@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/executors/local-deploy/local-deploy.js

@@ -1,911 +1,1062 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.prepareLocalSstBackend = prepareLocalSstBackend;
-exports.localPlanSummaryDigest = localPlanSummaryDigest;
+exports.localWorkingTreeDigest = localWorkingTreeDigest;
+exports.localDeploymentProjectOrder = localDeploymentProjectOrder;
 exports.runLocalDeploy = runLocalDeploy;
 const node_crypto_1 = require("node:crypto");
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
-const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
-const client_sts_1 = require("@aws-sdk/client-sts");
-const client_ssm_1 = require("@aws-sdk/client-ssm");
-const credential_providers_1 = require("@aws-sdk/credential-providers");
 const devkit_1 = require("@nx/devkit");
-const index_js_1 = require("../../infrastructure-change/index.js");
-const local_capability_js_1 = require("../../infrastructure-change/local-capability.js");
+const client_sts_1 = require("@aws-sdk/client-sts");
+const index_js_1 = require("../../aws-authority/index.js");
+const child_environment_js_1 = require("../../aws/child-environment.js");
+const identity_js_1 = require("../../aws/identity.js");
 const index_js_2 = require("../../repository-policy/index.js");
-const source_authority_js_1 = require("../../release/source-authority.js");
+const production_database_safeguard_js_1 = require("../foundation-profile-preflight/production-database-safeguard.js");
 const private_state_js_1 = require("../../local-dev/private-state.js");
-const infrastructure_plan_js_1 = require("../infrastructure-plan/infrastructure-plan.js");
-const sst_environment_source_js_1 = require("../sst-lifecycle/sst-environment-source.js");
+const federated_credential_transport_js_1 = require("./federated-credential-transport.js");
 const local_approval_js_1 = require("./local-approval.js");
-const SHA = /^[a-f0-9]{40}$/;
-const SHA256 = /^[a-f0-9]{64}$/;
-const MAX_PLAN_BYTES = 2 * 1024 * 1024;
-const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
-const AMBIENT_CREDENTIAL_KEYS = [
-    'AWS_ACCESS_KEY_ID',
-    'AWS_SECRET_ACCESS_KEY',
-    'AWS_SESSION_TOKEN',
-    'AWS_SECURITY_TOKEN',
-    'AWS_ROLE_ARN',
-    'AWS_ROLE_SESSION_NAME',
-    'AWS_WEB_IDENTITY_TOKEN_FILE',
-    'AWS_CONTAINER_AUTHORIZATION_TOKEN',
-    'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE',
-    'AWS_CONTAINER_CREDENTIALS_FULL_URI',
-    'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
-];
-const PROTECTED_PLAN_KEYS = [
-    'EBK_LOCAL_MUTATION_CAPABILITY_NONCE',
-    'EBK_LOCAL_MUTATION_CAPABILITY_PATH',
-    'EBK_LOCAL_PLAN_APPROVER_ARN',
-    'EBK_LOCAL_PLAN_MATERIAL_DIGEST',
-    'EBK_LOCAL_PLAN_SUMMARY_DIGEST',
-    'AWS_PLAN_GENERATED_OBJECT_ARNS_JSON',
-    'AWS_PLAN_GENERATED_PARAMETER_ARNS_JSON',
-    'AWS_PLAN_GENERATED_SECRET_ARNS_JSON',
-    'AWS_PLAN_PROVIDER_REFRESH_POLICY_JSON',
-    'AWS_PLAN_STATE_KMS_KEY_ARN',
-    'EBK_RELEASE_SOURCE_COMMIT',
-];
-function projectEvidencePath(context, project, name) {
-    const configured = context.projectsConfigurations?.projects[project]?.root;
-    if (!configured) {
-        throw new Error(`Local deployment references unknown project ${project}.`);
-    }
-    return (0, node_path_1.join)((0, node_path_1.isAbsolute)(configured) ? configured : (0, node_path_1.join)(context.root, configured), '.ebk', 'evidence', name);
-}
-function writeLocalMutationCapability(input) {
-    const nonce = (0, node_crypto_1.randomBytes)(32).toString('hex');
-    const directory = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ebk-local-mutation-'));
-    (0, private_state_js_1.ensurePrivateDirectory)(directory);
-    const path = (0, node_path_1.join)(directory, 'capability.json');
-    const planContents = (0, node_fs_1.readFileSync)(projectEvidencePath(input.context, input.project, 'infrastructure-plan.json'), 'utf8');
-    const authorizationContents = (0, node_fs_1.readFileSync)(projectEvidencePath(input.context, input.project, 'infrastructure-plan-authorization.json'), 'utf8');
-    const capability = (0, local_capability_js_1.createLocalMutationCapability)({
-        actorArn: input.actorArn,
-        authorizationContents,
-        deploymentProfile: input.deploymentProfile,
-        deploymentSourceCommit: input.deploymentSourceCommit,
-        deploymentSourceTree: input.deploymentSourceTree,
-        expectedRoleArn: input.expectedRoleArn,
-        issuedAt: input.issuedAt,
-        nonce,
-        plan: input.plan,
-        planContents,
-        project: input.project,
-        releaseSourceTree: input.releaseSourceTree,
-    });
-    (0, private_state_js_1.atomicWritePrivateFile)(path, `${JSON.stringify(capability, null, 2)}\n`);
-    return { directory, nonce, path };
-}
-function digest(value) {
-    return (0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
-}
-function ssmParameterAuthority(value, expectedName) {
-    const parameter = record(value, expectedName);
-    if (parameter['Name'] !== expectedName ||
-        parameter['Type'] !== 'SecureString' ||
-        typeof parameter['Version'] !== 'number' ||
-        !Number.isSafeInteger(parameter['Version']) ||
-        parameter['Version'] < 1) {
-        throw new Error(`Local SST backend parameter ${expectedName} is missing or malformed.`);
-    }
-    return {
-        name: expectedName,
-        type: parameter['Type'],
-        version: parameter['Version'],
-    };
-}
-/** @internal */
-async function prepareLocalSstBackend(input, dependencies = {}) {
-    if (input.applications.length === 0 ||
-        new Set(input.applications).size !== input.applications.length ||
-        input.applications.some((application) => !/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(application))) {
-        throw new Error('Local SST backend requires a unique exact application inventory.');
-    }
-    const client = new client_ssm_1.SSMClient({
-        region: input.region,
-        ...(input.profile
-            ? { credentials: (0, credential_providers_1.fromIni)({ profile: input.profile }) }
-            : {}),
-    });
-    const send = dependencies.send ??
-        (async (command) => client.send(command));
-    const bootstrapResponse = await send(new client_ssm_1.GetParameterCommand({ Name: '/sst/bootstrap' }));
-    const bootstrapParameter = bootstrapResponse.Parameter;
-    let bootstrap;
-    try {
-        bootstrap = record(JSON.parse(bootstrapParameter?.Value ?? ''), 'Local SST bootstrap value');
-    }
-    catch {
-        throw new Error('Local deployment requires an existing exact SST v5 account bootstrap.');
-    }
-    const exactBootstrapKeys = [
-        'appsyncHttp',
-        'appsyncRealtime',
-        'asset',
-        'assetEcrRegistryId',
-        'assetEcrUrl',
-        'state',
-        'version',
-    ];
-    const state = bootstrap['state'];
-    if (bootstrapParameter?.Name !== '/sst/bootstrap' ||
-        bootstrapParameter.Type !== 'String' ||
-        typeof bootstrapParameter.Version !== 'number' ||
-        !Number.isSafeInteger(bootstrapParameter.Version) ||
-        bootstrapParameter.Version < 1 ||
-        Object.keys(bootstrap).sort().join(',') !== exactBootstrapKeys.join(',') ||
-        bootstrap['version'] !== 5 ||
-        typeof state !== 'string' ||
-        !/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(state) ||
-        typeof bootstrap['asset'] !== 'string' ||
-        !/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bootstrap['asset']) ||
-        bootstrap['assetEcrRegistryId'] !== input.account ||
-        bootstrap['assetEcrUrl'] !==
-            `${input.account}.dkr.ecr.${input.region}.amazonaws.com/sst-asset` ||
-        typeof bootstrap['appsyncHttp'] !== 'string' ||
-        typeof bootstrap['appsyncRealtime'] !== 'string') {
-        throw new Error('Local deployment requires an existing exact SST v5 account bootstrap.');
-    }
-    const parameterAuthority = new Map();
-    const missingApplications = [];
-    const createdApplications = [];
-    for (const application of input.applications) {
-        const name = `/sst/passphrase/${application}/${input.stage}`;
-        try {
-            const observed = await send(new client_ssm_1.GetParameterCommand({ Name: name }));
-            parameterAuthority.set(application, ssmParameterAuthority(observed.Parameter, name));
-        }
-        catch (error) {
-            if (!(error instanceof Error) || error.name !== 'ParameterNotFound') {
-                throw error;
-            }
-            missingApplications.push(application);
-        }
-    }
-    for (const application of missingApplications) {
-        const name = `/sst/passphrase/${application}/${input.stage}`;
-        await send(new client_ssm_1.PutParameterCommand({
-            Description: `SST state passphrase for ${application}/${input.stage}`,
-            Name: name,
-            Overwrite: false,
-            Type: 'SecureString',
-            Value: dependencies.passphrase?.() ?? (0, node_crypto_1.randomBytes)(32).toString('base64'),
-        }));
-        createdApplications.push(application);
-        const observed = await send(new client_ssm_1.GetParameterCommand({ Name: name }));
-        parameterAuthority.set(application, ssmParameterAuthority(observed.Parameter, name));
-    }
-    const parameters = input.applications.map((application) => {
-        const authority = parameterAuthority.get(application);
-        if (!authority) {
-            throw new Error(`Local SST backend parameter authority is absent for ${application}.`);
-        }
-        return authority;
-    });
-    return {
-        authorityDigest: digest(JSON.stringify({
-            applications: [...input.applications],
-            bootstrap: {
-                name: bootstrapParameter.Name,
-                type: bootstrapParameter.Type,
-                version: bootstrapParameter.Version,
-            },
-            parameters,
-            region: input.region,
-            stage: input.stage,
-            state,
-        })),
-        createdApplications,
-        stateBucketArn: `arn:aws:s3:::${state}`,
-    };
+const container_release_js_1 = require("../../supply-chain/container-release.js");
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+const index_js_3 = require("../../workspace-deployment/index.js");
