@empire-builder-kit/nx 1.0.0-rc.43 → 1.0.0-rc.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.43",
+  "version": "1.0.0-rc.45",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -145,7 +145,7 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.43",
+    "@empire-builder-kit/runtime": "1.0.0-rc.45",
     "@aws-sdk/client-cloudfront": "^3.700.0",
     "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
@@ -178,5 +178,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "7703b131fbcd59bc364ce7f914a1ff22250378c9"
+  "gitHead": "24b8859bb40fe58e57caf41555513f90fa734a05"
 }

package/src/blueprints/external-sandbox.d.ts

@@ -1,5 +1,5 @@
 import { type ChildProcessWithoutNullStreams } from 'node:child_process';
-export declare const EXTERNAL_BLUEPRINT_SANDBOX_IMAGE: "node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402";
+export declare const EXTERNAL_BLUEPRINT_SANDBOX_IMAGE: "node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914";
 export declare const EXTERNAL_BLUEPRINT_CONTAINER_AUTO_REMOVE: "--rm";
 export declare const EXTERNAL_BLUEPRINT_SANDBOX_FLAGS: readonly ["--network=none", "--read-only", "--cap-drop=ALL", "--security-opt=no-new-privileges", "--pids-limit=64", "--memory=256m", "--memory-swap=256m", "--cpus=1", "--ulimit=nofile=256:256", "--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777"];
 export type ExternalBlueprintSource = 'installed' | 'local';

package/src/cli/main.d.ts

@@ -2,7 +2,7 @@
 import { inspectLocalDevelopment } from '../executors/dev-doctor/dev-doctor.js';
 import { applyDevSetup } from '../executors/dev-setup/dev-setup.js';
 import { inspectDevelopmentEnvironment } from '../local-dev/environment-inspector.js';
-import { type FleetOperationSubmission } from '../local-dev/fleet-client.js';
+import { type FleetOperationSubmission, type FleetOperationWaitOptions } from '../local-dev/fleet-client.js';
 import { inventoryFleets, inventorySliceClaims, type FleetInventoryRecord, pruneStaleFleets } from '../local-dev/fleet-inventory.js';
 import { type FleetLaunchInput } from '../local-dev/fleet-launcher.js';
 import { followFleetLogs, searchFleetLogs } from '../local-dev/fleet-logs.js';
@@ -35,10 +35,8 @@ export interface FleetClientPort {
     shutdown(idempotencyKey?: string): Promise<void>;
     status(): Promise<FleetStateRecord>;
     submit(command: 'down' | 'restart' | 'up', selector: DevSliceSelector, idempotencyKey?: string): Promise<FleetOperationSubmission>;
-    waitForOperation(operationId: string, options?: {
-        pollMs?: number;
-        timeoutMs?: number;
-    }): Promise<FleetOperationStateRecord>;
+    /** Resolves on the terminal record, `succeeded` or `failed`. */
+    waitForOperationOutcome(operationId: string, options?: FleetOperationWaitOptions): Promise<FleetOperationStateRecord>;
 }
 export interface CurrentFleetCoordinates {
     fleetId: string;
@@ -128,6 +126,14 @@ export interface EbkCliDependencies {
 }
 export declare function resolveCurrentFleetCoordinates(workspaceRoot: string, appData: string, dependencies: Pick<EbkCliDependencies, 'loadPlan' | 'personalStageResolver'>): Promise<CurrentFleetCoordinates>;
 export declare function resolveRecoveryFleetCoordinates(workspaceRoot: string, appData: string, dependencies: Pick<EbkCliDependencies, 'inventory' | 'loadPlan' | 'personalStageResolver'>, currentPlatform?: NodeJS.Platform): Promise<RecoveryFleetCoordinates>;
+/** Process interrupts become an abort signal for the running command. With
+ * `onRepeatedInterrupt`, interrupts after the first are reported instead of
+ * reaching Node's default handler, which would kill the process. Exported for
+ * tests, which pass their own emitter in place of the process. */
+export declare function processAbortSignal(onRepeatedInterrupt?: () => void, target?: Pick<NodeJS.Process, 'on' | 'once' | 'removeListener'>): {
+    cleanup: () => void;
+    signal: AbortSignal;
+};
 export declare function runAgentCommandCore(command: AgentCliCommand, io?: EbkCliIo, overrides?: Partial<EbkCliDependencies>): Promise<0 | 1 | 2>;
 /**
  * Shared command core consumed by both the `ebk` parser shell and the Nx

