@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/repository-policy/repository-policy.js

@@ -2,7 +2,39 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.repositoryPolicyGenerator = repositoryPolicyGenerator;
 const devkit_1 = require("@nx/devkit");
+const node_buffer_1 = require("node:buffer");
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
 const index_js_1 = require("../../repository-policy/index.js");
+const index_js_2 = require("../../workspace-deployment/index.js");
+const SEEDED_ROUTER_WAF_POLICY_PATH = 'packages/foundation/security/router-waf.json';
+const SEEDED_PROFILE_GUIDANCE = 'Review adopter-owned README.md, AGENTS.md, docs/architecture.md, docs/developer-agent.md, docs/repository-operating-policy.md, Foundation README/runbooks/security/costs guidance, and packages/foundation/performance/account-cost-policy.json after changing profile.';
+function staleSeededRouterWafDiagnostic(tree, profile) {
+    const source = tree.read(SEEDED_ROUTER_WAF_POLICY_PATH, 'utf8');
+    if (source === null)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        value = null;
+    }
+    const policy = value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+    const stages = policy?.stages !== null &&
+        typeof policy?.stages === 'object' &&
+        !Array.isArray(policy.stages)
+        ? Object.keys(policy.stages).sort()
+        : null;
+    const expectedStages = [...(0, index_js_1.activeDeploymentStages)(profile)].sort();
+    if (policy?.deploymentProfile === profile &&
+        JSON.stringify(stages) === JSON.stringify(expectedStages)) {
+        return null;
+    }
+    return `The seeded ${SEEDED_ROUTER_WAF_POLICY_PATH} still has a different deployment profile or stage set. Before applying this topology change, update that adopter-owned policy to ${profile} with exactly ${expectedStages.join(', ')} stages, preserving reviewed CIDRs and WAF settings. Then rerun repository-policy --apply, managed workspace/Foundation upgrades, and foundation:verify. Review profile-dependent seeded guidance before protected deployment; EBK will not overwrite it.`;
+}
 function sliceStatusFor(options) {
     if (options.status)
         return options.status;
@@ -18,6 +50,37 @@ function createChange(options) {
         throw new Error('--status requires at least one Product Slice in --slices.');
     }
     const change = {
+        ...([
+            options.developmentAccountId,
+            options.stagingAccountId,
+            options.productionAccountId,
+        ].some((value) => value !== undefined)
+            ? {
+                deploymentAccounts: {
+                    ...(options.developmentAccountId !== undefined
+                        ? {
+                            development: (0, index_js_1.normalizeDeploymentAccountId)(options.developmentAccountId, 'Development deployment account'),
+                        }
+                        : {}),
+                    ...(options.stagingAccountId !== undefined
+                        ? {
+                            staging: (0, index_js_1.normalizeDeploymentAccountId)(options.stagingAccountId, 'Staging deployment account'),
+                        }
+                        : {}),
+                    ...(options.productionAccountId !== undefined
+                        ? {
+                            production: (0, index_js_1.normalizeDeploymentAccountId)(options.productionAccountId, 'Production deployment account'),
+                        }
+                        : {}),
+                },
+            }
+            : {}),
+        ...(options.deploymentProfile
+            ? { deploymentProfile: options.deploymentProfile }
+            : {}),
+        ...(options.deploymentRegion
+            ? { deploymentRegion: options.deploymentRegion }
+            : {}),
         ...(options.preset ? { preset: options.preset } : {}),
         ...(options.productionAccess
             ? { productionAccess: options.productionAccess }
@@ -25,6 +88,7 @@ function createChange(options) {
         ...(options.productionApprovalMode
             ? { productionApprovalMode: options.productionApprovalMode }
             : {}),
+        ...(options.deliveryLane ? { deliveryLane: options.deliveryLane } : {}),
         ...(options.profile
             ? { productionFoundationProfile: options.profile }
             : {}),
@@ -34,25 +98,191 @@ function createChange(options) {
             }
             : {}),
     };
-    if (Object.keys(change).length === 0) {
-        throw new Error('Repository policy command requires --preset, --productionAccess, --productionApprovalMode, --profile, or --slices.');
+    if (Object.keys(change).length === 0 &&
