure,
-  })) store.set(name, value, options);
-  return NextResponse.json({ ok: true });
-}
-`,
-        'web/src/app/api/auth/password-reset/route.ts': `import { ForgotPasswordCommand, CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider';
-import { NextResponse } from 'next/server';
-
-const cognito = new CognitoIdentityProviderClient({});
-export async function POST(request: Request) {
-  const body = await request.json() as { email?: string };
-  if (body.email) await cognito.send(new ForgotPasswordCommand({
-    ClientId: process.env.AUTH_CLIENT_ID, Username: body.email,
-  }));
-  return NextResponse.json({ ok: true });
-}
-`,
-        'web/src/app/api/auth/callback/route.ts': `import { NextResponse } from 'next/server';
-
-export function GET() {
-  return NextResponse.json({
-    message: 'The Standard Blueprint uses server-side Cognito password auth; OAuth Blueprints may replace this callback.',
-  });
-}
-`,
-        'web/src/app/api/protected/route.ts': `import { getSessionTokenCookieNames } from '@empire-builder-kit/runtime/auth-session';
-import { cookies } from 'next/headers';
-import { NextResponse } from 'next/server';
-
-export async function GET() {
-  const store = await cookies();
-  const names = getSessionTokenCookieNames({
-    namespace: '${name}',
-    secure: process.env.EBK_SECURE_COOKIES === 'true' || process.env.NODE_ENV === 'production',
-  });
-  const accessToken = store.get(names.access)?.value;
-  if (!accessToken) return NextResponse.json({ ok: false }, { status: 401 });
-  const response = await fetch((process.env.NEXT_PUBLIC_API_URL ?? '') + '/protected', {
-    headers: { authorization: 'Bearer ' + accessToken },
-  });
-  return new NextResponse(await response.text(), {
-    headers: { 'content-type': 'application/json' },
-    status: response.status,
-  });
-}
-`,
-        'web/src/app/page.spec.tsx': `import { renderToStaticMarkup } from 'react-dom/server';
-import { describe, expect, it } from 'vitest';
-import Home from './page.js';
-
-describe('home page', () => {
-  it('renders the Product Slice identity and sign-in path', () => {
-    const html = renderToStaticMarkup(<Home />);
-    expect(html).toContain('${pascalName}');
-    expect(html).toContain('/sign-in');
-  });
-});
-`,
-        'vitest.config.ts': `import { configDefaults, defineConfig } from 'vitest/config';
-export default defineConfig({
-  test: {
-    environment: 'node',
-    env: { EBK_STAGE: 'development' },
-    exclude: [...configDefaults.exclude, '**/dist/**', 'e2e/**'],
-  },
-});
-`,
-        'e2e/product.spec.ts': `import { expect, test } from '@playwright/test';
-
-test('renders the product and sign-in journey', async ({ page }) => {
-  await page.goto(process.env.EBK_SMOKE_URL ?? 'http://localhost:3000/${name}');
-  await expect(page.getByRole('heading', { name: '${pascalName}' })).toBeVisible();
-  await page.getByRole('link', { name: 'Sign in' }).click();
-  await expect(page.getByRole('heading', { name: 'Sign in' })).toBeVisible();
-});
-`,
-        'playwright.config.ts': `import { defineConfig } from '@playwright/test';
-export default defineConfig({
-  testDir: './e2e',
-  use: { trace: 'retain-on-failure' },
-});
-`,
-    };
-}
-function renderSliceFiles(name, scope, runtimeVersion, ownership) {
-    const pascalName = name
-        .split('-')
-        .map((segment) => segment[0]?.toUpperCase() + segment.slice(1))
-        .join('');
-    return {
-        '.ebk/ownership.json': json(ownership),
-        'README.md': `# ${name}
-
-This Product Slice is an independent business and deployment boundary generated from the
-built-in Empire Builder Kit Standard Blueprint.
-
-It consumes the Standard Foundation through its versioned capability contract. Do not import
-files from \`packages/foundation/infra\` or from another slice's internals.
-
-## Included product baseline
-
-- Next.js web application with sign-in, refresh, sign-out, callback, and password-reset paths
-- Lambda HTTP API with health and JWT-protected routes
-- stage- and slice-scoped logical Postgres database plus migration history
-- typed EventBridge publisher and SQS/DLQ-backed consumer
-- Product Slice dashboard and API/DLQ alarms routed through Foundation alerts
-- Vitest source test and Playwright deployed-smoke path
-
-Keep business contracts in \`contracts/\`. Add long-running Services and finite Jobs only when
-the product needs them.
-
-Add product dependencies with \`pnpm --filter ${scope}/${name} add <package>\`. EBK owns only
-its recorded framework keys in this package manifest, so health checks and upgrades preserve
-dependencies, scripts, and other keys added by the product team.
-
-## Local database
-
-Run \`pnpm nx run ${name}:dev --stage=development\`. The target starts Docker Postgres,
-applies local migrations, and then starts SST live mode. Set \`EBK_DEV_PORT\` to choose the
-Next.js port; it defaults to \`3000\`. The web readiness endpoint is
-\`http://127.0.0.1:<port>/${name}/api/health\`.
