@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/executors/infrastructure-plan/infrastructure-plan.js

@@ -0,0 +1,3320 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractPrivateImportIdentifierDigests = extractPrivateImportIdentifierDigests;
+exports.approvalCandidateSourceCommit = approvalCandidateSourceCommit;
+exports.createCandidateBoundSstChildEnvironment = createCandidateBoundSstChildEnvironment;
+exports.assessPulumiRefreshPreview = assessPulumiRefreshPreview;
+exports.standardRemoveProbeForResource = standardRemoveProbeForResource;
+exports.probeStandardRemoveResource = probeStandardRemoveResource;
+exports.observeInfrastructureState = observeInfrastructureState;
+exports.validateGovernanceEvidence = validateGovernanceEvidence;
+exports.runInfrastructurePlanExecutor = runInfrastructurePlanExecutor;
+exports.revalidateInfrastructureMutationAuthorization = revalidateInfrastructureMutationAuthorization;
+exports.recordInfrastructureMutationConvergence = recordInfrastructureMutationConvergence;
+exports.finalizeInfrastructureMutationConvergence = finalizeInfrastructureMutationConvergence;
+const deterministic_order_js_1 = require("../../deterministic-order.js");
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+const devkit_1 = require("@nx/devkit");
+const canonical_json_1 = require("@empire-builder-kit/runtime/canonical-json");
+const index_js_1 = require("../../infrastructure-change/index.js");
+const index_js_2 = require("../../repository-policy/index.js");
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+function repositoryInfrastructureApprovalMode(context, stage) {
+    return stage === 'production'
+        ? (0, index_js_2.readRepositoryOperatingPolicy)(context.root).productionApproval.mode
+        : 'promotion-pr';
+}
+function projectEvidence(context, projects) {
+    return Object.fromEntries(projects.map((project) => {
+        const configured = context.projectsConfigurations?.projects[project]?.root;
+        if (!configured) {
+            throw new Error(`Infrastructure plan summary references unknown project ${project}.`);
+        }
+        const evidenceDirectory = (0, node_path_1.join)((0, node_path_1.isAbsolute)(configured) ? configured : (0, node_path_1.join)(context.root, configured), '.ebk', 'evidence');
+        return [
+            project,
+            {
+                authorization: record(readJsonFile((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan-authorization.json'), `${project} infrastructure authorization`), `${project} infrastructure authorization`),
+                plan: record(readJsonFile((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.json'), `${project} infrastructure plan`), `${project} infrastructure plan`),
+            },
+        ];
+    }));
+}
+const SHA256 = /^[a-f0-9]{64}$/;
+const SOURCE_COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const MAX_JSON_BYTES = 5 * 1024 * 1024;
+const STANDARD_REMOVE_CLOUD_CONTROL_TYPES = {
+    'aws:acm/certificate:Certificate': 'AWS::CertificateManager::Certificate',
+    'aws:apigatewayv2/api:Api': 'AWS::ApiGatewayV2::Api',
+    'aws:apigatewayv2/apiMapping:ApiMapping': 'AWS::ApiGatewayV2::ApiMapping',
+    'aws:apigatewayv2/authorizer:Authorizer': 'AWS::ApiGatewayV2::Authorizer',
+    'aws:apigatewayv2/domainName:DomainName': 'AWS::ApiGatewayV2::DomainName',
+    'aws:apigatewayv2/integration:Integration': 'AWS::ApiGatewayV2::Integration',
+    'aws:apigatewayv2/route:Route': 'AWS::ApiGatewayV2::Route',
+    'aws:apigatewayv2/stage:Stage': 'AWS::ApiGatewayV2::Stage',
+    'aws:appconfig/application:Application': 'AWS::AppConfig::Application',
+    'aws:appconfig/configurationProfile:ConfigurationProfile': 'AWS::AppConfig::ConfigurationProfile',
+    'aws:appconfig/deployment:Deployment': 'AWS::AppConfig::Deployment',
+    'aws:appconfig/deploymentStrategy:DeploymentStrategy': 'AWS::AppConfig::DeploymentStrategy',
+    'aws:appconfig/environment:Environment': 'AWS::AppConfig::Environment',
+    'aws:appconfig/hostedConfigurationVersion:HostedConfigurationVersion': 'AWS::AppConfig::HostedConfigurationVersion',
+    'aws:cloudformation/stack:Stack': 'AWS::CloudFormation::Stack',
+    'aws:cloudfront/cachePolicy:CachePolicy': 'AWS::CloudFront::CachePolicy',
+    'aws:cloudfront/distribution:Distribution': 'AWS::CloudFront::Distribution',
+    'aws:cloudfront/function:Function': 'AWS::CloudFront::Function',
+    'aws:cloudfront/originAccessControl:OriginAccessControl': 'AWS::CloudFront::OriginAccessControl',
+    'aws:cloudfront/originRequestPolicy:OriginRequestPolicy': 'AWS::CloudFront::OriginRequestPolicy',
+    'aws:cloudfront/responseHeadersPolicy:ResponseHeadersPolicy': 'AWS::CloudFront::ResponseHeadersPolicy',
+    'aws:cloudwatch/dashboard:Dashboard': 'AWS::CloudWatch::Dashboard',
+    'aws:cloudwatch/eventRule:EventRule': 'AWS::Events::Rule',
+    'aws:cloudwatch/logGroup:LogGroup': 'AWS::Logs::LogGroup',
+    'aws:cloudwatch/metricAlarm:MetricAlarm': 'AWS::CloudWatch::Alarm',
+    'aws:cognito/userPool:UserPool': 'AWS::Cognito::UserPool',
+    'aws:cognito/userPoolClient:UserPoolClient': 'AWS::Cognito::UserPoolClient',
+    'aws:dynamodb/table:Table': 'AWS::DynamoDB::Table',
+    'aws:ec2/eip:Eip': 'AWS::EC2::EIP',
+    'aws:ec2/internetGateway:InternetGateway': 'AWS::EC2::InternetGateway',
+    'aws:ec2/natGateway:NatGateway': 'AWS::EC2::NatGateway',
+    'aws:ec2/route:Route': 'AWS::EC2::Route',
+    'aws:ec2/routeTable:RouteTable': 'AWS::EC2::RouteTable',
+    'aws:ec2/securityGroup:SecurityGroup': 'AWS::EC2::SecurityGroup',
+    'aws:ec2/subnet:Subnet': 'AWS::EC2::Subnet',
+    'aws:ec2/vpc:Vpc': 'AWS::EC2::VPC',
+    'aws:ecr/repository:Repository': 'AWS::ECR::Repository',
+    'aws:ecs/cluster:Cluster': 'AWS::ECS::Cluster',
+    'aws:ecs/service:Service': 'AWS::ECS::Service',
+    'aws:ecs/taskDefinition:TaskDefinition': 'AWS::ECS::TaskDefinition',
+    'aws:events/archive:Archive': 'AWS::Events::Archive',
+    'aws:events/eventBus:EventBus': 'AWS::Events::EventBus',
+    'aws:events/rule:Rule': 'AWS::Events::Rule',
+    'aws:iam/instanceProfile:InstanceProfile': 'AWS::IAM::InstanceProfile',
+    'aws:iam/managedPolicy:ManagedPolicy': 'AWS::IAM::ManagedPolicy',
+    'aws:iam/policy:Policy': 'AWS::IAM::ManagedPolicy',
+    'aws:iam/role:Role': 'AWS::IAM::Role',
+    'aws:lambda/function:Function': 'AWS::Lambda::Function',
+    'aws:lambda/layerVersion:LayerVersion': 'AWS::Lambda::LayerVersion',
+    'aws:lb/loadBalancer:LoadBalancer': 'AWS::ElasticLoadBalancingV2::LoadBalancer',
+    'aws:lb/listener:Listener': 'AWS::ElasticLoadBalancingV2::Listener',
+    'aws:lb/targetGroup:TargetGroup': 'AWS::ElasticLoadBalancingV2::TargetGroup',
+    'aws:rds/cluster:Cluster': 'AWS::RDS::DBCluster',
+    'aws:rds/clusterInstance:ClusterInstance': 'AWS::RDS::DBInstance',
+    'aws:rds/subnetGroup:SubnetGroup': 'AWS::RDS::DBSubnetGroup',
+    'aws:sfn/stateMachine:StateMachine': 'AWS::StepFunctions::StateMachine',
+    'aws:sns/topic:Topic': 'AWS::SNS::Topic',
+    'aws:sqs/queue:Queue': 'AWS::SQS::Queue',
+};
+function digest(value) {
+    return (0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
+}
+function requiredEnvironment(environment, name, pattern) {
+    const value = environment[name]?.trim();
+    if (!value || (pattern && !pattern.test(value))) {
+        throw new Error(`${name} is missing or invalid.`);
+    }
+    return value;
+}
+function parseJson(value, label) {
+    if (Buffer.byteLength(value, 'utf8') > MAX_JSON_BYTES) {
+        throw new Error(`${label} exceeds the 5 MiB metadata limit.`);
+    }
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        throw new Error(`${label} is not valid JSON.`);
+    }
+}
+function record(value, label) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error(`${label} must be one JSON object.`);
+    }
+    return value;
+}
+function requireExactKeys(value, keys, label) {
+    if (JSON.stringify(Object.keys(value).sort()) !==
+        JSON.stringify([...keys].sort())) {
+        throw new Error(`${label} has an invalid exact field set.`);
+    }
+}
+function infrastructureResourceKey(input) {
+    return `${input.logicalId}\u0000${input.resourceType}`;
+}
+/**
+ * Reads the Pulumi StepEventStateMetadata `new.id` emitted by SST's pinned
+ * JSON diff for imports. Only its digest leaves this private boundary.
+ */
+function extractPrivateImportIdentifierDigests(diffStdout, diff) {
+    const imports = diff.resources.filter(({ operation }) => operation === 'import');
+    if (imports.length === 0)
+        return {};
+    const raw = parseJson(diffStdout, 'SST import diff');
+    if (!Array.isArray(raw)) {
+        throw new Error('SST import diff does not expose an exact private import identifier.');
+    }
+    const identifiers = {};
+    for (const resource of imports) {
+        const entry = raw[resource.sourceIndex];
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            throw new Error(`Infrastructure import ${resource.logicalId} does not expose an exact private import identifier.`);
+        }
+        const next = entry['new'];
+        if (typeof next !== 'object' || next === null || Array.isArray(next)) {
+            throw new Error(`Infrastructure import ${resource.logicalId} does not expose an exact private import identifier.`);
+        }
+        const identifier = next['id'];
+        if (typeof identifier !== 'string' || identifier.trim().length === 0) {
+            throw new Error(`Infrastructure import ${resource.logicalId} does not expose an exact private import identifier.`);
+        }
+        const key = infrastructureResourceKey(resource);
+        if (identifiers[key]) {
+            throw new Error(`Infrastructure import ${resource.logicalId} has an ambiguous private import identifier.`);
+        }
+        identifiers[key] = digest(identifier);
+    }
+    return Object.fromEntries(Object.entries(identifiers).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right)));
+}
+function stringArray(value, label) {
+    if (!Array.isArray(value) ||
+        value.some((entry) => typeof entry !== 'string' || entry.length === 0)) {
+        throw new Error(`${label} must be an array of non-empty strings.`);
+    }
+    return [...new Set(value)].sort();
+}
+function readJsonFile(path, label) {
+    return parseJson((0, node_fs_1.readFileSync)(path, 'utf8'), label);
+}
+function projectRoot(context, options) {
+    const configured = options.cwd ??
+        (context.projectName
+            ? context.projectsConfigurations?.projects[context.projectName]?.root
+            : undefined) ??
+        context.root;
+    return (0, node_path_1.isAbsolute)(configured) ? configured : (0, node_path_1.join)(context.root, configured);
+}
+function relativeFile(root, value) {
+    if ((0, node_path_1.isAbsolute)(value)) {
+        throw new Error('Infrastructure metadata paths must be project-relative.');
+    }
+    const absoluteRoot = (0, node_path_1.resolve)(root);
+    const result = (0, node_path_1.resolve)(absoluteRoot, value);
+    const relativePath = (0, node_path_1.relative)(absoluteRoot, result);
+    if (relativePath === '..' ||
+        relativePath.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`) ||
+        (0, node_path_1.isAbsolute)(relativePath)) {
+        throw new Error('Infrastructure metadata paths must remain in the project.');
+    }
+    return result;
+}
+function readDescriptor(path, project) {
+    const raw = (0, node_fs_1.readFileSync)(path, 'utf8');
+    const descriptor = record(parseJson(raw, 'Infrastructure descriptor'), 'Infrastructure descriptor');
+    const descriptorProject = descriptor.project ?? descriptor.slice;
+    if (descriptor.schemaVersion !== 1 ||
+        descriptorProject !== project ||
+        descriptor.planner?.version !== index_js_1.SST_DIFF_TOOL_VERSION) {
+        throw new Error(`Infrastructure descriptor must bind ${project} to SST ${index_js_1.SST_DIFF_TOOL_VERSION}.`);
+    }
+    const policy = descriptor.policy;
+    if (!policy) {
+        throw new Error('Infrastructure descriptor omitted its risk policy.');
+    }
+    return {
+        policy: {
+            additiveLowRiskTypes: stringArray(policy.additiveLowRiskTypes, 'policy.additiveLowRiskTypes'),
+            costOrQuotaTypes: stringArray(policy.costOrQuotaTypes, 'policy.costOrQuotaTypes'),
+            statefulTypes: stringArray(policy.statefulTypes, 'policy.statefulTypes'),
+        },
+        raw,
+        standingPolicyRiskClasses: stringArray(policy.standingPolicyRiskClasses, 'policy.standingPolicyRiskClasses'),
+    };
+}
+function readOptionalArray(environment, name) {
+    const path = environment[name]?.trim();
+    if (!path)
+        return [];
+    const value = readJsonFile(path, name);
+    if (!Array.isArray(value)) {
+        throw new Error(`${name} must reference one JSON array.`);
+    }
+    return value;
+}
+function planAuthorityPolicyDigest(environment) {
+    const parseArray = (name) => {
+        const raw = requiredEnvironment(environment, name);
+        if (Buffer.byteLength(raw, 'utf8') > 128 * 1024) {
+            throw new Error(`${name} exceeds the bounded authority metadata size.`);
+        }
+        const value = parseJson(raw, name);
+        if (Array.isArray(value) && value.length > 0)
+            return value;
+        throw new Error(`${name} must contain one non-empty exact JSON array.`);
+    };
+    const providerPolicy = parseArray('AWS_PLAN_PROVIDER_REFRESH_POLICY_JSON');
+    if (providerPolicy.some((statement) => typeof statement !== 'object' ||
+        statement === null ||
+        Array.isArray(statement))) {
+        throw new Error('AWS_PLAN_PROVIDER_REFRESH_POLICY_JSON must contain exact policy statements.');
+    }
+    return digest(canonicalJson({
+        applications: parseArray('AWS_PLAN_SST_APPS_JSON'),
+        generatedObjectArns: parseArray('AWS_PLAN_GENERATED_OBJECT_ARNS_JSON'),
+        generatedParameterArns: parseArray('AWS_PLAN_GENERATED_PARAMETER_ARNS_JSON'),
+        generatedSecretArns: parseArray('AWS_PLAN_GENERATED_SECRET_ARNS_JSON'),
+        planRoleArn: requiredEnvironment(environment, 'AWS_PLAN_ROLE_ARN', /^arn:aws:iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/),
+        providerPolicy,
+        stateBucketArn: requiredEnvironment(environment, 'AWS_PLAN_STATE_BUCKET_ARN', /^arn:aws:s3:::[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/),
+        stateKmsKeyArn: requiredEnvironment(environment, 'AWS_PLAN_STATE_KMS_KEY_ARN', /^arn:aws:kms:[a-z0-9-]+:\d{12}:key\/[A-Za-z0-9-]+$/),
+    }));
+}
+function frameworkVersion(root) {
+    const value = record(readJsonFile((0, node_path_1.join)(root, 'node_modules', '@empire-builder-kit', 'nx', 'package.json'), '@empire-builder-kit/nx package metadata'), '@empire-builder-kit/nx package metadata');
+    if (typeof value['version'] !== 'string' || !value['version']) {
+        throw new Error('Installed framework version is missing.');
+    }
+    return value['version'];
+}
+function releaseCandidateBinding(input) {
+    const path = (0, node_path_1.join)(input.workspaceRoot, '.ebk', 'evidence', 'release-candidate', 'packages', input.project, 'candidate.json');
+    if (!(0, node_fs_1.existsSync)(path)) {
+        throw new Error(`Exact immutable release candidate is absent for ${input.project}.`);
+    }
+    const raw = (0, node_fs_1.readFileSync)(path, 'utf8');
+    const candidate = record(parseJson(raw, `${input.project} release candidate`), `${input.project} release candidate`);
+    const provenance = record(candidate['provenance'], `${input.project} release candidate provenance`);
+    if (candidate['kind'] !== 'ebk-release-candidate' ||
+        candidate['schemaVersion'] !== 1 ||
+        candidate['slice'] !== input.project ||
+        candidate['sourceCommit'] !== input.sourceCommit ||
+        provenance['kind'] !== 'ebk-release-candidate-provenance' ||
+        provenance['schemaVersion'] !== 1 ||
+        provenance['repository'] !== input.repository ||
+        provenance['sourceCommit'] !== input.sourceCommit) {
+        throw new Error(`Release candidate for ${input.project} does not bind the exact source and repository.`);
+    }
+    return { digest: digest(raw), path };
+}
+/** @internal */
+function approvalCandidateSourceCommit(context, options, environment) {
+    const project = context.projectName;
+    const selectedSource = environment['EBK_RELEASE_SOURCE_COMMIT']?.trim();
+    if (selectedSource !== undefined && !SOURCE_COMMIT.test(selectedSource)) {
+        throw new Error('EBK_RELEASE_SOURCE_COMMIT must be one exact Git object ID when set.');
+    }
+    if (!project)
+        return selectedSource;
+    const approvalPath = relativeFile(context.root, options.approvalPath ?? 'operations/infrastructure-approval.json');
+    if (!(0, node_fs_1.existsSync)(approvalPath))
+        return selectedSource;
+    let batch;
+    try {
+        batch = record(readJsonFile(approvalPath, 'Infrastructure approval candidate binding'), 'Infrastructure approval candidate binding');
+    }
+    catch {
+        return selectedSource;
+    }
+    const action = options.action ?? 'deploy';
