@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (791) hide show
  1. package/README.md +18 -0
  2. package/executors.json +21 -1
  3. package/generators.json +10 -0
  4. package/package.json +31 -7
  5. package/src/aws/child-environment.d.ts +10 -0
  6. package/src/aws/child-environment.js +77 -0
  7. package/src/aws/identity.d.ts +13 -0
  8. package/src/aws/identity.js +41 -0
  9. package/src/aws-authority/index.d.ts +2 -0
  10. package/src/aws-authority/index.js +6 -0
  11. package/src/aws-authority/lambda-policy-ordering.d.ts +38 -0
  12. package/src/aws-authority/lambda-policy-ordering.js +56 -0
  13. package/src/aws-authority/stage-authority.d.ts +248 -0
  14. package/src/aws-authority/stage-authority.js +3558 -0
  15. package/src/blueprints/external-sandbox.js +21 -9
  16. package/src/blueprints/manifest.d.ts +1 -1
  17. package/src/blueprints/resolver.js +28 -15
  18. package/src/cli/bootstrap.d.ts +1 -1
  19. package/src/cli/deploy-runtime.d.ts +6 -0
  20. package/src/cli/deploy-runtime.js +58 -0
  21. package/src/cli/dev-command.d.ts +16 -4
  22. package/src/cli/dev-command.js +63 -0
  23. package/src/cli/main.d.ts +9 -1
  24. package/src/cli/main.js +139 -20
  25. package/src/cli/output.d.ts +1 -1
  26. package/src/cli/output.js +1 -1
  27. package/src/developer-agent/context.js +41 -9
  28. package/src/developer-agent/generator-planning.js +20 -6
  29. package/src/developer-agent/git-inspection.d.ts +6 -2
  30. package/src/developer-agent/git-inspection.js +78 -6
  31. package/src/developer-agent/model.d.ts +5 -3
  32. package/src/developer-agent/model.js +4 -4
  33. package/src/developer-agent/operation-registry.d.ts +5 -0
  34. package/src/developer-agent/operation-registry.js +286 -40
  35. package/src/developer-agent/planning.js +16 -13
  36. package/src/developer-agent/preview-changes.d.ts +2 -0
  37. package/src/developer-agent/preview-changes.js +14 -2
  38. package/src/developer-agent/preview-source.js +3 -0
  39. package/src/developer-agent/validation.js +25 -9
  40. package/src/developer-agent/workspace-inspection.js +60 -5
  41. package/src/executors/blueprint-trust/blueprint-trust.js +6 -0
  42. package/src/executors/deployment-plan/deployment-plan.d.ts +2 -0
  43. package/src/executors/deployment-plan/deployment-plan.js +57 -2
  44. package/src/executors/dev-doctor/dev-doctor.js +13 -6
  45. package/src/executors/dev-task-cleanup/dev-task-cleanup.d.ts +23 -0
  46. package/src/executors/dev-task-cleanup/dev-task-cleanup.js +145 -0
  47. package/src/executors/dev-task-cleanup/schema.json +9 -0
  48. package/src/executors/dev-task-cleanup/task-stack-absence.d.ts +27 -0
  49. package/src/executors/dev-task-cleanup/task-stack-absence.js +281 -0
  50. package/src/executors/dev-task-cleanup/task-stack-checkpoint.d.ts +12 -0
  51. package/src/executors/dev-task-cleanup/task-stack-checkpoint.js +92 -0
  52. package/src/executors/fleet/fleet.js +1 -1
  53. package/src/executors/foundation-preflight/foundation-preflight.d.ts +1 -0
  54. package/src/executors/foundation-preflight/foundation-preflight.js +6 -2
  55. package/src/executors/foundation-preflight/schema.json +5 -0
  56. package/src/executors/foundation-profile-preflight/foundation-profile-preflight.d.ts +13 -2
  57. package/src/executors/foundation-profile-preflight/foundation-profile-preflight.js +95 -31
  58. package/src/executors/foundation-profile-preflight/production-database-safeguard.d.ts +65 -0
  59. package/src/executors/foundation-profile-preflight/production-database-safeguard.js +223 -0
  60. package/src/executors/foundation-profile-preflight/schema.json +15 -4
  61. package/src/executors/foundation-remove-preflight/foundation-remove-preflight.d.ts +11 -1
  62. package/src/executors/foundation-remove-preflight/foundation-remove-preflight.js +70 -20
  63. package/src/executors/foundation-remove-preflight/schema.json +6 -1
  64. package/src/executors/github-bootstrap/github-bootstrap.d.ts +1 -0
  65. package/src/executors/github-bootstrap/github-bootstrap.js +3 -0
  66. package/src/executors/github-bootstrap/schema.json +7 -1
  67. package/src/executors/infrastructure-plan/infrastructure-plan.d.ts +29 -136
  68. package/src/executors/infrastructure-plan/infrastructure-plan.js +230 -3282
  69. package/src/executors/infrastructure-plan/schema.json +12 -52
  70. package/src/executors/local-deploy/federated-credential-transport.d.ts +48 -0
  71. package/src/executors/local-deploy/federated-credential-transport.js +252 -0
  72. package/src/executors/local-deploy/local-approval.d.ts +18 -0
  73. package/src/executors/local-deploy/local-approval.js +39 -0
  74. package/src/executors/local-deploy/local-deploy.d.ts +112 -0
  75. package/src/executors/local-deploy/local-deploy.js +1404 -0
  76. package/src/executors/local-deploy/schema.json +70 -0
  77. package/src/executors/refresh/refresh.js +2 -2
  78. package/src/executors/remove/remove.js +2 -2
  79. package/src/executors/router-waf-rehearsal/router-waf-rehearsal.d.ts +42 -0
  80. package/src/executors/router-waf-rehearsal/router-waf-rehearsal.js +1229 -0
  81. package/src/executors/router-waf-rehearsal/schema.json +29 -0
  82. package/src/executors/secret-initialize/schema.json +42 -0
  83. package/src/executors/secret-initialize/secret-initialize.d.ts +34 -0
  84. package/src/executors/secret-initialize/secret-initialize.js +297 -0
  85. package/src/executors/secret-metadata/schema.json +5 -0
  86. package/src/executors/secret-metadata/secret-metadata.d.ts +16 -2
  87. package/src/executors/secret-metadata/secret-metadata.js +129 -30
  88. package/src/executors/sst-lifecycle/generated-secret-retirement.d.ts +53 -0
  89. package/src/executors/sst-lifecycle/generated-secret-retirement.js +192 -0
  90. package/src/executors/sst-lifecycle/governed-native-operation.d.ts +48 -0
  91. package/src/executors/sst-lifecycle/governed-native-operation.js +162 -0
  92. package/src/executors/sst-lifecycle/logging-preflight.d.ts +5 -0
  93. package/src/executors/sst-lifecycle/logging-preflight.js +23 -13
  94. package/src/executors/sst-lifecycle/run-sst-command.d.ts +40 -6
  95. package/src/executors/sst-lifecycle/run-sst-command.js +779 -70
  96. package/src/executors/sst-lifecycle/schema.json +8 -1
  97. package/src/executors/sst-lifecycle/secret-preflight.d.ts +2 -0
  98. package/src/executors/sst-lifecycle/secret-preflight.js +13 -7
  99. package/src/executors/sst-lifecycle/sst-environment-source.d.ts +33 -0
  100. package/src/executors/sst-lifecycle/sst-environment-source.js +267 -0
  101. package/src/executors/sst-lifecycle/task-unlock.d.ts +15 -0
  102. package/src/executors/sst-lifecycle/task-unlock.js +126 -0
  103. package/src/executors/unlock/unlock.js +2 -2
  104. package/src/foundation/capability-plan.d.ts +43 -0
  105. package/src/foundation/capability-plan.js +168 -0
  106. package/src/foundation/discovery.d.ts +14 -11
  107. package/src/foundation/discovery.js +32 -6
  108. package/src/foundation/index.d.ts +4 -0
  109. package/src/foundation/index.js +11 -0
  110. package/src/foundation/local-database-contract.d.ts +20 -0
  111. package/src/foundation/local-database-contract.js +262 -13
  112. package/src/foundation/local-private-smoke-access.d.ts +20 -0
  113. package/src/foundation/local-private-smoke-access.js +197 -0
  114. package/src/foundation/logging-preflight.js +1 -1
  115. package/src/foundation/logging.d.ts +3 -1
  116. package/src/foundation/logging.js +1 -1
  117. package/src/foundation/partial-state.d.ts +10 -0
  118. package/src/foundation/partial-state.js +21 -0
  119. package/src/foundation/preflight.js +37 -18
  120. package/src/foundation/private-smoke-access.d.ts +25 -0
  121. package/src/foundation/private-smoke-access.js +135 -0
  122. package/src/foundation/private-smoke-admission.d.ts +45 -0
  123. package/src/foundation/private-smoke-admission.js +180 -0
  124. package/src/foundation/private-smoke-control-plane.d.ts +18 -0
  125. package/src/foundation/private-smoke-control-plane.js +184 -0
  126. package/src/foundation/provision-database-bindings.d.ts +5 -0
  127. package/src/foundation/provision-database-bindings.js +41 -8
  128. package/src/foundation/provision-logical-database.js +15 -8
  129. package/src/foundation/requirements.d.ts +3 -3
  130. package/src/foundation/requirements.js +24 -12
  131. package/src/foundation/router-waf-rate-rehearsal.d.ts +97 -0
  132. package/src/foundation/router-waf-rate-rehearsal.js +210 -0
  133. package/src/foundation/router-waf.d.ts +149 -0
  134. package/src/foundation/router-waf.js +809 -0
  135. package/src/foundation/stages.d.ts +1 -0
  136. package/src/foundation/stages.js +11 -0
  137. package/src/generators/blueprint/blueprint.d.ts +5 -0
  138. package/src/generators/blueprint/blueprint.js +102 -0
  139. package/src/generators/blueprint/files.d.ts +6 -0
  140. package/src/generators/blueprint/files.js +217 -0
  141. package/src/generators/blueprint/schema.d.ts +4 -0
  142. package/src/generators/blueprint/schema.json +18 -0
  143. package/src/generators/formatting.d.ts +8 -0
  144. package/src/generators/formatting.js +141 -0
  145. package/src/generators/function/function.js +38 -17
  146. package/src/generators/logging-registry.d.ts +2 -0
  147. package/src/generators/logging-registry.js +22 -0
  148. package/src/generators/post-generation-install.js +2 -2
  149. package/src/generators/preset/dependency-overrides.d.ts +8 -0
  150. package/src/generators/preset/dependency-overrides.js +55 -0
  151. package/src/generators/preset/generator.js +43 -3
  152. package/src/generators/preset/schema.d.ts +10 -0
  153. package/src/generators/preset/schema.json +47 -0
  154. package/src/generators/preset/tool-versions.d.ts +2 -0
  155. package/src/generators/preset/tool-versions.js +3 -1
  156. package/src/generators/preset/workspace-files-adopter-skills.d.ts +7 -0
  157. package/src/generators/preset/workspace-files-adopter-skills.js +303 -0
