@empire-builder-kit/nx 1.0.0-rc.32 → 1.0.0-rc.33

package/src/foundation/private-smoke-control-plane.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openPrivateSmokeControlPlane = openPrivateSmokeControlPlane;
+const client_wafv2_1 = require("@aws-sdk/client-wafv2");
+const client_cloudfront_1 = require("@aws-sdk/client-cloudfront");
+function check(condition, message) {
+    if (!condition)
+        throw new Error(`Private smoke access: ${message}`);
+}
+/** Only global WAF resources attached to the exact generated Router are eligible. */
+async function openPrivateSmokeControlPlane(identity, smokeUrl, clients = {
+    waf: new client_wafv2_1.WAFV2Client({
+        region: 'us-east-1',
+        endpoint: 'https://wafv2.us-east-1.amazonaws.com',
+        maxAttempts: 3,
+        requestHandler: { connectionTimeout: 10_000, requestTimeout: 30_000 },
+    }),
+    cloudfront: new client_cloudfront_1.CloudFrontClient({
+        region: 'us-east-1',
+        endpoint: 'https://cloudfront.amazonaws.com',
+        maxAttempts: 3,
+        requestHandler: { connectionTimeout: 10_000, requestTimeout: 30_000 },
+    }),
+}) {
+    check(/^\d{12}$/.test(identity.account) &&
+        /^[a-z0-9][a-z0-9-]{0,62}$/.test(identity.workspace) &&
+        ['development', 'staging', 'production'].includes(identity.stage) &&
+        /^sha256:[a-f0-9]{64}$/.test(identity.policyDigest), 'invalid committed resource identity');
+    const url = smokeUrl === undefined ? undefined : new URL(smokeUrl);
+    if (url)
+        check(url.protocol === 'https:' && !url.username && !url.password && !url.port, 'credential-free HTTPS Router required');
+    const name = `foundation-${identity.stage}-router-ipv4-allowlist`;
+    const ipSets = [];
+    let marker;
+    const seen = new Set();
+    do {
+        const page = await clients.waf.send(new client_wafv2_1.ListIPSetsCommand({
+            Scope: 'CLOUDFRONT',
+            Limit: 100,
+            NextMarker: marker,
+        }));
+        ipSets.push(...(page.IPSets ?? []));
+        marker = page.NextMarker;
+        check(!marker || !seen.has(marker), 'IP-set pagination did not advance');
+        if (marker)
+            seen.add(marker);
+        check(seen.size <= 100, 'IP-set inventory exceeds bounded inspection');
+    } while (marker);
+    const matches = ipSets.filter((set) => set.Name === name);
+    check(matches.length === 1 && matches[0].Id, 'exact stage IPv4 IP set missing or ambiguous; configure a baseline IPv4 CIDR before private hosted smoke');
+    const selected = matches[0];
+    const arn = `arn:aws:wafv2:us-east-1:${identity.account}:global/ipset/${name}/${selected.Id}`;
+    check(selected.ARN === arn, 'IP-set account/scope/identity mismatch');
+    const expectedTags = {
+        'ebk:managed-by': 'empire-builder-kit',
+        'ebk:owner': 'foundation',
+        'ebk:stage': identity.stage,
+        'ebk:workspace': identity.workspace,
+        'ebk:policy-digest': identity.policyDigest,
+    };
+    async function attestTags(resourceArn) {
+        const tags = {};
+        let tagMarker;
+        const markers = new Set();
+        do {
+            const page = await clients.waf.send(new client_wafv2_1.ListTagsForResourceCommand({
+                ResourceARN: resourceArn,
+                NextMarker: tagMarker,
+                Limit: 100,
+            }));
+            for (const tag of page.TagInfoForResource?.TagList ?? []) {
+                if (tag.Key && tag.Value)
+                    tags[tag.Key] = tag.Value;
+            }
+            tagMarker = page.NextMarker;
+            check(!tagMarker || !markers.has(tagMarker), 'tag pagination did not advance');
+            if (tagMarker)
+                markers.add(tagMarker);
+            check(markers.size <= 10, 'tag inventory exceeds bounded inspection');
+        } while (tagMarker);
+        for (const [key, value] of Object.entries(expectedTags))
+            check(tags[key] === value, 'WAF ownership or committed policy differs');
+    }
+    await attestTags(arn);
+    // Cleanup never expands access; exact tagged IP-set identity and lease are sufficient.
+    // Admission additionally proves the Router-to-ACL-to-IP-set attachment.
+    if (url) {
+        const distributions = [];
+        marker = undefined;
+        seen.clear();
+        do {
+            const page = await clients.cloudfront.send(new client_cloudfront_1.ListDistributionsCommand({ Marker: marker }));
+            distributions.push(...(page.DistributionList?.Items ?? []));
+            marker = page.DistributionList?.NextMarker;
+            check(!page.DistributionList?.IsTruncated || marker, 'truncated Router inventory has no continuation');
+            check(!marker || !seen.has(marker), 'Router pagination did not advance');
+            if (marker)
+                seen.add(marker);
+            check(seen.size <= 100, 'Router inventory exceeds bounded inspection');
+        } while (marker);
+        const routers = distributions.filter((router) => router.DomainName === url.hostname ||
+            router.Aliases?.Items?.includes(url.hostname));
+        check(routers.length === 1 &&
+            routers[0].Enabled &&
+            routers[0].ARN?.startsWith(`arn:aws:cloudfront::${identity.account}:distribution/`), 'exact account Router missing, disabled, or ambiguous');
+        const acls = [];
+        marker = undefined;
+        seen.clear();
+        do {
+            const page = await clients.waf.send(new client_wafv2_1.ListWebACLsCommand({
+                Scope: 'CLOUDFRONT',
+                Limit: 100,
+                NextMarker: marker,
+            }));
+            acls.push(...(page.WebACLs ?? []));
+            marker = page.NextMarker;
+            check(!marker || !seen.has(marker), 'Web ACL pagination did not advance');
+            if (marker)
+                seen.add(marker);
+            check(seen.size <= 100, 'Web ACL inventory exceeds bounded inspection');
+        } while (marker);
+        const attached = acls.filter((acl) => acl.ARN === routers[0].WebACLId);
+        check(attached.length === 1 &&
+            attached[0].Id &&
+            attached[0].Name &&
+            attached[0].ARN?.startsWith(`arn:aws:wafv2:us-east-1:${identity.account}:global/webacl/`), 'Router Web ACL is outside the exact account/scope');
+        const acl = attached[0];
+        await attestTags(acl.ARN);
+        const { WebACL } = await clients.waf.send(new client_wafv2_1.GetWebACLCommand({ Scope: 'CLOUDFRONT', Name: acl.Name, Id: acl.Id }));
+        check(WebACL?.ARN === acl.ARN, 'Web ACL readback identity differs');
+        const rules = WebACL?.Rules?.filter((rule) => rule.Name === 'StageIpAllowlist') ?? [];
+        const statement = rules[0]?.Statement?.NotStatement?.Statement;
+        const refs = statement?.IPSetReferenceStatement
+            ? [statement.IPSetReferenceStatement]
+            : statement?.OrStatement?.Statements?.map((item) => item.IPSetReferenceStatement);
+        check(rules.length === 1 &&
+            rules[0].Action?.Block &&
+            refs?.length &&
+            refs.every((ref) => ref?.ARN) &&
+            refs.filter((ref) => ref?.ARN === arn).length === 1, 'Router blocking rule does not reference the exact IP set');
+        // A dual-stack rule may have only its same-stage IPv6 companion, never an arbitrary second set.
+        check(refs.every((ref) => ref?.ARN === arn ||
+            ref?.ARN?.startsWith(`arn:aws:wafv2:us-east-1:${identity.account}:global/ipset/foundation-${identity.stage}-router-ipv6-allowlist/`)), 'Router allowlist contains an out-of-stage reference');
+    }
+    const key = { Name: name, Id: selected.Id, Scope: 'CLOUDFRONT' };
+    return {
+        arn,
+        async read() {
+            await attestTags(arn);
+            const { IPSet, LockToken } = await clients.waf.send(new client_wafv2_1.GetIPSetCommand(key));
+            check(IPSet?.ARN === arn &&
+                IPSet.Name === name &&
+                IPSet.IPAddressVersion === 'IPV4' &&
+                LockToken &&
+                Array.isArray(IPSet.Addresses), 'live IP-set identity mismatch');
+            return {
+                addresses: IPSet.Addresses,
+                description: IPSet.Description ?? '',
+                lockToken: LockToken,
+            };
+        },
+        async update(previous, next) {
+            await attestTags(arn);
+            await clients.waf.send(new client_wafv2_1.UpdateIPSetCommand({
+                ...key,
+                LockToken: previous.lockToken,
+                Addresses: [...next.addresses],
+                Description: next.description || undefined,
+            }));
+        },
+    };
+}
+//# sourceMappingURL=private-smoke-control-plane.js.map

