@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-data-files.js

@@ -8,7 +8,7 @@ function snapshotColumn(name, type, options = {}) {
         type,
         primaryKey: options.primaryKey ?? false,
         notNull: options.notNull ?? true,
-        ...(options.default ? { default: options.default } : {}),
+        ...(options.default === undefined ? {} : { default: options.default }),
     };
 }
 function snapshotTable(name, columns, uniqueConstraints = {}, compositePrimaryKeys = {}, indexes = {}, foreignKeys = {}) {
@@ -25,25 +25,12 @@ function snapshotTable(name, columns, uniqueConstraints = {}, compositePrimaryKe
         isRLSEnabled: false,
     };
 }
-function snapshotIndex(name, columns) {
-    return {
-        columns: columns.map(({ expression, opclass }) => ({
-            asc: true,
-            expression,
-            isExpression: false,
-            nulls: 'last',
-            opclass,
-        })),
-        concurrently: false,
-        isUnique: false,
-        method: 'btree',
-        name,
-        with: {},
-    };
-}
 /** @internal */
-function renderProductDataFiles(name, pascalName) {
-    return {
+function renderProductDataFiles(name, pascalName, protectedRuntimeStages = ['staging', 'production'], sql = true) {
+    const databaseStages = [
+        ...new Set(['development', ...protectedRuntimeStages]),
+    ];
+    const files = {
         'contracts/events.ts': `import type { DataLifecycleChangeEventV1 } from '@empire-builder-kit/runtime/data-lifecycle';
 
 export interface ${pascalName}CreatedData {
@@ -96,219 +83,13 @@ export const EventContractSchema = {
   slice: '${name}',
 } as const;
 `,
-        'database/schema.ts': `import { boolean, index, integer, jsonb, pgTable, primaryKey, text, timestamp, uuid } from 'drizzle-orm/pg-core';
-
-export const records = pgTable(
-  'records',
-  {
-    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
-    id: uuid('id').defaultRandom().primaryKey(),
-    lastActivityAt: timestamp('last_activity_at', { withTimezone: true }).defaultNow().notNull(),
-    name: text('name').notNull(),
-    ownerId: text('owner_id').notNull(),
-    runScope: text('run_scope').notNull(),
-    testExpiresAt: timestamp('test_expires_at', { withTimezone: true }),
-  },
-  (table) => [
-    index('records_performance_expiry_idx').on(
-      table.ownerId,
-      table.name,
-      table.testExpiresAt,
-    ),
-    index('records_performance_run_scope_idx').on(
-      table.ownerId,
-      table.name,
-      table.runScope,
-    ),
-  ],
-);
-
-export const authorizationAudit = pgTable('authorization_audit', {
-  action: text('action').notNull(),
-  approvalReference: text('approval_reference'),
-  authorityMode: text('authority_mode').notNull(),
-  correlationId: text('correlation_id').notNull(),
-  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
-  decision: text('decision').notNull(),
-  id: uuid('id').defaultRandom().primaryKey(),
-  policyVersion: text('policy_version').notNull(),
-  principalKind: text('principal_kind').notNull(),
-  pseudonymousSubjectId: text('pseudonymous_subject_id').notNull(),
-  reasonCategory: text('reason_category').notNull(),
-  delegationReference: text('delegation_reference'),
-  resourceReference: text('resource_reference'),
-  resourceType: text('resource_type').notNull(),
-  slice: text('slice').notNull(),
-  stage: text('stage').notNull(),
-  subjectType: text('subject_type').notNull(),
-});
-
-export const delegationGrants = pgTable('delegation_grants', {
-  capabilityDigest: text('capability_digest').notNull(),
-  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
-  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-  grantJson: jsonb('grant_json').notNull(),
-  id: uuid('id').primaryKey(),
-  issuedAt: timestamp('issued_at', { withTimezone: true }).notNull(),
-  policyVersion: text('policy_version').notNull(),
-  revision: integer('revision').notNull(),
-  status: text('status').notNull(),
-});
-
-export const approvalRequests = pgTable('approval_requests', {
-  authorReference: text('author_reference').notNull(),
-  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
-  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-  id: uuid('id').primaryKey(),
-  policyVersion: text('policy_version').notNull(),
-  requestJson: jsonb('request_json').notNull(),
-  requestDigest: text('request_digest').notNull(),
-  revision: integer('revision').notNull(),
-  status: text('status').notNull(),
-});
-
-export const dataLifecycleAudit = pgTable(
-  'data_lifecycle_audit',
-  {
-    action: text('action').notNull(),
-    actorRef: text('actor_ref').notNull(),
-    approvalReference: text('approval_reference'),
-    auditJson: jsonb('audit_json').notNull(),
-    authorityCode: text('authority_code').notNull(),
-    correlationRef: text('correlation_ref').notNull(),
-    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-    id: uuid('id').defaultRandom().primaryKey(),
-    occurredAt: timestamp('occurred_at', { withTimezone: true }).notNull(),
-    outcome: text('outcome').notNull(),
-    policyVersion: text('policy_version').notNull(),
-    principalKind: text('principal_kind').notNull(),
-    purposeCode: text('purpose_code').notNull(),
-    resourceReference: text('resource_reference'),
-    slice: text('slice').notNull(),
-    stage: text('stage').notNull(),
-    subjectType: text('subject_type').notNull(),
-    targetCategoryId: text('target_category_id').notNull(),
-  },
-  (table) => [
-    index('data_lifecycle_audit_expires_at_idx').on(table.expiresAt),
-  ],
-);
-
-export const dataLifecycleExportArtifacts = pgTable(
-  'data_lifecycle_export_artifacts',
-  {
-    approvalRequestId: uuid('approval_request_id')
-      .primaryKey()
-      .references(() => approvalRequests.id, { onDelete: 'cascade' }),
-    artifactRef: text('artifact_ref'),
-    cleanupDeadlineAt: timestamp('cleanup_deadline_at', {
-      withTimezone: true,
-    }),
-    cleanupState: text('cleanup_state').notNull(),
-    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
-    currentVersionId: text('current_version_id'),
-    expiresAt: timestamp('expires_at', { withTimezone: true }),
-    lastErrorCode: text('last_error_code'),
-    objectKey: text('object_key').notNull(),
-    recordRef: text('record_ref').notNull(),
-    subjectRef: text('subject_ref').notNull(),
-    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
-    uploadStartedAt: timestamp('upload_started_at', { withTimezone: true }),
-  },
-  (table) => [
-    index('data_lifecycle_export_artifacts_subject_created_idx').on(
-      table.subjectRef,
-      table.createdAt,
-    ),
-    index('data_lifecycle_export_artifacts_cleanup_expiry_idx').on(
-      table.cleanupState,
-      table.expiresAt,
-    ),
-    index('data_lifecycle_export_artifacts_cleanup_deadline_idx').on(
-      table.cleanupState,
-      table.cleanupDeadlineAt,
-    ),
-  ],
-);
-
-export const dataLifecycleExportVersions = pgTable(
-  'data_lifecycle_export_versions',
-  {
-    approvalRequestId: uuid('approval_request_id')
-      .notNull()
-      .references(() => approvalRequests.id, { onDelete: 'cascade' }),
-    deletedAt: timestamp('deleted_at', { withTimezone: true }),
-    isDeleteMarker: boolean('is_delete_marker').notNull(),
-    objectKey: text('object_key').notNull(),
-    status: text('status').notNull(),
-    versionId: text('version_id').notNull(),
-  },
-  (table) => [
-    primaryKey({
-      columns: [table.approvalRequestId, table.versionId],
-    }),
-    index('data_lifecycle_export_versions_status_idx').on(table.status),
-  ],
-);
-
-export const cleanupDeadlineReportCapacity = pgTable(
-  'cleanup_deadline_report_capacity',
-  {
-    feature: text('feature').primaryKey(),
-    maximumPending: integer('maximum_pending').notNull(),
-  },
-);
-
-export const cleanupDeadlineReports = pgTable(
-  'cleanup_deadline_reports',
-  {
-    deadlineAt: timestamp('deadline_at', { withTimezone: true }).notNull(),
-    feature: text('feature').notNull(),
-    observedAt: timestamp('observed_at', { withTimezone: true })
-      .defaultNow()
-      .notNull(),
-    resourceRef: text('resource_ref').notNull(),
-  },
-  (table) => [
-    primaryKey({ columns: [table.feature, table.resourceRef] }),
-    index('cleanup_deadline_reports_feature_observed_idx').on(
-      table.feature,
-      table.observedAt,
-    ),
-  ],
-);
-
-export const dataLifecycleLedger = pgTable('data_lifecycle_ledger', {
-  action: text('action').notNull(),
-  categoryId: text('category_id').notNull(),
-  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
-  effectiveAt: timestamp('effective_at', { withTimezone: true }).notNull(),
-  entryId: text('entry_id').primaryKey(),
-  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-  idempotencyKey: text('idempotency_key').notNull().unique(),
-  policyVersion: text('policy_version').notNull(),
-  pseudonymousKey: text('pseudonymous_key').notNull(),
-});
-
-export const dataLifecycleRequests = pgTable('data_lifecycle_requests', {
-  approvalRequestId: uuid('approval_request_id').notNull().unique(),
-  id: uuid('id').primaryKey(),
-  requestJson: jsonb('request_json').notNull(),
-  revision: integer('revision').notNull(),
-  status: text('status').notNull(),
-  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
-});
-
-export const dataLifecycleHolds = pgTable('data_lifecycle_holds', {
-  categoryId: text('category_id').notNull(),
-  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-  holdId: text('hold_id').primaryKey(),
-  holdJson: jsonb('hold_json').notNull(),
-  reviewAt: timestamp('review_at', { withTimezone: true }).notNull(),
-  scopeRef: text('scope_ref').notNull(),
-  status: text('status').notNull(),
-});
+        'database/schema.ts': `import { integer, jsonb, pgTable, text, timestamp } from 'drizzle-orm/pg-core';
 