  158. package/src/generators/preset/workspace-files-ci-acceptance.d.ts +1 -0
  159. package/src/generators/preset/workspace-files-ci-acceptance.js +791 -0
  160. package/src/generators/preset/workspace-files-ci-install.d.ts +2 -0
  161. package/src/generators/preset/workspace-files-ci-install.js +196 -0
  162. package/src/generators/preset/workspace-files-developer-agent.d.ts +2 -0
  163. package/src/generators/preset/workspace-files-developer-agent.js +90 -28
  164. package/src/generators/preset/workspace-files-ecr-inspector.d.ts +18 -0
  165. package/src/generators/preset/workspace-files-ecr-inspector.js +298 -0
  166. package/src/generators/preset/workspace-files-foundation-workload-roles.js +5 -2
  167. package/src/generators/preset/workspace-files-performance-cost.d.ts +2 -2
  168. package/src/generators/preset/workspace-files-performance-cost.js +8 -8
  169. package/src/generators/preset/workspace-files-performance-load.d.ts +1 -1
  170. package/src/generators/preset/workspace-files-performance-load.js +39 -25
  171. package/src/generators/preset/workspace-files-stage-authority.d.ts +6 -0
  172. package/src/generators/preset/workspace-files-stage-authority.js +518 -0
  173. package/src/generators/preset/workspace-files-thin-deploy.d.ts +55 -0
  174. package/src/generators/preset/workspace-files-thin-deploy.js +2473 -0
  175. package/src/generators/preset/workspace-files-thin-docs.d.ts +7 -0
  176. package/src/generators/preset/workspace-files-thin-docs.js +352 -0
  177. package/src/generators/preset/workspace-files-thin-release.d.ts +14 -0
  178. package/src/generators/preset/workspace-files-thin-release.js +26 -0
  179. package/src/generators/preset/workspace-files-workload-role-baseline.js +254 -42
  180. package/src/generators/preset/workspace-files.d.ts +18 -2
  181. package/src/generators/preset/workspace-files.js +1504 -608
  182. package/src/generators/repository-policy/repository-policy.js +235 -5
  183. package/src/generators/repository-policy/schema.d.ts +10 -0
  184. package/src/generators/repository-policy/schema.json +80 -4
  185. package/src/generators/repository-policy/tree-policy.d.ts +3 -0
  186. package/src/generators/repository-policy/tree-policy.js +25 -0
  187. package/src/generators/slice/built-in-plan-api-contract-files.js +42 -7
  188. package/src/generators/slice/built-in-plan-api-files.d.ts +1 -1
  189. package/src/generators/slice/built-in-plan-api-files.js +130 -414
  190. package/src/generators/slice/built-in-plan-async-work-files.js +166 -1969
  191. package/src/generators/slice/built-in-plan-authorization-files.js +92 -329
  192. package/src/generators/slice/built-in-plan-authorization-infrastructure-files.js +60 -2
  193. package/src/generators/slice/built-in-plan-authorization-storage.d.ts +3 -0
  194. package/src/generators/slice/built-in-plan-authorization-storage.js +119 -0
  195. package/src/generators/slice/built-in-plan-background-work-files.d.ts +2 -0
  196. package/src/generators/slice/built-in-plan-background-work-files.js +99 -0
  197. package/src/generators/slice/built-in-plan-data-deletion-files.js +2 -830
  198. package/src/generators/slice/built-in-plan-data-export-infrastructure-files.js +5 -31
  199. package/src/generators/slice/built-in-plan-data-files.d.ts +1 -1
  200. package/src/generators/slice/built-in-plan-data-files.js +163 -1196
  201. package/src/generators/slice/built-in-plan-data-lifecycle-files.js +53 -28
  202. package/src/generators/slice/built-in-plan-data-lifecycle-runtime-files.js +37 -2
  203. package/src/generators/slice/built-in-plan-data-retention-job-files.js +7 -2443
  204. package/src/generators/slice/built-in-plan-data-retention-launcher-files.js +50 -8
  205. package/src/generators/slice/built-in-plan-data-rights-files.js +6 -4482
  206. package/src/generators/slice/built-in-plan-database-lifecycle-files.js +44 -25
  207. package/src/generators/slice/built-in-plan-database-retirement-rehearsal-files.js +20 -1
  208. package/src/generators/slice/built-in-plan-foundation-files.d.ts +2 -1
  209. package/src/generators/slice/built-in-plan-foundation-files.js +39 -18
  210. package/src/generators/slice/built-in-plan-frontend-files.js +7 -3
  211. package/src/generators/slice/built-in-plan-infrastructure-files.d.ts +1 -1
  212. package/src/generators/slice/built-in-plan-infrastructure-files.js +933 -729
  213. package/src/generators/slice/built-in-plan-infrastructure-safety-files.js +67 -11
  214. package/src/generators/slice/built-in-plan-key-value-cleanup.d.ts +4 -0
  215. package/src/generators/slice/built-in-plan-key-value-cleanup.js +100 -0
  216. package/src/generators/slice/built-in-plan-key-value-consumer.d.ts +4 -0
  217. package/src/generators/slice/built-in-plan-key-value-consumer.js +151 -0
  218. package/src/generators/slice/built-in-plan-key-value-deletion.d.ts +2 -0
  219. package/src/generators/slice/built-in-plan-key-value-deletion.js +377 -0
  220. package/src/generators/slice/built-in-plan-key-value-delivery.d.ts +2 -0
  221. package/src/generators/slice/built-in-plan-key-value-delivery.js +137 -0
  222. package/src/generators/slice/built-in-plan-key-value-export.d.ts +2 -0
  223. package/src/generators/slice/built-in-plan-key-value-export.js +595 -0
  224. package/src/generators/slice/built-in-plan-key-value-files.d.ts +2 -0
  225. package/src/generators/slice/built-in-plan-key-value-files.js +31 -0
  226. package/src/generators/slice/built-in-plan-key-value-holds.d.ts +2 -0
  227. package/src/generators/slice/built-in-plan-key-value-holds.js +189 -0
  228. package/src/generators/slice/built-in-plan-key-value-infrastructure.d.ts +2 -0
  229. package/src/generators/slice/built-in-plan-key-value-infrastructure.js +102 -0
  230. package/src/generators/slice/built-in-plan-key-value-performance.d.ts +5 -0
  231. package/src/generators/slice/built-in-plan-key-value-performance.js +530 -0
  232. package/src/generators/slice/built-in-plan-key-value-provider.d.ts +4 -0
  233. package/src/generators/slice/built-in-plan-key-value-provider.js +366 -0
  234. package/src/generators/slice/built-in-plan-key-value-records.d.ts +3 -0
  235. package/src/generators/slice/built-in-plan-key-value-records.js +232 -0
  236. package/src/generators/slice/built-in-plan-key-value-retention-infrastructure.d.ts +2 -0
  237. package/src/generators/slice/built-in-plan-key-value-retention-infrastructure.js +103 -0
  238. package/src/generators/slice/built-in-plan-key-value-retention-job-files.d.ts +2 -0
  239. package/src/generators/slice/built-in-plan-key-value-retention-job-files.js +160 -0
  240. package/src/generators/slice/built-in-plan-key-value-retention-maintenance.d.ts +2 -0
  241. package/src/generators/slice/built-in-plan-key-value-retention-maintenance.js +329 -0
  242. package/src/generators/slice/built-in-plan-key-value-retention-worker.d.ts +2 -0
  243. package/src/generators/slice/built-in-plan-key-value-retention-worker.js +477 -0
  244. package/src/generators/slice/built-in-plan-key-value-retention.d.ts +2 -0
  245. package/src/generators/slice/built-in-plan-key-value-retention.js +184 -0
  246. package/src/generators/slice/built-in-plan-metadata-files.d.ts +1 -1
  247. package/src/generators/slice/built-in-plan-metadata-files.js +157 -28
  248. package/src/generators/slice/built-in-plan-native-runtime-authority-files.d.ts +2 -0
  249. package/src/generators/slice/built-in-plan-native-runtime-authority-files.js +324 -0
  250. package/src/generators/slice/built-in-plan-operations-files.d.ts +1 -1
  251. package/src/generators/slice/built-in-plan-operations-files.js +585 -97
  252. package/src/generators/slice/built-in-plan-performance-files.d.ts +2 -1
  253. package/src/generators/slice/built-in-plan-performance-files.js +220 -1074
  254. package/src/generators/slice/built-in-plan-project-files.js +141 -135
  255. package/src/generators/slice/built-in-plan-release-files.d.ts +1 -1
  256. package/src/generators/slice/built-in-plan-release-files.js +310 -70
  257. package/src/generators/slice/built-in-plan-reliability-files.d.ts +1 -1
  258. package/src/generators/slice/built-in-plan-reliability-files.js +279 -43
  259. package/src/generators/slice/built-in-plan-secret-runtime-files.d.ts +1 -1
  260. package/src/generators/slice/built-in-plan-secret-runtime-files.js +87 -76
  261. package/src/generators/slice/built-in-plan-shared.d.ts +4 -2
  262. package/src/generators/slice/built-in-plan-shared.js +41 -19
  263. package/src/generators/slice/built-in-plan-sql-events.d.ts +2 -0
  264. package/src/generators/slice/built-in-plan-sql-events.js +276 -0
  265. package/src/generators/slice/built-in-plan-testing-files.d.ts +1 -1
  266. package/src/generators/slice/built-in-plan-testing-files.js +304 -172
  267. package/src/generators/slice/built-in-plan-testing-persistence-files.d.ts +2 -0
  268. package/src/generators/slice/built-in-plan-testing-persistence-files.js +178 -0
  269. package/src/generators/slice/built-in-plan-thin-release-files.d.ts +11 -0
  270. package/src/generators/slice/built-in-plan-thin-release-files.js +162 -0
  271. package/src/generators/slice/built-in-plan-verification-files.js +76 -2
  272. package/src/generators/slice/built-in-plan-web-files.d.ts +1 -1
  273. package/src/generators/slice/built-in-plan-web-files.js +223 -16
  274. package/src/generators/slice/built-in-plan-workload-role-files.d.ts +1 -1
  275. package/src/generators/slice/built-in-plan-workload-role-files.js +143 -279
  276. package/src/generators/slice/built-in-plan.d.ts +11 -1
  277. package/src/generators/slice/built-in-plan.js +80 -29
  278. package/src/generators/slice/data-policy-review-seed.d.ts +2 -0
  279. package/src/generators/slice/data-policy-review-seed.js +22 -0
  280. package/src/generators/slice/deployed-smoke-readiness.d.ts +2 -0
  281. package/src/generators/slice/deployed-smoke-readiness.js +214 -0
