@empire-builder-kit/nx 1.0.0-rc.40 → 1.0.0-rc.42

package/src/developer-agent/operation-registry.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DeveloperAgentOperationRegistryError = void 0;
+exports.ROUTER_WAF_REHEARSAL_OWNER_RATIONALE = exports.GRAPH_INTERACTIVE_RATIONALE = exports.FORMAT_WRITE_OWNER_RATIONALE = exports.WORKLOAD_DEV_OWNER_RATIONALE = exports.DOCKER_BUILD_OWNER_RATIONALE = exports.DEPLOY_LOCAL_OWNER_RATIONALE = exports.DeveloperAgentOperationRegistryError = void 0;
 exports.joinDeveloperAgentAuthorityClasses = joinDeveloperAgentAuthorityClasses;
 exports.createDeveloperAgentOperationRegistry = createDeveloperAgentOperationRegistry;
 exports.requireDeveloperAgentOperation = requireDeveloperAgentOperation;
@@ -37,7 +37,16 @@ const PROTECTED_CANONICAL_STAGES = [
     'production',
 ];
 const PROTECTED_WORKFLOW_ONLY_RATIONALE = 'This exact target is reserved for a protected workflow that supplies reviewed authority and retained evidence; Developer-Agent planning must use that owning workflow.';
-const LOCAL_OWNER_ONLY_RATIONALE = 'This exact target is intentionally unavailable to Developer-Agent planning; use its bounded framework owner instead.';
+/**
+ * Non-plannable local targets name their real owner. Each string states only
+ * behaviour that exists: none of them promises a Developer-Agent plan entry.
+ */
+exports.DEPLOY_LOCAL_OWNER_RATIONALE = 'Development deployment is owned by ebk deploy development [slice]: run that command directly with the saved development --profile and the policy-derived --expectedRoleArn. This root target is its Nx implementation, not a separate entry point.';
+exports.DOCKER_BUILD_OWNER_RATIONALE = 'Local workload image builds use the host Docker daemon outside any bounded owner. Verify workload source with its build, test and typecheck targets; ebk deploy development <slice> builds the deployable image.';
+exports.WORKLOAD_DEV_OWNER_RATIONALE = 'A hot workload process started outside the ebk dev Fleet has no owned port, lifecycle or cleanup. Verify Service and Job source with its test, typecheck and build targets and exercise it through ebk deploy development <slice>.';
+exports.FORMAT_WRITE_OWNER_RATIONALE = 'Formatting rewrites source files only: run pnpm nx format:write directly as part of a source edit, then rerun the required verification.';
+exports.GRAPH_INTERACTIVE_RATIONALE = 'nx graph starts an interactive browser server and is not a bounded operation; use ebk agent context for the read-only project inventory.';
+exports.ROUTER_WAF_REHEARSAL_OWNER_RATIONALE = 'The Router WAF rehearsal requires an exact --probeUrl that planning cannot derive: run it directly through its Nx target with that option after a development deployment.';
 function policyLifecycleActionForTarget(targetName) {
     if (exact('deploy', 'deploy-infrastructure', 'deploy-local', 'deployment-plan', 'foundation-ready')(targetName)) {
         return 'deploy';
@@ -402,19 +411,19 @@ const TARGET_SIGNATURES = [
         const kind = plural === 'services' ? 'service' : 'job';
         return (`docker build -f packages/${slice}/${plural}/${workload}/Dockerfile ` +
             `-t ${slice}-${kind}-${workload}:local ../../../..`);
-    }, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+    }, { nonPlannableRationale: exports.DOCKER_BUILD_OWNER_RATIONALE }),
     runScriptSignature('dev', (input) => input.project.root.includes('/services/')
         ? 'node --experimental-strip-types src/main.ts'
         : input.project.root.includes('/jobs/')
             ? 'node --experimental-strip-types src/run.ts'
-            : undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+            : undefined, { nonPlannableRationale: exports.WORKLOAD_DEV_OWNER_RATIONALE }),
     runScriptSignature('format', (input) => input.project.tags.includes('scope:workspace')
         ? 'nx format:write'
-        : undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+        : undefined, { nonPlannableRationale: exports.FORMAT_WRITE_OWNER_RATIONALE }),
     runScriptSignature('format:check', (input) => input.project.tags.includes('scope:workspace')
         ? 'nx format:check --all'
         : undefined),
-    runScriptSignature('graph', (input) => input.project.tags.includes('scope:workspace') ? 'nx graph' : undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+    runScriptSignature('graph', (input) => input.project.tags.includes('scope:workspace') ? 'nx graph' : undefined, { nonPlannableRationale: exports.GRAPH_INTERACTIVE_RATIONALE }),
     runScriptSignature('health', (input) => input.project.tags.includes('scope:workspace')
         ? `nx run ${input.project.name}:workspace-health`
         : undefined),
@@ -441,7 +450,7 @@ const TARGET_SIGNATURES = [
         ? 'pnpm run lint && pnpm run typecheck && pnpm test && pnpm run build'
         : undefined),
     executorSignature('deployment-plan', '@empire-builder-kit/nx:deployment-plan', exactOptions(() => ({ action: 'deploy', stage: 'staging' }))),
-    executorSignature('deploy-local', '@empire-builder-kit/nx:local-deploy', exactOptions(() => ({ stage: 'development' })), ['workspace-health'], { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+    executorSignature('deploy-local', '@empire-builder-kit/nx:local-deploy', exactOptions(() => ({ stage: 'development' })), ['workspace-health'], { nonPlannableRationale: exports.DEPLOY_LOCAL_OWNER_RATIONALE }),
     executorSignature('dev', '@empire-builder-kit/nx:fleet', exactOptions(() => ({})), undefined, {
         continuous: true,
     }),
@@ -528,7 +537,7 @@ const TARGET_SIGNATURES = [
