@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/foundation/cost-estimate.js

@@ -0,0 +1,683 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FOUNDATION_COST_ESTIMATE_END_MARKER = exports.FOUNDATION_COST_ESTIMATE_BEGIN_MARKER = exports.STANDARD_SLICE_COST_INVENTORY = exports.FOUNDATION_COST_INVENTORY = exports.FOUNDATION_LIST_PRICE_SNAPSHOT = void 0;
+exports.foundationCostEstimateLabel = foundationCostEstimateLabel;
+exports.nonproductionAuroraScalingLabel = nonproductionAuroraScalingLabel;
+exports.renderFoundationCostEstimate = renderFoundationCostEstimate;
+const index_js_1 = require("../repository-policy/index.js");
+const capability_plan_js_1 = require("./capability-plan.js");
+const router_waf_js_1 = require("./router-waf.js");
+function price(usd, unit, offer, version, sku, rate, usageType, options = {}) {
+    return {
+        per: options.per ?? 1,
+        source: {
+            file: options.file ?? 'us-east-1',
+            offer,
+            rateCode: `${sku}.${rate}`,
+            sku,
+            usageType,
+            version,
+        },
+        unit,
+        usd,
+    };
+}
+const MILLION = 1_000_000;
+const TEN_THOUSAND = 10_000;
+const THOUSAND = 1_000;
+exports.FOUNDATION_LIST_PRICE_SNAPSHOT = {
+    capturedOn: '2026-10-02',
+    currency: 'USD',
+    hoursPerMonth: 730,
+    offerFileUrlTemplate: 'https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/<offer>/<version>/<file>/index.json',
+    region: { code: 'us-east-1', name: 'US East (N. Virginia)' },
+    // prettier-ignore
+    prices: {
+        apiGatewayHttpRequests: price('0.0000010000', 'million requests (first 300 million)', 'AmazonApiGateway', '20260921231404', 'FC2TWT2UEPTBKVBX', 'JRTCKXETXF.9NXBCPDZYR', 'USE1-ApiGatewayHttpRequest', { per: MILLION }),
+        appConfigConfigurationRequests: price('0.0000002000', 'million configuration requests', 'AWSSystemsManager', '20260911124619', '83YNJDGH6F8RN675', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-AppConfig-Requests', { per: MILLION }),
+        appConfigConfigurationsReceived: price('0.0008000000', 'configuration received', 'AWSSystemsManager', '20260911124619', 'ZHBBQT53NUZ69GUP', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-AppConfig-Deployments'),
+        auroraPostgresBackup: price('0.0210000000', 'GB-month beyond the free allocation', 'AmazonRDS', '20261001060230', 'AYEW6PNFPJSSTGH7', 'JRTCKXETXF.6YS6EN2CT7', 'Aurora:BackupUsage'),
+        auroraPostgresIo: price('0.0000002000', 'million I/O requests', 'AmazonRDS', '20261001060230', '7JDSZP38DMKT9B86', 'JRTCKXETXF.6YS6EN2CT7', 'Aurora:StorageIOUsage', { per: MILLION }),
+        auroraPostgresServerlessV2Acu: price('0.1200000000', 'ACU-hour', 'AmazonRDS', '20261001060230', 'AVKW7ZJP8D72HNQC', 'JRTCKXETXF.6YS6EN2CT7', 'Aurora:ServerlessV2Usage'),
+        auroraPostgresStorage: price('0.1000000000', 'GB-month', 'AmazonRDS', '20261001060230', '7GYUVAA992PFJPCB', 'JRTCKXETXF.6YS6EN2CT7', 'Aurora:StorageUsage'),
+        cloudFrontDataTransferOut: price('0.0850000000', 'GB (first 10 TB, United States edge)', 'AmazonCloudFront', '20260916132208', 'GV2WFGX37Q9PDSHF', 'JRTCKXETXF.Q3Z75P77EN', 'US-DataTransfer-Out-Bytes', { file: 'aws-other' }),
+        cloudFrontHttpsRequests: price('0.0000010000', '10,000 HTTPS requests (United States edge)', 'AmazonCloudFront', '20260916132208', 'NPFD6SEH9MXS8M4J', 'JRTCKXETXF.6YS6EN2CT7', 'US-Requests-Tier2-HTTPS', { file: 'aws-other', per: TEN_THOUSAND }),
+        cloudWatchAlarmMetric: price('0.1000000000', 'alarm metric-month', 'AmazonCloudWatch', '20260922021715', 'EVETVUGEN3MUTMXM', 'JRTCKXETXF.6YS6EN2CT7', 'CW:AlarmMonitorUsage'),
+        cloudWatchCustomMetric: price('0.3000000000', 'metric-month (first 10,000)', 'AmazonCloudWatch', '20260922021715', 'KG586CTNGQ4VRZKZ', 'JRTCKXETXF.A6VD9GXV7W', 'CW:MetricMonitorUsage'),
+        cloudWatchDashboard: price('3.0000000000', 'dashboard-month', 'AmazonCloudWatch', '20260922021715', '8AWBXE5MPQY58BK4', 'JRTCKXETXF.6YS6EN2CT7', 'DashboardsUsageHour', { file: 'aws-other' }),
+        cloudWatchLogsDataProtection: price('0.1200000000', 'GB scanned', 'AmazonCloudWatch', '20260922021715', '2G2RG8TB9A6ZVN56', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-DataProtection-Bytes'),
