@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/generators/preset/generator.js

@@ -6,6 +6,8 @@ const prettier_1 = require("prettier");
 const index_js_1 = require("../../repository-policy/index.js");
 const index_js_2 = require("../../ownership/index.js");
 const workspace_files_1 = require("./workspace-files");
+const formatting_js_1 = require("../formatting.js");
+const index_js_3 = require("../../workspace-deployment/index.js");
 function frameworkPackageVersion() {
     const manifest = require('../../../package.json');
     if (typeof manifest.version !== 'string') {
@@ -14,28 +16,44 @@ function frameworkPackageVersion() {
     return manifest.version;
 }
 async function presetGenerator(tree, options) {
+    const deploymentProfile = options.deploymentProfile ?? 'starter';
     const suppliedAccounts = [
         options.developmentAccountId,
         options.stagingAccountId,
         options.productionAccountId,
     ];
-    if (suppliedAccounts.some((value) => value !== undefined) &&
-        suppliedAccounts.some((value) => value === undefined)) {
-        throw new Error('Preset deployment topology requires all three exact stage account IDs together.');
+    if (deploymentProfile === 'starter' &&
+        options.stagingAccountId !== undefined) {
+        throw new Error('The starter deployment profile has no staging stage; omit --stagingAccountId.');
     }
-    const deploymentAccounts = suppliedAccounts.every((value) => value !== undefined)
-        ? (0, index_js_1.validateDeploymentAccountTopology)(options.deploymentProfile ?? 'starter', {
+    const requiredAccounts = deploymentProfile === 'starter'
+        ? [options.developmentAccountId, options.productionAccountId]
+        : suppliedAccounts;
+    if (requiredAccounts.some((value) => value !== undefined) &&
+        requiredAccounts.some((value) => value === undefined)) {
+        throw new Error(deploymentProfile === 'starter'
+            ? 'Starter preset deployment topology requires development and production account IDs together.'
+            : 'Isolated preset deployment topology requires all three exact stage account IDs together.');
+    }
+    const deploymentAccounts = requiredAccounts.every((value) => value !== undefined)
+        ? (0, index_js_1.validateDeploymentAccountTopology)(deploymentProfile, {
             development: (0, index_js_1.normalizeDeploymentAccountId)(options.developmentAccountId, 'Development deployment account'),
             production: (0, index_js_1.normalizeDeploymentAccountId)(options.productionAccountId, 'Production deployment account'),
-            staging: (0, index_js_1.normalizeDeploymentAccountId)(options.stagingAccountId, 'Staging deployment account'),
+            staging: deploymentProfile === 'starter'
+                ? null
+                : (0, index_js_1.normalizeDeploymentAccountId)(options.stagingAccountId, 'Staging deployment account'),
         })
         : { development: null, production: null, staging: null };
+    const deploymentRegion = options.deploymentRegion === undefined
+        ? null
+        : (0, index_js_1.configuredDeploymentRegion)(options.deploymentRegion);
     const renderedFiles = (0, workspace_files_1.renderWorkspaceFiles)({
         deploymentAccounts,
-        deploymentProfile: options.deploymentProfile ?? 'starter',
-        deploymentRegion: options.deploymentRegion ?? null,
+        deploymentProfile,
+        deploymentRegion,
         frameworkVersion: options.frameworkVersion ?? frameworkPackageVersion(),
         name: options.name,
+        workspaceDeploymentId: options.workspaceDeploymentId ?? (0, index_js_3.createWorkspaceDeploymentId)(),
     });
     const files = Object.fromEntries(await Promise.all(Object.entries(renderedFiles).map(async ([path, contents]) => {
         if ((0, workspace_files_1.isRawWorkspaceAuthorityPath)(path)) {
@@ -59,6 +77,8 @@ async function presetGenerator(tree, options) {
     }
     (0, index_js_2.restampFoundationOwnership)(tree);
     (0, index_js_2.restampWorkspaceOwnership)(tree);
+    await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, 'packages/foundation/.ebk/ownership.json');
+    await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, '.ebk/ownership.json');
 }
 exports.default = presetGenerator;
 //# sourceMappingURL=generator.js.map

package/src/generators/preset/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/generator.ts"],"names":[],"mappings":";;AAiBA,0DAQC;AAED,0CAuEC;AAjGD,uCAAoD;AAEpD,+DAI0C;AAC1C,uDAGkC;AAClC,uDAG2B;AAE3B,SAAgB,uBAAuB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,uBAAuB,CAA0B,CAAC;IAC3E,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,IAAU,EACV,OAA8B;IAE9B,MAAM,gBAAgB,GAAG;QACvB,OAAO,CAAC,oBAAoB;QAC5B,OAAO,CAAC,gBAAgB;QACxB,OAAO,CAAC,mBAAmB;KAC5B,CAAC;IACF,IACE,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACrD,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,EACrD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GACtB,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACpD,CAAC,CAAC,IAAA,4CAAiC,EAC/B,OAAO,CAAC,iBAAiB,IAAI,SAAS,EACtC;YACE,WAAW,EAAE,IAAA,uCAA4B,EACvC,OAAO,CAAC,oBAAuC,EAC/C,gCAAgC,CACjC;YACD,UAAU,EAAE,IAAA,uCAA4B,EACtC,OAAO,CAAC,mBAAsC,EAC9C,+BAA+B,CAChC;YACD,OAAO,EAAE,IAAA,uCAA4B,EACnC,OAAO,CAAC,gBAAmC,EAC3C,4BAA4B,CAC7B;SACF,CACF;QACH,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,aAAa,GAAG,IAAA,sCAAoB,EAAC;QACzC,kBAAkB;QAClB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,SAAS;QACzD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QAClD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,EAAE;QACvE,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;QAC3D,IAAI,IAAA,6CAA2B,EAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAU,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACH,OAAO;gBACL,IAAI;gBACJ,MAAM,IAAA,iBAAc,EAAC,QAAQ,EAAE;oBAC7B,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAE,IAAI;iBAClB,CAAC;aACM,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAU,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CACH,CACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,IAAA,qCAA0B,EAAC,IAAI,CAAC,CAAC;IACjC,IAAA,oCAAyB,EAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,kBAAe,eAAe,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/generator.ts"],"names":[],"mappings":";;AAoBA,0DAQC;AAED,0CAiGC;AA9HD,uCAAoD;AAEpD,+DAK0C;AAC1C,uDAGkC;AAClC,uDAG2B;AAC3B,oDAA8D;AAC9D,kEAAkF;AAElF,SAAgB,uBAAuB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,uBAAuB,CAA0B,CAAC;IAC3E,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,IAAU,EACV,OAA8B;IAE9B,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,SAAS,CAAC;IACjE,MAAM,gBAAgB,GAAG;QACvB,OAAO,CAAC,oBAAoB;QAC5B,OAAO,CAAC,gBAAgB;QACxB,OAAO,CAAC,mBAAmB;KAC5B,CAAC;IACF,IACE,iBAAiB,KAAK,SAAS;QAC/B,OAAO,CAAC,gBAAgB,KAAK,SAAS,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GACpB,iBAAiB,KAAK,SAAS;QAC7B,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,mBAAmB,CAAC;QAC7D,CAAC,CAAC,gBAAgB,CAAC;IACvB,IACE,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACrD,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,EACrD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,SAAS;YAC7B,CAAC,CAAC,8FAA8F;YAChG,CAAC,CAAC,0FAA0F,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,kBAAkB,GACtB,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACpD,CAAC,CAAC,IAAA,4CAAiC,EAAC,iBAAiB,EAAE;YACnD,WAAW,EAAE,IAAA,uCAA4B,EACvC,OAAO,CAAC,oBAAuC,EAC/C,gCAAgC,CACjC;YACD,UAAU,EAAE,IAAA,uCAA4B,EACtC,OAAO,CAAC,mBAAsC,EAC9C,+BAA+B,CAChC;YACD,OAAO,EACL,iBAAiB,KAAK,SAAS;gBAC7B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAA,uCAA4B,EAC1B,OAAO,CAAC,gBAAmC,EAC3C,4BAA4B,CAC7B;SACR,CAAC;QACJ,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACpC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAA,qCAA0B,EAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAA,sCAAoB,EAAC;QACzC,kBAAkB;QAClB,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,EAAE;QACvE,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,qBAAqB,EACnB,OAAO,CAAC,qBAAqB,IAAI,IAAA,sCAA2B,GAAE;KACjE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;QAC3D,IAAI,IAAA,6CAA2B,EAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAU,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACH,OAAO;gBACL,IAAI;gBACJ,MAAM,IAAA,iBAAc,EAAC,QAAQ,EAAE;oBAC7B,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAE,IAAI;iBAClB,CAAC;aACM,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAU,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CACH,CACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,IAAA,qCAA0B,EAAC,IAAI,CAAC,CAAC;IACjC,IAAA,oCAAyB,EAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAA,0CAA0B,EAC9B,IAAI,EACJ,yCAAyC,CAC1C,CAAC;IACF,MAAM,IAAA,0CAA0B,EAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;AAChE,CAAC;AAED,kBAAe,eAAe,CAAC"}