+    const stage = options.stage?.trim();
+    if (batch['kind'] !== 'ebk-infrastructure-approval-batch' ||
+        batch['schemaVersion'] !== 1 ||
+        batch['action'] !== action ||
+        stage === undefined ||
+        batch['stage'] !== stage) {
+        return selectedSource;
+    }
+    let approvedSource;
+    try {
+        const projects = record(batch['projects'], 'Infrastructure approval candidate projects');
+        const reviewed = record(projects[project], `Infrastructure approval candidate project ${project}`);
+        const planned = record(reviewed['planned'], `Infrastructure approval candidate plan ${project}`);
+        approvedSource = planned['sourceCommit'];
+    }
+    catch {
+        return selectedSource;
+    }
+    if (typeof approvedSource !== 'string' ||
+        !SOURCE_COMMIT.test(approvedSource)) {
+        return selectedSource;
+    }
+    if (selectedSource === undefined) {
+        throw new Error('Approval-resume infrastructure planning requires a workflow-selected release source.');
+    }
+    if (selectedSource !== undefined && selectedSource !== approvedSource) {
+        throw new Error('Infrastructure approval candidate differs from the workflow-selected release source.');
+    }
+    return approvedSource;
+}
+/** @internal */
+function createCandidateBoundSstChildEnvironment(environment, invocationEnvironment, candidateSourceCommit) {
+    if (!SOURCE_COMMIT.test(candidateSourceCommit)) {
+        throw new Error('Infrastructure lifecycle candidate must be one exact Git object ID.');
+    }
+    return {
+        ...(0, run_sst_command_js_1.createSstChildEnvironment)(environment, invocationEnvironment),
+        EBK_RELEASE_SOURCE_COMMIT: candidateSourceCommit,
+    };
+}
+function frameworkAndBlueprintVersions(workspaceRoot, projectRoot) {
+    const workspacePackage = record(readJsonFile((0, node_path_1.join)(workspaceRoot, 'package.json'), 'Workspace package'), 'Workspace package');
+    const declared = {
+        ...record(workspacePackage['dependencies'] ?? {}, 'Workspace dependencies'),
+        ...record(workspacePackage['devDependencies'] ?? {}, 'Workspace development dependencies'),
+    };
+    const versions = {};
+    for (const name of Object.keys(declared)
+        .filter((candidate) => candidate.startsWith('@empire-builder-kit/'))
+        .sort()) {
+        const installed = record(readJsonFile((0, node_path_1.join)(workspaceRoot, 'node_modules', ...name.split('/'), 'package.json'), `${name} installed package`), `${name} installed package`);
+        if (typeof installed['version'] !== 'string' || !installed['version']) {
+            throw new Error(`${name} installed version is missing.`);
+        }
+        versions[name] = installed['version'];
+    }
+    const workspaceOwnershipPath = (0, node_path_1.join)(workspaceRoot, '.ebk', 'ownership.json');
+    if ((0, node_fs_1.existsSync)(workspaceOwnershipPath)) {
+        const ownership = record(readJsonFile(workspaceOwnershipPath, 'Workspace ownership'), 'Workspace ownership');
+        if (ownership['kind'] !== 'workspace' ||
+            typeof ownership['frameworkVersion'] !== 'string') {
+            throw new Error('Workspace ownership framework identity is invalid.');
+        }
+        versions['ownership:workspace-framework'] = ownership['frameworkVersion'];
+    }
+    const ownershipPath = (0, node_path_1.join)(projectRoot, '.ebk', 'ownership.json');
+    if (!(0, node_fs_1.existsSync)(ownershipPath)) {
+        throw new Error('Infrastructure planning requires exact project ownership version metadata.');
+    }
+    const ownership = record(readJsonFile(ownershipPath, 'Project ownership'), 'Project ownership');
+    if (ownership['kind'] === 'foundation') {
+        if (typeof ownership['frameworkVersion'] !== 'string') {
+            throw new Error('Foundation ownership framework identity is invalid.');
+        }
+        versions['ownership:foundation-framework'] = ownership['frameworkVersion'];
+    }
+    else {
+        const blueprint = record(ownership['blueprint'], 'Product Slice Blueprint ownership');
+        if (typeof blueprint['name'] !== 'string' ||
+            typeof blueprint['version'] !== 'string' ||
+            !blueprint['name'] ||
+            !blueprint['version']) {
+            throw new Error('Product Slice Blueprint version identity is invalid.');
+        }
+        versions[`blueprint:${blueprint['name']}`] = blueprint['version'];
+    }
+    return versions;
+}
+function assertCheckedOutSourceCommit(spawn, root, environment) {
+    const expected = requiredEnvironment(environment, 'EBK_SOURCE_COMMIT', SOURCE_COMMIT);
+    const result = (spawn ?? defaultSpawn)('git', ['rev-parse', '--verify', 'HEAD'], {
+        cwd: root,
+        encoding: 'utf8',
+        env: environment,
+        maxBuffer: MAX_JSON_BYTES,
+        shell: false,
+    });
+    const actual = result.stdout.trim().toLowerCase();
+    if (result.status !== 0 ||
+        !SOURCE_COMMIT.test(actual) ||
+        actual !== expected) {
+        throw new Error('EBK_SOURCE_COMMIT does not match the checked-out Git HEAD.');
+    }
+    return actual;
+}
+function sourceChanges(spawn, root, environment, plannedCommit) {
+    const current = requiredEnvironment(environment, 'EBK_SOURCE_COMMIT', SOURCE_COMMIT);
+    if (plannedCommit === current)
+        return [];
+    const ancestry = (spawn ?? defaultSpawn)('git', ['merge-base', '--is-ancestor', plannedCommit, current], {
+        cwd: root,
+        encoding: 'utf8',
+        env: environment,
+        maxBuffer: MAX_JSON_BYTES,
+        shell: false,
+    });
+    if (ancestry.status !== 0) {
+        throw new Error('Reviewed infrastructure plan commit is not an exact ancestor of the checked-out source.');
+    }
+    const result = (spawn ?? defaultSpawn)('git', ['diff', '--name-only', plannedCommit, current, '--'], {
+        cwd: root,
+        encoding: 'utf8',
+        env: environment,
+        maxBuffer: MAX_JSON_BYTES,
+        shell: false,
+    });
+    if (result.status !== 0) {
+        throw new Error('Unable to verify source changes since the reviewed plan.');
+    }
+    return result.stdout.split(/\r?\n/).filter(Boolean).sort();
+}
+function defaultSpawn(executable, args, options) {
+    const result = (0, node_child_process_1.spawnSync)(executable, [...args], options);
+    if (result.error)
+        throw result.error;
+    return {
+        status: result.status,
+        stderr: result.stderr ?? '',
+        stdout: result.stdout ?? '',
+    };
+}
+function canonicalJson(value) {
+    return (0, canonical_json_1.canonicalJson)(value, { omitUndefinedObjectValues: true });
+}
+function stateResources(value) {
+    const root = record(value, 'SST state export');
+    const deployment = typeof root['deployment'] === 'object' && root['deployment'] !== null
+        ? record(root['deployment'], 'SST state deployment')
+        : root;
+    if (!Array.isArray(deployment['resources'])) {
+        throw new Error('SST state export does not contain a Pulumi deployment resource list.');
+    }
+    return deployment['resources'].map((resource, index) => record(resource, `SST state resource ${index}`));
+}
+function stringRecord(value) {
+    if (typeof value !== 'object' ||
+        value === null ||
+        Array.isArray(value) ||
+        Object.values(value).some((entry) => typeof entry !== 'string')) {
+        return undefined;
+    }
+    return value;
+}
+function resourceArn(resource) {
+    for (const material of [resource.outputs, resource.inputs]) {
+        if (typeof material !== 'object' || material === null)
+            continue;
+        const value = material;
+        for (const key of [
+            'arn',
+            'resourceArn',
+            'roleArn',
+            'queueArn',
+            'topicArn',
+        ]) {
+            if (typeof value[key] === 'string' && value[key].startsWith('arn:aws:')) {
+                return value[key];
+            }
+        }
+    }
+    return undefined;
+}
+function removePhysicalSelector(resource) {
+    const type = typeof resource.type === 'string' ? resource.type : '';
+    const material = [resource.inputs, resource.outputs].filter((value) => typeof value === 'object' && value !== null && !Array.isArray(value));
+    const first = (...keys) => {
+        for (const value of material) {
+            for (const key of keys) {
+                if (typeof value[key] === 'string' && value[key].length > 0) {
+                    return value[key];
+                }
+            }
+        }
+        return undefined;
+    };
+    if (type === 'aws:cloudwatch/eventTarget:EventTarget') {
+        const rule = first('rule');
+        const targetId = first('targetId');
+        return rule && targetId
+            ? {
+                ...(first('eventBusName')
+                    ? { eventBusName: first('eventBusName') }
+                    : {}),
+                rule,
+                targetId,
+            }
+            : undefined;
+    }
+    if (type === 'aws:iam/rolePolicy:RolePolicy') {
+        const policyName = first('name');
+        const roleName = first('role');
+        return policyName && roleName ? { policyName, roleName } : undefined;
+    }
+    if (type === 'aws:lambda/functionEventInvokeConfig:FunctionEventInvokeConfig') {
+        const functionName = first('functionName', 'function');
+        return functionName
+            ? {
+                functionName,
+                ...(first('qualifier') ? { qualifier: first('qualifier') } : {}),
+            }
+            : undefined;
+    }
+    if (type === 'aws:lambda/permission:Permission') {
+        const functionName = first('function', 'functionName');
+        const statementId = first('statementId');
+        return functionName && statementId
+            ? { functionName, statementId }
+            : undefined;
+    }
+    if (type === 'aws:cloudwatch/logDataProtectionPolicy:LogDataProtectionPolicy') {
+        const logGroupIdentifier = first('logGroupIdentifier', 'logGroupName');
+        return logGroupIdentifier ? { logGroupIdentifier } : undefined;
+    }
+    if (type === 'aws:s3/bucketObjectv2:BucketObjectv2') {
+        const bucket = first('bucket');
+        const key = first('key');
+        return bucket && key ? { bucket, key } : undefined;
+    }
+    if (type === 'aws:sqs/queuePolicy:QueuePolicy') {
+        const queueUrl = first('queueUrl');
+        return queueUrl ? { queueUrl } : undefined;
+    }
+    const id = typeof resource.id === 'string' && resource.id.length > 0
+        ? resource.id
+        : undefined;
+    const cloudControlIdentifier = (() => {
+        if (!id)
+            return undefined;
+        if ([
+            'aws:apigatewayv2/authorizer:Authorizer',
+            'aws:apigatewayv2/integration:Integration',
+            'aws:apigatewayv2/route:Route',
+        ].includes(type)) {
+            const apiId = first('apiId');
+            return apiId ? `${apiId}|${id}` : undefined;
+        }
+        if (type === 'aws:apigatewayv2/stage:Stage') {
+            const apiId = first('apiId');
+            const stageName = first('name');
+            return apiId && stageName ? `${apiId}|${stageName}` : undefined;
+        }
+        if (type === 'aws:apigatewayv2/apiMapping:ApiMapping') {
+            const domainName = first('domainName');
+            return domainName ? `${domainName}|${id}` : undefined;
+        }
+        if ([
+            'aws:appconfig/configurationProfile:ConfigurationProfile',
+            'aws:appconfig/environment:Environment',
+        ].includes(type)) {
+            const applicationId = first('applicationId');
+            return applicationId ? `${applicationId}|${id}` : undefined;
+        }
+        if (type ===
+            'aws:appconfig/hostedConfigurationVersion:HostedConfigurationVersion') {
+            const applicationId = first('applicationId');
+            const configurationProfileId = first('configurationProfileId');
+            return applicationId && configurationProfileId
+                ? `${applicationId}|${configurationProfileId}|${id}`
+                : undefined;
+        }
+        if (type === 'aws:appconfig/deployment:Deployment') {
+            const applicationId = first('applicationId');
+            const environmentId = first('environmentId');
+            return applicationId && environmentId
+                ? `${applicationId}|${environmentId}|${id}`
+                : undefined;
+        }
+        if (type === 'aws:cognito/userPoolClient:UserPoolClient') {
+            const userPoolId = first('userPoolId');
+            return userPoolId ? `${userPoolId}|${id}` : undefined;
+        }
+        if (type === 'aws:ecs/service:Service') {
+            const cluster = first('cluster');
+            return cluster ? `${cluster}|${id}` : undefined;
+        }
+        return undefined;
+    })();
+    if (cloudControlIdentifier)
+        return { cloudControlIdentifier };
+    return undefined;
+}
+function expectedTags(resource) {
+    for (const material of [resource.inputs, resource.outputs]) {
+        if (typeof material !== 'object' || material === null)
+            continue;
+        const tags = stringRecord(material['tags']);
+        if (tags)
+            return tags;
+    }
+    return undefined;
+}
+function isPulumiBookkeepingResource(resource) {
+    const type = typeof resource.type === 'string' ? resource.type : '';
+    return type === 'pulumi:pulumi:Stack' || type.startsWith('pulumi:providers:');
+}
+function materialPropertyPaths(resource) {
+    if (typeof resource.inputs !== 'object' ||
+        resource.inputs === null ||
+        Array.isArray(resource.inputs)) {
+        return [];
+    }
+    return Object.keys(resource.inputs)
+        .filter((key) => key !== 'tags' && key !== 'tagsAll')
+        .sort()
+        .map((key) => `inputs.${key}`);
+}
+const PULUMI_REFRESH_PREVIEW_VERSION = '3.215.0';
+const REFRESH_PREVIEW_PROPERTY_OVERLAYS = {
+    'aws:secretsmanager/secretVersion:SecretVersion': ['inputs.secretString'],
+};
+function normalizedDiffMaterial(diff) {
+    return diff.resources.map((resource) => Object.fromEntries(Object.entries(resource).filter(([key]) => key !== 'sourceIndex')));
+}
+function assessPulumiRefreshPreview(input) {
+    const sstPath = input.invocation.args[0];
+    if (!sstPath)
+        throw new Error('Workspace SST path is missing.');
+    const result = input.spawn(input.invocation.executable, [sstPath, 'diff', ...input.invocation.args.slice(2), '--json'], {
+        cwd: input.invocation.cwd,
+        encoding: 'utf8',
+        env: {
+            ...input.childEnvironment,
+            PULUMI_OPTION_REFRESH: 'true',
+            PULUMI_OPTION_RUN_PROGRAM: 'true',
+        },
+        maxBuffer: 20 * 1024 * 1024,
+        shell: false,
+    });
+    let raw;
+    try {
+        raw = parseJson(result.stdout, 'SST refresh preview');
+    }
+    catch {
+        raw = null;
+    }
+    const entries = Array.isArray(raw) ? raw : [];
+    const refreshEntries = [];
+    const desiredEntries = [];
+    let shapeComplete = Array.isArray(raw);
+    const observedRefreshUrns = new Set();
+    for (const entry of entries) {
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            shapeComplete = false;
+            continue;
+        }
+        const recordEntry = entry;
+        const operation = recordEntry['op'];
+        if (operation === 'refresh') {
+            const urn = recordEntry['urn'];
+            if (typeof urn !== 'string' || observedRefreshUrns.has(urn)) {
+                shapeComplete = false;
+                continue;
+            }
+            observedRefreshUrns.add(urn);
+            const hasOld = Object.prototype.hasOwnProperty.call(recordEntry, 'old');
+            const hasNew = Object.prototype.hasOwnProperty.call(recordEntry, 'new');
+            const detailedDiff = recordEntry['detailedDiff'];
+            const diffs = recordEntry['diffs'];
+            const hasDetailedDiff = typeof detailedDiff === 'object' &&
+                detailedDiff !== null &&
+                !Array.isArray(detailedDiff) &&
+                Object.keys(detailedDiff).length > 0;
+            const hasDiffs = Array.isArray(diffs) && diffs.length > 0;
+            if (hasNew && recordEntry['new'] === null) {
+                refreshEntries.push({ ...recordEntry, op: 'delete' });
+            }
+            else if (hasDetailedDiff ||
+                hasDiffs ||
+                (hasOld &&
+                    hasNew &&
+                    canonicalJson(recordEntry['old']) !==
+                        canonicalJson(recordEntry['new']))) {
+                refreshEntries.push({ ...recordEntry, op: 'update' });
+            }
+            else if (hasOld &&
+                hasNew &&
+                canonicalJson(recordEntry['old']) === canonicalJson(recordEntry['new'])) {
+                // Refresh events with identical old/new material are provider reads,
+                // not drift. SST filters Pulumi "same" steps, so this is the explicit
+                // no-change refresh shape.
