@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/generators/preset/workspace-files.js

@@ -10,6 +10,7 @@ const sensitive_patterns_1 = require("@empire-builder-kit/runtime/sensitive-patt
 const dependency_overrides_js_1 = require("./dependency-overrides.js");
 const index_js_1 = require("../../ownership/index.js");
 const index_js_2 = require("../../frontend-security/index.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
 const index_js_3 = require("../../git-policy/index.js");
 const index_js_4 = require("../../repository-policy/index.js");
 const index_js_5 = require("../../release/index.js");
@@ -18,6 +19,8 @@ const deterministic_order_js_1 = require("../../deterministic-order.js");
 const tool_versions_js_1 = require("./tool-versions.js");
 const workspace_files_developer_agent_js_1 = require("./workspace-files-developer-agent.js");
 const workspace_files_ci_acceptance_js_1 = require("./workspace-files-ci-acceptance.js");
+const workspace_files_ci_install_js_1 = require("./workspace-files-ci-install.js");
+const workspace_files_adopter_skills_js_1 = require("./workspace-files-adopter-skills.js");
 const workspace_files_ecr_inspector_js_1 = require("./workspace-files-ecr-inspector.js");
 const workspace_files_thin_deploy_js_1 = require("./workspace-files-thin-deploy.js");
 const workspace_files_thin_docs_js_1 = require("./workspace-files-thin-docs.js");
@@ -186,7 +189,7 @@ function protectedSecretPolicyDerivationScript() {
     return `node --input-type=module <<'NODE'
 import { appendFileSync } from 'node:fs';
 import {
-  configuredDeploymentAccountTopology,
+  configuredDeploymentAccountForStage,
   configuredDeploymentRegion,
   isActiveDeploymentStage,
   readRepositoryOperatingPolicy,
@@ -203,16 +206,18 @@ if (policy.deploymentProfile !== renderedProfile) {
 if (!isActiveDeploymentStage(policy.deploymentProfile, stage)) {
   throw new Error('Secret workflow stage is inactive for the committed deployment profile.');
 }
-const accounts = configuredDeploymentAccountTopology(
+configuredDeploymentAccountForStage(
   policy.deploymentProfile,
   policy.deploymentAccounts,
+  stage,
 );
+const accounts = policy.deploymentAccounts;
 const region = configuredDeploymentRegion(policy.deploymentRegion);
 appendFileSync(output, [
   'deployment_region=' + region,
-  'development_account_id=' + accounts.development,
+  'development_account_id=' + (accounts.development ?? ''),
   'staging_account_id=' + (accounts.staging ?? ''),
-  'production_account_id=' + accounts.production,
+  'production_account_id=' + (accounts.production ?? ''),
   '',
 ].join('\\n'));
 NODE`;
@@ -1170,6 +1175,10 @@ function createWorkspaceOwnership(files, frameworkVersion) {
 }
 function renderWorkspaceFiles(options) {
     const { frameworkVersion, name } = options;
+    const foundationPlan = (0, capability_plan_js_1.planFoundationCapabilities)({
+        current: options.foundationDescriptor,
+        requirements: options.foundationRequirements ?? [],
+    });
     const dependencyOverrides = (0, dependency_overrides_js_1.parseDependencyOverrides)(options.dependencyOverrides === undefined
         ? { schemaVersion: 1, overrides: {} }
         : options.dependencyOverrides);
@@ -1249,6 +1258,7 @@ function renderWorkspaceFiles(options) {
     const stagingApplyJobPrefix = 'apply staging plan ';
     const files = {
         ...(0, workspace_files_ci_acceptance_js_1.renderWorkspaceCiAcceptanceFiles)(),
+        ...(0, workspace_files_ci_install_js_1.renderWorkspaceCiInstallFiles)(),
         '.node-version': `${tool_versions_js_1.WORKSPACE_NODE_VERSION}\n`,
         '.github/CODEOWNERS': `# Replace this placeholder with the GitHub user or team that owns protected source.
 # GitHub bootstrap remains blocked until a non-placeholder catch-all owner is committed.
@@ -1346,7 +1356,7 @@ jobs:
         with:
           node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
           cache: pnpm
-      - run: pnpm install --frozen-lockfile
+      - run: node tools/ci/install.mjs
       - run: node tools/ebk-git-policy.mjs
         env:
           EBK_HEAD_REPOSITORY: \${{ github.event.pull_request.head.repo.full_name }}
@@ -1366,7 +1376,7 @@ jobs:
         with:
           node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
           cache: pnpm
-      - run: pnpm install --frozen-lockfile
+      - run: node tools/ci/install.mjs
 ${nxCacheSteps}
       - run: pnpm format:check
       - name: Resolve the affected base and head for proposed work
@@ -1444,15 +1454,19 @@ ${nxCacheSteps}
         with:
           node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
           cache: pnpm
-      - run: pnpm install --frozen-lockfile
+      - run: node tools/ci/install.mjs
 ${nxCacheSteps}
       - name: Build immutable release candidates
+        id: candidates
         env:
           EBK_SOURCE_COMMIT: \${{ github.sha }}
         run: |
-          slice_projects="$(pnpm nx show projects --with-target=release-candidate --json | jq -r 'join(",")')"
-          test -n "$slice_projects" ||
-            { echo 'At least one release-candidate target is required'; exit 1; }
+          slice_projects="$(node tools/ci/release-candidates.mjs)"
+          if [ -z "$slice_projects" ]; then
+            echo 'No application release producers; application artifacts are not applicable.'
+            echo 'available=false' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           pnpm nx run-many -t release-candidate --projects="$slice_projects" --parallel=3
           mkdir -p .ebk/evidence/release-candidate/packages
           IFS=',' read -r -a projects <<< "$slice_projects"
@@ -1463,7 +1477,9 @@ ${nxCacheSteps}
             cp packages/"$project"/.ebk/evidence/release-candidate/*.json \
               ".ebk/evidence/release-candidate/packages/$project/"
           done
+          echo 'available=true' >> "$GITHUB_OUTPUT"
       - name: Retain exact immutable release candidate
+        if: steps.candidates.outputs.available == 'true'
         uses: ${uploadArtifactAction}
         with:
           name: release-candidate-\${{ github.sha }}
@@ -7684,6 +7700,12 @@ infrastructure or protected deployment policy. Preserve the ownership boundary r
 \`.ebk/ownership.json\`: managed files belong to EBK, seeded files are generated starting
 points that adopters may change, and unrecorded files are adopter-owned.
 
