@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/generators/slice/built-in-plan-testing-persistence-files.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderTestingPersistenceFiles = renderTestingPersistenceFiles;
+/** Disposable integration resources are independent of fleet or deployed data. */
+function renderTestingPersistenceFiles(name, pascalName, sql) {
+    const labels = `    labels:
+      dev.empirebuilderkit.owner: test-integration
+      dev.empirebuilderkit.run: \${EBK_TEST_RUN_ID}
+      dev.empirebuilderkit.slice: ${name}`;
+    return {
+        'database/test-compose.yml': `services:
+  key-value:
+    image: amazon/dynamodb-local@sha256:ff89bd48ff32cd8d9be5fee8873b65b8854dc408f1afe881be6eb00247bc0dab
+    command: [-jar, DynamoDBLocal.jar, -inMemory, -sharedDb]
+${labels}
+    ports:
+      - '127.0.0.1::8000'
+${sql
+            ? `  database:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD: ebk_test
+      POSTGRES_USER: ebk_test
+    healthcheck:
+      test: [CMD-SHELL, "pg_isready -U ebk_test -d postgres"]
+      interval: 1s
+      timeout: 3s
+      retries: 30
+${labels}
+    ports:
+      - '127.0.0.1::5432'
+    tmpfs:
+      - /var/lib/postgresql/data
+`
+            : ''}`,
+        'testing/local-key-value.ts': `import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import { createDynamoPersistence } from '@empire-builder-kit/runtime/key-value';
+
+const endpoint = new URL(process.env.EBK_TEST_DYNAMODB_ENDPOINT ?? 'http://invalid');
+const tableName = process.env.EBK_TEST_DYNAMODB_TABLE;
+if (endpoint.protocol !== 'http:' || endpoint.hostname !== '127.0.0.1' ||
+    !endpoint.port || endpoint.username || endpoint.password || endpoint.search ||
+    endpoint.hash || endpoint.pathname !== '/' ||
+    !tableName || !/^ebk-test-${name}-[a-z0-9]{1,32}-a[12]-w[0-7]$/.test(tableName)) {
+  throw new Error('Integration requires the runner-owned loopback DynamoDB endpoint and worker table.');
+}
+export const localKeyValueClient = new DynamoDBClient({
+  endpoint: endpoint.href, region: 'us-east-1', maxAttempts: 1,
+  credentials: { accessKeyId: 'LOCALFIXTURE', secretAccessKey: 'local-fixture-not-an-aws-credential' },
+});
+export const localKeyValueTable = tableName;
+export function localKeyValueStore(stage = 'development') {
+  return createDynamoPersistence({ client: localKeyValueClient, tableName: localKeyValueTable,
+    stage, slice: '${name}', eventBusName: 'local-integration-events' });
+}
+`,
+        'integration/record.spec.ts': `import { ScanCommand } from '@aws-sdk/client-dynamodb';
+import { afterAll, describe, expect, it, vi } from 'vitest';
+import { build${pascalName}RecordFixture } from '../testing/fixtures/records.js';
+import { localKeyValueClient, localKeyValueStore, localKeyValueTable } from '../testing/local-key-value.js';
+import { getOwnedRecord, mutateRecord, type RecordMutationInput } from '../data/records.js';
+
+vi.mock('../data/key-value.js', async () => {
+  const { localKeyValueStore } = await import('../testing/local-key-value.js');
+  const store = localKeyValueStore();
+  return { dataStore: () => store };
+});
+const seed = process.env.EBK_TEST_SEED;
+if (!seed) throw new Error('EBK_TEST_SEED is required for reproducible integration fixtures.');
+afterAll(() => localKeyValueClient.destroy());
+
+describe('${name} DynamoDB integration', () => {
+  it('atomically creates a subject-owned record and durable event intent', async () => {
+    const fixture = build${pascalName}RecordFixture(seed);
+    const input: RecordMutationInput = { correlationId: fixture.id, name: fixture.name, recordId: fixture.id, now: new Date().toISOString(),
+      runScope: seed, principal: { kind: 'member', actor: { id: 'synthetic-owner', type: 'user' },
+        subject: { id: 'synthetic-owner', type: 'user' },
+        authority: { mode: 'direct' } } };
+    const created = await mutateRecord(input, true);
+    expect(created).toMatchObject({ created: true, propagation: 'pending' });