  282. package/src/generators/slice/local-source-identity.d.ts +2 -0
  283. package/src/generators/slice/local-source-identity.js +31 -0
  284. package/src/generators/slice/persistence-contract.d.ts +14 -0
  285. package/src/generators/slice/persistence-contract.js +32 -0
  286. package/src/generators/slice/slice.js +61 -50
  287. package/src/generators/sql/schema.d.ts +7 -0
  288. package/src/generators/sql/schema.json +38 -0
  289. package/src/generators/sql/sql.d.ts +6 -0
  290. package/src/generators/sql/sql.js +53 -0
  291. package/src/generators/upgrade/sql-seeded-reconciliation.d.ts +2 -0
  292. package/src/generators/upgrade/sql-seeded-reconciliation.js +170 -0
  293. package/src/generators/upgrade/upgrade.d.ts +15 -1
  294. package/src/generators/upgrade/upgrade.js +435 -44
  295. package/src/generators/workload/performance-registration.d.ts +1 -0
  296. package/src/generators/workload/performance-registration.js +9 -11
  297. package/src/generators/workload/service-performance-files.d.ts +1 -0
  298. package/src/generators/workload/service-performance-files.js +27 -7
  299. package/src/generators/workload/workload.d.ts +1 -1
  300. package/src/generators/workload/workload.js +105 -29
  301. package/src/git-policy/action-pins.d.ts +5 -0
  302. package/src/git-policy/action-pins.js +5 -0
  303. package/src/git-policy/github-bootstrap.d.ts +39 -8
  304. package/src/git-policy/github-bootstrap.js +329 -175
  305. package/src/git-policy/routing.d.ts +7 -1
  306. package/src/git-policy/routing.js +62 -1
  307. package/src/index.d.ts +1 -0
  308. package/src/index.js +1 -0
  309. package/src/infrastructure-change/local-capability.d.ts +73 -0
  310. package/src/infrastructure-change/local-capability.js +114 -0
  311. package/src/infrastructure-change/model.d.ts +25 -4
  312. package/src/infrastructure-change/model.js +1 -0
  313. package/src/infrastructure-change/normalize.d.ts +4 -0
  314. package/src/infrastructure-change/normalize.js +47 -7
  315. package/src/infrastructure-change/plan.d.ts +30 -3
  316. package/src/infrastructure-change/plan.js +323 -13
  317. package/src/infrastructure-change/risk.d.ts +3 -1
  318. package/src/infrastructure-change/risk.js +96 -16
  319. package/src/local-dev/browser-verification.d.ts +37 -0
  320. package/src/local-dev/browser-verification.js +281 -0
  321. package/src/local-dev/contracts.d.ts +10 -1
  322. package/src/local-dev/contracts.js +114 -13
  323. package/src/local-dev/dev-command-core.js +24 -5
  324. package/src/local-dev/docker-credential-health.d.ts +14 -0
  325. package/src/local-dev/docker-credential-health.js +94 -0
  326. package/src/local-dev/environment-inspector.d.ts +7 -0
  327. package/src/local-dev/environment-inspector.js +42 -15
  328. package/src/local-dev/environment-state.js +2 -2
  329. package/src/local-dev/errors.d.ts +1 -1
  330. package/src/local-dev/errors.js +2 -0
  331. package/src/local-dev/fleet-client.js +2 -2
  332. package/src/local-dev/fleet-configuration.js +57 -25
  333. package/src/local-dev/fleet-inventory.js +46 -18
  334. package/src/local-dev/fleet-ipc.d.ts +7 -0
  335. package/src/local-dev/fleet-ipc.js +14 -2
  336. package/src/local-dev/fleet-launcher.d.ts +6 -0
  337. package/src/local-dev/fleet-launcher.js +14 -2
  338. package/src/local-dev/fleet-logs.js +50 -22
  339. package/src/local-dev/fleet-process.d.ts +20 -1
  340. package/src/local-dev/fleet-process.js +197 -41
  341. package/src/local-dev/fleet-runner-evidence.d.ts +5 -0
  342. package/src/local-dev/fleet-runner-evidence.js +56 -0
  343. package/src/local-dev/fleet-runtime.js +268 -229
  344. package/src/local-dev/fleet-session.d.ts +2 -0
  345. package/src/local-dev/fleet-session.js +28 -11
  346. package/src/local-dev/fleet-slice-runner-daemon.js +4 -0
  347. package/src/local-dev/fleet-state.d.ts +5 -2
  348. package/src/local-dev/fleet-state.js +25 -4
  349. package/src/local-dev/fleet-supervisor.d.ts +3 -0
  350. package/src/local-dev/fleet-supervisor.js +66 -11
  351. package/src/local-dev/fleet-web-start.d.ts +12 -0
  352. package/src/local-dev/fleet-web-start.js +48 -0
  353. package/src/local-dev/identity.js +3 -14
  354. package/src/local-dev/index.d.ts +1 -0
  355. package/src/local-dev/index.js +1 -0
  356. package/src/local-dev/native-completion.d.ts +9 -0
  357. package/src/local-dev/native-completion.js +130 -0
  358. package/src/local-dev/nx-workspace.d.ts +4 -2
  359. package/src/local-dev/nx-workspace.js +11 -6
  360. package/src/local-dev/personal-stage.d.ts +4 -5
  361. package/src/local-dev/personal-stage.js +6 -54
  362. package/src/local-dev/port-claims.d.ts +13 -0
  363. package/src/local-dev/port-claims.js +46 -0
  364. package/src/local-dev/ports.d.ts +14 -2
  365. package/src/local-dev/ports.js +78 -3
  366. package/src/local-dev/private-state.d.ts +11 -0
  367. package/src/local-dev/private-state.js +146 -40
  368. package/src/local-dev/process-group.d.ts +4 -0
  369. package/src/local-dev/process-group.js +29 -0
  370. package/src/local-dev/process-identity.d.ts +8 -0
  371. package/src/local-dev/process-identity.js +31 -1
  372. package/src/local-dev/proxy.js +11 -12
  373. package/src/local-dev/runtime-paths.js +1 -1
  374. package/src/local-dev/slice-claim.js +1 -1
  375. package/src/local-dev/slice-runner.d.ts +15 -6
  376. package/src/local-dev/slice-runner.js +189 -54
  377. package/src/local-dev/task-attachment.d.ts +17 -0
  378. package/src/local-dev/task-attachment.js +73 -0
  379. package/src/local-dev/task-authority.d.ts +10 -0
  380. package/src/local-dev/task-authority.js +27 -0
  381. package/src/local-dev/task-identity.d.ts +33 -0
  382. package/src/local-dev/task-identity.js +418 -0
  383. package/src/local-dev/task-native-writer.d.ts +18 -0
  384. package/src/local-dev/task-native-writer.js +329 -0
  385. package/src/local-dev/tls.js +8 -2
  386. package/src/local-dev/web-launch.d.ts +9 -0
  387. package/src/local-dev/web-launch.js +130 -0
  388. package/src/ownership/composition.d.ts +2 -1
  389. package/src/ownership/composition.js +1 -0
  390. package/src/performance/cost-collection.d.ts +1 -1
  391. package/src/performance/cost-collection.js +4 -2
  392. package/src/performance/cost-controls.d.ts +8 -4
  393. package/src/performance/cost-controls.js +39 -28
  394. package/src/performance/evidence.d.ts +1 -1
  395. package/src/performance/evidence.js +5 -3
  396. package/src/performance/load-safety.js +5 -3
  397. package/src/performance/model.d.ts +4 -4
  398. package/src/performance/model.js +4 -5
  399. package/src/performance/scenario.d.ts +22 -0
  400. package/src/performance/scenario.js +100 -92
  401. package/src/release/index.d.ts +0 -2
  402. package/src/release/index.js +0 -2
  403. package/src/release/source-authority.d.ts +5 -5
  404. package/src/release/source-authority.js +141 -124
  405. package/src/repository-policy/aurora-preflight.d.ts +1 -1
  406. package/src/repository-policy/aurora-preflight.js +4 -1
  407. package/src/repository-policy/capacity-migration.d.ts +3 -0
  408. package/src/repository-policy/capacity-migration.js +21 -0
  409. package/src/repository-policy/deployment-plan.d.ts +4 -1
  410. package/src/repository-policy/deployment-plan.js +9 -0
  411. package/src/repository-policy/foundation-profile.js +10 -1
  412. package/src/repository-policy/policy.d.ts +57 -3
  413. package/src/repository-policy/policy.js +497 -11
  414. package/src/schemas/blueprint-v1.json +5 -4
  415. package/src/schemas/foundation-requirement-v1.json +5 -4
  416. package/src/schemas/performance-policy-v1.json +3 -3
  417. package/src/schemas/repository-policy-v1.json +130 -6
  418. package/src/schemas/testing-evidence-result-v1.json +1 -1
  419. package/src/secrets/adapters.d.ts +7 -2
  420. package/src/secrets/adapters.js +34 -3
  421. package/src/secrets/aws-control-plane.d.ts +10 -1
  422. package/src/secrets/aws-control-plane.js +67 -0
  423. package/src/secrets/generated-aws-control-plane.d.ts +23 -0
  424. package/src/secrets/generated-aws-control-plane.js +259 -0
  425. package/src/secrets/metadata.js +38 -10
  426. package/src/secrets/model.d.ts +8 -1
  427. package/src/secrets/model.js +24 -3
  428. package/src/secrets/operator.d.ts +91 -3
  429. package/src/secrets/operator.js +463 -13
  430. package/src/secrets/registry.d.ts +2 -1
  431. package/src/secrets/registry.js +18 -1
  432. package/src/secrets/verification.js +9 -1
  433. package/src/secrets/workload-access.js +10 -2
  434. package/src/sst-environment-source-format.d.ts +6 -0
  435. package/src/sst-environment-source-format.js +199 -0
  436. package/src/supply-chain/action-pins.js +61 -7
  437. package/src/supply-chain/blueprint-trust-git.js +85 -24
  438. package/src/supply-chain/blueprint-verification-authority.js +55 -3
  439. package/src/supply-chain/build-output-bounds.d.ts +2 -0
  440. package/src/supply-chain/build-output-bounds.js +12 -0
  441. package/src/supply-chain/build-output.d.ts +7 -1
  442. package/src/supply-chain/build-output.js +177 -24
  443. package/src/supply-chain/ecr-scanning.d.ts +5 -3
  444. package/src/supply-chain/ecr-scanning.js +11 -7
  445. package/src/supply-chain/ecs-deployed-image.d.ts +5 -3
  446. package/src/supply-chain/ecs-deployed-image.js +6 -4
  447. package/src/supply-chain/generated-blueprint-trust-command.js +18 -1
  448. package/src/supply-chain/generated-command.js +1 -0
  449. package/src/supply-chain/generated-container-release-command.js +1285 -124
  450. package/src/supply-chain/generated-ecr-collector-command.d.ts +0 -1
  451. package/src/supply-chain/generated-ecr-collector-command.js +200 -93
  452. package/src/supply-chain/generated-files.js +25 -14
  453. package/src/supply-chain/generated-scanner-command.js +2 -1
  454. package/src/supply-chain/index.d.ts +1 -1
  455. package/src/supply-chain/index.js +2 -1
  456. package/src/supply-chain/sbom.d.ts +1 -1
