@empire-builder-kit/nx 1.0.0-rc.29 → 1.0.0-rc.31

package/src/executors/deployment-plan/deployment-plan.js

@@ -13,7 +13,7 @@ function writeGithubOutputs(plan) {
         `deployment_profile=${plan.deploymentProfile}`,
         `deployment_region=${plan.deploymentRegion}`,
         `development_account_id=${plan.deploymentAccounts.development}`,
-        `staging_account_id=${plan.deploymentAccounts.staging}`,
+        `staging_account_id=${plan.deploymentAccounts.staging ?? ''}`,
         `production_account_id=${plan.deploymentAccounts.production}`,
         `foundation_profile=${plan.effectiveProductionProfile ?? ''}`,
         `has_slices=${plan.sliceProjects.length > 0 ? 'true' : 'false'}`,

package/src/executors/deployment-plan/deployment-plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-plan.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/deployment-plan/deployment-plan.ts"],"names":[],"mappings":";;AAAA,qCAAyC;AACzC,uCAA0D;AAC1D,+DAK0C;AAC1C,0DAIqC;AAQrC,SAAS,kBAAkB,CAAC,IAa3B;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAA,wBAAc,EACZ,MAAM,EACN;QACE,sBAAsB,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE;QACpD,sBAAsB,IAAI,CAAC,iBAAiB,EAAE;QAC9C,qBAAqB,IAAI,CAAC,gBAAgB,EAAE;QAC5C,0BAA0B,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE;QAC/D,sBAAsB,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE;QACvD,yBAAyB,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE;QAC7D,sBAAsB,IAAI,CAAC,0BAA0B,IAAI,EAAE,EAAE;QAC7D,cAAc,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAChE,oBAAoB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,4BAA4B,IAAI,CAAC,sBAAsB,EAAE;QACzD,kBAAkB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAA2C,KAAK,EAC5D,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,YAAY,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,eAAM,CAAC,IAAI,CAAC,IAAA,iCAAsB,EAAC,YAAY,CAAC,CAAC,CAAC;YAClD,IAAA,iCAAsB,EAAC,YAAY,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAA,wCAA6B,EAAC,MAAM,EAAE;YACjD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,MAAM,CAAC,OAAO,CACtB,OAAO,CAAC,sBAAsB,EAAE,QAAQ,IAAI,EAAE,CAC/C,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE;gBACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,eAAM,CAAC,IAAI,CACT,sDAAsD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CACtF,CAAC;QACF,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}
+{"version":3,"file":"deployment-plan.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/deployment-plan/deployment-plan.ts"],"names":[],"mappings":";;AAAA,qCAAyC;AACzC,uCAA0D;AAC1D,+DAK0C;AAC1C,0DAIqC;AAQrC,SAAS,kBAAkB,CAAC,IAa3B;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAA,wBAAc,EACZ,MAAM,EACN;QACE,sBAAsB,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE;QACpD,sBAAsB,IAAI,CAAC,iBAAiB,EAAE;QAC9C,qBAAqB,IAAI,CAAC,gBAAgB,EAAE;QAC5C,0BAA0B,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE;QAC/D,sBAAsB,IAAI,CAAC,kBAAkB,CAAC,OAAO,IAAI,EAAE,EAAE;QAC7D,yBAAyB,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE;QAC7D,sBAAsB,IAAI,CAAC,0BAA0B,IAAI,EAAE,EAAE;QAC7D,cAAc,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAChE,oBAAoB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,4BAA4B,IAAI,CAAC,sBAAsB,EAAE;QACzD,kBAAkB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAA2C,KAAK,EAC5D,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,YAAY,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,eAAM,CAAC,IAAI,CAAC,IAAA,iCAAsB,EAAC,YAAY,CAAC,CAAC,CAAC;YAClD,IAAA,iCAAsB,EAAC,YAAY,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAA,wCAA6B,EAAC,MAAM,EAAE;YACjD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,MAAM,CAAC,OAAO,CACtB,OAAO,CAAC,sBAAsB,EAAE,QAAQ,IAAI,EAAE,CAC/C,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE;gBACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,eAAM,CAAC,IAAI,CACT,sDAAsD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CACtF,CAAC;QACF,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/foundation-preflight/foundation-preflight.d.ts

@@ -8,7 +8,6 @@ interface FoundationPreflightOptions {
     expectedRoleArn?: string;
     foundationProject?: string;
     foundationStage?: string;
-    localProductionConfirmation?: string;
     profile?: string;
     region?: string;
     stage: string;

