@empire-builder-kit/nx 1.0.0-rc.40 → 1.0.0-rc.42

package/src/generators/preset/workspace-files.js

@@ -11,12 +11,14 @@ const dependency_overrides_js_1 = require("./dependency-overrides.js");
 const index_js_1 = require("../../ownership/index.js");
 const index_js_2 = require("../../frontend-security/index.js");
 const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const cost_estimate_js_1 = require("../../foundation/cost-estimate.js");
 const index_js_3 = require("../../git-policy/index.js");
 const index_js_4 = require("../../repository-policy/index.js");
 const index_js_5 = require("../../release/index.js");
 const index_js_6 = require("../../supply-chain/index.js");
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 const tool_versions_js_1 = require("./tool-versions.js");
+const workspace_files_shared_operation_claims_js_1 = require("./workspace-files-shared-operation-claims.js");
 const workspace_files_developer_agent_js_1 = require("./workspace-files-developer-agent.js");
 const workspace_files_ci_acceptance_js_1 = require("./workspace-files-ci-acceptance.js");
 const workspace_files_ci_install_js_1 = require("./workspace-files-ci-install.js");
@@ -1069,6 +1071,7 @@ const WORKSPACE_SEEDED_PATHS = new Set([
     'docs/stage-deployment-authority.md',
     'docs/workspace-deployment-ownership.md',
     'docs/work-markers.md',
+    workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIMS_PATH,
     'ebk.repository-policy.json',
 ]);
 exports.WORKSPACE_PACKAGE_MANAGED_JSON_POINTERS = [
@@ -7459,7 +7462,7 @@ jobs:
             fi
             sleep 5
           done
-          echo 'No pull-request verification run materialized. Close and reopen the sync pull request as a human, then approve its workflows.'
+          echo "No pull-request verification run materialized; events created with GITHUB_TOKEN may not start workflows. Close and reopen sync pull request #$number with a user credential (a write-access user, or an agent in that user's own gh session: gh pr close $number && gh pr reopen $number), then approve its workflows if GitHub marks them approval-required."
           exit 1
 `,
         'tools/ebk-infrastructure-plan-summary.mjs': `import {
@@ -7706,10 +7709,9 @@ At a local milestone, \`pnpm verify\` checks current source through
 protected Blueprint acceptance. The separate \`${name}:verify\` target and
 protected GitHub workflows retain their committed-history and trust gates.
 
-Human-supplied secret values are a human-only TTY ceremony. Agents and CI must
-never invoke \`ebk secret set\` or \`ebk secret remove\`. They may use
-value-blind metadata, status, verification, and the exact generated-secret
-initializer, which accepts and returns no plaintext value.
+Human-supplied secret values are entered only by a human. The Developer-Agent workflow
+below describes the hand-off for \`ebk secret set\` and \`ebk secret remove\` and the
+value-blind paths agents and CI use.
 
 ## Work markers
 
@@ -7853,7 +7855,21 @@ deployment by themselves. Open \`SECURITY\` and \`BLOCKER\` markers fail staging
 deploy or refresh before AWS access. Protected remove and unlock remain usable for recovery.
 There is no local or silent bypass in this prerelease contract; any future waiver mechanism
 must be committed, reviewable, and auditable.
+
+## Shared-operation claims
+
+\`${workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIMS_PATH}\` is a seeded claim ledger for operations that only one
+actor at a time may run: gateway setup, package release, candidate adoption, database
+replacement, and development deployment. Before starting one, an agent or human reads the
+current ledger where the other actors record claims; if another open claim names the same
+operation, it stops and reports the conflict instead of running the operation. Otherwise it
+records one \`EBK-TODO\` claim with the reference
+\`PLAN:${workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIM_PHASE}/<operation>\`, commits it where the others read the
+ledger, and deletes the claim when the operation and its verification are complete. The
+work-markers target above lists open claims. Nothing enforces a claim; the ledger is a
+convention, current only as far as the copy each actor reads.
 `,
+        [workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIMS_PATH]: (0, workspace_files_shared_operation_claims_js_1.renderSharedOperationClaims)(name),
         'ebk.repository-policy.json': json(initialRepositoryPolicy),
         'nx.json': json({
             $schema: './node_modules/nx/schemas/nx-schema.json',
@@ -8126,8 +8142,8 @@ The machine-readable stage inventory is \`../contracts/costs.json\`; keep this
 seeded decision record aligned with organization-specific budgets and alerts.
 