package/src/foundation/private-smoke-control-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-smoke-control-plane.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/private-smoke-control-plane.ts"],"names":[],"mappings":";;AAqCA,oEA6NC;AAlQD,wDAU+B;AAC/B,kEAIoC;AAiBpC,SAAS,KAAK,CAAC,SAAkB,EAAE,OAAe;IAChD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,4BAA4B,CAChD,QAAsC,EACtC,QAA4B,EAC5B,UAA+B;IAC7B,GAAG,EAAE,IAAI,0BAAW,CAAC;QACnB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,uCAAuC;QACjD,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE;KACtE,CAAC;IACF,UAAU,EAAE,IAAI,oCAAgB,CAAC;QAC/B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,kCAAkC;QAC5C,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE;KACtE,CAAC;CACH;IAED,KAAK,CACH,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC/B,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpD,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjE,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EACrD,qCAAqC,CACtC,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,GAAG;QACL,KAAK,CACH,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EACxE,uCAAuC,CACxC,CAAC;IACJ,MAAM,IAAI,GAAG,cAAc,QAAQ,CAAC,KAAK,wBAAwB,CAAC;IAClE,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,IAAI,MAA0B,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACjC,IAAI,gCAAiB,CAAC;YACpB,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,MAAM;SACnB,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QACzB,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,mCAAmC,CAAC,CAAC;QACzE,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,6CAA6C,CAAC,CAAC;IACzE,CAAC,QAAQ,MAAM,EAAE;IACjB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC1D,KAAK,CACH,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACrC,0GAA0G,CAC3G,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,2BAA2B,QAAQ,CAAC,OAAO,iBAAiB,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC9F,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,wCAAwC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG;QACnB,gBAAgB,EAAE,oBAAoB;QACtC,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,QAAQ,CAAC,KAAK;QAC3B,eAAe,EAAE,QAAQ,CAAC,SAAS;QACnC,mBAAmB,EAAE,QAAQ,CAAC,YAAY;KAC3C,CAAC;IACF,KAAK,UAAU,UAAU,CAAC,WAAmB;QAC3C,MAAM,IAAI,GAA2B,EAAE,CAAC;QACxC,IAAI,SAA6B,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACjC,IAAI,yCAA0B,CAAC;gBAC7B,WAAW,EAAE,WAAW;gBACxB,UAAU,EAAE,SAAS;gBACrB,KAAK,EAAE,GAAG;aACX,CAAC,CACH,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;gBACzD,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;YACtD,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;YAC5B,KAAK,CACH,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EACrC,gCAAgC,CACjC,CAAC;YACF,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACxE,CAAC,QAAQ,SAAS,EAAE;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,2CAA2C,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAEtB,uFAAuF;IACvF,wEAAwE;IACxE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,aAAa,GAA0B,EAAE,CAAC;QAChD,MAAM,GAAG,SAAS,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CACxC,IAAI,4CAAwB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACjD,CAAC;YACF,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5D,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC;YAC3C,KAAK,CACH,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,IAAI,MAAM,EAC7C,gDAAgD,CACjD,CAAC;YACF,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,mCAAmC,CAAC,CAAC;YACzE,IAAI,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,6CAA6C,CAAC,CAAC;QACzE,CAAC,QAAQ,MAAM,EAAE;QACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAClC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,UAAU,KAAK,GAAG,CAAC,QAAQ;YAClC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAChD,CAAC;QACF,KAAK,CACH,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;YAClB,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CACxB,uBAAuB,QAAQ,CAAC,OAAO,gBAAgB,CACxD,EACH,sDAAsD,CACvD,CAAC;QACF,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,MAAM,GAAG,SAAS,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACjC,IAAI,iCAAkB,CAAC;gBACrB,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,GAAG;gBACV,UAAU,EAAE,MAAM;aACnB,CAAC,CACH,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YACzB,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,oCAAoC,CAAC,CAAC;YAC1E,IAAI,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,8CAA8C,CAAC,CAAC;QAC1E,CAAC,QAAQ,MAAM,EAAE;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvE,KAAK,CACH,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACd,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YAChB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CACzB,2BAA2B,QAAQ,CAAC,OAAO,iBAAiB,CAC7D,EACH,mDAAmD,CACpD,CAAC;QACF,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,UAAU,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACvC,IAAI,+BAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAC1E,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACpE,MAAM,KAAK,GACT,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC;QAC/D,MAAM,IAAI,GAAG,SAAS,EAAE,uBAAuB;YAC7C,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC;YACrC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CACvC,CAAC;QACN,KAAK,CACH,KAAK,CAAC,MAAM,KAAK,CAAC;YAChB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EACrD,0DAA0D,CAC3D,CAAC;QACF,gGAAgG;QAChG,KAAK,CACH,IAAI,CAAC,KAAK,CACR,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,EAAE,GAAG,KAAK,GAAG;YAChB,GAAG,EAAE,GAAG,EAAE,UAAU,CAClB,2BAA2B,QAAQ,CAAC,OAAO,4BAA4B,QAAQ,CAAC,KAAK,yBAAyB,CAC/G,CACJ,EACD,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,YAAqB,EAAE,CAAC;IAC1E,OAAO;QACL,GAAG;QACH,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACjD,IAAI,8BAAe,CAAC,GAAG,CAAC,CACzB,CAAC;YACF,KAAK,CACH,KAAK,EAAE,GAAG,KAAK,GAAG;gBAChB,KAAK,CAAC,IAAI,KAAK,IAAI;gBACnB,KAAK,CAAC,gBAAgB,KAAK,MAAM;gBACjC,SAAS;gBACT,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAChC,+BAA+B,CAChC,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;gBACpC,SAAS,EAAE,SAAS;aACrB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI;YACzB,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACpB,IAAI,iCAAkB,CAAC;gBACrB,GAAG,GAAG;gBACN,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC9B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,SAAS;aAC3C,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/src/generators/preset/dependency-overrides.d.ts

@@ -0,0 +1,8 @@
+export declare const DEPENDENCY_OVERRIDES_PATH = "supply-chain/dependency-overrides.json";
+export interface DependencyOverrides {
+    schemaVersion: 1;
+    overrides: Record<string, string>;
+}
+/** Seeded pins are data, never package-manager hooks or alternate registries. */
+export declare function parseDependencyOverrides(value: unknown): DependencyOverrides;
+export declare function renderDependencyOverridesYaml(value: DependencyOverrides): string;

package/src/generators/preset/dependency-overrides.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPENDENCY_OVERRIDES_PATH = void 0;
+exports.parseDependencyOverrides = parseDependencyOverrides;
+exports.renderDependencyOverridesYaml = renderDependencyOverridesYaml;
+const semver_1 = require("semver");
+const deterministic_order_js_1 = require("../../deterministic-order.js");
+exports.DEPENDENCY_OVERRIDES_PATH = 'supply-chain/dependency-overrides.json';
+function isSelector(value) {
+    const parts = value.split('>');
+    if (parts.length > 2)
+        return false;
+    return parts.every((part) => {
+        const match = /^((?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*)(?:@(.+))?$/u.exec(part);
+        return (match !== null &&
+            (match[2] === undefined || (0, semver_1.validRange)(match[2]) !== null));
+    });
+}
+/** Seeded pins are data, never package-manager hooks or alternate registries. */
+function parseDependencyOverrides(value) {
+    const fail = () => {
+        throw new Error(`${exports.DEPENDENCY_OVERRIDES_PATH} must contain schemaVersion 1 and at most 256 npm selectors mapped to exact versions.`);
+    };
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return fail();
+    const record = value;
+    if (record.schemaVersion !== 1 ||
+        Object.keys(record).some((key) => key !== 'schemaVersion' && key !== 'overrides'))
+        return fail();
+    if (typeof record.overrides !== 'object' ||
+        record.overrides === null ||
+        Array.isArray(record.overrides))
+        return fail();
+    const entries = Object.entries(record.overrides);
+    if (entries.length > 256)
+        return fail();
+    for (const [selector, version] of entries) {
+        if (selector.length > 256 ||
+            !isSelector(selector) ||
+            typeof version !== 'string' ||
+            (0, semver_1.valid)(version) !== version)
+            return fail();
+    }
+    return {
+        schemaVersion: 1,
+        overrides: Object.fromEntries(entries.sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))),
+    };
+}
+function renderDependencyOverridesYaml(value) {
+    const entries = Object.entries(value.overrides);
+    return entries.length === 0
+        ? ''
+        : `overrides:\n${entries.map(([selector, version]) => `  ${JSON.stringify(selector)}: ${JSON.stringify(version)}`).join('\n')}\n`;
+}
+//# sourceMappingURL=dependency-overrides.js.map

