local-serverless-stack 0.6.0 → 0.9.0

package/CHANGELOG.md

@@ -5,6 +5,110 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.0] - 2026-07-12
+
+Dashboard header split into a brand row + navigation row with the configured region pre-selected; the registered-services cache is now scoped per project — fixing orchestrators of one example silently binding (and stealing) another example's gateway ports; gateways recover automatically from port conflicts; each example runs in its own AWS region; `examples/localstack-ultimate` now exercises EventBridge, schedules and a DLQ, with its own VS Code task palette.
+
+### Added
+- **`examples/localstack-ultimate` expanded** to showcase the full LSS resource menu on the Pro path: an `AWS::Events::EventBus` (`ultimate-order-events`) receiving `order.processed` events from the SQS consumer, a new `auditEvents` function (eventBridge pattern trigger) persisting every matched event into a new `AuditTrail` table readable at `GET /audit`, a `purgeSessions` function on `schedule: rate(2 minutes)` that deletes expired sessions and emits `sessions.purged`, and an `OrderProcessingDLQ` with a `RedrivePolicy` (`maxReceiveCount: 3`) on the order queue — `processOrderQueue` now reports poison orders (missing `userId`, `total <= 0`) via `ReportBatchItemFailures` so they land in the DLQ and show up in the dashboard's Queues tab. Since LSS's provisioner does not yet apply `RedrivePolicy` from CloudFormation, `scripts/wire-dlq.js` (hooked into `npm run offline`) sets it on the live queue; native support is tracked as a follow-up. New `seeds/localstack-ultimate-Sessions.json` feeds the purge demo; README and the request-driver console gained flows for audit trail, poison order → DLQ and schedule observation.
+- **VS Code tasks for `examples/localstack-ultimate`** (`.vscode/tasks.json`): setup, start (Docker + `LOCALSTACK_AUTH_TOKEN`), offline, seed, drive demo, drive catalog (OpenSearch) and stop — same style as the existing example task sections, which previously covered only `self-hosted` and `localstack-free`.
+- **OpenSearch Serverless on LocalStack engines — the aoss sidecar**: no LocalStack edition emulates `aoss` (localstack/localstack#8707 is still backlog), so the orchestrator now serves the self engine's OpenSearch emulator **in-process** on a dedicated port (default `14567`) whenever the active engine is LocalStack. `AWS::OpenSearchServerless::Collection` resources provision into it transparently (`SecurityPolicy`/`AccessPolicy` stay accepted-and-skipped), the dashboard's resources/collections views work unchanged, and `GET /api/health` gains an `aossSidecar {enabled, running, port}` block. New optional config block `aossSidecar: { enabled?, port? }` (`enabled: false` opts out; never runs on the self engine, which serves aoss natively); data persists under `<stateDir>/aoss` (else `~/.lss/aoss`). Implementation reuses the engine store, OpenSearch emulator and AWS-wire router as-is (`src/server/engine/aoss-sidecar.ts`); documented in `docs/CONFIGURATION.md`. Verified end to end on the Pro image: collection provisioned on registration, full-text search/filters/aggregations served from the sidecar, `enabled/running` in health.
+- **OpenSearch tab in the dashboard**: the nav gains an OpenSearch section alongside S3/DynamoDB — a collections list (owning service, data-plane endpoint) with a per-collection browser: indices with doc counts/health, plus a search panel (free-text `q`, index scope, page size) rendering hits with their `_source`. Backed by new `GET /api/opensearch/collections`, `GET /api/opensearch/collections/:name/indices` and `POST /api/opensearch/collections/:name/search` routes and an `OpenSearchExplorer` service that targets the aoss sidecar or the self engine via the same endpoint-selection rule as the provisioner; the region selector is honored on the data plane by pinning the region through the SigV4 credential-scope query parameter (the local engines parse it without verifying signatures).
+- **`examples/localstack-ultimate` gains an OpenSearch Serverless catalog** (`ultimate-products` collection): `POST/GET/DELETE /products`, `GET /search?q=&category=&maxPrice=` and `GET /stats` routes served through serverless-offline, with fetch-based handlers (no SDK dependency), a console flow, a `drive catalog (OpenSearch)` VS Code task, README/ports documentation, and `stateDir: ".lss"` so orchestrator state (pid/log/aoss data) stays project-local like the other examples.
