@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/generators/preset/workspace-files-thin-deploy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-files-thin-deploy.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-deploy.ts"],"names":[],"mappings":";;;AA2EA,oEA6BC;AAYD,sEAsBC;AAGD,0FAuBC;AAGD,oFAmBC;AAGD,0FAiFC;AAGD,8EAmCC;AAGD,gEA4EC;AAGD,gFAoEC;AA6iCD,4EAUC;AA//CY,QAAA,yBAAyB,GACpC,8BAAuC,CAAC;AA4B1C,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,MAAM,UAAU,GACd,iEAAiE,CAAC;AAEpE,SAAS,aAAa,CAAC,OAAkC;IACvD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA0B;IACrD,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;;;;;;;;;;;;;;CAiBL,CAAC;AACF,CAAC;AAED,SAAgB,4BAA4B,CAC1C,OAA0B;IAE1B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,yEAAyE,CAAC;IAC5E,OAAO;;;;;;;;QAQD,wBAAwB;;;;;;;;;;;;;;2CAcW,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,MAAM;SACV,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,+DAA+D;AAC/D,SAAgB,6BAA6B,CAC3C,SAAiB,EACjB,eAAuB;IAEvB,OAAO;yBACgB,eAAe;UAC9B,SAAS;;;;;UAKT,SAAS;;6CAE0B,eAAe;;UAElD,SAAS;;kDAE+B,eAAe;;;aAGpD,SAAS;KACjB,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,SAAgB,uCAAuC;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;8CAqBqC,CAAC;AAC/C,CAAC;AAED,+DAA+D;AAC/D,SAAgB,oCAAoC;IAClD,OAAO;;;;;;;;;;;;;;;;;KAiBJ,CAAC;AACN,CAAC;AAED,kFAAkF;AAClF,SAAgB,uCAAuC;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4HA+EmH,CAAC;AAC7H,CAAC;AAED,kFAAkF;AAClF,SAAgB,iCAAiC;IAC/C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wGAiC+F,CAAC;AACzG,CAAC;AAED,kFAAkF;AAClF,SAAgB,0BAA0B;IACxC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uHA0E8G,CAAC;AACxH,CAAC;AAED,kFAAkF;AAClF,SAAgB,kCAAkC;IAChD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEN,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAkC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACtE,OAAO;;;;EAIP,mBAAmB,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;8BAwBV,YAAY,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAkE9B,UAAU,CAAC,QAAQ;;;;;gBAKnB,UAAU,CAAC,SAAS;gBACpB,UAAU,CAAC,SAAS;;0BAEV,YAAY,CAAC,IAAI;;;;;;;;yBAQlB,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4ClB,IAAI;;;kCAGM,iBAAiB;;;;;;;;;;;;EAYjD,cAAc,CAAC,sBAAsB,uCAAuC,EAAE,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6BvE,UAAU,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6FnB,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;EAwBzC,cAAc,CAAC,uCAAuC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2E/C,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,6BAA6B,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;gBAOhF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0CzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,6BAA6B,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;;;;gBAanF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA4CzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,oCAAoC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;gBAyB5C,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;EAchD,cAAc,CAAC,6BAA6B,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;gBAUtF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAmEzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;;gBAGf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;gBAiB3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;gBAa3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCzC,cAAc,CAAC,iCAAiC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAiC9B,IAAI;;;;;;2BAMJ,IAAI;;;;;;;;;;;;;;;;;;;gBAmBf,UAAU,CAAC,uBAAuB;;;;;;;;;;;EAWhD,cAAc,CAAC,6BAA6B,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;0BAUvE,IAAI;;;;;;;;;;;;;;;;;;;;;;;;EAwB5B,cAAc,CAAC,0BAA0B,EAAE,EAAE,EAAE,CAAC;;;;;;;;;EAShD,cAAc,CAAC,kCAAkC,EAAE,EAAE,EAAE,CAAC;;;;gBAI1C,UAAU,CAAC,cAAc;;;;;;;;;;CAUxC,CAAC;AACF,CAAC;AAED,SAAgB,gCAAgC,CAC9C,OAAkC;IAElC,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO;QACL,KAAK,EAAE;YACL,CAAC,iCAAyB,CAAC,EAAE,wBAAwB,CAAC,OAAO,CAAC;SAC/D;QACD,YAAY,EAAE,CAAC,iCAAyB,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-thin-docs.d.ts