+Ordinary feature work uses affected tests, typecheck, lint, and ownership checks.
+At a local milestone, \`pnpm verify\` checks current source through
+\`${name}:verify-proposed\`, including before the first Git commit. This is not
+protected Blueprint acceptance. The separate \`${name}:verify\` target and
+protected GitHub workflows retain their committed-history and trust gates.
+
 Human-supplied secret values are a human-only TTY ceremony. Agents and CI must
 never invoke \`ebk secret set\` or \`ebk secret remove\`. They may use
 value-blind metadata, status, verification, and the exact generated-secret
@@ -7765,10 +7787,13 @@ ${activeStages.join(', ')}. Each active canonical consumer stage uses the matchi
 Inactive canonical stages are rejected. Framework-derived personal stages may use only the
 \`development\` Foundation; generic preview stages are unsupported.
 
-Every active canonical stage owns a separate Router/domain, Aurora cluster and migration history,
-Cognito user pool, event bus, secret namespace, IAM boundary, logs, queues, ECR namespace, and
+Every active canonical stage owns a separate Router/domain, Cognito user pool,
+event bus, secret namespace, IAM boundary, logs, queues, ECR namespace, and
 stage-qualified SSM discovery contract. Discovery rejects a record for an inactive or different
-canonical stage.
+canonical stage. DynamoDB tables belong to individual Slices/tasks, not one global application
+table. Declared relational features add an independent Aurora cluster per canonical stage,
+with separate logical databases and migration histories per Slice. Existing relational resources
+remain declared on upgrade and after removing their last consumer; that is not database retirement.
 `,
         'docs/work-markers.md': `# Agent work markers
 
