@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/executors/sst-lifecycle/logging-preflight.d.ts

@@ -0,0 +1,17 @@
+import type { ExecutorContext } from '@nx/devkit';
+import { type ExistingManagedLogGroup, type ManagedLogGroupContract } from '../../foundation/index.js';
+import type { SstCommandInvocation, SstLifecycleOptions } from './run-sst-command.js';
+export interface ManagedLogGroupPreflightDependencies {
+    exportState: (invocation: SstCommandInvocation, options: SstLifecycleOptions) => Promise<unknown>;
+    inventory: (names: readonly string[], options: {
+        profile?: string;
+        region: string;
+    }) => Promise<ExistingManagedLogGroup[]>;
+    readJson: (path: string) => Promise<unknown>;
+}
+export declare function loadManagedLogGroupContracts(input: {
+    context: ExecutorContext;
+    invocation: SstCommandInvocation;
+    readJson?: (path: string) => Promise<unknown>;
+}): Promise<ManagedLogGroupContract[]>;
+export declare function preflightManagedLogGroups(command: 'deploy' | 'dev', options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: Partial<ManagedLogGroupPreflightDependencies>): Promise<void>;

package/src/executors/sst-lifecycle/logging-preflight.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadManagedLogGroupContracts = loadManagedLogGroupContracts;
+exports.preflightManagedLogGroups = preflightManagedLogGroups;
+const deterministic_order_js_1 = require("../../deterministic-order.js");
+const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_child_process_1 = require("node:child_process");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../../foundation/index.js");
+const logging_registry_js_1 = require("../../generators/logging-registry.js");
+const MAX_STATE_EXPORT_BYTES = 32 * 1024 * 1024;
+function normalizedSlug(value, label) {
+    if (typeof value !== 'string' || !/^[a-z0-9][a-z0-9-]{0,127}$/.test(value)) {
+        throw new Error(`${label} must be a normalized lowercase slug.`);
+    }
+    return value;
+}
+async function readJson(path) {
+    const source = await (0, promises_1.readFile)(path, 'utf8');
+    try {
+        return JSON.parse(source);
+    }
+    catch {
+        throw new Error(`Managed log-group preflight input is not JSON: ${path}.`);
+    }
+}
+async function inventoryManagedLogGroups(names, options) {
+    const client = new client_cloudwatch_logs_1.CloudWatchLogsClient({
+        ...(options.profile
+            ? { credentials: (0, credential_providers_1.fromIni)({ profile: options.profile }) }
+            : {}),
+        region: options.region,
+    });
+    const existing = [];
+    for (const name of names) {
+        const described = await client.send(new client_cloudwatch_logs_1.DescribeLogGroupsCommand({
+            limit: 50,
+            logGroupNamePrefix: name,
+        }));
+        const group = described.logGroups?.find((candidate) => candidate.logGroupName === name);
+        if (!group)
+            continue;
+        const arn = group.arn ?? group.logGroupArn;
+        if (!arn) {
+            throw new Error(`CloudWatch Logs did not return an ARN for existing group ${name}.`);
+        }
+        const [tagResult, indexResult] = await Promise.all([
+            client.send(new client_cloudwatch_logs_1.ListTagsForResourceCommand({ resourceArn: arn })),
+            client.send(new client_cloudwatch_logs_1.DescribeIndexPoliciesCommand({ logGroupIdentifiers: [arn] })),
+        ]);
+        existing.push({
+            hasGroupIndexPolicy: indexResult.indexPolicies?.some((policy) => policy.source === 'LOG_GROUP') ?? false,
+            name,
+            tags: tagResult.tags ?? {},
+        });
+    }
+    client.destroy();
+    return existing;
+}
+function exportSstState(invocation, options) {
+    const args = [
+        invocation.args[0],
+        'state',
+        'export',
+        '--stage',
+        invocation.environment.EBK_CONSUMER_STAGE,
+        ...(options.profile ? ['--profile', options.profile] : []),
+    ];
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)(invocation.executable, args, {
+            cwd: invocation.cwd,
+            env: { ...process.env, ...invocation.environment },
+            shell: false,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const chunks = [];
+        let bytes = 0;
+        let stderr = '';
+        let settled = false;
+        const fail = (message) => {
+            if (settled)
+                return;
+            settled = true;
+            child.kill();
+            reject(new Error(message));
+        };
+        child.stdout.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > MAX_STATE_EXPORT_BYTES) {
+                fail('SST state export exceeded the bounded preflight size.');
+                return;
+            }
+            chunks.push(chunk);
+        });
+        child.stderr.setEncoding('utf8');
+        child.stderr.on('data', (chunk) => {
+            if (stderr.length < 4096)
+                stderr += chunk;
+        });
+        child.on('error', (error) => {
+            fail(`Unable to start SST state export: ${error.message}`);
+        });
+        child.on('close', (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (code !== 0) {
+                reject(new Error(`SST state export failed before log-group ownership could be proved${stderr.trim() ? `: ${stderr.trim()}` : '.'}`));
+                return;
+            }
+            try {
+                resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+            }
+            catch {
+                reject(new Error('SST state export did not return valid JSON.'));
+            }
+        });
+    });
+}
+async function loadManagedLogGroupContracts(input) {
+    if (!input.context.projectName) {
+        throw new Error('Managed log-group preflight requires the exact Nx project name.');
+    }
+    const read = input.readJson ?? readJson;
+    const slice = normalizedSlug(input.context.projectName, 'Product Slice');
+    const packageJson = (await read((0, node_path_1.join)(input.context.root, 'package.json')));
+    const workspace = normalizedSlug(packageJson.name, 'Workspace');
+    const registry = (0, logging_registry_js_1.parseSliceLoggingRegistry)(await read((0, node_path_1.join)(input.invocation.cwd, logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH)));
+    const stage = input.invocation.environment.EBK_CONSUMER_STAGE;
+    const localDev = input.context.projectsConfigurations?.projects[input.context.projectName]?.metadata?.['ebk']?.['localDev'];
+    const databaseMode = localDev?.['databaseMode'];
+    if (databaseMode === 'none' && registry.databaseComponents.length > 0) {
+        throw new Error('A database-free Slice cannot declare managed database log-group components.');
+    }
+    const provisionedDatabases = databaseMode === 'none'
+        ? []
+        : (0, index_js_1.createDatabaseBindingPlan)((await read((0, node_path_1.join)(input.invocation.cwd, 'database/bindings.json'))), { slice, stage }).provisioned;
+    return [
+        ...registry.components.map((component) => (0, index_js_1.createManagedLogGroupContract)({
+            component,
+            slice,
+            stage,
+            workspace,
+        })),
+        ...registry.databaseComponents.flatMap((component) => provisionedDatabases.flatMap((resource) => component.startsWith('database-retirement') &&
+            (stage !== 'development' || resource !== 'retirement_rehearsal')
+            ? []
+            : [
+                (0, index_js_1.createManagedLogGroupContract)({
+                    component,
+                    resource,
+                    slice,
+                    stage,
+                    workspace,
+                }),
+            ])),
+    ].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name));
+}
+async function preflightManagedLogGroups(command, options, context, invocation, dependencies = {}) {
+    const tags = context.projectsConfigurations?.projects[context.projectName ?? '']?.tags ??