-
-The workspace fleet target discovers this slice through its versioned
-\`metadata.ebk.localDev\` adapter. It supplies the exact HTTPS fleet origin, secure-cookie
-signal, callback/logout URLs, and allocated internal port; do not persist a developer port in
-this project.
-
-\`database/bindings.json\` is the adopter-owned database selection contract. Add a candidate
-identifier to \`primary.provisioned\` to provision it without moving workload traffic. After the
-candidate is migrated and verified through the database-replacement runbook, change only
-\`primary.active\` to select it on the next reviewed deployment. Do not edit managed
-\`infra/product.ts\` or provision databases with Foundation master credentials.
-
-The readiness route is framework-managed for local orchestration. Put product-specific
-dependency and status checks under \`/${name}/api/status\` rather than editing that route.
-
-Run \`pnpm nx run ${name}:db-local-down\` when finished. The named volume preserves local data
-between sessions.
-
-Use \`pnpm nx run ${name}:dev --stage=<personal-name>\` for a personal live relay. The target
-maps that consumer stage to the \`development\` Foundation and reports both stages during
-preflight. It never deploys a personal Foundation. A normal full deploy at a mapped personal
-stage fails closed; use a canonical stage for \`${name}:deploy\`.
-`,
-        'contracts/index.ts': `export const ${pascalName}ContractVersion = '1.0.0' as const;
-
-// Export transport-neutral commands, events, DTOs, and clients from this package surface.
-`,
-        'docs/architecture.md': `# ${name} architecture
-
-## Boundary
-
-This slice owns its product behavior, routes, app clients, logical databases, event rules,
-queues, alarms, dashboards, and runbooks. The Foundation owns shared capacity and policy.
-
-## Dependencies
-
-- Foundation contract: \`^1\`
-- Canonical stages map to the same Foundation stage; personal/preview stages map only to
-  \`development\`
-- Other slices: contracts-only imports
-`,
-        'docs/contracts.md': `# ${name} contracts
-
-Published contracts belong in \`contracts/\`. Keep them transport-neutral and versioned.
-Record consumed slice contracts here before adding a source dependency.
-`,
-        'docs/runbooks.md': `# ${name} runbooks
-
-Document deployment smoke checks, alarms, rollback, event redrive, database migration, and
-Service or Job recovery procedures as those capabilities are added.
-`,
-        'ebk-globals.d.ts': `declare const sst: any;
-declare const aws: any;
-declare const $app: { name: string; stage: string };
-declare const $config: any;
-declare const $dev: boolean;
-declare const $interpolate: (
-  strings: TemplateStringsArray,
-  ...values: unknown[]
-) => unknown;
-declare const $util: any;
-`,
-        'infra/foundation.ts': `import {
-  foundationSsmPath,
-  productSliceRegistrationPath,
-  resolveFoundationStages,
-  type FoundationDiscovery,
-} from '@empire-builder-kit/nx/foundation';
-
-const stages = resolveFoundationStages({
-  consumerStage: $app.stage,
-  foundationStage: process.env.EBK_FOUNDATION_STAGE,
-});
-
-function foundationParameter(name: Parameters<typeof foundationSsmPath>[1]) {
-  return aws.ssm.getParameterOutput({
-    name: foundationSsmPath(stages.foundationStage, name),
-  }).value;
-}
-
-export function getFoundation(): FoundationDiscovery {
-  return {
-    alertTopicArn: foundationParameter('alertTopicArn'),
-    capabilities: foundationParameter('capabilities').apply((value: string) =>
-      value.split(',').map((capability) => capability.trim()),
-    ),
-    clusterId: foundationParameter('clusterId'),
-    contractVersion: foundationParameter('contractVersion'),
-    databaseClusterArn: foundationParameter('databaseClusterArn'),
-    databaseClusterId: foundationParameter('databaseClusterId'),
-    databaseMasterSecretArn: foundationParameter('databaseMasterSecretArn'),
-    eventBusArn: foundationParameter('eventBusArn'),
-    eventBusName: foundationParameter('eventBusName'),
-    hasPublicDomain: foundationParameter('hasPublicDomain').apply(
-      (value: string) => value === 'true',
-    ),
-    identityUserPoolArn: foundationParameter('identityUserPoolArn'),
-    identityUserPoolId: foundationParameter('identityUserPoolId'),
-    rootDomain: foundationParameter('rootDomain').apply((value: string) =>
-      value === 'none' ? undefined : value,
-    ),
-    routerDistributionId: foundationParameter('routerDistributionId'),
-    routerUrl: foundationParameter('routerUrl'),
-    schemaVersion: foundationParameter('schemaVersion').apply(Number),
-    vpcId: foundationParameter('vpcId'),
-  } as FoundationDiscovery;
-}
-
-export function getFoundationInfrastructure() {
-  const discovery = getFoundation();
-  const vpc = sst.aws.Vpc.get('FoundationVpc', discovery.vpcId);
-  const cluster = sst.aws.Cluster.get('FoundationCluster', {
-    id: discovery.clusterId,
-    vpc,
-  });
-  const router = sst.aws.Router.get(
-    'FoundationRouter',
-    discovery.routerDistributionId,
-  );
-  const userPool = sst.aws.CognitoUserPool.get(
-    'FoundationIdentity',
-    discovery.identityUserPoolId,
-  );
-  const eventBus = sst.aws.Bus.get(
-    'FoundationEventBus',
-    discovery.eventBusName,
-  );
-  const database = sst.aws.Aurora.get(
-    'FoundationDatabase',