@@ -7891,7 +7916,7 @@ must be committed, reviewable, and auditable.
                 lint: `nx run-many -t lint --exclude=${name}`,
                 test: `nx run-many -t test --exclude=${name}`,
                 typecheck: `nx run-many -t typecheck --exclude=${name}`,
-                verify: `nx format:check --all && nx run ${name}:verify && nx run-many -t verify --exclude=${name}`,
+                verify: `nx format:check --all && nx run ${name}:verify-proposed && nx run-many -t verify --exclude=${name}`,
             },
             dependencies: {
                 '@empire-builder-kit/runtime': frameworkVersion,
@@ -8043,23 +8068,11 @@ must be committed, reviewable, and auditable.
                 },
             },
         }),
-        'packages/foundation/contracts/foundation.json': json({
-            contractVersion: '1.0.0',
-            capabilities: [
-                'network',
-                'routing',
-                'container-compute',
-                'postgres',
-                'identity',
-                'events',
-                'observability',
-                'configuration',
-                'deployment',
-            ],
-        }),
+        'packages/foundation/contracts/foundation.json': json(foundationPlan.descriptor),
         'packages/foundation/contracts/costs.json': json({
-            schemaVersion: 2,
+            schemaVersion: 3,
             aurora: {
+                declared: foundationPlan.resources.postgres,
                 engine: index_js_4.FOUNDATION_AURORA_ENGINE_FAMILY,
                 engineVersion: index_js_4.FOUNDATION_AURORA_ENGINE_VERSION,
             },
@@ -8067,23 +8080,29 @@ must be committed, reviewable, and auditable.
             productionProfileSource: 'ebk.repository-policy.json',
             stages: {
                 development: {
-                    aurora: 'scale-to-zero',
+                    aurora: foundationPlan.resources.postgres
+                        ? 'scale-to-zero'
+                        : 'not-declared',
                     dataRetention: 'retained',
-                    nat: 'ec2',
+                    nat: foundationPlan.resources.network ? 'ec2' : 'none',
                 },
                 ...(deploymentProfile === 'starter'
                     ? {}
                     : {
                         staging: {
-                            aurora: 'scale-to-zero',
+                            aurora: foundationPlan.resources.postgres
+                                ? 'scale-to-zero'
+                                : 'not-declared',
                             dataRetention: 'retained',
-                            nat: 'ec2',
+                            nat: foundationPlan.resources.network ? 'ec2' : 'none',
                         },
                     }),
                 production: {
-                    aurora: 'repository-policy',
+                    aurora: foundationPlan.resources.postgres
+                        ? 'repository-policy'
+                        : 'not-declared',
                     dataRetention: 'retained-and-protected',
-                    nat: 'managed',
+                    nat: foundationPlan.resources.network ? 'managed' : 'none',
                 },
             },
             usagePriced: [
@@ -8098,16 +8117,21 @@ must be committed, reviewable, and auditable.
         'packages/foundation/contracts/frontend-security-headers.json': json((0, index_js_2.foundationFrontendSecurityHeaderPolicy)()),
         'packages/foundation/docs/costs.md': `# Foundation cost contract
 
-The VPC NAT path and Aurora capacity are the main fixed-cost decisions.
+The default Foundation has no Aurora, VPC/NAT, or ECS cluster. Slice-scoped DynamoDB
+is the first persistence choice. A relational requirement adds Aurora and its
+network/container migration dependencies; an explicit network workload can also
+require those dependencies without SQL. Previously provisioned capabilities stay
+declared until an explicit retirement operation, even with no remaining consumers.
 The machine-readable stage inventory is \`../contracts/costs.json\`; keep this
 seeded decision record aligned with organization-specific budgets and alerts.
 