+        [];
+    if (!tags.includes('type:slice'))
+        return;
+    const contracts = await loadManagedLogGroupContracts({
+        context,
+        invocation,
+        ...(dependencies.readJson ? { readJson: dependencies.readJson } : {}),
+    });
+    const inventory = dependencies.inventory ?? inventoryManagedLogGroups;
+    const existing = await inventory(contracts.map(({ name }) => name), {
+        ...(options.profile ? { profile: options.profile } : {}),
+        region: options.region ??
+            process.env.AWS_REGION ??
+            process.env.AWS_DEFAULT_REGION ??
+            'us-east-1',
+    });
+    const state = existing.length === 0
+        ? { deployment: { resources: [] } }
+        : await (dependencies.exportState ?? exportSstState)(invocation, options);
+    const report = (0, index_js_1.evaluateManagedLogGroupPreflight)({
+        contracts,
+        expectedStackIdentity: `${context.projectName}/${invocation.environment.EBK_CONSUMER_STAGE}`,
+        existing,
+        stateOwnership: (0, index_js_1.readSstStateLogGroupOwnership)(state),
+    });
+    if (!report.ok) {
+        throw new Error(`[logging-preflight] ${command} refused before SST mutation:\n${report.issues
+            .map((issue) => `- ${issue.classification}: ${issue.logGroupName}${issue.expectedStackIdentity
+            ? ` (expected state ${issue.expectedStackIdentity})`
+            : ''}`)
+            .join('\n')}`);
+    }
+}
+//# sourceMappingURL=logging-preflight.js.map

package/src/executors/sst-lifecycle/logging-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/logging-preflight.ts"],"names":[],"mappings":";;AA0KA,oEAiEC;AAED,8DAqDC;AAlSD,yEAA4D;AAC5D,4EAKyC;AACzC,wEAAwD;AAExD,2DAA2C;AAC3C,+CAA4C;AAC5C,yCAAiC;AACjC,wDAOmC;AACnC,8EAG8C;AAM9C,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAchD,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,IAAI,GAAG,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAwB,EACxB,OAA6C;IAE7C,MAAM,MAAM,GAAG,IAAI,6CAAoB,CAAC;QACtC,GAAG,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC,IAAI,iDAAwB,CAAC;YAC3B,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,IAAI;SACzB,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CACrC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,IAAI,CAC/C,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC;QAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,4DAA4D,IAAI,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,IAAI,mDAA0B,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CACT,IAAI,qDAA4B,CAAC,EAAE,mBAAmB,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CACjE;SACF,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC;YACZ,mBAAmB,EACjB,WAAW,CAAC,aAAa,EAAE,IAAI,CAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAC1C,IAAI,KAAK;YACZ,IAAI;YACJ,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,CAAC;IACjB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,UAAgC,EAChC,OAA4B;IAE5B,MAAM,IAAI,GAAG;QACX,UAAU,CAAC,IAAI,CAAC,CAAC,CAAW;QAC5B,OAAO;QACP,QAAQ;QACR,SAAS;QACT,UAAU,CAAC,WAAW,CAAC,kBAAkB;QACzC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE;YAC/C,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,EAAE;YAClD,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,sBAAsB,EAAE,CAAC;gBACnC,IAAI,CAAC,uDAAuD,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,IAAI,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,CACJ,IAAI,KAAK,CACP,qEAAqE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAClH,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAAC,KAIlD;IACC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC;IACxC,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,CAC7B,IAAA,gBAAI,EAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CACzC,CAAsC,CAAC;IACxC,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAA,+CAAyB,EACxC,MAAM,IAAI,CAAC,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,iDAA2B,CAAC,CAAC,CACpE,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAC7D,KAAK,CAAC,OAAO,CAAC,WAAW,CAC1B,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CACc,CAAC;IAChD,MAAM,YAAY,GAAG,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC;IAChD,IAAI,YAAY,KAAK,MAAM,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GACxB,YAAY,KAAK,MAAM;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAA,oCAAyB,EACvB,CAAC,MAAM,IAAI,CACT,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC,CACrD,CAAoD,EACrD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC,WAAW,CAAC;IACpB,OAAO;QACL,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACvC,IAAA,wCAA6B,EAAC;YAC5B,SAAS;YACT,KAAK;YACL,KAAK;YACL,SAAS;SACV,CAAC,CACH;QACD,GAAG,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CACnD,oBAAoB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACxC,SAAS,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC3C,CAAC,KAAK,KAAK,aAAa,IAAI,QAAQ,KAAK,sBAAsB,CAAC;YAC9D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,IAAA,wCAA6B,EAAC;oBAC5B,SAAS;oBACT,QAAQ;oBACR,KAAK;oBACL,KAAK;oBACL,SAAS;iBACV,CAAC;aACH,CACN,CACF;KACF,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,OAAyB,EACzB,OAA4B,EAC5B,OAAwB,EACxB,UAAgC,EAChC,eAA8D,EAAE;IAEhE,MAAM,IAAI,GACR,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,IAAI;QACzE,EAAE,CAAC;IACL,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO;IAEzC,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC;QACnD,OAAO;QACP,UAAU;QACV,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,IAAI,yBAAyB,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EACjC;QACE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,EACJ,OAAO,CAAC,MAAM;YACd,OAAO,CAAC,GAAG,CAAC,UAAU;YACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB;YAC9B,WAAW;KACd,CACF,CAAC;IACF,MAAM,KAAK,GACT,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE;QACnC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAA,2CAAgC,EAAC;QAC9C,SAAS;QACT,qBAAqB,EAAE,GAAG,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,kBAAkB,EAAE;QAC5F,QAAQ;QACR,cAAc,EAAE,IAAA,wCAA6B,EAAC,KAAK,CAAC;KACrD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,kCAAkC,MAAM,CAAC,MAAM;aAC1E,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,YAAY,GAC9C,KAAK,CAAC,qBAAqB;YACzB,CAAC,CAAC,oBAAoB,KAAK,CAAC,qBAAqB,GAAG;YACpD,CAAC,CAAC,EACN,EAAE,CACL;aACA,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/src/executors/sst-lifecycle/run-sst-command.d.ts

