@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-data-files.js

@@ -0,0 +1,1530 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductDataFiles = renderProductDataFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+function snapshotColumn(name, type, options = {}) {
+    return {
+        name,
+        type,
+        primaryKey: options.primaryKey ?? false,
+        notNull: options.notNull ?? true,
+        ...(options.default ? { default: options.default } : {}),
+    };
+}
+function snapshotTable(name, columns, uniqueConstraints = {}, compositePrimaryKeys = {}, indexes = {}, foreignKeys = {}) {
+    return {
+        name,
+        schema: '',
+        columns,
+        indexes,
+        foreignKeys,
+        compositePrimaryKeys,
+        uniqueConstraints,
+        policies: {},
+        checkConstraints: {},
+        isRLSEnabled: false,
+    };
+}
+function snapshotIndex(name, columns) {
+    return {
+        columns: columns.map(({ expression, opclass }) => ({
+            asc: true,
+            expression,
+            isExpression: false,
+            nulls: 'last',
+            opclass,
+        })),
+        concurrently: false,
+        isUnique: false,
+        method: 'btree',
+        name,
+        with: {},
+    };
+}
+/** @internal */
+function renderProductDataFiles(name, pascalName) {
+    return {
+        'contracts/events.ts': `import type { DataLifecycleChangeEventV1 } from '@empire-builder-kit/runtime/data-lifecycle';
+
+export interface ${pascalName}CreatedData {
+  id: string;
+  occurredBy: string;
+}
+
+export const ${pascalName}Created = {
+  detailType: '${pascalName}Created',
+  schemaVersion: 1,
+  source: '${name}',
+} as const;
+
+export type ${pascalName}DataLifecycleChangedData =
+  DataLifecycleChangeEventV1;
+
+export const ${pascalName}DataLifecycleChanged = {
+  detailType: 'DataLifecycleChanged',
+  schemaVersion: 1,
+  source: '${name}',
+} as const;
+
+/**
+ * Canonical machine-readable projection of the public event surface above.
+ * Release compatibility derives this value directly from this TypeScript
+ * source; async work scheduling metadata is intentionally not an event schema.
+ */
+export const EventContractSchema = {
+  events: [
+    {
+      data: {
+        id: 'string',
+        occurredBy: 'string',
+      },
+      detailType: '${pascalName}Created',
+      schemaVersion: 1,
+      source: '${name}',
+    },
+    {
+      data: {
+        contract: 'DataLifecycleChangeEventV1',
+      },
+      detailType: 'DataLifecycleChanged',
+      schemaVersion: 1,
+      source: '${name}',
+    },
+  ],
+  kind: 'ebk-event-contract-schema',
+  schemaVersion: 1,
+  slice: '${name}',
+} as const;
+`,
+        'database/schema.ts': `import { boolean, index, integer, jsonb, pgTable, primaryKey, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+
+export const records = pgTable(
+  'records',
+  {
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    id: uuid('id').defaultRandom().primaryKey(),
+    lastActivityAt: timestamp('last_activity_at', { withTimezone: true }).defaultNow().notNull(),
+    name: text('name').notNull(),
+    ownerId: text('owner_id').notNull(),
+    runScope: text('run_scope').notNull(),
+    testExpiresAt: timestamp('test_expires_at', { withTimezone: true }),
+  },
+  (table) => [
+    index('records_performance_expiry_idx').on(
+      table.ownerId,
+      table.name,
+      table.testExpiresAt,
+    ),
+    index('records_performance_run_scope_idx').on(
+      table.ownerId,
+      table.name,
+      table.runScope,
+    ),
+  ],
+);
+
+export const authorizationAudit = pgTable('authorization_audit', {
+  action: text('action').notNull(),
+  approvalReference: text('approval_reference'),
+  authorityMode: text('authority_mode').notNull(),
+  correlationId: text('correlation_id').notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  decision: text('decision').notNull(),
+  id: uuid('id').defaultRandom().primaryKey(),
+  policyVersion: text('policy_version').notNull(),
+  principalKind: text('principal_kind').notNull(),
+  pseudonymousSubjectId: text('pseudonymous_subject_id').notNull(),
+  reasonCategory: text('reason_category').notNull(),
+  delegationReference: text('delegation_reference'),
+  resourceReference: text('resource_reference'),
+  resourceType: text('resource_type').notNull(),
+  slice: text('slice').notNull(),
+  stage: text('stage').notNull(),
+  subjectType: text('subject_type').notNull(),
+});
+
+export const delegationGrants = pgTable('delegation_grants', {
+  capabilityDigest: text('capability_digest').notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+  grantJson: jsonb('grant_json').notNull(),
+  id: uuid('id').primaryKey(),
+  issuedAt: timestamp('issued_at', { withTimezone: true }).notNull(),
+  policyVersion: text('policy_version').notNull(),
+  revision: integer('revision').notNull(),
+  status: text('status').notNull(),
+});
+
+export const approvalRequests = pgTable('approval_requests', {
+  authorReference: text('author_reference').notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+  id: uuid('id').primaryKey(),
+  policyVersion: text('policy_version').notNull(),
+  requestJson: jsonb('request_json').notNull(),
+  requestDigest: text('request_digest').notNull(),
+  revision: integer('revision').notNull(),
+  status: text('status').notNull(),
+});
+
+export const dataLifecycleAudit = pgTable(
+  'data_lifecycle_audit',
+  {
+    action: text('action').notNull(),
+    actorRef: text('actor_ref').notNull(),
+    approvalReference: text('approval_reference'),
+    auditJson: jsonb('audit_json').notNull(),
+    authorityCode: text('authority_code').notNull(),
+    correlationRef: text('correlation_ref').notNull(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    id: uuid('id').defaultRandom().primaryKey(),
+    occurredAt: timestamp('occurred_at', { withTimezone: true }).notNull(),
+    outcome: text('outcome').notNull(),
+    policyVersion: text('policy_version').notNull(),
+    principalKind: text('principal_kind').notNull(),
+    purposeCode: text('purpose_code').notNull(),
+    resourceReference: text('resource_reference'),
+    slice: text('slice').notNull(),
+    stage: text('stage').notNull(),
+    subjectType: text('subject_type').notNull(),
+    targetCategoryId: text('target_category_id').notNull(),
+  },
+  (table) => [
+    index('data_lifecycle_audit_expires_at_idx').on(table.expiresAt),
+  ],
+);
+
+export const dataLifecycleExportArtifacts = pgTable(
+  'data_lifecycle_export_artifacts',
+  {
+    approvalRequestId: uuid('approval_request_id')
+      .primaryKey()
+      .references(() => approvalRequests.id, { onDelete: 'cascade' }),
+    artifactRef: text('artifact_ref'),
+    cleanupDeadlineAt: timestamp('cleanup_deadline_at', {
+      withTimezone: true,
+    }),
+    cleanupState: text('cleanup_state').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    currentVersionId: text('current_version_id'),
+    expiresAt: timestamp('expires_at', { withTimezone: true }),
+    lastErrorCode: text('last_error_code'),
+    objectKey: text('object_key').notNull(),
+    recordRef: text('record_ref').notNull(),
+    subjectRef: text('subject_ref').notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+    uploadStartedAt: timestamp('upload_started_at', { withTimezone: true }),
+  },
+  (table) => [
+    index('data_lifecycle_export_artifacts_subject_created_idx').on(
+      table.subjectRef,
+      table.createdAt,
+    ),
+    index('data_lifecycle_export_artifacts_cleanup_expiry_idx').on(
+      table.cleanupState,
+      table.expiresAt,
+    ),
+    index('data_lifecycle_export_artifacts_cleanup_deadline_idx').on(
+      table.cleanupState,
+      table.cleanupDeadlineAt,
+    ),
+  ],
+);
+
+export const dataLifecycleExportVersions = pgTable(
+  'data_lifecycle_export_versions',
+  {
+    approvalRequestId: uuid('approval_request_id')
+      .notNull()
+      .references(() => approvalRequests.id, { onDelete: 'cascade' }),
