@empire-builder-kit/nx 1.0.0-rc.44 → 1.0.0-rc.46

package/src/generators/slice/built-in-plan-alarm-identity.d.ts

@@ -0,0 +1,173 @@
+/**
+ * The one identity table for every alarm a Standard Slice registers.
+ *
+ * The seeded operations/reliability.json (its alarmRegistrations and
+ * deployedAlarmResources) and every managed MetricAlarm description
+ * (infra/reliability.ts, infra/product.ts, infra/key-value-retention.ts) are
+ * rendered from this table. The generated `scripts/verify-reliability.mjs
+ * --deployed` compares the inventory's owner, route and runbook with each
+ * deployed alarm's description, so a value written in two places can drift
+ * into a deployed alarm the verifier rejects (CROSS-SLICE-RETENTION-IDENTITY-003).
+ *
+ * Where the seeded and managed values disagreed, the seeded value is kept:
+ * an upgrade rewrites only the managed emitters, so aligning them with the
+ * seeded inventory repairs every existing adopter without a hand edit.
+ *
+ * For the same reason the runbook of an existing ID, and the owner and route
+ * from sliceAlarmOwnership, are frozen for existing adopters:
+ * built-in-plan-alarm-identity.spec.ts pins them, and changing one needs a
+ * seeded operations/reliability.json migration.
+ */
+declare const SLICE_ALARM_IDENTITIES: {
+    readonly 'alert-delivery-degraded': {
+        readonly businessSymptom: "The primary alert route is failing delivery.";
+        readonly runbook: "alert-delivery";
+    };
+    readonly 'api-fast-burn': {
+        readonly businessSymptom: "Critical API operations are failing.";
+        readonly runbook: "api-recovery";
+    };
+    readonly 'api-slow-burn': {
+        readonly businessSymptom: "Critical API operations have sustained failures.";
+        readonly runbook: "api-recovery";
+    };
+    readonly 'async-target-dlq-depth': {
+        readonly businessSymptom: "An asynchronous target has terminal failures.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'data-export-cleanup-deadline': {
+        readonly businessSymptom: "Confidential-export residue exceeded its deletion deadline.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'data-export-cleanup-failure': {
+        readonly businessSymptom: "The confidential-export cleanup invocation is failing.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'data-export-cleanup-invocation-missing': {
+        readonly businessSymptom: "The scheduled confidential-export cleanup is not running.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'data-protection-findings': {
+        readonly businessSymptom: "A managed log group contains a protected-data finding.";
+        readonly runbook: "log-investigation";
+    };
+    readonly 'database-capacity': {
+        readonly businessSymptom: "Slice data access or durable event delivery is being throttled.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'event-delivery-attempts': {
+        readonly businessSymptom: "A domain-event intent is repeatedly failing delivery.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'event-dlq-depth': {
+        readonly businessSymptom: "Domain-event processing has terminal failures.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'event-intent-rejected': {
+        readonly businessSymptom: "A retained domain-event intent cannot be delivered.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'function-failure': {
+        readonly businessSymptom: "The generated confidential-export cleanup Function has a terminal invocation error.";
+        readonly runbook: "api-recovery";
+    };
+    readonly 'inbox-cleanup-backlog': {
+        readonly businessSymptom: "Terminal asynchronous inbox records are accumulating.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'inbox-cleanup-errors': {
+        readonly businessSymptom: "The asynchronous inbox cleanup job is failing.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'key-value-reconciliation-errors': {
