@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/workload/frozen-container.d.ts

@@ -1,4 +1,4 @@
-export declare const WORKLOAD_CONTAINER_NODE_IMAGE: "node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2";
+export declare const WORKLOAD_CONTAINER_NODE_IMAGE: "node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402";
 export declare const WORKLOAD_CONTAINER_PNPM_VERSION: "11.20.0";
 export declare const WORKLOAD_CONTAINER_PNPM_DESCRIPTOR: "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 export declare const WORKLOAD_CONTAINER_PNPM_STORE = "/workspace/.ebk/cache/pnpm-store";

package/src/generators/workload/performance-registration.d.ts

@@ -14,6 +14,7 @@ export interface WorkloadPerformancePlan {
     contents: string;
     ownsProtectedLoadAdapter: boolean;
     path: string;
+    protectedRuntimeStages: readonly ('development' | 'production' | 'staging')[];
     tagContext: {
         frameworkVersion: string;
         owner: string;

package/src/generators/workload/performance-registration.js

@@ -7,6 +7,7 @@ const node_path_1 = require("node:path");
 const index_js_1 = require("../../performance/index.js");
 const index_js_2 = require("../../repository-policy/index.js");
 const index_js_3 = require("../../ownership/index.js");
+const tree_policy_js_1 = require("../repository-policy/tree-policy.js");
 exports.WORKLOAD_PERFORMANCE_POLICY_PATH = 'performance/policy.json';
 exports.WORKLOAD_PERFORMANCE_SCENARIO_PATH = 'performance/load-scenarios.json';
 exports.WORKLOAD_PERFORMANCE_OPERATIONS_PATH = 'operations/performance.json';
@@ -180,13 +181,12 @@ function planWorkloadPerformanceRegistration(tree, input) {
     }
     capacity.push(registration);
     capacity.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.id, right.id));
-    const repositoryPolicyResult = (0, index_js_2.validateRepositoryOperatingPolicy)(readJson(tree, index_js_2.REPOSITORY_POLICY_FILE, 'Repository operating policy'));
-    if (!repositoryPolicyResult.valid) {
-        throw new Error(`Repository operating policy is invalid at ${index_js_2.REPOSITORY_POLICY_FILE}: ${repositoryPolicyResult.issues
-            .map(({ message, path: issuePath }) => `${issuePath} ${message}`)
-            .join('; ')}`);
-    }
-    const productionProfile = repositoryPolicyResult.value.productionFoundation.profile;
+    const repositoryPolicy = (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree);
+    const productionProfile = repositoryPolicy.productionFoundation.profile;
+    const protectedRuntimeStages = [
+        (0, index_js_2.productionRehearsalStage)(repositoryPolicy.deploymentProfile),
+        'production',
+    ];
     (0, index_js_1.createStandardResourceTags)({
         frameworkVersion: input.runtimeVersion,
         owner: policy.owner,
@@ -197,10 +197,7 @@ function planWorkloadPerformanceRegistration(tree, input) {
         workspace: input.workspace,
     });
     const nextPolicy = (0, index_js_1.validatePerformancePolicy)({ ...policy, capacity });
-    const logicalName = `${input.slice
-        .split('-')
-        .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)
-        .join('')}PerformanceLoadHmacKeys`;
+    const logicalName = 'GeneratedPerformanceLoadHmacKeys';
     const servicePlan = input.kind === 'service'
         ? planManagedServicePerformanceFiles(tree, {
             logicalName,
@@ -215,6 +212,7 @@ function planWorkloadPerformanceRegistration(tree, input) {
         contents: `${JSON.stringify(nextPolicy, null, 2)}\n`,
         ownsProtectedLoadAdapter: servicePlan.ownsProtectedLoadAdapter,
         path,
+        protectedRuntimeStages,
         tagContext: {
             frameworkVersion: input.runtimeVersion,
             owner: policy.owner,

package/src/generators/workload/service-performance-files.d.ts

@@ -1,4 +1,5 @@
 export declare function renderServicePerformanceFiles(input: {
+    protectedRuntimeStages: readonly ('development' | 'production' | 'staging')[];
     slice: string;
     workload: string;
 }): Readonly<Record<string, string>>;

