@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/developer-agent/operation-registry.js

@@ -0,0 +1,1255 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeveloperAgentOperationRegistryError = void 0;
+exports.joinDeveloperAgentAuthorityClasses = joinDeveloperAgentAuthorityClasses;
+exports.createDeveloperAgentOperationRegistry = createDeveloperAgentOperationRegistry;
+exports.requireDeveloperAgentOperation = requireDeveloperAgentOperation;
+exports.operationLooksMutating = operationLooksMutating;
+const node_util_1 = require("node:util");
+const blueprint_trust_js_1 = require("../supply-chain/blueprint-trust.js");
+const model_js_1 = require("./model.js");
+const ordering_js_1 = require("./ordering.js");
+class DeveloperAgentOperationRegistryError extends Error {
+    classification = 'unsupported-operation';
+    constructor() {
+        super('Requested Developer-Agent operation is not in the inspected operation registry.');
+        this.name = 'DeveloperAgentOperationRegistryError';
+    }
+}
+exports.DeveloperAgentOperationRegistryError = DeveloperAgentOperationRegistryError;
+const exact = (...names) => {
+    const values = new Set(names);
+    return (targetName) => values.has(targetName);
+};
+const suffix = (...suffixes) => (targetName) => suffixes.some((value) => targetName.endsWith(value));
+const containsSegment = (...segments) => (targetName) => {
+    const words = new Set(targetName.split('-'));
+    return segments.some((value) => words.has(value));
+};
+const ALL_CANONICAL_STAGES = [
+    'development',
+    'staging',
+    'production',
+];
+const PROTECTED_CANONICAL_STAGES = [
+    'staging',
+    'production',
+];
+const PROTECTED_WORKFLOW_ONLY_RATIONALE = 'This exact target is reserved for a protected workflow that supplies reviewed authority and retained evidence; Developer-Agent planning must use that owning workflow.';
+const LOCAL_OWNER_ONLY_RATIONALE = 'This exact target is intentionally unavailable to Developer-Agent planning; use its bounded framework owner instead.';
+function policyLifecycleActionForTarget(targetName) {
+    if (exact('deploy', 'deploy-infrastructure', 'deployment-plan', 'foundation-ready', 'infrastructure-plan')(targetName)) {
+        return 'deploy';
+    }
+    if (exact('dev', 'dev-cleanup', 'dev-setup')(targetName))
+        return 'dev';
+    if (exact('db-local-migrate', 'db-migrate')(targetName))
+        return 'migrate';
+    if (targetName === 'refresh')
+        return 'refresh';
+    if (targetName === 'remove')
+        return 'remove';
+    if (targetName === 'unlock')
+        return 'unlock';
+    return undefined;
+}
+function exactOptions(expected) {
+    return (input, options) => (0, node_util_1.isDeepStrictEqual)(options, expected(input));
+}
+function runCommandSignature(targetName, command, settings = {}) {
+    return {
+        ...(settings.continuous ? { continuous: true } : {}),
+        ...(settings.dependsOn
+            ? { dependsOn: () => settings.dependsOn }
+            : {}),
+        executor: 'nx:run-commands',
+        ...(settings.nonPlannableRationale
+            ? { nonPlannableRationale: settings.nonPlannableRationale }
+            : {}),
+        optionsMatch: exactOptions((input) => ({
+            command,
+            ...(settings.workspaceRoot ? {} : { cwd: input.project.root }),
+            ...(settings.env ? { env: settings.env } : {}),
+            ...(settings.forwardAllArgs === undefined
+                ? {}
+                : { forwardAllArgs: settings.forwardAllArgs }),
+        })),
+        targetName,
+    };
+}
+function runScriptSignature(targetName, expectedScript, settings = {}) {
+    const { dependsOn, ...signatureSettings } = settings;
+    return {
+        ...signatureSettings,
+        ...(dependsOn ? { dependsOn: () => dependsOn } : {}),
+        executor: 'nx:run-script',
+        metadataMatch: (input, metadata) => {
+            const script = expectedScript(input);
+            return (script !== undefined &&
+                (0, node_util_1.isDeepStrictEqual)(metadata, {
+                    runCommand: `pnpm run ${targetName}`,
+                    scriptContent: script,
+                }));
+        },
+        optionsMatch: (_input, options) => (0, node_util_1.isDeepStrictEqual)(options, { script: targetName }),
+        targetName,
+    };
+}
+function executorSignature(targetName, executor, options, dependsOn, settings = {}) {
+    return {
+        ...settings,
+        ...(dependsOn ? { dependsOn: () => dependsOn } : {}),
+        executor,
+        optionsMatch: options,
+        targetName,
+    };
+}
+const sliceVerifyDependencies = [
+    'api-contract-check',
+    'async-verify',
+    'authorization-check',
+    'build',
+    'contract-dependencies-check',
+    'data-policy-check',
+    'db-check',
+    'frontend-boundaries',
+    'lint',
+    'performance-budget',
+    'performance-check',
+    'reliability-verify',
+    'secret-guardrails',
+    'smoke-deployed-check',
+    'test',
+    'test-integration',
+    'typecheck',
+];
+// These are execution signatures, not name heuristics. Generator changes that
+// alter executor options or dependency closure must update this reviewed list;
+// external Blueprint verification instead enters through the exact protected
+// target-closure review passed to the registry below.
