@empire-builder-kit/nx 1.0.0-rc.44 → 1.0.0-rc.45

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -541,6 +541,9 @@ writeFileSync(
 function renderThinDeployWorkflow(options) {
     const { actionPins, deploymentProfile, name, toolVersions } = options;
     const trunkPromotion = options.productionApprovalMode === 'trunk-promotion';
+    // The starter protected pair deploys development from protected develop;
+    // in the trunk lane develop is unprotected and owns no stage.
+    const developmentFromProtectedDevelop = deploymentProfile === 'starter' && options.deliveryLane !== 'trunk';
     return `name: Deploy
 run-name: Deploy \${{ inputs.source_commit || github.sha }}
 
@@ -707,14 +710,17 @@ jobs:
           plan_action="$action"
           [ "$action" != rehearse ] || plan_action=deploy
           case "$EBK_SOURCE_BRANCH" in
-            main) stage=production ;;
+            main) stage=production ;;${options.deliveryLane === 'trunk'
+        ? `
+            develop) echo 'Trunk lane protected lifecycle runs from main'; exit 1 ;;`
+        : `
             develop)
               if [ "$EBK_PROFILE" = starter ]; then
                 stage=development
               else
                 stage=staging
               fi
-              ;;
+              ;;`}
             *) echo 'Protected lifecycle must run from develop or main'; exit 1 ;;
           esac
           echo "action=$action" >> "$GITHUB_OUTPUT"
@@ -1665,7 +1671,10 @@ ${indentedScript(restoredCandidateValidationScript(), 10)}
             { echo 'Protected Blueprint authority must be one full Git object ID'; exit 1; }
           test "$(git rev-parse HEAD)" = "$EBK_PROTECTED_BLUEPRINT_COMMIT" ||
             { echo 'Protected Blueprint authority differs from the exact workflow checkout'; exit 1; }
-          case "$EBK_STAGE" in
+          case "$EBK_STAGE" in${developmentFromProtectedDevelop
+        ? `
+            development) protected_branch=develop ;;`
+        : ''}
             staging) protected_branch=develop ;;
             production) protected_branch=main ;;
             *) exit 1 ;;

package/src/generators/preset/workspace-files-thin-docs.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderThinLifecycleDocumentation = renderThinLifecycleDocumentation;
+const workspace_files_agent_development_js_1 = require("./workspace-files-agent-development.js");
 const index_js_1 = require("../../repository-policy/index.js");
 function renderThinLifecycleDocumentation(options) {
     const stages = (0, index_js_1.activeDeploymentStages)(options.deploymentProfile);
@@ -18,19 +19,13 @@ The committed \`${options.deploymentProfile}\` profile activates: ${stageList}.
 
 For ordinary feature work, run affected tests, typecheck, lint, and ownership
 checks. Run \`pnpm verify\` at a milestone, not before each development edit.
-Configure the exact temporary AWS profile and stage deployment role described
+Configure the development profile and the stage deployment role described
 in \`docs/stage-deployment-authority.md\` before deploying development through
-\`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`
-(the root \`deploy-local\` target). The profile is the human's IAM Identity
-Center profile, typically the one saved by \`ebk dev configure\`. When
-\`ebk dev doctor\` reports the session expired or missing, an attended coding
-agent (local or hosted) may run \`aws sso login --profile <profile>\`; the
-human approves the request in the browser, so the session stays the human's
-own identity. In a hosted or headless shell, add \`--use-device-code\` and the
-human approves the printed code from their own browser. Confirm
-\`aws sts get-caller-identity\` reports that identity before continuing.
-Never embed access keys, export, copy, or read credentials from the SSO cache,
-or assume a separate or stronger principal. Do not invoke SST directly.
+\`ebk deploy development --profile=<development-profile> --expectedRoleArn=<role-arn>\`
+(the root \`deploy-local\` target).
+
+${workspace_files_agent_development_js_1.AGENT_DEVELOPMENT_AUTHORITY}
+Do not invoke SST directly.
 
