@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.31

package/src/executors/local-deploy/federated-credential-transport.d.ts

@@ -0,0 +1,48 @@
+import { type PrivateStateSecurity } from '../../local-dev/private-state.js';
+declare const CHILD_PROFILE = "ebk-sst-federated";
+declare const GOVERNED_SIGNALS: readonly ["SIGINT", "SIGTERM"];
+type GovernedSignal = (typeof GOVERNED_SIGNALS)[number];
+interface GovernedSignalCleanup {
+    readonly priority: number;
+    run(signal: GovernedSignal): Promise<void> | void;
+}
+/** Coordinate an exact child shutdown or private-state cleanup before the
+ * current process preserves its normal SIGINT/SIGTERM behavior. Higher
+ * priorities run first so mutation children stop before credentials vanish. */
+export declare function registerGovernedSignalCleanup(run: GovernedSignalCleanup['run'], priority?: number): () => void;
+export declare function governedSignalCleanupInProgress(): boolean;
+interface FederatedCredentialIdentity {
+    accessKeyId: string;
+    expiration?: Date;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+export interface LocalFederatedCredentialTransport {
+    readonly profile: typeof CHILD_PROFILE;
+    childEnvironment(ambient: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+    cleanup(): void;
+    refresh(): Promise<{
+        actorArn: string;
+        expiresAt: string;
+    }>;
+}
+export interface LocalFederatedCredentialTransportInput {
+    account: string;
+    expectedRoleArn: string;
+    profile?: string;
+    region: string;
+}
+export interface LocalFederatedCredentialTransportDependencies {
+    identify?: (credentials: FederatedCredentialIdentity, region: string) => Promise<{
+        Account?: string;
+        Arn?: string;
+    }>;
+    now?: () => Date;
+    removeDirectory?: (path: string) => void;
+    resolve?: () => Promise<FederatedCredentialIdentity>;
+    security?: PrivateStateSecurity;
+}
+/** Materialize temporary federated credentials for tools that cannot resolve a
+ * modern IAM Identity Center source-profile chain themselves. */
+export declare function createLocalFederatedCredentialTransport(input: LocalFederatedCredentialTransportInput, dependencies?: LocalFederatedCredentialTransportDependencies): Promise<LocalFederatedCredentialTransport>;
+export {};

package/src/executors/local-deploy/federated-credential-transport.js

@@ -0,0 +1,252 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerGovernedSignalCleanup = registerGovernedSignalCleanup;
+exports.governedSignalCleanupInProgress = governedSignalCleanupInProgress;
+exports.createLocalFederatedCredentialTransport = createLocalFederatedCredentialTransport;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const client_sts_1 = require("@aws-sdk/client-sts");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const child_environment_js_1 = require("../../aws/child-environment.js");
+const identity_js_1 = require("../../aws/identity.js");
+const private_state_js_1 = require("../../local-dev/private-state.js");
+const CHILD_PROFILE = 'ebk-sst-federated';
+const MINIMUM_REMAINING_LIFETIME_MS = 30 * 60 * 1000;
+const PROFILE = /^[A-Za-z0-9_+=,.@-]{1,128}$/u;
+const REGION = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/u;
+const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/u;
+const AMBIENT_CREDENTIAL_KEYS = [
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+    'AWS_SECURITY_TOKEN',
+    'AWS_ROLE_ARN',
+    'AWS_ROLE_SESSION_NAME',
+    'AWS_WEB_IDENTITY_TOKEN_FILE',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE',
+    'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+    'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
+    'AWS_CONFIG_FILE',
+    'AWS_CREDENTIAL_EXPIRATION',
+    'AWS_DEFAULT_PROFILE',
+    'AWS_DEFAULT_REGION',
+    'AWS_SHARED_CREDENTIALS_FILE',
+    'AWS_PROFILE',
+    'AWS_REGION',
+    'EBK_GOVERNED_PROCESS_GROUP',
+];
+const GOVERNED_SIGNALS = ['SIGINT', 'SIGTERM'];
+const governedSignalCleanups = new Set();
+const governedSignalHandlers = new Map();
+let governedSignalInProgress;
+function removeGovernedSignalHandlers() {
+    if (governedSignalCleanups.size > 0 || governedSignalInProgress)
+        return;
+    for (const [signal, handler] of governedSignalHandlers) {
+        process.removeListener(signal, handler);
+    }