+const TARGET_SIGNATURES = [
+    runCommandSignature('api-contract-baseline', 'node --experimental-strip-types scripts/api-contract.mjs baseline', { forwardAllArgs: true }),
+    runCommandSignature('api-contract-check', 'node --experimental-strip-types scripts/api-contract.mjs check', { forwardAllArgs: false }),
+    runCommandSignature('api-contract-generate', 'node --experimental-strip-types scripts/api-contract.mjs generate', { forwardAllArgs: false }),
+    runCommandSignature('authorization-check', 'vitest run authorization', {
+        forwardAllArgs: false,
+    }),
+    executorSignature('blueprint-trust-check', '@empire-builder-kit/nx:blueprint-trust', exactOptions(() => ({
+        operation: 'adopt',
+        output: '.ebk/evidence/supply-chain/blueprint-trust.json',
+        protectedBranch: 'develop',
+        protectedRef: 'refs/remotes/origin/develop',
+    }))),
+    executorSignature('blueprint-trust-check-protected', '@empire-builder-kit/nx:blueprint-trust', exactOptions(() => ({
+        operation: 'deploy',
+        output: '.ebk/evidence/supply-chain/blueprint-trust.json',
+        protectedBranch: 'develop',
+        protectedRef: 'refs/remotes/origin/develop',
+    })), undefined, {
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('async-inventory', 'node --experimental-strip-types scripts/async-recovery.mjs inventory dlq-redrive', { forwardAllArgs: false }),
+    runCommandSignature('async-backfill', 'node --experimental-strip-types scripts/async-recovery.mjs apply checkpointed-backfill', { forwardAllArgs: false }),
+    runCommandSignature('async-backfill-report', 'node --experimental-strip-types scripts/async-recovery.mjs report checkpointed-backfill', { forwardAllArgs: false }),
+    runCommandSignature('async-backfill-status', 'node --experimental-strip-types scripts/async-recovery.mjs status checkpointed-backfill', { forwardAllArgs: false }),
+    runCommandSignature('async-provider-reconcile', 'node --experimental-strip-types scripts/async-recovery.mjs apply provider-reconciliation', { forwardAllArgs: false }),
+    runCommandSignature('async-provider-reconcile-report', 'node --experimental-strip-types scripts/async-recovery.mjs report provider-reconciliation', { forwardAllArgs: false }),
+    runCommandSignature('async-provider-reconcile-status', 'node --experimental-strip-types scripts/async-recovery.mjs status provider-reconciliation', { forwardAllArgs: false }),
+    runCommandSignature('async-queue-redrive-report', 'node --experimental-strip-types scripts/async-recovery.mjs report dlq-redrive', { forwardAllArgs: false }),
+    runCommandSignature('async-queue-redrive-status', 'node --experimental-strip-types scripts/async-recovery.mjs status dlq-redrive', { forwardAllArgs: false }),
+    runCommandSignature('async-workflow-recover', 'node --experimental-strip-types scripts/async-recovery.mjs apply workflow-recovery', { forwardAllArgs: false }),
+    runCommandSignature('async-workflow-recovery-report', 'node --experimental-strip-types scripts/async-recovery.mjs report workflow-recovery', { forwardAllArgs: false }),
+    runCommandSignature('async-workflow-recovery-status', 'node --experimental-strip-types scripts/async-recovery.mjs status workflow-recovery', { forwardAllArgs: false }),
+    runCommandSignature('async-verify', 'node --experimental-strip-types scripts/async-contract.mjs', { forwardAllArgs: false }),
+    runCommandSignature('build', 'next build web', {
+        dependsOn: ['secret-guardrails', 'typecheck'],
+        env: { NODE_ENV: 'production' },
+    }),
+    runCommandSignature('configuration-expected', 'node --experimental-strip-types scripts/configuration-expected.mjs', { forwardAllArgs: false }),
+    runCommandSignature('configuration-check', 'node --experimental-strip-types scripts/configuration-check.mjs', { forwardAllArgs: false }),
+    runCommandSignature('contract-dependencies-check', 'node scripts/contract-dependencies.mjs check', { forwardAllArgs: false }),
+    runCommandSignature('contract-dependencies-sync', 'node scripts/contract-dependencies.mjs sync', { forwardAllArgs: false }),
+    runCommandSignature('container-release-amd64', 'node ../../tools/container-release.mjs platform linux/amd64', {
+        forwardAllArgs: false,
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('container-release-arm64', 'node ../../tools/container-release.mjs platform linux/arm64', {
+        forwardAllArgs: false,
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('container-release-assemble', 'node ../../tools/container-release.mjs assemble', {
+        forwardAllArgs: false,
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('container-release-promote', 'node ../../tools/container-release.mjs promote', {
+        forwardAllArgs: false,
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('db-check', 'node scripts/check-database.mjs'),
+    runCommandSignature('db-generate', 'drizzle-kit generate --config=database/drizzle.config.ts'),
+    runCommandSignature('db-migrate', 'node scripts/migrate-database.mjs', {
+        dependsOn: [{ params: 'forward', target: 'deploy-infrastructure' }],
+        forwardAllArgs: true,
+    }),
+    runCommandSignature('db-local-down', 'node scripts/local-database.mjs down'),
+    runCommandSignature('db-local-migrate', 'drizzle-kit migrate --config=database/drizzle.config.ts', { dependsOn: ['db-local-up'] }),
+    runCommandSignature('db-local-up', 'node scripts/local-database.mjs up', {
+        dependsOn: ['db-check'],
+    }),
+    runCommandSignature('db-retirement-rehearsal', 'node scripts/rehearse-database-retirement.mjs', { forwardAllArgs: false }),
+    runCommandSignature('data-policy-check', 'node scripts/data-policy.mjs', {
+        forwardAllArgs: false,
+    }),
+    runCommandSignature('data-policy-reconcile', 'node scripts/data-policy-reconcile.mjs', { dependsOn: ['data-policy-check'], forwardAllArgs: true }),
+    runCommandSignature('data-restore-reconcile', 'node --experimental-strip-types scripts/data-restore-reconcile.mjs', { forwardAllArgs: true }),
+    runCommandSignature('data-retention', 'node --experimental-strip-types scripts/data-retention.mjs', { forwardAllArgs: true }),
+    runCommandSignature('deploy', 'node scripts/confirm-deploy.mjs', {
+        dependsOn: [{ params: 'forward', target: 'db-migrate' }],
+        forwardAllArgs: true,
+    }),
+    runCommandSignature('dev-prerequisite', 'node scripts/verify-live-mode.mjs', {
+        dependsOn: ['db-check', 'secret-guardrails', 'typecheck'],
+    }),
+    runCommandSignature('frontend-boundaries', 'node scripts/frontend-boundaries.mjs --output=.ebk/evidence/frontend/frontend-boundaries.json', { forwardAllArgs: false }),
+    runCommandSignature('frontend-security-headers', 'node scripts/frontend-security-headers.mjs', {
+        forwardAllArgs: true,
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('frontend-visual', 'node scripts/frontend-visual-report.mjs verify', { forwardAllArgs: false }),
+    runCommandSignature('frontend-visual-update', 'node scripts/frontend-visual-report.mjs update', { forwardAllArgs: true }),
+    runCommandSignature('ecr-inspector-collect', 'node ../../tools/ecr-inspector-collect.mjs collect', { forwardAllArgs: false }),
+    runCommandSignature('ecr-scan-applicability', 'node ../../tools/ecr-inspector-collect.mjs assess', { forwardAllArgs: false }),
+    runCommandSignature('infrastructure-drift', 'node --experimental-strip-types scripts/infrastructure-drift.mjs', { forwardAllArgs: false }),
+    runCommandSignature('lint', 'eslint .'),
+    runCommandSignature('performance-budget', 'node scripts/performance-budget-check.mjs', { dependsOn: ['build'], forwardAllArgs: false }),
