@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/workload/workload.js

@@ -1,11 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = void 0;
+exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = exports.WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = void 0;
 exports.createWorkloadFilePlan = createWorkloadFilePlan;
 exports.workloadGenerator = workloadGenerator;
+const deterministic_order_js_1 = require("../../deterministic-order.js");
 const devkit_1 = require("@nx/devkit");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../ownership/index.js");
+const feature_registry_js_1 = require("../feature-registry.js");
+const logging_registry_js_1 = require("../logging-registry.js");
+const post_generation_install_js_1 = require("../post-generation-install.js");
+const tool_versions_js_1 = require("../preset/tool-versions.js");
+const built_in_plan_shared_js_1 = require("../slice/built-in-plan-shared.js");
+const frozen_container_js_1 = require("./frozen-container.js");
+const performance_registration_js_1 = require("./performance-registration.js");
+const reliability_registration_js_1 = require("./reliability-registration.js");
+const service_performance_files_js_1 = require("./service-performance-files.js");
+const RELEASE_REGISTRY_PATH = 'operations/release.json';
 function name(value, label) {
     const normalized = value.trim();
     if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(normalized)) {
@@ -26,9 +37,77 @@ function replaceMarker(tree, path, marker, line) {
     }
     tree.write(path, source.replace(marker, `${line}\n${marker}`));
 }
+function requireCompositionMarker(tree, path, marker) {
+    const source = tree.read(path, 'utf8');
+    if (source === null || !source.includes(marker)) {
+        throw new Error(`Product Slice composition marker ${marker} is missing from ${path}.`);
+    }
+}
 function json(value) {
     return `${JSON.stringify(value, null, 2)}\n`;
 }
+function registerReleaseArtifact(tree, sliceRoot, slice, workload, kind) {
+    const path = node_path_1.posix.join(sliceRoot, RELEASE_REGISTRY_PATH);
+    const source = tree.read(path, 'utf8');
+    if (source === null) {
+        throw new Error(`Product Slice release registry is missing from ${path}.`);
+    }
+    let release;
+    try {
+        release = JSON.parse(source);
+    }
+    catch {
+        throw new Error(`Product Slice release registry is invalid at ${path}.`);
+    }
+    if (release.schemaVersion !== 1 ||
+        !Array.isArray(release.artifactInventory)) {
+        throw new Error(`Product Slice release registry lacks a v1 artifact inventory at ${path}.`);
+    }
+    const id = `${slice}.${kind}.${workload}`;
+    const name = `${slice}-${kind}-${workload}`;
+    if (release.artifactInventory.some((entry) => entry.id === id || entry.name === name)) {
+        throw new Error(`Release artifact ${id} is already registered.`);
+    }
+    release.artifactInventory.push({
+        candidate: {
+            materialPaths: [
+                `packages/${slice}/${kind === 'service' ? 'services' : 'jobs'}/${workload}/dist`,
+            ],
+            recipePaths: [
+                'pnpm-lock.yaml',
+                `packages/${slice}/${kind === 'service' ? 'services' : 'jobs'}/${workload}/Dockerfile`,
+                `packages/${slice}/${kind === 'service' ? 'services' : 'jobs'}/${workload}/package.json`,
+                `packages/${slice}/sst.config.ts`,
+            ],
+            sourceInputPaths: [
+                `packages/${slice}/${kind === 'service' ? 'services' : 'jobs'}/${workload}/src`,
+                `packages/${slice}/${kind === 'service' ? 'services' : 'jobs'}/${workload}/tsconfig.json`,
+            ],
+        },
+        classification: 'stage-neutral',
+        finalArtifact: {
+            container: {
+                context: '.',
+                dockerfile: `packages/${slice}/${kind === 'service' ? 'services' : 'jobs'}/${workload}/Dockerfile`,
+                nativeLifecycleProof: kind === 'service' ? 'service-default-health' : 'job-default-success',
+                proofEntrypoints: [kind === 'service' ? 'dist/main.js' : 'dist/run.js'],
+                proofImports: [
+                    '@aws-sdk/client-appconfigdata',
+                    '@empire-builder-kit/runtime/logging',
+                ],
+                role: kind,
+            },
+            family: 'oci-image',
+            imageConsumption: 'digest-qualified',
+            support: 'supported',
+        },
+        id,
+        name,
+        workload: kind,
+    });
+    release.artifactInventory.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(String(left.id), String(right.id)));
+    tree.write(path, json(release));
+}
 exports.WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = [
     '/name',
     '/private',
@@ -41,11 +120,18 @@ exports.WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = [
     '/scripts/test',
     '/scripts/typecheck',
     '/scripts/verify',
+    '/dependencies/@empire-builder-kit~1runtime',
+    '/dependencies/@aws-sdk~1client-appconfigdata',
     '/devDependencies/@types~1node',
     '/devDependencies/typescript',
     '/devDependencies/vitest',
 ];
-function createWorkloadFilePlan(slice, workload, kind) {
+exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = [
+    ...exports.WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS,
+    '/dependencies/@aws-sdk~1client-dynamodb',
+    '/dependencies/sst',
+];
+function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, ownsProtectedLoadAdapter) {
     const plural = kind === 'service' ? 'services' : 'jobs';
     const relativeRoot = node_path_1.posix.join(plural, workload);
     const className = `${pascal(slice)}${pascal(workload)}${pascal(kind)}`;
@@ -53,25 +139,42 @@ function createWorkloadFilePlan(slice, workload, kind) {
     const resource = kind === 'service' ? 'Service' : 'Task';
     const entry = kind === 'service' ? 'dist/main.js' : 'dist/run.js';
     const sourceName = kind === 'service' ? 'main.ts' : 'run.ts';
+    const packageName = `@${slice}/${kind}-${workload}`;
     const files = {
+        ...(kind === 'service'
+            ? {
+                [`${relativeRoot}/src/service-runtime.ts`]: 'export const DEFAULT_SERVICE_PORT = 3000 as const;\n',
+            }
+            : {}),
         [`${relativeRoot}/package.json`]: json({
-            name: `@${slice}/${kind}-${workload}`,
+            name: packageName,
             private: true,
             type: 'module',
             version: '0.0.0',
             scripts: {
                 build: 'tsc -p tsconfig.json',
-                'docker-build': `docker build -t ${slice}-${kind}-${workload}:local .`,
+                'docker-build': `docker build -f packages/${slice}/${relativeRoot}/Dockerfile ` +
+                    `-t ${slice}-${kind}-${workload}:local ../../../..`,
                 dev: `node --experimental-strip-types ${kind === 'service' ? 'src/main.ts' : 'src/run.ts'}`,
                 lint: 'eslint .',
                 test: 'vitest run',
                 typecheck: 'tsc --noEmit -p tsconfig.json',
                 verify: 'pnpm run lint && pnpm run typecheck && pnpm test && pnpm run build',
             },
+            dependencies: {
+                '@aws-sdk/client-appconfigdata': built_in_plan_shared_js_1.PRODUCT_VERSIONS.awsAppConfigData,
+                ...(kind === 'service' && ownsProtectedLoadAdapter
+                    ? {
+                        '@aws-sdk/client-dynamodb': built_in_plan_shared_js_1.PRODUCT_VERSIONS.awsDynamoDb,
+                        sst: tool_versions_js_1.WORKSPACE_SST_VERSION,
+                    }
+                    : {}),
+                '@empire-builder-kit/runtime': runtimeVersion,
+            },
             devDependencies: {
                 '@types/node': '25.5.0',
                 typescript: '~5.9.2',
-                vitest: '4.1.4',
+                vitest: tool_versions_js_1.WORKSPACE_VITEST_VERSION,
             },
         }),
         [`${relativeRoot}/tsconfig.json`]: json({
@@ -89,29 +192,817 @@ function createWorkloadFilePlan(slice, workload, kind) {
             include: ['src/**/*.ts'],
         }),
         [`${relativeRoot}/vitest.config.ts`]: `import { configDefaults, defineConfig } from 'vitest/config';\n\nexport default defineConfig({\n  test: {\n    environment: 'node',\n    exclude: [...configDefaults.exclude, '**/dist/**'],\n  },\n});\n`,