package/src/cli/main.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sameWorkspaceRealpath = sameWorkspaceRealpath;
 exports.resolveCurrentFleetCoordinates = resolveCurrentFleetCoordinates;
 exports.resolveRecoveryFleetCoordinates = resolveRecoveryFleetCoordinates;
+exports.processAbortSignal = processAbortSignal;
 exports.runAgentCommandCore = runAgentCommandCore;
 exports.runDevCommandCore = runDevCommandCore;
 exports.runEbkCli = runEbkCli;
@@ -107,8 +108,8 @@ Usage:
   ebk dev configure [<context options>] [--clear-development-router-url] [--json]
   ebk dev setup [--trust] [--portless] [--upgrade] [--remove] [--json]
   ebk dev up <slice...>|--all [--foreground] [--sst-mode=mono|multiplexer]
-  ebk dev attach <task-id> [--json]
              [--no-wait] [--timeout=<duration>] [<context options>] [--json]
+  ebk dev attach <task-id> [--json]
   ebk dev status [--json]
   ebk dev restart <slice...>|--all [--no-wait] [--timeout=<duration>] [--json]
   ebk dev down <slice...>|--all [--no-wait] [--timeout=<duration>] [--json]
@@ -130,6 +131,12 @@ Configure mutation requires at least one context option or
 --clear-development-router-url. The clear option may accompany other
 non-router context changes.
 
