@empire-builder-kit/nx 1.0.0-rc.44 → 1.0.0-rc.46

package/src/foundation/cost-estimate.js

@@ -2,11 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FOUNDATION_COST_ESTIMATE_END_MARKER = exports.FOUNDATION_COST_ESTIMATE_BEGIN_MARKER = exports.STANDARD_SLICE_COST_INVENTORY = exports.FOUNDATION_COST_INVENTORY = exports.FOUNDATION_LIST_PRICE_SNAPSHOT = void 0;
 exports.foundationCostEstimateLabel = foundationCostEstimateLabel;
+exports.observabilityDashboardInventory = observabilityDashboardInventory;
 exports.nonproductionAuroraScalingLabel = nonproductionAuroraScalingLabel;
 exports.renderFoundationCostEstimate = renderFoundationCostEstimate;
 const index_js_1 = require("../repository-policy/index.js");
 const capability_plan_js_1 = require("./capability-plan.js");
 const router_waf_js_1 = require("./router-waf.js");
+const observability_js_1 = require("./observability.js");
 function price(usd, unit, offer, version, sku, rate, usageType, options = {}) {
     return {
         per: options.per ?? 1,
@@ -91,8 +93,8 @@ exports.FOUNDATION_LIST_PRICE_SNAPSHOT = {
 exports.FOUNDATION_COST_INVENTORY = {
     /** One CloudFront Router Web ACL per stage. */
     wafWebAcls: 1,
-    /** One Foundation CloudWatch dashboard per stage. */
-    dashboards: 1,
+    /** Cost-optimized has no paid dashboard; richer profiles have one stage dashboard. */
+    dashboards: 0,
     /** Declared network: `az: 2`, one Elastic IP and one NAT unit per public subnet. */
     availabilityZones: 2,
     /** SST Vpc Cloud Map private DNS namespace (a Route 53 private hosted zone). */
@@ -122,28 +124,28 @@ exports.FOUNDATION_COST_INVENTORY = {
  */
 exports.STANDARD_SLICE_COST_INVENTORY = {
     sqlFree: {
-        alarms: 54,
-        alarmMetrics: 63,
-        dashboards: 1,
-        dataProtectedLogGroups: 28,
+        alarms: 52,
+        alarmMetrics: 61,
+        dashboards: 0,
+        dataProtectedLogGroups: 26,
         kmsKeys: 1,
         machineClients: 1,
         secrets: 1,
     },
     sqlDeclared: {
-        alarms: 61,
-        alarmMetrics: 70,
-        dashboards: 1,
-        dataProtectedLogGroups: 32,
+        alarms: 59,
+        alarmMetrics: 68,
+        dashboards: 0,
+        dataProtectedLogGroups: 30,
         kmsKeys: 1,
         machineClients: 1,
         secrets: 3,
     },
     personalStage: {
-        alarms: 50,
-        alarmMetrics: 57,
-        dashboards: 1,
-        dataProtectedLogGroups: 25,
+        alarms: 48,
+        alarmMetrics: 55,
+        dashboards: 0,
+        dataProtectedLogGroups: 23,
         kmsKeys: 1,
         machineClients: 1,
         secrets: 1,
@@ -263,11 +265,22 @@ function natMode(stage, profile) {
         ? index_js_1.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS[profile].nat
         : exports.FOUNDATION_COST_INVENTORY.nonproductionNat;
 }
+function observabilityDashboardInventory(stage, observabilityProfile = 'cost-optimized') {
+    const policy = (0, observability_js_1.resolveObservabilityPolicy)({
+        policy: (0, observability_js_1.defaultObservabilityPolicy)(['development', 'staging', 'production'], { productionProfile: observabilityProfile }),
+        stage,
+        productionProfile: observabilityProfile,
+    });
+    return {
+        foundation: policy.dashboards === 'none' ? 0 : 1,
+        slice: policy.dashboards === 'slice' ? 1 : 0,
+    };
+}
 function stageFloors(stage, profile) {
     const inventory = exports.FOUNDATION_COST_INVENTORY;
     const sqlFree = monthly('wafWebAcl', inventory.wafWebAcls) +
         monthly('wafRule', wafRuleCount(stage)) +
-        monthly('cloudWatchDashboard', inventory.dashboards);
+        monthly('cloudWatchDashboard', observabilityDashboardInventory(stage).foundation);
     const nat = natMode(stage, profile);
     const network = sqlFree +
         monthly('route53HostedZone', inventory.privateHostedZones) +
@@ -344,7 +357,7 @@ function renderFoundationCostEstimate(options) {
         [
             'CloudWatch dashboard',
             p('cloudWatchDashboard'),
-            ...perStage(() => cell(monthly('cloudWatchDashboard', inventory.dashboards), inventory.dashboards)),
+            ...perStage((stage) => cell(monthly('cloudWatchDashboard', observabilityDashboardInventory(stage, defaultProfile).foundation), observabilityDashboardInventory(stage, defaultProfile).foundation)),
         ],
         [
             '**SQL-free stage floor**',
@@ -555,14 +568,18 @@ function renderFoundationCostEstimate(options) {
         [
             'CloudWatch Logs ingestion',
             p('cloudWatchLogsIngest'),
-            'TRACE application logging on every function',
+            'JSON application logs; only explicitly marked routine success diagnostics are sampled',
         ],
         [
             'CloudWatch Logs data protection',
             p('cloudWatchLogsDataProtection'),
             'Every byte written to a data-protected log group',
         ],
-        ['CloudWatch Logs storage', p('cloudWatchLogsStorage'), '30-day retention'],
+        [
+            'CloudWatch Logs storage',
+            p('cloudWatchLogsStorage'),
+            'At least 30 days for mixed security/receipt groups; see ebk.observability.json',
+        ],
         [
             'CloudWatch custom metrics',
             p('cloudWatchCustomMetric'),
@@ -636,6 +653,8 @@ function renderFoundationCostEstimate(options) {
         '',
         heading(level + 1, 'Production Aurora capacity profiles'),
         '',
+        'These capacity comparisons keep the independently seeded cost-optimized production observability policy. Selecting more Aurora capacity does not add dashboards or change log retention.',
+        '',
         table([
             'Capacity profile',
             'Aurora range',
@@ -647,7 +666,11 @@ function renderFoundationCostEstimate(options) {
         '',
         heading(level + 1, 'Standard Slice fixed floor per stage'),
         '',
-        'Every deployed stage of every default Standard Slice adds this floor (no async adapters, performance load off).',
+        'Every deployed stage of every default Standard Slice adds this floor (no async adapters, performance load off). This table uses cost-optimized/balanced Slice defaults: no Slice dashboard. Standard adds one per Slice, priced below.',
+        '',
+        `Observability: cost-optimized adds no dashboard; balanced adds one Foundation dashboard; standard adds one Foundation dashboard and one per Slice (${money(monthly('cloudWatchDashboard', 1))} each per month). See ebk.observability.json; upgraded explicit legacy dashboard choices have the standard dashboard count. Core failure/security alarms remain in every profile.`,
+        '',
+        `Fresh defaults omit the two never-created async provider/webhook component log groups while adapters are disabled. Enabling adapters or retaining dormant component logs adds 2 data-protected groups and 2 findings alarms (2 alarm metrics, ${money(monthly('cloudWatchAlarmMetric', 2))} per month). Legacy stage policies retain these groups to preserve possible log history, including personal stages; fresh personal stages omit them unless preservation is configured. Provider recovery queues and their failure alarms remain in every case.`,
         '',
         table(['Item', 'Unit list price', 'SQL-free Slice', 'SQL-declared Slice'], sliceRows, ['left', 'left', 'right', 'right']),
         '',