package/src/generators/preset/schema.d.ts

@@ -8,4 +8,7 @@ export interface PresetGeneratorSchema {
   name: string;
   productionAccountId?: string | number;
   stagingAccountId?: string | number;
+  /** Internal deterministic-test hook. Public generation always creates a new
+   * workspace deployment identity. */
+  workspaceDeploymentId?: string;
 }

package/src/generators/preset/schema.json

@@ -12,8 +12,8 @@
     },
     "deploymentRegion": {
       "type": "string",
-      "pattern": "^[a-z]{2}(-gov)?-[a-z]+(-[a-z]+)*-[0-9]$",
-      "description": "Optional exact shared AWS Region for all canonical stages."
+      "pattern": "^(?!(us-iso-|us-isob-|eu-isoe-|us-isof-))[a-z]{2}(-gov)?-[a-z]+(-[a-z]+)*-[0-9]$",
+      "description": "Optional exact shared AWS Region for every stage active under the selected deployment profile."
     },
     "developmentAccountId": {
       "anyOf": [
@@ -25,7 +25,7 @@
           "multipleOf": 1
         }
       ],
-      "description": "Optional exact development AWS account ID. Supply all three stage accounts together."
+      "description": "Optional exact development AWS account ID. Supply development and production together for starter; supply all three stage accounts for an isolated profile."
     },
     "name": {
       "type": "string",
@@ -50,7 +50,7 @@
           "multipleOf": 1
         }
       ],
-      "description": "Optional exact staging AWS account ID. Supply all three stage accounts together."
+      "description": "Optional exact staging AWS account ID. Omit for starter; supply all three stage accounts together for an isolated profile."
     },
     "productionAccountId": {
       "anyOf": [
@@ -62,7 +62,7 @@
           "multipleOf": 1
         }
       ],
-      "description": "Optional exact production AWS account ID. Supply all three stage accounts together."
+      "description": "Optional exact production AWS account ID. Supply development and production together for starter; supply all three stage accounts for an isolated profile."
     }
   },
   "required": ["name"]

package/src/generators/preset/workspace-files-developer-agent.js

@@ -22,9 +22,9 @@ const HANDOFF_STATE_DESCRIPTIONS = {
 function deploymentAuthorityGuidance(deploymentProfile) {
     switch (deploymentProfile) {
         case 'starter':
-            return `Development and staging mutation may run locally only through the matching
-authenticated Nx lifecycle and committed Repository Operating Policy. Production mutation
-belongs to the protected GitHub environment and OIDC workflow. Never invoke SST directly.`;
+            return `Development and production mutation may run locally only through the matching
+authenticated Nx lifecycle and committed Repository Operating Policy. GitHub deployment
+remains optional. Never invoke SST directly.`;
         case 'production-isolated':
             return `Development and staging mutation may run locally only through the matching
 authenticated Nx lifecycle and committed Repository Operating Policy. Production mutation
@@ -61,13 +61,20 @@ Begin and hand off implementation work with
 \`pnpm nx run ${name}:verify\` and the workspace \`pnpm verify\` barrier before claiming
 implemented-and-verified.
 
+If a Slice, Service, or Job generator reports a retained post-generation install, rerun
+that same generator with the exact scoped prefix
+\`pnpm --config.verify-deps-before-run=warn nx generate\`. This is the sole exception to
+the workspace's fail-closed dependency-state check: it lets Nx reach EBK's bound recovery
+callback, which owns the install. Never run \`pnpm install\` while the retained marker exists.
+
 Use one topic branch and linked worktree per independent change. Stop on stale base,
 overlapping paths or shared external state, ownership or generated drift, invalid policy,
 blocking markers, missing prerequisites, or unknown authority; never merge, rebase, discard,
 or overwrite another worktree automatically.
 
-${deploymentAuthorityGuidance(deploymentProfile)} Secret values remain a human-only TTY ceremony;
-agents may use only value-blind metadata, status, and verification.
+${deploymentAuthorityGuidance(deploymentProfile)} Human-supplied secret values remain a
+human-only TTY ceremony. Agents may use value-blind metadata, status, verification, and the
+exact generated-secret initializer; the initializer accepts and returns no plaintext value.
 