+    runCommandSignature('performance-evidence-evaluate', 'node scripts/performance-evidence-evaluate.mjs', { forwardAllArgs: false }),
+    runCommandSignature('performance-check', 'node scripts/performance-policy-check.mjs', { forwardAllArgs: false }),
+    runCommandSignature('performance-cost-collect', 'node scripts/performance-cost-collect.mjs', { forwardAllArgs: false }),
+    runCommandSignature('performance-aggregate-counts', 'node --experimental-strip-types scripts/performance-aggregate-counts.mjs', {
+        forwardAllArgs: false,
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('performance-load-cleanup', 'node scripts/performance-load-cleanup.mjs', {
+        forwardAllArgs: false,
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('performance-run', 'node scripts/performance-load-runner.mjs', {
+        forwardAllArgs: false,
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('performance-ready', 'node scripts/performance-policy-check.mjs --require-ready', { forwardAllArgs: false }),
+    runCommandSignature('performance-tag-coverage', 'node scripts/performance-tag-coverage.mjs', { forwardAllArgs: false }),
+    runCommandSignature('performance-unit-cost', 'node scripts/performance-unit-cost.mjs', { forwardAllArgs: false }),
+    runCommandSignature('reliability-deployed-verify', 'node scripts/verify-reliability.mjs --deployed', { forwardAllArgs: false }),
+    runCommandSignature('reliability-deployment-binding', 'node scripts/create-reliability-deployment-binding.mjs', {
+        forwardAllArgs: false,
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+    }),
+    runCommandSignature('reliability-diagnostic', 'node scripts/reliability-diagnostic.mjs', { forwardAllArgs: false }),
+    runCommandSignature('reliability-exercise-collect', 'node scripts/collect-reliability-exercise.mjs', { forwardAllArgs: false }),
+    runCommandSignature('reliability-exercise-report', 'node scripts/reliability-exercise-report.mjs', { forwardAllArgs: false }),
+    runCommandSignature('reliability-remediation', 'node scripts/incident-remediation.mjs', { forwardAllArgs: false }),
+    runCommandSignature('reliability-report', 'node scripts/reliability-report.mjs', { forwardAllArgs: false }),
+    runCommandSignature('reliability-verify', 'node scripts/verify-reliability.mjs', { forwardAllArgs: false }),
+    runCommandSignature('release-artifacts', 'node --experimental-strip-types scripts/release-artifacts.mjs', { forwardAllArgs: false }),
+    runCommandSignature('release-candidate', 'node --experimental-strip-types scripts/release-candidate.mjs', { dependsOn: ['release-artifacts'], forwardAllArgs: false }),
+    runCommandSignature('release-lifecycle', 'node --experimental-strip-types scripts/release-lifecycle.mjs', { forwardAllArgs: false }),
+    runCommandSignature('release-manifest', 'node --experimental-strip-types scripts/release-manifest.mjs', { forwardAllArgs: false }),
+    runCommandSignature('release-rollout', 'node --experimental-strip-types scripts/release-rollout.mjs', { forwardAllArgs: false }),
+    runCommandSignature('secret-personal-down', 'node --experimental-strip-types scripts/remove-personal-secrets.mjs', { forwardAllArgs: false }),
+    runCommandSignature('smoke-deployed', 'node scripts/run-smoke-deployed.mjs', {
+        forwardAllArgs: false,
+    }),
+    runCommandSignature('smoke-deployed-check', 'playwright test --list'),
+    runCommandSignature('test', 'vitest run'),
+    runCommandSignature('test', 'vitest run', {
+        dependsOn: ['^build'],
+    }),
+    runCommandSignature('test-integration', 'node scripts/run-integration-tests.mjs', { forwardAllArgs: false }),
+    runCommandSignature('typecheck', 'tsc --noEmit -p tsconfig.json'),
+    runCommandSignature('typecheck', 'tsc --noEmit -p tsconfig.json', {
+        dependsOn: ['^build'],
+    }),
+    runCommandSignature('verify', 'node scripts/verify-slice.mjs', {
+        dependsOn: sliceVerifyDependencies,
+    }),
+    runCommandSignature('verify', 'node scripts/verify-foundation.mjs', {
+        dependsOn: ['lint', 'typecheck'],
+    }),
+    runCommandSignature('install-git-hooks', 'node tools/install-ebk-hooks.mjs', {
+        workspaceRoot: true,
+    }),
+    runCommandSignature('supply-chain-scan', 'node tools/supply-chain-scan.mjs --output=.ebk/evidence/supply-chain/scanner-input.json', { workspaceRoot: true }),
+    runCommandSignature('supply-chain-check', 'node tools/supply-chain-check.mjs --scanner=supply-chain/structural-scanner-input.json --output=.ebk/evidence/supply-chain/check.json', { workspaceRoot: true }),
+    runCommandSignature('supply-chain-check-protected', 'node tools/supply-chain-check.mjs --protected --scanner=.ebk/evidence/supply-chain/scanner-input.json --output=.ebk/evidence/supply-chain/check.json', {
+        nonPlannableRationale: PROTECTED_WORKFLOW_ONLY_RATIONALE,
+        workspaceRoot: true,
+    }),
+    runCommandSignature('workload-role-candidate-report', 'node tools/workload-role-baseline/report-candidate-bundle.mjs', { forwardAllArgs: true, workspaceRoot: true }),
+    runCommandSignature('workload-role-provisioner-build', 'node tools/workload-role-baseline/build.mjs', { workspaceRoot: true }),
+    runCommandSignature('verify', 'node tools/workspace-health.mjs', {
+        dependsOn: ['blueprint-trust-check', 'supply-chain-check'],
+        workspaceRoot: true,
+    }),
+    runCommandSignature('workspace-health', 'node tools/workspace-health.mjs', {
+        workspaceRoot: true,
+    }),
+    runScriptSignature('build', (input) => input.project.tags.includes('scope:workspace')
+        ? `nx run-many -t build --exclude=${input.project.name}`
+        : input.project.root.includes('/services/') ||
+            input.project.root.includes('/jobs/')
+            ? 'tsc -p tsconfig.json'
+            : undefined, { dependsOn: ['^build'] }),
+    runScriptSignature('docker-build', (input) => {
+        const match = /^packages\/([^/]+)\/(services|jobs)\/([^/]+)$/u.exec(input.project.root);
+        if (!match)
+            return undefined;
+        const [, slice, plural, workload] = match;
+        const kind = plural === 'services' ? 'service' : 'job';
+        return (`docker build -f packages/${slice}/${plural}/${workload}/Dockerfile ` +
+            `-t ${slice}-${kind}-${workload}:local ../../../..`);
+    }, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+    runScriptSignature('dev', (input) => input.project.root.includes('/services/')
+        ? 'node --experimental-strip-types src/main.ts'
+        : input.project.root.includes('/jobs/')
+            ? 'node --experimental-strip-types src/run.ts'
+            : undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+    runScriptSignature('format', (input) => input.project.tags.includes('scope:workspace')
+        ? 'nx format:write'
+        : undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+    runScriptSignature('format:check', (input) => input.project.tags.includes('scope:workspace')
+        ? 'nx format:check'
+        : undefined),
+    runScriptSignature('graph', (input) => input.project.tags.includes('scope:workspace') ? 'nx graph' : undefined, { nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE }),
+    runScriptSignature('health', (input) => input.project.tags.includes('scope:workspace')
+        ? `nx run ${input.project.name}:workspace-health`
+        : undefined),
+    runScriptSignature('lint', (input) => input.project.tags.includes('scope:workspace')
+        ? `nx run-many -t lint --exclude=${input.project.name}`
+        : input.project.root.includes('/services/') ||
+            input.project.root.includes('/jobs/')
+            ? 'eslint .'
