@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/generators/slice/built-in-plan.d.ts

@@ -1,8 +1,18 @@
 import type { BlueprintManifest } from '../../blueprints/index.js';
+import type { DeploymentProfile } from '../../repository-policy/index.js';
 import { type GeneratedOwnershipRecord } from '../../ownership/index.js';
 export { PRODUCT_PACKAGE_MANAGED_JSON_POINTERS, STANDARD_LOCAL_DEV_ADAPTER, } from './built-in-plan-shared.js';
+export declare function isBuiltInSliceFormatSensitivePath(path: string): boolean;
 export interface BuiltInSlicePlan {
     files: Readonly<Record<string, string>>;
     ownership: GeneratedOwnershipRecord;
 }
-export declare function createBuiltInSlicePlan(name: string, scope: string, runtimeVersion: string, manifest: BlueprintManifest, inputs: Record<string, unknown>, dataPolicyReviewedAt?: string): BuiltInSlicePlan;
+export declare function createBuiltInSlicePlan(name: string, scope: string, runtimeVersion: string, manifest: BlueprintManifest, inputs: Record<string, unknown>, dataPolicyReviewedAt?: string, deploymentProfile?: DeploymentProfile, persistenceSource?: {
+    current?: unknown;
+    compositions?: readonly {
+        kind: string;
+    }[];
+    existingStandardRequirement?: {
+        capabilities: readonly string[];
+    };
+}): BuiltInSlicePlan;