+                continue;
+            }
+            else {
+                shapeComplete = false;
+            }
+        }
+        else if (operation !== 'same') {
+            desiredEntries.push(entry);
+        }
+        else {
+            shapeComplete = false;
+        }
+    }
+    const drift = (0, index_js_1.normalizeSstDiffV4_17_1)({
+        exitCode: result.status ?? 1,
+        stdout: refreshEntries,
+        toolVersion: input.toolVersion,
+    });
+    const desired = (0, index_js_1.normalizeSstDiffV4_17_1)({
+        exitCode: result.status ?? 1,
+        stdout: desiredEntries,
+        toolVersion: input.toolVersion,
+    });
+    const commandSucceeded = result.status === 0;
+    const desiredMatchesOrdinary = desired.complete &&
+        input.ordinaryDiff.complete &&
+        canonicalJson(normalizedDiffMaterial(desired)) ===
+            canonicalJson(normalizedDiffMaterial(input.ordinaryDiff));
+    const complete = commandSucceeded &&
+        shapeComplete &&
+        drift.complete &&
+        desired.complete &&
+        input.toolVersion === index_js_1.SST_DIFF_TOOL_VERSION &&
+        PULUMI_REFRESH_PREVIEW_VERSION === '3.215.0';
+    return {
+        commandSucceeded,
+        complete,
+        desiredMatchesOrdinary,
+        digest: digest(canonicalJson({
+            desired: normalizedDiffMaterial(desired),
+            desiredMatchesOrdinary,
+            drift: normalizedDiffMaterial(drift),
+            pulumiVersion: PULUMI_REFRESH_PREVIEW_VERSION,
+            sstVersion: input.toolVersion,
+        })),
+        drift,
+        observedRefreshUrns: [...observedRefreshUrns].sort(),
+    };
+}
+function costQuotaEvidence(input) {
+    const quotaByType = {
+        'aws:lambda/function:Function': {
+            quotaCode: 'L-B99A9384',
+            serviceCode: 'lambda',
+        },
+    };
+    const entries = input.diff.resources
+        .filter(({ operation, resourceType }) => ['create', 'import', 'replace', 'update'].includes(operation) &&
+        input.policy.costOrQuotaTypes.includes(resourceType))
+        .map(({ logicalId, resourceType }) => {
+        const mapped = quotaByType[resourceType];
+        let quota = {
+            adjustable: null,
+            headroom: null,
+            quotaCode: mapped?.quotaCode ?? null,
+            serviceCode: mapped?.serviceCode ?? null,
+            status: mapped ? 'query-failed' : 'not-service-quotas-backed',
+            value: null,
+        };
+        if (mapped) {
+            const result = input.spawn('aws', [
+                'service-quotas',
+                'get-service-quota',
+                '--service-code',
+                mapped.serviceCode,
+                '--quota-code',
+                mapped.quotaCode,
+                '--output',
+                'json',
+            ], {
+                cwd: input.invocation.cwd,
+                encoding: 'utf8',
+                env: input.childEnvironment,
+                maxBuffer: MAX_JSON_BYTES,
+                shell: false,
+            });
+            try {
+                const response = record(parseJson(result.stdout, `${logicalId} service quota`), `${logicalId} service quota`);
+                const observed = record(response['Quota'], `${logicalId} service quota`);
+                if (result.status === 0 &&
+                    observed['ServiceCode'] === mapped.serviceCode &&
+                    observed['QuotaCode'] === mapped.quotaCode &&
+                    typeof observed['Value'] === 'number' &&
+                    Number.isFinite(observed['Value']) &&
+                    typeof observed['Adjustable'] === 'boolean') {
+                    quota = {
+                        adjustable: observed['Adjustable'],
+                        headroom: null,
+                        quotaCode: mapped.quotaCode,
+                        serviceCode: mapped.serviceCode,
+                        status: 'observed-limit-usage-unavailable',
+                        value: observed['Value'],
+                    };
+                }
+            }
+            catch {
+                // The evidence remains query-failed and therefore review-blocking.
+            }
+        }
+        return {
+            cost: {
+                assumptions: [
+                    'Usage, duration, storage, data transfer, and request volume are not inferred from infrastructure source.',
+                    'A product owner must supply a reviewed bound before protected mutation.',
+                ],
+                maximumUsdMonthly: null,
+                minimumUsdMonthly: null,
+                status: 'unknown',
+            },
+            logicalId,
+            quota,
+            resourceType,
+        };
+    });
+    return {
+        accountFingerprint: digest(input.accountId),
+        entries,
+        project: input.project,
+        region: input.region,
+        sourceCommit: input.sourceCommit,
+    };
+}
+function iamPolicyDocuments(input) {
+    let entries;
+    try {
+        entries = parseJson(input.diffStdout, 'SST IAM plan');
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(entries))
+        return [];
+    const validations = [];
+    for (const resource of input.diff.resources) {
+        const policyProperty = resource.resourceType === 'aws:iam/role:Role'
+            ? { kind: 'trust', name: 'assumeRolePolicy' }
+            : resource.resourceType === 'aws:iam/policy:Policy' ||
+                resource.resourceType === 'aws:iam/rolePolicy:RolePolicy'
+                ? { kind: 'identity', name: 'policy' }
+                : undefined;
+        if (!policyProperty)
+            continue;
+        if (resource.operation === 'delete')
+            continue;
+        const rawEntry = entries[resource.sourceIndex];
+        if (typeof rawEntry !== 'object' ||
+            rawEntry === null ||
+            Array.isArray(rawEntry)) {
+            continue;
+        }
+        const rawNewValue = rawEntry['new'];
+        if (typeof rawNewValue !== 'object' ||
+            rawNewValue === null ||
+            Array.isArray(rawNewValue)) {
+            continue;
+        }
+        const rawNew = rawNewValue;
+        const rawInputs = record(rawNew['inputs'], `${resource.logicalId} planned IAM inputs`);
+        const rawPolicy = rawInputs[policyProperty.name];
+        let policy = rawPolicy;
+        if (typeof rawPolicy === 'string') {
+            try {
+                policy = parseJson(rawPolicy, `${resource.logicalId} planned IAM policy`);
+            }
+            catch {
+                continue;
+            }
+        }
+        if (typeof policy !== 'object' ||
+            policy === null ||
+            Array.isArray(policy)) {
+            continue;
+        }
+        const policyDocument = canonicalJson(policy);
+        const result = input.spawn('aws', [
+            'accessanalyzer',
+            'validate-policy',
+            '--policy-document',
+            policyDocument,
+            '--policy-type',
+            policyProperty.kind === 'trust' ? 'RESOURCE_POLICY' : 'IDENTITY_POLICY',
+            ...(policyProperty.kind === 'trust'
+                ? [
+                    '--validate-policy-resource-type',
+                    'AWS::IAM::AssumeRolePolicyDocument',
+                ]
+                : []),
+            '--output',
+            'json',
+        ], {
+            cwd: input.invocation.cwd,
+            encoding: 'utf8',
+            env: input.childEnvironment,
+            maxBuffer: MAX_JSON_BYTES,
+            shell: false,
+        });
+        let response;
+        try {
+            response = record(parseJson(result.stdout, `${resource.logicalId} IAM validation`), `${resource.logicalId} IAM validation`);
+        }
+        catch {
+            response = undefined;
+        }
+        const rawFindings = response?.['findings'];
+        const findingsShapeComplete = Array.isArray(rawFindings) &&
+            rawFindings.every((finding) => {
+                if (typeof finding !== 'object' ||
+                    finding === null ||
+                    Array.isArray(finding)) {
+                    return false;
+                }
+                const value = finding;
+                return (typeof value['findingType'] === 'string' &&
+                    ['ERROR', 'SECURITY_WARNING', 'SUGGESTION', 'WARNING'].includes(value['findingType']) &&
+                    typeof value['issueCode'] === 'string');
+            });
+        const findings = findingsShapeComplete
+            ? rawFindings.map((value) => ({
+                code: digest(canonicalJson(value)),
+                findingType: value['findingType']
+                    .toLowerCase()
+                    .replace('_', '-'),
+                issueCode: value['issueCode'],
+            }))
+            : [];
+        validations.push({
+            accessChange: 'expanded',
+            accountFingerprint: digest(input.accountId),
+            analyzer: 'aws-iam-access-analyzer-validate-policy',
+            findings,
+            logicalId: resource.logicalId,
+            policyDigest: digest(policyDocument),
+            policyKind: policyProperty.kind,
+            policyResourceId: resource.logicalId,
+            region: input.region,
+            sourceCommit: input.sourceCommit,
+            status: result.status === 0 && findingsShapeComplete ? 'complete' : 'failed',
+        });
+    }
+    return validations;
+}
+function exactSstStateLocation(environment) {
+    const bucketArn = requiredEnvironment(environment, 'AWS_PLAN_STATE_BUCKET_ARN', /^arn:aws:s3:::[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/);
+    const applicationsValue = parseJson(requiredEnvironment(environment, 'AWS_PLAN_SST_APPS_JSON'), 'AWS_PLAN_SST_APPS_JSON');
+    if (!Array.isArray(applicationsValue) ||
+        applicationsValue.length === 0 ||
+        new Set(applicationsValue).size !== applicationsValue.length ||
+        applicationsValue.some((application) => typeof application !== 'string' ||
+            !/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(application))) {
+        throw new Error('AWS_PLAN_SST_APPS_JSON must list unique exact SST application names.');
+    }
+    return {
+        applications: [...applicationsValue].sort(),
+        bucketArn,
+        bucketName: bucketArn.slice('arn:aws:s3:::'.length),
+    };
+}
+function preflightSstBackendParameter(input) {
+    let parameter;
+    try {
+        parameter = record(runJsonCommand(input.spawn, 'aws', [
+            'ssm',
+            'get-parameter',
+            '--name',
+            input.name,
+            '--query',
+            'Parameter.{Name:Name,Type:Type,Version:Version}',
+            '--output',
+            'json',
+        ], {
+            cwd: input.invocation.cwd,
+            env: input.childEnvironment,
+            label: `SST backend parameter ${input.name}`,
+        }), `SST backend parameter ${input.name}`);
+    }
+    catch {
+        throw new Error(`SST backend parameter ${input.name} is missing or outdated.`);
+    }
+    if (parameter['Name'] !== input.name ||
+        parameter['Type'] !== input.expectedType ||
+        typeof parameter['Version'] !== 'number' ||
+        !Number.isSafeInteger(parameter['Version']) ||
+        parameter['Version'] < 1) {
+        throw new Error(`SST backend parameter ${input.name} is missing or outdated.`);
+    }
+}
+function preflightSstBootstrap(input) {
+    let parameter;
+    try {
+        parameter = record(runJsonCommand(input.spawn, 'aws', [
+            'ssm',
+            'get-parameter',
+            '--name',
+            '/sst/bootstrap',
+            '--query',
+            'Parameter.{Name:Name,Type:Type,Version:Version,Value:Value}',
+            '--output',
+            'json',
+        ], {
+            cwd: input.invocation.cwd,
+            env: input.childEnvironment,
+            label: 'SST bootstrap parameter',
+        }), 'SST bootstrap parameter');
+    }
+    catch {
+        throw new Error('SST bootstrap parameter is missing, malformed, or outdated.');
+    }
+    if (parameter['Name'] !== '/sst/bootstrap' ||
+        parameter['Type'] !== 'String' ||
+        typeof parameter['Version'] !== 'number' ||
+        !Number.isSafeInteger(parameter['Version']) ||
+        parameter['Version'] < 1 ||
+        typeof parameter['Value'] !== 'string') {
+        throw new Error('SST bootstrap parameter is missing, malformed, or outdated.');
+    }
+    let bootstrap;
+    try {
+        bootstrap = record(parseJson(parameter['Value'], 'SST v4.17.1 bootstrap value'), 'SST v4.17.1 bootstrap value');
+    }
+    catch {
+        throw new Error('SST bootstrap parameter is missing, malformed, or outdated.');
+    }
+    const exactKeys = [
+        'appsyncHttp',
+        'appsyncRealtime',
+        'asset',
+        'assetEcrRegistryId',
+        'assetEcrUrl',
+        'state',
+        'version',
+    ];
+    const bucketName = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+    const expectedEcrUrl = `${input.accountId}.dkr.ecr.${input.region}.amazonaws.com/sst-asset`;
+    if (Object.keys(bootstrap).sort().join(',') !== exactKeys.join(',') ||
+        bootstrap['version'] !== 5 ||
+        bootstrap['state'] !== input.stateBucketName ||
+        typeof bootstrap['asset'] !== 'string' ||
+        !bucketName.test(bootstrap['asset']) ||
+        bootstrap['assetEcrRegistryId'] !== input.accountId ||
+        bootstrap['assetEcrUrl'] !== expectedEcrUrl ||
+        typeof bootstrap['appsyncHttp'] !== 'string' ||
+        typeof bootstrap['appsyncRealtime'] !== 'string') {
+        throw new Error('SST bootstrap parameter does not match the exact v4.17.1 schema and declared state backend.');
+    }
+    return digest(canonicalJson({
+        bootstrap,
+        parameterRevision: parameter['Version'],
+    }));
+}
+function exactS3KeyExists(input) {
+    const result = record(runJsonCommand(input.spawn, 'aws', [
+        's3api',
+        'list-objects-v2',
+        '--bucket',
+        input.stateBucketName,
+        '--prefix',
+        input.key,
+        '--max-keys',
+        '1',
+        '--output',
+        'json',
+    ], {
+        cwd: input.invocation.cwd,
+        env: input.childEnvironment,
+        label: input.label,
+    }), input.label);
+    const contents = result['Contents'];
+    const commonPrefixes = result['CommonPrefixes'];
+    if (result['Prefix'] !== input.key ||
+        !Number.isSafeInteger(result['KeyCount']) ||
+        (contents !== undefined && !Array.isArray(contents)) ||
+        (commonPrefixes !== undefined && !Array.isArray(commonPrefixes)) ||
+        (Array.isArray(commonPrefixes) && commonPrefixes.length > 0)) {
+        throw new Error(`${input.label} returned an ambiguous exact-key listing.`);
+    }
+    if (result['KeyCount'] === 0 &&
+        (contents === undefined ||
+            (Array.isArray(contents) && contents.length === 0))) {
+        return false;
+    }
+    if (result['KeyCount'] === 1 &&
+        Array.isArray(contents) &&
+        contents.length === 1 &&
+        record(contents[0], input.label)['Key'] === input.key) {
+        return true;
+    }
+    throw new Error(`${input.label} returned an unexpected key or prefix.`);
+}
+function preflightProtectedSstSecrets(input) {
+    for (const key of [
+        `secret/${input.application}/${input.stage}.json`,
+        `secret/${input.application}/_fallback.json`,
+    ]) {
+        if (exactS3KeyExists({
+            childEnvironment: input.childEnvironment,
+            invocation: input.invocation,
+            key,
+            label: `Protected SST secret absence preflight ${key}`,
+            spawn: input.spawn,
+            stateBucketName: input.stateBucketName,
+        })) {
+            throw new Error(`Protected SST secret object ${key} exists; protected SST secrets are forbidden.`);
+        }
+    }
+}
+function observeSstStateLock(input) {
+    const key = `lock/${input.app}/${input.stage}.json`;
+    if (!exactS3KeyExists({
+        childEnvironment: input.childEnvironment,
+        invocation: input.invocation,
+        key,
+        label: `Exact SST state lock inventory ${key}`,
+        spawn: input.spawn,
+        stateBucketName: input.stateBucketName,
+    })) {
+        return {
+            digest: digest(canonicalJson({ key, status: 'absent' })),
+            key,
+            locked: false,
+        };
+    }
+    const temporaryDirectory = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ebk-sst-lock-'));
+    const lockPath = (0, node_path_1.join)(temporaryDirectory, 'lock.json');
+    try {
+        const result = input.spawn('aws', [
+            's3api',
+            'get-object',
+            '--bucket',
+            input.stateBucketName,
+            '--key',
+            key,
+            '--output',
+            'json',
+            lockPath,
+        ], {
+            cwd: input.invocation.cwd,
+            encoding: 'utf8',
+            env: input.childEnvironment,
+            maxBuffer: MAX_JSON_BYTES,
+            shell: false,
+        });
+        if (result.status !== 0) {
+            throw new Error(`Exact SST state lock observation failed${result.stderr.trim() ? `: ${result.stderr.trim()}` : '.'}`);
+        }
+        if (!(0, node_fs_1.existsSync)(lockPath)) {
+            throw new Error('Exact SST state lock response body is absent.');
+        }
+        const contents = (0, node_fs_1.readFileSync)(lockPath, 'utf8');
+        const lock = record(parseJson(contents, 'Exact SST state lock'), 'Exact SST state lock');
+        const expectedKeys = ['command', 'created', 'ignore', 'runID', 'updateID'];
+        if (Object.keys(lock).sort().join(',') !== expectedKeys.join(',') ||
+            typeof lock['created'] !== 'string' ||
+            !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(lock['created']) ||
+            !Number.isFinite(Date.parse(lock['created'])) ||
+            typeof lock['updateID'] !== 'string' ||
+            typeof lock['runID'] !== 'string' ||
+            typeof lock['command'] !== 'string' ||
+            typeof lock['ignore'] !== 'boolean') {
+            throw new Error('Exact SST state lock has an invalid v4.17.1 shape.');
+        }
+        const createdAt = new Date(lock['created']).toISOString();
+        const zeroCreatedAt = new Date('0001-01-01T00:00:00.000Z').toISOString();
+        if (createdAt === zeroCreatedAt ||
+            lock['updateID'].length === 0 ||
+            lock['runID'].length === 0 ||
+            lock['command'].length === 0) {
+            throw new Error('Exact SST state lock is zero-valued or inconsistent; only exact-key absence is unlocked.');
+        }
+        return {
+            digest: digest(canonicalJson({ key, lock })),
+            key,
+            locked: true,
+        };
+    }
+    finally {
+        (0, node_fs_1.rmSync)(temporaryDirectory, { force: true, recursive: true });
+    }
+}
+function runJsonCommand(spawn, executable, args, options) {
+    const result = spawn(executable, args, {
+        cwd: options.cwd,