+        readonly businessSymptom: "Durable domain-event recovery is failing.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'key-value-stream-delivery-errors': {
+        readonly businessSymptom: "The key-value stream delivery Function failed an invocation.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'key-value-stream-iterator-age': {
+        readonly businessSymptom: "Prompt domain-event delivery from the key-value stream is falling behind.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'outbox-backlog': {
+        readonly businessSymptom: "Durable domain-event intents remain undelivered.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'outbox-relay-errors': {
+        readonly businessSymptom: "The isolated performance-sink outbox relay is failing.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'performance-load-cleanup-backlog': {
+        readonly businessSymptom: "Expired protected performance-load control records are accumulating.";
+        readonly runbook: "performance-capacity-cost";
+    };
+    readonly 'performance-load-cleanup-deadline': {
+        readonly businessSymptom: "Protected performance-load residue exceeded its cleanup deadline.";
+        readonly runbook: "performance-capacity-cost";
+    };
+    readonly 'provider-dlq-depth': {
+        readonly businessSymptom: "Provider deliveries have terminal failures.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'provider-queue-age': {
+        readonly businessSymptom: "Accepted provider work is missing its deadline.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'retention-job-failure': {
+        readonly businessSymptom: "The built-in retention Job terminated unsuccessfully.";
+        readonly runbook: "database-recovery";
+    };
+    readonly 'sql-outbox-attempts': {
+        readonly businessSymptom: "A relational event intent is repeatedly failing delivery.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'sql-outbox-backlog': {
+        readonly businessSymptom: "Relational event intents remain undelivered.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'sql-outbox-relay-errors': {
+        readonly businessSymptom: "Relational event delivery is failing.";
+        readonly runbook: "async-recovery";
+    };
+    readonly 'web-latency-fast-burn': {
+        readonly businessSymptom: "Server-rendered routes exceed the latency objective.";
+        readonly runbook: "web-recovery";
+    };
+    readonly 'web-latency-slow-burn': {
+        readonly businessSymptom: "Server-rendered routes have sustained latency degradation.";
+        readonly runbook: "web-recovery";
+    };
+};
+export type SliceAlarmId = keyof typeof SLICE_ALARM_IDENTITIES;
+export interface SliceAlarmIdentity {
+    businessSymptom: string;
+    id: SliceAlarmId;
+    owner: string;
+    route: string;
+    /** The Slice-relative runbook path that the description and inventory name. */
+    runbook: string;
+    /** The alarm registration's reference to the same runbook. */
+    runbookRef: string;
+}
+/** The owner and escalation route every built-in Slice alarm carries. */
+export declare function sliceAlarmOwnership(name: string): {
+    owner: string;
+    route: string;
+};
+export declare function sliceAlarmIdentity(name: string, id: SliceAlarmId): SliceAlarmIdentity;
+/**
+ * The generated description helper's argument for one alarm, as TypeScript
+ * source. Both generated helpers (`alarmDescription` in infra/reliability.ts
+ * and `operationalAlarmDescription` in infra/product.ts) add the owner,
+ * route, schema version and Slice from sliceAlarmOwnership.
+ */
+export declare function renderSliceAlarmDescriptionInput(name: string, id: SliceAlarmId, indent: string): string;
+/**
+ * The complete alarm description object for one alarm, as TypeScript source
+ * for an emitter without a description helper. Keys are in the helpers'
+ * order.
+ */
+export declare function renderSliceAlarmDescriptionObject(name: string, id: SliceAlarmId): string;
+export {};