package/src/generators/slice/built-in-plan.js

@@ -1,8 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.STANDARD_LOCAL_DEV_ADAPTER = exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = void 0;
+exports.isBuiltInSliceFormatSensitivePath = isBuiltInSliceFormatSensitivePath;
 exports.createBuiltInSlicePlan = createBuiltInSlicePlan;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const persistence_contract_js_1 = require("./persistence-contract.js");
+const built_in_plan_key_value_files_js_1 = require("./built-in-plan-key-value-files.js");
+const built_in_plan_key_value_infrastructure_js_1 = require("./built-in-plan-key-value-infrastructure.js");
+const built_in_plan_sql_events_js_1 = require("./built-in-plan-sql-events.js");
 const index_js_1 = require("../../ownership/index.js");
 const built_in_plan_api_contract_files_js_1 = require("./built-in-plan-api-contract-files.js");
 const built_in_plan_api_files_js_1 = require("./built-in-plan-api-files.js");
@@ -22,22 +28,32 @@ const built_in_plan_database_retirement_rehearsal_files_js_1 = require("./built-
 const built_in_plan_foundation_files_js_1 = require("./built-in-plan-foundation-files.js");
 const built_in_plan_frontend_files_js_1 = require("./built-in-plan-frontend-files.js");
 const built_in_plan_infrastructure_files_js_1 = require("./built-in-plan-infrastructure-files.js");
-const built_in_plan_infrastructure_safety_files_js_1 = require("./built-in-plan-infrastructure-safety-files.js");
+const built_in_plan_background_work_files_js_1 = require("./built-in-plan-background-work-files.js");
 const built_in_plan_metadata_files_js_1 = require("./built-in-plan-metadata-files.js");
+const built_in_plan_native_runtime_authority_files_js_1 = require("./built-in-plan-native-runtime-authority-files.js");
 const built_in_plan_operations_files_js_1 = require("./built-in-plan-operations-files.js");
 const built_in_plan_performance_files_js_1 = require("./built-in-plan-performance-files.js");
 const built_in_plan_project_files_js_1 = require("./built-in-plan-project-files.js");
 const built_in_plan_reliability_files_js_1 = require("./built-in-plan-reliability-files.js");
-const built_in_plan_release_files_js_1 = require("./built-in-plan-release-files.js");
+const built_in_plan_thin_release_files_js_1 = require("./built-in-plan-thin-release-files.js");
 const built_in_plan_secret_runtime_files_js_1 = require("./built-in-plan-secret-runtime-files.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 const built_in_plan_testing_files_js_1 = require("./built-in-plan-testing-files.js");
 const built_in_plan_verification_files_js_1 = require("./built-in-plan-verification-files.js");
 const built_in_plan_web_files_js_1 = require("./built-in-plan-web-files.js");
-const built_in_plan_workload_role_files_js_1 = require("./built-in-plan-workload-role-files.js");
 var built_in_plan_shared_js_2 = require("./built-in-plan-shared.js");
 Object.defineProperty(exports, "PRODUCT_PACKAGE_MANAGED_JSON_POINTERS", { enumerable: true, get: function () { return built_in_plan_shared_js_2.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS; } });
 Object.defineProperty(exports, "STANDARD_LOCAL_DEV_ADAPTER", { enumerable: true, get: function () { return built_in_plan_shared_js_2.STANDARD_LOCAL_DEV_ADAPTER; } });
+const FORMAT_SENSITIVE_BUILT_IN_PATHS = new Set([
+    'api/generated/baseline.json',
+    'api/generated/contract.json',
+    'api/generated/openapi.json',
+    'web/next-env.d.ts',
+]);
+function isBuiltInSliceFormatSensitivePath(path) {
+    return (path.startsWith('database/migrations/') ||
+        FORMAT_SENSITIVE_BUILT_IN_PATHS.has(path));
+}
 function composeDisjointFileGroups(groups) {
     const files = {};
     for (const [label, groupFiles] of groups) {
@@ -50,35 +66,56 @@ function composeDisjointFileGroups(groups) {
     }
     return files;
 }
-function renderSliceFiles(name, scope, runtimeVersion, ownership, dataPolicyReviewedAt) {
+function renderSliceFiles(name, scope, runtimeVersion, ownership, dataPolicyReviewedAt, deploymentProfile, persistence) {
     const pascalName = name
         .split('-')
         .map((segment) => segment[0]?.toUpperCase() + segment.slice(1))
         .join('');
+    const protectedRuntimeStages = deploymentProfile === 'starter'
+        ? ['development', 'production']
+        : ['staging', 'production'];
+    const sql = ownership.foundation.capabilities.includes('postgres');
     return composeDisjointFileGroups([
+        [
+            'persistence declaration',
+            { 'data/persistence.json': JSON.stringify(persistence, null, 2) + '\n' },
+        ],
+        ['key-value runtime', (0, built_in_plan_key_value_files_js_1.renderKeyValueRuntimeFiles)(name)],
+        [
+            'key-value infrastructure',
+            (0, built_in_plan_key_value_infrastructure_js_1.renderKeyValueInfrastructureFiles)(name, pascalName),
+        ],
+        ['background work', (0, built_in_plan_background_work_files_js_1.renderBackgroundWorkFiles)(deploymentProfile, sql)],
+        ['SQL events', sql ? (0, built_in_plan_sql_events_js_1.renderSqlEventFiles)(name) : {}],
         [
             'Slice metadata',