+up, restart, and down wait for the supervised operation's outcome and print
+progress to stderr; there is no default deadline. --timeout=<duration> caps only
+a detached wait: the operation continues, so check ebk dev status and ebk dev
+logs. A foreground up hosts its supervisor and watches until the outcome.
+--no-wait returns once the operation is accepted.
+
 Use "ebk dev <command> --help" to return this bounded command reference.
 Fleet stage uses a persisted random task ID per worktree. Use attach explicitly
 to resume a verified inactive task; --stage overrides are not supported.`;
@@ -384,6 +391,18 @@ function failureFromError(namespace, command, error) {
             : (0, agent_runtime_js_1.classifyDeveloperAgentCliError)(error);
         return failure(namespace, command, classified.classification, classified.message);
     }
+    if (error instanceof errors_js_1.FleetObservationError) {
+        // The accepted operation may still be running: name it so a script can
+        // keep following it with ebk dev status.
+        return (0, output_js_1.createCliResult)({
+            command,
+            failureClassification: error.classification,
+            namespace,
+            operationId: error.detail.operationId,
+            outcome: 'failed',
+            payload: { ...error.detail, message: error.message },
+        });
+    }
     const classification = error instanceof errors_js_1.LocalDevContractError
         ? error.classification
         : 'internal-error';
@@ -711,27 +730,49 @@ async function resolveUpContext(command, dispatch) {
     dispatch.dependencies.writeContext(common, resolution.context);
     return { gitCommonDirectory: common, resolution };
 }
-function operationWaitOptions(command) {
-    return command.timeoutMs === undefined
-        ? {}
-        : { timeoutMs: command.timeoutMs };
+/** Observation of a submitted lifecycle operation: no default deadline,
+ * an explicit --timeout cap, interrupt ends observation only, and progress
+ * lines go to stderr so --json stdout stays one envelope. */
+function operationWaitOptions(command, dispatch) {
+    return {
+        onProgress: (0, dev_command_core_js_1.fleetOperationProgressReporter)(command.command, (line) => dispatch.io.stderr(`${line}\n`)),
+        signal: dispatch.signal,
+        ...(command.timeoutMs === undefined
+            ? {}
+            : { timeoutMs: command.timeoutMs }),
+    };
 }
 async function executeUp(command, coordinates, dispatch) {
     const { resolution } = await resolveUpContext(command, dispatch);
-    const executed = await (0, dev_command_core_js_1.executeFleetUpCore)(command, {
-        appData: dispatch.appData,
-        context: resolution.context,
-        frameworkVersion: dispatch.dependencies.frameworkVersion(),
-        identity: coordinates.identity,
-        plan: coordinates.plan,
-        signal: dispatch.signal,
-        workspaceRoot: dispatch.workspaceRoot,
-    }, {
-        idempotencyKey: dispatch.dependencies.idempotencyKey,
-        inspectEnvironment: dispatch.dependencies.inspectEnvironment,
-        launchFleet: dispatch.dependencies.launchFleet,
-        reportCleanupFailure: (message) => dispatch.io.stderr(`[cleanup-incomplete] ${message}\n`),
-    });
+    let executed;
+    try {
+        executed = await (0, dev_command_core_js_1.executeFleetUpCore)(command, {
+            appData: dispatch.appData,
+            context: resolution.context,
+            frameworkVersion: dispatch.dependencies.frameworkVersion(),
+            identity: coordinates.identity,
+            plan: coordinates.plan,
+            signal: dispatch.signal,
+            workspaceRoot: dispatch.workspaceRoot,
+        }, {
+            idempotencyKey: dispatch.dependencies.idempotencyKey,
+            inspectEnvironment: dispatch.dependencies.inspectEnvironment,
+            launchFleet: dispatch.dependencies.launchFleet,
+            reportCleanupFailure: (message) => dispatch.io.stderr(`[cleanup-incomplete] ${message}\n`),
+            reportProgress: (line) => dispatch.io.stderr(`${line}\n`),
+        });
+    }
+    catch (error) {
+        const afterWrite = (0, dev_command_core_js_1.foregroundUpSettlement)(error);
+        if (!afterWrite)
+            throw error;
+        // The foreground supervisor outlives this failure in this process: report
+        // it now and keep interrupt handling until owned cleanup settles.
+        return {
+            afterWrite,
+            result: failureFromError('dev', command.command, error),
+        };
+    }
     return {
         ...(executed.afterWrite ? { afterWrite: executed.afterWrite } : {}),
         result: success(command.command, {
@@ -794,7 +835,7 @@ async function executeRestart(command, coordinates, dispatch) {
             result: success(command.command, { fleetId: coordinates.fleetId, operation: submission }, submission.operationId),
         };
     }
-    const operation = await client.waitForOperation(submission.operationId, operationWaitOptions(command));
+    const operation = await client.waitForOperationOutcome(submission.operationId, operationWaitOptions(command, dispatch));
     const failed = lifecycleOperationFailure(command.command, coordinates.fleetId, operation);
     if (failed)
         return { result: failed };
@@ -841,7 +882,7 @@ async function executeDown(command, coordinates, dispatch) {
             result: success(command.command, { fleetId: coordinates.fleetId, operation: submission }, submission.operationId),
         };
     }
-    const operation = await client.waitForOperation(submission.operationId, operationWaitOptions(command));
+    const operation = await client.waitForOperationOutcome(submission.operationId, operationWaitOptions(command, dispatch));
     const failed = lifecycleOperationFailure(command.command, coordinates.fleetId, operation);
     if (failed)
         return { result: failed };
@@ -867,7 +908,7 @@ function lifecycleOperationFailure(command, fleetId, operation) {
         outcome: 'failed',
         payload: {
             fleetId,
-            message: `Fleet ${command} failed (${classification}).${retained}`,
+            message: `Fleet ${command} failed (${classification}).${retained}${(0, dev_command_core_js_1.fleetOperationFailureDetail)(operation)}`,
             operation,
         },
     });
@@ -1155,15 +1196,31 @@ async function dispatchDevCommand(command, dispatch) {
             return executeTail(command, coordinates, dispatch);
     }
 }
-function processAbortSignal() {
+/** Process interrupts become an abort signal for the running command. With
+ * `onRepeatedInterrupt`, interrupts after the first are reported instead of
+ * reaching Node's default handler, which would kill the process. Exported for
+ * tests, which pass their own emitter in place of the process. */
+function processAbortSignal(onRepeatedInterrupt, target = process) {
     const controller = new AbortController();
-    const abort = () => controller.abort();
-    process.once('SIGINT', abort);
-    process.once('SIGTERM', abort);
+    const repeated = () => onRepeatedInterrupt?.();
+    let guarded = false;
+    const abort = () => {
+        controller.abort();
+        // A foreground Fleet hosts its supervisor in this process. After the
+        // first interrupt starts the owned down, another Ctrl-C must not kill the
+        // process and orphan native work; it only reports what is still running.
+        if (onRepeatedInterrupt && !guarded) {
+            guarded = true;
+            target.on('SIGINT', repeated);
+        }
+    };
+    target.once('SIGINT', abort);
+    target.once('SIGTERM', abort);
     return {
         cleanup: () => {
-            process.removeListener('SIGINT', abort);
-            process.removeListener('SIGTERM', abort);
+            target.removeListener('SIGINT', abort);
+            target.removeListener('SIGTERM', abort);
+            target.removeListener('SIGINT', repeated);
         },
         signal: controller.signal,
     };
@@ -1233,7 +1290,9 @@ async function runDevCommandCore(command, io = {}, overrides = {}) {
         const root = dependencies.resolveWorkspaceRoot(io.cwd ?? process.cwd());
         dependencies.changeDirectory(root);
         if (!io.abortSignal)
-            ownedSignal = processAbortSignal();
+            ownedSignal = processAbortSignal(command.command === 'up' && command.foreground
+                ? () => output.stderr('[ebk dev up] Fleet down is running in this process and exits when owned cleanup settles; another interrupt does not stop it, and killing the process orphans native work. Check ebk dev status from another terminal.\n')
+                : undefined);
         const execution = await dispatchDevCommand(command, {
             appData: dependencies.appData(),
             dependencies,