 Slice \`verify\` runs \`test-integration\`, which needs a running Docker engine
 for DynamoDB Local (and PostgreSQL when SQL is declared).
@@ -143,7 +138,7 @@ removal, unlock, discovery, and secret resolution.
 
 ## Native lifecycle
 
-Use \`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`.
+Use \`ebk deploy development --profile=<development-profile> --expectedRoleArn=<role-arn>\`.
 Add Slice names, for example \`ebk deploy development billing\` with the same
 authority options, for focused deployment after Foundation. Other Slices are
 not redeployed; required peers must already exist. Omit Slice names for the
@@ -248,16 +243,9 @@ The resolved ${rehearsalStage} stage is rehearsed with
 Use temporary IAM Identity Center credentials and the stable stage deployment
 role. Development accepts a dirty tree and requires no acknowledgement:
 
-\`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`
+\`ebk deploy development --profile=<development-profile> --expectedRoleArn=<role-arn>\`
 
-For development, when the session is expired or missing, an attended coding
-agent (local or hosted) may run \`aws sso login --profile <profile>\`; the
-human approves the request in the browser, so the session stays the human's
-own identity. In a hosted or headless shell, add \`--use-device-code\` and the
-human approves the printed code from their own browser. Confirm
-\`aws sts get-caller-identity\` reports that identity before continuing.
-Never embed access keys, export, copy, or read credentials from the SSO cache,
-or assume a separate or stronger principal.
+${workspace_files_agent_development_js_1.AGENT_DEVELOPMENT_AUTHORITY}
 
 Local staging, when active, requires a clean commit and an interactive
 \`approve:deploy:staging:<source-commit>\` response. Starter production requires

package/src/generators/preset/workspace-files.d.ts

@@ -11,6 +11,7 @@ export interface WorkspaceFileOptions {
     /** Seeded supply-chain/dependency-overrides.json data. When absent, the
      * workspace is seeded with DEFAULT_DEPENDENCY_OVERRIDES. */
     dependencyOverrides?: unknown;
+    observabilityPolicy?: unknown;
     deploymentAccounts?: ConfiguredDeploymentAccounts;
     deploymentProfile?: DeploymentProfile;
     deploymentRegion?: string | null;