-        [`${relativeRoot}/Dockerfile`]: `FROM node:22-alpine AS build\nWORKDIR /app\nCOPY package.json tsconfig.json ./\nCOPY src ./src\nRUN npm install && npm run build && npm prune --omit=dev\n\nFROM node:22-alpine\nWORKDIR /app\nCOPY --from=build /app/package.json ./package.json\nCOPY --from=build /app/node_modules ./node_modules\nCOPY --from=build /app/dist ./dist\nUSER node\nCMD ["node", "${entry}"]\n`,
+        [`${relativeRoot}/Dockerfile`]: (0, frozen_container_js_1.renderFrozenWorkloadDockerfile)({
+            entry,
+            packageName,
+            workspacePath: `packages/${slice}/${relativeRoot}`,
+        }),
         [`${relativeRoot}/README.md`]: `# ${workload} ${kind}\n\nOwned by the ${slice} Product Slice. Run build, test, typecheck, verify, dev, and docker-build through this package's inferred Nx targets. Add runtime dependencies with \`pnpm --filter @${slice}/${kind}-${workload} add <package>\`; EBK upgrades preserve adopter-owned manifest keys and the production image retains installed runtime dependencies. Document ${kind === 'service' ? 'health, scaling, and rollback' : 'invocation, retry, idempotency, and failure recovery'} before production use.\n`,
         [`${relativeRoot}/src/${sourceName}`]: kind === 'service'
-            ? `import { createServer } from 'node:http';\n\nexport function healthResponse(path: string | undefined) {\n  const healthy = path === '/health';\n  return { body: { service: '${workload}', status: healthy ? 'ok' : 'not_found' }, status: healthy ? 200 : 404 };\n}\n\nexport function start() {\n  const port = Number(process.env.PORT ?? 3000);\n  return createServer((request, response) => {\n    const result = healthResponse(request.url);\n    response.writeHead(result.status, { 'content-type': 'application/json' });\n    response.end(JSON.stringify(result.body));\n  }).listen(port);\n}\n\nif (import.meta.url === new URL(process.argv[1] ?? '', 'file:').href) start();\n`
-            : `export async function run() {\n  console.info(JSON.stringify({ job: '${workload}', status: 'started', trigger: process.env.JOB_TRIGGER ?? 'manual' }));\n  return { ok: true };\n}\n\nif (import.meta.url === new URL(process.argv[1] ?? '', 'file:').href) {\n  await run();\n}\n`,
+            ? `import { createLogger, type Logger } from '@empire-builder-kit/runtime/logging';\nimport { createServer } from 'node:http';\nimport { hostProviderDeliveryAssignment } from './provider-delivery.js';\n\nexport function healthResponse(path: string | undefined) {\n  const healthy = path === '/health';\n  return { body: { service: '${workload}', status: healthy ? 'ok' : 'not_found' }, status: healthy ? 200 : 404 };\n}\n\nfunction serviceLogger(): Logger {\n  return createLogger({\n    component: 'service-${workload}',\n    feature: '${feature}',\n    operation: 'serve',\n    slice: '${slice}',\n    stage: process.env.EBK_STAGE ?? 'development',\n    workspace: '${workspace}',\n  });\n}\n\nexport async function start(logger = serviceLogger()) {\n  const port = Number(process.env.PORT ?? 3000);\n  const assignment = await hostProviderDeliveryAssignment(\n    'service-${slice}-${workload}-host-v1',\n  );\n  logger.info('${workload} service starting', {\n    attributes: { port, providerDeliveryAssigned: assignment.assigned },\n  });\n  const server = createServer((request, response) => {\n    const result = healthResponse(request.url);\n    logger.info('${workload} service health request completed', {\n      attributes: { httpStatus: result.status },\n      outcome: result.status === 200 ? 'success' : 'failure',\n    });\n    response.writeHead(result.status, { 'content-type': 'application/json' });\n    response.end(JSON.stringify(result.body));\n  });\n  server.on('error', (error) => {\n    logger.error('${workload} service failed', { error, outcome: 'failure' });\n  });\n  return server.listen(port, () => {\n    logger.info('${workload} service started', { outcome: 'success' });\n  });\n}\n\nif (import.meta.url === new URL(process.argv[1] ?? '', 'file:').href) {\n  await start();\n}\n`
+            : `import { createLogger, type Logger } from '@empire-builder-kit/runtime/logging';\nimport { hostProviderDeliveryAssignment } from './provider-delivery.js';\n\nfunction jobLogger(): Logger {\n  return createLogger({\n    component: 'job-${workload}',\n    feature: '${feature}',\n    operation: 'run',\n    slice: '${slice}',\n    stage: process.env.EBK_STAGE ?? 'development',\n    workspace: '${workspace}',\n  });\n}\n\nexport async function run(logger = jobLogger()) {\n  logger.info('${workload} job started', {\n    attributes: { trigger: process.env.JOB_TRIGGER ?? 'manual' },\n  });\n  try {\n    const assignment = await hostProviderDeliveryAssignment(\n      'job-${slice}-${workload}-host-v1',\n    );\n    const result = { ok: true, providerDeliveryAssigned: assignment.assigned };\n    logger.info('${workload} job completed', { outcome: 'success' });\n    return result;\n  } catch (error) {\n    logger.error('${workload} job failed', { error, outcome: 'failure' });\n    throw error;\n  }\n}\n\nif (import.meta.url === new URL(process.argv[1] ?? '', 'file:').href) {\n  await run();\n}\n`,
         [`${relativeRoot}/src/workload.spec.ts`]: kind === 'service'
             ? `import { describe, expect, it } from 'vitest';\nimport { healthResponse } from './main.js';\n\ndescribe('${workload} service', () => {\n  it('reports healthy only on the health endpoint', () => {\n    expect(healthResponse('/health')).toEqual({ body: { service: '${workload}', status: 'ok' }, status: 200 });\n    expect(healthResponse('/missing').status).toBe(404);\n  });\n});\n`
-            : `import { describe, expect, it, vi } from 'vitest';\nimport { run } from './run.js';\n\ndescribe('${workload} job', () => {\n  it('completes the generated unit of work', async () => {\n    vi.spyOn(console, 'info').mockImplementation(() => undefined);\n    await expect(run()).resolves.toEqual({ ok: true });\n  });\n});\n`,
-        [`${relativeRoot}/infra.ts`]: `export function ${factoryName}(cluster: any) {\n  const workload = new sst.aws.${resource}('${className}', {\n    cluster,\n    environment: { EBK_STAGE: $app.stage },\n    ${kind === 'service' ? "image: { context: './services/" + workload + "', dockerfile: 'Dockerfile' },\n    health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:3000/health || exit 1'] },\n    logging: { retention: '1 month' },\n    serviceRegistry: { port: 3000 }," : "image: { context: './jobs/" + workload + "', dockerfile: 'Dockerfile' },\n    logging: { retention: '1 month' },"}\n  });\n  return workload;\n}\n`,
+            : `import { createLogger, type LogEntry } from '@empire-builder-kit/runtime/logging';\nimport { describe, expect, it } from 'vitest';\nimport { run } from './run.js';\n\ndescribe('${workload} job', () => {\n  it('emits canonical start and completion records', async () => {\n    const entries: LogEntry[] = [];\n    const logger = createLogger({\n      component: 'job-${workload}', feature: '${feature}', operation: 'run',\n      slice: '${slice}', stage: 'test', workspace: '${workspace}',\n      sink: (entry) => entries.push(entry as LogEntry),\n    });\n    await expect(run(logger)).resolves.toEqual({\n      ok: true,\n      providerDeliveryAssigned: false,\n    });\n    expect(entries.map(({ message, outcome }) => ({ message, outcome }))).toEqual([\n      { message: '${workload} job started', outcome: undefined },\n      { message: '${workload} job completed', outcome: 'success' },\n    ]);\n  });\n});\n`,