-- Development uses EC2 NAT, a development bastion, and Aurora scale-to-zero.
-${deploymentProfile === 'starter' ? '' : '- Staging uses EC2 NAT and Aurora scale-to-zero by default.\n'}- Production always uses managed NAT and retains protected data. Its explicit Repository
+- When network/SQL is declared, development uses EC2 NAT, a development bastion,
+  and Aurora scale-to-zero.
+${deploymentProfile === 'starter' ? '' : '- Declared staging network/SQL uses EC2 NAT and Aurora scale-to-zero by default.\n'}- Declared production networking uses managed NAT; production retains protected data. Its explicit Repository
   Operating Policy profile selects cost-optimized (0–2 ACUs, pause after five idle
   minutes), balanced (0.5–4 ACUs, always warm), or standard (2–16 ACUs, always warm).
-  New starter repositories default to cost-optimized. Cold resume typically takes
-  about 15 seconds and can exceed 30 seconds after extended inactivity; validate
+  Newly generated repositories default to cost-optimized in every deployment profile.
+  Cold resume adds latency; measure it for the workload and validate
   connection retries, request timeouts, migrations, and background polling.
   Capacity is shared by all Slices. Open connections can prevent pausing; storage
   and managed NAT remain billable while Aurora compute is paused.
@@ -8122,10 +8146,11 @@ the SST configuration.
         'packages/foundation/docs/security.md': `# Foundation security contract
 
 - Production resources are retained and protected.
-- The shared Aurora master credential is Foundation-internal.
-- Aurora IAM authentication is enabled for generated short-lived migration
+- When relational persistence is declared, the shared Aurora master credential is Foundation-internal.
+- Declared Aurora IAM authentication is enabled for generated short-lived migration
   tasks. The exact cluster resource ID is non-secret Foundation discovery.
-- Product slices receive scoped logical-database credentials through the provisioning contract.
+- Relational Product Slices receive scoped logical-database credentials through the provisioning contract.
+- DynamoDB tables and their access are Slice/task scoped; no shared Foundation application table exists.
 - Cognito owns authentication; product slices own authorization policy and app clients.
 - Lambda and server-side web workloads use resource linking. Containers use the documented
   stage-scoped SSM/secret path and least-privilege IAM.
@@ -8168,10 +8193,9 @@ declare const $app: {
 
 import {
   FOUNDATION_SSM_SCHEMA_VERSION,
-  STANDARD_FOUNDATION_CAPABILITIES,
   createRouterWafRules,
   createRouterWafStagePlan,
-  foundationDatabaseEndpointHost,
+${foundationPlan.resources.postgres ? '  foundationDatabaseEndpointHost,' : ''}
   foundationSsmPath,
   normalizeRouterWafPolicy,
   reconcileRouterWafBlockingRehearsal,
@@ -8179,8 +8203,7 @@ import {
   type FoundationSsmKey,
 } from '@empire-builder-kit/nx/foundation';
 import {
-  FOUNDATION_AURORA_ENGINE,
-  FOUNDATION_AURORA_ENGINE_VERSION,
+${foundationPlan.resources.postgres ? '  FOUNDATION_AURORA_ENGINE,\n  FOUNDATION_AURORA_ENGINE_VERSION,' : ''}
   productionFoundationProfileContract,
 } from '@empire-builder-kit/nx/repository-policy';
 import { installStageIamBoundaryTransforms } from '@empire-builder-kit/nx/aws-authority';
@@ -8216,7 +8239,7 @@ function identityDomainPrefix(stage: string, accountId: string): string {
   return value.slice(0, 50) + '-' + digest;
 }
 