+        cloudWatchLogsIngest: price('0.5000000000', 'GB ingested (Standard class)', 'AmazonCloudWatch', '20260922021715', 'S8QGXX5R2BKKMDSJ', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-DataProcessing-Bytes'),
+        cloudWatchLogsStorage: price('0.0300000000', 'GB-month stored', 'AmazonCloudWatch', '20260922021715', '6K9ADYQAHV5KX9KZ', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-TimedStorage-ByteHrs'),
+        cognitoEssentialsMau: price('0.0150000000', 'monthly active user (Essentials)', 'AmazonCognito', '20260925193108', 'XVYWD6TWRYVQWN85', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-CognitoEssentialsMAU'),
+        cognitoLiteMau: price('0.0055000000', 'monthly active user (Lite, first 90,000)', 'AmazonCognito', '20260925193108', 'QA55XHQT8NAY3D4U', 'JRTCKXETXF.VV2AUKAVFP', 'USE1-CognitoLiteMAU'),
+        cognitoMachineAppClient: price('0.0000000000', 'app client-month (as published)', 'AmazonCognito', '20260925193108', '35WAS3YQUZX28BKP', 'JRTCKXETXF.ETY2894C67', 'USE1-CUPM2MAppClientsFull'),
+        cognitoMachineTokenRequest: price('0.0022500000', 'token request (first 250,000)', 'AmazonCognito', '20260925193108', 'KWC776HSBJBTMNS9', 'JRTCKXETXF.925HBHWMHV', 'USE1-CUPM2MTokenRequestsFull'),
+        dynamoDbPitrStorage: price('0.2000000000', 'GB-month', 'AmazonDynamoDB', '20260911124422', 'TFXQN9PEG62G7A67', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-TimedPITRStorage-ByteHrs'),
+        dynamoDbReadRequestUnits: price('0.0000001250', 'million read request units', 'AmazonDynamoDB', '20260911124422', '4W4ZMC46EHE8XTTZ', 'JRTCKXETXF.6YS6EN2CT7', 'ReadRequestUnits', { per: MILLION }),
+        dynamoDbStorage: price('0.2500000000', 'GB-month', 'AmazonDynamoDB', '20260911124422', 'F3E2EDSYC6ZNW7XP', 'JRTCKXETXF.VYAP54KATQ', 'TimedStorage-ByteHrs'),
+        dynamoDbWriteRequestUnits: price('0.0000006250', 'million write request units', 'AmazonDynamoDB', '20260911124422', 'FGXVD96DKJMUASY3', 'JRTCKXETXF.6YS6EN2CT7', 'WriteRequestUnits', { per: MILLION }),
+        ec2T4gNano: price('0.0042000000', 'instance-hour', 'AmazonEC2', '20260925174521', 'DU8E8NJG743V3F8M', 'JRTCKXETXF.6YS6EN2CT7', 'BoxUsage:t4g.nano'),
+        eventBridgeArchiveProcessed: price('0.1000000000', 'GB archived', 'AWSEvents', '20260924163903', '8B7RJEAZYT9BJB6W', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-ArchivedEvents-Bytes'),
+        eventBridgeArchiveStorage: price('0.0230000000', 'GB-month stored', 'AWSEvents', '20260924163903', 'KY5XTGQ8R4W34N4N', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-TimedStorage-ByteHrs'),
+        eventBridgeCustomEvents: price('0.0000010000', 'million custom events', 'AWSEvents', '20260924163903', 'ZA92ERYNKX457AJD', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-Event-64K-Chunks', { per: MILLION }),
+        fargateMemoryGbHour: price('0.0044450000', 'GB-hour', 'AmazonECS', '20260911124425', 'PBZNQUSEXZUC34C9', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-Fargate-GB-Hours'),
+        fargateVcpuHour: price('0.0404800000', 'vCPU-hour', 'AmazonECS', '20260911124425', '8CESGAFWKAJ98PME', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-Fargate-vCPU-Hours:perCPU'),
+        kmsKey: price('1.0000000000', 'key-month', 'awskms', '20260911124601', 'U553K98XGDXCYHWS', 'JRTCKXETXF.6YS6EN2CT7', 'us-east-1-KMS-Keys'),
+        kmsRequests: price('0.0000030000', '10,000 requests', 'awskms', '20260911124601', 'MFEBZPX8NHM5FY7Z', 'JRTCKXETXF.6YS6EN2CT7', 'us-east-1-KMS-Requests', { per: TEN_THOUSAND }),
+        lambdaComputeX86: price('0.0000166667', 'GB-second (x86)', 'AWSLambda', '20261001184746', 'TG3M4CAGBA3NYQBH', 'JRTCKXETXF.CUKFZ388N3', 'Lambda-GB-Second'),
+        lambdaRequests: price('0.0000002000', 'million requests', 'AWSLambda', '20261001184746', 'GU2ZS9HVP6QTQ7KE', 'JRTCKXETXF.6YS6EN2CT7', 'Request', { per: MILLION }),
+        natGatewayData: price('0.0450000000', 'GB processed', 'AmazonEC2', '20260925174521', '59S5R83GFPUAGVR5', 'JRTCKXETXF.6YS6EN2CT7', 'NatGateway-Bytes'),