@@ -1,12 +1,17 @@
 import { type ExecutorContext } from '@nx/devkit';
+import { spawn } from 'node:child_process';
 import { type FoundationStageResolution } from '../../foundation/stages.js';
+import { type PersonalStageResolver } from '../../local-dev/personal-stage.js';
+import { preflightManagedLogGroups } from './logging-preflight.js';
+import { preflightSliceSecretMetadata } from './secret-preflight.js';
 export type SstLifecycleCommand = 'deploy' | 'dev' | 'refresh' | 'remove' | 'unlock';
 export interface SstLifecycleOptions {
     args?: string[];
     cwd?: string;
     foundationStage?: string;
     profile?: string;
-    stage: string;
+    region?: string;
+    stage?: string;
     stageMode: 'consumer' | 'foundation';
     target?: string;
 }
@@ -14,17 +19,32 @@ export interface SstCommandInvocation {
     args: string[];
     cwd: string;
     environment: {
+        AWS_REGION?: string;
         EBK_CONSUMER_STAGE: string;
         EBK_FOUNDATION_STAGE: string;
         EBK_PRODUCTION_FOUNDATION_PROFILE?: string;
     };
     executable: string;
 }
+export interface SstLifecyclePreflightDependencies {
+    infrastructureAuthorization?: (command: 'deploy' | 'refresh' | 'remove', options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation) => Promise<void>;
+    logging?: typeof preflightManagedLogGroups;
+    secrets?: typeof preflightSliceSecretMetadata;
+}
+interface SstLifecycleRuntimeDependencies extends SstLifecyclePreflightDependencies {
+    infrastructureConvergence?: (command: 'deploy' | 'refresh' | 'remove', options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, applySucceeded: boolean) => Promise<boolean>;
+    spawnChild?: typeof spawn;
+}
 export declare function createSstChildEnvironment(ambient: NodeJS.ProcessEnv, invocation: SstCommandInvocation['environment']): NodeJS.ProcessEnv;
 export declare function assertSafeSstForwardedArguments(args: readonly string[]): void;
+export declare function resolveSstDevMode(environment: NodeJS.ProcessEnv, forwardedArguments?: readonly string[]): 'basic' | 'mono' | undefined;
 export declare function assertSstLifecyclePolicy(command: SstLifecycleCommand, stage: string, environment?: NodeJS.ProcessEnv): void;
 export declare function resolveSstLifecycleStages(options: SstLifecycleOptions, environment?: NodeJS.ProcessEnv): FoundationStageResolution;
-export declare function buildSstCommandInvocation(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv): SstCommandInvocation;
-export declare function runSstCommand(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext): Promise<{
+export declare function buildSstCommandInvocation(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, environment?: NodeJS.ProcessEnv, dependencies?: {
+    personalStageResolver?: PersonalStageResolver;
+}): SstCommandInvocation;
+export declare function runSstLifecyclePreflights(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: SstLifecyclePreflightDependencies): Promise<void>;
+export declare function runSstCommand(command: SstLifecycleCommand, options: SstLifecycleOptions, context: ExecutorContext, dependencies?: SstLifecycleRuntimeDependencies): Promise<{
     success: boolean;
 }>;
+export {};

package/src/executors/sst-lifecycle/run-sst-command.js

@@ -2,23 +2,43 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createSstChildEnvironment = createSstChildEnvironment;
 exports.assertSafeSstForwardedArguments = assertSafeSstForwardedArguments;
+exports.resolveSstDevMode = resolveSstDevMode;
 exports.assertSstLifecyclePolicy = assertSstLifecyclePolicy;
 exports.resolveSstLifecycleStages = resolveSstLifecycleStages;
 exports.buildSstCommandInvocation = buildSstCommandInvocation;
+exports.runSstLifecyclePreflights = runSstLifecyclePreflights;
 exports.runSstCommand = runSstCommand;
 const devkit_1 = require("@nx/devkit");
 const node_child_process_1 = require("node:child_process");
 const node_path_1 = require("node:path");
 const stages_js_1 = require("../../foundation/stages.js");
+const personal_stage_js_1 = require("../../local-dev/personal-stage.js");
 const index_js_1 = require("../../repository-policy/index.js");
 const index_js_2 = require("../../work-markers/index.js");
+const logging_preflight_js_1 = require("./logging-preflight.js");
+const secret_preflight_js_1 = require("./secret-preflight.js");
 const PROTECTED_STAGES = new Set(['staging', 'production']);
 const RESERVED_FORWARDED_OPTIONS = new Set([
     '--config',
     '--profile',
+    '--region',
     '--stage',
     '--target',
 ]);
+const SST_DEV_MODES = new Set(['basic', 'mono']);
+const AWS_REGION_PATTERN = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
+function requiresInfrastructureBinding(command, stage) {
+    return (PROTECTED_STAGES.has(stage) &&
+        (command === 'deploy' || command === 'refresh' || command === 'remove'));
+}
+async function authorizeInfrastructureMutation(command, options, context, invocation) {