package/src/generators/preset/workspace-files.js

@@ -11,6 +11,7 @@ const dependency_overrides_js_1 = require("./dependency-overrides.js");
 const index_js_1 = require("../../ownership/index.js");
 const index_js_2 = require("../../frontend-security/index.js");
 const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const observability_js_1 = require("../../foundation/observability.js");
 const cost_estimate_js_1 = require("../../foundation/cost-estimate.js");
 const index_js_3 = require("../../git-policy/index.js");
 const index_js_4 = require("../../repository-policy/index.js");
@@ -1059,6 +1060,7 @@ const SUPPLY_CHAIN_WORKSPACE_FILE_PLAN = (0, index_js_6.renderSupplyChainWorkspa
 });
 const WORKSPACE_SEEDED_PATHS = new Set([
     dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH,
+    observability_js_1.OBSERVABILITY_POLICY_PATH,
     ...SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.seeded,
     ...workspace_files_developer_agent_js_1.DEVELOPER_AGENT_WORKSPACE_SEEDED_PATHS,
     '.github/CODEOWNERS',
@@ -1066,6 +1068,7 @@ const WORKSPACE_SEEDED_PATHS = new Set([
     'CLAUDE.md',
     'README.md',
     'docs/architecture.md',
+    'docs/observability.md',
     'docs/git-workflow.md',
     'docs/repository-operating-policy.md',
     'docs/stage-deployment-authority.md',
@@ -7874,6 +7877,72 @@ convention, current only as far as the copy each actor reads.
 `,
         [workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIMS_PATH]: (0, workspace_files_shared_operation_claims_js_1.renderSharedOperationClaims)(name),
         'ebk.repository-policy.json': json(initialRepositoryPolicy),
+        [observability_js_1.OBSERVABILITY_POLICY_PATH]: json(options.observabilityPolicy === undefined
+            ? (0, observability_js_1.defaultObservabilityPolicy)(activeStages, {
+                productionProfile: initialRepositoryPolicy.productionFoundation.profile,
+            })
+            : (0, observability_js_1.parseObservabilityPolicy)(options.observabilityPolicy, activeStages)),
+        'docs/observability.md': `# Observability spending and diagnostics
+
+The seeded ebk.observability.json is the stage-specific policy. New development
+uses cost-optimized, active staging uses balanced, and production gets an explicit
+profile initialized from its capacity choice. Later capacity changes never alter
+that seeded observability choice. Task diagnostics are lean, but explicit retention
+and dormant-log preservation still apply; local hot diagnostics remain complete.
+This policy never pauses work or
+changes database protection, encryption, backups, topology or deployment authority.
+
+Cost-optimized retains 5% of marked neutral request-start/success diagnostics, WARN Lambda
+system logs and no dashboards. Balanced retains 25%, INFO system logs and one
+Foundation dashboard. Standard retains 100%, INFO system logs and Foundation plus
+Slice dashboards. All retain errors, warnings, security, migration/event receipts,
+required counters and core failure/backlog alarms. Custom metrics are not free;
+batching reduces ingestion bytes, not billable metric series.
+
+Mixed application/security log groups retain at least 30 days (90 for new standard
+production). diagnosticRetentionDays is an extension default; no generated log
+group uses it. Shorter diagnostic retention applies only to separately declared
+diagnostic groups, never mixed groups. Insights, enhanced database monitoring and
+tracing have no control in this policy. Retain Standard class for EMF and generated
+receipt queries. WAF enforcement and existing request-log privacy are unchanged.
+
+Upgrades from older workspaces seed explicit prior retention and verbosity; they
+do not silently adopt shorter retention or remove dormant log groups. Review this
+seeded file to opt in deliberately. Profile changes require ordinary deployment;
+generators never change AWS. Workspace upgrade comes before Foundation/Slices.
+When enabling a new canonical stage, declare it here as well as in repository policy.
+
+Stage overrides: profile; routineSuccessSampleRate (0–1); diagnosticRetentionDays;
+protectedRetentionDays (AWS-supported, at least 30); dashboards (none, stage, slice);
+systemLogLevel (WARN, INFO); retainDormantComponentLogs (boolean). Declared optional
+components always keep their logs. Only absent provider/webhook components may
+omit their otherwise unused log groups and findings alarms.
+
+Fractional sampling uses a server-owned ID, not client correlation/request headers.
+Request starts are neutral, never successful. Legacy/standard retain an entry
+breadcrumb even for handlers that never return; cheap profiles may omit routine
+starts, but failures and receipts remain unsampled.
+
+Custom reliability labels belong in each Slice's seeded reliability/metric-declarations.ts.
+Declare finite component/feature/operation values, never user, tenant, request or
+resource identifiers. Keep high-cardinality context in redacted logs. Only reviewed
+routine INFO successes may use routineSuccess; never mark receipts or security events.
+Upgrades flag the new declaration requirement with a reconciliation work marker.
+Undeclared tuples and invalid observations produce bounded reason-only warnings;
+invalid latency never suppresses the valid operation counters.
+
+At low traffic, fixed dashboards, alarms and metric series can dominate the bill.
+Profile savings primarily change dashboard inventory; fresh disabled adapters omit
+two dormant groups and findings alarms. Sampling/batching affect ingestion and
+scanning volume, while retention affects storage only where applied. No live
+saving or free-tier discount is implied by the list-price estimate.
+
+Diagnostics are on demand. Budget CloudWatch API metric retrieval as well as
+alarms, storage, ingestion, scanning and custom series. Narrow queries to the
+exact owned stage/resources/window; account-wide repeated sweeps are not a
+default application behavior. Never reduce a safety check's coverage or cadence
+to hide its cost. Measure actual billing after deployment, not just estimates.
+`,
         'nx.json': json({
             $schema: './node_modules/nx/schemas/nx-schema.json',
             defaultBase: 'develop',
@@ -8222,6 +8291,7 @@ ${foundationPlan.resources.postgres ? '  foundationDatabaseEndpointHost,' : ''}
   foundationSsmPath,
   normalizeRouterWafPolicy,
   reconcileRouterWafBlockingRehearsal,
+  resolveObservabilityPolicy,
   routerWafContractDigest,
   type FoundationSsmKey,
 } from '@empire-builder-kit/nx/foundation';
@@ -8242,6 +8312,7 @@ import routerWafBlockingRehearsal from '../security/router-waf-blocking-rehearsa
 import routerWafLiveEvidence from '../security/router-waf-live-evidence.json';
 import routerWafPolicy from '../security/router-waf.json';
 import repositoryPolicy from '../../../ebk.repository-policy.json';
+import observabilityPolicy from '../../../ebk.observability.json';
 