-            (0, built_in_plan_metadata_files_js_1.renderSliceMetadataFiles)(name, scope, pascalName, ownership),
+            (0, built_in_plan_metadata_files_js_1.renderSliceMetadataFiles)(name, scope, pascalName, ownership, sql),
+        ],
+        [
+            'Foundation wiring',
+            (0, built_in_plan_foundation_files_js_1.renderSliceFoundationFiles)(name, pascalName, ownership.foundation.capabilities),
         ],
-        ['Foundation wiring', (0, built_in_plan_foundation_files_js_1.renderSliceFoundationFiles)(name, pascalName)],
         [
             'project configuration',
             (0, built_in_plan_project_files_js_1.renderSliceProjectFiles)(name, scope, runtimeVersion, ownership),
         ],
         [
             'operations',
-            (0, built_in_plan_operations_files_js_1.renderSliceOperationsFiles)(name, scope.slice(1), runtimeVersion),
+            (0, built_in_plan_operations_files_js_1.renderSliceOperationsFiles)(name, scope.slice(1), runtimeVersion, sql),
         ],
-        ['database lifecycle', (0, built_in_plan_database_lifecycle_files_js_1.renderDatabaseLifecycleFiles)(name)],
+        ['database lifecycle', sql ? (0, built_in_plan_database_lifecycle_files_js_1.renderDatabaseLifecycleFiles)(name) : {}],
         [
             'database retirement rehearsal',
-            (0, built_in_plan_database_retirement_rehearsal_files_js_1.renderDatabaseRetirementRehearsalFiles)(name),
+            sql ? (0, built_in_plan_database_retirement_rehearsal_files_js_1.renderDatabaseRetirementRehearsalFiles)(name) : {},
         ],
         [
-            'workload roles',
-            (0, built_in_plan_workload_role_files_js_1.renderStandardSliceWorkloadRoleFiles)(name, scope.slice(1)),
+            'native runtime authority',
+            (0, built_in_plan_native_runtime_authority_files_js_1.renderStandardSliceNativeRuntimeAuthorityFiles)(name, scope.slice(1), sql),
+        ],
+        [
+            'data contracts',
+            (0, built_in_plan_data_files_js_1.renderProductDataFiles)(name, pascalName, protectedRuntimeStages, sql),
         ],
-        ['data contracts', (0, built_in_plan_data_files_js_1.renderProductDataFiles)(name, pascalName)],
         [
             'data deletion',
             (0, built_in_plan_data_deletion_files_js_1.renderProductDataDeletionFiles)(name, pascalName, scope.slice(1)),
@@ -98,7 +135,10 @@ function renderSliceFiles(name, scope, runtimeVersion, ownership, dataPolicyRevi
             (0, built_in_plan_data_retention_job_files_js_1.renderProductDataRetentionJobFiles)(name, runtimeVersion),
         ],
         ['data retention launcher', (0, built_in_plan_data_retention_launcher_files_js_1.renderProductDataRetentionLauncherFiles)(name)],
-        ['secret runtime', (0, built_in_plan_secret_runtime_files_js_1.renderStandardSliceSecretRuntimeFiles)(name)],
+        [
+            'secret runtime',
+            (0, built_in_plan_secret_runtime_files_js_1.renderStandardSliceSecretRuntimeFiles)(name, scope.slice(1)),
+        ],
         ['async work', (0, built_in_plan_async_work_files_js_1.renderProductAsyncWorkFiles)(name, pascalName)],
         ['API contracts', (0, built_in_plan_api_contract_files_js_1.renderProductApiContractFiles)(name, pascalName)],
         ['authorization', (0, built_in_plan_authorization_files_js_1.renderProductAuthorizationFiles)(name, pascalName)],
@@ -106,32 +146,35 @@ function renderSliceFiles(name, scope, runtimeVersion, ownership, dataPolicyRevi
             'authorization infrastructure',
             (0, built_in_plan_authorization_infrastructure_files_js_1.renderStandardSliceAuthorizationInfrastructureFiles)(name, pascalName),
         ],
-        ['API', (0, built_in_plan_api_files_js_1.renderProductApiFiles)(name, pascalName, scope.slice(1))],
+        ['API', (0, built_in_plan_api_files_js_1.renderProductApiFiles)(name, pascalName, scope.slice(1), sql)],
         [
             'reliability and incident response',
-            (0, built_in_plan_reliability_files_js_1.renderProductReliabilityFiles)(name, pascalName, dataPolicyReviewedAt),
+            (0, built_in_plan_reliability_files_js_1.renderProductReliabilityFiles)(name, pascalName, dataPolicyReviewedAt, sql),
         ],
         [
             'product infrastructure',
-            (0, built_in_plan_infrastructure_files_js_1.renderProductInfrastructureFiles)(name, pascalName, scope.slice(1)),
+            (0, built_in_plan_infrastructure_files_js_1.renderProductInfrastructureFiles)(name, pascalName, scope.slice(1), protectedRuntimeStages, sql, ownership.foundation.capabilities.includes('network')),
+        ],
+        [
+            'performance, capacity, and cost',
+            (0, built_in_plan_performance_files_js_1.renderProductPerformanceFiles)(name, deploymentProfile),
         ],
-        ['infrastructure safety', (0, built_in_plan_infrastructure_safety_files_js_1.renderProductInfrastructureSafetyFiles)(name)],
-        ['performance, capacity, and cost', (0, built_in_plan_performance_files_js_1.renderProductPerformanceFiles)(name)],
         [
             'release and configuration',
-            (0, built_in_plan_release_files_js_1.renderProductReleaseFiles)(name, dataPolicyReviewedAt),