+            : undefined),
+    runScriptSignature('test', (input) => input.project.tags.includes('scope:workspace')
+        ? `nx run-many -t test --exclude=${input.project.name}`
+        : input.project.root.includes('/services/') ||
+            input.project.root.includes('/jobs/')
+            ? 'vitest run'
+            : undefined, { dependsOn: ['^build'] }),
+    runScriptSignature('typecheck', (input) => input.project.tags.includes('scope:workspace')
+        ? `nx run-many -t typecheck --exclude=${input.project.name}`
+        : input.project.root.includes('/services/') ||
+            input.project.root.includes('/jobs/')
+            ? 'tsc --noEmit -p tsconfig.json'
+            : undefined, { dependsOn: ['^build'] }),
+    runScriptSignature('verify', (input) => input.project.root.includes('/services/') ||
+        input.project.root.includes('/jobs/')
+        ? 'pnpm run lint && pnpm run typecheck && pnpm test && pnpm run build'
+        : undefined),
+    executorSignature('deployment-plan', '@empire-builder-kit/nx:deployment-plan', exactOptions(() => ({ action: 'deploy', stage: 'staging' }))),
+    executorSignature('dev', '@empire-builder-kit/nx:fleet', exactOptions(() => ({})), undefined, {
+        continuous: true,
+        nonPlannableRationale: LOCAL_OWNER_ONLY_RATIONALE,
+    }),
+    executorSignature('developer-context', '@empire-builder-kit/nx:developer-context', exactOptions(() => ({}))),
+    executorSignature('dev-doctor', '@empire-builder-kit/nx:dev-doctor', exactOptions(() => ({}))),
+    executorSignature('dev-setup', '@empire-builder-kit/nx:dev-setup', exactOptions(() => ({}))),
+    executorSignature('github-bootstrap', '@empire-builder-kit/nx:github-bootstrap', exactOptions(() => ({}))),
+    executorSignature('work-markers', '@empire-builder-kit/nx:work-markers', exactOptions(() => ({}))),
+    executorSignature('secret-guardrails', '@empire-builder-kit/nx:secret-guardrails', exactOptions(() => ({}))),
+    executorSignature('secret-metadata', '@empire-builder-kit/nx:secret-metadata', exactOptions(() => ({ stage: 'development' }))),
+    executorSignature('dev-cleanup', 'nx:noop', exactOptions(() => ({})), ['db-local-down', 'secret-personal-down']),
+    executorSignature('dev', '@empire-builder-kit/nx:dev', exactOptions((input) => ({
+        cwd: input.project.root,
+        stageMode: 'consumer',
+    })), [
+        'dev-prerequisite',
+        'db-local-migrate',
+        { params: 'forward', target: 'foundation-preflight' },
+    ]),
+    executorSignature('deploy-infrastructure', '@empire-builder-kit/nx:deploy', exactOptions((input) => ({
+        cwd: input.project.root,
+        stage: 'development',
+        stageMode: 'consumer',
+    })), ['verify', { params: 'forward', target: 'foundation-ready' }]),
+    executorSignature('deploy', '@empire-builder-kit/nx:deploy', exactOptions((input) => ({
+        cwd: input.project.root,
+        stage: 'development',
+        stageMode: 'foundation',
+    })), ['verify', { params: 'forward', target: 'profile-preflight' }]),
+    executorSignature('infrastructure-plan', '@empire-builder-kit/nx:infrastructure-plan', exactOptions((input) => ({
+        action: 'deploy',
+        cwd: input.project.root,
+        stage: 'development',
+        stageMode: 'consumer',
+    }))),
+    executorSignature('infrastructure-plan', '@empire-builder-kit/nx:infrastructure-plan', exactOptions((input) => ({
+        action: 'deploy',
+        cwd: input.project.root,
+        stage: 'development',
+        stageMode: 'foundation',
+    }))),
+    ...['refresh', 'remove', 'unlock'].flatMap((targetName) => [
+        executorSignature(targetName, `@empire-builder-kit/nx:${targetName}`, exactOptions((input) => ({
+            cwd: input.project.root,
+            stage: 'development',
+            stageMode: 'consumer',
+        }))),
+        executorSignature(targetName, `@empire-builder-kit/nx:${targetName}`, exactOptions((input) => ({
+            cwd: input.project.root,
+            stage: 'development',
+            stageMode: 'foundation',
+        })), targetName === 'refresh'
+            ? [{ params: 'forward', target: 'profile-preflight' }]
+            : targetName === 'remove'
+                ? [{ params: 'forward', target: 'remove-preflight' }]
+                : undefined),
+    ]),
+    executorSignature('foundation-preflight', '@empire-builder-kit/nx:foundation-preflight', (input, options) => options['stage'] === 'development' &&
+        Array.isArray(options['capabilities']) &&
+        options['capabilities'].every((capability) => typeof capability === 'string') &&
+        typeof options['contract'] === 'string' &&
+        Object.keys(options).sort().join(',') === 'capabilities,contract,stage' &&
+        input.project.root.length > 0),
+    executorSignature('foundation-ready', '@empire-builder-kit/nx:foundation-preflight', (_input, options) => options['stage'] === 'development' &&
+        options['deployIfMissing'] === true &&
+        options['foundationProject'] === 'foundation' &&
+        Array.isArray(options['capabilities']) &&
+        options['capabilities'].every((capability) => typeof capability === 'string') &&
+        typeof options['contract'] === 'string' &&
+        Object.keys(options).sort().join(',') ===
+            'capabilities,contract,deployIfMissing,foundationProject,stage', [{ params: 'ignore', projects: ['foundation'], target: 'verify' }]),
+    executorSignature('profile-preflight', '@empire-builder-kit/nx:foundation-profile-preflight', exactOptions(() => ({ stage: 'development' }))),
+    executorSignature('remove-preflight', '@empire-builder-kit/nx:foundation-remove-preflight', exactOptions(() => ({ stage: 'development' }))),
+];
+/**
+ * Rules are deliberately ordered from highest/conservative authority to
+ * lowest. A target that is not explicitly recognized is omitted and reported
+ * as unsupported; it never inherits read-only or local-source authority.
+ * Authority describes the target's reviewed effects, not a code sandbox.
+ * Targets that load seeded or adopter-owned executable configuration belong in
+ * local-source even when their command is observational by convention.
+ */
+const TARGET_RULES = [
+    {
+        approvalRequired: true,
+        authority: 'destructive',
+        contractClasses: ['database', 'data', 'infrastructure'],
+        documentationPaths: [
+            'AGENTS.md',
+            'docs/architecture.md',
+            'docs/developer-agent.md',
+        ],
+        evidenceClasses: ['recovery-proof', 'protected-promotion-proof'],
+        matches: exact('remove', 'unlock', 'db-migrate', 'db-retirement-rehearsal', 'data-restore-reconcile', 'data-retention'),
+        requiredVerification: ['verify', 'protected-proof'],
+    },
+    {
+        approvalRequired: true,
+        authority: 'protected-mutate',
+        contractClasses: [
+            'async',
+            'configuration',
+            'data',
+            'infrastructure',
+            'reliability',
+            'release',
+        ],
+        documentationPaths: [
+            'AGENTS.md',
+            'docs/git-workflow.md',
+            'docs/developer-agent.md',
+        ],
+        evidenceClasses: ['protected-promotion-proof'],
+        matches: (targetName) => exact('async-backfill', 'async-provider-reconcile', 'async-workflow-recover', 'deploy', 'deploy-infrastructure', 'foundation-ready', 'refresh', 'release-lifecycle', 'release-rollout', 'reliability-remediation')(targetName) ||
+            (suffix('-reconcile')(targetName) &&
+                !suffix('-report', '-status')(targetName)),
+        requiredVerification: ['verify', 'protected-proof'],
+    },
+    {
+        approvalRequired: true,
+        authority: 'protected-propose',
+        contractClasses: [
+            'configuration',
+            'infrastructure',
+            'reliability',
+            'performance',
+        ],
+        documentationPaths: [
+            'AGENTS.md',
+            'docs/git-workflow.md',
+            'docs/developer-agent.md',
+        ],
+        evidenceClasses: ['protected-promotion-proof'],
+        matches: (targetName) => exact('deployment-plan', 'github-bootstrap', 'infrastructure-plan', 'infrastructure-drift', 'ecr-inspector-collect', 'performance-cost-collect', 'reliability-deployed-verify', 'reliability-diagnostic', 'reliability-exercise-collect', 'secret-metadata', 'smoke-deployed')(targetName),
+        requiredVerification: ['source', 'protected-proof'],
+    },
+    {
+        applicableStages: ['development'],
+        approvalRequired: true,
+        authority: 'development-mutate',
+        contractClasses: ['database'],
+        documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+        evidenceClasses: ['local-integration'],
+        matches: exact('test-integration'),
+        requiredVerification: ['local-integration'],
+    },
+    {
+        approvalRequired: true,