package/src/foundation/index.d.ts

@@ -2,6 +2,7 @@ export * from './discovery.js';
 export * from './capability-plan.js';
 export * from './local-database-contract.js';
 export * from './logging.js';
+export * from './observability.js';
 export * from './logging-preflight.js';
 export * from './partial-state.js';
 export * from './provision-database-bindings.js';

package/src/foundation/index.js

@@ -6,6 +6,7 @@ tslib_1.__exportStar(require("./discovery.js"), exports);
 tslib_1.__exportStar(require("./capability-plan.js"), exports);
 tslib_1.__exportStar(require("./local-database-contract.js"), exports);
 tslib_1.__exportStar(require("./logging.js"), exports);
+tslib_1.__exportStar(require("./observability.js"), exports);
 tslib_1.__exportStar(require("./logging-preflight.js"), exports);
 tslib_1.__exportStar(require("./partial-state.js"), exports);
 tslib_1.__exportStar(require("./provision-database-bindings.js"), exports);

package/src/foundation/local-private-smoke-access.js

@@ -169,6 +169,12 @@ async function runLocalPrivateSmoke(input, dependencies = {}) {
         }
         throw new Error(`Local private smoke: ${allowed ? 'admission' : 'revocation'} not observed; deployment acceptance prohibited`);
     }
+    // On cancellation this runs after the priority-200 transport cleanup has
+    // deleted the credential files. It relies on the WAF client opened above:
+    // the SDK memoizes resolved credentials per client, and credentials read
+    // from an ini file carry no expiry, so they are never re-read. Do not
+    // construct a new client or credential provider in this cleanup path; an
+    // unrevoked admission otherwise waits for next-run receipt recovery.
     const unregister = (0, federated_credential_transport_js_1.registerGovernedSignalCleanup)(async () => {
         await (0, private_smoke_admission_js_1.cleanupSmokeAdmission)(store, context);
     }, 90);

package/src/foundation/logging.d.ts

@@ -12,6 +12,8 @@ export declare const FORBIDDEN_DEPLOYMENT_LOG_POLICY_ACTIONS: readonly ["logs:De
 export interface ManagedLogGroupInput {
     component: string;
     resource?: string;
+    /** These groups mix diagnostics with security and delivery receipts. */
+    retentionInDays?: number;
     slice: string;
     stage: string;
     workspace: string;
@@ -44,7 +46,7 @@ export interface ManagedLogGroupContract {
     };
     logGroupClass: typeof MANAGED_LOG_GROUP_CLASS;
     name: string;
-    retentionInDays: typeof MANAGED_LOG_GROUP_RETENTION_DAYS;
+    retentionInDays: number;
     tags: Record<string, string>;
 }
 export interface ObservedManagedLogGroup {

package/src/foundation/logging.js

@@ -43,6 +43,13 @@ function requireWorkspace(value) {
 }
 function createManagedLogGroupContract(input) {
     const component = requireSegment(input.component, 'component');
+    const retentionInDays = input.retentionInDays ?? exports.MANAGED_LOG_GROUP_RETENTION_DAYS;
+    if (![
+        30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557,
+        2922, 3288, 3653,
+    ].includes(retentionInDays)) {
+        throw new Error('[foundation/logging] Mixed security/receipt log groups require an AWS-supported retention of at least 30 days.');
+    }
     const slice = requireSegment(input.slice, 'slice');
     const stage = requireSegment(input.stage, 'stage');
     const workspace = requireWorkspace(input.workspace);
@@ -79,7 +86,7 @@ function createManagedLogGroupContract(input) {
         },
         logGroupClass: exports.MANAGED_LOG_GROUP_CLASS,
         name,
-        retentionInDays: exports.MANAGED_LOG_GROUP_RETENTION_DAYS,
+        retentionInDays,
         tags: {
             [exports.MANAGED_LOG_GROUP_TAG_KEYS.component]: component,
             [exports.MANAGED_LOG_GROUP_TAG_KEYS.managed]: 'true',

