@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-infrastructure-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-infrastructure-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-infrastructure-files.ts"],"names":[],"mappings":";;AAMA,4EA29FC;AAj+FD,uEAGmC;AAEnC,gBAAgB;AAChB,SAAgB,gCAAgC,CAC9C,IAAY,EACZ,UAAkB,EAClB,SAAiB;IAEjB,MAAM,gBAAgB,GAAG,IAAA,8CAAoB,EAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,wBAAwB,GAAG,IAAA,6CAAmB,EAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/D,OAAO;QACL,6CAA6C,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6ErC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4EjB;QACG,kBAAkB,EAAE;;;;;;;;;;;;;;;;IAgBpB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;;;;;;;;;;;;;;;;;;iBAkBH,UAAU;;;;;;;iBAOV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2DAsCgC,IAAI;;;;;;;;;;;;;2BAapC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA4Df,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAiCN,IAAI;;kBAEA,SAAS;;;;;;;;;;;;cAYb,IAAI;cACJ,IAAI;;;cAGJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyEX,UAAU;;;;;oCAKmB,IAAI;;;;;;;;;;;;;6BAaX,UAAU;;;;;6BAKV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAkCpB,IAAI;;;8BAGO,IAAI;;;;;;mBAMf,IAAI;;;8BAGO,IAAI;;;;;;mBAMf,IAAI;;;;8BAIO,IAAI;;;;;;;;;;;;;0CAaQ,UAAU;;;;;kBAKlC,SAAS;;;;cAIb,IAAI;;;;sDAIoC,UAAU;;;;;;;;;;;;OAYzD,UAAU;;;;;OAKV,UAAU;;;;;;;;;;;;;sBAaK,IAAI;;0BAEA,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;OA0B5B,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;OAKV,UAAU;;;;;0CAKyB,UAAU;;;;;;aAMvC,UAAU;;;;;;;;;;6CAUsB,UAAU;;;;;sDAKD,IAAI;;;;;;;;;;;;;;;;;;cAkB5C,gBAAgB,yBAAyB,gBAAgB;;;;;;;;;;;MAWjE,gBAAgB;;QAEd,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;mBAuBL,gBAAgB;;;;mBAIhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;;;;;;;;;;;;;;;;;;;mBAsBhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAgChB,gBAAgB;;;;mBAIhB,gBAAgB;;;;;;;;;;;;;;;;;;;;MAoB7B,gBAAgB;;QAEd,gBAAgB;;;;;;;;;;;;;;;;;;MAkBlB,gBAAgB;;QAEd,gBAAgB;;;;;;;;;;;;;;;;;;;;mBAoBL,gBAAgB;;;;mBAIhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA2BhB,gBAAgB;;;;mBAIhB,gBAAgB;;;;;;;;;;;;;;;;;;;;MAoB7B,gBAAgB;;QAEd,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;OAuBjB,UAAU;;;;;;;;;wCASuB,gBAAgB;;;;;;;;;OASjD,UAAU;;;;;;;;;;kCAUiB,IAAI;;;;;;;;;;;;;OAa/B,UAAU;;;;;;;;;;;wBAWO,IAAI;;;;;;OAMrB,UAAU;;;;;;;;;OASV,UAAU;;;;;;;;;;;;;;SAcR,UAAU;;;;;;;;;;wCAUqB,UAAU;;;;;;;;;;0CAUR,UAAU;;;;;;;;;;;;;OAa7C,UAAU;;;;;;;;;;;wBAWO,IAAI;;;;;;;;;;;;gCAYI,IAAI;;;;;;;;;;;;;;OAc7B,UAAU;;;;;wBAKO,UAAU;oBACd,IAAI;;;;;OAKjB,UAAU;;;;;;;;;;;;iBAYA,UAAU;;;cAGb,IAAI;;;;;;qDAMmC,UAAU;;;;;;;aAOlD,IAAI;;;;;;;;;;;;OAYV,UAAU;;;;;;;;;;4BAUW,IAAI;;;;;;;2CAOW,UAAU;;;;;;;;;0BAS3B,IAAI;;;;;;6CAMe,UAAU;;;;;;;;;;0BAU7B,IAAI;;;;;;;8BAOA,UAAU;;;;;;;;;;OAUjC,UAAU;;;;;;;;;;;;eAYF,IAAI;;;;;;;;;OASZ,UAAU;;;;;;;;;;;;eAYF,IAAI;;;;;;;;;;;aAWN,UAAU;;4BAEK,IAAI;yBACP,IAAI;;8BAEC,IAAI;;;;;;aAMrB,UAAU;;;;iBAIN,IAAI;;;;;;;;;;;;;;8BAcS,IAAI;;;;;;aAMrB,UAAU;;;;;;8BAMO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAiDrB,UAAU;;;;;;;iBAON,IAAI;;;;;;eAMN,UAAU;;;;mBAIN,IAAI;;;;;uBAKA,IAAI;;;gCAGK,IAAI;;;;;;aAMvB,UAAU;;;;;;;iBAON,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCAuCe,IAAI;4BACZ,SAAS;;;;;;;;;;;;;;;;;;;;;;;uBAuBd,IAAI;;;;;kCAKO,IAAI;0BACZ,SAAS;;;;;;;;;;;;OAY5B,UAAU;;;;;kCAKiB,IAAI;0BACZ,SAAS;;;;;;;;;;;;;;;OAe5B,UAAU;;;;;kCAKiB,IAAI;0BACZ,SAAS;;;;;;;;;;;;;OAa5B,UAAU;;;;;kCAKiB,IAAI;0BACZ,SAAS;;;;;;;;;OAS5B,UAAU;;;;;;kCAMiB,IAAI;0BACZ,SAAS;;;;;;;;;;;;OAY5B,UAAU;;;;;;;wBAOO,IAAI;;;;;;OAMrB,UAAU;;;;;;wBAMO,IAAI;;;;;;OAMrB,UAAU;;;;;;;wBAOO,IAAI;;;;;;OAMrB,UAAU;;;;;;;;;OASV,UAAU;;;;;;;;;OASV,UAAU;;;;;;;;;OASV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;OAyBV,UAAU;;;;;;;;;;;;;;;;;;;OAmBV,UAAU;;;;;;;;;;;;;;OAcV,UAAU;;;;;;;;;;;;;;;;SAgBR,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2IF,wBAAwB;;;;;;0BAMf,IAAI;;;;;;;;;oCASM,UAAU;;;;gBAI9B,UAAU;4CACkB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qDA+BK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA2C/C,IAAI;UACJ,IAAI;UACJ,IAAI;UACJ,IAAI;UACJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA8FgC,UAAU;;;;;;;;;;;;sBAYlC,IAAI;;kCAEQ,IAAI;0BACZ,SAAS;;;;;;;;;;;;;;;;;;;;SAoB1B,UAAU;;;;;;;SAOV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAsCV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAoCV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkCF,IAAI;;;;;;;;;;;;;;;;;;;;SAoBZ,UAAU;;;;;;;;;;;;;;wBAcK,IAAI;;oCAEQ,IAAI;4BACZ,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;WA0B1B,UAAU;;;;;;;SAOZ,UAAU;;;;;;;;;;;;;;;;SAgBV,UAAU;;;;;;;;;;;;;;;;;;;;;4BAqBS,SAAS;;;;;;;;;;SAU5B,UAAU;;;;;;;;;WASR,UAAU;;;;;;;;;;WAUV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAiES,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAkDT,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAwHT,IAAI;;kCAEA,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmGpC,UAAU;;;;;;;;;;;;eAYF,IAAI;;;;;;;;;OASZ,UAAU;;;;;;;;;;;;eAYF,IAAI;;;;;;;;;OASZ,UAAU;;;;;;;;;;;;;eAaF,IAAI;;;;;;;;;;SAUV,UAAU;;;;;;;;;;;;;;aAcN,IAAI;;;;;;;;;;;OAWV,UAAU;;;;;;;;;8BASa,IAAI;;;eAGnB,IAAI;;;;;;;;;OASZ,UAAU;;;;;;;;;;;;;kBAaC,IAAI;;;;;eAKP,IAAI;;;;;;;;;;SAUV,UAAU;;;;;;;;;;;;;;oBAcC,IAAI;;;;;;aAMX,IAAI;;;;;;;;;;;;SAYR,UAAU;;;;;;;;;;;;;;oBAcC,IAAI;;;;;;aAMX,IAAI;;;;;;;;;;;;SAYR,UAAU;;;;;;;;;;;;;;oBAcC,IAAI;;;;;;aAMX,IAAI;;;;;;;;;;oDAUmC,UAAU;sBACxC,IAAI;;;;qCAIW,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8D9C;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-infrastructure-safety-files.d.ts

@@ -0,0 +1,2 @@
+/** @internal */
+export declare function renderProductInfrastructureSafetyFiles(name: string): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-infrastructure-safety-files.js

@@ -0,0 +1,312 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductInfrastructureSafetyFiles = renderProductInfrastructureSafetyFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+/** @internal */
+function renderProductInfrastructureSafetyFiles(name) {
+    return {
+        'operations/infrastructure-change.json': (0, built_in_plan_shared_js_1.json)({
+            approvals: {
+                expirySeconds: 3_600,
+                materialDigestExcludes: [
+                    'approval',
+                    'expiresAt',
+                    'generatedAt',
+                    'repository',
+                    'sourceCommit',
+                ],
+                revalidateAccountRegionStage: true,
+                revalidateMaterialDigest: true,
+                revalidateSourceCommit: true,
+            },
+            drift: {
+                adapters: [
+                    {
+                        detection: 'sst-diff-json-with-pulumi-refresh-preview-options',
+                        id: 'sst-pulumi-refresh-preview',
+                        support: 'pinned-read-only-preview',
+                    },
+                    {
+                        detection: 'aws-resource-groups-tagging-api',
+                        id: 'tag-and-existence-fallback',
+                        support: 'tags-and-existence-only',
+                    },
+                    {
+                        detection: 'in-memory-provider-refresh-comparison',
+                        id: 'generated-non-secret-ssm-string',
+                        support: 'supported-redacted',
+                    },
+                    {
+                        detection: 'none',
+                        id: 'secret-payload-properties',
+                        support: 'explicitly-unsupported-blocks',
+                    },
+                ],
+                decisions: ['revert', 'adopt', 'externally-owned', 'investigate'],
+                evidenceFreshness: 'expiry-bound',
+                authoritativeRefreshForbiddenForDetection: true,
+                previewEnvironment: {
+                    PULUMI_OPTION_REFRESH: 'true',
+                    PULUMI_OPTION_RUN_PROGRAM: 'true',
+                },
+            },
+            planner: {
+                command: 'sst diff --json plus same-command read-only refresh preview',
+                executor: '@empire-builder-kit/nx:infrastructure-plan',
+                scope: 'product-slice',
