@empire-builder-kit/nx 1.0.0-rc.37 → 1.0.0-rc.39

package/src/generators/sql/schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "$id": "EmpireBuilderKitSql",
+  "title": "Add a relational requirement to an existing Standard Slice",
+  "description": "Report or apply an additive Foundation/Slice SQL declaration while preserving existing data stores and managed ownership. No AWS calls.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "name": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]{0,62}$",
+      "$default": { "$source": "argv", "index": 0 },
+      "description": "Existing Standard Product Slice."
+    },
+    "reason": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512,
+      "description": "Concrete relational requirement, such as integrity constraints or reporting joins. Stored in the existing Blueprint inputs.sql declaration."
+    },
+    "apply": {
+      "type": "boolean",
+      "default": false,
+      "description": "Apply the paired managed Foundation/Slice source upgrade; otherwise only report it. No AWS operation is performed."
+    },
+    "skipFormat": {
+      "type": "boolean",
+      "default": false,
+      "description": "Leave source formatting to a subsequent explicit check."
+    },
+    "skipInstall": {
+      "type": "boolean",
+      "default": false,
+      "description": "Do not run the dependency-install callback after applying source changes."
+    }
+  },
+  "required": ["name", "reason"]
+}

package/src/generators/sql/sql.d.ts

@@ -0,0 +1,6 @@
+import { type GeneratorCallback, type Tree } from '@nx/devkit';
+import { type UpgradeGeneratorLogger } from '../upgrade/upgrade.js';
+import type { SqlGeneratorSchema } from './schema.js';
+/** One additive entry point; the existing upgrader owns validation and all writes. */
+export declare function sqlGenerator(tree: Tree, options: SqlGeneratorSchema, output?: UpgradeGeneratorLogger): Promise<void | GeneratorCallback>;
+export default sqlGenerator;

package/src/generators/sql/sql.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sqlGenerator = sqlGenerator;
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../blueprints/index.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const index_js_2 = require("../../ownership/index.js");
+const upgrade_js_1 = require("../upgrade/upgrade.js");
+/** One additive entry point; the existing upgrader owns validation and all writes. */
+async function sqlGenerator(tree, options, output = devkit_1.logger) {
+    if (typeof options.name !== 'string' ||
+        !/^[a-z][a-z0-9-]{0,62}$/.test(options.name) ||
+        ['foundation', 'workspace'].includes(options.name))
+        throw new Error('SQL requires one existing Standard Product Slice name.');
+    const declaration = (0, capability_plan_js_1.readStandardSqlDeclaration)({
+        sql: { reason: options.reason },
+    });
+    if (!declaration)
+        throw new Error('A concrete relational reason is required.');
+    const ownershipPath = `packages/${options.name}/.ebk/ownership.json`;
+    const source = tree.read(ownershipPath, 'utf8');
+    if (!source)
+        throw new Error(`Standard Slice ownership is missing at ${ownershipPath}. Generate the Slice first.`);
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        throw new Error(`Standard Slice ownership is invalid at ${ownershipPath}.`);
+    }
+    const ownership = (0, index_js_2.validateGeneratedOwnershipRecord)(parsed);
+    if (!ownership.valid || ownership.value.slice !== options.name)
+        throw new Error(`Standard Slice ownership is invalid at ${ownershipPath}.`);
+    if (ownership.value.blueprint.name !== index_js_1.BUILTIN_BLUEPRINT_NAME)
+        throw new Error('The sql generator only supports the Standard Blueprint. Declare relational capabilities through the external Blueprint owner.');
+    const existing = (0, capability_plan_js_1.readStandardSqlDeclaration)(ownership.value.inputs);
+    if (existing && existing.reason !== declaration.reason)
+        throw new Error('SQL is already declared with a different reason. Keep the recorded reason, or use the managed upgrade inputs surface for an intentional declaration change.');
+    output.info(`[ebk-sql] ${options.name}: ${existing ? 'retain' : 'add'} the relational declaration. ` +
+        'The paired upgrade reports Foundation Aurora, private networking/container compute and Slice Drizzle/migration sources. ' +
+        'Existing default-store records, resource identities, capacity, protections and seeded features are preserved. ' +
+        'Aurora/network/container resources can add recurring cost; inspect the generated plan and committed capacity policy before deployment. ' +
+        'This command does not deploy, copy data or retire SQL.');
+    return (0, upgrade_js_1.upgradeGenerator)(tree, {
+        name: options.name,
+        inputs: { ...ownership.value.inputs, sql: declaration },
+        apply: options.apply === true,
+        skipFormat: options.skipFormat,
+        skipInstall: options.skipInstall,
+    }, output);
+}
+exports.default = sqlGenerator;
+//# sourceMappingURL=sql.js.map

package/src/generators/upgrade/sql-seeded-reconciliation.d.ts

@@ -0,0 +1,2 @@
+/** Only append required SQL members; never replace an adopter's seeded decisions. */
+export declare function planSqlSeededReconciliation(current: ReadonlyMap<string, string | null>, target: Readonly<Record<string, string>>): Map<string, string>;

package/src/generators/upgrade/sql-seeded-reconciliation.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.planSqlSeededReconciliation = planSqlSeededReconciliation;
+const node_util_1 = require("node:util");
+const ts = require("typescript");