+    deletedAt: timestamp('deleted_at', { withTimezone: true }),
+    isDeleteMarker: boolean('is_delete_marker').notNull(),
+    objectKey: text('object_key').notNull(),
+    status: text('status').notNull(),
+    versionId: text('version_id').notNull(),
+  },
+  (table) => [
+    primaryKey({
+      columns: [table.approvalRequestId, table.versionId],
+    }),
+    index('data_lifecycle_export_versions_status_idx').on(table.status),
+  ],
+);
+
+export const cleanupDeadlineReportCapacity = pgTable(
+  'cleanup_deadline_report_capacity',
+  {
+    feature: text('feature').primaryKey(),
+    maximumPending: integer('maximum_pending').notNull(),
+  },
+);
+
+export const cleanupDeadlineReports = pgTable(
+  'cleanup_deadline_reports',
+  {
+    deadlineAt: timestamp('deadline_at', { withTimezone: true }).notNull(),
+    feature: text('feature').notNull(),
+    observedAt: timestamp('observed_at', { withTimezone: true })
+      .defaultNow()
+      .notNull(),
+    resourceRef: text('resource_ref').notNull(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.feature, table.resourceRef] }),
+    index('cleanup_deadline_reports_feature_observed_idx').on(
+      table.feature,
+      table.observedAt,
+    ),
+  ],
+);
+
+export const dataLifecycleLedger = pgTable('data_lifecycle_ledger', {
+  action: text('action').notNull(),
+  categoryId: text('category_id').notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  effectiveAt: timestamp('effective_at', { withTimezone: true }).notNull(),
+  entryId: text('entry_id').primaryKey(),
+  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+  idempotencyKey: text('idempotency_key').notNull().unique(),
+  policyVersion: text('policy_version').notNull(),
+  pseudonymousKey: text('pseudonymous_key').notNull(),
+});
+
+export const dataLifecycleRequests = pgTable('data_lifecycle_requests', {
+  approvalRequestId: uuid('approval_request_id').notNull().unique(),
+  id: uuid('id').primaryKey(),
+  requestJson: jsonb('request_json').notNull(),
+  revision: integer('revision').notNull(),
+  status: text('status').notNull(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+});
+
+export const dataLifecycleHolds = pgTable('data_lifecycle_holds', {
+  categoryId: text('category_id').notNull(),
+  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+  holdId: text('hold_id').primaryKey(),
+  holdJson: jsonb('hold_json').notNull(),
+  reviewAt: timestamp('review_at', { withTimezone: true }).notNull(),
+  scopeRef: text('scope_ref').notNull(),
+  status: text('status').notNull(),
+});
+
+export const dataLifecycleOutbox = pgTable('data_lifecycle_outbox', {
+  attempts: integer('attempts').default(0).notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  eventJson: jsonb('event_json').notNull(),
+  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+  idempotencyKey: text('idempotency_key').primaryKey(),
+  lastErrorCode: text('last_error_code'),
+  publishedAt: timestamp('published_at', { withTimezone: true }),
+});
+
+export const performanceLoadRuns = pgTable(
+  'performance_load_runs',
+  {
+    adapterId: text('adapter_id').notNull(),
+    cleanupStartedAt: timestamp('cleanup_started_at', {
+      withTimezone: true,
+    }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    maximumRequests: integer('maximum_requests').notNull(),
+    planDigest: text('plan_digest').primaryKey(),
+    releaseMaterialDigest: text('release_material_digest').notNull(),
+    runId: text('run_id').notNull(),
+    scenarioId: text('scenario_id').notNull(),
+    sourceCommit: text('source_commit').notNull(),
+    stage: text('stage').notNull(),
+  },
+  (table) => [
+    index('performance_load_runs_expires_at_idx').on(table.expiresAt),
+  ],
+);
+
+export const performanceLoadRequests = pgTable(
+  'performance_load_requests',
+  {
+    claimedAt: timestamp('claimed_at', { withTimezone: true })
+      .defaultNow()
+      .notNull(),
+    effectId: text('effect_id'),
+    planDigest: text('plan_digest').notNull(),
+    requestOrdinal: integer('request_ordinal').notNull(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.planDigest, table.requestOrdinal] }),
+  ],
+);
+
+export const performanceLoadAsyncEffects = pgTable(
+  'performance_load_async_effects',
+  {
+    createdAt: timestamp('created_at', { withTimezone: true })
+      .defaultNow()
+      .notNull(),
+    effectId: text('effect_id').primaryKey(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    planDigest: text('plan_digest').notNull(),
+    processedAt: timestamp('processed_at', { withTimezone: true }),
+    runId: text('run_id').notNull(),
+  },
+  (table) => [
+    index('performance_load_async_effects_expires_at_idx').on(
+      table.expiresAt,
+    ),
+    index('performance_load_async_effects_pending_idx').on(
+      table.processedAt,
+      table.expiresAt,
+    ),
+    index('performance_load_async_effects_run_idx').on(
+      table.planDigest,
+      table.runId,
+    ),
+  ],
+);
+
+export const ebkInbox = pgTable(
+  'ebk_inbox',
+  {
+    attempts: integer('attempts').default(0).notNull(),
+    completedAt: timestamp('completed_at', { withTimezone: true }),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    firstSeenAt: timestamp('first_seen_at', { withTimezone: true }).defaultNow().notNull(),
+    handlerId: text('handler_id').notNull(),
+    handlerVersion: text('handler_version').notNull(),
+    lastAttemptAt: timestamp('last_attempt_at', { withTimezone: true }).notNull(),
+    messageId: text('message_id').notNull(),
+    payloadDigest: text('payload_digest').notNull(),
+    resultReference: text('result_reference'),
+    status: text('status').notNull(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.handlerId, table.messageId] }),
+    index('ebk_inbox_expires_at_idx').on(table.expiresAt),
+  ],
+);
+
+export const dataLifecycleRetentionCandidates = pgTable(
+  'data_lifecycle_retention_candidates',
+  {
+    candidateOrder: text('candidate_order').notNull(),
+    dueAt: timestamp('due_at', { withTimezone: true }).notNull(),
+    recordId: uuid('record_id').notNull(),
+    recordRef: text('record_ref').notNull(),
+    runId: uuid('run_id').notNull(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.runId, table.candidateOrder] }),
+  ],
+);
+
+export const dataLifecycleRetentionRuns = pgTable('data_lifecycle_retention_runs', {
+  approvalRequestId: uuid('approval_request_id').unique(),
+  asOf: timestamp('as_of', { withTimezone: true }).notNull(),
+  checkpointJson: jsonb('checkpoint_json').notNull(),
+  completedAt: timestamp('completed_at', { withTimezone: true }),
+  countsJson: jsonb('counts_json').notNull(),
+  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+  id: uuid('id').primaryKey(),
+  planJson: jsonb('plan_json').notNull(),
+  policyVersion: text('policy_version').notNull(),
+  revision: integer('revision').notNull(),
+  status: text('status').notNull(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+});
+
+export const dataLifecycleReceipts = pgTable('data_lifecycle_receipts', {
+  action: text('action').notNull(),
+  occurredAt: timestamp('occurred_at', { withTimezone: true }).notNull(),
+  policyVersion: text('policy_version').notNull(),
+  pseudonymousKey: text('pseudonymous_key').notNull(),
+  receivedAt: timestamp('received_at', { withTimezone: true }).defaultNow().notNull(),
+  requestRef: text('request_ref').notNull(),
+  sourceSlice: text('source_slice').notNull(),
+}, (table) => [
+  primaryKey({
+    columns: [
+      table.sourceSlice,
+      table.pseudonymousKey,
+      table.action,
+      table.requestRef,
+    ],
+  }),
+]);
+
+export const dataLifecycleDownstreamCopies = pgTable(
+  'data_lifecycle_downstream_copies',
+  {
+    action: text('action').notNull(),
+    copyId: text('copy_id').notNull(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    holdRefs: jsonb('hold_refs').notNull(),
+    pseudonymousKey: text('pseudonymous_key').notNull(),