+    await expect(getOwnedRecord(fixture.id, 'synthetic-owner')).resolves.toMatchObject(fixture);
+    await expect(getOwnedRecord(fixture.id, 'different-owner')).resolves.toBeNull();
+    await expect(localKeyValueStore('production').get('application', 'records', fixture.id)).resolves.toBeNull();
+    const rows = await localKeyValueClient.send(new ScanCommand({ TableName: localKeyValueTable, ConsistentRead: true }));
+    expect(rows.LastEvaluatedKey).toBeUndefined();
+    expect(rows.Items?.filter((row) => row.kind?.S === 'outbox')).toHaveLength(1);
+    await expect(mutateRecord(input, true)).resolves.toEqual(created);
+    const repeated = await localKeyValueClient.send(new ScanCommand({ TableName: localKeyValueTable, ConsistentRead: true }));
+    expect(repeated.Items?.filter((row) => row.kind?.S === 'outbox')).toHaveLength(1);
+  });
+});
+`,
+        'integration/performance-load-cleanup.spec.ts': `import { afterAll, describe, expect, it } from 'vitest';
+import type { ProtectedLoadRequestAuthorizationV1 } from '@empire-builder-kit/runtime/performance';
+import { createPerformancePersistence } from '../performance/persistence.js';
+import { localKeyValueClient, localKeyValueStore } from '../testing/local-key-value.js';
+
+afterAll(() => localKeyValueClient.destroy());
+const at = Date.parse('2026-09-12T12:00:00.000Z');
+function authorization(plan: string): ProtectedLoadRequestAuthorizationV1 {
+  return { adapterId: 'ebk-dynamodb-async-v1', configuredMaximum: 40,
+    createdAt: new Date(at).toISOString(), durationSeconds: 60, effectId: 'e'.repeat(64),
+    expiresAt: new Date(at + 3_600_000).toISOString(), hmacKeyId: 'integration-fixture', maximumRequests: 10,
+    operation: 'execute', planMaterialDigest: plan, release: { candidateDigest: 'b'.repeat(64),
+      releaseId: 'local-integration', releaseMaterialDigest: 'c'.repeat(64), sourceCommit: 'd'.repeat(40) },
+    requestOrdinal: 1, runId: 'run-' + plan.slice(0, 4),
+    saturationSignalRef: 'dynamodb:protected-run-unprocessed-effects-percent', scenarioId: 'async-key-value-burst',
+    stage: 'development', target: { accountFingerprint: 'sha256:' + 'f'.repeat(64),
+      endpoint: 'https://fixture.example.test/${name}/__ebk/performance/async-worker', region: 'us-east-1', slice: '${name}' },
+    workload: 'async-worker' };
+}
+const cleanup = (auth: ProtectedLoadRequestAuthorizationV1): ProtectedLoadRequestAuthorizationV1 =>
+  ({ ...auth, operation: 'cleanup', effectId: null });
+
+describe('${name} DynamoDB performance cleanup', () => {
+  it('processes an idempotent effect and tombstones cleanup against late writes', async () => {
+    const persistence = createPerformancePersistence(localKeyValueStore(), () => at);
+    const auth = authorization('1'.repeat(64));
+    await persistence.reserve(auth);
+    await expect(persistence.reserve(auth)).rejects.toThrow('replayed');
+    await expect(persistence.execute(auth.adapterId as 'ebk-dynamodb-async-v1', auth.effectId!, auth)).resolves.toEqual({ effectState: 'created' });
+    await expect(persistence.execute('ebk-dynamodb-async-v1', auth.effectId!, auth)).resolves.toEqual({ effectState: 'already-existed' });
+    await expect(persistence.processAsync()).resolves.toMatchObject({ processed: 1 });
+    await expect(persistence.cleanup(cleanup(auth))).resolves.toEqual({ removedEffectCount: 1, remainingEffectCount: 0 });
+    await expect(persistence.cleanup(cleanup(auth))).resolves.toEqual({ removedEffectCount: 0, remainingEffectCount: 0 });
+    await expect(persistence.execute('ebk-dynamodb-async-v1', auth.effectId!, auth)).rejects.toThrow('collision');
+  });
+
+  it('recovers interruption between reservation and effect without touching another stage', async () => {
+    const store = localKeyValueStore();
+    const auth = authorization('2'.repeat(64));
+    await createPerformancePersistence(store, () => at).reserve(auth);