+/** Only append required SQL members; never replace an adopter's seeded decisions. */
+function planSqlSeededReconciliation(current, target) {
+    const updates = new Map();
+    const read = (path, contents) => {
+        const value = JSON.parse(contents);
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error(`SQL reconciliation requires an object at ${path}.`);
+        return value;
+    };
+    const append = (path, property, key, select, preserveExisting = false, equivalent = node_util_1.isDeepStrictEqual) => {
+        const contents = current.get(path);
+        if (contents == null)
+            return;
+        const existing = read(path, contents), desired = read(path, target[path]);
+        if (!Array.isArray(existing[property]) || !Array.isArray(desired[property]))
+            throw new Error(`SQL reconciliation requires ${path}#/${property}.`);
+        let changed = false;
+        for (const addition of desired[property].filter(select)) {
+            const matches = existing[property].filter((entry) => entry?.[key] === addition[key]);
+            if (matches.length > 1 ||
+                (matches.length === 1 &&
+                    !preserveExisting &&
+                    !equivalent(matches[0], addition)))
+                throw new Error(`SQL reconciliation conflict at ${path}: ${addition[key]}. Preserve the customization and reconcile this required declaration explicitly; no files changed.`);
+            if (matches.length === 0) {
+                existing[property].push(addition);
+                changed = true;
+            }
+        }
+        if (changed)
+            updates.set(path, JSON.stringify(existing, null, 2) + '\n');
+    };
+    append('operations/features.json', 'features', 'id', (entry) => entry.id === 'database-lifecycle', true);
+    append('secrets/metadata.json', 'declarations', 'logicalName', (entry) => entry.source === 'database-bootstrap', false, (existing, desired) => {
+        // Rotation is an adopter decision. Required identity, stage and source
+        // bindings still have to agree; never silently overwrite either kind.
+        const existingBinding = { ...existing }, desiredBinding = { ...desired };
+        delete existingBinding.rotation;
+        delete desiredBinding.rotation;
+        return (0, node_util_1.isDeepStrictEqual)(existingBinding, desiredBinding);
+    });
+    append('operations/release.json', 'artifactInventory', 'id', (entry) => typeof entry.id === 'string' &&
+        /\.job\.database-(migration|retirement)$/.test(entry.id), true);
+    const backgroundPath = 'operations/background-work.json';
+    const background = current.get(backgroundPath);
+    if (background != null) {
+        const existing = read(backgroundPath, background), desired = read(backgroundPath, target[backgroundPath]);
+        if (!existing.stages ||
+            typeof existing.stages !== 'object' ||
+            Array.isArray(existing.stages))
+            throw new Error('SQL reconciliation requires declared background-work stages.');
+        let changed = false;
+        for (const [stage, defaults] of Object.entries(desired.stages)) {
+            const settings = existing.stages[stage];
+            if (!settings ||
+                typeof settings !== 'object' ||
+                Array.isArray(settings) ||
+                typeof settings.outbox?.enabled !== 'boolean')
+                throw new Error(`SQL reconciliation requires the existing ${stage} outbox pause decision.`);
+            if (!Object.prototype.hasOwnProperty.call(settings, 'sqlOutboxRecovery')) {
+                settings.sqlOutboxRecovery = {
+                    ...defaults.sqlOutboxRecovery,
+                    enabled: settings.outbox.enabled,
+                };
+                changed = true;
+            }
+        }
+        if (changed)
+            updates.set(backgroundPath, JSON.stringify(existing, null, 2) + '\n');
+    }
+    const path = 'secrets/declarations.ts', contents = current.get(path);
+    if (contents == null)
+        return updates;
+    const parse = (source) => {
+        const file = ts.createSourceFile(path, source, ts.ScriptTarget.Latest, true);
+        const declarations = file.statements
+            .flatMap((statement) => ts.isVariableStatement(statement)
+            ? [...statement.declarationList.declarations]
+            : [])
+            .filter((declaration) => ts.isIdentifier(declaration.name) &&
+            declaration.name.text === 'SecretDefinitions');
+        let expression = declarations.length === 1 ? declarations[0].initializer : undefined;
+        while (expression &&
+            (ts.isAsExpression(expression) ||
+                ts.isSatisfiesExpression(expression) ||
+                ts.isParenthesizedExpression(expression)))
+            expression = expression.expression;
+        if (!expression ||
+            !ts.isObjectLiteralExpression(expression) ||
+            expression.properties.some((property) => !ts.isPropertyAssignment(property)))
+            throw new Error('SQL reconciliation requires a literal SecretDefinitions object without spreads. Preserve custom declarations and add the generated database credential explicitly; no files changed.');
+        return {
+            file,
+            object: expression,
+            properties: expression.properties.filter(ts.isPropertyAssignment),
+        };
+    };
+    const existing = parse(contents), desired = parse(target[path]);
+    const name = (property) => ts.isIdentifier(property.name) || ts.isStringLiteral(property.name)
+        ? property.name.text
+        : undefined;
+    // Compare syntax, not the printer's retained quote style or trailing commas.