-function publishFoundation(values: Record<FoundationSsmKey, any>) {
+function publishFoundation(values: Partial<Record<FoundationSsmKey, any>>) {
   return Object.fromEntries(
     Object.entries(values).map(([key, value]) => [
       key,
@@ -8231,14 +8254,14 @@ function publishFoundation(values: Record<FoundationSsmKey, any>) {
 
 export function foundation() {
   const isProduction = $app.stage === 'production';
-  const isStaging = $app.stage === 'staging';
+${foundationPlan.resources.postgres ? "  const isStaging = $app.stage === 'staging';" : ''}
   const rootDomain = process.env.EBK_ROOT_DOMAIN?.trim();
   const productionConfiguration = isProduction
     ? productionFoundationProfileContract(
         process.env.EBK_PRODUCTION_FOUNDATION_PROFILE,
       )
     : undefined;
-  const natMode = productionConfiguration?.contract.nat ?? 'ec2';
+${foundationPlan.resources.network ? "  const natMode = productionConfiguration?.contract.nat ?? 'ec2';" : ''}
   const normalizedRouterWafPolicy = normalizeRouterWafPolicy(routerWafPolicy);
   if (repositoryPolicy.deploymentProfile !== normalizedRouterWafPolicy.deploymentProfile) {
     throw new Error('Router WAF policy profile differs from committed repository policy.');
@@ -8292,13 +8315,15 @@ export function foundation() {
       | 'production',
   });
 
-  const vpc = new sst.aws.Vpc('FoundationVpc', {
+${foundationPlan.resources.network
+            ? `  const vpc = new sst.aws.Vpc('FoundationVpc', {
     az: 2,
     bastion: $app.stage === 'development',
     nat:
       natMode === 'ec2' ? 'ec2' : 'managed',
-  });
-  const cluster = new sst.aws.Cluster('FoundationCluster', { vpc });
+  });`
+            : ''}
+${foundationPlan.resources.containerCompute ? "  const cluster = new sst.aws.Cluster('FoundationCluster', { vpc });" : ''}
   const router = new sst.aws.Router('FoundationRouter', {
     ...(rootDomain
       ? {
@@ -8339,7 +8364,7 @@ export function foundation() {
             'Foundation Router Web ACL must use global CloudFront scope.',
           );
         }
-        const ipSets: { ipv4Arn?: any; ipv6Arn?: any } = {};
+        const ipSets: { ipv4Arn?: any; ipv6Arn?: any; smokeArn?: any } = {};
         if (wafPlan.ipv4Cidrs.length > 0) {
           ipSets.ipv4Arn = new aws.wafv2.IpSet(
             'FoundationRouterIpv4Allowlist',
@@ -8378,6 +8403,42 @@ export function foundation() {
             { provider: opts.provider },
           ).arn;
         }
+        if (wafPlan.access === 'allowlist') {
+          // Smoke rotates WAF's LockToken outside Pulumi. Keep the existing
+          // baseline IP sets untouched; AWS's Cloud Control handler owns the
+          // separate ephemeral set's lifecycle without a cached lock token.
+          const smokeAccess = new aws.cloudcontrol.Resource(
+            'FoundationRouterSmokeAccess',
+            {
+              typeName: 'AWS::WAFv2::IPSet',
+              desiredState: JSON.stringify({
+                Addresses: [],
+                IPAddressVersion: 'IPV4',
+                Name: 'foundation-' + wafPlan.stage + '-router-smoke-access',
+                Scope: 'CLOUDFRONT',
+                Tags: Object.entries({
+                  'ebk:managed-by': 'empire-builder-kit',
+                  'ebk:owner': 'foundation',
+                  'ebk:purpose': 'private-smoke-access',
+                  'ebk:stage': wafPlan.stage,
+                  'ebk:workspace': '${name}',
+                }).map(([Key, Value]) => ({ Key, Value })),
+              }),
+            },
+            {
+              provider: opts.provider,
+              // This dedicated set has creation-only identity/ownership inputs.
+              // Admission owns its addresses; the Web ACL owns policy binding.
+              // Retain old inputs on upgrade too: Cloud Control patches arrays
+              // by index, which is unsafe for service-reordered Tags (including
+              // removing an older policy-digest tag). Never patch this document.
+              ignoreChanges: ['desiredState'],
+            },
+          );
+          ipSets.smokeArn = smokeAccess.properties.apply(
+            (properties: string) => JSON.parse(properties).Arn,
+          );
+        }
         args.defaultAction = { allow: {} };
         args.rules = createRouterWafRules(wafPlan, ipSets);
         args.scope = 'CLOUDFRONT';
@@ -8401,7 +8462,8 @@ export function foundation() {
       },
     },
   });
-  const database = new sst.aws.Aurora('FoundationDatabase', {
+${foundationPlan.resources.postgres
+            ? `  const database = new sst.aws.Aurora('FoundationDatabase', {
     // SQL bootstrap and migrations run inside the VPC. Keep the public HTTPS
     // Data API surface disabled; protected GitHub roles also deny its actions.
     dataApi: false,
@@ -8462,7 +8524,8 @@ export function foundation() {
       secretArn: database.secretArn,
       username: database.username,
     },
-  });
+  });`
+            : ''}
   const foundationAccountId = aws.getCallerIdentityOutput({}).accountId;
   const foundationPartition = aws.getPartitionOutput({});
   const foundationRegion = aws.getRegionOutput({});
@@ -8496,7 +8559,7 @@ export function foundation() {
     stage: $app.stage,
     workspace: '${name}',
   });
-  const databaseInstanceId = database.nodes.instance.identifier;
+${foundationPlan.resources.postgres ? '  const databaseInstanceId = database.nodes.instance.identifier;' : ''}
   const alertTopicPolicy = new aws.sns.TopicPolicy(
     'FoundationAlertTopicPolicy',
     {
@@ -8542,7 +8605,8 @@ export function foundation() {
             resources: [alertTopic.arn],
             sid: 'AllowCostAnomalyAlerts',
           },
-          {
+${foundationPlan.resources.postgres
+            ? `          {
             actions: ['sns:Publish'],
             conditions: [
               {
@@ -8564,7 +8628,8 @@ export function foundation() {
             }],
             resources: [alertTopic.arn],
             sid: 'AllowRdsEventAlerts',
-          },
+          },`
+            : ''}
           {
             actions: ['sns:Publish'],
             conditions: [
@@ -8652,7 +8717,8 @@ export function foundation() {
           { dependsOn: [accountCostAnomalyMonitor, alertTopicPolicy] },
         )
       : undefined;
-  const databaseEvents = isProduction
+${foundationPlan.resources.postgres
+            ? `  const databaseEvents = isProduction
     ? new aws.rds.EventSubscription(
         'FoundationDatabaseEvents',
         {
@@ -8734,7 +8800,14 @@ export function foundation() {
       threshold: 90,
       treatMissingData: 'notBreaching',
     },
-  );
+  );`
+            : `  const dashboard = new aws.cloudwatch.Dashboard('FoundationDashboard', {
+    dashboardName: 'ebk-' + $app.stage + '-foundation',
+    dashboardBody: JSON.stringify({ widgets: [{
+      type: 'text', x: 0, y: 0, width: 24, height: 3,
+      properties: { markdown: '# Empire Builder Kit Foundation\\nStage: ' + $app.stage + '\\nPersistence: Slice-scoped DynamoDB; SQL not declared.' },
+    }] }),
+  });`}
 