+        authority: 'development-mutate',
+        contractClasses: ['database', 'infrastructure'],
+        documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+        evidenceClasses: ['local-integration'],
+        matches: exact('dev', 'dev-cleanup', 'dev-setup', 'db-local-down', 'db-local-migrate', 'db-local-up', 'secret-personal-down'),
+        requiredVerification: ['local-integration'],
+    },
+    {
+        approvalRequired: false,
+        authority: 'local-source',
+        contractClasses: [
+            'configuration',
+            'frontend',
+            'release',
+            'synchronous',
+            'supply-chain',
+        ],
+        documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+        evidenceClasses: ['source'],
+        matches: (targetName) => exact('api-contract-baseline', 'api-contract-generate', 'authorization-check', 'build', 'configuration-expected', 'contract-dependencies-sync', 'db-generate', 'ecr-scan-applicability', 'format:check', 'frontend-visual', 'frontend-visual-update', 'install-git-hooks', 'performance-tag-coverage', 'performance-unit-cost', 'release-artifacts', 'release-candidate', 'release-manifest', 'smoke-deployed-check', 'supply-chain-scan', 'test', 'typecheck', 'verify', 'workload-role-provisioner-build')(targetName),
+        requiredVerification: ['source'],
+    },
+    {
+        approvalRequired: false,
+        authority: 'local-source',
+        documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+        evidenceClasses: ['source'],
+        matches: (targetName) => suffix('-check', '-report', '-verify')(targetName) ||
+            exact('lint')(targetName),
+        requiredVerification: ['source'],
+    },
+    {
+        approvalRequired: false,
+        authority: 'read-only',
+        documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+        evidenceClasses: ['source'],
+        matches: (targetName) => exact('blueprint-trust-check', 'developer-context', 'dev-doctor', 'dev-prerequisite', 'foundation-preflight', 'frontend-boundaries', 'health', 'performance-budget', 'performance-evidence-evaluate', 'performance-ready', 'profile-preflight', 'remove-preflight', 'secret-guardrails', 'workspace-health', 'work-markers', 'workload-role-candidate-report')(targetName) || suffix('-inventory', '-status')(targetName),
+        requiredVerification: ['source'],
+    },
+];
+/**
+ * Static invocable operations contain complete argv only. Source edits use a
+ * commandless, project-scoped identity. Stable generators use commandless
+ * typed templates that planning binds to exact normalized argv. Mutable dev
+ * configuration and human-only secret set/remove stay with their direct owner.
+ */
+function localDevOperations(projects, externalOwnedProjectNames) {
+    const sliceNames = projects
+        .map(({ context }) => context)
+        .filter(({ tags }) => tags.includes('type:slice'))
+        .map(({ name }) => name)
+        .sort();
+    const readOnly = (id, args, selectedProjects = []) => ({
+        applicableStages: ['development'],
+        approvalRequired: false,
+        authority: 'read-only',
+        command: { args, executable: 'ebk' },
+        contracts: [],
+        documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+        evidenceClasses: ['local-integration'],
+        id,
+        owner: 'ebk-reconciler',
+        projects: selectedProjects,
+        requiredVerification: ['source'],
+    });
+    const lifecycle = (command, slice) => ({
+        applicableStages: ['development'],
+        approvalRequired: true,
+        authority: 'development-mutate',
+        command: {
+            args: ['dev', command, slice, '--no-wait', '--json'],
+            executable: 'ebk',
+        },
+        contracts: [
+            { class: 'database', reference: `${slice}:database` },
+            { class: 'infrastructure', reference: `${slice}:infrastructure` },
+        ],
+        documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+        evidenceClasses: ['local-integration'],
+        id: `ebk-dev:${command}:${slice}`,
+        owner: 'ebk-reconciler',
+        policyLifecycleAction: 'dev',
+        projects: [slice],
+        requiredVerification: ['ebk-dev:doctor'],
+    });
+    return [
+        readOnly('ebk-dev:configure-show', [
+            'dev',
+            'configure',
+            '--show',
+            '--json',
+        ]),
+        readOnly('ebk-dev:doctor', ['dev', 'doctor', '--json']),
+        readOnly('ebk-dev:ps', ['dev', 'ps', '--json']),
+        readOnly('ebk-dev:status', ['dev', 'status', '--json']),
+        ...sliceNames.flatMap((slice) => [
+            readOnly(`ebk-dev:logs:${slice}`, ['dev', 'logs', slice, '--limit=200', '--json'], [slice]),
+            ...(externalOwnedProjectNames.has(slice)
+                ? []
+                : [
+                    lifecycle('up', slice),
+                    lifecycle('restart', slice),
+                    lifecycle('down', slice),
+                ]),
+        ]),
+    ];
+}
+function packageManagerOperations(workspaceVerification) {
+    return [
+        {
+            applicableStages: ALL_CANONICAL_STAGES,
+            approvalRequired: false,
+            authority: 'local-source',
+            command: {
+                args: ['install', '--frozen-lockfile'],
+                executable: 'pnpm',
+            },
+            contracts: [],
+            documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+            evidenceClasses: ['source'],
+            id: 'package-manager:install-frozen',
+            owner: 'package-manager',
+            projects: [],
+            requiredVerification: [workspaceVerification],
+        },
+    ];
+}
+function generatorOperations(workspaceVerification) {
+    const operation = (generator, mode) => ({
+        applicableStages: ALL_CANONICAL_STAGES,
+        approvalRequired: false,
+        authority: 'local-source',
+        contracts: [],
+        documentationPaths: [
+            'AGENTS.md',
+            'docs/developer-agent.md',
+            'docs/architecture.md',
+        ],
+        evidenceClasses: ['source'],
+        generator: { generator, mode },
+        id: `generator:${generator}:${mode}`,
+        owner: 'nx-generator',
+        projects: [],
+        requiredVerification: [workspaceVerification],
+    });
+    return model_js_1.DEVELOPER_AGENT_STABLE_GENERATORS.flatMap((generator) => [
+        operation(generator, 'preview'),
+        operation(generator, 'apply'),
+    ]);
+}
+function contractsForRule(rule, project) {
+    return (rule.contractClasses ?? []).map((contractClass) => ({
+        class: contractClass,
+        reference: `${project.name}:${contractClass}`,
+    }));
+}
+function authenticatedTargetSignature(input) {
+    const configurations = input.target.configurations;
+    if (input.namedInputRuntimeDetected ||
+        (configurations !== undefined &&
+            (configurations === null ||
+                typeof configurations !== 'object' ||
+                Array.isArray(configurations) ||
+                Object.keys(configurations).length > 0)) ||
+        input.target.defaultConfiguration !== undefined ||
+        (input.target.syncGenerators !== undefined &&
+            (!Array.isArray(input.target.syncGenerators) ||
+                input.target.syncGenerators.length > 0)) ||
+        (input.target.inputs !== undefined &&
+            (!Array.isArray(input.target.inputs) ||
+                containsRuntimeInput(input.target.inputs))) ||
+        !hasAuthenticatedCacheContract(input) ||
+        (input.target.parallelism !== undefined &&
+            input.target.parallelism !== true)) {
+        return undefined;
+    }
+    const options = input.target.options ?? {};
+    if (typeof options !== 'object' ||
+        options === null ||
+        Array.isArray(options)) {
+        return undefined;
+    }
+    return TARGET_SIGNATURES.find((signature) => {
+        const continuousMatches = signature.continuous
+            ? input.target.continuous === true
+            : input.target.continuous === undefined ||
+                input.target.continuous === false;
+        const metadataMatches = signature.metadataMatch
+            ? signature.metadataMatch(input, input.target.metadata)
+            : input.target.metadata === undefined;
+        return (continuousMatches &&
+            metadataMatches &&
+            signature.targetName === input.targetName &&
+            signature.executor === input.target.executor &&
+            signature.optionsMatch(input, options) &&
+            (0, node_util_1.isDeepStrictEqual)(input.target.dependsOn ?? [], signature.dependsOn?.(input) ?? []));
+    });
+}
+const CACHEABLE_TARGET_INPUTS = new Map([
+    ['build', ['production', '^production']],
+    ['lint', ['default', '^production']],
+    ['test', ['default', '^production']],
+    ['typecheck', ['default', '^production']],
+]);