+    // Formatting a seeded declaration must not turn an unchanged binding into a
+    // conflict. Preserve every expression/operator and literal value in the shape.
+    const shape = (node) => {
+        if (ts.isStringLiteral(node) ||
+            ts.isNumericLiteral(node) ||
+            ts.isIdentifier(node))
+            return [node.kind, node.text];
+        const children = [];
+        ts.forEachChild(node, (child) => {
+            children.push(shape(child));
+        });
+        return [node.kind, children.length ? children : node.getText()];
+    };
+    const additions = [];
+    const bindingShape = (property) => {
+        const value = property.initializer;
+        if (!ts.isObjectLiteralExpression(value))
+            return shape(property);
+        return value.properties
+            .filter((entry) => !ts.isPropertyAssignment(entry) || name(entry) !== 'rotation')
+            .map(shape);
+    };
+    for (const property of desired.properties.filter((entry) => name(entry)?.endsWith('PrimaryDatabaseCredential'))) {
+        const matches = existing.properties.filter((entry) => name(entry) === name(property));
+        if (matches.length > 1 ||
+            (matches.length === 1 &&
+                !(0, node_util_1.isDeepStrictEqual)(bindingShape(matches[0]), bindingShape(property))))
+            throw new Error(`SQL reconciliation conflict at ${path}: ${name(property)}. No files changed.`);
+        if (!matches.length)
+            additions.push(property.getText(desired.file));
+    }
+    if (additions.length) {
+        // Use AST offsets so unrelated declarations, comments and feature code remain byte-for-byte intact.
+        const end = existing.object.end - 1;
+        const comma = existing.properties.length && !existing.object.properties.hasTrailingComma
+            ? ','
+            : '';
+        let result = contents.slice(0, end) +
+            comma +
+            '\n' +
+            additions.join(',\n') +
+            ',\n' +
+            contents.slice(end);
+        const imports = existing.file.statements.filter(ts.isImportDeclaration);
+        const schemaImport = imports.some((entry) => ts.isStringLiteral(entry.moduleSpecifier) &&
+            entry.moduleSpecifier.text === '@empire-builder-kit/runtime/database' &&
+            entry.importClause?.namedBindings &&
+            ts.isNamedImports(entry.importClause.namedBindings) &&
+            entry.importClause.namedBindings.elements.some((binding) => binding.name.text === 'databaseCredentialSecretSchema' &&
+                (!binding.propertyName ||
+                    binding.propertyName.text === 'databaseCredentialSecretSchema')));
+        if (!schemaImport) {
+            if (/\bdatabaseCredentialSecretSchema\b/.test(contents))
+                throw new Error(`SQL reconciliation conflict at ${path}: databaseCredentialSecretSchema is already bound. No files changed.`);
+            result =
+                "import { databaseCredentialSecretSchema } from '@empire-builder-kit/runtime/database';\n" +
+                    result;
+        }
+        updates.set(path, result);
+    }
+    return updates;
+}
+//# sourceMappingURL=sql-seeded-reconciliation.js.map

package/src/generators/upgrade/upgrade.d.ts

@@ -85,5 +85,7 @@ export declare function preserveCompositionRegions(current: string, target: stri
 export declare function reemitRecordedNativeRuntimeCompositions(files: Readonly<Record<string, string>>, ownership: Pick<GeneratedOwnershipRecord, 'compositions'>): Readonly<Record<string, string>>;
 export declare function inspectWorkspaceSstVersion(tree: Tree, packageJson: WorkspacePackageJson): WorkspaceSstVersionState;
 export declare function createUpgradeReport(currentFiles: ReadonlyMap<string, string | null>, currentOwnership: OwnershipPaths, targetFiles: ReadonlyMap<string, string>, targetOwnership: OwnershipPaths, jsonOwnershipChanges?: JsonOwnershipChanges): UpgradeReport;
+/** Internal paired-generation path: the ordinary ownership-preserving upgrader owns Foundation writes. */
+export declare function upgradeFoundationForRequirements(tree: Tree, requirements: readonly unknown[], apply: boolean, output?: UpgradeGeneratorLogger): Promise<void>;
 export declare function upgradeGenerator(tree: Tree, options: UpgradeGeneratorSchema, output?: UpgradeGeneratorLogger, executionOptions?: UpgradeGeneratorExecutionOptions): Promise<GeneratorCallback | void>;
 export default upgradeGenerator;

package/src/generators/upgrade/upgrade.js

@@ -6,10 +6,13 @@ exports.preserveCompositionRegions = preserveCompositionRegions;
 exports.reemitRecordedNativeRuntimeCompositions = reemitRecordedNativeRuntimeCompositions;