+    governedSignalHandlers.clear();
+}
+async function handleGovernedSignal(signal, handler) {
+    if (governedSignalInProgress)
+        return;
+    governedSignalInProgress = signal;
+    const hasExternalListener = process
+        .listeners(signal)
+        .some((listener) => listener !== handler);
+    let cleanupFailed = false;
+    for (const cleanup of [...governedSignalCleanups].sort((left, right) => right.priority - left.priority)) {
+        try {
+            await cleanup.run(signal);
+        }
+        catch {
+            cleanupFailed = true;
+        }
+    }
+    governedSignalInProgress = undefined;
+    removeGovernedSignalHandlers();
+    if (cleanupFailed) {
+        process.stderr.write('Governed signal cleanup failed; private recovery evidence was retained.\n');
+    }
+    if (!hasExternalListener) {
+        const retainedHandler = governedSignalHandlers.get(signal);
+        if (retainedHandler) {
+            process.removeListener(signal, retainedHandler);
+            governedSignalHandlers.delete(signal);
+        }
+        process.kill(process.pid, signal);
+    }
+}
+function ensureGovernedSignalHandlers() {
+    for (const signal of GOVERNED_SIGNALS) {
+        if (governedSignalHandlers.has(signal))
+            continue;
+        const handler = () => {
+            void handleGovernedSignal(signal, handler);
+        };
+        governedSignalHandlers.set(signal, handler);
+        process.prependListener(signal, handler);
+    }
+}
+/** Coordinate an exact child shutdown or private-state cleanup before the
+ * current process preserves its normal SIGINT/SIGTERM behavior. Higher
+ * priorities run first so mutation children stop before credentials vanish. */
+function registerGovernedSignalCleanup(run, priority = 0) {
+    const cleanup = { priority, run };
+    governedSignalCleanups.add(cleanup);
+    ensureGovernedSignalHandlers();
+    let registered = true;
+    return () => {
+        if (!registered)
+            return;
+        registered = false;
+        governedSignalCleanups.delete(cleanup);
+        removeGovernedSignalHandlers();
+    };
+}
+function governedSignalCleanupInProgress() {
+    return governedSignalInProgress !== undefined;
+}
+function requireCredentialValue(value, label) {
+    if (!value || value !== value.trim() || /[\r\n]/u.test(value)) {
+        throw new Error(`Temporary federated ${label} is missing or malformed.`);
+    }
+    return value;
+}
+function credentialsFile(identity) {
+    return `[${CHILD_PROFILE}]\naws_access_key_id = ${requireCredentialValue(identity.accessKeyId, 'access key')}\naws_secret_access_key = ${requireCredentialValue(identity.secretAccessKey, 'secret key')}\naws_session_token = ${requireCredentialValue(identity.sessionToken, 'session token')}\n`;
+}
+function configFile(region) {
+    return `[profile ${CHILD_PROFILE}]\nregion = ${region}\noutput = json\n`;
+}
+/** Materialize temporary federated credentials for tools that cannot resolve a
+ * modern IAM Identity Center source-profile chain themselves. */
+async function createLocalFederatedCredentialTransport(input, dependencies = {}) {
+    if (!/^\d{12}$/u.test(input.account) ||
+        !ROLE.test(input.expectedRoleArn) ||
+        (input.profile !== undefined && !PROFILE.test(input.profile)) ||
+        !REGION.test(input.region)) {
+        throw new Error('Local federated credential transport input is invalid.');
+    }
+    const security = dependencies.security ?? {};
+    const directory = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ebk-sst-federated-'));
+    const configurationPath = (0, node_path_1.join)(directory, 'config');
+    const credentialsPath = (0, node_path_1.join)(directory, 'credentials');
+    let closed = false;
+    let disposed = false;
+    let actorArn = '';
+    let expiresAt = '';
+    let unregisterSignalCleanup = () => undefined;
+    (0, private_state_js_1.hardenPrivatePath)(directory, 'directory', security);
+    (0, private_state_js_1.assertPrivatePath)(directory, 'directory', security);
+    const cleanupFiles = (signalCoordinator = false) => {
+        if (disposed)
+            return true;
+        closed = true;
+        if (governedSignalInProgress && !signalCoordinator)
+            return false;
+        try {
+            (dependencies.removeDirectory ??