   if (new Set(['development', 'staging', 'production']).has($app.stage)) {
     new aws.cloudwatch.EventArchive('FoundationEventArchive', {
@@ -8750,16 +8823,18 @@ export function foundation() {
       accountCostControl.authority.monthlyMaximumUsd,
     ),
     alertTopicArn: alertTopic.arn,
-    capabilities: STANDARD_FOUNDATION_CAPABILITIES.join(','),
-    clusterId: cluster.id,
-    contractVersion: '1.0.0',
-    databaseClusterArn: database.clusterArn,
+    capabilities: ${JSON.stringify(foundationPlan.descriptor.capabilities.join(','))},
+${foundationPlan.resources.containerCompute ? '    clusterId: cluster.id,' : ''}
+    contractVersion: '${foundationPlan.descriptor.contractVersion}',
+${foundationPlan.resources.postgres
+            ? `    databaseClusterArn: database.clusterArn,
     databaseClusterEndpoint,
     databaseClusterId: database.id,
     databaseClusterResourceId: database.nodes.cluster.clusterResourceId,
     databaseHost: databaseClusterEndpoint,
     databaseMasterSecretArn: database.secretArn,
-    databasePort: database.port.apply(String),
+    databasePort: database.port.apply(String),`
+            : ''}
     eventBusArn: eventBus.arn,
     eventBusName: eventBus.name,
     hasPublicDomain: rootDomain ? 'true' : 'false',
@@ -8770,20 +8845,22 @@ export function foundation() {
     routerDistributionId: router.distributionID,
     routerUrl: router.url,
     schemaVersion: String(FOUNDATION_SSM_SCHEMA_VERSION),
-    vpcId: vpc.id,
+${foundationPlan.resources.network ? '    vpcId: vpc.id,' : ''}
   });
 