@@ -0,0 +1,5 @@
+import { type DeploymentProfile } from '../../repository-policy/index.js';
+export declare function renderThinLifecycleDocumentation(options: {
+    deploymentProfile: DeploymentProfile;
+    name: string;
+}): Readonly<Record<string, string>>;

package/src/generators/preset/workspace-files-thin-docs.js

@@ -0,0 +1,240 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderThinLifecycleDocumentation = renderThinLifecycleDocumentation;
+const index_js_1 = require("../../repository-policy/index.js");
+function renderThinLifecycleDocumentation(options) {
+    const stages = (0, index_js_1.activeDeploymentStages)(options.deploymentProfile);
+    const stageList = stages.join(', ');
+    const rehearsalStage = (0, index_js_1.productionRehearsalStage)(options.deploymentProfile);
+    return {
+        'README.md': `# ${options.name}
+
+This repository follows the Empire Builder Kit thin SST paved road. Nx owns
+generation, ordering, identity checks, migrations, smoke tests, and receipts;
+SST 4.17.1 owns application bootstrap, state, locks, previews, deployment,
+refresh, removal, and provider diagnostics.
+
+The committed \`${options.deploymentProfile}\` profile activates: ${stageList}.
+
+Start with \`pnpm verify\`, configure the exact temporary AWS profile and stage
+deployment role described in \`docs/stage-deployment-authority.md\`, then deploy
+development through the root \`deploy-local\` target. Do not invoke SST directly.
+`,
+        'docs/git-workflow.md': `# Protected Git workflow
+
+Ordinary work targets \`develop\`; production promotion is an exact reviewed
+\`develop\` to \`main\` merge followed by the managed sync-back. Keep the
+generated branch rules, CODEOWNER review, resolved-conversation requirement,
+merge-only history, and read-only default workflow permissions.
+
+The managed \`Deploy\` workflow is the single protected infrastructure path.
+It derives the canonical stage deployment-role ARN from committed account,
+stage, Region-partition, and naming policy; the GitHub environment supplies no
+deployment-role secret. It invokes the same root Nx lifecycle used locally,
+runs migrations and Slice smoke checks after each successful native SST
+deployment, and retains one bounded deployment receipt.
+For isolated profiles, the protected-branch \`Verify\` run calls the reusable
+\`Deploy\` workflow only after acceptance and its immutable candidate succeed.
+The call binds the exact source commit, branch ref, run, and attempt, consumes
+artifacts from that same run, and rechecks the live protected-branch tip before
+AWS authority. A verified history-only sync skips both candidate creation and
+the deployment call. Manual recovery remains an explicit workflow dispatch.
+There is no second deployed-smoke workflow, staging-evidence workflow,
+reliability-read workflow, preview approval artifact, or plan role.
+
+For \`starter\`, GitHub deployment is optional. \`production-isolated\` permits
+local staging, but its protected production promotion requires the candidate
+receipt from a successful managed GitHub staging deployment. \`fully-isolated\`
+uses GitHub for staging and production. Isolated production restores the exact
+candidate recorded by the successful staging deployment.
+When \`starter\` uses its optional manual workflow, \`develop\` routes to
+development and \`main\` routes to production; starter has no automatic caller.
+Every protected job checks out an immutable commit, validates managed source,
+and assumes the derived stage role through the matching GitHub environment.
+The reusable Verify caller delegates job-scoped \`id-token: write\`; each
+credential-bearing job proves both the configured canonical ARN and terminal
+STS assumed-role caller immediately before OCI or lifecycle mutation.