  457. package/src/supply-chain/sbom.js +30 -5
  458. package/src/supply-chain/scanner.js +3 -0
  459. package/src/testing-evidence/fixture-scope.d.ts +2 -1
  460. package/src/testing-evidence/fixture-scope.js +4 -2
  461. package/src/testing-evidence/result.d.ts +2 -1
  462. package/src/testing-evidence/result.js +18 -4
  463. package/src/workload-roles/account-baseline.d.ts +11 -0
  464. package/src/workload-roles/account-baseline.js +253 -16
  465. package/src/workload-roles/authority.d.ts +3 -1
  466. package/src/workload-roles/authority.js +48 -2
  467. package/src/workload-roles/aws-s3-state.js +27 -0
  468. package/src/workload-roles/boundary.d.ts +2 -1
  469. package/src/workload-roles/boundary.js +9 -2
  470. package/src/workload-roles/handler.js +52 -24
  471. package/src/workload-roles/index.d.ts +10 -17
  472. package/src/workload-roles/index.js +5 -18
  473. package/src/workload-roles/injection.js +1 -1
  474. package/src/workload-roles/provisioner.js +12 -4
  475. package/src/workload-roles/registration.d.ts +1 -0
  476. package/src/workload-roles/registration.js +5 -0
  477. package/src/workload-roles/stage-boundary.js +1 -1
  478. package/src/workload-roles/standard-slice.js +3 -3
  479. package/src/workspace-deployment/affected-lifecycle.d.ts +53 -0
  480. package/src/workspace-deployment/affected-lifecycle.js +84 -0
  481. package/src/workspace-deployment/identity.d.ts +3 -0
  482. package/src/workspace-deployment/identity.js +22 -0
  483. package/src/workspace-deployment/index.d.ts +4 -0
  484. package/src/workspace-deployment/index.js +8 -0
  485. package/src/workspace-deployment/migration-evidence.d.ts +29 -0
  486. package/src/workspace-deployment/migration-evidence.js +83 -0
  487. package/src/workspace-deployment/migration.d.ts +27 -0
  488. package/src/workspace-deployment/migration.js +109 -0
  489. package/src/workspace-deployment/ownership.d.ts +81 -0
  490. package/src/workspace-deployment/ownership.js +381 -0
  491. package/src/api-contract/baseline-update.js.map +0 -1
  492. package/src/api-contract/compatibility.js.map +0 -1
  493. package/src/api-contract/contract-graph.js.map +0 -1
  494. package/src/api-contract/evidence.js.map +0 -1
  495. package/src/api-contract/index.js.map +0 -1
  496. package/src/api-contract/model.fixtures.d.ts +0 -2
  497. package/src/api-contract/model.fixtures.js +0 -81
  498. package/src/api-contract/model.fixtures.js.map +0 -1
  499. package/src/api-contract/model.js.map +0 -1
  500. package/src/api-contract/rollout.js.map +0 -1
  501. package/src/authorization/compatibility.js.map +0 -1
  502. package/src/authorization/index.js.map +0 -1
  503. package/src/blueprints/execution.js.map +0 -1
  504. package/src/blueprints/external-sandbox.js.map +0 -1
  505. package/src/blueprints/index.js.map +0 -1
  506. package/src/blueprints/inputs.js.map +0 -1
  507. package/src/blueprints/manifest.js.map +0 -1
  508. package/src/blueprints/resolver.js.map +0 -1
  509. package/src/blueprints/transitions.js.map +0 -1
  510. package/src/cli/agent-command.js.map +0 -1
  511. package/src/cli/agent-runtime.js.map +0 -1
  512. package/src/cli/blueprint-authority.js.map +0 -1
  513. package/src/cli/blueprint-command.js.map +0 -1
  514. package/src/cli/bootstrap.js.map +0 -1
  515. package/src/cli/dev-command.js.map +0 -1
  516. package/src/cli/main.js.map +0 -1
  517. package/src/cli/output.js.map +0 -1
  518. package/src/cli/personal-secret-runtime.js.map +0 -1
  519. package/src/cli/secret-terminal.js.map +0 -1
  520. package/src/container-images.js.map +0 -1
  521. package/src/data-lifecycle/index.js.map +0 -1
  522. package/src/data-lifecycle/model.fixtures.d.ts +0 -2
  523. package/src/data-lifecycle/model.fixtures.js +0 -244
  524. package/src/data-lifecycle/model.fixtures.js.map +0 -1
  525. package/src/data-lifecycle/model.js.map +0 -1
  526. package/src/data-lifecycle/sensitive-artifacts.js.map +0 -1
  527. package/src/data-lifecycle/validation.js.map +0 -1
  528. package/src/database-retirement/contract.js.map +0 -1
  529. package/src/database-retirement/index.js.map +0 -1
  530. package/src/deterministic-order.js.map +0 -1
  531. package/src/developer-agent/context.js.map +0 -1
  532. package/src/developer-agent/generator-planning.js.map +0 -1
  533. package/src/developer-agent/generator-preview.js.map +0 -1
  534. package/src/developer-agent/git-inspection.js.map +0 -1
  535. package/src/developer-agent/handoff.js.map +0 -1
  536. package/src/developer-agent/index.js.map +0 -1
  537. package/src/developer-agent/model.js.map +0 -1
  538. package/src/developer-agent/operation-registry.js.map +0 -1
  539. package/src/developer-agent/ordering.js.map +0 -1
  540. package/src/developer-agent/planning.js.map +0 -1
  541. package/src/developer-agent/preview-changes.js.map +0 -1
  542. package/src/developer-agent/preview-source.js.map +0 -1
  543. package/src/developer-agent/validation.js.map +0 -1
  544. package/src/developer-agent/workspace-inspection.js.map +0 -1
  545. package/src/developer-agent/workspace-path.js.map +0 -1
  546. package/src/executors/blueprint-trust/blueprint-trust.js.map +0 -1
  547. package/src/executors/blueprint-verification/blueprint-verification.js.map +0 -1
  548. package/src/executors/deploy/deploy.js.map +0 -1
  549. package/src/executors/deployment-plan/deployment-plan.js.map +0 -1
  550. package/src/executors/dev/dev.js.map +0 -1
  551. package/src/executors/dev-doctor/dev-doctor.js.map +0 -1
  552. package/src/executors/dev-setup/dev-setup.js.map +0 -1
  553. package/src/executors/developer-context/developer-context.js.map +0 -1
  554. package/src/executors/fleet/fleet.js.map +0 -1
  555. package/src/executors/foundation-preflight/foundation-preflight.js.map +0 -1
  556. package/src/executors/foundation-profile-preflight/foundation-profile-preflight.js.map +0 -1
  557. package/src/executors/foundation-remove-preflight/foundation-remove-preflight.js.map +0 -1
  558. package/src/executors/github-bootstrap/github-bootstrap.js.map +0 -1
  559. package/src/executors/infrastructure-plan/infrastructure-plan.js.map +0 -1
  560. package/src/executors/refresh/refresh.js.map +0 -1
  561. package/src/executors/remove/remove.js.map +0 -1
  562. package/src/executors/secret-guardrails/secret-guardrails.js.map +0 -1
  563. package/src/executors/secret-metadata/secret-metadata.js.map +0 -1
  564. package/src/executors/sst-lifecycle/logging-preflight.js.map +0 -1
  565. package/src/executors/sst-lifecycle/run-sst-command.js.map +0 -1
  566. package/src/executors/sst-lifecycle/secret-preflight.js.map +0 -1
  567. package/src/executors/unlock/unlock.js.map +0 -1
  568. package/src/executors/work-markers/work-markers.js.map +0 -1
  569. package/src/foundation/discovery.js.map +0 -1
  570. package/src/foundation/index.js.map +0 -1
  571. package/src/foundation/local-database-contract.js.map +0 -1
  572. package/src/foundation/logging-preflight.js.map +0 -1
  573. package/src/foundation/logging.js.map +0 -1
  574. package/src/foundation/preflight.js.map +0 -1
  575. package/src/foundation/provision-database-bindings.js.map +0 -1
  576. package/src/foundation/provision-logical-database.js.map +0 -1
  577. package/src/foundation/requirements.js.map +0 -1
  578. package/src/foundation/router-origin-proof.js.map +0 -1
  579. package/src/foundation/stages.js.map +0 -1
  580. package/src/frontend-security/index.js.map +0 -1
  581. package/src/frontend-security/security-headers.js.map +0 -1
  582. package/src/generators/feature-registry.js.map +0 -1
  583. package/src/generators/function/function.js.map +0 -1
  584. package/src/generators/job/job.js.map +0 -1
  585. package/src/generators/logging-registry.js.map +0 -1
  586. package/src/generators/post-generation-install.js.map +0 -1
  587. package/src/generators/preset/generator.js.map +0 -1
  588. package/src/generators/preset/tool-versions.js.map +0 -1
  589. package/src/generators/preset/workspace-files-developer-agent.js.map +0 -1
  590. package/src/generators/preset/workspace-files-foundation-workload-roles.js.map +0 -1
  591. package/src/generators/preset/workspace-files-performance-cost.js.map +0 -1
  592. package/src/generators/preset/workspace-files-performance-load.js.map +0 -1
  593. package/src/generators/preset/workspace-files-workload-role-baseline.js.map +0 -1
  594. package/src/generators/preset/workspace-files.js.map +0 -1
  595. package/src/generators/repository-policy/repository-policy.js.map +0 -1
  596. package/src/generators/service/service.js.map +0 -1
  597. package/src/generators/slice/built-in-plan-api-contract-files.js.map +0 -1
  598. package/src/generators/slice/built-in-plan-api-files.js.map +0 -1
  599. package/src/generators/slice/built-in-plan-async-work-files.js.map +0 -1
  600. package/src/generators/slice/built-in-plan-authorization-files.js.map +0 -1
  601. package/src/generators/slice/built-in-plan-authorization-infrastructure-files.js.map +0 -1
  602. package/src/generators/slice/built-in-plan-data-deletion-files.js.map +0 -1
  603. package/src/generators/slice/built-in-plan-data-export-infrastructure-files.js.map +0 -1
  604. package/src/generators/slice/built-in-plan-data-files.js.map +0 -1
  605. package/src/generators/slice/built-in-plan-data-lifecycle-files.js.map +0 -1
  606. package/src/generators/slice/built-in-plan-data-lifecycle-runtime-files.js.map +0 -1
  607. package/src/generators/slice/built-in-plan-data-retention-job-files.js.map +0 -1
  608. package/src/generators/slice/built-in-plan-data-retention-launcher-files.js.map +0 -1
  609. package/src/generators/slice/built-in-plan-data-rights-files.js.map +0 -1
  610. package/src/generators/slice/built-in-plan-database-lifecycle-files.js.map +0 -1
  611. package/src/generators/slice/built-in-plan-database-retirement-rehearsal-files.js.map +0 -1
  612. package/src/generators/slice/built-in-plan-foundation-files.js.map +0 -1