 - When network/SQL is declared, development uses EC2 NAT, a development bastion,
-  and Aurora scale-to-zero.
-${deploymentProfile === 'starter' ? '' : '- Declared staging network/SQL uses EC2 NAT and Aurora scale-to-zero by default.\n'}- Declared production networking uses managed NAT; production retains protected data. Its explicit Repository
+  and Aurora scale-to-zero (${(0, cost_estimate_js_1.nonproductionAuroraScalingLabel)('development')}).
+${deploymentProfile === 'starter' ? '' : `- Declared staging network/SQL uses EC2 NAT and Aurora scale-to-zero (${(0, cost_estimate_js_1.nonproductionAuroraScalingLabel)('staging')}) by default.\n`}- Declared production networking uses managed NAT; production retains protected data. Its explicit Repository
   Operating Policy profile selects cost-optimized (0–2 ACUs, pause after five idle
   minutes), balanced (0.5–4 ACUs, always warm), or standard (2–16 ACUs, always warm).
   Newly generated repositories default to cost-optimized in every deployment profile.
@@ -8139,10 +8155,14 @@ ${deploymentProfile === 'starter' ? '' : '- Declared staging network/SQL uses EC
   upgrade, then opt into cost-optimized separately if cold starts are acceptable.
 - ECS, EventBridge, Cognito, SNS, SSM, and CloudWatch are primarily usage-priced; logs,
   metrics, alarms, and retained data still require active cost review.
+- Every deployed stage of every Standard Slice, including each personal development
+  stage, adds its own fixed floor: a KMS key, secrets, a machine-to-machine app client,
+  CloudWatch alarms and a dashboard. The estimate below lists it.
 
 Run \`foundation:remove\` only for disposable stages. Production is retained and protected by
 the SST configuration.
-`,
+
+${(0, cost_estimate_js_1.renderFoundationCostEstimate)({ deploymentProfile, headingLevel: 2 })}`,
         'packages/foundation/docs/security.md': `# Foundation security contract
 
 - Production resources are retained and protected.

package/src/generators/slice/built-in-plan-api-contract-files.js

@@ -2017,10 +2017,13 @@ An intentional baseline update requires a reviewed JSON approval:
 pnpm nx run ${name}:api-contract-baseline -- --approval=path/to/approval.json
 \`\`\`
 
-Compatible approvals pin the exact candidate digest and reason. Conditional
-approvals also require semantic-review evidence. Breaking approvals require
-consumer evidence, rollout evidence, and an exact rollout-plan identity and
-digest. Baseline updates never occur during generation or verification.
+An agent may author the approval file. Compatible approvals pin the exact
+candidate digest and reason, and the agent may apply them directly during
+development. Conditional approvals also require semantic-review evidence, and
+breaking approvals require consumer evidence, rollout evidence, and an exact
+rollout-plan identity and digest; a human reviews those two classes before the
+baseline command runs. Baseline updates never occur during generation or
+verification.
 
 Other Slices may import only \`@<workspace>/${name}/api-contract\`,
 \`@<workspace>/${name}/api-client\`, or the transport-neutral

package/src/generators/slice/built-in-plan-authorization-files.js

@@ -1189,18 +1189,23 @@ async function exchange(input: {
     token_type?: unknown;
   };
   const expiresIn = Number(value.expires_in);
-  const scopes =
-    typeof value.scope === 'string'
-      ? value.scope.split(/\\s+/).filter(Boolean)
-      : [];
   if (
     typeof value.access_token !== 'string' ||
     value.token_type !== 'Bearer' ||
     !Number.isFinite(expiresIn) ||
-    expiresIn < 1
+    expiresIn < 1 ||
+    (value.scope !== undefined && typeof value.scope !== 'string')
   ) {
     throw new Error('Machine token exchange returned an invalid response.');
   }
+  // RFC 6749 section 5.1: an omitted scope is identical to the requested
+  // scope. Amazon Cognito omits it from client_credentials responses and
+  // rejects, never narrows, a scope the client may not use. A returned scope
+  // is still parsed, and createMachineTokenProvider requires the exact set.
+  const scopes =
+    value.scope === undefined
+      ? [...input.scopes]
+      : value.scope.split(/\\s+/).filter(Boolean);
   return {
     accessToken: value.access_token,
     audience: input.audience,