package/src/executors/foundation-preflight/foundation-preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"foundation-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-preflight/foundation-preflight.ts"],"names":[],"mappings":";;AAAA,uCAAgF;AAChF,gEAIuC;AACvC,gEAAgF;AAEhF,0DAAqE;AACrE,+DAAiF;AACjF,4EAAoE;AAgBpE,KAAK,UAAU,gBAAgB,CAC7B,OAAmC,EACnC,OAAwB,EACxB,eAAuB,EACvB,MAAc;IAEd,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAM,CAAC,KAAK,CACV,6CAA6C,OAAO,yCAAyC,CAC9F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAM,CAAC,IAAI,CACT,oCAAoC,OAAO,uBAAuB,eAAe,GAAG,CACrF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAa,EAChC,QAAQ,EACR;QACE,GAAG,EAAE,IAAI;QACT,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE;YACjC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM;QACN,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,YAAY;KACxB,EACD,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CACrC,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,QAAQ,GAAgD,KAAK,EACjE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,mCAAuB,EAAC;YAC/B,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YACD,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;gBAC1C,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GACnB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAA,8CAA+B,EAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,eAAe,IAAI,SAAS,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,MAAM;YACN,WAAW,EAAE;gBACX,YAAY,EACV,OAAO,CAAC,YAAY,IAAI,8CAA+B,CAAC,YAAY;gBACtE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;aACvE;SACF,CAAC,CAAC;QACH,IACE,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,CAAC,MAAM,CAAC,MAAM,EACd,CAAC;YACD,IACE,MAAM,CAAC,eAAe,KAAK,SAAS;gBACpC,MAAM,CAAC,eAAe,KAAK,YAAY,EACvC,CAAC;gBACD,eAAM,CAAC,KAAK,CACV,0BAA0B,MAAM,CAAC,eAAe,gMAAgM,CACjP,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,OAAO,EACP,OAAO,EACP,MAAM,CAAC,eAAe,EACtB,MAAM,CACP,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzC,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;gBACzC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,cAAc,EAAE,MAAM,CAAC,IAAI;gBAC3B,MAAM;gBACN,WAAW,EAAE;oBACX,YAAY,EACV,OAAO,CAAC,YAAY;wBACpB,8CAA+B,CAAC,YAAY;oBAC9C,QAAQ,EACN,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;iBAC/D;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,8CAA+B,EAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,eAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,eAAM,CAAC,IAAI,CACT,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,oDAAoD,OAAO,EAAE,CACrL,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,eAAM,CAAC,KAAK,CACV,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,4BAA4B,OAAO,EAAE,CAC7J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}
+{"version":3,"file":"foundation-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-preflight/foundation-preflight.ts"],"names":[],"mappings":";;AAAA,uCAAgF;AAChF,gEAIuC;AACvC,gEAAgF;AAEhF,0DAAqE;AACrE,+DAAiF;AACjF,4EAAoE;AAepE,KAAK,UAAU,gBAAgB,CAC7B,OAAmC,EACnC,OAAwB,EACxB,eAAuB,EACvB,MAAc;IAEd,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAM,CAAC,KAAK,CACV,6CAA6C,OAAO,yCAAyC,CAC9F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAM,CAAC,IAAI,CACT,oCAAoC,OAAO,uBAAuB,eAAe,GAAG,CACrF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAa,EAChC,QAAQ,EACR;QACE,GAAG,EAAE,IAAI;QACT,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE;YACjC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM;QACN,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,YAAY;KACxB,EACD,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CACrC,CAAC;IACF,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,QAAQ,GAAgD,KAAK,EACjE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,mCAAuB,EAAC;YAC/B,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,eAAe,EACb,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YACD,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;gBAC1C,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxD,KAAK,EAAE,MAAM,CAAC,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GACnB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAA,8CAA+B,EAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,eAAe,IAAI,SAAS,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;YAC7C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,MAAM;YACN,WAAW,EAAE;gBACX,YAAY,EACV,OAAO,CAAC,YAAY,IAAI,8CAA+B,CAAC,YAAY;gBACtE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;aACvE;SACF,CAAC,CAAC;QACH,IACE,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,CAAC,MAAM,CAAC,MAAM,EACd,CAAC;YACD,IACE,MAAM,CAAC,eAAe,KAAK,SAAS;gBACpC,MAAM,CAAC,eAAe,KAAK,YAAY,EACvC,CAAC;gBACD,eAAM,CAAC,KAAK,CACV,0BAA0B,MAAM,CAAC,eAAe,gMAAgM,CACjP,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,OAAO,EACP,OAAO,EACP,MAAM,CAAC,eAAe,EACtB,MAAM,CACP,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzC,MAAM,GAAG,MAAM,IAAA,0CAA2B,EAAC;gBACzC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,cAAc,EAAE,MAAM,CAAC,IAAI;gBAC3B,MAAM;gBACN,WAAW,EAAE;oBACX,YAAY,EACV,OAAO,CAAC,YAAY;wBACpB,8CAA+B,CAAC,YAAY;oBAC9C,QAAQ,EACN,OAAO,CAAC,QAAQ,IAAI,8CAA+B,CAAC,QAAQ;iBAC/D;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,8CAA+B,EAAC,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,eAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,eAAM,CAAC,IAAI,CACT,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,oDAAoD,OAAO,EAAE,CACrL,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,eAAM,CAAC,KAAK,CACV,wCAAwC,MAAM,CAAC,aAAa,oBAAoB,MAAM,CAAC,eAAe,WAAW,MAAM,4BAA4B,OAAO,EAAE,CAC7J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}

package/src/executors/foundation-preflight/schema.json

@@ -22,11 +22,6 @@
       "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
       "description": "Exact temporary-session IAM role expected for local governed deployment. This is verified against STS before mutation."
     },
-    "localProductionConfirmation": {
-      "type": "string",
-      "maxLength": 256,
-      "description": "One-use local starter production confirmation: <action>:production:<account>:<region>:<source-commit>. It is never forwarded to SST."
-    },
     "contract": { "type": "string", "default": "^1.0.0" },
     "capabilities": {
       "type": "array",

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.d.ts

@@ -1,10 +1,19 @@
 import { type PromiseExecutor } from '@nx/devkit';
+import { type ProductionDatabaseSafeguardReader } from './production-database-safeguard.js';
 interface FoundationProfilePreflightOptions {
     expectedRoleArn?: string;
-    localProductionConfirmation?: string;
     profile?: string;
     region?: string;
     stage: string;
 }
-declare const executor: PromiseExecutor<FoundationProfilePreflightOptions>;
-export default executor;
+export interface FoundationProfilePreflightDependencies {
+    createProductionDatabaseReader?: (options: {
+        profile?: string;
+        region: string;
+        stage: 'production';
+    }) => ProductionDatabaseSafeguardReader;
+    now?: () => Date;
+}
+export declare function createFoundationProfilePreflightExecutor(dependencies?: FoundationProfilePreflightDependencies): PromiseExecutor<FoundationProfilePreflightOptions>;
+declare const _default: PromiseExecutor<FoundationProfilePreflightOptions>;
+export default _default;