+    const restarted = createPerformancePersistence(localKeyValueStore(), () => at);
+    await expect(restarted.cleanup(cleanup(auth))).resolves.toEqual({ removedEffectCount: 0, remainingEffectCount: 0 });
+    await expect(restarted.reserve(auth)).rejects.toThrow('collision');
+    await expect(localKeyValueStore('production').get('system', 'performance-runs', auth.planMaterialDigest)).resolves.toBeNull();
+  });
+
+  it('retains durable deadline telemetry until acknowledgement, independently of TTL deletion', async () => {
+    let clock = at;
+    const persistence = createPerformancePersistence(localKeyValueStore(), () => clock);
+    const auth = authorization('3'.repeat(64));
+    await persistence.reserve(auth);
+    await persistence.execute('ebk-dynamodb-async-v1', auth.effectId!, auth);
+    clock += 49 * 60 * 60 * 1_000;
+    await expect(persistence.expire()).resolves.toMatchObject({ removedEffects: 1, completeScan: true });
+    await expect(persistence.reportDeadlines(async () => { throw new Error('metric-transport'); })).rejects.toThrow('metric-transport');
+    const metrics: number[] = [];
+    await expect(persistence.reportDeadlines(async value => { metrics.push(value); })).resolves.toMatchObject({ reported: 1 });
+    expect(metrics).toEqual([1]);
+    await expect(persistence.reportDeadlines(async () => {})).resolves.toMatchObject({ reported: 0 });
+  });
+});
+`,
+        ...(sql
+            ? {
+                'integration/migrations.spec.ts': `import { Client } from 'pg';
+import { describe, expect, it } from 'vitest';
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) throw new Error('DATABASE_URL is required for declared SQL integration proof.');
+describe('${name} optional SQL migrations', () => {
+  it('applies committed migrations to an isolated worker database without creating a SQL framework core', async () => {
+    const client = new Client({ connectionString: databaseUrl });
+    await client.connect();
+    try {
+      const result = await client.query("SELECT to_regclass('public.data_lifecycle_outbox')::text AS intents");
+      expect(result.rows).toEqual([{ intents: 'data_lifecycle_outbox' }]);
+    } finally { await client.end(); }
+  });
+});
+`,
+            }
+            : {}),
+    };
+}
+//# sourceMappingURL=built-in-plan-testing-persistence-files.js.map

package/src/generators/slice/built-in-plan-thin-release-files.d.ts

@@ -8,4 +8,4 @@ import type { DeploymentProfile } from '../../repository-policy/index.js';
  */
 export declare const RETIRED_PREVIEW_RELEASE_PATHS: readonly ["scripts/release-lifecycle.mjs", "scripts/release-manifest.mjs", "scripts/release-rollout-proof.mjs", "scripts/release-rollout.mjs"];
 /** @internal */
-export declare function renderProductThinReleaseFiles(name: string, configurationSeed: string, deploymentProfile: DeploymentProfile): Readonly<Record<string, string>>;
+export declare function renderProductThinReleaseFiles(name: string, configurationSeed: string, deploymentProfile: DeploymentProfile, sql?: boolean): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-thin-release-files.js

@@ -55,6 +55,11 @@ successful CI run for the deployed commit and assumes the stage deployment
 role through GitHub OIDC. The native SST deployment receipt is post-operation
 evidence; a provider preview is advisory and is never release authority.
 
+For Next.js, release material excludes only the compiler-cache directory directly
+under the declared .next output. Emitted application files and every referenced
+runtime trace dependency remain inventoried with the same content and size checks.
+Do not delete caches or increase evidence bounds to repair a release build.
+
 Active stages for this deployment profile are: ${stages}. Configuration
 declarations are typed and value-free. Evidence records provider identities and
 digests, never secret or flag values. Flags cannot grant authorization.
@@ -66,9 +71,9 @@ smoke evidence for each accepted protected deployment.
