@empire-builder-kit/nx 1.0.0-rc.43 → 1.0.0-rc.45

package/src/generators/slice/built-in-plan-infrastructure-files.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductInfrastructureFiles = renderProductInfrastructureFiles;
+const built_in_plan_alarm_identity_js_1 = require("./built-in-plan-alarm-identity.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 const built_in_plan_key_value_retention_infrastructure_js_1 = require("./built-in-plan-key-value-retention-infrastructure.js");
 /** @internal */
@@ -8,7 +9,11 @@ function renderProductInfrastructureFiles(name, pascalName, workspace, protected
     const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
     const recordExportWorkflowName = (0, built_in_plan_shared_js_1.stableGeneratedName)(40, name);
     const files = {
-        'infra/event-subscriptions.ts': `/** Read the existing seeded event contract; never broaden source or stage routing. */
+        'infra/event-subscriptions.ts': `/**
+ * Same-Slice routing reads only the Slice's own seeded EventContractSchema and
+ * never broadens its source or stage filter. Foreign Slices are routed only
+ * through the seeded contracts/event-subscriptions.json declaration below.
+ */
 export function sameSliceEventDetailTypes(value: unknown): string[] {
   const contract = value as {
     kind?: unknown;
@@ -46,6 +51,104 @@ export function sameSliceEventDetailTypes(value: unknown): string[] {
   types.delete('DataLifecycleChanged');
   return [...types].sort();
 }
+
+/** One exact queue rule for each foreign Slice that the seeded declaration names. */
+export interface CrossSliceEventSubscription {
+  readonly detailTypes: readonly string[];
+  readonly ruleName: string;
+  readonly schemaVersions: readonly number[];
+  readonly source: string;
+}
+
+function exactKeys(
+  value: unknown,
+  keys: readonly string[],
+): value is Record<string, unknown> {
+  return !!value && typeof value === 'object' && !Array.isArray(value) &&
+    Object.keys(value).length === keys.length &&
+    keys.every((key) => Object.hasOwn(value, key));
+}
+
+function subscriptionError(detail: string): Error {
+  return new Error('contracts/event-subscriptions.json ' + detail);
+}
+
+/**
+ * Validate the seeded cross-Slice declaration before any rule registers.
+ * Source and detail type are delivery filters, not authentication: the
+ * consumer authorizes every effect from its own data and policy.
+ */
+export function crossSliceEventSubscriptions(
+  declaration: unknown,
+  dependencies: unknown,
+): CrossSliceEventSubscription[] {
+  if (
+    !exactKeys(declaration, ['schemaVersion', 'subscriptions']) ||
+    declaration.schemaVersion !== 1 ||
+    !Array.isArray(declaration.subscriptions) ||
+    declaration.subscriptions.length > 8
+  ) throw subscriptionError('must be a v1 declaration with at most 8 source subscriptions.');
+  if (
+    !exactKeys(dependencies, ['consumes', 'schemaVersion']) ||
+    dependencies.schemaVersion !== 1 ||
+    !Array.isArray(dependencies.consumes)
+  ) throw subscriptionError('requires the v1 contracts/dependencies.json declaration.');
+  const consumes = new Set<unknown>(dependencies.consumes);
+  const sources = new Set<string>();
+  const ruleNames = new Set<string>();
+  const subscriptions: CrossSliceEventSubscription[] = [];
+  for (const raw of declaration.subscriptions as unknown[]) {
+    if (
+      !exactKeys(raw, ['events', 'source']) || typeof raw.source !== 'string' ||
+      raw.source.length > 63 || !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(raw.source) ||
+      raw.source === '${name}' || sources.has(raw.source)
+    ) throw subscriptionError('requires unique foreign Slice sources other than ${name}.');
+    const source = raw.source;
+    sources.add(source);
+    const contracts = '@${workspace}/' + source + '/contracts';
+    if (!consumes.has(contracts))
+      throw subscriptionError('source ' + source + ' requires ' + contracts + ' in contracts/dependencies.json consumes.');
+    if (!Array.isArray(raw.events) || raw.events.length < 1 || raw.events.length > 32)
+      throw subscriptionError('source ' + source + ' must declare 1 to 32 events.');
+    const detailTypes = new Set<string>();
+    let schemaVersions: number[] | undefined;
+    for (const event of raw.events as unknown[]) {
+      if (
+        !exactKeys(event, ['detailType', 'schemaVersions']) ||
+        typeof event.detailType !== 'string' ||
+        !/^[A-Za-z][A-Za-z0-9._-]{0,127}$/.test(event.detailType) ||
+        event.detailType === 'DataLifecycleChanged' || detailTypes.has(event.detailType)
+      ) throw subscriptionError('source ' + source + ' requires unique literal detail types other than DataLifecycleChanged.');
+      const declared: unknown = event.schemaVersions;
+      if (
+        !Array.isArray(declared) || declared.length < 1 || declared.length > 8 ||
+        declared.some((version) => typeof version !== 'number' ||
+          !Number.isSafeInteger(version) || version < 1) ||
+        new Set(declared).size !== declared.length
+      ) throw subscriptionError('source ' + source + ' requires 1 to 8 unique schemaVersions of at least 1.');
+      const versions = (declared as number[]).slice().sort((left, right) => left - right);
+      // One rule filters detail type and schema version independently, so
+      // every event of one source shares one version set to stay exact.