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.js

@@ -1,42 +1,105 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFoundationProfilePreflightExecutor = createFoundationProfilePreflightExecutor;
 const devkit_1 = require("@nx/devkit");
 const index_js_1 = require("../../repository-policy/index.js");
+const identity_js_1 = require("../../aws/identity.js");
 const stages_js_1 = require("../../foundation/stages.js");
 const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
-const executor = async (options, context) => {
-    try {
-        const stage = (0, stages_js_1.requireFoundationStage)(options.stage);
-        if (stage === 'development') {
-            devkit_1.logger.info('[foundation-profile-preflight] development uses the generated non-production profile; no protected profile check is required.');
+const production_database_safeguard_js_1 = require("./production-database-safeguard.js");
+const EXACT_ROLE_ARN = /^arn:(?:aws|aws-cn|aws-us-gov):iam::(\d{12}):role\/[A-Za-z0-9+=,.@_/-]+$/u;
+function createFoundationProfilePreflightExecutor(dependencies = {}) {
+    return async (options, context) => {
+        try {
+            const stage = (0, stages_js_1.requireFoundationStage)(options.stage);
+            if (stage === 'development') {
+                devkit_1.logger.info('[foundation-profile-preflight] development uses the generated non-production profile; no protected profile check is required.');
+                return { success: true };
+            }
+            const operatingPolicy = (0, index_js_1.readRepositoryOperatingPolicy)(context.root);
+            (0, run_sst_command_js_1.assertSstLifecyclePolicy)('deploy', stage, process.env, operatingPolicy.deploymentProfile);
+            (0, index_js_1.assertRepositoryPolicyRequest)(context.root, {
+                action: 'deploy',
+                projects: [{ kind: 'foundation', name: 'foundation' }],
+                stage,
+            });
+            const requestedRegion = options.region?.trim() ||
+                process.env.AWS_REGION?.trim() ||
+                process.env.AWS_DEFAULT_REGION?.trim();
+            const committedRegion = (0, index_js_1.configuredDeploymentRegion)(operatingPolicy.deploymentRegion);
+            if (requestedRegion && requestedRegion !== committedRegion) {
+                throw new Error(`Foundation profile preflight Region ${requestedRegion} differs from committed deployment Region ${committedRegion}.`);
+            }
+            const reader = (0, index_js_1.createAuroraProfileCapabilityReader)({
+                ...(options.profile?.trim() ? { profile: options.profile.trim() } : {}),
+                region: committedRegion,
+            });
+            const region = committedRegion;
+            const report = (0, index_js_1.evaluateAuroraProfileCapability)(await reader.read(), region);
+            if (!report.ok) {
+                throw new Error(`Aurora ${report.engine} ${report.engineVersion} is not orderable as db.serverless in ${report.region}; protected Foundation deployment is blocked before mutation.`);
+            }
+            devkit_1.logger.info(`[foundation-profile-preflight] Aurora ${report.engine} ${report.engineVersion} is orderable as db.serverless in ${report.region}.`);
+            if (stage === 'production') {
+                const expectedAccountId = (0, index_js_1.configuredDeploymentAccountForStage)(operatingPolicy.deploymentProfile, operatingPolicy.deploymentAccounts, stage);
+                const local = process.env.GITHUB_ACTIONS !== 'true';
+                const expectedRole = options.expectedRoleArn?.trim();
+                const roleMatch = expectedRole
+                    ? EXACT_ROLE_ARN.exec(expectedRole)
+                    : null;
+                if (local &&
+                    (!options.profile?.trim() ||
+                        !roleMatch ||
+                        roleMatch[1] !== expectedAccountId)) {
+                    throw new Error('Local production Foundation preflight requires the passed invocation-private AWS profile and an exact assumed role in the committed account.');
+                }
+                if (expectedRole &&
+                    (!roleMatch || roleMatch[1] !== expectedAccountId)) {
+                    throw new Error('Production Foundation expected role does not match the committed account.');
+                }
+                const productionReader = (dependencies.createProductionDatabaseReader ??
+                    production_database_safeguard_js_1.createProductionDatabaseSafeguardReader)({
+                    ...(options.profile?.trim()
+                        ? { profile: options.profile.trim() }
+                        : {}),
+                    region,
+                    stage,
+                });
+                try {
+                    const caller = await productionReader.readCallerIdentity();
+                    if (caller.accountId !== expectedAccountId ||
+                        typeof caller.arn !== 'string' ||
+                        (expectedRole &&
+                            !(0, identity_js_1.matchesExpectedAssumedRoleArn)(expectedAccountId, caller.arn, expectedRole))) {
+                        throw new Error('Production Foundation AWS caller does not match the committed account and expected deployment role.');
+                    }
+                    const discovery = await productionReader.readDiscovery();
+                    if (discovery.state === 'absent') {
+                        devkit_1.logger.info('[foundation-profile-preflight] no production Foundation database discovery exists; native SST first deployment may proceed.');
+                    }
+                    else {
+                        const cluster = await productionReader.describeCluster(discovery.clusterIdentifier);
+                        (0, production_database_safeguard_js_1.assertExistingProductionDatabaseSafeguards)({
+                            cluster,
+                            discovery,
+                            expectedAccountId,
+                            expectedRegion: region,
+                            now: (dependencies.now ?? (() => new Date()))(),
+                        });
+                        devkit_1.logger.info('[foundation-profile-preflight] existing production Foundation database identity, availability, deletion protection, retention, and backup signal are intact.');
+                    }
+                }
+                finally {
+                    productionReader.destroy();
+                }
+            }
             return { success: true };
         }
-        const operatingPolicy = (0, index_js_1.readRepositoryOperatingPolicy)(context.root);
-        (0, run_sst_command_js_1.assertSstLifecyclePolicy)('deploy', stage, process.env, operatingPolicy.deploymentProfile);
-        (0, index_js_1.assertRepositoryPolicyRequest)(context.root, {
-            action: 'deploy',
-            projects: [{ kind: 'foundation', name: 'foundation' }],
-            stage,
-        });
-        const requestedRegion = options.region?.trim() ||
-            process.env.AWS_REGION?.trim() ||
-            process.env.AWS_DEFAULT_REGION?.trim();
-        const reader = (0, index_js_1.createAuroraProfileCapabilityReader)({
-            ...(options.profile?.trim() ? { profile: options.profile.trim() } : {}),
-            ...(requestedRegion ? { region: requestedRegion } : {}),
-        });
-        const region = requestedRegion ?? (await reader.resolveRegion());
-        const report = (0, index_js_1.evaluateAuroraProfileCapability)(await reader.read(), region);
-        if (!report.ok) {
-            throw new Error(`Aurora ${report.engine} ${report.engineVersion} is not orderable as db.serverless in ${report.region}; protected Foundation deployment is blocked before mutation.`);
+        catch (error) {
+            devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+            return { success: false };
         }
-        devkit_1.logger.info(`[foundation-profile-preflight] Aurora ${report.engine} ${report.engineVersion} is orderable as db.serverless in ${report.region}.`);
-        return { success: true };
-    }
-    catch (error) {
-        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
-        return { success: false };
-    }
-};
-exports.default = executor;
+    };
+}
+exports.default = createFoundationProfilePreflightExecutor();
 //# sourceMappingURL=foundation-profile-preflight.js.map