+/**
+ * Add user-owned relational feature tables here. Standard records, authorization,
+ * inbox, retention and ordinary event intents remain in DynamoDB.
+ * This table is only for events committed atomically with an optional SQL feature.
+ */
 export const dataLifecycleOutbox = pgTable('data_lifecycle_outbox', {
   attempts: integer('attempts').default(0).notNull(),
   createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
@@ -318,162 +99,8 @@ export const dataLifecycleOutbox = pgTable('data_lifecycle_outbox', {
   lastErrorCode: text('last_error_code'),
   publishedAt: timestamp('published_at', { withTimezone: true }),
 });
-
-export const performanceLoadRuns = pgTable(
-  'performance_load_runs',
-  {
-    adapterId: text('adapter_id').notNull(),
-    cleanupStartedAt: timestamp('cleanup_started_at', {
-      withTimezone: true,
-    }),
-    createdAt: timestamp('created_at', { withTimezone: true }).notNull(),
-    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-    maximumRequests: integer('maximum_requests').notNull(),
-    planDigest: text('plan_digest').primaryKey(),
-    releaseMaterialDigest: text('release_material_digest').notNull(),
-    runId: text('run_id').notNull(),
-    scenarioId: text('scenario_id').notNull(),
-    sourceCommit: text('source_commit').notNull(),
-    stage: text('stage').notNull(),
-  },
-  (table) => [
-    index('performance_load_runs_expires_at_idx').on(table.expiresAt),
-  ],
-);
-
-export const performanceLoadRequests = pgTable(
-  'performance_load_requests',
-  {
-    claimedAt: timestamp('claimed_at', { withTimezone: true })
-      .defaultNow()
-      .notNull(),
-    effectId: text('effect_id'),
-    planDigest: text('plan_digest').notNull(),
-    requestOrdinal: integer('request_ordinal').notNull(),
-  },
-  (table) => [
-    primaryKey({ columns: [table.planDigest, table.requestOrdinal] }),
-  ],
-);
-
-export const performanceLoadAsyncEffects = pgTable(
-  'performance_load_async_effects',
-  {
-    createdAt: timestamp('created_at', { withTimezone: true })
-      .defaultNow()
-      .notNull(),
-    effectId: text('effect_id').primaryKey(),
-    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-    planDigest: text('plan_digest').notNull(),
-    processedAt: timestamp('processed_at', { withTimezone: true }),
-    runId: text('run_id').notNull(),
-  },
-  (table) => [
-    index('performance_load_async_effects_expires_at_idx').on(
-      table.expiresAt,
-    ),
-    index('performance_load_async_effects_pending_idx').on(
-      table.processedAt,
-      table.expiresAt,
-    ),
-    index('performance_load_async_effects_run_idx').on(
-      table.planDigest,
-      table.runId,
-    ),
-  ],
-);
-
-export const ebkInbox = pgTable(
-  'ebk_inbox',
-  {
-    attempts: integer('attempts').default(0).notNull(),
-    completedAt: timestamp('completed_at', { withTimezone: true }),
-    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-    firstSeenAt: timestamp('first_seen_at', { withTimezone: true }).defaultNow().notNull(),
-    handlerId: text('handler_id').notNull(),
-    handlerVersion: text('handler_version').notNull(),
-    lastAttemptAt: timestamp('last_attempt_at', { withTimezone: true }).notNull(),
-    messageId: text('message_id').notNull(),
-    payloadDigest: text('payload_digest').notNull(),
-    resultReference: text('result_reference'),
-    status: text('status').notNull(),
-  },
-  (table) => [
-    primaryKey({ columns: [table.handlerId, table.messageId] }),
-    index('ebk_inbox_expires_at_idx').on(table.expiresAt),
-  ],
-);
-
-export const dataLifecycleRetentionCandidates = pgTable(
-  'data_lifecycle_retention_candidates',
-  {
-    candidateOrder: text('candidate_order').notNull(),
-    dueAt: timestamp('due_at', { withTimezone: true }).notNull(),
-    recordId: uuid('record_id').notNull(),
-    recordRef: text('record_ref').notNull(),
-    runId: uuid('run_id').notNull(),
-  },
-  (table) => [
-    primaryKey({ columns: [table.runId, table.candidateOrder] }),
-  ],
-);
-
-export const dataLifecycleRetentionRuns = pgTable('data_lifecycle_retention_runs', {
-  approvalRequestId: uuid('approval_request_id').unique(),
-  asOf: timestamp('as_of', { withTimezone: true }).notNull(),
-  checkpointJson: jsonb('checkpoint_json').notNull(),
-  completedAt: timestamp('completed_at', { withTimezone: true }),
-  countsJson: jsonb('counts_json').notNull(),
-  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-  id: uuid('id').primaryKey(),
-  planJson: jsonb('plan_json').notNull(),
-  policyVersion: text('policy_version').notNull(),
-  revision: integer('revision').notNull(),
-  status: text('status').notNull(),
-  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
-});
-
-export const dataLifecycleReceipts = pgTable('data_lifecycle_receipts', {
-  action: text('action').notNull(),
-  occurredAt: timestamp('occurred_at', { withTimezone: true }).notNull(),
-  policyVersion: text('policy_version').notNull(),
-  pseudonymousKey: text('pseudonymous_key').notNull(),
-  receivedAt: timestamp('received_at', { withTimezone: true }).defaultNow().notNull(),
-  requestRef: text('request_ref').notNull(),
-  sourceSlice: text('source_slice').notNull(),
-}, (table) => [
-  primaryKey({
-    columns: [
-      table.sourceSlice,
-      table.pseudonymousKey,
-      table.action,
-      table.requestRef,
-    ],
-  }),
-]);
-
-export const dataLifecycleDownstreamCopies = pgTable(
-  'data_lifecycle_downstream_copies',
-  {
-    action: text('action').notNull(),
-    copyId: text('copy_id').notNull(),
-    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
-    holdRefs: jsonb('hold_refs').notNull(),
-    pseudonymousKey: text('pseudonymous_key').notNull(),
-    purpose: text('purpose').notNull(),
-    recipient: text('recipient').notNull(),
-    sourceSlice: text('source_slice').notNull(),
-    status: text('status').notNull(),
-    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
-  },
-  (table) => [
-    primaryKey({
-      columns: [table.sourceSlice, table.pseudonymousKey, table.copyId],
-    }),
-  ],
-);
 `,
-        'secrets/declarations.ts': `import { databaseCredentialSecretSchema } from '@empire-builder-kit/runtime/database';
+        'secrets/declarations.ts': `${sql ? "import { databaseCredentialSecretSchema } from '@empire-builder-kit/runtime/database';\n" : ''}\
 import {
   defineSecrets,
   secret,
@@ -530,21 +157,23 @@ const performanceLoadHmacKeys = secret.json<{
 });
 
 const SecretDefinitions = {
-  ${pascalName}PerformanceLoadHmacKeys: {
+  GeneratedPerformanceLoadHmacKeys: {
     cache: { freshTtlMs: 1_000, staleTtlMs: 0 },
+    generation: { kind: 'hmac-key-ring-v1' },
     owner: '${name}',
-    requiredStages: ['staging', 'production'],
+    requiredStages: ${JSON.stringify(protectedRuntimeStages)},
     retention: { mode: 'retain' },
     rotation: {
       mode: 'manual',
       runbook: 'docs/runbooks/performance-capacity-cost.md',
     },
-    source: 'operator',
+    source: 'generated',
     value: performanceLoadHmacKeys,
   },
-  ${pascalName}PrimaryDatabaseCredential: {
+${sql
+            ? `  ${pascalName}PrimaryDatabaseCredential: {
     owner: '${name}',
-    requiredStages: ['development', 'staging', 'production'],
+    requiredStages: ${JSON.stringify(databaseStages)},
     retention: { mode: 'retain' },
     rotation: {
       mode: 'manual',
@@ -553,6 +182,8 @@ const SecretDefinitions = {
     source: 'database-bootstrap',
     value: databaseCredentialSecretSchema,
   },
+`
+            : ''}\
 } as const;
 