+    purpose: text('purpose').notNull(),
+    recipient: text('recipient').notNull(),
+    sourceSlice: text('source_slice').notNull(),
+    status: text('status').notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  },
+  (table) => [
+    primaryKey({
+      columns: [table.sourceSlice, table.pseudonymousKey, table.copyId],
+    }),
+  ],
+);
+`,
+        'secrets/declarations.ts': `import { databaseCredentialSecretSchema } from '@empire-builder-kit/runtime/database';
+import {
+  defineSecrets,
+  secret,
+  type DefinedSecrets,
+} from '@empire-builder-kit/runtime/secret-contract';
+
+const performanceLoadHmacKeys = secret.json<{
+  current: { id: string; secret: string };
+  previous?: { id: string; secret: string };
+}>({
+  validate(value): value is {
+    current: { id: string; secret: string };
+    previous?: { id: string; secret: string };
+  } {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+    const keys = value as Record<string, unknown>;
+    if (
+      Object.keys(keys).some(
+        (key) => key !== 'current' && key !== 'previous',
+      )
+    ) return false;
+    const validKey = (candidate: unknown) => {
+      if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
+        return false;
+      }
+      const record = candidate as Record<string, unknown>;
+      const secret =
+        typeof record.secret === 'string' ? record.secret : '';
+      const decoded = /^[A-Za-z0-9_-]{43}$/.test(secret)
+        ? Buffer.from(secret, 'base64url')
+        : Buffer.alloc(0);
+      return (
+        Object.keys(record).length === 2 &&
+        typeof record.id === 'string' &&
+        /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(record.id) &&
+        decoded.length === 32 &&
+        decoded.toString('base64url') === secret
+      );
+    };
+    return (
+      validKey(keys.current) &&
+      (keys.previous === undefined || validKey(keys.previous)) &&
+      (
+        keys.previous === undefined ||
+        (
+          (keys.previous as { id: string; secret: string }).id !==
+            (keys.current as { id: string; secret: string }).id &&
+          (keys.previous as { id: string; secret: string }).secret !==
+            (keys.current as { id: string; secret: string }).secret
+        )
+      )
+    );
+  },
+});
+
+const SecretDefinitions = {
+  ${pascalName}PerformanceLoadHmacKeys: {
+    cache: { freshTtlMs: 1_000, staleTtlMs: 0 },
+    owner: '${name}',
+    requiredStages: ['staging', 'production'],
+    retention: { mode: 'retain' },
+    rotation: {
+      mode: 'manual',
+      runbook: 'docs/runbooks/performance-capacity-cost.md',
+    },
+    source: 'operator',
+    value: performanceLoadHmacKeys,
+  },
+  ${pascalName}PrimaryDatabaseCredential: {
+    owner: '${name}',
+    requiredStages: ['development', 'staging', 'production'],
+    retention: { mode: 'retain' },
+    rotation: {
+      mode: 'manual',
+      runbook: 'docs/runbooks/database-credential-rotation.md',
+    },
+    source: 'database-bootstrap',
+    value: databaseCredentialSecretSchema,
+  },
+} as const;
+
+export const Secrets: DefinedSecrets<typeof SecretDefinitions> =
+  defineSecrets(SecretDefinitions);
+`,
+        'secrets/metadata.json': (0, built_in_plan_shared_js_1.json)({
+            declarations: [
+                {
+                    logicalName: `${pascalName}PerformanceLoadHmacKeys`,
+                    owner: name,
+                    requiredStages: ['staging', 'production'],
+                    rotation: { mode: 'manual' },
+                    source: 'operator',
+                    valueKind: 'json',
+                },
+                {
+                    logicalName: `${pascalName}PrimaryDatabaseCredential`,
+                    owner: name,
+                    requiredStages: ['development', 'staging', 'production'],
+                    rotation: { mode: 'manual' },
+                    source: 'database-bootstrap',
+                    valueKind: 'json',
+                },
+            ],
+            schemaVersion: 1,
+        }),
+        'docs/runbooks/database-credential-rotation.md': `# Database credential rotation
+
+The \`${pascalName}PrimaryDatabaseCredential\` value is generated and rotated
+inside AWS by the exact database bootstrap workflow. Never read, copy, pass, or
+write this value through an EBK deploy, CI input, SST output, source file, or
+operator-secret command.
+
+To rotate after an authentication failure, run the reviewed database migration
+workflow for the exact Slice and stage. The server-only resolver invalidates its
+cached value and retries one authentication failure against \`AWSCURRENT\`.
+Confirm the bootstrap and migration lifecycle records share their execution
+correlation, the runtime secret version is current, and the prior version can be
+restored before accepting the rotation.
+`,
+        'docs/runbooks/operator-secret-management.md': `# Operator secret management
+
+Operator-supplied deployed secrets use AWS Secrets Manager containers named
+\`ebk/<stage>/${name}/<logical-name>\`. The declaration in
+\`secrets/declarations.ts\` owns the typed runtime contract. Its value-free
+control-plane projection in \`secrets/metadata.json\` must carry the same
+logical name, owner, required stages, rotation mode, source, and value kind.
+Neither file may contain a value, placeholder, fallback, value hash, or
+provider credential.
+
+## Personal development value
+
+Only a human at a local interactive terminal may set or remove an
+operator-declared personal value:
+
+\`\`\`bash
+ebk secret set ${name} <logical-name>
+ebk secret remove ${name} <logical-name>
+\`\`\`
+
+The CLI derives the personal stage, reads the profile and Region saved by
+\`ebk dev configure\`, proves the current AWS account is the development
+Foundation account, and invokes the workspace-pinned SST CLI. Set accepts the
+value only through a hidden TTY prompt; remove requires a hidden confirmation.
+Neither command accepts a stage, profile, Region, value argument, environment
+value, file, fallback, or placeholder. Do not ask or permit an agent or CI job
+to invoke either command.
+
+## Development metadata
+
+Report first, using the exact development account profile and Region:
+
+\`\`\`bash
+pnpm nx run ${name}:secret-metadata --stage=development --profile=<profile> --region=<region>
+\`\`\`
+
+Review the complete report before explicitly adding \`--apply\`. Apply may
+create an empty container and repair owned EBK tags only. It cannot read or
+write a secret version, change a rotation label, or delete a secret.
+
+## Protected metadata
+
+Run the **Secret metadata** GitHub workflow from \`develop\` for staging or
+\`main\` for production. Select this exact Slice and choose \`report\` first.
+After review, dispatch \`apply\` from the same protected branch and
+environment. The workflow assumes the protected deploy role through OIDC,
+verifies the expected AWS account, and invokes the same value-blind Nx
+executor. Never add an application value to GitHub secrets or workflow input.
+
+The protected deploy role needs metadata-only authority for the Slice prefix:
+\`ListSecrets\`, \`DescribeSecret\`, \`CreateSecret\`, and \`TagResource\`.
+It must be denied \`BatchGetSecretValue\`, \`GetSecretValue\`,
+\`PutSecretValue\`, \`UpdateSecretVersionStage\`, \`DeleteSecret\`, and
+application deployment outside its separately reviewed deploy policy.
+Account-level role materialization remains an adopter responsibility.
+
+## Value ceremony
+
+After an empty container exists, a human secret operator enters or rotates the
+value through the approved hidden-input or provider-owned ceremony. Do not
+delegate this ceremony to an agent and do not pass a value through argv,
+source, a file, a ticket, a work marker, GitHub, logs, or evidence. Routine
+operator authority is write-only for exact approved paths and has no
+application or Foundation deployment authority. Value reads require a separate
+audited break-glass path.