 function identityDomainPrefix(stage: string, accountId: string): string {
   if (!/^\\d{12}$/.test(accountId)) {
@@ -8277,6 +8348,11 @@ function publishFoundation(values: Partial<Record<FoundationSsmKey, any>>) {
 
 export function foundation() {
   const isProduction = $app.stage === 'production';
+  const observability = resolveObservabilityPolicy({
+    policy: observabilityPolicy,
+    stage: $app.stage,
+    productionProfile: process.env.EBK_PRODUCTION_FOUNDATION_PROFILE,
+  });
 ${foundationPlan.resources.postgres ? "  const isStaging = $app.stage === 'staging';" : ''}
   const rootDomain = process.env.EBK_ROOT_DOMAIN?.trim();
   const productionConfiguration = isProduction
@@ -8753,7 +8829,7 @@ ${foundationPlan.resources.postgres
         { dependsOn: [alertTopicPolicy] },
       )
     : undefined;
-  const dashboard = new aws.cloudwatch.Dashboard('FoundationDashboard', {
+  const dashboard = observability.dashboards === 'none' ? undefined : new aws.cloudwatch.Dashboard('FoundationDashboard', {
     dashboardName: 'ebk-' + $app.stage + '-foundation',
     dashboardBody: databaseInstanceId.apply((identifier: string) => JSON.stringify({
       widgets: [
@@ -8824,12 +8900,18 @@ ${foundationPlan.resources.postgres
       treatMissingData: 'notBreaching',
     },
   );`
-            : `  const dashboard = new aws.cloudwatch.Dashboard('FoundationDashboard', {
+            : `  const dashboard = observability.dashboards === 'none' ? undefined : new aws.cloudwatch.Dashboard('FoundationDashboard', {
     dashboardName: 'ebk-' + $app.stage + '-foundation',
-    dashboardBody: JSON.stringify({ widgets: [{
-      type: 'text', x: 0, y: 0, width: 24, height: 3,
-      properties: { markdown: '# Empire Builder Kit Foundation\\nStage: ' + $app.stage + '\\nPersistence: Slice-scoped DynamoDB; SQL not declared.' },
-    }] }),
+    dashboardBody: router.distributionID.apply((distributionId: string) => JSON.stringify({ widgets: [{
+      type: 'metric', x: 0, y: 0, width: 24, height: 6,
+      properties: {
+        title: 'Router requests and errors', region: 'us-east-1', period: 300,
+        metrics: [
+          ['AWS/CloudFront', 'Requests', 'DistributionId', distributionId, 'Region', 'Global', { stat: 'Sum' }],
+          ['AWS/CloudFront', '5xxErrorRate', 'DistributionId', distributionId, 'Region', 'Global', { stat: 'Average', yAxis: 'right' }],
+        ],
+      },
+    }] })),
   });`}
 
   if (new Set(['development', 'staging', 'production']).has($app.stage)) {
@@ -8879,7 +8961,7 @@ ${foundationPlan.resources.containerCompute ? '    clusterId: cluster.id,' : ''}
     contractVersion: '${foundationPlan.descriptor.contractVersion}',
     costAnomalySubscriptionArn: accountCostAnomalySubscription?.arn,
 ${foundationPlan.resources.postgres ? '    databaseCapacityAlarmName: databaseCapacityAlarm.name,' : ''}
-    dashboardName: dashboard.dashboardName,
+    dashboardName: dashboard?.dashboardName,
 ${foundationPlan.resources.postgres
             ? `    databaseClusterId: database.id,
     databaseEventSubscriptionId: databaseEvents?.id,`