+        [`${relativeRoot}/infra.ts`]: `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';\nimport { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';\n\nexport function ${factoryName}(\n  cluster: any,\n  alertTopicArn: any,\n  roles?: { executionRole: string; taskRole: string },\n  links: any[] = [],\n  configuration?: {\n    applicationId: any;\n    deployment: any;\n    environmentId: any;\n    profileId: any;\n  },\n) {\n  const contract = createManagedLogGroupContract({\n    component: '${kind}-${workload}',\n    slice: '${slice}',\n    stage: $app.stage,\n    workspace: '${workspace}',\n  });\n  const workload = new sst.aws.${resource}('${className}', {\n    ...(roles ?? {}),\n    cluster,\n    environment: {\n      EBK_STAGE: $app.stage,\n      ...(configuration\n        ? {\n            EBK_APPCONFIG_APPLICATION_ID: configuration.applicationId,\n            EBK_APPCONFIG_ENVIRONMENT_ID: configuration.environmentId,\n            EBK_APPCONFIG_PROFILE_ID: configuration.profileId,\n          }\n        : {}),\n    },\n    link: links,\n    ${kind === 'service' ? "image: { context: './services/" + workload + "', dockerfile: 'Dockerfile' },\n    health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:3000/health || exit 1'] },\n    logging: { name: contract.name, retention: '1 month' },\n    serviceRegistry: { port: 3000 }," : "image: { context: './jobs/" + workload + "', dockerfile: 'Dockerfile' },\n    logging: { name: contract.name, retention: '1 month' },"}\n    transform: {\n      logGroup: {\n        logGroupClass: contract.logGroupClass,\n        tags: contract.tags,\n      },\n      taskDefinition: {\n        family: standardSliceExtensionTaskFamily(\n          $app.stage,\n          '${workload}',\n          '${kind}',\n        ),\n      },\n    },\n  }, configuration?.deployment\n    ? { dependsOn: [configuration.deployment] }\n    : {});\n  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(\n    '${className}LogDataProtection',\n    {\n      logGroupName: contract.name,\n      policyDocument: JSON.stringify(contract.dataProtectionPolicy),\n    },\n    { dependsOn: [workload.nodes.taskDefinition] },\n  );\n  const dataProtectionAlarm = new aws.cloudwatch.MetricAlarm(\n    '${className}LogDataProtectionFindings',\n    {\n      alarmActions: [alertTopicArn],\n      comparisonOperator: 'GreaterThanOrEqualToThreshold',\n      dimensions: { LogGroupName: contract.name },\n      evaluationPeriods: 1,\n      metricName: 'LogEventsWithFindings',\n      namespace: 'AWS/Logs',\n      period: 300,\n      statistic: 'Sum',\n      threshold: 1,\n      treatMissingData: 'notBreaching',\n    },\n    { dependsOn: [dataProtection] },\n  );\n  void dataProtectionAlarm;\n  return workload;\n}\n`,
+    };
+    if (kind === 'service') {
+        const serviceMainPath = `${relativeRoot}/src/main.ts`;
+        const serviceInfrastructurePath = `${relativeRoot}/infra.ts`;
+        const mainSource = files[serviceMainPath] ?? '';
+        const infrastructureSource = files[serviceInfrastructurePath] ?? '';
+        if (!mainSource.includes("import { hostProviderDeliveryAssignment } from './provider-delivery.js';\n") ||
+            !mainSource.includes('process.env.PORT ?? 3000') ||
+            !infrastructureSource.includes("import { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';\n") ||
+            !infrastructureSource.includes("health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:3000/health || exit 1'] },") ||
+            !infrastructureSource.includes('serviceRegistry: { port: 3000 },')) {
+            throw new Error('Built-in Service runtime is missing its shared port integration point.');
+        }
+        files[serviceMainPath] = mainSource
+            .replace("import { hostProviderDeliveryAssignment } from './provider-delivery.js';\n", "import { hostProviderDeliveryAssignment } from './provider-delivery.js';\nimport { DEFAULT_SERVICE_PORT } from './service-runtime.js';\n")
+            .replace('process.env.PORT ?? 3000', 'process.env.PORT ?? DEFAULT_SERVICE_PORT');
+        files[serviceInfrastructurePath] = infrastructureSource
+            .replace("import { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';\n", "import { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';\nimport { DEFAULT_SERVICE_PORT } from './src/service-runtime.js';\n")
+            .replace("health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:3000/health || exit 1'] },", "health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:' + DEFAULT_SERVICE_PORT + '/health || exit 1'] },")
+            .replace('serviceRegistry: { port: 3000 },', 'serviceRegistry: { port: DEFAULT_SERVICE_PORT },');
+    }
+    if (kind === 'service' && ownsProtectedLoadAdapter) {
+        const mainPath = `${relativeRoot}/src/main.ts`;
+        let mainSource = files[mainPath] ?? '';
+        const replaceMainFragment = (expected, replacement) => {
+            if (!mainSource.includes(expected)) {
+                throw new Error('Built-in Service runtime is missing its protected performance integration point.');
+            }
+            mainSource = mainSource.replace(expected, replacement);
+        };
+        replaceMainFragment(`import { hostProviderDeliveryAssignment } from './provider-delivery.js';\n`, `import { hostProviderDeliveryAssignment } from './provider-delivery.js';\nimport { serveProtectedServicePerformanceRequest } from './performance.js';\n`);
+        replaceMainFragment('export async function start(logger = serviceLogger()) {', `export async function start(\n  logger = serviceLogger(),\n  performanceHandler = serveProtectedServicePerformanceRequest,\n) {`);
+        replaceMainFragment(`  const server = createServer((request, response) => {\n    const result = healthResponse(request.url);`, `  const server = createServer(async (request, response) => {\n    const path = request.url?.split('?')[0];\n    if (\n      path === '/${slice}/__ebk/performance/service' ||\n      path === '/${slice}/__ebk/performance/service/cleanup'\n    ) {\n      try {\n        await performanceHandler(request, response);\n      } catch (error) {\n        logger.error('${workload} protected performance request failed', {\n          error,\n          outcome: 'failure',\n        });\n        if (!response.headersSent) {\n          response.writeHead(404, { 'content-type': 'application/json' });\n          response.end(JSON.stringify({\n            kind: 'ebk-protected-load-endpoint-refusal',\n            status: 'not-found',\n          }));\n        } else {\n          response.destroy();\n        }\n      }\n      return;\n    }\n    const result = healthResponse(request.url);`);
+        replaceMainFragment(`response.writeHead(404, { 'content-type': 'application/json' });`, `response.writeHead(404, {
+          'cache-control': 'no-store',
+          'content-type': 'application/json',
+        });`);
+        files[mainPath] = mainSource;
+        Object.assign(files, (0, service_performance_files_js_1.renderServicePerformanceFiles)({ slice, workload }));
+    }
+    const infrastructurePath = `${relativeRoot}/infra.ts`;
+    const packageLocalImage = `image: { context: './${plural}/${workload}', dockerfile: 'Dockerfile' }`;
+    const protectedReleaseImage = 'image: container.image';
+    let infrastructureSource = files[infrastructurePath] ?? '';
+    const replaceInfrastructureFragment = (expected, replacement) => {
+        if (!infrastructureSource.includes(expected)) {
+            throw new Error(`Built-in ${kind} infrastructure is missing its performance integration point.`);
+        }
+        infrastructureSource = infrastructureSource.replace(expected, replacement);
+    };
+    replaceInfrastructureFragment(`import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';
+`, `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';
+import { createStandardResourceTags } from '@empire-builder-kit/nx/performance';
+import { resolveStandardContainerImage } from '../../infra/container-images.js';
+`);
+    replaceInfrastructureFragment(`  alertTopicArn: any,
+  roles?: { executionRole: string; taskRole: string },
+`, `  alertTopicArn: any,
+  performance: {
+    frameworkVersion: string;
+    owner: string;
+    productionProfile: 'cost-optimized' | 'standard';
+    repository: string;
+  },
+${kind !== 'service' || ownsProtectedLoadAdapter
+        ? `  performanceDeploymentBinding: {
+    candidateDigest: string;
+    releaseId: string;
+    releaseMaterialDigest: string;
+    target: {
+      accountFingerprint: string;
+      origin: any;
+      region: string;
+      slice: string;
+    };
+  } | undefined,
+`
+        : ''}${kind === 'service' && ownsProtectedLoadAdapter
+        ? `  performanceIngress: {
+    api: any;
+    originProof: any;
+    router: any;
+  } | undefined,
+`
+        : ''}  roles?: { executionRole: string; taskRole: string },
+`);
+    replaceInfrastructureFragment(`    workspace: '${workspace}',
+  });
+  const workload = new sst.aws.${resource}`, `    workspace: '${workspace}',
+  });
+  const standardTags = createStandardResourceTags({
+    ...performance,
+    slice: '${slice}',
+    stage: $app.stage,
+    workspace: '${workspace}',
+  });
+  const container = resolveStandardContainerImage({
+    artifactId: '${slice}.${kind}.${workload}',
+    local: {
+      context: '../..',
+      dockerfile: 'packages/${slice}/${relativeRoot}/Dockerfile',
+    },
+    sourceCommit: process.env.EBK_RELEASE_SOURCE_COMMIT ??