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"foundation-profile-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-profile-preflight/foundation-profile-preflight.ts"],"names":[],"mappings":";;AAAA,uCAA0D;AAC1D,+DAK0C;AAC1C,0DAAoE;AACpE,4EAA+E;AAU/E,MAAM,QAAQ,GAAuD,KAAK,EACxE,OAAO,EACP,OAAO,EACP,EAAE;IACF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,eAAM,CAAC,IAAI,CACT,+HAA+H,CAChI,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,eAAe,GAAG,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,IAAA,6CAAwB,EACtB,QAAQ,EACR,KAAK,EACL,OAAO,CAAC,GAAG,EACX,eAAe,CAAC,iBAAiB,CAClC,CAAC;QACF,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;YAC1C,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACtD,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,eAAe,GACnB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;YACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;YAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAA,8CAAmC,EAAC;YACjD,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,IAAI,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAA,0CAA+B,EAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,yCAAyC,MAAM,CAAC,MAAM,+DAA+D,CACrK,CAAC;QACJ,CAAC;QACD,eAAM,CAAC,IAAI,CACT,yCAAyC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,qCAAqC,MAAM,CAAC,MAAM,GAAG,CACpI,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,kBAAe,QAAQ,CAAC"}
+{"version":3,"file":"foundation-profile-preflight.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-profile-preflight/foundation-profile-preflight.ts"],"names":[],"mappings":";;AAqCA,4FA6IC;AAlLD,uCAA0D;AAC1D,+DAO0C;AAC1C,uDAAsE;AACtE,0DAAoE;AACpE,4EAA+E;AAC/E,yFAI4C;AAkB5C,MAAM,cAAc,GAClB,2EAA2E,CAAC;AAE9E,SAAgB,wCAAwC,CACtD,eAAuD,EAAE;IAEzD,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,eAAM,CAAC,IAAI,CACT,+HAA+H,CAChI,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,eAAe,GAAG,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpE,IAAA,6CAAwB,EACtB,QAAQ,EACR,KAAK,EACL,OAAO,CAAC,GAAG,EACX,eAAe,CAAC,iBAAiB,CAClC,CAAC;YACF,IAAA,wCAA6B,EAAC,OAAO,CAAC,IAAI,EAAE;gBAC1C,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBACtD,KAAK;aACN,CAAC,CAAC;YAEH,MAAM,eAAe,GACnB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;gBACtB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;gBAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;YACzC,MAAM,eAAe,GAAG,IAAA,qCAA0B,EAChD,eAAe,CAAC,gBAAgB,CACjC,CAAC;YACF,IAAI,eAAe,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CACb,uCAAuC,eAAe,6CAA6C,eAAe,GAAG,CACtH,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,8CAAmC,EAAC;gBACjD,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,EAAE,eAAe;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,eAAe,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAA,0CAA+B,EAC5C,MAAM,MAAM,CAAC,IAAI,EAAE,EACnB,MAAM,CACP,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,yCAAyC,MAAM,CAAC,MAAM,+DAA+D,CACrK,CAAC;YACJ,CAAC;YACD,eAAM,CAAC,IAAI,CACT,yCAAyC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,qCAAqC,MAAM,CAAC,MAAM,GAAG,CACpI,CAAC;YAEF,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;gBAC3B,MAAM,iBAAiB,GAAG,IAAA,8CAAmC,EAC3D,eAAe,CAAC,iBAAiB,EACjC,eAAe,CAAC,kBAAkB,EAClC,KAAK,CACN,CAAC;gBACF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;gBACpD,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,YAAY;oBAC5B,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC;oBACnC,CAAC,CAAC,IAAI,CAAC;gBACT,IACE,KAAK;oBACL,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE;wBACvB,CAAC,SAAS;wBACV,SAAS,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,EACrC,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,8IAA8I,CAC/I,CAAC;gBACJ,CAAC;gBACD,IACE,YAAY;oBACZ,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,EAClD,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;gBACJ,CAAC;gBACD,MAAM,gBAAgB,GAAG,CACvB,YAAY,CAAC,8BAA8B;oBAC3C,0EAAuC,CACxC,CAAC;oBACA,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE;wBACzB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;wBACrC,CAAC,CAAC,EAAE,CAAC;oBACP,MAAM;oBACN,KAAK;iBACN,CAAC,CAAC;gBACH,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;oBAC3D,IACE,MAAM,CAAC,SAAS,KAAK,iBAAiB;wBACtC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;wBAC9B,CAAC,YAAY;4BACX,CAAC,IAAA,2CAA6B,EAC5B,iBAAiB,EACjB,MAAM,CAAC,GAAG,EACV,YAAY,CACb,CAAC,EACJ,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;oBACJ,CAAC;oBACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,CAAC;oBACzD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACjC,eAAM,CAAC,IAAI,CACT,6HAA6H,CAC9H,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,eAAe,CACpD,SAAS,CAAC,iBAAiB,CAC5B,CAAC;wBACF,IAAA,6EAA0C,EAAC;4BACzC,OAAO;4BACP,SAAS;4BACT,iBAAiB;4BACjB,cAAc,EAAE,MAAM;4BACtB,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE;yBAChD,CAAC,CAAC;wBACH,eAAM,CAAC,IAAI,CACT,8JAA8J,CAC/J,CAAC;oBACJ,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,kBAAe,wCAAwC,EAAE,CAAC"}