+
+Run the report again and then deploy. Deployment performs only a read-only
+metadata preflight and refuses before SST mutation when a required container,
+\`AWSCURRENT\`, ownership tag, or rotation policy is invalid. Remove, unlock,
+retirement, and recovery do not depend on this preflight.
+`,
+        'database/migrations/0000_initial.sql': `CREATE TABLE IF NOT EXISTS "records" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "name" text NOT NULL,
+  "owner_id" text NOT NULL,
+  "run_scope" text NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "last_activity_at" timestamptz NOT NULL DEFAULT now(),
+  "test_expires_at" timestamptz
+);
+CREATE INDEX IF NOT EXISTS "records_performance_expiry_idx"
+  ON "records" ("owner_id", "name", "test_expires_at");
+CREATE INDEX IF NOT EXISTS "records_performance_run_scope_idx"
+  ON "records" ("owner_id", "name", "run_scope");
+
+CREATE TABLE IF NOT EXISTS "authorization_audit" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "action" text NOT NULL,
+  "approval_reference" text,
+  "authority_mode" text NOT NULL,
+  "correlation_id" text NOT NULL,
+  "decision" text NOT NULL,
+  "policy_version" text NOT NULL,
+  "principal_kind" text NOT NULL,
+  "pseudonymous_subject_id" text NOT NULL,
+  "reason_category" text NOT NULL,
+  "delegation_reference" text,
+  "resource_reference" text,
+  "resource_type" text NOT NULL,
+  "slice" text NOT NULL,
+  "stage" text NOT NULL,
+  "subject_type" text NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS "delegation_grants" (
+  "id" uuid PRIMARY KEY,
+  "capability_digest" text NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "expires_at" timestamptz NOT NULL,
+  "grant_json" jsonb NOT NULL,
+  "issued_at" timestamptz NOT NULL,
+  "policy_version" text NOT NULL,
+  "revision" integer NOT NULL,
+  "status" text NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "approval_requests" (
+  "id" uuid PRIMARY KEY,
+  "author_reference" text NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "expires_at" timestamptz NOT NULL,
+  "policy_version" text NOT NULL,
+  "request_json" jsonb NOT NULL,
+  "request_digest" text NOT NULL,
+  "revision" integer NOT NULL,
+  "status" text NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_audit" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "action" text NOT NULL,
+  "actor_ref" text NOT NULL,
+  "approval_reference" text,
+  "audit_json" jsonb NOT NULL,
+  "authority_code" text NOT NULL,
+  "correlation_ref" text NOT NULL,
+  "expires_at" timestamptz NOT NULL,
+  "outcome" text NOT NULL,
+  "policy_version" text NOT NULL,
+  "principal_kind" text NOT NULL,
+  "purpose_code" text NOT NULL,
+  "resource_reference" text,
+  "slice" text NOT NULL,
+  "stage" text NOT NULL,
+  "subject_type" text NOT NULL,
+  "target_category_id" text NOT NULL,
+  "occurred_at" timestamptz NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS "data_lifecycle_audit_expires_at_idx"
+  ON "data_lifecycle_audit" ("expires_at");
+
+CREATE OR REPLACE FUNCTION "ebk_prune_data_lifecycle_audit"(
+  "cutoff" timestamptz,
+  "batch_limit" integer
+) RETURNS integer
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, public
+AS $$
+DECLARE
+  deleted_count integer;
+  effective_cutoff timestamptz;
+BEGIN
+  IF batch_limit < 1 OR batch_limit > 1000 THEN
+    RAISE EXCEPTION 'audit prune batch is outside the reviewed bound';
+  END IF;
+  effective_cutoff := LEAST(cutoff, clock_timestamp());
+  WITH expired AS (
+    SELECT ctid FROM public.data_lifecycle_audit
+    WHERE expires_at <= effective_cutoff
+    ORDER BY expires_at, id
+    LIMIT batch_limit
+    FOR UPDATE SKIP LOCKED
+  )
+  DELETE FROM public.data_lifecycle_audit
+  WHERE ctid IN (SELECT ctid FROM expired);
+  GET DIAGNOSTICS deleted_count = ROW_COUNT;
+  RETURN deleted_count;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION "ebk_prune_authorization_audit"(
+  "cutoff" timestamptz,
+  "batch_limit" integer
+) RETURNS integer
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, public
+AS $$
+DECLARE
+  deleted_count integer;
+  effective_cutoff timestamptz;
+BEGIN
+  IF batch_limit < 1 OR batch_limit > 1000 THEN
+    RAISE EXCEPTION 'audit prune batch is outside the reviewed bound';
+  END IF;
+  effective_cutoff := LEAST(cutoff, clock_timestamp());
+  WITH expired AS (
+    SELECT ctid FROM public.authorization_audit
+    WHERE created_at <= effective_cutoff - INTERVAL '400 days'
+    ORDER BY created_at, id
+    LIMIT batch_limit
+    FOR UPDATE SKIP LOCKED
+  )
+  DELETE FROM public.authorization_audit
+  WHERE ctid IN (SELECT ctid FROM expired);
+  GET DIAGNOSTICS deleted_count = ROW_COUNT;
+  RETURN deleted_count;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION "ebk_prune_data_lifecycle_audit"(
+  timestamptz, integer
+) FROM PUBLIC;
+REVOKE ALL ON FUNCTION "ebk_prune_authorization_audit"(
+  timestamptz, integer
+) FROM PUBLIC;
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_export_artifacts" (
+  "approval_request_id" uuid PRIMARY KEY
+    REFERENCES "approval_requests" ("id") ON DELETE CASCADE,
+  "artifact_ref" text,
+  "cleanup_deadline_at" timestamptz,
+  "cleanup_state" text NOT NULL,
+  "current_version_id" text,
+  "expires_at" timestamptz,
+  "last_error_code" text,
+  "object_key" text NOT NULL,
+  "record_ref" text NOT NULL,
+  "subject_ref" text NOT NULL,
+  "upload_started_at" timestamptz,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS "data_lifecycle_export_artifacts_subject_created_idx"
+  ON "data_lifecycle_export_artifacts" ("subject_ref", "created_at");
+CREATE INDEX IF NOT EXISTS "data_lifecycle_export_artifacts_cleanup_expiry_idx"
+  ON "data_lifecycle_export_artifacts" ("cleanup_state", "expires_at");
+CREATE INDEX IF NOT EXISTS "data_lifecycle_export_artifacts_cleanup_deadline_idx"
+  ON "data_lifecycle_export_artifacts" ("cleanup_state", "cleanup_deadline_at");
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_export_versions" (
+  "approval_request_id" uuid NOT NULL
+    REFERENCES "approval_requests" ("id") ON DELETE CASCADE,
+  "version_id" text NOT NULL,
+  "object_key" text NOT NULL,
+  "is_delete_marker" boolean NOT NULL,
+  "status" text NOT NULL,
+  "deleted_at" timestamptz,
+  PRIMARY KEY ("approval_request_id", "version_id")
+);
+
+CREATE TABLE IF NOT EXISTS "cleanup_deadline_reports" (
+  "feature" text NOT NULL,
+  "resource_ref" text NOT NULL,
+  "deadline_at" timestamptz NOT NULL,
+  "observed_at" timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY ("feature", "resource_ref")
+);
+CREATE INDEX IF NOT EXISTS "cleanup_deadline_reports_feature_observed_idx"
+  ON "cleanup_deadline_reports" ("feature", "observed_at");
+
+CREATE TABLE IF NOT EXISTS "cleanup_deadline_report_capacity" (
+  "feature" text PRIMARY KEY,
+  "maximum_pending" integer NOT NULL
+);
+INSERT INTO "cleanup_deadline_report_capacity" ("feature", "maximum_pending")
+VALUES ('confidential-export', 1000)
+ON CONFLICT ("feature") DO NOTHING;
+
+CREATE INDEX IF NOT EXISTS "data_lifecycle_export_versions_status_idx"
+  ON "data_lifecycle_export_versions" ("status");
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_ledger" (
+  "entry_id" text PRIMARY KEY,
+  "action" text NOT NULL,
+  "category_id" text NOT NULL,
+  "effective_at" timestamptz NOT NULL,
+  "expires_at" timestamptz NOT NULL,
+  "idempotency_key" text NOT NULL UNIQUE,
+  "policy_version" text NOT NULL,
+  "pseudonymous_key" text NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_requests" (
+  "id" uuid PRIMARY KEY,
+  "approval_request_id" uuid NOT NULL UNIQUE,
+  "request_json" jsonb NOT NULL,
+  "revision" integer NOT NULL,
+  "status" text NOT NULL,
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_holds" (
+  "hold_id" text PRIMARY KEY,
+  "scope_ref" text NOT NULL,
+  "category_id" text NOT NULL,
+  "hold_json" jsonb NOT NULL,
+  "status" text NOT NULL,
+  "expires_at" timestamptz NOT NULL,
+  "review_at" timestamptz NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_outbox" (
+  "idempotency_key" text PRIMARY KEY,
+  "event_json" jsonb NOT NULL,
+  "published_at" timestamptz,
+  "attempts" integer NOT NULL DEFAULT 0,
+  "last_error_code" text,
+  "expires_at" timestamptz NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS "performance_load_runs" (
+  "plan_digest" text PRIMARY KEY,
+  "run_id" text NOT NULL,
