@empire-builder-kit/nx 1.0.0-rc.44 → 1.0.0-rc.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.44",
+  "version": "1.0.0-rc.46",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -145,7 +145,7 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.44",
+    "@empire-builder-kit/runtime": "1.0.0-rc.46",
     "@aws-sdk/client-cloudfront": "^3.700.0",
     "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
@@ -178,5 +178,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "37e9dfcf2fcd9561ca389019600206d05975598a"
+  "gitHead": "2165c67769556e404a2d0e9d2f5bcdd23413fce8"
 }

package/src/blueprints/external-sandbox.d.ts

@@ -1,5 +1,5 @@
 import { type ChildProcessWithoutNullStreams } from 'node:child_process';
-export declare const EXTERNAL_BLUEPRINT_SANDBOX_IMAGE: "node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402";
+export declare const EXTERNAL_BLUEPRINT_SANDBOX_IMAGE: "node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914";
 export declare const EXTERNAL_BLUEPRINT_CONTAINER_AUTO_REMOVE: "--rm";
 export declare const EXTERNAL_BLUEPRINT_SANDBOX_FLAGS: readonly ["--network=none", "--read-only", "--cap-drop=ALL", "--security-opt=no-new-privileges", "--pids-limit=64", "--memory=256m", "--memory-swap=256m", "--cpus=1", "--ulimit=nofile=256:256", "--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777"];
 export type ExternalBlueprintSource = 'installed' | 'local';

package/src/cli/main.d.ts

@@ -2,7 +2,7 @@
 import { inspectLocalDevelopment } from '../executors/dev-doctor/dev-doctor.js';
 import { applyDevSetup } from '../executors/dev-setup/dev-setup.js';
 import { inspectDevelopmentEnvironment } from '../local-dev/environment-inspector.js';
-import { type FleetOperationSubmission } from '../local-dev/fleet-client.js';
+import { type FleetOperationSubmission, type FleetOperationWaitOptions } from '../local-dev/fleet-client.js';
 import { inventoryFleets, inventorySliceClaims, type FleetInventoryRecord, pruneStaleFleets } from '../local-dev/fleet-inventory.js';
 import { type FleetLaunchInput } from '../local-dev/fleet-launcher.js';
 import { followFleetLogs, searchFleetLogs } from '../local-dev/fleet-logs.js';
@@ -35,10 +35,8 @@ export interface FleetClientPort {
     shutdown(idempotencyKey?: string): Promise<void>;
     status(): Promise<FleetStateRecord>;
     submit(command: 'down' | 'restart' | 'up', selector: DevSliceSelector, idempotencyKey?: string): Promise<FleetOperationSubmission>;
-    waitForOperation(operationId: string, options?: {
-        pollMs?: number;
-        timeoutMs?: number;
-    }): Promise<FleetOperationStateRecord>;
+    /** Resolves on the terminal record, `succeeded` or `failed`. */
+    waitForOperationOutcome(operationId: string, options?: FleetOperationWaitOptions): Promise<FleetOperationStateRecord>;
 }
 export interface CurrentFleetCoordinates {
     fleetId: string;
@@ -128,6 +126,14 @@ export interface EbkCliDependencies {
 }
 export declare function resolveCurrentFleetCoordinates(workspaceRoot: string, appData: string, dependencies: Pick<EbkCliDependencies, 'loadPlan' | 'personalStageResolver'>): Promise<CurrentFleetCoordinates>;
 export declare function resolveRecoveryFleetCoordinates(workspaceRoot: string, appData: string, dependencies: Pick<EbkCliDependencies, 'inventory' | 'loadPlan' | 'personalStageResolver'>, currentPlatform?: NodeJS.Platform): Promise<RecoveryFleetCoordinates>;
+/** Process interrupts become an abort signal for the running command. With
+ * `onRepeatedInterrupt`, interrupts after the first are reported instead of
+ * reaching Node's default handler, which would kill the process. Exported for
+ * tests, which pass their own emitter in place of the process. */
+export declare function processAbortSignal(onRepeatedInterrupt?: () => void, target?: Pick<NodeJS.Process, 'on' | 'once' | 'removeListener'>): {
+    cleanup: () => void;
+    signal: AbortSignal;
+};
 export declare function runAgentCommandCore(command: AgentCliCommand, io?: EbkCliIo, overrides?: Partial<EbkCliDependencies>): Promise<0 | 1 | 2>;
 /**
  * Shared command core consumed by both the `ebk` parser shell and the Nx