+      process.env.EBK_SOURCE_COMMIT ?? '',
+    stage: $app.stage,
+  });
+  const workload = new sst.aws.${resource}`);
+    replaceInfrastructureFragment(`    environment: {
+      EBK_STAGE: $app.stage,
+`, `    environment: {
+      ...container.environment,
+      EBK_STAGE: $app.stage,
+`);
+    replaceInfrastructureFragment(`        tags: contract.tags,
+`, `        tags: { ...contract.tags, ...standardTags },
+`);
+    replaceInfrastructureFragment(`      taskDefinition: {
+`, `${kind === 'service' ? '      service: { tags: standardTags },\n' : ''}      taskDefinition: {
+`);
+    replaceInfrastructureFragment(`          '${kind}',
+        ),
+      },
+`, `          '${kind}',
+        ),
+        tags: standardTags,
+      },
+`);
+    replaceInfrastructureFragment(`      treatMissingData: 'notBreaching',
+`, `      tags: standardTags,
+      treatMissingData: 'notBreaching',
+`);
+    replaceInfrastructureFragment(`      alarmActions: [alertTopicArn],
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+`, `      alarmActions: [alertTopicArn],
+      alarmDescription: JSON.stringify({
+        businessSymptom:
+          '${kind} ${workload} emitted a protected-data log finding.',
+        id: 'data-protection-findings',
+        owner: '${slice}-product',
+        route: '${slice}-on-call',
+        runbook: 'docs/runbooks/log-investigation.md',
+        schemaVersion: 1,
+        slice: '${slice}',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+`);
+    replaceInfrastructureFragment(`  void dataProtectionAlarm;
+  return workload;
+`, `  void dataProtectionAlarm;
+  ${kind === 'job'
+        ? `const reliabilityTaskStopped = new aws.cloudwatch.EventRule(
+    '${className}EssentialContainerStopped',
+    {
+      description:
+        'AWS-native hard-crash signal for the exact ${workload} Job task family.',
+      eventPattern: $jsonStringify({
+        'detail-type': ['ECS Task State Change'],
+        detail: {
+          lastStatus: ['STOPPED'],
+          stopCode: ['EssentialContainerExited'],
+          taskDefinitionArn: [
+            {
+              wildcard: $interpolate\`*task-definition/\${standardSliceExtensionTaskFamily(
+                $app.stage,
+                '${workload}',
+                'job',
+              )}:*\`,
+            },
+          ],
+        },
+        source: ['aws.ecs'],
+      }),
+    },
+  );`
+        : ''}
+  const reliabilityAlarm = new aws.cloudwatch.MetricAlarm(
+    '${className}Reliability',
+    {
+      alarmActions: [alertTopicArn],
+      alarmDescription: JSON.stringify({
+        businessSymptom:
+          '${kind === 'service'
+        ? `${workload} Service has no running task.`
+        : `${workload} Job essential container exited.`}',
+        id: '${kind === 'service'
+        ? `service-${workload}-health`
+        : `job-${workload}-failure`}',
+        owner: '${slice}-product',
+        route: '${slice}-on-call',
+        runbook: '${relativeRoot}/RUNBOOK.md',
+        schemaVersion: 1,
+        slice: '${slice}',
+      }),
+      comparisonOperator: '${kind === 'service'
+        ? 'LessThanThreshold'
+        : 'GreaterThanOrEqualToThreshold'}',
+      dimensions: ${kind === 'service'
+        ? `{ ClusterName: cluster.name, ServiceName: workload.name }`
+        : `{ RuleName: reliabilityTaskStopped.name }`},
+      evaluationPeriods: 1,
+      metricName: '${kind === 'service' ? 'RunningTaskCount' : 'MatchedEvents'}',
+      name: '${slice}-' + $app.stage + '-${kind}-${workload}-${kind === 'service' ? 'running' : 'hard-crash'}',
+      namespace: '${kind === 'service' ? 'ECS/ContainerInsights' : 'AWS/Events'}',
+      period: 60,
+      statistic: 'Sum',
+      tags: standardTags,
+      threshold: 1,
+      treatMissingData: '${kind === 'service' ? 'breaching' : 'notBreaching'}',
+    },
+  );
+  void reliabilityAlarm;
+  return workload;
+`);
+    if (!infrastructureSource.includes(packageLocalImage)) {
+        throw new Error(`Built-in ${kind} infrastructure is missing its image context.`);
+    }
+    infrastructureSource = infrastructureSource.replace(packageLocalImage, protectedReleaseImage);
+    if (kind === 'service' && ownsProtectedLoadAdapter) {
+        replaceInfrastructureFragment(`import { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';`, `import {
+  standardSliceExtensionTaskFamily,
+  standardSliceServicePerformanceReservationTableName,
+} from '../../infra/workload-roles/effective-intent.js';`);
+        replaceInfrastructureFragment(`  const workload = new sst.aws.Service`, `  const performanceReservations = performanceDeploymentBinding
+    ? new aws.dynamodb.Table(
+    '${className}PerformanceReservationsTable',
+    {
+      attributes: [
+        { name: 'pk', type: 'S' },
+        { name: 'sk', type: 'S' },
+      ],
+      billingMode: 'PAY_PER_REQUEST',
+      hashKey: 'pk',
+      name: standardSliceServicePerformanceReservationTableName(
+        $app.stage,
+        '${workload}',
+      ),
+      pointInTimeRecovery: { enabled: true },
+      rangeKey: 'sk',
+      tags: standardTags,
+      ttl: {
+        attributeName: 'expires_at_epoch_seconds',
+        enabled: true,
+      },
+      },
+    )
+    : undefined;
+  const performanceReservationsLink = performanceReservations
+    ? new sst.Linkable(
+    '${className}PerformanceReservations',
+    {
+      properties: { tableName: performanceReservations.name },
+      },
+    )
+    : undefined;
+  const workload = new sst.aws.Service`);
+        replaceInfrastructureFragment(`    link: links,`, `    link: [
+      ...links,
+      ...(performanceReservationsLink ? [performanceReservationsLink] : []),
+    ],`);
+        replaceInfrastructureFragment(`      EBK_STAGE: $app.stage,`, `      EBK_PERFORMANCE_ACCOUNT_FINGERPRINT:
+        performanceDeploymentBinding?.target.accountFingerprint ?? '',
+      EBK_PERFORMANCE_CANDIDATE_DIGEST:
+        performanceDeploymentBinding?.candidateDigest ?? '',
+      EBK_PERFORMANCE_LOAD_ENABLED:
+        performanceDeploymentBinding ? 'true' : 'false',
+      EBK_PERFORMANCE_INGRESS_PROOF:
+        performanceIngress?.originProof ?? '',
+      EBK_PERFORMANCE_ORIGIN:
+        performanceDeploymentBinding?.target.origin ?? '',
+      EBK_PERFORMANCE_REGION:
+        performanceDeploymentBinding?.target.region ?? '',
+      EBK_PERFORMANCE_RELEASE_ID:
+        performanceDeploymentBinding?.releaseId ?? '',
+      EBK_PERFORMANCE_RELEASE_MATERIAL_DIGEST:
+        performanceDeploymentBinding?.releaseMaterialDigest ?? '',
+      EBK_PERFORMANCE_SLICE:
+        performanceDeploymentBinding?.target.slice ?? '',
+      EBK_STAGE: $app.stage,`);
+        replaceInfrastructureFragment(`  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(`, `  if (performanceIngress) {
+    performanceIngress.api.routePrivate(
+      'GET /${slice}/__ebk/performance/service',
+      workload.nodes.cloudmapService.arn,
+      { name: '${className}PerformanceExecute' },
+    );
+    performanceIngress.api.routePrivate(
+      'POST /${slice}/__ebk/performance/service/cleanup',
+      workload.nodes.cloudmapService.arn,