+                ((path) => (0, node_fs_1.rmSync)(path, { force: true, recursive: true })))(directory);
+            disposed = true;
+            unregisterSignalCleanup();
+            return true;
+        }
+        catch {
+            throw new Error('Local federated credential transport cleanup failed.');
+        }
+    };
+    const onExit = () => {
+        try {
+            cleanupFiles(true);
+        }
+        catch {
+            // Credentials are temporary and the directory remains user-private if
+            // process-exit cleanup itself cannot report an error.
+        }
+    };
+    unregisterSignalCleanup = registerGovernedSignalCleanup(() => {
+        cleanupFiles(true);
+        process.removeListener('exit', onExit);
+    });
+    process.once('exit', onExit);
+    const resolve = dependencies.resolve ??
+        (input.profile
+            ? (0, credential_providers_1.fromIni)({ profile: input.profile })
+            : (0, credential_providers_1.fromNodeProviderChain)());
+    const identify = dependencies.identify ??
+        (async (credentials, region) => new client_sts_1.STSClient({
+            credentials,
+            endpoint: (0, identity_js_1.canonicalStsEndpoint)(region),
+            region,
+        }).send(new client_sts_1.GetCallerIdentityCommand({})));
+    const refresh = async () => {
+        if (closed || disposed) {
+            throw new Error('Local federated credential transport is already closed.');
+        }
+        const identity = await resolve();
+        requireCredentialValue(identity.accessKeyId, 'access key');
+        requireCredentialValue(identity.secretAccessKey, 'secret key');
+        requireCredentialValue(identity.sessionToken, 'session token');
+        const expiration = identity.expiration;
+        const now = (dependencies.now ?? (() => new Date()))();
+        if (!(expiration instanceof Date) ||
+            !Number.isFinite(expiration.getTime()) ||
+            expiration.getTime() - now.getTime() < MINIMUM_REMAINING_LIFETIME_MS) {
+            throw new Error('Local deployment requires temporary federated credentials with at least 30 minutes remaining.');
+        }
+        const caller = await identify(identity, input.region);
+        const callerArn = caller.Arn?.trim() ?? '';
+        if (caller.Account?.trim() !== input.account ||
+            !(0, identity_js_1.matchesExpectedAssumedRoleArn)(input.account, callerArn, input.expectedRoleArn)) {
+            throw new Error('Temporary SST child credentials do not match the committed account and exact assumed role.');
+        }
+        (0, private_state_js_1.atomicWritePrivateFile)(configurationPath, configFile(input.region), security);
+        (0, private_state_js_1.atomicWritePrivateFile)(credentialsPath, credentialsFile(identity), security);
+        (0, private_state_js_1.assertPrivatePath)(directory, 'directory', security);
+        (0, private_state_js_1.assertPrivatePath)(configurationPath, 'file', security);
+        (0, private_state_js_1.assertPrivatePath)(credentialsPath, 'file', security);
+        actorArn = callerArn;
+        expiresAt = expiration.toISOString();
+        return { actorArn, expiresAt };
+    };
+    try {
+        await refresh();
+    }
+    catch (error) {
+        if (cleanupFiles())
+            process.removeListener('exit', onExit);
+        throw error;
+    }
+    return {
+        profile: CHILD_PROFILE,
+        childEnvironment(ambient) {
+            if (closed || disposed || !expiresAt) {
+                throw new Error('Local federated credential transport is unavailable.');
+            }
+            (0, private_state_js_1.assertPrivatePath)(directory, 'directory', security);
+            (0, private_state_js_1.assertPrivatePath)(configurationPath, 'file', security);
+            (0, private_state_js_1.assertPrivatePath)(credentialsPath, 'file', security);
+            const environment = (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(ambient);
+            for (const key of AMBIENT_CREDENTIAL_KEYS)