package/src/generators/slice/built-in-plan-alarm-identity.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sliceAlarmOwnership = sliceAlarmOwnership;
+exports.sliceAlarmIdentity = sliceAlarmIdentity;
+exports.renderSliceAlarmDescriptionInput = renderSliceAlarmDescriptionInput;
+exports.renderSliceAlarmDescriptionObject = renderSliceAlarmDescriptionObject;
+/**
+ * The one identity table for every alarm a Standard Slice registers.
+ *
+ * The seeded operations/reliability.json (its alarmRegistrations and
+ * deployedAlarmResources) and every managed MetricAlarm description
+ * (infra/reliability.ts, infra/product.ts, infra/key-value-retention.ts) are
+ * rendered from this table. The generated `scripts/verify-reliability.mjs
+ * --deployed` compares the inventory's owner, route and runbook with each
+ * deployed alarm's description, so a value written in two places can drift
+ * into a deployed alarm the verifier rejects (CROSS-SLICE-RETENTION-IDENTITY-003).
+ *
+ * Where the seeded and managed values disagreed, the seeded value is kept:
+ * an upgrade rewrites only the managed emitters, so aligning them with the
+ * seeded inventory repairs every existing adopter without a hand edit.
+ *
+ * For the same reason the runbook of an existing ID, and the owner and route
+ * from sliceAlarmOwnership, are frozen for existing adopters:
+ * built-in-plan-alarm-identity.spec.ts pins them, and changing one needs a
+ * seeded operations/reliability.json migration.
+ */
+const SLICE_ALARM_IDENTITIES = {
+    'alert-delivery-degraded': {
+        businessSymptom: 'The primary alert route is failing delivery.',
+        runbook: 'alert-delivery',
+    },
+    'api-fast-burn': {
+        businessSymptom: 'Critical API operations are failing.',
+        runbook: 'api-recovery',
+    },
+    'api-slow-burn': {
+        businessSymptom: 'Critical API operations have sustained failures.',
+        runbook: 'api-recovery',
+    },
+    'async-target-dlq-depth': {
+        businessSymptom: 'An asynchronous target has terminal failures.',
+        runbook: 'async-recovery',
+    },
+    'data-export-cleanup-deadline': {
+        businessSymptom: 'Confidential-export residue exceeded its deletion deadline.',
+        runbook: 'database-recovery',
+    },
+    'data-export-cleanup-failure': {
+        businessSymptom: 'The confidential-export cleanup invocation is failing.',
+        runbook: 'database-recovery',
+    },
+    'data-export-cleanup-invocation-missing': {
+        businessSymptom: 'The scheduled confidential-export cleanup is not running.',
+        runbook: 'database-recovery',
+    },
+    'data-protection-findings': {
+        businessSymptom: 'A managed log group contains a protected-data finding.',
+        runbook: 'log-investigation',
+    },
+    'database-capacity': {
+        businessSymptom: 'Slice data access or durable event delivery is being throttled.',
+        runbook: 'database-recovery',
+    },
+    'event-delivery-attempts': {
+        businessSymptom: 'A domain-event intent is repeatedly failing delivery.',
+        runbook: 'async-recovery',
+    },
+    'event-dlq-depth': {
+        businessSymptom: 'Domain-event processing has terminal failures.',
+        runbook: 'async-recovery',
+    },
+    'event-intent-rejected': {
+        businessSymptom: 'A retained domain-event intent cannot be delivered.',
+        runbook: 'async-recovery',
+    },
+    'function-failure': {
+        businessSymptom: 'The generated confidential-export cleanup Function has a terminal invocation error.',
+        runbook: 'api-recovery',
+    },
+    'inbox-cleanup-backlog': {
+        businessSymptom: 'Terminal asynchronous inbox records are accumulating.',
+        runbook: 'async-recovery',
+    },
+    'inbox-cleanup-errors': {
+        businessSymptom: 'The asynchronous inbox cleanup job is failing.',
+        runbook: 'async-recovery',
+    },
+    'key-value-reconciliation-errors': {
+        businessSymptom: 'Durable domain-event recovery is failing.',
+        runbook: 'async-recovery',
+    },
+    'key-value-stream-delivery-errors': {
+        businessSymptom: 'The key-value stream delivery Function failed an invocation.',
+        runbook: 'async-recovery',
+    },
+    'key-value-stream-iterator-age': {
+        businessSymptom: 'Prompt domain-event delivery from the key-value stream is falling behind.',
+        runbook: 'async-recovery',
+    },
+    'outbox-backlog': {