+      { name: '${className}PerformanceCleanup' },
+    );
+    performanceIngress.router.route(
+      '/${slice}/__ebk/performance/service',
+      performanceIngress.api.url,
+      {
+        connectionAttempts: 1,
+        connectionTimeout: '3 seconds',
+        readTimeout: '30 seconds',
+      },
+    );
+    performanceIngress.router.route(
+      '/${slice}/__ebk/performance/service/cleanup',
+      performanceIngress.api.url,
+      {
+        connectionAttempts: 1,
+        connectionTimeout: '3 seconds',
+        readTimeout: '30 seconds',
+      },
+    );
+  }
+  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(`);
+    }
+    files[infrastructurePath] = infrastructureSource;
+    files[`${relativeRoot}/RUNBOOK.md`] = `# ${workload} ${kind} recovery
+
+Confirm the exact Slice, stage, release, configuration, alarm, and workload
+identity before acting. Inspect health or completion signals and sanitized logs
+through the read-only diagnostic path. Do not restart, scale, retry, or replace
+protected resources without the named approval.
+
+${kind === 'service'
+        ? 'Prefer a verified roll-forward; verify readiness, dependency protection, and the critical Service journey after recovery.'
+        : 'Preserve idempotency and checkpoint state; verify the business deadline and postconditions before retrying or declaring recovery.'}
+`;
+    files[`${relativeRoot}/src/reliability.ts`] = `import {
+  createMetricEmitter,
+  type MetricEmitter,
+} from '@empire-builder-kit/runtime/observability';
+
+export function recordWorkloadReliability(
+  failed: boolean,
+  metrics: MetricEmitter = createMetricEmitter(),
+) {
+  return metrics.emit({
+    dimensions: {
+      component: '${kind}-${workload}',
+      feature: '${feature}',
+      slice: '${slice}',
+      stage: process.env.EBK_STAGE ?? 'development',
+    },
+    metricName: '${kind === 'service' ? 'ServiceHealthFailures' : 'JobFailures'}',
+    unit: 'Count',
+    value: failed ? 1 : 0,
+  });
+}
+`;
+    files[`${relativeRoot}/src/reliability.spec.ts`] =
+        `import { describe, expect, it } from 'vitest';
+import { recordWorkloadReliability } from './reliability.js';
+
+describe('${workload} ${kind} reliability signal', () => {
+  it('emits the exact generated alarm metric and dimensions', () => {
+    const records: unknown[] = [];
+    recordWorkloadReliability(true, {
+      emit(input) {
+        records.push(input);
+        return undefined;
+      },
+    });
+    expect(records).toEqual([
+      expect.objectContaining({
+        dimensions: {
+          component: '${kind}-${workload}',
+          feature: '${feature}',
+          slice: '${slice}',
+          stage: 'development',
+        },
+        metricName: '${kind === 'service' ? 'ServiceHealthFailures' : 'JobFailures'}',
+        value: 1,
+      }),
+    ]);
+  });
+});
+`;
+    const sourcePath = `${relativeRoot}/src/${sourceName}`;
+    let source = files[sourcePath] ?? '';
+    source = source.replace(`import { hostProviderDeliveryAssignment } from './provider-delivery.js';`, `import { hostProviderDeliveryAssignment } from './provider-delivery.js';
+import { recordWorkloadReliability } from './reliability.js';`);
+    if (kind === 'service') {
+        source = source
+            .replace(`    const result = healthResponse(request.url);
+`, `    const result = healthResponse(request.url);
+    recordWorkloadReliability(result.status !== 200);
+`)
+            .replace(`  server.on('error', (error) => {
+    logger.error('${workload} service failed', { error, outcome: 'failure' });
+`, `  server.on('error', (error) => {
+    recordWorkloadReliability(true);
+    logger.error('${workload} service failed', { error, outcome: 'failure' });
+`);
+    }
+    else {
+        source = source
+            .replace(`    const result = { ok: true, providerDeliveryAssigned: assignment.assigned };
+    logger.info('${workload} job completed', { outcome: 'success' });
+`, `    const result = { ok: true, providerDeliveryAssigned: assignment.assigned };
+    recordWorkloadReliability(false);
+    logger.info('${workload} job completed', { outcome: 'success' });
+`)
+            .replace(`  } catch (error) {
+    logger.error('${workload} job failed', { error, outcome: 'failure' });
+`, `  } catch (error) {
+    recordWorkloadReliability(true);
+    logger.error('${workload} job failed', { error, outcome: 'failure' });
+`);
+    }
+    files[sourcePath] = source;
+    files[`${relativeRoot}/src/provider-delivery.ts`] = `import {
+  AppConfigDataClient,
+  GetLatestConfigurationCommand,
+  StartConfigurationSessionCommand,
+} from '@aws-sdk/client-appconfigdata';
+import {
+  deriveOperationalRolloutStableKey,
+  evaluatePercentageRollout,
+  type OperationalRolloutStableKey,
+} from '@empire-builder-kit/runtime/configuration';
+
+type EvaluationReason = 'CACHED' | 'ERROR' | 'STALE' | 'STATIC';
+interface Evaluation<Value extends boolean | number> {
+  errorCategory?: 'PROVIDER_UNAVAILABLE';
+  flagKey: string;
+  providerName: string;
+  providerVersion?: string;
+  reason: EvaluationReason;
+  value: Value;
+}
+export interface HostConfigurationProvider {
+  resolveBooleanEvaluation(
+    key: string,
+    defaultValue: boolean,
+  ): Promise<Evaluation<boolean>>;
+  resolveNumberEvaluation(
+    key: string,
+    defaultValue: number,
+  ): Promise<Evaluation<number>>;
+}
+interface Snapshot {
+  loadedAt: number;
+  values: Record<string, unknown>;
+  version: string;
+}
+
+const REFRESH_AFTER_MS = 45_000;
+const MAX_STALE_MS = 5 * 60_000;
+
+function required(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(name + ' is required in a protected stage.');
+  return value;
+}
+
+function createHostConfigurationProvider(): HostConfigurationProvider {
+  const protectedStage = ['staging', 'production'].includes(
+    process.env.EBK_STAGE ?? '',
+  );
+  if (!protectedStage) {
+    return {
+      async resolveBooleanEvaluation(flagKey, defaultValue) {
+        return {
+          flagKey,
+          providerName: 'ebk-local',
+          providerVersion: 'local-v1',
+          reason: 'STATIC',
+          value: defaultValue,
+        };
+      },
+      async resolveNumberEvaluation(flagKey, defaultValue) {
+        return {
+          flagKey,
+          providerName: 'ebk-local',
+          providerVersion: 'local-v1',
+          reason: 'STATIC',
+          value: defaultValue,
+        };
+      },
+    };
+  }
+
+  const client = new AppConfigDataClient({});
+  let cached: Snapshot | undefined;
+  let inFlight: Promise<Snapshot> | undefined;
+  let token: string | undefined;
+  const refresh = async (): Promise<Snapshot> => {
+    if (!token) {
+      const session = await client.send(
+        new StartConfigurationSessionCommand({
+          ApplicationIdentifier: required('EBK_APPCONFIG_APPLICATION_ID'),
+          ConfigurationProfileIdentifier: required(
+            'EBK_APPCONFIG_PROFILE_ID',
+          ),
+          EnvironmentIdentifier: required('EBK_APPCONFIG_ENVIRONMENT_ID'),
+        }),
+      );
+      token = session.InitialConfigurationToken;
+    }
+    if (!token) throw new Error('AppConfig did not return a session token.');