+  "adapter_id" text NOT NULL,
+  "cleanup_started_at" timestamptz,
+  "scenario_id" text NOT NULL,
+  "stage" text NOT NULL,
+  "source_commit" text NOT NULL,
+  "release_material_digest" text NOT NULL,
+  "maximum_requests" integer NOT NULL,
+  "created_at" timestamptz NOT NULL,
+  "expires_at" timestamptz NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "performance_load_runs_expires_at_idx"
+  ON "performance_load_runs" ("expires_at");
+
+CREATE TABLE IF NOT EXISTS "performance_load_requests" (
+  "plan_digest" text NOT NULL,
+  "request_ordinal" integer NOT NULL,
+  "effect_id" text,
+  "claimed_at" timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY ("plan_digest", "request_ordinal")
+);
+
+CREATE TABLE IF NOT EXISTS "performance_load_async_effects" (
+  "effect_id" text PRIMARY KEY,
+  "plan_digest" text NOT NULL,
+  "run_id" text NOT NULL,
+  "processed_at" timestamptz,
+  "expires_at" timestamptz NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS "performance_load_async_effects_expires_at_idx"
+  ON "performance_load_async_effects" USING btree ("expires_at");
+CREATE INDEX "performance_load_async_effects_pending_idx"
+  ON "performance_load_async_effects" USING btree
+  ("processed_at", "expires_at");
+CREATE INDEX IF NOT EXISTS "performance_load_async_effects_run_idx"
+  ON "performance_load_async_effects" USING btree
+  ("plan_digest", "run_id");
+
+CREATE TABLE IF NOT EXISTS "ebk_inbox" (
+  "handler_id" text NOT NULL,
+  "handler_version" text NOT NULL,
+  "message_id" text NOT NULL,
+  "payload_digest" text NOT NULL,
+  "status" text NOT NULL,
+  "attempts" integer NOT NULL DEFAULT 0,
+  "result_reference" text,
+  "first_seen_at" timestamptz NOT NULL DEFAULT now(),
+  "last_attempt_at" timestamptz NOT NULL,
+  "completed_at" timestamptz,
+  "expires_at" timestamptz NOT NULL,
+  PRIMARY KEY ("handler_id", "message_id")
+);
+CREATE INDEX "ebk_inbox_expires_at_idx"
+  ON "ebk_inbox" USING btree ("expires_at");
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_retention_runs" (
+  "id" uuid PRIMARY KEY,
+  "approval_request_id" uuid UNIQUE,
+  "as_of" timestamptz NOT NULL,
+  "checkpoint_json" jsonb NOT NULL,
+  "completed_at" timestamptz,
+  "counts_json" jsonb NOT NULL,
+  "expires_at" timestamptz NOT NULL,
+  "plan_json" jsonb NOT NULL,
+  "policy_version" text NOT NULL,
+  "revision" integer NOT NULL,
+  "status" text NOT NULL,
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_retention_candidates" (
+  "run_id" uuid NOT NULL,
+  "candidate_order" text NOT NULL,
+  "record_id" uuid NOT NULL,
+  "record_ref" text NOT NULL,
+  "due_at" timestamptz NOT NULL,
+  PRIMARY KEY ("run_id", "candidate_order")
+);
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_receipts" (
+  "source_slice" text NOT NULL,
+  "pseudonymous_key" text NOT NULL,
+  "action" text NOT NULL,
+  "request_ref" text NOT NULL,
+  "policy_version" text NOT NULL,
+  "occurred_at" timestamptz NOT NULL,
+  "received_at" timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY ("source_slice", "pseudonymous_key", "action", "request_ref")
+);
+
+CREATE TABLE IF NOT EXISTS "data_lifecycle_downstream_copies" (
+  "source_slice" text NOT NULL,
+  "pseudonymous_key" text NOT NULL,
+  "copy_id" text NOT NULL,
+  "recipient" text NOT NULL,
+  "purpose" text NOT NULL,
+  "expires_at" timestamptz NOT NULL,
+  "action" text NOT NULL,
+  "hold_refs" jsonb NOT NULL,
+  "status" text NOT NULL,
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY ("source_slice", "pseudonymous_key", "copy_id")
+);
+`,
+        'database/migrations/meta/_journal.json': (0, built_in_plan_shared_js_1.json)({
+            dialect: 'postgresql',
+            entries: [
+                {
+                    idx: 0,
+                    tag: '0000_initial',
+                    version: '7',
+                    when: 0,
+                    breakpoints: true,
+                },
+            ],
+            version: '7',
+        }),
+        'database/migrations/meta/0000_snapshot.json': (0, built_in_plan_shared_js_1.json)({
+            id: 'fdcf5ce3-ada5-44bf-bd9e-e01f2abe3bc4',
+            prevId: '00000000-0000-0000-0000-000000000000',
+            version: '7',
+            dialect: 'postgresql',
+            tables: {
+                'public.approval_requests': snapshotTable('approval_requests', {
+                    author_reference: snapshotColumn('author_reference', 'text'),
+                    created_at: snapshotColumn('created_at', 'timestamp with time zone', {
+                        default: 'now()',
+                    }),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    id: snapshotColumn('id', 'uuid', { primaryKey: true }),
+                    policy_version: snapshotColumn('policy_version', 'text'),
+                    request_digest: snapshotColumn('request_digest', 'text'),
+                    request_json: snapshotColumn('request_json', 'jsonb'),
+                    revision: snapshotColumn('revision', 'integer'),
+                    status: snapshotColumn('status', 'text'),
+                }),
+                'public.authorization_audit': snapshotTable('authorization_audit', {
+                    action: snapshotColumn('action', 'text'),
+                    approval_reference: snapshotColumn('approval_reference', 'text', {
+                        notNull: false,
+                    }),
+                    authority_mode: snapshotColumn('authority_mode', 'text'),
+                    correlation_id: snapshotColumn('correlation_id', 'text'),
+                    created_at: snapshotColumn('created_at', 'timestamp with time zone', {
+                        default: 'now()',
+                    }),
+                    decision: snapshotColumn('decision', 'text'),
+                    id: snapshotColumn('id', 'uuid', {
+                        default: 'gen_random_uuid()',
+                        primaryKey: true,
+                    }),
+                    policy_version: snapshotColumn('policy_version', 'text'),
+                    principal_kind: snapshotColumn('principal_kind', 'text'),
+                    pseudonymous_subject_id: snapshotColumn('pseudonymous_subject_id', 'text'),
+                    reason_category: snapshotColumn('reason_category', 'text'),
+                    delegation_reference: snapshotColumn('delegation_reference', 'text', {
+                        notNull: false,
+                    }),
+                    resource_reference: snapshotColumn('resource_reference', 'text', {
+                        notNull: false,
+                    }),
+                    resource_type: snapshotColumn('resource_type', 'text'),
+                    slice: snapshotColumn('slice', 'text'),
+                    stage: snapshotColumn('stage', 'text'),
+                    subject_type: snapshotColumn('subject_type', 'text'),
+                }),
+                'public.data_lifecycle_audit': snapshotTable('data_lifecycle_audit', {
+                    action: snapshotColumn('action', 'text'),
+                    actor_ref: snapshotColumn('actor_ref', 'text'),
+                    approval_reference: snapshotColumn('approval_reference', 'text', {
+                        notNull: false,
+                    }),
+                    audit_json: snapshotColumn('audit_json', 'jsonb'),
+                    authority_code: snapshotColumn('authority_code', 'text'),
+                    correlation_ref: snapshotColumn('correlation_ref', 'text'),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    id: snapshotColumn('id', 'uuid', {
+                        default: 'gen_random_uuid()',
+                        primaryKey: true,
+                    }),
+                    occurred_at: snapshotColumn('occurred_at', 'timestamp with time zone'),
+                    outcome: snapshotColumn('outcome', 'text'),
+                    policy_version: snapshotColumn('policy_version', 'text'),
+                    principal_kind: snapshotColumn('principal_kind', 'text'),
+                    purpose_code: snapshotColumn('purpose_code', 'text'),
+                    resource_reference: snapshotColumn('resource_reference', 'text', {
+                        notNull: false,
+                    }),
+                    slice: snapshotColumn('slice', 'text'),
+                    stage: snapshotColumn('stage', 'text'),