+        encoding: 'utf8',
+        env: options.env,
+        maxBuffer: options.maxBuffer ?? MAX_JSON_BYTES,
+        shell: false,
+    });
+    if (result.status !== 0) {
+        throw new Error(`${options.label} failed under the read-only plan authority${result.stderr.trim() ? `: ${result.stderr.trim()}` : '.'}`);
+    }
+    return parseJson(result.stdout, options.label);
+}
+const STANDARD_RETAINED_S3_TYPES = new Set([
+    'aws:s3/bucket:Bucket',
+    'aws:s3/bucketLifecycleConfigurationV2:BucketLifecycleConfigurationV2',
+    'aws:s3/bucketOwnershipControls:BucketOwnershipControls',
+    'aws:s3/bucketPolicy:BucketPolicy',
+    'aws:s3/bucketPublicAccessBlock:BucketPublicAccessBlock',
+    'aws:s3/bucketServerSideEncryptionConfigurationV2:BucketServerSideEncryptionConfigurationV2',
+    'aws:s3/bucketVersioningV2:BucketVersioningV2',
+]);
+function hasControlCharacters(value) {
+    return [...value].some((character) => {
+        const codePoint = character.codePointAt(0);
+        return codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f);
+    });
+}
+function standardRemoveProbeForResource(resource) {
+    const physicalId = resource.physicalId?.trim();
+    const physicalArn = resource.physicalArn?.trim();
+    if ((physicalId &&
+        (physicalId.length > 2_048 || hasControlCharacters(physicalId))) ||
+        (physicalArn &&
+            (physicalArn.length > 2_048 ||
+                hasControlCharacters(physicalArn) ||
+                !/^arn:aws(?:-[a-z]+)*:/.test(physicalArn)))) {
+        throw new Error(`Infrastructure remove target ${resource.logicalId} has an ambiguous physical identity.`);
+    }
+    if (resource.resourceType === 'aws:ssm/parameter:Parameter') {
+        if (!physicalId) {
+            throw new Error(`Infrastructure remove target ${resource.logicalId} has no exact SSM parameter identity.`);
+        }
+        return {
+            identifier: physicalId,
+            kind: 'aws-ssm-parameter',
+            protectionProfile: /registration/i.test(resource.logicalId)
+                ? 'slice-registration'
+                : 'slice-parameter',
+        };
+    }
+    if (resource.resourceType === 'aws:secretsmanager/secret:Secret') {
+        if (!physicalArn && !physicalId) {
+            throw new Error(`Infrastructure remove target ${resource.logicalId} has no exact secret identity.`);
+        }
+        return {
+            identifier: physicalArn ?? physicalId,
+            kind: 'aws-secrets-manager-secret',
+            protectionProfile: 'slice-secret',
+        };
+    }
+    if (STANDARD_RETAINED_S3_TYPES.has(resource.resourceType)) {
+        if (!physicalId) {
+            throw new Error(`Infrastructure remove target ${resource.logicalId} has no exact S3 identity.`);
+        }
+        return {
+            identifier: physicalId,
+            kind: 'aws-s3-retained',
+            protectionProfile: resource.resourceType,
+        };
+    }
+    if (resource.resourceType === 'aws:kms/key:Key' ||
+        resource.resourceType === 'aws:kms/alias:Alias') {
+        if (!physicalId && !physicalArn) {
+            throw new Error(`Infrastructure remove target ${resource.logicalId} has no exact KMS identity.`);
+        }
+        return {
+            identifier: physicalId ?? physicalArn,
+            kind: 'aws-kms-retained',
+            protectionProfile: resource.resourceType,
+        };
+    }
+    const selector = resource.physicalSelector;
+    const selectorProbeKinds = {
+        'aws:cloudwatch/eventTarget:EventTarget': 'aws-events-target',
+        'aws:cloudwatch/logDataProtectionPolicy:LogDataProtectionPolicy': 'aws-logs-data-protection-policy',
+        'aws:iam/rolePolicy:RolePolicy': 'aws-iam-role-policy',
+        'aws:lambda/functionEventInvokeConfig:FunctionEventInvokeConfig': 'aws-lambda-event-invoke-config',
+        'aws:lambda/permission:Permission': 'aws-lambda-permission',
+        'aws:s3/bucketObjectv2:BucketObjectv2': 'aws-s3-object',
+        'aws:sqs/queuePolicy:QueuePolicy': 'aws-sqs-queue-policy',
+    };
+    const selectorKind = selectorProbeKinds[resource.resourceType];
+    if (selectorKind) {
+        if (!physicalId || !selector || Object.keys(selector).length === 0) {
+            throw new Error(`Infrastructure remove target ${resource.logicalId} lacks its exact Standard selector.`);
+        }
+        return {
+            identifier: physicalId,
+            kind: selectorKind,
+            selector,
+        };
+    }
+    const typeName = STANDARD_REMOVE_CLOUD_CONTROL_TYPES[resource.resourceType];
+    const cloudControlIdentifier = resource.physicalSelector?.['cloudControlIdentifier'] ?? physicalId;
+    if (!typeName || !cloudControlIdentifier) {
+        throw new Error(`Infrastructure remove target ${resource.logicalId} uses unmapped Standard type ${resource.resourceType} or lacks its exact provider ID.`);
+    }
+    return {
+        identifier: cloudControlIdentifier,
+        kind: 'aws-cloud-control',
+        typeName,
+    };
+}
+function runRemoveProbeCommand(input) {
+    const result = input.spawn('aws', input.args, {
+        cwd: input.invocation.cwd,
+        encoding: 'utf8',
+        env: input.childEnvironment,
+        maxBuffer: MAX_JSON_BYTES,
+        shell: false,
+    });
+    if (result.status !== 0) {
+        if (input.notFound.test(result.stderr)) {
+            return { found: false };
+        }
+        throw new Error(`${input.label} failed under the protected remove authority; raw provider diagnostics were suppressed.`);
+    }
+    return {
+        found: true,
+        value: result.stdout.trim()
+            ? parseJson(result.stdout, input.label)
+            : { status: 'present' },
+    };
+}
+function probeStandardRemoveResource(input) {
+    const { probe } = input;
+    if (probe.kind === 'aws-cloud-control') {
+        const response = runRemoveProbeCommand({
+            ...input,
+            args: [
+                'cloudcontrol',
+                'get-resource',
+                '--type-name',
+                probe.typeName,
+                '--identifier',
+                probe.identifier,
+                '--output',
+                'json',
+            ],
+            label: 'AWS Cloud Control exact remove observation',
+            notFound: /ResourceNotFound(?:Exception)?/,
+        });
+        if (!response.found)
+            return { present: false, protectionDigest: null };
+        const description = record(record(response.value, 'AWS Cloud Control response')['ResourceDescription'], 'AWS Cloud Control resource description');
+        if (description['Identifier'] !== probe.identifier) {
+            throw new Error('AWS Cloud Control remove observation returned another resource identity.');
+        }
+        const properties = typeof description['Properties'] === 'string'
+            ? parseJson(description['Properties'], 'AWS Cloud Control resource properties')
+            : description['Properties'];
+        if (properties === undefined) {
+            throw new Error('AWS Cloud Control resource properties are absent.');
+        }
+        return {
+            present: true,
+            protectionDigest: digest(canonicalJson(properties)),
+        };
+    }
+    if (probe.kind === 'aws-ssm-parameter') {
+        const response = runRemoveProbeCommand({
+            ...input,
+            args: [
+                'ssm',
+                'get-parameter',
+                '--name',
+                probe.identifier,
+                '--output',
+                'json',
+            ],
+            label: 'Exact SSM parameter remove observation',
+            notFound: /ParameterNotFound/,
+        });
+        if (!response.found)
+            return { present: false, protectionDigest: null };
+        const parameter = record(record(response.value, 'SSM parameter response')['Parameter'], 'SSM parameter');
+        if (parameter['Name'] !== probe.identifier) {
+            throw new Error('SSM parameter remove observation returned another resource identity.');
+        }
+        return {
+            present: true,
+            protectionDigest: digest(canonicalJson({
+                dataType: parameter['DataType'],
+                tier: parameter['Tier'],
+                type: parameter['Type'],
+            })),
+        };
+    }
+    if (probe.kind === 'aws-secrets-manager-secret') {
+        const response = runRemoveProbeCommand({
+            ...input,
+            args: [
+                'secretsmanager',
+                'describe-secret',
+                '--secret-id',
+                probe.identifier,
+                '--output',
+                'json',
+            ],
+            label: 'Exact Secrets Manager remove observation',
+            notFound: /ResourceNotFoundException/,
+        });
+        if (!response.found)
+            return { present: false, protectionDigest: null };
+        const secret = record(response.value, 'Secrets Manager secret');
+        if (secret['ARN'] !== probe.identifier &&
+            secret['Name'] !== probe.identifier) {
+            throw new Error('Secrets Manager remove observation returned another resource identity.');
+        }
+        return {
+            present: true,
+            protectionDigest: digest(canonicalJson({
+                kmsKeyId: secret['KmsKeyId'] ?? null,
+                primaryRegion: secret['PrimaryRegion'] ?? null,
+                replicationStatus: secret['ReplicationStatus'] ?? [],
+            })),
+        };
+    }
+    if ([
+        'aws-events-target',
+        'aws-iam-role-policy',
+        'aws-lambda-event-invoke-config',
+        'aws-lambda-permission',
+        'aws-logs-data-protection-policy',
+        'aws-s3-object',
+        'aws-sqs-queue-policy',
+    ].includes(probe.kind)) {
+        const selector = probe.selector;
+        const requiredSelectorKeys = {
+            'aws-events-target': ['rule', 'targetId'],
+            'aws-iam-role-policy': ['policyName', 'roleName'],
+            'aws-lambda-event-invoke-config': ['functionName'],
+            'aws-lambda-permission': ['functionName', 'statementId'],
+            'aws-logs-data-protection-policy': ['logGroupIdentifier'],
+            'aws-s3-object': ['bucket', 'key'],
+            'aws-sqs-queue-policy': ['queueUrl'],
+        };
+        const allowedOptionalKeys = {
+            'aws-events-target': ['eventBusName'],
+            'aws-lambda-event-invoke-config': ['qualifier'],
+        };
+        const requiredKeys = requiredSelectorKeys[probe.kind] ?? [];
+        const allowedKeys = [
+            ...requiredKeys,
+            ...(allowedOptionalKeys[probe.kind] ?? []),
+        ];
+        if (!selector ||
+            requiredKeys.some((key) => typeof selector[key] !== 'string' || !selector[key]) ||
+            Object.keys(selector).some((key) => !allowedKeys.includes(key) ||
+                hasControlCharacters(selector[key] ?? ''))) {
+            throw new Error('Standard composite remove selector is absent.');
+        }
+        let args;
+        let notFound;
+        if (probe.kind === 'aws-events-target') {
+            args = [
+                'events',
+                'list-targets-by-rule',
+                '--rule',
+                selector['rule'],
+                ...(selector['eventBusName']
+                    ? ['--event-bus-name', selector['eventBusName']]
+                    : []),
+                '--output',
+                'json',
+            ];
+            notFound = /ResourceNotFoundException/;
+        }
+        else if (probe.kind === 'aws-iam-role-policy') {
+            args = [
+                'iam',
+                'get-role-policy',
+                '--role-name',
+                selector['roleName'],
+                '--policy-name',
+                selector['policyName'],
+                '--output',
+                'json',
+            ];
+            notFound = /NoSuchEntity/;
+        }
+        else if (probe.kind === 'aws-lambda-event-invoke-config') {
+            args = [
+                'lambda',
+                'get-function-event-invoke-config',
+                '--function-name',
+                selector['functionName'],
+                ...(selector['qualifier']
+                    ? ['--qualifier', selector['qualifier']]
+                    : []),
+                '--output',
+                'json',
+            ];
+            notFound = /ResourceNotFoundException/;
+        }
+        else if (probe.kind === 'aws-lambda-permission') {
+            args = [
+                'lambda',
+                'get-policy',
+                '--function-name',
+                selector['functionName'],
+                '--output',
+                'json',
+            ];
+            notFound = /ResourceNotFoundException/;
+        }
+        else if (probe.kind === 'aws-logs-data-protection-policy') {
+            args = [
+                'logs',
+                'get-data-protection-policy',
+                '--log-group-identifier',
+                selector['logGroupIdentifier'],
+                '--output',
+                'json',
+            ];
+            notFound = /ResourceNotFoundException/;
+        }
+        else if (probe.kind === 'aws-s3-object') {
+            args = [
+                's3api',
+                'head-object',
+                '--bucket',
+                selector['bucket'],
+                '--key',
+                selector['key'],
+                '--output',
+                'json',
+            ];
+            notFound = /NoSuchKey|NoSuchBucket|NotFound|404/;
+        }
+        else {
+            args = [
+                'sqs',
+                'get-queue-attributes',
+                '--queue-url',
+                selector['queueUrl'],
+                '--attribute-names',
+                'Policy',
+                '--output',
+                'json',
+            ];
+            notFound = /AWS\.SimpleQueueService\.NonExistentQueue|QueueDoesNotExist/;
+        }
+        const response = runRemoveProbeCommand({
+            ...input,
+            args,
+            label: 'Exact Standard composite remove observation',
+            notFound,
+        });
+        if (!response.found)
+            return { present: false, protectionDigest: null };
+        const value = record(response.value, 'Standard composite remove response');
+        let material = value;
+        let present = true;
+        if (probe.kind === 'aws-events-target') {
+            const targets = value['Targets'];
+            if (!Array.isArray(targets)) {
+                throw new Error('Event target remove observation is malformed.');
+            }
+            const exact = targets.filter((target) => typeof target === 'object' &&
+                target !== null &&
+                !Array.isArray(target) &&
+                target['Id'] === selector['targetId']);
+            if (exact.length > 1) {
+                throw new Error('Event target remove observation is ambiguous.');
+            }
+            present = exact.length === 1;
+            material = exact[0] ?? null;
+        }
+        else if (probe.kind === 'aws-iam-role-policy') {
+            if (value['RoleName'] !== selector['roleName'] ||
+                value['PolicyName'] !== selector['policyName']) {
+                throw new Error('IAM role policy observation returned another identity.');
+            }
+        }
+        else if (probe.kind === 'aws-lambda-permission') {
+            if (typeof value['Policy'] !== 'string') {
+                throw new Error('Lambda permission observation is malformed.');
+            }
+            const policy = record(parseJson(value['Policy'], 'Lambda function policy'), 'Lambda function policy');
+            const statements = Array.isArray(policy['Statement'])
+                ? policy['Statement']
+                : [];
+            const exact = statements.filter((statement) => typeof statement === 'object' &&
+                statement !== null &&
+                !Array.isArray(statement) &&
+                statement['Sid'] ===
+                    selector['statementId']);
+            if (exact.length > 1) {
+                throw new Error('Lambda permission observation is ambiguous.');
+            }
+            present = exact.length === 1;
+            material = exact[0] ?? null;
+        }
+        else if (probe.kind === 'aws-logs-data-protection-policy') {
+            if (value['logGroupIdentifier'] !== selector['logGroupIdentifier'] &&
+                value['logGroupArn'] !== selector['logGroupIdentifier']) {
+                throw new Error('CloudWatch Logs protection observation returned another identity.');
+            }
+        }
+        else if (probe.kind === 'aws-sqs-queue-policy') {
+            const attributes = record(value['Attributes'] ?? {}, 'SQS queue policy attributes');
+            present =
+                typeof attributes['Policy'] === 'string' &&
+                    attributes['Policy'].length > 0;
+            material = present
+                ? parseJson(attributes['Policy'], 'SQS queue policy document')
+                : null;
+        }
+        return {
+            present,
+            protectionDigest: present ? digest(canonicalJson(material)) : null,
+        };
+    }
+    if (probe.kind === 'aws-kms-retained') {
+        const response = runRemoveProbeCommand({
+            ...input,
+            args: [
+                'kms',
+                'describe-key',
+                '--key-id',
+                probe.identifier,
+                '--output',
+                'json',
+            ],
+            label: 'Exact KMS remove observation',
+            notFound: /NotFoundException/,
+        });
+        if (!response.found)
+            return { present: false, protectionDigest: null };
+        const metadata = record(record(response.value, 'KMS describe-key response')['KeyMetadata'], 'KMS key metadata');
+        if (metadata['KeyState'] !== 'Enabled' ||
+            metadata['Enabled'] !== true ||
+            (metadata['Arn'] !== probe.identifier &&
+                metadata['KeyId'] !== probe.identifier &&
+                probe.protectionProfile !== 'aws:kms/alias:Alias')) {
+            throw new Error('Retained KMS identity is missing, disabled, or pending deletion.');
+        }
+        const rotation = runRemoveProbeCommand({
+            ...input,
+            args: [
+                'kms',
+                'get-key-rotation-status',
+                '--key-id',
+                String(metadata['KeyId']),
+                '--output',
+                'json',
+            ],
+            label: 'Exact KMS rotation protection observation',
+            notFound: /NotFoundException/,
+        });
+        if (!rotation.found ||
+            record(rotation.value, 'KMS rotation status')['KeyRotationEnabled'] !==
+                true) {
+            throw new Error('Retained KMS key rotation protection is absent.');
+        }
+        return {
+            present: true,
+            protectionDigest: digest(canonicalJson({ metadata, rotation: rotation.value })),