 export const Secrets: DefinedSecrets<typeof SecretDefinitions> =
@@ -561,23 +192,28 @@ export const Secrets: DefinedSecrets<typeof SecretDefinitions> =
         'secrets/metadata.json': (0, built_in_plan_shared_js_1.json)({
             declarations: [
                 {
-                    logicalName: `${pascalName}PerformanceLoadHmacKeys`,
+                    generation: { kind: 'hmac-key-ring-v1' },
+                    logicalName: 'GeneratedPerformanceLoadHmacKeys',
                     owner: name,
-                    requiredStages: ['staging', 'production'],
+                    requiredStages: protectedRuntimeStages,
                     rotation: { mode: 'manual' },
-                    source: 'operator',
-                    valueKind: 'json',
-                },
-                {
-                    logicalName: `${pascalName}PrimaryDatabaseCredential`,
-                    owner: name,
-                    requiredStages: ['development', 'staging', 'production'],
-                    rotation: { mode: 'manual' },
-                    source: 'database-bootstrap',
+                    source: 'generated',
                     valueKind: 'json',
                 },
+                ...(sql
+                    ? [
+                        {
+                            logicalName: `${pascalName}PrimaryDatabaseCredential`,
+                            owner: name,
+                            requiredStages: databaseStages,
+                            rotation: { mode: 'manual' },
+                            source: 'database-bootstrap',
+                            valueKind: 'json',
+                        },
+                    ]
+                    : []),
             ],
-            schemaVersion: 1,
+            schemaVersion: 2,
         }),
         'docs/runbooks/database-credential-rotation.md': `# Database credential rotation
 
@@ -595,7 +231,8 @@ restored before accepting the rotation.
 `,
         'docs/runbooks/operator-secret-management.md': `# Operator secret management
 
-Operator-supplied deployed secrets use AWS Secrets Manager containers named
+Human-supplied and machine-generated deployed secrets use AWS Secrets Manager
+containers named
 \`ebk/<stage>/${name}/<logical-name>\`. The declaration in
 \`secrets/declarations.ts\` owns the typed runtime contract. Its value-free
 control-plane projection in \`secrets/metadata.json\` must carry the same
@@ -603,10 +240,60 @@ logical name, owner, required stages, rotation mode, source, and value kind.
 Neither file may contain a value, placeholder, fallback, value hash, or
 provider credential.
 
-## Personal development value
+## Machine-generated performance key ring
+
+The trusted AWS adapter process generates the
+\`GeneratedPerformanceLoadHmacKeys\` value and writes it directly to Secrets
+Manager. Transient plaintext bytes exist only in that adapter process; the
+agent, model, and invoking caller never receive, copy, or log them. The
+initializer atomically creates the container and first version; do not
+pre-create it with \`secret-metadata\`. Report the initialization proposal:
+
+\`\`\`bash
+pnpm nx run ${name}:secret-initialize -- --logicalName=GeneratedPerformanceLoadHmacKeys --stage=<required-stage> --profile=<profile> --region=<region> --expectedRoleArn=<role-arn>
+\`\`\`
+
+After reviewing the exact declaration and target, apply with the committed
+stage deployment role:
 
-Only a human at a local interactive terminal may set or remove an
-operator-declared personal value:
+\`\`\`bash
+pnpm nx run ${name}:secret-initialize -- --logicalName=GeneratedPerformanceLoadHmacKeys --stage=<required-stage> --profile=<profile> --region=<region> --expectedRoleArn=<role-arn> --apply
+\`\`\`
+
+For a protected stage, dispatch
+the dedicated **Secret initialize** workflow from its exact protected branch,
+select the Slice and logical name, and choose \`report\` before \`apply\`. The
+executor generates and writes the key ring inside the AWS adapter and returns
+only bounded status; it accepts no value input and cannot read the plaintext
+back through its public contract.
+
+The initializer is initial-create only. It never rotates or silently replaces
+an existing version; later rotation remains a separate reviewed manual
+lifecycle under the declaration's rotation runbook.
+
+A successful governed Slice \`remove\` targets only the exact
+\`GeneratedPerformanceLoadHmacKeys\` container for deletion. Development and
+staging use immediate deletion and wait up to ten minutes for the asynchronous
+provider operation to reach not-found so the deterministic name can be
+redeployed. Production uses a fixed seven-day recovery window, where an already
+scheduled container is idempotent only when its deletion date is no later than
+seven days plus the bounded five-minute clock-skew allowance; a later date
+fails closed. A lower-stage container with a future recovery date is restored,
+reattested, and converted to immediate deletion; a current, past, or
+five-minute clock-skew-tolerant deletion date denotes an interrupted force
+deletion and is polled to not-found without restore. The post-remove step
+reattests the committed account, Region, stage deployment role, canonical name,
+and complete generated ownership tags without reading the value. An absent
+container is
+idempotent. A failed or interrupted native SST remove does not run this step.
+Imported, externally owned, genuinely shared, database-bootstrap, and authority-history
+containers are never targets. Container ownership—not whether a value was
+human-supplied—controls cleanup.
+
+## Personal human-supplied development value
+
+Setting a human-supplied operator-declared personal value is a human-only
+step. Removing one carries no value and may be started by an agent:
 
 \`\`\`bash
 ebk secret set ${name} <logical-name>
@@ -616,14 +303,21 @@ ebk secret remove ${name} <logical-name>
 The CLI derives the personal stage, reads the profile and Region saved by
 \`ebk dev configure\`, proves the current AWS account is the development
 Foundation account, and invokes the workspace-pinned SST CLI. Set accepts the
-value only through a hidden TTY prompt; remove requires a hidden confirmation.
+value only through a hidden TTY prompt and refuses agent and CI environments,
+because a hidden prompt does not hide the value from the process that owns the
+terminal: a human runs it in a terminal no agent spawned. An agent prepares
+that step by naming the exact logical name and command, then resumes without
+reading the value. Remove may be started by an agent; the human types the
+hidden \`REMOVE <logical-name>\` confirmation in that interactive terminal.
 Neither command accepts a stage, profile, Region, value argument, environment
-value, file, fallback, or placeholder. Do not ask or permit an agent or CI job
-to invoke either command.
+value, file, fallback, or placeholder. Never ask an agent or CI job to run
+\`ebk secret set\`.
 
 ## Development metadata
 
-Report first, using the exact development account profile and Region:
+This target is only for human-supplied operator declarations. It never creates
+or updates a generated declaration. Report first, using the exact development
+account profile and Region:
 
 \`\`\`bash
 pnpm nx run ${name}:secret-metadata --stage=development --profile=<profile> --region=<region>
@@ -635,272 +329,56 @@ write a secret version, change a rotation label, or delete a secret.
 
 ## Protected metadata
 
-Run the **Secret metadata** GitHub workflow from \`develop\` for staging or
-\`main\` for production. Select this exact Slice and choose \`report\` first.
-After review, dispatch \`apply\` from the same protected branch and
-environment. The workflow assumes the protected deploy role through OIDC,
-verifies the expected AWS account, and invokes the same value-blind Nx
-executor. Never add an application value to GitHub secrets or workflow input.
+This workflow is only for human-supplied operator declarations. Run the
+**Secret metadata** GitHub workflow from \`develop\` for staging or
+\`main\` for production when the deployment profile requires protected GitHub
+authority. Select this exact Slice and choose \`report\` first. After review,
+dispatch \`apply\` from the same protected branch and environment. The workflow
+assumes the protected deploy role through OIDC, verifies the expected AWS
+account, and invokes the same value-blind Nx executor.
+
+Profiles that admit local deployment may apply the reviewed empty-container
+metadata with the same temporary federated profile and stage deployment role:
+
+\`\`\`bash
+pnpm nx run ${name}:secret-metadata -- --stage=<staging-or-production> --profile=<profile> --region=<region> --expectedRoleArn=<role-arn> --apply
+\`\`\`
+
+The local path binds the committed deployment profile, account, Region, and
+exact assumed role. It does not permit a secret value. Never add an application
+value to GitHub secrets, workflow input, argv, or agent-visible material.
 
