@empire-builder-kit/nx 1.0.0-rc.45 → 1.0.0-rc.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.45",
+  "version": "1.0.0-rc.46",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -145,7 +145,7 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.45",
+    "@empire-builder-kit/runtime": "1.0.0-rc.46",
     "@aws-sdk/client-cloudfront": "^3.700.0",
     "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
@@ -178,5 +178,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "24b8859bb40fe58e57caf41555513f90fa734a05"
+  "gitHead": "2165c67769556e404a2d0e9d2f5bcdd23413fce8"
 }

package/src/developer-agent/generator-planning.js

@@ -11,7 +11,8 @@ exports.rebindDeveloperAgentGeneratorPlan = rebindDeveloperAgentGeneratorPlan;
 const node_util_1 = require("node:util");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
-const index_js_1 = require("../blueprints/index.js");
+const index_js_1 = require("../repository-policy/index.js");
+const index_js_2 = require("../blueprints/index.js");
 const function_js_1 = require("../generators/function/function.js");
 const logging_registry_js_1 = require("../generators/logging-registry.js");
 const built_in_plan_js_1 = require("../generators/slice/built-in-plan.js");
@@ -313,7 +314,7 @@ function slicePlan(context, input, mode, rebindCompleted = false) {
         workspacePathExists(context, node_path_1.posix.join('packages', input.name))) {
         return unavailableGeneratorDestination(`Product Slice ${input.name} collides with an existing packages/${input.name} path.`);
     }
-    const blueprint = (0, index_js_1.resolveBlueprint)({
+    const blueprint = (0, index_js_2.resolveBlueprint)({
         engineVersion: context.workspace.frameworkVersion,
         reference: 'standard',
         workspaceRoot: context.workspace.repositoryRoot,
@@ -420,7 +421,13 @@ function workloadPlan(context, input, mode, rebindCompleted = false) {
     const ownsProtectedLoadAdapter = kind === 'service'
         ? serviceShouldOwnProtectedLoadAdapter(context, input.slice)
         : false;
-    const plan = (0, workload_js_1.createWorkloadFilePlan)(context.workspace.identity, input.slice, input.name, kind, context.workspace.frameworkVersion, input.feature, ownsProtectedLoadAdapter);
+    const plan = (0, workload_js_1.createWorkloadFilePlan)(context.workspace.identity, input.slice, input.name, kind, context.workspace.frameworkVersion, input.feature, ownsProtectedLoadAdapter, ownsProtectedLoadAdapter
+        ? [
+            (0, index_js_1.productionRehearsalStage)((0, index_js_1.readRepositoryOperatingPolicy)(context.workspace.repositoryRoot)
+                .deploymentProfile),
+            'production',
+        ]
+        : []);
     if (!rebindCompleted) {
         requireAvailableProspectiveProjectIds(context, [plan.project], `${kind} ${input.name}`);
     }

package/src/developer-agent/operation-registry.js

@@ -409,7 +409,7 @@ const TARGET_SIGNATURES = [
                 : undefined;
         }
         const kind = plural === 'services' ? 'service' : 'job';
-        return (`docker build -f packages/${slice}/${plural}/${workload}/Dockerfile ` +
+        return ('docker build -f Dockerfile ' +
             `-t ${slice}-${kind}-${workload}:local ../../../..`);
     }, { nonPlannableRationale: exports.DOCKER_BUILD_OWNER_RATIONALE }),
     runScriptSignature('dev', (input) => input.project.root.includes('/services/')

package/src/executors/github-bootstrap/github-bootstrap.d.ts

@@ -3,6 +3,9 @@ interface GitHubBootstrapExecutorOptions {
     apply?: boolean;
     immutableOidcTrustAcknowledgement?: string;
     npmPrereleaseReviewerIds?: string;
+    npmStable?: boolean;
+    npmStableReviewerIds?: string;
+    npmStablePreventSelfReview?: boolean;
     productionReviewerIds?: string;
     repository?: string;
 }

package/src/executors/github-bootstrap/github-bootstrap.js

@@ -10,6 +10,34 @@ function parseReviewerIds(value) {
 }
 const executor = async (options, context) => {
     try {
+        if (options.npmStable === true) {
+            if (options.npmStableReviewerIds === undefined ||
+                !/^[1-9][0-9]*(,[1-9][0-9]*)*$/.test(options.npmStableReviewerIds) ||
+                typeof options.npmStablePreventSelfReview !== 'boolean') {
+                throw new Error('npm-stable requires explicit reviewer IDs and prevent-self-review choice.');
+            }
+            if (options.npmPrereleaseReviewerIds !== undefined ||
+                options.productionReviewerIds !== undefined ||
+                options.immutableOidcTrustAcknowledgement !== undefined) {
+                throw new Error('npm-stable does not accept adopter bootstrap options.');
+            }
+            const report = await (0, index_js_1.runGitHubBootstrap)({
+                npmStable: true,
+                apply: options.apply === true,
+                repository: options.repository?.trim() ?? '',
+                npmStableReviewerIds: parseReviewerIds(options.npmStableReviewerIds),
+                npmStablePreventSelfReview: options.npmStablePreventSelfReview,
+                token: process.env.GH_TOKEN?.trim() ||
+                    process.env.GITHUB_TOKEN?.trim() ||
+                    '',
+            });
+            devkit_1.logger.info(JSON.stringify(report, null, 2));
+            return { success: options.apply ? report.ready : true };
+        }
+        if (options.npmStableReviewerIds !== undefined ||
+            options.npmStablePreventSelfReview !== undefined) {
+            throw new Error('npm-stable settings require the explicit npmStable selector.');
+        }
         const policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
         const report = await (0, index_js_1.runGitHubBootstrap)({
             apply: options.apply === true,

package/src/executors/github-bootstrap/schema.json

@@ -31,6 +31,20 @@
       "type": "string",
       "pattern": "^[1-9][0-9]*(,[1-9][0-9]*)*$",
       "description": "Optional comma-separated GitHub user IDs when committed Repository Operating Policy selects environment-reviewer mode. Existing reviewers are preserved when omitted."
+    },
+    "npmStable": {
+      "type": "boolean",
+      "default": false,
+      "description": "Configure only the framework npm-stable environment; exact framework repository required."
+    },
+    "npmStableReviewerIds": {
+      "type": "string",
+      "pattern": "^[1-9][0-9]*(,[1-9][0-9]*)*$",
+      "description": "Explicit GitHub user IDs for the framework npm-stable required reviewers."
+    },
+    "npmStablePreventSelfReview": {
+      "type": "boolean",
+      "description": "Explicit prevent-self-review choice for the framework npm-stable environment."
     }
   }
 }

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -759,7 +759,11 @@ ${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()
       # production authority is derived here beside the staging authority.
       - id: production-account
         name: Derive canonical committed production authority for trunk promotion
-        if: steps.route.outputs.stage == 'staging'
+        if: >-
+          steps.route.outputs.action == 'deploy' &&
+          steps.route.outputs.stage == 'staging' &&
+          steps.policy.outputs.deployment_profile != 'starter' &&
+          steps.policy.outputs.has_slices == 'true'
         env:
           EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
           EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}