+                sourceBoundary: 'desired-source-versus-recorded-sst-state',
+                stateIdentity: 'full-canonical-live-state-or-exact-key-absence-digest',
+                tool: 'sst',
+                version: '4.17.1',
+            },
+            policy: {
+                additiveLowRiskTypes: [
+                    'aws:cloudwatch/dashboard:Dashboard',
+                    'aws:cloudwatch/logGroup:LogGroup',
+                    'aws:cloudwatch/metricAlarm:MetricAlarm',
+                    'random:index/randomPassword:RandomPassword',
+                ],
+                costOrQuotaTypes: [
+                    'aws:apigatewayv2/api:Api',
+                    'aws:apigatewayv2/integration:Integration',
+                    'aws:apigatewayv2/route:Route',
+                    'aws:apigatewayv2/vpcLink:VpcLink',
+                    'aws:appconfig/deployment:Deployment',
+                    'aws:budgets/budget:Budget',
+                    'aws:cloudfront/cachePolicy:CachePolicy',
+                    'aws:cloudfront/distribution:Distribution',
+                    'aws:cloudfront/function:Function',
+                    'aws:cloudfront/keyValueStore:KeyValueStore',
+                    'aws:costexplorer/anomalyMonitor:AnomalyMonitor',
+                    'aws:costexplorer/anomalySubscription:AnomalySubscription',
+                    'aws:dynamodb/table:Table',
+                    'aws:ecs/service:Service',
+                    'aws:lambda/function:Function',
+                    'aws:rds/cluster:Cluster',
+                ],
+                failClosedOnUnknown: true,
+                iamAccessAnalyzer: 'in-process-validate-policy-for-proposed-policy-documents',
+                costQuotaEvidence: 'bounded-standard-envelope-unknown-cost-visible',
+                planRoleStatus: 'generated-exact-bootstrap-audit',
+                protectedPlanAuthority: 'dedicated-read-only-oidc-role',
+                rawAndNormalizedEvidence: true,
+                redactBeforeReview: true,
+                standingPolicyRiskClasses: ['no-change', 'additive-low-risk'],
+                statefulTypes: [
+                    'aws:dynamodb/table:Table',
+                    'aws:kms/key:Key',
+                    'aws:rds/cluster:Cluster',
+                    'aws:s3/bucket:Bucket',
+                    'aws:sqs/queue:Queue',
+                    'aws:ssm/parameter:Parameter',
+                    'random:index/randomPassword:RandomPassword',
+                ],
+            },
+            liveEvidenceRequirements: [
+                'plan-role-cloudtrail-call-calibration',
+                'deliberate-drift-read-only-preview',
+            ],
+            residuals: [
+                'general-purpose-pricing-engine',
+                'third-party-provider-drift-adapters',
+            ],
+            riskClasses: [
+                'no-change',
+                'additive-low-risk',
+                'in-place-reviewed',
+                'stateless-replacement',
+                'stateful-or-destructive',
+                'security-expansion',
+                'protection-reduction',
+                'material-cost-or-quota',
+                'unknown',
+            ],
+            schemaVersion: 1,
+            slice: name,
+        }),
+        'scripts/infrastructure-plan.mjs': `import { readFileSync } from 'node:fs';
+import {
+  computeMaterialPlanDigest,
+} from '@empire-builder-kit/nx/infrastructure-change';
+
+const evidenceDirectory = new URL('../.ebk/evidence/', import.meta.url);
+const plan = JSON.parse(
+  readFileSync(
+    new URL('infrastructure-plan.json', evidenceDirectory),
+    'utf8',
+  ),
+);
+const authorization = JSON.parse(
+  readFileSync(
+    new URL('infrastructure-plan-authorization.json', evidenceDirectory),
+    'utf8',
+  ),
+);
+if (
+  plan?.schemaVersion !== 1 ||
+  !Array.isArray(plan?.projects) ||
+  !plan.projects.includes('${name}') ||
+  computeMaterialPlanDigest(plan) !== plan.materialDigest
+) {
+  throw new Error(
+    'Infrastructure plan evidence is absent, malformed, or no longer material.',
