@empire-builder-kit/nx 1.0.0-rc.43 → 1.0.0-rc.45

package/src/foundation/logging.js

@@ -43,6 +43,13 @@ function requireWorkspace(value) {
 }
 function createManagedLogGroupContract(input) {
     const component = requireSegment(input.component, 'component');
+    const retentionInDays = input.retentionInDays ?? exports.MANAGED_LOG_GROUP_RETENTION_DAYS;
+    if (![
+        30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557,
+        2922, 3288, 3653,
+    ].includes(retentionInDays)) {
+        throw new Error('[foundation/logging] Mixed security/receipt log groups require an AWS-supported retention of at least 30 days.');
+    }
     const slice = requireSegment(input.slice, 'slice');
     const stage = requireSegment(input.stage, 'stage');
     const workspace = requireWorkspace(input.workspace);
@@ -79,7 +86,7 @@ function createManagedLogGroupContract(input) {
         },
         logGroupClass: exports.MANAGED_LOG_GROUP_CLASS,
         name,
-        retentionInDays: exports.MANAGED_LOG_GROUP_RETENTION_DAYS,
+        retentionInDays,
         tags: {
             [exports.MANAGED_LOG_GROUP_TAG_KEYS.component]: component,
             [exports.MANAGED_LOG_GROUP_TAG_KEYS.managed]: 'true',

package/src/foundation/observability.d.ts

@@ -0,0 +1,42 @@
+import { type FoundationStage } from './stages.js';
+export declare const OBSERVABILITY_POLICY_PATH = "ebk.observability.json";
+export declare const OBSERVABILITY_PROFILES: readonly ["cost-optimized", "balanced", "standard"];
+export type ObservabilityProfile = (typeof OBSERVABILITY_PROFILES)[number];
+export type DashboardPolicy = 'none' | 'stage' | 'slice';
+export interface ObservabilityStagePolicy {
+    /** Explicitly seeded; an omitted production value requires a supplied capacity profile. */
+    profile?: ObservabilityProfile;
+    routineSuccessSampleRate?: number;
+    diagnosticRetentionDays?: number;
+    protectedRetentionDays?: number;
+    dashboards?: DashboardPolicy;
+    systemLogLevel?: 'WARN' | 'INFO';
+    /** Preserve groups with possible historical logs when adapters are disabled. */
+    retainDormantComponentLogs?: boolean;
+}
+export interface ObservabilityPolicy {
+    schemaVersion: 1;
+    stages: Partial<Record<FoundationStage, ObservabilityStagePolicy>>;
+}
+export interface ResolvedObservabilityPolicy {
+    profile: ObservabilityProfile;
+    routineSuccessSampleRate: number;
+    diagnosticRetentionDays: number;
+    /** Shared application/security/receipt groups use this floor, not diagnostic retention. */
+    protectedRetentionDays: number;
+    dashboards: DashboardPolicy;
+    systemLogLevel: 'WARN' | 'INFO';
+    retainDormantComponentLogs: boolean;
+}
+export declare function parseObservabilityPolicy(value: unknown, activeStages?: readonly FoundationStage[]): ObservabilityPolicy;
+/** New workspaces opt in; a managed upgrade of an older workspace preserves its choices. */
+export declare function defaultObservabilityPolicy(stages: readonly FoundationStage[], options?: {
+    preserveLegacy?: boolean;
+    productionProfile?: ObservabilityProfile;
+}): ObservabilityPolicy;
+export declare function resolveObservabilityPolicy(input: {
+    policy: unknown;
+    stage: string;
+    productionProfile?: string;
+    local?: boolean;
+}): ResolvedObservabilityPolicy;