package/src/generators/preset/workspace-files.js

@@ -7659,6 +7659,7 @@ console.log('Installed the repository-local EBK pre-push hook at ' + hookPath +
 .open-next
 dist
 *.tsbuildinfo
+**/next-env.d.ts
 node_modules
 .sst
 **/playwright/.auth
@@ -8365,36 +8366,38 @@ ${foundationPlan.resources.network ? "  const natMode = productionConfiguration?
   if (repositoryPolicy.deploymentProfile !== normalizedRouterWafPolicy.deploymentProfile) {
     throw new Error('Router WAF policy profile differs from committed repository policy.');
   }
-  const rehearsalStage = productionRehearsalStage(normalizedRouterWafPolicy.deploymentProfile);
-  const rehearsalAccount = configuredDeploymentAccountForStage(
-    normalizedRouterWafPolicy.deploymentProfile,
-    repositoryPolicy.deploymentAccounts,
-    rehearsalStage,
-  );
-  const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
-  const rehearsalRoleArn = createStageAuthorityIdentity({
-    accountId: rehearsalAccount,
-    partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
-    region: rehearsalRegion,
-    stage: rehearsalStage,
-  }).deploymentRoleArn;
+  let rehearsal: ReturnType<typeof reconcileRouterWafBlockingRehearsal> = null;
+  if (isProduction) {
+    const rehearsalStage = productionRehearsalStage(normalizedRouterWafPolicy.deploymentProfile);
+    const rehearsalAccount = configuredDeploymentAccountForStage(
+      normalizedRouterWafPolicy.deploymentProfile,
+      repositoryPolicy.deploymentAccounts,
+      rehearsalStage,
+    );
+    const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
+    const rehearsalRoleArn = createStageAuthorityIdentity({
+      accountId: rehearsalAccount,
+      partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
+      region: rehearsalRegion,
+      stage: rehearsalStage,
+    }).deploymentRoleArn;
+    rehearsal = reconcileRouterWafBlockingRehearsal({
+      evidence: routerWafLiveEvidence,
+      expected: {
+        accountId: rehearsalAccount,
+        deploymentRoleArn: rehearsalRoleArn,
+        region: rehearsalRegion,
+        stage: rehearsalStage,
+        wafContractDigest: routerWafContractDigest(normalizedRouterWafPolicy),
+        workspace: '${name}',
+      },
+      policy: normalizedRouterWafPolicy,
+      receipt: routerWafBlockingRehearsal,
+    });
+  }
   const wafPlan = createRouterWafStagePlan({
     policy: normalizedRouterWafPolicy,
-    rehearsal: isProduction
-      ? reconcileRouterWafBlockingRehearsal({
-          evidence: routerWafLiveEvidence,
-          expected: {
-            accountId: rehearsalAccount,
-            deploymentRoleArn: rehearsalRoleArn,
-            region: rehearsalRegion,
-            stage: rehearsalStage,
-            wafContractDigest: routerWafContractDigest(normalizedRouterWafPolicy),
-            workspace: '${name}',
-          },
-          policy: normalizedRouterWafPolicy,
-          receipt: routerWafBlockingRehearsal,
-        })
-      : null,
+    rehearsal,
     stage: $app.stage,
   });
   const deploymentAccount = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';

package/src/generators/slice/built-in-plan-data-files.js

@@ -350,9 +350,16 @@ value to GitHub secrets, workflow input, argv, or agent-visible material.
 
 The protected deploy role needs metadata authority for the Slice prefix:
 \`ListSecrets\`, \`DescribeSecret\`, \`CreateSecret\`, and \`TagResource\`.
-It must be denied \`BatchGetSecretValue\`, \`GetSecretValue\`,
-\`PutSecretValue\`, \`UpdateSecret\`, \`UpdateSecretVersionStage\`,
-and application deployment outside its separately reviewed deploy policy.
+It is denied \`BatchGetSecretValue\`, \`UpdateSecretVersionStage\`, and
+application deployment outside its separately reviewed deploy policy, and it is
+denied \`GetSecretValue\` and \`PutSecretValue\` for every operator and
+generated secret; the exact tagged Foundation database credential is the only
+value-action exception. \`UpdateSecret\` is permitted only inside the stage's
+\`ebk/<stage>/*\` namespace and the Foundation provider secret, so native
+recovery can reconcile EBK-owned containers. \`CreateSecret\` and
+\`UpdateSecret\` can both carry a value and IAM cannot prove a call is
+metadata-only, so reviewed generated source, temporary deployment credentials,
+and CloudTrail are the controls.
 \`DeleteSecret\` is used only by the governed generated-secret retirement path
 after native Slice removal succeeds; the executor binds that call to the exact
 generated HMAC name and ownership tags described above.

package/src/generators/slice/built-in-plan-metadata-files.js

@@ -337,7 +337,10 @@ keep the source checkout, continue an interrupted report with its run
 reference, and retry the same approved run. Never delete its checkpoint,
 pending deletion work or retained evidence to silence the alarm.
 `,
-        'ebk-globals.d.ts': `import 'sst/resource';
+        'ebk-globals.d.ts': `// Next.js ambient types, independent of the gitignored web/next-env.d.ts.
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import 'sst/resource';
 
 declare global {
   type EbkSstOutput<T> = {

package/src/generators/slice/built-in-plan-release-files.js

@@ -6360,7 +6360,6 @@ if (['stopped', 'recovering'].includes(result.rollout.phase)) {
                         sourceInputPaths: [
                             `packages/${name}/configuration`,
                             `packages/${name}/infra`,
-                            `packages/${name}/web/next-env.d.ts`,
                             `packages/${name}/web/next.config.ts`,
                             `packages/${name}/web/open-next.config.ts`,
                             `packages/${name}/web/src`,

package/src/generators/slice/built-in-plan-verification-files.js

@@ -416,7 +416,6 @@ test('renders the Slice through its exact task HTTPS origin', async ({ page }) =
   expect(response?.status()).toBe(200);
   expect(response?.headers()['x-ebk-upstream']).toBe('local');
   expect(new URL(page.url()).origin).toBe(target.origin);
-  await expect(page.getByRole('heading', { name: '${pascalName}', exact: true })).toBeVisible();
 });
 `,
         'playwright.config.ts': `import { defineConfig } from '@playwright/test';

package/src/generators/slice/built-in-plan-web-files.js

@@ -2,11 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductWebFiles = renderProductWebFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
-const sst_environment_source_format_js_1 = require("../../sst-environment-source-format.js");
 /** @internal */
 function renderProductWebFiles(name, pascalName, workspace, sql = false) {
     return {
-        'web/next-env.d.ts': (0, sst_environment_source_format_js_1.generatedNextEnvironmentSource)(),
         'web/tsconfig.json': (0, built_in_plan_shared_js_1.json)({
             extends: '../tsconfig.json',
             compilerOptions: {
@@ -18,9 +16,10 @@ function renderProductWebFiles(name, pascalName, workspace, sql = false) {
                 incremental: true,
                 plugins: [{ name: 'next' }],
             },
-            // Next 16.3 regenerates next-env.d.ts and rewrites tsconfig.json when
-            // these entries are missing; the generated files match its output so
-            // a build leaves the tracked workspace unchanged.
+            // Next rewrites tsconfig.json when these entries are missing, so the
+            // generated include matches its output. Next writes the gitignored
+            // next-env.d.ts itself on dev, build, and typegen; EBK does not
+            // generate or track it.
             include: [
                 'next-env.d.ts',
                 '.next/types/**/*.ts',

package/src/generators/slice/built-in-plan.js

@@ -48,7 +48,6 @@ const FORMAT_SENSITIVE_BUILT_IN_PATHS = new Set([
     'api/generated/baseline.json',
     'api/generated/contract.json',
     'api/generated/openapi.json',
-    'web/next-env.d.ts',
 ]);
 function isBuiltInSliceFormatSensitivePath(path) {
     return (path.startsWith('database/migrations/') ||
@@ -257,7 +256,7 @@ function classifyPaths(files, sql) {
     ]);
     for (const path of built_in_plan_performance_files_js_1.PRODUCT_PERFORMANCE_SEEDED_PATHS)
         seededPaths.add(path);
-    const toolOwnedPaths = new Set(['sst-env.d.ts', 'web/next-env.d.ts']);
+    const toolOwnedPaths = new Set(['sst-env.d.ts']);
     return Object.entries(files)
         .filter(([path]) => path !== '.ebk/ownership.json' && !toolOwnedPaths.has(path))
         .map(([path, contents]) => {