+        businessSymptom: 'Durable domain-event intents remain undelivered.',
+        runbook: 'async-recovery',
+    },
+    'outbox-relay-errors': {
+        businessSymptom: 'The isolated performance-sink outbox relay is failing.',
+        runbook: 'async-recovery',
+    },
+    'performance-load-cleanup-backlog': {
+        businessSymptom: 'Expired protected performance-load control records are accumulating.',
+        runbook: 'performance-capacity-cost',
+    },
+    'performance-load-cleanup-deadline': {
+        businessSymptom: 'Protected performance-load residue exceeded its cleanup deadline.',
+        runbook: 'performance-capacity-cost',
+    },
+    'provider-dlq-depth': {
+        businessSymptom: 'Provider deliveries have terminal failures.',
+        runbook: 'async-recovery',
+    },
+    'provider-queue-age': {
+        businessSymptom: 'Accepted provider work is missing its deadline.',
+        runbook: 'async-recovery',
+    },
+    // The Step Functions retention workflow is a database-lifecycle job: its
+    // recovery belongs with the other lifecycle alarms in database-recovery.md,
+    // which routes the operator to the Job's own README for the run procedure.
+    'retention-job-failure': {
+        businessSymptom: 'The built-in retention Job terminated unsuccessfully.',
+        runbook: 'database-recovery',
+    },
+    'sql-outbox-attempts': {
+        businessSymptom: 'A relational event intent is repeatedly failing delivery.',
+        runbook: 'async-recovery',
+    },
+    'sql-outbox-backlog': {
+        businessSymptom: 'Relational event intents remain undelivered.',
+        runbook: 'async-recovery',
+    },
+    'sql-outbox-relay-errors': {
+        businessSymptom: 'Relational event delivery is failing.',
+        runbook: 'async-recovery',
+    },
+    'web-latency-fast-burn': {
+        businessSymptom: 'Server-rendered routes exceed the latency objective.',
+        runbook: 'web-recovery',
+    },
+    'web-latency-slow-burn': {
+        businessSymptom: 'Server-rendered routes have sustained latency degradation.',
+        runbook: 'web-recovery',
+    },
+};
+/** The owner and escalation route every built-in Slice alarm carries. */
+function sliceAlarmOwnership(name) {
+    return { owner: `${name}-product`, route: `${name}-on-call` };
+}
+function sliceAlarmIdentity(name, id) {
+    const { businessSymptom, runbook } = SLICE_ALARM_IDENTITIES[id];
+    return {
+        businessSymptom,
+        id,
+        ...sliceAlarmOwnership(name),
+        runbook: `docs/runbooks/${runbook}.md`,
+        runbookRef: `runbook:${runbook}`,
+    };
+}
+/** A TypeScript single-quoted string literal. */
+function typescriptString(value) {
+    if (/[\\'\n\r\u2028\u2029]/u.test(value)) {
+        throw new Error(`Alarm identity text cannot be rendered: ${value}`);
+    }
+    return `'${value}'`;
+}
+/**
+ * The generated description helper's argument for one alarm, as TypeScript
+ * source. Both generated helpers (`alarmDescription` in infra/reliability.ts
+ * and `operationalAlarmDescription` in infra/product.ts) add the owner,
+ * route, schema version and Slice from sliceAlarmOwnership.
+ */
+function renderSliceAlarmDescriptionInput(name, id, indent) {
+    const identity = sliceAlarmIdentity(name, id);
+    const symptom = `${indent}  businessSymptom: ${typescriptString(identity.businessSymptom)},`;
+    return [
+        '{',
+        // Wrap a symptom that would not fit 80 columns, as the template did.
+        symptom.length <= 80
+            ? symptom
+            : `${indent}  businessSymptom:\n${indent}    ${typescriptString(identity.businessSymptom)},`,
+        `${indent}  id: ${typescriptString(identity.id)},`,
+        `${indent}  runbook: ${typescriptString(identity.runbook)},`,
+        `${indent}}`,
+    ].join('\n');
+}
+/**
+ * The complete alarm description object for one alarm, as TypeScript source
+ * for an emitter without a description helper. Keys are in the helpers'
+ * order.
+ */
+function renderSliceAlarmDescriptionObject(name, id) {
+    const identity = sliceAlarmIdentity(name, id);
+    return `{ businessSymptom: ${typescriptString(identity.businessSymptom)}, id: ${typescriptString(identity.id)}, owner: ${typescriptString(identity.owner)}, route: ${typescriptString(identity.route)}, runbook: ${typescriptString(identity.runbook)}, schemaVersion: 1, slice: ${typescriptString(name)} }`;
+}
+//# sourceMappingURL=built-in-plan-alarm-identity.js.map

