@empire-builder-kit/nx 1.0.0-rc.43 → 1.0.0-rc.45

package/src/generators/slice/built-in-plan-shared.d.ts

@@ -17,7 +17,7 @@ export declare const PRODUCT_VERSIONS: {
     readonly awsSts: "^3.700.0";
     readonly drizzle: "^0.45.2";
     readonly drizzleKit: "^0.31.4";
-    readonly next: "16.3.6";
+    readonly next: "16.4.2";
     readonly pg: "^8.22.0";
     readonly playwright: "^1.59.1";
     readonly react: "19.2.8";
@@ -27,9 +27,35 @@ export declare const PRODUCT_VERSIONS: {
     readonly typesPg: "^8.15.5";
     readonly typesReact: "19.2.17";
     readonly typesReactDom: "19.2.3";
-    readonly vitest: "4.1.4";
+    readonly vitest: "4.1.12";
 };
-export declare const PRODUCT_PACKAGE_MANAGED_JSON_POINTERS: readonly ["/name", "/version", "/private", "/dependencies/@aws-sdk~1client-appconfigdata", "/dependencies/@aws-sdk~1client-cloudwatch", "/dependencies/@aws-sdk~1client-cloudwatch-logs", "/dependencies/@aws-sdk~1client-cost-explorer", "/dependencies/@aws-sdk~1client-cognito-identity-provider", "/dependencies/@aws-sdk~1client-dynamodb", "/dependencies/@aws-sdk~1client-ecs", "/dependencies/@aws-sdk~1client-eventbridge", "/dependencies/@aws-sdk~1client-s3", "/dependencies/@aws-sdk~1client-secrets-manager", "/dependencies/@aws-sdk~1client-sfn", "/dependencies/@aws-sdk~1client-sqs", "/dependencies/@aws-sdk~1rds-signer", "/dependencies/@aws-sdk~1client-ssm", "/dependencies/@aws-sdk~1client-sts", "/dependencies/@empire-builder-kit~1runtime", "/dependencies/drizzle-orm", "/dependencies/next", "/dependencies/pg", "/dependencies/react", "/dependencies/react-dom", "/dependencies/server-only", "/devDependencies/@axe-core~1playwright", "/devDependencies/@playwright~1test", "/devDependencies/@types~1node", "/devDependencies/@types~1pg", "/devDependencies/@types~1react", "/devDependencies/@types~1react-dom", "/devDependencies/drizzle-kit", "/devDependencies/vitest", "/exports/.~1api-client", "/exports/.~1api-contract", "/exports/.~1contracts"];
+/**
+ * Exact managed builder: declared as a Slice devDependency and run from the
+ * Slice's installed node_modules slot after its package metadata matches. The
+ * wrapper does not read the lockfile; the frozen pnpm install governs what is
+ * installed in that slot.
+ */
+export declare const OPEN_NEXT_AWS_VERSION = "4.1.12";
+/**
+ * The sharp release OpenNext installs into the image-optimization Function.
+ * OpenNext installs that Function's packages with npm during its build,
+ * outside the Slice lockfile and every lockfile gate. Without
+ * `imageOptimization.install` it selects its own Sharp release with
+ * `--arch=arm64` (OpenNext createImageOptimizationBundle and installDeps), and
+ * npm 10 and 11 ignore `--arch` when they select sharp's native package, so
+ * the build host's CPU wins. The generated web/open-next.config.ts therefore
+ * sets `imageOptimization.install` with this release and `--cpu=arm64`.
+ */
+export declare const OPEN_NEXT_IMAGE_OPTIMIZATION_SHARP_VERSION = "0.35.5";
+/**
+ * The libvips package and library that sharp 0.35.5 requires for Linux arm64:
+ * it pins `@img/sharp-libvips-linux-arm64` 1.3.4 exactly, which exports
+ * `./binary` as `./lib/libvips-cpp.so.8.18.7`. The build wrapper's native
+ * check requires both, so they move with the sharp pin above.
+ */
+export declare const OPEN_NEXT_IMAGE_OPTIMIZATION_LIBVIPS_VERSION = "1.3.4";
+export declare const OPEN_NEXT_IMAGE_OPTIMIZATION_LIBVIPS_LIBRARY = "libvips-cpp.so.8.18.7";
+export declare const PRODUCT_PACKAGE_MANAGED_JSON_POINTERS: readonly ["/name", "/version", "/private", "/dependencies/@aws-sdk~1client-appconfigdata", "/dependencies/@aws-sdk~1client-cloudwatch", "/dependencies/@aws-sdk~1client-cloudwatch-logs", "/dependencies/@aws-sdk~1client-cost-explorer", "/dependencies/@aws-sdk~1client-cognito-identity-provider", "/dependencies/@aws-sdk~1client-dynamodb", "/dependencies/@aws-sdk~1client-ecs", "/dependencies/@aws-sdk~1client-eventbridge", "/dependencies/@aws-sdk~1client-s3", "/dependencies/@aws-sdk~1client-secrets-manager", "/dependencies/@aws-sdk~1client-sfn", "/dependencies/@aws-sdk~1client-sqs", "/dependencies/@aws-sdk~1rds-signer", "/dependencies/@aws-sdk~1client-ssm", "/dependencies/@aws-sdk~1client-sts", "/dependencies/@empire-builder-kit~1runtime", "/dependencies/drizzle-orm", "/dependencies/next", "/dependencies/pg", "/dependencies/react", "/dependencies/react-dom", "/dependencies/server-only", "/devDependencies/@axe-core~1playwright", "/devDependencies/@playwright~1test", "/devDependencies/@opennextjs~1aws", "/devDependencies/@types~1node", "/devDependencies/@types~1pg", "/devDependencies/@types~1react", "/devDependencies/@types~1react-dom", "/devDependencies/drizzle-kit", "/devDependencies/vitest", "/exports/.~1api-client", "/exports/.~1api-contract", "/exports/.~1contracts"];
 export declare function standardPackageManagedJsonPointers(sql: boolean): string[];
 export declare const STANDARD_LOCAL_DEV_ADAPTER: (name: string, dependencySlices?: unknown, sql?: boolean) => {
     dependencySlices: string[];