+        options.workspaceDeploymentId === undefined &&
+        options.workspaceDeploymentMigrationEvidence === undefined) {
+        throw new Error('Repository policy command requires --deploymentProfile, --deploymentRegion, an exact stage account ID, --preset, --productionAccess, --productionApprovalMode, --profile, or --slices.');
     }
     return change;
 }
+function deploymentTopologyChanged(current, next) {
+    return (current.deploymentProfile !== next.deploymentProfile ||
+        current.deploymentRegion !== next.deploymentRegion ||
+        JSON.stringify(current.deploymentAccounts) !==
+            JSON.stringify(next.deploymentAccounts));
+}
+function migrationEvidenceInput(tree, requestedPath) {
+    const evidencePath = node_path_1.posix.normalize(requestedPath);
+    if ((0, node_path_1.isAbsolute)(evidencePath) ||
+        evidencePath.includes('\0') ||
+        evidencePath === '..' ||
+        evidencePath.startsWith('../') ||
+        !evidencePath.startsWith('docs/adoption/')) {
+        throw new Error('Workspace deployment migration evidence must remain under docs/adoption in the workspace.');
+    }
+    const evidenceBytes = tree.read(evidencePath, 'utf8');
+    const packageBytes = tree.read('package.json', 'utf8');
+    if (evidenceBytes === null || packageBytes === null) {
+        throw new Error('Workspace deployment migration requires committed evidence and the generated root package manifest.');
+    }
+    if (node_buffer_1.Buffer.byteLength(evidenceBytes, 'utf8') > 131_072) {
+        throw new Error('Workspace deployment migration evidence exceeds the 128 KiB retention bound.');
+    }
+    let evidence;
+    let workspaceName;
+    try {
+        evidence = JSON.parse(evidenceBytes);
+        workspaceName = JSON.parse(packageBytes).name;
+    }
+    catch {
+        throw new Error('Workspace deployment migration evidence and root package manifest must be valid JSON.');
+    }
+    if (typeof workspaceName !== 'string') {
+        throw new Error('Workspace deployment migration requires one exact generated root package name.');
+    }
+    return { evidence, evidenceBytes, evidencePath, workspaceName };
+}
+function validateCurrentMigrationBinding(tree, policy) {
+    if (policy.workspaceDeploymentProvenance.kind !== 'migrated')
+        return;
+    const input = migrationEvidenceInput(tree, policy.workspaceDeploymentProvenance.evidencePath);
+    const actualDigest = (0, node_crypto_1.createHash)('sha256')
+        .update(input.evidenceBytes, 'utf8')
+        .digest('hex');
+    if (actualDigest !== policy.workspaceDeploymentProvenance.evidenceSha256) {
+        throw new Error('Workspace deployment migration evidence does not match the committed SHA-256 binding.');
+    }
+    (0, index_js_1.validateRepositoryOperatingPolicyMigrationProvenance)({
+        evidenceBytes: input.evidenceBytes,
+        evidenceSource: input.evidencePath,
+        policy,
+    });
+}
+function applyMigrationTopology(legacy, change) {
+    const existingAccounts = legacy.deploymentAccounts !== null &&
+        typeof legacy.deploymentAccounts === 'object' &&
+        !Array.isArray(legacy.deploymentAccounts)
+        ? legacy.deploymentAccounts
+        : {};
+    const deploymentProfile = change.deploymentProfile ?? legacy.deploymentProfile;
+    const deploymentAccounts = {
+        ...existingAccounts,
+        ...(deploymentProfile === 'starter' ? { staging: null } : {}),
+        ...change.deploymentAccounts,
+    };
+    return {
+        ...legacy,
+        deploymentAccounts,
+        ...(change.deploymentProfile !== undefined
+            ? { deploymentProfile: change.deploymentProfile }
+            : {}),
+        ...(change.deploymentRegion !== undefined
+            ? { deploymentRegion: change.deploymentRegion }
+            : {}),
+    };
+}
 async function repositoryPolicyGenerator(tree, options) {
     const contents = tree.read(index_js_1.REPOSITORY_POLICY_FILE, 'utf8');
     if (contents === null) {
         throw new Error(`Repository Operating Policy is missing at ${index_js_1.REPOSITORY_POLICY_FILE}. Apply the workspace upgrade before changing policy decisions.`);
     }
     const change = createChange(options);
-    const current = (0, index_js_1.parseRepositoryOperatingPolicy)(contents, index_js_1.REPOSITORY_POLICY_FILE);
-    const next = (0, index_js_1.applyRepositoryPolicyChange)(current, change);
-    const changed = JSON.stringify(current) !== JSON.stringify(next);
+    let migratedLegacyDeploymentProfile = false;
+    let migratedWorkspaceDeploymentIdentity = false;
+    let current;
+    try {
+        current = (0, index_js_1.parseRepositoryOperatingPolicy)(contents, index_js_1.REPOSITORY_POLICY_FILE);