  613. package/src/generators/slice/built-in-plan-frontend-files.js.map +0 -1
  614. package/src/generators/slice/built-in-plan-infrastructure-files.js.map +0 -1
  615. package/src/generators/slice/built-in-plan-infrastructure-safety-files.js.map +0 -1
  616. package/src/generators/slice/built-in-plan-metadata-files.js.map +0 -1
  617. package/src/generators/slice/built-in-plan-operations-files.js.map +0 -1
  618. package/src/generators/slice/built-in-plan-performance-files.js.map +0 -1
  619. package/src/generators/slice/built-in-plan-project-files.js.map +0 -1
  620. package/src/generators/slice/built-in-plan-release-files.js.map +0 -1
  621. package/src/generators/slice/built-in-plan-reliability-files.js.map +0 -1
  622. package/src/generators/slice/built-in-plan-secret-runtime-files.js.map +0 -1
  623. package/src/generators/slice/built-in-plan-shared.js.map +0 -1
  624. package/src/generators/slice/built-in-plan-testing-files.js.map +0 -1
  625. package/src/generators/slice/built-in-plan-verification-files.js.map +0 -1
  626. package/src/generators/slice/built-in-plan-web-files.js.map +0 -1
  627. package/src/generators/slice/built-in-plan-workload-role-files.js.map +0 -1
  628. package/src/generators/slice/built-in-plan.js.map +0 -1
  629. package/src/generators/slice/slice.js.map +0 -1
  630. package/src/generators/upgrade/upgrade.js.map +0 -1
  631. package/src/generators/workload/frozen-container.js.map +0 -1
  632. package/src/generators/workload/performance-registration.js.map +0 -1
  633. package/src/generators/workload/reliability-registration.js.map +0 -1
  634. package/src/generators/workload/service-performance-files.js.map +0 -1
  635. package/src/generators/workload/workload.js.map +0 -1
  636. package/src/git-policy/action-pins.js.map +0 -1
  637. package/src/git-policy/github-bootstrap.js.map +0 -1
  638. package/src/git-policy/index.js.map +0 -1
  639. package/src/git-policy/routing.js.map +0 -1
  640. package/src/index.js.map +0 -1
  641. package/src/infrastructure-change/convergence.js.map +0 -1
  642. package/src/infrastructure-change/drift.js.map +0 -1
  643. package/src/infrastructure-change/index.js.map +0 -1
  644. package/src/infrastructure-change/model.js.map +0 -1
  645. package/src/infrastructure-change/normalize.js.map +0 -1
  646. package/src/infrastructure-change/plan.js.map +0 -1
  647. package/src/infrastructure-change/risk.js.map +0 -1
  648. package/src/infrastructure-change/summary.js.map +0 -1
  649. package/src/local-dev/context-discovery.js.map +0 -1
  650. package/src/local-dev/contract-validation.js.map +0 -1
  651. package/src/local-dev/contracts.js.map +0 -1
  652. package/src/local-dev/control-contract.js.map +0 -1
  653. package/src/local-dev/dev-command-core.js.map +0 -1
  654. package/src/local-dev/effects.js.map +0 -1
  655. package/src/local-dev/environment-inspector.js.map +0 -1
  656. package/src/local-dev/environment-state.js.map +0 -1
  657. package/src/local-dev/errors.js.map +0 -1
  658. package/src/local-dev/fleet-client.js.map +0 -1
  659. package/src/local-dev/fleet-configuration.js.map +0 -1
  660. package/src/local-dev/fleet-inventory.js.map +0 -1
  661. package/src/local-dev/fleet-ipc.js.map +0 -1
  662. package/src/local-dev/fleet-launcher.js.map +0 -1
  663. package/src/local-dev/fleet-lock.js.map +0 -1
  664. package/src/local-dev/fleet-logs.js.map +0 -1
  665. package/src/local-dev/fleet-process.js.map +0 -1
  666. package/src/local-dev/fleet-runtime.js.map +0 -1
  667. package/src/local-dev/fleet-session.js.map +0 -1
  668. package/src/local-dev/fleet-slice-runner-daemon.js.map +0 -1
  669. package/src/local-dev/fleet-startup.js.map +0 -1
  670. package/src/local-dev/fleet-state.js.map +0 -1
  671. package/src/local-dev/fleet-supervisor-daemon.js.map +0 -1
  672. package/src/local-dev/fleet-supervisor.js.map +0 -1
  673. package/src/local-dev/gateway-daemon.js.map +0 -1
  674. package/src/local-dev/gateway.js.map +0 -1
  675. package/src/local-dev/identity.js.map +0 -1
  676. package/src/local-dev/index.js.map +0 -1
  677. package/src/local-dev/local-context.js.map +0 -1
  678. package/src/local-dev/nx-workspace.js.map +0 -1
  679. package/src/local-dev/personal-secret-ledger.js.map +0 -1
  680. package/src/local-dev/personal-stage.js.map +0 -1
  681. package/src/local-dev/portless.js.map +0 -1
  682. package/src/local-dev/ports.js.map +0 -1
  683. package/src/local-dev/private-state.js.map +0 -1
  684. package/src/local-dev/process-identity.js.map +0 -1
  685. package/src/local-dev/proxy.js.map +0 -1
  686. package/src/local-dev/runtime-paths.js.map +0 -1
  687. package/src/local-dev/secret-slice-claim.js.map +0 -1
  688. package/src/local-dev/slice-claim.js.map +0 -1
  689. package/src/local-dev/slice-runner.js.map +0 -1
  690. package/src/local-dev/tls.js.map +0 -1
  691. package/src/ownership/composition.js.map +0 -1
  692. package/src/ownership/foundation-record.js.map +0 -1
  693. package/src/ownership/hash.js.map +0 -1
  694. package/src/ownership/index.js.map +0 -1
  695. package/src/ownership/json-ownership.js.map +0 -1
  696. package/src/ownership/record.js.map +0 -1
  697. package/src/ownership/workspace-record.js.map +0 -1
  698. package/src/performance/cost-collection.js.map +0 -1
  699. package/src/performance/cost-controls.js.map +0 -1
  700. package/src/performance/evidence.js.map +0 -1
  701. package/src/performance/index.js.map +0 -1
  702. package/src/performance/load-safety.js.map +0 -1
  703. package/src/performance/model.js.map +0 -1
  704. package/src/performance/pr-artifact-budget.js.map +0 -1
  705. package/src/performance/runner.js.map +0 -1
  706. package/src/performance/scenario-endpoint.js.map +0 -1
  707. package/src/performance/scenario.js.map +0 -1
  708. package/src/performance/test-fixtures.d.ts +0 -7
  709. package/src/performance/test-fixtures.js +0 -169
  710. package/src/performance/test-fixtures.js.map +0 -1
  711. package/src/performance/unit-cost.js.map +0 -1
  712. package/src/release/index.js.map +0 -1
  713. package/src/release/lifecycle.js.map +0 -1
  714. package/src/release/manifest.js.map +0 -1
  715. package/src/release/rollout.js.map +0 -1
  716. package/src/release/source-authority.js.map +0 -1
  717. package/src/repository-policy/aurora-preflight.js.map +0 -1
  718. package/src/repository-policy/deployment-plan.js.map +0 -1
  719. package/src/repository-policy/foundation-profile.js.map +0 -1
  720. package/src/repository-policy/index.js.map +0 -1
  721. package/src/repository-policy/policy.js.map +0 -1
  722. package/src/secrets/adapters.js.map +0 -1
  723. package/src/secrets/aws-control-plane.js.map +0 -1
  724. package/src/secrets/declaration-verification.js.map +0 -1
  725. package/src/secrets/guardrails.js.map +0 -1
  726. package/src/secrets/index.js.map +0 -1
  727. package/src/secrets/metadata.js.map +0 -1
  728. package/src/secrets/model.js.map +0 -1
  729. package/src/secrets/operator.js.map +0 -1
  730. package/src/secrets/permissions.js.map +0 -1
  731. package/src/secrets/personal-command.js.map +0 -1
  732. package/src/secrets/personal-ledger.js.map +0 -1
  733. package/src/secrets/registry.js.map +0 -1
  734. package/src/secrets/verification.js.map +0 -1
  735. package/src/secrets/workload-access.js.map +0 -1
  736. package/src/supply-chain/action-pins.js.map +0 -1
  737. package/src/supply-chain/blueprint-trust-git.js.map +0 -1
  738. package/src/supply-chain/blueprint-trust-process.js.map +0 -1
  739. package/src/supply-chain/blueprint-trust.js.map +0 -1
  740. package/src/supply-chain/blueprint-verification-authority.js.map +0 -1
  741. package/src/supply-chain/blueprint-verification-execution.js.map +0 -1
  742. package/src/supply-chain/build-output.js.map +0 -1
  743. package/src/supply-chain/common.js.map +0 -1
  744. package/src/supply-chain/container-artifact-contract.js.map +0 -1
  745. package/src/supply-chain/container-release.js.map +0 -1
  746. package/src/supply-chain/ecr-applicability.js.map +0 -1
  747. package/src/supply-chain/ecr-scanning.js.map +0 -1
  748. package/src/supply-chain/ecs-deployed-image.js.map +0 -1
  749. package/src/supply-chain/errors.js.map +0 -1
  750. package/src/supply-chain/generated-blueprint-trust-command.js.map +0 -1
  751. package/src/supply-chain/generated-command.js.map +0 -1
  752. package/src/supply-chain/generated-container-release-command.js.map +0 -1
  753. package/src/supply-chain/generated-ecr-collector-command.js.map +0 -1
  754. package/src/supply-chain/generated-files.js.map +0 -1
  755. package/src/supply-chain/generated-scanner-command.js.map +0 -1
  756. package/src/supply-chain/index.js.map +0 -1
  757. package/src/supply-chain/inventory.js.map +0 -1
  758. package/src/supply-chain/license-expression.js.map +0 -1
  759. package/src/supply-chain/pnpm-toolchain-authority.js.map +0 -1
  760. package/src/supply-chain/policy.js.map +0 -1
  761. package/src/supply-chain/publication.js.map +0 -1
  762. package/src/supply-chain/sbom.js.map +0 -1
  763. package/src/supply-chain/scanner.js.map +0 -1
  764. package/src/supply-chain/vendored-source.js.map +0 -1
  765. package/src/testing-evidence/fixture-scope.js.map +0 -1
  766. package/src/testing-evidence/index.js.map +0 -1
  767. package/src/testing-evidence/quarantine.js.map +0 -1
  768. package/src/testing-evidence/result.js.map +0 -1
  769. package/src/testing-evidence/runner-adapter.js.map +0 -1
  770. package/src/testing-evidence/sensitive-artifacts.js.map +0 -1
  771. package/src/validation.js.map +0 -1
  772. package/src/work-markers/index.js.map +0 -1
  773. package/src/work-markers/work-markers.js.map +0 -1
  774. package/src/workload-roles/account-baseline.js.map +0 -1
  775. package/src/workload-roles/authority.js.map +0 -1
  776. package/src/workload-roles/aws-adapter.js.map +0 -1
  777. package/src/workload-roles/aws-internal-handler.js.map +0 -1