+        };
+    }
+    const s3Commands = {
+        'aws:s3/bucket:Bucket': ['head-bucket', '--bucket', probe.identifier],
+        'aws:s3/bucketLifecycleConfigurationV2:BucketLifecycleConfigurationV2': [
+            'get-bucket-lifecycle-configuration',
+            '--bucket',
+            probe.identifier,
+        ],
+        'aws:s3/bucketOwnershipControls:BucketOwnershipControls': [
+            'get-bucket-ownership-controls',
+            '--bucket',
+            probe.identifier,
+        ],
+        'aws:s3/bucketPolicy:BucketPolicy': [
+            'get-bucket-policy',
+            '--bucket',
+            probe.identifier,
+        ],
+        'aws:s3/bucketPublicAccessBlock:BucketPublicAccessBlock': [
+            'get-public-access-block',
+            '--bucket',
+            probe.identifier,
+        ],
+        'aws:s3/bucketServerSideEncryptionConfigurationV2:BucketServerSideEncryptionConfigurationV2': ['get-bucket-encryption', '--bucket', probe.identifier],
+        'aws:s3/bucketVersioningV2:BucketVersioningV2': [
+            'get-bucket-versioning',
+            '--bucket',
+            probe.identifier,
+        ],
+    };
+    const operation = s3Commands[probe.protectionProfile ?? ''];
+    if (!operation) {
+        throw new Error('Retained S3 remove adapter profile is unmapped.');
+    }
+    const response = runRemoveProbeCommand({
+        ...input,
+        args: ['s3api', ...operation, '--output', 'json'],
+        label: 'Exact S3 retention protection observation',
+        notFound: /NoSuchBucket|NoSuchLifecycleConfiguration|NoSuchPublicAccessBlockConfiguration|NotFound|404/,
+    });
+    if (!response.found)
+        return { present: false, protectionDigest: null };
+    const value = record(response.value, 'S3 retention protection');
+    const serialized = canonicalJson(value);
+    if ((probe.protectionProfile ===
+        'aws:s3/bucketOwnershipControls:BucketOwnershipControls' &&
+        !serialized.includes('BucketOwnerEnforced')) ||
+        (probe.protectionProfile ===
+            'aws:s3/bucketPublicAccessBlock:BucketPublicAccessBlock' &&
+            ![
+                'BlockPublicAcls',
+                'BlockPublicPolicy',
+                'IgnorePublicAcls',
+                'RestrictPublicBuckets',
+            ].every((key) => serialized.includes(`"${key}":true`))) ||
+        (probe.protectionProfile ===
+            'aws:s3/bucketServerSideEncryptionConfigurationV2:BucketServerSideEncryptionConfigurationV2' &&
+            !serialized.includes('"SSEAlgorithm":"aws:kms"')) ||
+        (probe.protectionProfile ===
+            'aws:s3/bucketVersioningV2:BucketVersioningV2' &&
+            !serialized.includes('"Status":"Enabled"')) ||
+        (probe.protectionProfile ===
+            'aws:s3/bucketLifecycleConfigurationV2:BucketLifecycleConfigurationV2' &&
+            ![
+                'confidential-export-fallback-expiry',
+                'confidential-export-delete-markers',
+            ].every((id) => serialized.includes(id)))) {
+        throw new Error('Retained S3 protection no longer matches Standard policy.');
+    }
+    return {
+        present: true,
+        protectionDigest: digest(serialized),
+    };
+}
+function observeInfrastructureState(input) {
+    const stage = requiredEnvironment(input.childEnvironment, 'EBK_CONSUMER_STAGE');
+    const region = requiredEnvironment(input.childEnvironment, 'AWS_REGION');
+    const expectedAccount = requiredEnvironment(input.environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/);
+    const caller = record(runJsonCommand(input.spawn, 'aws', ['sts', 'get-caller-identity', '--output', 'json'], {
+        cwd: input.invocation.cwd,
+        env: input.childEnvironment,
+        label: 'AWS caller identity',
+    }), 'AWS caller identity');
+    if (caller['Account'] !== expectedAccount ||
+        typeof caller['Arn'] !== 'string' ||
+        !caller['Arn']) {
+        throw new Error('Read-only infrastructure observer does not match the expected AWS account.');
+    }
+    const stateLocation = exactSstStateLocation(input.environment);
+    const stateKey = `app/${input.project}/${stage}.json`;
+    const stateExists = exactS3KeyExists({
+        childEnvironment: input.childEnvironment,
+        invocation: input.invocation,
+        key: stateKey,
+        label: `Exact SST application state inventory ${stateKey}`,
+        spawn: input.spawn,
+        stateBucketName: stateLocation.bucketName,
+    });
+    const sstPath = input.invocation.args[0];
+    if (!sstPath)
+        throw new Error('Workspace SST path is missing.');
+    const exported = stateExists
+        ? runJsonCommand(input.spawn, input.invocation.executable, [
+            sstPath,
+            'state',
+            'export',
+            '--stage',
+            stage,
+            ...(input.invocation.args.includes('--profile')
+                ? input.invocation.args.slice(input.invocation.args.indexOf('--profile'), input.invocation.args.indexOf('--profile') + 2)
+                : []),
+        ], {
+            cwd: input.invocation.cwd,
+            env: input.childEnvironment,
+            label: 'SST state export',
+            maxBuffer: 32 * 1024 * 1024,
+        })
+        : null;
+    const resources = stateExists ? stateResources(exported) : [];
+    const stackIdentities = new Set();
+    for (const resource of resources) {
+        const urn = typeof resource.urn === 'string' ? resource.urn : '';
+        const match = /^urn:pulumi:([^:]+)::([^:]+)::/.exec(urn);
+        if (match)
+            stackIdentities.add(`${match[2]}/${match[1]}`);
+    }
+    if (stateExists && stackIdentities.size !== 1) {
+        throw new Error('SST state export does not identify exactly one Pulumi application and stack.');
+    }
+    const stackIdentity = stateExists
+        ? [...stackIdentities][0]
+        : `${input.project}/${stage}`;
+    const [application, observedStage] = stackIdentity.split('/');
+    if (!application || observedStage !== stage) {
+        throw new Error('SST state export stack identity does not match the requested stage.');
+    }
+    if (application !== input.project ||
+        !stateLocation.applications.includes(application)) {
+        throw new Error('SST state export application is outside AWS_PLAN_SST_APPS_JSON.');
+    }
+    const stateLock = observeSstStateLock({
+        app: application,
+        childEnvironment: input.childEnvironment,
+        invocation: input.invocation,
+        spawn: input.spawn,
+        stage,
+        stateBucketName: stateLocation.bucketName,
+    });
+    const nonBookkeepingResources = resources.filter((resource) => !isPulumiBookkeepingResource(resource));
+    const deployableResources = nonBookkeepingResources.filter((resource) => resource.custom === true);
+    const incompleteInventory = nonBookkeepingResources
+        .filter((resource) => resource.custom !== true && resource.custom !== false)
+        .map((resource) => ({
+        type: typeof resource.type === 'string' ? resource.type : 'unknown',
+        urn: typeof resource.urn === 'string' ? resource.urn : 'unknown',
+    }));
+    const refreshPreview = assessPulumiRefreshPreview({
+        childEnvironment: input.childEnvironment,
+        invocation: input.invocation,
+        ordinaryDiff: input.ordinaryDiff,
+        spawn: input.spawn,
+        toolVersion: input.toolVersion,
+    });
+    const refreshInventoryComplete = deployableResources.every((resource) => typeof resource.urn === 'string' &&
+        refreshPreview.observedRefreshUrns.includes(resource.urn));
+    const structuralResources = deployableResources
+        .map((resource) => ({
+        dependencies: Array.isArray(resource.dependencies)
+            ? [...resource.dependencies]
+                .filter((value) => typeof value === 'string')
+                .sort()
+            : [],
+        idPresent: typeof resource.id === 'string' && resource.id.length > 0,
+        parent: typeof resource.parent === 'string' ? resource.parent : null,
+        provider: typeof resource.provider === 'string' ? resource.provider : null,
+        type: typeof resource.type === 'string' ? resource.type : 'unknown',
+        urn: typeof resource.urn === 'string' ? resource.urn : 'unknown',
+    }))
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.urn, right.urn));
+    const tagged = deployableResources
+        .map((resource) => ({
+        arn: resourceArn(resource),
+        tags: expectedTags(resource),
+        urn: typeof resource.urn === 'string' ? resource.urn : 'unknown',
+    }))
+        .filter((value) => value.arn !== undefined && value.tags !== undefined);
+    const observedTags = new Map();
+    for (let index = 0; index < tagged.length; index += 100) {
+        const arns = tagged.slice(index, index + 100).map(({ arn }) => arn);
+        const result = record(runJsonCommand(input.spawn, 'aws', [
+            'resourcegroupstaggingapi',
+            'get-resources',
+            '--resource-arn-list',
+            ...arns,
+            '--output',
+            'json',
+        ], {
+            cwd: input.invocation.cwd,
+            env: input.childEnvironment,
+            label: 'AWS tagged-resource observation',
+        }), 'AWS tagged-resource observation');
+        if (!Array.isArray(result['ResourceTagMappingList'])) {
+            throw new Error('AWS tagged-resource observation is malformed.');
+        }
+        for (const item of result['ResourceTagMappingList']) {
+            const mapping = record(item, 'AWS tagged-resource mapping');
+            if (typeof mapping['ResourceARN'] !== 'string' ||
+                !Array.isArray(mapping['Tags'])) {
+                throw new Error('AWS tagged-resource mapping is malformed.');
+            }
+            observedTags.set(mapping['ResourceARN'], Object.fromEntries(mapping['Tags'].map((tag) => {
+                const value = record(tag, 'AWS resource tag');
+                if (typeof value['Key'] !== 'string' ||
+                    typeof value['Value'] !== 'string') {
+                    throw new Error('AWS resource tag is malformed.');
+                }
+                return [value['Key'], value['Value']];
+            })));
+        }
+    }
+    const drifted = tagged
+        .filter(({ arn, tags }) => {
+        const observed = observedTags.get(arn);
+        return observed && canonicalJson(observed) !== canonicalJson(tags);
+    })
+        .map(({ arn, urn }) => ({ arnDigest: digest(arn), urn }));
+    const taggedByUrn = new Map(tagged.map((resource) => [resource.urn, resource]));
+    const resourceByUrn = new Map(deployableResources.map((resource) => [
+        typeof resource.urn === 'string' ? resource.urn : 'unknown',
+        resource,
+    ]));
+    const coverage = structuralResources.map(({ type, urn }) => {
+        const taggedResource = taggedByUrn.get(urn);
+        const observed = taggedResource !== undefined && observedTags.has(taggedResource.arn);
+        const materialProperties = materialPropertyPaths(resourceByUrn.get(urn) ?? {});
+        const overlayProperties = [
+            ...(REFRESH_PREVIEW_PROPERTY_OVERLAYS[type] ?? []),
+            ...(type === 'aws:ssm/parameter:Parameter' &&
+                record(resourceByUrn.get(urn)?.inputs ?? {}, `${urn} inputs`)['type'] !== 'String'
+                ? ['inputs.value']
+                : []),
+        ].filter((path) => materialProperties.includes(path));
+        const refreshCoversResource = refreshPreview.complete &&
+            refreshPreview.desiredMatchesOrdinary &&
+            incompleteInventory.length === 0 &&
+            refreshPreview.observedRefreshUrns.includes(urn);
+        return {
+            adapter: refreshCoversResource
+                ? 'sst-pulumi-refresh-preview'
+                : taggedResource === undefined
+                    ? 'none'
+                    : 'aws-resource-groups-tagging-api',
+            arnDigest: taggedResource === undefined ? null : digest(taggedResource.arn),
+            coveredProperties: refreshCoversResource
+                ? [
+                    'existence',
+                    ...materialProperties.filter((path) => !overlayProperties.includes(path)),
+                ]
+                : observed
+                    ? ['existence', 'tags']
+                    : [],
+            type,
+            unobservedMaterialProperties: refreshCoversResource
+                ? overlayProperties
+                : materialProperties.length > 0
+                    ? materialProperties
+                    : ['service-native-configuration'],
+            urn,
+        };
+    });
+    const unsupported = coverage
+        .filter(({ coveredProperties, unobservedMaterialProperties }) => coveredProperties.length < 2 || unobservedMaterialProperties.length > 0)
+        .map(({ adapter, coveredProperties, type, unobservedMaterialProperties, urn, }) => ({
+        adapter,
+        coveredProperties,
+        type,
+        unobservedMaterialProperties,
+        urn,
+    }));
+    if (!refreshPreview.complete ||
+        !refreshPreview.desiredMatchesOrdinary ||
+        !refreshInventoryComplete ||
+        incompleteInventory.length > 0) {
+        unsupported.push({
+            adapter: 'sst-pulumi-refresh-preview',
+            coveredProperties: [],
+            type: 'full-stack-refresh-preview',
+            unobservedMaterialProperties: [
+                ...(!refreshPreview.complete ? ['preview.complete'] : []),
+                ...(!refreshPreview.desiredMatchesOrdinary
+                    ? ['preview.desired-plan-equivalence']
+                    : []),
+                ...(!refreshInventoryComplete ? ['preview.refresh-inventory'] : []),
+                ...(incompleteInventory.length > 0 ? ['state.custom-inventory'] : []),
+            ],
+            urn: 'full-stack',
+        });
+    }
+    const generatedAt = input.now.toISOString();
+    const expiresAt = new Date(input.now.getTime() + 60 * 60_000).toISOString();
+    const observerBinding = {
+        accountFingerprint: digest(expectedAccount),
+        backendBootstrapDigest: input.backendBootstrapDigest,
+        project: input.project,
+        region,
+        sourceCommit: input.sourceCommit,
+        stage,
+        stateLocationDigest: digest(canonicalJson({
+            bucketArn: stateLocation.bucketArn,
+            lockKey: stateLock.key,
+            stateKey: `app/${application}/${stage}.json`,
+        })),
+    };
+    const driftStatus = !refreshPreview.commandSucceeded
+        ? 'failed'
+        : refreshPreview.drift.resources.length > 0 || drifted.length > 0
+            ? 'drift-detected'
+            : unsupported.length > 0
+                ? 'partial-coverage'
+                : 'no-drift';
+    // The full export is canonicalized and hashed in memory. Only the digest is
+    // retained, so changes to IDs, inputs, outputs, protection, or provider
+    // metadata invalidate the state identity without persisting raw state.
+    const stateDigest = digest(canonicalJson(stateExists
+        ? { exportedState: exported, observerBinding }
+        : { observerBinding, stateKey, status: 'absent' }));
+    const resourceInventory = deployableResources
+        .map((resource) => {
+        const urn = typeof resource.urn === 'string' ? resource.urn : '';
+        const logicalId = urn.split('::').at(-1) ?? '';
+        const id = typeof resource.id === 'string' && resource.id.length > 0
+            ? resource.id
+            : undefined;
+        const arn = resourceArn(resource);
+        const selector = removePhysicalSelector(resource);
+        return {
+            dependencyDigests: Array.isArray(resource.dependencies)
+                ? resource.dependencies
+                    .filter((dependency) => typeof dependency === 'string' && dependency.length > 0)
+                    .map((dependency) => digest(dependency))
+                    .sort()
+                : [],
+            logicalId,
+            ...(arn ? { physicalArn: arn } : {}),
+            ...(id ? { physicalId: id } : {}),
+            ...(selector ? { physicalSelector: selector } : {}),
+            physicalIdentityDigest: id || arn
+                ? digest(canonicalJson({
+                    ...(arn ? { arn } : {}),
+                    ...(id ? { id } : {}),
+                }))
+                : null,
+            protected: typeof resource.protect === 'boolean' ? resource.protect : null,
+            resourceType: typeof resource.type === 'string' ? resource.type : 'unknown',
+            retainedOnDelete: typeof resource.retainOnDelete === 'boolean'
+                ? resource.retainOnDelete
+                : null,
+            urnDigest: digest(urn),
+        };
+    })
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType));
+    return {
+        callInventory: [
+            'resourcegroupstaggingapi:GetResources',
+            's3:GetObject',
+            's3:ListBucket',
+            'sst:DiffRefreshPreview',
+            'ssm:GetParameter',
+            'sts:GetCallerIdentity',
+        ],
+        drift: {
+            coverage,
+            digest: digest(canonicalJson({
+                coverage,
+                drifted,
+                incompleteInventory,
+                observerBinding,
+                refreshPreviewDigest: refreshPreview.digest,
+                refreshPreviewDrift: normalizedDiffMaterial(refreshPreview.drift),
+                refreshPreviewInventory: refreshPreview.observedRefreshUrns,
+                unsupported,
+            })),
+            expiresAt,
+            generatedAt,
+            status: driftStatus,
+        },
+        observerArnDigest: digest(caller['Arn']),
+        resources: resourceInventory,
+        state: {
+            backend: stateExists
+                ? 'sst-pulumi-state-export'
+                : 'sst-pulumi-state-absent',
+            digest: digest(canonicalJson({ lock: stateLock.digest, stateDigest })),
+            expiresAt,
+            locked: stateLock.locked,
+            observedAt: generatedAt,
+            stack: stackIdentity,
+            version: digest(canonicalJson({ lock: stateLock.digest, stateDigest })),
+        },
+    };
+}
+function writeGithubOutputs(environment, values) {
+    const path = environment.GITHUB_OUTPUT?.trim();
+    if (!path)
+        return;
+    (0, node_fs_1.appendFileSync)(path, `${Object.entries(values)
+        .map(([key, value]) => `${key}=${value}`)
+        .join('\n')}\n`, 'utf8');
+}
+function writePrivateEvidence(path, contents) {
+    (0, node_fs_1.writeFileSync)(path, contents, { encoding: 'utf8', mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+}
+function actionRisk(risk, action) {
+    if (action === 'deploy')
+        return risk;
+    const code = action === 'refresh'
+        ? 'protected-state-refresh'
+        : 'protected-stack-removal';
+    const message = action === 'refresh'
+        ? 'State refresh mutates recorded infrastructure state and requires an exact drift decision and recovery record.'