 `;
 }
 /** @internal */
-function renderProductThinReleaseFiles(name, configurationSeed, deploymentProfile) {
+function renderProductThinReleaseFiles(name, configurationSeed, deploymentProfile, sql = false) {
     const files = {
-        ...(0, built_in_plan_release_files_js_1.renderProductReleaseFiles)(name, configurationSeed),
+        ...(0, built_in_plan_release_files_js_1.renderProductReleaseFiles)(name, configurationSeed, sql),
     };
     for (const path of exports.RETIRED_PREVIEW_RELEASE_PATHS)
         delete files[path];
@@ -106,6 +111,34 @@ function renderProductThinReleaseFiles(name, configurationSeed, deploymentProfil
     if (!Array.isArray(controls.artifactInventory)) {
         throw new Error('Generated release artifact inventory is absent.');
     }
+    // These handlers are native SST artifacts, not a second, nonexistent OCI image.
+    // SQL added later retains its own migration/retirement images without moving
+    // the original DynamoDB records or maintenance into the database.
+    controls.artifactInventory = controls.artifactInventory.filter((artifact) => artifact.id !== `${name}.job.data-retention` &&
+        (sql ||
+            ![
+                `${name}.job.database-migration`,
+                `${name}.job.database-retirement`,
+            ].includes(String(artifact.id))));
+    const lambda = controls.artifactInventory.find((artifact) => artifact.id === `${name}.lambda`);
+    const candidate = lambda?.candidate;
+    if (!candidate?.materialPaths ||
+        !candidate.sourceInputPaths ||
+        !candidate.recipePaths)
+        throw new Error('Native retention requires the exact Lambda artifact inventory.');
+    const nativeInputs = [
+        'authorization',
+        'data',
+        'secrets',
+        'jobs/data-retention/src',
+    ].map((path) => `packages/${name}/${path}`);
+    candidate.materialPaths = [
+        ...new Set([...candidate.materialPaths, ...nativeInputs]),
+    ];
+    candidate.sourceInputPaths = [
+        ...new Set([...candidate.sourceInputPaths, ...nativeInputs]),
+    ];
+    candidate.recipePaths.push(`packages/${name}/jobs/data-retention/package.json`);
     controls.artifactInventory = controls.artifactInventory.map((artifact) => artifact.classification === 'stage-specific'
         ? {
             ...artifact,

package/src/generators/slice/built-in-plan-verification-files.js

@@ -13,6 +13,7 @@ export default defineConfig({
       ...configDefaults.exclude,
       '**/dist/**',
       'e2e/**',
+      'local-e2e/**',
       'integration/**',
     ],
   },
@@ -348,6 +349,75 @@ test('proves the deployed product, auth, database, and event journey', async ({
   await expect(signOutResponse.json()).resolves.toEqual({ ok: true });
   expect((await page.request.get(protectedUrl)).status()).toBe(401);
 });
+`,
+        'scripts/verify-local-browser.mjs': `import { resolve } from 'node:path';
+import { runLocalBrowserVerification } from '@empire-builder-kit/nx/local-dev';
+await runLocalBrowserVerification({ workspaceRoot: resolve(import.meta.dirname, '../../..'), slice: '${name}' });
+`,
+        'playwright.local.config.ts': `import { defineConfig } from '@playwright/test';
+import { resolve } from 'node:path';
+import { localBrowserLaunchArguments, resolveLocalBrowserTarget } from '@empire-builder-kit/nx/local-dev';
+const target = await resolveLocalBrowserTarget({ workspaceRoot: resolve(import.meta.dirname, '../..'), slice: '${name}' });
+export default defineConfig({
+  forbidOnly: true,
+  retries: 0,
+  workers: 1,
+  testDir: './local-e2e',
+  outputDir: './.ebk/evidence/local-browser-artifacts',
+  projects: [{ name: 'local-chromium', use: {
+    browserName: 'chromium',
+    ignoreHTTPSErrors: false,
+    serviceWorkers: 'block',
+    launchOptions: { args: localBrowserLaunchArguments(target) },
+  } }],
+});
+`,
+        'local-e2e/fixture.ts': `import { test as base, expect } from '@playwright/test';
+import { resolve } from 'node:path';
+import { localBrowserRequestAllowed, resolveLocalBrowserTarget } from '@empire-builder-kit/nx/local-dev';
+export const target = await resolveLocalBrowserTarget({ workspaceRoot: resolve(import.meta.dirname, '../../..'), slice: '${name}' });
+export const test = base.extend({
+  page: async ({ context }, use) => {
+    const page = await context.newPage();
+    const session = await context.newCDPSession(page);
+    // CDP checks every redirect hop. No process-wide certificate bypass is used.