package/src/generators/upgrade/upgrade.js

@@ -470,6 +470,89 @@ function appendSeededReconciliationMarker(tree, root, report) {
         return;
     tree.write(anchor, `${current.replace(/\s*$/, '')}\n\n${SEEDED_RECONCILIATION_MARKER}\n`);
 }
+function isJsonObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function appendServiceTaskPresenceReconciliation(currentFiles, currentOwnership, targetOwnership, report) {
+    const services = currentOwnership.compositions
+        .filter(({ kind }) => kind === 'service')
+        .map(({ name }) => name)
+        .sort(deterministic_order_js_1.compareUtf16);
+    if (services.length === 0)
+        return;
+    const registryPath = 'operations/reliability.json';
+    const source = currentFiles.get(registryPath);
+    if (source === null || source === undefined)
+        return;
+    let operations;
+    try {
+        operations = JSON.parse(source);
+    }
+    catch {
+        throw new Error('Retained Service reliability registry must be valid JSON before upgrade.');
+    }
+    if (!isJsonObject(operations) ||
+        !Array.isArray(operations.deployedAlarmResources)) {
+        throw new Error('Retained Service reliability registry must expose deployedAlarmResources before upgrade.');
+    }
+    const resources = operations.deployedAlarmResources;
+    const append = (path, guidance) => {
+        const current = currentFiles.get(path);
+        const targetEntry = targetOwnership.paths.find((entry) => entry.path === path);
+        const currentEntry = currentOwnership.paths.find((entry) => entry.path === path);
+        if (current === null ||
+            current === undefined ||
+            targetEntry?.mode !== 'seeded')
+            return;
+        const existing = report.seededReconciliation.find((entry) => entry.path === path);
+        if (existing) {
+            existing.guidance = `${existing.guidance ? `${existing.guidance}\n\n` : ''}${guidance}`;
+            existing.implications = [
+                ...new Set([...existing.implications, 'service-live-task-presence']),
+            ].sort(deterministic_order_js_1.compareUtf16);
+            return;
+        }
+        report.seededReconciliation.push({
+            adopterContentSha256: (0, index_js_5.hashOwnedContent)(current, currentEntry ?? targetEntry),
+            category: 'reliability-operations',
+            currentFrameworkSha256: currentEntry?.sha256 ?? null,
+            guidance,
+            implications: ['alarm-registration', 'service-live-task-presence'],
+            markerReference: SEEDED_RECONCILIATION_MARKER_REFERENCE,
+            path,
+            requiredAction: 'review-and-reconcile-preserving-adopter-content',
+            targetFrameworkSha256: targetEntry.sha256,
+        });
+    };
+    for (const name of services) {
+        const id = `service-${name}-health`;
+        const legacy = resources.some((entry) => {
+            if (!isJsonObject(entry))
+                return false;
+            const expected = {
+                comparisonOperator: 'LessThanThreshold',
+                evaluationPeriods: 1,
+                id,
+                metricName: 'RunningTaskCount',
+                name: `${currentOwnership.slice}-{stage}-service-${name}-running`,
+                namespace: 'ECS/ContainerInsights',
+                period: 60,
+                signal: 'metric',
+                statistic: 'Sum',
+                threshold: 1,
+                treatMissingData: 'breaching',
+            };
+            return (Object.entries(expected).every(([key, value]) => entry[key] === value) &&
+                JSON.stringify(entry.dimensionNames) ===
+                    JSON.stringify(['ClusterName', 'ServiceName']));
+        });
+        if (!legacy)
+            continue;
+        append(registryPath, `For recorded Service ${name}, reconcile only deployedAlarmResources[id=${id}]: namespace ECS/ContainerInsights -> AWS/ECS, metricName RunningTaskCount -> LiveTaskCount, statistic Sum -> Minimum. Keep its ID, physical name, actions, dimensions, threshold 1, LessThanThreshold, 60-second period, one evaluation period and breaching missing-data policy. In alarmRegistrations[id=${id}], set missingData to breaching and review businessSymptom, condition and both expected risk fields for task presence or missing telemetry, startup/emission-gap false positives, and activating/draining/replacement crash-loop false negatives. Preserve unrelated registrations and every adopter-owned field. Review services/${name}/RUNBOOK.md, run the declared reliability verification after authorized deployment, retain evidence, then resolve the existing seeded reconciliation marker.`);
+        append(`services/${name}/RUNBOOK.md`, `Review the retained Service ${name} runbook for AWS/ECS LiveTaskCount Minimum: ACTIVATING, RUNNING and DEACTIVATING task presence, not readiness. Missing telemetry breaches but does not prove zero tasks. Document startup/emission-gap false positives and activating/draining/replacement crash-loop false negatives, preserve custom recovery instructions, verify the critical journey and alarm recovery after an authorized roll-forward, retain evidence, then resolve the existing seeded reconciliation marker.`);
+    }
+    report.seededReconciliation.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path));
+}
 function currentContractConsumers(tree, root) {
     const source = tree.read(node_path_1.posix.join(root, 'contracts/dependencies.json'), 'utf8');
     if (source === null)
@@ -1110,7 +1193,7 @@ async function formatMergedManagedJsonFiles(tree, root, merge, ownership) {
     }));
     return { ...merge, files };
 }
-function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serviceAdapterOwner) {
+function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serviceAdapterOwner, deploymentProfile) {
     const compositionPaths = ownership.paths.filter(({ origin }) => origin === 'composition');
     const files = {};
     const paths = new Map();
@@ -1139,7 +1222,7 @@ function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serv
         }
         else {
             const plan = (0, workload_js_1.createWorkloadFilePlan)(workspace, ownership.slice, composition.name, composition.kind, runtimeVersion, composition.feature, composition.kind === 'service' &&
-                composition.name === serviceAdapterOwner);
+                composition.name === serviceAdapterOwner, [(0, index_js_4.productionRehearsalStage)(deploymentProfile), 'production']);
             addPlan(plan.files, plan.paths);
         }
     }
@@ -1672,7 +1755,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         targetFiles = preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, targetFiles);
     }
     const targetPathSet = new Set(targetOwnership.paths.map(({ path }) => path));
-    const compositionPlan = renderCompositionUpgradePlan(currentOwnership, packageJson.name ?? '', packageJson.dependencies?.['@empire-builder-kit/runtime'] ?? '', serviceAdapterOwner);
+    const compositionPlan = renderCompositionUpgradePlan(currentOwnership, packageJson.name ?? '', packageJson.dependencies?.['@empire-builder-kit/runtime'] ?? '', serviceAdapterOwner, (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree).deploymentProfile);
     const compositionPaths = compositionPlan.paths.filter(({ path }) => !targetPathSet.has(path));
     if (externalBlueprintDestinationPaths) {
         (0, index_js_1.assertBlueprintDestinationPaths)(tree.root, root, [
@@ -1745,6 +1828,9 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         mergedTarget.files.set(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH, await (0, formatting_js_1.formatTreeContentsToFixedPoint)(loggingAppend, formatting, workspacePath));
     }
     const report = createUpgradeReport(currentFiles, currentOwnership, mergedTarget.files, targetOwnership, mergedTarget);
+    if (blueprint.source === 'built-in') {
+        appendServiceTaskPresenceReconciliation(currentFiles, currentOwnership, targetOwnership, report);
+    }
     if (loggingAppend !== null) {
         report.preservedSeeded = report.preservedSeeded.filter((path) => path !== logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);
         report.appendedSeeded.push(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);

package/src/generators/workload/reliability-registration.d.ts

@@ -3,7 +3,7 @@ export declare const WORKLOAD_RELIABILITY_REGISTRY_PATH: "operations/reliability
 export interface WorkloadReliabilityPlan {
     alarmId: string;
     contents: string;
-    metricName: 'MatchedEvents' | 'RunningTaskCount';
+    metricName: 'LiveTaskCount' | 'MatchedEvents';
     path: string;
     runbookRef: string;
 }