+        : 'Stack removal is destructive and requires exact recovery evidence and a point-of-no-return acknowledgement.';
+    const requiredApprovals = new Set(risk.requiredApprovals);
+    requiredApprovals.add('point-of-no-return');
+    if (action === 'refresh') {
+        requiredApprovals.add('drift-decision-and-state-recovery');
+    }
+    else {
+        requiredApprovals.add('data-owner-and-recovery');
+    }
+    return {
+        aggregate: [
+            'unknown',
+            'protection-reduction',
+            'security-expansion',
+        ].includes(risk.aggregate)
+            ? risk.aggregate
+            : 'stateful-or-destructive',
+        applyAllowed: false,
+        findings: [
+            ...risk.findings,
+            {
+                class: 'stateful-or-destructive',
+                code,
+                disposition: 'block',
+                message,
+            },
+        ],
+        requiredApprovals: [...requiredApprovals].sort(),
+    };
+}
+function validateGovernanceEvidence(reviewed, plan, observedResources = [], importIdentifierDigests = {}) {
+    const imports = plan.diff.resources.filter(({ operation }) => operation === 'import');
+    const replacements = plan.diff.resources.filter(({ operation, replacement }) => operation === 'replace' || replacement);
+    const requiresGovernance = plan.action !== 'deploy' || imports.length > 0 || replacements.length > 0;
+    if (!requiresGovernance)
+        return {};
+    if (!reviewed) {
+        throw new Error('Governed infrastructure mutation evidence is absent from the exact approval record.');
+    }
+    const governance = record(reviewed.governance, 'Infrastructure approval governance evidence');
+    const digests = {};
+    const common = (value, kind, label, extraKeys) => {
+        requireExactKeys(value, [
+            'kind',
+            'materialDigest',
+            'project',
+            'schemaVersion',
+            'sourceCommit',
+            'stage',
+            'stateDigest',
+            ...extraKeys,
+        ], label);
+        if (value['kind'] !== kind ||
+            value['schemaVersion'] !== 1 ||
+            value['materialDigest'] !== plan.materialDigest ||
+            value['project'] !== plan.projects[0] ||
+            value['sourceCommit'] !== plan.sourceCommit ||
+            value['stage'] !== plan.target.stage ||
+            value['stateDigest'] !== plan.state.digest) {
+            throw new Error(`${label} is stale or belongs to another exact plan.`);
+        }
+    };
+    if (plan.action === 'refresh') {
+        const decision = record(governance['driftDecision'], 'Refresh drift decision');
+        common(decision, 'ebk-infrastructure-drift-decision', 'Refresh drift decision', [
+            'actor',
+            'approvalRef',
+            'decision',
+            'driftEvidenceDigest',
+            'reviewedSourceChangeRef',
+            'runbookRef',
+        ]);
+        if (decision['decision'] !== 'adopt' ||
+            decision['driftEvidenceDigest'] !== plan.driftEvidenceDigest ||
+            decision['reviewedSourceChangeRef'] !== plan.sourceCommit ||
+            !['actor', 'approvalRef', 'runbookRef'].every((key) => typeof decision[key] === 'string' &&
+                decision[key].trim().length > 0)) {
+            throw new Error('Protected refresh requires an exact reviewed adopt decision bound to source, state, observation, and runbook.');
+        }
+        digests['drift-decision'] = digest(canonicalJson(decision));
+    }
+    if (plan.action === 'remove') {
+        const removal = record(governance['removal'], 'Infrastructure removal governance');
+        common(removal, 'ebk-infrastructure-removal-governance', 'Infrastructure removal governance', [
+            'cleanupEvidenceRef',
+            'dataExportEvidenceRef',
+            'dependentsDrained',
+            'foundationPreserved',
+            'resources',
+            'secretRevocationEvidenceRef',
+        ]);
+        const resources = removal['resources'];
+        const targets = [...observedResources].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+            (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType));
+        if (targets.length === 0 ||
+            targets.some(({ logicalId, physicalIdentityDigest, resourceType, urnDigest }) => !logicalId ||
+                resourceType === 'unknown' ||
+                !physicalIdentityDigest ||
+                !SHA256.test(physicalIdentityDigest) ||
+                !SHA256.test(urnDigest)) ||
+            !Array.isArray(resources) ||
+            resources.length !== targets.length ||
+            removal['dependentsDrained'] !== true ||
+            removal['foundationPreserved'] !== true ||
+            ![
+                'cleanupEvidenceRef',
+                'dataExportEvidenceRef',
+                'secretRevocationEvidenceRef',
+            ].every((key) => typeof removal[key] === 'string' &&
+                removal[key].trim().length > 0)) {
+            throw new Error('Protected remove lacks an exact deletion inventory, dependency drain, retained Foundation, data export, secret revocation, or cleanup proof.');
+        }
+        const byIdentity = new Map(resources.map((entry, index) => {
+            const value = record(entry, `Infrastructure removal resource ${index}`);
+            requireExactKeys(value, [
+                'dependencyDigests',
+                'disposition',
+                'logicalId',
+                'physicalIdentityDigest',
+                'protected',
+                'resourceType',
+                'retainedOnDelete',
+                'urnDigest',
+            ], `Infrastructure removal resource ${index}`);
+            return [
+                `${value['logicalId']}\u0000${value['resourceType']}`,
+                value,
+            ];
+        }));
+        for (const target of targets) {
+            const evidence = byIdentity.get(`${target.logicalId}\u0000${target.resourceType}`);
+            const disposition = target.retainedOnDelete === true ? 'retain' : 'delete';
+            if (!evidence ||
+                evidence['physicalIdentityDigest'] !== target.physicalIdentityDigest ||
+                evidence['urnDigest'] !== target.urnDigest ||
+                canonicalJson(evidence['dependencyDigests']) !==
+                    canonicalJson(target.dependencyDigests) ||
+                evidence['protected'] !== target.protected ||
+                evidence['retainedOnDelete'] !== target.retainedOnDelete ||
+                evidence['disposition'] !== disposition) {
+                throw new Error(`Infrastructure remove target ${target.logicalId} does not match the exact live state inventory and retention behavior.`);
+            }
+        }
+        if (byIdentity.size !== targets.length) {
+            throw new Error('Infrastructure removal target inventory is ambiguous.');
+        }
+        digests.removal = digest(canonicalJson(removal));
+    }
+    if (imports.length > 0) {
+        const importEvidence = record(governance['import'], 'Infrastructure import governance');
+        common(importEvidence, 'ebk-infrastructure-import-governance', 'Infrastructure import governance', ['resources']);
+        const resources = importEvidence['resources'];
+        if (!Array.isArray(resources) || resources.length !== imports.length) {
+            throw new Error('Infrastructure import governance must cover every exact imported resource.');
+        }
+        const byResource = new Map(resources.map((entry, index) => {
+            const value = record(entry, `Infrastructure import resource ${index}`);
+            requireExactKeys(value, [
+                'competingControllerCheck',
+                'logicalId',
+                'ownershipEvidenceRef',
+                'privateIdentifierDigest',
+                'removalBehavior',
+                'removalTestEvidenceRef',
+                'resourceType',
+            ], `Infrastructure import resource ${index}`);
+            return [
+                `${value['logicalId']}\u0000${value['resourceType']}`,
+                value,
+            ];
+        }));
+        for (const resource of imports) {
+            const key = infrastructureResourceKey(resource);
+            const evidence = byResource.get(key);
+            if (!evidence ||
+                evidence['resourceType'] !== resource.resourceType ||
+                evidence['competingControllerCheck'] !== 'passed' ||
+                !['retain', 'delete'].includes(String(evidence['removalBehavior'])) ||
+                evidence['privateIdentifierDigest'] !== importIdentifierDigests[key] ||
+                !['ownershipEvidenceRef', 'removalTestEvidenceRef'].every((key) => typeof evidence[key] === 'string' &&
+                    evidence[key].trim().length > 0)) {
+                throw new Error(`Infrastructure import ${resource.logicalId} lacks exact source-bound private identity, ownership, controller, and tested removal evidence.`);
+            }
+        }
+        if (byResource.size !== imports.length ||
+            Object.keys(importIdentifierDigests).length !== imports.length) {
+            throw new Error('Infrastructure import governance is ambiguous.');
+        }
+        digests.import = digest(canonicalJson(importEvidence));
+    }
+    if (replacements.length > 0) {
+        const replacementEvidence = record(governance['replacement'], 'Infrastructure replacement governance');
+        common(replacementEvidence, 'ebk-infrastructure-replacement-governance', 'Infrastructure replacement governance', ['resources']);
+        const resources = replacementEvidence['resources'];
+        if (!Array.isArray(resources) || resources.length !== replacements.length) {
+            throw new Error('Infrastructure replacement governance must cover every exact replacement.');
+        }
+        const byLogicalId = new Map(resources.map((entry, index) => {
+            const value = record(entry, `Infrastructure replacement resource ${index}`);
+            requireExactKeys(value, [
+                'dataCopyEvidenceRef',
+                'dependencyCutoverRef',
+                'logicalId',
+                'nameCollisionCheck',
+                'recoveryRunbookRef',
+                'resourceType',
+                'rollbackLimit',
+                'strategy',
+            ], `Infrastructure replacement resource ${index}`);
+            return [value['logicalId'], value];
+        }));
+        for (const resource of replacements) {
+            const evidence = byLogicalId.get(resource.logicalId);
+            if (!evidence ||
+                evidence['resourceType'] !== resource.resourceType ||
+                evidence['strategy'] !== resource.replacementStrategy ||
+                evidence['nameCollisionCheck'] !== 'passed' ||
+                ![
+                    'dataCopyEvidenceRef',
+                    'dependencyCutoverRef',
+                    'recoveryRunbookRef',
+                    'rollbackLimit',
+                ].every((key) => typeof evidence[key] === 'string' &&
+                    evidence[key].trim().length > 0)) {
+                throw new Error(`Infrastructure replacement ${resource.logicalId} lacks exact cutover, data, rollback, collision, or recovery evidence.`);
+            }
+        }
+        if (byLogicalId.size !== replacements.length) {
+            throw new Error('Infrastructure replacement governance is ambiguous.');
+        }
+        digests.replacement = digest(canonicalJson(replacementEvidence));
+    }
+    return Object.fromEntries(Object.entries(digests).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right)));
+}
+function computeCurrentInfrastructurePlan(input) {
+    const { action, context, dependencies, environment, invocation, options } = input;
+    const project = context.projectName;
+    if (!project) {
+        throw new Error('Infrastructure planning requires an Nx project name.');
+    }
+    const root = projectRoot(context, options);
+    const descriptorPath = relativeFile(root, options.descriptorPath ?? 'operations/infrastructure-change.json');
+    const descriptor = readDescriptor(descriptorPath, project);
+    const configurationPaths = options.configurationPaths ??
+        (options.configurationPath
+            ? [options.configurationPath]
+            : [
+                'configuration/declarations.json',
+                'configuration/declarations.ts',
+                'configuration/local-values.json',
+            ]);
+    const configurationInputs = [...new Set(configurationPaths)]
+        .sort()
+        .map((path) => ({
+        contents: (0, node_fs_1.readFileSync)(relativeFile(root, path), 'utf8'),
+        path,
+    }));
+    const spawn = dependencies.spawn ?? defaultSpawn;
+    const sourceCommit = assertCheckedOutSourceCommit(dependencies.spawn, context.root, environment);
+    const repository = requiredEnvironment(environment, 'GITHUB_REPOSITORY');
+    const candidateSourceCommit = input.candidateSourceCommit ?? sourceCommit;
+    const candidate = releaseCandidateBinding({
+        project,
+        repository,
+        sourceCommit: candidateSourceCommit,
+        workspaceRoot: context.root,
+    });
+    const childEnvironment = {
+        ...createCandidateBoundSstChildEnvironment(environment, invocation.environment, candidateSourceCommit),
+        EBK_CANDIDATE_IDENTITY: candidate.digest,
+    };
+    let backendBootstrapDigest = digest('dependency-supplied-observer');
+    if (dependencies.observe === undefined) {
+        const stateLocation = exactSstStateLocation(environment);
+        if (!stateLocation.applications.includes(project)) {
+            throw new Error('Current project is outside AWS_PLAN_SST_APPS_JSON.');
+        }
+        const stage = requiredEnvironment(childEnvironment, 'EBK_CONSUMER_STAGE');
+        backendBootstrapDigest = preflightSstBootstrap({
+            accountId: requiredEnvironment(environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/),
+            childEnvironment,
+            invocation,
+            region: requiredEnvironment(childEnvironment, 'AWS_REGION'),
+            spawn,
+            stateBucketName: stateLocation.bucketName,
+        });
+        preflightSstBackendParameter({
+            childEnvironment,
+            expectedType: 'SecureString',
+            invocation,
+            name: `/sst/passphrase/${project}/${stage}`,
+            spawn,
+        });
+        preflightProtectedSstSecrets({
+            application: project,
+            childEnvironment,
+            invocation,
+            spawn,
+            stage,
+            stateBucketName: stateLocation.bucketName,
+        });
+    }
+    const sstPath = invocation.args[0];
+    if (!sstPath)
+        throw new Error('Workspace SST path is missing.');
+    const versionResult = spawn(invocation.executable, [sstPath, 'version'], {
+        cwd: invocation.cwd,
+        encoding: 'utf8',
+        env: childEnvironment,
+        maxBuffer: MAX_JSON_BYTES,
+        shell: false,
+    });
+    const version = `${versionResult.stdout}\n${versionResult.stderr}`.match(/(?:^|\s)v?(\d+\.\d+\.\d+)(?:\s|$)/)?.[1] ?? 'unknown';
+    const diffResult = spawn(invocation.executable, [sstPath, 'diff', ...invocation.args.slice(2), '--json'], {
+        cwd: invocation.cwd,
+        encoding: 'utf8',
+        env: childEnvironment,
+        maxBuffer: 20 * 1024 * 1024,
+        shell: false,
+    });
+    const diff = (0, index_js_1.normalizeSstDiffV4_17_1)({
+        exitCode: diffResult.status ?? 1,
+        stdout: diffResult.stdout,
+        toolVersion: version,
+    });
+    const importIdentifierDigests = extractPrivateImportIdentifierDigests(diffResult.stdout, diff);
+    const iamValidations = iamPolicyDocuments({
+        accountId: requiredEnvironment(environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/),
+        childEnvironment,
+        diff,
+        diffStdout: diffResult.stdout,
+        invocation,
+        region: requiredEnvironment(childEnvironment, 'AWS_REGION'),
+        sourceCommit: candidateSourceCommit,
+        spawn,
+    });
+    const boundedCostQuotaEvidence = costQuotaEvidence({
+        accountId: requiredEnvironment(environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/),
+        childEnvironment,
+        diff,
+        invocation,
+        policy: descriptor.policy,
+        project,
+        region: requiredEnvironment(childEnvironment, 'AWS_REGION'),
+        sourceCommit: candidateSourceCommit,
+        spawn,
+    });
+    const policySignals = readOptionalArray(environment, 'EBK_INFRA_POLICY_SIGNALS_PATH');
+    const policyBearingIamResources = diff.resources.filter(({ operation, resourceType }) => operation !== 'delete' &&
+        [
+            'aws:iam/policy:Policy',
+            'aws:iam/role:Role',
+            'aws:iam/rolePolicy:RolePolicy',
+        ].includes(resourceType));
+    if (policyBearingIamResources.some(({ logicalId }) => !iamValidations.some((validation) => validation.logicalId === logicalId &&
+        validation.analyzer === 'aws-iam-access-analyzer-validate-policy' &&
+        validation.status === 'complete'))) {
+        policySignals.push({
+            class: 'unknown',
+            code: 'iam-access-analyzer-evidence-missing',
+            resourceId: 'iam-change-set',
+        });
+    }
+    const risk = actionRisk((0, index_js_1.classifyInfrastructureRisk)({
+        diff,
+        iamValidations,
+        policy: descriptor.policy,
+        policySignals,
+    }), action);
+    const now = (dependencies.now ?? (() => new Date()))();
+    const observation = (dependencies.observe ?? observeInfrastructureState)({
+        backendBootstrapDigest,
+        childEnvironment,
+        environment,
+        invocation,
+        now,
+        ordinaryDiff: diff,
+        project,
+        sourceCommit,
+        spawn,
+        toolVersion: version,
+    });
+    const drift = observation.drift;
+    const state = observation.state;
+    const expiresAt = new Date(Math.min(now.getTime() + 60 * 60_000, Date.parse(drift.expiresAt), Date.parse(state.expiresAt)));
+    const account = requiredEnvironment(environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/);
+    const framework = frameworkVersion(context.root);
+    const planAuthorityDigest = planAuthorityPolicyDigest(environment);
+    return {
+        costQuotaEvidence: boundedCostQuotaEvidence,
+        descriptor,
+        diffStderr: diffResult.stderr,
+        diffStdout: diffResult.stdout,
+        iamValidations,
+        importIdentifierDigests,
+        observation,
+        plan: (0, index_js_1.createInfrastructurePlan)({
+            action,
+            configurationMetadataDigest: digest(canonicalJson({
+                configurationInputs,
+                releaseCandidateDigest: candidate.digest,
+            })),
+            diff,
+            driftEvidenceDigest: drift.digest,
+            driftEvidenceExpiresAt: drift.expiresAt,
+            driftEvidenceGeneratedAt: drift.generatedAt,
+            driftStatus: drift.status,
+            expiresAt: expiresAt.toISOString(),
+            frameworkVersion: framework,
+            generatedAt: now.toISOString(),
+            policyProfileDigest: digest(descriptor.raw),
+            projects: [project],
+            repository,
+            risk,
+            sourceCommit,
+            state,
+            target: {
+                accountFingerprint: digest(account),
+                region: requiredEnvironment(childEnvironment, 'AWS_REGION', /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/),
+                stage: requiredEnvironment(childEnvironment, 'EBK_CONSUMER_STAGE'),
+            },
+            versions: {
+                '@empire-builder-kit/nx': framework,
+                ...frameworkAndBlueprintVersions(context.root, root),
+                'infrastructure-observer': digest(canonicalJson({
+                    callInventory: observation.callInventory,
+                    resourceInventory: (observation.resources ?? []).map(({ dependencyDigests, logicalId, physicalIdentityDigest, protected: protectedResource, resourceType, retainedOnDelete, urnDigest, }) => ({