package/src/container-images.d.ts

@@ -1 +1 @@
-export declare const EBK_NODE_22_ALPINE_IMAGE: "node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402";
+export declare const EBK_NODE_22_ALPINE_IMAGE: "node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914";

package/src/container-images.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EBK_NODE_22_ALPINE_IMAGE = void 0;
-exports.EBK_NODE_22_ALPINE_IMAGE = 'node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402';
+exports.EBK_NODE_22_ALPINE_IMAGE = 'node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914';
 //# sourceMappingURL=container-images.js.map

package/src/executors/deployment-plan/deployment-plan.js

@@ -36,7 +36,11 @@ const executor = async (options, context) => {
         if (options.action === 'deploy' || options.action === 'refresh') {
             const markerReport = (0, index_js_2.scanWorkMarkers)(context.root);
             devkit_1.logger.info((0, index_js_2.formatWorkMarkerReport)(markerReport));
-            (0, index_js_2.assertWorkMarkerReport)(markerReport, { protectedPromotion: true });
+            // Like the SST lifecycle, EBK-SECURITY and EBK-BLOCKER block only
+            // staging and production; malformed markers still fail every stage.
+            (0, index_js_2.assertWorkMarkerReport)(markerReport, {
+                protectedPromotion: options.stage !== 'development',
+            });
         }
         const policy = (0, index_js_1.readRepositoryOperatingPolicy)(context.root);
         const plan = (0, index_js_1.createProtectedDeploymentPlan)(policy, {

package/src/executors/deployment-plan/schema.json

@@ -12,7 +12,7 @@
     },
     "stage": {
       "type": "string",
-      "enum": ["staging", "production"]
+      "enum": ["development", "staging", "production"]
     },
     "project": {
       "type": "string",

package/src/executors/fleet/fleet.js

@@ -126,6 +126,7 @@ const executor = async (options, context) => {
             workspaceRoot: context.root,
         }, {
             reportCleanupFailure: (message) => devkit_1.logger.error(message),
+            reportProgress: (line) => devkit_1.logger.info(line),
         });
         devkit_1.logger.info(JSON.stringify({
             attached: result.attached,
@@ -138,6 +139,9 @@ const executor = async (options, context) => {
     }
     catch (error) {
         devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        // A foreground supervisor can outlive the failure in this process; keep
+        // the interrupt handler until its owned cleanup settles.
+        await (0, dev_command_core_js_1.foregroundUpSettlement)(error);
         return { success: false };
     }
     finally {