package/src/foundation/observability.d.ts

@@ -0,0 +1,42 @@
+import { type FoundationStage } from './stages.js';
+export declare const OBSERVABILITY_POLICY_PATH = "ebk.observability.json";
+export declare const OBSERVABILITY_PROFILES: readonly ["cost-optimized", "balanced", "standard"];
+export type ObservabilityProfile = (typeof OBSERVABILITY_PROFILES)[number];
+export type DashboardPolicy = 'none' | 'stage' | 'slice';
+export interface ObservabilityStagePolicy {
+    /** Explicitly seeded; an omitted production value requires a supplied capacity profile. */
+    profile?: ObservabilityProfile;
+    routineSuccessSampleRate?: number;
+    diagnosticRetentionDays?: number;
+    protectedRetentionDays?: number;
+    dashboards?: DashboardPolicy;
+    systemLogLevel?: 'WARN' | 'INFO';
+    /** Preserve groups with possible historical logs when adapters are disabled. */
+    retainDormantComponentLogs?: boolean;
+}
+export interface ObservabilityPolicy {
+    schemaVersion: 1;
+    stages: Partial<Record<FoundationStage, ObservabilityStagePolicy>>;
+}
+export interface ResolvedObservabilityPolicy {
+    profile: ObservabilityProfile;
+    routineSuccessSampleRate: number;
+    diagnosticRetentionDays: number;
+    /** Shared application/security/receipt groups use this floor, not diagnostic retention. */
+    protectedRetentionDays: number;
+    dashboards: DashboardPolicy;
+    systemLogLevel: 'WARN' | 'INFO';
+    retainDormantComponentLogs: boolean;
+}
+export declare function parseObservabilityPolicy(value: unknown, activeStages?: readonly FoundationStage[]): ObservabilityPolicy;
+/** New workspaces opt in; a managed upgrade of an older workspace preserves its choices. */
+export declare function defaultObservabilityPolicy(stages: readonly FoundationStage[], options?: {
+    preserveLegacy?: boolean;
+    productionProfile?: ObservabilityProfile;
+}): ObservabilityPolicy;
+export declare function resolveObservabilityPolicy(input: {
+    policy: unknown;
+    stage: string;
+    productionProfile?: string;
+    local?: boolean;
+}): ResolvedObservabilityPolicy;