package/src/generators/workload/service-performance-files.js

@@ -9,9 +9,18 @@ function pascal(value) {
         .join('');
 }
 function renderServicePerformanceFiles(input) {
+    if (input.protectedRuntimeStages.length === 0 ||
+        new Set(input.protectedRuntimeStages).size !==
+            input.protectedRuntimeStages.length) {
+        throw new Error('Service performance generation requires unique protected runtime stages.');
+    }
     const sliceClass = pascal(input.slice);
     const workloadClass = pascal(input.workload);
-    const secretName = `${sliceClass}PerformanceLoadHmacKeys`;
+    const protectedRuntimeStages = `[${input.protectedRuntimeStages
+        .map((stage) => `'${stage}'`)
+        .join(', ')}]`;
+    const fixtureStage = input.protectedRuntimeStages[0];
+    const secretName = 'GeneratedPerformanceLoadHmacKeys';
     const reservationResourceName = `${sliceClass}${workloadClass}PerformanceReservations`;
     const workloadIdentity = `${input.slice}.${input.workload}-service-performance-task`;
     const executePath = `/${input.slice}/__ebk/performance/service`;
@@ -101,14 +110,15 @@ const performanceHmacKeys = secret.json<PerformanceHmacKeys>({
 const PerformanceSecrets = defineSecrets({
   ${secretName}: {
     cache: { freshTtlMs: 1_000, staleTtlMs: 0 },
+    generation: { kind: 'hmac-key-ring-v1' },
     owner: '${input.slice}',
-    requiredStages: ['staging', 'production'],
+    requiredStages: ${protectedRuntimeStages},
     retention: { mode: 'retain' },
     rotation: {
       mode: 'manual',
       runbook: 'docs/runbooks/performance-capacity-cost.md',
     },
-    source: 'operator',
+    source: 'generated',
     value: performanceHmacKeys,
   },
 });
@@ -650,7 +660,17 @@ export function createProtectedServicePerformanceExecutor(input: {
 
 const executeRequest = createProtectedServicePerformanceExecutor();
 
-let resolverStage: 'production' | 'staging' | undefined;
+const PROTECTED_RUNTIME_STAGES = ${protectedRuntimeStages} as const;
+type ProtectedRuntimeStage = (typeof PROTECTED_RUNTIME_STAGES)[number];
+
+function isProtectedRuntimeStage(
+  value: string | undefined,
+): value is ProtectedRuntimeStage {
+  return typeof value === 'string' &&
+    (PROTECTED_RUNTIME_STAGES as readonly string[]).includes(value);
+}
+
+let resolverStage: ProtectedRuntimeStage | undefined;
 let resolver: ReturnType<typeof createServerSecretResolver> | undefined;
 
 async function withEndpointBinding<Result>(
@@ -660,7 +680,7 @@ async function withEndpointBinding<Result>(
   const stage = process.env.EBK_STAGE;
   if (
     process.env.EBK_PERFORMANCE_LOAD_ENABLED !== 'true' ||
-    (stage !== 'staging' && stage !== 'production')
+    !isProtectedRuntimeStage(stage)
   ) {
     throw new Error('protected-performance-endpoint-disabled');
   }
@@ -926,7 +946,7 @@ const binding: ProtectedLoadEndpointBindingV1 = {
   deployedReleaseMaterialDigest: 'c'.repeat(64),
   deployedSourceCommit: 'd'.repeat(40),
   hmacKeys: { current: hmacKey },
-  stage: 'staging',
+  stage: '${fixtureStage}',
   target: {
     accountFingerprint: 'sha256:' + 'a'.repeat(64),
     origin: 'https://service.example.test',
@@ -958,7 +978,7 @@ function authorization(operation: 'cleanup' | 'execute'):
     runId: 'service-run',
     saturationSignalRef: SERVICE_PER_TASK_SATURATION_SIGNAL_REF,
     scenarioId: 'service-extension',
-    stage: 'staging',
+    stage: '${fixtureStage}',
     target: {
       ...binding.target,
       endpoint: 'https://service.example.test' +

package/src/generators/workload/workload.d.ts

@@ -13,5 +13,5 @@ export interface WorkloadFilePlan {
     }>;
     project: string;
 }
-export declare function createWorkloadFilePlan(workspace: string, slice: string, workload: string, kind: WorkloadKind, runtimeVersion: string, feature: string, ownsProtectedLoadAdapter: boolean): WorkloadFilePlan;
+export declare function createWorkloadFilePlan(workspace: string, slice: string, workload: string, kind: WorkloadKind, runtimeVersion: string, feature: string, ownsProtectedLoadAdapter: boolean, protectedRuntimeStages?: readonly ('development' | 'production' | 'staging')[]): WorkloadFilePlan;
 export declare function workloadGenerator(tree: Tree, options: WorkloadGeneratorSchema, kind: WorkloadKind): Promise<GeneratorCallback | void>;