-The protected deploy role needs metadata-only authority for the Slice prefix:
+The protected deploy role needs metadata authority for the Slice prefix:
 \`ListSecrets\`, \`DescribeSecret\`, \`CreateSecret\`, and \`TagResource\`.
 It must be denied \`BatchGetSecretValue\`, \`GetSecretValue\`,
-\`PutSecretValue\`, \`UpdateSecretVersionStage\`, \`DeleteSecret\`, and
-application deployment outside its separately reviewed deploy policy.
+\`PutSecretValue\`, \`UpdateSecret\`, \`UpdateSecretVersionStage\`,
+and application deployment outside its separately reviewed deploy policy.
+\`DeleteSecret\` is used only by the governed generated-secret retirement path
+after native Slice removal succeeds; the executor binds that call to the exact
+generated HMAC name and ownership tags described above.
 Account-level role materialization remains an adopter responsibility.
 
-## Value ceremony
-
-After an empty container exists, a human secret operator enters or rotates the
-value through the approved hidden-input or provider-owned ceremony. Do not
-delegate this ceremony to an agent and do not pass a value through argv,
-source, a file, a ticket, a work marker, GitHub, logs, or evidence. Routine
-operator authority is write-only for exact approved paths and has no
-application or Foundation deployment authority. Value reads require a separate
-audited break-glass path.
+## Human-supplied value ceremony
+
+After an empty human-supplied container exists, a human secret operator enters
+or rotates the value through the approved hidden-input or provider-owned
+ceremony. Only the value entry is human-only: an agent may confirm the empty
+container through the value-blind \`secret-metadata\` report, tell the operator
+the exact container name and stage, and verify afterwards with the same report
+and the deployment; it never enters, reads, or relays the value. Do not
+delegate that human-supplied ceremony to an agent and do not pass a value
+through argv, source, a file, a ticket, a work marker, GitHub, logs, or
+evidence. Routine operator authority is write-only for exact approved
+paths and has no application or Foundation deployment authority. Value reads
+require a separate audited break-glass path. Machine-generated declarations
+instead use \`secret-initialize\`; they never accept a human value.
 