package/src/foundation/observability.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OBSERVABILITY_PROFILES = exports.OBSERVABILITY_POLICY_PATH = void 0;
+exports.parseObservabilityPolicy = parseObservabilityPolicy;
+exports.defaultObservabilityPolicy = defaultObservabilityPolicy;
+exports.resolveObservabilityPolicy = resolveObservabilityPolicy;
+const stages_js_1 = require("./stages.js");
+exports.OBSERVABILITY_POLICY_PATH = 'ebk.observability.json';
+exports.OBSERVABILITY_PROFILES = [
+    'cost-optimized',
+    'balanced',
+    'standard',
+];
+const RETENTION_DAYS = new Set([
+    7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557,
+    2922, 3288, 3653,
+]);
+const STAGE_KEYS = new Set(['development', 'staging', 'production']);
+const FIELD_KEYS = new Set([
+    'profile',
+    'routineSuccessSampleRate',
+    'diagnosticRetentionDays',
+    'protectedRetentionDays',
+    'dashboards',
+    'systemLogLevel',
+    'retainDormantComponentLogs',
+]);
+const PROFILE_DEFAULTS = {
+    'cost-optimized': {
+        sampleRate: 0.05,
+        diagnosticDays: 7,
+        productionDiagnosticDays: 30,
+        dashboards: 'none',
+        systemLogLevel: 'WARN',
+    },
+    balanced: {
+        sampleRate: 0.25,
+        diagnosticDays: 14,
+        productionDiagnosticDays: 30,
+        dashboards: 'stage',
+        systemLogLevel: 'INFO',
+    },
+    standard: {
+        sampleRate: 1,
+        diagnosticDays: 30,
+        productionDiagnosticDays: 90,
+        dashboards: 'slice',
+        systemLogLevel: 'INFO',
+    },
+};
+function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`[observability] ${label} must be an object.`);
+    }
+    return value;
+}
+function parseObservabilityPolicy(value, activeStages) {
+    const root = record(value, 'Policy');
+    if (root.schemaVersion !== 1 ||
+        Object.keys(root).some((key) => !['schemaVersion', 'stages'].includes(key))) {
+        throw new Error('[observability] Expected schemaVersion 1 with stages only.');
+    }
+    const stages = record(root.stages, 'stages');
+    if (Object.keys(stages).length === 0)
+        throw new Error('[observability] Declare active stages.');
+    if (activeStages &&
+        (Object.keys(stages).length !== activeStages.length ||
+            activeStages.some((stage) => !Object.prototype.hasOwnProperty.call(stages, stage))))
+        throw new Error('[observability] Declare exactly the active repository stages: ' +
+            activeStages.join(', ') +
+            '. Update seeded ebk.observability.json before generation or upgrade.');
+    for (const [stage, raw] of Object.entries(stages)) {
+        if (!STAGE_KEYS.has(stage))
+            throw new Error(`[observability] Unsupported stage ${stage}.`);
+        const entry = record(raw, stage);
+        if (Object.keys(entry).some((key) => !FIELD_KEYS.has(key)))
+            throw new Error(`[observability] Unknown field in ${stage}.`);
+        if (entry.profile !== undefined &&
+            !exports.OBSERVABILITY_PROFILES.includes(entry.profile))
+            throw new Error(`[observability] Invalid profile for ${stage}.`);
+        const sample = entry.routineSuccessSampleRate;
+        if (sample !== undefined &&
+            (typeof sample !== 'number' ||
+                !Number.isFinite(sample) ||
+                sample < 0 ||
+                sample > 1))
+            throw new Error(`[observability] ${stage} routineSuccessSampleRate must be between 0 and 1.`);
+        for (const key of [
+            'diagnosticRetentionDays',
+            'protectedRetentionDays',
+        ]) {
+            const days = entry[key];
+            if (days !== undefined &&
+                (typeof days !== 'number' ||
+                    !RETENTION_DAYS.has(days) ||
+                    (key === 'protectedRetentionDays' && days < 30)))
+                throw new Error(`[observability] Invalid ${stage} ${key}; protected logs require at least 30 days.`);
+        }
+        if (entry.dashboards !== undefined &&
+            (typeof entry.dashboards !== 'string' ||
