@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/generators/slice/built-in-plan-project-files.js

@@ -6,6 +6,7 @@ const workspace_files_performance_load_js_1 = require("../preset/workspace-files
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 /** @internal */
 function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
+    const sql = ownership.foundation.capabilities.includes('postgres');
     return {
         'package.json': (0, built_in_plan_shared_js_1.json)({
             name: `${scope}/${name}`,
@@ -27,11 +28,15 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
                 '@aws-sdk/client-sqs': built_in_plan_shared_js_1.PRODUCT_VERSIONS.awsSqs,
                 '@aws-sdk/client-ssm': built_in_plan_shared_js_1.PRODUCT_VERSIONS.awsSsm,
                 '@aws-sdk/client-sts': built_in_plan_shared_js_1.PRODUCT_VERSIONS.awsSts,
-                '@aws-sdk/rds-signer': built_in_plan_shared_js_1.PRODUCT_VERSIONS.awsRdsSigner,
                 '@empire-builder-kit/runtime': runtimeVersion,
-                'drizzle-orm': built_in_plan_shared_js_1.PRODUCT_VERSIONS.drizzle,
+                ...(sql
+                    ? {
+                        '@aws-sdk/rds-signer': built_in_plan_shared_js_1.PRODUCT_VERSIONS.awsRdsSigner,
+                        'drizzle-orm': built_in_plan_shared_js_1.PRODUCT_VERSIONS.drizzle,
+                        pg: built_in_plan_shared_js_1.PRODUCT_VERSIONS.pg,
+                    }
+                    : {}),
                 next: built_in_plan_shared_js_1.PRODUCT_VERSIONS.next,
-                pg: built_in_plan_shared_js_1.PRODUCT_VERSIONS.pg,
                 react: built_in_plan_shared_js_1.PRODUCT_VERSIONS.react,
                 'react-dom': built_in_plan_shared_js_1.PRODUCT_VERSIONS.reactDom,
                 'server-only': built_in_plan_shared_js_1.PRODUCT_VERSIONS.serverOnly,
@@ -40,10 +45,14 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
                 '@axe-core/playwright': built_in_plan_shared_js_1.PRODUCT_VERSIONS.axePlaywright,
                 '@playwright/test': built_in_plan_shared_js_1.PRODUCT_VERSIONS.playwright,
                 '@types/node': built_in_plan_shared_js_1.PRODUCT_VERSIONS.typesNode,
-                '@types/pg': built_in_plan_shared_js_1.PRODUCT_VERSIONS.typesPg,
+                ...(sql
+                    ? {
+                        '@types/pg': built_in_plan_shared_js_1.PRODUCT_VERSIONS.typesPg,
+                        'drizzle-kit': built_in_plan_shared_js_1.PRODUCT_VERSIONS.drizzleKit,
+                    }
+                    : {}),
                 '@types/react': built_in_plan_shared_js_1.PRODUCT_VERSIONS.typesReact,
                 '@types/react-dom': built_in_plan_shared_js_1.PRODUCT_VERSIONS.typesReactDom,
-                'drizzle-kit': built_in_plan_shared_js_1.PRODUCT_VERSIONS.drizzleKit,
                 vitest: built_in_plan_shared_js_1.PRODUCT_VERSIONS.vitest,
             },
             exports: {
@@ -77,7 +86,7 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
             ],
             metadata: {
                 ebk: {
-                    localDev: (0, built_in_plan_shared_js_1.STANDARD_LOCAL_DEV_ADAPTER)(name),
+                    localDev: (0, built_in_plan_shared_js_1.STANDARD_LOCAL_DEV_ADAPTER)(name, ownership.inputs.dependencySlices, sql),
                 },
             },
             targets: {
@@ -251,7 +260,7 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
                     dependsOn: ['secret-guardrails', 'typecheck'],
                     outputs: [`{projectRoot}/web/.next`],
                     options: {
-                        command: 'next build web',
+                        command: 'next build --webpack web',
                         cwd: `packages/${name}`,
                         env: {
                             NODE_ENV: 'production',
@@ -297,60 +306,66 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
                         forwardAllArgs: false,
                     },
                 },
-                'db-check': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node scripts/check-database.mjs',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-generate': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'drizzle-kit generate --config=database/drizzle.config.ts',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-migrate': {
-                    executor: 'nx:run-commands',
-                    dependsOn: [{ target: 'deploy-infrastructure', params: 'forward' }],
-                    options: {
-                        command: 'node scripts/migrate-database.mjs',
-                        cwd: `packages/${name}`,
-                        forwardAllArgs: true,
-                    },
-                },
-                'db-local-down': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node scripts/local-database.mjs down',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-local-migrate': {
-                    executor: 'nx:run-commands',
-                    dependsOn: ['db-local-up'],
-                    options: {
-                        command: 'drizzle-kit migrate --config=database/drizzle.config.ts',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-local-up': {
-                    executor: 'nx:run-commands',
-                    dependsOn: ['db-check'],
-                    options: {
-                        command: 'node scripts/local-database.mjs up',
-                        cwd: `packages/${name}`,
-                    },
-                },
-                'db-retirement-rehearsal': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node scripts/rehearse-database-retirement.mjs',
-                        cwd: `packages/${name}`,
-                        forwardAllArgs: false,
-                    },
-                },
+                ...(sql
+                    ? {
+                        'db-check': {
+                            executor: 'nx:run-commands',
+                            options: {
+                                command: 'node scripts/check-database.mjs',
+                                cwd: `packages/${name}`,
+                            },
+                        },
+                        'db-generate': {
+                            executor: 'nx:run-commands',
+                            options: {