package/src/executors/fleet/schema.json

@@ -67,7 +67,7 @@
       "default": "mono"
     },
     "timeout": {
-      "description": "Bounded CLI operation timeout such as 30s.",
+      "description": "Optional cap on a detached wait (foreground: false), such as 30m. Without it the executor waits for the outcome; when the cap expires the operation continues. A foreground up watches until the outcome.",
       "type": "string",
       "pattern": "^[1-9][0-9]*(ms|s|m)$"
     }

package/src/executors/local-deploy/federated-credential-transport.d.ts

@@ -6,9 +6,10 @@ interface GovernedSignalCleanup {
     readonly priority: number;
     run(signal: GovernedSignal): Promise<void> | void;
 }
-/** Coordinate an exact child shutdown or private-state cleanup before the
- * current process preserves its normal SIGINT/SIGTERM behavior. Higher
- * priorities run first so mutation children stop before credentials vanish. */
+/** Coordinate cancellation of exact owned resources before preserving normal
+ * SIGINT/SIGTERM behavior. Synchronous credential revocation runs before any
+ * awaited child teardown: an ancestor such as Nx can independently force-stop
+ * this process while that teardown is pending. */
 export declare function registerGovernedSignalCleanup(run: GovernedSignalCleanup['run'], priority?: number): () => void;
 export declare function governedSignalCleanupInProgress(): boolean;
 interface FederatedCredentialIdentity {

package/src/executors/local-deploy/federated-credential-transport.js

@@ -59,7 +59,9 @@ async function handleGovernedSignal(signal, handler) {
     let cleanupFailed = false;
     for (const cleanup of [...governedSignalCleanups].sort((left, right) => right.priority - left.priority)) {
         try {
-            await cleanup.run(signal);
+            const pending = cleanup.run(signal);
+            if (pending !== undefined)
+                await pending;
         }
         catch {
             cleanupFailed = true;
@@ -90,9 +92,10 @@ function ensureGovernedSignalHandlers() {
         process.prependListener(signal, handler);
     }
 }
-/** Coordinate an exact child shutdown or private-state cleanup before the
- * current process preserves its normal SIGINT/SIGTERM behavior. Higher
- * priorities run first so mutation children stop before credentials vanish. */
+/** Coordinate cancellation of exact owned resources before preserving normal
+ * SIGINT/SIGTERM behavior. Synchronous credential revocation runs before any
+ * awaited child teardown: an ancestor such as Nx can independently force-stop
+ * this process while that teardown is pending. */
 function registerGovernedSignalCleanup(run, priority = 0) {
     const cleanup = { priority, run };
     governedSignalCleanups.add(cleanup);
@@ -170,7 +173,7 @@ async function createLocalFederatedCredentialTransport(input, dependencies = {})
     unregisterSignalCleanup = registerGovernedSignalCleanup(() => {
         cleanupFiles(true);
         process.removeListener('exit', onExit);
-    });
+    }, 200);
     process.once('exit', onExit);
     const resolve = dependencies.resolve ??
         (input.profile
@@ -186,7 +189,13 @@ async function createLocalFederatedCredentialTransport(input, dependencies = {})
         if (closed || disposed) {
             throw new Error('Local federated credential transport is already closed.');
         }
+        const assertOpen = () => {
+            if (closed || disposed) {
+                throw new Error('Local federated credential transport is already closed.');
+            }
+        };
         const identity = await resolve();
+        assertOpen();
         requireCredentialValue(identity.accessKeyId, 'access key');
         requireCredentialValue(identity.secretAccessKey, 'secret key');
         requireCredentialValue(identity.sessionToken, 'session token');
@@ -198,6 +207,7 @@ async function createLocalFederatedCredentialTransport(input, dependencies = {})
             throw new Error('Local deployment requires temporary federated credentials with at least 30 minutes remaining.');
         }
         const caller = await identify(identity, input.region);
+        assertOpen();
         const callerArn = caller.Arn?.trim() ?? '';
         if (caller.Account?.trim() !== input.account ||
             !(0, identity_js_1.matchesExpectedAssumedRoleArn)(input.account, callerArn, input.expectedRoleArn)) {