+            (0, built_in_plan_thin_release_files_js_1.renderProductThinReleaseFiles)(name, dataPolicyReviewedAt, deploymentProfile, sql),
         ],
         [
             'frontend contract and evidence',
             (0, built_in_plan_frontend_files_js_1.renderProductFrontendFiles)(name, pascalName),
         ],
-        ['web', (0, built_in_plan_web_files_js_1.renderProductWebFiles)(name, pascalName, scope.slice(1))],
-        ['testing', (0, built_in_plan_testing_files_js_1.renderProductTestingFiles)(name, pascalName)],
+        ['web', (0, built_in_plan_web_files_js_1.renderProductWebFiles)(name, pascalName, scope.slice(1), sql)],
+        ['testing', (0, built_in_plan_testing_files_js_1.renderProductTestingFiles)(name, pascalName, sql)],
         ['verification', (0, built_in_plan_verification_files_js_1.renderProductVerificationFiles)(name, pascalName)],
     ]);
 }
-function classifyPaths(files) {
+function classifyPaths(files, sql) {
     const seededPaths = new Set([
+        'operations/background-work.json',
         'README.md',
         'api/data-retention.ts',
         'async/recovery-adapters.ts',
@@ -151,6 +194,7 @@ function classifyPaths(files) {
         'data/record-correction.ts',
         'data/record-export.ts',
         'data/record-holds.ts',
+        'data/records.ts',
         'data/restore-adapter.ts',
         'docs/reliability/exclusions.md',
         'docs/reliability/slo.json',
@@ -162,7 +206,6 @@ function classifyPaths(files) {
         'jobs/data-retention/README.md',
         'jobs/data-retention/src/adapter.ts',
         'operations/features.json',
-        'operations/infrastructure-change.json',
         'operations/incident-template.json',
         'operations/log-queries.json',
         'operations/logging-components.json',
@@ -198,11 +241,15 @@ function classifyPaths(files) {
         'authorization/machine-authorization-proof.ts',
         'authorization/machine-client-provisioner.py',
         'authorization/runtime.ts',
+        'authorization/record-store.ts',
+        'authorization/groups.mjs',
+        'authorization/groups.d.mts',
         'data/runtime-policy.cts',
         'jobs/data-export-cleanup.ts',
         'jobs/data-retention-maintenance-launcher.ts',
         'testing/quarantine-runtime.mjs',
         'testing/strict-json-reporter.mjs',
+        'testing/local-key-value.ts',
         'e2e/frontend-accessibility.spec.ts',
     ]);
     for (const path of built_in_plan_performance_files_js_1.PRODUCT_PERFORMANCE_SEEDED_PATHS)
@@ -217,7 +264,7 @@ function classifyPaths(files) {
             ? 'seeded'
             : 'managed';
         const managedJsonPointers = path === 'package.json'
-            ? [...built_in_plan_shared_js_1.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS]
+            ? (0, built_in_plan_shared_js_1.standardPackageManagedJsonPointers)(sql)
             : undefined;
         if (managedJsonPointers) {
             (0, index_js_1.assertManagedJsonPointersExist)(contents, managedJsonPointers, `Built-in Standard Blueprint ${path}`);
@@ -232,7 +279,11 @@ function classifyPaths(files) {
     })
         .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path));
 }
-function createBuiltInSlicePlan(name, scope, runtimeVersion, manifest, inputs, dataPolicyReviewedAt = '2026-07-27T00:00:00.000Z') {
+function createBuiltInSlicePlan(name, scope, runtimeVersion, manifest, inputs, dataPolicyReviewedAt = '2026-07-27T00:00:00.000Z', deploymentProfile = 'starter', persistenceSource = {}) {
+    const persistence = (0, persistence_contract_js_1.standardPersistenceContract)({
+        inputs,
+        ...persistenceSource,
+    });
     const provisionalOwnership = {
         blueprint: { name: manifest.name, version: manifest.version },
         compositions: [],
@@ -243,7 +294,7 @@ function createBuiltInSlicePlan(name, scope, runtimeVersion, manifest, inputs, d
                 `${scope}/${name}/contracts`,
             ],
         },
-        foundation: manifest.foundation,
+        foundation: (0, capability_plan_js_1.standardPersistenceRequirement)(inputs, persistenceSource.compositions),
         inputs,
         paths: [],
         projects: [name, `@${name}/job-data-retention`],
@@ -251,13 +302,13 @@ function createBuiltInSlicePlan(name, scope, runtimeVersion, manifest, inputs, d
         slice: name,
         verification: manifest.verification,
     };
-    const provisionalFiles = renderSliceFiles(name, scope, runtimeVersion, provisionalOwnership, dataPolicyReviewedAt);
+    const provisionalFiles = renderSliceFiles(name, scope, runtimeVersion, provisionalOwnership, dataPolicyReviewedAt, deploymentProfile, persistence);
     const ownership = {
         ...provisionalOwnership,
-        paths: classifyPaths(provisionalFiles),
+        paths: classifyPaths(provisionalFiles, provisionalOwnership.foundation.capabilities.includes('postgres')),
     };
     return {
-        files: renderSliceFiles(name, scope, runtimeVersion, ownership, dataPolicyReviewedAt),
+        files: renderSliceFiles(name, scope, runtimeVersion, ownership, dataPolicyReviewedAt, deploymentProfile, persistence),
         ownership,
     };
 }