+  );
+}
+if (
+  authorization?.validation?.allowed !== true ||
+  authorization.validation.outcome !== 'plan-clean'
+) {
+  throw new Error('Infrastructure plan is not authorized for apply.');
+}
+process.stdout.write(
+  JSON.stringify({
+    aggregateRisk: plan.aggregateRisk,
+    materialDigest: plan.materialDigest,
+    outcome: authorization.validation.outcome,
+    projects: plan.projects,
+  }) + '\\n',
+);
+`,
+        'scripts/infrastructure-drift.mjs': `import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import {
+  evaluateDriftCoverage,
+  evaluatePostApplyConvergence,
+  validateDriftDecision,
+} from '@empire-builder-kit/nx/infrastructure-change';
+
+const inputPath = process.env.EBK_DRIFT_INPUT_PATH?.trim();
+if (!inputPath) throw new Error('EBK_DRIFT_INPUT_PATH is required.');
+const input = JSON.parse(readFileSync(inputPath, 'utf8'));
+if (
+  input?.schemaVersion !== 1 ||
+  !Array.isArray(input.expected) ||
+  !Array.isArray(input.reports) ||
+  input.reports.some(
+    (report) => report?.mode !== 'read-only' || report?.invokedRefresh,
+  )
+) {
+  throw new Error(
+    'Drift input must contain only bounded read-only adapter reports.',
+  );
+}
+const drift = evaluateDriftCoverage({
+  expected: input.expected,
+  reports: input.reports,
+});
+const decisions = drift.findings.map((finding) => {
+  const decision = input.decisions?.find(
+    (candidate) =>
+      candidate?.driftResourceId === finding.resourceId,
+  );
+  return {
+    finding,
+    validation: decision
+      ? validateDriftDecision(finding, decision)
+      : {
+          complete: false,
+          errors: ['Drift finding has no explicit decision.'],
+          lifecycleBlocked: true,
+        },
+  };
+});
+const result = input.postApply
+  ? {
+      decisions,
+      drift,
+      convergence: evaluatePostApplyConvergence({
+        ...input.postApply,
+        drift,
+      }),
+    }
+  : { decisions, drift };
+const evidenceDirectory = new URL('../.ebk/evidence/', import.meta.url);
+mkdirSync(evidenceDirectory, { recursive: true, mode: 0o700 });
+chmodSync(evidenceDirectory, 0o700);
+const evidencePath = new URL(
+  'infrastructure-drift.json',
+  evidenceDirectory,
+);
+writeFileSync(
+  evidencePath,
+  JSON.stringify(result, null, 2) + '\\n',
+  { encoding: 'utf8', mode: 0o600 },
+);
+chmodSync(evidencePath, 0o600);
+process.stdout.write(JSON.stringify(result) + '\\n');
+if (
+  drift.status !== 'no-drift' ||
+  decisions.some(({ validation }) => !validation.complete) ||
+  result.convergence?.converged === false
+) {
+  process.exitCode = 2;
+}
+`,
+        'docs/runbooks/infrastructure-change.md': `# Infrastructure change and drift
+
+\`pnpm nx run <slice>:infrastructure-plan --stage=<protected-stage>\` runs the
+workspace-pinned SST 4.17.1 \`sst diff --json\` contract through the framework
+executor. It first compares desired source with SST's recorded engine state,
+then repeats the same preview with the pinned Pulumi read-only refresh and
+run-program options. Refresh-phase events are separated from desired operations
+in memory. Raw state, policy documents, provider values, and secret-adjacent
+material are never written to review evidence.
+
+Unknown, destructive, stateful, security-expanding, protection-reducing, and
+material-cost findings fail closed. Approval binds to the exact material plan,
+candidate, stage, account, region, policy and state identity, and expires.
+Generated time and approval metadata do not alter the material digest, but are
+still independently revalidated before apply.
+
+Use only the bounded read-only preview for drift. Never invoke authoritative
+\`sst refresh\`, write state, unlock state, or mutate cloud resources to detect
+drift. A refresh preview is complete only when its desired phase materially
+equals the ordinary diff, its exact existing-resource inventory matches the
+full canonical state export, and all material properties have supported
+coverage. Generated non-secret String SSM parameter values are compared only in
+memory; secret payloads remain unsupported and block.