package/src/generators/slice/built-in-plan-shared.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.STANDARD_LOCAL_DEV_ADAPTER = exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = exports.PRODUCT_VERSIONS = void 0;
+exports.STANDARD_LOCAL_DEV_ADAPTER = exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = exports.OPEN_NEXT_IMAGE_OPTIMIZATION_LIBVIPS_LIBRARY = exports.OPEN_NEXT_IMAGE_OPTIMIZATION_LIBVIPS_VERSION = exports.OPEN_NEXT_IMAGE_OPTIMIZATION_SHARP_VERSION = exports.OPEN_NEXT_AWS_VERSION = exports.PRODUCT_VERSIONS = void 0;
 exports.standardPackageManagedJsonPointers = standardPackageManagedJsonPointers;
 exports.json = json;
 exports.lowerCamelIdentifier = lowerCamelIdentifier;
@@ -27,7 +27,7 @@ exports.PRODUCT_VERSIONS = {
     awsSts: '^3.700.0',
     drizzle: '^0.45.2',
     drizzleKit: '^0.31.4',
-    next: '16.3.6',
+    next: '16.4.2',
     pg: '^8.22.0',
     playwright: '^1.59.1',
     react: '19.2.8',
@@ -39,6 +39,32 @@ exports.PRODUCT_VERSIONS = {
     typesReactDom: '19.2.3',
     vitest: tool_versions_js_1.WORKSPACE_VITEST_VERSION,
 };
+/**
+ * Exact managed builder: declared as a Slice devDependency and run from the
+ * Slice's installed node_modules slot after its package metadata matches. The
+ * wrapper does not read the lockfile; the frozen pnpm install governs what is
+ * installed in that slot.
+ */
+exports.OPEN_NEXT_AWS_VERSION = '4.1.12';
+/**
+ * The sharp release OpenNext installs into the image-optimization Function.
+ * OpenNext installs that Function's packages with npm during its build,
+ * outside the Slice lockfile and every lockfile gate. Without
+ * `imageOptimization.install` it selects its own Sharp release with
+ * `--arch=arm64` (OpenNext createImageOptimizationBundle and installDeps), and
+ * npm 10 and 11 ignore `--arch` when they select sharp's native package, so
+ * the build host's CPU wins. The generated web/open-next.config.ts therefore
+ * sets `imageOptimization.install` with this release and `--cpu=arm64`.
+ */
+exports.OPEN_NEXT_IMAGE_OPTIMIZATION_SHARP_VERSION = '0.35.5';
+/**
+ * The libvips package and library that sharp 0.35.5 requires for Linux arm64:
+ * it pins `@img/sharp-libvips-linux-arm64` 1.3.4 exactly, which exports
+ * `./binary` as `./lib/libvips-cpp.so.8.18.7`. The build wrapper's native
+ * check requires both, so they move with the sharp pin above.
+ */
+exports.OPEN_NEXT_IMAGE_OPTIMIZATION_LIBVIPS_VERSION = '1.3.4';
+exports.OPEN_NEXT_IMAGE_OPTIMIZATION_LIBVIPS_LIBRARY = 'libvips-cpp.so.8.18.7';
 exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = [
     '/name',
     '/version',
@@ -67,6 +93,7 @@ exports.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS = [
     '/dependencies/server-only',
     '/devDependencies/@axe-core~1playwright',
     '/devDependencies/@playwright~1test',
+    '/devDependencies/@opennextjs~1aws',
     '/devDependencies/@types~1node',
     '/devDependencies/@types~1pg',
     '/devDependencies/@types~1react',