+                    subject_type: snapshotColumn('subject_type', 'text'),
+                    target_category_id: snapshotColumn('target_category_id', 'text'),
+                }, {}, {}, {
+                    data_lifecycle_audit_expires_at_idx: snapshotIndex('data_lifecycle_audit_expires_at_idx', [{ expression: 'expires_at', opclass: 'timestamptz_ops' }]),
+                }),
+                'public.data_lifecycle_export_artifacts': snapshotTable('data_lifecycle_export_artifacts', {
+                    approval_request_id: snapshotColumn('approval_request_id', 'uuid', {
+                        primaryKey: true,
+                    }),
+                    artifact_ref: snapshotColumn('artifact_ref', 'text', {
+                        notNull: false,
+                    }),
+                    cleanup_deadline_at: snapshotColumn('cleanup_deadline_at', 'timestamp with time zone', { notNull: false }),
+                    cleanup_state: snapshotColumn('cleanup_state', 'text'),
+                    created_at: snapshotColumn('created_at', 'timestamp with time zone', { default: 'now()' }),
+                    current_version_id: snapshotColumn('current_version_id', 'text', {
+                        notNull: false,
+                    }),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone', { notNull: false }),
+                    last_error_code: snapshotColumn('last_error_code', 'text', {
+                        notNull: false,
+                    }),
+                    object_key: snapshotColumn('object_key', 'text'),
+                    record_ref: snapshotColumn('record_ref', 'text'),
+                    subject_ref: snapshotColumn('subject_ref', 'text'),
+                    updated_at: snapshotColumn('updated_at', 'timestamp with time zone', { default: 'now()' }),
+                    upload_started_at: snapshotColumn('upload_started_at', 'timestamp with time zone', { notNull: false }),
+                }, {}, {}, {
+                    data_lifecycle_export_artifacts_cleanup_deadline_idx: snapshotIndex('data_lifecycle_export_artifacts_cleanup_deadline_idx', [
+                        { expression: 'cleanup_state', opclass: 'text_ops' },
+                        {
+                            expression: 'cleanup_deadline_at',
+                            opclass: 'timestamptz_ops',
+                        },
+                    ]),
+                    data_lifecycle_export_artifacts_cleanup_expiry_idx: snapshotIndex('data_lifecycle_export_artifacts_cleanup_expiry_idx', [
+                        { expression: 'cleanup_state', opclass: 'text_ops' },
+                        { expression: 'expires_at', opclass: 'timestamptz_ops' },
+                    ]),
+                    data_lifecycle_export_artifacts_subject_created_idx: snapshotIndex('data_lifecycle_export_artifacts_subject_created_idx', [
+                        { expression: 'subject_ref', opclass: 'text_ops' },
+                        { expression: 'created_at', opclass: 'timestamptz_ops' },
+                    ]),
+                }, {
+                    data_lifecycle_export_artifacts_approval_request_id_approval_requests_id_fk: {
+                        columnsFrom: ['approval_request_id'],
+                        columnsTo: ['id'],
+                        name: 'data_lifecycle_export_artifacts_approval_request_id_approval_requests_id_fk',
+                        onDelete: 'cascade',
+                        onUpdate: 'no action',
+                        tableFrom: 'data_lifecycle_export_artifacts',
+                        tableTo: 'approval_requests',
+                    },
+                }),
+                'public.cleanup_deadline_report_capacity': snapshotTable('cleanup_deadline_report_capacity', {
+                    feature: snapshotColumn('feature', 'text', { primaryKey: true }),
+                    maximum_pending: snapshotColumn('maximum_pending', 'integer'),
+                }),
+                'public.cleanup_deadline_reports': snapshotTable('cleanup_deadline_reports', {
+                    deadline_at: snapshotColumn('deadline_at', 'timestamp with time zone'),
+                    feature: snapshotColumn('feature', 'text'),
+                    observed_at: snapshotColumn('observed_at', 'timestamp with time zone', { default: 'now()' }),
+                    resource_ref: snapshotColumn('resource_ref', 'text'),
+                }, {}, {
+                    cleanup_deadline_reports_feature_resource_ref_pk: {
+                        columns: ['feature', 'resource_ref'],
+                        name: 'cleanup_deadline_reports_feature_resource_ref_pk',
+                    },
+                }, {
+                    cleanup_deadline_reports_feature_observed_idx: snapshotIndex('cleanup_deadline_reports_feature_observed_idx', [
+                        { expression: 'feature', opclass: 'text_ops' },
+                        {
+                            expression: 'observed_at',
+                            opclass: 'timestamptz_ops',
+                        },
+                    ]),
+                }),
+                'public.data_lifecycle_export_versions': snapshotTable('data_lifecycle_export_versions', {
+                    approval_request_id: snapshotColumn('approval_request_id', 'uuid'),
+                    deleted_at: snapshotColumn('deleted_at', 'timestamp with time zone', { notNull: false }),
+                    is_delete_marker: snapshotColumn('is_delete_marker', 'boolean'),
+                    object_key: snapshotColumn('object_key', 'text'),
+                    status: snapshotColumn('status', 'text'),
+                    version_id: snapshotColumn('version_id', 'text'),
+                }, {}, {
+                    data_lifecycle_export_versions_approval_request_id_version_id_pk: {
+                        columns: ['approval_request_id', 'version_id'],
+                        name: 'data_lifecycle_export_versions_approval_request_id_version_id_pk',
+                    },
+                }, {
+                    data_lifecycle_export_versions_status_idx: snapshotIndex('data_lifecycle_export_versions_status_idx', [{ expression: 'status', opclass: 'text_ops' }]),
+                }, {
+                    data_lifecycle_export_versions_approval_request_id_approval_requests_id_fk: {
+                        columnsFrom: ['approval_request_id'],
+                        columnsTo: ['id'],
+                        name: 'data_lifecycle_export_versions_approval_request_id_approval_requests_id_fk',
+                        onDelete: 'cascade',
+                        onUpdate: 'no action',
+                        tableFrom: 'data_lifecycle_export_versions',
+                        tableTo: 'approval_requests',
+                    },
+                }),
+                'public.data_lifecycle_ledger': snapshotTable('data_lifecycle_ledger', {
+                    action: snapshotColumn('action', 'text'),
+                    category_id: snapshotColumn('category_id', 'text'),
+                    created_at: snapshotColumn('created_at', 'timestamp with time zone', { default: 'now()' }),
+                    effective_at: snapshotColumn('effective_at', 'timestamp with time zone'),
+                    entry_id: snapshotColumn('entry_id', 'text', {
+                        primaryKey: true,
+                    }),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    idempotency_key: snapshotColumn('idempotency_key', 'text'),
+                    policy_version: snapshotColumn('policy_version', 'text'),
+                    pseudonymous_key: snapshotColumn('pseudonymous_key', 'text'),
+                }, {
+                    data_lifecycle_ledger_idempotency_key_unique: {
+                        columns: ['idempotency_key'],
+                        name: 'data_lifecycle_ledger_idempotency_key_unique',
+                        nullsNotDistinct: false,
+                    },
+                }),
+                'public.data_lifecycle_downstream_copies': snapshotTable('data_lifecycle_downstream_copies', {
+                    action: snapshotColumn('action', 'text'),
+                    copy_id: snapshotColumn('copy_id', 'text'),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    hold_refs: snapshotColumn('hold_refs', 'jsonb'),
+                    pseudonymous_key: snapshotColumn('pseudonymous_key', 'text'),