package/src/generators/workload/workload.js

@@ -4,13 +4,19 @@ exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = exports.WORKLOAD_PACKAG
 exports.createWorkloadFilePlan = createWorkloadFilePlan;
 exports.workloadGenerator = workloadGenerator;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
-const devkit_1 = require("@nx/devkit");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../ownership/index.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const preview_changes_js_1 = require("../../developer-agent/preview-changes.js");
+const upgrade_js_1 = require("../upgrade/upgrade.js");
+const built_in_plan_foundation_files_js_1 = require("../slice/built-in-plan-foundation-files.js");
 const feature_registry_js_1 = require("../feature-registry.js");
+const formatting_js_1 = require("../formatting.js");
 const logging_registry_js_1 = require("../logging-registry.js");
 const post_generation_install_js_1 = require("../post-generation-install.js");
 const tool_versions_js_1 = require("../preset/tool-versions.js");
+const workspace_files_js_1 = require("../preset/workspace-files.js");
+const built_in_plan_js_1 = require("../slice/built-in-plan.js");
 const built_in_plan_shared_js_1 = require("../slice/built-in-plan-shared.js");
 const frozen_container_js_1 = require("./frozen-container.js");
 const performance_registration_js_1 = require("./performance-registration.js");
@@ -131,7 +137,7 @@ exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = [
     '/dependencies/@aws-sdk~1client-dynamodb',
     '/dependencies/sst',
 ];
-function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, ownsProtectedLoadAdapter) {
+function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, ownsProtectedLoadAdapter, protectedRuntimeStages = ['staging', 'production']) {
     const plural = kind === 'service' ? 'services' : 'jobs';
     const relativeRoot = node_path_1.posix.join(plural, workload);
     const className = `${pascal(slice)}${pascal(workload)}${pascal(kind)}`;
@@ -226,6 +232,20 @@ function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion
             .replace("health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:3000/health || exit 1'] },", "health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:' + DEFAULT_SERVICE_PORT + '/health || exit 1'] },")
             .replace('serviceRegistry: { port: 3000 },', 'serviceRegistry: { port: DEFAULT_SERVICE_PORT },');
     }
+    const nativeAuthorityInfrastructurePath = `${relativeRoot}/infra.ts`;
+    const nativeAuthorityInfrastructure = files[nativeAuthorityInfrastructurePath] ?? '';
+    const nativeAuthoritySeams = [
+        '../../infra/workload-roles/effective-intent.js',
+        '  roles?: { executionRole: string; taskRole: string },',
+        '    ...(roles ?? {}),',
+    ];
+    if (nativeAuthoritySeams.some((fragment) => !nativeAuthorityInfrastructure.includes(fragment))) {
+        throw new Error(`Built-in ${kind} infrastructure is missing its native permission integration point.`);
+    }
+    files[nativeAuthorityInfrastructurePath] = nativeAuthorityInfrastructure
+        .replace('../../infra/workload-roles/effective-intent.js', '../../infra/native-runtime-authority/effective-intent.js')
+        .replace('  roles?: { executionRole: string; taskRole: string },', '  permissions: any,')
+        .replace('    ...(roles ?? {}),', '    permissions,');
     if (kind === 'service' && ownsProtectedLoadAdapter) {
         const mainPath = `${relativeRoot}/src/main.ts`;
         let mainSource = files[mainPath] ?? '';
@@ -243,7 +263,11 @@ function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion
           'content-type': 'application/json',
         });`);
         files[mainPath] = mainSource;
-        Object.assign(files, (0, service_performance_files_js_1.renderServicePerformanceFiles)({ slice, workload }));
+        Object.assign(files, (0, service_performance_files_js_1.renderServicePerformanceFiles)({
+            protectedRuntimeStages,
+            slice,
+            workload,
+        }));
     }
     const infrastructurePath = `${relativeRoot}/infra.ts`;
     const packageLocalImage = `image: { context: './${plural}/${workload}', dockerfile: 'Dockerfile' }`;
@@ -261,12 +285,12 @@ import { createStandardResourceTags } from '@empire-builder-kit/nx/performance';