             'capabilities,contract,deployIfMissing,foundationProject,stage', [{ params: 'ignore', projects: ['foundation'], target: 'verify' }]),
     executorSignature('profile-preflight', '@empire-builder-kit/nx:foundation-profile-preflight', exactOptions(() => ({ stage: 'development' }))),
     executorSignature('remove-preflight', '@empire-builder-kit/nx:foundation-remove-preflight', exactOptions(() => ({ stage: 'development' }))),
-    executorSignature('router-waf-rehearsal', '@empire-builder-kit/nx:router-waf-rehearsal', exactOptions(() => ({})), undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+    executorSignature('router-waf-rehearsal', '@empire-builder-kit/nx:router-waf-rehearsal', exactOptions(() => ({})), undefined, { nonPlannableRationale: exports.ROUTER_WAF_REHEARSAL_OWNER_RATIONALE }),
 ];
 /**
  * Rules are deliberately ordered from highest/conservative authority to
@@ -574,6 +583,8 @@ const TARGET_RULES = [
                 !suffix('-report', '-status')(targetName)),
         requiredVerification: ['verify', 'protected-proof'],
     },
+    // These two apply shared GitHub repository or AWS secret-container state
+    // outside the personal development stage, so they keep an approval point.
     {
         approvalRequired: true,
         authority: 'protected-propose',
@@ -589,12 +600,33 @@ const TARGET_RULES = [
             'docs/developer-agent.md',
         ],
         evidenceClasses: ['protected-promotion-proof'],
-        matches: (targetName) => exact('deployment-plan', 'github-bootstrap', 'infrastructure-plan', 'infrastructure-drift', 'ecr-inspector-collect', 'performance-cost-collect', 'reliability-deployed-verify', 'reliability-diagnostic', 'reliability-exercise-collect', 'secret-initialize', 'secret-metadata', 'smoke-deployed', 'stage-authority-render')(targetName),
+        matches: exact('github-bootstrap', 'secret-initialize'),
+        requiredVerification: ['source', 'protected-proof'],
+    },
+    // Report-first plans, collectors and deployed verification read and
+    // propose only; staging and production reach stays bounded by the
+    // deployment role, not by a plan-time approval point.
+    {
+        approvalRequired: false,
+        authority: 'protected-propose',
+        contractClasses: [
+            'configuration',
+            'infrastructure',
+            'reliability',
+            'performance',
+        ],
+        documentationPaths: [
+            'AGENTS.md',
+            'docs/git-workflow.md',
+            'docs/developer-agent.md',
+        ],
+        evidenceClasses: ['protected-promotion-proof'],
+        matches: (targetName) => exact('deployment-plan', 'infrastructure-plan', 'infrastructure-drift', 'ecr-inspector-collect', 'performance-cost-collect', 'reliability-deployed-verify', 'reliability-diagnostic', 'reliability-exercise-collect', 'secret-metadata', 'smoke-deployed', 'stage-authority-render')(targetName),
         requiredVerification: ['source', 'protected-proof'],
     },
     {
         applicableStages: ['development'],
-        approvalRequired: true,
+        approvalRequired: false,
         authority: 'development-mutate',
         contractClasses: ['database'],
         documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
@@ -602,13 +634,25 @@ const TARGET_RULES = [
         matches: exact('test-integration', 'verify-local-browser'),
         requiredVerification: ['local-integration'],
     },
+    // dev-setup can reach host trust-store installation and privileged port
+    // forwarding (--trust, --portless): an OS-level consent boundary.
     {
         approvalRequired: true,
         authority: 'development-mutate',
         contractClasses: ['database', 'infrastructure'],
         documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
         evidenceClasses: ['local-integration'],
-        matches: exact('dev', 'dev-cleanup', 'dev-task-cleanup', 'dev-setup', 'db-local-down', 'db-local-migrate', 'db-local-up', 'secret-personal-down'),
+        matches: exact('dev-setup'),
+        requiredVerification: ['local-integration'],
+    },
+    // Personal development-stage work under the human's own bounded identity.
+    {
+        approvalRequired: false,
+        authority: 'development-mutate',
+        contractClasses: ['database', 'infrastructure'],
+        documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+        evidenceClasses: ['local-integration'],
+        matches: exact('dev', 'dev-cleanup', 'dev-task-cleanup', 'db-local-down', 'db-local-migrate', 'db-local-up', 'secret-personal-down'),
         requiredVerification: ['local-integration'],
     },
     {
@@ -673,7 +717,7 @@ function localDevOperations(projects, externalOwnedProjectNames, developmentClos
     });
     const lifecycle = (command, slice) => ({
         applicableStages: ['development'],
-        approvalRequired: true,
+        approvalRequired: false,
         authority: 'development-mutate',
         command: {
             args: ['dev', command, slice, '--no-wait', '--json'],
@@ -1007,7 +1051,10 @@ function operationForTarget(input, forwardedStage, reviewedExternal = false) {
                     : ALL_CANONICAL_STAGES;
     return {
         applicableStages,
-        approvalRequired: developmentLifecycle ? true : rule.approvalRequired,
+        // Development needs no lifecycle acknowledgement (the governed executors
+        // prompt only for staging and production); protected stages never reach
+        // this branch and keep the rule's approval.
+        approvalRequired: developmentLifecycle ? false : rule.approvalRequired,
         authority,
         ...(authority === 'protected-mutate' || authority === 'destructive'
             ? {}