+const SHA = /^[a-f0-9]{40,64}$/u;
+const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/u;
+const MAX_LOCAL_RELEASE_CANDIDATE_FILE_BYTES = 64 * 1024;
+const MAX_LOCAL_RELEASE_ARTIFACTS_BYTES = 64 * 1024 * 1024;
+const MAX_LOCAL_RELEASE_CANDIDATE_FILES = 32;
+const MAX_LOCAL_RELEASE_CANDIDATE_BYTES = MAX_LOCAL_RELEASE_ARTIFACTS_BYTES +
+    (MAX_LOCAL_RELEASE_CANDIDATE_FILES - 1) *
+        MAX_LOCAL_RELEASE_CANDIDATE_FILE_BYTES;
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
 }
 function git(root, args, run) {
     const result = run('git', args, {
         cwd: root,
         encoding: 'utf8',
         env: process.env,
-        maxBuffer: 1024 * 1024,
+        maxBuffer: 32 * 1024 * 1024,
         shell: false,
     });
     if (result.status !== 0) {
         throw new Error(`Local deployment Git preflight failed: ${String(result.stderr).trim()}`);
     }
-    return String(result.stdout).trim();
+    return String(result.stdout);
 }
-function gitRaw(root, args, run) {
-    const result = run('git', args, {
-        cwd: root,
-        encoding: 'utf8',
-        env: process.env,
-        maxBuffer: 1024 * 1024,
-        shell: false,
-    });
-    if (result.status !== 0 || String(result.stderr) !== '') {
-        throw new Error(`Local deployment Git reconciliation failed: ${String(result.stderr).trim()}`);
+function confinedWorkspacePath(root, candidate) {
+    if (!candidate || (0, node_path_1.isAbsolute)(candidate) || candidate.includes('\0')) {
+        throw new Error('Working-tree inventory contains an invalid path.');
     }
-    return String(result.stdout);
+    const absolute = (0, node_path_1.join)(root, candidate);
+    const confined = (0, node_path_1.relative)(root, absolute);
+    if (confined === '..' || confined.startsWith('../') || (0, node_path_1.isAbsolute)(confined)) {
+        throw new Error('Working-tree inventory escapes the workspace.');
+    }
+    return absolute;
 }
-function toolOwnedSourceSnapshots(context, projects) {
-    const workspaceRoot = (0, node_fs_1.realpathSync)(context.root);
-    return projects.map((project) => {
-        const configured = context.projectsConfigurations?.projects[project]?.root;
-        if (!configured) {
-            throw new Error(`Local deployment tool-owned source references unknown project ${project}.`);
+/** Bind a development deployment to the exact tracked diff and untracked
+ * source bytes without requiring a commit. Ignored caches and build output are
+ * intentionally outside this identity. */
+function localWorkingTreeDigest(root, run = node_child_process_1.spawnSync) {
+    const commit = git(root, ['rev-parse', 'HEAD'], run).trim();
+    if (!SHA.test(commit)) {
+        throw new Error('Local deployment could not resolve one exact Git HEAD.');
+    }
+    const status = git(root, ['status', '--porcelain=v1', '--untracked-files=all'], run);
+    const trackedDiff = git(root, ['diff', '--binary', 'HEAD'], run);
+    const untracked = git(root, ['ls-files', '--others', '--exclude-standard', '-z'], run)
+        .split('\0')
+        .filter(Boolean)
+        .sort();
+    const hash = (0, node_crypto_1.createHash)('sha256');
+    hash.update('ebk-working-tree-v1\0');
+    hash.update(commit);
+    hash.update('\0');
+    hash.update(status);
+    hash.update('\0');
+    hash.update(trackedDiff);
+    hash.update('\0');
+    for (const path of untracked) {
+        const absolute = confinedWorkspacePath(root, path);
+        const stat = (0, node_fs_1.lstatSync)(absolute);
+        hash.update(path);
+        hash.update('\0');
+        if (stat.isSymbolicLink()) {
+            hash.update('symlink\0');
+            hash.update((0, node_fs_1.readlinkSync)(absolute));
         }
-        return (0, sst_environment_source_js_1.captureSstEnvironmentSourceTree)({
-            projectRoot: (0, node_path_1.isAbsolute)(configured)
-                ? configured
-                : (0, node_path_1.join)(workspaceRoot, configured),
-            workspaceRoot,
-        });
-    });
-}
-function nulSeparatedPaths(value) {
-    return value.split('\0').filter((entry) => entry !== '');
-}
-function reconcileToolOwnedSource(root, snapshots, run) {
-    for (const snapshot of snapshots) {
-        (0, sst_environment_source_js_1.reconcileSstEnvironmentSourceTree)(snapshot);
+        else if (stat.isFile()) {
+            hash.update('file\0');
+            hash.update((0, node_fs_1.readFileSync)(absolute));
+        }
+        else {
+            throw new Error(`Untracked deployment source ${path} is not a regular file or symbolic link.`);
+        }
+        hash.update('\0');
     }
-    const remaining = [
-        ...nulSeparatedPaths(gitRaw(root, ['diff', 'HEAD', '--name-only', '--no-renames', '-z'], run)),
-        ...nulSeparatedPaths(gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z'], run)),
-    ];
-    if (remaining.length > 0) {
-        throw new Error(`Local deployment child changed source outside exact tool-owned files: ${remaining.sort().join(', ')}.`);
+    return { clean: status === '', commit, digest: hash.digest('hex') };
+}
+function assertDeploymentSourceUnchanged(root, expected, run) {
+    const current = localWorkingTreeDigest(root, run);
+    if (current.clean !== expected.clean ||
+        current.commit !== expected.commit ||
+        current.digest !== expected.workingTreeDigest) {
+        throw new Error('Deployment source changed after lifecycle authority was established; downstream execution is blocked.');
     }
 }
-function projectInventory(context, stage, phase, action) {
-    const projects = Object.entries(context.projectsConfigurations?.projects ?? {}).map(([name, configuration]) => ({
+function projectDescriptors(context) {
+    return Object.entries(context.projectsConfigurations?.projects ?? {}).map(([name, configuration]) => ({
         name,
-        tags: configuration.tags,
-        targets: configuration.targets,
+        root: configuration.root,
+        tags: configuration.tags ?? [],
+        targets: configuration.targets ?? {},
     }));
-    const policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
-    const foundations = projects
-        .filter(({ tags }) => tags?.includes('scope:foundation'))
-        .map(({ name }) => name);
-    if (foundations.length !== 1) {
-        throw new Error('Local deployment requires exactly one Foundation project.');
+}
+function supportsTarget(project, target) {
+    return Object.prototype.hasOwnProperty.call(project.targets, target);
+}
+const LOCAL_CONTAINER_TARGETS = Object.freeze([
+    'release-candidate',
+    'container-release-amd64',
+    'container-release-arm64',
+    'container-release-assemble',
+]);
+function requiresLocalContainerPreparation(profile, stage) {
+    return ((profile === 'starter' && stage === 'production') ||
+        (profile === 'production-isolated' && stage === 'staging'));
+}
+function confinedEvidenceSegments(root, candidate) {
+    const confined = (0, node_path_1.relative)(root, candidate);
+    if (confined === '' ||
+        confined === '..' ||
+        confined.startsWith(`..${node_path_1.sep}`) ||
+        (0, node_path_1.isAbsolute)(confined)) {
+        throw new Error('Local container evidence path escapes the workspace.');
     }
-    if (phase === 'foundation-bootstrap') {
-        return foundations;
+    const segments = confined.split(node_path_1.sep);
+    if (segments.some((segment) => segment === '' ||
+        segment === '.' ||
+        segment === '..' ||
+        segment.includes('\0'))) {
+        throw new Error('Local container evidence path is invalid.');
     }
-    if (stage !== 'development') {
-        return (0, index_js_2.createProtectedDeploymentPlan)(policy, {
-            action,
-            projects,
-            stage,
-        }).orderedProjects;
+    return segments;
+}
+function assertSafeEvidenceTree(path) {
+    let entries = 0;
+    const visit = (directory) => {
+        for (const entry of (0, node_fs_1.readdirSync)(directory, { withFileTypes: true })) {
+            entries += 1;
+            if (entries > 4096) {
+                throw new Error('Local container evidence tree is unexpectedly large.');
+            }
+            const child = (0, node_path_1.join)(directory, entry.name);
+            const identity = (0, node_fs_1.lstatSync)(child);
+            if (identity.isSymbolicLink()) {
+                throw new Error('Local container evidence cleanup refuses symbolic links.');
+            }
+            if (identity.isDirectory()) {
+                visit(child);
+            }
+            else if (!identity.isFile()) {
+                throw new Error('Local container evidence cleanup accepts only regular files and directories.');
+            }
+        }
+    };
+    visit(path);
+}
+function removeExactLocalEvidenceDirectory(root, path) {
+    const segments = confinedEvidenceSegments(root, path);
+    let current = root;
+    const rootIdentity = (0, node_fs_1.lstatSync)(current);
+    if (!rootIdentity.isDirectory() || rootIdentity.isSymbolicLink()) {
+        throw new Error('Local deployment workspace root is absent or unsafe.');
     }
-    const slices = projects
-        .filter(({ tags }) => tags?.includes('type:slice'))
-        .map(({ name }) => name)
-        .sort();
-    return [foundations[0], ...slices];
+    for (const segment of segments) {
+        current = (0, node_path_1.join)(current, segment);
+        if (!(0, node_fs_1.existsSync)(current))
+            return;
+        const identity = (0, node_fs_1.lstatSync)(current);
+        if (!identity.isDirectory() || identity.isSymbolicLink()) {
+            throw new Error('Local container evidence cleanup encountered an unsafe path.');
+        }
+    }
+    assertSafeEvidenceTree(current);
+    (0, node_fs_1.rmSync)(current, { recursive: true });
 }
-function runNx(context, project, target, forwarded, environment, run) {
-    const result = run(process.execPath, [
-        (0, node_path_1.join)(context.root, 'node_modules', 'nx', 'dist', 'bin', 'nx.js'),
-        'run',
-        `${project}:${target}`,
-        '--',
-        ...forwarded,
-    ], {
-        cwd: context.root,
-        encoding: 'utf8',
-        env: environment,