 exports.inspectWorkspaceSstVersion = inspectWorkspaceSstVersion;
 exports.createUpgradeReport = createUpgradeReport;
+exports.upgradeFoundationForRequirements = upgradeFoundationForRequirements;
 exports.upgradeGenerator = upgradeGenerator;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 const capacity_migration_js_1 = require("../../repository-policy/capacity-migration.js");
 const dependency_overrides_js_1 = require("../preset/dependency-overrides.js");
+const workspace_files_adopter_skills_js_1 = require("../preset/workspace-files-adopter-skills.js");
+const sql_seeded_reconciliation_js_1 = require("./sql-seeded-reconciliation.js");
 const devkit_1 = require("@nx/devkit");
 const node_buffer_1 = require("node:buffer");
 const node_crypto_1 = require("node:crypto");
@@ -20,13 +23,17 @@ const yaml_1 = require("yaml");
 const index_js_1 = require("../../blueprints/index.js");
 const index_js_2 = require("../../api-contract/index.js");
 const index_js_3 = require("../../foundation/index.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const persistence_contract_js_1 = require("../slice/persistence-contract.js");
 const index_js_4 = require("../../ownership/index.js");
 const function_js_1 = require("../function/function.js");
+const logging_registry_js_1 = require("../logging-registry.js");
 const feature_registry_js_1 = require("../feature-registry.js");
 const generator_js_1 = require("../preset/generator.js");
 const tool_versions_js_1 = require("../preset/tool-versions.js");
 const workspace_files_js_1 = require("../preset/workspace-files.js");
 const built_in_plan_js_1 = require("../slice/built-in-plan.js");
+const data_policy_review_seed_js_1 = require("../slice/data-policy-review-seed.js");
 const workload_js_1 = require("../workload/workload.js");
 const formatting_js_1 = require("../formatting.js");
 const git_inspection_js_1 = require("../../developer-agent/git-inspection.js");
@@ -342,6 +349,7 @@ const SEEDED_RECONCILIATION = {
         category: 'reliability-operations',
         implications: [
             'alarm-registration',
+            'database-capacity-dynamodb-table-and-pending-events-throttle-metrics',
             'diagnostic-authority',
             'incident-remediation',
         ],
@@ -407,11 +415,18 @@ function developerAgentAgentsAppendix(renderedAgents) {
     return renderedAgents.slice(start + 1);
 }
 function planDeveloperAgentInstructionAppend(currentAgents, targetAgents) {
-    if (currentAgents === null ||
-        new RegExp(`(?:^|\\r?\\n)${DEVELOPER_AGENT_AGENTS_HEADING}(?:\\r?\\n|$)`).test(currentAgents)) {
+    if (currentAgents === null)
         return null;
+    const additions = [];
+    if (!/(?:^|\r?\n)## Bundled adopter skills(?:\r?\n|$)/u.test(currentAgents)) {
+        additions.push((0, workspace_files_adopter_skills_js_1.renderAdopterSkillIndex)());
     }
-    const appendix = developerAgentAgentsAppendix(targetAgents);
+    if (!new RegExp(`(?:^|\\r?\\n)${DEVELOPER_AGENT_AGENTS_HEADING}(?:\\r?\\n|$)`).test(currentAgents)) {
+        additions.push(developerAgentAgentsAppendix(targetAgents));
+    }
+    if (additions.length === 0)
+        return null;
+    const appendix = additions.join('\n');
     const separator = currentAgents.length === 0
         ? ''
         : currentAgents.endsWith('\n\n')
@@ -1229,7 +1244,7 @@ function carryRetainedServiceAdapterAuthority(targetFiles, owner) {
         'managed-generated-service-runtime-endpoint';
     return { ...targetFiles, [path]: json(target) };
 }
-async function upgradeFoundation(tree, options, packageJson, output) {
+async function upgradeFoundation(tree, options, packageJson, output, foundationRequirements = []) {
     if (options.blueprint !== undefined || options.inputs !== undefined) {
         throw new Error('Standard Foundation upgrades do not accept Blueprint or input options.');
     }
@@ -1245,6 +1260,8 @@ async function upgradeFoundation(tree, options, packageJson, output) {
     const deployment = readRepositoryDeploymentRenderingOptions(tree);
     const renderedTarget = (0, workspace_files_js_1.renderFoundationFilePlan)({
         ...deployment,
+        foundationRequirements,
+        foundationDescriptor: readJson(tree, node_path_1.posix.join(root, 'contracts/foundation.json'), 'Existing Foundation resource declaration'),
         frameworkVersion: (0, generator_js_1.frameworkPackageVersion)(),
         name: packageJson.name,
     });
@@ -1298,6 +1315,24 @@ async function upgradeFoundation(tree, options, packageJson, output) {
     // that skip workspace formatting. Canonicalize before binding those bytes.