+      if (schemaVersions && schemaVersions.join(',') !== versions.join(','))
+        throw subscriptionError('source ' + source + ' must declare the same schemaVersions for every event.');
+      schemaVersions = versions;
+      detailTypes.add(event.detailType);
+    }
+    const ruleName = '${pascalName}' + source.split('-').map((part) =>
+      part.charAt(0).toUpperCase() + part.slice(1)).join('') + 'SubscribedEventsRule';
+    if (!schemaVersions || ruleNames.has(ruleName))
+      throw subscriptionError('sources must derive unique rule identities.');
+    ruleNames.add(ruleName);
+    subscriptions.push({
+      detailTypes: [...detailTypes].sort(),
+      ruleName,
+      schemaVersions,
+      source,
+    });
+  }
+  return subscriptions.sort((left, right) =>
+    left.source < right.source ? -1 : left.source > right.source ? 1 : 0);
+}
 `,
         'infra/route-function-materialization.ts': `type RouteFunctionArgs = {
   ebkRouteMaterialization?: unknown;
@@ -388,6 +491,7 @@ export function validateSuccessfulDeploymentReceipt(
         'infra/product.ts': `import {
   createManagedLogGroupContract,
   createRouterOriginProofInjection,
+  resolveObservabilityPolicy,
 ${sql ? '  provisionDatabaseBindings,\n' : ''}\
 } from '@empire-builder-kit/nx/foundation';
 import * as random from '@pulumi/random';
@@ -420,8 +524,14 @@ import {
   ${identifierPrefix}UseRecordDelegation,
 } from '../api/contracts/protected.js';
 import lifecycleConsumers from '../data/lifecycle-consumers.json';
+import observabilityPolicy from '../../../ebk.observability.json';
+import contractDependencies from '../contracts/dependencies.json';
+import eventSubscriptions from '../contracts/event-subscriptions.json';
 import { EventContractSchema } from '../contracts/events.js';
-import { sameSliceEventDetailTypes } from './event-subscriptions.js';
+import {
+  crossSliceEventSubscriptions,
+  sameSliceEventDetailTypes,
+} from './event-subscriptions.js';
 ${sql ? "import databaseBindings from '../database/bindings.json';\n" : ''}\
 ${sql ? "import { createSqlOutboxInfrastructure } from './sql-outbox.js';\n" : ''}\
 ${"import { createKeyValueInfrastructure } from './key-value.js';\n"}\
@@ -464,6 +574,13 @@ import { validateSuccessfulDeploymentReceipt } from './deployment-receipt.js';
 // <ebk:composition-imports:start>
 // <ebk:composition-imports:end>
 
+const observability = resolveObservabilityPolicy({
+  policy: observabilityPolicy,
+  stage: $app.stage,
+  productionProfile: process.env.EBK_PRODUCTION_FOUNDATION_PROFILE,
+  local: $dev,
+});
+
 function protectedPerformanceDeploymentAuthority(input: {
   enabled: string;
   releaseSourceCommit: string;
@@ -578,6 +695,7 @@ function managedLogGroup(
 function managedLogContract(component: string, resource?: string) {
   return createManagedLogGroupContract({
     component,
+    retentionInDays: observability.protectedRetentionDays,
     ...(resource ? { resource } : {}),
     slice: '${name}',
     stage: $app.stage,
@@ -593,14 +711,22 @@ function operationalAlarmDescription(input: {
   return JSON.stringify({
     businessSymptom: input.businessSymptom,
     id: input.id,
-    owner: '${name}-product',
-    route: '${name}-on-call',
+    owner: '${(0, built_in_plan_alarm_identity_js_1.sliceAlarmOwnership)(name).owner}',
+    route: '${(0, built_in_plan_alarm_identity_js_1.sliceAlarmOwnership)(name).route}',
     runbook: input.runbook,
     schemaVersion: 1,
     slice: '${name}',
   });
 }
 
+// sst.aws.Queue has no name member: QueueName dimensions read the physical
+// aws.sqs.Queue name through nodes (nodes.queue.id is the queue URL).