package/src/cli/main.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sameWorkspaceRealpath = sameWorkspaceRealpath;
 exports.resolveCurrentFleetCoordinates = resolveCurrentFleetCoordinates;
 exports.resolveRecoveryFleetCoordinates = resolveRecoveryFleetCoordinates;
+exports.processAbortSignal = processAbortSignal;
 exports.runAgentCommandCore = runAgentCommandCore;
 exports.runDevCommandCore = runDevCommandCore;
 exports.runEbkCli = runEbkCli;
@@ -107,8 +108,8 @@ Usage:
   ebk dev configure [<context options>] [--clear-development-router-url] [--json]
   ebk dev setup [--trust] [--portless] [--upgrade] [--remove] [--json]
   ebk dev up <slice...>|--all [--foreground] [--sst-mode=mono|multiplexer]
-  ebk dev attach <task-id> [--json]
              [--no-wait] [--timeout=<duration>] [<context options>] [--json]
+  ebk dev attach <task-id> [--json]
   ebk dev status [--json]
   ebk dev restart <slice...>|--all [--no-wait] [--timeout=<duration>] [--json]
   ebk dev down <slice...>|--all [--no-wait] [--timeout=<duration>] [--json]
@@ -130,6 +131,12 @@ Configure mutation requires at least one context option or
 --clear-development-router-url. The clear option may accompany other
 non-router context changes.
 
