@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -0,0 +1,1500 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.THIN_DEPLOY_WORKFLOW_PATH = void 0;
+exports.renderThinDeployVerifyCaller = renderThinDeployVerifyCaller;
+exports.exactStageDeployerGuardScript = exactStageDeployerGuardScript;
+exports.canonicalStageAuthorityDerivationScript = canonicalStageAuthorityDerivationScript;
+exports.exactStagingPromotionPullGuardScript = exactStagingPromotionPullGuardScript;
+exports.stagingPromotionReceiptValidationScript = stagingPromotionReceiptValidationScript;
+exports.restoredCandidateValidationScript = restoredCandidateValidationScript;
+exports.stagingPromotionSealScript = stagingPromotionSealScript;
+exports.postdeploySupplyChainBindingScript = postdeploySupplyChainBindingScript;
+exports.renderThinDeployWorkflowFilePlan = renderThinDeployWorkflowFilePlan;
+exports.THIN_DEPLOY_WORKFLOW_PATH = '.github/workflows/deploy.yml';
+const EXACT_SEMVER = /^\d+\.\d+\.\d+$/;
+const WORKSPACE_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const ACTION_PIN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+@[a-f0-9]{40}(?: # [^\r\n]+)?$/;
+function assertOptions(options) {
+    if (!WORKSPACE_NAME.test(options.name)) {
+        throw new Error('Workspace name must be a bounded lowercase slug.');
+    }
+    for (const [name, value] of Object.entries(options.actionPins)) {
+        if (!ACTION_PIN.test(value)) {
+            throw new Error(`${name} must be an exact 40-character action pin.`);
+        }
+    }
+    for (const [name, value] of Object.entries(options.toolVersions)) {
+        if (!EXACT_SEMVER.test(value)) {
+            throw new Error(`${name} must be an exact semantic version.`);
+        }
+    }
+}
+function workflowCallTrigger(profile) {
+    return profile === 'starter'
+        ? ''
+        : `  workflow_call:
+    inputs:
+      source_branch:
+        required: true
+        type: string
+      source_commit:
+        required: true
+        type: string
+      source_ref:
+        required: true
+        type: string
+      verify_run_attempt:
+        required: true
+        type: string
+      verify_run_id:
+        required: true
+        type: string
+`;
+}
+function renderThinDeployVerifyCaller(profile) {
+    if (profile === 'starter')
+        return '';
+    const protectedBranchCondition = "(github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main')";
+    return `
+
+  deploy:
+    name: deploy exact verified source
+    needs: [acceptance, release-candidate]
+    if: >-
+      always() &&
+      github.event_name == 'push' &&
+      ${protectedBranchCondition} &&
+      needs.acceptance.result == 'success' &&
+      needs.acceptance.outputs.history_only != 'true' &&
+      needs.release-candidate.result == 'success'
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/deploy.yml
+    with:
+      source_branch: \${{ github.ref_name }}
+      source_commit: \${{ github.sha }}
+      source_ref: \${{ github.ref }}
+      verify_run_attempt: \${{ github.run_attempt }}
+      verify_run_id: \${{ github.run_id }}`;
+}
+function indentedScript(source, spaces) {
+    const prefix = ' '.repeat(spaces);
+    return source
+        .trim()
+        .split('\n')
+        .map((line) => `${prefix}${line}`)
+        .join('\n');
+}
+/** @internal Exported for executable source-contract tests. */
+function exactStageDeployerGuardScript(operation, accountVariable) {
+    return `read -r caller_account caller_arn <<< "$(aws sts get-caller-identity --query '[Account,Arn]' --output text)"
+[ "$caller_account" = "${accountVariable}" ] || {
+  echo '${operation} caller account differs from committed policy'; exit 1;
+}