package/src/generators/slice/built-in-plan-alarm-identity.d.ts

@@ -0,0 +1,173 @@
+/**
+ * The one identity table for every alarm a Standard Slice registers.
+ *
+ * The seeded operations/reliability.json (its alarmRegistrations and
+ * deployedAlarmResources) and every managed MetricAlarm description
+ * (infra/reliability.ts, infra/product.ts, infra/key-value-retention.ts) are
+ * rendered from this table. The generated `scripts/verify-reliability.mjs
+ * --deployed` compares the inventory's owner, route and runbook with each
+ * deployed alarm's description, so a value written in two places can drift
+ * into a deployed alarm the verifier rejects (CROSS-SLICE-RETENTION-IDENTITY-003).
+ *
+ * Where the seeded and managed values disagreed, the seeded value is kept:
+ * an upgrade rewrites only the managed emitters, so aligning them with the
+ * seeded inventory repairs every existing adopter without a hand edit.
+ *
+ * For the same reason the runbook of an existing ID, and the owner and route
+ * from sliceAlarmOwnership, are frozen for existing adopters:
+ * built-in-plan-alarm-identity.spec.ts pins them, and changing one needs a
+ * seeded operations/reliability.json migration.
+ */
+declare const SLICE_ALARM_IDENTITIES: {
+    readonly 'alert-delivery-degraded': {
+        readonly businessSymptom: "The primary alert route is failing delivery.";
+        readonly runbook: "alert-delivery";
+    };
+    readonly 'api-fast-burn': {
+        readonly businessSymptom: "Critical API operations are failing.";
+        readonly runbook: "api-recovery";
+    };
+    readonly 'api-slow-burn': {
+        readonly businessSymptom: "Critical API operations have sustained failures.";
+        readonly runbook: "api-recovery";
+    };
+    readonly 'async-target-dlq-depth': {
+        readonly businessSymptom: "An asynchronous target has terminal failures.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'data-export-cleanup-deadline': {
+        readonly businessSymptom: "Confidential-export residue exceeded its deletion deadline.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'data-export-cleanup-failure': {
+        readonly businessSymptom: "The confidential-export cleanup invocation is failing.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'data-export-cleanup-invocation-missing': {
+        readonly businessSymptom: "The scheduled confidential-export cleanup is not running.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'data-protection-findings': {
+        readonly businessSymptom: "A managed log group contains a protected-data finding.";
+        readonly runbook: "log-investigation";
+    };
+    readonly 'database-capacity': {
+        readonly businessSymptom: "Slice data access or durable event delivery is being throttled.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'event-delivery-attempts': {
+        readonly businessSymptom: "A domain-event intent is repeatedly failing delivery.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'event-dlq-depth': {
+        readonly businessSymptom: "Domain-event processing has terminal failures.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'event-intent-rejected': {
+        readonly businessSymptom: "A retained domain-event intent cannot be delivered.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'function-failure': {
+        readonly businessSymptom: "The generated confidential-export cleanup Function has a terminal invocation error.";
+        readonly runbook: "api-recovery";
+    };
+    readonly 'inbox-cleanup-backlog': {
+        readonly businessSymptom: "Terminal asynchronous inbox records are accumulating.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'inbox-cleanup-errors': {
+        readonly businessSymptom: "The asynchronous inbox cleanup job is failing.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'key-value-reconciliation-errors': {