+function hasAuthenticatedCacheContract(input) {
+    const cache = input.target.cache;
+    if (cache === undefined || cache === false)
+        return true;
+    if (cache !== true)
+        return false;
+    const expectedInputs = CACHEABLE_TARGET_INPUTS.get(input.targetName);
+    if (expectedInputs === undefined ||
+        !(0, node_util_1.isDeepStrictEqual)(input.target.inputs, expectedInputs)) {
+        return false;
+    }
+    if (input.targetName !== 'build')
+        return input.target.outputs === undefined;
+    return input.target.executor === 'nx:run-script'
+        ? input.target.outputs === undefined
+        : (0, node_util_1.isDeepStrictEqual)(input.target.outputs, ['{projectRoot}/web/.next']);
+}
+function containsRuntimeInput(value) {
+    if (Array.isArray(value))
+        return value.some(containsRuntimeInput);
+    if (!value || typeof value !== 'object')
+        return false;
+    if ('runtime' in value)
+        return true;
+    return Object.values(value).some(containsRuntimeInput);
+}
+function reviewedExternalTargetIsSafe(input) {
+    try {
+        (0, blueprint_trust_js_1.assertBlueprintVerificationTargetAgentSafe)(input.targetName, input.target, input.project.root);
+    }
+    catch {
+        return false;
+    }
+    const signature = authenticatedTargetSignature(input);
+    if (signature?.nonPlannableRationale !== undefined)
+        return false;
+    const rule = TARGET_RULES.find(({ matches }) => matches(input.targetName));
+    return (!operationLooksMutating(input.targetName) &&
+        (rule === undefined ||
+            rule.authority === 'local-source' ||
+            rule.authority === 'read-only'));
+}
+function reviewedExternalDependencies(input) {
+    try {
+        return [
+            ...(0, blueprint_trust_js_1.blueprintVerificationTargetDependencies)(input.targetName, input.target, input.project.root),
+        ];
+    }
+    catch {
+        return undefined;
+    }
+}
+function dependencyTargets(input, dependsOn, availableProjects, availableTargets) {
+    const targets = [];
+    for (const dependency of dependsOn) {
+        if (typeof dependency === 'string') {
+            if (dependency.startsWith('^')) {
+                const targetName = dependency.slice(1);
+                if (targetName.length === 0)
+                    return undefined;
+                for (const projectName of input.project.dependencies) {
+                    // Nx skips a ^target for dependency projects that do not define it.
+                    // Requiring the dependency project in the inspected selection first
+                    // distinguishes that legitimate absence from an omitted graph node.
+                    if (availableProjects !== undefined &&
+                        !availableProjects.has(projectName)) {
+                        return undefined;
+                    }
+                    const id = `${projectName}:${targetName}`;
+                    if (availableTargets === undefined || availableTargets.has(id)) {
+                        targets.push({ id, params: 'ignore' });
+                    }
+                }
+            }
+            else {
+                targets.push({
+                    id: `${input.project.name}:${dependency}`,
+                    params: 'ignore',
+                });
+            }
+            continue;
+        }
+        if (!dependency ||
+            typeof dependency !== 'object' ||
+            typeof dependency.target !== 'string') {
+            return undefined;
+        }
+        if (Array.isArray(dependency.projects)) {
+            if (dependency.projects.length === 0 ||
+                dependency.projects.some((projectName) => typeof projectName !== 'string')) {
+                return undefined;
+            }
+            targets.push(...dependency.projects.map((projectName) => ({
+                id: `${projectName}:${dependency.target}`,
+                params: dependency.params === 'forward' ? 'forward' : 'ignore',
+            })));
+            continue;
+        }
+        if (dependency.dependencies === true) {
+            for (const projectName of input.project.dependencies) {
+                if (availableProjects !== undefined &&
+                    !availableProjects.has(projectName)) {
+                    return undefined;
+                }
+                const id = `${projectName}:${dependency.target}`;
+                if (availableTargets === undefined || availableTargets.has(id)) {
+                    targets.push({
+                        id,
+                        params: dependency.params === 'forward' ? 'forward' : 'ignore',
+                    });
+                }
+            }
+            continue;
+        }
+        targets.push({
+            id: `${input.project.name}:${dependency.target}`,
+            params: dependency.params === 'forward' ? 'forward' : 'ignore',
+        });
+    }
+    return targets;
+}
+function configuredCanonicalStage(input) {
+    const stage = input.target.options &&
+        typeof input.target.options === 'object' &&
+        input.target.options['stage'];
+    return stage === 'development' ||
+        stage === 'staging' ||
+        stage === 'production'
+        ? stage
+        : undefined;
+}
+function operationForTarget(input, forwardedStage, reviewedExternal = false) {
+    if (reviewedExternal) {
+        return {
+            applicableStages: ALL_CANONICAL_STAGES,
+            approvalRequired: false,
+            authority: 'local-source',
+            command: {
+                args: ['nx', 'run', `${input.project.name}:${input.targetName}`],
+                executable: 'pnpm',
+            },
+            contracts: [
+                {
+                    class: 'supply-chain',
+                    reference: `${input.project.name}:external-blueprint-verification`,
+                },
+            ],
+            documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+            evidenceClasses: ['source'],
+            id: `target:${input.project.name}:${input.targetName}`,
+            owner: 'nx-target',
+            projects: [input.project.name],
+            requiredVerification: ['source'],
+        };
+    }
+    const rule = TARGET_RULES.find(({ matches }) => matches(input.targetName));
+    if (!rule || !authenticatedTargetSignature(input))
+        return undefined;
+    const configuredStage = configuredCanonicalStage(input);
+    const effectiveStage = forwardedStage ?? configuredStage;
+    const policyLifecycleAction = policyLifecycleActionForTarget(input.targetName);
+    const developmentLifecycle = effectiveStage === 'development' &&
+        policyLifecycleAction !== undefined &&
+        (rule.authority === 'protected-mutate' || rule.authority === 'destructive');
+    const authority = developmentLifecycle
+        ? 'development-mutate'
+        : rule.authority;
+    if (effectiveStage !== undefined &&
+        rule.applicableStages !== undefined &&
+        !rule.applicableStages.includes(effectiveStage)) {
+        return undefined;
+    }
+    if ((effectiveStage === 'staging' || effectiveStage === 'production') &&
+        authority === 'development-mutate') {
+        return undefined;
+    }
+    const applicableStages = effectiveStage !== undefined
+        ? [effectiveStage]
+        : rule.applicableStages
+            ? rule.applicableStages
+            : authority === 'development-mutate'
+                ? ['development']
+                : authority === 'protected-mutate' || authority === 'destructive'
+                    ? PROTECTED_CANONICAL_STAGES
+                    : ALL_CANONICAL_STAGES;
+    return {
+        applicableStages,
+        approvalRequired: developmentLifecycle ? true : rule.approvalRequired,
+        authority,
+        ...(authority === 'protected-mutate' || authority === 'destructive'
+            ? {}
+            : {
+                command: {
+                    args: ['nx', 'run', `${input.project.name}:${input.targetName}`],
+                    executable: 'pnpm',
+                },
+            }),
+        contracts: contractsForRule(rule, input.project),
+        documentationPaths: [...rule.documentationPaths],
+        evidenceClasses: [...rule.evidenceClasses],
+        id: `target:${input.project.name}:${input.targetName}`,
+        owner: input.target.executor?.startsWith('@empire-builder-kit/nx:') === true
+            ? 'ebk-reconciler'
+            : 'nx-target',
+        ...(policyLifecycleAction ? { policyLifecycleAction } : {}),
+        projects: [input.project.name],
+        requiredVerification: [...rule.requiredVerification],
+    };
+}
+/**
+ * Authority classes are not a severity list. In particular, development
+ * mutation plus protected proposal crosses authority domains and therefore
+ * requires protected mutation authority. Keep the join explicit so a newly
+ * added class or unmodeled pair fails closed instead of inheriting an ordinal.