+
+### Changed
+- **Dashboard header split into two rows**: a brand bar (logo + title + subtitle on the left; engine status, region selector and theme menu on the right) over a dedicated navigation bar with the section tabs — the previous single row collided at moderate widths. The whole header stays sticky; the tab row scrolls horizontally on narrow screens.
+- **The region selector now pre-selects the configured region**: on load the dashboard fetches `/api/config` and adopts the `region` from `lss.config.json` (env `AWS_REGION` override included). `localStorage` keeps acting as a first-paint cache and in-session changes still stick, but the configured region wins on every full load; a configured region outside the built-in list is added to the dropdown instead of being ignored.
+- **Each example now runs in its own region**: `localstack-free` → `sa-east-1`, `localstack-ultimate` → `eu-west-1`, `self-hosted` → `us-west-2` — config, `serverless.yml`s, SDK fallbacks, embedded ARNs and docs updated coherently (`examples/README.md` gained a Region column).
+- `examples/localstack-ultimate` now lists `events` in `lss.config.json` `services` (EventBridge was missing from the LocalStack container's `SERVICES`).
+- **`serverless-lss` peer dependency restored to `osls 4.0.0`** (the open-source Serverless Framework v3 fork — no auth token, unlike `serverless` v4, and not EOL like v3): an unreleased change had moved it to an optional `serverless >=3.40.0`. Example lockfiles re-synced accordingly, and the plugin's vestigial nested `package-lock.json` (npm workspaces ignore it, so it only drifted) was removed. `examples/localstack-ultimate` keeps its `overrides: { "serverless": "npm:osls@4.0.0" }` — that alias is what stops `serverless-offline`'s `serverless` peer from pulling the token-gated framework; the self-hosted example references no framework package besides `osls` itself.
+- The root package version is now `0.10.0`; `serverless-lss` is now `0.2.1` (the version bump lets the publish workflow ship the peer-dependency restore — the `0.2.0` on npm still carries the `serverless 3.40.0` peer).
+
+### Fixed
+- **Cross-project service-cache contamination**: the registered-services cache lived flat in `~/.lss/orchestrator/cache`, keyed by service name only, and `rehydrateAll()` reactivated *every* cached entry at boot — so starting one example's orchestrator also bound the gateway ports of services registered by *other* projects (observed as `self-hosted`'s catalog-service `:3634` being held by the `localstack-free` orchestrator), and same-named services in two projects overwrote each other. The cache is now scoped per project under `cache/projects/<slug>-<hash-of-root>` — the project root is the config file's directory (symlink-resolved), falling back to the launch cwd when no project-local config exists, so no-config setups should keep starting the orchestrator from the same directory. Rehydration logs a note when a cached service's root lies outside the project root (a legitimate layout — config under `infra/`, services elsewhere) but still reactivates it. Existing flat-layout entries are ignored — re-register services once after upgrading.
+- **Gateway port conflicts now self-heal**: on `EADDRINUSE` the listener still reports `port-conflict`, but LSS retries the bind every 5 s and flips the service back to online as soon as the port frees (previously the listener was disabled until re-registration, while registration still reported success).
+- `examples/self-hosted/catalog-service/package.json` description said port `3641` (invoke `13641`); the real ports are `3634`/`13634`.
+
+## [0.9.0] - 2026-07-12
+
+OpenSearch Serverless support: collections declared as `AWS::OpenSearchServerless::Collection` are provisioned on registration and served **in-process** by the self engine — control plane (`aoss`) plus the OpenSearch REST data plane (document CRUD, `_bulk`, `_search` with the everyday query DSL, aggregations) at `http://localhost:14566/_aoss/<collection>`. No Docker, no OpenSearch cluster, no auth token. Runnable demo: `examples/opensearch-sample`.
+
+### Added
+- **OpenSearch Serverless emulator** (`src/server/engine/emulators/opensearch/`), served by the self engine under the `aoss` SigV4 scope:
+  - *Control plane* (AWS JSON 1.0, `X-Amz-Target: OpenSearchServerless.*`): `CreateCollection` (AOSS naming rule enforced, deterministic ids, `ACTIVE` immediately), `BatchGetCollection` (by names or ids, hands out the local `collectionEndpoint`/`dashboardEndpoint`), `ListCollections`, `DeleteCollection` (by id, or name for convenience; drops the collection's indices and documents). Errors carry the AWS names the provisioner branches on (`ConflictException`, `ResourceNotFoundException`).