+                !['none', 'stage', 'slice'].includes(entry.dashboards)))
+            throw new Error(`[observability] Invalid dashboard policy for ${stage}.`);
+        if (entry.systemLogLevel !== undefined &&
+            (typeof entry.systemLogLevel !== 'string' ||
+                !['WARN', 'INFO'].includes(entry.systemLogLevel)))
+            throw new Error(`[observability] Invalid systemLogLevel for ${stage}.`);
+        if (entry.retainDormantComponentLogs !== undefined &&
+            typeof entry.retainDormantComponentLogs !== 'boolean')
+            throw new Error(`[observability] Invalid retainDormantComponentLogs for ${stage}.`);
+    }
+    return JSON.parse(JSON.stringify(root));
+}
+/** New workspaces opt in; a managed upgrade of an older workspace preserves its choices. */
+function defaultObservabilityPolicy(stages, options = {}) {
+    const value = { schemaVersion: 1, stages: {} };
+    for (const stage of stages) {
+        value.stages[stage] = options.preserveLegacy
+            ? {
+                profile: 'standard',
+                routineSuccessSampleRate: 1,
+                diagnosticRetentionDays: 30,
+                protectedRetentionDays: 30,
+                dashboards: 'slice',
+                systemLogLevel: 'INFO',
+                retainDormantComponentLogs: true,
+            }
+            : stage === 'production'
+                ? { profile: options.productionProfile ?? 'cost-optimized' }
+                : { profile: stage === 'development' ? 'cost-optimized' : 'balanced' };
+    }
+    return parseObservabilityPolicy(value);
+}
+function resolveObservabilityPolicy(input) {
+    const policy = parseObservabilityPolicy(input.policy);
+    const resolved = (0, stages_js_1.resolveFoundationStages)({
+        consumerStage: input.stage,
+        activeFoundationStages: Object.keys(policy.stages),
+    });
+    const entry = policy.stages[resolved.foundationStage];
+    if (!entry)
+        throw new Error('[observability] Resolved Foundation stage has no policy.');
+    const inherited = resolved.foundationStage === 'production'
+        ? input.productionProfile
+        : resolved.foundationStage === 'staging'
+            ? 'balanced'
+            : 'cost-optimized';
+    const profile = resolved.mapped
+        ? 'cost-optimized'
+        : (entry.profile ?? inherited);
+    if (!exports.OBSERVABILITY_PROFILES.includes(profile))
+        throw new Error('[observability] Production observability requires an explicit profile or a valid committed production capacity profile.');
+    const defaults = PROFILE_DEFAULTS[profile];
+    const production = resolved.foundationStage === 'production';
+    // Task stages never acquire paid dashboards or verbose cloud system logs just
+    // because the shared development stage uses a richer profile.
+    // Lean task diagnostics do not authorize shortening explicit retention or
+    // removing groups with historical logs. Those preservation choices survive.
+    const overrides = resolved.mapped
+        ? {
+            diagnosticRetentionDays: entry.diagnosticRetentionDays,
+            protectedRetentionDays: entry.protectedRetentionDays,
+            retainDormantComponentLogs: entry.retainDormantComponentLogs,
+        }
+        : entry;
+    return {
+        profile: profile,
+        routineSuccessSampleRate: input.local
+            ? 1
+            : (overrides.routineSuccessSampleRate ?? defaults.sampleRate),
+        diagnosticRetentionDays: overrides.diagnosticRetentionDays ??
+            (production
+                ? defaults.productionDiagnosticDays
+                : defaults.diagnosticDays),
+        protectedRetentionDays: overrides.protectedRetentionDays ??
+            (production && profile === 'standard' ? 90 : 30),
+        dashboards: overrides.dashboards ?? defaults.dashboards,
+        systemLogLevel: overrides.systemLogLevel ?? defaults.systemLogLevel,
+        retainDormantComponentLogs: overrides.retainDormantComponentLogs ?? false,
+    };
+}
+//# sourceMappingURL=observability.js.map