+ */
+function joinDeveloperAgentAuthorityClasses(left, right) {
+    if (left === right)
+        return left;
+    if (left === 'destructive' || right === 'destructive')
+        return 'destructive';
+    if (left === 'protected-mutate' || right === 'protected-mutate') {
+        return 'protected-mutate';
+    }
+    if (left === 'read-only')
+        return right;
+    if (right === 'read-only')
+        return left;
+    if ((left === 'local-source' && right === 'development-mutate') ||
+        (right === 'local-source' && left === 'development-mutate')) {
+        return 'development-mutate';
+    }
+    if ((left === 'local-source' && right === 'protected-propose') ||
+        (right === 'local-source' && left === 'protected-propose')) {
+        return 'protected-propose';
+    }
+    if ((left === 'development-mutate' && right === 'protected-propose') ||
+        (right === 'development-mutate' && left === 'protected-propose')) {
+        return 'protected-mutate';
+    }
+    return undefined;
+}
+function intersectApplicableStages(members) {
+    return ALL_CANONICAL_STAGES.filter((stage) => members.every(({ applicableStages }) => applicableStages.includes(stage)));
+}
+function composeTargetOperation(operation, dependencies) {
+    const members = [operation, ...dependencies];
+    let authority = operation.authority;
+    for (const candidate of dependencies) {
+        authority =
+            authority === undefined
+                ? undefined
+                : joinDeveloperAgentAuthorityClasses(authority, candidate.authority);
+    }
+    const applicableStages = intersectApplicableStages(members);
+    if (authority === undefined || applicableStages.length === 0) {
+        return undefined;
+    }
+    const contracts = new Map();
+    for (const contract of members.flatMap((candidate) => candidate.contracts)) {
+        contracts.set(`${contract.class}\u0000${contract.reference}`, contract);
+    }
+    const commandAllowed = authority !== 'protected-mutate' && authority !== 'destructive';
+    const { command: owningCommand, ...operationWithoutCommand } = operation;
+    return {
+        ...operationWithoutCommand,
+        applicableStages,
+        approvalRequired: members.some((candidate) => candidate.approvalRequired),
+        authority,
+        ...(commandAllowed && owningCommand ? { command: owningCommand } : {}),
+        contracts: [...contracts.values()].sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.class, right.class) ||
+            (0, ordering_js_1.compareDeveloperAgentStrings)(left.reference, right.reference)),
+        documentationPaths: [
+            ...new Set(members.flatMap((candidate) => candidate.documentationPaths)),
+        ].sort(),
+        evidenceClasses: [
+            ...new Set(members.flatMap((candidate) => candidate.evidenceClasses)),
+        ].sort(),
+        projects: [
+            ...new Set(members.flatMap((candidate) => candidate.projects)),
+        ].sort(),
+        requiredVerification: [
+            ...new Set(members.flatMap((candidate) => candidate.requiredVerification)),
+        ].sort(),
+    };
+}
+function sourceEditOperations(projects, authenticatedTargets, workspaceVerification) {
+    return projects.flatMap(({ context }) => {
+        const projectVerification = `${context.name}:verify`;
+        const requiredVerification = context.targets.includes('verify')
+            ? authenticatedTargets.has(projectVerification)
+                ? projectVerification
+                : undefined
+            : workspaceVerification;
+        if (!requiredVerification)
+            return [];
+        return [
+            {
+                applicableStages: ALL_CANONICAL_STAGES,
+                approvalRequired: false,
+                authority: 'local-source',
+                contracts: [],
+                documentationPaths: ['AGENTS.md', 'docs/developer-agent.md'],
+                evidenceClasses: ['source'],
+                id: `source-edit:${context.name}`,
+                owner: 'source-edit',
+                projects: [context.name],
+                requiredVerification: [requiredVerification],
+            },
+        ];
+    });
+}
+function createDeveloperAgentOperationRegistry(projects, options) {
+    const namedInputRuntimeDetected = options.namedInputDefinitions.some(containsRuntimeInput);
+    const exposedProjectNames = new Set(options.exposedProjectNames ?? projects.map(({ context }) => context.name));
+    const externalOwnedProjectNames = new Set(options.externalOwnedProjectNames);
+    const exposedProjects = projects.filter(({ context }) => exposedProjectNames.has(context.name));
+    const operations = [
+        ...localDevOperations(exposedProjects, externalOwnedProjectNames),
+    ];
+    const nonPlannableTargets = [];
+    const unsupportedTargets = [];
+    const orderedProjects = [...projects].sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.context.name, right.context.name));
+    const targetInputs = new Map();
+    for (const project of orderedProjects) {
+        for (const [targetName, target] of Object.entries(project.targets)) {
+            targetInputs.set(`${project.context.name}:${targetName}`, {
+                namedInputRuntimeDetected,
+                project: project.context,
+                target,
+                targetName,
+            });
+        }
+    }
+    const availableProjects = new Set(orderedProjects.map(({ context }) => context.name));
+    const availableTargets = new Set(targetInputs.keys());
+    const reviewedExternalTargets = new Set();
+    for (const review of options.reviewedExternalVerification ?? []) {
+        if (!externalOwnedProjectNames.has(review.project))
+            continue;
+        const project = orderedProjects.find(({ context }) => context.name === review.project);
+        if (!project)
+            continue;
+        let actual;
+        try {
+            actual = (0, blueprint_trust_js_1.blueprintVerificationTargetClosure)({
+                projectRoot: project.context.root,
+                roots: review.roots,
+                targets: project.targets,
+            });
+        }
+        catch {
+            continue;
+        }
+        if (!(0, node_util_1.isDeepStrictEqual)(actual, review.verificationTargets) ||
+            actual.some(({ name }) => {
+                const input = targetInputs.get(`${review.project}:${name}`);
+                return input === undefined || !reviewedExternalTargetIsSafe(input);
+            })) {
+            continue;
+        }
+        for (const { name } of actual) {
+            reviewedExternalTargets.add(`${review.project}:${name}`);
+        }
+    }
+    const authentication = new Map();
+    const authenticate = (id, active) => {
+        const memoized = authentication.get(id);
+        if (memoized !== undefined)
+            return memoized;
+        if (active.has(id)) {
+            authentication.set(id, false);
+            return false;
+        }
+        const input = targetInputs.get(id);
+        if (!input) {
+            authentication.set(id, false);
+            return false;
+        }
+        if (input.namedInputRuntimeDetected) {
+            authentication.set(id, false);
+            return false;
+        }
+        const signature = authenticatedTargetSignature(input);
+        const reviewedExternal = reviewedExternalTargets.has(id);
+        if (externalOwnedProjectNames.has(input.project.name) &&
+            !reviewedExternal) {
+            authentication.set(id, false);
+            return false;
+        }
+        if (!reviewedExternal &&
+            (!signature ||
+                signature.nonPlannableRationale !== undefined ||
+                !TARGET_RULES.some(({ matches }) => matches(input.targetName)))) {
+            authentication.set(id, false);
+            return false;
+        }
+        const reviewedDependencies = reviewedExternal