package/src/generators/workload/reliability-registration.js

@@ -61,21 +61,21 @@ function planWorkloadReliabilityRegistration(tree, input) {
         ...operations.alarmRegistrations,
         (0, reliability_1.validateAlarmRegistrationMetadata)({
             businessSymptom: input.kind === 'service'
-                ? `${input.name} Service health checks are failing.`
+                ? `${input.name} Service task presence is below one or telemetry is missing.`
                 : `${input.name} Job executions are failing.`,
             condition: input.kind === 'service'
-                ? 'The AWS-native ECS RunningTaskCount signal is below one or missing for the exact Service.'
+                ? 'The AWS/ECS LiveTaskCount minimum is below one or missing for the exact Service; it counts ACTIVATING, RUNNING, and DEACTIVATING tasks.'
                 : 'An AWS-native ECS task-state event reports an essential container exit for the exact Job task family.',
             dependencyAlarmIds: [],
             escalationRouteKey: `${input.slice}-on-call`,
             expectedFalseNegativeRisk: input.kind === 'service'
-                ? 'Container Insights delivery can be delayed; missing data is therefore treated as breaching.'
+                ? 'Activating, draining, or repeatedly replaced tasks can keep LiveTaskCount positive while readiness or useful work fails.'
                 : 'ECS task-state events are durable but can be delayed before EventBridge reports a match.',
             expectedFalsePositiveRisk: input.kind === 'service'
-                ? 'A synthetic health client can fail while the Service remains available.'
+                ? 'Metric emission gaps, startup, or lifecycle transitions can breach the missing-data policy while tasks remain present.'
                 : 'A retried Job attempt can fail before a later attempt succeeds.',
             id: alarmId,
-            missingData: 'missing',
+            missingData: input.kind === 'service' ? 'breaching' : 'missing',
             owner,
             runbookRef: `runbook:${runbookRef}`,
             severity: 'high',
@@ -90,15 +90,15 @@ function planWorkloadReliabilityRegistration(tree, input) {
         dimensionNames: input.kind === 'service' ? ['ClusterName', 'ServiceName'] : ['RuleName'],
         evaluationPeriods: 1,
         id: alarmId,
-        metricName: input.kind === 'service' ? 'RunningTaskCount' : 'MatchedEvents',
+        metricName: input.kind === 'service' ? 'LiveTaskCount' : 'MatchedEvents',
         name: `${input.slice}-{stage}-${input.kind}-${input.name}-${input.kind === 'service' ? 'running' : 'hard-crash'}`,
-        namespace: input.kind === 'service' ? 'ECS/ContainerInsights' : 'AWS/Events',
+        namespace: input.kind === 'service' ? 'AWS/ECS' : 'AWS/Events',
         owner,
         period: 60,
         route: `${input.slice}-on-call`,
         runbook: runbookRef,
         signal: 'metric',
-        statistic: 'Sum',
+        statistic: input.kind === 'service' ? 'Minimum' : 'Sum',
         threshold: 1,
         treatMissingData: input.kind === 'service' ? 'breaching' : 'notBreaching',
     };
@@ -142,7 +142,7 @@ function planWorkloadReliabilityRegistration(tree, input) {
     return {
         alarmId,
         contents: `${JSON.stringify(operations, null, 2)}\n`,
-        metricName: input.kind === 'service' ? 'RunningTaskCount' : 'MatchedEvents',
+        metricName: input.kind === 'service' ? 'LiveTaskCount' : 'MatchedEvents',
         path,
         runbookRef,
     };

package/src/generators/workload/workload.d.ts

@@ -13,5 +13,5 @@ export interface WorkloadFilePlan {
     }>;
     project: string;
 }
-export declare function createWorkloadFilePlan(workspace: string, slice: string, workload: string, kind: WorkloadKind, runtimeVersion: string, feature: string, ownsProtectedLoadAdapter: boolean, protectedRuntimeStages?: readonly ('development' | 'production' | 'staging')[]): WorkloadFilePlan;
+export declare function createWorkloadFilePlan(workspace: string, slice: string, workload: string, kind: WorkloadKind, runtimeVersion: string, feature: string, ownsProtectedLoadAdapter: boolean, protectedRuntimeStages: readonly ('development' | 'production' | 'staging')[]): WorkloadFilePlan;
 export declare function workloadGenerator(tree: Tree, options: WorkloadGeneratorSchema, kind: WorkloadKind): Promise<GeneratorCallback | void>;