+                        dependencyDigests,
+                        logicalId,
+                        physicalIdentityDigest,
+                        protected: protectedResource,
+                        resourceType,
+                        retainedOnDelete,
+                        urnDigest,
+                    })),
+                })),
+                'plan-authority-policy': planAuthorityDigest,
+                'iam-validation-evidence': digest(canonicalJson(iamValidations)),
+                'import-private-identifiers': digest(canonicalJson(importIdentifierDigests)),
+                'cost-quota-evidence': digest(canonicalJson(boundedCostQuotaEvidence)),
+                'release-candidate': candidate.digest,
+                sst: index_js_1.SST_DIFF_TOOL_VERSION,
+            },
+        }),
+        planAuthorityDigest,
+        toolVersion: version,
+    };
+}
+async function runInfrastructurePlanExecutor(options, context, environment = process.env, dependencies = {}) {
+    const action = options.action ?? 'deploy';
+    const root = projectRoot(context, options);
+    const invocation = (0, run_sst_command_js_1.buildSstCommandInvocation)(action, options, context, environment);
+    const current = computeCurrentInfrastructurePlan({
+        action,
+        candidateSourceCommit: approvalCandidateSourceCommit(context, {
+            ...options,
+            action,
+        }, environment),
+        context,
+        dependencies,
+        environment,
+        invocation,
+        options,
+    });
+    const { descriptor, plan } = current;
+    const project = context.projectName;
+    if (!project) {
+        throw new Error('Infrastructure planning requires an Nx project name.');
+    }
+    const now = (dependencies.now ?? (() => new Date()))();
+    let planned = plan;
+    let approval;
+    let reviewedApproval;
+    let changes = [];
+    if (descriptor.standingPolicyRiskClasses.includes(plan.aggregateRisk) &&
+        plan.requiredApprovals.length === 0) {
+        approval = {
+            approvedAt: now.toISOString(),
+            approver: 'committed-standing-policy',
+            author: 'committed-standing-policy',
+            codeownerReviewed: true,
+            evidenceRefs: {},
+            expiresAt: plan.expiresAt,
+            materialDigest: plan.materialDigest,
+            mode: 'standing-policy',
+            stage: plan.target.stage,
+        };
+    }
+    else {
+        const approvalRecordPath = options.approvalPath ?? 'operations/infrastructure-approval.json';
+        const approvalPath = relativeFile(context.root, approvalRecordPath);
+        if ((0, node_fs_1.existsSync)(approvalPath)) {
+            const batch = record(readJsonFile(approvalPath, 'Infrastructure approval'), 'Infrastructure approval');
+            const expectedProjects = requiredEnvironment(environment, 'ORDERED_PROJECTS')
+                .split(',')
+                .filter(Boolean);
+            if (batch.kind !== 'ebk-infrastructure-approval-batch' ||
+                batch.schemaVersion !== 1 ||
+                batch.action !== action ||
+                batch.stage !== plan.target.stage ||
+                !Array.isArray(batch.orderedProjects) ||
+                JSON.stringify(batch.orderedProjects) !==
+                    JSON.stringify(expectedProjects) ||
+                typeof batch.projects !== 'object' ||
+                batch.projects === null ||
+                Array.isArray(batch.projects) ||
+                Object.keys(batch.projects).sort().join(',') !==
+                    [...expectedProjects].sort().join(',')) {
+                throw new Error('Infrastructure approval batch does not bind the exact ordered project set, action, and stage.');
+            }
+            const reviewed = batch.projects[project];
+            if (!reviewed) {
+                throw new Error(`Infrastructure approval batch omitted project ${project}.`);
+            }
+            if (reviewed.approval.recordPath !== approvalRecordPath) {
+                throw new Error('Infrastructure approval batch uses an invalid approval record path.');
+            }
+            reviewedApproval = reviewed;
+            planned = reviewed.planned;
+            approval = reviewed.approval;
+            changes = sourceChanges(dependencies.spawn, context.root, environment, planned.sourceCommit);
+        }
+    }
+    const validation = (0, index_js_1.validateInfrastructurePlanForApply)({
+        ...(approval ? { approval } : {}),
+        now: now.toISOString(),
+        planned,
+        recomputed: plan,
+        sourceChangesSincePlan: changes,
+    });
+    const governanceEvidenceDigests = approval
+        ? validateGovernanceEvidence(reviewedApproval, planned, current.observation.resources, current.importIdentifierDigests)
+        : {};
+    const authorization = {
+        action,
+        ...(approval ? { approval } : {}),
+        ...(Object.keys(governanceEvidenceDigests).length > 0
+            ? { governanceEvidenceDigests }
+            : {}),
+        kind: 'ebk-infrastructure-authorization',
+        plannedMaterialDigest: planned.materialDigest,
+        recomputedMaterialDigest: plan.materialDigest,
+        schemaVersion: 1,
+        sourceChangesSincePlan: changes,
+        validation,
+    };
+    const evidenceDirectory = (0, node_path_1.join)(root, '.ebk', 'evidence');
+    (0, node_fs_1.mkdirSync)(evidenceDirectory, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(evidenceDirectory, 0o700);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.raw.json'), current.diffStdout);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.private-stderr.txt'), current.diffStderr);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.json'), `${JSON.stringify(plan, null, 2)}\n`);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan-authorization.json'), `${JSON.stringify(authorization, null, 2)}\n`);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-observer-authority.json'), `${JSON.stringify({
+        kind: 'ebk-infrastructure-observer-authority',
+        observerArnDigest: current.observation.observerArnDigest,
+        planAuthorityDigest: current.planAuthorityDigest,
+        project,
+        schemaVersion: 1,
+        sourceCommit: plan.sourceCommit,
+        stage: plan.target.stage,
+    }, null, 2)}\n`);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan-command.json'), `${JSON.stringify({
+        action,
+        rawDigest: digest(current.diffStdout),
+        schemaVersion: 1,
+        stderrDigest: digest(current.diffStderr),
+        toolVersion: current.toolVersion,
+    }, null, 2)}\n`);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-iam-validation.json'), `${JSON.stringify({
+        kind: 'ebk-infrastructure-iam-validation',
+        schemaVersion: 1,
+        validations: current.iamValidations,
+    }, null, 2)}\n`);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-cost-quota.json'), `${JSON.stringify({
+        ...current.costQuotaEvidence,
+        kind: 'ebk-infrastructure-cost-quota',
+        schemaVersion: 1,
+    }, null, 2)}\n`);
+    writeGithubOutputs(environment, {
+        material_digest: plan.materialDigest,
+        outcome: validation.outcome,
+    });
+    devkit_1.logger.info(`[ebk-infrastructure-plan] ${validation.outcome}\n${JSON.stringify({ plan, validation }, null, 2)}`);
+    const approvalMode = repositoryInfrastructureApprovalMode(context, plan.target.stage);
+    const waitsForEnvironmentReviewer = approvalMode === 'environment-reviewer' &&
+        plan.target.stage === 'production' &&
+        (0, index_js_1.isEnvironmentReviewerPendingAuthorization)(authorization);
+    return { success: validation.allowed || waitsForEnvironmentReviewer };
+}
+async function revalidateInfrastructureMutationAuthorization(action, options, context, invocation, environment = process.env, dependencies = {}) {
+    const root = projectRoot(context, options);
+    const evidenceDirectory = (0, node_path_1.join)(root, '.ebk', 'evidence');
+    const retainedPlan = record(readJsonFile((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.json'), 'Retained infrastructure plan'), 'Retained infrastructure plan');
+    const authorizationRaw = (0, node_fs_1.readFileSync)((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan-authorization.json'), 'utf8');
+    const retainedAuthorization = record(parseJson(authorizationRaw, 'Retained infrastructure authorization'), 'Retained infrastructure authorization');
+    const stage = invocation.environment.EBK_CONSUMER_STAGE;
+    const approvalMode = repositoryInfrastructureApprovalMode(context, stage);
+    const reviewedSummaryDigest = environment.EBK_ENVIRONMENT_REVIEWED_PLAN_DIGEST?.trim();
+    if (reviewedSummaryDigest && approvalMode !== 'environment-reviewer') {
+        throw new Error('An environment-reviewed plan digest is invalid unless committed policy selects environment-reviewer.');
+    }
+    let environmentAdmission;
+    if (approvalMode === 'environment-reviewer') {
+        if (!reviewedSummaryDigest || !SHA256.test(reviewedSummaryDigest)) {
+            throw new Error(`Protected ${action} requires the exact digest displayed at the production environment reviewer pause.`);
+        }
+        const retainedSummary = record(readJsonFile((0, node_path_1.join)(context.root, '.ebk', 'evidence', 'infrastructure-plan-summary.json'), 'Retained infrastructure plan summary'), 'Retained infrastructure plan summary');
+        const validatedSummary = (0, index_js_1.revalidateInfrastructurePlanSummary)({
+            evidence: projectEvidence(context, retainedSummary.projects.map(({ project }) => project)),
+            expectedDigest: reviewedSummaryDigest,
+            retained: retainedSummary,
+        });
+        if (validatedSummary.action !== action ||
+            validatedSummary.approvalMode !== approvalMode ||
+            validatedSummary.sourceCommit !==
+                requiredEnvironment(environment, 'EBK_SOURCE_COMMIT', SOURCE_COMMIT) ||
+            validatedSummary.stage !== stage ||
+            !validatedSummary.projects.some(({ project }) => project === context.projectName)) {
+            throw new Error('The environment-reviewed infrastructure plan digest does not match the current action, source, stage, or project.');
+        }
+        environmentAdmission = {
+            mode: 'environment-reviewer',
+            planSummaryDigest: reviewedSummaryDigest,
+        };
+    }
+    const retainedPlanClean = retainedAuthorization.validation?.allowed === true &&
+        retainedAuthorization.validation.outcome === 'plan-clean' &&
+        retainedAuthorization.approval !== undefined;
+    const retainedEnvironmentPending = environmentAdmission !== undefined &&
+        (0, index_js_1.isEnvironmentReviewerPendingAuthorization)(retainedAuthorization);
+    if (retainedAuthorization.kind !== 'ebk-infrastructure-authorization' ||
+        retainedAuthorization.schemaVersion !== 1 ||
+        retainedAuthorization.action !== action ||
+        (!retainedPlanClean && !retainedEnvironmentPending) ||
+        retainedAuthorization.recomputedMaterialDigest !==
+            retainedPlan.materialDigest ||
+        retainedPlan.action !== action ||
+        retainedPlan.target.stage !== invocation.environment.EBK_CONSUMER_STAGE ||
+        !retainedPlan.projects.includes(context.projectName ?? '')) {
+        throw new Error(`Protected ${action} requires the exact retained plan and plan-clean authorization for the current project and stage.`);
+    }
+    const planOptions = {
+        ...options,
+        action,
+    };
+    const candidateSourceCommit = approvalCandidateSourceCommit(context, planOptions, environment) ??
+        retainedPlan.sourceCommit;
+    const recomputedCurrent = computeCurrentInfrastructurePlan({
+        action,
+        candidateSourceCommit,
+        context,
+        dependencies,
+        environment,
+        invocation,
+        options: planOptions,
+    });
+    const recomputed = recomputedCurrent.plan;
+    let reviewedApproval;
+    const approvalRecordPath = retainedAuthorization.approval?.recordPath;
+    if (approvalRecordPath) {
+        const batch = record(readJsonFile(relativeFile(context.root, approvalRecordPath), 'Retained infrastructure approval governance'), 'Retained infrastructure approval governance');
+        reviewedApproval = batch.projects[context.projectName ?? ''];
+    }
+    const governanceEvidenceDigests = validateGovernanceEvidence(reviewedApproval, reviewedApproval?.planned ?? retainedPlan, recomputedCurrent.observation.resources, recomputedCurrent.importIdentifierDigests);
+    if (canonicalJson(governanceEvidenceDigests) !==
+        canonicalJson(retainedAuthorization.governanceEvidenceDigests ?? {})) {
+        throw new Error('Governed infrastructure mutation evidence changed after plan authorization.');
+    }
+    const changes = sourceChanges(dependencies.spawn, context.root, environment, retainedPlan.sourceCommit);
+    const now = (dependencies.now ?? (() => new Date()))().toISOString();
+    const validationPlan = retainedAuthorization.approval?.mode === 'human-record'
+        ? {
+            ...retainedPlan,
+            // The retained authorization already proved the reviewer acted after
+            // the originally reviewed plan. A resume recomputation has a later
+            // generatedAt, which is deliberately non-material.
+            generatedAt: retainedAuthorization.approval.approvedAt,
+        }
+        : retainedPlan;
+    const validation = (0, index_js_1.validateInfrastructurePlanForApply)({
+        ...(retainedAuthorization.approval
+            ? { approval: retainedAuthorization.approval }
+            : {}),
+        now,
+        planned: validationPlan,
+        recomputed,
+        sourceChangesSincePlan: changes,
+    });
+    const environmentReviewerAllowed = environmentAdmission !== undefined &&
+        (0, index_js_1.isEnvironmentReviewerPendingAuthorization)({
+            ...retainedAuthorization,
+            plannedMaterialDigest: validationPlan.materialDigest,
+            recomputedMaterialDigest: recomputed.materialDigest,
+            validation,
+        });
+    const binding = {
+        action,
+        kind: 'ebk-infrastructure-mutation-binding',
+        recomputedMaterialDigest: recomputed.materialDigest,
+        retainedAuthorizationDigest: digest(authorizationRaw),
+        retainedMaterialDigest: retainedPlan.materialDigest,
+        schemaVersion: 1,
+        sourceCommit: recomputed.sourceCommit,
+        stage: recomputed.target.stage,
+        ...(Object.keys(governanceEvidenceDigests).length > 0
+            ? { governanceEvidenceDigests }
+            : {}),
+        ...(environmentAdmission ? { environmentAdmission } : {}),
+        validation,
+        verifiedAt: now,
+    };
+    (0, node_fs_1.mkdirSync)(evidenceDirectory, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(evidenceDirectory, 0o700);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-mutation-binding.json'), `${JSON.stringify(binding, null, 2)}\n`);
+    if (!validation.allowed && !environmentReviewerAllowed) {
+        throw new Error(`Protected ${action} authorization became stale before mutation: ${validation.findings
+            .map(({ code }) => code)
+            .join(', ')}.`);
+    }
+    if (action === 'remove') {
+        const spawn = dependencies.spawn ?? defaultSpawn;
+        const childEnvironment = createCandidateBoundSstChildEnvironment(environment, invocation.environment, candidateSourceCommit);
+        const resources = (recomputedCurrent.observation.resources ?? []).map((resource) => {
+            const probe = standardRemoveProbeForResource(resource);
+            const observation = probeStandardRemoveResource({
+                childEnvironment,
+                invocation,
+                probe,
+                spawn,
+            });
+            if (!observation.present ||
+                (resource.retainedOnDelete === true && !observation.protectionDigest)) {
+                throw new Error(`Infrastructure remove target ${resource.logicalId} is absent or lacks exact pre-remove retention protection.`);
+            }
+            return {
+                ...resource,
+                adapter: probe,
+                disposition: resource.retainedOnDelete === true ? 'retain' : 'delete',
+                ownership: 'slice-stack',
+                preRemoveProtectionDigest: observation.protectionDigest,
+            };
+        });
+        if (resources.length === 0) {
+            throw new Error('Protected remove requires a non-empty exact private resource inventory.');
+        }
+        const removeInventoryContents = `${JSON.stringify({
+            action,
+            foundation: {
+                disposition: 'excluded-retained',
+                ownership: 'separate-foundation-stack',
+            },
+            kind: 'ebk-infrastructure-remove-inventory',
+            materialDigest: recomputed.materialDigest,
+            project: context.projectName,
+            resources,
+            schemaVersion: 1,
+            secretAndRegistrationChecks: resources
+                .filter(({ adapter }) => adapter.kind === 'aws-secrets-manager-secret' ||
+                adapter.kind === 'aws-ssm-parameter')
+                .map(({ adapter, logicalId, physicalIdentityDigest }) => ({
+                identityDigest: physicalIdentityDigest,
+                kind: adapter.protectionProfile,
+                logicalId,
+            })),
+            sourceCommit: recomputed.sourceCommit,
+            stage: recomputed.target.stage,
+            stateDigest: recomputed.state.digest,
+        }, null, 2)}\n`;
+        writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-remove-inventory.json'), removeInventoryContents);
+        writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-mutation-binding.json'), `${JSON.stringify({
+            ...binding,
+            removeInventoryDigest: digest(removeInventoryContents),
+        }, null, 2)}\n`);
+    }
+}
+async function recordInfrastructureMutationConvergence(action, options, context, invocation, applySucceeded, environment = process.env, dependencies = {}) {
+    const root = projectRoot(context, options);
+    const evidenceDirectory = (0, node_path_1.join)(root, '.ebk', 'evidence');
+    const retainedPlan = record(readJsonFile((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.json'), 'Retained infrastructure plan'), 'Retained infrastructure plan');
+    const mutationBindingContents = (0, node_fs_1.readFileSync)((0, node_path_1.join)(evidenceDirectory, 'infrastructure-mutation-binding.json'), 'utf8');
+    const mutationBinding = record(parseJson(mutationBindingContents, 'Retained infrastructure mutation binding'), 'Retained infrastructure mutation binding');
+    const project = context.projectName;
+    if (!project ||
+        mutationBinding['kind'] !== 'ebk-infrastructure-mutation-binding' ||
+        mutationBinding['schemaVersion'] !== 1 ||
+        mutationBinding['action'] !== action ||
+        mutationBinding['retainedMaterialDigest'] !== retainedPlan.materialDigest ||
+        mutationBinding['sourceCommit'] !== retainedPlan.sourceCommit ||
+        mutationBinding['stage'] !== retainedPlan.target.stage ||
+        retainedPlan.projects.length !== 1 ||
+        retainedPlan.projects[0] !== project) {
+        throw new Error('Infrastructure convergence requires the exact retained mutation binding.');
+    }
+    const evidenceBinding = {
+        accountFingerprint: retainedPlan.target.accountFingerprint,
+        authorizedMaterialDigest: String(mutationBinding['recomputedMaterialDigest']),
+        mutationBindingDigest: digest(mutationBindingContents),
+        plannedMaterialDigest: retainedPlan.materialDigest,
+        project,
+        region: retainedPlan.target.region,
+        sourceCommit: retainedPlan.sourceCommit,
+        stage: retainedPlan.target.stage,
+    };
+    let result;
+    let converged = false;
+    try {
+        const planOptions = {
+            ...options,
+            action,
+        };
+        const candidateSourceCommit = approvalCandidateSourceCommit(context, planOptions, environment) ??