+    const { revalidateInfrastructureMutationAuthorization } = await Promise.resolve().then(() => require('../infrastructure-plan/infrastructure-plan.js'));
+    await revalidateInfrastructureMutationAuthorization(command, options, context, invocation);
+}
+async function retainInfrastructureConvergence(command, options, context, invocation, applySucceeded) {
+    const { recordInfrastructureMutationConvergence } = await Promise.resolve().then(() => require('../infrastructure-plan/infrastructure-plan.js'));
+    return recordInfrastructureMutationConvergence(command, options, context, invocation, applySucceeded);
+}
 function projectKind(context) {
     if (!context.projectName) {
         throw new Error('SST lifecycle requires an Nx project name for tag-derived Repository Operating Policy evaluation.');
@@ -32,7 +52,9 @@ function projectKind(context) {
     return foundation ? 'foundation' : 'slice';
 }
 function createSstChildEnvironment(ambient, invocation) {
-    const sanitized = { ...ambient };
+    const sanitized = (0, personal_stage_js_1.isFrameworkPersonalStage)(invocation.EBK_CONSUMER_STAGE)
+        ? (0, personal_stage_js_1.createPersonalDevelopmentEnvironment)(invocation.EBK_CONSUMER_STAGE, ambient)
+        : (0, personal_stage_js_1.stripAmbientStageAuthority)(ambient);
     delete sanitized.EBK_PRODUCTION_FOUNDATION_PROFILE;
     return { ...sanitized, ...invocation };
 }
@@ -46,6 +68,18 @@ function assertSafeSstForwardedArguments(args) {
         throw new Error(`SST forwarded arguments cannot override lifecycle option ${option}. Use the corresponding Nx executor option instead.`);
     }
 }
+function resolveSstDevMode(environment, forwardedArguments = []) {
+    if (forwardedArguments.some((argument) => argument.split('=', 1)[0].toLowerCase() === '--mode')) {
+        return undefined;
+    }
+    const requested = environment.EBK_SST_DEV_MODE?.trim().toLowerCase();
+    if (!requested || requested === 'multiplexer')
+        return undefined;
+    if (!SST_DEV_MODES.has(requested)) {
+        throw new Error('EBK_SST_DEV_MODE must be mono, basic, or multiplexer when set.');
+    }
+    return requested;
+}
 function assertSstLifecyclePolicy(command, stage, environment = process.env) {
     if (!PROTECTED_STAGES.has(stage))
         return;
@@ -61,12 +95,17 @@ function assertSstLifecyclePolicy(command, stage, environment = process.env) {
     const eventName = environment.GITHUB_EVENT_NAME;
     const allowedEvent = eventName === 'workflow_dispatch' ||
         (eventName === 'push' && command === 'deploy');
-    const trustedWorkflow = Boolean(repository) &&
+    // These GitHub-provided values are a fail-closed provenance consistency
+    // check, not a credential boundary: a local process can spoof them. Actual
+    // protected-stage authority comes from environment-scoped OIDC role access
+    // and server-side IAM trust. A developer machine holding equivalent AWS
+    // credentials is outside this client-side guard's security claim.
+    const workflowProvenanceMatches = Boolean(repository) &&
         environment.GITHUB_ACTIONS === 'true' &&
         allowedEvent &&
         environment.GITHUB_REF === expectedRef &&
         environment.GITHUB_WORKFLOW_REF === expectedWorkflowRef;
-    if (!trustedWorkflow) {
+    if (!workflowProvenanceMatches) {
         throw new Error(`SST ${command} for protected stage ${stage} must run from the ${expectedBranch}-branch deploy workflow; pushes may run only deploy and other lifecycle actions require workflow_dispatch.`);
     }
     if (command === 'remove' &&
@@ -76,6 +115,9 @@ function assertSstLifecyclePolicy(command, stage, environment = process.env) {
     }
 }
 function resolveSstLifecycleStages(options, environment = process.env) {
+    if (!options.stage) {
+        throw new Error('Non-development SST lifecycle requires an exact stage.');
+    }
     if (options.stageMode === 'foundation') {
         const stage = (0, stages_js_1.requireFoundationStage)(options.stage);
         if (options.foundationStage?.trim() &&
@@ -96,7 +138,7 @@ function resolveSstLifecycleStages(options, environment = process.env) {
         foundationStage: options.foundationStage ?? environment.EBK_FOUNDATION_STAGE,
     });
 }
-function buildSstCommandInvocation(command, options, context, environment = process.env) {
+function buildSstCommandInvocation(command, options, context, environment = process.env, dependencies = {}) {
     const kind = projectKind(context);
     const expectedStageMode = kind === 'foundation' ? 'foundation' : 'consumer';
     if (options.stageMode !== expectedStageMode) {
@@ -109,11 +151,34 @@ function buildSstCommandInvocation(command, options, context, environment = proc
     const cwd = (0, node_path_1.isAbsolute)(configuredCwd)
         ? configuredCwd
         : (0, node_path_1.join)(context.root, configuredCwd);
-    const stages = resolveSstLifecycleStages(options, environment);
+    const stages = command === 'dev'
+        ? (() => {
+            if (kind !== 'slice') {
+                throw new Error('SST dev is supported only for Product Slices.');
+            }
+            if (options.stage !== undefined) {
+                throw new Error('SST dev does not accept caller-selected stage; use ebk dev so the framework derives the personal stage.');
+            }
+            if (options.foundationStage !== undefined &&
+                options.foundationStage !== 'development') {
+                throw new Error('SST dev always uses the development Foundation.');
+            }
+            return {
+                consumerStage: (dependencies.personalStageResolver ??