-        maxBuffer: 16 * 1024 * 1024,
-        shell: false,
-        stdio: 'inherit',
-    });
-    if (result.status !== 0) {
-        throw new Error(`Local ${target} failed for ${project}.`);
+function ensurePrivateEvidenceDirectory(root, path) {
+    const segments = confinedEvidenceSegments(root, path);
+    let current = root;
+    for (const segment of segments) {
+        current = (0, node_path_1.join)(current, segment);
+        if ((0, node_fs_1.existsSync)(current)) {
+            const identity = (0, node_fs_1.lstatSync)(current);
+            if (!identity.isDirectory() || identity.isSymbolicLink()) {
+                throw new Error('Local container evidence directory encountered an unsafe path.');
+            }
+        }
+        (0, private_state_js_1.ensurePrivateDirectory)(current);
     }
 }
-function runNxWithToolOwnedSourceReconciliation(context, project, target, forwarded, environment, snapshots, run, acceptExecutionFailure) {
-    let executionError;
-    try {
-        runNx(context, project, target, forwarded, environment, run);
+function resetLocalContainerWorkingEvidence(input) {
+    const projectRoot = confinedWorkspacePath(input.root, input.project.root);
+    for (const path of [
+        (0, node_path_1.join)(projectRoot, '.ebk', 'evidence', 'release-candidate'),
+        (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'release-candidate', 'packages', input.project.name),
+        (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'container-release', 'partials', input.stage, input.project.name),
+        (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'container-release', input.stage, 'packages', input.project.name),
+    ]) {
+        removeExactLocalEvidenceDirectory(input.root, path);
     }
-    catch (error) {
-        executionError = error;
+}
+/** Materialize the same bounded workspace-level candidate layout restored by
+ * protected GitHub deployment. The generated container helper and SST image
+ * resolver both consume this exact path. */
+function materializeLocalReleaseCandidate(input) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(input.project.name)) {
+        throw new Error(`Local container release project ${input.project.name} has an unsafe evidence identity.`);
     }
-    let reconciliationError;
+    const projectRoot = confinedWorkspacePath(input.root, input.project.root);
+    const source = (0, node_path_1.join)(projectRoot, '.ebk', 'evidence', 'release-candidate');
+    const sourceIdentity = (0, node_fs_1.lstatSync)(source);
+    if (!sourceIdentity.isDirectory() || sourceIdentity.isSymbolicLink()) {
+        throw new Error(`Local release candidate for ${input.project.name} is absent or unsafe.`);
+    }
+    const entries = (0, node_fs_1.readdirSync)(source, { withFileTypes: true }).sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+    if (entries.length === 0 ||
+        entries.length > MAX_LOCAL_RELEASE_CANDIDATE_FILES ||
+        entries.some((entry) => !entry.isFile() ||
+            entry.isSymbolicLink() ||
+            !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}\.json$/u.test(entry.name))) {
+        throw new Error(`Local release candidate for ${input.project.name} has an invalid file inventory.`);
+    }
+    let totalBytes = 0;
+    const files = entries.map(({ name }) => {
+        const path = (0, node_path_1.join)(source, name);
+        const identity = (0, node_fs_1.lstatSync)(path);
+        const maximumBytes = name === 'release-artifacts.json'
+            ? MAX_LOCAL_RELEASE_ARTIFACTS_BYTES
+            : MAX_LOCAL_RELEASE_CANDIDATE_FILE_BYTES;
+        if (!identity.isFile() ||
+            identity.isSymbolicLink() ||
+            identity.size <= 0 ||
+            identity.size > maximumBytes) {
+            throw new Error(`Local release candidate file ${input.project.name}/${name} is absent or unsafe.`);
+        }
+        totalBytes += identity.size;
+        return { name, path };
+    });
+    if (totalBytes > MAX_LOCAL_RELEASE_CANDIDATE_BYTES) {
+        throw new Error(`Local release candidate for ${input.project.name} exceeds the bounded inventory size.`);
+    }
+    const candidateFiles = files.map(({ name, path }) => ({
+        contents: (0, node_fs_1.readFileSync)(path),
+        name,
+    }));
+    const candidateFile = candidateFiles.find(({ name }) => name === 'candidate.json');
+    let candidate;
     try {
-        reconcileToolOwnedSource(context.root, snapshots, run);
+        candidate = JSON.parse(candidateFile?.contents.toString('utf8') ?? '');
     }
-    catch (error) {
-        reconciliationError = error;
+    catch {
+        throw new Error(`Local release candidate for ${input.project.name} is invalid JSON.`);
     }
-    if (executionError !== undefined && reconciliationError !== undefined) {
-        throw new Error(`Local ${target} and tool-owned source reconciliation both failed for ${project}. Execution: ${executionError instanceof Error ? executionError.message : String(executionError)} Reconciliation: ${reconciliationError instanceof Error ? reconciliationError.message : String(reconciliationError)}`);
+    if (candidate.kind !== 'ebk-release-candidate' ||
+        candidate.schemaVersion !== 1 ||
+        candidate.slice !== input.project.name ||
+        candidate.sourceCommit !== input.sourceCommit) {
+        throw new Error(`Local release candidate for ${input.project.name} differs from the exact deployment source.`);
     }
-    if (reconciliationError !== undefined)
-        throw reconciliationError;
-    if (executionError !== undefined) {
-        let accepted = false;
-        try {
-            accepted = acceptExecutionFailure?.() === true;
+    const destination = (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'release-candidate', 'packages', input.project.name);
+    removeExactLocalEvidenceDirectory(input.root, destination);
+    ensurePrivateEvidenceDirectory(input.root, destination);
+    for (const { contents, name } of candidateFiles) {
+        if (name === 'release-artifacts.json') {
+            (0, private_state_js_1.atomicWritePrivateFileWithMaximumBytes)((0, node_path_1.join)(destination, name), contents, MAX_LOCAL_RELEASE_ARTIFACTS_BYTES);
         }
-        catch {
-            accepted = false;
+        else {
+            (0, private_state_js_1.atomicWritePrivateFile)((0, node_path_1.join)(destination, name), contents);
         }
-        if (!accepted)
-            throw executionError;
     }
 }
-function record(value, label) {
-    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-        throw new Error(`${label} must be a JSON object.`);
+function attestLocalContainerBinding(input) {
+    const path = (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'container-release', input.stage, 'packages', input.project.name, 'binding.json');
+    const identity = (0, node_fs_1.lstatSync)(path);
+    if (!identity.isFile() ||
+        identity.isSymbolicLink() ||
+        identity.size <= 0 ||
+        identity.size > 64 * 1024 * 1024) {
+        throw new Error(`Local protected container binding for ${input.project.name} is absent or unsafe.`);
+    }
+    const binding = (0, container_release_js_1.validateContainerReleaseBinding)(JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8')));
+    if (binding.accountId !== input.account ||
+        binding.region !== input.region ||
+        binding.slice !== input.project.name ||
+        binding.sourceCommit !== input.sourceCommit ||
+        binding.stage !== input.stage) {
+        throw new Error(`Local protected container binding for ${input.project.name} differs from the exact deployment authority.`);
     }
-    return value;
 }
-function retainedPlan(context, project, deploymentSourceCommit, account, region, stage, action) {
-    const configured = context.projectsConfigurations?.projects[project]?.root;
-    if (!configured) {
-        throw new Error(`Local deployment references unknown project ${project}.`);
-    }
-    const workspaceRoot = (0, node_fs_1.realpathSync)(context.root);
-    const projectRoot = (0, node_fs_1.realpathSync)((0, node_path_1.isAbsolute)(configured) ? configured : (0, node_path_1.join)(workspaceRoot, configured));
-    const projectRelative = (0, node_path_1.relative)(workspaceRoot, projectRoot);
-    if (projectRelative === '..' ||
-        projectRelative.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`) ||
-        (0, node_path_1.isAbsolute)(projectRelative)) {
-        throw new Error(`Local deployment project ${project} escapes the workspace.`);
-    }
-    const path = (0, node_path_1.join)(projectRoot, '.ebk', 'evidence', 'infrastructure-plan.json');
-    const before = (0, node_fs_1.lstatSync)(path, { bigint: true });
-    if (!before.isFile() ||
-        before.nlink !== 1n ||
-        before.size > BigInt(MAX_PLAN_BYTES)) {
-        throw new Error(`Local deployment plan for ${project} is not one bounded regular file.`);
-    }
-    const bytes = (0, node_fs_1.readFileSync)(path);
-    const after = (0, node_fs_1.lstatSync)(path, { bigint: true });
-    if (before.dev !== after.dev ||
-        before.ino !== after.ino ||
-        before.mode !== after.mode ||
-        before.nlink !== after.nlink ||
-        before.size !== after.size ||
-        before.mtimeNs !== after.mtimeNs ||
-        before.ctimeNs !== after.ctimeNs ||
-        BigInt(bytes.byteLength) !== after.size) {
-        throw new Error(`Local deployment plan for ${project} changed while it was read.`);
-    }
-    let parsed;
+/** Read only the bounded public outputs SST writes after a successful native
+ * deploy. This is post-operation smoke input, never preview or mutation
+ * authority. Stage and project identity prevent a stale output file from
+ * selecting another deployment. */
+function readDeployedSmokeTarget(workspaceRoot, project, stage) {
+    const projectRoot = confinedWorkspacePath(workspaceRoot, project.root);
+    const outputPath = (0, node_path_1.join)(projectRoot, '.sst', 'outputs.json');
+    const identity = (0, node_fs_1.lstatSync)(outputPath);
+    if (!identity.isFile() ||
+        identity.isSymbolicLink() ||
+        identity.size < 2 ||
+        identity.size > 64 * 1024) {
+        throw new Error(`Native SST outputs for ${project.name} are absent or unsafe.`);