 Run the report again and then deploy. Deployment performs only a read-only
 metadata preflight and refuses before SST mutation when a required container,
 \`AWSCURRENT\`, ownership tag, or rotation policy is invalid. Remove, unlock,
 retirement, and recovery do not depend on this preflight.
 `,
-        'database/migrations/0000_initial.sql': `CREATE TABLE IF NOT EXISTS "records" (
-  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  "name" text NOT NULL,
-  "owner_id" text NOT NULL,
-  "run_scope" text NOT NULL,
-  "created_at" timestamptz NOT NULL DEFAULT now(),
-  "last_activity_at" timestamptz NOT NULL DEFAULT now(),
-  "test_expires_at" timestamptz
-);
-CREATE INDEX IF NOT EXISTS "records_performance_expiry_idx"
-  ON "records" ("owner_id", "name", "test_expires_at");
-CREATE INDEX IF NOT EXISTS "records_performance_run_scope_idx"
-  ON "records" ("owner_id", "name", "run_scope");
-
-CREATE TABLE IF NOT EXISTS "authorization_audit" (
-  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  "action" text NOT NULL,
-  "approval_reference" text,
-  "authority_mode" text NOT NULL,
-  "correlation_id" text NOT NULL,
-  "decision" text NOT NULL,
-  "policy_version" text NOT NULL,
-  "principal_kind" text NOT NULL,
-  "pseudonymous_subject_id" text NOT NULL,
-  "reason_category" text NOT NULL,
-  "delegation_reference" text,
-  "resource_reference" text,
-  "resource_type" text NOT NULL,
-  "slice" text NOT NULL,
-  "stage" text NOT NULL,
-  "subject_type" text NOT NULL,
-  "created_at" timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE TABLE IF NOT EXISTS "delegation_grants" (
-  "id" uuid PRIMARY KEY,
-  "capability_digest" text NOT NULL,
-  "created_at" timestamptz NOT NULL DEFAULT now(),
-  "expires_at" timestamptz NOT NULL,
-  "grant_json" jsonb NOT NULL,
-  "issued_at" timestamptz NOT NULL,
-  "policy_version" text NOT NULL,
-  "revision" integer NOT NULL,
-  "status" text NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS "approval_requests" (
-  "id" uuid PRIMARY KEY,
-  "author_reference" text NOT NULL,
-  "created_at" timestamptz NOT NULL DEFAULT now(),
-  "expires_at" timestamptz NOT NULL,
-  "policy_version" text NOT NULL,
-  "request_json" jsonb NOT NULL,
-  "request_digest" text NOT NULL,
-  "revision" integer NOT NULL,
-  "status" text NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_audit" (
-  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  "action" text NOT NULL,
-  "actor_ref" text NOT NULL,
-  "approval_reference" text,
-  "audit_json" jsonb NOT NULL,
-  "authority_code" text NOT NULL,
-  "correlation_ref" text NOT NULL,
-  "expires_at" timestamptz NOT NULL,
-  "outcome" text NOT NULL,
-  "policy_version" text NOT NULL,
-  "principal_kind" text NOT NULL,
-  "purpose_code" text NOT NULL,
-  "resource_reference" text,
-  "slice" text NOT NULL,
-  "stage" text NOT NULL,
-  "subject_type" text NOT NULL,
-  "target_category_id" text NOT NULL,
-  "occurred_at" timestamptz NOT NULL
-);
-
-CREATE INDEX IF NOT EXISTS "data_lifecycle_audit_expires_at_idx"
-  ON "data_lifecycle_audit" ("expires_at");
-
-CREATE OR REPLACE FUNCTION "ebk_prune_data_lifecycle_audit"(
-  "cutoff" timestamptz,
-  "batch_limit" integer
-) RETURNS integer
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog, public
-AS $$
-DECLARE
-  deleted_count integer;
-  effective_cutoff timestamptz;
-BEGIN
-  IF batch_limit < 1 OR batch_limit > 1000 THEN
-    RAISE EXCEPTION 'audit prune batch is outside the reviewed bound';
-  END IF;
-  effective_cutoff := LEAST(cutoff, clock_timestamp());
-  WITH expired AS (
-    SELECT ctid FROM public.data_lifecycle_audit
-    WHERE expires_at <= effective_cutoff
-    ORDER BY expires_at, id
-    LIMIT batch_limit
-    FOR UPDATE SKIP LOCKED
-  )
-  DELETE FROM public.data_lifecycle_audit
-  WHERE ctid IN (SELECT ctid FROM expired);
-  GET DIAGNOSTICS deleted_count = ROW_COUNT;
-  RETURN deleted_count;
-END;
-$$;
-
-CREATE OR REPLACE FUNCTION "ebk_prune_authorization_audit"(
-  "cutoff" timestamptz,
-  "batch_limit" integer
-) RETURNS integer
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = pg_catalog, public
-AS $$
-DECLARE
-  deleted_count integer;
-  effective_cutoff timestamptz;
-BEGIN
-  IF batch_limit < 1 OR batch_limit > 1000 THEN
-    RAISE EXCEPTION 'audit prune batch is outside the reviewed bound';
-  END IF;
-  effective_cutoff := LEAST(cutoff, clock_timestamp());
-  WITH expired AS (
-    SELECT ctid FROM public.authorization_audit
-    WHERE created_at <= effective_cutoff - INTERVAL '400 days'
-    ORDER BY created_at, id
-    LIMIT batch_limit
-    FOR UPDATE SKIP LOCKED
-  )
-  DELETE FROM public.authorization_audit
-  WHERE ctid IN (SELECT ctid FROM expired);
-  GET DIAGNOSTICS deleted_count = ROW_COUNT;
-  RETURN deleted_count;
-END;
-$$;
-
-REVOKE ALL ON FUNCTION "ebk_prune_data_lifecycle_audit"(
-  timestamptz, integer
-) FROM PUBLIC;
-REVOKE ALL ON FUNCTION "ebk_prune_authorization_audit"(
-  timestamptz, integer
-) FROM PUBLIC;
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_export_artifacts" (
-  "approval_request_id" uuid PRIMARY KEY
-    REFERENCES "approval_requests" ("id") ON DELETE CASCADE,
-  "artifact_ref" text,
-  "cleanup_deadline_at" timestamptz,
-  "cleanup_state" text NOT NULL,
-  "current_version_id" text,
-  "expires_at" timestamptz,
-  "last_error_code" text,
-  "object_key" text NOT NULL,
-  "record_ref" text NOT NULL,
-  "subject_ref" text NOT NULL,
-  "upload_started_at" timestamptz,
-  "created_at" timestamptz NOT NULL DEFAULT now(),
-  "updated_at" timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS "data_lifecycle_export_artifacts_subject_created_idx"
-  ON "data_lifecycle_export_artifacts" ("subject_ref", "created_at");
-CREATE INDEX IF NOT EXISTS "data_lifecycle_export_artifacts_cleanup_expiry_idx"
-  ON "data_lifecycle_export_artifacts" ("cleanup_state", "expires_at");
-CREATE INDEX IF NOT EXISTS "data_lifecycle_export_artifacts_cleanup_deadline_idx"
-  ON "data_lifecycle_export_artifacts" ("cleanup_state", "cleanup_deadline_at");
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_export_versions" (
-  "approval_request_id" uuid NOT NULL
-    REFERENCES "approval_requests" ("id") ON DELETE CASCADE,
-  "version_id" text NOT NULL,
-  "object_key" text NOT NULL,
-  "is_delete_marker" boolean NOT NULL,
-  "status" text NOT NULL,
-  "deleted_at" timestamptz,
-  PRIMARY KEY ("approval_request_id", "version_id")
-);
-
-CREATE TABLE IF NOT EXISTS "cleanup_deadline_reports" (
-  "feature" text NOT NULL,
-  "resource_ref" text NOT NULL,
-  "deadline_at" timestamptz NOT NULL,
-  "observed_at" timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY ("feature", "resource_ref")
-);
-CREATE INDEX IF NOT EXISTS "cleanup_deadline_reports_feature_observed_idx"
-  ON "cleanup_deadline_reports" ("feature", "observed_at");
-
-CREATE TABLE IF NOT EXISTS "cleanup_deadline_report_capacity" (
-  "feature" text PRIMARY KEY,
-  "maximum_pending" integer NOT NULL
-);
-INSERT INTO "cleanup_deadline_report_capacity" ("feature", "maximum_pending")
-VALUES ('confidential-export', 1000)
-ON CONFLICT ("feature") DO NOTHING;
-
-CREATE INDEX IF NOT EXISTS "data_lifecycle_export_versions_status_idx"
-  ON "data_lifecycle_export_versions" ("status");
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_ledger" (
-  "entry_id" text PRIMARY KEY,
-  "action" text NOT NULL,
-  "category_id" text NOT NULL,
-  "effective_at" timestamptz NOT NULL,
-  "expires_at" timestamptz NOT NULL,
-  "idempotency_key" text NOT NULL UNIQUE,
-  "policy_version" text NOT NULL,
-  "pseudonymous_key" text NOT NULL,
-  "created_at" timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_requests" (
-  "id" uuid PRIMARY KEY,
-  "approval_request_id" uuid NOT NULL UNIQUE,
-  "request_json" jsonb NOT NULL,
-  "revision" integer NOT NULL,
-  "status" text NOT NULL,
-  "updated_at" timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_holds" (
-  "hold_id" text PRIMARY KEY,
-  "scope_ref" text NOT NULL,
-  "category_id" text NOT NULL,
-  "hold_json" jsonb NOT NULL,
-  "status" text NOT NULL,
-  "expires_at" timestamptz NOT NULL,
-  "review_at" timestamptz NOT NULL
-);
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_outbox" (
+        'database/migrations/0000_initial.sql': `CREATE TABLE IF NOT EXISTS "data_lifecycle_outbox" (
   "idempotency_key" text PRIMARY KEY,
   "event_json" jsonb NOT NULL,
   "published_at" timestamptz,
@@ -909,113 +387,6 @@ CREATE TABLE IF NOT EXISTS "data_lifecycle_outbox" (
   "expires_at" timestamptz NOT NULL,
   "created_at" timestamptz NOT NULL DEFAULT now()
 );
-
-CREATE TABLE IF NOT EXISTS "performance_load_runs" (
-  "plan_digest" text PRIMARY KEY,
-  "run_id" text NOT NULL,
-  "adapter_id" text NOT NULL,
-  "cleanup_started_at" timestamptz,
-  "scenario_id" text NOT NULL,
-  "stage" text NOT NULL,
-  "source_commit" text NOT NULL,
-  "release_material_digest" text NOT NULL,
-  "maximum_requests" integer NOT NULL,
-  "created_at" timestamptz NOT NULL,
-  "expires_at" timestamptz NOT NULL
-);
-CREATE INDEX IF NOT EXISTS "performance_load_runs_expires_at_idx"
-  ON "performance_load_runs" ("expires_at");
-
-CREATE TABLE IF NOT EXISTS "performance_load_requests" (
-  "plan_digest" text NOT NULL,
-  "request_ordinal" integer NOT NULL,
-  "effect_id" text,
-  "claimed_at" timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY ("plan_digest", "request_ordinal")
-);
-
-CREATE TABLE IF NOT EXISTS "performance_load_async_effects" (
-  "effect_id" text PRIMARY KEY,
-  "plan_digest" text NOT NULL,
-  "run_id" text NOT NULL,
-  "processed_at" timestamptz,
-  "expires_at" timestamptz NOT NULL,
-  "created_at" timestamptz NOT NULL DEFAULT now()
-);
-CREATE INDEX IF NOT EXISTS "performance_load_async_effects_expires_at_idx"
-  ON "performance_load_async_effects" USING btree ("expires_at");
-CREATE INDEX "performance_load_async_effects_pending_idx"
-  ON "performance_load_async_effects" USING btree
-  ("processed_at", "expires_at");
-CREATE INDEX IF NOT EXISTS "performance_load_async_effects_run_idx"
-  ON "performance_load_async_effects" USING btree
-  ("plan_digest", "run_id");
-
-CREATE TABLE IF NOT EXISTS "ebk_inbox" (
-  "handler_id" text NOT NULL,
-  "handler_version" text NOT NULL,
-  "message_id" text NOT NULL,
-  "payload_digest" text NOT NULL,
-  "status" text NOT NULL,
-  "attempts" integer NOT NULL DEFAULT 0,
-  "result_reference" text,
-  "first_seen_at" timestamptz NOT NULL DEFAULT now(),
-  "last_attempt_at" timestamptz NOT NULL,
-  "completed_at" timestamptz,
-  "expires_at" timestamptz NOT NULL,
-  PRIMARY KEY ("handler_id", "message_id")
-);
-CREATE INDEX "ebk_inbox_expires_at_idx"
-  ON "ebk_inbox" USING btree ("expires_at");
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_retention_runs" (
-  "id" uuid PRIMARY KEY,
-  "approval_request_id" uuid UNIQUE,
-  "as_of" timestamptz NOT NULL,
-  "checkpoint_json" jsonb NOT NULL,
-  "completed_at" timestamptz,
-  "counts_json" jsonb NOT NULL,
-  "expires_at" timestamptz NOT NULL,
-  "plan_json" jsonb NOT NULL,
-  "policy_version" text NOT NULL,
-  "revision" integer NOT NULL,
-  "status" text NOT NULL,
-  "updated_at" timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_retention_candidates" (
-  "run_id" uuid NOT NULL,
-  "candidate_order" text NOT NULL,
-  "record_id" uuid NOT NULL,
-  "record_ref" text NOT NULL,
-  "due_at" timestamptz NOT NULL,
-  PRIMARY KEY ("run_id", "candidate_order")
-);
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_receipts" (
-  "source_slice" text NOT NULL,
-  "pseudonymous_key" text NOT NULL,
-  "action" text NOT NULL,
-  "request_ref" text NOT NULL,
-  "policy_version" text NOT NULL,
-  "occurred_at" timestamptz NOT NULL,
-  "received_at" timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY ("source_slice", "pseudonymous_key", "action", "request_ref")
-);
-
-CREATE TABLE IF NOT EXISTS "data_lifecycle_downstream_copies" (
-  "source_slice" text NOT NULL,
-  "pseudonymous_key" text NOT NULL,
-  "copy_id" text NOT NULL,
-  "recipient" text NOT NULL,
-  "purpose" text NOT NULL,
-  "expires_at" timestamptz NOT NULL,
-  "action" text NOT NULL,
-  "hold_refs" jsonb NOT NULL,
-  "status" text NOT NULL,
-  "updated_at" timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY ("source_slice", "pseudonymous_key", "copy_id")
-);
 `,
         'database/migrations/meta/_journal.json': (0, built_in_plan_shared_js_1.json)({
             dialect: 'postgresql',
@@ -1036,222 +407,8 @@ CREATE TABLE IF NOT EXISTS "data_lifecycle_downstream_copies" (
             version: '7',
             dialect: 'postgresql',
             tables: {
-                'public.approval_requests': snapshotTable('approval_requests', {
-                    author_reference: snapshotColumn('author_reference', 'text'),
-                    created_at: snapshotColumn('created_at', 'timestamp with time zone', {
-                        default: 'now()',
-                    }),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    id: snapshotColumn('id', 'uuid', { primaryKey: true }),
-                    policy_version: snapshotColumn('policy_version', 'text'),
-                    request_digest: snapshotColumn('request_digest', 'text'),
-                    request_json: snapshotColumn('request_json', 'jsonb'),
-                    revision: snapshotColumn('revision', 'integer'),
-                    status: snapshotColumn('status', 'text'),
-                }),
-                'public.authorization_audit': snapshotTable('authorization_audit', {
-                    action: snapshotColumn('action', 'text'),