+        natGatewayHour: price('0.0450000000', 'gateway-hour', 'AmazonEC2', '20260925174521', 'M2YSHUBETB3JX4M4', 'JRTCKXETXF.6YS6EN2CT7', 'NatGateway-Hours'),
+        publicIpv4InUse: price('0.0050000000', 'address-hour', 'AmazonVPC', '20260917190528', '4GQUNXTFWVSGPUZK', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-PublicIPv4:InUseAddress'),
+        route53HostedZone: price('0.5000000000', 'hosted zone-month (first 25)', 'AmazonRoute53', '20260911124504', 'KVPGEJE88UW8S779', 'JRTCKXETXF.G2A93NZ7DT', 'HostedZone', { file: 'aws-other' }),
+        s3StandardStorage: price('0.0230000000', 'GB-month (first 50 TB)', 'AmazonS3', '20260928230416', 'WP9ANXZGBYYSGJEA', 'JRTCKXETXF.PGHJ3S3EYE', 'TimedStorage-ByteHrs'),
+        secretsManagerApi: price('0.0000050000', '10,000 API requests', 'AWSSecretsManager', '20260911124610', '4MDZ5VNEJPMUTG9B', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-AWSSecretsManagerAPIRequest', { per: TEN_THOUSAND }),
+        secretsManagerSecret: price('0.4000000000', 'secret-month', 'AWSSecretsManager', '20260911124610', 'BJ3PQ9BYGU6P632F', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-AWSSecretsManager-Secrets'),
+        snsRequests: price('0.0000005000', 'million API requests', 'AmazonSNS', '20260915151944', 'QDX8G2WMY9NPXXPG', 'JRTCKXETXF.VNJQCFJPS4', 'Requests-Tier1', { per: MILLION }),
+        sqsFifoRequests: price('0.0000005000', 'million FIFO requests', 'AWSQueueService', '20260911124607', '624ZQ7K46KHFAD9Y', 'JRTCKXETXF.VXGXCWQKTY', 'Requests-FIFO-RBP', { per: MILLION }),
+        sqsStandardRequests: price('0.0000004000', 'million standard requests', 'AWSQueueService', '20260911124607', '8RN6B8U4MERHRXP3', 'JRTCKXETXF.VXGXCWQKTY', 'Requests-RBP', { per: MILLION }),
+        stepFunctionsStandardTransitions: price('0.0000250000', '1,000 state transitions', 'AmazonStates', '20260911124511', '5NX6NBD43SV57CH3', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-StateTransition', { per: THOUSAND }),
+        wafRequests: price('0.0000006000', 'million requests', 'awswaf', '20260914163921', '94S3KGQ8C7XGQFSJ', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-RequestV2-Tier1', { per: MILLION }),
+        wafRule: price('1.0000000000', 'rule-month', 'awswaf', '20260914163921', 'JGH3VFMTQFNJUV5W', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-RuleV2'),
+        wafWebAcl: price('5.0000000000', 'web ACL-month', 'awswaf', '20260914163921', 'KF2QAJUBXF7XNYSM', 'JRTCKXETXF.6YS6EN2CT7', 'USE1-WebACLV2'),
+    },
+};
+/**
+ * Generated Foundation quantities that are literals in the Foundation template
+ * or inside SST 4.17.1 components rather than in a framework contract. The
+ * cost-estimate count-drift spec executes the generated Foundation and fails
+ * when any of these differ from what the generator constructs.
+ */
+exports.FOUNDATION_COST_INVENTORY = {
+    /** One CloudFront Router Web ACL per stage. */
+    wafWebAcls: 1,
+    /** One Foundation CloudWatch dashboard per stage. */
+    dashboards: 1,
+    /** Declared network: `az: 2`, one Elastic IP and one NAT unit per public subnet. */
+    availabilityZones: 2,
+    /** SST Vpc Cloud Map private DNS namespace (a Route 53 private hosted zone). */
+    privateHostedZones: 1,
+    /** Declared nonproduction NAT mode; production uses its capacity contract. */
+    nonproductionNat: 'ec2',
+    /** SST Aurora master credential secret. */
+    auroraMasterSecrets: 1,
+    /** Declared SQL Foundation alarm metrics (Aurora capacity alarm). */
+    sqlAlarmMetrics: 1,
+    /** Declared nonproduction Aurora scaling. */
+    nonproductionAurora: {
+        development: { max: '2 ACU', min: '0 ACU', pauseAfter: '5 minutes' },
+        staging: { max: '4 ACU', min: '0 ACU', pauseAfter: '5 minutes' },
+    },
+    /** Seeded Router WAF access: nonproduction allowlist, production public. */
+    routerWafAccess: {
+        development: 'allowlist',
+        staging: 'allowlist',
+        production: 'public',
+    },
+};
+/**
+ * Per-stage fixed inventory of one default Standard Slice (no async adapters,
+ * performance load off). The count-drift spec renders and executes the
+ * generated Slice infrastructure and fails when these differ.