+function physicalQueueName<Q extends { nodes: { queue: { name: unknown } } }>(
+  queue: Q,
+): Q['nodes']['queue']['name'] {
+  return queue.nodes.queue.name;
+}
+
 function managedLogDataProtection(
   logicalName: string,
   contract: ReturnType<typeof createManagedLogGroupContract>,
@@ -620,12 +746,7 @@ function managedLogDataProtection(
     logicalName + 'DataProtectionFindings',
     {
       alarmActions: [alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom:
-          'A managed log group contains a protected-data finding.',
-        id: 'data-protection-findings',
-        runbook: 'docs/runbooks/log-investigation.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'data-protection-findings', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { LogGroupName: logGroupName },
       evaluationPeriods: 1,
@@ -645,14 +766,26 @@ function lambdaLogging(logGroupName: any, functionName?: any) {
   return {
     logging: { format: 'json' as const, logGroup: logGroupName },
     transform: {
-      function: {
-        ...(functionName ? { name: functionName } : {}),
-        loggingConfig: {
+      function(args: Record<string, any>): undefined {
+        if (functionName) args.name = functionName;
+        args.environment = $output(args.environment ?? {}).apply(
+          (environment: Record<string, any>) => ({
+            ...environment,
+            variables: $output(environment.variables ?? {}).apply(
+              (variables: Record<string, any>) => ({
+                ...variables,
+                EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+                  String(observability.routineSuccessSampleRate),
+              }),
+            ),
+          }),
+        );
+        args.loggingConfig = {
           applicationLogLevel: 'TRACE',
           logFormat: 'JSON',
           logGroup: logGroupName,
-          systemLogLevel: 'INFO',
-        },
+          systemLogLevel: observability.systemLogLevel,
+        };
       },
     },
   };
@@ -664,6 +797,11 @@ export function product() {
     $dev ? 'development' : $app.stage,
   );
   const asyncAdaptersConfigured = assertAsyncAdapterDeploymentReady();
+  // Declared cross-Slice subscriptions fail closed before any resource registers.
+  const crossSliceSubscriptions = crossSliceEventSubscriptions(
+    eventSubscriptions,
+    contractDependencies,
+  );
   const secretLinks = createStandardSliceSecretLinks();
   const performanceHmacLogicalName =
     'GeneratedPerformanceLoadHmacKeys';
@@ -780,12 +918,7 @@ ${`  const keyValue = createKeyValueInfrastructure({
     '${pascalName}KeyValueStreamDeliveryErrors',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom:
-          'The key-value stream delivery Function failed an invocation.',
-        id: 'key-value-stream-delivery-errors',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'key-value-stream-delivery-errors', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { FunctionName: keyValue.dispatcher.name },
       evaluationPeriods: 1,
@@ -802,12 +935,7 @@ ${`  const keyValue = createKeyValueInfrastructure({
     '${pascalName}KeyValueStreamIteratorAge',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom:
-          'Prompt domain-event delivery from the key-value stream is falling behind.',
-        id: 'key-value-stream-iterator-age',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'key-value-stream-iterator-age', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { FunctionName: keyValue.dispatcher.name },
       evaluationPeriods: 1,
@@ -824,11 +952,7 @@ ${`  const keyValue = createKeyValueInfrastructure({
     '${pascalName}KeyValueReconciliationErrors',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'Durable domain-event recovery is failing.',
-        id: 'key-value-reconciliation-errors',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'key-value-reconciliation-errors', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { FunctionName: keyValue.reconciler.name },
       evaluationPeriods: 1,
@@ -849,11 +973,7 @@ ${`  const keyValue = createKeyValueInfrastructure({
     '${pascalName}OutboxBacklog',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'Durable domain-event intents remain undelivered.',
-        id: 'outbox-backlog',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'outbox-backlog', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { Slice: '${name}', Stage: $app.stage },