+
+Run GitHub bootstrap in report mode first to obtain the repository's canonical
+slug and immutable owner/repository IDs. It configures repository and environment
+policy but never creates AWS credentials, secrets, or roles. For an existing
+repository, keep its current OIDC subject active while you render and apply the
+stage AWS trust for the reported immutable subject, then read back and simulate
+that effective trust. Only after AWS accepts the immutable subject should you
+rerun GitHub bootstrap with \`--apply\` and the exact
+\`--immutableOidcTrustAcknowledgement=aws-trust-ready:<repositoryIdentity.subjectPrefix>\`
+reported by the same inspection. A missing, wrong, or stale acknowledgement
+blocks the subject cutover before any GitHub setting is changed.
+This AWS-trust-first order prevents protected deployment from being stranded.
+Place the exact account and Region in their protected stage environment.
+Isolated production additionally keeps its exact staging promotion-pull role
+secret; do not add repository-scope fallbacks.
+`,
+        'docs/repository-operating-policy.md': `# Repository Operating Policy
+
+The committed \`ebk.repository-policy.json\` selects the
+\`${options.deploymentProfile}\` deployment profile and its active stages:
+${stageList}. Inactive stages are rejected by planning, deployment, refresh,
+removal, unlock, discovery, and secret resolution.
+
+## Native lifecycle
+
+The root \`${options.name}:deploy-local\` target orders Foundation before every
+eligible Product Slice. Each project runs its public Nx \`deploy\` target, which
+uses pinned native \`sst deploy\`; successful Slice infrastructure is followed
+by its governed migration and smoke checks. Native stdout and stderr are
+streamed unchanged. The first failed child ends the invocation and accepted
+deployment evidence is not written.
+
+\`infrastructure-plan\` is an optional advisory pass-through to native
+\`sst diff\`. It is never replayed and never authorizes mutation. Refresh,
+remove, and unlock are explicit per-project Nx operations using native SST.
+Every local SST-bearing operation derives the exact stage deployment role from
+committed policy and gives SST an invocation-private temporary profile rather
+than the operator's Identity Center profile chain.
+
+Governed AWS infrastructure planning and mutation are supported on macOS,
+Linux, and WSL2. Native Windows remains supported for local development and
+verification, but run \`deploy-local\`, \`infrastructure-plan\`, \`refresh\`,
+\`remove\`, and \`unlock\` from WSL2 or a macOS/Linux host. Generated protected
+GitHub AWS jobs continue to run on Ubuntu.
+
+Development may deploy a dirty working tree without a prompt. Its receipt binds
+the exact HEAD and working-tree digest. Local staging requires a clean commit
+and the exact TTY acknowledgement
+\`approve:deploy:staging:<source-commit>\`. Starter production requires a clean
+commit, a real TTY, and
+\`deploy:production:<account>:<region>:<source-commit>\`.
+
+GitHub deploys immutable commits through one canonical stage-scoped OIDC role
+whose ARN is derived from committed policy. The
+starter workflow is optional; isolated profiles require GitHub for the stages
+declared by their profile. Direct user SST invocation is outside the supported
+paved road.
+
+## AWS authority
+
+Each active stage has one stable deployment role and one runtime permission
+boundary. SST/Pulumi creates workload roles inside the application stack; a
+Pulumi transform applies the exact stage path and boundary. Authority is not
+candidate-bound. See \`stage-deployment-authority.md\`.
+
+The deployment role is a temporary bounded infrastructure administrator. IAM
+cannot inspect the initial trust document on \`CreateRole\`; reviewed generated
+source is therefore the create-time trust control, while later trust-policy
+mutation remains denied. EBK does not claim a postdeployment trust attestor. In
+commercial AWS, CloudFront, CloudFront-scope WAF, edge WAF log delivery, and
+edge ACM use the us-east-1 control plane. CloudWatch Logs cannot scope the
+generated WAF \`PutResourcePolicy\` payload through IAM; reviewed generated
+source and the edge Region are its controls. RC.31 does not claim Router edge support in noncommercial
+partitions: CloudFront is unavailable in GovCloud, and the China-partition edge
+control plane is not yet proven.
+
+Stages that share one AWS account retain separate application resources, data,
+runtime roles, secrets, and discovery, but their native SST deployment roles
+are not a hard IAM boundary from each other. The deployment role must reconcile
+SST's account-shared bootstrap state and assets; tag and name denies are defense
+in depth. Select \`production-isolated\` when production needs an AWS-enforced
+deployment blast-radius boundary from nonproduction.