+ */
+exports.STANDARD_SLICE_COST_INVENTORY = {
+    sqlFree: {
+        alarms: 54,
+        alarmMetrics: 63,
+        dashboards: 1,
+        dataProtectedLogGroups: 28,
+        kmsKeys: 1,
+        machineClients: 1,
+        secrets: 1,
+    },
+    sqlDeclared: {
+        alarms: 61,
+        alarmMetrics: 70,
+        dashboards: 1,
+        dataProtectedLogGroups: 32,
+        kmsKeys: 1,
+        machineClients: 1,
+        secrets: 3,
+    },
+    personalStage: {
+        alarms: 50,
+        alarmMetrics: 57,
+        dashboards: 1,
+        dataProtectedLogGroups: 25,
+        kmsKeys: 1,
+        machineClients: 1,
+        secrets: 1,
+    },
+};
+exports.FOUNDATION_COST_ESTIMATE_BEGIN_MARKER = '<!-- ebk:foundation-cost-estimate:begin -->';
+exports.FOUNDATION_COST_ESTIMATE_END_MARKER = '<!-- ebk:foundation-cost-estimate:end -->';
+/** The exact label every rendered estimate carries. */
+function foundationCostEstimateLabel() {
+    const snapshot = exports.FOUNDATION_LIST_PRICE_SNAPSHOT;
+    return `list-price estimate captured ${snapshot.capturedOn}, ${snapshot.region.code}, excludes taxes, free tier, credits and usage; verify before relying on it`;
+}
+function acu(value) {
+    const match = /^(\d+(?:\.\d+)?) ACU$/.exec(value);
+    if (!match)
+        throw new Error(`Unsupported Aurora capacity ${value}.`);
+    return Number(match[1]);
+}
+function minutes(value) {
+    const match = /^(\d+) minutes?$/.exec(value);
+    if (!match)
+        throw new Error(`Unsupported Aurora pause delay ${value}.`);
+    return Number(match[1]);
+}
+/** Scale a published decimal string by a power of ten without float noise. */
+function scaledDecimal(value, per) {
+    const shift = Math.round(Math.log10(per));
+    if (10 ** shift !== per)
+        throw new Error(`Unsupported multiplier ${per}.`);
+    const [whole = '0', fraction = ''] = value.split('.');
+    const digits = whole + fraction.padEnd(shift, '0');
+    const point = whole.length + shift;
+    const integer = digits.slice(0, point).replace(/^0+(?=\d)/, '');
+    const decimals = digits.slice(point).replace(/0+$/, '');
+    return decimals.length === 0 ? integer : `${integer}.${decimals}`;
+}
+function grouped(value) {
+    return String(value).replace(/\B(?=(\d{3})+(?!\d))/g, ',');
+}
+function money(value) {
+    if (value !== 0 && Math.abs(value) < 0.01)
+        return `$${value.toFixed(4)}`;
+    const [integer = '0', cents = '00'] = (Math.round(value * 100) / 100)
+        .toFixed(2)
+        .split('.');
+    return `$${grouped(Number(integer))}.${cents}`;
+}
+function unitPrice(key) {
+    const entry = exports.FOUNDATION_LIST_PRICE_SNAPSHOT.prices[key];
+    const scaled = scaledDecimal(entry.usd, entry.per);
+    const [integer = '0', decimals = ''] = scaled.split('.');
+    const shown = decimals.length < 2 ? decimals.padEnd(2, '0') : decimals;
+    return `$${integer}.${shown} per ${entry.unit}`;
+}
+function usd(key) {
+    return Number(exports.FOUNDATION_LIST_PRICE_SNAPSHOT.prices[key].usd);
+}
+function hourly(key, quantity) {
+    return usd(key) * quantity * exports.FOUNDATION_LIST_PRICE_SNAPSHOT.hoursPerMonth;
+}
+function monthly(key, quantity) {
+    return usd(key) * quantity;
+}
+function cell(amount, quantity) {
+    return `${money(amount)} (${quantity})`;
+}
+function stageLabel(stage) {
+    return stage;
+}
+/** Render a Prettier-stable GitHub table. */
+function table(header, rows, alignment) {
+    const widths = header.map((title, index) => Math.max(3, title.length, ...rows.map((row) => (row[index] ?? '').length)));
+    const line = (cells) => `| ${cells
+        .map((value, index) => alignment[index] === 'right'
+        ? value.padStart(widths[index] ?? 0)
+        : value.padEnd(widths[index] ?? 0))
+        .join(' | ')} |`;
+    const divider = `| ${widths
+        .map((width, index) => alignment[index] === 'right'
+        ? `${'-'.repeat(width - 1)}:`
+        : '-'.repeat(width))
+        .join(' | ')} |`;
+    return [line(header), divider, ...rows.map(line)].join('\n');
+}
+function representativeFoundationPlans() {
+    const sqlFree = (0, capability_plan_js_1.planFoundationCapabilities)({ requirements: [] });
+    const network = (0, capability_plan_js_1.planFoundationCapabilities)({
+        requirements: [(0, capability_plan_js_1.standardPersistenceRequirement)({}, [{ kind: 'service' }])],
+    });
+    const sql = (0, capability_plan_js_1.planFoundationCapabilities)({
+        requirements: [
+            (0, capability_plan_js_1.standardPersistenceRequirement)({ sql: { reason: 'cost estimate' } }),
+        ],
+    });
+    if (sqlFree.resources.network ||
+        sqlFree.resources.postgres ||
+        !network.resources.network ||
+        network.resources.postgres ||
+        !sql.resources.network ||
+        !sql.resources.postgres) {
+        throw new Error('The Foundation capability plan no longer separates SQL-free, network and SQL tiers; update the cost estimate.');
+    }
+    return { network, sql, sqlFree };
+}
+function wafRuleCount(stage) {
+    const allowlist = exports.FOUNDATION_COST_INVENTORY.routerWafAccess[stage] === 'allowlist' ? 1 : 0;
+    // StageIpAllowlist (allowlist stages), RateLimitPerIP and the required AWS managed rule groups.