+                    (0, personal_stage_js_1.createPersonalStageResolver)()).resolve().stage,
+                foundationStage: 'development',
+                mapped: true,
+            };
+        })()
+        : resolveSstLifecycleStages(options, environment);
+    if (options.region !== undefined &&
+        !AWS_REGION_PATTERN.test(options.region.trim())) {
+        throw new Error('SST lifecycle region must be an exact AWS Region.');
+    }
     if (options.stageMode === 'consumer' &&
         command === 'deploy' &&
         stages.mapped) {
-        throw new Error(`Full deploy is not permitted for mapped consumer stage ${stages.consumerStage}. Use dev against the ${stages.foundationStage} Foundation until preview routing is supported.`);
+        throw new Error(`Full deploy is not permitted for mapped personal stage ${stages.consumerStage}. Use ebk dev against the ${stages.foundationStage} Foundation.`);
     }
     assertSstLifecyclePolicy(command, stages.consumerStage, environment);
     if (PROTECTED_STAGES.has(stages.consumerStage) &&
@@ -141,6 +206,11 @@ function buildSstCommandInvocation(command, options, context, environment = proc
     if (options.target) {
         args.push('--target', options.target);
     }
+    if (command === 'dev') {
+        const mode = resolveSstDevMode(environment, options.args);
+        if (mode)
+            args.push(`--mode=${mode}`);
+    }
     if (options.args) {
         assertSafeSstForwardedArguments(options.args);
         args.push(...options.args);
@@ -152,6 +222,7 @@ function buildSstCommandInvocation(command, options, context, environment = proc
         ],
         cwd,
         environment: {
+            ...(options.region?.trim() ? { AWS_REGION: options.region.trim() } : {}),
             EBK_CONSUMER_STAGE: stages.consumerStage,
             EBK_FOUNDATION_STAGE: stages.foundationStage,
             ...(policyDecision?.effectiveProductionProfile
@@ -163,10 +234,23 @@ function buildSstCommandInvocation(command, options, context, environment = proc
         executable: process.execPath,
     };
 }
-async function runSstCommand(command, options, context) {
+async function runSstLifecyclePreflights(command, options, context, invocation, dependencies = {}) {
+    if (command === 'deploy' || command === 'dev') {
+        await (dependencies.logging ?? logging_preflight_js_1.preflightManagedLogGroups)(command, options, context, invocation);
+    }
+    if (command === 'deploy') {
+        await (dependencies.secrets ?? secret_preflight_js_1.preflightSliceSecretMetadata)(options, context, invocation);
+    }
+    if (requiresInfrastructureBinding(command, invocation.environment.EBK_CONSUMER_STAGE)) {
+        await (dependencies.infrastructureAuthorization ??
+            authorizeInfrastructureMutation)(command, options, context, invocation);
+    }
+}
+async function runSstCommand(command, options, context, dependencies = {}) {
     let invocation;
     try {
         invocation = buildSstCommandInvocation(command, options, context);
+        await runSstLifecyclePreflights(command, options, context, invocation, dependencies);
     }
     catch (error) {
         devkit_1.logger.error(error instanceof Error ? error.message : String(error));
@@ -174,7 +258,7 @@ async function runSstCommand(command, options, context) {
     }
     devkit_1.logger.info(`Running workspace SST: ${command} --stage ${invocation.environment.EBK_CONSUMER_STAGE} foundationStage=${invocation.environment.EBK_FOUNDATION_STAGE} (${invocation.cwd})`);
     return new Promise((resolve) => {
-        const child = (0, node_child_process_1.spawn)(invocation.executable, invocation.args, {
+        const child = (dependencies.spawnChild ?? node_child_process_1.spawn)(invocation.executable, invocation.args, {
             cwd: invocation.cwd,
             env: createSstChildEnvironment(process.env, invocation.environment),
             shell: false,
@@ -191,7 +275,7 @@ async function runSstCommand(command, options, context) {
             devkit_1.logger.error(`Failed to start workspace SST: ${error.message}`);
             settle(false);
         });
-        child.on('close', (code, signal) => {
+        child.on('close', async (code, signal) => {
             if (code !== 0) {
                 devkit_1.logger.error(signal
                     ? `SST ${command} terminated with signal ${signal}.`
@@ -200,7 +284,26 @@ async function runSstCommand(command, options, context) {
                     devkit_1.logger.error(`If the stack is locked, run pnpm nx run ${context.projectName ?? '<project>'}:unlock --stage=${options.stage}.`);
                 }
             }
-            settle(code === 0);
+            const applySucceeded = code === 0;
+            if (requiresInfrastructureBinding(command, invocation.environment.EBK_CONSUMER_STAGE)) {
+                try {
+                    const mutationEvidenceRetained = await (dependencies.infrastructureConvergence ??
+                        retainInfrastructureConvergence)(command, options, context, invocation, applySucceeded);
+                    if (!mutationEvidenceRetained) {
+                        devkit_1.logger.error(`SST ${command} did not retain valid infrastructure mutation evidence.`);
+                    }
+                    // A deploy retains apply-complete-unverified as a successful handoff
+                    // to deployed smoke. It is not terminal convergence; the protected
+                    // finalizer consumes the exact alarm, data, and journey evidence.