package/src/generators/slice/built-in-plan-web-files.js

@@ -131,6 +131,7 @@ export function proxy(request: NextRequest): NextResponse {
 }
 `,
         'web/src/lib/server-logging.ts': `import 'server-only';
+import { randomUUID } from 'node:crypto';
 import { createLogger, type Logger } from '@empire-builder-kit/runtime/logging';
 import { createNextServerContext, type RequestContext } from '@empire-builder-kit/runtime/request-context';
 import { recordReliabilityOperation } from '../../../reliability/metrics';
@@ -167,6 +168,7 @@ export async function observeNextOperation({
     context,
     feature,
     operation,
+    routineSamplingId: randomUUID(),
     slice: '${name}',
     stage,
     workspace: '${workspace}',
@@ -189,13 +191,16 @@ export async function observeNextOperation({
       outcome,
     });
   };
-  logger.info('${name} Next.js operation received');
   try {
+    logger.info('${name} Next.js operation started', {
+      routineRequestStart: true,
+    });
     const response = await handle(logger, context);
     recordOutcome(response.status < 400 ? 'success' : 'failure');
     logger.info('${name} Next.js operation completed', {
       attributes: { httpStatus: response.status },
       outcome: response.status < 400 ? 'success' : 'failure',
+      routineSuccess: response.status < 400 ? true : undefined,
     });
     return response;
   } catch (error) {
@@ -213,6 +218,18 @@ export async function observeNextOperation({
   // builds only this application instead of recursively invoking the Nx root.
   buildCommand: 'pnpm exec next build --webpack web',
   default: {},
+  // OpenNext installs the image-optimization Function's sharp with npm during
+  // the build, outside the lockfile. The Function runs on arm64 Linux (glibc).
+  // npm selects sharp's native package by --cpu and ignores OpenNext's --arch,
+  // so name the CPU here instead of inheriting the build host's.
+  imageOptimization: {
+    install: {
+      additionalArgs: '--cpu=arm64',
+      libc: 'glibc',
+      os: 'linux',
+      packages: ['sharp@${built_in_plan_shared_js_1.OPEN_NEXT_IMAGE_OPTIMIZATION_SHARP_VERSION}'],
+    },
+  },
   packageJsonPath: '../package.json',
 };
 

package/src/generators/slice/built-in-plan.js

@@ -175,6 +175,7 @@ function renderSliceFiles(name, scope, runtimeVersion, ownership, dataPolicyRevi
 function classifyPaths(files, sql) {
     const seededPaths = new Set([
         'operations/background-work.json',
+        'reliability/metric-declarations.ts',
         'README.md',
         'api/data-retention.ts',
         'async/recovery-adapters.ts',

package/src/generators/slice/slice.js

@@ -21,6 +21,7 @@ const workspace_files_js_1 = require("../preset/workspace-files.js");
 const built_in_plan_js_1 = require("./built-in-plan.js");
 const data_policy_review_seed_js_1 = require("./data-policy-review-seed.js");
 const tree_policy_js_1 = require("../repository-policy/tree-policy.js");
+const observability_policy_js_1 = require("../observability-policy.js");
 var built_in_plan_js_2 = require("./built-in-plan.js");
 Object.defineProperty(exports, "PRODUCT_PACKAGE_MANAGED_JSON_POINTERS", { enumerable: true, get: function () { return built_in_plan_js_2.PRODUCT_PACKAGE_MANAGED_JSON_POINTERS; } });
 Object.defineProperty(exports, "STANDARD_LOCAL_DEV_ADAPTER", { enumerable: true, get: function () { return built_in_plan_js_2.STANDARD_LOCAL_DEV_ADAPTER; } });
@@ -176,6 +177,7 @@ function parseBlueprintInputs(inputs) {
 }
 async function sliceGenerator(tree, options) {
     const name = requireSliceName(options.name);
+    (0, observability_policy_js_1.requireObservabilityPolicyFromTree)(tree);
     const root = node_path_1.posix.join('packages', name);
     const blueprintReference = options.blueprint ?? 'standard';
     const parsedInputs = parseBlueprintInputs(options.inputs);