-                    approval_reference: snapshotColumn('approval_reference', 'text', {
-                        notNull: false,
-                    }),
-                    authority_mode: snapshotColumn('authority_mode', 'text'),
-                    correlation_id: snapshotColumn('correlation_id', 'text'),
-                    created_at: snapshotColumn('created_at', 'timestamp with time zone', {
-                        default: 'now()',
-                    }),
-                    decision: snapshotColumn('decision', 'text'),
-                    id: snapshotColumn('id', 'uuid', {
-                        default: 'gen_random_uuid()',
-                        primaryKey: true,
-                    }),
-                    policy_version: snapshotColumn('policy_version', 'text'),
-                    principal_kind: snapshotColumn('principal_kind', 'text'),
-                    pseudonymous_subject_id: snapshotColumn('pseudonymous_subject_id', 'text'),
-                    reason_category: snapshotColumn('reason_category', 'text'),
-                    delegation_reference: snapshotColumn('delegation_reference', 'text', {
-                        notNull: false,
-                    }),
-                    resource_reference: snapshotColumn('resource_reference', 'text', {
-                        notNull: false,
-                    }),
-                    resource_type: snapshotColumn('resource_type', 'text'),
-                    slice: snapshotColumn('slice', 'text'),
-                    stage: snapshotColumn('stage', 'text'),
-                    subject_type: snapshotColumn('subject_type', 'text'),
-                }),
-                'public.data_lifecycle_audit': snapshotTable('data_lifecycle_audit', {
-                    action: snapshotColumn('action', 'text'),
-                    actor_ref: snapshotColumn('actor_ref', 'text'),
-                    approval_reference: snapshotColumn('approval_reference', 'text', {
-                        notNull: false,
-                    }),
-                    audit_json: snapshotColumn('audit_json', 'jsonb'),
-                    authority_code: snapshotColumn('authority_code', 'text'),
-                    correlation_ref: snapshotColumn('correlation_ref', 'text'),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    id: snapshotColumn('id', 'uuid', {
-                        default: 'gen_random_uuid()',
-                        primaryKey: true,
-                    }),
-                    occurred_at: snapshotColumn('occurred_at', 'timestamp with time zone'),
-                    outcome: snapshotColumn('outcome', 'text'),
-                    policy_version: snapshotColumn('policy_version', 'text'),
-                    principal_kind: snapshotColumn('principal_kind', 'text'),
-                    purpose_code: snapshotColumn('purpose_code', 'text'),
-                    resource_reference: snapshotColumn('resource_reference', 'text', {
-                        notNull: false,
-                    }),
-                    slice: snapshotColumn('slice', 'text'),
-                    stage: snapshotColumn('stage', 'text'),
-                    subject_type: snapshotColumn('subject_type', 'text'),
-                    target_category_id: snapshotColumn('target_category_id', 'text'),
-                }, {}, {}, {
-                    data_lifecycle_audit_expires_at_idx: snapshotIndex('data_lifecycle_audit_expires_at_idx', [{ expression: 'expires_at', opclass: 'timestamptz_ops' }]),
-                }),
-                'public.data_lifecycle_export_artifacts': snapshotTable('data_lifecycle_export_artifacts', {
-                    approval_request_id: snapshotColumn('approval_request_id', 'uuid', {
-                        primaryKey: true,
-                    }),
-                    artifact_ref: snapshotColumn('artifact_ref', 'text', {
-                        notNull: false,
-                    }),
-                    cleanup_deadline_at: snapshotColumn('cleanup_deadline_at', 'timestamp with time zone', { notNull: false }),
-                    cleanup_state: snapshotColumn('cleanup_state', 'text'),
-                    created_at: snapshotColumn('created_at', 'timestamp with time zone', { default: 'now()' }),
-                    current_version_id: snapshotColumn('current_version_id', 'text', {
-                        notNull: false,
-                    }),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone', { notNull: false }),
-                    last_error_code: snapshotColumn('last_error_code', 'text', {
-                        notNull: false,
-                    }),
-                    object_key: snapshotColumn('object_key', 'text'),
-                    record_ref: snapshotColumn('record_ref', 'text'),
-                    subject_ref: snapshotColumn('subject_ref', 'text'),
-                    updated_at: snapshotColumn('updated_at', 'timestamp with time zone', { default: 'now()' }),
-                    upload_started_at: snapshotColumn('upload_started_at', 'timestamp with time zone', { notNull: false }),
-                }, {}, {}, {
-                    data_lifecycle_export_artifacts_cleanup_deadline_idx: snapshotIndex('data_lifecycle_export_artifacts_cleanup_deadline_idx', [
-                        { expression: 'cleanup_state', opclass: 'text_ops' },
-                        {
-                            expression: 'cleanup_deadline_at',
-                            opclass: 'timestamptz_ops',
-                        },
-                    ]),
-                    data_lifecycle_export_artifacts_cleanup_expiry_idx: snapshotIndex('data_lifecycle_export_artifacts_cleanup_expiry_idx', [
-                        { expression: 'cleanup_state', opclass: 'text_ops' },
-                        { expression: 'expires_at', opclass: 'timestamptz_ops' },
-                    ]),
-                    data_lifecycle_export_artifacts_subject_created_idx: snapshotIndex('data_lifecycle_export_artifacts_subject_created_idx', [
-                        { expression: 'subject_ref', opclass: 'text_ops' },
-                        { expression: 'created_at', opclass: 'timestamptz_ops' },
-                    ]),
-                }, {
-                    data_lifecycle_export_artifacts_approval_request_id_approval_requests_id_fk: {
-                        columnsFrom: ['approval_request_id'],
-                        columnsTo: ['id'],
-                        name: 'data_lifecycle_export_artifacts_approval_request_id_approval_requests_id_fk',
-                        onDelete: 'cascade',
-                        onUpdate: 'no action',
-                        tableFrom: 'data_lifecycle_export_artifacts',
-                        tableTo: 'approval_requests',
-                    },
-                }),
-                'public.cleanup_deadline_report_capacity': snapshotTable('cleanup_deadline_report_capacity', {
-                    feature: snapshotColumn('feature', 'text', { primaryKey: true }),
-                    maximum_pending: snapshotColumn('maximum_pending', 'integer'),
-                }),
-                'public.cleanup_deadline_reports': snapshotTable('cleanup_deadline_reports', {
-                    deadline_at: snapshotColumn('deadline_at', 'timestamp with time zone'),
-                    feature: snapshotColumn('feature', 'text'),
-                    observed_at: snapshotColumn('observed_at', 'timestamp with time zone', { default: 'now()' }),
-                    resource_ref: snapshotColumn('resource_ref', 'text'),
-                }, {}, {
-                    cleanup_deadline_reports_feature_resource_ref_pk: {
-                        columns: ['feature', 'resource_ref'],
-                        name: 'cleanup_deadline_reports_feature_resource_ref_pk',
-                    },
-                }, {
-                    cleanup_deadline_reports_feature_observed_idx: snapshotIndex('cleanup_deadline_reports_feature_observed_idx', [
-                        { expression: 'feature', opclass: 'text_ops' },
-                        {
-                            expression: 'observed_at',
-                            opclass: 'timestamptz_ops',
-                        },
-                    ]),
-                }),
-                'public.data_lifecycle_export_versions': snapshotTable('data_lifecycle_export_versions', {
-                    approval_request_id: snapshotColumn('approval_request_id', 'uuid'),
-                    deleted_at: snapshotColumn('deleted_at', 'timestamp with time zone', { notNull: false }),
-                    is_delete_marker: snapshotColumn('is_delete_marker', 'boolean'),
-                    object_key: snapshotColumn('object_key', 'text'),
-                    status: snapshotColumn('status', 'text'),
-                    version_id: snapshotColumn('version_id', 'text'),
-                }, {}, {
-                    data_lifecycle_export_versions_approval_request_id_version_id_pk: {
-                        columns: ['approval_request_id', 'version_id'],
-                        name: 'data_lifecycle_export_versions_approval_request_id_version_id_pk',
-                    },
-                }, {
-                    data_lifecycle_export_versions_status_idx: snapshotIndex('data_lifecycle_export_versions_status_idx', [{ expression: 'status', opclass: 'text_ops' }]),
-                }, {
-                    data_lifecycle_export_versions_approval_request_id_approval_requests_id_fk: {
-                        columnsFrom: ['approval_request_id'],
-                        columnsTo: ['id'],
-                        name: 'data_lifecycle_export_versions_approval_request_id_approval_requests_id_fk',
-                        onDelete: 'cascade',
-                        onUpdate: 'no action',
-                        tableFrom: 'data_lifecycle_export_versions',
-                        tableTo: 'approval_requests',
-                    },
-                }),
-                'public.data_lifecycle_ledger': snapshotTable('data_lifecycle_ledger', {
-                    action: snapshotColumn('action', 'text'),
-                    category_id: snapshotColumn('category_id', 'text'),
-                    created_at: snapshotColumn('created_at', 'timestamp with time zone', { default: 'now()' }),
-                    effective_at: snapshotColumn('effective_at', 'timestamp with time zone'),
-                    entry_id: snapshotColumn('entry_id', 'text', {
-                        primaryKey: true,
-                    }),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    idempotency_key: snapshotColumn('idempotency_key', 'text'),
-                    policy_version: snapshotColumn('policy_version', 'text'),
-                    pseudonymous_key: snapshotColumn('pseudonymous_key', 'text'),
-                }, {
-                    data_lifecycle_ledger_idempotency_key_unique: {
-                        columns: ['idempotency_key'],
-                        name: 'data_lifecycle_ledger_idempotency_key_unique',
-                        nullsNotDistinct: false,
-                    },
-                }),
-                'public.data_lifecycle_downstream_copies': snapshotTable('data_lifecycle_downstream_copies', {
-                    action: snapshotColumn('action', 'text'),
-                    copy_id: snapshotColumn('copy_id', 'text'),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    hold_refs: snapshotColumn('hold_refs', 'jsonb'),
-                    pseudonymous_key: snapshotColumn('pseudonymous_key', 'text'),
-                    purpose: snapshotColumn('purpose', 'text'),
-                    recipient: snapshotColumn('recipient', 'text'),
-                    source_slice: snapshotColumn('source_slice', 'text'),
-                    status: snapshotColumn('status', 'text'),
-                    updated_at: snapshotColumn('updated_at', 'timestamp with time zone', { default: 'now()' }),
-                }, {}, {
-                    data_lifecycle_downstream_copies_source_slice_pseudonymous_key_copy_id_pk: {
-                        columns: ['source_slice', 'pseudonymous_key', 'copy_id'],
-                        name: 'data_lifecycle_downstream_copies_source_slice_pseudonymous_key_copy_id_pk',
-                    },
-                }),
-                'public.data_lifecycle_holds': snapshotTable('data_lifecycle_holds', {
-                    category_id: snapshotColumn('category_id', 'text'),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    hold_id: snapshotColumn('hold_id', 'text', { primaryKey: true }),
-                    hold_json: snapshotColumn('hold_json', 'jsonb'),
-                    review_at: snapshotColumn('review_at', 'timestamp with time zone'),
-                    scope_ref: snapshotColumn('scope_ref', 'text'),
-                    status: snapshotColumn('status', 'text'),
-                }),
                 'public.data_lifecycle_outbox': snapshotTable('data_lifecycle_outbox', {
-                    attempts: snapshotColumn('attempts', 'integer', { default: '0' }),
+                    attempts: snapshotColumn('attempts', 'integer', { default: 0 }),
                     created_at: snapshotColumn('created_at', 'timestamp with time zone', {
                         default: 'now()',
                     }),
@@ -1265,213 +422,6 @@ CREATE TABLE IF NOT EXISTS "data_lifecycle_downstream_copies" (
                     }),
                     published_at: snapshotColumn('published_at', 'timestamp with time zone', { notNull: false }),
                 }),