package/src/generators/slice/built-in-plan-api-contract-files.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductApiContractFiles = renderProductApiContractFiles;
 const api_contract_1 = require("@empire-builder-kit/runtime/api-contract");
 const index_js_1 = require("../../api-contract/index.js");
+const built_in_plan_event_contract_literal_js_1 = require("./built-in-plan-event-contract-literal.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 const local_source_identity_js_1 = require("./local-source-identity.js");
 // Shared by the machine-readable contract and the generated operation source.
@@ -2040,6 +2041,7 @@ database code, or other implementation paths.
 } from 'node:fs';
 import { createRequire } from 'node:module';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import ts from 'typescript';
 
 const require = createRequire(import.meta.url);
 const {
@@ -2211,6 +2213,139 @@ function validateContractExports(root, packageJson, publications) {
   }
 }
 
+${built_in_plan_event_contract_literal_js_1.EVENT_CONTRACT_LITERAL_SOURCE}
+function producerEventContract(producer, slice) {
+  const path = join(producer.root, 'contracts', 'events.ts');
+  if (!existsSync(path)) {
+    throw new Error(
+      'Producer ' + slice + ' publishes no contracts/events.ts EventContractSchema.',
+    );
+  }
+  const file = ts.createSourceFile(
+    path,
+    readFileSync(path, 'utf8'),
+    ts.ScriptTarget.ESNext,
+    true,
+    ts.ScriptKind.TS,
+  );
+  let schema;
+  for (const statement of file.statements) {
+    if (!ts.isVariableStatement(statement)) continue;
+    for (const variable of statement.declarationList.declarations) {
+      if (
+        ts.isIdentifier(variable.name) &&
+        variable.name.text === 'EventContractSchema' &&
+        variable.initializer
+      ) {
+        if (schema !== undefined) {
+          throw new Error(
+            'Producer ' + slice + ' EventContractSchema export is ambiguous.',
+          );
+        }
+        schema = eventLiteral(variable.initializer);
+      }
+    }
+  }
+  if (
+    schema?.kind !== 'ebk-event-contract-schema' ||
+    schema.schemaVersion !== 1 ||
+    schema.slice !== slice ||
+    !Array.isArray(schema.events)
+  ) {
+    throw new Error(
+      'Producer ' +
+        slice +
+        ' contracts/events.ts must export one canonical v1 EventContractSchema.',
+    );
+  }
+  return schema;
+}
+
+// Bind each declared cross-Slice subscription to the producer's published
+// EventContractSchema, so a removed, renamed or re-versioned event fails here
+// instead of silently stopping delivery.
+async function checkEventSubscriptions(dependencies, projects) {
+  const subscriptionPath = join(
+    projectRoot,
+    'contracts',
+    'event-subscriptions.json',
+  );
+  if (!existsSync(subscriptionPath)) {
+    throw new Error(
+      'contracts/event-subscriptions.json is missing. Restore the seeded ' +
+        'declaration with schemaVersion 1 and an empty subscriptions list.',
+    );
+  }
+  // The managed infrastructure validator is the one authority for the
+  // declaration shape; this check runs it exactly as deployment does.
+  const validator = await import(
+    'data:text/javascript;base64,' +
+      Buffer.from(
+        ts.transpileModule(
+          readFileSync(
+            join(projectRoot, 'infra', 'event-subscriptions.ts'),
+            'utf8',
+          ),
+          {
+            compilerOptions: {
+              module: ts.ModuleKind.ESNext,
+              target: ts.ScriptTarget.ES2022,
+            },
+          },
+        ).outputText,
+      ).toString('base64')
+  );
+  const subscriptions = validator.crossSliceEventSubscriptions(
+    readJson(subscriptionPath),
+    dependencies,
+  );
+  for (const subscription of subscriptions) {
+    const producer = projects.get(subscription.source);
+    if (
+      !producer ||
+      !dependencies.consumes.includes(producer.packageJson.name + '/contracts')
+    ) {
+      throw new Error(
+        'Subscribed source ' +
+          subscription.source +
+          ' is not a consumed Product Slice contracts package.',
+      );
+    }
+    const schema = producerEventContract(producer, subscription.source);
+    for (const detailType of subscription.detailTypes) {
+      const published = schema.events.filter(
+        (event) => event?.detailType === detailType,
+      );
+      if (
+        published.length !== 1 ||
+        published[0].source !== subscription.source
+      ) {
+        throw new Error(
+          'Producer ' +
+            subscription.source +
+            ' does not publish ' +
+            detailType +
+            ' in its EventContractSchema. Restore the producer event or ' +
+            'remove the subscription from contracts/event-subscriptions.json.',
+        );
+      }
+      if (!subscription.schemaVersions.includes(published[0].schemaVersion)) {
+        throw new Error(
+          'Producer ' +
+            subscription.source +
+            ' publishes ' +
+            detailType +
+            ' schemaVersion ' +
+            published[0].schemaVersion +
+            ', which ${name} does not subscribe to. Accept that version ' +
+            'in api/event-consumer.ts, then declare it in ' +
+            'contracts/event-subscriptions.json.',
+        );
+      }
+    }
+  }
+}
+
 const declaration = readJson(declarationPath);
 if (
   !declaration ||
@@ -2345,6 +2480,7 @@ for (const publication of resolution.contracts) {
 const current = [...(ownership.contracts?.consumes ?? [])].sort();
 const expected = [...normalized.contracts.consumes];
 if (action === 'check') {
+  await checkEventSubscriptions(declaration, projects);
   if (JSON.stringify(current) !== JSON.stringify(expected)) {
     throw new Error(
       'Contract declarations are out of sync. Run ' +