package/src/developer-agent/planning.d.ts

@@ -1,4 +1,4 @@
-import { type DeveloperAgentContext, type DeveloperAgentGeneratorInput, type DeveloperAgentGeneratorPreview, type DeveloperAgentPlan } from './model.js';
+import { type DeveloperAgentAuthorityClass, type DeveloperAgentContext, type DeveloperAgentGeneratorInput, type DeveloperAgentGeneratorPreview, type DeveloperAgentPlan } from './model.js';
 import { type DeveloperAgentOperationRegistry } from './operation-registry.js';
 export interface DeveloperAgentPlanRequest {
     acceptanceCriteriaReference: string;
@@ -15,4 +15,11 @@ export declare class DeveloperAgentPlanInputError extends Error {
     readonly classification: "invalid-input";
     constructor(message: string);
 }
+/**
+ * Names the gate an approval point actually stands for. Development-stage
+ * work through the bounded owners carries no approval point at all; the
+ * remaining points are protected authority, destructive recovery, an explicit
+ * shared-state apply, or host-level consent (dev-setup trust and ports).
+ */
+export declare function approvalPointDescription(authority: DeveloperAgentAuthorityClass): string;
 export declare function planDeveloperAgentWork(context: DeveloperAgentContext, registry: DeveloperAgentOperationRegistry, request: DeveloperAgentPlanRequest, options?: DeveloperAgentPlanOptions): DeveloperAgentPlan;