       evaluationPeriods: 2,
@@ -870,11 +990,7 @@ ${`  const keyValue = createKeyValueInfrastructure({
     '${pascalName}EventIntentRejected',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'A retained domain-event intent cannot be delivered.',
-        id: 'event-intent-rejected',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'event-intent-rejected', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { Slice: '${name}', Stage: $app.stage },
       evaluationPeriods: 1,
@@ -891,12 +1007,7 @@ ${`  const keyValue = createKeyValueInfrastructure({
     '${pascalName}EventDeliveryAttempts',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom:
-          'A domain-event intent is repeatedly failing delivery.',
-        id: 'event-delivery-attempts',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'event-delivery-attempts', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { Slice: '${name}', Stage: $app.stage },
       evaluationPeriods: 1,
@@ -970,6 +1081,8 @@ ${sql
         userPoolArn: foundation.discovery.identityUserPoolArn,
       }),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
         EBK_SLICE: '${name}',
         EBK_STAGE: $app.stage,
         EBK_WORKSPACE: '${workspace}',
@@ -1065,21 +1178,21 @@ ${sql
     'async-inbox-cleanup',
     foundation.discovery.alertTopicArn,
   );
-  const asyncProviderWorkerLogs = managedLogGroup(
+  const asyncProviderWorkerLogs = asyncAdaptersConfigured || observability.retainDormantComponentLogs ? managedLogGroup(
     '${pascalName}AsyncProviderWorkerLogs',
     'async-provider-worker',
     foundation.discovery.alertTopicArn,
-  );
+  ) : undefined;
   const asyncScheduleTargetLogs = managedLogGroup(
     '${pascalName}AsyncScheduleTargetLogs',
     'async-schedule-target',
     foundation.discovery.alertTopicArn,
   );
-  const asyncWebhookIngressLogs = managedLogGroup(
+  const asyncWebhookIngressLogs = asyncAdaptersConfigured || observability.retainDormantComponentLogs ? managedLogGroup(
     '${pascalName}AsyncWebhookIngressLogs',
     'async-webhook-ingress',
     foundation.discovery.alertTopicArn,
-  );
+  ) : undefined;
   const asyncWorkflowTaskLogs = managedLogGroup(
     '${pascalName}AsyncWorkflowTaskLogs',
     'async-workflow-task',
@@ -1174,6 +1287,8 @@ ${network ? '    ...(performanceDeploymentAuthority ? { vpc: foundation.vpc } :
   api.route(${identifierPrefix}Health.method + ' ' + ${identifierPrefix}Health.path, {
     permissions: nativeAuthority.permissions('api-health'),
     environment: {
+      EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+        String(observability.routineSuccessSampleRate),
       EBK_SOURCE_COMMIT: releaseSourceCommit,
       EBK_STAGE: $app.stage,
     },
@@ -1188,6 +1303,8 @@ ${network ? '    ...(performanceDeploymentAuthority ? { vpc: foundation.vpc } :
     {
       permissions: nativeAuthority.permissions('api-machine-authorization-proof'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
 ${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1221,6 +1338,8 @@ ${'        ...keyValue.environment,\n'}\
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-delegations'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
 ${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1275,6 +1394,8 @@ ${'        ...keyValue.environment,\n'}\
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-data-rights'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
 ${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1308,6 +1429,8 @@ ${'        ...keyValue.environment,\n'}\
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
 ${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1328,6 +1451,8 @@ ${'        ...keyValue.environment,\n'}\
     {
     permissions: nativeAuthority.permissions('api-protected'),
     environment: {
+      EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+        String(observability.routineSuccessSampleRate),
 ${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1348,6 +1473,8 @@ ${'      ...keyValue.environment,\n'}\
     {
     permissions: nativeAuthority.permissions('api-database-health'),
     environment: {
+      EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+        String(observability.routineSuccessSampleRate),
 ${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1378,6 +1505,8 @@ ${'      ...keyValue.environment,\n'}\