+
+The generated contract is Slice-scoped and protected planning runs under the
+dedicated branch-bound read-only plan role. The executor obtains state identity
+directly from the full canonical in-memory SST state export or from exact
+state-key absence for a first deploy. Exact-key inventory is checked before
+state, lock, or secret reads. Access Analyzer validates proposed IAM policy and
+trust documents in-process, while bounded cost/quota evidence makes unknown
+cost explicit and review-required. Partial or unsupported coverage blocks
+apply; it is never promoted to \`no-drift\`. The exact SST/provider call
+inventory still requires protected CloudTrail calibration evidence.
+
+When a plan requires human review, commit
+the workspace-level \`operations/infrastructure-approval.json\` batch. It binds
+the exact ordered project set, action, stage, and one sanitized planned
+plan/digest-bound decision per project. The resume run permits only that one
+aggregate file to differ from the planned source commit and recomputes every
+cloud plan before apply. The matching project entry carries sanitized
+\`governance\` records when applicable: an exact drift-adopt decision for
+refresh, controller/ownership/private-identifier/removal proof for every
+import, and cutover/data/collision/rollback/recovery proof for every
+replacement. Their canonical digests are retained in both authorization and
+the immediate pre-mutation binding; changing one after review fails closed.
+
+State edit, import operations inside a deploy preview, remove, repair, and
+authoritative refresh are governed recovery operations. Retain a state backup,
+exact physical target inventory, non-author approval, command/result evidence,
+and a finalized post-repair convergence record. Remove additionally requires
+the complete deletion inventory, drained dependents, retained Foundation,
+data-export, secret-revocation, and cleanup references; because the pinned SST
+diff does not emit a remove preview, EBK derives a redacted exact physical,
+dependency, protection, and retention inventory from the full live state
+export. The raw ID/ARN inventory remains private and binds a fixed Standard
+adapter before mutation; its exact file digest is carried by the immediate
+mutation binding. Service-native post-remove reads must prove NotFound
+for deleted resources, exact identity and unchanged protection for retained
+resources, separate-Foundation exclusion, and exact secret/registration
+absence. Unknown types, ambiguous identities, read failures, or mismatches
+produce \`cleanup-incomplete\` and require recovery; they never claim generic
+provider coverage.
+Immediate provider/state post-plan evidence is nonterminal until the protected
+deployed-smoke and alarm/data evidence finalizer binds the exact candidate and
+mutation.
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-infrastructure-safety-files.js.map

package/src/generators/slice/built-in-plan-infrastructure-safety-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-infrastructure-safety-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-infrastructure-safety-files.ts"],"names":[],"mappings":";;AAGA,wFAoTC;AAvTD,uEAAiD;AAEjD,gBAAgB;AAChB,SAAgB,sCAAsC,CACpD,IAAY;IAEZ,OAAO;QACL,uCAAuC,EAAE,IAAA,8BAAI,EAAC;YAC5C,SAAS,EAAE;gBACT,aAAa,EAAE,KAAK;gBACpB,sBAAsB,EAAE;oBACtB,UAAU;oBACV,WAAW;oBACX,aAAa;oBACb,YAAY;oBACZ,cAAc;iBACf;gBACD,4BAA4B,EAAE,IAAI;gBAClC,wBAAwB,EAAE,IAAI;gBAC9B,sBAAsB,EAAE,IAAI;aAC7B;YACD,KAAK,EAAE;gBACL,QAAQ,EAAE;oBACR;wBACE,SAAS,EAAE,mDAAmD;wBAC9D,EAAE,EAAE,4BAA4B;wBAChC,OAAO,EAAE,0BAA0B;qBACpC;oBACD;wBACE,SAAS,EAAE,iCAAiC;wBAC5C,EAAE,EAAE,4BAA4B;wBAChC,OAAO,EAAE,yBAAyB;qBACnC;oBACD;wBACE,SAAS,EAAE,uCAAuC;wBAClD,EAAE,EAAE,iCAAiC;wBACrC,OAAO,EAAE,oBAAoB;qBAC9B;oBACD;wBACE,SAAS,EAAE,MAAM;wBACjB,EAAE,EAAE,2BAA2B;wBAC/B,OAAO,EAAE,+BAA+B;qBACzC;iBACF;gBACD,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,aAAa,CAAC;gBACjE,iBAAiB,EAAE,cAAc;gBACjC,yCAAyC,EAAE,IAAI;gBAC/C,kBAAkB,EAAE;oBAClB,qBAAqB,EAAE,MAAM;oBAC7B,yBAAyB,EAAE,MAAM;iBAClC;aACF;YACD,OAAO,EAAE;gBACP,OAAO,EAAE,6DAA6D;gBACtE,QAAQ,EAAE,4CAA4C;gBACtD,KAAK,EAAE,eAAe;gBACtB,cAAc,EAAE,0CAA0C;gBAC1D,aAAa,EAAE,uDAAuD;gBACtE