package/src/foundation/observability.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OBSERVABILITY_PROFILES = exports.OBSERVABILITY_POLICY_PATH = void 0;
+exports.parseObservabilityPolicy = parseObservabilityPolicy;
+exports.defaultObservabilityPolicy = defaultObservabilityPolicy;
+exports.resolveObservabilityPolicy = resolveObservabilityPolicy;
+const stages_js_1 = require("./stages.js");
+exports.OBSERVABILITY_POLICY_PATH = 'ebk.observability.json';
+exports.OBSERVABILITY_PROFILES = [
+    'cost-optimized',
+    'balanced',
+    'standard',
+];
+const RETENTION_DAYS = new Set([
+    7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557,
+    2922, 3288, 3653,
+]);
+const STAGE_KEYS = new Set(['development', 'staging', 'production']);
+const FIELD_KEYS = new Set([
+    'profile',
+    'routineSuccessSampleRate',
+    'diagnosticRetentionDays',
+    'protectedRetentionDays',
+    'dashboards',
+    'systemLogLevel',
+    'retainDormantComponentLogs',
+]);
+const PROFILE_DEFAULTS = {
+    'cost-optimized': {
+        sampleRate: 0.05,
+        diagnosticDays: 7,
+        productionDiagnosticDays: 30,
+        dashboards: 'none',
+        systemLogLevel: 'WARN',
+    },
+    balanced: {
+        sampleRate: 0.25,
+        diagnosticDays: 14,
+        productionDiagnosticDays: 30,
+        dashboards: 'stage',
+        systemLogLevel: 'INFO',
+    },
+    standard: {
+        sampleRate: 1,
+        diagnosticDays: 30,
+        productionDiagnosticDays: 90,
+        dashboards: 'slice',
+        systemLogLevel: 'INFO',
+    },
+};
+function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`[observability] ${label} must be an object.`);
+    }
+    return value;
+}
+function parseObservabilityPolicy(value, activeStages) {
+    const root = record(value, 'Policy');
+    if (root.schemaVersion !== 1 ||
+        Object.keys(root).some((key) => !['schemaVersion', 'stages'].includes(key))) {
+        throw new Error('[observability] Expected schemaVersion 1 with stages only.');
+    }
+    const stages = record(root.stages, 'stages');
+    if (Object.keys(stages).length === 0)
+        throw new Error('[observability] Declare active stages.');
+    if (activeStages &&
+        (Object.keys(stages).length !== activeStages.length ||
+            activeStages.some((stage) => !Object.prototype.hasOwnProperty.call(stages, stage))))
+        throw new Error('[observability] Declare exactly the active repository stages: ' +
+            activeStages.join(', ') +
+            '. Update seeded ebk.observability.json before generation or upgrade.');
+    for (const [stage, raw] of Object.entries(stages)) {
+        if (!STAGE_KEYS.has(stage))
+            throw new Error(`[observability] Unsupported stage ${stage}.`);
+        const entry = record(raw, stage);
+        if (Object.keys(entry).some((key) => !FIELD_KEYS.has(key)))
+            throw new Error(`[observability] Unknown field in ${stage}.`);
+        if (entry.profile !== undefined &&
+            !exports.OBSERVABILITY_PROFILES.includes(entry.profile))
+            throw new Error(`[observability] Invalid profile for ${stage}.`);
+        const sample = entry.routineSuccessSampleRate;
+        if (sample !== undefined &&
+            (typeof sample !== 'number' ||
+                !Number.isFinite(sample) ||
+                sample < 0 ||
+                sample > 1))
+            throw new Error(`[observability] ${stage} routineSuccessSampleRate must be between 0 and 1.`);
+        for (const key of [
+            'diagnosticRetentionDays',
+            'protectedRetentionDays',
+        ]) {
+            const days = entry[key];
+            if (days !== undefined &&
+                (typeof days !== 'number' ||
+                    !RETENTION_DAYS.has(days) ||
+                    (key === 'protectedRetentionDays' && days < 30)))
+                throw new Error(`[observability] Invalid ${stage} ${key}; protected logs require at least 30 days.`);
+        }
+        if (entry.dashboards !== undefined &&
+            (typeof entry.dashboards !== 'string' ||