-    discovery.databaseClusterId,
-  );
-
-  return {
-    cluster,
-    database: {
-      cluster: database,
-      clusterArn: discovery.databaseClusterArn,
-      masterSecretArn: discovery.databaseMasterSecretArn,
-    },
-    discovery,
-    eventBus,
-    router,
-    userPool,
-    vpc,
-  };
-}
-
-export function registerProductSlice() {
-  return new aws.ssm.Parameter('${pascalName}ProductSliceRegistration', {
-    name: productSliceRegistrationPath(
-      stages.foundationStage,
-      stages.consumerStage,
-      '${name}',
-    ),
-    type: 'String',
-    value: JSON.stringify({
-      consumerStage: stages.consumerStage,
-      foundationContract: '^1.0.0',
-      foundationStage: stages.foundationStage,
-      name: '${name}',
-      registrationVersion: 1,
-    }),
-  });
-}
-`,
-        'infra/index.ts': `import { getFoundation, registerProductSlice } from './foundation.js';
-import { product } from './product.js';
-
-export function app() {
-  const foundation = getFoundation();
-  const registration = registerProductSlice();
-  const resources = product();
-  return {
-    apiUrl: resources.api.url,
-    authClientId: resources.authClient.id,
-    foundationContractVersion: foundation.contractVersion,
-    name: '${name}',
-    registration: registration.name,
-    stage: $app.stage,
-    webUrl: resources.web.url,
-  };
-}
-`,
-        'package.json': json({
-            name: `${scope}/${name}`,
-            version: '0.0.0',
-            private: true,
-            dependencies: {
-                '@aws-sdk/client-cognito-identity-provider': PRODUCT_VERSIONS.awsCognito,
-                '@aws-sdk/client-eventbridge': PRODUCT_VERSIONS.awsEventBridge,
-                '@aws-sdk/client-rds-data': PRODUCT_VERSIONS.awsRdsData,
-                '@aws-sdk/client-secrets-manager': PRODUCT_VERSIONS.awsSecretsManager,
-                '@aws-sdk/client-ssm': PRODUCT_VERSIONS.awsSsm,
-                '@empire-builder-kit/runtime': runtimeVersion,
-                'drizzle-orm': PRODUCT_VERSIONS.drizzle,
-                next: PRODUCT_VERSIONS.next,
-                react: PRODUCT_VERSIONS.react,
-                'react-dom': PRODUCT_VERSIONS.reactDom,
-            },
-            devDependencies: {
-                '@playwright/test': PRODUCT_VERSIONS.playwright,
-                '@types/node': PRODUCT_VERSIONS.typesNode,
-                '@types/react': PRODUCT_VERSIONS.typesReact,
-                '@types/react-dom': PRODUCT_VERSIONS.typesReactDom,
-                'drizzle-kit': PRODUCT_VERSIONS.drizzleKit,
-                pg: PRODUCT_VERSIONS.pg,
-                vitest: PRODUCT_VERSIONS.vitest,
-            },
-            exports: {
-                './contracts': {
-                    types: './contracts/index.ts',
-                    default: './contracts/index.ts',
-                },
-            },
-        }),
-        'project.json': json({
-            name,
-            $schema: '../../node_modules/nx/schemas/project-schema.json',
-            projectType: 'application',
-            sourceRoot: `packages/${name}/infra`,
-            implicitDependencies: ['foundation'],
-            tags: [
-                `scope:${name}`,
-                'type:slice',
-                'type:sst',
-                'layer:product',
-                'visibility:internal',
-            ],
-            metadata: {
-                ebk: {
-                    localDev: (0, exports.STANDARD_LOCAL_DEV_ADAPTER)(name),
-                },
-            },
-            targets: {
-                build: {
-                    executor: 'nx:run-commands',
-                    dependsOn: ['typecheck'],
-                    options: {
-                        command: 'next build web',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-check': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node scripts/check-database.mjs',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-generate': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'drizzle-kit generate --config=database/drizzle.config.ts',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-migrate': {
-                    executor: 'nx:run-commands',
-                    dependsOn: [{ target: 'deploy-infrastructure', params: 'forward' }],
-                    options: {
-                        command: 'node scripts/migrate-database.mjs',
-                        cwd: `packages/${name}`,
-                        forwardAllArgs: true,
-                    },
-                },
-                'db-local-down': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node scripts/local-database.mjs down',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-local-migrate': {
-                    executor: 'nx:run-commands',
-                    dependsOn: ['db-local-up'],
-                    options: {
-                        command: 'drizzle-kit migrate --config=database/drizzle.config.ts',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-local-up': {
-                    executor: 'nx:run-commands',
-                    dependsOn: ['db-check'],
-                    options: {
-                        command: 'node scripts/local-database.mjs up',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                deploy: {
-                    executor: 'nx:run-commands',