+                    settle(applySucceeded && mutationEvidenceRetained);
+                }
+                catch (error) {
+                    devkit_1.logger.error(`Failed to retain infrastructure convergence: ${error instanceof Error ? error.message : String(error)}`);
+                    settle(false);
+                }
+                return;
+            }
+            settle(applySucceeded);
         });
     });
 }

package/src/executors/sst-lifecycle/run-sst-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-sst-command.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/run-sst-command.ts"],"names":[],"mappings":";;AAgEA,8DAOC;AAED,0EAWC;AAED,4DAuCC;AAED,8DA4BC;AAED,8DAmFC;AAED,sCAoDC;AAtSD,uCAA0D;AAC1D,2DAA2C;AAC3C,yCAA6C;AAC7C,0DAIoC;AACpC,+DAAiF;AACjF,0DAGqC;AA0BrC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,OAAwB;IAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,+EAA+E,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA0B,EAC1B,UAA+C;IAE/C,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACjC,OAAO,SAAS,CAAC,iCAAiC,CAAC;IACnD,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,SAAgB,+BAA+B,CAAC,IAAuB;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,qDAAqD,CACxH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAA4B,EAC5B,KAAa,EACb,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IACzC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACjD,MAAM,cAAc,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,WAAW,GAAG,cAAc,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAG,UAAU;QACpC,CAAC,CAAC,GAAG,UAAU,iCAAiC,WAAW,EAAE;QAC7D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,WAAW,CAAC,iBAAiB,CAAC;IAChD,MAAM,YAAY,GAChB,SAAS,KAAK,mBAAmB;QACjC,CAAC,SAAS,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC;IACjD,MAAM,eAAe,GACnB,OAAO,CAAC,UAAU,CAAC;QACnB,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,YAAY;QACZ,WAAW,CAAC,UAAU,KAAK,WAAW;QACtC,WAAW,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;IAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,wBAAwB,KAAK,sBAAsB,cAAc,4GAA4G,CAC5L,CAAC;IACJ,CAAC;IACD,IACE,OAAO,KAAK,QAAQ;QACpB,KAAK,KAAK,YAAY;QACtB,WAAW,CAAC,2BAA2B,KAAK,MAAM,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,OAAO,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IACE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE;YAC/B,IAAA,kCAAsB,EAAC,OAAO,CAAC,eAAe,CAAC,KAAK,KAAK,EACzD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,mCAAmC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CACxG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAA,mCAAuB,EAAC;QAC7B,aAAa,EAAE,OAAO,CAAC,KAAK;QAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC,oBAAoB;KAC9D,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB,EACxB,cAAiC,OAAO,CAAC,GAAG;IAE5C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,iBAAiB,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5E,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,iBAAiB,IAAI,2BAA2B,iBAAiB,gDAAgD,CACnJ,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW;QACxC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI;QACrE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IACpE,MAAM,GAAG,GAAG,IAAA,sBAAU,EAAC,aAAa,CAAC;QACnC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/D,IACE,OAAO,CAAC,SAAS,KAAK,UAAU;QAChC,OAAO,KAAK,QAAQ;QACpB,MAAM,CAAC,MAAM,EACb,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,aAAa,yBAAyB,MAAM,CAAC,eAAe,iDAAiD,CAC/K,CAAC;IACJ,CAAC;IACD,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACrE,IACE,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAC1C,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,CAAC,EAC/C,CAAC;QACD,IAAA,iCAAsB,EAAC,IAAA,0BAAe,EAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACpD,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAClB,MAAM,CAAC,aAAa,KAAK,YAAY;QACnC,CAAC,CAAC,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE;gBACR;oBACE,IAAI;oBACJ,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;iBAChC;aACF;YACD,KAAK,EAAE,MAAM,CAAC,aAAa;SAC5B,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAExD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,+BAA+B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;YAC3D,GAAG,IAAI;SACR;QACD,GAAG;QACH,WAAW,EAAE;YACX,kBAAkB,EAAE,MAAM,CAAC,aAAa;YACxC,oBAAoB,EAAE,MAAM,CAAC,eAAe;YAC5C,GAAG,CAAC,cAAc,EAAE,0BAA0B;gBAC5C,CAAC,CAAC;oBACE,iCAAiC,EAC/B,cAAc,CAAC,0BAA0B;iBAC5C;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,UAAU,EAAE,OAAO,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB;IAExB,IAAI,UAAgC,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,eAAM,CAAC,IAAI,CACT,0BAA0B,OAAO,YAAY,UAAU,CAAC,WAAW,CAAC,kBAAkB,oBAAoB,UAAU,CAAC,WAAW,CAAC,oBAAoB,KAAK,UAAU,CAAC,GAAG,GAAG,CAC5K,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC1D,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC;YACnE,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,eAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,eAAM,CAAC,KAAK,CACV,MAAM;oBACJ,CAAC,CAAC,OAAO,OAAO,2BAA2B,MAAM,GAAG;oBACpD,CAAC,CAAC,OAAO,OAAO,uBAAuB,IAAI,IAAI,SAAS,GAAG,CAC9D,CAAC;gBACF,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACjD,eAAM,CAAC,KAAK,CACV,2CAA2C,OAAO,CAAC,WAAW,IAAI,WAAW,mBAAmB,OAAO,CAAC,KAAK,GAAG,CACjH,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"run-sst-command.