+    const latest = await client.send(
+      new GetLatestConfigurationCommand({ ConfigurationToken: token }),
+    );
+    token = latest.NextPollConfigurationToken;
+    if (!token) throw new Error('AppConfig did not return the next poll token.');
+    if (!latest.Configuration?.byteLength) {
+      if (!cached) {
+        throw new Error('AppConfig returned no initial configuration.');
+      }
+      cached = { ...cached, loadedAt: Date.now() };
+      return cached;
+    }
+    if (!latest.VersionLabel) {
+      throw new Error('AppConfig did not return a versioned document.');
+    }
+    const document = JSON.parse(
+      new TextDecoder().decode(latest.Configuration),
+    ) as { schemaVersion?: unknown; values?: unknown };
+    const values = document.values as Record<string, unknown> | undefined;
+    if (
+      document.schemaVersion !== 1 ||
+      !values ||
+      typeof values !== 'object' ||
+      Array.isArray(values) ||
+      typeof values['${slice}.provider-delivery-v1'] !== 'boolean' ||
+      !Number.isInteger(
+        values['${slice}.provider-delivery-percentage'],
+      )
+    ) {
+      throw new Error('AppConfig document is invalid.');
+    }
+    cached = {
+      loadedAt: Date.now(),
+      values,
+      version: latest.VersionLabel,
+    };
+    return cached;
+  };
+  const load = async (): Promise<{
+    snapshot?: Snapshot;
+    stale: boolean;
+  }> => {
+    const age = cached ? Date.now() - cached.loadedAt : Infinity;
+    if (cached && age < REFRESH_AFTER_MS) {
+      return { snapshot: cached, stale: false };
+    }
+    inFlight ??= refresh().finally(() => {
+      inFlight = undefined;
+    });
+    try {
+      return { snapshot: await inFlight, stale: false };
+    } catch {
+      token = undefined;
+      const staleAge = cached ? Date.now() - cached.loadedAt : Infinity;
+      return {
+        ...(cached && staleAge <= MAX_STALE_MS ? { snapshot: cached } : {}),
+        stale: true,
+      };
+    }
+  };
+  const resolve = async <Value extends boolean | number>(
+    flagKey: string,
+    defaultValue: Value,
+    valid: (value: unknown) => value is Value,
+  ): Promise<Evaluation<Value>> => {
+    const loaded = await load();
+    const value = loaded.snapshot?.values[flagKey];
+    if (!loaded.snapshot || !valid(value)) {
+      return {
+        errorCategory: 'PROVIDER_UNAVAILABLE',
+        flagKey,
+        providerName: 'aws-appconfig',
+        reason: 'ERROR',
+        value: defaultValue,
+      };
+    }
+    return {
+      ...(loaded.stale
+        ? { errorCategory: 'PROVIDER_UNAVAILABLE' as const }
+        : {}),
+      flagKey,
+      providerName: 'aws-appconfig',
+      providerVersion: loaded.snapshot.version,
+      reason: loaded.stale ? 'STALE' : 'CACHED',
+      value,
+    };
+  };
+  return {
+    resolveBooleanEvaluation: (flagKey, defaultValue) =>
+      resolve(
+        flagKey,
+        defaultValue,
+        (value): value is boolean => typeof value === 'boolean',
+      ),
+    resolveNumberEvaluation: (flagKey, defaultValue) =>
+      resolve(
+        flagKey,
+        defaultValue,
+        (value): value is number => Number.isInteger(value),
+      ),
+  };
+}
+
+export async function providerDeliveryAssignment(
+  provider: HostConfigurationProvider,
+  operationalIdentity:
+    | OperationalRolloutStableKey
+    | typeof workloadOperationalIdentity,
+) {
+  const [enabled, percentage] = await Promise.all([
+    provider.resolveBooleanEvaluation('${slice}.provider-delivery-v1', false),
+    provider.resolveNumberEvaluation(
+      '${slice}.provider-delivery-percentage',
+      0,
+    ),
+  ]);
+  const safeDefault =
+    enabled.value === false &&
+    percentage.value === 0 &&
+    enabled.errorCategory !== undefined &&
+    percentage.errorCategory !== undefined;
+  const staleLastKnownValid =
+    enabled.reason === 'STALE' &&
+    percentage.reason === 'STALE' &&
+    enabled.providerVersion !== undefined &&
+    enabled.providerVersion === percentage.providerVersion;
+  if (
+    ((!safeDefault && !staleLastKnownValid) &&
+      (enabled.errorCategory || percentage.errorCategory)) ||
+    (!safeDefault &&
+      (
+        !enabled.providerVersion ||
+        enabled.providerVersion !== percentage.providerVersion
+      )) ||
+    !Number.isInteger(percentage.value) ||
+    percentage.value < 0 ||
+    percentage.value > 100
+  ) {
+    throw new Error('Provider-delivery configuration is unavailable.');
+  }
+  const providerVersion =
+    enabled.providerVersion ?? 'safe-default-v1';
+  const operationalStableKey =
+    operationalIdentity === workloadOperationalIdentity
+      ? workloadOperationalStableKey
+      : operationalIdentity;
+  return {
+    ...evaluatePercentageRollout({
+      enabled: enabled.value,
+      percentage: percentage.value,
+      rolloutId: '${slice}-provider-delivery',
+      stableKey: operationalStableKey,
+      version: providerVersion,
+    }),
+    host: '${kind}' as const,
+    providerVersion,
+  };
+}
+
+let hostProvider: HostConfigurationProvider | undefined;
+export const workloadOperationalIdentity =
+  '${kind}-${slice}-${workload}-host-v1' as const;
+export const workloadOperationalStableKey =
+  deriveOperationalRolloutStableKey({
+    kind: '${kind}',
+    slice: '${slice}',
+    workload: '${workload}',
+  });
+export function hostProviderDeliveryAssignment(
+  operationalIdentity:
+    | OperationalRolloutStableKey
+    | typeof workloadOperationalIdentity,
+) {
+  hostProvider ??= createHostConfigurationProvider();
+  return providerDeliveryAssignment(
+    hostProvider,
+    operationalIdentity,
+  );
+}
+`;
+    files[`${relativeRoot}/src/provider-delivery.spec.ts`] =
+        `import { describe, expect, it } from 'vitest';
+import {
+  providerDeliveryAssignment,
+  workloadOperationalIdentity,
+  workloadOperationalStableKey,
+} from './provider-delivery.js';
+
+const provider = {
+  async resolveBooleanEvaluation(flagKey: string) {
+    return {
+      flagKey,
+      providerName: 'aws-appconfig',
+      providerVersion: 'release-018f8d',
+      reason: 'STATIC' as const,
+      value: true,
+    };
+  },
+  async resolveNumberEvaluation(flagKey: string) {
+    return {
+      flagKey,
+      providerName: 'aws-appconfig',
+      providerVersion: 'release-018f8d',
+      reason: 'STATIC' as const,
+      value: 25,
+    };
+  },
+};
+
+describe('${workload} ${kind} rollout binding', () => {
+  it('imports and uses the declared operational workload identity', async () => {
+    expect(workloadOperationalStableKey).toMatch(/^opk_v1_[a-f0-9]{64}$/);
+    await expect(
+      providerDeliveryAssignment(
+        provider,
+        workloadOperationalIdentity,
+      ),
+    ).resolves.toEqual(
+      expect.objectContaining({
+        host: '${kind}',
+        providerVersion: 'release-018f8d',
+      }),
+    );
+  });
+});
+
+describe('${workload} ${kind} outage behavior', () => {
+  it('uses a safe disabled assignment before a valid snapshot exists', async () => {
+    const unavailable = {
+      async resolveBooleanEvaluation(flagKey: string) {