-                'public.performance_load_runs': snapshotTable('performance_load_runs', {
-                    adapter_id: snapshotColumn('adapter_id', 'text'),
-                    cleanup_started_at: snapshotColumn('cleanup_started_at', 'timestamp with time zone', { notNull: false }),
-                    created_at: snapshotColumn('created_at', 'timestamp with time zone'),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    maximum_requests: snapshotColumn('maximum_requests', 'integer'),
-                    plan_digest: snapshotColumn('plan_digest', 'text', {
-                        primaryKey: true,
-                    }),
-                    release_material_digest: snapshotColumn('release_material_digest', 'text'),
-                    run_id: snapshotColumn('run_id', 'text'),
-                    scenario_id: snapshotColumn('scenario_id', 'text'),
-                    source_commit: snapshotColumn('source_commit', 'text'),
-                    stage: snapshotColumn('stage', 'text'),
-                }, {}, {}, {
-                    performance_load_runs_expires_at_idx: snapshotIndex('performance_load_runs_expires_at_idx', [
-                        {
-                            expression: 'expires_at',
-                            opclass: 'timestamptz_ops',
-                        },
-                    ]),
-                }),
-                'public.performance_load_requests': snapshotTable('performance_load_requests', {
-                    claimed_at: snapshotColumn('claimed_at', 'timestamp with time zone', { default: 'now()' }),
-                    effect_id: snapshotColumn('effect_id', 'text', {
-                        notNull: false,
-                    }),
-                    plan_digest: snapshotColumn('plan_digest', 'text'),
-                    request_ordinal: snapshotColumn('request_ordinal', 'integer'),
-                }, {}, {
-                    performance_load_requests_plan_digest_request_ordinal_pk: {
-                        columns: ['plan_digest', 'request_ordinal'],
-                        name: 'performance_load_requests_plan_digest_request_ordinal_pk',
-                    },
-                }),
-                'public.performance_load_async_effects': snapshotTable('performance_load_async_effects', {
-                    created_at: snapshotColumn('created_at', 'timestamp with time zone', { default: 'now()' }),
-                    effect_id: snapshotColumn('effect_id', 'text', {
-                        primaryKey: true,
-                    }),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    plan_digest: snapshotColumn('plan_digest', 'text'),
-                    processed_at: snapshotColumn('processed_at', 'timestamp with time zone', { notNull: false }),
-                    run_id: snapshotColumn('run_id', 'text'),
-                }, {}, {}, {
-                    performance_load_async_effects_expires_at_idx: snapshotIndex('performance_load_async_effects_expires_at_idx', [
-                        {
-                            expression: 'expires_at',
-                            opclass: 'timestamptz_ops',
-                        },
-                    ]),
-                    performance_load_async_effects_pending_idx: snapshotIndex('performance_load_async_effects_pending_idx', [
-                        {
-                            expression: 'processed_at',
-                            opclass: 'timestamptz_ops',
-                        },
-                        {
-                            expression: 'expires_at',
-                            opclass: 'timestamptz_ops',
-                        },
-                    ]),
-                    performance_load_async_effects_run_idx: snapshotIndex('performance_load_async_effects_run_idx', [
-                        {
-                            expression: 'plan_digest',
-                            opclass: 'text_ops',
-                        },
-                        {
-                            expression: 'run_id',
-                            opclass: 'text_ops',
-                        },
-                    ]),
-                }),
-                'public.ebk_inbox': snapshotTable('ebk_inbox', {
-                    attempts: snapshotColumn('attempts', 'integer', { default: '0' }),
-                    completed_at: snapshotColumn('completed_at', 'timestamp with time zone', { notNull: false }),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    first_seen_at: snapshotColumn('first_seen_at', 'timestamp with time zone', { default: 'now()' }),
-                    handler_id: snapshotColumn('handler_id', 'text'),
-                    handler_version: snapshotColumn('handler_version', 'text'),
-                    last_attempt_at: snapshotColumn('last_attempt_at', 'timestamp with time zone'),
-                    message_id: snapshotColumn('message_id', 'text'),
-                    payload_digest: snapshotColumn('payload_digest', 'text'),
-                    result_reference: snapshotColumn('result_reference', 'text', {
-                        notNull: false,
-                    }),
-                    status: snapshotColumn('status', 'text'),
-                }, {}, {
-                    ebk_inbox_handler_id_message_id_pk: {
-                        columns: ['handler_id', 'message_id'],
-                        name: 'ebk_inbox_handler_id_message_id_pk',
-                    },
-                }, {
-                    ebk_inbox_expires_at_idx: snapshotIndex('ebk_inbox_expires_at_idx', [
-                        {
-                            expression: 'expires_at',
-                            opclass: 'timestamptz_ops',
-                        },
-                    ]),
-                }),
-                'public.data_lifecycle_requests': snapshotTable('data_lifecycle_requests', {
-                    approval_request_id: snapshotColumn('approval_request_id', 'uuid'),
-                    id: snapshotColumn('id', 'uuid', { primaryKey: true }),
-                    request_json: snapshotColumn('request_json', 'jsonb'),
-                    revision: snapshotColumn('revision', 'integer'),
-                    status: snapshotColumn('status', 'text'),
-                    updated_at: snapshotColumn('updated_at', 'timestamp with time zone', { default: 'now()' }),
-                }, {
-                    data_lifecycle_requests_approval_request_id_unique: {
-                        columns: ['approval_request_id'],
-                        name: 'data_lifecycle_requests_approval_request_id_unique',
-                        nullsNotDistinct: false,
-                    },
-                }),
-                'public.data_lifecycle_receipts': snapshotTable('data_lifecycle_receipts', {
-                    action: snapshotColumn('action', 'text'),
-                    occurred_at: snapshotColumn('occurred_at', 'timestamp with time zone'),
-                    policy_version: snapshotColumn('policy_version', 'text'),
-                    pseudonymous_key: snapshotColumn('pseudonymous_key', 'text'),
-                    received_at: snapshotColumn('received_at', 'timestamp with time zone', { default: 'now()' }),
-                    request_ref: snapshotColumn('request_ref', 'text'),
-                    source_slice: snapshotColumn('source_slice', 'text'),
-                }, {}, {
-                    data_lifecycle_receipts_source_slice_pseudonymous_key_action_request_ref_pk: {
-                        columns: [
-                            'source_slice',
-                            'pseudonymous_key',
-                            'action',
-                            'request_ref',
-                        ],
-                        name: 'data_lifecycle_receipts_source_slice_pseudonymous_key_action_request_ref_pk',
-                    },
-                }),
-                'public.data_lifecycle_retention_runs': snapshotTable('data_lifecycle_retention_runs', {
-                    approval_request_id: snapshotColumn('approval_request_id', 'uuid', {
-                        notNull: false,
-                    }),
-                    as_of: snapshotColumn('as_of', 'timestamp with time zone'),
-                    checkpoint_json: snapshotColumn('checkpoint_json', 'jsonb'),
-                    completed_at: snapshotColumn('completed_at', 'timestamp with time zone', { notNull: false }),
-                    counts_json: snapshotColumn('counts_json', 'jsonb'),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    id: snapshotColumn('id', 'uuid', { primaryKey: true }),
-                    plan_json: snapshotColumn('plan_json', 'jsonb'),
-                    policy_version: snapshotColumn('policy_version', 'text'),
-                    revision: snapshotColumn('revision', 'integer'),
-                    status: snapshotColumn('status', 'text'),
-                    updated_at: snapshotColumn('updated_at', 'timestamp with time zone', { default: 'now()' }),
-                }, {
-                    data_lifecycle_retention_runs_approval_request_id_unique: {
-                        columns: ['approval_request_id'],
-                        name: 'data_lifecycle_retention_runs_approval_request_id_unique',
-                        nullsNotDistinct: false,
-                    },
-                }),
-                'public.data_lifecycle_retention_candidates': snapshotTable('data_lifecycle_retention_candidates', {
-                    candidate_order: snapshotColumn('candidate_order', 'text'),
-                    due_at: snapshotColumn('due_at', 'timestamp with time zone'),
-                    record_id: snapshotColumn('record_id', 'uuid'),
-                    record_ref: snapshotColumn('record_ref', 'text'),
-                    run_id: snapshotColumn('run_id', 'uuid'),
-                }, {}, {
-                    data_lifecycle_retention_candidates_run_id_candidate_order_pk: {
-                        columns: ['run_id', 'candidate_order'],
-                        name: 'data_lifecycle_retention_candidates_run_id_candidate_order_pk',
-                    },
-                }),
-                'public.delegation_grants': snapshotTable('delegation_grants', {
-                    capability_digest: snapshotColumn('capability_digest', 'text'),
-                    created_at: snapshotColumn('created_at', 'timestamp with time zone', {
-                        default: 'now()',
-                    }),
-                    expires_at: snapshotColumn('expires_at', 'timestamp with time zone'),
-                    grant_json: snapshotColumn('grant_json', 'jsonb'),
-                    id: snapshotColumn('id', 'uuid', { primaryKey: true }),
-                    issued_at: snapshotColumn('issued_at', 'timestamp with time zone'),
-                    policy_version: snapshotColumn('policy_version', 'text'),
-                    revision: snapshotColumn('revision', 'integer'),
-                    status: snapshotColumn('status', 'text'),
-                }),
-                'public.records': snapshotTable('records', {
-                    created_at: snapshotColumn('created_at', 'timestamp with time zone', {
-                        default: 'now()',
-                    }),
-                    id: snapshotColumn('id', 'uuid', {
-                        default: 'gen_random_uuid()',
-                        primaryKey: true,
-                    }),
-                    last_activity_at: snapshotColumn('last_activity_at', 'timestamp with time zone', { default: 'now()' }),
-                    name: snapshotColumn('name', 'text'),
-                    owner_id: snapshotColumn('owner_id', 'text'),
-                    run_scope: snapshotColumn('run_scope', 'text'),
-                    test_expires_at: snapshotColumn('test_expires_at', 'timestamp with time zone', { notNull: false }),
-                }, {}, {}, {
-                    records_performance_expiry_idx: snapshotIndex('records_performance_expiry_idx', [
-                        { expression: 'owner_id', opclass: 'text_ops' },
-                        { expression: 'name', opclass: 'text_ops' },
-                        {
-                            expression: 'test_expires_at',
-                            opclass: 'timestamptz_ops',
-                        },
-                    ]),
-                    records_performance_run_scope_idx: snapshotIndex('records_performance_run_scope_idx', [
-                        { expression: 'owner_id', opclass: 'text_ops' },
-                        { expression: 'name', opclass: 'text_ops' },
-                        { expression: 'run_scope', opclass: 'text_ops' },
-                    ]),
-                }),
             },
             enums: {},
             schemas: {},
@@ -1491,15 +441,20 @@ const plan = createDatabaseBindingPlan(databaseBindings, {
 });
 const activeDatabase = plan.active.primary;
 if (!activeDatabase) throw new Error('Database binding "primary" is required.');
-const localDatabase = resolveLocalDatabaseContract({
+// Schema-only commands stay offline; connection commands require the owned allocation.
+const schemaOnly = process.argv[2] === 'generate' || process.argv[2] === 'check';
+const localDatabase = schemaOnly || process.env.DATABASE_URL ? undefined : resolveLocalDatabaseContract({
   database: activeDatabase,
   slice: '${name}',
 });
+const databaseUrl = process.env.DATABASE_URL ?? (localDatabase
+  ? \`postgresql://\${encodeURIComponent(localDatabase.username)}:\${encodeURIComponent(localDatabase.password)}@\${localDatabase.host}:\${localDatabase.port}/\${localDatabase.database}\`
+  : undefined);
 