 Read \`docs/developer-agent.md\`, \`docs/developer-agent-handoff.template.json\`,
 \`docs/developer-agent-adapters.md\`, \`docs/git-workflow.md\`, and
@@ -236,8 +243,9 @@ For every mutation, name the cleanup and recovery owner before execution.
 ${deploymentAuthorityGuidance(deploymentProfile)} Destructive work additionally requires an
 exact target, explicit approval, retained recovery proof, and completed cleanup.
 
-Secret values are entered only through the human TTY ceremony. Agents and CI are limited to
-value-blind secret metadata, status, and verification.
+Human-supplied secret values are entered only through the human TTY ceremony. Agents and CI
+may use value-blind metadata, status, verification, and the exact generated-secret initializer;
+the initializer accepts and returns no plaintext value.
 
 ## Handoff and resumption
 

package/src/generators/preset/workspace-files-developer-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-files-developer-agent.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-developer-agent.ts"],"names":[],"mappings":";;;AAojBA,sFAuBC;AA3kBD,6DAQwC;AAG3B,QAAA,4BAA4B,GAAG,yBAAkC,CAAC;AAClE,QAAA,qCAAqC,GAChD,4CAAqD,CAAC;AAC3C,QAAA,uCAAuC,GAClD,kCAA2C,CAAC;AAEjC,QAAA,sCAAsC,GAAG;IACpD,oCAA4B;IAC5B,6CAAqC;IACrC,+CAAuC;CAC/B,CAAC;AAgBX,MAAM,0BAA0B,GAAG;IACjC,0BAA0B,EACxB,wEAAwE;IAC1E,oCAAoC,EAClC,kFAAkF;IACpF,yBAAyB,EACvB,+FAA+F;IACjG,0BAA0B,EACxB,+EAA+E;IACjF,qCAAqC,EACnC,wEAAwE;IAC1E,2BAA2B,EACzB,0DAA0D;CACC,CAAC;AAEhE,SAAS,2BAA2B,CAClC,iBAAoC;IAEpC,QAAQ,iBAAiB,EAAE,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO;;0FAE6E,CAAC;QACvF,KAAK,qBAAqB;YACxB,OAAO;;0FAE6E,CAAC;QACvF,KAAK,gBAAgB;YACnB,OAAO;;2FAE8E,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,iBAAoC;IAEpC,OAAO;;iDAEwC,IAAI;;;;;;;;;;;;;;;;;;;gBAmBrC,IAAI;gBACJ,IAAI;;;;;;;;EAQlB,2BAA2B,CAAC,iBAAiB,CAAC;;;;;;CAM/C,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,yCAA8B,CAAC,GAAG,CACvC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,iBAAoC;IAEpC,OAAO;;8DAEqD,IAAI;;;;;;;;;;;;uBAY3C,IAAI;;;;mBAIR,IAAI;;;;;;;;;;;;;;;;mBAgBJ,IAAI,sCAAsC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAgCjC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyFlC,2BAA2B,CAAC,iBAAiB,CAAC;;;;;;;;IAQ5C,6CAAqC;;;;;;;;;;;;;EAavC,mBAAmB,EAAE;;IAEnB,6CAAqC;8BACX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAoD5B,+CAAuC;CAC5C,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA2C;IAE3C,MAAM,qBAAqB,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACzD,MAAM,wBAAwB,GAC5B,wDAAwD,CAAC;IAC3D,MAAM,oBAAoB,GAAG,GAAG,OAAO,CAAC,IAAI,SAAS,CAAC;IACtD,OAAO;QACL,gBAAgB,EAAE,EAAE;QACpB,YAAY,EAAE,EAAE;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACpC,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,EAAE;QACjB,IAAI,EAAE,uCAA4B;QAClC,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE;YACd,gBAAgB,EAAE,KAAK;YACvB,SAAS,EAAE,WAAW;YACtB,WAAW,EACT,2FAA2F;SAC9F;QACD,UAAU,EAAE;YACV;gBACE,SAAS,EAAE,cAAc;gBACzB,EAAE,EAAE,eAAe,OAAO,CAAC,IAAI,EAAE;gBACjC,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE;oBACL,SAAS,EAAE,EAAE;oBACb,eAAe,EAAE,CAAC,QAAQ,CAAC;oBAC3B,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;oBACxB,oBAAoB,EAAE,CAAC,oBAAoB,CAAC;iBAC7C;aACF;SACF;QACD,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACrC,UAAU,EAAE;YACV,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,qBAAqB;YAC7B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,gCAAgC;SAC3C;QACD,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,uBAAuB,EAAE,EAAE;QAC3B,oBAAoB,EAAE,CAAC,oBAAoB,CAAC;QAC5C,2BAA2B,EAAE,CAAC,oBAAoB,CAAC;QACnD,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE;oBACR,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;iBACzB;gBACD,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,qBAAqB;wBAC7B,aAAa,EAAE,QAAQ;wBACvB,IAAI,EAAE,8BAA8B;wBACpC,YAAY,EAAE,qBAAqB;wBACnC,SAAS,EAAE,wBAAwB;qBACpC;iBACF;gBACD,OAAO,EAAE;oBACP,iBAAiB,EAAE,EAAE;oBACrB,KAAK,EAAE,EAAE;iBACV;gBACD,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBACpC,IAAI,EAAE,sCAA2B;gBACjC,cAAc,EAAE;oBACd,gBAAgB,EAAE,KAAK;oBACvB,SAAS,EAAE,WAAW;oBACtB,WAAW,EACT,sEAAsE;iBACzE;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