  778. package/src/workload-roles/aws-s3-state.js.map +0 -1
  779. package/src/workload-roles/aws-sdk-control-plane.js.map +0 -1
  780. package/src/workload-roles/boundary.js.map +0 -1
  781. package/src/workload-roles/convergence.js.map +0 -1
  782. package/src/workload-roles/effective-policy.js.map +0 -1
  783. package/src/workload-roles/handler.js.map +0 -1
  784. package/src/workload-roles/history.js.map +0 -1
  785. package/src/workload-roles/index.js.map +0 -1
  786. package/src/workload-roles/injection.js.map +0 -1
  787. package/src/workload-roles/manifest.js.map +0 -1
  788. package/src/workload-roles/provisioner.js.map +0 -1
  789. package/src/workload-roles/registration.js.map +0 -1
  790. package/src/workload-roles/stage-boundary.js.map +0 -1
  791. package/src/workload-roles/standard-slice.js.map +0 -1
@@ -8,12 +8,19 @@ const node_path_1 = require("node:path");
8
8
  const node_util_1 = require("node:util");
9
9
  const index_js_1 = require("../../blueprints/index.js");
10
10
  const index_js_2 = require("../../foundation/index.js");
11
+ const capability_plan_js_1 = require("../../foundation/capability-plan.js");
12
+ const preview_changes_js_1 = require("../../developer-agent/preview-changes.js");
13
+ const upgrade_js_1 = require("../upgrade/upgrade.js");
11
14
  const index_js_3 = require("../../ownership/index.js");
12
15
  const index_js_4 = require("../../repository-policy/index.js");
13
16
  const blueprint_verification_authority_js_1 = require("../../supply-chain/blueprint-verification-authority.js");
14
17
  const blueprint_trust_js_1 = require("../../supply-chain/blueprint-trust.js");
15
18
  const post_generation_install_js_1 = require("../post-generation-install.js");
19
+ const formatting_js_1 = require("../formatting.js");
20
+ const workspace_files_js_1 = require("../preset/workspace-files.js");
16
21
  const built_in_plan_js_1 = require("./built-in-plan.js");
22
+ const data_policy_review_seed_js_1 = require("./data-policy-review-seed.js");
23
+ const tree_policy_js_1 = require("../repository-policy/tree-policy.js");
17
24
  var built_in_plan_js_2 = require("./built-in-plan.js");
18
25
  Object.defineProperty(exports, "PRODUCT_PACKAGE_MANAGED_JSON_POINTERS", { enumerable: true, get: function () { return built_in_plan_js_2.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS; } });
19
26
  Object.defineProperty(exports, "STANDARD_LOCAL_DEV_ADAPTER", { enumerable: true, get: function () { return built_in_plan_js_2.STANDARD_LOCAL_DEV_ADAPTER; } });
@@ -47,6 +54,24 @@ function workspaceScope(packageJson) {
47
54
  function json(value) {
48
55
  return `${JSON.stringify(value, null, 2)}\n`;
49
56
  }
57
+ async function formatSliceBeforeOwnershipRestamp(tree, root, preserveBuiltInFormatSensitiveFiles) {
58
+ const prefix = `${root}/`;
59
+ const restoreProtectedFiles = (0, formatting_js_1.createTreeFileRestorer)(tree, (path) => {
60
+ // Paired Foundation generation has already formatted and hashed its own
61
+ // output. A Slice formatter must not invalidate that completed ownership.
62
+ if (!path.startsWith(prefix))
63
+ return true;
64
+ if ((0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(path))
65
+ return true;
66
+ return (preserveBuiltInFormatSensitiveFiles &&
67
+ path.startsWith(prefix) &&
68
+ (0, built_in_plan_js_1.isBuiltInSliceFormatSensitivePath)(path.slice(prefix.length)));
69
+ });
70
+ await (0, formatting_js_1.formatChangedTreeToFixedPoint)(tree, restoreProtectedFiles);
71
+ }
72
+ async function formatSliceOwnership(tree, root) {
73
+ await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, node_path_1.posix.join(root, '.ebk/ownership.json'));
74
+ }
50
75
  function assertExternalBlueprintVerificationProgram(input) {
51
76
  (0, blueprint_verification_authority_js_1.assertExternalBlueprintGeneratedNxProjectConfinement)({
52
77
  files: input.files,
@@ -103,28 +128,6 @@ function assertExternalBlueprintVerificationProgram(input) {
103
128
  targets: rootProject.targets,
104
129
  });
105
130
  }
106
- const FORMAT_SENSITIVE_BUILT_IN_PATHS = new Set([
107
- 'api/generated/contract.json',
108
- 'api/generated/openapi.json',
109
- 'web/next-env.d.ts',
110
- ]);
111
- function dataPolicyReviewSeed(tree, root) {
112
- const path = node_path_1.posix.join(root, 'data/policy.json');
113
- const existing = tree.read(path, 'utf8');
114
- if (existing !== null) {
115
- try {
116
- const reviewedAt = JSON.parse(existing).governance?.reviewedAt;
117
- if (typeof reviewedAt === 'string' &&
118
- new Date(reviewedAt).toISOString() === reviewedAt) {
119
- return reviewedAt;
120
- }
121
- }
122
- catch {
123
- // The generated ownership/reconciliation path reports malformed policy.
124
- }
125
- }
126
- return new Date().toISOString();
127
- }
128
131
  function reportSlicePolicyPosture(tree, name) {
129
132
  const contents = tree.read(index_js_4.REPOSITORY_POLICY_FILE, 'utf8');
130
133
  if (contents === null) {
@@ -132,7 +135,7 @@ function reportSlicePolicyPosture(tree, name) {
132
135
  return;
133
136
  }
134
137
  try {
135
- const policy = (0, index_js_4.parseRepositoryOperatingPolicy)(contents, index_js_4.REPOSITORY_POLICY_FILE);
138
+ const policy = (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree);
136
139
  const status = policy.slices[name]?.productionStatus;
137
140
  if (status) {
138
141
  devkit_1.logger.info(`[ebk-repository-policy] Product Slice ${name} retains explicit production status ${status}.`);
@@ -144,6 +147,13 @@ function reportSlicePolicyPosture(tree, name) {
144
147
  devkit_1.logger.warn(`[ebk-repository-policy] Product Slice ${name} is blocked from production because the repository policy is invalid. ${error instanceof Error ? error.message : String(error)}`);
145
148
  }
146
149
  }
150
+ function requireRepositoryDeploymentProfile(tree) {
151
+ const contents = tree.read(index_js_4.REPOSITORY_POLICY_FILE, 'utf8');
152
+ if (contents === null) {
153
+ throw new Error(`${index_js_4.REPOSITORY_POLICY_FILE} is required before generating a built-in Product Slice.`);
154
+ }
155
+ return (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree).deploymentProfile;
156
+ }
147
157
  function parseBlueprintInputs(inputs) {
148
158
  if (inputs === undefined) {
149
159
  return {};
@@ -181,6 +191,7 @@ async function sliceGenerator(tree, options) {
181
191
  },
182
192
  resumeArguments: [
183
193
  'pnpm',
194
+ '--config.verify-deps-before-run=warn',
184
195
  'nx',
185
196
  'generate',
186
197
  '@empire-builder-kit/nx:slice',
@@ -213,7 +224,15 @@ async function sliceGenerator(tree, options) {
213
224
  .join('\n')}`);
214
225
  }
215
226
  const foundationDescriptor = readJson(tree, 'packages/foundation/contracts/foundation.json', 'Standard Foundation descriptor');
216
- const compatibility = (0, index_js_2.validateFoundationCompatibility)(blueprint.manifest.foundation, foundationDescriptor);
227
+ const foundationRequirement = blueprint.source === 'built-in'
228
+ ? (0, capability_plan_js_1.standardPersistenceRequirement)(inputResult.value)
229
+ : blueprint.manifest.foundation;
230
+ const compatibility = (0, index_js_2.validateFoundationCompatibility)(foundationRequirement, blueprint.source === 'built-in'
231
+ ? (0, capability_plan_js_1.planFoundationCapabilities)({
232
+ current: foundationDescriptor,
233
+ requirements: [foundationRequirement],
234
+ }).descriptor
235
+ : foundationDescriptor);
217
236
  if (!compatibility.valid) {
218
237
  throw new Error(`Standard Foundation is incompatible with this Blueprint:\n${compatibility.issues
219
238
  .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -222,7 +241,7 @@ async function sliceGenerator(tree, options) {
222
241
  const installScope = {
223
242
  exactPaths: ['package.json'],
224
243
  requiredPaths: [node_path_1.posix.join(root, '.ebk/ownership.json')],
225
- roots: [root],
244
+ roots: blueprint.source === 'built-in' ? [root, 'packages/foundation'] : [root],
226
245
  };
227
246
  const installState = options.skipInstall
228
247
  ? undefined
@@ -315,13 +334,11 @@ async function sliceGenerator(tree, options) {
315
334
  };
316
335
  tree.write('package.json', json(packageJson));
317
336
  }
318
- if (!options.skipFormat) {
319
- await (0, devkit_1.formatFiles)(tree);
320
- }
337
+ if (!options.skipFormat)
338
+ await formatSliceBeforeOwnershipRestamp(tree, root, false);
321
339
  (0, index_js_3.restampProductSliceOwnership)(tree, name);
322
- if (!options.skipFormat) {
323
- await (0, devkit_1.formatFiles)(tree);
324
- }
340
+ if (!options.skipFormat)
341
+ await formatSliceOwnership(tree, root);
325
342
  reportSlicePolicyPosture(tree, name);
326
343
  if (options.skipInstall)
327
344
  return undefined;
@@ -334,33 +351,27 @@ async function sliceGenerator(tree, options) {
334
351
  if (!runtimeVersion) {
335
352
  throw new Error('Workspace package.json must depend on @empire-builder-kit/runtime before generating a Product Slice.');
336
353
  }
337
- const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value, dataPolicyReviewSeed(tree, root));
354
+ const plan = (0, built_in_plan_js_1.createBuiltInSlicePlan)(name, scope, runtimeVersion, blueprint.manifest, inputResult.value, (0, data_policy_review_seed_js_1.dataPolicyReviewSeed)(tree, root), requireRepositoryDeploymentProfile(tree));
338
355
  const ownershipValidation = (0, index_js_3.validateGeneratedOwnershipRecord)(plan.ownership);
339
356
  if (!ownershipValidation.valid) {
340
357
  throw new Error(`Generated ownership metadata is invalid:\n${ownershipValidation.issues
341
358
  .map((issue) => `- ${issue.path}: ${issue.message}`)
342
359
  .join('\n')}`);
343
360
  }
361
+ // Foundation capability growth and Slice creation are one ownership-preserving
362
+ // source operation. A later validation/formatting failure must not leave half
363
+ // of a relational declaration applied to the caller's tree.