package/src/generators/slice/data-policy-review-seed.d.ts

@@ -0,0 +1,2 @@
+import type { Tree } from '@nx/devkit';
+export declare function dataPolicyReviewSeed(tree: Tree, root: string): string;

package/src/generators/slice/data-policy-review-seed.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dataPolicyReviewSeed = dataPolicyReviewSeed;
+const node_path_1 = require("node:path");
+function dataPolicyReviewSeed(tree, root) {
+    const path = node_path_1.posix.join(root, 'data/policy.json');
+    const existing = tree.read(path, 'utf8');
+    if (existing !== null) {
+        try {
+            const reviewedAt = JSON.parse(existing).governance?.reviewedAt;
+            if (typeof reviewedAt === 'string' &&
+                new Date(reviewedAt).toISOString() === reviewedAt) {
+                return reviewedAt;
+            }
+        }
+        catch {
+            // The generated ownership/reconciliation path reports malformed policy.
+        }
+    }
+    return new Date().toISOString();
+}
+//# sourceMappingURL=data-policy-review-seed.js.map

package/src/generators/slice/deployed-smoke-readiness.d.ts

@@ -0,0 +1,2 @@
+/** Managed post-deployment prerequisite, not a replacement for browser proof. */
+export declare const deployedSmokeReadinessScript: string;