+                                command: 'drizzle-kit generate --config=database/drizzle.config.ts',
+                                cwd: `packages/${name}`,
+                            },
+                        },
+                        'db-migrate': {
+                            executor: 'nx:run-commands',
+                            dependsOn: [
+                                { target: 'deploy-infrastructure', params: 'forward' },
+                            ],
+                            options: {
+                                command: 'node scripts/migrate-database.mjs',
+                                cwd: `packages/${name}`,
+                                forwardAllArgs: true,
+                            },
+                        },
+                        'db-local-down': {
+                            executor: 'nx:run-commands',
+                            options: {
+                                command: 'node scripts/local-database.mjs down',
+                                cwd: `packages/${name}`,
+                            },
+                        },
+                        'db-local-migrate': {
+                            executor: 'nx:run-commands',
+                            dependsOn: ['db-local-up'],
+                            options: {
+                                command: 'drizzle-kit migrate --config=database/drizzle.config.ts',
+                                cwd: `packages/${name}`,
+                            },
+                        },
+                        'db-local-up': {
+                            executor: 'nx:run-commands',
+                            dependsOn: ['db-check'],
+                            options: {
+                                command: 'node scripts/local-database.mjs up',
+                                cwd: `packages/${name}`,
+                            },
+                        },
+                        'db-retirement-rehearsal': {
+                            executor: 'nx:run-commands',
+                            options: {
+                                command: 'node scripts/rehearse-database-retirement.mjs',
+                                cwd: `packages/${name}`,
+                                forwardAllArgs: false,
+                            },
+                        },
+                    }
+                    : {}),
                 'data-policy-check': {
                     cache: false,
                     executor: 'nx:run-commands',
@@ -397,12 +412,32 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
                     },
                 },
                 'dev-cleanup': {
-                    executor: 'nx:noop',
-                    dependsOn: ['db-local-down', 'secret-personal-down'],
+                    cache: false,
+                    executor: 'nx:run-commands',
+                    dependsOn: ['dev-task-cleanup'],
+                    options: {
+                        commands: [
+                            ...(sql ? [`pnpm nx run ${name}:db-local-down`] : []),
+                            `pnpm nx run ${name}:secret-personal-down`,
+                        ],
+                        cwd: '.',
+                        forwardAllArgs: false,
+                        parallel: false,
+                    },
+                },
+                'dev-task-cleanup': {
+                    cache: false,
+                    executor: '@empire-builder-kit/nx:dev-task-cleanup',
+                    options: {},
                 },
                 deploy: {
                     executor: 'nx:run-commands',
-                    dependsOn: [{ target: 'db-migrate', params: 'forward' }],
+                    dependsOn: [
+                        {
+                            target: sql ? 'db-migrate' : 'deploy-infrastructure',
+                            params: 'forward',
+                        },
+                    ],
                     options: {
                         command: 'node scripts/confirm-deploy.mjs',
                         cwd: `packages/${name}`,
@@ -425,7 +460,7 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
                     executor: '@empire-builder-kit/nx:dev',
                     dependsOn: [
                         'dev-prerequisite',
-                        'db-local-migrate',
+                        ...(sql ? ['db-local-migrate'] : []),
                         { target: 'foundation-preflight', params: 'forward' },
                     ],
                     options: {
@@ -435,7 +470,11 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
                 },
                 'dev-prerequisite': {
                     executor: 'nx:run-commands',
-                    dependsOn: ['db-check', 'secret-guardrails', 'typecheck'],
+                    dependsOn: [
+                        ...(sql ? ['db-check'] : []),
+                        'secret-guardrails',
+                        'typecheck',
+                    ],
                     options: {
                         command: 'node scripts/verify-live-mode.mjs',
                         cwd: `packages/${name}`,
@@ -850,6 +889,16 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
                         forwardAllArgs: false,
                     },
                 },
+                'verify-local-browser': {
+                    cache: false,
+                    executor: 'nx:run-commands',
+                    outputs: ['{projectRoot}/.ebk/evidence/local-browser.json'],
+                    options: {
+                        command: 'node scripts/verify-local-browser.mjs',
+                        cwd: `packages/${name}`,
+                        forwardAllArgs: false,
+                    },
+                },
                 'smoke-deployed': {
                     cache: false,
                     executor: 'nx:run-commands',
@@ -912,7 +961,7 @@ function renderSliceProjectFiles(name, scope, runtimeVersion, ownership) {
                         'build',
                         'contract-dependencies-check',
                         'data-policy-check',
-                        'db-check',
+                        ...(sql ? ['db-check'] : []),
                         'frontend-boundaries',
                         'lint',
                         'performance-budget',