package/src/generators/upgrade/upgrade.d.ts

@@ -54,13 +54,14 @@ export interface UpgradeReport {
     unchanged: string[];
 }
 export interface SeededReconciliationWork {
-    adopterContentSha256: string;
-    category: 'async-adapter' | 'async-settings' | 'configuration-contract' | 'configuration-values' | 'feature-controls' | 'frontend-contract' | 'frontend-security' | 'performance-aggregate-provider' | 'performance-policy' | 'reliability-operations' | 'reliability-slo' | 'release-controls' | 'secret-contract';
+    adopterContentSha256: string | null;
+    category: 'async-adapter' | 'async-settings' | 'configuration-contract' | 'configuration-values' | 'feature-controls' | 'frontend-contract' | 'frontend-security' | 'performance-aggregate-provider' | 'performance-policy' | 'reliability-metrics' | 'reliability-operations' | 'reliability-slo' | 'release-controls' | 'secret-contract';
     currentFrameworkSha256: string | null;
+    guidance?: string;
     implications: string[];
     markerReference: 'PLAN:5.6/seeded-upgrade-reconciliation';
     path: string;
-    requiredAction: 'review-and-reconcile-preserving-adopter-content';
+    requiredAction: 'declare-existing-custom-metric-series-before-promotion' | 'review-and-reconcile-preserving-adopter-content';
     targetFrameworkSha256: string;
 }
 interface JsonOwnershipChanges {