+    }
+    const value = JSON.parse((0, node_fs_1.readFileSync)(outputPath, 'utf8'));
+    let api;
+    let web;
     try {
-        parsed = record(JSON.parse(bytes.toString('utf8')), `${project} plan`);
+        api = new URL(String(value.apiUrl ?? ''));
+        web = new URL(String(value.webUrl ?? ''));
     }
     catch {
-        throw new Error(`Local deployment plan for ${project} is invalid JSON.`);
-    }
-    const plan = parsed;
-    if (plan.kind !== index_js_1.INFRASTRUCTURE_PLAN_KIND ||
-        plan.schemaVersion !== index_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION ||
-        plan.action !== action ||
-        !SHA.test(plan.sourceCommit) ||
-        plan.target?.accountFingerprint !== digest(account) ||
-        plan.target?.region !== region ||
-        plan.target?.stage !== stage ||
-        !Array.isArray(plan.projects) ||
-        plan.projects.length !== 1 ||
-        plan.projects[0] !== project ||
-        !SHA256.test(plan.materialDigest) ||
-        (0, index_js_1.computeMaterialPlanDigest)(plan) !== plan.materialDigest) {
-        throw new Error(`Local deployment plan for ${project} is not the exact current deployment authority.`);
-    }
-    if (plan.sourceCommit !== deploymentSourceCommit) {
-        try {
-            (0, source_authority_js_1.validateReviewedReleaseCheckout)({
-                deploymentSourceCommit,
-                releaseSourceCommit: plan.sourceCommit,
-                repositoryRoot: context.root,
-                reviewedSourceCommit: deploymentSourceCommit,
-            });
-        }
-        catch {
-            throw new Error(`Local deployment plan for ${project} is not bound through one exact approval-only source transition.`);
-        }
+        throw new Error(`Native SST outputs for ${project.name} contain invalid smoke URLs.`);
     }
-    return plan;
+    const credentialFreeHttps = (url) => url.protocol === 'https:' &&
+        !url.username &&
+        !url.password &&
+        !url.search &&
+        !url.hash;
+    if (value.name !== project.name ||
+        value.stage !== stage ||
+        !credentialFreeHttps(api) ||
+        !credentialFreeHttps(web) ||
+        api.pathname !== '/' ||
+        web.pathname.replace(/\/$/u, '') !== `/${project.name}` ||
+        !/^[a-z0-9]{1,128}$/u.test(String(value.authClientId ?? '')) ||
+        !/^[A-Za-z0-9_-]{1,128}_[A-Za-z0-9]{1,128}$/u.test(String(value.authUserPoolId ?? ''))) {
+        throw new Error(`Native SST outputs for ${project.name} do not match the deployed stage and smoke target.`);
+    }
+    return {
+        apiUrl: api.href,
+        clientId: String(value.authClientId),
+        userPoolId: String(value.authUserPoolId),
+        webUrl: web.href,
+    };
 }
-function hasExactPendingLocalAuthorizationRefusal(context, project, plan) {
-    const path = projectEvidencePath(context, project, 'infrastructure-plan-authorization.json');
-    try {
-        const before = (0, node_fs_1.lstatSync)(path, { bigint: true });
-        if (!before.isFile() ||
-            before.nlink !== 1n ||
-            before.size > BigInt(MAX_PLAN_BYTES)) {
-            return false;
-        }
-        const bytes = (0, node_fs_1.readFileSync)(path);
-        const after = (0, node_fs_1.lstatSync)(path, { bigint: true });
-        if (before.dev !== after.dev ||
-            before.ino !== after.ino ||
-            before.mode !== after.mode ||
-            before.nlink !== after.nlink ||
-            before.size !== after.size ||
-            before.mtimeNs !== after.mtimeNs ||
-            before.ctimeNs !== after.ctimeNs ||
-            BigInt(bytes.byteLength) !== after.size) {
-            return false;
-        }
-        const authorization = record(JSON.parse(bytes.toString('utf8')), `${project} authorization`);
-        return (authorization.kind === 'ebk-infrastructure-authorization' &&
-            authorization.schemaVersion === index_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION &&
-            authorization.action === 'deploy' &&
-            authorization.approval === undefined &&
-            authorization.localGovernance === undefined &&
-            authorization.governanceEvidenceDigests === undefined &&
-            authorization.plannedMaterialDigest === plan.materialDigest &&
-            authorization.recomputedMaterialDigest === plan.materialDigest &&
-            Array.isArray(authorization.sourceChangesSincePlan) &&
-            authorization.sourceChangesSincePlan.length === 0 &&
-            authorization.validation.allowed === false &&
-            authorization.validation.outcome === 'plan-risk-blocked' &&
-            authorization.validation.findings.length === 1 &&
-            authorization.validation.findings[0]?.code === 'approval-missing');
+/** Determine the one native deployment order. Foundation is always first and
+ * production Slice admission remains a committed policy decision. */
+function localDeploymentProjectOrder(policy, context, stage) {
+    if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
+        throw new Error(`Deployment stage ${stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
     }
-    catch {
-        return false;
+    const projects = projectDescriptors(context);
+    const foundations = projects.filter((project) => project.tags.includes('scope:foundation') &&
+        supportsTarget(project, 'deploy'));
+    if (foundations.length !== 1) {
+        throw new Error(`Local deployment requires exactly one deployable Foundation; found ${foundations.length}.`);
     }
-}
-/** @internal */
-function localPlanSummaryDigest(input) {
-    const action = input.action ?? 'deploy';
-    if ((action !== 'deploy' && action !== 'refresh') ||
-        !/^\d{12}$/.test(input.account) ||
-        !SHA.test(input.sourceCommit) ||
-        !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(input.region) ||
-        input.orderedProjects.length === 0 ||
-        new Set(input.orderedProjects).size !== input.orderedProjects.length ||
-        Object.keys(input.plans).length !== input.orderedProjects.length) {
-        throw new Error('Local deployment plan summary input is invalid.');
-    }
-    const plans = input.orderedProjects.map((project) => {
-        const plan = input.plans[project];
-        if (!plan ||
-            plan.action !== action ||
-            plan.projects.length !== 1 ||
-            plan.projects[0] !== project ||
-            !SHA256.test(plan.materialDigest)) {
-            throw new Error(`Local deployment plan summary omitted exact project ${project}.`);
+    const slices = projects
+        .filter((project) => project.tags.includes('type:slice') &&
+        supportsTarget(project, 'deploy'))
+        .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+    if (stage === 'production') {
+        const missing = slices
+            .filter(({ name }) => policy.slices[name] === undefined)
+            .map(({ name }) => name);
+        if (missing.length > 0) {
+            throw new Error(`Registered Product Slices lack an explicit production policy: ${missing.join(', ')}.`);
         }
-        return { materialDigest: plan.materialDigest, project };
+    }
+    const selectedSlices = stage === 'production'
+        ? slices.filter(({ name }) => {
+            const status = policy.slices[name]?.productionStatus;
+            return status === 'pilot' || status === 'ready';
+        })
+        : slices;
+    const selected = [
+        { kind: 'foundation', name: foundations[0]?.name ?? '' },
+        ...selectedSlices.map(({ name }) => ({ kind: 'slice', name })),
+    ];
+    const decision = (0, index_js_2.evaluateRepositoryPolicyRequest)(policy, {
+        action: 'deploy',
+        projects: selected,
+        stage,
     });
-    return digest(JSON.stringify({
-        accountFingerprint: digest(input.account),
-        action,
-        orderedProjects: [...input.orderedProjects],
-        phase: input.phase,
-        plans,
-        region: input.region,
-        sourceCommit: input.sourceCommit,
-        stage: input.stage,
-    }));
-}
-function retainEvidence(root, evidence) {
-    const directory = (0, node_path_1.join)(root, '.ebk', 'evidence', 'local-deployment');
-    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
-    (0, node_fs_1.chmodSync)(directory, 0o700);
-    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(directory, 'latest.json'), `${JSON.stringify(evidence, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    if (!decision.allowed) {
+        throw new Error(`Repository Operating Policy rejected local deployment:\n${decision.reasons.map((reason) => `- ${reason}`).join('\n')}`);
+    }
+    return selected.map(({ name }) => name);
 }
-const REFRESH_FRAMEWORK_TAG_OBSERVATION_PATHS = new Map([
-    ['/inputs/tagsAll/ebk:framework-version', true],
-    ['/outputs/tags/ebk:framework-version', false],
-    ['/outputs/tagsAll/ebk:framework-version', false],
-]);
-function isFrameworkTagProviderObservation(resource) {
-    if (resource.operation !== 'update' ||
-        resource.replacement ||
-        resource.resourceType !== 'aws:ssm/parameter:Parameter' ||
-        resource.changedProperties.length !==
-            REFRESH_FRAMEWORK_TAG_OBSERVATION_PATHS.size) {
-        return false;
-    }
-    const observed = new Set();
-    for (const property of resource.changedProperties) {
-        const expectedInputDiff = REFRESH_FRAMEWORK_TAG_OBSERVATION_PATHS.get(property.path);
-        if (expectedInputDiff === undefined ||
-            property.inputDiff !== expectedInputDiff ||
-            property.kind !== 'update' ||
-            property.sensitive ||
-            observed.has(property.path)) {
-            return false;
+function frameworkVersion(root) {
+    const candidates = [
+        (0, node_path_1.join)(root, 'node_modules', '@empire-builder-kit', 'nx', 'package.json'),
+        (0, node_path_1.join)(root, 'package.json'),
+    ];
+    for (const path of candidates) {
+        try {
+            const value = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+            if (value.name === '@empire-builder-kit/nx' && value.version) {
+                return value.version;
+            }
+            const dependency = value.devDependencies?.['@empire-builder-kit/nx'] ??