,eAAe,OAAO,CAAC,IAAI,EAAE;oBACnC,gBAAgB,EAAE,EAAE;iBACrB;gBACD,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBACrC,aAAa,EAAE,kDAAuC;gBACtD,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,QAAQ,EAAE,gCAAgC;iBAC3C;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,SAAS,EAAE,wBAAwB;oBACnC,MAAM,EAAE;wBACN,SAAS,EAAE,EAAE;wBACb,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;wBACpC,MAAM,EAAE;4BACN,MAAM,EAAE,CAAC;4BACT,MAAM,EAAE,CAAC;4BACT,WAAW,EAAE,CAAC;4BACd,OAAO,EAAE,CAAC;4BACV,OAAO,EAAE,CAAC;yBACX;wBACD,WAAW,EAAE;4BACX,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,KAAK;yBAChB;wBACD,QAAQ,EAAE,EAAE;wBACZ,cAAc,EAAE,KAAK;wBACrB,IAAI,EAAE,yBAAyB;wBAC/B,SAAS,EAAE;4BACT,cAAc,EAAE,8BAA8B;4BAC9C,OAAO,EAAE,OAAO,CAAC,IAAI;4BACrB,UAAU,EAAE,QAAQ;4BACpB,MAAM,EAAE,QAAQ;yBACjB;wBACD,OAAO,EAAE,QAAQ;wBACjB,YAAY,EAAE,IAAI;wBAClB,mBAAmB,EAAE,KAAK;wBAC1B,aAAa,EAAE,0DAA+C;wBAC9D,MAAM,EAAE;4BACN,mBAAmB,EAAE,EAAE;4BACvB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;4BACtB,kBAAkB,EAAE,0BAA0B,OAAO,CAAC,gBAAgB,EAAE;yBACzE;wBACD,MAAM,EAAE;4BACN,WAAW,EAAE,0BAA0B;4BACvC,UAAU,EAAE,IAAI;4BAChB,SAAS,EAAE,0BAA0B;yBACtC;wBACD,SAAS,EAAE,OAAO,CAAC,IAAI;qBACxB;oBACD,aAAa,EAAE,0DAA+C;iBAC/D;gBACD,IAAI,EAAE;oBACJ,eAAe,EAAE,kDAAuC;oBACxD,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,OAAO,CAAC,gBAAgB;iBAClC;gBACD,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE;oBACjB,WAAW,EAAE,EAAE;oBACf,SAAS,EAAE,EAAE;oBACb,OAAO,EAAE,EAAE;iBACZ;gBACD,YAAY,EAAE;oBACZ,QAAQ,EAAE,EAAE;oBACZ,OAAO,EAAE,CAAC,oBAAoB,CAAC;iBAChC;aACF;SACF;QACD,aAAa,EAAE,kDAAuC;QACtD,SAAS,EAAE;YACT,eAAe,EAAE,CAAC,QAAQ,CAAC;YAC3B,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACzB;QACD,KAAK,EAAE,2BAA2B;QAClC,UAAU,EAAE;YACV,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;YACjD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,gBAAgB,EAAE,CAAC,4BAA4B,CAAC;SACjD;QACD,IAAI,EAAE;YACJ,0BAA0B,EAAE,2CAA2C;YACvE,SAAS,EAAE,6BAA6B;SACzC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BR,CAAC;AACF,CAAC;AAED,SAAgB,qCAAqC,CACnD,OAA2C;IAE3C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO;QACL,cAAc,EAAE,oBAAoB,CAClC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,iBAAiB,CAC1B;QACD,KAAK,EAAE;YACL,CAAC,oCAA4B,CAAC,EAAE,aAAa,CAC3C,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,iBAAiB,CAC1B;YACD,CAAC,6CAAqC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CACxD,QAAQ,EACR,IAAI,EACJ,CAAC,CACF,IAAI;YACL,CAAC,+CAAuC,CAAC,EAAE,uBAAuB,EAAE;SACrE;QACD,WAAW,EAAE,8CAAsC;KACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-files-developer-agent.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-developer-agent.ts"],"names":[],"mappings":";;;AA4jBA,sFAuBC;AAnlBD,6DAQwC;AAG3B,QAAA,4BAA4B,GAAG,yBAAkC,CAAC;AAClE,QAAA,qCAAqC,GAChD,4CAAqD,CAAC;AAC3C,QAAA,uCAAuC,GAClD,kCAA2C,CAAC;AAEjC,QAAA,sCAAsC,GAAG;IACpD,oCAA4B;IAC5B,6CAAqC;IACrC,+CAAuC;CAC/B,CAAC;AAgBX,MAAM,0BAA0B,GAAG;IACjC,0BAA0B,EACxB,wEAAwE;IAC1E,oCAAoC,EAClC,kFAAkF;IACpF,yBAAyB,EACvB,+FAA+F;IACjG,0BAA0B,EACxB,+EAA+E;IACjF,qCAAqC,EACnC,wEAAwE;IAC1E,2BAA2B,EACzB,0DAA0D;CACC,CAAC;AAEhE,SAAS,2BAA2B,CAClC,iBAAoC;IAEpC,QAAQ,iBAAiB,EAAE,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO;;6CAEgC,CAAC;QAC1C,KAAK,qBAAqB;YACxB,OAAO;;0FAE6E,CAAC;QACvF,KAAK,gBAAgB;YACnB,OAAO;;2FAE8E,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,iBAAoC;IAEpC,OAAO;;iDAEwC,IAAI;;;;;;;;;;;;;;;;;;;gBAmBrC,IAAI;gBACJ,IAAI;;;;;;;;;;;;;;EAclB,2BAA2B,CAAC,iBAAiB,CAAC;;;;;;;CAO/C,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,yCAA8B,CAAC,GAAG,CACvC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,iBAAoC;IAEpC,OAAO;;8DAEqD,IAAI;;;;;;;;;;;;uBAY3C,IAAI;;;;mBAIR,IAAI;;;;;;;;;;;;;;;;mBAgBJ,IAAI,sCAAsC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAgCjC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyFlC,2BAA2B,CAAC,iBAAiB,CAAC;;;;;;;;;IAS5C,6CAAqC;;;;;;;;;;;;;EAavC,mBAAmB,EAAE;;IAEnB,6CAAqC;8BACX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAoD5B,+CAAuC;CAC5C,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA2C;IAE3C,MAAM,qBAAqB,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACzD,MAAM,wBAAwB,GAC5B,wDAAwD,CAAC;IAC3D,MAAM,oBAAoB,GAAG,GAAG,OAAO,CAAC,IAAI