+    }
+    catch (error) {
+        let legacy;
+        try {
+            legacy = JSON.parse(contents);
+        }
+        catch {
+            throw error;
+        }
+        const explicitProfileMigration = options.deploymentProfile;
+        if (!Object.prototype.hasOwnProperty.call(legacy, 'deploymentProfile')) {
+            if (explicitProfileMigration !== 'fully-isolated' ||
+                !index_js_1.DEPLOYMENT_PROFILES.includes(explicitProfileMigration)) {
+                throw error;
+            }
+            legacy = {
+                ...legacy,
+                deploymentAccounts: {
+                    development: null,
+                    production: null,
+                    staging: null,
+                },
+                deploymentProfile: explicitProfileMigration,
+                deploymentRegion: null,
+            };
+            migratedLegacyDeploymentProfile = true;
+        }
+        if (!options.workspaceDeploymentId ||
+            !options.workspaceDeploymentMigrationEvidence) {
+            throw new Error(`${error instanceof Error ? error.message : String(error)} Existing prerelease workspaces must explicitly migrate a stable workspace deployment identity with bounded occupancy evidence.`);
+        }
+        const input = migrationEvidenceInput(tree, options.workspaceDeploymentMigrationEvidence);
+        current = (0, index_js_2.migrateRepositoryPolicyWorkspaceDeploymentIdentity)({
+            evidence: input.evidence,
+            evidenceBytes: input.evidenceBytes,
+            evidencePath: input.evidencePath,
+            legacyPolicy: applyMigrationTopology(legacy, change),
+            previousPolicyBytes: contents,
+            sourceLabel: index_js_1.REPOSITORY_POLICY_FILE,
+            workspaceDeploymentId: options.workspaceDeploymentId,
+            workspaceName: input.workspaceName,
+        });
+        migratedWorkspaceDeploymentIdentity = true;
+    }
+    if (!migratedWorkspaceDeploymentIdentity) {
+        validateCurrentMigrationBinding(tree, current);
+    }
+    if (!migratedWorkspaceDeploymentIdentity &&
+        options.workspaceDeploymentId !== undefined) {
+        throw new Error('Workspace deployment identity is already committed and cannot be replaced or re-migrated.');
+    }
+    let next = (0, index_js_1.applyRepositoryPolicyChange)(current, change);
+    if (!migratedWorkspaceDeploymentIdentity &&
+        current.workspaceDeploymentProvenance.kind === 'migrated' &&
+        deploymentTopologyChanged(current, next)) {
+        if (!options.workspaceDeploymentMigrationEvidence) {
+            throw new Error('A migrated workspace topology change requires new versioned workspace-deployment evidence.');
+        }
+        const input = migrationEvidenceInput(tree, options.workspaceDeploymentMigrationEvidence);
+        next = (0, index_js_2.renewRepositoryPolicyWorkspaceDeploymentMigration)({
+            evidence: input.evidence,
+            evidenceBytes: input.evidenceBytes,
+            evidencePath: input.evidencePath,
+            previousEvidencePath: current.workspaceDeploymentProvenance.evidencePath,
+            previousPolicyBytes: contents,
+            proposedPolicy: next,
+            sourceLabel: index_js_1.REPOSITORY_POLICY_FILE,
+            workspaceName: input.workspaceName,
+        });
+    }
+    else if (!migratedWorkspaceDeploymentIdentity &&
+        options.workspaceDeploymentMigrationEvidence !== undefined) {
+        throw new Error('--workspaceDeploymentMigrationEvidence is accepted only for an explicit prerelease migration or a migrated workspace topology change.');
+    }
+    const changed = migratedLegacyDeploymentProfile ||
+        migratedWorkspaceDeploymentIdentity ||
+        JSON.stringify(current) !== JSON.stringify(next);
     devkit_1.logger.info(`[ebk-repository-policy] ${options.apply ? 'apply requested' : 'report only'}\n${JSON.stringify({
         changed,
         current,
         next,
     }, null, 2)}\nPolicy source changes do not deploy, remove, or alter AWS resources.`);
+    if (current.deploymentProfile !== next.deploymentProfile) {
+        devkit_1.logger.warn(`[ebk-repository-policy] ${SEEDED_PROFILE_GUIDANCE}`);
+        const diagnostic = staleSeededRouterWafDiagnostic(tree, next.deploymentProfile);
+        if (diagnostic !== null) {
+            if (options.apply)
+                throw new Error(diagnostic);
+            devkit_1.logger.warn(`[ebk-repository-policy] ${diagnostic}`);
+        }
+    }
     if (!options.apply || !changed)
         return;
     tree.write(index_js_1.REPOSITORY_POLICY_FILE, `${JSON.stringify(next, null, 2)}\n`);