+                value.dependencies?.['@empire-builder-kit/nx'];
+            if (dependency)
+                return dependency;
+        }
+        catch {
+            // Try the next deterministic package identity.
         }
-        observed.add(property.path);
     }
-    return observed.size === REFRESH_FRAMEWORK_TAG_OBSERVATION_PATHS.size;
+    return 'unknown';
 }
-function isSemanticallyConvergedRefresh(plan) {
-    if (plan.action !== 'refresh' ||
-        plan.state.locked ||
-        !plan.diff.complete ||
-        plan.diff.failures.length > 0) {
-        return false;
-    }
-    if (plan.diff.resources.length === 0) {
-        return plan.driftStatus === 'no-drift';
-    }
-    if (plan.driftStatus !== 'drift-detected' ||
-        !plan.diff.resources.every(isFrameworkTagProviderObservation) ||
-        plan.requiredApprovals.some((approval) => ![
-            'deployment-review',
-            'drift-decision-and-state-recovery',
-            'point-of-no-return',
-        ].includes(approval))) {
-        return false;
-    }
-    const observedResourceIds = new Set(plan.diff.resources.map(({ logicalId }) => logicalId));
-    return plan.resourceFindings.every((finding) => (finding.resourceId === undefined &&
-        finding.class === 'stateful-or-destructive' &&
-        finding.code === 'protected-state-refresh' &&
-        finding.disposition === 'block') ||
-        (finding.resourceId !== undefined &&
-            observedResourceIds.has(finding.resourceId) &&
-            finding.class === 'in-place-reviewed' &&
-            finding.code === 'in-place-update' &&
-            finding.disposition === 'review'));
+function prepareReceiptDestination(root) {
+    const directory = (0, node_path_1.join)(root, '.ebk', 'evidence', 'deployment');
+    ensurePrivateEvidenceDirectory(root, directory);
+    const path = (0, node_path_1.join)(directory, 'latest.json');
+    if ((0, node_fs_1.existsSync)(path))
+        (0, private_state_js_1.assertPrivatePath)(path, 'file');
+    return path;
 }
-function isSemanticallyConvergedDeploy(plan) {
-    if (plan.action !== 'deploy' ||
-        plan.state.locked !== false ||
-        !plan.diff.complete ||
-        plan.diff.failures.length > 0) {
-        return false;
-    }
-    if (plan.diff.resources.length === 0) {
-        return (plan.aggregateRisk === 'no-change' &&
-            plan.driftStatus === 'no-drift' &&
-            plan.requiredApprovals.length === 0 &&
-            plan.resourceFindings.length === 0);
-    }
-    if (plan.aggregateRisk !== 'in-place-reviewed' ||
-        (plan.driftStatus !== 'no-drift' &&
-            plan.driftStatus !== 'drift-detected') ||
-        plan.requiredApprovals.length !== 1 ||
-        plan.requiredApprovals[0] !== 'deployment-review') {
-        return false;
-    }
-    const providerReads = new Map();
-    for (const resource of plan.diff.resources) {
-        const retainedResourceType = providerReads.get(resource.logicalId);
-        if (resource.operation !== 'read' ||
-            resource.providerOperation !== 'read' ||
-            resource.replacement ||
-            resource.changedProperties.length > 0 ||
-            (retainedResourceType !== undefined &&
-                retainedResourceType !== resource.resourceType)) {
-            return false;
-        }
-        providerReads.set(resource.logicalId, resource.resourceType);
-    }
-    if (plan.resourceFindings.length !== providerReads.size) {
-        return false;
-    }
-    const providerReadFindings = new Set();
-    for (const finding of plan.resourceFindings) {
-        if (finding.resourceId === undefined ||
-            !providerReads.has(finding.resourceId) ||
-            finding.class !== 'in-place-reviewed' ||
-            finding.code !== 'provider-read' ||
-            finding.disposition !== 'review' ||
-            providerReadFindings.has(finding.resourceId)) {
-            return false;
-        }
-        providerReadFindings.add(finding.resourceId);
+function writeReceipt(root, receipt) {
+    (0, private_state_js_1.atomicWritePrivateFile)(prepareReceiptDestination(root), `${JSON.stringify(receipt, null, 2)}\n`);
+}
+function invalidatePriorReceipt(root) {
+    const path = prepareReceiptDestination(root);
+    if (!(0, node_fs_1.existsSync)(path))
+        return;
+    (0, private_state_js_1.assertPrivatePath)(path, 'file');
+    (0, node_fs_1.rmSync)(path, { force: true });
+    if ((0, node_fs_1.existsSync)(path)) {
+        throw new Error('Prior deployment receipt invalidation failed.');
     }
-    return providerReadFindings.size === providerReads.size;
 }
-function isFreshInvocationPlan(plan, invocationStartedAt, observedAt) {
-    const started = Date.parse(invocationStartedAt);
-    const generated = Date.parse(plan.generatedAt);
-    const observed = observedAt.getTime();
-    const expires = Date.parse(plan.expiresAt);
-    return (Number.isFinite(started) &&
-        Number.isFinite(generated) &&
-        Number.isFinite(observed) &&
-        Number.isFinite(expires) &&
-        generated >= started &&
-        generated <= observed &&
-        expires > observed);
+async function runNxTarget(input) {
+    const forwarded = [
+        `--stage=${input.stage}`,
+        `--expectedRoleArn=${input.expectedRoleArn}`,
+        `--region=${input.region}`,
+        ...(input.profile ? [`--profile=${input.profile}`] : []),
+    ];
+    const args = [
+        (0, node_path_1.join)(input.context.root, 'node_modules', 'nx', 'dist', 'bin', 'nx.js'),
+        'run',
+        `${input.project}:${input.target}`,
+        '--',
+        ...forwarded,
+    ];
+    const result = input.runSync
+        ? input.runSync(process.execPath, args, {
+            cwd: input.context.root,
+            env: input.environment,
+            shell: false,
+            stdio: 'inherit',
+        })
+        : await (0, run_sst_command_js_1.runGovernedChildProcess)({
+            args,
+            cwd: input.context.root,
+            environment: input.environment,
+            executable: process.execPath,
+            ...(input.spawnChild ? { spawnChild: input.spawnChild } : {}),
+        });
+    if (result.error || result.signal || result.status !== 0) {
+        throw new Error(result.error
+            ? `${input.target} failed for ${input.project}: ${result.error.message}`
+            : result.signal
+                ? `${input.target} failed for ${input.project} with signal ${result.signal}.`
+                : `${input.target} failed for ${input.project} with status ${result.status ?? 'unknown'}.`);
+    }
+}
+function productionConfirmation(account, region, commit) {
+    return `deploy:production:${account}:${region}:${commit}`;
+}
+async function defaultIdentifyGithubCaller(region) {
+    return new client_sts_1.STSClient({
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(region),
+        region,
+    }).send(new client_sts_1.GetCallerIdentityCommand({}));
+}
+function assertGithubDeploymentAuthority(input) {
+    const repository = process.env.GITHUB_REPOSITORY?.trim() ?? '';
+    const ref = process.env.GITHUB_REF?.trim() ?? '';
+    const eventName = process.env.GITHUB_EVENT_NAME?.trim() ?? '';
+    const callerWorkflow = process.env.GITHUB_WORKFLOW_REF?.trim() ?? '';
+    const calledWorkflow = process.env.EBK_GITHUB_JOB_WORKFLOW_REF?.trim() ?? '';
+    const expectedBranch = input.stage === 'production' ? 'main' : 'develop';
+    const expectedRef = `refs/heads/${expectedBranch}`;
+    const expectedCalledWorkflow = `${repository}/.github/workflows/deploy.yml@${expectedRef}`;
+    const expectedCallerWorkflow = eventName === 'push'
+        ? `${repository}/.github/workflows/ci.yml@${expectedRef}`
+        : eventName === 'workflow_dispatch'
+            ? expectedCalledWorkflow
+            : undefined;
+    const allowedEvent = eventName === 'workflow_dispatch' ||
+        (eventName === 'push' && input.policy.deploymentProfile !== 'starter');
+    if (process.env.GITHUB_ACTIONS !== 'true' ||
+        !repository ||
+        !allowedEvent ||
+        process.env.GITHUB_SHA !== input.commit ||
+        ref !== expectedRef ||
+        callerWorkflow !== expectedCallerWorkflow ||
+        calledWorkflow !== expectedCalledWorkflow) {
+        throw new Error('Protected deployment requires the exact generated GitHub caller and reusable deploy workflows, branch, and immutable source commit.');
+    }
+    if (input.policy.deploymentProfile === 'starter' &&
+        input.stage === 'staging') {
+        throw new Error('The starter deployment profile has no staging stage.');
+    }
+    const clean = git(input.root, ['status', '--porcelain=v1', '--untracked-files=all'], input.run);
+    if (clean !== '') {
+        throw new Error('Protected GitHub deployment requires a clean checkout.');
+    }
 }
 async function runLocalDeploy(options, context, dependencies = {}) {
     const run = dependencies.run ?? node_child_process_1.spawnSync;
-    if (process.env.GITHUB_ACTIONS === 'true') {
-        throw new Error('Local deployment is not a GitHub Actions authority mode.');
-    }
-    const policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
-    const action = options.action ?? 'deploy';
-    if (action !== 'deploy' && action !== 'refresh') {
-        throw new Error('Local infrastructure action is invalid.');
-    }
-    const phase = options.phase ?? 'full-stage';
-    if (phase !== 'foundation-bootstrap' && phase !== 'full-stage') {
-        throw new Error('Local deployment phase is invalid.');
-    }
-    if ((0, index_js_2.requiresGithubDeployment)(policy.deploymentProfile, options.stage)) {
-        throw new Error(`The ${policy.deploymentProfile} deployment profile requires GitHub deployment authority for ${options.stage}.`);
-    }
-    const accounts = (0, index_js_2.configuredDeploymentAccountTopology)(policy.deploymentProfile, policy.deploymentAccounts);
-    const region = (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion);
-    const expectedAccount = accounts[options.stage];
-    if (!ROLE.test(options.expectedRoleArn)) {
-        throw new Error('Local deployment requires one exact expected IAM role ARN.');
-    }
-    const status = git(context.root, ['status', '--porcelain=v1', '--untracked-files=all'], run);
-    if (status !== '') {
-        throw new Error('Local deployment requires a completely clean source tree.');
-    }
-    const sourceCommit = git(context.root, ['rev-parse', 'HEAD'], run);
-    const sourceTree = git(context.root, ['rev-parse', 'HEAD^{tree}'], run);
-    if (!SHA.test(sourceCommit) || !SHA.test(sourceTree)) {
-        throw new Error('Local deployment could not bind one immutable Git source.');
-    }
-    const expectedConfirmation = (0, infrastructure_plan_js_1.localProductionConfirmation)({
-        action,
-        accountId: expectedAccount,
-        region,
-        sourceCommit,
-    });
-    if (options.stage === 'production' &&
-        options.confirmation !== expectedConfirmation) {
-        throw new Error(`Local production ${action} requires --confirmation=${expectedConfirmation}.`);
-    }
-    const caller = await (dependencies.caller ??