package/src/executors/foundation-profile-preflight/production-database-safeguard.d.ts

@@ -0,0 +1,64 @@
+export declare const PRODUCTION_DATABASE_BACKUP_MAX_AGE_MS: number;
+export declare const PRODUCTION_DATABASE_CLOCK_SKEW_MS: number;
+export interface ExistingProductionDatabaseDiscovery {
+    clusterArn: string;
+    clusterIdentifier: string;
+    state: 'existing';
+}
+export type ProductionDatabaseDiscovery = {
+    state: 'absent';
+} | ExistingProductionDatabaseDiscovery;
+export interface ProductionDatabaseDescription {
+    backupRetentionPeriod?: number;
+    clusterArn?: string;
+    clusterIdentifier?: string;
+    deletionProtection?: boolean;
+    latestRestorableTime?: Date;
+    maxCapacity?: number;
+    minCapacity?: number;
+    status?: string;
+}
+export interface ProductionDatabaseCallerIdentity {
+    accountId?: string;
+    arn?: string;
+}
+export interface ProductionDatabaseSafeguardReader {
+    describeCluster: (clusterIdentifier: string) => Promise<ProductionDatabaseDescription | undefined>;
+    destroy: () => void;
+    readCallerIdentity: () => Promise<ProductionDatabaseCallerIdentity>;
+    readDiscovery: () => Promise<ProductionDatabaseDiscovery>;
+}
+export interface ProductionDatabaseLifecycleAttestationOptions {
+    configFilepath?: string;
+    credentialsFilepath?: string;
+    expectedAccountId: string;
+    expectedCapacity?: {
+        max: number;
+        min: number;
+    };
+    expectedRegion: string;
+    expectedRoleArn: string;
+    now: Date;
+    priorDiscovery?: ProductionDatabaseDiscovery;
+    profile?: string;
+    reader?: ProductionDatabaseSafeguardReader;
+    requireExisting: boolean;
+}
+export declare function createProductionDatabaseSafeguardReader(options: {
+    configFilepath?: string;
+    credentialsFilepath?: string;
+    profile?: string;
+    region: string;
+    stage: 'production';
+}): ProductionDatabaseSafeguardReader;
+export declare function assertExistingProductionDatabaseSafeguards(options: {
+    cluster: ProductionDatabaseDescription | undefined;
+    discovery: ExistingProductionDatabaseDiscovery;
+    expectedAccountId: string;
+    expectedRegion: string;
+    now: Date;
+}): void;
+/** Read-only lifecycle boundary attestation. Native SST remains the deployment
+ * engine; this verifies only the protected production properties that IAM
+ * cannot constrain from ModifyDBCluster request fields. */
+export declare function attestProductionDatabaseLifecycle(options: ProductionDatabaseLifecycleAttestationOptions): Promise<ProductionDatabaseDiscovery>;

package/src/executors/foundation-profile-preflight/production-database-safeguard.js