+caller_partition="\${caller_arn#arn:}"
+caller_partition="\${caller_partition%%:*}"
+[ "$caller_partition" = "$AWS_PARTITION" ] || {
+  echo '${operation} caller partition differs from committed policy'; exit 1;
+}
+expected_role_arn="arn:$AWS_PARTITION:iam::${accountVariable}:role/ebk/$EBK_STAGE/deployment/ebk-$EBK_STAGE-deploy"
+[ "$AWS_DEPLOY_ROLE_ARN" = "$expected_role_arn" ] || {
+  echo '${operation} configured role is not the canonical stage deployer'; exit 1;
+}
+expected_caller_prefix="arn:$AWS_PARTITION:sts::${accountVariable}:assumed-role/ebk-$EBK_STAGE-deploy/"
+case "$caller_arn" in
+  "$expected_caller_prefix"?*) ;;
+  *) echo '${operation} caller is not the exact stage deployer'; exit 1 ;;
+esac`;
+}
+/** @internal Shared verbatim by every generated protected workflow. */
+function canonicalStageAuthorityDerivationScript() {
+    return `case "$EBK_STAGE" in
+  development) account_id="$EBK_DEVELOPMENT_ACCOUNT" ;;
+  staging) account_id="$EBK_STAGING_ACCOUNT" ;;
+  production) account_id="$EBK_PRODUCTION_ACCOUNT" ;;
+  *) exit 1 ;;
+esac
+case "$account_id" in *[!0-9]*|'') exit 1 ;; esac
+[ "\${#account_id}" -eq 12 ]
+case "$EBK_REGION" in
+  cn-*) partition=aws-cn; audience=sts.amazonaws.com.cn ;;
+  us-gov-*) partition=aws-us-gov; audience=sts.amazonaws.com ;;
+  us-iso-*|us-isob-*|eu-isoe-*|us-isof-*)
+    echo 'The committed Region belongs to an unsupported AWS partition.' >&2
+    exit 1
+    ;;
+  *) partition=aws; audience=sts.amazonaws.com ;;
+esac
+role_arn="arn:$partition:iam::$account_id:role/ebk/$EBK_STAGE/deployment/ebk-$EBK_STAGE-deploy"
+echo "account_id=$account_id" >> "$GITHUB_OUTPUT"
+echo "audience=$audience" >> "$GITHUB_OUTPUT"
+echo "partition=$partition" >> "$GITHUB_OUTPUT"
+echo "role_arn=$role_arn" >> "$GITHUB_OUTPUT"`;
+}
+/** @internal Exported for executable source-contract tests. */
+function exactStagingPromotionPullGuardScript() {
+    return `read -r caller_account caller_arn <<< "$(aws sts get-caller-identity --query '[Account,Arn]' --output text)"
+[ "$caller_account" = "$EBK_STAGING_ACCOUNT_ID" ] || {
+  echo 'Staging registry caller account differs from committed policy'; exit 1;
+}
+caller_partition="\${caller_arn#arn:}"
+caller_partition="\${caller_partition%%:*}"
+[ "$caller_partition" = "$AWS_PARTITION" ] || {
+  echo 'Staging registry caller partition differs from committed policy'; exit 1;
+}
+expected_role_arn="arn:$AWS_PARTITION:iam::$EBK_STAGING_ACCOUNT_ID:role/ebk/promotion/ebk-staging-promotion-pull"
+[ "$AWS_STAGING_PROMOTION_PULL_ROLE_ARN" = "$expected_role_arn" ] || {
+  echo 'Staging registry configured role is not the canonical promotion pull role'; exit 1;
+}
+expected_caller_prefix="arn:$AWS_PARTITION:sts::$EBK_STAGING_ACCOUNT_ID:assumed-role/ebk-staging-promotion-pull/"
+case "$caller_arn" in
+  "$expected_caller_prefix"?*) ;;
+  *) echo 'Staging registry caller is not the exact promotion pull role'; exit 1 ;;
+esac`;
+}
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+function stagingPromotionReceiptValidationScript() {
+    return `import { createHash } from 'node:crypto';
+import { appendFileSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const commit = /^[a-f0-9]{40,64}$/;
+const integer = /^[1-9][0-9]*$/;
+const digest = /^sha256:[a-f0-9]{64}$/;
+const required = (name, pattern) => {
+  const value = process.env[name]?.trim() ?? '';
+  if (!pattern.test(value)) throw new Error(name + ' is absent or malformed.');
+  return value;
+};
+const root = process.env.EBK_STAGING_RECEIPT_ROOT?.trim() ?? '';
+if (!root) throw new Error('Staging deployment receipt root is absent.');
+const expectedHasSlices = required('EBK_EXPECTED_HAS_SLICES', /^(?:true|false)$/) === 'true';