+                delete environment[key];
+            return {
+                ...environment,
+                AWS_CONFIG_FILE: configurationPath,
+                AWS_DEFAULT_REGION: input.region,
+                AWS_PROFILE: CHILD_PROFILE,
+                AWS_REGION: input.region,
+                AWS_SDK_LOAD_CONFIG: '1',
+                AWS_SHARED_CREDENTIALS_FILE: credentialsPath,
+            };
+        },
+        cleanup() {
+            if (cleanupFiles())
+                process.removeListener('exit', onExit);
+        },
+        refresh,
+    };
+}
+//# sourceMappingURL=federated-credential-transport.js.map

package/src/executors/local-deploy/federated-credential-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federated-credential-transport.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/local-deploy/federated-credential-transport.ts"],"names":[],"mappings":";;AAqHA,sEAcC;AAED,0EAEC;AAsDD,0FAwJC;AArVD,qCAA8C;AAC9C,qCAAiC;AACjC,yCAAiC;AAEjC,oDAA0E;AAC1E,wEAA+E;AAE/E,yEAAqF;AACrF,uDAG+B;AAC/B,uEAK0C;AAE1C,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrD,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAC/C,MAAM,MAAM,GAAG,gCAAgC,CAAC;AAChD,MAAM,IAAI,GACR,6EAA6E,CAAC;AAChF,MAAM,uBAAuB,GAAG;IAC9B,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,oBAAoB;IACpB,cAAc;IACd,uBAAuB;IACvB,6BAA6B;IAC7B,mCAAmC;IACnC,wCAAwC;IACxC,oCAAoC;IACpC,wCAAwC;IACxC,iBAAiB;IACjB,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;IACpB,6BAA6B;IAC7B,aAAa;IACb,YAAY;IACZ,4BAA4B;CACpB,CAAC;AACX,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAU,CAAC;AASxD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAyB,CAAC;AAChE,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA8B,CAAC;AACrE,IAAI,wBAAoD,CAAC;AAEzD,SAAS,4BAA4B;IACnC,IAAI,sBAAsB,CAAC,IAAI,GAAG,CAAC,IAAI,wBAAwB;QAAE,OAAO;IACxE,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACvD,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,sBAAsB,CAAC,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,MAAsB,EACtB,OAAmB;IAEnB,IAAI,wBAAwB;QAAE,OAAO;IACrC,wBAAwB,GAAG,MAAM,CAAC;IAClC,MAAM,mBAAmB,GAAG,OAAO;SAChC,SAAS,CAAC,MAAM,CAAC;SACjB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC5C,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,sBAAsB,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAChD,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IACD,wBAAwB,GAAG,SAAS,CAAC;IACrC,4BAA4B,EAAE,CAAC;IAC/B,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,eAAe,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAChD,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACjD,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,KAAK,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC,CAAC;QACF,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,SAAgB,6BAA6B,CAC3C,GAAiC,EACjC,QAAQ,GAAG,CAAC;IAEZ,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAClC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,4BAA4B,EAAE,CAAC;IAC/B,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,OAAO,GAAG,EAAE;QACV,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,UAAU,GAAG,KAAK,CAAC;QACnB,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,4BAA4B,EAAE,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B;IAC7C,OAAO,wBAAwB,KAAK,SAAS,CAAC;AAChD,CAAC;AAkCD,SAAS,sBAAsB,CAC7B,KAAyB,EACzB,KAAa;IAEb,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,2BAA2B,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,OAAO,IAAI,aAAa,0BAA0B,sBAAsB,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,6BAA6B,sBAAsB,CAAC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC,yBAAyB,sBAAsB,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC;AACrS,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,YAAY,aAAa,eAAe,MAAM,mBAAmB,CAAC;AAC3E,CAAC;AAED;iEACiE;AAC1D,KAAK,UAAU,uCAAuC,CAC3D,KAA6C,EAC7C,eAA8D,EAAE;IAEhE,IACE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAChC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QACjC,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,uBAAuB,