package/src/generators/upgrade/upgrade.js

@@ -11,7 +11,9 @@ exports.upgradeGenerator = upgradeGenerator;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 const capacity_migration_js_1 = require("../../repository-policy/capacity-migration.js");
 const dependency_overrides_js_1 = require("../preset/dependency-overrides.js");
+const observability_js_1 = require("../../foundation/observability.js");
 const workspace_files_adopter_skills_js_1 = require("../preset/workspace-files-adopter-skills.js");
+const observability_policy_js_1 = require("../observability-policy.js");
 const sql_seeded_reconciliation_js_1 = require("./sql-seeded-reconciliation.js");
 const devkit_1 = require("@nx/devkit");
 const node_buffer_1 = require("node:buffer");
@@ -25,7 +27,8 @@ const index_js_2 = require("../../api-contract/index.js");
 const index_js_3 = require("../../foundation/index.js");
 const capability_plan_js_1 = require("../../foundation/capability-plan.js");
 const persistence_contract_js_1 = require("../slice/persistence-contract.js");
-const index_js_4 = require("../../ownership/index.js");
+const index_js_4 = require("../../repository-policy/index.js");
+const index_js_5 = require("../../ownership/index.js");
 const function_js_1 = require("../function/function.js");
 const logging_registry_js_1 = require("../logging-registry.js");
 const feature_registry_js_1 = require("../feature-registry.js");
@@ -380,6 +383,15 @@ const SEEDED_RECONCILIATION = {
             'journey-authority',
         ],
     },
+    'reliability/metric-declarations.ts': {
+        category: 'reliability-metrics',
+        guidance: 'Review existing custom recordReliabilityOperation calls and declare each finite deployment-owned component/feature/operation tuple in reliability/metric-declarations.ts. Undeclared custom series are dropped by the managed recorder. Never derive declarations from request, user, resource, or correlation IDs. Preserve existing declarations, verify custom metric emission, retain evidence, and resolve the seeded reconciliation marker before protected promotion.',
+        implications: [
+            'custom-metric-series-allowlist',
+            'finite-deployment-owned-dimensions',
+            'undeclared-custom-series-are-dropped',
+        ],
+    },
     'secrets/declarations.ts': {
         category: 'secret-contract',
         implications: [
@@ -667,7 +679,7 @@ function preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, target
         entry?.mode === 'managed' &&
         entry.origin === 'blueprint' &&
         entry.managedJsonPointers === undefined &&
-        (0, index_js_4.hashOwnedContent)(current, entry) === entry.sha256);
+        (0, index_js_5.hashOwnedContent)(current, entry) === entry.sha256);
     if (!completeCleanPair)
         return targetFiles;
     const retained = { ...targetFiles };
@@ -821,16 +833,17 @@ function ownershipValidationMessage(label, issues) {
 }
 function requireUpgradePrerequisites(tree, target) {
     const installedVersion = (0, generator_js_1.frameworkPackageVersion)();
-    const workspaceResult = (0, index_js_4.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
+    const workspaceResult = (0, index_js_5.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
     if (!workspaceResult.valid) {
         throw new Error(ownershipValidationMessage('Workspace ownership metadata', workspaceResult.issues));
     }
     if (workspaceResult.value.frameworkVersion !== installedVersion) {
         throw new Error(`Workspace tooling is recorded at ${workspaceResult.value.frameworkVersion}, but the installed @empire-builder-kit/nx version is ${installedVersion}. Report and apply the workspace upgrade before upgrading the ${target === 'foundation' ? 'Standard Foundation' : 'Product Slice'}.`);
     }
+    (0, observability_policy_js_1.requireObservabilityPolicyFromTree)(tree);
     if (target === 'foundation')
         return;
-    const foundationResult = (0, index_js_4.validateFoundationOwnershipRecord)(readJson(tree, 'packages/foundation/.ebk/ownership.json', 'Standard Foundation ownership metadata'));
+    const foundationResult = (0, index_js_5.validateFoundationOwnershipRecord)(readJson(tree, 'packages/foundation/.ebk/ownership.json', 'Standard Foundation ownership metadata'));
     if (!foundationResult.valid) {
         throw new Error(ownershipValidationMessage('Standard Foundation ownership metadata', foundationResult.issues));
     }
@@ -959,21 +972,29 @@ function createUpgradeReport(currentFiles, currentOwnership, targetFiles, target
                 path.startsWith('database/migrations/')) {
                 report.incompatibleSeededMigrations.push(path);
             }
-            else if (current !== null &&
-                currentEntry?.sha256 !== targetSha256 &&
+            else if (((current !== null && currentEntry?.sha256 !== targetSha256) ||
+                (current === null &&
+                    path === 'reliability/metric-declarations.ts')) &&
                 seededReconciliationDefinition(path) !== null) {
                 const reconciliation = seededReconciliationDefinition(path);
                 if (reconciliation === null) {
                     throw new Error(`Missing seeded reconciliation definition for ${path}.`);
                 }
                 report.seededReconciliation.push({
-                    adopterContentSha256: (0, index_js_4.hashOwnedContent)(current, currentEntry ?? targetEntry),
+                    adopterContentSha256: current === null
+                        ? null
+                        : (0, index_js_5.hashOwnedContent)(current, currentEntry ?? targetEntry),
                     category: reconciliation.category,
                     currentFrameworkSha256: currentEntry?.sha256 ?? null,
+                    ...('guidance' in reconciliation
+                        ? { guidance: reconciliation.guidance }
+                        : {}),
                     implications: [...reconciliation.implications],
                     markerReference: SEEDED_RECONCILIATION_MARKER_REFERENCE,
                     path,
-                    requiredAction: 'review-and-reconcile-preserving-adopter-content',
+                    requiredAction: current === null
+                        ? 'declare-existing-custom-metric-series-before-promotion'
+                        : 'review-and-reconcile-preserving-adopter-content',
                     targetFrameworkSha256: targetSha256,
                 });
             }
@@ -982,7 +1003,7 @@ function createUpgradeReport(currentFiles, currentOwnership, targetFiles, target
             report.missing.push(path);
         }
         else if (currentEntry !== undefined &&
-            (0, index_js_4.hashOwnedContent)(current, currentEntry) !== currentEntry.sha256) {
+            (0, index_js_5.hashOwnedContent)(current, currentEntry) !== currentEntry.sha256) {
             report.conflicting.push(path);
         }
         else if (current === target) {
@@ -1005,7 +1026,7 @@ function createUpgradeReport(currentFiles, currentOwnership, targetFiles, target
         const current = currentFiles.get(path) ?? null;
         if (current === null)
             continue;
-        if ((0, index_js_4.hashOwnedContent)(current, entry) === sha256) {
+        if ((0, index_js_5.hashOwnedContent)(current, entry) === sha256) {
             report.obsolete.push(path);
         }
         else if (!report.conflicting.includes(path)) {
@@ -1060,7 +1081,7 @@ function mergeStructuredTargetFiles(currentFiles, currentOwnership, targetFiles,
         if (!targetEntry.managedJsonPointers)
             continue;
         if (currentEntry?.managedJsonPointers) {
-            const transition = (0, index_js_4.analyzeManagedJsonPointerTransition)(current, target, currentEntry.managedJsonPointers, targetEntry.managedJsonPointers);
+            const transition = (0, index_js_5.analyzeManagedJsonPointerTransition)(current, target, currentEntry.managedJsonPointers, targetEntry.managedJsonPointers);
             changes.claimedJsonMembers.push(...transition.claimed.map((pointer) => `${targetEntry.path}#${pointer}`));
             changes.conflictingJsonMembers.push(...transition.conflictingClaims.map((pointer) => `${targetEntry.path}#${pointer}`));
             changes.releasedJsonMembers.push(...transition.released.map((pointer) => `${targetEntry.path}#${pointer}`));
@@ -1069,7 +1090,7 @@ function mergeStructuredTargetFiles(currentFiles, currentOwnership, targetFiles,