+                !['none', 'stage', 'slice'].includes(entry.dashboards)))
+            throw new Error(`[observability] Invalid dashboard policy for ${stage}.`);
+        if (entry.systemLogLevel !== undefined &&
+            (typeof entry.systemLogLevel !== 'string' ||
+                !['WARN', 'INFO'].includes(entry.systemLogLevel)))
+            throw new Error(`[observability] Invalid systemLogLevel for ${stage}.`);
+        if (entry.retainDormantComponentLogs !== undefined &&
+            typeof entry.retainDormantComponentLogs !== 'boolean')
+            throw new Error(`[observability] Invalid retainDormantComponentLogs for ${stage}.`);
+    }
+    return JSON.parse(JSON.stringify(root));
+}
+/** New workspaces opt in; a managed upgrade of an older workspace preserves its choices. */
+function defaultObservabilityPolicy(stages, options = {}) {
+    const value = { schemaVersion: 1, stages: {} };
+    for (const stage of stages) {
+        value.stages[stage] = options.preserveLegacy
+            ? {
+                profile: 'standard',
+                routineSuccessSampleRate: 1,
+                diagnosticRetentionDays: 30,
+                protectedRetentionDays: 30,
+                dashboards: 'slice',
+                systemLogLevel: 'INFO',
+                retainDormantComponentLogs: true,
+            }
+            : stage === 'production'
+                ? { profile: options.productionProfile ?? 'cost-optimized' }
+                : { profile: stage === 'development' ? 'cost-optimized' : 'balanced' };
+    }
+    return parseObservabilityPolicy(value);
+}
+function resolveObservabilityPolicy(input) {
+    const policy = parseObservabilityPolicy(input.policy);
+    const resolved = (0, stages_js_1.resolveFoundationStages)({
+        consumerStage: input.stage,
+        activeFoundationStages: Object.keys(policy.stages),
+    });
+    const entry = policy.stages[resolved.foundationStage];
+    if (!entry)
+        throw new Error('[observability] Resolved Foundation stage has no policy.');
+    const inherited = resolved.foundationStage === 'production'
+        ? input.productionProfile
+        : resolved.foundationStage === 'staging'
+            ? 'balanced'
+            : 'cost-optimized';
+    const profile = resolved.mapped
+        ? 'cost-optimized'
+        : (entry.profile ?? inherited);
+    if (!exports.OBSERVABILITY_PROFILES.includes(profile))
+        throw new Error('[observability] Production observability requires an explicit profile or a valid committed production capacity profile.');
+    const defaults = PROFILE_DEFAULTS[profile];
+    const production = resolved.foundationStage === 'production';
+    // Task stages never acquire paid dashboards or verbose cloud system logs just
+    // because the shared development stage uses a richer profile.
+    // Lean task diagnostics do not authorize shortening explicit retention or
+    // removing groups with historical logs. Those preservation choices survive.
+    const overrides = resolved.mapped
+        ? {
+            diagnosticRetentionDays: entry.diagnosticRetentionDays,
+            protectedRetentionDays: entry.protectedRetentionDays,
+            retainDormantComponentLogs: entry.retainDormantComponentLogs,
+        }
+        : entry;
+    return {
+        profile: profile,
+        routineSuccessSampleRate: input.local
+            ? 1
+            : (overrides.routineSuccessSampleRate ?? defaults.sampleRate),
+        diagnosticRetentionDays: overrides.diagnosticRetentionDays ??
+            (production
+                ? defaults.productionDiagnosticDays
+                : defaults.diagnosticDays),
+        protectedRetentionDays: overrides.protectedRetentionDays ??
+            (production && profile === 'standard' ? 90 : 30),
+        dashboards: overrides.dashboards ?? defaults.dashboards,
+        systemLogLevel: overrides.systemLogLevel ?? defaults.systemLogLevel,
+        retainDormantComponentLogs: overrides.retainDormantComponentLogs ?? false,
+    };
+}
+//# sourceMappingURL=observability.js.map