+
+Native SST initializes a clean account on first deployment. EBK does not run a
+pre-bootstrap state command or require a bootstrap record before SST can create
+it. Post-deployment evidence may attest the native bootstrap resources.
+`,
+        'packages/foundation/README.md': `# Standard Foundation
+
+Foundation owns the shared network, Router/WAF, Aurora, Cognito, events,
+observability, configuration, and container-compute resources for each active
+canonical stage. The \`${options.deploymentProfile}\` profile activates:
+${stageList}.
+
+Deploy it through the workspace root \`deploy-local\` target or the protected
+GitHub workflow. Nx always orders Foundation before Product Slices, while
+pinned SST owns native planning, state, locking, and deployment. Do not invoke
+SST directly.
+
+Before a nonproduction deployment, add the operator/probe CIDRs required by the
+stage's \`security/router-waf.json\` entry. Production remains public by default
+behind managed rules and rate limiting and requires its blocking rehearsal.
+The resolved ${rehearsalStage} stage is rehearsed with
+\`pnpm nx run foundation:router-waf-rehearsal -- --probeUrl=https://<router>/<slice>/api/health --profile=<temporary-profile>\`.
+`,
+        'packages/foundation/docs/runbooks.md': `# Foundation lifecycle runbook
+
+## Local deployment
+
+Use temporary IAM Identity Center credentials and the stable stage deployment
+role. Development accepts a dirty tree and requires no acknowledgement:
+
+\`pnpm nx run ${options.name}:deploy-local -- --stage=development --profile=<profile> --expectedRoleArn=<role-arn>\`
+
+Local staging, when active, requires a clean commit and an interactive
+\`approve:deploy:staging:<source-commit>\` response. Starter production requires
+a clean commit and one exact response entered at the real terminal prompt:
+
+\`deploy:production:<account>:<region>:<source-commit>\`
+
+The internal adapter converts the selected Identity Center chain into one
+invocation-private temporary profile, verifies the exact caller, and removes it
+on every exit path. Native SST diagnostics are not normalized or hidden.
+
+## Advisory planning and recovery
+
+Run \`<project>:infrastructure-plan\` for an advisory native diff when useful.
+The diff is not a transaction token. Use the explicit \`refresh\`, \`unlock\`,
+or \`remove\` Nx target for recovery. Refresh and removal never continue into a
+deployment. Development recovery requires no prompt. Local staging or
+production recovery requires a clean commit and the exact interactive
+\`approve:<action>:<stage>:<source-commit>\` response. The executor derives the
+committed stage role, refreshes its invocation-private temporary credentials
+immediately before SST, and removes them on every exit. A failed child stops
+immediately.
+
+## Router WAF rehearsal
+
+Count-mode tuning is optional. Restore ${rehearsalStage} to blocking mode,
+record the bounded allowlist and managed-rule probe results in
+\`security/router-waf-live-evidence.json\`, then run:
+
+\`pnpm nx run foundation:router-waf-rehearsal -- --probeUrl=https://<router>/<slice>/api/health --profile=<temporary-profile>\`
+
+The target derives stage, account, Region, and deployment role from the
+committed repository policy. Retained evidence must name that exact account,
+Region, deployment-role ARN, workspace, and deterministic WAF contract digest;
+the 40- or 64-character source commit remains in the evidence digest. Before
+traffic the target verifies the caller, the exact enabled CloudFront
+non-staging distribution and Web ACL attachment, their exact identity tags, the
+full ordered generated rule/IP-set/logging inventory, metrics/sampling, and the
+EBK policy/stage/workspace/ownership tags, then requires a successful health GET.
+The managed-rule and nonallowlisted operator records must first correlate by
+marker, method, path, and time to exact sampled BLOCK requests and owning rules.
+The public rate threshold is bounded from 100 through
+2,159; the default remains 2,000. The target uses concurrency 16 for a bounded
+burst and reserves 40 five-second follow-ups for AWS WAF's delayed evaluation.