 import { resolveStandardContainerImage } from '../../infra/container-images.js';
 `);
     replaceInfrastructureFragment(`  alertTopicArn: any,
-  roles?: { executionRole: string; taskRole: string },
+  permissions: any,
 `, `  alertTopicArn: any,
   performance: {
     frameworkVersion: string;
     owner: string;
-    productionProfile: 'cost-optimized' | 'standard';
+    productionProfile: 'cost-optimized' | 'balanced' | 'standard';
     repository: string;
   },
 ${kind !== 'service' || ownsProtectedLoadAdapter
@@ -289,7 +313,7 @@ ${kind !== 'service' || ownsProtectedLoadAdapter
     router: any;
   } | undefined,
 `
-        : ''}  roles?: { executionRole: string; taskRole: string },
+        : ''}  permissions: any,
 `);
     replaceInfrastructureFragment(`    workspace: '${workspace}',
   });
@@ -423,10 +447,10 @@ ${kind !== 'service' || ownsProtectedLoadAdapter
     }
     infrastructureSource = infrastructureSource.replace(packageLocalImage, protectedReleaseImage);
     if (kind === 'service' && ownsProtectedLoadAdapter) {
-        replaceInfrastructureFragment(`import { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';`, `import {
+        replaceInfrastructureFragment(`import { standardSliceExtensionTaskFamily } from '../../infra/native-runtime-authority/effective-intent.js';`, `import {
   standardSliceExtensionTaskFamily,
   standardSliceServicePerformanceReservationTableName,
-} from '../../infra/workload-roles/effective-intent.js';`);
+} from '../../infra/native-runtime-authority/effective-intent.js';`);
         replaceInfrastructureFragment(`  const workload = new sst.aws.Service`, `  const performanceReservations = performanceDeploymentBinding
     ? new aws.dynamodb.Table(
     '${className}PerformanceReservationsTable',
@@ -1010,7 +1034,7 @@ describe('${workload} ${kind} outage behavior', () => {
         project: `@${slice}/${kind}-${workload}`,
     };
 }
-async function workloadGenerator(tree, options, kind) {
+async function executeWorkloadGenerator(tree, options, kind) {
     const slice = name(options.slice, 'Product Slice name');
     const workload = name(options.name, kind === 'service' ? 'Service name' : 'Job name');
     const requestedFeature = name(options.feature, 'Feature');
@@ -1018,8 +1042,8 @@ async function workloadGenerator(tree, options, kind) {
     const sliceRoot = node_path_1.posix.join('packages', slice);
     const root = node_path_1.posix.join(sliceRoot, plural, workload);
     const productPath = node_path_1.posix.join(sliceRoot, 'infra/product.ts');
-    const candidatePath = node_path_1.posix.join(sliceRoot, 'infra/workload-roles/candidate.ts');
-    const intentPath = node_path_1.posix.join(sliceRoot, 'infra/workload-roles/effective-intent.ts');
+    const topologyPath = node_path_1.posix.join(sliceRoot, 'infra/native-runtime-authority/topology.ts');
+    const intentPath = node_path_1.posix.join(sliceRoot, 'infra/native-runtime-authority/effective-intent.ts');
     const installOperation = {
         generator: 'workload',
         id: `generator:workload:${slice}:${kind}:${workload}`,
@@ -1033,6 +1057,7 @@ async function workloadGenerator(tree, options, kind) {
         },
         resumeArguments: [
             'pnpm',
+            '--config.verify-deps-before-run=warn',
             'nx',
             'generate',
             `@empire-builder-kit/nx:${kind}`,
@@ -1070,8 +1095,28 @@ async function workloadGenerator(tree, options, kind) {
     if (!tree.exists(productPath)) {
         throw new Error(`${slice} is not an EBK v1 Product Slice.`);
     }
-    requireCompositionMarker(tree, candidatePath, '// <ebk:workload-role-extensions:end>');
-    requireCompositionMarker(tree, intentPath, '// <ebk:workload-role-intent-contributions:end>');
+    const ownership = (0, index_js_1.validateGeneratedOwnershipRecord)(JSON.parse(tree.read(node_path_1.posix.join(sliceRoot, '.ebk/ownership.json'), 'utf8') ?? 'null'));
+    if (!ownership.valid)
+        throw new Error('Product Slice ownership is invalid before workload composition.');
+    const foundationPath = node_path_1.posix.join(sliceRoot, 'infra/foundation.ts');
+    const foundationSource = tree.read(foundationPath, 'utf8');
+    const foundationOwner = ownership.value.paths.find(({ path }) => path === 'infra/foundation.ts');
+    if (foundationSource === null ||