package/src/developer-agent/planning.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeveloperAgentPlanInputError = void 0;
+exports.approvalPointDescription = approvalPointDescription;
 exports.planDeveloperAgentWork = planDeveloperAgentWork;
 const model_js_1 = require("./model.js");
 const index_js_1 = require("../testing-evidence/index.js");
@@ -222,6 +223,27 @@ function policyBlockers(context, operation) {
     }
     return blockers;
 }
+/**
+ * Names the gate an approval point actually stands for. Development-stage
+ * work through the bounded owners carries no approval point at all; the
+ * remaining points are protected authority, destructive recovery, an explicit
+ * shared-state apply, or host-level consent (dev-setup trust and ports).
+ */
+function approvalPointDescription(authority) {
+    switch (authority) {
+        case 'protected-mutate':
+            return 'Matching GitHub environment and OIDC authority';
+        case 'destructive':
+            return 'Explicit human approval of the exact target and retained recovery proof';
+        case 'protected-propose':
+            return 'Human approval before the owning tool applies shared GitHub or AWS state with --apply';
+        case 'development-mutate':
+            return 'Human consent to host trust-store or privileged port-forwarding changes; the human answers any OS credential prompt';
+        case 'local-source':
+        case 'read-only':
+            return 'Explicit human approval before invoking the owning tool';
+    }
+}
 function nextAction(operation, blockers) {
     if (blockers.length > 0) {
         return {
@@ -381,9 +403,7 @@ function planDeveloperAgentWork(context, registry, request, options = {}) {
             ? [
                 {
                     authority: operation.authority,
-                    description: operation.authority === 'protected-mutate'
-                        ? 'Matching GitHub environment and OIDC authority'
-                        : 'Explicit owning-tool approval',
+                    description: approvalPointDescription(operation.authority),
                 },
             ]
             : [],

package/src/executors/local-deploy/local-approval.js

@@ -5,7 +5,7 @@ exports.createTtyLocalMutationApprover = createTtyLocalMutationApprover;
 const promises_1 = require("node:readline/promises");
 class LocalMutationApprovalUnavailableError extends Error {
     constructor() {
-        super('Local protected-stage mutation requires an interactive TTY operated by a human or authorized agent.');
+        super('Local protected-stage mutation requires a human at an interactive TTY to type the exact acknowledgement challenge. Development needs no acknowledgement. An agent without a terminal should hand the human the exact command to run in their own terminal, or propose the change through the protected GitHub workflow.');
         this.name = 'LocalMutationApprovalUnavailableError';
     }
 }

package/src/executors/sst-lifecycle/governed-native-operation.js

@@ -30,6 +30,7 @@ function readSource(root) {
         workingTreeDigest: identity.digest,
     };
 }
+const LOCAL_PROTECTED_LIFECYCLE_TTY_MESSAGE = 'Local protected-stage lifecycle mutation requires a human at an interactive TTY to type the exact acknowledgement challenge. Development needs no acknowledgement. An agent without a terminal should hand the human the exact command to run in their own terminal, or propose the change through the protected GitHub workflow.';
 /** Active operator acknowledgement, not an independent-review claim. */
 function createTtyGovernedNativeOperationApprover(terminal = {
     input: process.stdin,
@@ -37,7 +38,7 @@ function createTtyGovernedNativeOperationApprover(terminal = {
 }) {
     return async ({ challenge }) => {
         if (!terminal.input.isTTY || !terminal.output.isTTY) {
-            throw new Error('Local protected-stage lifecycle mutation requires an interactive TTY operated by a human or authorized agent.');
+            throw new Error(LOCAL_PROTECTED_LIFECYCLE_TTY_MESSAGE);
         }
         const prompt = (0, promises_1.createInterface)({
             input: terminal.input,
@@ -48,7 +49,7 @@ function createTtyGovernedNativeOperationApprover(terminal = {
             return ((await prompt.question(`Type ${challenge} to continue: `)) === challenge);
         }
         catch {
-            throw new Error('Local protected-stage lifecycle mutation requires an interactive TTY operated by a human or authorized agent.');
+            throw new Error(LOCAL_PROTECTED_LIFECYCLE_TTY_MESSAGE);
         }
         finally {
             prompt.close();