   return {
     accountBudgetName: accountBudget?.name,
     alertTopicArn: alertTopic.arn,
-    capabilities: STANDARD_FOUNDATION_CAPABILITIES,
-    clusterId: cluster.id,
-    contractVersion: '1.0.0',
+    capabilities: ${JSON.stringify(foundationPlan.descriptor.capabilities)},
+${foundationPlan.resources.containerCompute ? '    clusterId: cluster.id,' : ''}
+    contractVersion: '${foundationPlan.descriptor.contractVersion}',
     costAnomalySubscriptionArn: accountCostAnomalySubscription?.arn,
-    databaseCapacityAlarmName: databaseCapacityAlarm.name,
+${foundationPlan.resources.postgres ? '    databaseCapacityAlarmName: databaseCapacityAlarm.name,' : ''}
     dashboardName: dashboard.dashboardName,
-    databaseClusterId: database.id,
-    databaseEventSubscriptionId: databaseEvents?.id,
+${foundationPlan.resources.postgres
+            ? `    databaseClusterId: database.id,
+    databaseEventSubscriptionId: databaseEvents?.id,`
+            : ''}
     eventBusName: eventBus.name,
     identityUserPoolId: userPool.id,
     identityTokenEndpoint,
@@ -8791,7 +8868,7 @@ export function foundation() {
     productionFoundationProfile: productionConfiguration?.profile,
     rootDomain,
     routerUrl: router.url,
-    vpcId: vpc.id,
+${foundationPlan.resources.network ? '    vpcId: vpc.id,' : ''}
   };
 }
 `,
@@ -9161,20 +9238,10 @@ if (normalizedRehearsal) {
     receipt: normalizedRehearsal,
   });
 }
-const expectedCapabilities = [
-  'network',
-  'routing',
-  'container-compute',
-  'postgres',
-  'identity',
-  'events',
-  'observability',
-  'configuration',
-  'deployment',
-];
+const expectedCapabilities = ${JSON.stringify(foundationPlan.descriptor.capabilities)};
 