+up, restart, and down wait for the supervised operation's outcome and print
+progress to stderr; there is no default deadline. --timeout=<duration> caps only
+a detached wait: the operation continues, so check ebk dev status and ebk dev
+logs. A foreground up hosts its supervisor and watches until the outcome.
+--no-wait returns once the operation is accepted.
+
 Use "ebk dev <command> --help" to return this bounded command reference.
 Fleet stage uses a persisted random task ID per worktree. Use attach explicitly
 to resume a verified inactive task; --stage overrides are not supported.`;
@@ -384,6 +391,18 @@ function failureFromError(namespace, command, error) {
             : (0, agent_runtime_js_1.classifyDeveloperAgentCliError)(error);
         return failure(namespace, command, classified.classification, classified.message);
     }
+    if (error instanceof errors_js_1.FleetObservationError) {
+        // The accepted operation may still be running: name it so a script can
+        // keep following it with ebk dev status.
+        return (0, output_js_1.createCliResult)({
+            command,
+            failureClassification: error.classification,
+            namespace,
+            operationId: error.detail.operationId,
+            outcome: 'failed',
+            payload: { ...error.detail, message: error.message },
+        });
+    }
     const classification = error instanceof errors_js_1.LocalDevContractError
         ? error.classification
         : 'internal-error';
@@ -711,27 +730,49 @@ async function resolveUpContext(command, dispatch) {
     dispatch.dependencies.writeContext(common, resolution.context);
     return { gitCommonDirectory: common, resolution };
 }
-function operationWaitOptions(command) {
-    return command.timeoutMs === undefined
-        ? {}
-        : { timeoutMs: command.timeoutMs };
+/** Observation of a submitted lifecycle operation: no default deadline,
+ * an explicit --timeout cap, interrupt ends observation only, and progress
+ * lines go to stderr so --json stdout stays one envelope. */
+function operationWaitOptions(command, dispatch) {
+    return {
+        onProgress: (0, dev_command_core_js_1.fleetOperationProgressReporter)(command.command, (line) => dispatch.io.stderr(`${line}\n`)),
+        signal: dispatch.signal,
+        ...(command.timeoutMs === undefined
+            ? {}
+            : { timeoutMs: command.timeoutMs }),
+    };
 }
 async function executeUp(command, coordinates, dispatch) {
     const { resolution } = await resolveUpContext(command, dispatch);
-    const executed = await (0, dev_command_core_js_1.executeFleetUpCore)(command, {
-        appData: dispatch.appData,
-        context: resolution.context,
-        frameworkVersion: dispatch.dependencies.frameworkVersion(),
-        identity: coordinates.identity,
-        plan: coordinates.plan,
-        signal: dispatch.signal,
-        workspaceRoot: dispatch.workspaceRoot,
-    }, {
-        idempotencyKey: dispatch.dependencies.idempotencyKey,
-        inspectEnvironment: dispatch.dependencies.inspectEnvironment,
-        launchFleet: dispatch.dependencies.launchFleet,
-        reportCleanupFailure: (message) => dispatch.io.stderr(`[cleanup-incomplete] ${message}\n`),
-    });
+    let executed;
+    try {
+        executed = await (0, dev_command_core_js_1.executeFleetUpCore)(command, {
+            appData: dispatch.appData,
+            context: resolution.context,
+            frameworkVersion: dispatch.dependencies.frameworkVersion(),
+            identity: coordinates.identity,
+            plan: coordinates.plan,
+            signal: dispatch.signal,
+            workspaceRoot: dispatch.workspaceRoot,
+        }, {
+            idempotencyKey: dispatch.dependencies.idempotencyKey,
+            inspectEnvironment: dispatch.dependencies.inspectEnvironment,
+            launchFleet: dispatch.dependencies.launchFleet,
+            reportCleanupFailure: (message) => dispatch.io.stderr(`[cleanup-incomplete] ${message}\n`),
+            reportProgress: (line) => dispatch.io.stderr(`${line}\n`),
+        });
+    }
+    catch (error) {
+        const afterWrite = (0, dev_command_core_js_1.foregroundUpSettlement)(error);
+        if (!afterWrite)
+            throw error;
+        // The foreground supervisor outlives this failure in this process: report
+        // it now and keep interrupt handling until owned cleanup settles.
+        return {
+            afterWrite,
+            result: failureFromError('dev', command.command, error),
+        };
+    }
     return {
         ...(executed.afterWrite ? { afterWrite: executed.afterWrite } : {}),
         result: success(command.command, {
@@ -794,7 +835,7 @@ async function executeRestart(command, coordinates, dispatch) {
             result: success(command.command, { fleetId: coordinates.fleetId, operation: submission }, submission.operationId),
         };
     }
-    const operation = await client.waitForOperation(submission.operationId, operationWaitOptions(command));
+    const operation = await client.waitForOperationOutcome(submission.operationId, operationWaitOptions(command, dispatch));
     const failed = lifecycleOperationFailure(command.command, coordinates.fleetId, operation);
     if (failed)
         return { result: failed };
@@ -841,7 +882,7 @@ async function executeDown(command, coordinates, dispatch) {
             result: success(command.command, { fleetId: coordinates.fleetId, operation: submission }, submission.operationId),
         };
     }
-    const operation = await client.waitForOperation(submission.operationId, operationWaitOptions(command));
+    const operation = await client.waitForOperationOutcome(submission.operationId, operationWaitOptions(command, dispatch));
     const failed = lifecycleOperationFailure(command.command, coordinates.fleetId, operation);
     if (failed)
         return { result: failed };
@@ -867,7 +908,7 @@ function lifecycleOperationFailure(command, fleetId, operation) {
         outcome: 'failed',
         payload: {
             fleetId,
-            message: `Fleet ${command} failed (${classification}).${retained}`,
+            message: `Fleet ${command} failed (${classification}).${retained}${(0, dev_command_core_js_1.fleetOperationFailureDetail)(operation)}`,
             operation,
         },
     });
@@ -1155,15 +1196,31 @@ async function dispatchDevCommand(command, dispatch) {
             return executeTail(command, coordinates, dispatch);
     }
 }
-function processAbortSignal() {
+/** Process interrupts become an abort signal for the running command. With
+ * `onRepeatedInterrupt`, interrupts after the first are reported instead of
+ * reaching Node's default handler, which would kill the process. Exported for
+ * tests, which pass their own emitter in place of the process. */
+function processAbortSignal(onRepeatedInterrupt, target = process) {
     const controller = new AbortController();
-    const abort = () => controller.abort();
-    process.once('SIGINT', abort);
-    process.once('SIGTERM', abort);
+    const repeated = () => onRepeatedInterrupt?.();
+    let guarded = false;
+    const abort = () => {
+        controller.abort();
+        // A foreground Fleet hosts its supervisor in this process. After the
+        // first interrupt starts the owned down, another Ctrl-C must not kill the
+        // process and orphan native work; it only reports what is still running.
+        if (onRepeatedInterrupt && !guarded) {
+            guarded = true;
+            target.on('SIGINT', repeated);
+        }
+    };
+    target.once('SIGINT', abort);
+    target.once('SIGTERM', abort);
     return {
         cleanup: () => {
-            process.removeListener('SIGINT', abort);
-            process.removeListener('SIGTERM', abort);
+            target.removeListener('SIGINT', abort);
+            target.removeListener('SIGTERM', abort);
+            target.removeListener('SIGINT', repeated);
         },
         signal: controller.signal,
     };
@@ -1233,7 +1290,9 @@ async function runDevCommandCore(command, io = {}, overrides = {}) {
         const root = dependencies.resolveWorkspaceRoot(io.cwd ?? process.cwd());
         dependencies.changeDirectory(root);
         if (!io.abortSignal)
-            ownedSignal = processAbortSignal();
+            ownedSignal = processAbortSignal(command.command === 'up' && command.foreground
+                ? () => output.stderr('[ebk dev up] Fleet down is running in this process and exits when owned cleanup settles; another interrupt does not stop it, and killing the process orphans native work. Check ebk dev status from another terminal.\n')
+                : undefined);
         const execution = await dispatchDevCommand(command, {
             appData: dependencies.appData(),
             dependencies,