+            ? reviewedExternalDependencies(input)
+            : undefined;
+        const dependencies = dependencyTargets(input, reviewedExternal
+            ? (reviewedDependencies ?? [])
+            : (signature?.dependsOn?.(input) ?? []), availableProjects, availableTargets);
+        if (reviewedExternal && reviewedDependencies === undefined) {
+            authentication.set(id, false);
+            return false;
+        }
+        if (!dependencies) {
+            authentication.set(id, false);
+            return false;
+        }
+        const nextActive = new Set(active);
+        nextActive.add(id);
+        const authenticated = dependencies.every((dependency) => authenticate(dependency.id, nextActive));
+        authentication.set(id, authenticated);
+        return authenticated;
+    };
+    const composedInvocations = new Map();
+    const composeInvocation = (id, forwardedStage) => {
+        const memoKey = `${id}\u0000${forwardedStage ?? ''}`;
+        const memoized = composedInvocations.get(memoKey);
+        if (memoized !== undefined)
+            return memoized ?? undefined;
+        if (!authenticate(id, new Set())) {
+            composedInvocations.set(memoKey, null);
+            return undefined;
+        }
+        const input = targetInputs.get(id);
+        if (!input) {
+            composedInvocations.set(memoKey, null);
+            return undefined;
+        }
+        const signature = authenticatedTargetSignature(input);
+        const reviewedExternal = reviewedExternalTargets.has(id);
+        const operation = operationForTarget(input, forwardedStage, reviewedExternal);
+        const reviewedDependencies = reviewedExternal
+            ? reviewedExternalDependencies(input)
+            : undefined;
+        const dependencyTargetsForOperation = reviewedExternal
+            ? reviewedDependencies === undefined
+                ? undefined
+                : dependencyTargets(input, reviewedDependencies, availableProjects, availableTargets)
+            : signature
+                ? dependencyTargets(input, signature.dependsOn?.(input) ?? [], availableProjects, availableTargets)
+                : undefined;
+        if (!operation || !dependencyTargetsForOperation) {
+            composedInvocations.set(memoKey, null);
+            return undefined;
+        }
+        const dependencies = dependencyTargetsForOperation.map((dependency) => {
+            const composed = composeInvocation(dependency.id, dependency.params === 'forward' ? forwardedStage : undefined);
+            if (!composed)
+                return undefined;
+            // Nx forwards CLI overrides only across params:forward. A dependency
+            // with ignored params runs under its independently authenticated stage,
+            // so it contributes authority and evidence without constraining the
+            // forwarded parent stage. Without a forwarded stage, ordinary aggregate
+            // targets share a stage domain and are intersected normally.
+            return forwardedStage !== undefined && dependency.params === 'ignore'
+                ? { ...composed, applicableStages: operation.applicableStages }
+                : composed;
+        });
+        if (dependencies.some((dependency) => dependency === undefined)) {
+            composedInvocations.set(memoKey, null);
+            return undefined;
+        }
+        const composed = composeTargetOperation(operation, dependencies);
+        composedInvocations.set(memoKey, composed ?? null);
+        return composed;
+    };
+    const compose = (id) => {
+        const input = targetInputs.get(id);
+        const direct = input
+            ? operationForTarget(input, undefined, reviewedExternalTargets.has(id))
+            : undefined;
+        if (!input || !direct)
+            return undefined;
+        // A protected lifecycle target without a configured stage receives its
+        // canonical stage as a CLI override. Nx then propagates that value only
+        // through params:forward edges. Compose each exact stage variant and merge
+        // their stage availability; all other targets use their configured/default
+        // invocation and a literal dependency-stage intersection.
+        if (configuredCanonicalStage(input) === undefined &&
+            direct.policyLifecycleAction !== undefined &&
+            (direct.authority === 'protected-mutate' ||
+                direct.authority === 'destructive')) {
+            const variants = direct.applicableStages
+                .map((stage) => composeInvocation(id, stage))
+                .filter((operation) => operation !== undefined);
+            if (variants.length === 0)
+                return undefined;
+            const applicableStages = ALL_CANONICAL_STAGES.filter((stage) => variants.some((operation) => operation.applicableStages.includes(stage)));
+            const merged = composeTargetOperation({ ...variants[0], applicableStages }, variants.slice(1).map((operation) => ({
+                ...operation,
+                applicableStages,
+            })));
+            return merged ? { ...merged, applicableStages } : undefined;
+        }
+        return composeInvocation(id, undefined);
+    };
+    const workspaceProjects = orderedProjects.filter(({ context }) => context.tags.includes('scope:workspace'));
+    let workspaceVerification;
+    if (workspaceProjects.length === 1) {
+        const candidate = `${workspaceProjects[0].context.name}:verify`;
+        if (compose(candidate)) {
+            workspaceVerification = candidate;
+            operations.push(...generatorOperations(candidate), ...packageManagerOperations(candidate));
+        }
+    }
+    const authenticatedTargets = new Set([...targetInputs.keys()].filter((target) => compose(target) !== undefined));
+    operations.push(...sourceEditOperations(exposedProjects, authenticatedTargets, workspaceVerification));
+    for (const project of orderedProjects) {
+        if (!exposedProjectNames.has(project.context.name))
+            continue;
+        for (const [targetName] of Object.entries(project.targets).sort(([left], [right]) => (0, ordering_js_1.compareDeveloperAgentStrings)(left, right))) {
+            const target = `${project.context.name}:${targetName}`;
+            const input = targetInputs.get(target);
+            const signature = input ? authenticatedTargetSignature(input) : undefined;
+            if (signature?.nonPlannableRationale &&
+                !externalOwnedProjectNames.has(project.context.name)) {
+                nonPlannableTargets.push({
+                    rationale: signature.nonPlannableRationale,
+                    target,
+                });
+                continue;
+            }
+            const operation = compose(target);
+            if (operation)
+                operations.push(operation);
+            else
+                unsupportedTargets.push(target);
+        }
+    }
+    operations.sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.id, right.id));
+    nonPlannableTargets.sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.target, right.target));
+    unsupportedTargets.sort();
+    return {
+        authenticatedTargets: [...authenticatedTargets].sort(ordering_js_1.compareDeveloperAgentStrings),
+        nonPlannableTargets,
+        operations,
+        unsupportedTargets,
+    };
+}
+function requireDeveloperAgentOperation(registry, id) {
+    const operation = registry.operations.find((candidate) => candidate.id === id);
+    if (!operation) {
+        throw new DeveloperAgentOperationRegistryError();
+    }
+    return operation;
+}
+function operationLooksMutating(targetName) {
+    return containsSegment('apply', 'backfill', 'cleanup', 'deploy', 'generate', 'migrate', 'reconcile', 'recover', 'refresh', 'remove', 'retire', 'rollout', 'setup', 'sync', 'unlock', 'update', 'up')(targetName);
+}
+//# sourceMappingURL=operation-registry.js.map