package/src/foundation/preflight.js

@@ -181,7 +181,7 @@ function formatFoundationPreflightReport(report) {
     report.issues.forEach((issue) => lines.push(`  - ${issue}`));
     if (!report.ok) {
         lines.push(report.foundationStage === 'development'
-            ? '  Establish Foundation through ebk deploy development --profile=<approved-profile> --expectedRoleArn=<approved-development-role>; the governed stage lifecycle deploys Foundation before eligible Slices.'
+            ? '  Establish Foundation through ebk deploy development --profile=<development-profile> --expectedRoleArn=<role-arn>; the governed stage lifecycle deploys Foundation before eligible Slices.'
             : `  Establish Foundation through the governed ${report.foundationStage} stage lifecycle under the repository deployment profile; follow its protected deployment runbook.`);
     }
     return lines.join('\n');

package/src/generators/function/function.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createFunctionFilePlan = createFunctionFilePlan;
 exports.functionGenerator = functionGenerator;
+const observability_infrastructure_js_1 = require("../observability-infrastructure.js");
+const observability_policy_js_1 = require("../observability-policy.js");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../ownership/index.js");
 const feature_registry_js_1 = require("../feature-registry.js");
@@ -50,9 +52,9 @@ function createFunctionFilePlan(workspace, slice, name, feature = name) {
         !infrastructureSource.includes('    ...(role ?? {}),')) {
         throw new Error('Built-in Function infrastructure is missing its native permission integration point.');
     }
-    files[infrastructurePath] = infrastructureSource
+    files[infrastructurePath] = (0, observability_infrastructure_js_1.renderExtensionObservability)(infrastructureSource
         .replace('  role?: { role: string },', '  permissions: any,')
-        .replace('    ...(role ?? {}),', '    permissions,');
+        .replace('    ...(role ?? {}),', '    permissions,'));
     return {
         files,
         paths: [
@@ -78,6 +80,7 @@ async function functionGenerator(tree, options) {
     const workspace = requireName(typeof packageName === 'string' ? packageName : '', 'Workspace name');
     const slice = requireName(options.slice, 'Product Slice name');
     const name = requireName(options.name, 'Function name');
+    (0, observability_policy_js_1.requireObservabilityPolicyFromTree)(tree);
     (0, post_generation_install_js_1.assertPostGenerationInstallWorkspaceAvailable)(tree, `generator:function:${slice}:${name}`);
     const sliceRoot = node_path_1.posix.join('packages', slice);
     const handlerPath = node_path_1.posix.join(sliceRoot, 'api', `${name}.ts`);

package/src/generators/observability-infrastructure.d.ts

@@ -0,0 +1,2 @@
+/** Apply the same policy to separately generated Function/Service/Job compositions. */
+export declare function renderExtensionObservability(source: string): string;