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
 ${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1409,6 +1538,8 @@ ${'        ...keyValue.environment,\n'}\
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
       permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
 ${'        ...keyValue.environment,\n'}\
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1429,6 +1560,8 @@ ${'        ...keyValue.environment,\n'}\
     {
     permissions: nativeAuthority.permissions('api-publish-created'),
     environment: {
+      EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+        String(observability.routineSuccessSampleRate),
 ${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1452,6 +1585,8 @@ ${'      ...keyValue.environment,\n'}\
     {
       permissions: machineAuthorization.proof.permissions,
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
         ...machineAuthorization.proof.environment,
         AUTH_MACHINE_PROBE_URL:
           $interpolate\`\${api.url}\${${identifierPrefix}MachineAuthorizationProof.path}\`,
@@ -1467,6 +1602,8 @@ ${'      ...keyValue.environment,\n'}\
     {
       permissions: dataExportStore.cleanupPermissions,
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
 ${'        ...keyValue.environment,\n'}\
         DATA_EXPORT_BUCKET_NAME: dataExportStore.bucket.bucket,
         DATA_EXPORT_KMS_KEY_ARN: dataExportStore.encryptionKey.arn,
@@ -1570,6 +1707,8 @@ ${''}\
   );
   eventQueue.subscribe({
     environment: {
+      EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+        String(observability.routineSuccessSampleRate),
 ${'      ...keyValue.environment,\n'}\
       EBK_STAGE: $app.stage,
       EBK_WORKLOAD_IDENTITY: '${name}:event-consumer',
@@ -1605,6 +1744,26 @@ ${''}\
       },
     },
   );
+  // One rule per declared foreign source: EventBridge ORs values within a
+  // field and ANDs fields, so a merged rule would cross-match sources and types.
+  for (const subscription of crossSliceSubscriptions) {
+    foundation.eventBus.subscribeQueue(
+      subscription.ruleName,
+      eventQueue,
+      {
+        pattern: {
+          detail: {
+            meta: {
+              schemaVersion: [...subscription.schemaVersions],
+              stage: [$app.stage],
+            },
+          },
+          detailType: [...subscription.detailTypes],
+          source: [subscription.source],
+        },
+      },
+    );
+  }
 
   const eventConsumerAlarmDefinition = defineEventConsumerAlarms({
     consumer: '${pascalName}Created',
@@ -1618,18 +1777,14 @@ ${''}\
   }
   const dlqAlarm = new aws.cloudwatch.MetricAlarm('${pascalName}EventDlqDepth', {
     alarmActions: [foundation.discovery.alertTopicArn],
-    alarmDescription: operationalAlarmDescription({
-      businessSymptom: 'Domain-event processing has terminal failures.',
-      id: 'event-dlq-depth',
-      runbook: 'docs/runbooks/async-recovery.md',
-    }),
+    alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'event-dlq-depth', '    ')}),
     name: '${name}-' + $app.stage + '-event-dlq-depth',
     comparisonOperator: eventConsumerAlarmDefinition.comparisonOperator,
-    dimensions: { QueueName: eventDlq.name },
+    dimensions: { QueueName: physicalQueueName(eventDlq) },
     evaluationPeriods: eventConsumerAlarmDefinition.evaluationPeriods,
     metricName: eventConsumerAlarmDefinition.metricName,
     namespace: eventConsumerAlarmDefinition.namespace,
-    period: eventConsumerAlarmDefinition.periodSeconds,
+    period: 300,
     statistic: 'Maximum',
     threshold: eventConsumerAlarmDefinition.threshold,
     treatMissingData: 'notBreaching',
@@ -1683,22 +1838,18 @@ ${''}\
     alertTopicName: foundation.discovery.alertTopicArn.apply(
       (alertTopicArn: string) => alertTopicArn.split(':').at(-1) ?? '',
     ),
-    apiId: api.id,
+    apiId: api.nodes.api.id,
 ${'    databaseTableName: keyValue.table.name,\n'}\
     functionName: dataExportCleanup.name,
-    providerQueueName: providerQueue.name,
+    providerQueueName: physicalQueueName(providerQueue),
   });
   const providerDlqAlarm = new aws.cloudwatch.MetricAlarm(
     '${pascalName}ProviderDlqDepth',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'Provider deliveries have terminal failures.',
-        id: 'provider-dlq-depth',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'provider-dlq-depth', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