package/src/generators/slice/built-in-plan-release-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderProductReleaseFiles(name: string, configurationSeed: string): Readonly<Record<string, string>>;
+export declare function renderProductReleaseFiles(name: string, configurationSeed: string, sql?: boolean): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-release-files.js

@@ -14,7 +14,7 @@ function configurationSeedDates(seed) {
     };
 }
 /** @internal */
-function renderProductReleaseFiles(name, configurationSeed) {
+function renderProductReleaseFiles(name, configurationSeed, sql = true) {
     const configurationDates = configurationSeedDates(configurationSeed);
     return {
         'infra/container-images.ts': `import {
@@ -79,6 +79,35 @@ function readJson(root: string, candidate: string, label: string): unknown {
   }
 }
 
+function localContainerImage(local: { context: string; dockerfile: string }) {
+  const registry = process.env.EBK_CONTAINER_PACKAGE_REGISTRY?.trim() ?? '';
+  if (registry === '') return local;
+  if (registry.length > 2_048) {
+    throw new Error('Container package registry authority is invalid.');
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(registry);
+  } catch {
+    throw new Error('Container package registry authority is invalid.');
+  }
+  const normalized = parsed.href;
+  const localPlaintext = parsed.protocol === 'http:' &&
+    ['127.0.0.1', 'localhost', 'host.docker.internal', '[::1]'].includes(parsed.hostname);
+  if (
+    (registry !== normalized && registry + '/' !== normalized) ||
+    (parsed.protocol !== 'https:' && !localPlaintext) ||
+    parsed.username !== '' || parsed.password !== '' ||
+    parsed.search !== '' || parsed.hash !== ''
+  ) {
+    throw new Error('Container package registry authority is invalid.');
+  }
+  return {
+    ...local,
+    args: { NPM_CONFIG_REGISTRY: normalized.endsWith('/') ? normalized.slice(0, -1) : normalized },
+  };
+}
+
 export function resolveStandardContainerImage(input: {
   artifactId: string;
   exactDevelopment?: boolean;
@@ -87,7 +116,7 @@ export function resolveStandardContainerImage(input: {
   stage: string;
 }): {
   environment: Record<string, string>;
-  image: string | { context: string; dockerfile: string };
+  image: string | { context: string; dockerfile: string; args?: Record<string, string> };
 } {
   const lifecycleAction = process.env.EBK_ACTION?.trim();
   if (
@@ -113,6 +142,9 @@ export function resolveStandardContainerImage(input: {
     (!protectedStage && !exactDevelopment) ||
     (lifecycleAction !== undefined && lifecycleAction !== 'deploy')
   ) {
+    if (!protectedStage && !exactDevelopment) {
+      return { environment: {}, image: localContainerImage(input.local) };
+    }
     return { environment: {}, image: input.local };
   }
   if (!COMMIT.test(input.sourceCommit)) {
@@ -1203,7 +1235,8 @@ describe('generated rollout host bindings', () => {
   });
 });
 `,
-        'web/src/lib/provider-delivery.ts': `import {
+        'web/src/lib/provider-delivery.ts': `import { NextResponse } from 'next/server';
+import {
   createSliceAwsConfigurationProvider,
   createSliceLocalConfigurationProvider,
 } from '../../../configuration/provider';
@@ -1260,9 +1293,6 @@ export function nextServerProviderDeliveryForSubject(
     ),
   );
 }
-`,
-        'web/src/app/api/provider-delivery/route.ts': `import { NextResponse } from 'next/server';
-import { nextServerProviderDeliveryForSubject } from '../../../lib/provider-delivery';
 