package/src/generators/preset/dependency-overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-overrides.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/dependency-overrides.ts"],"names":[],"mappings":";;;AA2BA,4DAuCC;AAED,sEAOC;AA3ED,mCAA2C;AAC3C,yEAA4D;AAE/C,QAAA,yBAAyB,GACpC,wCAAwC,CAAC;AAO3C,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,GACT,iEAAiE,CAAC,IAAI,CACpE,IAAI,CACL,CAAC;QACJ,OAAO,CACL,KAAK,KAAK,IAAI;YACd,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAA,mBAAU,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,SAAgB,wBAAwB,CAAC,KAAc;IACrD,MAAM,IAAI,GAAG,GAAU,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,iCAAyB,uFAAuF,CACpH,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrE,OAAO,IAAI,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IACE,MAAM,CAAC,aAAa,KAAK,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,WAAW,CACxD;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,MAAM,CAAC,SAAS,KAAK,IAAI;QACzB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAE/B,OAAO,IAAI,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,IACE,QAAQ,CAAC,MAAM,GAAG,GAAG;YACrB,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrB,OAAO,OAAO,KAAK,QAAQ;YAC3B,IAAA,cAAK,EAAC,OAAO,CAAC,KAAK,OAAO;YAE1B,OAAO,IAAI,EAAE,CAAC;IAClB,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACnC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAC3C,KAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACtI,CAAC"}

package/src/generators/preset/tool-versions.d.ts

@@ -8,6 +8,8 @@ export declare const WORKSPACE_SST_VERSION: "4.17.1";
 export declare const WORKSPACE_NODE_VERSION: "22.23.1";
 export declare const WORKSPACE_PNPM_VERSION: "11.20.0";
 export declare const WORKSPACE_VITEST_VERSION: "4.1.4";
+/** Python packaging runtime required by the pinned SST-generated workloads. */
+export declare const WORKSPACE_UV_VERSION: "0.11.28";
 export declare const WORKSPACE_PNPM_SHA512: "9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 export declare const WORKSPACE_PNPM_DESCRIPTOR: "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 /**

package/src/generators/preset/tool-versions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKSPACE_SST_NPM_INTEGRITY = exports.WORKSPACE_PNPM_DESCRIPTOR = exports.WORKSPACE_PNPM_SHA512 = exports.WORKSPACE_VITEST_VERSION = exports.WORKSPACE_PNPM_VERSION = exports.WORKSPACE_NODE_VERSION = exports.WORKSPACE_SST_VERSION = void 0;
+exports.WORKSPACE_SST_NPM_INTEGRITY = exports.WORKSPACE_PNPM_DESCRIPTOR = exports.WORKSPACE_PNPM_SHA512 = exports.WORKSPACE_UV_VERSION = exports.WORKSPACE_VITEST_VERSION = exports.WORKSPACE_PNPM_VERSION = exports.WORKSPACE_NODE_VERSION = exports.WORKSPACE_SST_VERSION = void 0;
 /**
  * Framework-required tool versions written into newly generated workspaces.
  *
@@ -11,6 +11,8 @@ exports.WORKSPACE_SST_VERSION = '4.17.1';
 exports.WORKSPACE_NODE_VERSION = '22.23.1';
 exports.WORKSPACE_PNPM_VERSION = '11.20.0';
 exports.WORKSPACE_VITEST_VERSION = '4.1.4';
+/** Python packaging runtime required by the pinned SST-generated workloads. */
+exports.WORKSPACE_UV_VERSION = '0.11.28';
 exports.WORKSPACE_PNPM_SHA512 = '9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee';
 exports.WORKSPACE_PNPM_DESCRIPTOR = `pnpm@${exports.WORKSPACE_PNPM_VERSION}+sha512.${exports.WORKSPACE_PNPM_SHA512}`;
 /**

package/src/generators/preset/tool-versions.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-versions.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/tool-versions.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,QAAiB,CAAC;AAC1C,QAAA,sBAAsB,GAAG,SAAkB,CAAC;AAC5C,QAAA,sBAAsB,GAAG,SAAkB,CAAC;AAC5C,QAAA,wBAAwB,GAAG,OAAgB,CAAC;AAC5C,QAAA,qBAAqB,GAChC,kIAA2I,CAAC;AACjI,QAAA,yBAAyB,GACpC,QAAQ,8BAAsB,WAAW,6BAAqB,EAAW,CAAC;AAE5E;;;;GAIG;AACU,QAAA,2BAA2B,GACtC,iGAA0G,CAAC"}
+{"version":3,"file":"tool-versions.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/tool-versions.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,QAAiB,CAAC;AAC1C,QAAA,sBAAsB,GAAG,SAAkB,CAAC;AAC5C,QAAA,sBAAsB,GAAG,SAAkB,CAAC;AAC5C,QAAA,wBAAwB,GAAG,OAAgB,CAAC;AACzD,+EAA+E;AAClE,QAAA,oBAAoB,GAAG,SAAkB,CAAC;AAC1C,QAAA,qBAAqB,GAChC,kIAA2I,CAAC;AACjI,QAAA,yBAAyB,GACpC,QAAQ,8BAAsB,WAAW,6BAAqB,EAAW,CAAC;AAE5E;;;;GAIG;AACU,QAAA,2BAA2B,GACtC,iGAA0G,CAAC"}

package/src/generators/preset/workspace-files-developer-agent.js

@@ -57,9 +57,17 @@ reported after that commit remain authenticated local-source Nx targets and reta
 documented same-user installed-toolchain boundary.
 
 Begin and hand off implementation work with
-\`pnpm nx run ${name}:work-markers\`. Verify the affected owner target, then run
-\`pnpm nx run ${name}:verify\` and the workspace \`pnpm verify\` barrier before claiming
-implemented-and-verified.
+\`pnpm nx run ${name}:work-markers\`. For ordinary feature completion, run the
+affected owner's tests, typecheck, lint, and ownership checks reported by the
+Nx graph and agent context. Record exactly which checks passed and which remain
+pending. Feature verification is not release qualification.
+
+Reserve \`pnpm nx run ${name}:verify\` and the workspace \`pnpm verify\` barrier
+for an adopter milestone or coherent integration batch. Release qualification
+additionally requires the declared packed, platform, and external acceptance.
+An explicitly required safety or contract check is never waived by this cadence.
+Development accepts a dirty tree and needs no production confirmation or release
+artifact; protected-stage source and approval requirements remain unchanged.
 