+                    purpose: snapshotColumn('purpose', 'text'),
+                    recipient: snapshotColumn('recipient', 'text'),
+                    source_slice: snapshotColumn('source_slice', 'text'),
+                    status: snapshotColumn('status', 'text'),
+                    updated_at: snapshotColumn('updated_at', 'timestamp with time zone', { default: 'now()' }),
+                }, {}, {
+                    data_lifecycle_downstream_copies_source_slice_pseudonymous_key_copy_id_pk: {
+                        columns: ['source_slice', 'pseudonymous_key', 'copy_id'],
+                        name: 'data_lifecycle_downstream_copies_source_slice_pseudonymous_key_copy_id_pk',
+                    },
+                }),
+                'public.data_lifecycle_holds': snapshotTable('data_lifecycle_holds', {
+                    category_id: snapshotColumn('category_id', 'text'),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    hold_id: snapshotColumn('hold_id', 'text', { primaryKey: true }),
+                    hold_json: snapshotColumn('hold_json', 'jsonb'),
+                    review_at: snapshotColumn('review_at', 'timestamp with time zone'),
+                    scope_ref: snapshotColumn('scope_ref', 'text'),
+                    status: snapshotColumn('status', 'text'),
+                }),
+                'public.data_lifecycle_outbox': snapshotTable('data_lifecycle_outbox', {
+                    attempts: snapshotColumn('attempts', 'integer', { default: '0' }),
+                    created_at: snapshotColumn('created_at', 'timestamp with time zone', {
+                        default: 'now()',
+                    }),
+                    event_json: snapshotColumn('event_json', 'jsonb'),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    idempotency_key: snapshotColumn('idempotency_key', 'text', {
+                        primaryKey: true,
+                    }),
+                    last_error_code: snapshotColumn('last_error_code', 'text', {
+                        notNull: false,
+                    }),
+                    published_at: snapshotColumn('published_at', 'timestamp with time zone', { notNull: false }),
+                }),
+                'public.performance_load_runs': snapshotTable('performance_load_runs', {
+                    adapter_id: snapshotColumn('adapter_id', 'text'),
+                    cleanup_started_at: snapshotColumn('cleanup_started_at', 'timestamp with time zone', { notNull: false }),
+                    created_at: snapshotColumn('created_at', 'timestamp with time zone'),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    maximum_requests: snapshotColumn('maximum_requests', 'integer'),
+                    plan_digest: snapshotColumn('plan_digest', 'text', {
+                        primaryKey: true,
+                    }),
+                    release_material_digest: snapshotColumn('release_material_digest', 'text'),
+                    run_id: snapshotColumn('run_id', 'text'),
+                    scenario_id: snapshotColumn('scenario_id', 'text'),
+                    source_commit: snapshotColumn('source_commit', 'text'),
+                    stage: snapshotColumn('stage', 'text'),
+                }, {}, {}, {
+                    performance_load_runs_expires_at_idx: snapshotIndex('performance_load_runs_expires_at_idx', [
+                        {
+                            expression: 'expires_at',
+                            opclass: 'timestamptz_ops',
+                        },
+                    ]),
+                }),
+                'public.performance_load_requests': snapshotTable('performance_load_requests', {
+                    claimed_at: snapshotColumn('claimed_at', 'timestamp with time zone', { default: 'now()' }),
+                    effect_id: snapshotColumn('effect_id', 'text', {
+                        notNull: false,
+                    }),
+                    plan_digest: snapshotColumn('plan_digest', 'text'),
+                    request_ordinal: snapshotColumn('request_ordinal', 'integer'),
+                }, {}, {
+                    performance_load_requests_plan_digest_request_ordinal_pk: {
+                        columns: ['plan_digest', 'request_ordinal'],
+                        name: 'performance_load_requests_plan_digest_request_ordinal_pk',
+                    },
+                }),
+                'public.performance_load_async_effects': snapshotTable('performance_load_async_effects', {
+                    created_at: snapshotColumn('created_at', 'timestamp with time zone', { default: 'now()' }),
+                    effect_id: snapshotColumn('effect_id', 'text', {
+                        primaryKey: true,
+                    }),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    plan_digest: snapshotColumn('plan_digest', 'text'),
+                    processed_at: snapshotColumn('processed_at', 'timestamp with time zone', { notNull: false }),
+                    run_id: snapshotColumn('run_id', 'text'),
+                }, {}, {}, {
+                    performance_load_async_effects_expires_at_idx: snapshotIndex('performance_load_async_effects_expires_at_idx', [
+                        {
+                            expression: 'expires_at',
+                            opclass: 'timestamptz_ops',
+                        },
+                    ]),
+                    performance_load_async_effects_pending_idx: snapshotIndex('performance_load_async_effects_pending_idx', [
+                        {
+                            expression: 'processed_at',
+                            opclass: 'timestamptz_ops',
+                        },
+                        {
+                            expression: 'expires_at',
+                            opclass: 'timestamptz_ops',
+                        },
+                    ]),
+                    performance_load_async_effects_run_idx: snapshotIndex('performance_load_async_effects_run_idx', [
+                        {
+                            expression: 'plan_digest',
+                            opclass: 'text_ops',
+                        },
+                        {
+                            expression: 'run_id',
+                            opclass: 'text_ops',
+                        },
+                    ]),
+                }),
+                'public.ebk_inbox': snapshotTable('ebk_inbox', {
+                    attempts: snapshotColumn('attempts', 'integer', { default: '0' }),
+                    completed_at: snapshotColumn('completed_at', 'timestamp with time zone', { notNull: false }),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    first_seen_at: snapshotColumn('first_seen_at', 'timestamp with time zone', { default: 'now()' }),
+                    handler_id: snapshotColumn('handler_id', 'text'),
+                    handler_version: snapshotColumn('handler_version', 'text'),
+                    last_attempt_at: snapshotColumn('last_attempt_at', 'timestamp with time zone'),
+                    message_id: snapshotColumn('message_id', 'text'),
+                    payload_digest: snapshotColumn('payload_digest', 'text'),
+                    result_reference: snapshotColumn('result_reference', 'text', {
+                        notNull: false,
+                    }),
+                    status: snapshotColumn('status', 'text'),
+                }, {}, {
+                    ebk_inbox_handler_id_message_id_pk: {
+                        columns: ['handler_id', 'message_id'],
+                        name: 'ebk_inbox_handler_id_message_id_pk',
+                    },
+                }, {
+                    ebk_inbox_expires_at_idx: snapshotIndex('ebk_inbox_expires_at_idx', [
+                        {
+                            expression: 'expires_at',
+                            opclass: 'timestamptz_ops',
+                        },
+                    ]),
+                }),
+                'public.data_lifecycle_requests': snapshotTable('data_lifecycle_requests', {
+                    approval_request_id: snapshotColumn('approval_request_id', 'uuid'),
+                    id: snapshotColumn('id', 'uuid', { primaryKey: true }),
+                    request_json: snapshotColumn('request_json', 'jsonb'),
+                    revision: snapshotColumn('revision', 'integer'),