package/src/generators/slice/built-in-plan-data-files.js

@@ -350,9 +350,16 @@ value to GitHub secrets, workflow input, argv, or agent-visible material.
 
 The protected deploy role needs metadata authority for the Slice prefix:
 \`ListSecrets\`, \`DescribeSecret\`, \`CreateSecret\`, and \`TagResource\`.
-It must be denied \`BatchGetSecretValue\`, \`GetSecretValue\`,
-\`PutSecretValue\`, \`UpdateSecret\`, \`UpdateSecretVersionStage\`,
-and application deployment outside its separately reviewed deploy policy.
+It is denied \`BatchGetSecretValue\`, \`UpdateSecretVersionStage\`, and
+application deployment outside its separately reviewed deploy policy, and it is
+denied \`GetSecretValue\` and \`PutSecretValue\` for every operator and
+generated secret; the exact tagged Foundation database credential is the only
+value-action exception. \`UpdateSecret\` is permitted only inside the stage's
+\`ebk/<stage>/*\` namespace and the Foundation provider secret, so native
+recovery can reconcile EBK-owned containers. \`CreateSecret\` and
+\`UpdateSecret\` can both carry a value and IAM cannot prove a call is
+metadata-only, so reviewed generated source, temporary deployment credentials,
+and CloudTrail are the controls.
 \`DeleteSecret\` is used only by the governed generated-secret retirement path
 after native Slice removal succeeds; the executor binds that call to the exact
 generated HMAC name and ownership tags described above.

package/src/generators/slice/built-in-plan-database-lifecycle-files.js

@@ -300,7 +300,7 @@ RUN --network=none pnpm --config.inject-workspace-packages=true --config.store-d
 