     await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation');
 }
+/** Internal paired-generation path: the ordinary ownership-preserving upgrader owns Foundation writes. */
+async function upgradeFoundationForRequirements(tree, requirements, apply, output = devkit_1.logger) {
+    requireUpgradePrerequisites(tree, 'product-slice');
+    const capabilityPlan = (0, capability_plan_js_1.planFoundationCapabilities)({
+        current: readJson(tree, 'packages/foundation/contracts/foundation.json', 'Standard Foundation descriptor'),
+        requirements,
+    });
+    if (capabilityPlan.migratedFromContract !== null)
+        throw new Error('Paired generation cannot migrate a prerelease Foundation contract. Report and apply the explicit Foundation upgrade first; no files changed.');
+    // A Slice generator is not an implicit Foundation version/formatting upgrade.
+    if (capabilityPlan.added.length === 0)
+        return;
+    const policy = (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree);
+    if (tree.exists('packages/foundation/contracts/costs.json'))
+        (0, capacity_migration_js_1.assertCapacityMigrationChoice)(policy.productionFoundation.profile, readJson(tree, 'packages/foundation/contracts/costs.json', 'Foundation cost contract'));
+    const packageJson = readJson(tree, 'package.json', 'Workspace package.json');
+    await upgradeFoundation(tree, { name: 'foundation', apply, skipFormat: true, skipInstall: true }, packageJson, output, requirements);
+}
 async function upgradeWorkspace(tree, options, packageJson, output) {
     if (options.blueprint !== undefined || options.inputs !== undefined) {
         throw new Error('Workspace upgrades do not accept Blueprint or input options.');
@@ -1397,6 +1432,30 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     }
     if (name === 'foundation') {
         requireUpgradePrerequisites(tree, 'foundation');
+        // Refuse an unsupported core transition before changing shared contracts.
+        // This is a preflight, not a prerelease migration or compatibility layer.
+        for (const slice of tree.children('packages')) {
+            const root = node_path_1.posix.join('packages', slice);
+            const path = node_path_1.posix.join(root, '.ebk/ownership.json');
+            if (slice === 'foundation' || !tree.exists(path))
+                continue;
+            const recorded = readJson(tree, path, 'Product Slice ownership metadata');
+            if (recorded?.blueprint
+                ?.name !== index_js_1.BUILTIN_BLUEPRINT_NAME)
+                continue;
+            const parsed = (0, index_js_4.validateGeneratedOwnershipRecord)(recorded);
+            if (!parsed.valid)
+                throw new Error(ownershipValidationMessage('Product Slice ownership metadata', parsed.issues));
+            (0, persistence_contract_js_1.standardPersistenceContract)({
+                inputs: parsed.value.inputs,
+                existingStandardRequirement: parsed.value.foundation,
+                ...(tree.exists(node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH))
+                    ? {
+                        current: readJson(tree, node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH), 'Standard persistence declaration'),
+                    }
+                    : {}),
+            });
+        }
         return upgradeFoundation(tree, options, packageJson, output);
     }
     requireUpgradePrerequisites(tree, 'product-slice');
@@ -1425,13 +1484,39 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     if (serviceAdapterOwner !== null && blueprint.source !== 'built-in') {
         throw new Error('External Blueprint upgrades cannot retain the managed generated Service adapter authority; remove or explicitly migrate the elected adapter before changing Blueprint authority.');
     }
-    const inputResult = (0, index_js_1.validateBlueprintInputs)(blueprint.inputSchema, parseInputs(options.inputs, currentOwnership.inputs));
+    const requestedInputs = parseInputs(options.inputs, currentOwnership.inputs);
+    if (blueprint.source === 'built-in') {
+        // Refuse old framework cores before any paired Foundation/Slice changes.