+It sends at most 2,199 rate-probe requests so the baseline GET keeps the whole
+invocation at or below 2,200 HTTP requests, and never treats an upstream HTTP 429 as WAF
+proof. The receipt seals only after HTTP 403 correlates to the exact nonce- and
+sequence-marked \`GET /<slice>/api/health\` request in an exact \`RateLimitPerIP\`
+\`BLOCK\` sample and the same-minute \`AWS/WAFV2\` \`BlockedRequests\` metric;
+retained evidence contains only the marker digest. Run this rate probe last:
+AWS WAF can continue blocking the source IP for several minutes. The sealed
+receipt binds the derived account and Region.
+
+## Production safeguards
+
+Production keeps the committed Aurora capacity profile, 30-day backup
+retention, deletion protection, WAF blocking rehearsal, migration preflight,
+and application smoke checks. Any change to these controls must be a committed
+policy change and must remain permitted by the stage authority's explicit
+guardrails. AWS exposes SNS topic and SQS queue policy updates through the same
+Set*Attributes actions required during native creation and provides no
+attribute-name IAM condition. The stable stage role therefore contains those
+calls by exact account, Region, and generated stage-name pattern; hard stage
+separation requires an isolated profile. CloudFront KeyValueStore data-plane
+ARNs likewise expose account and store identity but no stage condition key, so
+the Router's exact six key operations are account-scoped; use an isolated
+profile when that boundary must be enforced by AWS accounts.
+`,
+    };
+}
+//# sourceMappingURL=workspace-files-thin-docs.js.map

package/src/generators/preset/workspace-files-thin-docs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-files-thin-docs.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-docs.ts"],"names":[],"mappings":";;AAMA,4EA6OC;AAnPD,+DAI0C;AAE1C,SAAgB,gCAAgC,CAAC,OAGhD;IACC,MAAM,MAAM,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAA,mCAAwB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,OAAO;QACL,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI;;;;;;;kBAOhB,OAAO,CAAC,iBAAiB,yBAAyB,SAAS;;;;;CAK5E;QACG,sBAAsB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiD3B;QACG,qCAAqC,EAAE;;;IAGvC,OAAO,CAAC,iBAAiB;EAC3B,SAAS;;;;;aAKE,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DxB;QACG,+BAA+B,EAAE;;;;yBAIZ,OAAO,CAAC,iBAAiB;EAChD,SAAS;;;;;;;;;;eAUI,cAAc;;CAE5B;QACG,sCAAsC,EAAE;;;;;;;gBAO5B,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;yCA0Ba,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtD;KACE,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-thin-release.d.ts

@@ -0,0 +1,14 @@
+export declare const RETIRED_THIN_LIFECYCLE_PATHS: readonly [".github/workflows/deployed-smoke.yml", ".github/workflows/reliability-read.yml", ".github/workflows/release-rollout.yml", ".github/workflows/staging-evidence.yml", "tools/verify-staging-evidence.mjs"];
+export interface ThinReleaseWorkflowPlan {
+    files: Readonly<Record<string, string>>;
+    obsoletePaths: typeof RETIRED_THIN_LIFECYCLE_PATHS;
+}
+/**
+ * Protected release promotion now occurs through the one native deploy
+ * workflow. The former rollout, post-deploy smoke, staging-evidence, and
+ * reliability-read workflows reconstructed preview-era deployment authority
+ * from artifacts that the thin lifecycle no longer emits. Native deployment
+ * runs each Slice smoke target before sealing its receipt, so retaining that
+ * parallel graph would be both redundant and permanently red.
+ */
+export declare function renderThinReleaseWorkflowPlan(): ThinReleaseWorkflowPlan;

package/src/generators/preset/workspace-files-thin-release.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RETIRED_THIN_LIFECYCLE_PATHS = void 0;
+exports.renderThinReleaseWorkflowPlan = renderThinReleaseWorkflowPlan;
+exports.RETIRED_THIN_LIFECYCLE_PATHS = Object.freeze([
+    '.github/workflows/deployed-smoke.yml',
+    '.github/workflows/reliability-read.yml',
+    '.github/workflows/release-rollout.yml',
+    '.github/workflows/staging-evidence.yml',
+    'tools/verify-staging-evidence.mjs',
+]);
+/**
+ * Protected release promotion now occurs through the one native deploy
+ * workflow. The former rollout, post-deploy smoke, staging-evidence, and
+ * reliability-read workflows reconstructed preview-era deployment authority
+ * from artifacts that the thin lifecycle no longer emits. Native deployment
+ * runs each Slice smoke target before sealing its receipt, so retaining that
+ * parallel graph would be both redundant and permanently red.