@@ -0,0 +1,221 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRODUCTION_DATABASE_CLOCK_SKEW_MS = exports.PRODUCTION_DATABASE_BACKUP_MAX_AGE_MS = void 0;
+exports.createProductionDatabaseSafeguardReader = createProductionDatabaseSafeguardReader;
+exports.assertExistingProductionDatabaseSafeguards = assertExistingProductionDatabaseSafeguards;
+exports.attestProductionDatabaseLifecycle = attestProductionDatabaseLifecycle;
+const client_rds_1 = require("@aws-sdk/client-rds");
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const client_sts_1 = require("@aws-sdk/client-sts");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const identity_js_1 = require("../../aws/identity.js");
+const discovery_js_1 = require("../../foundation/discovery.js");
+exports.PRODUCTION_DATABASE_BACKUP_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
+exports.PRODUCTION_DATABASE_CLOCK_SKEW_MS = 5 * 60 * 1_000;
+const AWS_READ_TIMEOUT_MS = 20_000;
+function exactString(value) {
+    return typeof value === 'string' && value === value.trim() && value
+        ? value
+        : undefined;
+}
+function withReadTimeout(operation) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), AWS_READ_TIMEOUT_MS);
+    timeout.unref();
+    return operation(controller.signal).finally(() => clearTimeout(timeout));
+}
+function narrowCluster(cluster) {
+    return {
+        backupRetentionPeriod: cluster.BackupRetentionPeriod,
+        clusterArn: cluster.DBClusterArn,
+        clusterIdentifier: cluster.DBClusterIdentifier,
+        deletionProtection: cluster.DeletionProtection,
+        latestRestorableTime: cluster.LatestRestorableTime,
+        maxCapacity: cluster.ServerlessV2ScalingConfiguration?.MaxCapacity,
+        minCapacity: cluster.ServerlessV2ScalingConfiguration?.MinCapacity,
+        status: cluster.Status,
+    };
+}
+function createProductionDatabaseSafeguardReader(options) {
+    const profile = options.profile?.trim();
+    const clientOptions = {
+        ...(profile
+            ? {
+                credentials: (0, credential_providers_1.fromIni)({
+                    ...(options.configFilepath
+                        ? { configFilepath: options.configFilepath }
+                        : {}),
+                    ...(options.credentialsFilepath
+                        ? { filepath: options.credentialsFilepath }
+                        : {}),
+                    profile,
+                }),
+            }
+            : {}),
+        maxAttempts: 2,
+        region: options.region,
+    };
+    const ssm = new client_ssm_1.SSMClient({
+        ...clientOptions,
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('ssm', options.region),
+    });
+    const rds = new client_rds_1.RDSClient({
+        ...clientOptions,
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('rds', options.region),
+    });
+    const sts = new client_sts_1.STSClient({
+        ...clientOptions,
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(options.region),
+    });
+    const clusterIdName = (0, discovery_js_1.foundationSsmPath)(options.stage, 'databaseClusterId');
+    const clusterArnName = (0, discovery_js_1.foundationSsmPath)(options.stage, 'databaseClusterArn');
+    return {
+        describeCluster: async (clusterIdentifier) => {
+            const response = await withReadTimeout((abortSignal) => rds.send(new client_rds_1.DescribeDBClustersCommand({
+                DBClusterIdentifier: clusterIdentifier,
+            }), { abortSignal }));
+            const clusters = response.DBClusters ?? [];
+            if (clusters.length > 1) {
+                throw new Error('Production Foundation discovery resolved more than one Aurora cluster.');
+            }
+            return clusters[0] ? narrowCluster(clusters[0]) : undefined;
+        },
+        destroy: () => {
+            ssm.destroy();
+            rds.destroy();
+            sts.destroy();
+        },
+        readCallerIdentity: async () => {
+            const response = await withReadTimeout((abortSignal) => sts.send(new client_sts_1.GetCallerIdentityCommand({}), { abortSignal }));
+            return { accountId: response.Account, arn: response.Arn };
+        },
+        readDiscovery: async () => {
+            const response = await withReadTimeout((abortSignal) => ssm.send(new client_ssm_1.GetParametersCommand({
+                Names: [clusterArnName, clusterIdName],
+                WithDecryption: false,
+            }), { abortSignal }));
+            const values = new Map((response.Parameters ?? []).map((parameter) => [
+                parameter.Name ?? '',
+                exactString(parameter.Value),
+            ]));
+            const invalid = new Set(response.InvalidParameters ?? []);
+            const clusterArn = values.get(clusterArnName);
+            const clusterIdentifier = values.get(clusterIdName);
+            const arnAbsent = invalid.has(clusterArnName) && !clusterArn;
+            const identifierAbsent = invalid.has(clusterIdName) && !clusterIdentifier;
+            if (arnAbsent && identifierAbsent)
+                return { state: 'absent' };
+            if (!clusterArn || !clusterIdentifier || invalid.size > 0) {
+                throw new Error('Production Foundation database discovery is partial or malformed; deployment is blocked.');
+            }
+            return {
+                clusterArn,
+                clusterIdentifier,
+                state: 'existing',
+            };
+        },
+    };
+}
+function parseClusterArn(value) {
+    const match = /^arn:(?:aws|aws-cn|aws-us-gov):rds:([^:]+):(\d{12}):cluster:([A-Za-z0-9][A-Za-z0-9-]{0,62})$/u.exec(value);
+    return match?.[1] && match[2] && match[3]
+        ? {
+            accountId: match[2],
+            clusterIdentifier: match[3],
+            region: match[1],
+        }
+        : undefined;
+}
+function assertExistingProductionDatabaseSafeguards(options) {
+    const discoveredArn = parseClusterArn(options.discovery.clusterArn);
+    if (!discoveredArn ||
+        discoveredArn.accountId !== options.expectedAccountId ||
+        discoveredArn.region !== options.expectedRegion ||
+        discoveredArn.clusterIdentifier !== options.discovery.clusterIdentifier) {
+        throw new Error('Production Foundation database discovery does not match the committed account, Region, and cluster identity.');
+    }
+    const cluster = options.cluster;
+    if (!cluster ||
+        cluster.clusterArn !== options.discovery.clusterArn ||
+        cluster.clusterIdentifier !== options.discovery.clusterIdentifier) {
+        throw new Error('Production Foundation database identity does not match canonical discovery.');
+    }
+    if (cluster.status !== 'available') {
+        throw new Error(`Production Foundation database must be available before deployment; observed ${cluster.status ?? 'missing'}.`);
+    }
+    if (cluster.deletionProtection !== true) {
+        throw new Error('Production Foundation database deletion protection must remain enabled before deployment.');
+    }
+    if (!Number.isInteger(cluster.backupRetentionPeriod) ||
+        (cluster.backupRetentionPeriod ?? 0) < 30) {
+        throw new Error('Production Foundation database backup retention must remain at least 30 days before deployment.');
+    }
+    const latest = cluster.latestRestorableTime?.getTime();
+    const now = options.now.getTime();
+    if (latest === undefined ||
+        !Number.isFinite(latest) ||
+        latest > now + exports.PRODUCTION_DATABASE_CLOCK_SKEW_MS ||
+        now - latest > exports.PRODUCTION_DATABASE_BACKUP_MAX_AGE_MS) {
+        throw new Error('Production Foundation database requires a recent latest-restorable backup signal before deployment.');
+    }
+}
+function assertExactProductionDatabaseCapacity(cluster, expected) {
+    if (cluster.minCapacity !== expected.min ||
+        cluster.maxCapacity !== expected.max) {
+        throw new Error(`Production Foundation database Aurora capacity must equal the committed profile ${expected.min}-${expected.max} ACUs after deployment; observed ${cluster.minCapacity ?? 'missing'}-${cluster.maxCapacity ?? 'missing'}.`);
+    }
+}
+/** Read-only lifecycle boundary attestation. Native SST remains the deployment
+ * engine; this verifies only the protected production properties that IAM
+ * cannot constrain from ModifyDBCluster request fields. */
+async function attestProductionDatabaseLifecycle(options) {
+    const reader = options.reader ??
+        createProductionDatabaseSafeguardReader({
+            ...(options.configFilepath
+                ? { configFilepath: options.configFilepath }
+                : {}),
+            ...(options.credentialsFilepath
+                ? { credentialsFilepath: options.credentialsFilepath }
+                : {}),
+            ...(options.profile ? { profile: options.profile } : {}),
+            region: options.expectedRegion,
+            stage: 'production',
+        });
+    try {
+        const caller = await reader.readCallerIdentity();
+        if (caller.accountId !== options.expectedAccountId ||
+            typeof caller.arn !== 'string' ||
+            !(0, identity_js_1.matchesExpectedAssumedRoleArn)(options.expectedAccountId, caller.arn, options.expectedRoleArn)) {
+            throw new Error('Production Foundation database attestation caller does not match the committed account and exact deployment role.');
+        }
+        const discovery = await reader.readDiscovery();
+        if (discovery.state === 'absent') {
+            if (options.requireExisting) {
+                throw new Error('Production Foundation database discovery is absent after native deployment.');
+            }
+            return discovery;
+        }
+        if (options.priorDiscovery?.state === 'existing' &&
+            (options.priorDiscovery.clusterArn !== discovery.clusterArn ||
+                options.priorDiscovery.clusterIdentifier !==
+                    discovery.clusterIdentifier)) {
+            throw new Error('Production Foundation database identity changed during native deployment.');
+        }
+        const cluster = await reader.describeCluster(discovery.clusterIdentifier);
+        assertExistingProductionDatabaseSafeguards({
+            cluster,
+            discovery,
+            expectedAccountId: options.expectedAccountId,
+            expectedRegion: options.expectedRegion,
+            now: options.now,
+        });
+        if (options.expectedCapacity && cluster) {
+            assertExactProductionDatabaseCapacity(cluster, options.expectedCapacity);
+        }
+        return discovery;
+    }
+    finally {
+        reader.destroy();
+    }
+}
+//# sourceMappingURL=production-database-safeguard.js.map