+    session.on('Fetch.requestPaused', async ({ requestId, request }) => {
+      await session.send(localBrowserRequestAllowed(target.origin, request.url) ? 'Fetch.continueRequest' : 'Fetch.failRequest', {
+        requestId,
+        ...(!localBrowserRequestAllowed(target.origin, request.url) ? { errorReason: 'BlockedByClient' } : {}),
+      }).catch(() => undefined);
+    });
+    await session.send('Fetch.enable', { patterns: [{ urlPattern: '*' }] });
+    await context.route('**/*', async (route) => {
+      let ownedPage = false;
+      try { ownedPage = route.request().frame().page() === page; } catch { /* Workers are outside this bounded proof. */ }
+      if (ownedPage && localBrowserRequestAllowed(target.origin, route.request().url())) await route.continue();
+      else await route.abort('blockedbyclient');
+    });
+    await context.routeWebSocket('**/*', (socket) => {
+      if (localBrowserRequestAllowed(target.origin, socket.url(), true)) socket.connectToServer();
+      else socket.close();
+    });
+    try { await use(page); } finally { await page.close(); await session.detach().catch(() => undefined); }
+  },
+});
+export { expect };
+`,
+        'local-e2e/product.spec.ts': `import { expect, target, test } from './fixture';
+test('proves the ready task-local web health', async ({ page }) => {
+  const response = await page.goto(new URL(target.healthPath, target.origin).href);
+  expect(response?.status()).toBe(200);
+  expect(response?.headers()['x-ebk-upstream']).toBe('local');
+  expect(response?.headers()['x-ebk-consumer-stage']).toBe(target.stage);
+  expect(await response?.json()).toMatchObject({ service: '${name}-web', stage: target.stage, status: 'ok' });
+});
+test('renders the Slice through its exact task HTTPS origin', async ({ page }) => {
+  const response = await page.goto(new URL(target.routePrefix, target.origin).href);
+  expect(response?.status()).toBe(200);
+  expect(response?.headers()['x-ebk-upstream']).toBe('local');
+  expect(new URL(page.url()).origin).toBe(target.origin);
+  await expect(page.getByRole('heading', { name: '${pascalName}', exact: true })).toBeVisible();
+});
 `,
         'playwright.config.ts': `import { defineConfig } from '@playwright/test';
 export default defineConfig({

package/src/generators/slice/built-in-plan-web-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderProductWebFiles(name: string, pascalName: string, workspace: string): Readonly<Record<string, string>>;
+export declare function renderProductWebFiles(name: string, pascalName: string, workspace: string, sql?: boolean): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-web-files.js

@@ -2,17 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductWebFiles = renderProductWebFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const sst_environment_source_format_js_1 = require("../../sst-environment-source-format.js");
 /** @internal */
-function renderProductWebFiles(name, pascalName, workspace) {
+function renderProductWebFiles(name, pascalName, workspace, sql = false) {
     return {
-        'web/next-env.d.ts': `/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-import "./.next/types/routes.d.ts";
-import "./.next/types/root-params.d.ts";
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
-`,
+        'web/next-env.d.ts': (0, sst_environment_source_format_js_1.generatedNextEnvironmentSource)(),
         'web/tsconfig.json': (0, built_in_plan_shared_js_1.json)({
             extends: '../tsconfig.json',
             compilerOptions: {
@@ -54,8 +48,37 @@ function exactBuildId(): string {
 
 const config: NextConfig = {
   ...(fleetOrigin ? { allowedDevOrigins: [new URL(fleetOrigin).hostname] } : {}),
+  // Generated Node ESM modules retain their .js/.cjs runtime specifiers;
+  // Webpack resolves those to the TypeScript source during Next dev/build.