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;IACpD,IAAA,oCAAiB,EAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAA,oCAAiB,EAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,CAAC,iBAAiB,GAAG,KAAK,EAAW,EAAE;QAC1D,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,wBAAwB,IAAI,CAAC,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,CAAC;YACH,CACE,YAAY,CAAC,eAAe;gBAC5B,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAC3D,CAAC,SAAS,CAAC,CAAC;YACb,QAAQ,GAAG,IAAI,CAAC;YAChB,uBAAuB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,sDAAsD;QACxD,CAAC;IACH,CAAC,CAAC;IACF,uBAAuB,GAAG,6BAA6B,CAAC,GAAG,EAAE;QAC3D,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,OAAO,GACX,YAAY,CAAC,OAAO;QACpB,CAAC,KAAK,CAAC,OAAO;YACZ,CAAC,CAAC,IAAA,8BAAO,EAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,CAAC,CAAC,IAAA,4CAAqB,GAAE,CAAC,CAAC;IAC/B,MAAM,QAAQ,GACZ,YAAY,CAAC,QAAQ;QACrB,CAAC,KAAK,EAAE,WAAwC,EAAE,MAAc,EAAE,EAAE,CAClE,IAAI,sBAAS,CAAC;YACZ,WAAW;YACX,QAAQ,EAAE,IAAA,kCAAoB,EAAC,MAAM,CAAC;YACtC,MAAM;SACP,CAAC,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,IAGlB,EAAE;QACH,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC;QACjC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC3D,sBAAsB,CAAC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC/D,sBAAsB,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvD,IACE,CAAC,CAAC,UAAU,YAAY,IAAI,CAAC;YAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACtC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,6BAA6B,EACpE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3C,IACE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,KAAK,CAAC,OAAO;YACxC,CAAC,IAAA,2CAA6B,EAC5B,KAAK,CAAC,OAAO,EACb,SAAS,EACT,KAAK,CAAC,eAAe,CACtB,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QACD,IAAA,yCAAsB,EACpB,iBAAiB,EACjB,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EACxB,QAAQ,CACT,CAAC;QACF,IAAA,yCAAsB,EACpB,eAAe,EACf,eAAe,CAAC,QAAQ,CAAC,EACzB,QAAQ,CACT,CAAC;QACF,IAAA,oCAAiB,EAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAA,oCAAiB,EAAC,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAA,oCAAiB,EAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,QAAQ,GAAG,SAAS,CAAC;QACrB,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,YAAY,EAAE;YAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,gBAAgB,CAAC,OAAO;YACtB,IAAI,MAAM,IAAI,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,IAAA,oCAAiB,EAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAA,oCAAiB,EAAC,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAA,oCAAiB,EAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,IAAA,0DAAmC,EAAC,OAAO,CAAC,CAAC;YACjE,KAAK,MAAM,GAAG,IAAI,uBAAuB;gBAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;YACnE,OAAO;gBACL,GAAG,WAAW;gBACd,eAAe,EAAE,iBAAiB;gBAClC,kBAAkB,EAAE,KAAK,CAAC,MAAM;gBAChC,WAAW,EAAE,aAAa;gBAC1B,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,mBAAmB,EAAE,GAAG;gBACxB,2BAA2B,EAAE,eAAe;aAC7C,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,YAAY,EAAE;gBAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO;KACR,CAAC;AACJ,CAAC"}

package/src/executors/local-deploy/local-approval.d.ts

@@ -1,10 +1,9 @@
 import type { ReadStream, WriteStream } from 'node:tty';
 export interface LocalMutationApprovalRequest {
-    action: 'deploy' | 'refresh';
+    action: 'deploy';
     challenge: string;
-    planDigest: string;
-    project: string;
-    stage: 'development' | 'staging' | 'production';
+    sourceCommit: string;
+    stage: 'production' | 'staging';
 }
 export type LocalMutationApprover = (request: LocalMutationApprovalRequest) => Promise<boolean>;
 export declare class LocalMutationApprovalUnavailableError extends Error {
@@ -14,10 +13,6 @@ interface LocalApprovalTerminal {
     input: ReadStream;
     output: WriteStream;
 }
-/**
- * Creates the public, non-secret operator acknowledgement used by deploy-local
- * and refresh-local. This is an active-operator boundary, not an independent
- * human-review claim: an authorized agent controlling a real TTY may answer it.