package/src/foundation/cost-estimate.d.ts

@@ -1,4 +1,5 @@
-import { type DeploymentProfile } from '../repository-policy/index.js';
+import { type CanonicalDeploymentStage, type DeploymentProfile } from '../repository-policy/index.js';
+import { type ObservabilityProfile } from './observability.js';
 /**
  * Dated AWS list-price snapshot for the generated cost estimate.
  *
@@ -98,8 +99,8 @@ export type ListPriceKey = keyof typeof FOUNDATION_LIST_PRICE_SNAPSHOT.prices;
 export declare const FOUNDATION_COST_INVENTORY: {
     /** One CloudFront Router Web ACL per stage. */
     readonly wafWebAcls: 1;
-    /** One Foundation CloudWatch dashboard per stage. */
-    readonly dashboards: 1;
+    /** Cost-optimized has no paid dashboard; richer profiles have one stage dashboard. */
+    readonly dashboards: 0;
     /** Declared network: `az: 2`, one Elastic IP and one NAT unit per public subnet. */
     readonly availabilityZones: 2;
     /** SST Vpc Cloud Map private DNS namespace (a Route 53 private hosted zone). */
@@ -154,6 +155,10 @@ export declare const FOUNDATION_COST_ESTIMATE_BEGIN_MARKER = "<!-- ebk:foundatio
 export declare const FOUNDATION_COST_ESTIMATE_END_MARKER = "<!-- ebk:foundation-cost-estimate:end -->";
 /** The exact label every rendered estimate carries. */
 export declare function foundationCostEstimateLabel(): string;
+export declare function observabilityDashboardInventory(stage: CanonicalDeploymentStage, observabilityProfile?: ObservabilityProfile): {
+    foundation: number;
+    slice: number;
+};
 /** Nonproduction Aurora scaling as costs.md prose, e.g. "0–4 ACUs, pause after 5 idle minutes". */
 export declare function nonproductionAuroraScalingLabel(stage: 'development' | 'staging'): string;
 export interface FoundationCostEstimateOptions {