+        return {
+          errorCategory: 'PROVIDER_UNAVAILABLE' as const,
+          flagKey,
+          providerName: 'aws-appconfig',
+          reason: 'ERROR' as const,
+          value: false,
+        };
+      },
+      async resolveNumberEvaluation(flagKey: string) {
+        return {
+          errorCategory: 'PROVIDER_UNAVAILABLE' as const,
+          flagKey,
+          providerName: 'aws-appconfig',
+          reason: 'ERROR' as const,
+          value: 0,
+        };
+      },
     };
-    (0, index_js_1.assertManagedJsonPointersExist)(files[`${relativeRoot}/package.json`] ?? '', exports.WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS, `Built-in ${kind} package.json`);
+
+    await expect(
+      providerDeliveryAssignment(
+        unavailable,
+        workloadOperationalIdentity,
+      ),
+    ).resolves.toEqual(
+      expect.objectContaining({
+        assigned: false,
+        providerVersion: 'safe-default-v1',
+      }),
+    );
+  });
+});
+`;
+    (0, index_js_1.assertManagedJsonPointersExist)(files[`${relativeRoot}/package.json`] ?? '', kind === 'service' && ownsProtectedLoadAdapter
+        ? exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS
+        : exports.WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS, `Built-in ${kind} package.json`);
     return {
         factoryName,
         files,
         paths: [
             { mode: 'seeded', path: `${relativeRoot}/README.md` },
+            { mode: 'seeded', path: `${relativeRoot}/RUNBOOK.md` },
             { path: `${relativeRoot}/Dockerfile` },
             { path: `${relativeRoot}/infra.ts` },
             {
-                managedJsonPointers: [...exports.WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS],
+                managedJsonPointers: [
+                    ...(kind === 'service' && ownsProtectedLoadAdapter
+                        ? exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS
+                        : exports.WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS),
+                ],
                 path: `${relativeRoot}/package.json`,
             },
             { mode: 'seeded', path: `${relativeRoot}/src/${sourceName}` },
+            ...(kind === 'service'
+                ? [{ path: `${relativeRoot}/src/service-runtime.ts` }]
+                : []),
+            ...(kind === 'service' && ownsProtectedLoadAdapter
+                ? [
+                    { path: `${relativeRoot}/PERFORMANCE.md` },
+                    { path: `${relativeRoot}/src/performance.spec.ts` },
+                    { path: `${relativeRoot}/src/performance.ts` },
+                ]
+                : []),
+            { path: `${relativeRoot}/src/reliability.spec.ts` },
+            { path: `${relativeRoot}/src/reliability.ts` },
+            {
+                mode: 'seeded',
+                path: `${relativeRoot}/src/provider-delivery.spec.ts`,
+            },
+            {
+                mode: 'seeded',
+                path: `${relativeRoot}/src/provider-delivery.ts`,
+            },
             { mode: 'seeded', path: `${relativeRoot}/src/workload.spec.ts` },
             { path: `${relativeRoot}/tsconfig.json` },
             { path: `${relativeRoot}/vitest.config.ts` },
@@ -122,36 +1013,210 @@ function createWorkloadFilePlan(slice, workload, kind) {
 async function workloadGenerator(tree, options, kind) {
     const slice = name(options.slice, 'Product Slice name');
     const workload = name(options.name, kind === 'service' ? 'Service name' : 'Job name');
+    const requestedFeature = name(options.feature, 'Feature');
     const plural = kind === 'service' ? 'services' : 'jobs';
     const sliceRoot = node_path_1.posix.join('packages', slice);
     const root = node_path_1.posix.join(sliceRoot, plural, workload);
     const productPath = node_path_1.posix.join(sliceRoot, 'infra/product.ts');
+    const candidatePath = node_path_1.posix.join(sliceRoot, 'infra/workload-roles/candidate.ts');
+    const intentPath = node_path_1.posix.join(sliceRoot, 'infra/workload-roles/effective-intent.ts');
+    const installOperation = {
+        generator: 'workload',
+        id: `generator:workload:${slice}:${kind}:${workload}`,
+        key: `workload-${slice}-${kind}-${workload}`,
+        request: {
+            feature: requestedFeature,
+            kind,
+            name: workload,
+            skipFormat: options.skipFormat ?? false,
+            slice,
+        },
+        resumeArguments: [
+            'pnpm',
+            'nx',
+            'generate',
+            `@empire-builder-kit/nx:${kind}`,
+            `--name=${workload}`,
+            `--slice=${slice}`,
+            `--feature=${requestedFeature}`,
+            `--skipFormat=${String(options.skipFormat ?? false)}`,
+            '--skipInstall=false',
+            '--interactive=false',
+        ],
+        semanticPrerequisites: [
+            (0, post_generation_install_js_1.postGenerationInstallFeaturePrerequisite)(node_path_1.posix.join(sliceRoot, feature_registry_js_1.SLICE_FEATURE_REGISTRY_PATH), requestedFeature),
+        ],
+        sourceRoot: root,
+    };
+    const pendingInstall = (0, post_generation_install_js_1.resumePendingPostGenerationInstall)(tree, installOperation, options.skipInstall);
+    if (pendingInstall)
+        return pendingInstall;
+    const packageSource = tree.read('package.json', 'utf8');
+    if (packageSource === null) {
+        throw new Error('Workspace package.json is required.');
+    }
+    let packageJson;
+    try {
+        packageJson = JSON.parse(packageSource);
+    }
+    catch {
+        throw new Error('Workspace package.json must be valid JSON.');
+    }
+    const workspace = name(typeof packageJson.name === 'string' ? packageJson.name : '', 'Workspace name');
+    const runtimeVersion = packageJson.dependencies?.['@empire-builder-kit/runtime'];
+    if (typeof runtimeVersion !== 'string' || runtimeVersion.trim() === '') {
+        throw new Error('Workspace package.json must declare @empire-builder-kit/runtime before generating a workload.');
+    }
     if (!tree.exists(productPath)) {
         throw new Error(`${slice} is not an EBK v1 Product Slice.`);
     }
+    requireCompositionMarker(tree, candidatePath, '// <ebk:workload-role-extensions:end>');
+    requireCompositionMarker(tree, intentPath, '// <ebk:workload-role-intent-contributions:end>');
+    for (const marker of [
+        '// <ebk:composition-imports:end>',
+        '// <ebk:workload-registrations:end>',
+        '// <ebk:composition-outputs:end>',
+    ]) {
+        requireCompositionMarker(tree, productPath, marker);
+    }
+    const feature = (0, feature_registry_js_1.requireRegisteredSliceFeature)(tree, sliceRoot, requestedFeature);
     if (tree.exists(root)) {
         throw new Error(`${kind} ${workload} already exists at ${root}.`);
     }
-    const plan = createWorkloadFilePlan(slice, workload, kind);
+    const loggingRegistration = (0, logging_registry_js_1.planSliceLoggingComponentRegistration)(tree, sliceRoot, `${kind}-${workload}`);
+    const performanceRegistration = (0, performance_registration_js_1.planWorkloadPerformanceRegistration)(tree, {