+        foundationOwner?.mode !== 'managed' ||
+        (0, index_js_1.hashOwnedContent)(foundationSource, foundationOwner) !==
+            foundationOwner.sha256)
+        throw new Error('Product Slice Foundation bindings have managed drift; reconcile ownership before workload generation.');
+    const foundationRequirement = {
+        contract: ownership.value.foundation.contract,
+        capabilities: (0, capability_plan_js_1.planFoundationCapabilities)({
+            requirements: [
+                ownership.value.foundation,
+                { contract: '^2.0.0', capabilities: ['network', 'container-compute'] },
+            ],
+        }).descriptor.capabilities,
+    };
+    requireCompositionMarker(tree, topologyPath, '// <ebk:native-runtime-extensions:end>');
+    requireCompositionMarker(tree, intentPath, '// <ebk:native-runtime-intent-contributions:end>');
     for (const marker of [
         '// <ebk:composition-imports:end>',
         '// <ebk:workload-registrations:end>',
@@ -1099,12 +1144,13 @@ async function workloadGenerator(tree, options, kind) {
         slice,
         sliceRoot,
     });
-    const plan = createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, performanceRegistration.ownsProtectedLoadAdapter);
+    const plan = createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, performanceRegistration.ownsProtectedLoadAdapter, performanceRegistration.protectedRuntimeStages);
     const additionalPerformancePaths = performanceRegistration.additionalFiles.map(({ path }) => path);
     const installScope = {
         exactPaths: [
+            foundationPath,
             productPath,
-            candidatePath,
+            topologyPath,
             intentPath,
             node_path_1.posix.join(sliceRoot, logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH),
             node_path_1.posix.join(sliceRoot, performance_registration_js_1.WORKLOAD_PERFORMANCE_POLICY_PATH),
@@ -1116,7 +1162,7 @@ async function workloadGenerator(tree, options, kind) {
         requiredPaths: [
             node_path_1.posix.join(root, 'package.json'),
             productPath,
-            candidatePath,
+            topologyPath,
             intentPath,
             node_path_1.posix.join(sliceRoot, logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH),
             node_path_1.posix.join(sliceRoot, performance_registration_js_1.WORKLOAD_PERFORMANCE_POLICY_PATH),
@@ -1125,12 +1171,28 @@ async function workloadGenerator(tree, options, kind) {
             node_path_1.posix.join(sliceRoot, RELEASE_REGISTRY_PATH),
             node_path_1.posix.join(sliceRoot, '.ebk/ownership.json'),
         ],
-        roots: [root],
+        roots: [root, 'packages/foundation'],
     };
     const installState = options.skipInstall
         ? undefined
         : (0, post_generation_install_js_1.capturePostGenerationInstallState)(tree, installScope, installOperation);
     const { factoryName } = plan;
+    // Capability growth and its consuming bindings are a single deferred source
+    // operation. A container needs network/compute, never an implicit database.
+    await (0, upgrade_js_1.upgradeFoundationForRequirements)(tree, [foundationRequirement], true);
+    if (!ownership.value.foundation.capabilities.includes('network')) {
+        // Capability growth must update the API's consuming network binding in
+        // this same generation, before a Service registers private ingress.
+        const source = tree.read(productPath, 'utf8');
+        if (source === null)
+            throw new Error('Product Slice API source is missing; no workload files changed.');
+        const anchor = `  const api = new sst.aws.ApiGatewayV2('${pascal(slice)}Api', {`;
+        if (source.split(anchor).length !== 2)
+            throw new Error('Product Slice API composition is not recognized; no workload files changed.');
+        tree.write(productPath, source.replace(anchor, anchor +
+            '\n    ...(performanceDeploymentAuthority ? { vpc: foundation.vpc } : {}),'));
+    }
+    tree.write(foundationPath, (0, built_in_plan_foundation_files_js_1.renderSliceFoundationFiles)(slice, pascal(slice), foundationRequirement.capabilities)['infra/foundation.ts']);
     const infraRelative = `../${plural}/${workload}/infra.js`;
     for (const [path, contents] of Object.entries(plan.files)) {