package/src/generators/repository-policy/schema.d.ts

@@ -1,4 +1,6 @@
 import type {
+  DeliveryLane,
+  DeploymentProfile,
   ProductionAccess,
   ProductionApprovalMode,
   ProductionFoundationProfile,
@@ -8,11 +10,19 @@ import type {
 
 export interface RepositoryPolicyGeneratorSchema {
   apply?: boolean;
+  developmentAccountId?: string | number;
+  deploymentProfile?: DeploymentProfile;
+  deploymentRegion?: string;
   preset?: RepositoryModePreset;
   productionAccess?: ProductionAccess;
+  deliveryLane?: DeliveryLane;
   productionApprovalMode?: ProductionApprovalMode;
   profile?: ProductionFoundationProfile;
+  productionAccountId?: string | number;
   skipFormat?: boolean;
   slices?: string[];
   status?: SliceProductionStatus;
+  stagingAccountId?: string | number;
+  workspaceDeploymentId?: string;
+  workspaceDeploymentMigrationEvidence?: string;
 }

package/src/generators/repository-policy/schema.json

@@ -5,6 +5,71 @@
   "type": "object",
   "additionalProperties": false,
   "properties": {
+    "deploymentProfile": {
+      "type": "string",
+      "enum": ["starter", "production-isolated", "fully-isolated"],
+      "description": "AWS account and deployment-authority topology. Existing prerelease repositories must explicitly select fully-isolated before upgrading."
+    },
+    "deploymentRegion": {
+      "type": "string",
+      "pattern": "^(?!(us-iso-|us-isob-|eu-isoe-|us-isof-))[a-z]{2}(-gov)?-[a-z]+(-[a-z]+)*-[0-9]$",
+      "description": "Exact shared AWS Region for all canonical stages."
+    },
+    "developmentAccountId": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^[0-9]{12}$"
+        },
+        {
+          "type": "number",
+          "minimum": 100000000000,
+          "maximum": 999999999999,
+          "multipleOf": 1
+        }
+      ],
+      "description": "Exact development AWS account ID committed as non-secret deployment topology."
+    },
+    "stagingAccountId": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^[0-9]{12}$"
+        },
+        {
+          "type": "number",
+          "minimum": 100000000000,
+          "maximum": 999999999999,
+          "multipleOf": 1
+        }
+      ],
+      "description": "Exact staging AWS account ID committed as non-secret deployment topology."
+    },
+    "workspaceDeploymentId": {
+      "type": "string",
+      "pattern": "^ebkws-[a-f0-9]{32}$",
+      "description": "Exact stable generated workspace deployment identity. Accepted only with explicit migration evidence when upgrading an existing prerelease policy."
+    },
+    "workspaceDeploymentMigrationEvidence": {
+      "type": "string",
+      "pattern": "^docs/adoption/[A-Za-z0-9._/-]+[.]json$",
+      "description": "Version-controlled bounded occupancy evidence for explicitly adopting existing AWS tuples."
+    },
+    "productionAccountId": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^[0-9]{12}$"
+        },
+        {
+          "type": "number",
+          "minimum": 100000000000,
+          "maximum": 999999999999,
+          "multipleOf": 1
+        }
+      ],
+      "description": "Exact production AWS account ID committed as non-secret deployment topology."
+    },
     "preset": {
       "type": "string",
       "enum": ["incubation", "controlled-production", "operational"],
@@ -17,17 +82,25 @@
     },
     "productionApprovalMode": {
       "type": "string",
-      "enum": ["promotion-pr", "environment-reviewer"],
+      "enum": ["promotion-pr", "environment-reviewer", "trunk-promotion"],
       "description": "Explicit production authorization mechanism. promotion-pr is compatible with private repositories on GitHub Team; environment-reviewer requires plan support for private environment reviewers."
     },
+    "deliveryLane": {
+      "type": "string",
+      "enum": ["protected-pair", "trunk"],
+      "description": "How work reaches production. protected-pair (default) keeps develop and main with a promotion pull request and sync-back; trunk protects main alone and deploys production from every merged main push (starter profile only)."
+    },
     "profile": {
       "type": "string",
-      "enum": ["cost-optimized", "standard"],
+      "enum": ["cost-optimized", "balanced", "standard"],
       "description": "Explicit shared production Foundation profile."
     },
     "slices": {
       "type": "array",
-      "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]*$" },
+      "items": {
+        "type": "string",
+        "pattern": "^[a-z0-9][a-z0-9-]*$"
+      },
       "uniqueItems": true,
       "description": "Product Slices whose explicit production status should be added or changed."
     },
@@ -41,6 +114,9 @@
       "description": "Write the reported source change. The default is report-only and never touches AWS or GitHub.",
       "default": false
     },
-    "skipFormat": { "type": "boolean", "default": false }
+    "skipFormat": {
+      "type": "boolean",
+      "default": false
+    }
   }
 }