                 continue;
             }
         }
-        files.set(targetEntry.path, (0, index_js_4.mergeManagedJsonContents)(current, target, targetEntry.managedJsonPointers));
+        files.set(targetEntry.path, (0, index_js_5.mergeManagedJsonContents)(current, target, targetEntry.managedJsonPointers));
     }
     return { files, ...changes };
 }
@@ -1107,7 +1128,7 @@ function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serv
                 mode: entry.mode ?? 'managed',
                 origin: 'composition',
                 path: entry.path,
-                sha256: (0, index_js_4.hashOwnedContent)(contents, entry),
+                sha256: (0, index_js_5.hashOwnedContent)(contents, entry),
             });
         }
     };
@@ -1251,7 +1272,7 @@ async function upgradeFoundation(tree, options, packageJson, output, foundationR
         throw new Error('Standard Foundation upgrades do not accept Blueprint or input options.');
     }
     const root = 'packages/foundation';
-    const ownershipResult = (0, index_js_4.validateFoundationOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation ownership metadata'));
+    const ownershipResult = (0, index_js_5.validateFoundationOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation ownership metadata'));
     if (!ownershipResult.valid) {
         throw new Error(ownershipValidationMessage('Standard Foundation ownership metadata', ownershipResult.issues));
     }
@@ -1271,7 +1292,7 @@ async function upgradeFoundation(tree, options, packageJson, output, foundationR
         ...renderedTarget,
         files: await formatRenderedFiles(tree, renderedTarget.files, root),
     };
-    const targetValidation = (0, index_js_4.validateFoundationOwnershipRecord)(target.ownership);
+    const targetValidation = (0, index_js_5.validateFoundationOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
         throw new Error(`Target Standard Foundation ownership metadata is invalid:\n${targetValidation.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -1312,7 +1333,7 @@ async function upgradeFoundation(tree, options, packageJson, output, foundationR
         }
         tree.write(node_path_1.posix.join(root, path), contents);
     }
-    (0, index_js_4.restampFoundationOwnership)(tree);
+    (0, index_js_5.restampFoundationOwnership)(tree);
     // Ownership bytes are part of the upgrade result, including agent previews
     // that skip workspace formatting. Canonicalize before binding those bytes.
     await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation');
@@ -1339,7 +1360,7 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
     if (options.blueprint !== undefined || options.inputs !== undefined) {
         throw new Error('Workspace upgrades do not accept Blueprint or input options.');
     }
-    const ownershipResult = (0, index_js_4.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
+    const ownershipResult = (0, index_js_5.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
     if (!ownershipResult.valid) {
         throw new Error(ownershipValidationMessage('Workspace ownership metadata', ownershipResult.issues));
     }
@@ -1354,6 +1375,9 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         dependencyOverrides: tree.exists(dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH)
             ? readJson(tree, dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH, 'Dependency overrides')
             : undefined,
+        observabilityPolicy: tree.exists(observability_js_1.OBSERVABILITY_POLICY_PATH)
+            ? readJson(tree, observability_js_1.OBSERVABILITY_POLICY_PATH, 'Observability policy')
+            : (0, observability_js_1.defaultObservabilityPolicy)((0, index_js_4.activeDeploymentStages)(deployment.deploymentProfile ?? 'starter'), { preserveLegacy: true }),
         frameworkVersion: (0, generator_js_1.frameworkPackageVersion)(),
         name: packageJson.name,
     });
@@ -1361,7 +1385,7 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         ...renderedTarget,
         files: await formatRenderedFiles(tree, renderedTarget.files),
     };
-    const targetValidation = (0, index_js_4.validateWorkspaceOwnershipRecord)(target.ownership);
+    const targetValidation = (0, index_js_5.validateWorkspaceOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
         throw new Error('Target workspace ownership metadata is invalid.');
     }
@@ -1417,7 +1441,7 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
     if (developerAgentInstructionAppend !== null) {
         tree.write(developerAgentInstructionAppend.path, developerAgentInstructionAppend.contents);
     }
-    (0, index_js_4.restampWorkspaceOwnership)(tree);
+    (0, index_js_5.restampWorkspaceOwnership)(tree);
     await formatOwnershipRecord(tree, '.ebk/ownership.json', 'Workspace');
 }
 async function executeUpgradeGenerator(tree, options, output = devkit_1.logger, executionOptions = {}) {
@@ -1445,7 +1469,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             if (recorded?.blueprint
                 ?.name !== index_js_1.BUILTIN_BLUEPRINT_NAME)
                 continue;
-            const parsed = (0, index_js_4.validateGeneratedOwnershipRecord)(recorded);
+            const parsed = (0, index_js_5.validateGeneratedOwnershipRecord)(recorded);
             if (!parsed.valid)
                 throw new Error(ownershipValidationMessage('Product Slice ownership metadata', parsed.issues));
             (0, persistence_contract_js_1.standardPersistenceContract)({
@@ -1462,7 +1486,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     }
     requireUpgradePrerequisites(tree, 'product-slice');
     const root = node_path_1.posix.join('packages', name);
-    const ownershipResult = (0, index_js_4.validateGeneratedOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice ownership metadata'));
+    const ownershipResult = (0, index_js_5.validateGeneratedOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice ownership metadata'));
     if (!ownershipResult.valid) {
         throw new Error(ownershipValidationMessage('Product Slice ownership metadata', ownershipResult.issues));
     }
@@ -1609,7 +1633,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             mode,
             origin: 'blueprint',
             path,
-            sha256: (0, index_js_4.hashOwnedContent)(contents, { managedJsonPointers }),
+            sha256: (0, index_js_5.hashOwnedContent)(contents, { managedJsonPointers }),
         }));
         paths.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path));
         targetOwnership = {
@@ -1623,7 +1647,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             inputs: inputResult.value,
             paths,
             projects: generated.projects,
-            schemaVersion: index_js_4.GENERATED_OWNERSHIP_SCHEMA_VERSION,
+            schemaVersion: index_js_5.GENERATED_OWNERSHIP_SCHEMA_VERSION,
             slice: name,
             verification: blueprint.manifest.verification,
         };
@@ -1677,7 +1701,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             if (contents === undefined) {
                 throw new Error(`Target Blueprint did not render ${entry.path}.`);
             }
-            return { ...entry, sha256: (0, index_js_4.hashOwnedContent)(contents, entry) };
+            return { ...entry, sha256: (0, index_js_5.hashOwnedContent)(contents, entry) };
         }),
         projects: [
             ...new Set([...targetOwnership.projects, ...currentOwnership.projects]),
@@ -1687,7 +1711,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         ...targetFiles,
         '.ebk/ownership.json': json(targetOwnership),
     };
-    const targetValidation = (0, index_js_4.validateGeneratedOwnershipRecord)(targetOwnership);
+    const targetValidation = (0, index_js_5.validateGeneratedOwnershipRecord)(targetOwnership);
     if (!targetValidation.valid) {
         throw new Error(`Target ownership metadata is invalid:\n${targetValidation.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -1774,7 +1798,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, path);
         }
     }
-    (0, index_js_4.restampProductSliceOwnership)(tree, name, { preserveSeeded: true });
+    (0, index_js_5.restampProductSliceOwnership)(tree, name, { preserveSeeded: true });
     await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice');
     return options.skipInstall
         ? undefined