-if (descriptor.contractVersion !== '1.0.0') {
-  throw new Error('Foundation contractVersion must be 1.0.0.');
+if (descriptor.contractVersion !== '2.0.0') {
+  throw new Error('Foundation contractVersion must be 2.0.0.');
 }
 if (
   JSON.stringify(Object.keys(routerWafPolicy.stages).sort()) !==
@@ -9186,10 +9253,11 @@ if (
   throw new Error('Foundation Router WAF stage defaults are invalid.');
 }
 if (JSON.stringify(descriptor.capabilities) !== JSON.stringify(expectedCapabilities)) {
-  throw new Error('Foundation capability descriptor does not match the v1 standard.');
+  throw new Error('Foundation capability descriptor does not match its generated resource declaration.');
 }
 if (
-  costs.schemaVersion !== 2 ||
+  costs.schemaVersion !== 3 ||
+  costs.aurora?.declared !== ${foundationPlan.resources.postgres} ||
   costs.aurora?.engineVersion !== '${index_js_4.FOUNDATION_AURORA_ENGINE_VERSION}' ||
   costs.productionProfileSource !== 'ebk.repository-policy.json' ||
   costs.productionProfiles?.standard?.aurora?.min !== '2 ACU' ||
@@ -9199,7 +9267,7 @@ if (
     JSON.stringify(${JSON.stringify([...activeStages].sort())}) ||
   costs.stages?.production?.dataRetention !== 'retained-and-protected'
 ) {
-  throw new Error('Foundation cost manifest does not match the v1 stage contract.');
+  throw new Error('Foundation cost manifest does not match the declared capability and stage contract.');
 }
 const localHeaders =
   frontendSecurityHeaders.profiles?.['local-development']?.headers ?? [];
@@ -10294,7 +10362,7 @@ assertWorkMarkerReport(markerReport);
 process.stdout.write('Empire Builder Kit workspace source health is green.\\n');
 `,
     };
-    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, developerAgentFilePlan.files, (0, workspace_files_stage_authority_js_1.renderStageAuthorityWorkspaceFiles)({
+    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, developerAgentFilePlan.files, (0, workspace_files_adopter_skills_js_1.renderAdopterSkills)({ name, deploymentProfile }), (0, workspace_files_stage_authority_js_1.renderStageAuthorityWorkspaceFiles)({
         deploymentProfile,
         name,
         workspaceDeploymentId,

package/src/generators/repository-policy/repository-policy.js

@@ -7,6 +7,34 @@ const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../repository-policy/index.js");
 const index_js_2 = require("../../workspace-deployment/index.js");
+const SEEDED_ROUTER_WAF_POLICY_PATH = 'packages/foundation/security/router-waf.json';
+const SEEDED_PROFILE_GUIDANCE = 'Review adopter-owned README.md, AGENTS.md, docs/architecture.md, docs/developer-agent.md, docs/repository-operating-policy.md, Foundation README/runbooks/security/costs guidance, and packages/foundation/performance/account-cost-policy.json after changing profile.';
+function staleSeededRouterWafDiagnostic(tree, profile) {
+    const source = tree.read(SEEDED_ROUTER_WAF_POLICY_PATH, 'utf8');
+    if (source === null)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        value = null;
+    }
+    const policy = value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+    const stages = policy?.stages !== null &&
+        typeof policy?.stages === 'object' &&
+        !Array.isArray(policy.stages)
+        ? Object.keys(policy.stages).sort()
+        : null;
+    const expectedStages = [...(0, index_js_1.activeDeploymentStages)(profile)].sort();
+    if (policy?.deploymentProfile === profile &&
+        JSON.stringify(stages) === JSON.stringify(expectedStages)) {
+        return null;
+    }
+    return `The seeded ${SEEDED_ROUTER_WAF_POLICY_PATH} still has a different deployment profile or stage set. Before applying this topology change, update that adopter-owned policy to ${profile} with exactly ${expectedStages.join(', ')} stages, preserving reviewed CIDRs and WAF settings. Then rerun repository-policy --apply, managed workspace/Foundation upgrades, and foundation:verify. Review profile-dependent seeded guidance before protected deployment; EBK will not overwrite it.`;
+}
 function sliceStatusFor(options) {
     if (options.status)
         return options.status;
@@ -246,6 +274,15 @@ async function repositoryPolicyGenerator(tree, options) {
         current,
         next,
     }, null, 2)}\nPolicy source changes do not deploy, remove, or alter AWS resources.`);
+    if (current.deploymentProfile !== next.deploymentProfile) {
+        devkit_1.logger.warn(`[ebk-repository-policy] ${SEEDED_PROFILE_GUIDANCE}`);
+        const diagnostic = staleSeededRouterWafDiagnostic(tree, next.deploymentProfile);
+        if (diagnostic !== null) {
+            if (options.apply)
+                throw new Error(diagnostic);
+            devkit_1.logger.warn(`[ebk-repository-policy] ${diagnostic}`);
+        }
+    }
     if (!options.apply || !changed)
         return;
     tree.write(index_js_1.REPOSITORY_POLICY_FILE, `${JSON.stringify(next, null, 2)}\n`);