+                    status: snapshotColumn('status', 'text'),
+                    updated_at: snapshotColumn('updated_at', 'timestamp with time zone', { default: 'now()' }),
+                }, {
+                    data_lifecycle_requests_approval_request_id_unique: {
+                        columns: ['approval_request_id'],
+                        name: 'data_lifecycle_requests_approval_request_id_unique',
+                        nullsNotDistinct: false,
+                    },
+                }),
+                'public.data_lifecycle_receipts': snapshotTable('data_lifecycle_receipts', {
+                    action: snapshotColumn('action', 'text'),
+                    occurred_at: snapshotColumn('occurred_at', 'timestamp with time zone'),
+                    policy_version: snapshotColumn('policy_version', 'text'),
+                    pseudonymous_key: snapshotColumn('pseudonymous_key', 'text'),
+                    received_at: snapshotColumn('received_at', 'timestamp with time zone', { default: 'now()' }),
+                    request_ref: snapshotColumn('request_ref', 'text'),
+                    source_slice: snapshotColumn('source_slice', 'text'),
+                }, {}, {
+                    data_lifecycle_receipts_source_slice_pseudonymous_key_action_request_ref_pk: {
+                        columns: [
+                            'source_slice',
+                            'pseudonymous_key',
+                            'action',
+                            'request_ref',
+                        ],
+                        name: 'data_lifecycle_receipts_source_slice_pseudonymous_key_action_request_ref_pk',
+                    },
+                }),
+                'public.data_lifecycle_retention_runs': snapshotTable('data_lifecycle_retention_runs', {
+                    approval_request_id: snapshotColumn('approval_request_id', 'uuid', {
+                        notNull: false,
+                    }),
+                    as_of: snapshotColumn('as_of', 'timestamp with time zone'),
+                    checkpoint_json: snapshotColumn('checkpoint_json', 'jsonb'),
+                    completed_at: snapshotColumn('completed_at', 'timestamp with time zone', { notNull: false }),
+                    counts_json: snapshotColumn('counts_json', 'jsonb'),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    id: snapshotColumn('id', 'uuid', { primaryKey: true }),
+                    plan_json: snapshotColumn('plan_json', 'jsonb'),
+                    policy_version: snapshotColumn('policy_version', 'text'),
+                    revision: snapshotColumn('revision', 'integer'),
+                    status: snapshotColumn('status', 'text'),
+                    updated_at: snapshotColumn('updated_at', 'timestamp with time zone', { default: 'now()' }),
+                }, {
+                    data_lifecycle_retention_runs_approval_request_id_unique: {
+                        columns: ['approval_request_id'],
+                        name: 'data_lifecycle_retention_runs_approval_request_id_unique',
+                        nullsNotDistinct: false,
+                    },
+                }),
+                'public.data_lifecycle_retention_candidates': snapshotTable('data_lifecycle_retention_candidates', {
+                    candidate_order: snapshotColumn('candidate_order', 'text'),
+                    due_at: snapshotColumn('due_at', 'timestamp with time zone'),
+                    record_id: snapshotColumn('record_id', 'uuid'),
+                    record_ref: snapshotColumn('record_ref', 'text'),
+                    run_id: snapshotColumn('run_id', 'uuid'),
+                }, {}, {
+                    data_lifecycle_retention_candidates_run_id_candidate_order_pk: {
+                        columns: ['run_id', 'candidate_order'],
+                        name: 'data_lifecycle_retention_candidates_run_id_candidate_order_pk',
+                    },
+                }),
+                'public.delegation_grants': snapshotTable('delegation_grants', {
+                    capability_digest: snapshotColumn('capability_digest', 'text'),
+                    created_at: snapshotColumn('created_at', 'timestamp with time zone', {
+                        default: 'now()',
+                    }),
+                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
+                    grant_json: snapshotColumn('grant_json', 'jsonb'),
+                    id: snapshotColumn('id', 'uuid', { primaryKey: true }),
+                    issued_at: snapshotColumn('issued_at', 'timestamp with time zone'),
+                    policy_version: snapshotColumn('policy_version', 'text'),
+                    revision: snapshotColumn('revision', 'integer'),
+                    status: snapshotColumn('status', 'text'),
+                }),
+                'public.records': snapshotTable('records', {
+                    created_at: snapshotColumn('created_at', 'timestamp with time zone', {
+                        default: 'now()',
+                    }),
+                    id: snapshotColumn('id', 'uuid', {
+                        default: 'gen_random_uuid()',
+                        primaryKey: true,
+                    }),
+                    last_activity_at: snapshotColumn('last_activity_at', 'timestamp with time zone', { default: 'now()' }),
+                    name: snapshotColumn('name', 'text'),
+                    owner_id: snapshotColumn('owner_id', 'text'),
+                    run_scope: snapshotColumn('run_scope', 'text'),
+                    test_expires_at: snapshotColumn('test_expires_at', 'timestamp with time zone', { notNull: false }),
+                }, {}, {}, {
+                    records_performance_expiry_idx: snapshotIndex('records_performance_expiry_idx', [
+                        { expression: 'owner_id', opclass: 'text_ops' },
+                        { expression: 'name', opclass: 'text_ops' },
+                        {
+                            expression: 'test_expires_at',
+                            opclass: 'timestamptz_ops',
+                        },
+                    ]),
+                    records_performance_run_scope_idx: snapshotIndex('records_performance_run_scope_idx', [
+                        { expression: 'owner_id', opclass: 'text_ops' },
+                        { expression: 'name', opclass: 'text_ops' },
+                        { expression: 'run_scope', opclass: 'text_ops' },
+                    ]),
+                }),
+            },
+            enums: {},
+            schemas: {},
+            sequences: {},
+            roles: {},
+            policies: {},
+            views: {},
+            _meta: { columns: {}, schemas: {}, tables: {} },
+        }),
+        'database/drizzle.config.ts': `import { createDatabaseBindingPlan, resolveLocalDatabaseContract } from '@empire-builder-kit/nx/foundation';
+import { defineConfig } from 'drizzle-kit';
+import databaseBindings from './bindings.json';
+
+const plan = createDatabaseBindingPlan(databaseBindings, {
+  slice: '${name}',
+  stage: 'development',
+});
+const activeDatabase = plan.active.primary;
+if (!activeDatabase) throw new Error('Database binding "primary" is required.');
+const localDatabase = resolveLocalDatabaseContract({
+  database: activeDatabase,
+  slice: '${name}',
+});
+
+export default defineConfig({
+  dbCredentials: {
+    url: process.env.DATABASE_URL ?? \`postgresql://\${localDatabase.username}:\${localDatabase.password}@\${localDatabase.host}:\${localDatabase.port}/\${localDatabase.database}\`,
+  },
+  dialect: 'postgresql',
+  out: './database/migrations',
+  schema: './database/schema.ts',
+});
+`,
+        'database/docker-compose.yml': `services:
+  database:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_DB: \${EBK_LOCAL_DATABASE}
+      POSTGRES_PASSWORD: \${EBK_LOCAL_DATABASE_PASSWORD}
+      POSTGRES_USER: \${EBK_LOCAL_DATABASE_USERNAME}
+    healthcheck:
+      test: [CMD-SHELL, "pg_isready -U \${EBK_LOCAL_DATABASE_USERNAME} -d \${EBK_LOCAL_DATABASE}"]
+      interval: 2s
+      timeout: 3s
+      retries: 15
+    ports:
+      - '\${EBK_LOCAL_DATABASE_PORT}:5432'
+    volumes:
+      - database-data:/var/lib/postgresql/data
+
+volumes:
+  database-data:
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-data-files.js.map