package/src/executors/foundation-profile-preflight/production-database-safeguard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-database-safeguard.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/foundation-profile-preflight/production-database-safeguard.ts"],"names":[],"mappings":";;;AAmGA,0FAsGC;AAmBD,gGA0DC;AAmBD,8EAiEC;AA1WD,oDAI6B;AAC7B,oDAAsE;AACtE,oDAA0E;AAC1E,wEAAwD;AAExD,uDAI+B;AAC/B,gEAAkE;AAErD,QAAA,qCAAqC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAC7D,QAAA,iCAAiC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;AAChE,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAqDnC,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,SAAmD;IAEnD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,aAAa,CAAC,OAAkB;IACvC,OAAO;QACL,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,UAAU,EAAE,OAAO,CAAC,YAAY;QAChC,iBAAiB,EAAE,OAAO,CAAC,mBAAmB;QAC9C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,WAAW,EAAE,OAAO,CAAC,gCAAgC,EAAE,WAAW;QAClE,WAAW,EAAE,OAAO,CAAC,gCAAgC,EAAE,WAAW;QAClE,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,SAAgB,uCAAuC,CAAC,OAMvD;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG;QACpB,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,WAAW,EAAE,IAAA,8BAAO,EAAC;oBACnB,GAAG,CAAC,OAAO,CAAC,cAAc;wBACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,OAAO,CAAC,mBAAmB;wBAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,mBAAmB,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO;iBACR,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,WAAW,EAAE,CAAC;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC;QACxB,GAAG,aAAa;QAChB,QAAQ,EAAE,IAAA,0CAA4B,EAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;KAC9D,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC;QACxB,GAAG,aAAa;QAChB,QAAQ,EAAE,IAAA,0CAA4B,EAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;KAC9D,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC;QACxB,GAAG,aAAa;QAChB,QAAQ,EAAE,IAAA,kCAAoB,EAAC,OAAO,CAAC,MAAM,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAA,gCAAiB,EAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC5E,MAAM,cAAc,GAAG,IAAA,gCAAiB,EAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC9E,OAAO;QACL,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE;YAC3C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,CAAC,WAAW,EAAE,EAAE,CACrD,GAAG,CAAC,IAAI,CACN,IAAI,sCAAyB,CAAC;gBAC5B,mBAAmB,EAAE,iBAAiB;aACvC,CAAC,EACF,EAAE,WAAW,EAAE,CAChB,CACF,CAAC;YACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACZ,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;QACD,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,CAAC,WAAW,EAAE,EAAE,CACrD,GAAG,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAC5D,CAAC;YACF,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC5D,CAAC;QACD,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,CAAC,WAAW,EAAE,EAAE,CACrD,GAAG,CAAC,IAAI,CACN,IAAI,iCAAoB,CAAC;gBACvB,KAAK,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC;gBACtC,cAAc,EAAE,KAAK;aACtB,CAAC,EACF,EAAE,WAAW,EAAE,CAChB,CACF,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC7C,SAAS,CAAC,IAAI,IAAI,EAAE;gBACpB,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC;aAC7B,CAAC,CACH,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC1E,IAAI,SAAS,IAAI,gBAAgB;gBAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,UAAU;gBACV,iBAAiB;gBACjB,KAAK,EAAE,UAAU;aAClB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,KAAa;IAGb,MAAM,KAAK,GACT,+FAA+F,CAAC,IAAI,CAClG,KAAK,CACN,CAAC;IACJ,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC;YACE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YACnB,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;SACjB;QACH,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAgB,0CAA0C,CAAC,OAM1D;IACC,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACpE,IACE,CAAC,aAAa;QACd,aAAa,CAAC,SAAS,KAAK,OAAO,CAAC,iBAAiB;QACrD,aAAa,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc;QAC/C,aAAa,CAAC,iBAAiB,KAAK,OAAO,CAAC,SAAS,CAAC,iBAAiB,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IACE,CAAC,OAAO;QACR,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,SAAS,CAAC,UAAU;QACnD,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC,SAAS,CAAC,iBAAiB,EACjE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,gFAAgF,OAAO,CAAC,MAAM,IAAI,SAAS,GAAG,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAChD,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC,GAAG,EAAE,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,OAAO,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClC,IACE,MAAM,KAAK,SAAS;QACpB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,yCAAiC;QAChD,GAAG,GAAG,MAAM,GAAG,6CAAqC,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qCAAqC,CAC5C,OAAsC,EACtC,QAAsC;IAEtC,IACE,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,GAAG;QACpC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,GAAG,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mFAAmF,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,oCAAoC,OAAO,CAAC,WAAW,IAAI,SAAS,IAAI,OAAO,CAAC,WAAW,IAAI,SAAS,GAAG,CAC3N,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;2DAE2D;AACpD,KAAK,UAAU,iCAAiC,CACrD,OAAsD;IAEtD,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;QACd,uCAAuC,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,cAAc;gBACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,mBAAmB;gBAC7B,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,EAAE,OAAO,CAAC,cAAc;YAC9B,KAAK,EAAE,YAAY;SACpB,CAAC,CAAC;IACL,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACjD,IACE,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,iBAAiB;YAC9C,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,IAAA,2CAA6B,EAC5B,OAAO,CAAC,iBAAiB,EACzB,MAAM,CAAC,GAAG,EACV,OAAO,CAAC,eAAe,CACxB,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IACE,OAAO,CAAC,cAAc,EAAE,KAAK,KAAK,UAAU;YAC5C,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;gBACzD,OAAO,CAAC,cAAc,CAAC,iBAAiB;oBACtC,SAAS,CAAC,iBAAiB,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC1E,0CAA0C,CAAC;YACzC,OAAO;YACP,SAAS;YACT,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,EAAE,CAAC;YACxC,qCAAqC,CAAC,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/src/executors/foundation-profile-preflight/schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/schema",
   "version": 2,
   "title": "Empire Builder Kit production Foundation profile preflight",
-  "description": "Verify the pinned Aurora Serverless engine is orderable in the selected Region before Foundation mutation.",
+  "description": "Verify the pinned Aurora Serverless engine is orderable and an existing production Foundation database retains its canonical identity, deletion protection, backup retention, and recent restore signal before native SST mutation.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -22,11 +22,6 @@
       "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
       "description": "Exact temporary-session IAM role expected for local governed deployment. This is verified against STS before mutation."
     },
-    "localProductionConfirmation": {
-      "type": "string",
-      "maxLength": 256,
-      "description": "One-use local starter production confirmation: <action>:production:<account>:<region>:<source-commit>. It is never forwarded to SST."
-    },
     "region": {
       "type": "string",
       "pattern": "^[a-z]{2}(-gov)?-[a-z]+-[0-9]$",