364
+ const deferred = new preview_changes_js_1.DeferredDeveloperAgentTree(tree);
365
+ await (0, upgrade_js_1.upgradeFoundationForRequirements)(deferred, [foundationRequirement], true);
344
366
  for (const [relativePath, contents] of Object.entries(plan.files)) {
345
- tree.write(node_path_1.posix.join(root, relativePath), contents);
346
- }
347
- const restoreFormatSensitiveFiles = () => {
348
- for (const [relativePath, contents] of Object.entries(plan.files)) {
349
- if (relativePath.startsWith('database/migrations/') ||
350
- FORMAT_SENSITIVE_BUILT_IN_PATHS.has(relativePath)) {
351
- tree.write(node_path_1.posix.join(root, relativePath), contents);
352
- }
353
- }
354
- };
355
- if (!options.skipFormat) {
356
- await (0, devkit_1.formatFiles)(tree);
357
- restoreFormatSensitiveFiles();
358
- }
359
- (0, index_js_3.restampProductSliceOwnership)(tree, name);
360
- if (!options.skipFormat) {
361
- await (0, devkit_1.formatFiles)(tree);
362
- restoreFormatSensitiveFiles();
367
+ deferred.write(node_path_1.posix.join(root, relativePath), contents);
363
368
  }
369
+ if (!options.skipFormat)
370
+ await formatSliceBeforeOwnershipRestamp(deferred, root, true);
371
+ (0, index_js_3.restampProductSliceOwnership)(deferred, name);
372
+ if (!options.skipFormat)
373
+ await formatSliceOwnership(deferred, root);
374
+ deferred.apply();
364
375
  reportSlicePolicyPosture(tree, name);
365
376
  if (options.skipInstall)
366
377
  return undefined;
@@ -0,0 +1,7 @@
1
+ export interface SqlGeneratorSchema {
2
+ name: string;
3
+ reason: string;
4
+ apply?: boolean;
5
+ skipFormat?: boolean;
6
+ skipInstall?: boolean;
7
+ }
@@ -0,0 +1,38 @@
1
+ {
2
+ "$schema": "https://json-schema.org/schema",
3
+ "$id": "EmpireBuilderKitSql",
4
+ "title": "Add a relational requirement to an existing Standard Slice",
5
+ "description": "Report or apply an additive Foundation/Slice SQL declaration while preserving existing data stores and managed ownership. No AWS calls.",
6
+ "type": "object",
7
+ "additionalProperties": false,
8
+ "properties": {
9
+ "name": {
10
+ "type": "string",
11
+ "pattern": "^[a-z][a-z0-9-]{0,62}$",
12
+ "$default": { "$source": "argv", "index": 0 },
13
+ "description": "Existing Standard Product Slice."
14
+ },
15
+ "reason": {
16
+ "type": "string",
17
+ "minLength": 1,
18
+ "maxLength": 512,
19
+ "description": "Concrete relational requirement, such as integrity constraints or reporting joins. Stored in the existing Blueprint inputs.sql declaration."
20
+ },
21
+ "apply": {
22
+ "type": "boolean",
23
+ "default": false,
24
+ "description": "Apply the paired managed Foundation/Slice source upgrade; otherwise only report it. No AWS operation is performed."
25
+ },
26
+ "skipFormat": {
27
+ "type": "boolean",
28
+ "default": false,
29
+ "description": "Leave source formatting to a subsequent explicit check."
30
+ },
31
+ "skipInstall": {
32
+ "type": "boolean",
33
+ "default": false,
34
+ "description": "Do not run the dependency-install callback after applying source changes."
35
+ }
36
+ },
37
+ "required": ["name", "reason"]
38
+ }
@@ -0,0 +1,6 @@
1
+ import { type GeneratorCallback, type Tree } from '@nx/devkit';
2
+ import { type UpgradeGeneratorLogger } from '../upgrade/upgrade.js';
3
+ import type { SqlGeneratorSchema } from './schema.js';
4
+ /** One additive entry point; the existing upgrader owns validation and all writes. */
5
+ export declare function sqlGenerator(tree: Tree, options: SqlGeneratorSchema, output?: UpgradeGeneratorLogger): Promise<void | GeneratorCallback>;
6
+ export default sqlGenerator;
@@ -0,0 +1,53 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.sqlGenerator = sqlGenerator;
4
+ const devkit_1 = require("@nx/devkit");
5
+ const index_js_1 = require("../../blueprints/index.js");
6
+ const capability_plan_js_1 = require("../../foundation/capability-plan.js");
7
+ const index_js_2 = require("../../ownership/index.js");
8
+ const upgrade_js_1 = require("../upgrade/upgrade.js");
9
+ /** One additive entry point; the existing upgrader owns validation and all writes. */
10
+ async function sqlGenerator(tree, options, output = devkit_1.logger) {
11
+ if (typeof options.name !== 'string' ||
12
+ !/^[a-z][a-z0-9-]{0,62}$/.test(options.name) ||
13
+ ['foundation', 'workspace'].includes(options.name))
14
+ throw new Error('SQL requires one existing Standard Product Slice name.');
15
+ const declaration = (0, capability_plan_js_1.readStandardSqlDeclaration)({
16
+ sql: { reason: options.reason },
17
+ });
18
+ if (!declaration)
19
+ throw new Error('A concrete relational reason is required.');
20
+ const ownershipPath = `packages/${options.name}/.ebk/ownership.json`;
21
+ const source = tree.read(ownershipPath, 'utf8');
22
+ if (!source)
23
+ throw new Error(`Standard Slice ownership is missing at ${ownershipPath}. Generate the Slice first.`);
24
+ let parsed;
25
+ try {
26
+ parsed = JSON.parse(source);
27
+ }
28
+ catch {
29
+ throw new Error(`Standard Slice ownership is invalid at ${ownershipPath}.`);
30
+ }
31
+ const ownership = (0, index_js_2.validateGeneratedOwnershipRecord)(parsed);
32
+ if (!ownership.valid || ownership.value.slice !== options.name)
33
+ throw new Error(`Standard Slice ownership is invalid at ${ownershipPath}.`);
34
+ if (ownership.value.blueprint.name !== index_js_1.BUILTIN_BLUEPRINT_NAME)
35
+ throw new Error('The sql generator only supports the Standard Blueprint. Declare relational capabilities through the external Blueprint owner.');
36
+ const existing = (0, capability_plan_js_1.readStandardSqlDeclaration)(ownership.value.inputs);
37
+ if (existing && existing.reason !== declaration.reason)
38
+ throw new Error('SQL is already declared with a different reason. Keep the recorded reason, or use the managed upgrade inputs surface for an intentional declaration change.');
39
+ output.info(`[ebk-sql] ${options.name}: ${existing ? 'retain' : 'add'} the relational declaration. ` +
40
+ 'The paired upgrade reports Foundation Aurora, private networking/container compute and Slice Drizzle/migration sources. ' +
41
+ 'Existing default-store records, resource identities, capacity, protections and seeded features are preserved. ' +
42
+ 'Aurora/network/container resources can add recurring cost; inspect the generated plan and committed capacity policy before deployment. ' +
43
+ 'This command does not deploy, copy data or retire SQL.');
44
+ return (0, upgrade_js_1.upgradeGenerator)(tree, {
45
+ name: options.name,
46
+ inputs: { ...ownership.value.inputs, sql: declaration },
47
+ apply: options.apply === true,
48
+ skipFormat: options.skipFormat,
49
+ skipInstall: options.skipInstall,
50
+ }, output);
51
+ }
52
+ exports.default = sqlGenerator;
53
+ //# sourceMappingURL=sql.js.map
@@ -0,0 +1,2 @@
1
+ /** Only append required SQL members; never replace an adopter's seeded decisions. */
2
+ export declare function planSqlSeededReconciliation(current: ReadonlyMap<string, string | null>, target: Readonly<Record<string, string>>): Map<string, string>;
@@ -0,0 +1,170 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.planSqlSeededReconciliation = planSqlSeededReconciliation;
4
+ const node_util_1 = require("node:util");
5
+ const ts = require("typescript");
6
+ /** Only append required SQL members; never replace an adopter's seeded decisions. */
7
+ function planSqlSeededReconciliation(current, target) {
8
+ const updates = new Map();
9
+ const read = (path, contents) => {
10
+ const value = JSON.parse(contents);
11
+ if (!value || typeof value !== 'object' || Array.isArray(value))
12
+ throw new Error(`SQL reconciliation requires an object at ${path}.`);
13
+ return value;
14
+ };
15
+ const append = (path, property, key, select, preserveExisting = false, equivalent = node_util_1.isDeepStrictEqual) => {
16
+ const contents = current.get(path);
17
+ if (contents == null)
18
+ return;
19
+ const existing = read(path, contents), desired = read(path, target[path]);
20
+ if (!Array.isArray(existing[property]) || !Array.isArray(desired[property]))
21
+ throw new Error(`SQL reconciliation requires ${path}#/${property}.`);
22
+ let changed = false;
23
+ for (const addition of desired[property].filter(select)) {
24
+ const matches = existing[property].filter((entry) => entry?.[key] === addition[key]);
25
+ if (matches.length > 1 ||
26
+ (matches.length === 1 &&
27
+ !preserveExisting &&
28
+ !equivalent(matches[0], addition)))
29
+ throw new Error(`SQL reconciliation conflict at ${path}: ${addition[key]}. Preserve the customization and reconcile this required declaration explicitly; no files changed.`);
30
+ if (matches.length === 0) {
31
+ existing[property].push(addition);
32
+ changed = true;
33
+ }
34
+ }
35
+ if (changed)
36
+ updates.set(path, JSON.stringify(existing, null, 2) + '\n');
37
+ };
38
+ append('operations/features.json', 'features', 'id', (entry) => entry.id === 'database-lifecycle', true);
39
+ append('secrets/metadata.json', 'declarations', 'logicalName', (entry) => entry.source === 'database-bootstrap', false, (existing, desired) => {
40
+ // Rotation is an adopter decision. Required identity, stage and source
41
+ // bindings still have to agree; never silently overwrite either kind.