package/src/foundation/preflight.js

@@ -181,7 +181,7 @@ function formatFoundationPreflightReport(report) {
     report.issues.forEach((issue) => lines.push(`  - ${issue}`));
     if (!report.ok) {
         lines.push(report.foundationStage === 'development'
-            ? '  Establish Foundation through ebk deploy development --profile=<approved-profile> --expectedRoleArn=<approved-development-role>; the governed stage lifecycle deploys Foundation before eligible Slices.'
+            ? '  Establish Foundation through ebk deploy development --profile=<development-profile> --expectedRoleArn=<role-arn>; the governed stage lifecycle deploys Foundation before eligible Slices.'
             : `  Establish Foundation through the governed ${report.foundationStage} stage lifecycle under the repository deployment profile; follow its protected deployment runbook.`);
     }
     return lines.join('\n');

package/src/generators/function/function.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createFunctionFilePlan = createFunctionFilePlan;
 exports.functionGenerator = functionGenerator;
+const observability_infrastructure_js_1 = require("../observability-infrastructure.js");
+const observability_policy_js_1 = require("../observability-policy.js");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../ownership/index.js");
 const feature_registry_js_1 = require("../feature-registry.js");
@@ -50,9 +52,9 @@ function createFunctionFilePlan(workspace, slice, name, feature = name) {
         !infrastructureSource.includes('    ...(role ?? {}),')) {
         throw new Error('Built-in Function infrastructure is missing its native permission integration point.');
     }
-    files[infrastructurePath] = infrastructureSource
+    files[infrastructurePath] = (0, observability_infrastructure_js_1.renderExtensionObservability)(infrastructureSource
         .replace('  role?: { role: string },', '  permissions: any,')
-        .replace('    ...(role ?? {}),', '    permissions,');
+        .replace('    ...(role ?? {}),', '    permissions,'));
     return {
         files,
         paths: [
@@ -78,6 +80,7 @@ async function functionGenerator(tree, options) {
     const workspace = requireName(typeof packageName === 'string' ? packageName : '', 'Workspace name');
     const slice = requireName(options.slice, 'Product Slice name');
     const name = requireName(options.name, 'Function name');
+    (0, observability_policy_js_1.requireObservabilityPolicyFromTree)(tree);
     (0, post_generation_install_js_1.assertPostGenerationInstallWorkspaceAvailable)(tree, `generator:function:${slice}:${name}`);
     const sliceRoot = node_path_1.posix.join('packages', slice);
     const handlerPath = node_path_1.posix.join(sliceRoot, 'api', `${name}.ts`);

package/src/generators/observability-infrastructure.d.ts

@@ -0,0 +1,2 @@
+/** Apply the same policy to separately generated Function/Service/Job compositions. */
+export declare function renderExtensionObservability(source: string): string;

package/src/generators/observability-infrastructure.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderExtensionObservability = renderExtensionObservability;
+/** Apply the same policy to separately generated Function/Service/Job compositions. */
+function renderExtensionObservability(source) {
+    const replace = (from, to) => {
+        if (!source.includes(from))
+            throw new Error('Generated extension is missing its observability integration point.');
+        source = source.split(from).join(to);
+    };
+    replace("import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';", "import { createManagedLogGroupContract, resolveObservabilityPolicy } from '@empire-builder-kit/nx/foundation';\nimport observabilityPolicy from '../../../../ebk.observability.json';");
+    replace('  const contract = createManagedLogGroupContract({', `  const observability = resolveObservabilityPolicy({
+    policy: observabilityPolicy,
+    stage: $app.stage,
+    productionProfile: process.env.EBK_PRODUCTION_FOUNDATION_PROFILE,
+    local: $dev,
+  });
+  const contract = createManagedLogGroupContract({
+    retentionInDays: observability.protectedRetentionDays,`);
+    // These compositions already own their literal environment maps; preserve
+    // all application, container-image and configuration bindings.
+    replace('EBK_STAGE: $app.stage', 'EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE: String(observability.routineSuccessSampleRate), EBK_STAGE: $app.stage');
+    source = source
+        .split("systemLogLevel: 'INFO'")
+        .join('systemLogLevel: observability.systemLogLevel');
+    source = source
+        .split('      logGroup: {')
+        .join('      logGroup: {\n        retentionInDays: contract.retentionInDays,');
+    return source;
+}
+//# sourceMappingURL=observability-infrastructure.js.map

package/src/generators/observability-policy.d.ts

@@ -0,0 +1,4 @@
+import type { Tree } from '@nx/devkit';
+import { type ObservabilityPolicy } from '../foundation/observability.js';
+/** Leaf generators must not invent or repair the adopter's seeded policy. */
+export declare function requireObservabilityPolicyFromTree(tree: Tree): ObservabilityPolicy;

package/src/generators/observability-policy.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireObservabilityPolicyFromTree = requireObservabilityPolicyFromTree;
+const observability_js_1 = require("../foundation/observability.js");
+const index_js_1 = require("../repository-policy/index.js");
+const tree_policy_js_1 = require("./repository-policy/tree-policy.js");
+/** Leaf generators must not invent or repair the adopter's seeded policy. */
+function requireObservabilityPolicyFromTree(tree) {
+    const source = tree.read(observability_js_1.OBSERVABILITY_POLICY_PATH, 'utf8');
+    if (source === null) {
+        throw new Error(`[observability] ${observability_js_1.OBSERVABILITY_POLICY_PATH} is required before generation or upgrade. Report and apply the workspace upgrade before continuing; leaf generators do not seed this policy.`);
+    }
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new Error(`[observability] ${observability_js_1.OBSERVABILITY_POLICY_PATH} must be valid JSON. Reconcile the seeded policy before generation or upgrade.`);
+    }
+    const repositoryPolicy = (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree);
+    return (0, observability_js_1.parseObservabilityPolicy)(value, (0, index_js_1.activeDeploymentStages)(repositoryPolicy.deploymentProfile));
+}
+//# sourceMappingURL=observability-policy.js.map