 If a Slice, Service, or Job generator reports a retained post-generation install, rerun
 that same generator with the exact scoped prefix
@@ -118,9 +126,14 @@ CLI and Nx contract complete their live pilots.
    - make an ordinary source edit only within the plan-derived adopter-owned project scope; or
    - route protected work to the matching GitHub environment and OIDC workflow without
      receiving local command arguments.
-5. Verify the affected project or owner target, rerun
-   \`pnpm nx run ${name}:work-markers\`, run \`pnpm nx run ${name}:verify\`, and complete
-   \`pnpm verify\` before claiming completion.
+5. Run the affected owner's tests, typecheck, lint, and ownership checks from
+   the Nx graph and agent context, then rerun \`pnpm nx run ${name}:work-markers\`.
+   For ordinary feature completion, report those results without requiring the
+   full workspace barrier. At an adopter milestone or coherent integration batch,
+   also run \`pnpm nx run ${name}:verify\` and \`pnpm verify\`. Release qualification
+   adds the declared packed, platform, and external acceptance. Feature verification
+   is not release qualification; no explicitly required safety or contract check
+   is waived, and pending external proof remains pending in the handoff.
 6. Fill an adopter-owned copy of the seeded template, then run
    \`ebk agent handoff <handoff.json>\` to validate exact resumable state. A different actor
    uses \`ebk agent resume <handoff.json>\` and must re-inspect current state rather than