+const sourceCommit = required('EBK_STAGING_SOURCE_COMMIT', commit);
+const expectedAccount = required('EBK_EXPECTED_STAGING_ACCOUNT_ID', /^[0-9]{12}$/);
+const expectedProfile = required('EBK_EXPECTED_DEPLOYMENT_PROFILE', /^(?:production-isolated|fully-isolated)$/);
+const expectedRegion = required('EBK_EXPECTED_DEPLOYMENT_REGION', /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-[0-9]$/);
+const deploymentRunId = required('EBK_STAGING_DEPLOYMENT_RUN_ID', integer);
+const deploymentRunAttempt = required('EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT', integer);
+const receiptArtifactId = required('EBK_STAGING_RECEIPT_ARTIFACT_ID', integer);
+const receiptArtifactDigest = required('EBK_STAGING_RECEIPT_ARTIFACT_DIGEST', digest);
+const receiptBytes = readFileSync(join(root, 'latest.json'));
+const promotionBytes = readFileSync(join(root, 'promotion.json'));
+const receipt = JSON.parse(receiptBytes.toString('utf8'));
+const promotion = JSON.parse(promotionBytes.toString('utf8'));
+const receiptDigest = createHash('sha256').update(receiptBytes).digest('hex');
+if (
+  receipt?.kind !== 'ebk-deployment-receipt' ||
+  receipt.schemaVersion !== 1 ||
+  receipt.outcome !== 'succeeded' ||
+  receipt.authority !== 'github' ||
+  receipt.stage !== 'staging' ||
+  receipt.account !== expectedAccount ||
+  receipt.profile !== expectedProfile ||
+  receipt.region !== expectedRegion ||
+  receipt.source?.clean !== true ||
+  receipt.source?.commit !== sourceCommit ||
+  promotion?.kind !== 'ebk-staging-deployment-promotion' ||
+  promotion.schemaVersion !== 1 ||
+  promotion.hasSlices !== expectedHasSlices ||
+  promotion.stage !== 'staging' ||
+  promotion.account !== expectedAccount ||
+  promotion.deploymentProfile !== expectedProfile ||
+  promotion.region !== expectedRegion ||
+  promotion.sourceCommit !== sourceCommit ||
+  promotion.deployment?.runId !== deploymentRunId ||
+  promotion.deployment?.runAttempt !== deploymentRunAttempt ||
+  promotion.deployment?.receiptDigest !== receiptDigest ||
+  (expectedHasSlices
+    ? !integer.test(promotion.candidate?.artifactId ?? '') ||
+      !digest.test(promotion.candidate?.artifactDigest ?? '') ||
+      !integer.test(promotion.candidate?.producerRunId ?? '') ||
+      !integer.test(promotion.candidate?.producerRunAttempt ?? '') ||
+      promotion.candidate?.sourceCommit !== sourceCommit ||
+      !/^[a-f0-9]{64}$/.test(promotion.candidate?.materialDigest ?? '') ||
+      !integer.test(promotion.container?.artifactId ?? '') ||
+      !digest.test(promotion.container?.artifactDigest ?? '')
+    : promotion.candidate !== null || promotion.container !== null)
+) {
+  throw new Error('Staging deployment receipt and candidate promotion binding disagree.');
+}
+const outputs = {
+  deployment_run_attempt: deploymentRunAttempt,
+  deployment_run_id: deploymentRunId,
+  receipt_artifact_digest: receiptArtifactDigest,
+  receipt_artifact_id: receiptArtifactId,
+  source_commit: sourceCommit,
+};
+if (expectedHasSlices) Object.assign(outputs, {
+  artifact_digest: promotion.candidate.artifactDigest,
+  artifact_id: promotion.candidate.artifactId,
+  candidate_material_digest: promotion.candidate.materialDigest,
+  container_artifact_digest: promotion.container.artifactDigest,
+  container_artifact_id: promotion.container.artifactId,
+  producer_run_attempt: promotion.candidate.producerRunAttempt,
+  producer_run_id: promotion.candidate.producerRunId,
+});
+for (const [name, value] of Object.entries(outputs)) appendFileSync(process.env.GITHUB_OUTPUT, name + '=' + value + '\\n');`;
+}
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+function restoredCandidateValidationScript() {