+    return allowlist + 1 + router_waf_js_1.ROUTER_WAF_REQUIRED_MANAGED_RULES.length;
+}
+function auroraScaling(stage, profile) {
+    return stage === 'production'
+        ? index_js_1.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS[profile].aurora
+        : exports.FOUNDATION_COST_INVENTORY.nonproductionAurora[stage];
+}
+function natMode(stage, profile) {
+    return stage === 'production'
+        ? index_js_1.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS[profile].nat
+        : exports.FOUNDATION_COST_INVENTORY.nonproductionNat;
+}
+function stageFloors(stage, profile) {
+    const inventory = exports.FOUNDATION_COST_INVENTORY;
+    const sqlFree = monthly('wafWebAcl', inventory.wafWebAcls) +
+        monthly('wafRule', wafRuleCount(stage)) +
+        monthly('cloudWatchDashboard', inventory.dashboards);
+    const nat = natMode(stage, profile);
+    const network = sqlFree +
+        monthly('route53HostedZone', inventory.privateHostedZones) +
+        hourly('publicIpv4InUse', inventory.availabilityZones) +
+        (nat === 'ec2'
+            ? hourly('ec2T4gNano', inventory.availabilityZones)
+            : hourly('natGatewayHour', inventory.availabilityZones));
+    const sql = network +
+        monthly('secretsManagerSecret', inventory.auroraMasterSecrets) +
+        monthly('cloudWatchAlarmMetric', inventory.sqlAlarmMetrics) +
+        hourly('auroraPostgresServerlessV2Acu', acu(auroraScaling(stage, profile).min));
+    return { network, sql, sqlFree };
+}
+function sliceFloor(inventory) {
+    return (monthly('kmsKey', inventory.kmsKeys) +
+        monthly('secretsManagerSecret', inventory.secrets) +
+        monthly('cognitoMachineAppClient', inventory.machineClients) +
+        monthly('cloudWatchAlarmMetric', inventory.alarmMetrics) +
+        monthly('cloudWatchDashboard', inventory.dashboards));
+}
+function scalingLabel(scaling) {
+    const pause = scaling.pauseAfter
+        ? `, pause after ${minutes(scaling.pauseAfter)} idle minutes`
+        : ', always warm';
+    return `${acu(scaling.min)}–${acu(scaling.max)} ACUs${pause}`;
+}
+/** Nonproduction Aurora scaling as costs.md prose, e.g. "0–4 ACUs, pause after 5 idle minutes". */
+function nonproductionAuroraScalingLabel(stage) {
+    return scalingLabel(exports.FOUNDATION_COST_INVENTORY.nonproductionAurora[stage]);
+}
+function heading(level, text) {
+    return `${'#'.repeat(level)} ${text}`;
+}
+function list(values) {
+    if (values.length <= 1)
+        return values.join('');
+    if (values.length === 2)
+        return `${values[0]} and ${values[1]}`;
+    return `${values.slice(0, -1).join(', ')} and ${values.at(-1)}`;
+}
+/**
+ * Pure, deterministic Markdown renderer for the dated list-price estimate.
+ * Quantities derive from the Foundation capability plan, the deployment
+ * profile's active stages, the production capacity contracts and the
+ * drift-checked inventories above. No clock, network or environment input.