- */
+/** Active operator acknowledgement, not an independent-review claim. */
 export declare function createTtyLocalMutationApprover(terminal?: LocalApprovalTerminal): LocalMutationApprover;
 export {};

package/src/executors/local-deploy/local-approval.js

@@ -5,16 +5,12 @@ exports.createTtyLocalMutationApprover = createTtyLocalMutationApprover;
 const promises_1 = require("node:readline/promises");
 class LocalMutationApprovalUnavailableError extends Error {
     constructor() {
-        super('Local infrastructure mutation requires an interactive TTY operated by a human or authorized agent.');
+        super('Local protected-stage mutation requires an interactive TTY operated by a human or authorized agent.');
         this.name = 'LocalMutationApprovalUnavailableError';
     }
 }
 exports.LocalMutationApprovalUnavailableError = LocalMutationApprovalUnavailableError;
-/**
- * Creates the public, non-secret operator acknowledgement used by deploy-local
- * and refresh-local. This is an active-operator boundary, not an independent
- * human-review claim: an authorized agent controlling a real TTY may answer it.
- */
+/** Active operator acknowledgement, not an independent-review claim. */
 function createTtyLocalMutationApprover(terminal = {
     input: process.stdin,
     output: process.stderr,
@@ -29,7 +25,7 @@ function createTtyLocalMutationApprover(terminal = {
             terminal: true,
         });
         try {
-            const response = await prompt.question(`Type ${challenge} to acknowledge the current plan: `);
+            const response = await prompt.question(`Type ${challenge} to continue: `);
             return response === challenge;
         }
         catch {

package/src/executors/local-deploy/local-approval.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-approval.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/local-deploy/local-approval.ts"],"names":[],"mappings":";;;AAkCA,wEA0BC;AA5DD,qDAAyD;AAezD,MAAa,qCAAsC,SAAQ,KAAK;IAC9D;QACE,KAAK,CACH,oGAAoG,CACrG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;IACtD,CAAC;CACF;AAPD,sFAOC;AAOD;;;;GAIG;AACH,SAAgB,8BAA8B,CAC5C,WAAkC;IAChC,KAAK,EAAE,OAAO,CAAC,KAAK;IACpB,MAAM,EAAE,OAAO,CAAC,MAAM;CACvB;IAED,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpD,MAAM,IAAI,qCAAqC,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,0BAAe,EAAC;YAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CACpC,QAAQ,SAAS,oCAAoC,CACtD,CAAC;YACF,OAAO,QAAQ,KAAK,SAAS,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qCAAqC,EAAE,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"local-approval.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/executors/local-deploy/local-approval.ts"],"names":[],"mappings":";;;AA6BA,wEAwBC;AArDD,qDAAyD;AAczD,MAAa,qCAAsC,SAAQ,KAAK;IAC9D;QACE,KAAK,CACH,qGAAqG,CACtG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;IACtD,CAAC;CACF;AAPD,sFAOC;AAOD,wEAAwE;AACxE,SAAgB,8BAA8B,CAC5C,WAAkC;IAChC,KAAK,EAAE,OAAO,CAAC,KAAK;IACpB,MAAM,EAAE,OAAO,CAAC,MAAM;CACvB;IAED,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpD,MAAM,IAAI,qCAAqC,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,0BAAe,EAAC;YAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,SAAS,gBAAgB,CAAC,CAAC;YAC1E,OAAO,QAAQ,KAAK,SAAS,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qCAAqC,EAAE,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/src/executors/local-deploy/local-deploy.d.ts

@@ -1,67 +1,82 @@
-import { spawnSync } from 'node:child_process';
-import { GetParameterCommand, PutParameterCommand } from '@aws-sdk/client-ssm';
+import { spawn, spawnSync } from 'node:child_process';
 import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
-import { type InfrastructurePlanV1 } from '../../infrastructure-change/index.js';
-import { type CanonicalDeploymentStage } from '../../repository-policy/index.js';
+import { type CanonicalDeploymentStage, type RepositoryOperatingPolicy } from '../../repository-policy/index.js';
+import { attestProductionDatabaseLifecycle } from '../foundation-profile-preflight/production-database-safeguard.js';
+import { createLocalFederatedCredentialTransport } from './federated-credential-transport.js';
 import { type LocalMutationApprover } from './local-approval.js';
 interface LocalDeployOptions {