+  - *Data plane* (OpenSearch REST under `<engine>/_aoss/<collection>`): index lifecycle (create with mappings/settings, get, delete, HEAD, `_mapping` get/merge, `_cat/indices`, `_refresh`), document CRUD (`_doc`, `_create`, `_update` with deep merge + `doc_as_upsert`/`upsert`, versioning, auto-create index on first write), `_bulk` NDJSON with per-item results, `_search`/`_count` with `match`, `match_phrase`, `multi_match`, `term`, `terms`, `range`, `prefix`, `wildcard`, `exists`, `ids` and `bool` (+`minimum_should_match`), `sort`, `from`/`size`, `_source` filtering, the `?q=` shorthand, and `terms`/`avg`/`sum`/`min`/`max`/`value_count` aggregations. Errors are OpenSearch-shaped (`{"error": {...}, "status": N}`); unsupported operations/operators fail loudly naming the feature. Collections/index metadata persist as JSON catalogs, documents as one JSONL table per index (lazy hydration/idle unload like DynamoDB items).
+- **`AWS::OpenSearchServerless::Collection` provisioning**: parsed from `resources:` (name defaults to the lowercased logical id), created via `@aws-sdk/client-opensearchserverless` on registration (idempotent on `ConflictException`), deleted on cleanup (id resolved via `BatchGetCollection`). On an engine without an aoss provider (community LocalStack) the failure message points at the self engine. `SecurityPolicy`/`AccessPolicy`/`VpcEndpoint` resources are accepted and skipped with a registration warning — nothing enforces them locally, and the template stays deployable to real AWS.
+- **Dashboard visibility**: OpenSearch collections show up in the service detail page (own section) and as a `resourceBreakdown.collections` counter in the services list; `GET /api/resources` gains a `collections` array (plus `/owners` mapping) and the Overview page a collections stat tile.
+- **Example `examples/opensearch-sample`**: a product-catalog service (`POST /products`, `GET/DELETE /products/{id}`, `GET /search?q=&category=&maxPrice=`, `GET /stats`) exercising full-text search, `bool` filters, sorting and aggregations against the collection declared in its `serverless.yml` — handlers speak the OpenSearch REST API with Node's global `fetch`, zero runtime dependencies. Verified end to end on the self engine, including document persistence across an orchestrator restart.
+- **Dashboard branding via `lss.config.json`**: new optional `branding` key — `title`, `subtitle`, `logo`, `favicon` (http(s)/data URL, or a file path resolved next to the config file and served at `GET /api/config/branding/logo|favicon`), `defaultTheme` (`dark`/`light`), and TreeUI color-token overrides via `colors` (both themes) / `themeColors.dark|light` (per theme; keys accept the token suffix like `brand-primary` or a full `--tree-*` custom property). Exposed at `GET /api/config/branding` and inside `GET /api/config`; the UI applies title/logo/favicon/theme/colors on boot. The user's theme choice in the UI menu is now persisted per browser (`localStorage`) and wins over `defaultTheme`.
+
+### Changed
+- New runtime dependency: `@aws-sdk/client-opensearchserverless`.
+- The self engine's `/_localstack/health` alias and `healthDetail()` now report `aoss` among the available services; unsigned requests to `/_aoss/...` paths route to the OpenSearch emulator (ahead of the S3 path fallback).
+- The root package version is now `0.9.0`. The `serverless-lss` plugin package was not changed.
+- **Dashboard component library updated**: `@treeui/vue` `^0.10.0` → `^0.11.0`. No component API changes required.
+- Docs overhaul, audited against the v0.8.0 implementation: README rewritten (correct npm scripts, plugin keys `custom.orchestrator.orchestratorUrl` + `custom.lss.{apiPort,invokePort}`, full CLI surface incl. `seed`/`seed:clear`/`--config`, accurate registration/event-flow mermaid diagrams, stale "Project Structure"/"Project Status"/publishing sections removed); `docs/README.md` is now a real documentation index (the original design proposal moved to `docs/archive/DESIGN_PROPOSAL.md` with a historical banner); `docs/RELEASE.md` matches the actual publish workflow (no tests, no auto-tags); `docs/CONFIGURATION.md` gains `--config`/`LSS_CONFIG_PATH`, `seedsDir`, `stateDir`, `branding`, the missing env vars and a config-precedence diagram; `docs/FEATURES.md`/`docs/SELF_ENGINE.md`/`CONTRIBUTING.md`/example READMEs corrected against the code (incl. two real self-engine divergences now tracked in TODO.md: SQS `RedrivePolicy` not enforced, S3 ACL/policy sub-resources not recognized).