package/src/generators/observability-infrastructure.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderExtensionObservability = renderExtensionObservability;
+/** Apply the same policy to separately generated Function/Service/Job compositions. */
+function renderExtensionObservability(source) {
+    const replace = (from, to) => {
+        if (!source.includes(from))
+            throw new Error('Generated extension is missing its observability integration point.');
+        source = source.split(from).join(to);
+    };
+    replace("import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';", "import { createManagedLogGroupContract, resolveObservabilityPolicy } from '@empire-builder-kit/nx/foundation';\nimport observabilityPolicy from '../../../../ebk.observability.json';");
+    replace('  const contract = createManagedLogGroupContract({', `  const observability = resolveObservabilityPolicy({
+    policy: observabilityPolicy,
+    stage: $app.stage,
+    productionProfile: process.env.EBK_PRODUCTION_FOUNDATION_PROFILE,
+    local: $dev,
+  });
+  const contract = createManagedLogGroupContract({
+    retentionInDays: observability.protectedRetentionDays,`);
+    // These compositions already own their literal environment maps; preserve
+    // all application, container-image and configuration bindings.
+    replace('EBK_STAGE: $app.stage', 'EBK_OBSERVABILITY_SUCCESS_SAMPLE_RATE: String(observability.routineSuccessSampleRate), EBK_STAGE: $app.stage');
+    source = source
+        .split("systemLogLevel: 'INFO'")
+        .join('systemLogLevel: observability.systemLogLevel');
+    source = source
+        .split('      logGroup: {')
+        .join('      logGroup: {\n        retentionInDays: contract.retentionInDays,');
+    return source;
+}
+//# sourceMappingURL=observability-infrastructure.js.map

package/src/generators/observability-policy.d.ts

@@ -0,0 +1,4 @@
+import type { Tree } from '@nx/devkit';
+import { type ObservabilityPolicy } from '../foundation/observability.js';
+/** Leaf generators must not invent or repair the adopter's seeded policy. */
+export declare function requireObservabilityPolicyFromTree(tree: Tree): ObservabilityPolicy;

package/src/generators/observability-policy.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireObservabilityPolicyFromTree = requireObservabilityPolicyFromTree;
+const observability_js_1 = require("../foundation/observability.js");
+const index_js_1 = require("../repository-policy/index.js");
+const tree_policy_js_1 = require("./repository-policy/tree-policy.js");
+/** Leaf generators must not invent or repair the adopter's seeded policy. */
+function requireObservabilityPolicyFromTree(tree) {
+    const source = tree.read(observability_js_1.OBSERVABILITY_POLICY_PATH, 'utf8');
+    if (source === null) {
+        throw new Error(`[observability] ${observability_js_1.OBSERVABILITY_POLICY_PATH} is required before generation or upgrade. Report and apply the workspace upgrade before continuing; leaf generators do not seed this policy.`);
+    }
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new Error(`[observability] ${observability_js_1.OBSERVABILITY_POLICY_PATH} must be valid JSON. Reconcile the seeded policy before generation or upgrade.`);
+    }
+    const repositoryPolicy = (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree);
+    return (0, observability_js_1.parseObservabilityPolicy)(value, (0, index_js_1.activeDeploymentStages)(repositoryPolicy.deploymentProfile));
+}
+//# sourceMappingURL=observability-policy.js.map

package/src/generators/preset/dependency-overrides.d.ts

@@ -4,25 +4,36 @@ export interface DependencyOverrides {
     overrides: Record<string, string>;
 }
 /**
- * Reviewed overrides seeded into a workspace that has no
+ * Reviewed Nx and managed OpenNext overrides seeded into a workspace with no
  * `supply-chain/dependency-overrides.json` yet. Each selector names an exact
- * transitive release that the keyed `nx` version pins and that carries a high
- * advisory; each target is clean and older than the generated minimum release
- * age. The overrides are derived from that one `nx` release, so a spec fails
- * when the framework or generated `nx` pin moves and the list must be
- * reviewed again. An existing seeded file always wins over these defaults.
+ * transitive release with a recorded advisory; each target is clean and older
+ * than the generated minimum release age. Each default is keyed to the pin it
+ * was reviewed against (`nxVersion`, `openNextVersion`), so a spec fails when
+ * that pin moves and the entry must be reviewed again. The OpenNext selector is
+ * limited to the minifier parent. An existing seeded file always wins over
+ * these defaults.
  *
  * A `name@x.y.z` selector is not limited to the `nx` pin. pnpm rewrites every
  * dependency whose declared range includes x.y.z (in practice a caret or tilde
  * range on the same major), so minimatch's `brace-expansion` range `^5.0.5`
  * also resolves 5.0.12. A declared range that excludes x.y.z keeps its own
  * resolution.
+ *
+ * A parent selector matches only that exact parent release. `nx` declares its
+ * dependencies exactly, but `@opennextjs/aws` declares `@node-minify/core` with
+ * a caret, so a later 9.x release that still pins glob 10.3.3 would make the
+ * OpenNext entry match nothing without any framework change. The generated
+ * workspace's protected scan then denies glob 10.3.3, which is the fail-closed
+ * signal to review the entry again.
  */
 export declare const DEFAULT_DEPENDENCY_OVERRIDES: {
     readonly nxVersion: "23.2.1";
+    readonly openNextVersion: "4.1.12";
     readonly overrides: {
+        readonly '@node-minify/core@9.0.2>glob@10.3.3': "10.5.0";
         readonly 'axios@1.18.1': "1.20.0";
         readonly 'brace-expansion@5.0.9': "5.0.12";
+        readonly 'follow-redirects@1.16.0': "1.16.1";
         readonly 'smol-toml@1.6.1': "1.9.0";
     };
 };