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,QAAQ;aAClB;YACD,MAAM,EAAE;gBACN,oBAAoB,EAAE;oBACpB,oCAAoC;oBACpC,kCAAkC;oBAClC,wCAAwC;oBACxC,4CAA4C;iBAC7C;gBACD,gBAAgB,EAAE;oBAChB,0BAA0B;oBAC1B,0CAA0C;oBAC1C,8BAA8B;oBAC9B,kCAAkC;oBAClC,qCAAqC;oBACrC,2BAA2B;oBAC3B,wCAAwC;oBACxC,0CAA0C;oBAC1C,kCAAkC;oBAClC,4CAA4C;oBAC5C,gDAAgD;oBAChD,0DAA0D;oBAC1D,0BAA0B;oBAC1B,yBAAyB;oBACzB,8BAA8B;oBAC9B,yBAAyB;iBAC1B;gBACD,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EACf,0DAA0D;gBAC5D,iBAAiB,EAAE,gDAAgD;gBACnE,cAAc,EAAE,iCAAiC;gBACjD,sBAAsB,EAAE,+BAA+B;gBACvD,wBAAwB,EAAE,IAAI;gBAC9B,kBAAkB,EAAE,IAAI;gBACxB,yBAAyB,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;gBAC7D,aAAa,EAAE;oBACb,0BAA0B;oBAC1B,iBAAiB;oBACjB,yBAAyB;oBACzB,sBAAsB;oBACtB,qBAAqB;oBACrB,6BAA6B;oBAC7B,4CAA4C;iBAC7C;aACF;YACD,wBAAwB,EAAE;gBACxB,uCAAuC;gBACvC,oCAAoC;aACrC;YACD,SAAS,EAAE;gBACT,gCAAgC;gBAChC,qCAAqC;aACtC;YACD,WAAW,EAAE;gBACX,WAAW;gBACX,mBAAmB;gBACnB,mBAAmB;gBACnB,uBAAuB;gBACvB,yBAAyB;gBACzB,oBAAoB;gBACpB,sBAAsB;gBACtB,wBAAwB;gBACxB,SAAS;aACV;YACD,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,IAAI;SACZ,CAAC;QACF,iCAAiC,EAAE;;;;;;;;;;;;;;;;;;;;;6BAqBV,IAAI;;;;;;;;;;;;;;;;;;;;;CAqBhC;QACG,kCAAkC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyEvC;QACG,wCAAwC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiE7C;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-metadata-files.d.ts

@@ -0,0 +1,3 @@
+import type { GeneratedOwnershipRecord } from '../../ownership/index.js';
+/** @internal */
+export declare function renderSliceMetadataFiles(name: string, scope: string, pascalName: string, ownership: GeneratedOwnershipRecord): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-metadata-files.js

@@ -0,0 +1,219 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderSliceMetadataFiles = renderSliceMetadataFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+/** @internal */
+function renderSliceMetadataFiles(name, scope, pascalName, ownership) {
+    return {
+        '.ebk/ownership.json': (0, built_in_plan_shared_js_1.json)(ownership),
+        'README.md': `# ${name}
+
+This Product Slice is an independent business and deployment boundary generated from the
+built-in Empire Builder Kit Standard Blueprint.
+
+It consumes the Standard Foundation through its versioned capability contract. Do not import
+files from \`packages/foundation/infra\` or from another slice's internals.
+
+## Included product baseline
+
+- Next.js web application with sign-in, refresh, sign-out, callback, and password-reset paths
+- Lambda HTTP API with health and JWT-protected routes
+- stage- and slice-scoped logical Postgres database plus migration history
+- typed EventBridge publisher and SQS/DLQ-backed consumer
+- Product Slice dashboard and API/DLQ alarms routed through Foundation alerts
+- Vitest source test and Playwright deployed-smoke path
+- managed client/server and public-configuration boundaries, owned response-header policy,
+  rendered accessibility checks, and reviewable visual evidence
+- versioned SLO, alarm, diagnostic, incident-remediation, and reliability-exercise contracts
+- performance, capacity, resource-tag, protected-load, and actual-cost evidence contracts
+- workspace-lockfile-derived migration and retention container recipes with supply-chain checks
+
+Keep business contracts in \`contracts/\`. Add long-running Services and finite Jobs only when
+the product needs them.
+
+Run \`pnpm nx run ${name}:verify\` for the non-deployed Slice checks. The policy files under
+\`frontend/\`, \`docs/reliability/\`, \`operations/\`, and \`performance/\` are seeded decisions:
+adopt real owners, journeys, thresholds, targets, and evidence sources before enabling
+\`${name}:performance-ready\`, protected load, or making a production-readiness claim.
+Start with the
+[\`performance-capacity-cost\` runbook](docs/runbooks/performance-capacity-cost.md)
+before configuring the protected workflow.
+
+Add product dependencies with \`pnpm --filter ${scope}/${name} add <package>\`. EBK owns only
+its recorded framework keys in this package manifest, so health checks and upgrades preserve
+dependencies, scripts, and other keys added by the product team.