         tree.write(node_path_1.posix.join(sliceRoot, path), contents);
@@ -1159,13 +1221,13 @@ ${kind !== 'service' || performanceRegistration.ownsProtectedLoadAdapter
 ${kind === 'service' && performanceRegistration.ownsProtectedLoadAdapter
         ? `    performanceIngress,
     performanceDeploymentBinding
-      ? workloadRoleBindings?.extension.servicePerformance('${workload}')
-      : workloadRoleBindings?.extension.service('${workload}'),
+      ? nativeAuthority.permissions('${workload}-service-performance-task')
+      : nativeAuthority.permissions('${workload}-service-task'),
 `
         : kind === 'service'
-            ? `    workloadRoleBindings?.extension.service('${workload}'),
+            ? `    nativeAuthority.permissions('${workload}-service-task'),
 `
-            : `    workloadRoleBindings?.extension.job('${workload}'),
+            : `    nativeAuthority.permissions('${workload}-job-task'),
 `}
 ${kind === 'service' && performanceRegistration.ownsProtectedLoadAdapter
         ? `    performanceDeploymentBinding
@@ -1187,17 +1249,24 @@ ${kind === 'service' && performanceRegistration.ownsProtectedLoadAdapter
       : undefined,
   );`);
     replaceMarker(tree, productPath, '// <ebk:composition-outputs:end>', `    ${kind}${pascal(workload)},`);
-    replaceMarker(tree, candidatePath, '// <ebk:workload-role-extensions:end>', `  { id: '${workload}', kind: '${kind}' },`);
-    replaceMarker(tree, intentPath, '// <ebk:workload-role-intent-contributions:end>', `    ...extensionWorkloadRoleIntentContributions(context, topology, '${workload}', '${kind}'),`);
-    if (!options.skipFormat)
-        await (0, devkit_1.formatFiles)(tree);
+    replaceMarker(tree, topologyPath, '// <ebk:native-runtime-extensions:end>', `  { id: '${workload}', kind: '${kind}' },`);
+    replaceMarker(tree, intentPath, '// <ebk:native-runtime-intent-contributions:end>', `    ...extensionWorkloadRoleIntentContributions(context, topology, '${workload}', '${kind}'),`);
+    if (!options.skipFormat) {
+        const slicePrefix = `${sliceRoot}/`;
+        const restoreProtectedFiles = (0, formatting_js_1.createTreeFileRestorer)(tree, (path) => (0, workspace_files_js_1.isRawWorkspaceAuthorityPath)(path) ||
+            (path.startsWith(slicePrefix) &&
+                (0, built_in_plan_js_1.isBuiltInSliceFormatSensitivePath)(path.slice(slicePrefix.length))));
+        await (0, formatting_js_1.formatChangedTreeToFixedPoint)(tree, restoreProtectedFiles);
+    }
     (0, index_js_1.recordCompositionOwnership)(tree, {
         compositions: [{ feature, kind, name: workload }],
+        foundation: foundationRequirement,
         paths: [
             ...plan.paths,
+            { path: 'infra/foundation.ts' },
             { path: 'infra/product.ts' },
-            { path: 'infra/workload-roles/candidate.ts' },
-            { path: 'infra/workload-roles/effective-intent.ts' },
+            { path: 'infra/native-runtime-authority/topology.ts' },
+            { path: 'infra/native-runtime-authority/effective-intent.ts' },
             { path: logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH },
             { mode: 'seeded', path: performance_registration_js_1.WORKLOAD_PERFORMANCE_POLICY_PATH },
             ...performanceRegistration.additionalFiles.map(({ mode, path }) => ({
@@ -1210,8 +1279,9 @@ ${kind === 'service' && performanceRegistration.ownsProtectedLoadAdapter
         projects: [plan.project],
         slice,
     });
-    if (!options.skipFormat)
-        await (0, devkit_1.formatFiles)(tree);
+    if (!options.skipFormat) {
+        await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, node_path_1.posix.join(sliceRoot, '.ebk/ownership.json'));
+    }
     if (options.skipInstall)
         return undefined;
     if (!installState) {
@@ -1219,4 +1289,10 @@ ${kind === 'service' && performanceRegistration.ownsProtectedLoadAdapter
     }
     return (0, post_generation_install_js_1.createPostGenerationInstallCallback)(tree, installState, installScope, installOperation);
 }
+async function workloadGenerator(tree, options, kind) {
+    const deferred = new preview_changes_js_1.DeferredDeveloperAgentTree(tree);
+    const install = await executeWorkloadGenerator(deferred, options, kind);
+    deferred.apply();
+    return install;
+}
 //# sourceMappingURL=workload.js.map