package/src/executors/sst-lifecycle/run-sst-command.d.ts

@@ -68,6 +68,12 @@ export declare function runGovernedChildProcess(input: {
     environment: NodeJS.ProcessEnv;
     executable: string;
     spawnChild?: typeof spawn;
+    /**
+     * Defaults to inheriting all three streams. A structured caller may route
+     * the child's stdout to the parent's stderr (`['inherit', 2, 'inherit']`)
+     * so its own stdout carries only the structured result.
+     */
+    stdio?: 'inherit' | readonly ['inherit', 2, 'inherit'];
 }): Promise<GovernedChildProcessResult>;
 export declare function createSstChildEnvironment(ambient: NodeJS.ProcessEnv, invocation: SstCommandInvocation['environment']): NodeJS.ProcessEnv;
 export declare function assertSafeSstForwardedArguments(args: readonly string[]): void;

package/src/executors/sst-lifecycle/run-sst-command.js

@@ -241,7 +241,9 @@ function runGovernedChildProcess(input) {
             detached: process.platform !== 'win32',
             env: environment,
             shell: false,
-            stdio: 'inherit',
+            stdio: input.stdio === undefined || input.stdio === 'inherit'
+                ? 'inherit'
+                : ['inherit', 2, 'inherit'],
         });
         let finishing = false;
         let settled = false;
@@ -760,38 +762,6 @@ function buildSstCommandInvocation(command, options, context, environment = proc
     };
 }
 async function runSstLifecyclePreflights(command, options, context, invocation, dependencies = {}, environment = process.env) {
-    // Standard Slices contain a Python infrastructure provisioner even when
-    // their application handlers are TypeScript. Fail before SST can partially
-    // create resources; recovery operations must remain available without build
-    // tooling. This is a local prerequisite, not a provider-plan gate.
-    if ((command === 'dev' || command === 'deploy') &&
-        (0, node_fs_1.existsSync)((0, node_path_1.join)(invocation.cwd, 'pyproject.toml'))) {
-        const manifest = (0, node_fs_1.lstatSync)((0, node_path_1.join)(invocation.cwd, 'pyproject.toml'));
-        if (!manifest.isFile() || manifest.isSymbolicLink()) {
-            throw new Error('Python tooling manifest must be a regular project file.');
-        }
-        const childEnvironment = {};
-        for (const key of ['PATH', 'Path', 'PATHEXT', 'SystemRoot', 'SYSTEMROOT']) {
-            if (environment[key] !== undefined)
-                childEnvironment[key] = environment[key];
-        }
-        const result = (0, node_child_process_1.spawnSync)('uv', ['--version'], {
-            cwd: invocation.cwd,
-            env: childEnvironment,
-            encoding: 'utf8',
-            timeout: 5_000,
-            maxBuffer: 4_096,
-            windowsHide: true,
-            shell: false,
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        if (result.error ||
-            result.status !== 0 ||
-            !/^uv \d+\.\d+\.\d+\b/.test(result.stdout ?? '')) {
-            // Do not surface arbitrary tool stderr or inherited credential material.
-            throw new Error(`Python tooling for ${context.projectName ?? 'the selected project'} requires uv on PATH. Install the workspace-documented uv version and retry the same EBK command. No SST child started.`);
-        }
-    }
     const stage = command === 'dev' ||
         (command === 'remove' && invocation.environment.EBK_NX_TASK_CLEANUP) ||
         (command === 'unlock' && invocation.environment.EBK_NX_TASK_UNLOCK)