package/src/generators/repository-policy/tree-policy.d.ts

@@ -0,0 +1,3 @@
+import type { Tree } from '@nx/devkit';
+import { type RepositoryOperatingPolicy } from '../../repository-policy/index.js';
+export declare function readRepositoryOperatingPolicyFromTree(tree: Tree): RepositoryOperatingPolicy;

package/src/generators/repository-policy/tree-policy.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readRepositoryOperatingPolicyFromTree = readRepositoryOperatingPolicyFromTree;
+const index_js_1 = require("../../repository-policy/index.js");
+function readRepositoryOperatingPolicyFromTree(tree) {
+    const contents = tree.read(index_js_1.REPOSITORY_POLICY_FILE, 'utf8');
+    if (contents === null) {
+        throw new Error(`${index_js_1.REPOSITORY_POLICY_FILE} is required before profile-dependent generation or upgrade work.`);
+    }
+    const policy = (0, index_js_1.parseRepositoryOperatingPolicy)(contents, index_js_1.REPOSITORY_POLICY_FILE);
+    if (policy.workspaceDeploymentProvenance.kind === 'migrated') {
+        const evidencePath = policy.workspaceDeploymentProvenance.evidencePath;
+        const evidenceBytes = tree.read(evidencePath, 'utf8');
+        if (evidenceBytes === null) {
+            throw new Error(`Workspace deployment migration evidence is required at ${evidencePath}.`);
+        }
+        (0, index_js_1.validateRepositoryOperatingPolicyMigrationProvenance)({
+            evidenceBytes,
+            evidenceSource: evidencePath,
+            policy,
+        });
+    }
+    return policy;
+}
+//# sourceMappingURL=tree-policy.js.map

package/src/generators/slice/built-in-plan-api-contract-files.js

@@ -4,6 +4,38 @@ exports.renderProductApiContractFiles = renderProductApiContractFiles;
 const api_contract_1 = require("@empire-builder-kit/runtime/api-contract");
 const index_js_1 = require("../../api-contract/index.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const local_source_identity_js_1 = require("./local-source-identity.js");
+// Shared by the machine-readable contract and the generated operation source.
+const KEY_VALUE_RECORD_PROBLEMS = [
+    {
+        code: 'record_input_invalid',
+        message: 'Record input is invalid.',
+        retryable: false,
+        status: 400,
+        type: 'https://empirebuilderkit.dev/problems/records/input-invalid',
+    },
+    {
+        code: 'record_idempotency_conflict',
+        message: 'The mutation receipt does not match this exact request.',
+        retryable: false,
+        status: 409,
+        type: 'https://empirebuilderkit.dev/problems/records/idempotency-conflict',
+    },
+    {
+        code: 'record_write_conflict',
+        message: 'The record changed concurrently; retry the request.',
+        retryable: true,
+        status: 409,
+        type: 'https://empirebuilderkit.dev/problems/records/write-conflict',
+    },
+    {
+        code: 'record_not_found',
+        message: 'The record was not found.',
+        retryable: false,
+        status: 404,
+        type: 'https://empirebuilderkit.dev/problems/records/not-found',
+    },
+];
 function createStandardApiContract(name, pascalName) {
     const authenticationProblems = [
         {
@@ -68,6 +100,7 @@ function createStandardApiContract(name, pascalName) {
     ];
     const recordConflictProblems = [
         ...authorizationProblems,
+        ...KEY_VALUE_RECORD_PROBLEMS,
         {
             code: 'record_conflict',
             message: 'The record identifier is owned by another principal.',
@@ -232,6 +265,7 @@ function createStandardApiContract(name, pascalName) {
         },
     ];
     const retentionProblems = [
+        ...authorizationProblems,
         {
             code: 'data_retention_approval_invalid',
             message: 'The retention approval is invalid for this report.',
@@ -782,6 +816,7 @@ function createStandardApiContract(name, pascalName) {
             body: (0, api_contract_1.apiObject)({
                 deleted: (0, api_contract_1.apiBoolean)(),
                 id: (0, api_contract_1.apiString)({ format: 'uuid' }),
+                deliveryPending: (0, api_contract_1.apiOptional)((0, api_contract_1.apiBoolean)()),
             }),
             status: 200,
         },
@@ -995,6 +1030,7 @@ const authorizationProblems = [
 