package/src/container-images.d.ts

@@ -1 +1 @@
-export declare const EBK_NODE_22_ALPINE_IMAGE: "node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402";
+export declare const EBK_NODE_22_ALPINE_IMAGE: "node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914";

package/src/container-images.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EBK_NODE_22_ALPINE_IMAGE = void 0;
-exports.EBK_NODE_22_ALPINE_IMAGE = 'node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402';
+exports.EBK_NODE_22_ALPINE_IMAGE = 'node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914';
 //# sourceMappingURL=container-images.js.map

package/src/developer-agent/generator-planning.js

@@ -11,7 +11,8 @@ exports.rebindDeveloperAgentGeneratorPlan = rebindDeveloperAgentGeneratorPlan;
 const node_util_1 = require("node:util");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
-const index_js_1 = require("../blueprints/index.js");
+const index_js_1 = require("../repository-policy/index.js");
+const index_js_2 = require("../blueprints/index.js");
 const function_js_1 = require("../generators/function/function.js");
 const logging_registry_js_1 = require("../generators/logging-registry.js");
 const built_in_plan_js_1 = require("../generators/slice/built-in-plan.js");
@@ -313,7 +314,7 @@ function slicePlan(context, input, mode, rebindCompleted = false) {
         workspacePathExists(context, node_path_1.posix.join('packages', input.name))) {
         return unavailableGeneratorDestination(`Product Slice ${input.name} collides with an existing packages/${input.name} path.`);
     }
-    const blueprint = (0, index_js_1.resolveBlueprint)({
+    const blueprint = (0, index_js_2.resolveBlueprint)({
         engineVersion: context.workspace.frameworkVersion,
         reference: 'standard',
         workspaceRoot: context.workspace.repositoryRoot,
@@ -420,7 +421,13 @@ function workloadPlan(context, input, mode, rebindCompleted = false) {
     const ownsProtectedLoadAdapter = kind === 'service'
         ? serviceShouldOwnProtectedLoadAdapter(context, input.slice)
         : false;
-    const plan = (0, workload_js_1.createWorkloadFilePlan)(context.workspace.identity, input.slice, input.name, kind, context.workspace.frameworkVersion, input.feature, ownsProtectedLoadAdapter);
+    const plan = (0, workload_js_1.createWorkloadFilePlan)(context.workspace.identity, input.slice, input.name, kind, context.workspace.frameworkVersion, input.feature, ownsProtectedLoadAdapter, ownsProtectedLoadAdapter
+        ? [
+            (0, index_js_1.productionRehearsalStage)((0, index_js_1.readRepositoryOperatingPolicy)(context.workspace.repositoryRoot)
+                .deploymentProfile),
+            'production',
+        ]
+        : []);
     if (!rebindCompleted) {
         requireAvailableProspectiveProjectIds(context, [plan.project], `${kind} ${input.name}`);
     }