-      dimensions: { QueueName: providerDlq.name },
+      dimensions: { QueueName: physicalQueueName(providerDlq) },
       evaluationPeriods: 1,
       metricName: 'ApproximateNumberOfMessagesVisible',
       name: '${name}-' + $app.stage + '-provider-dlq-depth',
@@ -1713,13 +1864,9 @@ ${'    databaseTableName: keyValue.table.name,\n'}\
     '${pascalName}AsyncTargetDlqDepth',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'An asynchronous target has terminal failures.',
-        id: 'async-target-dlq-depth',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'async-target-dlq-depth', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
-      dimensions: { QueueName: asyncTargetDlq.name },
+      dimensions: { QueueName: physicalQueueName(asyncTargetDlq) },
       evaluationPeriods: 1,
       metricName: 'ApproximateNumberOfMessagesVisible',
       name: '${name}-' + $app.stage + '-async-target-dlq-depth',
@@ -1833,7 +1980,6 @@ ${'    databaseTableName: keyValue.table.name,\n'}\
             contentType: 'application/json',
             description:
               '${name} immutable generated default configuration.',
-            versionLabel: releaseSourceCommit,
           },
         );
         const deploymentStrategy =
@@ -1898,9 +2044,14 @@ ${'    databaseTableName: keyValue.table.name,\n'}\
   // <ebk:workload-registrations:end>
 
   if (asyncAdaptersConfigured) {
+    if (!asyncProviderWorkerLogs || !asyncWebhookIngressLogs) {
+      throw new Error('Configured async adapters require their protected log groups.');
+    }
     providerQueue.subscribe(
       {
         environment: {
+          EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+            String(observability.routineSuccessSampleRate),
 ${'          ...keyValue.environment,\n'}\
           EBK_STAGE: $app.stage,
           EBK_WORKLOAD_IDENTITY: '${name}:async-provider-worker',
@@ -1928,6 +2079,8 @@ ${''}\
     api.route('POST /${name}/webhooks/provider', {
       permissions: nativeAuthority.permissions('async-webhook-ingress'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
         EBK_ASYNC_LEDGER_TABLE: asyncRecoveryLedger.name,
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-webhook-ingress',
@@ -1947,6 +2100,8 @@ ${''}\
     {
       permissions: nativeAuthority.permissions('async-outbox-relay'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
 ${'        ...keyValue.environment,\n'}\
 ${''}\
         EBK_STAGE: $app.stage,
@@ -1979,11 +2134,7 @@ ${''}\
     '${pascalName}SqlOutboxRelayErrors',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'Relational event delivery is failing.',
-        id: 'sql-outbox-relay-errors',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'sql-outbox-relay-errors', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { FunctionName: sqlOutbox.relay.name },
       evaluationPeriods: 1,
@@ -2002,11 +2153,7 @@ ${''}\
     '${pascalName}SqlOutboxBacklog',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'Relational event intents remain undelivered.',
-        id: 'sql-outbox-backlog',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'sql-outbox-backlog', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { Slice: '${name}', Stage: $app.stage },
       evaluationPeriods: 2,
@@ -2023,12 +2170,7 @@ ${''}\
     '${pascalName}SqlOutboxAttempts',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom:
-          'A relational event intent is repeatedly failing delivery.',
-        id: 'sql-outbox-attempts',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'sql-outbox-attempts', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { Slice: '${name}', Stage: $app.stage },
       evaluationPeriods: 1,
@@ -2048,6 +2190,8 @@ ${''}\
     {
       permissions: nativeAuthority.permissions('async-inbox-cleanup'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
 ${'        ...keyValue.environment,\n'}\
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-inbox-cleanup',
@@ -2068,6 +2212,8 @@ ${''}\
     {
       permissions: nativeAuthority.permissions('async-schedule-target'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-schedule-target',
         EBK_WORKSPACE: '${workspace}',
@@ -2083,6 +2229,8 @@ ${''}\
     {
       permissions: nativeAuthority.permissions('async-workflow-task'),
       environment: {