+        // Keeping the old database safe does not imply supporting its old runtime.
+        (0, persistence_contract_js_1.standardPersistenceContract)({
+            inputs: requestedInputs,
+            existingStandardRequirement: currentOwnership.foundation,
+            ...(tree.exists(node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH))
+                ? {
+                    current: readJson(tree, node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH), 'Standard persistence declaration'),
+                }
+                : {}),
+        });
+        if (currentOwnership.foundation.capabilities.includes('postgres') &&
+            !(0, capability_plan_js_1.readStandardSqlDeclaration)(requestedInputs))
+            throw new Error('SQL cannot be retired through an upgrade. Keep the explicit inputs.sql declaration; database retirement requires a separate reviewed operation.');
+    }
+    const inputResult = (0, index_js_1.validateBlueprintInputs)(blueprint.inputSchema, requestedInputs);
     if (!inputResult.valid) {
         throw new Error(`Blueprint inputs are invalid:\n${inputResult.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
             .join('\n')}`);
     }
-    const compatibility = (0, index_js_3.validateFoundationCompatibility)(blueprint.manifest.foundation, readJson(tree, 'packages/foundation/contracts/foundation.json', 'Standard Foundation descriptor'));
+    const requiredFoundation = blueprint.source === 'built-in'
+        ? (0, capability_plan_js_1.standardPersistenceRequirement)(inputResult.value, currentOwnership.compositions)
+        : blueprint.manifest.foundation;
+    const existingFoundation = readJson(tree, 'packages/foundation/contracts/foundation.json', 'Standard Foundation descriptor');
+    const compatibility = (0, index_js_3.validateFoundationCompatibility)(requiredFoundation, blueprint.source === 'built-in'
+        ? (0, capability_plan_js_1.planFoundationCapabilities)({
+            current: existingFoundation,
+            requirements: [requiredFoundation],
+        }).descriptor
+        : existingFoundation);
     if (!compatibility.valid) {
         throw new Error(`Standard Foundation is incompatible with the target Blueprint:\n${compatibility.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -1449,7 +1534,15 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         const runtimeVersion = packageJson.dependencies?.['@empire-builder-kit/runtime'];
         if (!runtimeVersion)
             throw new Error('Workspace must depend on @empire-builder-kit/runtime.');
-        const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value, undefined, deployment.deploymentProfile);
+        const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value, (0, data_policy_review_seed_js_1.dataPolicyReviewSeed)(tree, root), deployment.deploymentProfile, {
+            existingStandardRequirement: currentOwnership.foundation,
+            compositions: currentOwnership.compositions,
+            ...(tree.exists(node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH))
+                ? {
+                    current: readJson(tree, node_path_1.posix.join(root, persistence_contract_js_1.STANDARD_PERSISTENCE_PATH), 'Standard persistence declaration'),
+                }
+                : {}),
+        });
         targetFiles = Object.fromEntries(Object.entries(plan.files).map(([path, contents]) => {
             const current = tree.read(node_path_1.posix.join(root, path), 'utf8');
             return [
@@ -1608,23 +1701,54 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     ]));
     let mergedTarget = mergeStructuredTargetFiles(currentFiles, currentOwnership, new Map(Object.entries(targetFiles)), targetOwnership);
     mergedTarget = await formatMergedManagedJsonFiles(tree, root, mergedTarget, targetOwnership);
+    const sqlAppends = blueprint.source === 'built-in' &&
+        (0, capability_plan_js_1.readStandardSqlDeclaration)(inputResult.value)
+        ? (0, sql_seeded_reconciliation_js_1.planSqlSeededReconciliation)(currentFiles, targetFiles)
+        : new Map();
+    for (const [path, contents] of sqlAppends) {
+        const workspacePath = node_path_1.posix.join(root, path);
+        mergedTarget.files.set(path, await (0, formatting_js_1.formatTreeContentsToFixedPoint)(contents, await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, (0, formatting_js_1.changedTreePrettierOptions)(tree)), workspacePath));
+    }
     requireTargetCompositionFeatures(mergedTarget.files, targetOwnership);
+    const loggingAppend = blueprint.source === 'built-in'