 FROM ${frozen_container_js_1.WORKLOAD_CONTAINER_NODE_IMAGE}
 WORKDIR /app
-ADD --chown=node:node --chmod=0444 --checksum=sha256:fe45bbebf92ad3e27a583bbb2ddd1553c521ed4d49af5514dc0a40372ea5395c https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem ./rds-global-bundle.pem
+ADD --chown=node:node --chmod=0444 --checksum=sha256:90a6f1a7978a1b1b096dca6c57511ca48d3b8cf052f8e704baf358f34ea2f21b https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem ./rds-global-bundle.pem
 COPY --from=build --chown=node:node /opt/migration ./
 COPY --chown=node:node packages/${name}/jobs/database-lifecycle-logging.mjs ./jobs/database-lifecycle-logging.mjs
 COPY --chown=node:node packages/${name}/jobs/bootstrap-database.mjs ./jobs/bootstrap-database.mjs

package/src/generators/slice/built-in-plan-event-contract-literal.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Literal-only evaluator for a Slice's canonical EventContractSchema export.
+ * Release compatibility and the cross-Slice subscription check render the
+ * same source so both read a producer contract identically.
+ */
+export declare const EVENT_CONTRACT_LITERAL_SOURCE = "const eventLiteral = (node) => {\n  while (\n    ts.isAsExpression(node) ||\n    ts.isSatisfiesExpression(node) ||\n    ts.isParenthesizedExpression(node)\n  ) {\n    node = node.expression;\n  }\n  if (ts.isObjectLiteralExpression(node)) {\n    return Object.fromEntries(\n      node.properties.map((property) => {\n        if (\n          !ts.isPropertyAssignment(property) ||\n          !(\n            ts.isIdentifier(property.name) ||\n            ts.isStringLiteral(property.name)\n          )\n        ) {\n          throw new Error(\n            'EventContractSchema accepts only explicit literal properties.',\n          );\n        }\n        return [property.name.text, eventLiteral(property.initializer)];\n      }),\n    );\n  }\n  if (ts.isArrayLiteralExpression(node)) {\n    return node.elements.map(eventLiteral);\n  }\n  if (ts.isStringLiteral(node) || ts.isNumericLiteral(node)) {\n    return ts.isNumericLiteral(node) ? Number(node.text) : node.text;\n  }\n  if (\n    node.kind === ts.SyntaxKind.TrueKeyword ||\n    node.kind === ts.SyntaxKind.FalseKeyword\n  ) {\n    return node.kind === ts.SyntaxKind.TrueKeyword;\n  }\n  throw new Error(\n    'EventContractSchema must remain a canonical literal-only export.',\n  );\n};\n";

package/src/generators/slice/built-in-plan-event-contract-literal.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EVENT_CONTRACT_LITERAL_SOURCE = void 0;
+/**
+ * Literal-only evaluator for a Slice's canonical EventContractSchema export.
+ * Release compatibility and the cross-Slice subscription check render the
+ * same source so both read a producer contract identically.
+ */
+exports.EVENT_CONTRACT_LITERAL_SOURCE = `const eventLiteral = (node) => {
+  while (
+    ts.isAsExpression(node) ||
+    ts.isSatisfiesExpression(node) ||
+    ts.isParenthesizedExpression(node)
+  ) {
+    node = node.expression;
+  }
+  if (ts.isObjectLiteralExpression(node)) {
+    return Object.fromEntries(
+      node.properties.map((property) => {
+        if (
+          !ts.isPropertyAssignment(property) ||
+          !(
+            ts.isIdentifier(property.name) ||
+            ts.isStringLiteral(property.name)
+          )
+        ) {
+          throw new Error(
+            'EventContractSchema accepts only explicit literal properties.',
+          );
+        }
+        return [property.name.text, eventLiteral(property.initializer)];
+      }),
+    );
+  }
+  if (ts.isArrayLiteralExpression(node)) {
+    return node.elements.map(eventLiteral);
+  }
+  if (ts.isStringLiteral(node) || ts.isNumericLiteral(node)) {
+    return ts.isNumericLiteral(node) ? Number(node.text) : node.text;
+  }
+  if (
+    node.kind === ts.SyntaxKind.TrueKeyword ||
+    node.kind === ts.SyntaxKind.FalseKeyword
+  ) {
+    return node.kind === ts.SyntaxKind.TrueKeyword;
+  }
+  throw new Error(
+    'EventContractSchema must remain a canonical literal-only export.',
+  );
+};
+`;
+//# sourceMappingURL=built-in-plan-event-contract-literal.js.map