package/src/generators/preset/workspace-files-developer-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-files-developer-agent.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-developer-agent.ts"],"names":[],"mappings":";;;AA4jBA,sFAuBC;AAnlBD,6DAQwC;AAG3B,QAAA,4BAA4B,GAAG,yBAAkC,CAAC;AAClE,QAAA,qCAAqC,GAChD,4CAAqD,CAAC;AAC3C,QAAA,uCAAuC,GAClD,kCAA2C,CAAC;AAEjC,QAAA,sCAAsC,GAAG;IACpD,oCAA4B;IAC5B,6CAAqC;IACrC,+CAAuC;CAC/B,CAAC;AAgBX,MAAM,0BAA0B,GAAG;IACjC,0BAA0B,EACxB,wEAAwE;IAC1E,oCAAoC,EAClC,kFAAkF;IACpF,yBAAyB,EACvB,+FAA+F;IACjG,0BAA0B,EACxB,+EAA+E;IACjF,qCAAqC,EACnC,wEAAwE;IAC1E,2BAA2B,EACzB,0DAA0D;CACC,CAAC;AAEhE,SAAS,2BAA2B,CAClC,iBAAoC;IAEpC,QAAQ,iBAAiB,EAAE,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO;;6CAEgC,CAAC;QAC1C,KAAK,qBAAqB;YACxB,OAAO;;0FAE6E,CAAC;QACvF,KAAK,gBAAgB;YACnB,OAAO;;2FAE8E,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,iBAAoC;IAEpC,OAAO;;iDAEwC,IAAI;;;;;;;;;;;;;;;;;;;gBAmBrC,IAAI;gBACJ,IAAI;;;;;;;;;;;;;;EAclB,2BAA2B,CAAC,iBAAiB,CAAC;;;;;;;CAO/C,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,yCAA8B,CAAC,GAAG,CACvC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,iBAAoC;IAEpC,OAAO;;8DAEqD,IAAI;;;;;;;;;;;;uBAY3C,IAAI;;;;mBAIR,IAAI;;;;;;;;;;;;;;;;mBAgBJ,IAAI,sCAAsC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAgCjC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyFlC,2BAA2B,CAAC,iBAAiB,CAAC;;;;;;;;;IAS5C,6CAAqC;;;;;;;;;;;;;EAavC,mBAAmB,EAAE;;IAEnB,6CAAqC;8BACX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAoD5B,+CAAuC;CAC5C,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA2C;IAE3C,MAAM,qBAAqB,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACzD,MAAM,wBAAwB,GAC5B,wDAAwD,CAAC;IAC3D,MAAM,oBAAoB,GAAG,GAAG,OAAO,CAAC,IAAI,SAAS,CAAC;IACtD,OAAO;QACL,gBAAgB,EAAE,EAAE;QACpB,YAAY,EAAE,EAAE;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACpC,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,EAAE;QACjB,IAAI,EAAE,uCAA4B;QAClC,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE;YACd,gBAAgB,EAAE,KAAK;YACvB,SAAS,EAAE,WAAW;YACtB,WAAW,EACT,2FAA2F;SAC9F;QACD,UAAU,EAAE;YACV;gBACE,SAAS,EAAE,cAAc;gBACzB,EAAE,EAAE,eAAe,OAAO,CAAC,IAAI,EAAE;gBACjC,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE;oBACL,SAAS,EAAE,EAAE;oBACb,eAAe,EAAE,CAAC,QAAQ,CAAC;oBAC3B,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;oBACxB,oBAAoB,EAAE,CAAC,oBAAoB,CAAC;iBAC7C;aACF;SACF;QACD,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACrC,UAAU,EAAE;YACV,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,qBAAqB;YAC7B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,gCAAgC;SAC3C;QACD,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,uBAAuB,EAAE,EAAE;QAC3B,oBAAoB,EAAE,CAAC,oBAAoB,CAAC;QAC5C,2BAA2B,EAAE,CAAC,oBAAoB,CAAC;QACnD,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE;oBACR,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;iBACzB;gBACD,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,qBAAqB;wBAC7B,aAAa,EAAE,QAAQ;wBACvB,IAAI,EAAE,8BAA8B;wBACpC,YAAY,EAAE,qBAAqB;wBACnC,SAAS,EAAE,wBAAwB;qBACpC;iBACF;gBACD,OAAO,EAAE;oBACP,iBAAiB,EAAE,EAAE;oBACrB,KAAK,EAAE,EAAE;iBACV;gBACD,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBACpC,IAAI,EAAE,sCAA2B;gBACjC,cAAc,EAAE;oBACd,gBAAgB,EAAE,KAAK;oBACvB,SAAS,EAAE,WAAW;oBACtB,WAAW,EACT,sEAAsE;iBACzE;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,eAAe,OAAO,CAAC,IAAI,EAAE;oBACnC,gBAAgB,EAAE,EAAE;iBACrB;gBACD,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBACrC,aAAa,EAAE,kDAAuC;gBACtD,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,QAAQ,EAAE,gCAAgC;iBAC3C;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,SAAS,EAAE,wBAAwB;oBACnC,MAAM,EAAE;wBACN,SAAS,EAAE,EAAE;wBACb,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;wBACpC,MAAM,EAAE;4BACN,MAAM,EAAE,CAAC;4BACT,MAAM,EAAE,CAAC;4BACT,WAAW,EAAE,CAAC;4BACd,OAAO,EAAE,CAAC;4BACV,OAAO,EAAE,CAAC;yBACX;wBACD,WAAW,EAAE;4BACX,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,KAAK;yBAChB;wBACD,QAAQ,EAAE,EAAE;wBACZ,cAAc,EAAE,KAAK;wBACrB,IAAI,EAAE,yBAAyB;wBAC/B,SAAS,EAAE;4BACT,cAAc,EAAE,8BAA8B;4BAC9C,OAAO,EAAE,OAAO,CAAC,IAAI;4BACrB,UAAU,EAAE,QAAQ;4BACpB,MAAM,EAAE,QAAQ;yBACjB;wBACD,OAAO,EAAE,QAAQ;wBACjB,YAAY,EAAE,IAAI;wBAClB,mBAAmB,EAAE,KAAK;wBAC1B,aAAa,EAAE,0DAA+C;wBAC9D,MAAM,EAAE;4BACN,mBAAmB,EAAE,EAAE;4BACvB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;4BACtB,kBAAkB,EAAE,0BAA0B,OAAO,CAAC,gBAAgB,EAAE;yBACzE;wBACD,MAAM,EAAE;4BACN,WAAW,EAAE,0BAA0B;4BACvC,UAAU,EAAE,IAAI;4BAChB,SAAS,EAAE,0BAA0B;yBACtC;wBACD,SAAS,EAAE,OAAO,CAAC,IAAI;qBACxB;oBACD,aAAa,EAAE,0DAA+C;iBAC/D;gBACD,IAAI,EAAE;oBACJ,eAAe,EAAE,kDAAuC;oBACxD,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,OAAO,CAAC,gBAAgB;iBAClC;gBACD,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE;oBACjB,WAAW,EAAE,EAAE;oBACf,SAAS,EAAE,EAAE;oBACb,OAAO,EAAE,EAAE;iBACZ;gBACD,YAAY,EAAE;oBACZ,QAAQ,EAAE,EAAE;oBACZ,OAAO,EAAE,CAAC,oBAAoB,CAAC;iBAChC;aACF;SACF;QACD,aAAa,EAAE,kDAAuC;QACtD,SAAS,EAAE;YACT,eAAe,EAAE,CAAC,QAAQ,CAAC;YAC3B,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACzB;QACD,KAAK,EAAE,2BAA2B;QAClC,UAAU,EAAE;YACV,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;YACjD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,gBAAgB,EAAE,CAAC,4BAA4B,CAAC;SACjD;QACD,IAAI,EAAE;YACJ,0BAA0B,EAAE,2CAA2C;YACvE,SAAS,EAAE,6BAA6B;SACzC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BR,CAAC;AACF,CAAC;AAED,SAAgB,qCAAqC,CACnD,OAA2C;IAE3C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO;QACL,cAAc,EAAE,oBAAoB,CAClC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,iBAAiB,CAC1B;QACD,KAAK,EAAE;YACL,CAAC,oCAA4B,CAAC,EAAE,aAAa,CAC3C,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,iBAAiB,CAC1B;YACD,CAAC,6CAAqC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CACxD,QAAQ,EACR,IAAI,EACJ,CAAC,CACF,IAAI;YACL,CAAC,+CAAuC,CAAC,EAAE,uBAAuB,EAAE;SACrE;QACD,WAAW,EAAE,8CAAsC;KACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-files-developer-agent.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-developer-agent.ts"],"names":[],"mappings":";;;AAykBA,sFAuBC;AAhmBD,6DAQwC;AAG3B,QAAA,4BAA4B,GAAG,yBAAkC,CAAC;AAClE,QAAA,qCAAqC,GAChD,4CAAqD,CAAC;AAC3C,QAAA,uCAAuC,GAClD,kCAA2C,CAAC;AAEjC,QAAA,sCAAsC,GAAG;IACpD,oCAA4B;IAC5B,6CAAqC;IACrC,+CAAuC;CAC/B,CAAC;AAgBX,MAAM,0BAA0B,GAAG;IACjC,0BAA0B,EACxB,wEAAwE;IAC1E,oCAAoC,EAClC,kFAAkF;IACpF,yBAAyB,EACvB,+FAA+F;IACjG,0BAA0B,EACxB,+EAA+E;IACjF,qCAAqC,EACnC,wEAAwE;IAC1E,2BAA2B,EACzB,0DAA0D;CACC,CAAC;AAEhE,SAAS,2BAA2B,CAClC,iBAAoC;IAEpC,QAAQ,iBAAiB,EAAE,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO;;6CAEgC,CAAC;QAC1C,KAAK,qBAAqB;YACxB,OAAO;;0FAE6E,CAAC;QACvF,KAAK,gBAAgB;YACnB,OAAO;;2FAE8E,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,iBAAoC;IAEpC,OAAO;;iDAEwC,IAAI;;;;;;;;;;;;;;;;;;;gBAmBrC,IAAI;;;;;wBAKI,IAAI;;;;;;;;;;;;;;;;;;EAkB1B,2BAA2B,CAAC,iBAAiB,CAAC;;;;;;;CAO/C,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,yCAA8B,CAAC,GAAG,CACvC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,iBAAoC;IAEpC,OAAO;;8DAEqD,IAAI;;;;;;;;;;;;uBAY3C,IAAI;;;;mBAIR,IAAI;;;;;;;;;;;;;;;;8DAgBuC,IAAI;;;4BAGtC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAkCA,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyFlC,2BAA2B,CAAC,iBAAiB,CAAC;;;;;;;;;IAS5C,6CAAqC;;;;;;;;;;;;;EAavC,mBAAmB,EAAE;;IAEnB,6CAAqC;8BACX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAoD5B,+CAAuC;CAC5C,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAA2C;IAE3C,MAAM,qBAAqB,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACzD,MAAM,wBAAwB,GAC5B,wDAAwD,CAAC;IAC3D,MAAM,oBAAoB,GAAG,GAAG,OAAO,CAAC,IAAI,SAAS,CAAC;IACtD,OAAO;QACL,gBAAgB,EAAE,EAAE;QACpB,YAAY,EAAE,EAAE;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACpC,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,EAAE;QACjB,IAAI,EAAE,uCAA4B;QAClC,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE;YACd,gBAAgB,EAAE,KAAK;YACvB,SAAS,EAAE,WAAW;YACtB,WAAW,EACT,2FAA2F;SAC9F;QACD,UAAU,EAAE;YACV;gBACE,SAAS,EAAE,cAAc;gBACzB,EAAE,EAAE,eAAe,OAAO,CAAC,IAAI,EAAE;gBACjC,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE;oBACL,SAAS,EAAE,EAAE;oBACb,eAAe,EAAE,CAAC,QAAQ,CAAC;oBAC3B,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;oBACxB,oBAAoB,EAAE,CAAC,oBAAoB,CAAC;iBAC7C;aACF;SACF;QACD,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACrC,UAAU,EAAE;YACV,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,qBAAqB;YAC7B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,gCAAgC;SAC3C;QACD,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,uBAAuB,EAAE,EAAE;QAC3B,oBAAoB,EAAE,CAAC,oBAAoB,CAAC;QAC5C,2BAA2B,EAAE,CAAC,oBAAoB,CAAC;QACnD,OAAO,EAAE;YACP;gBACE,QAAQ,EAAE;oBACR,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;iBACzB;gBACD,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,qBAAqB;wBAC7B,aAAa,EAAE,QAAQ;wBACvB,IAAI,EAAE,8BAA8B;wBACpC,YAAY,EAAE,qBAAqB;wBACnC,SAAS,EAAE,wBAAwB;qBACpC;iBACF;gBACD,OAAO,EAAE;oBACP,iBAAiB,EAAE,EAAE;oBACrB,KAAK,EAAE,EAAE;iBACV;gBACD,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBACpC,IAAI,EAAE,sCAA2B;gBACjC,cAAc,EAAE;oBACd,gBAAgB,EAAE,KAAK;oBACvB,SAAS,EAAE,WAAW;oBACtB,WAAW,EACT,sEAAsE;iBACzE;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,eAAe,OAAO,CAAC,IAAI,EAAE;oBACnC,gBAAgB,EAAE,EAAE;iBACrB;gBACD,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBACrC,aAAa,EAAE,kDAAuC;gBACtD,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,QAAQ,EAAE,gCAAgC;iBAC3C;gBACD,eAAe,EAAE;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,SAAS,EAAE,wBAAwB;oBACnC,MAAM,EAAE;wBACN,SAAS,EAAE,EAAE;wBACb,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;wBACpC,MAAM,EAAE;4BACN,MAAM,EAAE,CAAC;4BACT,MAAM,EAAE,CAAC;4BACT,WAAW,EAAE,CAAC;4BACd,OAAO,EAAE,CAAC;4BACV,OAAO,EAAE,CAAC;yBACX;wBACD,WAAW,EAAE;4BACX,KAAK,EAAE,OAAO;4BACd,QAAQ,EAAE,KAAK;yBAChB;wBACD,QAAQ,EAAE,EAAE;wBACZ,cAAc,EAAE,KAAK;wBACrB,IAAI,EAAE,yBAAyB;wBAC/B,SAAS,EAAE;4BACT,cAAc,EAAE,8BAA8B;4BAC9C,OAAO,EAAE,OAAO,CAAC,IAAI;4BACrB,UAAU,EAAE,QAAQ;4BACpB,MAAM,EAAE,QAAQ;yBACjB;wBACD,OAAO,EAAE,QAAQ;wBACjB,YAAY,EAAE,IAAI;wBAClB,mBAAmB,EAAE,KAAK;wBAC1B,aAAa,EAAE,0DAA+C;wBAC9D,MAAM,EAAE;4BACN,mBAAmB,EAAE,EAAE;4BACvB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;4BACtB,kBAAkB,EAAE,0BAA0B,OAAO,CAAC,gBAAgB,EAAE;yBACzE;wBACD,MAAM,EAAE;4BACN,WAAW,EAAE,0BAA0B;4BACvC,UAAU,EAAE,IAAI;4BAChB,SAAS,EAAE,0BAA0B;yBACtC;wBACD,SAAS,EAAE,OAAO,CAAC,IAAI;qBACxB;oBACD,aAAa,EAAE,0DAA+C;iBAC/D;gBACD,IAAI,EAAE;oBACJ,eAAe,EAAE,kDAAuC;oBACxD,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,OAAO,CAAC,gBAAgB;iBAClC;gBACD,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE;oBACjB,WAAW,EAAE,EAAE;oBACf,SAAS,EAAE,EAAE;oBACb,OAAO,EAAE,EAAE;iBACZ;gBACD,YAAY,EAAE;oBACZ,QAAQ,EAAE,EAAE;oBACZ,OAAO,EAAE,CAAC,oBAAoB,CAAC;iBAChC;aACF;SACF;QACD,aAAa,EAAE,kDAAuC;QACtD,SAAS,EAAE;YACT,eAAe,EAAE,CAAC,QAAQ,CAAC;YAC3B,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACzB;QACD,KAAK,EAAE,2BAA2B;QAClC,UAAU,EAAE;YACV,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ;QACD,QAAQ,EAAE;YACR,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;YACjD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,gBAAgB,EAAE,CAAC,4BAA4B,CAAC;SACjD;QACD,IAAI,EAAE;YACJ,0BAA0B,EAAE,2CAA2C;YACvE,SAAS,EAAE,6BAA6B;SACzC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BR,CAAC;AACF,CAAC;AAED,SAAgB,qCAAqC,CACnD,OAA2C;IAE3C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO;QACL,cAAc,EAAE,oBAAoB,CAClC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,iBAAiB,CAC1B;QACD,KAAK,EAAE;YACL,CAAC,oCAA4B,CAAC,EAAE,aAAa,CAC3C,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,iBAAiB,CAC1B;YACD,CAAC,6CAAqC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CACxD,QAAQ,EACR,IAAI,EACJ,CAAC,CACF,IAAI;YACL,CAAC,+CAAuC,CAAC,EAAE,uBAAuB,EAAE;SACrE;QACD,WAAW,EAAE,8CAAsC;KACpD,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-thin-deploy.d.ts