-    action?: 'deploy' | 'refresh';
-    confirmation?: string;
     expectedRoleArn: string;
-    phase?: 'foundation-bootstrap' | 'full-stage';
     profile?: string;
     stage: CanonicalDeploymentStage;
 }
 interface LocalDeployDependencies {
     approve?: LocalMutationApprover;
-    backend?: (input: {
-        account: string;
-        applications: readonly string[];
-        profile?: string;
-        region: string;
-        stage: CanonicalDeploymentStage;
-    }) => Promise<LocalSstBackendAuthority>;
-    now?: () => Date;
-    run?: typeof spawnSync;
-    caller?: (region: string) => Promise<{
+    attestContainerBinding?: typeof attestLocalContainerBinding;
+    attestProductionDatabase?: typeof attestProductionDatabaseLifecycle;
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    identifyGithubCaller?: (region: string) => Promise<{
         Account?: string;
         Arn?: string;
     }>;
+    now?: () => Date;
+    platform?: NodeJS.Platform;
+    run?: typeof spawnSync;
+    spawnChild?: typeof spawn;
 }
-interface LocalSstBackendAuthority {
-    authorityDigest: string;
-    createdApplications: readonly string[];
-    stateBucketArn: string;
+interface ProjectDescriptor {
+    name: string;
+    root: string;
+    tags: readonly string[];
+    targets: Readonly<Record<string, unknown>>;
 }
-/** @internal */
-export declare function prepareLocalSstBackend(input: {
+interface ChildReceipt {
+    completedAt: string;
+    outcome: 'failed' | 'succeeded';
+    project: string;
+    startedAt: string;
+    target: 'container-release-amd64' | 'container-release-arm64' | 'container-release-assemble' | 'deploy' | 'production-database-final-postflight' | 'production-database-postflight' | 'profile-preflight' | 'release-candidate' | 'smoke-deployed';
+}
+export interface DeploymentReceipt {
     account: string;
-    applications: readonly string[];
-    profile?: string;
+    actor: string;
+    authority: 'github' | 'local';
+    children: readonly ChildReceipt[];
+    completedAt: string;
+    frameworkVersion: string;
+    kind: 'ebk-deployment-receipt';
+    migrations: Readonly<Record<string, 'completed-by-deploy-target' | 'not-applicable'>>;
+    outcome: 'failed' | 'review-required' | 'succeeded';
+    profile: RepositoryOperatingPolicy['deploymentProfile'];
     region: string;
+    schemaVersion: 1;
+    smoke: Readonly<Record<string, 'not-applicable' | 'passed'>>;
+    source: {
+        clean: boolean;
+        commit: string;
+        workingTreeDigest: string;
+    };
     stage: CanonicalDeploymentStage;
-}, dependencies?: {
-    passphrase?: () => string;
-    send?: (command: GetParameterCommand | PutParameterCommand) => Promise<{
-        Parameter?: {
-            Name?: string;
-            Type?: string;
-            Value?: string;
-            Version?: number;
-        };
-    }>;
-}): Promise<LocalSstBackendAuthority>;
-/** @internal */
-export declare function localPlanSummaryDigest(input: {
-    action?: 'deploy' | 'refresh';
+    startedAt: string;
+}
+/** Bind a development deployment to the exact tracked diff and untracked
+ * source bytes without requiring a commit. Ignored caches and build output are
+ * intentionally outside this identity. */
+export declare function localWorkingTreeDigest(root: string, run?: typeof spawnSync): {
+    clean: boolean;
+    commit: string;
+    digest: string;
+};
+declare function attestLocalContainerBinding(input: {
     account: string;
-    orderedProjects: readonly string[];
-    phase: 'foundation-bootstrap' | 'full-stage';
-    plans: Readonly<Record<string, InfrastructurePlanV1>>;
+    project: ProjectDescriptor;
     region: string;
+    root: string;
     sourceCommit: string;
     stage: CanonicalDeploymentStage;
-}): string;
+}): void;
+/** Determine the one native deployment order. Foundation is always first and
+ * production Slice admission remains a committed policy decision. */
+export declare function localDeploymentProjectOrder(policy: RepositoryOperatingPolicy, context: ExecutorContext, stage: CanonicalDeploymentStage): string[];
 export declare function runLocalDeploy(options: LocalDeployOptions, context: ExecutorContext, dependencies?: LocalDeployDependencies): Promise<{
     success: boolean;
 }>;