+            retainedPlan.sourceCommit;
+        const current = computeCurrentInfrastructurePlan({
+            action,
+            candidateSourceCommit,
+            context,
+            dependencies,
+            environment,
+            invocation,
+            options: planOptions,
+        });
+        if (action === 'remove') {
+            const removeInventoryContents = (0, node_fs_1.readFileSync)((0, node_path_1.join)(evidenceDirectory, 'infrastructure-remove-inventory.json'), 'utf8');
+            const removeInventory = record(parseJson(removeInventoryContents, 'Retained infrastructure remove inventory'), 'Retained infrastructure remove inventory');
+            const inventoryResources = Array.isArray(removeInventory['resources'])
+                ? removeInventory['resources']
+                : [];
+            const foundation = record(removeInventory['foundation'], 'Retained Foundation exclusion');
+            const secretAndRegistrationChecks = Array.isArray(removeInventory['secretAndRegistrationChecks'])
+                ? removeInventory['secretAndRegistrationChecks']
+                : [];
+            const inventoryValid = removeInventory['kind'] === 'ebk-infrastructure-remove-inventory' &&
+                removeInventory['schemaVersion'] === 1 &&
+                removeInventory['action'] === 'remove' &&
+                removeInventory['materialDigest'] === retainedPlan.materialDigest &&
+                removeInventory['project'] === project &&
+                removeInventory['sourceCommit'] === retainedPlan.sourceCommit &&
+                removeInventory['stage'] === retainedPlan.target.stage &&
+                mutationBinding['removeInventoryDigest'] ===
+                    digest(removeInventoryContents) &&
+                inventoryResources.length > 0 &&
+                foundation['disposition'] === 'excluded-retained' &&
+                foundation['ownership'] === 'separate-foundation-stack';
+            const childEnvironment = createCandidateBoundSstChildEnvironment(environment, invocation.environment, candidateSourceCommit);
+            const spawn = dependencies.spawn ?? defaultSpawn;
+            const findings = [
+                ...(applySucceeded ? [] : ['SST remove did not complete.']),
+                ...(inventoryValid
+                    ? []
+                    : [
+                        'The retained pre-remove deletion inventory is absent or invalid.',
+                    ]),
+            ];
+            const observations = [];
+            if (inventoryValid) {
+                const expectedSensitiveChecks = new Map(secretAndRegistrationChecks.map((entry, index) => {
+                    const check = record(entry, `Secret or registration remove check ${index}`);
+                    return [check['logicalId'], check];
+                }));
+                for (const [index, value] of inventoryResources.entries()) {
+                    try {
+                        const resource = record(value, `Retained remove resource ${index}`);
+                        const adapter = record(resource['adapter'], `Retained remove adapter ${index}`);
+                        const logicalId = typeof resource['logicalId'] === 'string'
+                            ? resource['logicalId']
+                            : `resource-${index}`;
+                        const disposition = resource['disposition'];
+                        const expectedProtection = resource['preRemoveProtectionDigest'];
+                        if (resource['ownership'] !== 'slice-stack' ||
+                            !['delete', 'retain'].includes(String(disposition)) ||
+                            typeof adapter.identifier !== 'string' ||
+                            !adapter.identifier ||
+                            ![
+                                'aws-cloud-control',
+                                'aws-events-target',
+                                'aws-iam-role-policy',
+                                'aws-kms-retained',
+                                'aws-lambda-event-invoke-config',
+                                'aws-lambda-permission',
+                                'aws-logs-data-protection-policy',
+                                'aws-s3-retained',
+                                'aws-s3-object',
+                                'aws-secrets-manager-secret',
+                                'aws-sqs-queue-policy',
+                                'aws-ssm-parameter',
+                            ].includes(adapter.kind) ||
+                            (adapter.kind === 'aws-cloud-control' &&
+                                (typeof adapter.typeName !== 'string' || !adapter.typeName))) {
+                            throw new Error('private adapter binding is malformed');
+                        }
+                        const sensitive = adapter.kind === 'aws-secrets-manager-secret' ||
+                            adapter.kind === 'aws-ssm-parameter';
+                        if (sensitive) {
+                            const check = expectedSensitiveChecks.get(logicalId);
+                            if (!check ||
+                                check['identityDigest'] !==
+                                    resource['physicalIdentityDigest'] ||
+                                check['kind'] !== adapter.protectionProfile) {
+                                throw new Error('secret or registration check is absent or stale');
+                            }
+                        }
+                        const observation = probeStandardRemoveResource({
+                            childEnvironment,
+                            invocation,
+                            probe: adapter,
+                            spawn,
+                        });
+                        const exact = disposition === 'delete'
+                            ? !observation.present
+                            : observation.present &&
+                                typeof expectedProtection === 'string' &&
+                                SHA256.test(expectedProtection) &&
+                                observation.protectionDigest === expectedProtection;
+                        if (!exact) {
+                            throw new Error(disposition === 'delete'
+                                ? 'resource still exists'
+                                : 'retained identity or protection changed');
+                        }
+                        observations.push({
+                            adapter: adapter.kind,
+                            disposition: String(disposition),
+                            logicalId,
+                            status: disposition === 'delete'
+                                ? 'absence-confirmed'
+                                : 'retention-confirmed',
+                        });
+                    }
+                    catch (error) {
+                        findings.push(`Remove verification failed for resource ${index}: ${error instanceof Error ? error.message : String(error)}.`);
+                    }
+                }
+                if (expectedSensitiveChecks.size !==
+                    inventoryResources.filter((value) => {
+                        const resource = record(value, 'Sensitive remove resource');
+                        const adapter = record(resource['adapter'], 'Sensitive remove adapter');
+                        return (adapter['kind'] === 'aws-secrets-manager-secret' ||
+                            adapter['kind'] === 'aws-ssm-parameter');
+                    }).length) {
+                    findings.push('Secret and registration removal checks are incomplete or ambiguous.');
+                }
+            }
+            const stateAbsent = current.observation.resources?.length === 0 &&
+                current.observation.state.backend === 'sst-pulumi-state-absent';
+            if (!stateAbsent) {
+                findings.push('The exact Slice stack state or resource inventory remains present after remove.');
+            }
+            converged = findings.length === 0;
+            result = {
+                action,
+                ...evidenceBinding,
+                converged,
+                findings,
+                inventoryDigest: digest(canonicalJson(removeInventory)),
+                kind: 'ebk-infrastructure-convergence',
+                observations,
+                outcome: converged ? 'converged' : 'cleanup-incomplete',
+                postPlan: current.plan.diff,
+                recomputedMaterialDigest: current.plan.materialDigest,
+                providerCoverage: 'fixed-standard-service-native-adapters',
+                schemaVersion: 1,
+            };
+        }
+        else {
+            const postPlanEmpty = current.plan.diff.complete && current.plan.diff.resources.length === 0;
+            const requiredCheckIds = action === 'deploy'
+                ? ['deployed-smoke', 'alarm-health', 'data-integrity']
+                : [];
+            const convergence = (0, index_js_1.evaluatePostApplyConvergence)({
+                apply: {
+                    // A failed provider operation may have partially applied any
+                    // resource in the authorized plan. The empty recomputed post-plan
+                    // cannot prove that no provider mutation occurred.
+                    changedResourceCount: retainedPlan.diff.resources.length,
+                    status: applySucceeded ? 'succeeded' : 'failed',
+                },
+                checks: [],
+                cleanupDebt: [],
+                drift: {
+                    findings: [],
+                    status: current.plan.driftStatus,
+                    unsupported: [],
+                },
+                postPlan: current.plan.diff,
+                requiredCheckIds,
+            });
+            converged = convergence.converged;
+            result = {
+                action,
+                ...evidenceBinding,
+                ...convergence,
+                kind: 'ebk-infrastructure-convergence',
+                postPlan: current.plan.diff,
+                postApplyDrift: {
+                    evidenceDigest: current.plan.driftEvidenceDigest,
+                    evidenceExpiresAt: current.plan.driftEvidenceExpiresAt,
+                    evidenceGeneratedAt: current.plan.driftEvidenceGeneratedAt,
+                    status: current.plan.driftStatus,
+                },
+                recomputedMaterialDigest: current.plan.materialDigest,
+                ...(action === 'refresh'
+                    ? {
+                        driftBasis: postPlanEmpty && current.plan.driftStatus === 'no-drift'
+                            ? 'live-observer-no-drift-and-empty-source-state-plan'
+                            : 'live-observer-not-converged',
+                    }
+                    : {}),
+                schemaVersion: 1,
+            };
+        }
+    }
+    catch (error) {
+        result = {
+            action,
+            ...evidenceBinding,
+            converged: false,
+            findings: [error instanceof Error ? error.message : String(error)],
+            kind: 'ebk-infrastructure-convergence',
+            outcome: 'recovery-required',
+            schemaVersion: 1,
+        };
+    }
+    (0, node_fs_1.mkdirSync)(evidenceDirectory, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(evidenceDirectory, 0o700);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-convergence.json'), `${JSON.stringify(result, null, 2)}\n`);
+    // A successful deploy intentionally hands off nonterminal
+    // apply-complete-unverified evidence to deployed smoke. The lifecycle
+    // command succeeded, but no caller may treat this return value as terminal
+    // convergence; only finalizeInfrastructureMutationConvergence can write it.
+    return (converged ||
+        (action === 'deploy' &&
+            applySucceeded &&
+            result['outcome'] === 'apply-complete-unverified'));
+}
+async function finalizeInfrastructureMutationConvergence(options, context, environment = process.env, dependencies = {}) {
+    const root = projectRoot(context, options);
+    const project = context.projectName;
+    if (!project) {
+        throw new Error('Infrastructure convergence finalization requires one exact Nx project.');
+    }
+    const evidenceDirectory = (0, node_path_1.join)(root, '.ebk', 'evidence');
+    const selectedPath = (value, fallback) => relativeFile(root, value ?? (0, node_path_1.join)('.ebk', 'evidence', fallback));
+    const pendingPath = selectedPath(options.pendingConvergencePath, 'infrastructure-convergence.json');
+    const mutationPath = selectedPath(options.mutationBindingPath, 'infrastructure-mutation-binding.json');
+    const smokePath = selectedPath(options.smokeEvidencePath, 'smoke-deployed.json');
+    const smokeBindingPath = selectedPath(options.smokeBindingPath, 'deployment-binding.json');
+    const operationalPath = selectedPath(options.operationalEvidencePath, 'infrastructure-operational-evidence.json');
+    const pendingContents = (0, node_fs_1.readFileSync)(pendingPath, 'utf8');
+    const mutationContents = (0, node_fs_1.readFileSync)(mutationPath, 'utf8');
+    const smokeContents = (0, node_fs_1.readFileSync)(smokePath, 'utf8');
+    const smokeBindingContents = (0, node_fs_1.readFileSync)(smokeBindingPath, 'utf8');
+    const operationalContents = (0, node_fs_1.readFileSync)(operationalPath, 'utf8');
+    const pending = record(parseJson(pendingContents, 'Pending infrastructure convergence'), 'Pending infrastructure convergence');
+    const mutation = record(parseJson(mutationContents, 'Infrastructure mutation binding'), 'Infrastructure mutation binding');
+    const smoke = record(parseJson(smokeContents, 'Deployed smoke evidence'), 'Deployed smoke evidence');
+    const smokeBinding = record(parseJson(smokeBindingContents, 'Deployed smoke binding'), 'Deployed smoke binding');
+    const operational = record(parseJson(operationalContents, 'Infrastructure operational evidence'), 'Infrastructure operational evidence');
+    const postPlan = record(pending['postPlan'], 'Pending infrastructure post-apply plan');
+    const postApplyDrift = record(pending['postApplyDrift'], 'Pending infrastructure post-apply drift');
+    const smokeSource = record(smoke['source'], 'Deployed smoke source');
+    const smokeEnvironment = record(smoke['environment'], 'Deployed smoke environment');
+    const smokeOperation = record(smoke['operation'], 'Deployed smoke operation');
+    const smokeCleanup = record(smoke['cleanup'], 'Deployed smoke cleanup');
+    const smokeCounts = record(smoke['counts'], 'Deployed smoke counts');
+    const deployment = record(smokeBinding['deployment'], 'Deployed smoke deployment identity');
+    const smokeIdentity = record(smokeBinding['smoke'], 'Deployed smoke workflow identity');
+    const operationalSmoke = record(operational['smoke'], 'Operational smoke binding');
+    const operationalData = record(operational['data'], 'Operational data binding');
+    const operationalFrontend = record(operational['frontend'], 'Operational frontend binding');
+    const alarms = operational['alarms'];
+    const sourceCommit = requiredEnvironment(environment, 'EBK_SOURCE_COMMIT', SOURCE_COMMIT);
+    const stage = requiredEnvironment(environment, 'EBK_STAGE', /^(staging|production)$/);
+    const now = (dependencies.now ?? (() => new Date()))();
+    const driftExpiry = typeof postApplyDrift['evidenceExpiresAt'] === 'string'
+        ? Date.parse(postApplyDrift['evidenceExpiresAt'])
+        : Number.NaN;
+    const exactBinding = pending['kind'] === 'ebk-infrastructure-convergence' &&
+        pending['schemaVersion'] === 1 &&
+        pending['action'] === 'deploy' &&
+        pending['converged'] === false &&
+        pending['outcome'] === 'apply-complete-unverified' &&
+        pending['project'] === project &&
+        pending['sourceCommit'] === sourceCommit &&
+        pending['stage'] === stage &&
+        pending['mutationBindingDigest'] === digest(mutationContents) &&
+        mutation['kind'] === 'ebk-infrastructure-mutation-binding' &&
+        mutation['schemaVersion'] === 1 &&
+        mutation['action'] === 'deploy' &&
+        mutation['sourceCommit'] === sourceCommit &&
+        mutation['stage'] === stage;
+    const exactPostApply = postPlan.kind === 'ebk-sst-diff' &&
+        postPlan.schemaVersion === 1 &&
+        postPlan.tool?.version === index_js_1.SST_DIFF_TOOL_VERSION &&
+        postPlan.complete === true &&
+        postPlan.resources.length === 0 &&
+        postApplyDrift['status'] === 'no-drift' &&
+        typeof postApplyDrift['evidenceDigest'] === 'string' &&
+        SHA256.test(postApplyDrift['evidenceDigest']) &&
+        Number.isFinite(driftExpiry) &&
+        driftExpiry > now.getTime();
+    const exactSmoke = smoke['kind'] === 'testing-evidence-result' &&
+        smoke['schemaVersion'] === 1 &&
+        smoke['outcome'] === 'passed' &&
+        smoke['proofStarted'] === true &&
+        smoke['slice'] === project &&
+        Array.isArray(smoke['findings']) &&
+        smoke['findings'].length === 0 &&
+        smokeSource['commit'] === sourceCommit &&
+        smokeEnvironment['deployed'] === true &&
+        smokeEnvironment['stage'] === stage &&
+        smokeOperation['project'] === project &&
+        smokeOperation['proofLayer'] === 'deployed-smoke' &&
+        smokeOperation['target'] === 'smoke-deployed' &&
+        smokeCleanup['outcome'] === 'passed' &&
+        smokeCounts['failed'] === 0 &&
+        smokeCounts['quarantined'] === 0 &&
+        smokeCounts['retried'] === 0 &&
+        smokeCounts['skipped'] === 0 &&
+        typeof smokeCounts['passed'] === 'number' &&
+        smokeCounts['passed'] > 0;
+    const exactSmokeBinding = smokeBinding['kind'] === 'ebk-deployed-smoke-binding' &&
+        smokeBinding['schemaVersion'] === 1 &&
+        smokeBinding['project'] === project &&
+        smokeBinding['sourceCommit'] === sourceCommit &&
+        smokeBinding['stage'] === stage &&
+        deployment['conclusion'] === 'success' &&
+        deployment['headSha'] === sourceCommit &&
+        deployment['workflow'] === 'Deploy' &&
+        smokeIdentity['workflow'] === 'Deployed smoke';
+    const exactOperational = operational['kind'] === 'ebk-infrastructure-operational-evidence' &&
+        operational['schemaVersion'] === 1 &&
+        operational['project'] === project &&
+        operational['sourceCommit'] === sourceCommit &&
+        operational['stage'] === stage &&
+        operationalSmoke['evidenceDigest'] === digest(smokeContents) &&
+        String(operationalSmoke['runId']) === String(smokeIdentity['runId']) &&
+        String(operationalSmoke['runAttempt']) ===
+            String(smokeIdentity['runAttempt']) &&
+        operationalData['evidenceDigest'] === digest(smokeContents) &&
+        operationalData['status'] === 'passed' &&
+        operationalFrontend['status'] === 'passed' &&
+        typeof operationalFrontend['headerEvidenceDigest'] === 'string' &&
+        SHA256.test(operationalFrontend['headerEvidenceDigest']) &&
+        typeof operationalFrontend['visualEvidenceDigest'] === 'string' &&
+        SHA256.test(operationalFrontend['visualEvidenceDigest']) &&
+        typeof operationalFrontend['visualArtifactCount'] === 'number' &&
+        Number.isSafeInteger(operationalFrontend['visualArtifactCount']) &&
+        operationalFrontend['visualArtifactCount'] > 0 &&
+        Array.isArray(alarms) &&
+        alarms.length > 0 &&
+        alarms.every((alarm) => {
+            if (typeof alarm !== 'object' || alarm === null || Array.isArray(alarm)) {
+                return false;
+            }
+            const value = alarm;
+            return (typeof value['idDigest'] === 'string' &&
+                SHA256.test(value['idDigest']) &&
+                value['status'] === 'passed');
+        });
+    const findings = [
+        ...(!exactBinding
+            ? ['Exact pending mutation and authorization binding is invalid.']
+            : []),
+        ...(!exactPostApply
+            ? ['Empty post-plan and current no-drift evidence is invalid.']
+            : []),
+        ...(!exactSmoke
+            ? ['Exact deployed journey and data proof did not pass.']
+            : []),
+        ...(!exactSmokeBinding
+            ? ['Deployed smoke is not bound to the exact deployment.']
+            : []),
+        ...(!exactOperational
+            ? ['Alarm and data-integrity evidence is incomplete or stale.']
+            : []),
+    ];
+    const converged = findings.length === 0;
+    const result = {
+        action: 'deploy',
+        accountFingerprint: pending['accountFingerprint'],
+        alarmEvidenceDigest: digest(operationalContents),
+        authorizedMaterialDigest: pending['authorizedMaterialDigest'],
+        converged,
+        dataEvidenceDigest: digest(operationalContents),
+        finalizedAt: now.toISOString(),
+        findings,
+        kind: 'ebk-infrastructure-convergence',
+        mutationBindingDigest: pending['mutationBindingDigest'],
+        outcome: converged ? 'converged' : 'recovery-required',
+        pendingConvergenceDigest: digest(pendingContents),
+        plannedMaterialDigest: pending['plannedMaterialDigest'],
+        postApplyDrift,
+        postPlan,
+        project,
+        region: pending['region'],
+        schemaVersion: 1,
+        smokeBindingDigest: digest(smokeBindingContents),
+        smokeEvidenceDigest: digest(smokeContents),
+        sourceCommit,
+        stage,
+    };
+    (0, node_fs_1.mkdirSync)(evidenceDirectory, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(evidenceDirectory, 0o700);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-convergence.json'), `${JSON.stringify(result, null, 2)}\n`);
+    return { success: converged };
+}
+const executor = async (options, context) => {
+    try {
+        if (options.operation === 'finalize-convergence') {
+            return await finalizeInfrastructureMutationConvergence(options, context);
+        }
+        return await runInfrastructurePlanExecutor(options, context);
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        return { success: false };
+    }
+};
+exports.default = executor;
+//# sourceMappingURL=infrastructure-plan.js.map