package/src/generators/preset/dependency-overrides.d.ts

@@ -3,6 +3,40 @@ export interface DependencyOverrides {
     schemaVersion: 1;
     overrides: Record<string, string>;
 }
+/**
+ * Reviewed Nx and managed OpenNext overrides seeded into a workspace with no
+ * `supply-chain/dependency-overrides.json` yet. Each selector names an exact
+ * transitive release with a recorded advisory; each target is clean and older
+ * than the generated minimum release age. Each default is keyed to the pin it
+ * was reviewed against (`nxVersion`, `openNextVersion`), so a spec fails when
+ * that pin moves and the entry must be reviewed again. The OpenNext selector is
+ * limited to the minifier parent. An existing seeded file always wins over
+ * these defaults.
+ *
+ * A `name@x.y.z` selector is not limited to the `nx` pin. pnpm rewrites every
+ * dependency whose declared range includes x.y.z (in practice a caret or tilde
+ * range on the same major), so minimatch's `brace-expansion` range `^5.0.5`
+ * also resolves 5.0.12. A declared range that excludes x.y.z keeps its own
+ * resolution.
+ *
+ * A parent selector matches only that exact parent release. `nx` declares its
+ * dependencies exactly, but `@opennextjs/aws` declares `@node-minify/core` with
+ * a caret, so a later 9.x release that still pins glob 10.3.3 would make the
+ * OpenNext entry match nothing without any framework change. The generated
+ * workspace's protected scan then denies glob 10.3.3, which is the fail-closed
+ * signal to review the entry again.
+ */
+export declare const DEFAULT_DEPENDENCY_OVERRIDES: {
+    readonly nxVersion: "23.2.1";
+    readonly openNextVersion: "4.1.12";
+    readonly overrides: {
+        readonly '@node-minify/core@9.0.2>glob@10.3.3': "10.5.0";
+        readonly 'axios@1.18.1': "1.20.0";
+        readonly 'brace-expansion@5.0.9': "5.0.12";
+        readonly 'follow-redirects@1.16.0': "1.16.1";
+        readonly 'smol-toml@1.6.1': "1.9.0";
+    };
+};
 /** Seeded pins are data, never package-manager hooks or alternate registries. */
 export declare function parseDependencyOverrides(value: unknown): DependencyOverrides;
 export declare function renderDependencyOverridesYaml(value: DependencyOverrides): string;

package/src/generators/preset/dependency-overrides.js

@@ -1,11 +1,45 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEPENDENCY_OVERRIDES_PATH = void 0;
+exports.DEFAULT_DEPENDENCY_OVERRIDES = exports.DEPENDENCY_OVERRIDES_PATH = void 0;
 exports.parseDependencyOverrides = parseDependencyOverrides;
 exports.renderDependencyOverridesYaml = renderDependencyOverridesYaml;
 const semver_1 = require("semver");
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 exports.DEPENDENCY_OVERRIDES_PATH = 'supply-chain/dependency-overrides.json';
+/**
+ * Reviewed Nx and managed OpenNext overrides seeded into a workspace with no
+ * `supply-chain/dependency-overrides.json` yet. Each selector names an exact
+ * transitive release with a recorded advisory; each target is clean and older
+ * than the generated minimum release age. Each default is keyed to the pin it
+ * was reviewed against (`nxVersion`, `openNextVersion`), so a spec fails when
+ * that pin moves and the entry must be reviewed again. The OpenNext selector is
+ * limited to the minifier parent. An existing seeded file always wins over
+ * these defaults.
+ *
+ * A `name@x.y.z` selector is not limited to the `nx` pin. pnpm rewrites every
+ * dependency whose declared range includes x.y.z (in practice a caret or tilde
+ * range on the same major), so minimatch's `brace-expansion` range `^5.0.5`
+ * also resolves 5.0.12. A declared range that excludes x.y.z keeps its own
+ * resolution.
+ *
+ * A parent selector matches only that exact parent release. `nx` declares its
+ * dependencies exactly, but `@opennextjs/aws` declares `@node-minify/core` with
+ * a caret, so a later 9.x release that still pins glob 10.3.3 would make the
+ * OpenNext entry match nothing without any framework change. The generated
+ * workspace's protected scan then denies glob 10.3.3, which is the fail-closed
+ * signal to review the entry again.
+ */
+exports.DEFAULT_DEPENDENCY_OVERRIDES = {
+    nxVersion: '23.2.1',
+    openNextVersion: '4.1.12',
+    overrides: {
+        '@node-minify/core@9.0.2>glob@10.3.3': '10.5.0',
+        'axios@1.18.1': '1.20.0',
+        'brace-expansion@5.0.9': '5.0.12',
+        'follow-redirects@1.16.0': '1.16.1',
+        'smol-toml@1.6.1': '1.9.0',
+    },
+};
 function isSelector(value) {
     const parts = value.split('>');
     if (parts.length > 2)