+- `serverless.yml.example` moved to `docs/serverless.yml.example` and updated (runtime `nodejs20.x`, `custom.lss` ports as the primary mechanism).
+- `lss.config.json.example` now showcases `engine`/`selfEngine` and `branding`; the repo's dev `lss.config.json` gains `"events"` in `services`.
+- `TODO.md` re-audited: delivered items removed (npm publication, CLI unit tests, orchestrator integration tests, auto-rebuild on serverless.yml changes, architecture diagrams), half-done items narrowed, self-engine hardening backlog added.
+
+### Removed
+- Stale root files: `local-serverless-stack-0.0.3.tgz` (old package artifact, now gitignored via `*.tgz`), `run-tests.sh` (referenced npm scripts that no longer exist; CI uses npm scripts directly), `.npmignore` (redundant — the `files` allowlist in package.json controls the published content; verified identical `npm pack` output).
+
+## [0.8.0] - 2026-07-10
+
+The self engine: an in-process AWS emulator that replaces LocalStack for the typical serverless dev loop — DynamoDB, SQS, S3, EventBridge, SNS (minimal), Lambda control plane and STS served by the orchestrator itself on one port. No Docker, no container, no auth token; boots in milliseconds; data persisted in local files. Opt-in (`engine: "self"` / `lss start --self-engine`) — LocalStack mode remains the default and fully supported. Design: `docs/PRD_SELF_ENGINE.md`; coverage matrix: `docs/SELF_ENGINE.md`.
+
+### Added
+- **Engine selection**: `engine: "localstack" | "self"` and a `selfEngine` config block (`port` default 14566 — deliberately outside the 4566–4599 range a real LocalStack intercepts on some hosts —, `dataDir`, `account`, `idleUnloadMs`, `memoryBudgetMb`, `fsync`, `fallbackEndpoint`); env overrides `LSS_ENGINE`/`LSS_ENGINE_PORT`; CLI `lss start --self-engine` (rejected when combined with the LocalStack-only `--external`/`--pro`/`--localstack-token`).
+- **AWS wire front door** (`src/server/engine/http/`): one `node:http` listener routing by SigV4 credential scope → `X-Amz-Target` → path heuristics; per-protocol error serialization (JSON `__type`, Query XML, S3 XML with body-less HEAD errors, Lambda REST + `x-amzn-ErrorType`); the `x-amzn-query-error` SQS compat header; `aws-chunked` request decoding (SDK v3 streaming PutObject); `x-amzn-RequestId` on every response; `/_localstack/health` alias so existing readiness polls keep working; `selfEngine.fallbackEndpoint` reverse-proxies any unimplemented service/operation verbatim to a LocalStack during migration — unsupported calls otherwise fail loudly, never silently succeed.
+- **File-backed store** (`src/server/engine/store/`): JSONL snapshot + append-only WAL per data table (torn-tail-safe replay, seq-based compaction), atomic JSON catalogs for metadata, content-addressed blob storage for S3 bodies (never held in the heap); registration writes metadata only — data hydrates on first touch (streamed line-by-line) and dehydrates after `idleUnloadMs` or under the `memoryBudgetMb` LRU budget; debounced flushes (20 ms / 256 KB) with opt-in fsync.
+- **DynamoDB emulator** with a hand-rolled expression engine (KeyCondition/Condition/Filter/Update/Projection: comparators, `BETWEEN`/`IN`, boolean precedence, document paths, `SET`/`REMOVE`/`ADD`/`DELETE` with exact decimal-string `N` arithmetic), GSI/LSI queries with projection and sparse-index semantics, `Limit`-before-filter parity, `LastEvaluatedKey` paging (including index LEKs), lazy TTL (filtered at read, purged at compaction with Service-identity stream REMOVEs), stream records (`INSERT`/`MODIFY`/`REMOVE` per `StreamViewType`), batch ops, and the full `DescribeTable` introspection shape (`LatestStreamArn` present immediately).
+- **SQS emulator**: FIFO (per-group ordering, 5-minute dedup window), event-driven long polling (parked promises — no polling loops), visibility-timeout redelivery, live `ApproximateNumberOfMessages*` counters (QueueInspector `await-idle`/metrics work unchanged), `MD5OfMessageBody`/`MD5OfMessageAttributes`, CreateQueue idempotent-success on identical attributes; messages are memory-only with a graceful-shutdown snapshot under `persistence`.