,SAAS,CAAC;IACtD,OAAO;QACL,gBAAgB,EAAE,EAAE;QACpB,YAAY,EAAE,EAAE;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACpC,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,EAAE;QACjB,IAAI,EAAE,uCAA4B;QAClC,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE;YACd,gBAAgB,EAAE,KAAK;YACvB,SAAS,EAAE,WAAW;YACtB,WAAW,EACT,2FAA2F;SAC9F;QACD,UAAU,EAAE;YACV;gBACE,SAAS,EAAE,cAAc;gBACzB,EAAE,EAAE,eAAe,OAAO,CAAC,IAAI,EAAE;gBACjC,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE;oBACL,SAAS,EAAE,EAAE;oBACb,eAAe,EAAE,CAAC,QAAQ,CAAC;oBAC3B,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;oBACxB,oBAAoB,EAAE,CAAC,oBAAoB,CAAC;iBAC7C;aACF;SACF;QACD,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACrC,UAAU,EAAE;YACV,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,qBAAqB;YAC7B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,gCAAgC;SAC3C;QACD,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,uBAAuB,EAAE,EAAE;QAC3B,oBAAoB,EAAE,CAAC,oBAAoB,CAAC;QAC5C,2BAA2B,EAAE,CAAC,oBAAoB,CAAC;QACnD,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE;oBACR,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;iBACzB;gBACD,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,qBAAqB;wBAC7B,aAAa,EAAE,QAAQ;wBACvB,IAAI,EAAE,8BAA8B;wBACpC,YAAY,EAAE,qBAAqB;wBACnC,SAAS,EAAE,wBAAwB;qBACpC;iBACF;gBACD,OAAO,EAAE;oBACP,iBAAiB,EAAE,EAAE;oBACrB,KAAK,EAAE,EAAE;iBACV;gBACD,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBACpC,IAAI,EAAE,sCAA2B;gBACjC,cAAc,EAAE;oBACd,gBAAgB,EAAE,KAAK;oBACvB,SAAS,EAAE,WAAW;oBACtB,WAAW,EACT,sEAAsE;iBACzE;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,eAAe,OAAO,CAAC,IAAI,EAAE;oBACnC,gBAAgB,EAAE,EAAE;iBACrB;gBACD,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBACrC,aAAa,EAAE,kDAAuC;gBACtD,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,QAAQ,EAAE,gCAAgC;iBAC3C;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,SAAS,EAAE,wBAAwB;oBACnC,MAAM,EAAE;wBACN,SAAS,EAAE,EAAE;wBACb,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;wBACpC,MAAM,EAAE;4BACN,MAAM,EAAE,CAAC;4BACT,MAAM,EAAE,CAAC;4BACT,WAAW,EAAE,CAAC;4BACd,OAAO,EAAE,CAAC;4BACV,OAAO,EAAE,CAAC;yBACX;wBACD,WAAW,EAAE;4BACX,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,KAAK;yBAChB;wBACD,QAAQ,EAAE,EAAE;wBACZ,cAAc,EAAE,KAAK;wBACrB,IAAI,EAAE,yBAAyB;wBAC/B,SAAS,EAAE;4BACT,cAAc,EAAE,8BAA8B;4BAC9C,OAAO,EAAE,OAAO,CAAC,IAAI;4BACrB,UAAU,EAAE,QAAQ;4BACpB,MAAM,EAAE,QAAQ;yBACjB;wBACD,OAAO,EAAE,QAAQ;wBACjB,YAAY,EAAE,IAAI;wBAClB,mBAAmB,EAAE,KAAK;wBAC1B,aAAa,EAAE,0DAA+C;wBAC9D,MAAM,EAAE;4BACN,mBAAmB,EAAE,EAAE;4BACvB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;4BACtB,kBAAkB,EAAE,0BAA0B,OAAO,CAAC,gBAAgB,EAAE;yBACzE;wBACD,MAAM,EAAE;4BACN,WAAW,EAAE,0BAA0B;4BACvC,UAAU,EAAE,IAAI;4BAChB,SAAS,EAAE,0BAA0B;yBACtC;wBACD,SAAS,EAAE,OAAO,CAAC,IAAI;qBACxB;oBACD,aAAa,EAAE,0DAA+C;iBAC/D;gBACD,IAAI,EAAE;oBACJ,eAAe,EAAE,kDAAuC;oBACxD,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,OAAO,CAAC,gBAAgB;iBAClC;gBACD,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE;oBACjB,WAAW,EAAE,EAAE;oBACf,SAAS,EAAE,EAAE;oBACb,OAAO,EAAE,EAAE;iBACZ;gBACD,YAAY,EAAE;oBACZ,QAAQ,EAAE,EAAE;oBACZ,OAAO,EAAE,CAAC,oBAAoB,CAAC;iBAChC;aACF;SACF;QACD,aAAa,EAAE,kDAAuC;QACtD,SAAS,EAAE;YACT,eAAe,EAAE,CAAC,QAAQ,CAAC;YAC3B,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACzB;QACD,KAAK,EAAE,2BAA2B;QAClC,UAAU,EAAE;YACV,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;YACjD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,gBAAgB,EAAE,CAAC,4BAA4B,CAAC;SACjD;QACD,IAAI,EAAE;YACJ,0BAA0B,EAAE,2CAA2C;YACvE,SAAS,EAAE,6BAA6B;SACzC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BR,CAAC;AACF,CAAC;AAED,SAAgB,qCAAqC,CACnD,OAA2C;IAE3C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO;QACL,cAAc,EAAE,oBAAoB,CAClC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,iBAAiB,CAC1B;QACD,KAAK,EAAE;YACL,CAAC,oCAA4B,CAAC,EAAE,aAAa,CAC3C,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,iBAAiB,CAC1B;YACD,CAAC,6CAAqC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CACxD,QAAQ,EACR,IAAI,EACJ,CAAC,CACF,IAAI;YACL,CAAC,+CAAuC,CAAC,EAAE,uBAAuB,EAAE;SACrE;QACD,WAAW,EAAE,8CAAsC;KACpD,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-ecr-inspector.d.ts