+        ? (0, logging_registry_js_1.planRequiredSliceLoggingComponents)(currentFiles.get(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH) ?? null, targetFiles[logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH])
+        : null;
+    if (loggingAppend !== null) {
+        const workspacePath = node_path_1.posix.join(root, logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);
+        const formatting = await (0, formatting_js_1.effectiveTreePrettierOptions)(tree, workspacePath, (0, formatting_js_1.changedTreePrettierOptions)(tree));
+        mergedTarget.files.set(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH, await (0, formatting_js_1.formatTreeContentsToFixedPoint)(loggingAppend, formatting, workspacePath));
+    }
     const report = createUpgradeReport(currentFiles, currentOwnership, mergedTarget.files, targetOwnership, mergedTarget);
+    if (loggingAppend !== null) {
+        report.preservedSeeded = report.preservedSeeded.filter((path) => path !== logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);
+        report.appendedSeeded.push(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);
+    }
+    for (const path of sqlAppends.keys()) {
+        report.preservedSeeded = report.preservedSeeded.filter((entry) => entry !== path);
+        report.appendedSeeded.push(path);
+    }
+    report.appendedSeeded.sort(deterministic_order_js_1.compareUtf16);
     output.info(`[ebk-upgrade] ${name} ${currentOwnership.blueprint.name}@${currentOwnership.blueprint.version} -> ${blueprint.manifest.name}@${blueprint.manifest.version}\n${JSON.stringify(report, null, 2)}`);
-    if (!options.apply)
+    if (!options.apply) {
+        if (blueprint.source === 'built-in')
+            await upgradeFoundationForRequirements(tree, [requiredFoundation], false, output);
         return;
+    }
     if (report.incompatibleSeededMigrations.length > 0) {
         throw new Error(seededMigrationUpgradeMessage('Product Slice', report));
     }
     if (report.conflicting.length > 0) {
         throw new Error(upgradeConflictMessage('Product Slice', report));
     }
+    if (blueprint.source === 'built-in')
+        await upgradeFoundationForRequirements(tree, [requiredFoundation], true, output);
     for (const path of report.obsolete)
         tree.delete(node_path_1.posix.join(root, path));
     const writePaths = new Set([
         ...report.changed,
         ...report.missing,
         ...report.addedSeeded,
+        ...report.appendedSeeded,
         '.ebk/ownership.json',
     ]);
     for (const path of writePaths) {
@@ -1657,7 +1781,10 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
 async function upgradeGenerator(tree, options, output = devkit_1.logger, executionOptions = {}) {
     const previewFile = await requireDeveloperAgentPreviewBinding(tree, options, executionOptions);
     if (!previewFile) {
-        return executeUpgradeGenerator(tree, options, output, executionOptions);
+        const deferred = new preview_changes_js_1.DeferredDeveloperAgentTree(tree);
+        const install = await executeUpgradeGenerator(deferred, options, output, executionOptions);
+        deferred.apply();
+        return install;
     }
     const upgradeOptions = { ...options };
     delete upgradeOptions.developerAgentPreview;

package/src/generators/workload/workload.js

@@ -6,6 +6,10 @@ exports.workloadGenerator = workloadGenerator;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../ownership/index.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const preview_changes_js_1 = require("../../developer-agent/preview-changes.js");
+const upgrade_js_1 = require("../upgrade/upgrade.js");
+const built_in_plan_foundation_files_js_1 = require("../slice/built-in-plan-foundation-files.js");
 const feature_registry_js_1 = require("../feature-registry.js");
 const formatting_js_1 = require("../formatting.js");
 const logging_registry_js_1 = require("../logging-registry.js");
@@ -1030,7 +1034,7 @@ describe('${workload} ${kind} outage behavior', () => {
         project: `@${slice}/${kind}-${workload}`,
     };
 }
-async function workloadGenerator(tree, options, kind) {
+async function executeWorkloadGenerator(tree, options, kind) {
     const slice = name(options.slice, 'Product Slice name');
     const workload = name(options.name, kind === 'service' ? 'Service name' : 'Job name');
     const requestedFeature = name(options.feature, 'Feature');
@@ -1091,6 +1095,26 @@ async function workloadGenerator(tree, options, kind) {
     if (!tree.exists(productPath)) {
         throw new Error(`${slice} is not an EBK v1 Product Slice.`);
     }
+    const ownership = (0, index_js_1.validateGeneratedOwnershipRecord)(JSON.parse(tree.read(node_path_1.posix.join(sliceRoot, '.ebk/ownership.json'), 'utf8') ?? 'null'));
+    if (!ownership.valid)