+        EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+          String(observability.routineSuccessSampleRate),
         EBK_ASYNC_LEDGER_TABLE: asyncRecoveryLedger.name,
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-workflow-task',
@@ -2404,6 +2552,8 @@ ${''}\
       url: \`http://127.0.0.1:\${devPort}/${name}\`,
     },
     environment: {
+      EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE:
+        String(observability.routineSuccessSampleRate),
 ${'      ...keyValue.environment,\n'}\
       AUTH_CLIENT_ID: authClient.id,
       AUTH_USER_POOL_ID: foundation.userPool.id,
@@ -2671,6 +2821,7 @@ ${''}\
           transform: {
             logGroup: {
               logGroupClass: bootstrapLogContract.logGroupClass,
+              retentionInDays: bootstrapLogContract.retentionInDays,
               tags: bootstrapLogContract.tags,
             },
             taskDefinition: {
@@ -2723,6 +2874,7 @@ ${''}\
           transform: {
             logGroup: {
               logGroupClass: migrationLogContract.logGroupClass,
+              retentionInDays: migrationLogContract.retentionInDays,
               tags: migrationLogContract.tags,
             },
             taskDefinition: {
@@ -2858,6 +3010,7 @@ ${''}\
               transform: {
                 logGroup: {
                   logGroupClass: retirementLogContract.logGroupClass,
+                  retentionInDays: retirementLogContract.retentionInDays,
                   tags: retirementLogContract.tags,
                 },
                 taskDefinition: {
@@ -2949,12 +3102,7 @@ ${''}\
     '${pascalName}OutboxRelayErrors',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom:
-          'The isolated performance-sink outbox relay is failing.',
-        id: 'outbox-relay-errors',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'outbox-relay-errors', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { FunctionName: asyncOutboxRelay.name },
       evaluationPeriods: 1,
@@ -2971,11 +3119,7 @@ ${''}\
     '${pascalName}InboxCleanupErrors',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'The asynchronous inbox cleanup job is failing.',
-        id: 'inbox-cleanup-errors',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'inbox-cleanup-errors', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { FunctionName: asyncInboxCleanup.name },
       evaluationPeriods: 1,
@@ -2992,12 +3136,7 @@ ${''}\
     '${pascalName}DataExportCleanupErrors',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom:
-          'The confidential-export cleanup invocation is failing.',
-        id: 'data-export-cleanup-failure',
-        runbook: 'docs/runbooks/database-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'data-export-cleanup-failure', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { FunctionName: dataExportCleanup.name },
       evaluationPeriods: 1,
@@ -3015,12 +3154,7 @@ ${''}\
       '${pascalName}DataExportCleanupInvocationMissing',
       {
         alarmActions: [foundation.discovery.alertTopicArn],
-        alarmDescription: operationalAlarmDescription({
-          businessSymptom:
-            'The scheduled confidential-export cleanup is not running.',
-          id: 'data-export-cleanup-invocation-missing',
-          runbook: 'docs/runbooks/database-recovery.md',
-        }),
+        alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'data-export-cleanup-invocation-missing', '        ')}),
         comparisonOperator: 'LessThanThreshold',
         dimensions: { FunctionName: dataExportCleanup.name },
         evaluationPeriods: 2,
@@ -3040,11 +3174,7 @@ ${''}\
     '${pascalName}InboxCleanupBacklog',
     {
       alarmActions: [foundation.discovery.alertTopicArn],
-      alarmDescription: operationalAlarmDescription({
-        businessSymptom: 'Terminal asynchronous inbox records are accumulating.',
-        id: 'inbox-cleanup-backlog',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'inbox-cleanup-backlog', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: {
         Component: 'inbox-cleanup',
@@ -3068,12 +3198,7 @@ ${''}\
       '${pascalName}DataExportCleanupDeadline',
       {
         alarmActions: [foundation.discovery.alertTopicArn],
-        alarmDescription: operationalAlarmDescription({
-          businessSymptom:
-            'Confidential-export residue exceeded its deletion deadline.',
-          id: 'data-export-cleanup-deadline',