package/src/git-policy/action-pins.d.ts

@@ -1,4 +1,9 @@
 export declare const GITHUB_ACTION_PINS: {
+    readonly cache: {
+        readonly action: "actions/cache";
+        readonly sha: "0057852bfaa89a56745cba8c7296529d2fc39830";
+        readonly tag: "v4.3.0";
+    };
     readonly checkout: {
         readonly action: "actions/checkout";
         readonly sha: "df4cb1c069e1874edd31b4311f1884172cec0e10";

package/src/git-policy/action-pins.js

@@ -3,6 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GITHUB_ACTION_PINS = void 0;
 exports.pinnedAction = pinnedAction;
 exports.GITHUB_ACTION_PINS = {
+    cache: {
+        action: 'actions/cache',
+        sha: '0057852bfaa89a56745cba8c7296529d2fc39830',
+        tag: 'v4.3.0',
+    },
     checkout: {
         action: 'actions/checkout',
         sha: 'df4cb1c069e1874edd31b4311f1884172cec0e10',

package/src/git-policy/github-bootstrap.d.ts

@@ -1,24 +1,55 @@
-import { type ProductionApprovalMode } from '../repository-policy/index.js';
+import { type DeliveryLane, type DeploymentProfile, type ProductionApprovalMode } from '../repository-policy/index.js';
 export declare const EBK_PROTECTED_BRANCH_RULESET_NAME = "Empire Builder Kit protected branches";
 export declare const EBK_REQUIRED_CHECKS: readonly ["policy", "verify"];
-export declare const EBK_DEPLOYMENT_ROLE_SECRET = "AWS_DEPLOY_ROLE_ARN";
+export declare const EBK_RETIRED_DEPLOYMENT_ROLE_SECRET = "AWS_DEPLOY_ROLE_ARN";
 export declare const EBK_ECR_INSPECTOR_EVIDENCE_ROLE_SECRET = "AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN";
 export declare const EBK_ASYNC_RECOVERY_ROLE_SECRET = "AWS_ASYNC_RECOVERY_ROLE_ARN";
 export declare const EBK_PERFORMANCE_AGGREGATE_ROLE_SECRET = "AWS_PERFORMANCE_AGGREGATE_ROLE_ARN";
 export declare const EBK_PERFORMANCE_COST_ROLE_SECRET = "AWS_PERFORMANCE_COST_ROLE_ARN";
 export declare const EBK_PERFORMANCE_LOAD_ROLE_SECRET = "AWS_PERFORMANCE_LOAD_ROLE_ARN";
 export declare const EBK_PERFORMANCE_ORIGINS_VARIABLE: "EBK_PERFORMANCE_ORIGINS_JSON";
-export declare const EBK_RELIABILITY_READ_ROLE_SECRET = "AWS_RELIABILITY_READ_ROLE_ARN";
-export declare const EBK_SMOKE_ROLE_SECRET = "AWS_SMOKE_ROLE_ARN";
+/** Production environment secret that lets trunk promotion fast-forward main. */
+export declare const EBK_RECORD_MAIN_TOKEN_SECRET: "EBK_RECORD_MAIN_TOKEN";
+/** Trunk promotion keeps main behind status checks and fast-forward pushes only. */
+export declare const EBK_PROTECTED_MAIN_RULESET_NAME: "EBK protected main (trunk promotion)";
 export declare const EBK_STAGING_PROMOTION_PULL_ROLE_SECRET = "AWS_STAGING_PROMOTION_PULL_ROLE_ARN";
-export declare const EBK_PROTECTED_ENVIRONMENT_SECRETS: readonly ["AWS_ASYNC_RECOVERY_ROLE_ARN", "AWS_DEPLOY_ROLE_ARN", "AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN", "AWS_PERFORMANCE_AGGREGATE_ROLE_ARN", "AWS_PERFORMANCE_COST_ROLE_ARN", "AWS_PERFORMANCE_LOAD_ROLE_ARN", "AWS_RELIABILITY_READ_ROLE_ARN", "AWS_SMOKE_ROLE_ARN", "AWS_STAGING_PROMOTION_PULL_ROLE_ARN"];
-export declare const EBK_PROTECTED_ENVIRONMENT_VARIABLES: readonly ["AWS_EXPECTED_ACCOUNT_ID", "AWS_REGION", "AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID", "AWS_STAGING_PROMOTION_REGION", "EBK_ALLOW_PRODUCTION_REMOVE", "EBK_FLEET_ORIGIN", "EBK_PERFORMANCE_ORIGINS_JSON", "EBK_SMOKE_AUTHORITY_VERSION", "EBK_SMOKE_TARGETS"];
-export declare const EBK_PRODUCTION_PLAN_REPOSITORY_VARIABLES: readonly ["AWS_PRODUCTION_PLAN_EXPECTED_ACCOUNT_ID", "AWS_PRODUCTION_PLAN_GENERATED_OBJECT_ARNS_JSON", "AWS_PRODUCTION_PLAN_GENERATED_PARAMETER_ARNS_JSON", "AWS_PRODUCTION_PLAN_GENERATED_SECRET_ARNS_JSON", "AWS_PRODUCTION_PLAN_PROVIDER_REFRESH_POLICY_JSON", "AWS_PRODUCTION_PLAN_REGION", "AWS_PRODUCTION_PLAN_ROLE_ARN", "AWS_PRODUCTION_PLAN_SST_APPS_JSON", "AWS_PRODUCTION_PLAN_STATE_BUCKET_ARN", "AWS_PRODUCTION_PLAN_STATE_KMS_KEY_ARN", "EBK_PRODUCTION_FLEET_ORIGIN"];