package/src/executors/foundation-remove-preflight/foundation-remove-preflight.d.ts

@@ -1,5 +1,7 @@
+import { DescribeParametersCommand, type DescribeParametersCommandInput, type DescribeParametersCommandOutput } from '@aws-sdk/client-ssm';
 import { type PromiseExecutor } from '@nx/devkit';
-interface FoundationRemovePreflightOptions {
+export interface FoundationRemovePreflightOptions {
+    expectedRoleArn?: string;
     profile?: string;
     region?: string;
     stage: string;
@@ -9,5 +11,13 @@ export declare function evaluateFoundationRemoval(foundationStage: string, regis
     success: boolean;
 };
 export declare function productSliceRegistrationName(foundationStage: string, parameterName: string | undefined): string;
+type DescribeParametersPage = Pick<DescribeParametersCommandOutput, 'NextToken' | 'Parameters'>;
+export interface FoundationRemovePreflightDependencies {
+    sendCommand?: (command: DescribeParametersCommand) => Promise<DescribeParametersPage>;
+}
+export declare function inspectProductSliceRegistrations(foundationStage: string, fetchPage: (input: DescribeParametersCommandInput) => Promise<DescribeParametersPage>): Promise<string[]>;
+export declare function runFoundationRemovePreflight(options: FoundationRemovePreflightOptions, dependencies?: FoundationRemovePreflightDependencies): Promise<{
+    success: boolean;
+}>;
 declare const executor: PromiseExecutor<FoundationRemovePreflightOptions>;
 export default executor;