package/src/foundation/cost-estimate.js

@@ -2,11 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FOUNDATION_COST_ESTIMATE_END_MARKER = exports.FOUNDATION_COST_ESTIMATE_BEGIN_MARKER = exports.STANDARD_SLICE_COST_INVENTORY = exports.FOUNDATION_COST_INVENTORY = exports.FOUNDATION_LIST_PRICE_SNAPSHOT = void 0;
 exports.foundationCostEstimateLabel = foundationCostEstimateLabel;
+exports.observabilityDashboardInventory = observabilityDashboardInventory;
 exports.nonproductionAuroraScalingLabel = nonproductionAuroraScalingLabel;
 exports.renderFoundationCostEstimate = renderFoundationCostEstimate;
 const index_js_1 = require("../repository-policy/index.js");
 const capability_plan_js_1 = require("./capability-plan.js");
 const router_waf_js_1 = require("./router-waf.js");
+const observability_js_1 = require("./observability.js");
 function price(usd, unit, offer, version, sku, rate, usageType, options = {}) {
     return {
         per: options.per ?? 1,
@@ -91,8 +93,8 @@ exports.FOUNDATION_LIST_PRICE_SNAPSHOT = {
 exports.FOUNDATION_COST_INVENTORY = {
     /** One CloudFront Router Web ACL per stage. */
     wafWebAcls: 1,
-    /** One Foundation CloudWatch dashboard per stage. */
-    dashboards: 1,
+    /** Cost-optimized has no paid dashboard; richer profiles have one stage dashboard. */
+    dashboards: 0,
     /** Declared network: `az: 2`, one Elastic IP and one NAT unit per public subnet. */
     availabilityZones: 2,
     /** SST Vpc Cloud Map private DNS namespace (a Route 53 private hosted zone). */
@@ -122,28 +124,28 @@ exports.FOUNDATION_COST_INVENTORY = {
  */
 exports.STANDARD_SLICE_COST_INVENTORY = {
     sqlFree: {
-        alarms: 54,
-        alarmMetrics: 63,
-        dashboards: 1,
-        dataProtectedLogGroups: 28,
+        alarms: 52,
+        alarmMetrics: 61,
+        dashboards: 0,
+        dataProtectedLogGroups: 26,
         kmsKeys: 1,
         machineClients: 1,
         secrets: 1,
     },
     sqlDeclared: {
-        alarms: 61,
-        alarmMetrics: 70,
-        dashboards: 1,
-        dataProtectedLogGroups: 32,
+        alarms: 59,
+        alarmMetrics: 68,
+        dashboards: 0,
+        dataProtectedLogGroups: 30,
         kmsKeys: 1,
         machineClients: 1,
         secrets: 3,
     },
     personalStage: {
-        alarms: 50,
-        alarmMetrics: 57,
-        dashboards: 1,
-        dataProtectedLogGroups: 25,
+        alarms: 48,
+        alarmMetrics: 55,
+        dashboards: 0,
+        dataProtectedLogGroups: 23,
         kmsKeys: 1,
         machineClients: 1,
         secrets: 1,
@@ -263,11 +265,22 @@ function natMode(stage, profile) {
         ? index_js_1.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS[profile].nat
         : exports.FOUNDATION_COST_INVENTORY.nonproductionNat;
 }
+function observabilityDashboardInventory(stage, observabilityProfile = 'cost-optimized') {
+    const policy = (0, observability_js_1.resolveObservabilityPolicy)({
+        policy: (0, observability_js_1.defaultObservabilityPolicy)(['development', 'staging', 'production'], { productionProfile: observabilityProfile }),
+        stage,
+        productionProfile: observabilityProfile,
+    });
+    return {
+        foundation: policy.dashboards === 'none' ? 0 : 1,
+        slice: policy.dashboards === 'slice' ? 1 : 0,
+    };
+}
 function stageFloors(stage, profile) {
     const inventory = exports.FOUNDATION_COST_INVENTORY;
     const sqlFree = monthly('wafWebAcl', inventory.wafWebAcls) +
         monthly('wafRule', wafRuleCount(stage)) +
-        monthly('cloudWatchDashboard', inventory.dashboards);
+        monthly('cloudWatchDashboard', observabilityDashboardInventory(stage).foundation);
     const nat = natMode(stage, profile);
     const network = sqlFree +
         monthly('route53HostedZone', inventory.privateHostedZones) +
@@ -344,7 +357,7 @@ function renderFoundationCostEstimate(options) {
         [
             'CloudWatch dashboard',
             p('cloudWatchDashboard'),
-            ...perStage(() => cell(monthly('cloudWatchDashboard', inventory.dashboards), inventory.dashboards)),
+            ...perStage((stage) => cell(monthly('cloudWatchDashboard', observabilityDashboardInventory(stage, defaultProfile).foundation), observabilityDashboardInventory(stage, defaultProfile).foundation)),
         ],
         [
             '**SQL-free stage floor**',
@@ -555,14 +568,18 @@ function renderFoundationCostEstimate(options) {
         [
             'CloudWatch Logs ingestion',
             p('cloudWatchLogsIngest'),
-            'TRACE application logging on every function',
+            'JSON application logs; only explicitly marked routine success diagnostics are sampled',
         ],
         [
             'CloudWatch Logs data protection',
             p('cloudWatchLogsDataProtection'),
             'Every byte written to a data-protected log group',
         ],
-        ['CloudWatch Logs storage', p('cloudWatchLogsStorage'), '30-day retention'],
+        [
+            'CloudWatch Logs storage',
+            p('cloudWatchLogsStorage'),
+            'At least 30 days for mixed security/receipt groups; see ebk.observability.json',
+        ],
         [
             'CloudWatch custom metrics',
             p('cloudWatchCustomMetric'),
@@ -636,6 +653,8 @@ function renderFoundationCostEstimate(options) {
         '',
         heading(level + 1, 'Production Aurora capacity profiles'),
         '',
+        'These capacity comparisons keep the independently seeded cost-optimized production observability policy. Selecting more Aurora capacity does not add dashboards or change log retention.',
+        '',
         table([
             'Capacity profile',
             'Aurora range',
@@ -647,7 +666,11 @@ function renderFoundationCostEstimate(options) {
         '',
         heading(level + 1, 'Standard Slice fixed floor per stage'),
         '',
-        'Every deployed stage of every default Standard Slice adds this floor (no async adapters, performance load off).',
+        'Every deployed stage of every default Standard Slice adds this floor (no async adapters, performance load off). This table uses cost-optimized/balanced Slice defaults: no Slice dashboard. Standard adds one per Slice, priced below.',
+        '',
+        `Observability: cost-optimized adds no dashboard; balanced adds one Foundation dashboard; standard adds one Foundation dashboard and one per Slice (${money(monthly('cloudWatchDashboard', 1))} each per month). See ebk.observability.json; upgraded explicit legacy dashboard choices have the standard dashboard count. Core failure/security alarms remain in every profile.`,
+        '',
+        `Fresh defaults omit the two never-created async provider/webhook component log groups while adapters are disabled. Enabling adapters or retaining dormant component logs adds 2 data-protected groups and 2 findings alarms (2 alarm metrics, ${money(monthly('cloudWatchAlarmMetric', 2))} per month). Legacy stage policies retain these groups to preserve possible log history, including personal stages; fresh personal stages omit them unless preservation is configured. Provider recovery queues and their failure alarms remain in every case.`,
         '',
         table(['Item', 'Unit list price', 'SQL-free Slice', 'SQL-declared Slice'], sliceRows, ['left', 'left', 'right', 'right']),
         '',