+  experimental: { extensionAlias: { '.js': ['.ts', '.js'], '.cjs': ['.cts', '.cjs'] } },
   basePath: '/${name}',
   generateBuildId: async () => exactBuildId(),
+  async rewrites() {
+    if (!fleetOrigin || process.env.NODE_ENV !== 'development') return [];
+    const stage = process.env.EBK_STAGE;
+    if (!/^personal-[a-f0-9]{24}$/.test(stage ?? '') ||
+        process.env.EBK_CONSUMER_STAGE !== stage) {
+      throw new Error('Fleet Function routing requires the owned task stage. Restart with ebk dev up ${name}.');
+    }
+    // SST injects this Slice's API URL into its owned Next child. This is the
+    // current task API, not the optional deployed-development HTTP fallback.
+    const rawApiUrl = process.env.NEXT_PUBLIC_API_URL?.trim();
+    let apiUrl: URL;
+    try { apiUrl = new URL(rawApiUrl ?? ''); }
+    catch { throw new Error('Fleet Function routing requires the SST task API URL. Restart with ebk dev up ${name}.'); }
+    if (apiUrl.protocol !== 'https:' || apiUrl.username || apiUrl.password ||
+        apiUrl.port || apiUrl.pathname !== '/' || apiUrl.search || apiUrl.hash ||
+        !/^[a-z0-9]+\\.execute-api\\.[a-z0-9-]+\\.amazonaws\\.com(?:\\.cn)?$/.test(apiUrl.hostname)) {
+      throw new Error('Fleet Function routing requires the SST task API origin, without credentials or a path. Restart with ebk dev up ${name}.');
+    }
+    return {
+      beforeFiles: [{
+        source: '/${name}/api/functions/:function',
+        destination: apiUrl.origin + '/functions/:function',
+        basePath: false,
+      }],
+    };
+  },
   reactStrictMode: true,
 };
 
@@ -109,12 +132,12 @@ export function proxy(request: NextRequest): NextResponse {
 `,
         'web/src/lib/server-logging.ts': `import 'server-only';
 import { createLogger, type Logger } from '@empire-builder-kit/runtime/logging';
-import { createNextServerContext } from '@empire-builder-kit/runtime/request-context';
+import { createNextServerContext, type RequestContext } from '@empire-builder-kit/runtime/request-context';
 import { recordReliabilityOperation } from '../../../reliability/metrics';
 
 export interface ObserveNextOperationOptions {
   feature: string;
-  handle(logger: Logger): Promise<Response> | Response;
+  handle(logger: Logger, context: RequestContext): Promise<Response> | Response;
   operation: string;
   request?: Request;
 }
@@ -168,7 +191,7 @@ export async function observeNextOperation({
   };
   logger.info('${name} Next.js operation received');
   try {
-    const response = await handle(logger);
+    const response = await handle(logger, context);
     recordOutcome(response.status < 400 ? 'success' : 'failure');
     logger.info('${name} Next.js operation completed', {
       attributes: { httpStatus: response.status },
@@ -188,7 +211,7 @@ export async function observeNextOperation({
         'web/open-next.config.ts': `const config = {
   // OpenNext runs from this web directory. Point it at the slice package so it
   // builds only this application instead of recursively invoking the Nx root.