package/src/generators/slice/deployed-smoke-readiness.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployedSmokeReadinessScript = void 0;
+/** Managed post-deployment prerequisite, not a replacement for browser proof. */
+exports.deployedSmokeReadinessScript = String.raw `import { performance } from 'node:perf_hooks';
+import { setTimeout as delay } from 'node:timers/promises';
+
+const totalLimitMs = 30_000;
+// Only a CloudFront-generated Router fallthrough extends readiness. The pinned
+// SST Router reads routing from an eventually consistent CloudFront
+// KeyValueStore; until a new Slice's route is visible at the serving edge the
+// request reaches the placeholder origin. Every other failure keeps the
+// thirty-second bound above.
+const edgeRouteLimitMs = 300_000;
+const requestLimitMs = 5_000;
+const retryDelayMs = 2_000;
+// Edge hosts within one POP converge on new routing at different times. Admit
+// browser setup only after consecutive healthy rounds, each on a fresh
+// connection, span a sustained window; any fallthrough restarts the window.
+const confirmationWindowMs = 30_000;
+const confirmationDelayMs = 1_000;
+const confirmationLimitMs = confirmationWindowMs + 10_000;
+// Every round sleeps at least the shorter delay, so this cap is reached only
+// by a stalled fixture or clock, never before the time bounds below.
+const roundLimit = Math.ceil((edgeRouteLimitMs + confirmationLimitMs) / Math.min(retryDelayMs, confirmationDelayMs)) + 1;
+const bodyLimitBytes = 4_096;
+const transientStatuses = new Set([502, 503, 504]);
+const transientNetworkCodes = new Set([
+  'EAI_AGAIN', 'ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT',
+  'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_SOCKET',
+]);
+
+function endpoint(value, path) {
+  const url = new URL(value);
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname.replace(/\/$/, '') !== path) {
+    throw new Error('invalid-output');
+  }
+  return url;
+}
+
+function responseCorrelation(response) {
+  const requestId = response.headers.get('x-amz-cf-id');
+  const pop = response.headers.get('x-amz-cf-pop');
+  const cache = /^(Hit|Miss|RefreshHit|Error) from cloudfront$/i.exec(response.headers.get('x-cache') ?? '');
+  return {
+    ...(typeof requestId === 'string' && /^[A-Za-z0-9_+=/-]{20,128}$/.test(requestId) ? { cloudfrontRequestId: requestId } : {}),
+    ...(typeof pop === 'string' && /^[A-Z]{3}[0-9]{1,3}-[A-Z][0-9]{1,3}$/.test(pop) ? { cloudfrontPop: pop } : {}),
+    ...(cache ? { cloudfrontCache: cache[1].toLowerCase() } : {}),
+  };
+}
+
+async function boundedBytes(response) {
+  const reader = response.body?.getReader();
+  if (!reader) throw new Error('invalid-health');
+  const chunks = [];
+  let length = 0;
+  try {
+    for (;;) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      length += chunk.value.byteLength;
+      if (length > bodyLimitBytes) throw new Error('invalid-health');
+      chunks.push(chunk.value);
+    }
+    const bytes = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+    return bytes;
+  } finally {
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+
+async function boundedJson(response) {
+  return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(await boundedBytes(response)));
+}
+
+// The Router answers a request it could not route with CloudFront's own error
+// page. Only that page is classified; origin-returned gateway errors are not.
+async function edgeRouteUnavailable(response) {
+  if (!/^Error from cloudfront$/i.test(response.headers.get('x-cache') ?? '')) return undefined;
+  if (!/^text\/html\b/i.test(response.headers.get('content-type') ?? '')) return undefined;
+  let page;
+  try { page = new TextDecoder('latin1').decode(await boundedBytes(response)); }
+  catch { return undefined; }
+  if (!/<title>\s*ERROR: The request could not be satisfied\s*<\/title>/i.test(page)) return undefined;
+  return { edgeRouting: 'unavailable', originDnsPage: /resolve the origin domain name/i.test(page) };
+}
+
+// Dependency injection is internal fixture support; the generated runner has
+// no environment/CLI override for endpoints, TLS, policy or timing.
+export async function waitForDeployedSmokeReadiness(input, runtime = {}) {
+  const request = runtime.fetch ?? globalThis.fetch;
+  const now = runtime.now ?? (() => performance.now());
+  const sleep = runtime.sleep ?? ((ms, signal) => delay(ms, undefined, { signal }));
+  const started = now();
+  const standardDeadline = started + totalLimitMs;
+  const edgeDeadline = started + edgeRouteLimitMs;
+  const observations = [];
+  let edgePending = false;
+  let edgeObservations = 0;
+  let consecutive = 0;
+  let confirmationDeadline = 0;
+  let firstReadyAt = 0;
+  let firstReadyMs;
+  const elapsed = () => Math.max(0, Math.round(now() - started));
+  const deadline = () => Math.max(
+    edgePending ? edgeDeadline : standardDeadline,
+    consecutive > 0 ? confirmationDeadline : 0,
+  );
+  const failed = (classification, summary) => ({
+    outcome: 'failed', classification, summary, elapsedMs: elapsed(), observations,
+  });
+  let targets;
+  try {
+    if (!/^[a-z][a-z0-9-]*$/.test(input.service) || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(input.sourceCommit) || !['development', 'staging', 'production'].includes(input.stage)) throw new Error('invalid-identity');
+    const api = endpoint(input.apiUrl, '');
+    const web = endpoint(input.webUrl, '/' + input.service);
+    targets = [
+      { name: 'api', url: new URL('/health', api).href, service: input.service },
+      { name: 'web', url: new URL('/' + input.service + '/api/health', web.origin).href, service: input.service + '-web' },
+    ];
+  } catch {
+    return failed('environment-drift', 'Deployed readiness requires exact credential-free HTTPS outputs and service/stage/build identity.');
+  }
+  // The round cap also bounds receipts if a fixture or monotonic clock stalls.
+  for (let round = 0; round < roundLimit && now() < deadline(); round += 1) {
+    if (input.signal?.aborted) return failed('infrastructure-unavailable', 'Deployed readiness was interrupted before smoke setup.');
+    let ready = true;
+    for (const target of targets) {
+      if (input.signal?.aborted) return failed('infrastructure-unavailable', 'Deployed readiness was interrupted before smoke setup.');
+      const remaining = deadline() - now();
+      if (remaining <= 0) { ready = false; break; }
+      const timeout = AbortSignal.timeout(Math.max(1, Math.min(requestLimitMs, Math.ceil(remaining))));
+      const signal = input.signal ? AbortSignal.any([input.signal, timeout]) : timeout;
+      const startedAt = new Date().toISOString();
+      const requestStarted = now();
+      const timing = () => ({ startedAt, durationMs: Math.max(0, Math.round(now() - requestStarted)), elapsedMs: elapsed() });
+      let response;
+      let observation;
+      try {
+        // A fresh connection per request samples more than one edge host.
+        response = await request(target.url, {
+          method: 'GET', redirect: 'manual', credentials: 'omit', cache: 'no-store',
+          headers: { accept: 'application/json', connection: 'close' }, signal,
+        });
+        observation = { endpoint: target.name, status: response.status, ...timing(), ...responseCorrelation(response) };
+        observations.push(observation);
+        if (response.status !== 200) {
+          if (!transientStatuses.has(response.status)) {
+            await response.body?.cancel();
+            return failed('infrastructure-unavailable', 'Deployed ' + target.name + ' readiness refused HTTP ' + response.status + '; verify the native deployment and exact output before retrying.');
+          }
+          const edge = target.name === 'web' && response.status === 502 ? await edgeRouteUnavailable(response) : undefined;
+          if (edge) { Object.assign(observation, edge); edgeObservations += 1; }
+          else await response.body?.cancel().catch(() => {});
+          edgePending = Boolean(edge);
+          consecutive = 0;
+          ready = false;
+          break;
+        }
+        let payload;
+        try { payload = await boundedJson(response); }
+        catch (error) { if (signal.aborted) throw error; return failed('environment-drift', 'Deployed ' + target.name + ' health is malformed or exceeds its bounded contract.'); }
+        const health = target.name === 'api' ? payload?.data : payload;
+        if (!health || health.service !== target.service || health.stage !== input.stage || health.sourceCommit !== input.sourceCommit || health.status !== 'ok') {
+          return failed('environment-drift', 'Deployed ' + target.name + ' health differs from the expected service/stage/build; reconcile source and deployed outputs.');
+        }
+      } catch (error) {
+        if (input.signal?.aborted) return failed('infrastructure-unavailable', 'Deployed readiness was interrupted before smoke setup.');
+        const transient = signal.aborted || transientNetworkCodes.has(error?.cause?.code ?? error?.code);
+        // One row per request: a body failure after headers annotates that row.
+        if (observation) observation.body = signal.aborted ? 'timeout' : 'network-error';
+        else observations.push({ endpoint: target.name, status: signal.aborted ? 'timeout' : 'network-error', ...timing() });
+        if (!transient) return failed('infrastructure-unavailable', 'Deployed readiness transport failed; verify endpoint and certificate configuration before retrying.');
+        edgePending = false;
+        consecutive = 0;
+        ready = false;
+        break;
+      }
+    }
+    if (input.signal?.aborted) return failed('infrastructure-unavailable', 'Deployed readiness was interrupted before smoke setup.');
+    if (ready && now() < deadline()) {
+      edgePending = false;
+      consecutive += 1;
+      if (consecutive === 1) {
+        firstReadyAt = now();
+        firstReadyMs = elapsed();
+        confirmationDeadline = firstReadyAt + confirmationLimitMs;
+      }
+      if (consecutive > 1 && now() - firstReadyAt >= confirmationWindowMs) {
+        return {
+          outcome: 'ready', elapsedMs: elapsed(), observations,
+          confirmation: { windowMs: confirmationWindowMs, rounds: consecutive, firstReadyMs },
+          edgeRouting: { unavailableObservations: edgeObservations, limitMs: edgeRouteLimitMs },
+        };
+      }
+    }
+    const remaining = deadline() - now();
+    if (remaining <= 0) break;
+    try { await sleep(Math.min(consecutive > 0 ? confirmationDelayMs : retryDelayMs, remaining), input.signal); }
+    catch { return failed('infrastructure-unavailable', 'Deployed readiness was interrupted before smoke setup.'); }
+  }
+  if (now() < deadline()) {
+    return failed('infrastructure-unavailable', 'Deployed readiness reached its bounded attempt count before its time bound; inspect the readiness clock and native diagnostics before another governed attempt.');
+  }
+  if (edgePending) {
+    return failed('infrastructure-unavailable', 'The deployed web route was not served by the Router within 300 seconds: CloudFront answered with its own error page because routing fell through to the placeholder origin. Inspect Router KeyValueStore propagation before another governed attempt.');
+  }
+  return failed('infrastructure-unavailable', 'The expected deployed API and web build did not become ready within the 30-second bound for unavailability other than Router edge propagation; inspect native diagnostics before another governed attempt.');
+}
+`;
+//# sourceMappingURL=deployed-smoke-readiness.js.map