package/src/developer-agent/operation-registry.js

@@ -409,7 +409,7 @@ const TARGET_SIGNATURES = [
                 : undefined;
         }
         const kind = plural === 'services' ? 'service' : 'job';
-        return (`docker build -f packages/${slice}/${plural}/${workload}/Dockerfile ` +
+        return ('docker build -f Dockerfile ' +
             `-t ${slice}-${kind}-${workload}:local ../../../..`);
     }, { nonPlannableRationale: exports.DOCKER_BUILD_OWNER_RATIONALE }),
     runScriptSignature('dev', (input) => input.project.root.includes('/services/')

package/src/executors/deployment-plan/deployment-plan.js

@@ -36,7 +36,11 @@ const executor = async (options, context) => {
         if (options.action === 'deploy' || options.action === 'refresh') {
             const markerReport = (0, index_js_2.scanWorkMarkers)(context.root);
             devkit_1.logger.info((0, index_js_2.formatWorkMarkerReport)(markerReport));
-            (0, index_js_2.assertWorkMarkerReport)(markerReport, { protectedPromotion: true });
+            // Like the SST lifecycle, EBK-SECURITY and EBK-BLOCKER block only
+            // staging and production; malformed markers still fail every stage.
+            (0, index_js_2.assertWorkMarkerReport)(markerReport, {
+                protectedPromotion: options.stage !== 'development',
+            });
         }
         const policy = (0, index_js_1.readRepositoryOperatingPolicy)(context.root);
         const plan = (0, index_js_1.createProtectedDeploymentPlan)(policy, {

package/src/executors/deployment-plan/schema.json

@@ -12,7 +12,7 @@
     },
     "stage": {
       "type": "string",
-      "enum": ["staging", "production"]
+      "enum": ["development", "staging", "production"]
     },
     "project": {
       "type": "string",

package/src/executors/fleet/fleet.js

@@ -126,6 +126,7 @@ const executor = async (options, context) => {
             workspaceRoot: context.root,
         }, {
             reportCleanupFailure: (message) => devkit_1.logger.error(message),
+            reportProgress: (line) => devkit_1.logger.info(line),
         });
         devkit_1.logger.info(JSON.stringify({
             attached: result.attached,
@@ -138,6 +139,9 @@ const executor = async (options, context) => {
     }
     catch (error) {
         devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        // A foreground supervisor can outlive the failure in this process; keep
+        // the interrupt handler until its owned cleanup settles.
+        await (0, dev_command_core_js_1.foregroundUpSettlement)(error);
         return { success: false };
     }
     finally {

package/src/executors/fleet/schema.json

@@ -67,7 +67,7 @@
       "default": "mono"
     },
     "timeout": {
-      "description": "Bounded CLI operation timeout such as 30s.",
+      "description": "Optional cap on a detached wait (foreground: false), such as 30m. Without it the executor waits for the outcome; when the cap expires the operation continues. A foreground up watches until the outcome.",
       "type": "string",
       "pattern": "^[1-9][0-9]*(ms|s|m)$"
     }

package/src/executors/github-bootstrap/github-bootstrap.d.ts

@@ -3,6 +3,9 @@ interface GitHubBootstrapExecutorOptions {
     apply?: boolean;
     immutableOidcTrustAcknowledgement?: string;
     npmPrereleaseReviewerIds?: string;
+    npmStable?: boolean;
+    npmStableReviewerIds?: string;
+    npmStablePreventSelfReview?: boolean;
     productionReviewerIds?: string;
     repository?: string;
 }