+        readonly businessSymptom: "Durable domain-event recovery is failing.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'key-value-stream-delivery-errors': {
+        readonly businessSymptom: "The key-value stream delivery Function failed an invocation.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'key-value-stream-iterator-age': {
+        readonly businessSymptom: "Prompt domain-event delivery from the key-value stream is falling behind.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'outbox-backlog': {
+        readonly businessSymptom: "Durable domain-event intents remain undelivered.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'outbox-relay-errors': {
+        readonly businessSymptom: "The isolated performance-sink outbox relay is failing.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'performance-load-cleanup-backlog': {
+        readonly businessSymptom: "Expired protected performance-load control records are accumulating.";
+        readonly runbook: "performance-capacity-cost";
+    };
+    readonly 'performance-load-cleanup-deadline': {
+        readonly businessSymptom: "Protected performance-load residue exceeded its cleanup deadline.";
+        readonly runbook: "performance-capacity-cost";
+    };
+    readonly 'provider-dlq-depth': {
+        readonly businessSymptom: "Provider deliveries have terminal failures.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'provider-queue-age': {
+        readonly businessSymptom: "Accepted provider work is missing its deadline.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'retention-job-failure': {
+        readonly businessSymptom: "The built-in retention Job terminated unsuccessfully.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'sql-outbox-attempts': {
+        readonly businessSymptom: "A relational event intent is repeatedly failing delivery.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'sql-outbox-backlog': {
+        readonly businessSymptom: "Relational event intents remain undelivered.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'sql-outbox-relay-errors': {
+        readonly businessSymptom: "Relational event delivery is failing.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'web-latency-fast-burn': {
+        readonly businessSymptom: "Server-rendered routes exceed the latency objective.";
+        readonly runbook: "web-recovery";
+    };
+    readonly 'web-latency-slow-burn': {
+        readonly businessSymptom: "Server-rendered routes have sustained latency degradation.";
+        readonly runbook: "web-recovery";
+    };
+};
+export type SliceAlarmId = keyof typeof SLICE_ALARM_IDENTITIES;
+export interface SliceAlarmIdentity {
+    businessSymptom: string;
+    id: SliceAlarmId;
+    owner: string;
+    route: string;
+    /** The Slice-relative runbook path that the description and inventory name. */
+    runbook: string;
+    /** The alarm registration's reference to the same runbook. */
+    runbookRef: string;
+}
+/** The owner and escalation route every built-in Slice alarm carries. */
+export declare function sliceAlarmOwnership(name: string): {
+    owner: string;
+    route: string;
+};
+export declare function sliceAlarmIdentity(name: string, id: SliceAlarmId): SliceAlarmIdentity;
+/**
+ * The generated description helper's argument for one alarm, as TypeScript
+ * source. Both generated helpers (`alarmDescription` in infra/reliability.ts
+ * and `operationalAlarmDescription` in infra/product.ts) add the owner,
+ * route, schema version and Slice from sliceAlarmOwnership.
+ */
+export declare function renderSliceAlarmDescriptionInput(name: string, id: SliceAlarmId, indent: string): string;
+/**
+ * The complete alarm description object for one alarm, as TypeScript source
+ * for an emitter without a description helper. Keys are in the helpers'
+ * order.
+ */
+export declare function renderSliceAlarmDescriptionObject(name: string, id: SliceAlarmId): string;
+export {};