package/src/foundation/index.d.ts

@@ -2,6 +2,7 @@ export * from './discovery.js';
 export * from './capability-plan.js';
 export * from './local-database-contract.js';
 export * from './logging.js';
+export * from './observability.js';
 export * from './logging-preflight.js';
 export * from './partial-state.js';
 export * from './provision-database-bindings.js';

package/src/foundation/index.js

@@ -6,6 +6,7 @@ tslib_1.__exportStar(require("./discovery.js"), exports);
 tslib_1.__exportStar(require("./capability-plan.js"), exports);
 tslib_1.__exportStar(require("./local-database-contract.js"), exports);
 tslib_1.__exportStar(require("./logging.js"), exports);
+tslib_1.__exportStar(require("./observability.js"), exports);
 tslib_1.__exportStar(require("./logging-preflight.js"), exports);
 tslib_1.__exportStar(require("./partial-state.js"), exports);
 tslib_1.__exportStar(require("./provision-database-bindings.js"), exports);

package/src/foundation/local-private-smoke-access.js

@@ -169,6 +169,12 @@ async function runLocalPrivateSmoke(input, dependencies = {}) {
         }
         throw new Error(`Local private smoke: ${allowed ? 'admission' : 'revocation'} not observed; deployment acceptance prohibited`);
     }
+    // On cancellation this runs after the priority-200 transport cleanup has
+    // deleted the credential files. It relies on the WAF client opened above:
+    // the SDK memoizes resolved credentials per client, and credentials read
+    // from an ini file carry no expiry, so they are never re-read. Do not
+    // construct a new client or credential provider in this cleanup path; an
+    // unrevoked admission otherwise waits for next-run receipt recovery.
     const unregister = (0, federated_credential_transport_js_1.registerGovernedSignalCleanup)(async () => {
         await (0, private_smoke_admission_js_1.cleanupSmokeAdmission)(store, context);
     }, 90);

package/src/foundation/logging.d.ts

@@ -12,6 +12,8 @@ export declare const FORBIDDEN_DEPLOYMENT_LOG_POLICY_ACTIONS: readonly ["logs:De
 export interface ManagedLogGroupInput {
     component: string;
     resource?: string;
+    /** These groups mix diagnostics with security and delivery receipts. */
+    retentionInDays?: number;
     slice: string;
     stage: string;
     workspace: string;
@@ -44,7 +46,7 @@ export interface ManagedLogGroupContract {
     };
     logGroupClass: typeof MANAGED_LOG_GROUP_CLASS;
     name: string;
-    retentionInDays: typeof MANAGED_LOG_GROUP_RETENTION_DAYS;
+    retentionInDays: number;
     tags: Record<string, string>;
 }
 export interface ObservedManagedLogGroup {