+
+## Local database
+
+Run \`ebk dev up ${name}\`. The framework derives the current developer's
+personal stage, starts Docker Postgres, applies local migrations, and starts
+SST live mode through the workspace-pinned Nx task. A caller cannot supply or
+persist a stage override. The fleet supervisor allocates the internal Next.js
+port and reports the HTTPS readiness URL.
+
+The workspace fleet target discovers this slice through its versioned
+\`metadata.ebk.localDev\` adapter. It supplies the exact HTTPS fleet origin, secure-cookie
+signal, callback/logout URLs, and allocated internal port; do not persist a developer port in
+this project.
+
+\`database/bindings.json\` is the adopter-owned database selection contract. Add a candidate
+identifier to \`primary.provisioned\` to provision it without moving workload traffic. Every
+provisioned identifier receives its own AWS-internal bootstrap-and-migration workflow. Run
+\`pnpm nx run ${name}:db-migrate --stage=<stage> --database=<identifier>\` to migrate and verify
+a non-active candidate before switching \`primary.active\`. Without \`--database\`, the target
+selects the active \`primary\` identifier. Do not edit managed \`infra/product.ts\` or provision
+databases with Foundation master credentials.
+
+The readiness route is framework-managed for local orchestration. Put product-specific
+dependency and status checks under \`/${name}/api/status\` rather than editing that route.
+
+Run \`ebk dev down ${name}\` when finished. The named volume preserves local
+data between sessions.
+
+For a deployed canonical stage, \`${name}:db-migrate\` does not connect from the
+local or GitHub process. It starts the generated Standard Step Functions
+workflow, waits for its one-off Fargate task, and reports the execution ARN.
+The workflow first runs an AWS-internal bootstrap task that converges the
+database, roles, and reference-only runtime credentials, then runs the
+IAM-authenticated migration task. Neither password resolves in GitHub, SST, or
+Pulumi state. The authenticated \`GET /database-health\` API route uses the
+server-only resolver, linked secret, and runtime-embedded AWS RDS global CA
+bundle to prove the deployed runtime path with hostname-verified TLS.
+Staging and production use the existing environment-scoped
+\`AWS_DEPLOY_ROLE_ARN\`; no second migration OIDC role or database password is
+configured by the adopter. That role needs only \`ssm:GetParameter\` for the
+exact generated migration-registration path and \`states:StartExecution\` /
+\`states:DescribeExecution\` for the exact generated state machine and its
+execution namespace; it never receives SQL, database-token, or arbitrary ECS
+authority.
+
+Ordinary Slice removal is non-destructive and retains logical databases and
+credential containers. The only destructive v1 database path is the protected
+\`db-retirement-rehearsal\` target for the exact operations-declared
+\`development\` database named \`retirement_rehearsal\`. It accepts no stage,
+Slice, database, task, role, image, network, or workflow selection.
+`,
+        'contracts/index.ts': `export {
+  ${pascalName}Created,
+  ${pascalName}DataLifecycleChanged,
+  type ${pascalName}CreatedData,
+  type ${pascalName}DataLifecycleChangedData,
+} from './events.js';
+
+export const ${pascalName}ContractVersion = '1.0.0' as const;
+`,
+        'contracts/dependencies.json': (0, built_in_plan_shared_js_1.json)({
+            consumes: [],
+            schemaVersion: 1,
+        }),
+        'docs/architecture.md': `# ${name} architecture
+
+## Boundary
+
+This slice owns its product behavior, routes, app clients, logical databases, event rules,
+queues, alarms, dashboards, and runbooks. The Foundation owns shared capacity and policy.
+
+## Dependencies
+
+- Foundation contract: \`^1\`
+- Canonical stages map to the same Foundation stage; framework-derived personal stages map
+  only to \`development\`
+- Other slices: contracts-only imports
+`,
+        'docs/contracts.md': `# ${name} contracts
+
+Published contracts belong in \`contracts/\`. Keep them transport-neutral and versioned.
+Record every consumed Slice publication in \`contracts/dependencies.json\`,
+add its base workspace package as a \`workspace:*\` dependency, then run
+\`pnpm nx run ${name}:contract-dependencies-sync\`. Verification fails when
+the seeded declaration, package dependency, and generated ownership record
+do not agree.
+`,
+        'docs/runbooks.md': `# ${name} runbooks
+
+Document deployment smoke checks, alarms, rollback, event redrive, database migration, and
+Service or Job recovery procedures as those capabilities are added.
+
+## Operator secrets
+
+Use \`docs/runbooks/operator-secret-management.md\` for value-free metadata
+convergence and the separate, human-only personal-stage value ceremony.
+
+## Performance, capacity, and cost
+
+Use the [performance, capacity, and cost runbook](runbooks/performance-capacity-cost.md)
+before adopting capacity limits, enabling protected load, or collecting actual-cost evidence.