@@ -23,6 +23,8 @@ export interface ThinDeployWorkflowFilePlan {
     managedPaths: readonly [typeof THIN_DEPLOY_WORKFLOW_PATH];
 }
 export declare function renderThinDeployVerifyCaller(profile: DeploymentProfile): string;
+/** @internal Run exactly this generated script in the protected-runner fixture. */
+export declare function protectedBrowserInstallScript(): string;
 /** @internal Exported for executable source-contract tests. */
 export declare function exactStageDeployerGuardScript(operation: string, accountVariable: string): string;
 /** @internal Shared verbatim by every generated protected workflow. */

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.THIN_DEPLOY_WORKFLOW_PATH = void 0;
 exports.renderThinDeployVerifyCaller = renderThinDeployVerifyCaller;
+exports.protectedBrowserInstallScript = protectedBrowserInstallScript;
 exports.exactStageDeployerGuardScript = exactStageDeployerGuardScript;
 exports.canonicalStageAuthorityDerivationScript = canonicalStageAuthorityDerivationScript;
 exports.exactStagingPromotionPullGuardScript = exactStagingPromotionPullGuardScript;
@@ -10,6 +11,7 @@ exports.restoredCandidateValidationScript = restoredCandidateValidationScript;
 exports.stagingPromotionSealScript = stagingPromotionSealScript;
 exports.postdeploySupplyChainBindingScript = postdeploySupplyChainBindingScript;
 exports.renderThinDeployWorkflowFilePlan = renderThinDeployWorkflowFilePlan;
+const tool_versions_js_1 = require("./tool-versions.js");
 exports.THIN_DEPLOY_WORKFLOW_PATH = '.github/workflows/deploy.yml';
 const EXACT_SEMVER = /^\d+\.\d+\.\d+$/;
 const WORKSPACE_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/;
@@ -87,6 +89,22 @@ function indentedScript(source, spaces) {
         .map((line) => `${prefix}${line}`)
         .join('\n');
 }
+/** @internal Run exactly this generated script in the protected-runner fixture. */
+function protectedBrowserInstallScript() {
+    return `set -euo pipefail
+if [ -z "$EBK_SLICE_PROJECTS" ]; then exit 0; fi
+case "$EBK_SLICE_PROJECTS" in ,*|*,|*,,*) echo 'Invalid smoke project inventory'; exit 1 ;; esac
+IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+seen=,
+for project in "\${projects[@]}"; do
+  case "$project" in ''|*[!A-Za-z0-9_-]*) echo 'Invalid smoke project'; exit 1 ;; esac
+  case "$seen" in *,"$project",*) echo 'Duplicate smoke project'; exit 1 ;; esac
+  seen="$seen$project,"
+done
+for project in "\${projects[@]}"; do
+  pnpm --dir "packages/$project" exec playwright install --with-deps chromium
+done`;
+}
 /** @internal Exported for executable source-contract tests. */
 function exactStageDeployerGuardScript(operation, accountVariable) {
     return `read -r caller_account caller_arn <<< "$(aws sts get-caller-identity --query '[Account,Arn]' --output text)"
@@ -1400,6 +1418,23 @@ ${indentedScript(restoredCandidateValidationScript(), 10)}
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
         run: pnpm nx run ${name}:supply-chain-check-protected
+      - name: Install pinned uv for generated Python workloads
+        if: env.EBK_ACTION == 'deploy'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          python3 -m pip install --user --disable-pip-version-check 'uv==${tool_versions_js_1.WORKSPACE_UV_VERSION}'
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          "$HOME/.local/bin/uv" --version
+      - name: Install pinned Playwright Chromium for deployed smoke proofs
+        if: env.EBK_ACTION == 'deploy' && needs.prepare.outputs.has_slices == 'true'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+${indentedScript(protectedBrowserInstallScript(), 10)}
       - name: Revalidate exact protected branch tip before OIDC
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
@@ -1431,10 +1466,12 @@ ${indentedScript(restoredCandidateValidationScript(), 10)}
           [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
 ${indentedScript(exactStageDeployerGuardScript('Native lifecycle', '$EBK_POLICY_ACCOUNT_ID'), 10)}
       - name: Run ordered native lifecycle targets
+        id: native-lifecycle
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
           EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
         run: |
           set -euo pipefail
           test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'Stage deployment role is absent'; exit 1; }
@@ -1453,6 +1490,29 @@ ${indentedScript(exactStageDeployerGuardScript('Native lifecycle', '$EBK_POLICY_
               pnpm nx run "$project:$EBK_ACTION" -- --stage="$EBK_STAGE" --region="$AWS_REGION" --expectedRoleArn="$AWS_DEPLOY_ROLE_ARN"
             done
           fi
+      - name: Prove temporary smoke admission removed
+        if: always() && env.EBK_ACTION == 'deploy' && steps.native-lifecycle.outcome != 'skipped'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Smoke access cleanup', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ]
+          git diff --quiet HEAD
+          node --input-type=module <<'NODE'
+          import { cleanupGithubPrivateSmoke } from '@empire-builder-kit/nx/foundation';
+          await cleanupGithubPrivateSmoke({
+            account: process.env.EBK_POLICY_ACCOUNT_ID,
+            deploymentProfile: process.env.EBK_DEPLOYMENT_PROFILE,
+            root: process.cwd(),
+            source: process.env.EBK_SOURCE_COMMIT,
+            stage: process.env.EBK_STAGE,
+            workspace: '${name}',
+          });
+          NODE
       - name: Seal exact staging promotion receipt
         if: env.EBK_ACTION == 'deploy' && env.EBK_STAGE == 'staging' && needs.prepare.outputs.profile != 'starter'
         env:

package/src/generators/preset/workspace-files-thin-deploy.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-files-thin-deploy.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-deploy.ts"],"names":[],"mappings":";;;AA2EA,oEA6BC;AAYD,sEAsBC;AAGD,0FAuBC;AAGD,oFAmBC;AAGD,0FAiFC;AAGD,8EAmCC;AAGD,gEA4EC;AAGD,gFAoEC;AA6iCD,4EAUC;AA//CY,QAAA,yBAAyB,GACpC,8BAAuC,CAAC;AA4B1C,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,MAAM,UAAU,GACd,iEAAiE,CAAC;AAEpE,SAAS,aAAa,CAAC,OAAkC;IACvD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA0B;IACrD,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;;;;;;;;;;;;;;CAiBL,CAAC;AACF,CAAC;AAED,SAAgB,4BAA4B,CAC1C,OAA0B;IAE1B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,yEAAyE,CAAC;IAC5E,OAAO;;;;;;;;QAQD,wBAAwB;;;;;;;;;;;;;;2CAcW,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,MAAM;SACV,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,+DAA+D;AAC/D,SAAgB,6BAA6B,CAC3C,SAAiB,EACjB,eAAuB;IAEvB,OAAO;yBACgB,eAAe;UAC9B,SAAS;;;;;UAKT,SAAS;;6CAE0B,eAAe;;UAElD,SAAS;;kDAE+B,eAAe;;;aAGpD,SAAS;KACjB,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,SAAgB,uCAAuC;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;8CAqBqC,CAAC;AAC/C,CAAC;AAED,+DAA+D;AAC/D,SAAgB,oCAAoC;IAClD,OAAO;;;;;;;;;;;;;;;;;KAiBJ,CAAC;AACN,CAAC;AAED,kFAAkF;AAClF,SAAgB,uCAAuC;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4HA+EmH,CAAC;AAC7H,CAAC;AAED,kFAAkF;AAClF,SAAgB,iCAAiC;IAC/C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wGAiC+F,CAAC;AACzG,CAAC;AAED,kFAAkF;AAClF,SAAgB,0BAA0B;IACxC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uHA0E8G,CAAC;AACxH,CAAC;AAED,kFAAkF;AAClF,SAAgB,kCAAkC;IAChD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEN,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAkC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACtE,OAAO;;;;EAIP,mBAAmB,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;8BAwBV,YAAY,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAkE9B,UAAU,CAAC,QAAQ;;;;;gBAKnB,UAAU,CAAC,SAAS;gBACpB,UAAU,CAAC,SAAS;;0BAEV,YAAY,CAAC,IAAI;;;;;;;;yBAQlB,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4ClB,IAAI;;;kCAGM,iBAAiB;;;;;;;;;;;;EAYjD,cAAc,CAAC,sBAAsB,uCAAuC,EAAE,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6BvE,UAAU,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6FnB,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;EAwBzC,cAAc,CAAC,uCAAuC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2E/C,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,6BAA6B,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;gBAOhF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0CzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,6BAA6B,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;;;;gBAanF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA4CzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,oCAAoC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;gBAyB5C,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;EAchD,cAAc,CAAC,6BAA6B,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;gBAUtF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAmEzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;;gBAGf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;gBAiB3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;gBAa3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCzC,cAAc,CAAC,iCAAiC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAiC9B,IAAI;;;;;;2BAMJ,IAAI;;;;;;;;;;;;;;;;;;;gBAmBf,UAAU,CAAC,uBAAuB;;;;;;;;;;;EAWhD,cAAc,CAAC,6BAA6B,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;0BAUvE,IAAI;;;;;;;;;;;;;;;;;;;;;;;;EAwB5B,cAAc,CAAC,0BAA0B,EAAE,EAAE,EAAE,CAAC;;;;;;;;;EAShD,cAAc,CAAC,kCAAkC,EAAE,EAAE,EAAE,CAAC;;;;gBAI1C,UAAU,CAAC,cAAc;;;;;;;;;;CAUxC,CAAC;AACF,CAAC;AAED,SAAgB,gCAAgC,CAC9C,OAAkC;IAElC,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO;QACL,KAAK,EAAE;YACL,CAAC,iCAAyB,CAAC,EAAE,wBAAwB,CAAC,OAAO,CAAC;SAC/D;QACD,YAAY,EAAE,CAAC,iCAAyB,CAAC;KAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-files-thin-deploy.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-deploy.ts"],"names":[],"mappings":";;;AA4EA,oEA6BC;AAYD,sEAcC;AAGD,sEAsBC;AAGD,0FAuBC;AAGD,oFAmBC;AAGD,0FAiFC;AAGD,8EAmCC;AAGD,gEA4EC;AAGD,gFAoEC;AAulCD,4EAUC;AA5jDD,yDAA0D;AAE7C,QAAA,yBAAyB,GACpC,8BAAuC,CAAC;AA4B1C,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,MAAM,UAAU,GACd,iEAAiE,CAAC;AAEpE,SAAS,aAAa,CAAC,OAAkC;IACvD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA0B;IACrD,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;;;;;;;;;;;;;;CAiBL,CAAC;AACF,CAAC;AAED,SAAgB,4BAA4B,CAC1C,OAA0B;IAE1B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,wBAAwB,GAC5B,yEAAyE,CAAC;IAC5E,OAAO;;;;;;;;QAQD,wBAAwB;;;;;;;;;;;;;;2CAcW,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,MAAM;SACV,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,SAAgB,6BAA6B;IAC3C,OAAO;;;;;;;;;;;;KAYJ,CAAC;AACN,CAAC;AAED,+DAA+D;AAC/D,SAAgB,6BAA6B,CAC3C,SAAiB,EACjB,eAAuB;IAEvB,OAAO;yBACgB,eAAe;UAC9B,SAAS;;;;;UAKT,SAAS;;6CAE0B,eAAe;;UAElD,SAAS;;kDAE+B,eAAe;;;aAGpD,SAAS;KACjB,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,SAAgB,uCAAuC;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;8CAqBqC,CAAC;AAC/C,CAAC;AAED,+DAA+D;AAC/D,SAAgB,oCAAoC;IAClD,OAAO;;;;;;;;;;;;;;;;;KAiBJ,CAAC;AACN,CAAC;AAED,kFAAkF;AAClF,SAAgB,uCAAuC;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4HA+EmH,CAAC;AAC7H,CAAC;AAED,kFAAkF;AAClF,SAAgB,iCAAiC;IAC/C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wGAiC+F,CAAC;AACzG,CAAC;AAED,kFAAkF;AAClF,SAAgB,0BAA0B;IACxC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uHA0E8G,CAAC;AACxH,CAAC;AAED,kFAAkF;AAClF,SAAgB,kCAAkC;IAChD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEN,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAkC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACtE,OAAO;;;;EAIP,mBAAmB,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;8BAwBV,YAAY,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAkE9B,UAAU,CAAC,QAAQ;;;;;gBAKnB,UAAU,CAAC,SAAS;gBACpB,UAAU,CAAC,SAAS;;0BAEV,YAAY,CAAC,IAAI;;;;;;;;yBAQlB,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4ClB,IAAI;;;kCAGM,iBAAiB;;;;;;;;;;;;EAYjD,cAAc,CAAC,sBAAsB,uCAAuC,EAAE,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6BvE,UAAU,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA6FnB,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;EAwBzC,cAAc,CAAC,uCAAuC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2E/C,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,6BAA6B,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;gBAOhF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0CzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;gBA0B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,6BAA6B,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;;;;gBAanF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA4CzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;gBAEf,UAAU,CAAC,gBAAgB;;;;;;;;;;gBAU3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2B3B,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;;EAehD,cAAc,CAAC,oCAAoC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;gBAyB5C,UAAU,CAAC,uBAAuB;;;;;;;;;;;;;;EAchD,cAAc,CAAC,6BAA6B,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;gBAUtF,UAAU,CAAC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAmEzB,UAAU,CAAC,QAAQ;;;;;;;;gBAQnB,UAAU,CAAC,SAAS;;;;gBAIpB,UAAU,CAAC,SAAS;;;;;0BAKV,YAAY,CAAC,IAAI;;;;;;;;;;2BAUhB,IAAI;;;gBAGf,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;gBAiB3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;gBAa3B,UAAU,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCzC,cAAc,CAAC,iCAAiC,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAiC9B,IAAI;;;;;;2BAMJ,IAAI;;;;;;;;2EAQ4C,uCAAoB;;;;;;;;;EAS7F,cAAc,CAAC,6BAA6B,EAAE,EAAE,EAAE,CAAC;;;;;;;;;;;;;;;;;;;gBAmBrC,UAAU,CAAC,uBAAuB;;;;;;;;;;;EAWhD,cAAc,CAAC,6BAA6B,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;;;0BAYvE,IAAI;;;;;;;;;;;;;;;;;;;;;;;EAuB5B,cAAc,CAAC,6BAA6B,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC;;;;;;;;;;;0BAW3E,IAAI;;;;;;;;;;;;;EAa5B,cAAc,CAAC,0BAA0B,EAAE,EAAE,EAAE,CAAC;;;;;;;;;EAShD,cAAc,CAAC,kCAAkC,EAAE,EAAE,EAAE,CAAC;;;;gBAI1C,UAAU,CAAC,cAAc;;;;;;;;;;CAUxC,CAAC;AACF,CAAC;AAED,SAAgB,gCAAgC,CAC9C,OAAkC;IAElC,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO;QACL,KAAK,EAAE;YACL,CAAC,iCAAyB,CAAC,EAAE,wBAAwB,CAAC,OAAO,CAAC;SAC/D;QACD,YAAY,EAAE,CAAC,iCAAyB,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files-thin-docs.js

@@ -72,6 +72,24 @@ secret; do not add repository-scope fallbacks.
 `,
         'docs/repository-operating-policy.md': `# Repository Operating Policy
 