42
+ const existingBinding = { ...existing }, desiredBinding = { ...desired };
43
+ delete existingBinding.rotation;
44
+ delete desiredBinding.rotation;
45
+ return (0, node_util_1.isDeepStrictEqual)(existingBinding, desiredBinding);
46
+ });
47
+ append('operations/release.json', 'artifactInventory', 'id', (entry) => typeof entry.id === 'string' &&
48
+ /\.job\.database-(migration|retirement)$/.test(entry.id), true);
49
+ const backgroundPath = 'operations/background-work.json';
50
+ const background = current.get(backgroundPath);
51
+ if (background != null) {
52
+ const existing = read(backgroundPath, background), desired = read(backgroundPath, target[backgroundPath]);
53
+ if (!existing.stages ||
54
+ typeof existing.stages !== 'object' ||
55
+ Array.isArray(existing.stages))
56
+ throw new Error('SQL reconciliation requires declared background-work stages.');
57
+ let changed = false;
58
+ for (const [stage, defaults] of Object.entries(desired.stages)) {
59
+ const settings = existing.stages[stage];
60
+ if (!settings ||
61
+ typeof settings !== 'object' ||
62
+ Array.isArray(settings) ||
63
+ typeof settings.outbox?.enabled !== 'boolean')
64
+ throw new Error(`SQL reconciliation requires the existing ${stage} outbox pause decision.`);
65
+ if (!Object.prototype.hasOwnProperty.call(settings, 'sqlOutboxRecovery')) {
66
+ settings.sqlOutboxRecovery = {
67
+ ...defaults.sqlOutboxRecovery,
68
+ enabled: settings.outbox.enabled,
69
+ };
70
+ changed = true;
71
+ }
72
+ }
73
+ if (changed)
74
+ updates.set(backgroundPath, JSON.stringify(existing, null, 2) + '\n');
75
+ }
76
+ const path = 'secrets/declarations.ts', contents = current.get(path);
77
+ if (contents == null)
78
+ return updates;
79
+ const parse = (source) => {
80
+ const file = ts.createSourceFile(path, source, ts.ScriptTarget.Latest, true);
81
+ const declarations = file.statements
82
+ .flatMap((statement) => ts.isVariableStatement(statement)
83
+ ? [...statement.declarationList.declarations]
84
+ : [])
85
+ .filter((declaration) => ts.isIdentifier(declaration.name) &&
86
+ declaration.name.text === 'SecretDefinitions');
87
+ let expression = declarations.length === 1 ? declarations[0].initializer : undefined;
88
+ while (expression &&
89
+ (ts.isAsExpression(expression) ||
90
+ ts.isSatisfiesExpression(expression) ||
91
+ ts.isParenthesizedExpression(expression)))
92
+ expression = expression.expression;
93
+ if (!expression ||
94
+ !ts.isObjectLiteralExpression(expression) ||
95
+ expression.properties.some((property) => !ts.isPropertyAssignment(property)))
96
+ throw new Error('SQL reconciliation requires a literal SecretDefinitions object without spreads. Preserve custom declarations and add the generated database credential explicitly; no files changed.');
97
+ return {
98
+ file,
99
+ object: expression,
100
+ properties: expression.properties.filter(ts.isPropertyAssignment),
101
+ };
102
+ };
103
+ const existing = parse(contents), desired = parse(target[path]);
104
+ const name = (property) => ts.isIdentifier(property.name) || ts.isStringLiteral(property.name)
105
+ ? property.name.text
106
+ : undefined;
107
+ // Compare syntax, not the printer's retained quote style or trailing commas.
108
+ // Formatting a seeded declaration must not turn an unchanged binding into a
109
+ // conflict. Preserve every expression/operator and literal value in the shape.
110
+ const shape = (node) => {
111
+ if (ts.isStringLiteral(node) ||
112
+ ts.isNumericLiteral(node) ||
113
+ ts.isIdentifier(node))
114
+ return [node.kind, node.text];
115
+ const children = [];
116
+ ts.forEachChild(node, (child) => {
117
+ children.push(shape(child));
118
+ });
119
+ return [node.kind, children.length ? children : node.getText()];
120
+ };
121
+ const additions = [];
122
+ const bindingShape = (property) => {
123
+ const value = property.initializer;
124
+ if (!ts.isObjectLiteralExpression(value))
125
+ return shape(property);
126
+ return value.properties
127
+ .filter((entry) => !ts.isPropertyAssignment(entry) || name(entry) !== 'rotation')
128
+ .map(shape);
129
+ };
130
+ for (const property of desired.properties.filter((entry) => name(entry)?.endsWith('PrimaryDatabaseCredential'))) {
131
+ const matches = existing.properties.filter((entry) => name(entry) === name(property));
132
+ if (matches.length > 1 ||
133
+ (matches.length === 1 &&
134
+ !(0, node_util_1.isDeepStrictEqual)(bindingShape(matches[0]), bindingShape(property))))
135
+ throw new Error(`SQL reconciliation conflict at ${path}: ${name(property)}. No files changed.`);
136
+ if (!matches.length)
137
+ additions.push(property.getText(desired.file));
138
+ }
139
+ if (additions.length) {
140
+ // Use AST offsets so unrelated declarations, comments and feature code remain byte-for-byte intact.
141
+ const end = existing.object.end - 1;
142
+ const comma = existing.properties.length && !existing.object.properties.hasTrailingComma
143
+ ? ','
144
+ : '';
145
+ let result = contents.slice(0, end) +
146
+ comma +
147
+ '\n' +
148
+ additions.join(',\n') +
149
+ ',\n' +
150
+ contents.slice(end);
151
+ const imports = existing.file.statements.filter(ts.isImportDeclaration);
152
+ const schemaImport = imports.some((entry) => ts.isStringLiteral(entry.moduleSpecifier) &&
153
+ entry.moduleSpecifier.text === '@empire-builder-kit/runtime/database' &&
154
+ entry.importClause?.namedBindings &&
155
+ ts.isNamedImports(entry.importClause.namedBindings) &&
156
+ entry.importClause.namedBindings.elements.some((binding) => binding.name.text === 'databaseCredentialSecretSchema' &&
157
+ (!binding.propertyName ||
158
+ binding.propertyName.text === 'databaseCredentialSecretSchema')));
159
+ if (!schemaImport) {
160
+ if (/\bdatabaseCredentialSecretSchema\b/.test(contents))
161
+ throw new Error(`SQL reconciliation conflict at ${path}: databaseCredentialSecretSchema is already bound. No files changed.`);
162
+ result =
163
+ "import { databaseCredentialSecretSchema } from '@empire-builder-kit/runtime/database';\n" +
164
+ result;
165
+ }
166
+ updates.set(path, result);
167
+ }
168
+ return updates;
169
+ }
170
+ //# sourceMappingURL=sql-seeded-reconciliation.js.map
@@ -55,7 +55,7 @@ export interface UpgradeReport {
55
55
  }
56
56
  export interface SeededReconciliationWork {
57
57
  adopterContentSha256: string;
58
- category: 'async-adapter' | 'async-settings' | 'configuration-contract' | 'configuration-values' | 'feature-controls' | 'frontend-contract' | 'frontend-security' | 'performance-aggregate-provider' | 'performance-policy' | 'reliability-operations' | 'reliability-slo' | 'release-controls';
58
+ category: 'async-adapter' | 'async-settings' | 'configuration-contract' | 'configuration-values' | 'feature-controls' | 'frontend-contract' | 'frontend-security' | 'performance-aggregate-provider' | 'performance-policy' | 'reliability-operations' | 'reliability-slo' | 'release-controls' | 'secret-contract';
59
59
  currentFrameworkSha256: string | null;
60
60
  implications: string[];
61
61
  markerReference: 'PLAN:5.6/seeded-upgrade-reconciliation';
@@ -71,7 +71,21 @@ interface JsonOwnershipChanges {
71
71
  }
72
72
  type OwnershipPaths = Pick<GeneratedOwnershipRecord, 'paths'>;
73
73
  export declare function preserveCompositionRegions(current: string, target: string): string;
74
+ /**
75
+ * Re-emits every recorded composition into the managed native runtime
76
+ * authority regions of a regenerated Product Slice. Region preservation only
77
+ * carries a body when the current file exposes the same-named markers, so a
78
+ * Slice whose compositions predate the native-runtime-authority region names
79
+ * (or whose regions were emptied by an earlier managed upgrade) would
80
+ * otherwise lose the recorded workload authority. The recorded compositions in
81
+ * `.ebk/ownership.json` are the source of truth; compositions already present
82
+ * in a region are left untouched so a second apply is byte-stable.
83
+ * (EBK-INT-2026-070)
84
+ */
85
+ export declare function reemitRecordedNativeRuntimeCompositions(files: Readonly<Record<string, string>>, ownership: Pick<GeneratedOwnershipRecord, 'compositions'>): Readonly<Record<string, string>>;
74
86
  export declare function inspectWorkspaceSstVersion(tree: Tree, packageJson: WorkspacePackageJson): WorkspaceSstVersionState;
75
87
  export declare function createUpgradeReport(currentFiles: ReadonlyMap<string, string | null>, currentOwnership: OwnershipPaths, targetFiles: ReadonlyMap<string, string>, targetOwnership: OwnershipPaths, jsonOwnershipChanges?: JsonOwnershipChanges): UpgradeReport;
88
+ /** Internal paired-generation path: the ordinary ownership-preserving upgrader owns Foundation writes. */
89
+ export declare function upgradeFoundationForRequirements(tree: Tree, requirements: readonly unknown[], apply: boolean, output?: UpgradeGeneratorLogger): Promise<void>;
76
90
  export declare function upgradeGenerator(tree: Tree, options: UpgradeGeneratorSchema, output?: UpgradeGeneratorLogger, executionOptions?: UpgradeGeneratorExecutionOptions): Promise<GeneratorCallback | void>;
77
91
  export default upgradeGenerator;