+        throw new Error('Product Slice ownership is invalid before workload composition.');
+    const foundationPath = node_path_1.posix.join(sliceRoot, 'infra/foundation.ts');
+    const foundationSource = tree.read(foundationPath, 'utf8');
+    const foundationOwner = ownership.value.paths.find(({ path }) => path === 'infra/foundation.ts');
+    if (foundationSource === null ||
+        foundationOwner?.mode !== 'managed' ||
+        (0, index_js_1.hashOwnedContent)(foundationSource, foundationOwner) !==
+            foundationOwner.sha256)
+        throw new Error('Product Slice Foundation bindings have managed drift; reconcile ownership before workload generation.');
+    const foundationRequirement = {
+        contract: ownership.value.foundation.contract,
+        capabilities: (0, capability_plan_js_1.planFoundationCapabilities)({
+            requirements: [
+                ownership.value.foundation,
+                { contract: '^2.0.0', capabilities: ['network', 'container-compute'] },
+            ],
+        }).descriptor.capabilities,
+    };
     requireCompositionMarker(tree, topologyPath, '// <ebk:native-runtime-extensions:end>');
     requireCompositionMarker(tree, intentPath, '// <ebk:native-runtime-intent-contributions:end>');
     for (const marker of [
@@ -1124,6 +1148,7 @@ async function workloadGenerator(tree, options, kind) {
     const additionalPerformancePaths = performanceRegistration.additionalFiles.map(({ path }) => path);
     const installScope = {
         exactPaths: [
+            foundationPath,
             productPath,
             topologyPath,
             intentPath,
@@ -1146,12 +1171,28 @@ async function workloadGenerator(tree, options, kind) {
             node_path_1.posix.join(sliceRoot, RELEASE_REGISTRY_PATH),
             node_path_1.posix.join(sliceRoot, '.ebk/ownership.json'),
         ],
-        roots: [root],
+        roots: [root, 'packages/foundation'],
     };
     const installState = options.skipInstall
         ? undefined
         : (0, post_generation_install_js_1.capturePostGenerationInstallState)(tree, installScope, installOperation);
     const { factoryName } = plan;
+    // Capability growth and its consuming bindings are a single deferred source
+    // operation. A container needs network/compute, never an implicit database.
+    await (0, upgrade_js_1.upgradeFoundationForRequirements)(tree, [foundationRequirement], true);
+    if (!ownership.value.foundation.capabilities.includes('network')) {
+        // Capability growth must update the API's consuming network binding in
+        // this same generation, before a Service registers private ingress.
+        const source = tree.read(productPath, 'utf8');
+        if (source === null)
+            throw new Error('Product Slice API source is missing; no workload files changed.');
+        const anchor = `  const api = new sst.aws.ApiGatewayV2('${pascal(slice)}Api', {`;
+        if (source.split(anchor).length !== 2)
+            throw new Error('Product Slice API composition is not recognized; no workload files changed.');
+        tree.write(productPath, source.replace(anchor, anchor +
+            '\n    ...(performanceDeploymentAuthority ? { vpc: foundation.vpc } : {}),'));
+    }
+    tree.write(foundationPath, (0, built_in_plan_foundation_files_js_1.renderSliceFoundationFiles)(slice, pascal(slice), foundationRequirement.capabilities)['infra/foundation.ts']);
     const infraRelative = `../${plural}/${workload}/infra.js`;
     for (const [path, contents] of Object.entries(plan.files)) {
         tree.write(node_path_1.posix.join(sliceRoot, path), contents);
@@ -1219,8 +1260,10 @@ ${kind === 'service' && performanceRegistration.ownsProtectedLoadAdapter
     }
     (0, index_js_1.recordCompositionOwnership)(tree, {
         compositions: [{ feature, kind, name: workload }],
+        foundation: foundationRequirement,
         paths: [
             ...plan.paths,
+            { path: 'infra/foundation.ts' },
             { path: 'infra/product.ts' },
             { path: 'infra/native-runtime-authority/topology.ts' },
             { path: 'infra/native-runtime-authority/effective-intent.ts' },
@@ -1246,4 +1289,10 @@ ${kind === 'service' && performanceRegistration.ownsProtectedLoadAdapter
     }
     return (0, post_generation_install_js_1.createPostGenerationInstallCallback)(tree, installState, installScope, installOperation);
 }
+async function workloadGenerator(tree, options, kind) {
+    const deferred = new preview_changes_js_1.DeferredDeveloperAgentTree(tree);
+    const install = await executeWorkloadGenerator(deferred, options, kind);
+    deferred.apply();
+    return install;
+}
 //# sourceMappingURL=workload.js.map