package/src/generators/preset/tool-versions.d.ts

@@ -5,9 +5,9 @@
  * existing workspace explicitly adopts the exact reviewed descriptor.
  */
 export declare const WORKSPACE_SST_VERSION: "4.17.1";
-export declare const WORKSPACE_NODE_VERSION: "22.23.1";
+export declare const WORKSPACE_NODE_VERSION: "22.23.4";
 export declare const WORKSPACE_PNPM_VERSION: "11.20.0";
-export declare const WORKSPACE_VITEST_VERSION: "4.1.4";
+export declare const WORKSPACE_VITEST_VERSION: "4.1.12";
 export declare const WORKSPACE_PNPM_SHA512: "9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 export declare const WORKSPACE_PNPM_DESCRIPTOR: "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 /**

package/src/generators/preset/tool-versions.js

@@ -8,9 +8,9 @@ exports.WORKSPACE_SST_NPM_INTEGRITY = exports.WORKSPACE_PNPM_DESCRIPTOR = export
  * existing workspace explicitly adopts the exact reviewed descriptor.
  */
 exports.WORKSPACE_SST_VERSION = '4.17.1';
-exports.WORKSPACE_NODE_VERSION = '22.23.1';
+exports.WORKSPACE_NODE_VERSION = '22.23.4';
 exports.WORKSPACE_PNPM_VERSION = '11.20.0';
-exports.WORKSPACE_VITEST_VERSION = '4.1.4';
+exports.WORKSPACE_VITEST_VERSION = '4.1.12';
 exports.WORKSPACE_PNPM_SHA512 = '9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee';
 exports.WORKSPACE_PNPM_DESCRIPTOR = `pnpm@${exports.WORKSPACE_PNPM_VERSION}+sha512.${exports.WORKSPACE_PNPM_SHA512}`;
 /**

package/src/generators/preset/workspace-files-adopter-skills.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ADOPTER_SKILL_NAMES = void 0;
 exports.renderAdopterSkillIndex = renderAdopterSkillIndex;
 exports.renderAdopterSkills = renderAdopterSkills;
+const workspace_files_agent_development_js_1 = require("./workspace-files-agent-development.js");
 exports.ADOPTER_SKILL_NAMES = [
     'ebk-orient-plan',
     'ebk-build-feature',
@@ -107,6 +108,21 @@ intents commit atomically. TTL is eventual cleanup, not an authorization or
 expiry decision. Events use the same stage/task; never bridge task async work
 to deployed development.
 
+For a cross-Slice event, the producer declares it in its seeded
+\`contracts/events.ts\` \`EventContractSchema\`; its own queue rule then also
+receives it, so its seeded consumer acknowledges it. The consumer adds the
+producer's \`@<scope>/<producer>/contracts\` package to its seeded
+\`contracts/dependencies.json\` \`consumes\` with a \`workspace:*\` dependency,
+runs \`pnpm nx run <consumer>:contract-dependencies-sync\`, declares
+\`{ "source": "<producer>", "events": [{ "detailType": "<Type>", "schemaVersions": [1] }] }\`
+in its seeded \`contracts/event-subscriptions.json\`, and extends its seeded
+\`api/event-consumer.ts\` to accept that source, type and every declared
+version. Managed infrastructure adds one rule per source; never edit
+\`infra/product.ts\`. \`contract-dependencies-check\` binds the declaration to
+the producer's schema. Source and detail type are delivery filters, not
+authentication: authorize every effect from the consumer's own data and
+policy. Never carry product data in \`DataLifecycleChanged\`.
+
 Add SQL only when relational constraints, transactions or joins justify it:
 \`pnpm nx g @empire-builder-kit/nx:sql billing --reason="Ledger requires relational constraints and reporting joins"\`
 reports the paired changes; review and repeat with \`--apply\`. The generator
@@ -125,18 +141,12 @@ not done merely because its generated file exists or the page loads.
             body: `# Develop and verify
 