package/src/generators/workload/frozen-container.d.ts

@@ -1,4 +1,4 @@
-export declare const WORKLOAD_CONTAINER_NODE_IMAGE: "node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402";
+export declare const WORKLOAD_CONTAINER_NODE_IMAGE: "node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914";
 export declare const WORKLOAD_CONTAINER_PNPM_VERSION: "11.20.0";
 export declare const WORKLOAD_CONTAINER_PNPM_DESCRIPTOR: "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 export declare const WORKLOAD_CONTAINER_PNPM_STORE = "/workspace/.ebk/cache/pnpm-store";

package/src/generators/workload/service-performance-files.js

@@ -1654,9 +1654,21 @@ describe('${input.workload} protected Service performance runtime', () => {
     );
     try {
       if (!server.listening) await once(server, 'listening');
+      // start() keeps the production dual-stack wildcard bind. A wildcard
+      // port can coincide with a foreign 127.0.0.1 listener that the loopback
+      // probe would reach instead, so rebind this test server on 127.0.0.1.
+      await new Promise<void>((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      );
+      server.listen({ host: '127.0.0.1', port: 0 });
+      await once(server, 'listening');
       const address = server.address();
-      if (!address || typeof address === 'string') {
-        throw new Error('Generated Service did not bind a TCP port.');
+      if (
+        !address ||
+        typeof address === 'string' ||
+        address.address !== '127.0.0.1'
+      ) {
+        throw new Error('Generated Service did not bind a loopback TCP port.');
       }
       process.env.PORT = String(address.port);
       await expect(
@@ -1699,9 +1711,14 @@ describe('${input.workload} protected Service performance runtime', () => {
         saturation: { percent: 25 },
       });
     } finally {
-      await new Promise<void>((resolve, reject) =>
-        server.close((error) => (error ? reject(error) : resolve())),
-      );
+      // A failed rebind (for example EADDRNOTAVAIL on a host without IPv4
+      // loopback) leaves the server closed; closing it again would reject with
+      // ERR_SERVER_NOT_RUNNING and hide the original error.
+      if (server.listening) {
+        await new Promise<void>((resolve, reject) =>
+          server.close((error) => (error ? reject(error) : resolve())),
+        );
+      }
       if (previousPort === undefined) delete process.env.PORT;
       else process.env.PORT = previousPort;
       if (previousIngressProof === undefined) {