-          runbook: 'docs/runbooks/database-recovery.md',
-        }),
+        alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'data-export-cleanup-deadline', '        ')}),
         comparisonOperator: 'GreaterThanOrEqualToThreshold',
         dimensions: {
           Component: 'data-export-cleanup',
@@ -3100,12 +3225,7 @@ ${''}\
       '${pascalName}PerformanceLoadCleanupBacklog',
       {
         alarmActions: [foundation.discovery.alertTopicArn],
-        alarmDescription: operationalAlarmDescription({
-          businessSymptom:
-            'Expired protected performance-load evidence is accumulating.',
-          id: 'performance-load-cleanup-backlog',
-          runbook: 'docs/runbooks/performance-capacity-cost.md',
-        }),
+        alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'performance-load-cleanup-backlog', '        ')}),
         comparisonOperator: 'GreaterThanOrEqualToThreshold',
         dimensions: {
           Component: 'performance-load-cleanup',
@@ -3132,12 +3252,7 @@ ${''}\
       '${pascalName}PerformanceLoadCleanupDeadline',
       {
         alarmActions: [foundation.discovery.alertTopicArn],
-        alarmDescription: operationalAlarmDescription({
-          businessSymptom:
-            'Protected performance-load residue exceeded its cleanup deadline.',
-          id: 'performance-load-cleanup-deadline',
-          runbook: 'docs/runbooks/performance-capacity-cost.md',
-        }),
+        alarmDescription: operationalAlarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'performance-load-cleanup-deadline', '        ')}),
         comparisonOperator: 'GreaterThanOrEqualToThreshold',
         dimensions: {
           Component: 'performance-load-cleanup',
@@ -3159,15 +3274,60 @@ ${''}\
         treatMissingData: 'notBreaching',
       },
     );
-  const dashboard = new aws.cloudwatch.Dashboard('${pascalName}Dashboard', {
+  const dashboard = observability.dashboards === 'slice'
+    ? new aws.cloudwatch.Dashboard('${pascalName}Dashboard', {
     dashboardName: '${name}-' + $app.stage,
-    dashboardBody: JSON.stringify({
-      widgets: [{
-        type: 'text', x: 0, y: 0, width: 24, height: 3,
-        properties: { markdown: '# ${pascalName}\\nOwner: product' },
-      }],
-    }),
-  });
+    dashboardBody: $resolve({
+      table: keyValue.table.name,
+      dispatcher: keyValue.dispatcher.name,
+      reconciler: keyValue.reconciler.name,
+      providerQueue: physicalQueueName(providerQueue),
+      providerDlq: physicalQueueName(providerDlq),
+    }).apply(({ table, dispatcher, reconciler, providerQueue, providerDlq }) => JSON.stringify({
+      widgets: [
+        {
+          type: 'metric', x: 0, y: 0, width: 12, height: 6,
+          properties: {
+            title: '${pascalName} delivery errors and throttles',
+            region: process.env.AWS_REGION ?? 'us-east-1',
+            period: 300, stat: 'Sum',
+            metrics: [
+              ['AWS/Lambda', 'Errors', 'FunctionName', dispatcher],
+              ['.', 'Throttles', '.', '.'],
+              ['.', 'Errors', '.', reconciler],
+              ['.', 'Throttles', '.', '.'],
+            ],
+          },
+        },
+        {
+          type: 'metric', x: 12, y: 0, width: 12, height: 6,
+          properties: {
+            title: '${pascalName} durable storage capacity',
+            region: process.env.AWS_REGION ?? 'us-east-1',
+            period: 300, stat: 'Sum',
+            metrics: [
+              ['AWS/DynamoDB', 'ConsumedReadCapacityUnits', 'TableName', table],
+              ['.', 'ConsumedWriteCapacityUnits', '.', '.'],
+              ['.', 'ThrottledRequests', '.', '.', 'Operation', 'PutItem'],
+            ],
+          },
+        },
+        {
+          type: 'metric', x: 0, y: 6, width: 24, height: 6,
+          properties: {
+            title: '${pascalName} provider backlog and dead letters',
+            region: process.env.AWS_REGION ?? 'us-east-1',
+            period: 300, stat: 'Maximum',
+            metrics: [
+              ['AWS/SQS', 'ApproximateNumberOfMessagesVisible', 'QueueName', providerQueue],
+              ['.', '.', '.', providerDlq],
+              ['.', 'ApproximateAgeOfOldestMessage', '.', providerQueue],
+            ],
+          },
+        },
+      ],
+    })),
+  }) : undefined;
   return {
     api,
     asyncInboxCleanup,