+    return `import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+const root = '.ebk/evidence/release-candidate/packages';
+const sourceCommit = process.env.EBK_RELEASE_SOURCE_COMMIT?.trim() ?? '';
+const producerRunId = process.env.EBK_CANDIDATE_PRODUCER_RUN_ID?.trim() ?? '';
+const producerRunAttempt = process.env.EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT?.trim() ?? '';
+const expected = process.env.EBK_CANDIDATE_MATERIAL_DIGEST?.trim() ?? '';
+if (!/^[a-f0-9]{40,64}$/.test(sourceCommit) || !/^[1-9][0-9]*$/.test(producerRunId) || !/^[1-9][0-9]*$/.test(producerRunAttempt) || !/^[a-f0-9]{64}$/.test(expected)) {
+  throw new Error('Restored candidate authority is absent or malformed.');
+}
+const projects = readdirSync(root, { withFileTypes: true })
+  .filter((entry) => entry.isDirectory())
+  .map((entry) => entry.name)
+  .sort();
+if (projects.length === 0 || projects.some((project) => !/^[a-z0-9][a-z0-9-]{0,62}$/.test(project))) {
+  throw new Error('Restored candidate project inventory is absent or malformed.');
+}
+const entries = projects.map((project) => {
+  const bytes = readFileSync(join(root, project, 'candidate.json'));
+  const value = JSON.parse(bytes.toString('utf8'));
+  if (
+    value?.kind !== 'ebk-release-candidate' ||
+    value.schemaVersion !== 1 ||
+    value.slice !== project ||
+    value.sourceCommit !== sourceCommit ||
+    value.provenance?.runId !== producerRunId ||
+    value.provenance?.runAttempt !== producerRunAttempt
+  ) throw new Error('Restored candidate provenance is stale or cross-paired.');
+  return { manifestDigest: createHash('sha256').update(bytes).digest('hex'), project };
+});
+const observed = createHash('sha256').update(JSON.stringify(entries)).digest('hex');
+if (observed !== expected) throw new Error('Restored candidate material digest differs from staging.');`;
+}
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+function stagingPromotionSealScript() {
+    return `import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const required = (name, pattern) => {
+  const value = process.env[name]?.trim() ?? '';
+  if (!pattern.test(value)) throw new Error(name + ' is absent or malformed.');
+  return value;
+};
+const sourceCommit = required('EBK_RELEASE_SOURCE_COMMIT', /^[a-f0-9]{40,64}$/);
+const hasSlices = required('EBK_HAS_SLICES', /^(?:true|false)$/) === 'true';
+const account = required('EBK_POLICY_ACCOUNT_ID', /^[0-9]{12}$/);
+const deploymentProfile = required('EBK_DEPLOYMENT_PROFILE', /^(?:production-isolated|fully-isolated)$/);
+const region = required('EBK_POLICY_REGION', /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-[0-9]$/);
+const deploymentRunId = required('GITHUB_RUN_ID', /^[1-9][0-9]*$/);
+const deploymentRunAttempt = required('GITHUB_RUN_ATTEMPT', /^[1-9][0-9]*$/);
+const receiptPath = '.ebk/evidence/deployment/latest.json';
+const receiptBytes = readFileSync(receiptPath);
+const receipt = JSON.parse(receiptBytes.toString('utf8'));
+if (receipt?.kind !== 'ebk-deployment-receipt' || receipt.schemaVersion !== 1 || receipt.outcome !== 'succeeded' || receipt.authority !== 'github' || receipt.stage !== 'staging' || receipt.account !== account || receipt.profile !== deploymentProfile || receipt.region !== region || receipt.source?.clean !== true || receipt.source?.commit !== sourceCommit) {
+  throw new Error('Successful staging deployment receipt is absent or stale.');
+}
+const candidateEnvironment = {
+  artifactDigest: process.env.EBK_CANDIDATE_ARTIFACT_DIGEST?.trim() ?? '',
+  artifactId: process.env.EBK_CANDIDATE_ARTIFACT_ID?.trim() ?? '',
+  producerRunAttempt: process.env.EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT?.trim() ?? '',
+  producerRunId: process.env.EBK_CANDIDATE_PRODUCER_RUN_ID?.trim() ?? '',