package/src/generators/workload/workload.js

@@ -139,7 +139,7 @@ exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = [
     '/dependencies/@aws-sdk~1client-dynamodb',
     '/dependencies/sst',
 ];
-function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, ownsProtectedLoadAdapter, protectedRuntimeStages = ['staging', 'production']) {
+function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, ownsProtectedLoadAdapter, protectedRuntimeStages) {
     const plural = kind === 'service' ? 'services' : 'jobs';
     const relativeRoot = node_path_1.posix.join(plural, workload);
     const className = `${pascal(slice)}${pascal(workload)}${pascal(kind)}`;
@@ -161,7 +161,7 @@ function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion
             version: '0.0.0',
             scripts: {
                 build: 'tsc -p tsconfig.json',
-                'docker-build': `docker build -f packages/${slice}/${relativeRoot}/Dockerfile ` +
+                'docker-build': 'docker build -f Dockerfile ' +
                     `-t ${slice}-${kind}-${workload}:local ../../../..`,
                 dev: `node --experimental-strip-types ${kind === 'service' ? 'src/main.ts' : 'src/run.ts'}`,
                 lint: 'eslint .',
@@ -212,7 +212,7 @@ function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion
         [`${relativeRoot}/src/workload.spec.ts`]: kind === 'service'
             ? `import { describe, expect, it } from 'vitest';\nimport { healthResponse } from './main.js';\n\ndescribe('${workload} service', () => {\n  it('reports healthy only on the health endpoint', () => {\n    expect(healthResponse('/health')).toEqual({ body: { service: '${workload}', status: 'ok' }, status: 200 });\n    expect(healthResponse('/missing').status).toBe(404);\n  });\n});\n`
             : `import { createLogger, type LogEntry } from '@empire-builder-kit/runtime/logging';\nimport { describe, expect, it } from 'vitest';\nimport { run } from './run.js';\n\ndescribe('${workload} job', () => {\n  it('emits canonical start and completion records', async () => {\n    const entries: LogEntry[] = [];\n    const logger = createLogger({\n      component: 'job-${workload}', feature: '${feature}', operation: 'run',\n      slice: '${slice}', stage: 'test', workspace: '${workspace}',\n      sink: (entry) => entries.push(entry as LogEntry),\n    });\n    await expect(run(logger)).resolves.toEqual({\n      ok: true,\n      providerDeliveryAssigned: false,\n    });\n    expect(entries.map(({ message, outcome }) => ({ message, outcome }))).toEqual([\n      { message: '${workload} job started', outcome: undefined },\n      { message: '${workload} job completed', outcome: 'success' },\n    ]);\n  });\n});\n`,
-        [`${relativeRoot}/infra.ts`]: `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';\nimport { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';\n\nexport function ${factoryName}(\n  cluster: any,\n  alertTopicArn: any,\n  roles?: { executionRole: string; taskRole: string },\n  links: any[] = [],\n  configuration?: {\n    applicationId: any;\n    deployment: any;\n    environmentId: any;\n    profileId: any;\n  },\n) {\n  const contract = createManagedLogGroupContract({\n    component: '${kind}-${workload}',\n    slice: '${slice}',\n    stage: $app.stage,\n    workspace: '${workspace}',\n  });\n  const workload = new sst.aws.${resource}('${className}', {\n    ...(roles ?? {}),\n    cluster,\n    environment: {\n      EBK_STAGE: $app.stage,\n      ...(configuration\n        ? {\n            EBK_APPCONFIG_APPLICATION_ID: configuration.applicationId,\n            EBK_APPCONFIG_ENVIRONMENT_ID: configuration.environmentId,\n            EBK_APPCONFIG_PROFILE_ID: configuration.profileId,\n          }\n        : {}),\n    },\n    link: links,\n    ${kind === 'service' ? "image: { context: './services/" + workload + "', dockerfile: 'Dockerfile' },\n    health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:3000/health || exit 1'] },\n    logging: { name: contract.name, retention: '1 month' },\n    serviceRegistry: { port: 3000 }," : "image: { context: './jobs/" + workload + "', dockerfile: 'Dockerfile' },\n    logging: { name: contract.name, retention: '1 month' },"}\n    transform: {\n      logGroup: {\n        logGroupClass: contract.logGroupClass,\n        tags: contract.tags,\n      },\n      taskDefinition: {\n        family: standardSliceExtensionTaskFamily(\n          $app.stage,\n          '${workload}',\n          '${kind}',\n        ),\n      },\n    },\n  }, configuration?.deployment\n    ? { dependsOn: [configuration.deployment] }\n    : {});\n  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(\n    '${className}LogDataProtection',\n    {\n      logGroupName: contract.name,\n      policyDocument: JSON.stringify(contract.dataProtectionPolicy),\n    },\n    { dependsOn: [workload.nodes.taskDefinition] },\n  );\n  const dataProtectionAlarm = new aws.cloudwatch.MetricAlarm(\n    '${className}LogDataProtectionFindings',\n    {\n      alarmActions: [alertTopicArn],\n      comparisonOperator: 'GreaterThanOrEqualToThreshold',\n      dimensions: { LogGroupName: contract.name },\n      evaluationPeriods: 1,\n      metricName: 'LogEventsWithFindings',\n      namespace: 'AWS/Logs',\n      period: 300,\n      statistic: 'Sum',\n      threshold: 1,\n      treatMissingData: 'notBreaching',\n    },\n    { dependsOn: [dataProtection] },\n  );\n  void dataProtectionAlarm;\n  return workload;\n}\n`,
+        [`${relativeRoot}/infra.ts`]: `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';\nimport { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';\n\nexport function ${factoryName}(\n  cluster: any,\n  alertTopicArn: any,\n  roles?: { executionRole: string; taskRole: string },\n  links: any[] = [],\n  configuration?: {\n    applicationId: any;\n    deployment: any;\n    environmentId: any;\n    profileId: any;\n  },\n) {\n  const contract = createManagedLogGroupContract({\n    component: '${kind}-${workload}',\n    slice: '${slice}',\n    stage: $app.stage,\n    workspace: '${workspace}',\n  });\n  const workload = new sst.aws.${resource}('${className}', {\n    ...(roles ?? {}),\n    cluster,\n    environment: {\n      EBK_STAGE: $app.stage,\n      ...(configuration\n        ? {\n            EBK_APPCONFIG_APPLICATION_ID: configuration.applicationId,\n            EBK_APPCONFIG_ENVIRONMENT_ID: configuration.environmentId,\n            EBK_APPCONFIG_PROFILE_ID: configuration.profileId,\n          }\n        : {}),\n    },\n    link: links,\n    ${kind === 'service' ? "image: { context: './services/" + workload + "', dockerfile: 'Dockerfile' },\n    health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:3000/health || exit 1'] },\n    logging: { name: contract.name, retention: '1 month' },\n    serviceRegistry: { port: 3000 }," : "image: { context: './jobs/" + workload + "', dockerfile: 'Dockerfile' },\n    logging: { name: contract.name, retention: '1 month' },"}\n    transform: {\n      logGroup: {\n        logGroupClass: contract.logGroupClass,\n        tags: contract.tags,\n      },\n      taskDefinition: {\n        family: standardSliceExtensionTaskFamily(\n          $app.stage,\n          '${workload}',\n          '${kind}',\n        ),\n      },\n    },\n  }, configuration?.deployment\n    ? { dependsOn: [configuration.deployment] }\n    : {});\n${kind === 'service' ? '  if ($dev) return workload;\n' : ''}  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(\n    '${className}LogDataProtection',\n    {\n      logGroupName: contract.name,\n      policyDocument: JSON.stringify(contract.dataProtectionPolicy),\n    },\n    { dependsOn: [workload.nodes.taskDefinition] },\n  );\n  const dataProtectionAlarm = new aws.cloudwatch.MetricAlarm(\n    '${className}LogDataProtectionFindings',\n    {\n      alarmActions: [alertTopicArn],\n      comparisonOperator: 'GreaterThanOrEqualToThreshold',\n      dimensions: { LogGroupName: contract.name },\n      evaluationPeriods: 1,\n      metricName: 'LogEventsWithFindings',\n      namespace: 'AWS/Logs',\n      period: 300,\n      statistic: 'Sum',\n      threshold: 1,\n      treatMissingData: 'notBreaching',\n    },\n    { dependsOn: [dataProtection] },\n  );\n  void dataProtectionAlarm;\n  return workload;\n}\n`,
     };
     if (kind === 'service') {
         const serviceMainPath = `${relativeRoot}/src/main.ts`;
@@ -413,7 +413,7 @@ ${kind !== 'service' || ownsProtectedLoadAdapter
       alarmDescription: JSON.stringify({
         businessSymptom:
           '${kind === 'service'
-        ? `${workload} Service has no running task.`
+        ? `${workload} Service task presence is below one or telemetry is missing.`
         : `${workload} Job essential container exited.`}',
         id: '${kind === 'service'
         ? `service-${workload}-health`
@@ -428,14 +428,14 @@ ${kind !== 'service' || ownsProtectedLoadAdapter
         ? 'LessThanThreshold'
         : 'GreaterThanOrEqualToThreshold'}',
       dimensions: ${kind === 'service'
-        ? `{ ClusterName: cluster.name, ServiceName: workload.name }`
+        ? `{ ClusterName: cluster.nodes.cluster.name, ServiceName: workload.nodes.service.name }`
         : `{ RuleName: reliabilityTaskStopped.name }`},
       evaluationPeriods: 1,
-      metricName: '${kind === 'service' ? 'RunningTaskCount' : 'MatchedEvents'}',
+      metricName: '${kind === 'service' ? 'LiveTaskCount' : 'MatchedEvents'}',
       name: '${slice}-' + $app.stage + '-${kind}-${workload}-${kind === 'service' ? 'running' : 'hard-crash'}',
-      namespace: '${kind === 'service' ? 'ECS/ContainerInsights' : 'AWS/Events'}',
+      namespace: '${kind === 'service' ? 'AWS/ECS' : 'AWS/Events'}',
       period: 60,
-      statistic: 'Sum',
+      statistic: '${kind === 'service' ? 'Minimum' : 'Sum'}',
       tags: standardTags,
       threshold: 1,
       treatMissingData: '${kind === 'service' ? 'breaching' : 'notBreaching'}',
@@ -551,7 +551,25 @@ through the read-only diagnostic path. Do not restart, scale, retry, or replace
 protected resources without the named approval.
 