package/src/foundation/cost-estimate.d.ts

@@ -0,0 +1,170 @@
+import { type DeploymentProfile } from '../repository-policy/index.js';
+/**
+ * Dated AWS list-price snapshot for the generated cost estimate.
+ *
+ * Every price is copied from the public AWS Price List bulk API
+ * (https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/index.json),
+ * OnDemand terms, without rounding. `usd` is the published price per AWS
+ * `unit`; `per` only scales the displayed unit (for example per million
+ * requests). Refresh the whole snapshot together, change `capturedOn`, and
+ * re-render docs/foundation.md; never compute a date at generation time.
+ */
+export interface ListPriceSource {
+    /** Price List offer code. */
+    offer: string;
+    /** Version segment of the offer file URL. */
+    version: string;
+    /** Offer file region segment: us-east-1, or aws-other for global rates. */
+    file: 'aws-other' | 'us-east-1';
+    sku: string;
+    rateCode: string;
+    usageType: string;
+}
+export interface ListUnitPrice {
+    /** Exact published USD price per AWS unit. */
+    usd: string;
+    /** Display multiplier (a power of ten) applied to `usd`. */
+    per: number;
+    /** Display unit for `per` AWS units, e.g. "million requests". */
+    unit: string;
+    source: ListPriceSource;
+}
+export declare const FOUNDATION_LIST_PRICE_SNAPSHOT: {
+    readonly capturedOn: "2026-10-02";
+    readonly currency: "USD";
+    readonly hoursPerMonth: 730;
+    readonly offerFileUrlTemplate: "https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/<offer>/<version>/<file>/index.json";
+    readonly region: {
+        readonly code: "us-east-1";
+        readonly name: "US East (N. Virginia)";
+    };
+    readonly prices: {
+        readonly apiGatewayHttpRequests: ListUnitPrice;
+        readonly appConfigConfigurationRequests: ListUnitPrice;
+        readonly appConfigConfigurationsReceived: ListUnitPrice;
+        readonly auroraPostgresBackup: ListUnitPrice;
+        readonly auroraPostgresIo: ListUnitPrice;
+        readonly auroraPostgresServerlessV2Acu: ListUnitPrice;
+        readonly auroraPostgresStorage: ListUnitPrice;
+        readonly cloudFrontDataTransferOut: ListUnitPrice;
+        readonly cloudFrontHttpsRequests: ListUnitPrice;
+        readonly cloudWatchAlarmMetric: ListUnitPrice;
+        readonly cloudWatchCustomMetric: ListUnitPrice;
+        readonly cloudWatchDashboard: ListUnitPrice;
+        readonly cloudWatchLogsDataProtection: ListUnitPrice;
+        readonly cloudWatchLogsIngest: ListUnitPrice;
+        readonly cloudWatchLogsStorage: ListUnitPrice;
+        readonly cognitoEssentialsMau: ListUnitPrice;
+        readonly cognitoLiteMau: ListUnitPrice;
+        readonly cognitoMachineAppClient: ListUnitPrice;
+        readonly cognitoMachineTokenRequest: ListUnitPrice;
+        readonly dynamoDbPitrStorage: ListUnitPrice;
+        readonly dynamoDbReadRequestUnits: ListUnitPrice;
+        readonly dynamoDbStorage: ListUnitPrice;
+        readonly dynamoDbWriteRequestUnits: ListUnitPrice;
+        readonly ec2T4gNano: ListUnitPrice;
+        readonly eventBridgeArchiveProcessed: ListUnitPrice;
+        readonly eventBridgeArchiveStorage: ListUnitPrice;
+        readonly eventBridgeCustomEvents: ListUnitPrice;
+        readonly fargateMemoryGbHour: ListUnitPrice;
+        readonly fargateVcpuHour: ListUnitPrice;
+        readonly kmsKey: ListUnitPrice;
+        readonly kmsRequests: ListUnitPrice;
+        readonly lambdaComputeX86: ListUnitPrice;
+        readonly lambdaRequests: ListUnitPrice;
+        readonly natGatewayData: ListUnitPrice;
+        readonly natGatewayHour: ListUnitPrice;
+        readonly publicIpv4InUse: ListUnitPrice;
+        readonly route53HostedZone: ListUnitPrice;
+        readonly s3StandardStorage: ListUnitPrice;
+        readonly secretsManagerApi: ListUnitPrice;
+        readonly secretsManagerSecret: ListUnitPrice;
+        readonly snsRequests: ListUnitPrice;
+        readonly sqsFifoRequests: ListUnitPrice;