-export declare const EBK_STAGING_PLAN_REPOSITORY_VARIABLES: readonly ["AWS_STAGING_PLAN_EXPECTED_ACCOUNT_ID", "AWS_STAGING_PLAN_GENERATED_OBJECT_ARNS_JSON", "AWS_STAGING_PLAN_GENERATED_PARAMETER_ARNS_JSON", "AWS_STAGING_PLAN_GENERATED_SECRET_ARNS_JSON", "AWS_STAGING_PLAN_PROVIDER_REFRESH_POLICY_JSON", "AWS_STAGING_PLAN_REGION", "AWS_STAGING_PLAN_ROLE_ARN", "AWS_STAGING_PLAN_SST_APPS_JSON", "AWS_STAGING_PLAN_STATE_BUCKET_ARN", "AWS_STAGING_PLAN_STATE_KMS_KEY_ARN", "EBK_STAGING_FLEET_ORIGIN"];
+export declare const EBK_PROTECTED_ENVIRONMENT_SECRETS: readonly ["AWS_ASYNC_RECOVERY_ROLE_ARN", "AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN", "AWS_DEPLOY_ROLE_ARN", "AWS_STAGING_PROMOTION_PULL_ROLE_ARN"];
+export declare const EBK_PROTECTED_ENVIRONMENT_VARIABLES: readonly ["AWS_EXPECTED_ACCOUNT_ID", "AWS_REGION", "AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID", "AWS_STAGING_PROMOTION_REGION", "EBK_ALLOW_PRODUCTION_REMOVE", "EBK_FLEET_ORIGIN"];
+/**
+ * Non-secret stage environment variables an operator may set to request a
+ * machine credential generation or its retirement on a workflow deploy. They
+ * are never required, and a repository- or organization-scoped copy would
+ * silently apply to every stage, so only the stage environment may hold them.
+ */
+export declare const EBK_OPTIONAL_STAGE_ENVIRONMENT_VARIABLES: readonly ["EBK_MACHINE_CREDENTIAL_GENERATION", "EBK_MACHINE_RETIRE_PREVIOUS_GENERATION"];
 export declare const EBK_CODE_OWNER_PLACEHOLDER: "@REPLACE_WITH_GITHUB_CODE_OWNER";
+type GitHubEnvironmentStage = 'development' | 'production' | 'staging';
+type GitHubAuxiliaryEnvironment = 'async-recovery' | 'ecr-inspector';
+export type GitHubEnvironmentName = `${GitHubAuxiliaryEnvironment}-${GitHubEnvironmentStage}` | GitHubEnvironmentStage | 'npm-prerelease';
+export interface GitHubEnvironmentTopologyEntry {
+    /** Further branches admitted alongside branch (trunk promotion admits
+     * develop into production-stage environments). */
+    additionalBranches?: readonly ('develop' | 'main')[];
+    branch: 'develop' | 'main';
+    name: GitHubEnvironmentName;
+    /** Variables the environment may hold but never requires. */
+    optionalVariables?: readonly string[];
+    requiredSecrets: readonly string[];
+    requiredVariables: readonly string[];
+    stage: GitHubEnvironmentStage;
+}
+/**
+ * Exact generated GitHub environment contract for one deployment profile.
+ * Starter uses development as its rehearsal stage; isolated profiles use
+ * staging. Production and npm publication remain present for every profile.
+ */
+export declare function githubEnvironmentTopology(deploymentProfile: DeploymentProfile, deliveryLane?: DeliveryLane, productionApprovalMode?: ProductionApprovalMode): readonly GitHubEnvironmentTopologyEntry[];
 export interface GitHubBootstrapOptions {
     apiBaseUrl?: string;
     apply?: boolean;
+    deliveryLane?: DeliveryLane;
+    deploymentProfile?: DeploymentProfile;
+    immutableOidcTrustAcknowledgement?: string;
     npmPrereleaseReviewerIds?: number[];
     productionApprovalMode: ProductionApprovalMode;
     productionReviewerIds?: number[];
@@ -28,9 +59,18 @@ export interface GitHubBootstrapOptions {
 export interface GitHubBootstrapReport {
     blockers: string[];
     changes: string[];
+    deploymentProfile: DeploymentProfile;
     ready: boolean;
     repository: string;
+    repositoryIdentity?: GitHubRepositoryIdentity;
     productionApprovalMode: ProductionApprovalMode;
     warnings: string[];
 }
+export interface GitHubRepositoryIdentity {
+    fullName: string;
+    ownerId: string;
+    repositoryId: string;
+    subjectPrefix: string;
+}
 export declare function runGitHubBootstrap(options: GitHubBootstrapOptions): Promise<GitHubBootstrapReport>;
+export {};