+ */
+function renderFoundationCostEstimate(options) {
+    const snapshot = exports.FOUNDATION_LIST_PRICE_SNAPSHOT;
+    const inventory = exports.FOUNDATION_COST_INVENTORY;
+    const stages = (0, index_js_1.activeDeploymentStages)(options.deploymentProfile);
+    const defaultProfile = (0, index_js_1.createIncubationRepositoryPolicy)(options.deploymentProfile, 'cost-estimate').productionFoundation.profile;
+    const plans = representativeFoundationPlans();
+    const level = options.headingLevel;
+    const used = new Set();
+    const p = (key) => {
+        used.add(key);
+        return unitPrice(key);
+    };
+    const floors = Object.fromEntries(stages.map((stage) => [stage, stageFloors(stage, defaultProfile)]));
+    const perStage = (render) => stages.map(render);
+    const sum = (tier) => stages.reduce((total, stage) => total + floors[stage][tier], 0);
+    const az = inventory.availabilityZones;
+    const foundationRows = [
+        [
+            'AWS WAF web ACL',
+            p('wafWebAcl'),
+            ...perStage(() => cell(monthly('wafWebAcl', inventory.wafWebAcls), inventory.wafWebAcls)),
+        ],
+        [
+            'AWS WAF rules',
+            p('wafRule'),
+            ...perStage((stage) => cell(monthly('wafRule', wafRuleCount(stage)), wafRuleCount(stage))),
+        ],
+        [
+            'CloudWatch dashboard',
+            p('cloudWatchDashboard'),
+            ...perStage(() => cell(monthly('cloudWatchDashboard', inventory.dashboards), inventory.dashboards)),
+        ],
+        [
+            '**SQL-free stage floor**',
+            '',
+            ...perStage((stage) => `**${money(floors[stage].sqlFree)}**`),
+        ],
+    ];
+    if (plans.network.resources.network) {
+        foundationRows.push([
+            'Network: Route 53 private hosted zone',
+            p('route53HostedZone'),
+            ...perStage(() => cell(monthly('route53HostedZone', inventory.privateHostedZones), inventory.privateHostedZones)),
+        ], [
+            'Network: public IPv4 addresses',
+            p('publicIpv4InUse'),
+            ...perStage(() => cell(hourly('publicIpv4InUse', az), az)),
+        ], [
+            'Network: EC2 NAT instances (t4g.nano)',
+            p('ec2T4gNano'),
+            ...perStage((stage) => natMode(stage, defaultProfile) === 'ec2'
+                ? cell(hourly('ec2T4gNano', az), az)
+                : '–'),
+        ], [
+            'Network: managed NAT gateways',
+            p('natGatewayHour'),
+            ...perStage((stage) => natMode(stage, defaultProfile) === 'managed'
+                ? cell(hourly('natGatewayHour', az), az)
+                : '–'),
+        ], [
+            '**Network-declared stage floor**',
+            '',
+            ...perStage((stage) => `**${money(floors[stage].network)}**`),
+        ]);
+    }
+    if (plans.sql.resources.postgres) {
+        foundationRows.push([
+            'SQL: Aurora master secret',
+            p('secretsManagerSecret'),
+            ...perStage(() => cell(monthly('secretsManagerSecret', inventory.auroraMasterSecrets), inventory.auroraMasterSecrets)),
+        ], [
+            'SQL: Aurora capacity alarm',
+            p('cloudWatchAlarmMetric'),
+            ...perStage(() => cell(monthly('cloudWatchAlarmMetric', inventory.sqlAlarmMetrics), `${inventory.sqlAlarmMetrics} metric`)),
+        ], [
+            'SQL: Aurora Serverless v2 minimum',
+            p('auroraPostgresServerlessV2Acu'),
+            ...perStage((stage) => {
+                const scaling = auroraScaling(stage, defaultProfile);
+                return cell(hourly('auroraPostgresServerlessV2Acu', acu(scaling.min)), `${acu(scaling.min)}–${acu(scaling.max)} ACU`);
+            }),
+        ], [
+            '**SQL-declared stage floor**',
+            '',
+            ...perStage((stage) => `**${money(floors[stage].sql)}**`),
+        ]);
+    }
+    const profileRows = index_js_1.PRODUCTION_FOUNDATION_PROFILES.map((profile) => {
+        const scaling = index_js_1.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS[profile].aurora;
+        const minimum = acu(scaling.min);
+        const hours = minimum * snapshot.hoursPerMonth;
+        return [
+            `\`${profile}\`${profile === defaultProfile ? ' (default)' : ''}`,
+            scalingLabel(scaling),
+            minimum === 0
+                ? '$0.00 while paused, plus wakes'
+                : `${money(hourly('auroraPostgresServerlessV2Acu', minimum))} (${grouped(hours)} ACU-hours)`,
+            money(stageFloors('production', profile).sql),
+        ];
+    });
+    const pausing = [
+        ...stages.filter((stage) => stage !== 'production' &&
+            acu(auroraScaling(stage, defaultProfile).min) === 0),
+        ...index_js_1.PRODUCTION_FOUNDATION_PROFILES.filter((profile) => acu(index_js_1.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS[profile].aurora.min) === 0).map((profile) => `\`${profile}\` production`),
+    ];
+    const pauseDelays = new Set([
+        ...Object.values(inventory.nonproductionAurora),
+        ...Object.values(index_js_1.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS).map(({ aurora }) => aurora),
+    ]
+        .map((scaling) => scaling.pauseAfter)
+        .filter((pauseAfter) => pauseAfter !== undefined)
+        .map(minutes));
+    if (pauseDelays.size !== 1) {
+        throw new Error('The cost estimate assumes one Aurora auto-pause delay.');
+    }
+    const pauseMinutes = [...pauseDelays][0] ?? 0;
+    const smallestAwakeAcu = 0.5;
+    const perWake = (hourly('auroraPostgresServerlessV2Acu', smallestAwakeAcu) /
+        snapshot.hoursPerMonth) *
+        (pauseMinutes / 60);