-                    dependsOn: [{ target: 'db-migrate', params: 'forward' }],
-                    options: {
-                        command: 'node scripts/confirm-deploy.mjs',
-                        cwd: `packages/${name}`,
-                        forwardAllArgs: true,
-                    },
-                },
-                'deploy-infrastructure': {
-                    executor: '@empire-builder-kit/nx:deploy',
-                    dependsOn: [
-                        'verify',
-                        { target: 'foundation-ready', params: 'forward' },
-                    ],
-                    options: {
-                        cwd: `packages/${name}`,
-                        stage: 'development',
-                        stageMode: 'consumer',
-                    },
-                },
-                dev: {
-                    executor: '@empire-builder-kit/nx:dev',
-                    dependsOn: [
-                        'dev-prerequisite',
-                        'db-local-migrate',
-                        { target: 'foundation-preflight', params: 'forward' },
-                    ],
-                    options: {
-                        cwd: `packages/${name}`,
-                        stage: 'development',
-                        stageMode: 'consumer',
-                    },
-                },
-                'dev-prerequisite': {
-                    executor: 'nx:run-commands',
-                    dependsOn: ['db-check', 'typecheck'],
-                    options: {
-                        command: 'node scripts/verify-live-mode.mjs',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                lint: {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'eslint .',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'foundation-preflight': {
-                    executor: '@empire-builder-kit/nx:foundation-preflight',
-                    options: {
-                        capabilities: [...ownership.foundation.capabilities],
-                        contract: ownership.foundation.contract,
-                        stage: 'development',
-                    },
-                },
-                'foundation-ready': {
-                    executor: '@empire-builder-kit/nx:foundation-preflight',
-                    dependsOn: [
-                        { projects: ['foundation'], target: 'verify', params: 'ignore' },
-                    ],
-                    options: {
-                        capabilities: [...ownership.foundation.capabilities],
-                        contract: ownership.foundation.contract,
-                        deployIfMissing: true,
-                        foundationProject: 'foundation',
-                        stage: 'development',
-                    },
-                },
-                refresh: {
-                    executor: '@empire-builder-kit/nx:refresh',
-                    options: {
-                        cwd: `packages/${name}`,
-                        stage: 'development',
-                        stageMode: 'consumer',
-                    },
-                },
-                remove: {
-                    executor: '@empire-builder-kit/nx:remove',
-                    options: {
-                        cwd: `packages/${name}`,
-                        stage: 'development',
-                        stageMode: 'consumer',
-                    },
-                },
-                'smoke-deployed': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'playwright install chromium && playwright test',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'smoke-deployed-check': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'playwright test --list',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                test: {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'vitest run',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                typecheck: {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'tsc --noEmit -p tsconfig.json',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                unlock: {
-                    executor: '@empire-builder-kit/nx:unlock',
-                    options: {
-                        cwd: `packages/${name}`,
-                        stage: 'development',
-                        stageMode: 'consumer',
-                    },
-                },
-                verify: {
-                    executor: 'nx:run-commands',
-                    dependsOn: [
-                        'build',
-                        'db-check',
-                        'lint',
-                        'smoke-deployed-check',
-                        'test',
-                        'typecheck',
-                    ],
-                    options: {
-                        command: 'node scripts/verify-slice.mjs',
-                        cwd: `packages/${name}`,
-                    },
-                },
-            },
-        }),
-        'scripts/verify-slice.mjs': `import { readFileSync } from 'node:fs';
-
-const ownership = JSON.parse(
-  readFileSync(new URL('../.ebk/ownership.json', import.meta.url), 'utf8'),
-);
-if (ownership.schemaVersion !== ${index_js_3.GENERATED_OWNERSHIP_SCHEMA_VERSION} || ownership.slice !== '${name}') {