 export interface ProviderDeliveryRouteDependencies {
   resolveAuthenticatedSubjectId(request: Request): Promise<string>;
@@ -1291,6 +1321,8 @@ export function createProviderDeliveryRoute(
     });
   };
 }
+`,
+        'web/src/app/api/provider-delivery/route.ts': `import { NextResponse } from 'next/server';
 
 export async function GET() {
   return NextResponse.json(
@@ -1935,12 +1967,18 @@ if (
 ) {
   throw new Error('Generated artifact inventory names must be unique.');
 }
-const safeFiles = (paths, pointer, { allowSymbolicLinks = false } = {}) => {
+const safeFiles = (paths, pointer, { allowSymbolicLinks = false, nextJsBuildOutput = false } = {}) => {
   if (!Array.isArray(paths) || paths.length === 0) {
     throw new Error(pointer + ' must name at least one artifact path.');
   }
   const files = [];
   const seen = new Set();
+  const compilerCacheDirectories = new Set(
+    nextJsBuildOutput
+      ? paths.filter((path) => typeof path === 'string' && path.split('/').at(-1) === '.next')
+          .map((path) => resolve(repositoryRoot, path, 'cache'))
+      : [],
+  );
   const visit = (candidate) => {
     if (isAbsolute(candidate)) {
       throw new Error(pointer + ' contains an absolute artifact path.');
@@ -1969,6 +2007,12 @@ const safeFiles = (paths, pointer, { allowSymbolicLinks = false } = {}) => {
     const realFromRoot = repositoryRelativeRealPath(real, pointer);
     const stat = lstatSync(absolute);
     const normalized = pathFromRoot.split(sep).join('/');
+    if (compilerCacheDirectories.has(absolute)) {
+      if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error(pointer + ': Next.js compiler cache must be a real directory.');
+      }
+      return;
+    }
     if (stat.isSymbolicLink()) {
       const targetText = readlinkSync(absolute, 'utf8');
       const target = realFromRoot.split(sep).join('/');
@@ -2102,7 +2146,7 @@ const artifacts = inventory.map((artifact, index) => {
   const materialDigestOptions =
     artifact.buildArtifact?.support === 'supported' &&
     artifact.buildArtifact.family === 'nextjs-build-output'
-      ? { allowSymbolicLinks: true }
+      ? { allowSymbolicLinks: true, nextJsBuildOutput: true }
       : undefined;
   const common = {
     buildRecipeDigest: digestPaths(
@@ -2479,10 +2523,14 @@ const contract = treeEvidence(
   'contracts',
   'ebk-release-contract-source',
 );
-const migration = treeEvidence(
-  'database/migrations',
-  'ebk-release-migration-source',
-);
+const sqlDeclared = ${sql};
+const migration = {
+  ...treeEvidence(
+    sqlDeclared ? 'database/migrations' : 'data/persistence.json',
+    'ebk-release-migration-source',
+  ),
+  applicability: sqlDeclared ? 'declared-sql' : 'not-applicable',
+};
 const testEvidence = JSON.parse(
   readFileSync(
     new URL('../.ebk/evidence/test-integration.json', import.meta.url),
@@ -2523,10 +2571,10 @@ if (
 }
 const migrationJournalPath =
   'packages/${name}/database/migrations/meta/_journal.json';
-const migrationJournalContent = readFileSync(
+const migrationJournalContent = sqlDeclared ? readFileSync(
   new URL('../database/migrations/meta/_journal.json', import.meta.url),
   'utf8',
-);
+) : JSON.stringify({ entries: [] });
 const migrationJournal = JSON.parse(migrationJournalContent);
 const baselineMigrationJournalContent = trackedAt(
   baselineCommit,
@@ -2570,7 +2618,8 @@ const databaseCompatibilityReport = {
   baselineDigest: digest(baselineMigrationJournalContent ?? ''),
   candidateDigest: digest(migrationJournalContent),
   classification:
-    preservedMigrations && !destructiveMigration
+    preservedMigrations && !destructiveMigration &&
+    (sqlDeclared || baselineMigrationJournalContent === undefined)
       ? 'compatible'
       : 'incompatible',
   kind: 'database-migration-compatibility',