+- **S3 emulator**: byte-exact object round trips, `Range` reads, `ListObjectsV2` (prefix/delimiter/CommonPrefixes/continuation/`encoding-type=url`), `DeleteObjects`, `CopyObject`, versioning flag, notification configuration (including the legacy `CloudFunctionConfiguration` XML names), quoted-MD5 ETags, `GetBucketLocation` us-east-1 quirk; multipart answers an explicit `NotImplemented` until the hardening phase.
+- **EventBridge emulator**: buses, rules with validated patterns (exact, array-OR, `prefix`, `exists`, nested keys; unsupported operators rejected at `PutRule` with `InvalidEventPatternException`), targets, `PutEvents` with per-entry results, plus minimal **SNS** (topics + logged `Publish`) and **STS** (`GetCallerIdentity`).
+- **Lambda control plane**: the provisioner's proxy functions are absorbed as metadata (zip discarded, `INVOKE_URL` kept — it doubles as the HTTP fallback for services still on serverless-offline), event source mappings with UUIDs persisted across restarts, `UpdateEventSourceMapping Enabled` = QueueInspector hold/release, `Invoke` honoring `X-Amz-Invocation-Type`.
+- **In-process event dispatch** (`src/server/engine/dispatch/`): SQS delivery loops (batch size + `MaximumBatchingWindowInSeconds`, failure → visibility redelivery, capped backoff on runtime-unavailable), DynamoDB stream tailers (`TRIM_HORIZON`/`LATEST`, retry-then-advance with the `DDBStreamBatchInfo` OnFailure SQS envelope), S3 notification fan-out (event globs + prefix/suffix filters, `eventVersion 2.1` records), EventBridge target invocation (`Input`/`InputPath`) and **schedule triggering** (`rate()` + 6-field AWS cron, single timer wheel) — all delivered straight into the LSS Lambda runtime: no proxy Lambdas, no HTTP hop, no polling containers. Closes the long-standing scheduled-triggers TODO for self-engine mode.
+- **Example `examples/self-engine-sample`**: three microservices (orders → billing → notifications) exercising DynamoDB + SQS (cross-service ESM by ARN) + S3 + EventBridge on the self engine, registered with `sls package` only. Measured: engine boot ~10 ms; the full pipeline across the three services completes in ~170 ms — no Docker.
+- **Docs**: `docs/SELF_ENGINE.md` (coverage matrix, storage model, known divergences), `docs/PRD_SELF_ENGINE.md` (design), FEATURES.md §13, CONFIGURATION.md and README (self engine as the headline feature).
+- **VS Code tasks** (`.vscode/tasks.json`, now versioned via a `.gitignore` exception): build/dev, unit/coverage/integration tests, lint, cross-project typecheck, a `validate: pre-prod` sequence (lint → typecheck → tests → build), and one-click flows for the self-engine and eventbridge examples (start/register/drive pipeline/stop).
+
+### Changed
+- **Dashboard component library updated**: `@treeui/vue` `^0.6.1` → `^0.10.0` (latest). No API changes required in the LSS components — `vue-tsc` and the Vite build pass unchanged.
+- **Engine seam**: the LocalStack container lifecycle moved to `src/server/engine/backends/localstack-backend.ts`; `services/localstack-manager.ts` is now a thin facade over the new `EngineManager`, so the provisioner/explorers/seeds keep their imports and work against whichever engine is active (they always speak AWS SDK to `getConfig().endpoint`). Self-engine code is loaded via dynamic `import()` — LocalStack-mode memory footprint is unchanged.
+- `lambdaRuntime.invokeHost` defaults to `127.0.0.1` in self-engine mode (nothing runs inside Docker); explicit config still wins.
+- `GET /api/health` now includes an `engine: {kind, running, endpoint, ...}` block; the `localstack` boolean stays truthy when the active engine is healthy (client/UI compatibility).
+- The root package version is now `0.8.0`. The `serverless-lss` plugin package was not changed.
+
+### Fixed
+- **Branch-coverage gate restored to 100%**: closed the six uncovered branches left by the 0.7.0 EventBridge work (`cloudformation-parser.ts` — bus/rule with no `Properties`, rule with no `Targets`; `resource-provisioner.ts` — non-Error rejections in the event-rule pass and eventbus cleanup, `AddPermission` conflict/message-less fallbacks while wiring rule targets). `npm run test:coverage` passes again.