+    const sliceInventory = exports.STANDARD_SLICE_COST_INVENTORY;
+    const sliceRow = (label, key, pick, quantity = pick) => [
+        label,
+        p(key),
+        cell(monthly(key, pick(sliceInventory.sqlFree)), quantity(sliceInventory.sqlFree)),
+        cell(monthly(key, pick(sliceInventory.sqlDeclared)), quantity(sliceInventory.sqlDeclared)),
+    ];
+    const sliceRows = [
+        sliceRow('KMS customer managed key', 'kmsKey', (i) => i.kmsKeys),
+        sliceRow('Secrets Manager secrets', 'secretsManagerSecret', (i) => i.secrets),
+        sliceRow('Cognito machine-to-machine app client', 'cognitoMachineAppClient', (i) => i.machineClients),
+        sliceRow('CloudWatch alarms', 'cloudWatchAlarmMetric', (i) => i.alarmMetrics, (i) => `${i.alarms} alarms, ${i.alarmMetrics} metrics`),
+        sliceRow('CloudWatch dashboard', 'cloudWatchDashboard', (i) => i.dashboards),
+        [
+            'Data-protected log groups',
+            'usage-priced (below)',
+            `${sliceInventory.sqlFree.dataProtectedLogGroups}`,
+            `${sliceInventory.sqlDeclared.dataProtectedLogGroups}`,
+        ],
+        [
+            '**Slice floor per stage**',
+            '',
+            `**${money(sliceFloor(sliceInventory.sqlFree))}**`,
+            `**${money(sliceFloor(sliceInventory.sqlDeclared))}**`,
+        ],
+    ];
+    const protectedStages = [
+        (0, index_js_1.productionRehearsalStage)(options.deploymentProfile),
+        'production',
+    ];
+    const usageRows = [
+        [
+            'CloudFront requests',
+            p('cloudFrontHttpsRequests'),
+            'Every Router request',
+        ],
+        [
+            'CloudFront data transfer out',
+            p('cloudFrontDataTransferOut'),
+            'Responses served through the Router',
+        ],
+        ['AWS WAF requests', p('wafRequests'), 'Every Router request'],
+        ['API Gateway HTTP API', p('apiGatewayHttpRequests'), 'Slice API routes'],
+        [
+            'Lambda requests',
+            p('lambdaRequests'),
+            'Routes, consumers and scheduled jobs',
+        ],
+        ['Lambda compute', p('lambdaComputeX86'), 'Function duration and memory'],
+        [
+            'SQS standard queues',
+            p('sqsStandardRequests'),
+            'Event delivery and idle long polling',
+        ],
+        ['SQS FIFO queue', p('sqsFifoRequests'), 'Next.js revalidation'],
+        [
+            'DynamoDB writes',
+            p('dynamoDbWriteRequestUnits'),
+            'Records, outbox and recovery ledger',
+        ],
+        [
+            'DynamoDB reads',
+            p('dynamoDbReadRequestUnits'),
+            'Records and scheduled reconciliation',
+        ],
+        ['DynamoDB storage', p('dynamoDbStorage'), 'Stored items'],
+        [
+            'DynamoDB point-in-time recovery',
+            p('dynamoDbPitrStorage'),
+            'Protected table size',
+        ],
+        [
+            'EventBridge custom events',
+            p('eventBridgeCustomEvents'),
+            'Published domain events',
+        ],
+        [
+            'EventBridge archive',
+            p('eventBridgeArchiveProcessed'),
+            'Every bus event (30-day archive)',
+        ],
+        [
+            'EventBridge archive storage',
+            p('eventBridgeArchiveStorage'),
+            'Archived event volume',
+        ],
+        [
+            'Cognito Lite users',
+            p('cognitoLiteMau'),
+            'Signed-in users; the generator does not set a user pool tier',
+        ],
+        [
+            'Cognito Essentials users',
+            p('cognitoEssentialsMau'),
+            'Signed-in users; the AWS default tier for new pools applies',
+        ],
+        [
+            'Cognito machine tokens',
+            p('cognitoMachineTokenRequest'),
+            'Machine-to-machine token requests',
+        ],
+        [
+            'Aurora compute',
+            p('auroraPostgresServerlessV2Acu'),
+            'SQL: capacity while awake',
+        ],
+        ['Aurora storage', p('auroraPostgresStorage'), 'SQL: consumed storage'],
+        ['Aurora I/O', p('auroraPostgresIo'), 'SQL: storage I/O'],
+        [
+            'Aurora backup storage',
+            p('auroraPostgresBackup'),
+            'SQL: backups beyond the free allocation',
+        ],
+        [
+            'NAT gateway data',
+            p('natGatewayData'),
+            'Production network: in-VPC traffic to AWS APIs and the internet',
+        ],
+        [
+            'CloudWatch Logs ingestion',
+            p('cloudWatchLogsIngest'),
+            'TRACE application logging on every function',
+        ],
+        [
+            'CloudWatch Logs data protection',
+            p('cloudWatchLogsDataProtection'),
+            'Every byte written to a data-protected log group',
+        ],
+        ['CloudWatch Logs storage', p('cloudWatchLogsStorage'), '30-day retention'],
+        [
+            'CloudWatch custom metrics',
+            p('cloudWatchCustomMetric'),
+            'Embedded metric format series',
+        ],
+        ['Secrets Manager API', p('secretsManagerApi'), 'Secret reads'],
+        ['KMS requests', p('kmsRequests'), 'Data export encryption'],
+        [
+            'AppConfig requests',
+            p('appConfigConfigurationRequests'),
+            'Protected-stage configuration polling',
+        ],
+        [
+            'AppConfig configurations received',
+            p('appConfigConfigurationsReceived'),
+            'Protected-stage configuration polling',
+        ],
+        [
+            'Step Functions standard',