 ${kind === 'service'
-        ? 'Prefer a verified roll-forward; verify readiness, dependency protection, and the critical Service journey after recovery.'
+        ? `The native AWS/ECS LiveTaskCount alarm uses Minimum over 60 seconds and
+counts tasks in ACTIVATING, RUNNING, and DEACTIVATING states. It breaches below
+one or when telemetry is missing. ECS can emit no metrics when there are no
+RUNNING tasks; missing telemetry is actionable but does not prove zero tasks.
+
+Startup, emission gaps, and lifecycle transitions can cause false positives.
+Activating, draining, or repeatedly replaced tasks can keep the count positive
+while readiness or useful work fails. ALARM is not a diagnosis. OK does not
+prove readiness, freedom from crash loops, or successful business traffic.
+
+Inspect ECS events, task states and exit reasons, the existing container health
+check, and the Slice API health and burn alarms. Do not infer that every Service
+has a load-balancer readiness alarm. Prefer a verified roll-forward; verify
+stable tasks, readiness, dependency protection, and the critical Service journey
+after recovery, then confirm telemetry and alarm recovery.
+
+LiveTaskCount adds no metric collection charge and needs no Container Insights
+opt-in. Existing alarm, compute, log, and request charges still apply; this is
+not a measured account-cost claim.`
         : 'Preserve idempotency and checkpoint state; verify the business deadline and postconditions before retrying or declaring recovery.'}
 `;
     files[`${relativeRoot}/src/reliability.ts`] = `import {

package/src/git-policy/github-bootstrap.d.ts

@@ -72,5 +72,23 @@ export interface GitHubRepositoryIdentity {
     repositoryId: string;
     subjectPrefix: string;
 }
+export interface FrameworkNpmStableBootstrapOptions {
+    npmStable: true;
+    apiBaseUrl?: string;
+    apply?: boolean;
+    repository: string;
+    token: string;
+    npmStableReviewerIds: number[];
+    npmStablePreventSelfReview: boolean;
+}
+export interface FrameworkNpmStableBootstrapReport {
+    kind: 'framework-npm-stable';
+    repository: string;
+    ready: boolean;
+    blockers: string[];
+    changes: string[];
+    warnings: string[];
+}
+export declare function runGitHubBootstrap(options: FrameworkNpmStableBootstrapOptions): Promise<FrameworkNpmStableBootstrapReport>;
 export declare function runGitHubBootstrap(options: GitHubBootstrapOptions): Promise<GitHubBootstrapReport>;
 export {};

package/src/git-policy/github-bootstrap.js

@@ -203,11 +203,7 @@ function requiresImmutableOidcSubjectCutover(state) {
 function immutableOidcTrustAcknowledgement(identity) {
     return `${GITHUB_IMMUTABLE_OIDC_TRUST_ACKNOWLEDGEMENT_PREFIX}${identity.subjectPrefix}`;
 }
-const PRIVATE_ENVIRONMENT_REVIEWER_PLANS = new Set([
-    'business_plus',
-    'enterprise',
-    'enterprise_cloud',
-]);
+const PRIVATE_ENVIRONMENT_REVIEWER_PLANS = new Set(['enterprise']);
 class GitHubApiError extends Error {
     status;
     constructor(status, message) {
@@ -575,6 +571,14 @@ async function inspectEnvironment(api, repositoryPath, name) {
         branchPolicies: branchPolicyValues,
         customBranchPolicies,
         exists: true,
+        canAdminsBypass: environment.can_admins_bypass === false ? false : true,
+        protectedBranches: typeof environment.deployment_branch_policy === 'object' &&
+            environment.deployment_branch_policy !== null &&
+            'protected_branches' in environment.deployment_branch_policy &&
+            typeof environment.deployment_branch_policy.protected_branches ===
+                'boolean'
+            ? environment.deployment_branch_policy.protected_branches
+            : undefined,
         preventSelfReview: reviewers.preventSelfReview,
         reviewers: reviewers.reviewers,
         secretNames: namedValues(secrets),
@@ -786,7 +790,7 @@ function evaluate(repository, state, inspectionBlockers, productionApprovalMode,
         privateRepository &&
         state.ownerPlanName !== undefined &&
         !PRIVATE_ENVIRONMENT_REVIEWER_PLANS.has(state.ownerPlanName)) {
-        blockers.push(`Committed environment-reviewer mode requires GitHub Enterprise support for a private repository; the inspected owner plan is ${state.ownerPlanName}.`);
+        blockers.push(`Committed environment-reviewer mode does not support inspected owner plan ${state.ownerPlanName} under EBK's verified private environment-reviewer contract; supported REST plan.name: enterprise.`);
     }
     if (state.repo.allow_merge_commit !== true) {
         changes.push('Enable repository merge commits.');
@@ -1099,7 +1103,96 @@ async function applyChanges(api, repositoryPath, state, productionApprovalMode,
         }
     }
 }
+async function runFrameworkNpmStableBootstrap(options) {
+    if (options.repository !== 'empire-builder-kit/empire-builder-kit')
+        throw new Error('npm-stable is restricted to the exact framework repository.');
+    if (!options.token.trim())
+        throw new Error('GH_TOKEN or GITHUB_TOKEN is required for GitHub bootstrap.');
+    if (!Array.isArray(options.npmStableReviewerIds) ||
+        options.npmStableReviewerIds.length < 1 ||
+        options.npmStableReviewerIds.length > 6 ||
+        options.npmStableReviewerIds.some((id) => !Number.isSafeInteger(id) || id <= 0) ||
+        new Set(options.npmStableReviewerIds).size !==
+            options.npmStableReviewerIds.length ||
+        typeof options.npmStablePreventSelfReview !== 'boolean') {
+        throw new Error('npm-stable requires exact reviewer IDs and explicit prevent-self-review choice.');
+    }
+    const reviewers = existingReviewerPayload([...options.npmStableReviewerIds].sort((left, right) => left - right));
+    const api = new GitHubApi(options.apiBaseUrl?.trim() || 'https://api.github.com', options.token);
+    const repositoryPath = '/repos/empire-builder-kit/empire-builder-kit';
+    const repo = await api.request('GET', repositoryPath);
+    if (repo.full_name !== options.repository)
+        throw new Error('npm-stable repository readback differs from its exact target.');
+    const environmentPath = `${repositoryPath}/environments/npm-stable`;
+    const inspectStable = () => inspectEnvironment(api, repositoryPath, 'npm-stable');
+    const evaluateStable = (state) => {
+        const changes = [];
+        const blockers = [];
+        if (!state.exists ||
+            !state.customBranchPolicies ||
+            state.protectedBranches !== false ||
+            state.canAdminsBypass !== false ||
+            state.preventSelfReview !== options.npmStablePreventSelfReview ||
+            state.waitTimer !== 0 ||
+            JSON.stringify(state.reviewers) !== JSON.stringify(reviewers)) {
+            changes.push('Set exact npm-stable reviewers, explicit self-review choice, administrator bypass false, and custom main-only policy.');
+        }
+        if (state.branchPolicies.length !== 1 ||
+            state.branchPolicies[0]?.name !== 'main' ||
+            state.branchPolicies[0]?.type !== 'branch')
+            changes.push('Restrict npm-stable to the main branch only.');
+        if ([...state.secretNames, ...state.variableNames].some((name) => FORBIDDEN_NPM_TOKEN_NAMES.some((tokenName) => name.toUpperCase() === tokenName)))
+            blockers.push('npm-stable may not contain npm token credentials.');
+        return {
+            kind: 'framework-npm-stable',
+            repository: options.repository,
+            ready: changes.length === 0 && blockers.length === 0,
+            blockers,
+            changes,
+            warnings: [],
+        };
+    };
+    const initial = await inspectStable();
+    const report = evaluateStable(initial);
+    if (!options.apply)
+        return report;
+    if (report.blockers.length)
+        throw new Error(`npm-stable apply is blocked: ${report.blockers.join(' ')}`);
+    if (report.ready)
+        return report;
+    await api.request('PUT', environmentPath, {
+        can_admins_bypass: false,
+        deployment_branch_policy: {
+            protected_branches: false,
+            custom_branch_policies: true,
+        },
+        prevent_self_review: options.npmStablePreventSelfReview,
+        reviewers,
+        wait_timer: 0,
+    });
+    const policies = await readPagedObjects(api, `${environmentPath}/deployment-branch-policies`, 'branch_policies');
+    let mainRetained = false;
+    for (const policy of policies) {
+        if (policy.name === 'main' && policy.type === 'branch' && !mainRetained) {
+            mainRetained = true;
+            continue;
+        }
+        if (!Number.isSafeInteger(policy.id) ||
+            typeof policy.id !== 'number' ||
+            policy.id <= 0)
+            throw new Error('npm-stable branch policy has no exact deletion identity.');
+        await api.request('DELETE', `${environmentPath}/deployment-branch-policies/${policy.id}`);
+    }
+    if (!mainRetained)
+        await api.request('POST', `${environmentPath}/deployment-branch-policies`, {
+            name: 'main',
+            type: 'branch',
+        });
+    return evaluateStable(await inspectStable());
+}
 async function runGitHubBootstrap(options) {
+    if ('npmStable' in options)
+        return runFrameworkNpmStableBootstrap(options);
     const repository = options.repository.trim();
     const deploymentProfile = options.deploymentProfile ?? 'fully-isolated';
     const { owner, repo } = parseRepository(repository);