package/src/generators/slice/built-in-plan-alarm-identity.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sliceAlarmOwnership = sliceAlarmOwnership;
+exports.sliceAlarmIdentity = sliceAlarmIdentity;
+exports.renderSliceAlarmDescriptionInput = renderSliceAlarmDescriptionInput;
+exports.renderSliceAlarmDescriptionObject = renderSliceAlarmDescriptionObject;
+/**
+ * The one identity table for every alarm a Standard Slice registers.
+ *
+ * The seeded operations/reliability.json (its alarmRegistrations and
+ * deployedAlarmResources) and every managed MetricAlarm description
+ * (infra/reliability.ts, infra/product.ts, infra/key-value-retention.ts) are
+ * rendered from this table. The generated `scripts/verify-reliability.mjs
+ * --deployed` compares the inventory's owner, route and runbook with each
+ * deployed alarm's description, so a value written in two places can drift
+ * into a deployed alarm the verifier rejects (CROSS-SLICE-RETENTION-IDENTITY-003).
+ *
+ * Where the seeded and managed values disagreed, the seeded value is kept:
+ * an upgrade rewrites only the managed emitters, so aligning them with the
+ * seeded inventory repairs every existing adopter without a hand edit.
+ *
+ * For the same reason the runbook of an existing ID, and the owner and route
+ * from sliceAlarmOwnership, are frozen for existing adopters:
+ * built-in-plan-alarm-identity.spec.ts pins them, and changing one needs a
+ * seeded operations/reliability.json migration.
+ */
+const SLICE_ALARM_IDENTITIES = {
+    'alert-delivery-degraded': {
+        businessSymptom: 'The primary alert route is failing delivery.',
+        runbook: 'alert-delivery',
+    },
+    'api-fast-burn': {
+        businessSymptom: 'Critical API operations are failing.',
+        runbook: 'api-recovery',
+    },
+    'api-slow-burn': {
+        businessSymptom: 'Critical API operations have sustained failures.',
+        runbook: 'api-recovery',
+    },
+    'async-target-dlq-depth': {
+        businessSymptom: 'An asynchronous target has terminal failures.',
+        runbook: 'async-recovery',
+    },
+    'data-export-cleanup-deadline': {
+        businessSymptom: 'Confidential-export residue exceeded its deletion deadline.',
+        runbook: 'database-recovery',
+    },
+    'data-export-cleanup-failure': {
+        businessSymptom: 'The confidential-export cleanup invocation is failing.',
+        runbook: 'database-recovery',
+    },
+    'data-export-cleanup-invocation-missing': {
+        businessSymptom: 'The scheduled confidential-export cleanup is not running.',
+        runbook: 'database-recovery',
+    },
+    'data-protection-findings': {
+        businessSymptom: 'A managed log group contains a protected-data finding.',
+        runbook: 'log-investigation',
+    },
+    'database-capacity': {
+        businessSymptom: 'Slice data access or durable event delivery is being throttled.',
+        runbook: 'database-recovery',
+    },
+    'event-delivery-attempts': {
+        businessSymptom: 'A domain-event intent is repeatedly failing delivery.',
+        runbook: 'async-recovery',
+    },
+    'event-dlq-depth': {
+        businessSymptom: 'Domain-event processing has terminal failures.',
+        runbook: 'async-recovery',
+    },
+    'event-intent-rejected': {
+        businessSymptom: 'A retained domain-event intent cannot be delivered.',
+        runbook: 'async-recovery',
+    },
+    'function-failure': {
+        businessSymptom: 'The generated confidential-export cleanup Function has a terminal invocation error.',
+        runbook: 'api-recovery',
+    },
+    'inbox-cleanup-backlog': {
+        businessSymptom: 'Terminal asynchronous inbox records are accumulating.',
+        runbook: 'async-recovery',
+    },
+    'inbox-cleanup-errors': {
+        businessSymptom: 'The asynchronous inbox cleanup job is failing.',
+        runbook: 'async-recovery',
+    },
+    'key-value-reconciliation-errors': {
+        businessSymptom: 'Durable domain-event recovery is failing.',
+        runbook: 'async-recovery',
+    },
+    'key-value-stream-delivery-errors': {
+        businessSymptom: 'The key-value stream delivery Function failed an invocation.',
+        runbook: 'async-recovery',
+    },
+    'key-value-stream-iterator-age': {
+        businessSymptom: 'Prompt domain-event delivery from the key-value stream is falling behind.',
+        runbook: 'async-recovery',
+    },
+    'outbox-backlog': {