 Inspect \`ebk dev doctor\` and \`ebk dev status\` using the account and Region
-fixed by committed repository policy and the profile saved by
-\`ebk dev configure\`. If doctor reports an expired or missing SSO session, run
-\`aws sso login --profile <profile>\`; the human approves the request in the
-browser, so the session stays the human's own identity. In a hosted or
-headless shell, add \`--use-device-code\` and the human approves the printed
-code from their own browser. Confirm \`aws sts get-caller-identity\` reports
-that identity, then continue. Never embed access keys, export, copy, or read
-credentials from the SSO cache, or assume a separate or stronger principal.
-Only an attended agent (local or hosted), one a human is actively directing,
-uses that session; an unattended or background agent never receives a human
-profile or SSO session. Resolve other readiness failures using the reported
-prerequisite; a doctor pass is not feature proof.
+fixed by committed repository policy and the development profile saved by
+\`ebk dev configure\`.
+
+${workspace_files_agent_development_js_1.AGENT_DEVELOPMENT_AUTHORITY}
+Resolve other readiness failures using the reported prerequisite; a doctor pass
+is not feature proof.
 Development accepts dirty source and does not require a production
 confirmation, release artifact or full workspace barrier.
 
@@ -178,7 +188,7 @@ browser check. Prefer \`ebk dev restart\` while iterating and reserve
 \`ebk dev down\` for the completion boundary.
 
 At the completion boundary, settle \`ebk dev down billing\`, then use
-\`ebk deploy development billing --profile=<approved-profile> --expectedRoleArn=<exact-role>\`.
+\`ebk deploy development billing --profile=<development-profile> --expectedRoleArn=<exact-role>\`.
 This selects Foundation then Billing. Omit Slice selectors for complete-stage
 proof. Verify the deployed Router without hot processes or fallback serving it.
 Check migration, smoke and cleanup outcomes; failure is not acceptance.
@@ -199,11 +209,12 @@ mutation; source policy is authoritative if deliberately changed later.
 
 Use \`ebk deploy development\` for the complete active development stage, or
 \`ebk deploy development billing\` for Foundation plus one selected Slice.
-Pass the human's Identity Center \`--profile\` (typically the one saved by
-\`ebk dev configure\`) and the exact stage deployment role from
+Pass the development profile saved by \`ebk dev configure\` as \`--profile\`;
+it chains the human's Identity Center source profile into the exact development
+deployment role. Pass that role from
 \`docs/stage-deployment-authority.md\` as \`--expectedRoleArn\`; verify
-account, Region, stage and current caller. Refresh an expired development
-session as in the develop/verify skill. No direct SST or AWS application
+account, Region, stage and current caller. Refresh an expired source session
+as in the develop/verify skill. No direct SST or AWS application
 mutation. A development deploy runs to completion with no prompt; add
 \`--json\` for one bounded result on stdout after the run (the receipt this run
 wrote and each project's outcome). Staging and production refuse \`--json\`.