package/src/local-dev/fleet-session.js

@@ -22,6 +22,7 @@ class FleetSession {
     #cleanupStates = new Map();
     #fleetId;
     #operation = Promise.resolve();
+    #pendingStartup;
     #processFactory;
     #processes = new Map();
     #proxy;
@@ -144,7 +145,19 @@ class FleetSession {
                         upstream: route.upstream,
                     });
                     this.#processes.set(name, process);
-                    await process.start();
+                    const pending = {
+                        name,
+                        process,
+                        interruptionRequested: false,
+                    };
+                    this.#pendingStartup = pending;
+                    try {
+                        await process.start();
+                    }
+                    finally {
+                        if (this.#pendingStartup === pending)
+                            this.#pendingStartup = undefined;
+                    }
                 }
             }
             catch (error) {
@@ -228,7 +241,28 @@ class FleetSession {
                     return sessionError('not-running', `Product Slice ${name} is not selected.`);
                 }
                 const previousState = route.state;
-                await process.restart();
+                const pending = {
+                    name,
+                    process,
+                    interruptionRequested: false,
+                };
+                this.#pendingStartup = pending;
+                try {
+                    await process.restart();
+                }
+                catch (error) {
+                    if (pending.interruptionRequested) {
+                        const failures = await this.#quiesce([name]);
+                        if (failures.length > 0) {
+                            return sessionError('cleanup-incomplete', `Fleet restart failed (${startupFailure(error)}) and owned writer quiescence was incomplete: ${failures.join('; ')}`);
+                        }
+                    }
+                    throw error;
+                }
+                finally {
+                    if (this.#pendingStartup === pending)
+                        this.#pendingStartup = undefined;
+                }
                 results.push({
                     changed: true,
                     name,
@@ -314,8 +348,11 @@ class FleetSession {
         // running up operation owns rollback; down waits for that rollback rather
         // than racing a second native cleanup against a live writer.
         const ordered = (0, contracts_js_1.resolveFleetSliceOperation)(this.#adapters, 'down', names, this.selectedSlices());
-        for (const name of ordered)
-            this.#processes.get(name)?.interruptStartup?.();
+        const pending = this.#pendingStartup;
+        if (pending && ordered.includes(pending.name)) {
+            pending.interruptionRequested = true;
+            pending.process.interruptStartup?.();
+        }
     }
     allSlices() {
         return this.routes.map(({ name }) => name).sort();

package/src/local-dev/fleet-supervisor-daemon.js

@@ -10,11 +10,7 @@ async function runFleetSupervisorDaemon(startupPath) {
             return;
         handlingSignal = true;
         try {
-            const selected = runtime.session.selectedSlices();
-            if (selected.length > 0)
-                await runtime.session.down(selected);
-            await runtime.session.closeProxyWhenEmpty();
-            await runtime.supervisor.stopGracefully();
+            await runtime.supervisor.stopForSignal();
         }
         catch (error) {
             handlingSignal = false;

package/src/local-dev/fleet-supervisor.d.ts

@@ -57,5 +57,6 @@ export declare class FleetSupervisor {
     waitForIdle(): Promise<void>;
     waitUntilStopped(): Promise<void>;
     stopGracefully(): Promise<void>;
+    stopForSignal(): Promise<void>;
 }
 export {};

package/src/local-dev/fleet-supervisor.js

@@ -96,6 +96,7 @@ class FleetSupervisor {
     #shutdownGraceMs;
     #state;
     #stopping = false;
+    #stopOperation;
     constructor(options, effects = {}) {
         this.#adapters = options.adapters;
         this.#host = options.host;
@@ -422,22 +423,44 @@ class FleetSupervisor {
             return;
         await new Promise((resolvePromise) => this.#closedWaiters.push(resolvePromise));
     }
-    async stopGracefully() {
+    stopGracefully() {
+        return this.#stop('empty');
+    }
+    stopForSignal() {
+        return this.#stop('down-selected');
+    }
+    #stop(mode) {
         if (this.#closed)
-            return;
+            return Promise.resolve();
+        if (this.#stopOperation)
+            return this.#stopOperation;
         this.#stopping = true;
-        await this.waitForIdle();
-        try {
-            this.#assertShutdownOwnership();
-            await this.#host.closeProxyWhenEmpty();
-            (0, fleet_runner_evidence_js_1.retireFleetRunnerEvidence)(this.#state, this.#paths, {
-                security: this.#security,
-            });
-        }
-        catch (error) {
+        this.#stopOperation = this.#finishStop(mode).catch((error) => {
             this.#stopping = false;
+            this.#stopOperation = undefined;
             throw error;
+        });
+        return this.#stopOperation;
+    }
+    async #finishStop(mode) {
+        await this.waitForIdle();
+        if (mode === 'down-selected') {
+            const selected = this.#host.selectedSlices();
+            if (selected.length > 0) {
+                try {
+                    this.#syncSliceStates(await this.#host.down(selected));
+                }
+                finally {
+                    this.#syncLiveSliceStates();
+                    this.#persistState();
+                }
+            }
         }
+        this.#assertShutdownOwnership();
+        await this.#host.closeProxyWhenEmpty();
+        (0, fleet_runner_evidence_js_1.retireFleetRunnerEvidence)(this.#state, this.#paths, {
+            security: this.#security,
+        });
         if (this.#heartbeat)
             clearInterval(this.#heartbeat);
         this.#heartbeat = undefined;

package/src/supply-chain/blueprint-verification-authority.js

@@ -439,6 +439,25 @@ function isBlueprintVerificationExecutionAuthorityPath(path) {
         /^(?:vite|vitest)\.config\.[a-z0-9]+$/u.test(name) ||
         /^packages\/[^/]+\/\.ebk\/ownership\.json$/u.test(normalized));
 }
+function isNativeArtifactDependencyBoundary(workspaceRoot, path, candidate) {
+    const match = /^packages\/([a-z][a-z0-9]*(?:-[a-z0-9]+)*)\/\.sst\/artifacts\/[^/]+\/node_modules$/u.exec(path);
+    const slice = match?.[1];
+    if (!slice)
+        return false;
+    const dependencyRoot = (0, node_path_1.join)(workspaceRoot, 'packages', slice, 'node_modules');
+    try {
+        const metadata = (0, node_fs_1.lstatSync)(dependencyRoot);
+        return (metadata.isDirectory() &&
+            !metadata.isSymbolicLink() &&
+            (0, node_fs_1.realpathSync)(dependencyRoot) === dependencyRoot &&
+            (0, node_path_1.toNamespacedPath)((0, node_path_1.resolve)((0, node_path_1.dirname)(candidate), (0, node_fs_1.readlinkSync)(candidate))) ===
+                (0, node_path_1.toNamespacedPath)(dependencyRoot) &&
+            (0, node_fs_1.realpathSync)(candidate) === dependencyRoot);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Inventories every execution-loader configuration outside bounded generated,
  * dependency, cache, and evidence directories. Forbidden ambient config is
@@ -467,15 +486,17 @@ function assertNoMutableBlueprintVerificationConfiguration(workspace) {
             const path = directoryPath
                 ? `${directoryPath}/${entry.name}`
                 : entry.name;
-            const skippedDirectory = entry.isDirectory() &&
-                SKIPPED_CONFIGURATION_DIRECTORIES.has(entry.name.toLowerCase());
+            const candidate = (0, node_path_1.join)(directory, entry.name);
+            const skippedDirectory = (entry.isDirectory() &&
+                SKIPPED_CONFIGURATION_DIRECTORIES.has(entry.name.toLowerCase())) ||
+                (entry.isSymbolicLink() &&
+                    isNativeArtifactDependencyBoundary(workspaceRoot, path, candidate));
             if (entry.isSymbolicLink() && !skippedDirectory) {
                 throw new Error(`Blueprint verification configuration inventory refuses symbolic-link authority at ${path}.`);
             }
             if (forbiddenConfigurationName(entry.name)) {
                 throw new Error(`Blueprint verification refuses mutable environment or package-manager configuration at ${path}.`);
             }
-            const candidate = (0, node_path_1.join)(directory, entry.name);
             if (protectedConfigurationName(entry.name)) {
                 const metadata = (0, node_fs_1.lstatSync)(candidate);
                 const child = (0, node_path_1.relative)(workspaceRoot, candidate);