package/src/generators/preset/dependency-overrides.js

@@ -7,25 +7,36 @@ const semver_1 = require("semver");
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 exports.DEPENDENCY_OVERRIDES_PATH = 'supply-chain/dependency-overrides.json';
 /**
- * Reviewed overrides seeded into a workspace that has no
+ * Reviewed Nx and managed OpenNext overrides seeded into a workspace with no
  * `supply-chain/dependency-overrides.json` yet. Each selector names an exact
- * transitive release that the keyed `nx` version pins and that carries a high
- * advisory; each target is clean and older than the generated minimum release
- * age. The overrides are derived from that one `nx` release, so a spec fails
- * when the framework or generated `nx` pin moves and the list must be
- * reviewed again. An existing seeded file always wins over these defaults.
+ * transitive release with a recorded advisory; each target is clean and older
+ * than the generated minimum release age. Each default is keyed to the pin it
+ * was reviewed against (`nxVersion`, `openNextVersion`), so a spec fails when
+ * that pin moves and the entry must be reviewed again. The OpenNext selector is
+ * limited to the minifier parent. An existing seeded file always wins over
+ * these defaults.
  *
  * A `name@x.y.z` selector is not limited to the `nx` pin. pnpm rewrites every
  * dependency whose declared range includes x.y.z (in practice a caret or tilde
  * range on the same major), so minimatch's `brace-expansion` range `^5.0.5`
  * also resolves 5.0.12. A declared range that excludes x.y.z keeps its own
  * resolution.
+ *
+ * A parent selector matches only that exact parent release. `nx` declares its
+ * dependencies exactly, but `@opennextjs/aws` declares `@node-minify/core` with
+ * a caret, so a later 9.x release that still pins glob 10.3.3 would make the
+ * OpenNext entry match nothing without any framework change. The generated
+ * workspace's protected scan then denies glob 10.3.3, which is the fail-closed
+ * signal to review the entry again.
  */
 exports.DEFAULT_DEPENDENCY_OVERRIDES = {
     nxVersion: '23.2.1',
+    openNextVersion: '4.1.12',
     overrides: {
+        '@node-minify/core@9.0.2>glob@10.3.3': '10.5.0',
         'axios@1.18.1': '1.20.0',
         'brace-expansion@5.0.9': '5.0.12',
+        'follow-redirects@1.16.0': '1.16.1',
         'smol-toml@1.6.1': '1.9.0',
     },
 };

package/src/generators/preset/tool-versions.d.ts

@@ -5,9 +5,9 @@
  * existing workspace explicitly adopts the exact reviewed descriptor.
  */
 export declare const WORKSPACE_SST_VERSION: "4.17.1";
-export declare const WORKSPACE_NODE_VERSION: "22.23.1";
+export declare const WORKSPACE_NODE_VERSION: "22.23.4";
 export declare const WORKSPACE_PNPM_VERSION: "11.20.0";
-export declare const WORKSPACE_VITEST_VERSION: "4.1.11";
+export declare const WORKSPACE_VITEST_VERSION: "4.1.12";
 export declare const WORKSPACE_PNPM_SHA512: "9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 export declare const WORKSPACE_PNPM_DESCRIPTOR: "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 /**