@@ -0,0 +1,18 @@
+import type { DeploymentProfile } from '../../repository-policy/index.js';
+export declare const THIN_ECR_INSPECTOR_WORKFLOW_PATH: ".github/workflows/ecr-inspector-evidence.yml";
+interface EcrInspectorWorkflowOptions {
+    actionPins: {
+        checkout: string;
+        configureAwsCredentials: string;
+        downloadArtifact: string;
+        pnpmSetup: string;
+        setupNode: string;
+        uploadArtifact: string;
+    };
+    deploymentProfile: DeploymentProfile;
+    name: string;
+    nodeVersion: string;
+}
+/** Render the postdeploy scanner against the thin lifecycle receipt artifact. */
+export declare function renderThinEcrInspectorWorkflow(options: EcrInspectorWorkflowOptions): Readonly<Record<typeof THIN_ECR_INSPECTOR_WORKFLOW_PATH, string>>;
+export {};

package/src/generators/preset/workspace-files-ecr-inspector.js

@@ -0,0 +1,298 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.THIN_ECR_INSPECTOR_WORKFLOW_PATH = void 0;
+exports.renderThinEcrInspectorWorkflow = renderThinEcrInspectorWorkflow;
+exports.THIN_ECR_INSPECTOR_WORKFLOW_PATH = '.github/workflows/ecr-inspector-evidence.yml';
+/** Render the postdeploy scanner against the thin lifecycle receipt artifact. */
+function renderThinEcrInspectorWorkflow(options) {
+    const { actionPins, deploymentProfile, name, nodeVersion } = options;
+    const stageChoices = deploymentProfile === 'starter' ? 'production' : 'staging, production';
+    const stageBranchCases = deploymentProfile === 'starter'
+        ? 'production:main'
+        : 'staging:develop|production:main';
+    return {
+        [exports.THIN_ECR_INSPECTOR_WORKFLOW_PATH]: `name: ECR Inspector evidence
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: Exact deployed container stage
+        required: true
+        type: choice
+        options: [${stageChoices}]
+      deployment_commit:
+        description: Exact successful Deploy workflow commit
+        required: true
+        type: string
+      deploy_run_id:
+        description: Exact successful Deploy workflow run ID
+        required: true
+        type: string
+      deployment_receipt_artifact_name:
+        description: Exact deployment-receipt artifact from that run
+        required: true
+        type: string
+      slice:
+        description: Exact registered Product Slice
+        required: true
+        type: string
+      artifact_id:
+        description: Exact OCI artifact ID from operations/release.json
+        required: true
+        type: string
+      task_definition_family:
+        description: Exact deployed ECS task-definition family
+        required: true
+        type: string
+      deployment_kind:
+        description: Exact deployed ECS authority kind
+        required: true
+        type: choice
+        options: [service, task]
+      cluster_arn:
+        description: Exact ECS cluster ARN
+        required: true
+        type: string
+      deployment_arn:
+        description: Exact ECS service ARN or task ARN
+        required: true
+        type: string
+
+concurrency:
+  group: ecr-inspector-\${{ inputs.stage }}-\${{ inputs.slice }}-\${{ inputs.artifact_id }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  collect:
+    name: exact deployed OCI and Inspector evidence
+    runs-on: ubuntu-latest
+    environment: ecr-inspector-\${{ inputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      AWS_EVIDENCE_ROLE_ARN: \${{ secrets.AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ARTIFACT_ID: \${{ inputs.artifact_id }}
+      EBK_CLUSTER_ARN: \${{ inputs.cluster_arn }}
+      EBK_DEPLOYMENT_ARN: \${{ inputs.deployment_arn }}
+      EBK_DEPLOYMENT_COMMIT: \${{ inputs.deployment_commit }}
+      EBK_DEPLOYMENT_KIND: \${{ inputs.deployment_kind }}
+      EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME: \${{ inputs.deployment_receipt_artifact_name }}
+      EBK_DEPLOY_RUN_ID: \${{ inputs.deploy_run_id }}
+      EBK_SLICE: \${{ inputs.slice }}
+      EBK_STAGE: \${{ inputs.stage }}
+      EBK_TASK_DEFINITION_FAMILY: \${{ inputs.task_definition_family }}
+      GH_REPO: \${{ github.repository }}
+      GH_TOKEN: \${{ github.token }}
+    steps:
+      - name: Validate exact postdeploy evidence authority
+        run: |
+          set -euo pipefail
+          case "$EBK_DEPLOYMENT_COMMIT" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          { [ "\${#EBK_DEPLOYMENT_COMMIT}" -eq 40 ] || [ "\${#EBK_DEPLOYMENT_COMMIT}" -eq 64 ]; } || exit 1
+          case "$EBK_DEPLOY_RUN_ID" in ''|0|*[!0-9]*) exit 1 ;; esac
+          case "$EBK_SLICE" in ''|-*|*-|*[!a-z0-9-]*) exit 1 ;; esac
+          expected_branch=develop
+          if [ "$EBK_STAGE" = production ]; then expected_branch=main; fi
+          case "$EBK_STAGE:$expected_branch" in ${stageBranchCases}) ;;
+            *) echo 'ECR evidence stage is inactive for this deployment profile'; exit 1 ;;
+          esac
+          prefix="deployment-receipt-$EBK_STAGE-$EBK_DEPLOY_RUN_ID-"
+          case "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" in
+            "$prefix"*) attempt="\${EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME#"$prefix"}" ;;
+            *) echo 'Deployment receipt artifact does not bind the exact Deploy run'; exit 1 ;;
+          esac
+          case "$attempt" in ''|0*|*[!0-9]*) exit 1 ;; esac
+          echo "EBK_DEPLOY_RUN_ATTEMPT=$attempt" >> "$GITHUB_ENV"
+          run="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_DEPLOY_RUN_ID")"
+          [ "$(printf '%s' "$run" | jq -r .conclusion)" = success ] &&
+            [ "$(printf '%s' "$run" | jq -r .run_attempt)" = "$attempt" ] &&
+            [ "$(printf '%s' "$run" | jq -r .head_sha)" = "$EBK_DEPLOYMENT_COMMIT" ] &&
+            [ "$(printf '%s' "$run" | jq -r .head_branch)" = "$expected_branch" ] &&
+            [ "$(printf '%s' "$run" | jq -r .path)" = .github/workflows/deploy.yml ] || {
+              echo 'Deploy run is not the exact successful protected source authority'; exit 1;
+            }
+          artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_DEPLOY_RUN_ID/artifacts?per_page=100")"
+          count="$(printf '%s' "$artifacts" | jq --arg name "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" \
+            '[.artifacts[] | select(.name == $name and .expired == false)] | length')"
+          [ "$count" = 1 ] || { echo 'Exact unexpired deployment receipt is absent or ambiguous'; exit 1; }
+      - uses: ${actionPins.checkout}
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ inputs.deployment_commit }}
+      - name: Restore exact deployment receipt and release binding
+        uses: ${actionPins.downloadArtifact}
+        with:
+          github-token: \${{ github.token }}
+          name: \${{ inputs.deployment_receipt_artifact_name }}
+          path: .
+          run-id: \${{ inputs.deploy_run_id }}
+      - id: candidate
+        name: Verify exact release-candidate artifact provenance
+        run: |
+          set -euo pipefail
+          binding=.ebk/evidence/deployment/postdeploy-supply-chain.json
+          test -f "$binding" || { echo 'Postdeploy release-candidate binding is absent'; exit 1; }
+          artifact_id="$(jq -r '.releaseCandidateArtifactId // empty' "$binding")"
+          artifact_digest="$(jq -r '.releaseCandidateArtifactDigest // empty' "$binding")"
+          candidate_source="$(jq -r '.releaseSourceCommit // empty' "$binding")"
+          producer_attempt="$(jq -r '.releaseCandidateProducerRunAttempt // empty' "$binding")"
+          producer_run_id="$(jq -r '.releaseCandidateProducerRunId // empty' "$binding")"
+          profile="$(jq -r '.profile // empty' "$binding")"
+          case "$artifact_id:$producer_attempt:$producer_run_id" in
+            *[!0-9:]*|:*|*:|*::*|0*:*|*:0*:*|*:0*) echo 'Candidate artifact provenance is malformed'; exit 1 ;;