package/src/generators/slice/local-source-identity.d.ts

@@ -0,0 +1,2 @@
+/** Local checks may run before the first commit; deployment evidence may not. */
+export declare const localSourceCommitFunction = "function localSourceCommit() {\n  const supplied = process.env.EBK_SOURCE_COMMIT;\n  if (supplied !== undefined) {\n    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(supplied)) {\n      throw new Error('EBK_SOURCE_COMMIT must be a full commit SHA.');\n    }\n    return supplied;\n  }\n  const git = (args) => spawnSync('git', args, {\n    cwd: workspaceRoot,\n    encoding: 'utf8',\n    shell: false,\n    windowsHide: true,\n  });\n  const head = git(['rev-parse', '--verify', 'HEAD^{commit}']);\n  if (!head.error && head.status === 0) return head.stdout.trim();\n  const worktree = git(['rev-parse', '--is-inside-work-tree']);\n  const symbolic = git(['symbolic-ref', '--quiet', 'HEAD']);\n  if (!worktree.error && worktree.status === 0 &&\n      worktree.stdout.trim() === 'true' && !symbolic.error &&\n      symbolic.status === 0 && symbolic.stdout.trim().startsWith('refs/heads/')) {\n    const branch = git(['show-ref', '--verify', '--quiet', symbolic.stdout.trim()]);\n    if (!branch.error && branch.status === 1) return null;\n  }\n  throw new Error('Local source identity requires a readable Git worktree or a full EBK_SOURCE_COMMIT.');\n}";