+
+## Database migration
+
+Protected migration runs from generated immutable bootstrap and migration
+Fargate tasks through one Standard Step Functions workflow per provisioned
+database identifier. The bootstrap task owns exact master-secret read,
+runtime-secret read/write, and migrator-connect permissions; it converges the
+database and roles under a database-scoped advisory lock. PostgreSQL may retain
+a creator ADMIN membership for role administration; bootstrap removes its
+\`SET\` and \`INHERIT\` options before granting \`rds_iam\`. The migration task
+receives only exact migrator-connect permission.
+
+Retain the workflow execution ARN, both task identities, image identity, source
+commit, migration checksums, sanitized CloudWatch logs, backup reference, and
+verification result. The GitHub job reuses
+\`AWS_DEPLOY_ROLE_ARN\` only to start and describe the exact workflow; it must
+not have direct SQL, secret-value, \`rds-db:connect\`, or arbitrary
+\`ecs:RunTask\` authority.
+
+The default \`db-migrate\` target selects the active \`primary\` database.
+During replacement, first add the candidate to \`primary.provisioned\`, deploy
+infrastructure, then run \`db-migrate --database=<candidate>\` and complete
+candidate verification before changing \`primary.active\`.
+
+Ordinary removal retains every logical database and generated credential
+container. Outcome-2 evidence uses the separate protected
+\`db-retirement-rehearsal\` target for exactly one reviewed, disposable
+\`development\` database named \`retirement_rehearsal\`. Its fixed
+AWS-internal callback task deletes that database, its three generated roles,
+and its two exact generated credential containers, then proves their absence
+and unchanged retained-sibling fingerprints. It never makes ordinary removal
+destructive.
+
+The authenticated \`GET /database-health\` route uses the server-only runtime
+resolver and its checksum-pinned AWS RDS global CA bundle. Remote Aurora
+connections retain hostname verification; only local loopback database
+connections disable TLS.
+
+Migrations are lexically ordered, checksum-locked, transaction-scoped, and
+serialized with a Postgres advisory lock. v1 schema migrations are restricted
+to the \`public\` schema. Known non-transactional operations fail closed; use a
+reviewed replacement or forward-compatible design instead of bypassing the
+transaction. Apply expand/migrate/contract. Repair failures with a forward
+migration or the documented restore/replacement procedure; do not edit an
+applied SQL file.
+`,
+        'ebk-globals.d.ts': `import 'sst/resource';
+
+declare global {
+  const sst: any;
+  const aws: any;
+  const $app: { name: string; stage: string };
+  const $config: any;
+  const $dev: boolean;
+  const $interpolate: (
+    strings: TemplateStringsArray,
+    ...values: unknown[]
+  ) => unknown;
+  const $jsonStringify: (value: unknown) => unknown;
+  const $transform: any;
+  const $util: any;
+}
+
+declare module 'sst/resource' {
+  interface Resource {
+    ${pascalName}ProviderQueue: { url: string };
+  }
+}
+
+export {};
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-metadata-files.js.map

package/src/generators/slice/built-in-plan-metadata-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-plan-metadata-files.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/slice/built-in-plan-metadata-files.ts"],"names":[],"mappings":";;AAIA,4DAyNC;AA5ND,uEAAiD;AAEjD,gBAAgB;AAChB,SAAgB,wBAAwB,CACtC,IAAY,EACZ,KAAa,EACb,UAAkB,EAClB,SAAmC;IAEnC,OAAO;QACL,qBAAqB,EAAE,IAAA,8BAAI,EAAC,SAAS,CAAC;QACtC,WAAW,EAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;oBAyBN,IAAI;;;IAGpB,IAAI;;;;;gDAKwC,KAAK,IAAI,IAAI;;;;;;mBAM1C,IAAI;;;;;;;;;;;;;;gBAcP,IAAI;;;;;;wCAMoB,IAAI;;qBAEvB,IAAI;;;oCAGW,IAAI;;;;;;;;;;;;;;;;;;;;;;CAsBvC;QACG,oBAAoB,EAAE;IACtB,UAAU;IACV,UAAU;SACL,UAAU;SACV,UAAU;;;eAGJ,UAAU;CACxB;QACG,6BAA6B,EAAE,IAAA,8BAAI,EAAC;YAClC,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,CAAC;SACjB,CAAC;QACF,sBAAsB,EAAE,KAAK,IAAI;;;;;;;;;;;;;CAapC;QACG,mBAAmB,EAAE,KAAK,IAAI;;;;;gBAKlB,IAAI;;;CAGnB;QACG,kBAAkB,EAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DhC;QACG,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;;MAmBlB,UAAU;;;;;CAKf;KACE,CAAC;AACJ,CAAC"}

package/src/generators/slice/built-in-plan-operations-files.d.ts

@@ -0,0 +1,2 @@
+/** @internal */
+export declare function renderSliceOperationsFiles(name: string, workspace?: string, frameworkVersion?: string): Readonly<Record<string, string>>;