+        readonly sqsStandardRequests: ListUnitPrice;
+        readonly stepFunctionsStandardTransitions: ListUnitPrice;
+        readonly wafRequests: ListUnitPrice;
+        readonly wafRule: ListUnitPrice;
+        readonly wafWebAcl: ListUnitPrice;
+    };
+};
+export type ListPriceKey = keyof typeof FOUNDATION_LIST_PRICE_SNAPSHOT.prices;
+/**
+ * Generated Foundation quantities that are literals in the Foundation template
+ * or inside SST 4.17.1 components rather than in a framework contract. The
+ * cost-estimate count-drift spec executes the generated Foundation and fails
+ * when any of these differ from what the generator constructs.
+ */
+export declare const FOUNDATION_COST_INVENTORY: {
+    /** One CloudFront Router Web ACL per stage. */
+    readonly wafWebAcls: 1;
+    /** One Foundation CloudWatch dashboard per stage. */
+    readonly dashboards: 1;
+    /** Declared network: `az: 2`, one Elastic IP and one NAT unit per public subnet. */
+    readonly availabilityZones: 2;
+    /** SST Vpc Cloud Map private DNS namespace (a Route 53 private hosted zone). */
+    readonly privateHostedZones: 1;
+    /** Declared nonproduction NAT mode; production uses its capacity contract. */
+    readonly nonproductionNat: "ec2";
+    /** SST Aurora master credential secret. */
+    readonly auroraMasterSecrets: 1;
+    /** Declared SQL Foundation alarm metrics (Aurora capacity alarm). */
+    readonly sqlAlarmMetrics: 1;
+    /** Declared nonproduction Aurora scaling. */
+    readonly nonproductionAurora: {
+        readonly development: {
+            readonly max: "2 ACU";
+            readonly min: "0 ACU";
+            readonly pauseAfter: "5 minutes";
+        };
+        readonly staging: {
+            readonly max: "4 ACU";
+            readonly min: "0 ACU";
+            readonly pauseAfter: "5 minutes";
+        };
+    };
+    /** Seeded Router WAF access: nonproduction allowlist, production public. */
+    readonly routerWafAccess: {
+        readonly development: "allowlist";
+        readonly staging: "allowlist";
+        readonly production: "public";
+    };
+};
+export interface StandardSliceCostInventory {
+    alarms: number;
+    alarmMetrics: number;
+    dataProtectedLogGroups: number;
+    kmsKeys: number;
+    /** Secrets Manager secrets created by Slice infrastructure. */
+    secrets: number;
+    machineClients: number;
+    dashboards: number;
+}
+/**
+ * Per-stage fixed inventory of one default Standard Slice (no async adapters,
+ * performance load off). The count-drift spec renders and executes the
+ * generated Slice infrastructure and fails when these differ.
+ */
+export declare const STANDARD_SLICE_COST_INVENTORY: Readonly<{
+    sqlFree: StandardSliceCostInventory;
+    sqlDeclared: StandardSliceCostInventory;
+    personalStage: StandardSliceCostInventory;
+}>;
+export declare const FOUNDATION_COST_ESTIMATE_BEGIN_MARKER = "<!-- ebk:foundation-cost-estimate:begin -->";
+export declare const FOUNDATION_COST_ESTIMATE_END_MARKER = "<!-- ebk:foundation-cost-estimate:end -->";
+/** The exact label every rendered estimate carries. */
+export declare function foundationCostEstimateLabel(): string;
+/** Nonproduction Aurora scaling as costs.md prose, e.g. "0–4 ACUs, pause after 5 idle minutes". */
+export declare function nonproductionAuroraScalingLabel(stage: 'development' | 'staging'): string;
+export interface FoundationCostEstimateOptions {
+    deploymentProfile: DeploymentProfile;
+    /** Markdown level of the estimate's top heading (2 for costs.md, 3 for docs). */
+    headingLevel: 2 | 3;
+}
+/**
+ * Pure, deterministic Markdown renderer for the dated list-price estimate.
+ * Quantities derive from the Foundation capability plan, the deployment
+ * profile's active stages, the production capacity contracts and the
+ * drift-checked inventories above. No clock, network or environment input.
+ */
+export declare function renderFoundationCostEstimate(options: FoundationCostEstimateOptions): string;