package/src/supply-chain/sbom.js

@@ -160,7 +160,8 @@ function createCycloneDxComponentsFromInventory(input) {
     }));
 }
 function canonicalTimestamp(value, path) {
-    if (!Number.isFinite(Date.parse(value)) ||
+    if (typeof value !== 'string' ||
+        !Number.isFinite(Date.parse(value)) ||
         new Date(value).toISOString() !== value) {
         throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be a canonical ISO-8601 timestamp');
     }
@@ -775,8 +776,11 @@ function bindingInput(value) {
 }
 function createSupplyChainReleaseBinding(input) {
     canonicalTimestamp(input.createdAt, 'createdAt');
-    if (!common_js_1.SUPPLY_CHAIN_REFERENCE.test(input.releaseId) ||
-        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.releaseManifestDigest) ||
+    if (typeof input.releaseId !== 'string' ||
+        common_js_1.SUPPLY_CHAIN_REFERENCE.exec(input.releaseId)?.[0] !== input.releaseId ||
+        typeof input.releaseManifestDigest !== 'string' ||
+        common_js_1.SUPPLY_CHAIN_SHA256.exec(input.releaseManifestDigest)?.[0] !==
+            input.releaseManifestDigest ||
         input.artifacts.length === 0 ||
         (0, common_js_1.hasSensitiveSupplyChainShape)(input)) {
         throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding', 'must bind at least one artifact to an exact release manifest');
@@ -785,11 +789,21 @@ function createSupplyChainReleaseBinding(input) {
     const artifacts = [...input.artifacts]
         .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.bindingId, right.bindingId))
         .map((artifact, index) => {
-        if (!common_js_1.SUPPLY_CHAIN_REFERENCE.test(artifact.bindingId) ||
-            !common_js_1.SUPPLY_CHAIN_SHA256.test(artifact.candidateDigest) ||
-            !common_js_1.SUPPLY_CHAIN_SHA256.test(artifact.contentDigest) ||
-            !common_js_1.SUPPLY_CHAIN_SHA256.test(artifact.sbomDigest) ||
-            !/^urn:uuid:[a-f0-9-]{36}$/.test(artifact.sbomSerialNumber) ||
+        if (typeof artifact.bindingId !== 'string' ||
+            common_js_1.SUPPLY_CHAIN_REFERENCE.exec(artifact.bindingId)?.[0] !==
+                artifact.bindingId ||
+            typeof artifact.candidateDigest !== 'string' ||
+            common_js_1.SUPPLY_CHAIN_SHA256.exec(artifact.candidateDigest)?.[0] !==
+                artifact.candidateDigest ||
+            typeof artifact.contentDigest !== 'string' ||
+            common_js_1.SUPPLY_CHAIN_SHA256.exec(artifact.contentDigest)?.[0] !==
+                artifact.contentDigest ||
+            typeof artifact.sbomDigest !== 'string' ||
+            common_js_1.SUPPLY_CHAIN_SHA256.exec(artifact.sbomDigest)?.[0] !==
+                artifact.sbomDigest ||
+            typeof artifact.sbomSerialNumber !== 'string' ||
+            /^urn:uuid:[a-f0-9-]{36}$/.exec(artifact.sbomSerialNumber)?.[0] !==
+                artifact.sbomSerialNumber ||
             seen.has(artifact.bindingId)) {
             throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `releaseBinding.artifacts[${index}]`, 'must uniquely bind artifact and SBOM digests');
         }
@@ -810,14 +824,62 @@ function createSupplyChainReleaseBinding(input) {
     };
 }
 function validateSupplyChainReleaseBinding(value, expected) {
+    const exactKeys = (record, keys) => [Object.prototype, null].includes(Object.getPrototypeOf(record)) &&
+        Object.keys(record).sort(deterministic_order_js_1.compareUtf16).join('\0') ===
+            [...keys].sort(deterministic_order_js_1.compareUtf16).join('\0');
     if (!(0, validation_js_1.isRecord)(value) ||
+        !exactKeys(value, [
+            'artifacts',
+            'createdAt',
+            'kind',
+            'materialDigest',
+            'releaseId',
+            'releaseManifestDigest',
+            'schemaVersion',
+        ]) ||
         value.kind !== exports.SUPPLY_CHAIN_RELEASE_BINDING_KIND ||
         value.schemaVersion !== exports.SUPPLY_CHAIN_SBOM_SCHEMA_VERSION ||
-        !common_js_1.SUPPLY_CHAIN_SHA256.test(String(value.materialDigest)) ||
-        !Array.isArray(value.artifacts)) {
-        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding', 'must be an EBK supply-chain release binding v1');
+        typeof value.materialDigest !== 'string' ||
+        common_js_1.SUPPLY_CHAIN_SHA256.exec(value.materialDigest)?.[0] !==
+            value.materialDigest ||
+        typeof value.createdAt !== 'string' ||
+        typeof value.releaseId !== 'string' ||
+        typeof value.releaseManifestDigest !== 'string' ||
+        !Array.isArray(value.artifacts) ||
+        !value.artifacts.length) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding', 'must be an exact EBK supply-chain release binding v1');
+    }
+    const artifacts = [];
+    for (const artifact of value.artifacts) {
+        if (!(0, validation_js_1.isRecord)(artifact) ||
+            !exactKeys(artifact, [
+                'bindingId',
+                'candidateDigest',
+                'contentDigest',
+                'sbomDigest',
+                'sbomSerialNumber',
+            ]) ||
+            typeof artifact.bindingId !== 'string' ||
+            typeof artifact.candidateDigest !== 'string' ||
+            typeof artifact.contentDigest !== 'string' ||
+            typeof artifact.sbomDigest !== 'string' ||
+            typeof artifact.sbomSerialNumber !== 'string') {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding.artifacts', 'must contain exact string artifact fields');
+        }
+        artifacts.push({
+            bindingId: artifact.bindingId,
+            candidateDigest: artifact.candidateDigest,
+            contentDigest: artifact.contentDigest,
+            sbomDigest: artifact.sbomDigest,
+            sbomSerialNumber: artifact.sbomSerialNumber,
+        });
     }
-    const recreated = createSupplyChainReleaseBinding(value);
+    const recreated = createSupplyChainReleaseBinding({
+        artifacts,
+        createdAt: value.createdAt,
+        releaseId: value.releaseId,
+        releaseManifestDigest: value.releaseManifestDigest,
+    });
     if (recreated.materialDigest !== value.materialDigest) {
         throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'releaseBinding.materialDigest', 'does not match the canonical binding bytes');
     }