 export default defineConfig({
-  dbCredentials: {
-    url: process.env.DATABASE_URL ?? \`postgresql://\${localDatabase.username}:\${localDatabase.password}@\${localDatabase.host}:\${localDatabase.port}/\${localDatabase.database}\`,
-  },
+  ...(!schemaOnly && databaseUrl ? {
+    dbCredentials: { url: databaseUrl },
+  } : {}),
   dialect: 'postgresql',
   out: './database/migrations',
   schema: './database/schema.ts',
@@ -1508,6 +463,11 @@ export default defineConfig({
         'database/docker-compose.yml': `services:
   database:
     image: postgres:17-alpine
+    container_name: \${EBK_LOCAL_DATABASE_PROJECT}-database
+    labels:
+      dev.ebk.task: \${EBK_LOCAL_DATABASE_TASK}
+      dev.ebk.slice: \${EBK_LOCAL_DATABASE_SLICE}
+      dev.ebk.database: \${EBK_LOCAL_DATABASE_LOGICAL}
     environment:
       POSTGRES_DB: \${EBK_LOCAL_DATABASE}
       POSTGRES_PASSWORD: \${EBK_LOCAL_DATABASE_PASSWORD}
@@ -1518,13 +478,29 @@ export default defineConfig({
       timeout: 3s
       retries: 15
     ports:
-      - '\${EBK_LOCAL_DATABASE_PORT}:5432'
+      - '127.0.0.1:\${EBK_LOCAL_DATABASE_PORT}:5432'
     volumes:
       - database-data:/var/lib/postgresql/data
 
 volumes:
   database-data:
+    name: \${EBK_LOCAL_DATABASE_PROJECT}-data
+    labels:
+      dev.ebk.task: \${EBK_LOCAL_DATABASE_TASK}
+      dev.ebk.slice: \${EBK_LOCAL_DATABASE_SLICE}
+      dev.ebk.database: \${EBK_LOCAL_DATABASE_LOGICAL}
+
+networks:
+  default:
+    name: \${EBK_LOCAL_DATABASE_PROJECT}-network
+    labels:
+      dev.ebk.task: \${EBK_LOCAL_DATABASE_TASK}
+      dev.ebk.slice: \${EBK_LOCAL_DATABASE_SLICE}
+      dev.ebk.database: \${EBK_LOCAL_DATABASE_LOGICAL}
 `,
     };
+    return Object.fromEntries(Object.entries(files).filter(([path]) => sql ||
+        (!path.startsWith('database/') &&
+            path !== 'docs/runbooks/database-credential-rotation.md')));
 }
 //# sourceMappingURL=built-in-plan-data-files.js.map