-  throw new Error('Slice ownership metadata is missing or incompatible.');
-}
-if (!ownership.foundation.capabilities.includes('deployment')) {
-  throw new Error('Slice does not declare the Foundation deployment capability.');
-}
-process.stdout.write('${name} slice source contract verified.\\n');
-`,
-        'scripts/verify-live-mode.mjs': `const origin = process.env.EBK_FLEET_ORIGIN?.trim();
-if (origin) {
-  const parsed = new URL(origin);
-  const supportedHostname = parsed.hostname.endsWith('.ebk.localhost') || parsed.hostname.endsWith('.test');
-  if (parsed.protocol !== 'https:' || parsed.origin !== origin || !supportedHostname) {
-    throw new Error('EBK_FLEET_ORIGIN must be an exact HTTPS *.ebk.localhost or adopter-managed *.test origin.');
-  }
-  if (process.env.EBK_SECURE_COOKIES !== 'true') {
-    throw new Error('Fleet development requires EBK_SECURE_COOKIES=true.');
-  }
-}
-process.stdout.write('${name} live-mode prerequisites verified.\\n');
-`,
-        'scripts/check-database.mjs': `import { existsSync, readFileSync } from 'node:fs';
-import { createDatabaseBindingPlan } from '@empire-builder-kit/nx/foundation';
-import databaseBindings from '../database/bindings.json' with { type: 'json' };
-
-const migration = new URL('../database/migrations/0000_initial.sql', import.meta.url);
-if (!existsSync(migration) || !readFileSync(migration, 'utf8').includes('CREATE TABLE')) {
-  throw new Error('The initial database migration is missing or invalid.');
-}
-const plan = createDatabaseBindingPlan(databaseBindings, {
-  slice: '${name}',
-  stage: process.env.EBK_STAGE ?? 'development',
-});
-if (!plan.active.primary) throw new Error('Database binding "primary" is required.');
-process.stdout.write('${name} database history verified.\\n');
-`,
-        'scripts/local-database.mjs': `import { spawnSync } from 'node:child_process';
-import { createDatabaseBindingPlan, resolveLocalDatabaseContract } from '@empire-builder-kit/nx/foundation';
-import databaseBindings from '../database/bindings.json' with { type: 'json' };
-
-const action = process.argv[2];
-if (action !== 'up' && action !== 'down') {
-  throw new Error('Usage: node scripts/local-database.mjs <up|down>');
-}
-const plan = createDatabaseBindingPlan(databaseBindings, {
-  slice: '${name}',
-  stage: 'development',
-});
-const activeDatabase = plan.active.primary;
-if (!activeDatabase) throw new Error('Database binding "primary" is required.');
-const local = resolveLocalDatabaseContract({
-  database: activeDatabase,
-  slice: '${name}',
-});
-const project = process.env.COMPOSE_PROJECT_NAME ?? ('ebk-${name}-' + activeDatabase)
-  .replace(/[^a-z0-9_-]/g, '_')
-  .toLowerCase();
-const args = ['compose', '--project-name', project, '-f', 'database/docker-compose.yml'];
-args.push(...(action === 'up' ? ['up', '-d', '--wait'] : ['down']));
-const result = spawnSync('docker', args, {
-  env: {
-    ...process.env,
-    EBK_LOCAL_DATABASE: local.database,
-    EBK_LOCAL_DATABASE_PASSWORD: local.password,
-    EBK_LOCAL_DATABASE_PORT: String(local.port),
-    EBK_LOCAL_DATABASE_USERNAME: local.username,
-  },
-  stdio: 'inherit',
-});
-if (result.error) throw result.error;
-if (result.status !== 0) process.exit(result.status ?? 1);
-`,
-        'scripts/confirm-deploy.mjs': `const stageArg = process.argv.find((value) => value.startsWith('--stage='));
-const stage = stageArg?.slice('--stage='.length) ?? 'development';
-process.stdout.write('${name} infrastructure and database migrations completed for ' + stage + '.\\n');
-`,
-        'scripts/migrate-database.mjs': `import { createHash } from 'node:crypto';
-import { readdir, readFile } from 'node:fs/promises';
-import { createDatabaseBindingPlan, resolveFoundationStages } from '@empire-builder-kit/nx/foundation';
-import {
-  BeginTransactionCommand,
-  CommitTransactionCommand,
-  ExecuteStatementCommand,
-  RDSDataClient,
-  RollbackTransactionCommand,
-} from '@aws-sdk/client-rds-data';
-import { DescribeSecretCommand, SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
-import { GetParameterCommand, SSMClient } from '@aws-sdk/client-ssm';
-import databaseBindings from '../database/bindings.json' with { type: 'json' };
-
-const stageArg = process.argv.find((value) => value.startsWith('--stage='));
-const foundationStageArg = process.argv.find((value) => value.startsWith('--foundationStage='));
-const { consumerStage: stage, foundationStage } = resolveFoundationStages({
-  consumerStage: stageArg?.slice('--stage='.length) ?? 'development',
-  foundationStage: foundationStageArg?.slice('--foundationStage='.length) ?? process.env.EBK_FOUNDATION_STAGE,
-});
-const bindingPlan = createDatabaseBindingPlan(databaseBindings, {
-  slice: '${name}',
-  stage,
-});
-const activeDatabase = bindingPlan.active.primary;
-if (!activeDatabase) throw new Error('Database binding "primary" is required.');
-const database = bindingPlan.identifiers[activeDatabase].database;
-const clusterParameter = '/ebk/' + foundationStage + '/foundation/databaseClusterArn';
-const clusterResponse = await new SSMClient({}).send(
-  new GetParameterCommand({ Name: clusterParameter }),
-);
-const resourceArn = clusterResponse.Parameter?.Value;
-if (!resourceArn) throw new Error('Foundation database cluster ARN is missing at ' + clusterParameter + '.');