+
+### Tests
+- ~700 new unit tests (1802 total, up from 1100): wire router/SigV4/aws-chunked, store WAL/compaction/hydration/LRU-budget, DynamoDB expression engine (223 assertions) + emulator core, SQS/S3/EventBridge/SNS/STS/lambda-ctl emulators, dispatcher loops/stream tailers/scheduler, self-backend boot; engine selection covered in `config-manager` and `cli` suites. End-to-end smoke with real AWS SDK v3 clients against a booted engine (CRUD/Query/GSI, queue lifecycle, binary S3 round trip, per-entry PutEvents, ESM hold, restart persistence).
+
+## [0.7.0] - 2026-07-10
+
+EventBridge support: LSS can now provision the shared event bus and rule→Lambda triggers that previously required the last remaining `serverless deploy` (CloudFormation) step in local monorepo setups.
+
+### Added
+- **`AWS::Events::EventBus` provisioning**: buses declared in the `resources:` section are created in LocalStack on registration (idempotent — re-registration tolerates an existing bus). `PutEvents` from handlers already worked via the SDK; the bus just had to exist.
+- **`AWS::Events::Rule` triggers**: rules (event pattern or schedule, `ENABLED`/`DISABLED` state honored) are created on the declared bus and their Lambda targets wired through the same proxy model used by streams/SQS — EventBridge → proxy Lambda in LocalStack → LSS invoke API (130xx). Target `Input`/`InputPath` pass through; the bus is resolved from the template's logical ids, a literal name, or an ARN. Rules whose `EventBusName` can't be resolved from the template (e.g. `Fn::ImportValue`) are skipped with a warning instead of silently landing on the default bus.
+- **Resources-only stacks**: a registered service that declares only `resources:` (no functions, no ports) provisions its resources without starting a runtime worker, gateway listeners or watcher — this already worked structurally since 0.5.0 gated those on declared functions/ports, and is now covered by tests for the EventBus-only infra-stack case.
+- **Cleanup parity**: unregistering a service removes rule targets and rules first, then deletes its event buses.
+- **Dashboard visibility**: EventBridge buses and rules show up in the service detail page (own sections) and as counters in the services list (`resourceBreakdown.buses`/`eventRules`), so a resources-only infra stack no longer renders as "N total" with an empty body.
+- **Example `examples/eventbridge-sample`**: resources-only `events-stack` owning the shared bus (+ skipped Archive), a producer publishing `UserSignedUp` via `PutEvents`, and a consumer with an `events: eventBridge` trigger storing events in DynamoDB — registered with `sls package` only, no deploy. Its LocalStack runs on port `14566`, outside the standard 4566–4599 range, so a real LocalStack publishing that range (docker-compose defaults) can't intercept the example's `localhost` traffic on Docker Desktop/WSL2.
+
+### Fixed
+- **EventBridge event shape through proxies**: the generated LocalStack proxy Lambda no longer wraps EventBridge events in a `Records` array — handlers receive `source`/`detail-type`/`detail` at the top level, exactly like on AWS. SQS/DynamoDB/SNS batches keep their `Records` shape. Proxies created by earlier versions keep the old code until recreated (only their `INVOKE_URL` is updated in place); delete the proxy function or reset LocalStack to pick up the fix.
+
+### Changed
+- `AWS::Events::Archive` resources are accepted and skipped with a registration warning: LocalStack mocks Archives (CloudFormation reports `CREATE_COMPLETE` but `ListArchives` stays empty), so provisioning one locally would only fake success.
+- `CloudFormationParser.parse()` accepts an optional warnings sink; the registrar forwards template-level warnings (like skipped Archives) to the registering client alongside state-file warnings.
+- New runtime dependency: `@aws-sdk/client-eventbridge`.
+
+### Tests
+- Parser coverage for `AWS::Events::EventBus`/`Rule`/`Archive` (bus name fallback, pattern/schedule/state, `Fn::ImportValue` flagging, literal-ARN targets, warning sink) and ResourceProvisioner coverage for bus creation, rule wiring (proxy reuse, permissions, default vs named vs literal bus), unresolvable-bus/unsupported-target skips, and cleanup ordering.
+
 ## [0.6.0] - 2026-07-09
 
 Corrections from integrating LSS 0.5.0 in a real monorepo using osls 4, serverless-esbuild ESM artifacts, HTTP API v2 authorizers, DynamoDB Streams, and Docker-in-Docker devcontainers.