+## Production capacity
+
+The shared Foundation has three capacity profiles, independent of deployment topology:
+- \`cost-optimized\`: 0–2 ACUs, five-minute idle auto-pause; new starter default.
+- \`balanced\`: 0.5–4 ACUs, always warm.
+- \`standard\`: 2–16 ACUs, always warm; isolated repository default.
+
+All retain 30-day backups, deletion protection, encryption, and managed NAT.
+Pause can delay first requests (typically 15 seconds, sometimes 30 seconds or
+longer); open connections or polling can prevent it. Storage/NAT still cost money.
+Validate cold-resume retries, migration timeouts, and the shared capacity ceiling.
+
+Existing warm \`cost-optimized\` users must use the new generator to report
+\`pnpm nx g @empire-builder-kit/nx:repository-policy --profile=balanced\`, then
+repeat with \`--apply\` before managed upgrade or deployment. This preserves
+0.5–4 ACUs. After upgrade, deliberately select \`--profile=cost-optimized --apply\`
+only to accept scale-to-zero. These commands change policy, not AWS resources.
+
 The committed \`ebk.repository-policy.json\` selects the
 \`${options.deploymentProfile}\` deployment profile and its active stages:
 ${stageList}. Inactive stages are rejected by planning, deployment, refresh,

package/src/generators/preset/workspace-files-thin-docs.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-files-thin-docs.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-docs.ts"],"names":[],"mappings":";;AAMA,4EA6OC;AAnPD,+DAI0C;AAE1C,SAAgB,gCAAgC,CAAC,OAGhD;IACC,MAAM,MAAM,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAA,mCAAwB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,OAAO;QACL,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI;;;;;;;kBAOhB,OAAO,CAAC,iBAAiB,yBAAyB,SAAS;;;;;CAK5E;QACG,sBAAsB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiD3B;QACG,qCAAqC,EAAE;;;IAGvC,OAAO,CAAC,iBAAiB;EAC3B,SAAS;;;;;aAKE,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DxB;QACG,+BAA+B,EAAE;;;;yBAIZ,OAAO,CAAC,iBAAiB;EAChD,SAAS;;;;;;;;;;eAUI,cAAc;;CAE5B;QACG,sCAAsC,EAAE;;;;;;;gBAO5B,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;yCA0Ba,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtD;KACE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-files-thin-docs.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/workspace-files-thin-docs.ts"],"names":[],"mappings":";;AAMA,4EA+PC;AArQD,+DAI0C;AAE1C,SAAgB,gCAAgC,CAAC,OAGhD;IACC,MAAM,MAAM,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAA,mCAAwB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,OAAO;QACL,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI;;;;;;;kBAOhB,OAAO,CAAC,iBAAiB,yBAAyB,SAAS;;;;;CAK5E;QACG,sBAAsB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiD3B;QACG,qCAAqC,EAAE;;;;;;;;;;;;;;;;;;;;;IAqBvC,OAAO,CAAC,iBAAiB;EAC3B,SAAS;;;;;aAKE,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DxB;QACG,+BAA+B,EAAE;;;;yBAIZ,OAAO,CAAC,iBAAiB;EAChD,SAAS;;;;;;;;;;eAUI,cAAc;;CAE5B;QACG,sCAAsC,EAAE;;;;;;;gBAO5B,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;yCA0Ba,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtD;KACE,CAAC;AACJ,CAAC"}

package/src/generators/preset/workspace-files.d.ts

@@ -1,6 +1,7 @@
 import { type FoundationOwnershipRecord, type WorkspaceOwnershipRecord } from '../../ownership/index.js';
 import { type ConfiguredDeploymentAccounts, type DeploymentProfile } from '../../repository-policy/index.js';
 export interface WorkspaceFileOptions {
+    dependencyOverrides?: unknown;
     deploymentAccounts?: ConfiguredDeploymentAccounts;
     deploymentProfile?: DeploymentProfile;
     deploymentRegion?: string | null;

package/src/generators/preset/workspace-files.js

@@ -7,6 +7,7 @@ exports.renderWorkspaceFiles = renderWorkspaceFiles;
 exports.renderWorkspaceRootFilePlan = renderWorkspaceRootFilePlan;
 exports.renderFoundationFilePlan = renderFoundationFilePlan;
 const sensitive_patterns_1 = require("@empire-builder-kit/runtime/sensitive-patterns");
+const dependency_overrides_js_1 = require("./dependency-overrides.js");
 const index_js_1 = require("../../ownership/index.js");
 const index_js_2 = require("../../frontend-security/index.js");
 const index_js_3 = require("../../git-policy/index.js");
@@ -1050,6 +1051,7 @@ const SUPPLY_CHAIN_WORKSPACE_FILE_PLAN = (0, index_js_6.renderSupplyChainWorkspa
     generatedAt: '1970-01-01T00:00:00.000Z',
 });
 const WORKSPACE_SEEDED_PATHS = new Set([
+    dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH,
     ...SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.seeded,
     ...workspace_files_developer_agent_js_1.DEVELOPER_AGENT_WORKSPACE_SEEDED_PATHS,
     '.github/CODEOWNERS',
@@ -1168,6 +1170,9 @@ function createWorkspaceOwnership(files, frameworkVersion) {
 }
 function renderWorkspaceFiles(options) {
     const { frameworkVersion, name } = options;
+    const dependencyOverrides = (0, dependency_overrides_js_1.parseDependencyOverrides)(options.dependencyOverrides === undefined
+        ? { schemaVersion: 1, overrides: {} }
+        : options.dependencyOverrides);
     const deploymentProfile = options.deploymentProfile ?? 'starter';
     const activeStages = (0, index_js_4.activeDeploymentStages)(deploymentProfile);
     const protectedWorkflowStageChoices = deploymentProfile === 'starter'
@@ -8055,8 +8060,15 @@ seeded decision record aligned with organization-specific budgets and alerts.
 
 - Development uses EC2 NAT, a development bastion, and Aurora scale-to-zero.
 ${deploymentProfile === 'starter' ? '' : '- Staging uses EC2 NAT and Aurora scale-to-zero by default.\n'}- Production always uses managed NAT and retains protected data. Its explicit Repository
-  Operating Policy profile selects either the standard 2-ACU Aurora floor or the
-  cost-optimized 0.5-ACU warm floor.
+  Operating Policy profile selects cost-optimized (0–2 ACUs, pause after five idle
+  minutes), balanced (0.5–4 ACUs, always warm), or standard (2–16 ACUs, always warm).
+  New starter repositories default to cost-optimized. Cold resume typically takes
+  about 15 seconds and can exceed 30 seconds after extended inactivity; validate
+  connection retries, request timeouts, migrations, and background polling.
+  Capacity is shared by all Slices. Open connections can prevent pausing; storage
+  and managed NAT remain billable while Aurora compute is paused.
+  Existing 0.5–4 cost-optimized adopters must explicitly select balanced before
+  upgrade, then opt into cost-optimized separately if cold starts are acceptable.
 - ECS, EventBridge, Cognito, SNS, SSM, and CloudWatch are primarily usage-priced; logs,
   metrics, alarms, and retained data still require active cost review.
 
@@ -9137,7 +9149,7 @@ if (
   costs.aurora?.engineVersion !== '${index_js_4.FOUNDATION_AURORA_ENGINE_VERSION}' ||
   costs.productionProfileSource !== 'ebk.repository-policy.json' ||
   costs.productionProfiles?.standard?.aurora?.min !== '2 ACU' ||
-  costs.productionProfiles?.['cost-optimized']?.aurora?.min !== '0.5 ACU' ||
+  JSON.stringify(costs.productionProfiles) !== JSON.stringify(${JSON.stringify(index_js_4.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS)}) ||
   !costs.stages?.development ||
   JSON.stringify(Object.keys(costs.stages ?? {}).sort()) !==
     JSON.stringify(${JSON.stringify([...activeStages].sort())}) ||
@@ -9230,6 +9242,7 @@ export default $config({
             ],
             exclude: ['.sst', 'dist', 'node_modules'],
         }),
+        [dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH]: json(dependencyOverrides),
         'pnpm-workspace.yaml': `packages:
   - 'packages/*'
   - 'packages/*/apps/*'
@@ -9264,6 +9277,7 @@ supportedArchitectures:
 strictDepBuilds: true
 allowBuilds:
 ${index_js_6.FRAMEWORK_REVIEWED_BUILD_PACKAGES.map((packageName) => `  '${packageName}': true`).join('\n')}
+${(0, dependency_overrides_js_1.renderDependencyOverridesYaml)(dependencyOverrides)}
 `,
         'tsconfig.base.json': json({
             compilerOptions: {