package/src/generators/slice/built-in-plan-reliability-files.js

@@ -186,8 +186,8 @@ function alarmRegistrations(name) {
         },
         {
             ...common,
-            businessSymptom: 'The shared database is approaching its capacity bound.',
-            condition: 'Aurora capacity exceeds the reviewed warning threshold.',
+            businessSymptom: 'Slice data access or durable event delivery is being throttled.',
+            condition: 'The Slice DynamoDB table or PendingEvents index reports read or write throttling.',
             dependencyAlarmIds: [],
             id: 'database-capacity',
             runbookRef: 'runbook:database-recovery',
@@ -612,18 +612,19 @@ function deployedAlarmResources(name) {
         },
         {
             ...primary,
-            dimensionNames: ['DBClusterIdentifier'],
-            evaluationPeriods: 3,
+            dimensionNames: ['GlobalSecondaryIndexName', 'TableName'],
+            dimensionValues: { GlobalSecondaryIndexName: 'PendingEvents' },
+            evaluationPeriods: 1,
             id: 'database-capacity',
-            metricName: 'ServerlessDatabaseCapacity',
+            metricNames: ['ReadThrottleEvents', 'WriteThrottleEvents'],
             name: `${name}-{stage}-database-capacity`,
-            namespace: 'AWS/RDS',
-            period: 300,
+            namespace: 'AWS/DynamoDB',
+            period: 60,
             runbook: 'docs/runbooks/database-recovery.md',
-            signal: 'metric',
-            statistic: 'Maximum',
-            threshold: 3.5,
-            treatMissingData: 'missing',
+            signal: 'metric-math',
+            statistic: 'Sum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
         },
         {
             ...primary,
@@ -1102,7 +1103,7 @@ export interface ReliabilityInfrastructureInput {
   alertTopicArn: any;
   alertTopicName: any;
   apiId: any;
-  databaseClusterIdentifier: any;
+${'  databaseTableName: any;\n'}\
   functionName: any;
   providerQueueName: any;
 }
@@ -1280,22 +1281,32 @@ export function create${pascalName}Reliability(
     {
       alarmActions: [input.alertTopicArn],
       alarmDescription: alarmDescription({
-        businessSymptom: 'The shared database is approaching its reviewed capacity bound.',
+        businessSymptom: ${JSON.stringify('The Slice table or event-reconciliation index is throttling operations.')},
         id: 'database-capacity',
         owner: '${name}-product',
         route: '${name}-on-call',
         runbook: 'docs/runbooks/database-recovery.md',
       }),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
-      dimensions: { DBClusterIdentifier: input.databaseClusterIdentifier },
-      evaluationPeriods: 3,
-      metricName: 'ServerlessDatabaseCapacity',
+${`      evaluationPeriods: 1,
       name: '${name}-' + $app.stage + '-database-capacity',
-      namespace: 'AWS/RDS',
-      period: 300,
-      statistic: 'Maximum',
-      threshold: 3.5,
-      treatMissingData: 'missing',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+      // AWS publishes throttle-event metrics for the table and each index,
+      // unlike ThrottledRequests, which also requires an Operation dimension.
+      metricQueries: [
+        { id: 'total', expression: 'SUM(METRICS())', returnData: true },
+        ...['ReadThrottleEvents', 'WriteThrottleEvents'].flatMap((metricName, kind) =>
+          [undefined, 'PendingEvents'].map((index, scope) => ({
+            id: 'throttle' + kind + scope, returnData: false,
+            metric: { namespace: 'AWS/DynamoDB', metricName, period: 60, stat: 'Sum',
+              dimensions: { TableName: input.databaseTableName,
+                ...(index ? { GlobalSecondaryIndexName: index } : {}) },
+            },
+          })),
+        ),
+      ],
+`}\
     },
   );
   const functionFailure = new aws.cloudwatch.MetricAlarm(
@@ -1358,19 +1369,34 @@ export function create${pascalName}Reliability(
 `,
         'docs/runbooks/reliability-diagnostic.md': `# Reliability diagnostic
 