-const secretId = 'ebk/' + stage + '/${name}/database/' + activeDatabase + '/readwrite';
-const secretResponse = await new SecretsManagerClient({}).send(
-  new DescribeSecretCommand({ SecretId: secretId }),
-);
-const secretArn = secretResponse.ARN;
-if (!secretArn) throw new Error('Logical database secret ARN is missing for ' + secretId + '.');
-
-const client = new RDSDataClient({});
-const resumeRetryDelaysMs = [1_000, 2_000, 4_000, 8_000, 16_000];
-const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
-const send = async (command) => {
-  for (let attempt = 0; ; attempt += 1) {
-    try {
-      return await client.send(command);
-    } catch (error) {
-      const resumable = error && typeof error === 'object' && error.name === 'DatabaseResumingException';
-      if (!resumable || attempt >= resumeRetryDelaysMs.length) throw error;
-      await sleep(resumeRetryDelaysMs[attempt]);
-    }
-  }
-};
-const execute = (sql, parameters = [], transactionId) => send(
-  new ExecuteStatementCommand({
-    database,
-    parameters,
-    resourceArn,
-    secretArn,
-    sql,
-    transactionId,
-  }),
-);
-
-await execute('CREATE TABLE IF NOT EXISTS _ebk_migrations (name text PRIMARY KEY, checksum text NOT NULL, applied_at timestamptz NOT NULL DEFAULT now())');
-const directory = new URL('../database/migrations/', import.meta.url);
-const files = (await readdir(directory)).filter((file) => file.endsWith('.sql')).sort();
-for (const name of files) {
-  const sql = await readFile(new URL(name, directory), 'utf8');
-  const checksum = createHash('sha256').update(sql).digest('hex');
-  const existing = await execute(
-    'SELECT checksum FROM _ebk_migrations WHERE name = :name',
-    [{ name: 'name', value: { stringValue: name } }],
-  );
-  const appliedChecksum = existing.records?.[0]?.[0]?.stringValue;
-  if (appliedChecksum === checksum) continue;
-  if (appliedChecksum) throw new Error('Applied migration changed: ' + name);
-
-  const transaction = await send(new BeginTransactionCommand({
-    database,
-    resourceArn,
-    secretArn,
-  }));
-  if (!transaction.transactionId) throw new Error('Data API did not return a transaction id.');
-  try {
-    const statements = sql.split(/^--> statement-breakpoint\\s*$/m).map((value) => value.trim()).filter(Boolean);
-    for (const statement of statements) await execute(statement, [], transaction.transactionId);
-    await execute(
-      'INSERT INTO _ebk_migrations (name, checksum) VALUES (:name, :checksum)',
-      [
-        { name: 'name', value: { stringValue: name } },
-        { name: 'checksum', value: { stringValue: checksum } },
-      ],
-      transaction.transactionId,
-    );
-    await send(new CommitTransactionCommand({
-      resourceArn,
-      secretArn,
-      transactionId: transaction.transactionId,
-    }));
-  } catch (error) {
-    await send(new RollbackTransactionCommand({
-      resourceArn,
-      secretArn,
-      transactionId: transaction.transactionId,
-    }));
-    throw error;
-  }
-}
-process.stdout.write('${name} database migrations completed for ' + stage + '.\\n');
-`,
-        'sst-env.d.ts': `// Bootstrap placeholder. SST overwrites this file after install, dev, or deploy.
-export {};
-`,
-        'sst.config.ts': `export default $config({
-  app(input: { stage?: string } | undefined) {
-    const production = input?.stage === 'production';
-    return {
-      name: '${name}',
-      removal: production ? 'retain' : 'remove',
-      protect: production,
-      home: 'aws',
-      providers: {
-        aws: { region: process.env.AWS_REGION ?? 'us-east-1' },
-      },
-    };
-  },
-  async run() {
-    const { app } = await import('./infra/index.js');
-    return app();
-  },
-});
-`,
-        'tsconfig.json': json({
-            extends: '../../tsconfig.base.json',
-            compilerOptions: {
-                allowJs: true,
-                esModuleInterop: true,
-                jsx: 'react-jsx',
-                lib: ['dom', 'dom.iterable', 'es2022'],
-                plugins: [{ name: 'next' }],
-                resolveJsonModule: true,
-                types: ['node'],
-            },
-            include: [
-                'contracts/**/*.ts',
-                'database/**/*.ts',
-                'api/**/*.ts',
-                'infra/**/*.ts',
-                'jobs/**/*.ts',
-                'services/**/*.ts',
-                'web/**/*.ts',
-                'web/**/*.tsx',
-                'vitest.config.ts',
-                'sst.config.ts',
-                'sst-env.d.ts',
-                'ebk-globals.d.ts',
-            ],
-            exclude: ['.sst', 'dist', 'node_modules'],
-        }),
-        ...renderStandardProductFiles(name, pascalName),
-    };
-}
-function classifyPaths(files) {
-    const seededPaths = new Set([
-        'README.md',
-        'database/bindings.json',
-        'database/schema.ts',
-        'web/src/app/globals.css',
-        'web/src/app/layout.tsx',
-        'web/src/app/page.spec.tsx',
-        'web/src/app/page.tsx',
-        'web/src/app/password-reset/page.tsx',
-        'web/src/app/api/protected/route.ts',
-        'web/src/app/sign-in/page.tsx',
-    ]);
-    const seededPrefixes = [
-        'api/',
-        'contracts/',
-        'database/migrations/',
-        'docs/',
-        'e2e/',
-    ];