package/src/executors/github-bootstrap/github-bootstrap.js

@@ -10,6 +10,34 @@ function parseReviewerIds(value) {
 }
 const executor = async (options, context) => {
     try {
+        if (options.npmStable === true) {
+            if (options.npmStableReviewerIds === undefined ||
+                !/^[1-9][0-9]*(,[1-9][0-9]*)*$/.test(options.npmStableReviewerIds) ||
+                typeof options.npmStablePreventSelfReview !== 'boolean') {
+                throw new Error('npm-stable requires explicit reviewer IDs and prevent-self-review choice.');
+            }
+            if (options.npmPrereleaseReviewerIds !== undefined ||
+                options.productionReviewerIds !== undefined ||
+                options.immutableOidcTrustAcknowledgement !== undefined) {
+                throw new Error('npm-stable does not accept adopter bootstrap options.');
+            }
+            const report = await (0, index_js_1.runGitHubBootstrap)({
+                npmStable: true,
+                apply: options.apply === true,
+                repository: options.repository?.trim() ?? '',
+                npmStableReviewerIds: parseReviewerIds(options.npmStableReviewerIds),
+                npmStablePreventSelfReview: options.npmStablePreventSelfReview,
+                token: process.env.GH_TOKEN?.trim() ||
+                    process.env.GITHUB_TOKEN?.trim() ||
+                    '',
+            });
+            devkit_1.logger.info(JSON.stringify(report, null, 2));
+            return { success: options.apply ? report.ready : true };
+        }
+        if (options.npmStableReviewerIds !== undefined ||
+            options.npmStablePreventSelfReview !== undefined) {
+            throw new Error('npm-stable settings require the explicit npmStable selector.');
+        }
         const policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
         const report = await (0, index_js_1.runGitHubBootstrap)({
             apply: options.apply === true,

package/src/executors/github-bootstrap/schema.json

@@ -31,6 +31,20 @@
       "type": "string",
       "pattern": "^[1-9][0-9]*(,[1-9][0-9]*)*$",
       "description": "Optional comma-separated GitHub user IDs when committed Repository Operating Policy selects environment-reviewer mode. Existing reviewers are preserved when omitted."
+    },
+    "npmStable": {
+      "type": "boolean",
+      "default": false,
+      "description": "Configure only the framework npm-stable environment; exact framework repository required."
+    },
+    "npmStableReviewerIds": {
+      "type": "string",
+      "pattern": "^[1-9][0-9]*(,[1-9][0-9]*)*$",
+      "description": "Explicit GitHub user IDs for the framework npm-stable required reviewers."
+    },
+    "npmStablePreventSelfReview": {
+      "type": "boolean",
+      "description": "Explicit prevent-self-review choice for the framework npm-stable environment."
     }
   }
 }

package/src/executors/local-deploy/federated-credential-transport.d.ts

@@ -6,9 +6,10 @@ interface GovernedSignalCleanup {
     readonly priority: number;
     run(signal: GovernedSignal): Promise<void> | void;
 }
-/** Coordinate an exact child shutdown or private-state cleanup before the
- * current process preserves its normal SIGINT/SIGTERM behavior. Higher
- * priorities run first so mutation children stop before credentials vanish. */
+/** Coordinate cancellation of exact owned resources before preserving normal
+ * SIGINT/SIGTERM behavior. Synchronous credential revocation runs before any
+ * awaited child teardown: an ancestor such as Nx can independently force-stop
+ * this process while that teardown is pending. */
 export declare function registerGovernedSignalCleanup(run: GovernedSignalCleanup['run'], priority?: number): () => void;
 export declare function governedSignalCleanupInProgress(): boolean;
 interface FederatedCredentialIdentity {