-        (async (targetRegion) => new client_sts_1.STSClient({
-            region: targetRegion,
-            ...(options.profile
-                ? { credentials: (0, credential_providers_1.fromIni)({ profile: options.profile }) }
-                : {}),
-        }).send(new client_sts_1.GetCallerIdentityCommand({}))))(region);
-    const account = caller.Account?.trim() ?? '';
-    const arn = caller.Arn?.trim() ?? '';
-    if (account !== expectedAccount ||
-        !(0, infrastructure_plan_js_1.matchesExpectedAssumedRoleArn)(expectedAccount, arn, options.expectedRoleArn)) {
-        throw new Error('Local AWS caller does not match the committed account and exact temporary assumed role.');
-    }
-    const orderedProjects = projectInventory(context, options.stage, phase, action);
-    const sourceSnapshots = toolOwnedSourceSnapshots(context, orderedProjects);
-    const startedAt = (dependencies.now ?? (() => new Date()))().toISOString();
-    let backend;
-    let result = 'failed';
-    let planDigests = {};
-    let planSummaryDigest = null;
-    let deployNoOpProjects = [];
-    const mutatedProjects = [];
-    let operatorAcknowledgementDigest = null;
-    let replanRequiredProject = null;
-    let refreshNoOpProjects = [];
-    try {
-        backend = await (dependencies.backend ?? prepareLocalSstBackend)({
-            account: expectedAccount,
-            applications: orderedProjects,
-            ...(options.profile ? { profile: options.profile } : {}),
+    const now = dependencies.now ?? (() => new Date());
+    const startedAt = now().toISOString();
+    const children = [];
+    const migrations = {};
+    const smoke = {};
+    let account = '';
+    let actor = '';
+    let policy;
+    let region = '';
+    let source = { clean: false, commit: '', workingTreeDigest: '' };
+    let transport;
+    let productionDatabaseBefore;
+    let productionDatabaseAfterFoundation;
+    let outcome = 'failed';
+    let receiptDestinationPrepared = false;
+    const githubAuthority = process.env.GITHUB_ACTIONS === 'true';
+    const retain = () => {
+        if (!policy || !receiptDestinationPrepared)
+            return;
+        writeReceipt(context.root, {
+            account,
+            actor,
+            authority: githubAuthority ? 'github' : 'local',
+            children,
+            completedAt: now().toISOString(),
+            frameworkVersion: frameworkVersion(context.root),
+            kind: 'ebk-deployment-receipt',
+            migrations,
+            outcome,
+            profile: policy.deploymentProfile,
             region,
+            schemaVersion: 1,
+            smoke,
+            source,
             stage: options.stage,
+            startedAt,
         });
-        const environment = {
-            ...process.env,
-            AWS_EXPECTED_ACCOUNT_ID: expectedAccount,
-            AWS_PLAN_ROLE_ARN: options.expectedRoleArn,
-            AWS_PLAN_SST_APPS_JSON: JSON.stringify(orderedProjects),
-            AWS_PLAN_STATE_BUCKET_ARN: backend.stateBucketArn,
-            ...(options.profile ? { AWS_PROFILE: options.profile } : {}),
-            AWS_REGION: region,
-            // Local deployment's reviewed clean Git commit is the one stage-wide
-            // workload-role candidate shared by Foundation and every Slice. Never
-            // accept an ambient candidate identity from the caller.
-            EBK_ACTION: action,
-            EBK_CANDIDATE_IDENTITY: sourceCommit,
-            EBK_LOCAL_DEPLOYMENT_MODE: 'federated',
-            EBK_LOCAL_SOURCE_TREE: sourceTree,
-            EBK_SOURCE_COMMIT: sourceCommit,
-            EBK_STAGE: options.stage,
-            ORDERED_PROJECTS: orderedProjects.join(','),
-        };
-        for (const key of PROTECTED_PLAN_KEYS)
-            delete environment[key];
-        if (options.profile) {
-            for (const key of AMBIENT_CREDENTIAL_KEYS)
-                delete environment[key];
+    };
+    try {
+        invalidatePriorReceipt(context.root);
+        receiptDestinationPrepared = true;
+        (0, run_sst_command_js_1.assertGovernedAwsLifecyclePlatform)(dependencies.platform);
+        policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
+        if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, options.stage)) {
+            throw new Error(`Deployment stage ${options.stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
         }
-        const common = [
-            `--stage=${options.stage}`,
-            `--expectedRoleArn=${options.expectedRoleArn}`,
-            `--region=${region}`,
-            ...(options.profile ? [`--profile=${options.profile}`] : []),
-        ];
-        for (const project of orderedProjects) {
-            runNxWithToolOwnedSourceReconciliation(context, project, 'infrastructure-plan', [`--action=${action}`, ...common], environment, sourceSnapshots, run, action === 'deploy'
-                ? () => {
-                    const plan = retainedPlan(context, project, sourceCommit, expectedAccount, region, options.stage, action);
-                    const accepted = isFreshInvocationPlan(plan, startedAt, (dependencies.now ?? (() => new Date()))()) &&
-                        isSemanticallyConvergedDeploy(plan) &&
-                        hasExactPendingLocalAuthorizationRefusal(context, project, plan);
-                    if (accepted) {
-                        devkit_1.logger.info(`Local infrastructure-plan for ${project} returned a conservative non-success after emitting one fresh provider-read-only semantic convergence record.`);
-                    }
-                    return accepted;
-                }
-                : undefined);
+        if (!githubAuthority &&
+            (0, index_js_2.requiresGithubDeployment)(policy.deploymentProfile, options.stage)) {
+            throw new Error(`The ${policy.deploymentProfile} profile requires GitHub deployment authority for ${options.stage}.`);
+        }
+        if (!ROLE.test(options.expectedRoleArn)) {
+            throw new Error('Local deployment requires one exact IAM role ARN.');
         }
-        const plans = Object.fromEntries(orderedProjects.map((project) => [
-            project,
-            retainedPlan(context, project, sourceCommit, expectedAccount, region, options.stage, action),
-        ]));
-        planDigests = Object.fromEntries(orderedProjects.map((project) => [
-            project,
-            plans[project].materialDigest,
-        ]));
-        planSummaryDigest = localPlanSummaryDigest({
-            account: expectedAccount,
-            action,
-            orderedProjects,
-            phase,
-            plans,
+        region = (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion);
+        account = (0, index_js_2.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, options.stage);
+        const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+            accountId: account,
+            partition: partitionForRegion(region),
             region,
-            sourceCommit,
             stage: options.stage,
-        });
-        const approvalEnvironment = {
-            ...environment,
-            EBK_LOCAL_PLAN_APPROVER_ARN: arn,
-            EBK_LOCAL_PLAN_SUMMARY_DIGEST: planSummaryDigest,
+        }).deploymentRoleArn;
+        if (options.expectedRoleArn !== expectedRoleArn) {
+            throw new Error(`Deployment role must equal the committed ${options.stage} stage authority role ${expectedRoleArn}.`);
+        }
+        const identity = localWorkingTreeDigest(context.root, run);
+        source = {
+            clean: identity.clean,
+            commit: identity.commit,
+            workingTreeDigest: identity.digest,
         };
-        const planEnvironment = (project) => plans[project].requiredApprovals.length > 0
-            ? {
-                ...approvalEnvironment,
-                EBK_LOCAL_PLAN_MATERIAL_DIGEST: plans[project].materialDigest,
+        if ((githubAuthority || options.stage !== 'development') && !source.clean) {
+            throw new Error(`Local ${options.stage} deployment requires a completely clean source tree.`);
+        }
+        if (githubAuthority) {
+            if (options.profile) {
+                throw new Error('Protected GitHub deployment must use ambient OIDC credentials, not a local AWS profile.');
             }
-            : environment;
-        deployNoOpProjects =
-            action === 'deploy'
-                ? orderedProjects.filter((project) => isSemanticallyConvergedDeploy(plans[project]))
-                : [];
-        refreshNoOpProjects =
-            action === 'refresh'
-                ? orderedProjects.filter((project) => isSemanticallyConvergedRefresh(plans[project]))
-                : [];
-        const mutationNoOpProjectSet = new Set([
-            ...deployNoOpProjects,
-            ...refreshNoOpProjects,
-        ]);
-        const materialProjectIndex = orderedProjects.findIndex((project) => !mutationNoOpProjectSet.has(project));
-        if (materialProjectIndex >= 0) {
-            const project = orderedProjects[materialProjectIndex];
-            const plan = plans[project];
-            const challenge = `approve:${action}:${options.stage}:${project}:${plan.materialDigest}`;
-            devkit_1.logger.info(`[ebk-local-deployment-review]\n${JSON.stringify({
-                action,
-                challenge,
-                firstMaterialProject: project,
-                orderedProjects,
-                plan: {
-                    aggregateRisk: plan.aggregateRisk,
-                    diff: plan.diff,
-                    materialDigest: plan.materialDigest,
-                    requiredApprovals: plan.requiredApprovals,
-                    resourceFindings: plan.resourceFindings,
-                    stateDigest: plan.state.digest,
-                },
-                planSummaryDigest,
-                sourceCommit,
+            assertGithubDeploymentAuthority({
+                commit: source.commit,
+                policy,
+                root: context.root,
+                run,
                 stage: options.stage,
-            }, null, 2)}`);
+            });
+            const caller = await (dependencies.identifyGithubCaller ?? defaultIdentifyGithubCaller)(region);
+            if (caller.Account?.trim() !== account ||
+                !(0, identity_js_1.matchesExpectedAssumedRoleArn)(account, caller.Arn?.trim() ?? '', expectedRoleArn)) {
+                throw new Error('Protected GitHub deployment caller does not match the committed account and exact assumed role.');
+            }
+            actor = process.env.GITHUB_ACTOR?.trim() ?? '';
+            if (!actor) {
+                throw new Error('Protected GitHub deployment actor is absent.');
+            }
+        }
+        else if (options.stage === 'staging') {
+            const challenge = `approve:deploy:staging:${source.commit}`;
             let acknowledged = false;
             try {
                 acknowledged = await (dependencies.approve ?? (0, local_approval_js_1.createTtyLocalMutationApprover)())({
-                    action,
+                    action: 'deploy',
                     challenge,
-                    planDigest: plan.materialDigest,
-                    project,
+                    sourceCommit: source.commit,
                     stage: options.stage,
                 });
             }
             catch (error) {
                 if (error instanceof local_approval_js_1.LocalMutationApprovalUnavailableError) {
-                    result = 'review-required';
+                    outcome = 'review-required';
                 }
                 throw error;
             }
             if (!acknowledged) {
-                result = 'review-required';
-                throw new Error(`Local ${action} acknowledgement was declined for ${project}.`);
+                outcome = 'review-required';
+                throw new Error('Local staging deployment acknowledgement was declined.');
             }
-            operatorAcknowledgementDigest = digest(challenge);
-            const issuedAt = (dependencies.now ?? (() => new Date()))();
-            (0, infrastructure_plan_js_1.authorizeRetainedLocalInfrastructurePlan)({
-                context: { ...context, projectName: project },
-                environment: planEnvironment(project),
-                now: issuedAt,
-                plan,
-            });
-            if (retainedPlan(context, project, sourceCommit, expectedAccount, region, options.stage, action).materialDigest !== planDigests[project]) {