package/src/generators/workload/workload.js

@@ -4,6 +4,8 @@ exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = exports.WORKLOAD_PACKAG
 exports.createWorkloadFilePlan = createWorkloadFilePlan;
 exports.workloadGenerator = workloadGenerator;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
+const observability_infrastructure_js_1 = require("../observability-infrastructure.js");
+const observability_policy_js_1 = require("../observability-policy.js");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../ownership/index.js");
 const capability_plan_js_1 = require("../../foundation/capability-plan.js");
@@ -539,7 +541,8 @@ ${kind !== 'service' || ownsProtectedLoadAdapter
   }
   const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(`);
     }
-    files[infrastructurePath] = infrastructureSource;
+    files[infrastructurePath] =
+        (0, observability_infrastructure_js_1.renderExtensionObservability)(infrastructureSource);
     files[`${relativeRoot}/RUNBOOK.md`] = `# ${workload} ${kind} recovery
 
 Confirm the exact Slice, stage, release, configuration, alarm, and workload
@@ -1038,6 +1041,7 @@ async function executeWorkloadGenerator(tree, options, kind) {
     const slice = name(options.slice, 'Product Slice name');
     const workload = name(options.name, kind === 'service' ? 'Service name' : 'Job name');
     const requestedFeature = name(options.feature, 'Feature');
+    (0, observability_policy_js_1.requireObservabilityPolicyFromTree)(tree);
     const plural = kind === 'service' ? 'services' : 'jobs';
     const sliceRoot = node_path_1.posix.join('packages', slice);
     const root = node_path_1.posix.join(sliceRoot, plural, workload);

package/src/local-dev/dev-command-core.d.ts

@@ -1,4 +1,5 @@
 import { inspectDevelopmentEnvironment } from './environment-inspector.js';
+import type { FleetOperationProgress, FleetOperationWaitOptions } from './fleet-client.js';
 import type { FleetOperationStateRecord, FleetStateRecord } from './fleet-state.js';
 import { type FleetLaunchInput } from './fleet-launcher.js';
 import type { LocalDevContext } from './local-context.js';
@@ -22,9 +23,8 @@ export interface FleetUpCoreClient {
         operationId: string;
         state: 'accepted';
     }>;
-    waitForOperation(operationId: string, options?: {
-        timeoutMs?: number;
-    }): Promise<FleetOperationStateRecord>;
+    /** Resolves on the terminal record, `succeeded` or `failed`. */
+    waitForOperationOutcome(operationId: string, options?: FleetOperationWaitOptions): Promise<FleetOperationStateRecord>;
 }
 export interface FleetUpCoreLaunchResult {
     attached: boolean;
@@ -48,7 +48,28 @@ export interface FleetUpCoreEffects {
     inspectEnvironment?: typeof inspectDevelopmentEnvironment;
     launchFleet?: (input: FleetLaunchInput) => Promise<FleetUpCoreLaunchResult>;
     reportCleanupFailure?: (message: string) => void;
+    /** One human progress line while an operation is observed (stderr). */
+    reportProgress?: (line: string) => void;
 }
+/** Aspirational duration targets per Fleet command, taken from the measured
+ * two-Slice figures in docs/local-development.md (fresh up 334-442 s, down
+ * 242-345 s, restart about 70-85 s). Exceeding one prints a "slower than
+ * target" line; it never fails or stops observing an operation. */
+export declare const FLEET_OPERATION_TARGET_MS: Readonly<{
+    down: 350000;
+    restart: 90000;
+    up: 450000;
+}>;
+/** Progress lines for a watched Fleet operation; the first report past the
+ * command's target says so once, and observation continues. */
+export declare function fleetOperationProgressReporter(command: keyof typeof FLEET_OPERATION_TARGET_MS, report: (line: string) => void): (progress: FleetOperationProgress) => void;
+/** Human cause for a terminal failed operation record. */
+export declare function fleetOperationFailureDetail(operation: FleetOperationStateRecord): string;
+/** Owned-cleanup settlement attached to an error from a foreground `up` whose
+ * in-process supervisor can outlive the failure. Callers report the error
+ * first, then keep interrupt handling installed until this settles, exactly as
+ * they do with `afterWrite` after a successful foreground `up`. */
+export declare function foregroundUpSettlement(error: unknown): Promise<void> | undefined;
 export declare function executeFleetUpCore(command: FleetUpCoreCommand, input: {
     appData: string;
     context: LocalDevContext;