-  buildCommand: 'pnpm exec next build web',
+  buildCommand: 'pnpm exec next build --webpack web',
   default: {},
   packageJsonPath: '../package.json',
 };
@@ -225,7 +248,7 @@ export default async function Layout({ children }: Readonly<{ children: ReactNod
     <p>Empire Builder Kit Product Slice</p>
     <h1>${pascalName}</h1>
     <div className="card">
-      <p>The web app, Lambda API, logical Postgres database, Cognito client,
+      <p>The web app, Lambda API, DynamoDB persistence${sql ? ', declared PostgreSQL database' : ''}, Cognito client,
       event buffer/DLQ, dashboard, and alarms are wired and owned here.</p>
       <a href="/${name}/sign-in">Sign in</a>
     </div>
@@ -442,6 +465,160 @@ export async function GET(request: Request) {
     },
   });
 }
+`,
+        'web/src/lib/fleet-records.ts': `import 'server-only';
+import { getSessionTokenCookieNames } from '@empire-builder-kit/runtime/auth-session';
+import { extractBearerToken } from '@empire-builder-kit/runtime/auth-backend';
+import { ApiContractError } from '@empire-builder-kit/runtime/api-contract';
+import { createErrorResponse, createSuccessResponse, RuntimeError } from '@empire-builder-kit/runtime/response';
+import type { Logger } from '@empire-builder-kit/runtime/logging';
+import type { RequestContext } from '@empire-builder-kit/runtime/request-context';
+import { cookies } from 'next/headers';
+import { ${(0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName)}GetRecord, ${(0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName)}PutRecord } from '../../../api/contracts/protected';
+import { authorize${pascalName}FleetRecordOperation } from '../../../authorization/runtime';
+import { putRecordWithLifecycle } from '../../../data/record-correction';
+import { getOwnedRecord } from '../../../data/records';
+
+type RecordMethod = 'GET' | 'PUT';
+const noStore = { 'cache-control': 'no-store' };
+
+function fleetOrigin(request: Request): URL | null {
+  if (process.env.NODE_ENV !== 'development') return null;
+  const stage = process.env.EBK_STAGE;
+  if (!/^personal-[a-f0-9]{24}$/.test(stage ?? '') ||
+      process.env.EBK_CONSUMER_STAGE !== stage ||
+      process.env.EBK_SECURE_COOKIES !== 'true') return null;
+  try {
+    const raw = process.env.EBK_FLEET_ORIGIN ?? '';
+    const origin = new URL(raw);
+    const target = new URL(request.url);
+    const localPort = process.env.EBK_DEV_PORT ?? '';
+    const parsedLocalPort = Number(localPort);
+    if (origin.protocol !== 'https:' || origin.origin !== raw ||
+        origin.username || origin.password || origin.pathname !== '/' || origin.search || origin.hash ||
+        !(origin.hostname.endsWith('.ebk.localhost') || origin.hostname.endsWith('.test')) ||
+        !Number.isSafeInteger(parsedLocalPort) || parsedLocalPort < 1 || parsedLocalPort > 65535 ||
+        String(parsedLocalPort) !== localPort ||
+        target.protocol !== 'https:' ||
+        (target.hostname !== 'localhost' && target.hostname !== '127.0.0.1') ||
+        target.port !== localPort ||
+        target.username || target.password ||
+        request.headers.get('host') !== origin.host ||
+        request.headers.get('x-forwarded-host') !== origin.host ||
+        request.headers.get('x-forwarded-proto') !== 'https' ||
+        request.headers.get('x-forwarded-port') !== (origin.port || '443') ||
+        request.headers.get('x-forwarded-for') !== '127.0.0.1') return null;
+    const suppliedOrigin = request.headers.get('origin');
+    if (suppliedOrigin !== null && suppliedOrigin !== origin.origin) return null;
+    return origin;
+  } catch {
+    return null;
+  }
+}
+
+async function boundedBody(request: Request, maxBytes: number): Promise<unknown> {
+  if (request.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase() !== 'application/json')
+    throw new RuntimeError({ code: 'invalid_request', message: 'JSON request body is required.', status: 400 });
+  const reader = request.body?.getReader();
+  if (!reader) throw new RuntimeError({ code: 'invalid_request', message: 'JSON request body is required.', status: 400 });
+  const chunks: Uint8Array[] = [];
+  let length = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      length += value.byteLength;
+      if (length > maxBytes) throw new RuntimeError({ code: 'invalid_request', message: 'Request body is too large.', status: 400 });
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  try {
+    return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+  } catch {
+    throw new RuntimeError({ code: 'invalid_request', message: 'JSON request body is invalid.', status: 400 });
+  }
+}
+
+async function accessToken(request: Request): Promise<{ token: string | null; cookie: boolean }> {
+  if (request.headers.has('authorization'))
+    return { token: extractBearerToken(request.headers.get('authorization') ?? undefined), cookie: false };
+  const store = await cookies();
+  const names = getSessionTokenCookieNames({ namespace: '${name}', secure: true });
+  return { token: store.get(names.access)?.value ?? null, cookie: true };
+}
+
+/** Only the owned task's Next server exposes a native record path. */
+export async function handleFleetRecord(request: Request, recordId: string, method: RecordMethod,
+  logger: Logger, context: RequestContext): Promise<Response> {
+  const origin = fleetOrigin(request);
+  if (!origin || request.method !== method)
+    return Response.json(createErrorResponse(new RuntimeError({ code: 'record_not_found',
+      message: 'The record route is unavailable.', status: 404 })), { status: 404, headers: noStore });
+  try {
+    const auth = await accessToken(request);
+    // Cookie-backed writes require the browser's exact same-origin proof.