-    const toolOwnedPaths = new Set(['sst-env.d.ts', 'web/next-env.d.ts']);
-    return Object.entries(files)
-        .filter(([path]) => path !== '.ebk/ownership.json' && !toolOwnedPaths.has(path))
-        .map(([path, contents]) => {
-        const mode = seededPaths.has(path) ||
-            seededPrefixes.some((prefix) => path.startsWith(prefix))
-            ? 'seeded'
-            : 'managed';
-        const managedJsonPointers = path === 'package.json'
-            ? [...exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS]
-            : undefined;
-        if (managedJsonPointers) {
-            (0, index_js_3.assertManagedJsonPointersExist)(contents, managedJsonPointers, `Built-in Standard Blueprint ${path}`);
-        }
-        return {
-            ...(managedJsonPointers ? { managedJsonPointers } : {}),
-            mode,
-            origin: 'blueprint',
-            path,
-            sha256: (0, index_js_3.hashOwnedContent)(contents, { managedJsonPointers }),
-        };
-    })
-        .sort((left, right) => left.path.localeCompare(right.path));
-}
-function createBuiltInSlicePlan(name, scope, runtimeVersion, manifest, inputs) {
-    const provisionalOwnership = {
-        blueprint: { name: manifest.name, version: manifest.version },
-        contracts: { consumes: [], publishes: [`${scope}/${name}/contracts`] },
-        foundation: manifest.foundation,
-        inputs,
-        paths: [],
-        projects: [name],
-        schemaVersion: index_js_3.GENERATED_OWNERSHIP_SCHEMA_VERSION,
-        slice: name,
-        verification: manifest.verification,
-    };
-    const provisionalFiles = renderSliceFiles(name, scope, runtimeVersion, provisionalOwnership);
-    const ownership = {
-        ...provisionalOwnership,
-        paths: classifyPaths(provisionalFiles),
-    };
-    return {
-        files: renderSliceFiles(name, scope, runtimeVersion, ownership),
-        ownership,
-    };
-}
 async function sliceGenerator(tree, options) {
     const name = requireSliceName(options.name);
     const root = node_path_1.posix.join('packages', name);
+    const blueprintReference = options.blueprint ?? 'standard';
+    const parsedInputs = parseBlueprintInputs(options.inputs);
+    const installOperation = {
+        generator: 'slice',
+        id: `generator:slice:${name}`,
+        key: `slice-${name}`,
+        request: {
+            blueprint: blueprintReference,
+            inputs: parsedInputs,
+            name,
+            skipFormat: options.skipFormat ?? false,
+        },
+        resumeArguments: [
+            'pnpm',
+            'nx',
+            'generate',
+            '@empire-builder-kit/nx:slice',
+            `--name=${name}`,
+            `--blueprint=${blueprintReference}`,
+            `--inputs=${JSON.stringify(parsedInputs)}`,
+            `--skipFormat=${String(options.skipFormat ?? false)}`,
+            '--skipInstall=false',
+            '--interactive=false',
+        ],
+        sourceRoot: root,
+    };
+    const pendingInstall = (0, post_generation_install_js_1.resumePendingPostGenerationInstall)(tree, installOperation, options.skipInstall);
+    if (pendingInstall)
+        return pendingInstall;
     if (tree.exists(root)) {
         throw new Error(`Product Slice ${name} already exists at ${root}.`);
     }
     const packageJson = readJson(tree, 'package.json', 'Workspace package.json');
     const blueprint = (0, index_js_1.resolveBlueprint)({
+        localAuthoringPackages: packageJson.ebk?.blueprints?.localAuthoringPackages ?? [],
         localPackages: packageJson.ebk?.blueprints?.localPackages,
         reference: options.blueprint,
-        trust: {
-            packages: packageJson.ebk?.blueprints?.trustedPackages ?? [],
-        },
         workspaceRoot: tree.root,
     });
-    const inputResult = (0, index_js_1.validateBlueprintInputs)(blueprint.inputSchema, parseBlueprintInputs(options.inputs));
+    const inputResult = (0, index_js_1.validateBlueprintInputs)(blueprint.inputSchema, parsedInputs);
     if (!inputResult.valid) {
         throw new Error(`Blueprint inputs are invalid:\n${inputResult.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -1601,11 +219,38 @@ async function sliceGenerator(tree, options) {
             .map((issue) => `- ${issue.path}: ${issue.message}`)
             .join('\n')}`);
     }
+    const installScope = {
+        exactPaths: ['package.json'],
+        requiredPaths: [node_path_1.posix.join(root, '.ebk/ownership.json')],
+        roots: [root],
+    };
+    const installState = options.skipInstall
+        ? undefined
+        : (0, post_generation_install_js_1.capturePostGenerationInstallState)(tree, installScope, installOperation);
     const scope = workspaceScope(packageJson);
     if (blueprint.source !== 'built-in') {
+        const nxVersion = packageJson.devDependencies?.['@empire-builder-kit/nx'];
+        const runtimeVersion = packageJson.dependencies?.['@empire-builder-kit/runtime'];
+        if (!nxVersion || !runtimeVersion) {
+            throw new Error('External Blueprint generation requires exact Nx and Runtime framework dependencies.');
+        }
         if (!blueprint.generatorPath) {
             throw new Error('Resolved external Blueprint has no generator entry point.');
         }