package/src/executors/local-deploy/federated-credential-transport.js

@@ -59,7 +59,9 @@ async function handleGovernedSignal(signal, handler) {
     let cleanupFailed = false;
     for (const cleanup of [...governedSignalCleanups].sort((left, right) => right.priority - left.priority)) {
         try {
-            await cleanup.run(signal);
+            const pending = cleanup.run(signal);
+            if (pending !== undefined)
+                await pending;
         }
         catch {
             cleanupFailed = true;
@@ -90,9 +92,10 @@ function ensureGovernedSignalHandlers() {
         process.prependListener(signal, handler);
     }
 }
-/** Coordinate an exact child shutdown or private-state cleanup before the
- * current process preserves its normal SIGINT/SIGTERM behavior. Higher
- * priorities run first so mutation children stop before credentials vanish. */
+/** Coordinate cancellation of exact owned resources before preserving normal
+ * SIGINT/SIGTERM behavior. Synchronous credential revocation runs before any
+ * awaited child teardown: an ancestor such as Nx can independently force-stop
+ * this process while that teardown is pending. */
 function registerGovernedSignalCleanup(run, priority = 0) {
     const cleanup = { priority, run };
     governedSignalCleanups.add(cleanup);
@@ -170,7 +173,7 @@ async function createLocalFederatedCredentialTransport(input, dependencies = {})
     unregisterSignalCleanup = registerGovernedSignalCleanup(() => {
         cleanupFiles(true);
         process.removeListener('exit', onExit);
-    });
+    }, 200);
     process.once('exit', onExit);
     const resolve = dependencies.resolve ??
         (input.profile
@@ -186,7 +189,13 @@ async function createLocalFederatedCredentialTransport(input, dependencies = {})
         if (closed || disposed) {
             throw new Error('Local federated credential transport is already closed.');
         }
+        const assertOpen = () => {
+            if (closed || disposed) {
+                throw new Error('Local federated credential transport is already closed.');
+            }
+        };
         const identity = await resolve();
+        assertOpen();
         requireCredentialValue(identity.accessKeyId, 'access key');
         requireCredentialValue(identity.secretAccessKey, 'secret key');
         requireCredentialValue(identity.sessionToken, 'session token');
@@ -198,6 +207,7 @@ async function createLocalFederatedCredentialTransport(input, dependencies = {})
             throw new Error('Local deployment requires temporary federated credentials with at least 30 minutes remaining.');
         }
         const caller = await identify(identity, input.region);
+        assertOpen();
         const callerArn = caller.Arn?.trim() ?? '';
         if (caller.Account?.trim() !== input.account ||
             !(0, identity_js_1.matchesExpectedAssumedRoleArn)(input.account, callerArn, input.expectedRoleArn)) {

package/src/foundation/cost-estimate.d.ts

@@ -1,4 +1,5 @@
-import { type DeploymentProfile } from '../repository-policy/index.js';
+import { type CanonicalDeploymentStage, type DeploymentProfile } from '../repository-policy/index.js';
+import { type ObservabilityProfile } from './observability.js';
 /**
  * Dated AWS list-price snapshot for the generated cost estimate.
  *
@@ -98,8 +99,8 @@ export type ListPriceKey = keyof typeof FOUNDATION_LIST_PRICE_SNAPSHOT.prices;
 export declare const FOUNDATION_COST_INVENTORY: {
     /** One CloudFront Router Web ACL per stage. */
     readonly wafWebAcls: 1;
-    /** One Foundation CloudWatch dashboard per stage. */
-    readonly dashboards: 1;
+    /** Cost-optimized has no paid dashboard; richer profiles have one stage dashboard. */
+    readonly dashboards: 0;
     /** Declared network: `az: 2`, one Elastic IP and one NAT unit per public subnet. */
     readonly availabilityZones: 2;
     /** SST Vpc Cloud Map private DNS namespace (a Route 53 private hosted zone). */
@@ -154,6 +155,10 @@ export declare const FOUNDATION_COST_ESTIMATE_BEGIN_MARKER = "<!-- ebk:foundatio
 export declare const FOUNDATION_COST_ESTIMATE_END_MARKER = "<!-- ebk:foundation-cost-estimate:end -->";
 /** The exact label every rendered estimate carries. */
 export declare function foundationCostEstimateLabel(): string;
+export declare function observabilityDashboardInventory(stage: CanonicalDeploymentStage, observabilityProfile?: ObservabilityProfile): {
+    foundation: number;
+    slice: number;
+};
 /** Nonproduction Aurora scaling as costs.md prose, e.g. "0–4 ACUs, pause after 5 idle minutes". */
 export declare function nonproductionAuroraScalingLabel(stage: 'development' | 'staging'): string;
 export interface FoundationCostEstimateOptions {