+          esac
+          printf '%s' "$artifact_digest" | grep -Eq '^sha256:[0-9a-f]{64}$' || {
+            echo 'Candidate artifact digest is malformed'; exit 1;
+          }
+          case "$candidate_source" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          { [ "\${#candidate_source}" -eq 40 ] || [ "\${#candidate_source}" -eq 64 ]; } || exit 1
+          expected_candidate_branch=develop
+          case "$profile:$EBK_STAGE" in
+            starter:production) expected_candidate_branch=main ;;
+            production-isolated:staging|production-isolated:production|fully-isolated:staging|fully-isolated:production) ;;
+            *) echo 'Candidate profile and protected ECR stage disagree'; exit 1 ;;
+          esac
+          artifact="$(gh api "/repos/$GH_REPO/actions/artifacts/$artifact_id")"
+          printf '%s' "$artifact" | jq -e \
+            --arg digest "$artifact_digest" \
+            --arg id "$artifact_id" \
+            --arg name "release-candidate-$candidate_source" \
+            --arg run "$producer_run_id" \
+            '(.id | tostring) == $id and .name == $name and .expired == false and .digest == $digest and (.workflow_run.id | tostring) == $run' \
+            >/dev/null || { echo 'Candidate artifact differs from the exact producer'; exit 1; }
+          producer="$(gh api "/repos/$GH_REPO/actions/runs/$producer_run_id")"
+          printf '%s' "$producer" | jq -e \
+            --arg attempt "$producer_attempt" \
+            --arg branch "$expected_candidate_branch" \
+            --arg run "$producer_run_id" \
+            --arg source "$candidate_source" \
+            '(.id | tostring) == $run and (.run_attempt | tostring) == $attempt and .head_sha == $source and .head_branch == $branch and .conclusion == "success" and .event == "push" and .path == ".github/workflows/ci.yml"' \
+            >/dev/null || { echo 'Candidate producer is not the exact successful protected CI run'; exit 1; }
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+          echo "producer_run_id=$producer_run_id" >> "$GITHUB_OUTPUT"
+          echo "candidate_source=$candidate_source" >> "$GITHUB_OUTPUT"
+      - name: Require fresh original candidate destination
+        run: |
+          set -euo pipefail
+          test ! -e .ebk/evidence/ecr-original-release-candidate || {
+            echo 'Original candidate destination already exists'; exit 1;
+          }
+      - name: Download exact original release candidate
+        uses: ${actionPins.downloadArtifact}
+        with:
+          artifact-ids: \${{ steps.candidate.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/ecr-original-release-candidate
+          run-id: \${{ steps.candidate.outputs.producer_run_id }}
+      - name: Verify downloaded release candidate identity
+        env:
+          EBK_CANDIDATE_SOURCE: \${{ steps.candidate.outputs.candidate_source }}
+          EBK_PRODUCER_RUN_ID: \${{ steps.candidate.outputs.producer_run_id }}
+        run: |
+          set -euo pipefail
+          candidate=.ebk/evidence/ecr-original-release-candidate/packages/$EBK_SLICE/candidate.json
+          test -f "$candidate" || { echo 'Exact Slice candidate is absent'; exit 1; }
+          jq -e \
+            --arg slice "$EBK_SLICE" \
+            --arg source "$EBK_CANDIDATE_SOURCE" \
+            --arg run "$EBK_PRODUCER_RUN_ID" \
+            '.kind == "ebk-release-candidate" and .schemaVersion == 1 and .slice == $slice and .sourceCommit == $source and (.provenance.runId | tostring) == $run' \
+            "$candidate" >/dev/null || { echo 'Downloaded candidate identity disagrees with its immutable artifact'; exit 1; }
+      - uses: ${actionPins.pnpmSetup}
+      - uses: ${actionPins.setupNode}
+        with:
+          node-version: ${nodeVersion}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        run: pnpm nx run ${name}:workspace-health
+      - name: Validate read-only evidence role configuration
+        run: |
+          set -euo pipefail
+          test -n "$AWS_EVIDENCE_ROLE_ARN" && test -n "$AWS_EXPECTED_ACCOUNT_ID" && test -n "$AWS_REGION"
+          case "$AWS_EVIDENCE_ROLE_ARN" in
+            arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
+            *) echo 'ECR evidence role does not belong to the expected account'; exit 1 ;;
+          esac
+      - uses: ${actionPins.configureAwsCredentials}
+        with:
+          role-to-assume: \${{ secrets.AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN }}
+          role-session-name: ebk-ecr-inspector-\${{ github.run_id }}-\${{ github.run_attempt }}
+          aws-region: \${{ vars.AWS_REGION }}
+      - name: Collect exact deployed OCI and Inspector evidence
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          [ "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID" ]
+          slice_root="packages/$EBK_SLICE"
+          test -d "$slice_root" || { echo 'Requested Product Slice is absent'; exit 1; }
+          input="$slice_root/.ebk/evidence/ecr-inspector-input.json"
+          EBK_COLLECTOR_INPUT="$input" node -e '
+            const { mkdirSync, writeFileSync } = require("node:fs");
+            const { dirname } = require("node:path");
+            const deployment = process.env.EBK_DEPLOYMENT_KIND === "service"
+              ? { clusterArn: process.env.EBK_CLUSTER_ARN, kind: "service", serviceArn: process.env.EBK_DEPLOYMENT_ARN }
+              : { clusterArn: process.env.EBK_CLUSTER_ARN, kind: "task", taskArn: process.env.EBK_DEPLOYMENT_ARN };
+            const record = {
+              accountId: process.env.AWS_EXPECTED_ACCOUNT_ID,
+              artifactId: process.env.EBK_ARTIFACT_ID,
+              deployment,
+              deployRunAttempt: process.env.EBK_DEPLOY_RUN_ATTEMPT,
+              deployRunId: process.env.EBK_DEPLOY_RUN_ID,
+              deploymentReceiptPath: "../../.ebk/evidence/deployment/latest.json",
+              outputDirectory: ".ebk/evidence/supply-chain/ecr-scans",
+              postdeployBindingPath: "../../.ebk/evidence/deployment/postdeploy-supply-chain.json",
+              region: process.env.AWS_REGION,
+              releaseCandidatePath: "../../.ebk/evidence/ecr-original-release-candidate/packages/" + process.env.EBK_SLICE + "/candidate.json",
+              schemaVersion: 1,
+              stage: process.env.EBK_STAGE,
+              taskDefinitionFamily: process.env.EBK_TASK_DEFINITION_FAMILY,
+            };
+            mkdirSync(dirname(process.env.EBK_COLLECTOR_INPUT), { recursive: true, mode: 0o700 });
+            writeFileSync(process.env.EBK_COLLECTOR_INPUT, JSON.stringify(record, null, 2) + "\\n", { flag: "wx", mode: 0o600 });
+          '
+          export EBK_ECR_SCAN_INPUT_PATH=.ebk/evidence/ecr-inspector-input.json
+          pnpm nx run "$EBK_SLICE:ecr-inspector-collect"
+      - name: Clear current ECR evidence authority
+        if: always()
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
+          echo 'AWS_ACCESS_KEY_ID=' >> "$GITHUB_ENV"
+          echo 'AWS_SECRET_ACCESS_KEY=' >> "$GITHUB_ENV"
+          echo 'AWS_SESSION_TOKEN=' >> "$GITHUB_ENV"
+          echo 'AWS_SECURITY_TOKEN=' >> "$GITHUB_ENV"
+      - name: Retain exact deployed OCI and Inspector evidence
+        if: always()
+        uses: ${actionPins.uploadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          AWS_ACCESS_KEY_ID: ''
+          AWS_SECRET_ACCESS_KEY: ''
+          AWS_SESSION_TOKEN: ''
+        with:
+          name: ecr-inspector-\${{ inputs.stage }}-\${{ inputs.slice }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 90
+          path: |
+            packages/\${{ inputs.slice }}/.ebk/evidence/ecr-inspector-input.json
+            packages/\${{ inputs.slice }}/.ebk/evidence/supply-chain/ecr-scans/**
+`,
+    };
+}
+//# sourceMappingURL=workspace-files-ecr-inspector.js.map