+        if (!blueprint.packageRoot) {
+            throw new Error('Resolved external Blueprint has no package root.');
+        }
+        if (blueprint.source === 'installed' &&
+            (!blueprint.registryIntegrity || !blueprint.lockfileDigest)) {
+            throw new Error('Resolved installed Blueprint has no lockfile and registry-integrity authority.');
+        }
+        const executionSource = blueprint.source === 'installed'
+            ? {
+                lockfileDigest: blueprint.lockfileDigest,
+                registryIntegrity: blueprint.registryIntegrity,
+                source: 'installed',
+            }
+            : { source: 'local' };
         const generated = await (0, index_js_1.executeBlueprintGenerator)(blueprint.generatorPath, {
             foundation: compatibility.value,
             inputs: inputResult.value,
@@ -1613,9 +258,22 @@ async function sliceGenerator(tree, options) {
             name,
             root,
             workspace: {
+                framework: { nx: nxVersion, runtime: runtimeVersion },
                 name: packageJson.name ?? '',
                 scope,
             },
+        }, {
+            packageRoot: blueprint.packageRoot,
+            ...executionSource,
+            workspaceRoot: tree.root,
+        });
+        (0, index_js_1.assertBlueprintDestinationPaths)(tree.root, root, generated.files.map(({ path }) => path));
+        assertExternalBlueprintVerificationProgram({
+            files: generated.files,
+            name,
+            projects: generated.projects,
+            root,
+            verification: blueprint.manifest.verification,
         });
         const ownershipPaths = generated.files.map(({ contents, managedJsonPointers, mode, path }) => ({
             ...(managedJsonPointers ? { managedJsonPointers } : {}),
@@ -1624,12 +282,13 @@ async function sliceGenerator(tree, options) {
             path,
             sha256: (0, index_js_3.hashOwnedContent)(contents, { managedJsonPointers }),
         }));
-        ownershipPaths.sort((left, right) => left.path.localeCompare(right.path));
+        ownershipPaths.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path));
         const ownership = {
             blueprint: {
                 name: blueprint.manifest.name,
                 version: blueprint.manifest.version,
             },
+            compositions: [],
             contracts: generated.contracts,
             foundation: blueprint.manifest.foundation,
             inputs: inputResult.value,
@@ -1664,15 +323,18 @@ async function sliceGenerator(tree, options) {
             await (0, devkit_1.formatFiles)(tree);
         }
         reportSlicePolicyPosture(tree, name);
-        return options.skipInstall
-            ? undefined
-            : () => (0, devkit_1.installPackagesTask)(tree, true);
+        if (options.skipInstall)
+            return undefined;
+        if (!installState) {
+            throw new Error('Post-generation install state was not prepared.');
+        }
+        return (0, post_generation_install_js_1.createPostGenerationInstallCallback)(tree, installState, installScope, installOperation);
     }
     const runtimeVersion = packageJson.dependencies?.['@empire-builder-kit/runtime'];
     if (!runtimeVersion) {
         throw new Error('Workspace package.json must depend on @empire-builder-kit/runtime before generating a Product Slice.');
     }
-    const plan = createBuiltInSlicePlan(name, scope, runtimeVersion, blueprint.manifest, inputResult.value);
+    const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value, dataPolicyReviewSeed(tree, root));
     const ownershipValidation = (0, index_js_3.validateGeneratedOwnershipRecord)(plan.ownership);
     if (!ownershipValidation.valid) {
         throw new Error(`Generated ownership metadata is invalid:\n${ownershipValidation.issues
@@ -1682,17 +344,30 @@ async function sliceGenerator(tree, options) {
     for (const [relativePath, contents] of Object.entries(plan.files)) {
         tree.write(node_path_1.posix.join(root, relativePath), contents);
     }
+    const restoreFormatSensitiveFiles = () => {
+        for (const [relativePath, contents] of Object.entries(plan.files)) {
+            if (relativePath.startsWith('database/migrations/') ||
+                FORMAT_SENSITIVE_BUILT_IN_PATHS.has(relativePath)) {
+                tree.write(node_path_1.posix.join(root, relativePath), contents);
+            }
+        }
+    };
     if (!options.skipFormat) {
         await (0, devkit_1.formatFiles)(tree);
+        restoreFormatSensitiveFiles();
     }
     (0, index_js_3.restampProductSliceOwnership)(tree, name);
     if (!options.skipFormat) {
         await (0, devkit_1.formatFiles)(tree);
+        restoreFormatSensitiveFiles();
     }
     reportSlicePolicyPosture(tree, name);
-    return options.skipInstall
-        ? undefined
-        : () => (0, devkit_1.installPackagesTask)(tree, true);
+    if (options.skipInstall)
+        return undefined;
+    if (!installState) {
+        throw new Error('Post-generation install state was not prepared.');
+    }
+    return (0, post_generation_install_js_1.createPostGenerationInstallCallback)(tree, installState, installScope, installOperation);
 }
 exports.default = sliceGenerator;
 //# sourceMappingURL=slice.js.map