package/src/generators/slice/local-source-identity.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.localSourceCommitFunction = void 0;
+/** Local checks may run before the first commit; deployment evidence may not. */
+exports.localSourceCommitFunction = `function localSourceCommit() {
+  const supplied = process.env.EBK_SOURCE_COMMIT;
+  if (supplied !== undefined) {
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(supplied)) {
+      throw new Error('EBK_SOURCE_COMMIT must be a full commit SHA.');
+    }
+    return supplied;
+  }
+  const git = (args) => spawnSync('git', args, {
+    cwd: workspaceRoot,
+    encoding: 'utf8',
+    shell: false,
+    windowsHide: true,
+  });
+  const head = git(['rev-parse', '--verify', 'HEAD^{commit}']);
+  if (!head.error && head.status === 0) return head.stdout.trim();
+  const worktree = git(['rev-parse', '--is-inside-work-tree']);
+  const symbolic = git(['symbolic-ref', '--quiet', 'HEAD']);
+  if (!worktree.error && worktree.status === 0 &&
+      worktree.stdout.trim() === 'true' && !symbolic.error &&
+      symbolic.status === 0 && symbolic.stdout.trim().startsWith('refs/heads/')) {
+    const branch = git(['show-ref', '--verify', '--quiet', symbolic.stdout.trim()]);
+    if (!branch.error && branch.status === 1) return null;
+  }
+  throw new Error('Local source identity requires a readable Git worktree or a full EBK_SOURCE_COMMIT.');
+}`;
+//# sourceMappingURL=local-source-identity.js.map

package/src/generators/slice/persistence-contract.d.ts

@@ -0,0 +1,14 @@
+export declare const STANDARD_PERSISTENCE_PATH = "data/persistence.json";
+export interface StandardPersistenceContract {
+    kind: 'ebk-standard-persistence';
+    schemaVersion: 1;
+    defaultStore: 'dynamodb';
+}
+/** The framework core is DynamoDB. SQL is additive, never an alternate core. */
+export declare function standardPersistenceContract(options: {
+    inputs: Record<string, unknown>;
+    current?: unknown;
+    existingStandardRequirement?: {
+        capabilities: readonly string[];
+    };
+}): StandardPersistenceContract;

package/src/generators/slice/persistence-contract.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STANDARD_PERSISTENCE_PATH = void 0;
+exports.standardPersistenceContract = standardPersistenceContract;
+const validation_js_1 = require("../../validation.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+exports.STANDARD_PERSISTENCE_PATH = 'data/persistence.json';
+/** The framework core is DynamoDB. SQL is additive, never an alternate core. */
+function standardPersistenceContract(options) {
+    (0, capability_plan_js_1.readStandardSqlDeclaration)(options.inputs);
+    if (options.current !== undefined) {
+        const current = options.current;
+        if (!(0, validation_js_1.isRecord)(current) ||
+            current.kind !== 'ebk-standard-persistence' ||
+            current.schemaVersion !== 1 ||
+            (current.defaultStore !== 'dynamodb' &&
+                current.defaultStore !== 'postgres') ||
+            Object.keys(current).some((key) => !['kind', 'schemaVersion', 'defaultStore'].includes(key)))
+            throw new Error('Standard persistence declaration is invalid; no store may be inferred or reassigned.');
+        if (current.defaultStore === 'postgres')
+            throw new Error('This prerelease Standard Slice uses a PostgreSQL-backed framework core. Automatic upgrade is unsupported. Preserve its data and infrastructure, then complete an explicit repository-owned migration or rebuild before adopting the DynamoDB core. No files have been changed.');
+    }
+    else if (options.existingStandardRequirement) {
+        throw new Error('Existing Standard Slice is missing its persisted storage declaration. Automatic prerelease conversion is unsupported; preserve its data and infrastructure and complete an explicit repository-owned migration or rebuild. No files have been changed.');
+    }
+    return {
+        kind: 'ebk-standard-persistence',
+        schemaVersion: 1,
+        defaultStore: 'dynamodb',
+    };
+}
+//# sourceMappingURL=persistence-contract.js.map