-The stable-v1 generated adapter supports exactly three approval-free sources:
-alarm state, sanitized SLO metric signals, and bounded ECS or Step Functions
-resource metadata. It executes read-only \`DescribeAlarms\`,
+The Standard Slice database-capacity alarm measures DynamoDB
+ReadThrottleEvents and WriteThrottleEvents for its table and PendingEvents
+index (60-second Sum, threshold 1, one evaluation, missing data notBreaching).
+It does not measure Aurora ACUs, even when a user feature declares SQL.
+During a seeded upgrade, reconcile only this database-capacity registration
+against the generated infrastructure; preserve adopter-owned owners, routes
+and other operational decisions. Then run the reliability verification target
+with --deployed against the actual stage. A registry-only check cannot prove
+that an AWS alarm was updated.
+
+The generated diagnostic adapter is defined for exactly three approval-free
+sources: alarm state, sanitized SLO metric signals, and bounded ECS or Step
+Functions resource metadata, but no supported producer currently exists for
+its inputs. In a generated workspace \`reliability-diagnostic\` therefore fails
+closed before any AWS read; do not cite it as an executed diagnostic. Its
+definition follows. It executes read-only \`DescribeAlarms\`,
 \`GetMetricData\`, \`DescribeServices\`, and \`DescribeExecution\` calls
 against one exact target and immutable deployment binding. Dashboard, generic
 health, cost, and runbook lookups are not claimed as executable diagnostic
 sources. The adapter does not accept arbitrary metric expressions or resource
 scans, read application log contents, or unmask data.
 
-Before an AWS read, the adapter requires a protected GitHub Actions context and
-selects the requested workload only through
-\`.ebk/evidence/reliability/active-bindings.json\`. That protected
-deployed-smoke index must name the current checked-out source commit and exact
+Before an AWS read, the adapter requires a protected GitHub Actions context, a
+\`.ebk/evidence/reliability/active-bindings.json\` index whose authority names
+the \`Deployed smoke\` workflow, and matching
+\`EBK_RELIABILITY_AUTHORIZED_*\` run values. Only the retired Deployed smoke and
+Reliability read workflows produced these; the native Deploy workflow does not.
+That index must name the current checked-out source commit and exact
 repository. The adapter then recomputes the binding from the exact
 deployed-smoke, active protected-release, and release-manifest artifact bytes.
 The binding also carries the environment-reviewed alarm, API, ECS, and Step

package/src/generators/slice/built-in-plan-shared.d.ts

@@ -30,7 +30,9 @@ export declare const PRODUCT_VERSIONS: {
     readonly vitest: "4.1.4";
 };
 export declare const PRODUCT_PACKAGE_MANAGED_JSON_POINTERS: readonly ["/name", "/version", "/private", "/dependencies/@aws-sdk~1client-appconfigdata", "/dependencies/@aws-sdk~1client-cloudwatch", "/dependencies/@aws-sdk~1client-cloudwatch-logs", "/dependencies/@aws-sdk~1client-cost-explorer", "/dependencies/@aws-sdk~1client-cognito-identity-provider", "/dependencies/@aws-sdk~1client-dynamodb", "/dependencies/@aws-sdk~1client-ecs", "/dependencies/@aws-sdk~1client-eventbridge", "/dependencies/@aws-sdk~1client-s3", "/dependencies/@aws-sdk~1client-secrets-manager", "/dependencies/@aws-sdk~1client-sfn", "/dependencies/@aws-sdk~1client-sqs", "/dependencies/@aws-sdk~1rds-signer", "/dependencies/@aws-sdk~1client-ssm", "/dependencies/@aws-sdk~1client-sts", "/dependencies/@empire-builder-kit~1runtime", "/dependencies/drizzle-orm", "/dependencies/next", "/dependencies/pg", "/dependencies/react", "/dependencies/react-dom", "/dependencies/server-only", "/devDependencies/@axe-core~1playwright", "/devDependencies/@playwright~1test", "/devDependencies/@types~1node", "/devDependencies/@types~1pg", "/devDependencies/@types~1react", "/devDependencies/@types~1react-dom", "/devDependencies/drizzle-kit", "/devDependencies/vitest", "/exports/.~1api-client", "/exports/.~1api-contract", "/exports/.~1contracts"];
-export declare const STANDARD_LOCAL_DEV_ADAPTER: (name: string) => {
+export declare function standardPackageManagedJsonPointers(sql: boolean): string[];
+export declare const STANDARD_LOCAL_DEV_ADAPTER: (name: string, dependencySlices?: unknown, sql?: boolean) => {
+    dependencySlices: string[];
     adapterVersion: number;
     auth: {
         callbackPaths: string[];