+        kind,
+        name: workload,
+        runtimeVersion,
+        slice,
+        sliceRoot,
+        workspace,
+    });
+    const reliabilityRegistration = (0, reliability_registration_js_1.planWorkloadReliabilityRegistration)(tree, {
+        feature,
+        kind,
+        name: workload,
+        slice,
+        sliceRoot,
+    });
+    const plan = createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, performanceRegistration.ownsProtectedLoadAdapter);
+    const additionalPerformancePaths = performanceRegistration.additionalFiles.map(({ path }) => path);
+    const installScope = {
+        exactPaths: [
+            productPath,
+            candidatePath,
+            intentPath,
+            node_path_1.posix.join(sliceRoot, logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH),
+            node_path_1.posix.join(sliceRoot, performance_registration_js_1.WORKLOAD_PERFORMANCE_POLICY_PATH),
+            ...additionalPerformancePaths,
+            node_path_1.posix.join(sliceRoot, reliability_registration_js_1.WORKLOAD_RELIABILITY_REGISTRY_PATH),
+            node_path_1.posix.join(sliceRoot, RELEASE_REGISTRY_PATH),
+            node_path_1.posix.join(sliceRoot, '.ebk/ownership.json'),
+        ],
+        requiredPaths: [
+            node_path_1.posix.join(root, 'package.json'),
+            productPath,
+            candidatePath,
+            intentPath,
+            node_path_1.posix.join(sliceRoot, logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH),
+            node_path_1.posix.join(sliceRoot, performance_registration_js_1.WORKLOAD_PERFORMANCE_POLICY_PATH),
+            ...additionalPerformancePaths,
+            node_path_1.posix.join(sliceRoot, reliability_registration_js_1.WORKLOAD_RELIABILITY_REGISTRY_PATH),
+            node_path_1.posix.join(sliceRoot, RELEASE_REGISTRY_PATH),
+            node_path_1.posix.join(sliceRoot, '.ebk/ownership.json'),
+        ],
+        roots: [root],
+    };
+    const installState = options.skipInstall
+        ? undefined
+        : (0, post_generation_install_js_1.capturePostGenerationInstallState)(tree, installScope, installOperation);
     const { factoryName } = plan;
     const infraRelative = `../${plural}/${workload}/infra.js`;
     for (const [path, contents] of Object.entries(plan.files)) {
         tree.write(node_path_1.posix.join(sliceRoot, path), contents);
     }
+    tree.write(loggingRegistration.path, loggingRegistration.contents);
+    tree.write(performanceRegistration.path, performanceRegistration.contents);
+    for (const file of performanceRegistration.additionalFiles) {
+        tree.write(file.path, file.contents);
+    }
+    tree.write(reliabilityRegistration.path, reliabilityRegistration.contents);
+    registerReleaseArtifact(tree, sliceRoot, slice, workload, kind);
     replaceMarker(tree, productPath, '// <ebk:composition-imports:end>', `import { ${factoryName} } from '${infraRelative}';`);
-    replaceMarker(tree, productPath, '// <ebk:workload-registrations:end>', `  const ${kind}${pascal(workload)} = ${factoryName}(foundation.cluster);`);
+    replaceMarker(tree, productPath, '// <ebk:workload-registrations:end>', `  const ${kind}${pascal(workload)} = ${factoryName}(
+    foundation.cluster,
+    foundation.discovery.alertTopicArn,
+    {
+      frameworkVersion: ${JSON.stringify(performanceRegistration.tagContext.frameworkVersion)},
+      owner: ${JSON.stringify(performanceRegistration.tagContext.owner)},
+      productionProfile: ${JSON.stringify(performanceRegistration.tagContext.productionProfile)},
+      repository: ${JSON.stringify(performanceRegistration.tagContext.repository)},
+    },
+${kind !== 'service' || performanceRegistration.ownsProtectedLoadAdapter
+        ? `    performanceDeploymentBinding,
+`
+        : ''}
+${kind === 'service' && performanceRegistration.ownsProtectedLoadAdapter
+        ? `    performanceIngress,
+    performanceDeploymentBinding
+      ? workloadRoleBindings?.extension.servicePerformance('${workload}')
+      : workloadRoleBindings?.extension.service('${workload}'),
+`
+        : kind === 'service'
+            ? `    workloadRoleBindings?.extension.service('${workload}'),
+`
+            : `    workloadRoleBindings?.extension.job('${workload}'),
+`}
+${kind === 'service' && performanceRegistration.ownsProtectedLoadAdapter
+        ? `    performanceDeploymentBinding
+      ? secretLinksForWorkloads(
+          '${workload}-service-task',
+          '${workload}-service-performance-task',
+        )
+      : secretLinksFor('${workload}-service-task'),`
+        : kind === 'service'
+            ? `    secretLinksFor('${workload}-service-task'),`
+            : `    secretLinksFor('${workload}-job-task'),`}
+    runtimeConfiguration
+      ? {
+          applicationId: runtimeConfiguration.application.id,
+          deployment: runtimeConfiguration.deployment,
+          environmentId: runtimeConfiguration.environment.environmentId,
+          profileId: runtimeConfiguration.profile.configurationProfileId,
+        }
+      : undefined,
+  );`);
     replaceMarker(tree, productPath, '// <ebk:composition-outputs:end>', `    ${kind}${pascal(workload)},`);
+    replaceMarker(tree, candidatePath, '// <ebk:workload-role-extensions:end>', `  { id: '${workload}', kind: '${kind}' },`);
+    replaceMarker(tree, intentPath, '// <ebk:workload-role-intent-contributions:end>', `    ...extensionWorkloadRoleIntentContributions(context, topology, '${workload}', '${kind}'),`);
     if (!options.skipFormat)
         await (0, devkit_1.formatFiles)(tree);
     (0, index_js_1.recordCompositionOwnership)(tree, {
-        paths: [...plan.paths, { path: 'infra/product.ts' }],
+        compositions: [{ feature, kind, name: workload }],
+        paths: [
+            ...plan.paths,
+            { path: 'infra/product.ts' },
+            { path: 'infra/workload-roles/candidate.ts' },
+            { path: 'infra/workload-roles/effective-intent.ts' },
+            { path: logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH },
+            { mode: 'seeded', path: performance_registration_js_1.WORKLOAD_PERFORMANCE_POLICY_PATH },
+            ...performanceRegistration.additionalFiles.map(({ mode, path }) => ({
+                mode,
+                path: node_path_1.posix.relative(sliceRoot, path),
+            })),
+            { mode: 'seeded', path: reliability_registration_js_1.WORKLOAD_RELIABILITY_REGISTRY_PATH },
+            { mode: 'seeded', path: RELEASE_REGISTRY_PATH },
+        ],
         projects: [plan.project],
         slice,
     });
     if (!options.skipFormat)
         await (0, devkit_1.formatFiles)(tree);
-    return options.skipInstall
-        ? undefined
-        : () => (0, devkit_1.installPackagesTask)(tree, true);
+    if (options.skipInstall)
+        return undefined;
+    if (!installState) {
+        throw new Error('Post-generation install state was not prepared.');
+    }
+    return (0, post_generation_install_js_1.createPostGenerationInstallCallback)(tree, installState, installScope, installOperation);
 }
 //# sourceMappingURL=workload.js.map