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/sst-lifecycle/run-sst-command.ts"],"names":[],"mappings":";;AAgJA,8DAYC;AAED,0EAWC;AAED,8CAmBC;AAED,4DA4CC;AAED,8DA+BC;AAED,8DAyHC;AAED,8DAiCC;AAED,sCA+FC;AA5gBD,uCAA0D;AAC1D,2DAA2C;AAC3C,yCAA6C;AAC7C,0DAIoC;AACpC,yEAM2C;AAC3C,+DAAiF;AACjF,0DAGqC;AACrC,iEAAmE;AACnE,+DAAqE;AAkDrE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,UAAU;IACV,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACjD,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D,SAAS,6BAA6B,CACpC,OAA4B,EAC5B,KAAa;IAEb,OAAO,CACL,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;QAC3B,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,OAAwC,EACxC,OAA4B,EAC5B,OAAwB,EACxB,UAAgC;IAEhC,MAAM,EAAE,6CAA6C,EAAE,GACrD,2CAAa,+CAA+C,EAAC,CAAC;IAChE,MAAM,6CAA6C,CACjD,OAAO,EACP,OAAO,EACP,OAAO,EACP,UAAU,CACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,OAAwC,EACxC,OAA4B,EAC5B,OAAwB,EACxB,UAAgC,EAChC,cAAuB;IAEvB,MAAM,EAAE,uCAAuC,EAAE,GAC/C,2CAAa,+CAA+C,EAAC,CAAC;IAChE,OAAO,uCAAuC,CAC5C,OAAO,EACP,OAAO,EACP,OAAO,EACP,UAAU,EACV,cAAc,CACf,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAwB;IAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,+EAA+E,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7C,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA0B,EAC1B,UAA+C;IAE/C,MAAM,SAAS,GAAG,IAAA,4CAAwB,EAAC,UAAU,CAAC,kBAAkB,CAAC;QACvE,CAAC,CAAC,IAAA,wDAAoC,EAClC,UAAU,CAAC,kBAAkB,EAC7B,OAAO,CACR;QACH,CAAC,CAAC,IAAA,8CAA0B,EAAC,OAAO,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC,iCAAiC,CAAC;IACnD,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,SAAgB,+BAA+B,CAAC,IAAuB;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,qDAAqD,CACxH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,iBAAiB,CAC/B,WAA8B,EAC9B,qBAAwC,EAAE;IAE1C,IACE,kBAAkB,CAAC,IAAI,CACrB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CACnE,EACD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAChE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,SAA6B,CAAC;AACvC,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAA4B,EAC5B,KAAa,EACb,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IACzC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACjD,MAAM,cAAc,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,WAAW,GAAG,cAAc,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAG,UAAU;QACpC,CAAC,CAAC,GAAG,UAAU,iCAAiC,WAAW,EAAE;QAC7D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,WAAW,CAAC,iBAAiB,CAAC;IAChD,MAAM,YAAY,GAChB,SAAS,KAAK,mBAAmB;QACjC,CAAC,SAAS,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC;IACjD,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,yBAAyB,GAC7B,OAAO,CAAC,UAAU,CAAC;QACnB,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,YAAY;QACZ,WAAW,CAAC,UAAU,KAAK,WAAW;QACtC,WAAW,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;IAC1D,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,OAAO,OAAO,wBAAwB,KAAK,sBAAsB,cAAc,4GAA4G,CAC5L,CAAC;IACJ,CAAC;IACD,IACE,OAAO,KAAK,QAAQ;QACpB,KAAK,KAAK,YAAY;QACtB,WAAW,CAAC,2BAA2B,KAAK,MAAM,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IACE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE;YAC/B,IAAA,kCAAsB,EAAC,OAAO,CAAC,eAAe,CAAC,KAAK,KAAK,EACzD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,mCAAmC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CACxG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAA,mCAAuB,EAAC;QAC7B,aAAa,EAAE,OAAO,CAAC,KAAK;QAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC,oBAAoB;KAC9D,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB,EACxB,cAAiC,OAAO,CAAC,GAAG,EAC5C,eAAkE,EAAE;IAEpE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,iBAAiB,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5E,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,iBAAiB,IAAI,2BAA2B,iBAAiB,gDAAgD,CACnJ,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW;QACxC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI;QACrE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IACpE,MAAM,GAAG,GAAG,IAAA,sBAAU,EAAC,aAAa,CAAC;QACnC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtC,MAAM,MAAM,GACV,OAAO,KAAK,KAAK;QACf,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;YACJ,CAAC;YACD,IACE,OAAO,CAAC,eAAe,KAAK,SAAS;gBACrC,OAAO,CAAC,eAAe,KAAK,aAAa,EACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,OAAO;gBACL,aAAa,EAAE,CACb,YAAY,CAAC,qBAAqB;oBAClC,IAAA,+CAA2B,GAAE,CAC9B,CAAC,OAAO,EAAE,CAAC,KAAK;gBACjB,eAAe,EAAE,aAAsB;gBACvC,MAAM,EAAE,IAAI;aACb,CAAC;QACJ,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACtD,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,OAAO,CAAC,SAAS,KAAK,UAAU;QAChC,OAAO,KAAK,QAAQ;QACpB,MAAM,CAAC,MAAM,EACb,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,aAAa,6BAA6B,MAAM,CAAC,eAAe,cAAc,CAChJ,CAAC;IACJ,CAAC;IACD,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACrE,IACE,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;QAC1C,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,CAAC,EAC/C,CAAC;QACD,IAAA,iCAAsB,EAAC,IAAA,0BAAe,EAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACpD,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAClB,MAAM,CAAC,aAAa,KAAK,YAAY;QACnC,CAAC,CAAC,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE;gBACR;oBACE,IAAI;oBACJ,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;iBAChC;aACF;YACD,KAAK,EAAE,MAAM,CAAC,aAAa;SAC5B,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAExD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,+BAA+B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,IAAA,gBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;YAC3D,GAAG,IAAI;SACR;QACD,GAAG;QACH,WAAW,EAAE;YACX,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,kBAAkB,EAAE,MAAM,CAAC,aAAa;YACxC,oBAAoB,EAAE,MAAM,CAAC,eAAe;YAC5C,GAAG,CAAC,cAAc,EAAE,0BAA0B;gBAC5C,CAAC,CAAC;oBACE,iCAAiC,EAC/B,cAAc,CAAC,0BAA0B;iBAC5C;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,UAAU,EAAE,OAAO,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB,EACxB,UAAgC,EAChC,eAAkD,EAAE;IAEpD,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,CAAC,YAAY,CAAC,OAAO,IAAI,gDAAyB,CAAC,CACvD,OAAO,EACP,OAAO,EACP,OAAO,EACP,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,YAAY,CAAC,OAAO,IAAI,kDAA4B,CAAC,CAC1D,OAAO,EACP,OAAO,EACP,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IACE,6BAA6B,CAC3B,OAAO,EACP,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAC1C,EACD,CAAC;QACD,MAAM,CACJ,YAAY,CAAC,2BAA2B;YACxC,+BAA+B,CAChC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,OAA4B,EAC5B,OAA4B,EAC5B,OAAwB,EACxB,eAAgD,EAAE;IAElD,IAAI,UAAgC,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,yBAAyB,CAC7B,OAAO,EACP,OAAO,EACP,OAAO,EACP,UAAU,EACV,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,eAAM,CAAC,IAAI,CACT,0BAA0B,OAAO,YAAY,UAAU,CAAC,WAAW,CAAC,kBAAkB,oBAAoB,UAAU,CAAC,WAAW,CAAC,oBAAoB,KAAK,UAAU,CAAC,GAAG,GAAG,CAC5K,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,UAAU,IAAI,0BAAK,CAAC,CAC9C,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,IAAI,EACf;YACE,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC;YACnE,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,SAAS;SACjB,CACF,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,eAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACvC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,eAAM,CAAC,KAAK,CACV,MAAM;oBACJ,CAAC,CAAC,OAAO,OAAO,2BAA2B,MAAM,GAAG;oBACpD,CAAC,CAAC,OAAO,OAAO,uBAAuB,IAAI,IAAI,SAAS,GAAG,CAC9D,CAAC;gBACF,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACjD,eAAM,CAAC,KAAK,CACV,2CAA2C,OAAO,CAAC,WAAW,IAAI,WAAW,mBAAmB,OAAO,CAAC,KAAK,GAAG,CACjH,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,KAAK,CAAC,CAAC;YAClC,IACE,6BAA6B,CAC3B,OAAO,EACP,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAC1C,EACD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,wBAAwB,GAAG,MAAM,CACrC,YAAY,CAAC,yBAAyB;wBACtC,+BAA+B,CAChC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;oBACzD,IAAI,CAAC,wBAAwB,EAAE,CAAC;wBAC9B,eAAM,CAAC,KAAK,CACV,OAAO,OAAO,yDAAyD,CACxE,CAAC;oBACJ,CAAC;oBACD,qEAAqE;oBACrE,mEAAmE;oBACnE,kEAAkE;oBAClE,MAAM,CAAC,cAAc,IAAI,wBAAwB,CAAC,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,eAAM,CAAC,KAAK,CACV,gDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;oBACF,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,CAAC,cAAc,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/src/executors/sst-lifecycle/schema.json

@@ -13,8 +13,7 @@
     "stage": {
       "type": "string",
       "pattern": "^[a-z0-9][a-z0-9-]*$",
-      "description": "SST stage name.",
-      "default": "development"
+      "description": "SST stage name for non-development lifecycle actions. The dev action rejects this option and derives the personal stage."
     },
     "stageMode": {
       "type": "string",
@@ -24,22 +23,27 @@
     "foundationStage": {
       "type": "string",
       "pattern": "^[a-z0-9][a-z0-9-]*$",
-      "description": "Optional explicit Foundation stage. Consumer personal/preview stages may use only development."
+      "description": "Optional explicit Foundation stage. Framework-derived personal consumer stages may use only development."
     },
     "profile": {
       "type": "string",
       "description": "Optional AWS profile passed to SST."
     },
+    "region": {
+      "type": "string",
+      "pattern": "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$",
+      "description": "Exact AWS Region used by EBK control-plane preflights. Defaults to AWS_REGION or AWS_DEFAULT_REGION."
+    },
     "target": {
       "type": "string",
       "description": "Optional SST target selector."
     },
     "args": {
       "type": "array",
-      "description": "Additional arguments passed to SST. Cannot override --stage, --profile, --target, or --config; use the executor options instead.",
+      "description": "Additional arguments passed to SST. Cannot override --stage, --profile, --region, --target, or --config; use the executor options instead.",
       "items": { "type": "string" },
       "default": []
     }
   },
-  "required": ["stage", "stageMode"]
+  "required": ["stageMode"]
 }

package/src/executors/sst-lifecycle/secret-preflight.d.ts

@@ -0,0 +1,25 @@
+import type { ExecutorContext } from '@nx/devkit';
+import { type SecretManagementScope, type SecretMetadataControlPlane, type SecretMetadataDeclaration } from '../../secrets/index.js';
+import type { SstCommandInvocation, SstLifecycleOptions } from './run-sst-command.js';
+export interface SecretAwsContext {
+    profile?: string;
+    region: string;
+}
+export interface LoadedSliceSecretMetadata {
+    declarations: readonly SecretMetadataDeclaration[];
+    scope: SecretManagementScope;
+}
+export interface SecretDeployPreflightDependencies {
+    controlPlane?: SecretMetadataControlPlane;
+    environment?: NodeJS.ProcessEnv;
+    readJson?: (path: string) => Promise<unknown>;
+}
+export declare function resolveSecretAwsContext(options: Pick<SstLifecycleOptions, 'profile' | 'region'>, environment?: NodeJS.ProcessEnv): SecretAwsContext;
+export declare function createSecretMetadataControlPlane(context: SecretAwsContext): SecretMetadataControlPlane;
+export declare function loadSliceSecretMetadata(input: {
+    context: ExecutorContext;
+    cwd: string;
+    readJson?: (path: string) => Promise<unknown>;
+    stage: string;
+}): Promise<LoadedSliceSecretMetadata>;
+export declare function preflightSliceSecretMetadata(options: SstLifecycleOptions, context: ExecutorContext, invocation: SstCommandInvocation, dependencies?: SecretDeployPreflightDependencies): Promise<void>;