package/src/generators/preset/workspace-files-agent-development.d.ts

@@ -0,0 +1,9 @@
+/**
+ * One canonical statement of what a coding agent may do in the development
+ * stage. The seeded README and Foundation runbook and the managed
+ * develop/verify skill interpolate it verbatim so the three copies cannot
+ * drift. Any agent, attended or unattended, may use the human's approved
+ * development profile for development-stage work; the protected stages,
+ * credential handling and denial handling stay fixed.
+ */
+export declare const AGENT_DEVELOPMENT_AUTHORITY = "Any coding agent, attended or unattended, may run `ebk dev up`, `restart`,\n`down`, and `ebk deploy development` through EBK/Nx with the human's approved\ndevelopment profile, within the approved task, account, Region, ownership,\ncost, and cleanup limits, without repeated confirmation. The source profile is\nthe human's IAM Identity Center login profile. The development profile is the\none `ebk dev configure` saves and `--profile` receives; it chains the source\nprofile into the exact bounded development deployment role named in\n`docs/stage-deployment-authority.md`. That role assumption is expected; it\ndoes not authorize another role or broader access. An agent on another host\nreceives no copy of either profile or of the SSO cache.\nIf the source session is expired or missing, run\n`aws sso login --profile <source-profile>`, adding `--use-device-code` in a\nheadless shell. The login needs the human's browser approval, so an agent whose\nsource session has expired with no human available stops and reports.\nBefore mutation, run `aws sts get-caller-identity --profile <development-profile>`.\n`Account` must equal the committed development account, `Arn` must be\n`arn:<partition>:sts::<account>:assumed-role/ebk-development-deploy/<session>`,\nan assumed-role session of that exact role, and the Region saved by\n`ebk dev configure` must equal the committed Region. `ebk dev up` checks only\nthe account and Region; `ebk deploy development` also enforces the role.\nNever embed keys, export or copy credentials, read the SSO cache, or broaden\ntrust or policies. A protected observer profile, meaning a read-only staging or\nproduction profile the human may hold for inspection, is never a role source,\nand neither is any other staging or production profile.\nStaging and production stay GitHub-only or human-only, and agents and CI never\nrun `ebk secret set`. A new binding or authority expansion stops for a human\ndecision. A denial from the agent host, EBK, or AWS stops that mutation and\nevery equivalent route: report the exact denial and command, and do not\nre-route through Nx, SST, raw AWS, another profile, or another role. A\nhuman-started Fleet is the fallback.";

package/src/generators/preset/workspace-files-agent-development.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_DEVELOPMENT_AUTHORITY = void 0;
+/**
+ * One canonical statement of what a coding agent may do in the development
+ * stage. The seeded README and Foundation runbook and the managed
+ * develop/verify skill interpolate it verbatim so the three copies cannot
+ * drift. Any agent, attended or unattended, may use the human's approved
+ * development profile for development-stage work; the protected stages,
+ * credential handling and denial handling stay fixed.
+ */
+exports.AGENT_DEVELOPMENT_AUTHORITY = `Any coding agent, attended or unattended, may run \`ebk dev up\`, \`restart\`,
+\`down\`, and \`ebk deploy development\` through EBK/Nx with the human's approved
+development profile, within the approved task, account, Region, ownership,
+cost, and cleanup limits, without repeated confirmation. The source profile is
+the human's IAM Identity Center login profile. The development profile is the
+one \`ebk dev configure\` saves and \`--profile\` receives; it chains the source
+profile into the exact bounded development deployment role named in
+\`docs/stage-deployment-authority.md\`. That role assumption is expected; it
+does not authorize another role or broader access. An agent on another host
+receives no copy of either profile or of the SSO cache.
+If the source session is expired or missing, run
+\`aws sso login --profile <source-profile>\`, adding \`--use-device-code\` in a
+headless shell. The login needs the human's browser approval, so an agent whose
+source session has expired with no human available stops and reports.
+Before mutation, run \`aws sts get-caller-identity --profile <development-profile>\`.
+\`Account\` must equal the committed development account, \`Arn\` must be
+\`arn:<partition>:sts::<account>:assumed-role/ebk-development-deploy/<session>\`,
+an assumed-role session of that exact role, and the Region saved by
+\`ebk dev configure\` must equal the committed Region. \`ebk dev up\` checks only
+the account and Region; \`ebk deploy development\` also enforces the role.
+Never embed keys, export or copy credentials, read the SSO cache, or broaden
+trust or policies. A protected observer profile, meaning a read-only staging or
+production profile the human may hold for inspection, is never a role source,
+and neither is any other staging or production profile.
+Staging and production stay GitHub-only or human-only, and agents and CI never
+run \`ebk secret set\`. A new binding or authority expansion stops for a human
+decision. A denial from the agent host, EBK, or AWS stops that mutation and
+every equivalent route: report the exact denial and command, and do not
+re-route through Nx, SST, raw AWS, another profile, or another role. A
+human-started Fleet is the fallback.`;
+//# sourceMappingURL=workspace-files-agent-development.js.map