 const recordConflictProblems = [
   ...authorizationProblems,
+  ...${JSON.stringify(KEY_VALUE_RECORD_PROBLEMS, null, 2)},
   {
     code: 'record_conflict',
     message: 'The record identifier is owned by another principal.',
@@ -1166,6 +1202,7 @@ const dataRightsProblems = [
 ] as const;
 
 const retentionProblems = [
+  ...authorizationProblems,
   {
     code: 'data_retention_approval_invalid',
     message: 'The retention approval is invalid for this report.',
@@ -1766,6 +1803,7 @@ export const ${identifierPrefix}DeleteRecord = defineApiOperation({
     body: apiObject({
       deleted: apiBoolean(),
       id: apiString({ format: 'uuid' }),
+      deliveryPending: apiOptional(apiBoolean()),
     }),
     status: 200,
   },
@@ -1979,10 +2017,13 @@ An intentional baseline update requires a reviewed JSON approval:
 pnpm nx run ${name}:api-contract-baseline -- --approval=path/to/approval.json
 \`\`\`
 
-Compatible approvals pin the exact candidate digest and reason. Conditional
-approvals also require semantic-review evidence. Breaking approvals require
-consumer evidence, rollout evidence, and an exact rollout-plan identity and
-digest. Baseline updates never occur during generation or verification.
+An agent may author the approval file. Compatible approvals pin the exact
+candidate digest and reason, and the agent may apply them directly during
+development. Conditional approvals also require semantic-review evidence, and
+breaking approvals require consumer evidence, rollout evidence, and an exact
+rollout-plan identity and digest; a human reviews those two classes before the
+baseline command runs. Baseline updates never occur during generation or
+verification.
 
 Other Slices may import only \`@<workspace>/${name}/api-contract\`,
 \`@<workspace>/${name}/api-client\`, or the transport-neutral
@@ -2349,7 +2390,7 @@ if (action === 'check') {
 }
 `,
         'scripts/api-contract.mjs': `import { createHash } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
 import {
   mkdirSync,
   readFileSync,
@@ -2395,13 +2436,10 @@ const action = process.argv[2] ?? 'check';
 const digest = (contents) =>
   'sha256:' + createHash('sha256').update(contents).digest('hex');
 
+${local_source_identity_js_1.localSourceCommitFunction}
+
 function sourceIdentity() {
-  const commit =
-    process.env.EBK_SOURCE_COMMIT ??
-    execFileSync('git', ['rev-parse', 'HEAD'], {
-      cwd: workspaceRoot,
-      encoding: 'utf8',
-    }).trim();
+  const commit = localSourceCommit();
   const frameworkCandidate =
     workspacePackage.dependencies?.['@empire-builder-kit/runtime'];
   if (typeof frameworkCandidate !== 'string' || !frameworkCandidate) {

package/src/generators/slice/built-in-plan-api-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderProductApiFiles(name: string, pascalName: string, workspace: string): Readonly<Record<string, string>>;
+export declare function renderProductApiFiles(name: string, pascalName: string, workspace: string, sql?: boolean): Readonly<Record<string, string>>;