+    if (method === 'PUT' && auth.cookie && request.headers.get('origin') !== origin.origin)
+      throw new RuntimeError({ code: 'authorization_denied', message: 'Same-origin authorization is required.', status: 403 });
+    if (method === 'PUT') {
+      const operation = ${(0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName)}PutRecord;
+      const path = operation.request.path.parse({ recordId }, 'request.path');
+      const body = operation.request.body.parse(
+        await boundedBody(request, operation.request.maxBodyBytes ?? 512), 'request.body');
+      const principal = await authorize${pascalName}FleetRecordOperation({
+        accessToken: auth.token, context, logger, operation, request: { path, body },
+      });
+      const value = await putRecordWithLifecycle({ correlationId: context.correlationId, principal,
+        recordId: path.recordId, name: body.name, runScope: body.runScope,
+        testExpiresAt: body.testExpiresAt });
+      const projected = operation.response.body.project({
+        id: value.id, name: value.name, runScope: value.runScope,
+      }, 'response.data');
+      return Response.json(createSuccessResponse(projected, { status: operation.response.status }),
+        { status: operation.response.status, headers: noStore });
+    }
+    const operation = ${(0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName)}GetRecord;
+    if (request.body !== null)
+      throw new RuntimeError({ code: 'invalid_request', message: 'GET does not accept a body.', status: 400 });
+    const path = operation.request.path.parse({ recordId }, 'request.path');
+    const principal = await authorize${pascalName}FleetRecordOperation({
+      accessToken: auth.token, context, logger, operation, request: { path },
+    });
+    const record = await getOwnedRecord(path.recordId, principal.actor.id);
+    if (!record) throw new RuntimeError({ code: 'record_not_found',
+      message: 'The record was not found.', status: 404 });
+    const projected = operation.response.body.project({
+      id: record.id, name: record.name, runScope: record.runScope,
+    }, 'response.data');
+    return Response.json(createSuccessResponse(projected, { status: operation.response.status }),
+      { status: operation.response.status, headers: noStore });
+  } catch (error) {
+    const normalized = error instanceof ApiContractError &&
+        error.classification === 'api-schema-validation-failed'
+      ? new RuntimeError({ code: 'invalid_request',
+          message: 'The request does not satisfy the record contract.', status: 400 })
+      : error;
+    const response = createErrorResponse(normalized);
+    return Response.json(response, { status: response.status, headers: noStore });
+  }
+}
+`,
+        'web/src/app/api/records/[recordId]/route.ts': `import 'server-only';
+import { observeNextOperation } from '../../../../lib/server-logging';
+import { handleFleetRecord } from '../../../../lib/fleet-records';
+
+type RecordRouteContext = { params: Promise<{ recordId: string }> };
+
+export async function GET(request: Request, route: RecordRouteContext) {
+  return observeNextOperation({ feature: 'database', operation: 'get-record', request,
+    handle: async (logger, context) => handleFleetRecord(request, (await route.params).recordId, 'GET', logger, context) });
+}
+
+export async function PUT(request: Request, route: RecordRouteContext) {
+  return observeNextOperation({ feature: 'database', operation: 'put-record', request,
+    handle: async (logger, context) => handleFleetRecord(request, (await route.params).recordId, 'PUT', logger, context) });
+}
 `,
         'web/src/app/page.spec.tsx': `import { renderToStaticMarkup } from 'react-dom/server';
 import { describe, expect, it } from 'vitest';

package/src/generators/slice/built-in-plan-workload-role-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderStandardSliceWorkloadRoleFiles(name: string, workspace: string): Readonly<Record<string, string>>;
+export declare function renderStandardSliceWorkloadRoleFiles(name: string, workspace: string, sql?: boolean): Readonly<Record<string, string>>;