+        businessSymptom: 'Durable domain-event intents remain undelivered.',
+        runbook: 'async-recovery',
+    },
+    'outbox-relay-errors': {
+        businessSymptom: 'The isolated performance-sink outbox relay is failing.',
+        runbook: 'async-recovery',
+    },
+    'performance-load-cleanup-backlog': {
+        businessSymptom: 'Expired protected performance-load control records are accumulating.',
+        runbook: 'performance-capacity-cost',
+    },
+    'performance-load-cleanup-deadline': {
+        businessSymptom: 'Protected performance-load residue exceeded its cleanup deadline.',
+        runbook: 'performance-capacity-cost',
+    },
+    'provider-dlq-depth': {
+        businessSymptom: 'Provider deliveries have terminal failures.',
+        runbook: 'async-recovery',
+    },
+    'provider-queue-age': {
+        businessSymptom: 'Accepted provider work is missing its deadline.',
+        runbook: 'async-recovery',
+    },
+    // The Step Functions retention workflow is a database-lifecycle job: its
+    // recovery belongs with the other lifecycle alarms in database-recovery.md,
+    // which routes the operator to the Job's own README for the run procedure.
+    'retention-job-failure': {
+        businessSymptom: 'The built-in retention Job terminated unsuccessfully.',
+        runbook: 'database-recovery',
+    },
+    'sql-outbox-attempts': {
+        businessSymptom: 'A relational event intent is repeatedly failing delivery.',
+        runbook: 'async-recovery',
+    },
+    'sql-outbox-backlog': {
+        businessSymptom: 'Relational event intents remain undelivered.',
+        runbook: 'async-recovery',
+    },
+    'sql-outbox-relay-errors': {
+        businessSymptom: 'Relational event delivery is failing.',
+        runbook: 'async-recovery',
+    },
+    'web-latency-fast-burn': {
+        businessSymptom: 'Server-rendered routes exceed the latency objective.',
+        runbook: 'web-recovery',
+    },
+    'web-latency-slow-burn': {
+        businessSymptom: 'Server-rendered routes have sustained latency degradation.',
+        runbook: 'web-recovery',
+    },
+};
+/** The owner and escalation route every built-in Slice alarm carries. */
+function sliceAlarmOwnership(name) {
+    return { owner: `${name}-product`, route: `${name}-on-call` };
+}
+function sliceAlarmIdentity(name, id) {
+    const { businessSymptom, runbook } = SLICE_ALARM_IDENTITIES[id];
+    return {
+        businessSymptom,
+        id,
+        ...sliceAlarmOwnership(name),
+        runbook: `docs/runbooks/${runbook}.md`,
+        runbookRef: `runbook:${runbook}`,
+    };
+}
+/** A TypeScript single-quoted string literal. */
+function typescriptString(value) {
+    if (/[\\'\n\r\u2028\u2029]/u.test(value)) {
+        throw new Error(`Alarm identity text cannot be rendered: ${value}`);
+    }
+    return `'${value}'`;
+}
+/**
+ * The generated description helper's argument for one alarm, as TypeScript
+ * source. Both generated helpers (`alarmDescription` in infra/reliability.ts
+ * and `operationalAlarmDescription` in infra/product.ts) add the owner,
+ * route, schema version and Slice from sliceAlarmOwnership.
+ */
+function renderSliceAlarmDescriptionInput(name, id, indent) {
+    const identity = sliceAlarmIdentity(name, id);
+    const symptom = `${indent}  businessSymptom: ${typescriptString(identity.businessSymptom)},`;
+    return [
+        '{',
+        // Wrap a symptom that would not fit 80 columns, as the template did.
+        symptom.length <= 80
+            ? symptom
+            : `${indent}  businessSymptom:\n${indent}    ${typescriptString(identity.businessSymptom)},`,
+        `${indent}  id: ${typescriptString(identity.id)},`,
+        `${indent}  runbook: ${typescriptString(identity.runbook)},`,
+        `${indent}}`,
+    ].join('\n');
+}
+/**
+ * The complete alarm description object for one alarm, as TypeScript source
+ * for an emitter without a description helper. Keys are in the helpers'
+ * order.
+ */
+function renderSliceAlarmDescriptionObject(name, id) {
+    const identity = sliceAlarmIdentity(name, id);
+    return `{ businessSymptom: ${typescriptString(identity.businessSymptom)}, id: ${typescriptString(identity.id)}, owner: ${typescriptString(identity.owner)}, route: ${typescriptString(identity.route)}, runbook: ${typescriptString(identity.runbook)}, schemaVersion: 1, slice: ${typescriptString(name)} }`;
+}
+//# sourceMappingURL=built-in-plan-alarm-identity.js.map