+            p('stepFunctionsStandardTransitions'),
+            'Retention and SQL migration workflows',
+        ],
+        ['Fargate vCPU', p('fargateVcpuHour'), 'SQL bootstrap and migration tasks'],
+        [
+            'Fargate memory',
+            p('fargateMemoryGbHour'),
+            'SQL bootstrap and migration tasks',
+        ],
+        [
+            'Public IPv4 for tasks',
+            p('publicIpv4InUse'),
+            'SQL tasks run with a public address',
+        ],
+        [
+            'S3 Standard storage',
+            p('s3StandardStorage'),
+            'Web assets and data export objects',
+        ],
+        ['SNS requests', p('snsRequests'), 'Alarm notifications'],
+    ];
+    const sources = [...used].sort().map((key) => {
+        const { source } = exports.FOUNDATION_LIST_PRICE_SNAPSHOT.prices[key];
+        return [
+            `\`${key}\``,
+            `${source.offer} ${source.version} (${source.file})`,
+            source.sku,
+            source.rateCode,
+            source.usageType,
+        ];
+    });
+    const personal = sliceInventory.personalStage;
+    const stageList = list(stages.map(stageLabel));
+    return [
+        heading(level, 'List-price estimate'),
+        '',
+        `**ESTIMATE:** ${foundationCostEstimateLabel()}.`,
+        '',
+        `Unit prices are AWS public On-Demand list prices in ${snapshot.currency} for ${snapshot.region.name} from the AWS Price List bulk API. CloudFront and AWS WAF are global services billed in ${snapshot.region.code}; CloudFront rates are the United States edge-location rates. Quantities come from the generator for the \`${options.deploymentProfile}\` deployment profile (stages: ${stageList}); a month is ${snapshot.hoursPerMonth} hours. Each cell shows the monthly amount and, in parentheses, the quantity.`,
+        '',
+        heading(level + 1, 'Foundation fixed floor per stage'),
+        '',
+        `A SQL-free Foundation has only the first rows. A Slice that declares a service or job adds the network rows; a Slice that declares SQL adds the network and SQL rows. Production uses the \`${defaultProfile}\` capacity profile that new repositories select.`,
+        '',
+        table(['Item', 'Unit list price', ...stages], foundationRows, [
+            'left',
+            'left',
+            ...stages.map(() => 'right'),
+        ]),
+        '',
+        `Workspace floor across ${stageList}: SQL-free ${money(sum('sqlFree'))}, network-declared ${money(sum('network'))}, SQL-declared ${money(sum('sql'))} a month, before usage.`,
+        '',
+        heading(level + 1, 'Production Aurora capacity profiles'),
+        '',
+        table([
+            'Capacity profile',
+            'Aurora range',
+            'Minimum compute per month',
+            'SQL-declared production floor',
+        ], profileRows, ['left', 'left', 'right', 'right']),
+        '',
+        `Scale-to-zero Aurora (${list(pausing)}) bills no compute while paused. Each wake bills at least ${smallestAwakeAcu} ACU, the smallest non-zero Serverless v2 capacity, for the active time plus the ${pauseMinutes}-minute pause delay: at least ${money(perWake)} per wake. Open connections and scheduled database work can wake the cluster or keep it awake; a cluster that never pauses bills at least ${money(hourly('auroraPostgresServerlessV2Acu', smallestAwakeAcu))} a month. Storage, I/O and backups are usage-priced.`,
+        '',
+        heading(level + 1, 'Standard Slice fixed floor per stage'),
+        '',
+        'Every deployed stage of every default Standard Slice adds this floor (no async adapters, performance load off).',
+        '',
+        table(['Item', 'Unit list price', 'SQL-free Slice', 'SQL-declared Slice'], sliceRows, ['left', 'left', 'right', 'right']),
+        '',
+        `- Protected runtime stages (${list(protectedStages)}) add 1 Secrets Manager secret for performance-load HMAC keys: ${money(monthly('secretsManagerSecret', 1))}.`,
+        `- A machine-credential rotation runs 2 machine-to-machine app clients until the previous generation is retired. The Price List publishes ${money(usd('cognitoMachineAppClient'))} per app client-month for this usage type at capture; verify it.`,
+        '- The SQL-declared secrets are the machine-client secret and the read-write and read-only database credentials.',
+        `- Each personal development stage repeats the Slice floor in the development account against the development Foundation, without retention orchestration: ${personal.alarms} alarms (${personal.alarmMetrics} metrics) and ${personal.dataProtectedLogGroups} data-protected log groups, ${money(sliceFloor(personal))} per SQL-free Slice per personal stage while it exists.`,
+        '',
+        heading(level + 1, 'Usage-priced lines'),
+        '',
+        table(['Line', 'Unit list price', 'Driven by'], usageRows, [
+            'left',
+            'left',
+            'left',
+        ]),
+        '',
+        'Not priced: EC2 NAT instance root volumes (AMI default size), EC2 data transfer out (NAT instances have no per-GB processing charge), an adopter-owned public hosted zone for `EBK_ROOT_DOMAIN`, AWS Budgets, Cost Anomaly Detection, SSM standard parameters and SST bootstrap storage.',
+        '',
+        heading(level + 1, 'Price sources'),
+        '',
+        `Offer files: \`${snapshot.offerFileUrlTemplate}\` (OnDemand terms).`,
+        '',
+        table(['Price', 'Offer file', 'SKU', 'Rate code', 'Usage type'], sources, [
+            'left',
+            'left',
+            'left',
+            'left',
+            'left',
+        ]),
+        '',
+    ].join('\n');
+}
+//# sourceMappingURL=cost-estimate.js.map