-                throw new Error(`Local deployment plan for ${project} changed before invocation-scoped authority was established.`);
+        }
+        if (!githubAuthority && options.stage === 'production') {
+            const expected = productionConfirmation(account, region, source.commit);
+            let acknowledged = false;
+            try {
+                acknowledged = await (dependencies.approve ?? (0, local_approval_js_1.createTtyLocalMutationApprover)())({
+                    action: 'deploy',
+                    challenge: expected,
+                    sourceCommit: source.commit,
+                    stage: options.stage,
+                });
             }
-            const capability = writeLocalMutationCapability({
-                actorArn: arn,
-                context,
-                deploymentProfile: policy.deploymentProfile,
-                deploymentSourceCommit: sourceCommit,
-                deploymentSourceTree: sourceTree,
-                expectedRoleArn: options.expectedRoleArn,
-                issuedAt,
-                plan,
+            catch (error) {
+                if (error instanceof local_approval_js_1.LocalMutationApprovalUnavailableError) {
+                    outcome = 'review-required';
+                }
+                throw error;
+            }
+            if (!acknowledged) {
+                outcome = 'review-required';
+                throw new Error('Local production deployment acknowledgement was declined.');
+            }
+        }
+        const orderedProjects = localDeploymentProjectOrder(policy, context, options.stage);
+        const descriptors = projectDescriptors(context);
+        const localProtectedContainerStage = !githubAuthority &&
+            requiresLocalContainerPreparation(policy.deploymentProfile, options.stage)
+            ? options.stage
+            : undefined;
+        const localProtectedContainerProjects = localProtectedContainerStage
+            ? orderedProjects
+                .map((project) => descriptors.find((candidate) => candidate.name === project))
+                .filter((project) => project?.tags.includes('type:slice') === true)
+            : [];
+        for (const project of localProtectedContainerProjects) {
+            const missingTargets = LOCAL_CONTAINER_TARGETS.filter((target) => !supportsTarget(project, target));
+            if (missingTargets.length > 0) {
+                throw new Error(`Local ${policy.deploymentProfile} ${options.stage} requires the complete immutable OCI target set for ${project.name}: ${missingTargets.join(', ')}.`);
+            }
+        }
+        if (!githubAuthority) {
+            transport = await (dependencies.createTransport ?? federated_credential_transport_js_1.createLocalFederatedCredentialTransport)({
+                account,
+                expectedRoleArn,
+                ...(options.profile ? { profile: options.profile } : {}),
+                region,
+            });
+            const firstIdentity = await transport.refresh();
+            actor = firstIdentity.actorArn;
+        }
+        const ownershipEnvironment = transport
+            ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+            : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                preserveVerifiedGithubCredentials: true,
+            });
+        await (dependencies.ownership ?? index_js_3.assertWorkspaceStageOwnershipForWorkspace)(context.root, options.stage, {
+            ...(ownershipEnvironment.AWS_CONFIG_FILE
+                ? { configFilepath: ownershipEnvironment.AWS_CONFIG_FILE }
+                : {}),
+            ...(ownershipEnvironment.AWS_SHARED_CREDENTIALS_FILE
+                ? {
+                    credentialsFilepath: ownershipEnvironment.AWS_SHARED_CREDENTIALS_FILE,
+                }
+                : {}),
+            ...(transport ? { profile: transport.profile } : {}),
+        });
+        if (options.stage === 'production') {
+            if (transport)
+                await transport.refresh();
+            const boundaryEnvironment = transport
+                ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                    preserveVerifiedGithubCredentials: true,
+                });
+            productionDatabaseBefore = await (dependencies.attestProductionDatabase ??
+                production_database_safeguard_js_1.attestProductionDatabaseLifecycle)({
+                ...(boundaryEnvironment.AWS_CONFIG_FILE
+                    ? { configFilepath: boundaryEnvironment.AWS_CONFIG_FILE }
+                    : {}),
+                ...(boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE
+                    ? {
+                        credentialsFilepath: boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE,
+                    }
+                    : {}),
+                expectedAccountId: account,
+                expectedRegion: region,
+                expectedRoleArn,
+                now: now(),
+                ...(transport ? { profile: transport.profile } : {}),
+                requireExisting: false,
+            });
+        }
+        const localContainerRunId = localProtectedContainerProjects.length === 0
+            ? ''
+            : ((0, node_crypto_1.randomBytes)(8).readBigUInt64BE() + 1n).toString();
+        for (const project of localProtectedContainerProjects) {
+            resetLocalContainerWorkingEvidence({
                 project,
-                releaseSourceTree: git(context.root, ['rev-parse', `${plan.sourceCommit}^{tree}`], run),
+                root: context.root,
+                stage: localProtectedContainerStage,
             });
+            for (const target of LOCAL_CONTAINER_TARGETS) {
+                if (transport)
+                    await transport.refresh();
+                const environment = {
+                    ...(transport
+                        ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                        : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env)),
+                    AWS_EXPECTED_ACCOUNT_ID: account,
+                    AWS_REGION: region,
+                    EBK_LOCAL_CONTAINER_RUN_ID: localContainerRunId,
+                    EBK_LOCAL_DEPLOYMENT_MODE: 'federated',
+                    EBK_DEPLOYMENT_PROFILE: policy.deploymentProfile,
+                    EBK_NX_STAGE_LIFECYCLE: 'local',
+                    EBK_RELEASE_SOURCE_COMMIT: source.commit,
+                    EBK_SOURCE_COMMIT: source.commit,
+                    EBK_STAGE: options.stage,
+                    EBK_WORKING_TREE_DIRTY: 'false',
+                };
+                assertDeploymentSourceUnchanged(context.root, source, run);
+                const childStartedAt = now().toISOString();
+                try {
+                    await runNxTarget({
+                        context,
+                        environment,
+                        expectedRoleArn,
+                        ...(transport ? { profile: transport.profile } : {}),
+                        project: project.name,
+                        region,
+                        ...(dependencies.run ? { runSync: dependencies.run } : {}),
+                        ...(dependencies.spawnChild
+                            ? { spawnChild: dependencies.spawnChild }
+                            : {}),
+                        stage: options.stage,
+                        target,
+                    });
+                    if (target === 'release-candidate') {
+                        materializeLocalReleaseCandidate({
+                            project,
+                            root: context.root,
+                            sourceCommit: source.commit,
+                        });
+                    }
+                    if (target === 'container-release-assemble') {
+                        (dependencies.attestContainerBinding ?? attestLocalContainerBinding)({
+                            account,
+                            project,
+                            region,
+                            root: context.root,
+                            sourceCommit: source.commit,
+                            stage: options.stage,
+                        });
+                    }
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'succeeded',
+                        project: project.name,
+                        startedAt: childStartedAt,
+                        target,
+                    });
+                }
+                catch (error) {
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'failed',
+                        project: project.name,
+                        startedAt: childStartedAt,
+                        target,
+                    });
+                    throw error;
+                }
+            }
+        }
+        for (const project of orderedProjects) {
+            const descriptor = descriptors.find((candidate) => candidate.name === project);
+            if (!descriptor) {
+                throw new Error(`Local deployment project ${project} disappeared.`);
+            }
+            if (transport)
+                await transport.refresh();
+            const environment = {
+                ...(transport
+                    ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                    : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                        preserveVerifiedGithubCredentials: true,
+                    })),
+                AWS_EXPECTED_ACCOUNT_ID: account,
+                AWS_REGION: region,
+                EBK_LOCAL_SOURCE_TREE: source.workingTreeDigest,
+                EBK_NX_STAGE_LIFECYCLE: githubAuthority ? 'github' : 'local',
+                EBK_SOURCE_COMMIT: source.commit,
+                EBK_WORKING_TREE_DIRTY: source.clean ? 'false' : 'true',
+            };
+            assertDeploymentSourceUnchanged(context.root, source, run);
+            const childStartedAt = now().toISOString();
             try {
-                runNxWithToolOwnedSourceReconciliation(context, project, action, [
-                    ...common,
-                    ...(options.stage === 'production'
-                        ? [`--localProductionConfirmation=${expectedConfirmation}`]
-                        : []),
-                ], {
-                    ...environment,
-                    EBK_LOCAL_MUTATION_CAPABILITY_NONCE: capability.nonce,
-                    EBK_LOCAL_MUTATION_CAPABILITY_PATH: capability.path,
-                }, sourceSnapshots, run);
+                await runNxTarget({
+                    context,
+                    environment,
+                    expectedRoleArn,
+                    ...(transport ? { profile: transport.profile } : {}),
+                    project,
+                    region,
+                    ...(dependencies.run ? { runSync: dependencies.run } : {}),
+                    ...(dependencies.spawnChild
+                        ? { spawnChild: dependencies.spawnChild }
+                        : {}),
+                    stage: options.stage,
+                    target: 'deploy',
+                });
+                children.push({
+                    completedAt: now().toISOString(),
+                    outcome: 'succeeded',
+                    project,
+                    startedAt: childStartedAt,
+                    target: 'deploy',
+                });
+            }
+            catch (error) {
+                children.push({
+                    completedAt: now().toISOString(),
+                    outcome: 'failed',
+                    project,
+                    startedAt: childStartedAt,
+                    target: 'deploy',
+                });
+                throw error;
             }
-            finally {
-                (0, node_fs_1.rmSync)(capability.directory, { force: true, recursive: true });
+            if (options.stage === 'production' &&
+                descriptor.tags.includes('scope:foundation')) {
+                if (transport)
+                    await transport.refresh();
+                const boundaryEnvironment = transport
+                    ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                    : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                        preserveVerifiedGithubCredentials: true,
+                    });
+                const postflightStartedAt = now().toISOString();
+                const profile = (0, index_js_2.productionFoundationProfileContract)(policy.productionFoundation.profile).contract;
+                try {
+                    productionDatabaseAfterFoundation = await (dependencies.attestProductionDatabase ??