+ */
+function renderThinReleaseWorkflowPlan() {
+    return {
+        files: {},
+        obsoletePaths: exports.RETIRED_THIN_LIFECYCLE_PATHS,
+    };
+}
+//# sourceMappingURL=workspace-files-thin-release.js.map

package/src/generators/preset/workspace-files-thin-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-files-thin-release.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-release.ts"],"names":[],"mappings":";;;AAqBA,sEAKC;AA1BY,QAAA,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,sCAAsC;IACtC,wCAAwC;IACxC,uCAAuC;IACvC,wCAAwC;IACxC,mCAAmC;CAC3B,CAAC,CAAC;AAOZ;;;;;;;GAOG;AACH,SAAgB,6BAA6B;IAC3C,OAAO;QACL,KAAK,EAAE,EAAE;QACT,aAAa,EAAE,oCAA4B;KAC5C,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files.d.ts

@@ -6,6 +6,7 @@ export interface WorkspaceFileOptions {
     deploymentRegion?: string | null;
     frameworkVersion: string;
     name: string;
+    workspaceDeploymentId?: string;
 }
 export declare const BLUEPRINT_TRUST_AUTHORITY_PATH: "tools/blueprint-trust-check.mjs";
 export declare function isRawWorkspaceAuthorityPath(path: string): boolean;
@@ -20,7 +21,7 @@ export interface PlanProviderRefreshPolicyStatement {
 }
 export declare function validatePlanProviderRefreshPolicy(value: unknown, region: string, account: string, stage: 'production' | 'staging'): PlanProviderRefreshPolicyStatement[];
 export declare const WORKSPACE_PACKAGE_MANAGED_JSON_POINTERS: readonly ["/devDependencies/eslint-plugin-jsx-a11y", "/devDependencies/vitest", "/engines/node", "/engines/pnpm", "/packageManager"];
-export declare const WORKSPACE_PROJECT_MANAGED_JSON_POINTERS: readonly ["/name", "/$schema", "/projectType", "/root", "/tags", "/targets/blueprint-trust-check", "/targets/blueprint-trust-check-main", "/targets/blueprint-trust-check-protected", "/targets/developer-context", "/targets/deployment-plan", "/targets/deploy-local", "/targets/dev", "/targets/dev-doctor", "/targets/dev-setup", "/targets/github-bootstrap", "/targets/install-git-hooks", "/targets/supply-chain-check", "/targets/supply-chain-check-protected", "/targets/supply-chain-scan", "/targets/verify", "/targets/verify-proposed", "/targets/work-markers", "/targets/workload-role-candidate-report", "/targets/workload-role-provisioner-build", "/targets/workspace-health"];
+export declare const WORKSPACE_PROJECT_MANAGED_JSON_POINTERS: readonly ["/name", "/$schema", "/projectType", "/root", "/tags", "/targets/blueprint-trust-check", "/targets/blueprint-trust-check-main", "/targets/blueprint-trust-check-protected", "/targets/developer-context", "/targets/deployment-plan", "/targets/deploy-local", "/targets/dev", "/targets/dev-doctor", "/targets/dev-setup", "/targets/github-bootstrap", "/targets/install-git-hooks", "/targets/stage-authority-render", "/targets/supply-chain-check", "/targets/supply-chain-check-protected", "/targets/supply-chain-scan", "/targets/verify", "/targets/verify-proposed", "/targets/work-markers", "/targets/workspace-health"];
 export interface FoundationFilePlan {
     files: Readonly<Record<string, string>>;
     ownership: FoundationOwnershipRecord;