package/src/generators/preset/workspace-files-ecr-inspector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-files-ecr-inspector.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-ecr-inspector.ts"],"names":[],"mappings":";;;AAoBA,wEAsSC;AAxTY,QAAA,gCAAgC,GAC3C,8CAAuD,CAAC;AAgB1D,iFAAiF;AACjF,SAAgB,8BAA8B,CAC5C,OAAoC;IAEpC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACrE,MAAM,YAAY,GAChB,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACzE,MAAM,gBAAgB,GACpB,iBAAiB,KAAK,SAAS;QAC7B,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,iCAAiC,CAAC;IACxC,OAAO;QACL,CAAC,wCAAgC,CAAC,EAAE;;;;;;;;;oBASpB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDAiFkB,gBAAgB;;;;;;;;;;;;;;;;;;;;;;gBAsBlD,UAAU,CAAC,QAAQ;;;;;;gBAMnB,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0D3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;gBAoB3B,UAAU,CAAC,SAAS;gBACpB,UAAU,CAAC,SAAS;;0BAEV,WAAW;;;;2BAIV,IAAI;;;;;;;;;gBASf,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAsDlC,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;CAexC;KACE,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-performance-cost.d.ts

@@ -55,12 +55,12 @@ export declare function validateProtectedAggregateCountSourceAuthority(input: Pr
     artifactName: string;
     runAttempt: string;
 }>;
-export declare function renderProtectedAggregateCountWorkflow(): Readonly<Record<typeof PROTECTED_AGGREGATE_COUNT_WORKFLOW_PATH, string>>;
+export declare function renderProtectedAggregateCountWorkflow(rehearsalStage?: 'development' | 'staging'): Readonly<Record<typeof PROTECTED_AGGREGATE_COUNT_WORKFLOW_PATH, string>>;
 /**
  * Treats caller-supplied run IDs and artifact names only as selectors. The
  * selected producer runs and artifacts must independently match the fixed
  * protected workflow contracts before AWS authority is introduced.
  */
 export declare function validateProtectedPerformanceCostSourceAuthority(input: ProtectedPerformanceCostSourceAuthority): void;
-export declare function renderProtectedPerformanceCostWorkflow(): Readonly<Record<typeof PROTECTED_PERFORMANCE_COST_WORKFLOW_PATH, string>>;
+export declare function renderProtectedPerformanceCostWorkflow(rehearsalStage?: 'development' | 'staging'): Readonly<Record<typeof PROTECTED_PERFORMANCE_COST_WORKFLOW_PATH, string>>;
 export {};

package/src/generators/preset/workspace-files-performance-cost.js

@@ -20,7 +20,7 @@ function validateProtectedAggregateCountSourceAuthority(input) {
     const refuse = (detail) => {
         throw new Error(`Protected aggregate-count source authority is invalid: ${detail}.`);
     };
-    const branch = input.stage === 'staging'
+    const branch = input.stage === 'development' || input.stage === 'staging'
         ? 'develop'
         : input.stage === 'production'
             ? 'main'
@@ -61,7 +61,7 @@ function validateProtectedAggregateCountSourceAuthority(input) {
     }
     return Object.freeze({ artifactName, runAttempt });
 }
-function renderProtectedAggregateCountWorkflow() {
+function renderProtectedAggregateCountWorkflow(rehearsalStage = 'staging') {
     const checkout = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.checkout);
     const configureAws = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.configureAwsCredentials);
     const downloadArtifact = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.downloadArtifact);
@@ -79,7 +79,7 @@ on:
         description: Exact protected aggregate cohort stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${rehearsalStage}, production]
       project:
         description: Exact Product Slice project
         required: true
@@ -137,7 +137,7 @@ jobs:
         run: |
           set -euo pipefail
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${rehearsalStage}:refs/heads/develop|production:refs/heads/main) ;;
             *) echo 'Aggregate stage does not match its protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in
@@ -334,7 +334,7 @@ function validateProtectedPerformanceCostSourceAuthority(input) {
     const refuse = (detail) => {
         throw new Error(`Protected cost source authority is invalid: ${detail}.`);
     };
-    const branch = input.stage === 'staging'
+    const branch = input.stage === 'development' || input.stage === 'staging'
         ? 'develop'
         : input.stage === 'production'
             ? 'main'
@@ -399,7 +399,7 @@ function validateProtectedPerformanceCostSourceAuthority(input) {
     validateArtifact(input.aggregateArtifacts, input.aggregateArtifactTotal, input.aggregateArtifactName, expectedAggregateName, 'aggregate-count');
     validateArtifact(input.releaseArtifacts, input.releaseArtifactTotal, input.releaseArtifactName, expectedReleaseName, 'release');
 }
-function renderProtectedPerformanceCostWorkflow() {
+function renderProtectedPerformanceCostWorkflow(rehearsalStage = 'staging') {
     const checkout = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.checkout);
     const configureAws = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.configureAwsCredentials);
     const downloadArtifact = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.downloadArtifact);
@@ -417,7 +417,7 @@ on:
         description: Exact protected billing cohort stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${rehearsalStage}, production]
       project:
         description: Exact Product Slice project
         required: true
@@ -511,7 +511,7 @@ jobs:
         run: |
           set -euo pipefail
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${rehearsalStage}:refs/heads/develop|production:refs/heads/main) ;;
             *) echo 'Cost collection stage does not match its protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in