+                        production_database_safeguard_js_1.attestProductionDatabaseLifecycle)({
+                        ...(boundaryEnvironment.AWS_CONFIG_FILE
+                            ? { configFilepath: boundaryEnvironment.AWS_CONFIG_FILE }
+                            : {}),
+                        ...(boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE
+                            ? {
+                                credentialsFilepath: boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE,
+                            }
+                            : {}),
+                        expectedAccountId: account,
+                        expectedCapacity: {
+                            max: Number.parseFloat(profile.aurora.max),
+                            min: Number.parseFloat(profile.aurora.min),
+                        },
+                        expectedRegion: region,
+                        expectedRoleArn,
+                        now: now(),
+                        priorDiscovery: productionDatabaseBefore,
+                        ...(transport ? { profile: transport.profile } : {}),
+                        requireExisting: true,
+                    });
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'succeeded',
+                        project,
+                        startedAt: postflightStartedAt,
+                        target: 'production-database-postflight',
+                    });
+                }
+                catch (error) {
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'failed',
+                        project,
+                        startedAt: postflightStartedAt,
+                        target: 'production-database-postflight',
+                    });
+                    throw error;
+                }
+            }
+            migrations[project] = supportsTarget(descriptor, 'db-migrate')
+                ? 'completed-by-deploy-target'
+                : 'not-applicable';
+            if (supportsTarget(descriptor, 'smoke-deployed')) {
+                if (transport)
+                    await transport.refresh();
+                const smokeTarget = readDeployedSmokeTarget(context.root, descriptor, options.stage);
+                assertDeploymentSourceUnchanged(context.root, source, run);
+                const smokeStartedAt = now().toISOString();
+                try {
+                    await runNxTarget({
+                        context,
+                        environment: {
+                            ...(transport
+                                ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                                : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                                    preserveVerifiedGithubCredentials: true,
+                                })),
+                            AWS_EXPECTED_ACCOUNT_ID: account,
+                            AWS_REGION: region,
+                            EBK_NX_STAGE_LIFECYCLE: githubAuthority ? 'github' : 'local',
+                            EBK_SOURCE_COMMIT: source.commit,
+                            EBK_SMOKE_API_URL: smokeTarget.apiUrl,
+                            EBK_SMOKE_AUTHORITY_VERSION: 'cognito-admin-cloudwatch-observe-v1',
+                            EBK_SMOKE_CLIENT_ID: smokeTarget.clientId,
+                            EBK_SMOKE_URL: smokeTarget.webUrl,
+                            EBK_SMOKE_USER_POOL_ID: smokeTarget.userPoolId,
+                            EBK_STAGE: options.stage,
+                        },
+                        expectedRoleArn,
+                        ...(transport ? { profile: transport.profile } : {}),
+                        project,
+                        region,
+                        ...(dependencies.run ? { runSync: dependencies.run } : {}),
+                        ...(dependencies.spawnChild
+                            ? { spawnChild: dependencies.spawnChild }
+                            : {}),
+                        stage: options.stage,
+                        target: 'smoke-deployed',
+                    });
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'succeeded',
+                        project,
+                        startedAt: smokeStartedAt,
+                        target: 'smoke-deployed',
+                    });
+                    smoke[project] = 'passed';
+                }
+                catch (error) {
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'failed',
+                        project,
+                        startedAt: smokeStartedAt,
+                        target: 'smoke-deployed',
+                    });
+                    throw error;
+                }
             }
-            mutatedProjects.push(project);
-            result = 'replan-required';
-            replanRequiredProject = orderedProjects[materialProjectIndex + 1] ?? null;
-            throw new Error(replanRequiredProject
-                ? `Local deployment applied ${project} and requires a new complete-stage plan before ${replanRequiredProject}. Rerun and acknowledge the new current plan before any further mutation.`
-                : `Local deployment applied ${project} and requires a new complete-stage plan before accepting stage convergence. Rerun and require every current project to be a semantic no-op.`);
+            else {
+                smoke[project] = 'not-applicable';
+            }
+        }
+        if (options.stage === 'production') {
+            if (!productionDatabaseAfterFoundation) {
+                throw new Error('Production Foundation database postflight was not completed before final deployment acceptance.');
+            }
+            if (transport)
+                await transport.refresh();
+            const boundaryEnvironment = transport
+                ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                    preserveVerifiedGithubCredentials: true,
+                });
+            const finalPostflightStartedAt = now().toISOString();
+            const foundationProject = orderedProjects[0] ?? 'foundation';
+            const profile = (0, index_js_2.productionFoundationProfileContract)(policy.productionFoundation.profile).contract;
+            try {
+                await (dependencies.attestProductionDatabase ??
+                    production_database_safeguard_js_1.attestProductionDatabaseLifecycle)({
+                    ...(boundaryEnvironment.AWS_CONFIG_FILE
+                        ? { configFilepath: boundaryEnvironment.AWS_CONFIG_FILE }
+                        : {}),
+                    ...(boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE
+                        ? {
+                            credentialsFilepath: boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE,
+                        }
+                        : {}),
+                    expectedAccountId: account,
+                    expectedCapacity: {
+                        max: Number.parseFloat(profile.aurora.max),
+                        min: Number.parseFloat(profile.aurora.min),
+                    },
+                    expectedRegion: region,
+                    expectedRoleArn,
+                    now: now(),
+                    priorDiscovery: productionDatabaseAfterFoundation,
+                    ...(transport ? { profile: transport.profile } : {}),
+                    requireExisting: true,
+                });
+                children.push({
+                    completedAt: now().toISOString(),
+                    outcome: 'succeeded',
+                    project: foundationProject,
+                    startedAt: finalPostflightStartedAt,
+                    target: 'production-database-final-postflight',
+                });
+            }
+            catch (error) {
+                children.push({
+                    completedAt: now().toISOString(),
+                    outcome: 'failed',
+                    project: foundationProject,
+                    startedAt: finalPostflightStartedAt,
+                    target: 'production-database-final-postflight',
+                });
+                throw error;
+            }
+        }
+        assertDeploymentSourceUnchanged(context.root, source, run);
+        if (transport) {
+            transport.cleanup();
+            transport = undefined;
         }
-        result = 'succeeded';
+        outcome = 'succeeded';
+        retain();
+        devkit_1.logger.info(`${githubAuthority ? 'Protected GitHub' : 'Local'} ${options.stage} deployment completed through native SST for ${children.filter(({ target }) => target === 'deploy').length} project(s).`);
         return { success: true };
     }
-    finally {
-        retainEvidence(context.root, {
-            account: expectedAccount,
-            action,
-            actorArnDigest: digest(arn),
-            backendAuthorityDigest: backend?.authorityDigest ?? null,
-            backendCreatedApplications: backend
-                ? [...backend.createdApplications]
-                : [],
-            completedAt: (dependencies.now ?? (() => new Date()))().toISOString(),
-            deployNoOpProjects,
-            kind: 'ebk-local-deployment-evidence',
-            mutatedProjects,
-            orderedProjects,
-            operatorAcknowledgementDigest,
-            planDigests,
-            planSummaryDigest,
-            phase,
-            profile: policy.deploymentProfile,
-            replanRequiredProject,
-            refreshNoOpProjects,
-            region,
-            result,
-            schemaVersion: 1,
-            sourceCommit,
-            sourceDigest: digest(`${sourceCommit}:${sourceTree}`),
-            stage: options.stage,
-            startedAt,
-        });
-    }
-}
-const executor = async (options, context) => {
-    try {
-        return await runLocalDeploy(options, context);
-    }
     catch (error) {
         devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        if (transport) {
+            try {
+                transport.cleanup();
+                transport = undefined;
+            }
+            catch {
+                devkit_1.logger.error('Local federated credential transport cleanup failed; deployment acceptance is blocked.');
+            }
+        }
+        retain();
         return { success: false };
     }
-};
+}
+const executor = (options, context) => runLocalDeploy(options, context);
 exports.default = executor;
 //# sourceMappingURL=local-deploy.js.map