+};
+const containerEnvironment = {
+  artifactDigest: process.env.EBK_CONTAINER_ARTIFACT_DIGEST?.trim() ?? '',
+  artifactId: process.env.EBK_CONTAINER_ARTIFACT_ID?.trim() ?? '',
+};
+let candidate = null;
+let container = null;
+if (hasSlices) {
+  const producerRunId = required('EBK_CANDIDATE_PRODUCER_RUN_ID', /^[1-9][0-9]*$/);
+  const producerRunAttempt = required('EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT', /^[1-9][0-9]*$/);
+  const artifactId = required('EBK_CANDIDATE_ARTIFACT_ID', /^[1-9][0-9]*$/);
+  const artifactDigest = required('EBK_CANDIDATE_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
+  const containerArtifactId = required('EBK_CONTAINER_ARTIFACT_ID', /^[1-9][0-9]*$/);
+  const containerArtifactDigest = required('EBK_CONTAINER_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
+  const root = '.ebk/evidence/release-candidate/packages';
+  const projects = readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+    .sort();
+  if (projects.length === 0 || projects.some((project) => !/^[a-z0-9][a-z0-9-]{0,62}$/.test(project))) throw new Error('Staging candidate inventory is absent or malformed.');
+  const entries = projects.map((project) => {
+    const bytes = readFileSync(join(root, project, 'candidate.json'));
+    const value = JSON.parse(bytes.toString('utf8'));
+    if (value?.kind !== 'ebk-release-candidate' || value.schemaVersion !== 1 || value.slice !== project || value.sourceCommit !== sourceCommit || value.provenance?.runId !== producerRunId || value.provenance?.runAttempt !== producerRunAttempt) {
+      throw new Error('Staging candidate provenance is stale or cross-paired.');
+    }
+    return { manifestDigest: createHash('sha256').update(bytes).digest('hex'), project };
+  });
+  candidate = { artifactDigest, artifactId, materialDigest: createHash('sha256').update(JSON.stringify(entries)).digest('hex'), producerRunAttempt, producerRunId, sourceCommit };
+  container = { artifactDigest: containerArtifactDigest, artifactId: containerArtifactId };
+} else if (Object.values(candidateEnvironment).some(Boolean) || Object.values(containerEnvironment).some(Boolean)) {
+  throw new Error('A staging promotion without Slices must not carry Slice release material.');
+}
+const promotion = {
+  account,
+  candidate,
+  container,
+  deploymentProfile,
+  deployment: { receiptDigest: createHash('sha256').update(receiptBytes).digest('hex'), runAttempt: deploymentRunAttempt, runId: deploymentRunId },
+  hasSlices,
+  kind: 'ebk-staging-deployment-promotion',
+  region,
+  schemaVersion: 1,
+  sourceCommit,
+  stage: 'staging',
+};
+mkdirSync('.ebk/evidence/deployment', { recursive: true });
+writeFileSync('.ebk/evidence/deployment/promotion.json', JSON.stringify(promotion, null, 2) + '\\n', { mode: 0o600 });`;
+}
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+function postdeploySupplyChainBindingScript() {
+    return `import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+
+const required = (name, pattern) => {
+  const value = process.env[name]?.trim() ?? '';
+  if (!pattern.test(value)) throw new Error(name + ' is absent or malformed.');
+  return value;
+};
+const canonical = (value) => {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return '[' + value.map(canonical).join(',') + ']';
+  return '{' + Object.entries(value)
+    .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+    .map(([key, child]) => JSON.stringify(key) + ':' + canonical(child))
+    .join(',') + '}';
+};
+const accountId = required('EBK_POLICY_ACCOUNT_ID', /^[0-9]{12}$/);
+const deploymentCommit = required('EBK_SOURCE_COMMIT', /^[a-f0-9]{40,64}$/);
+const profile = required('EBK_DEPLOYMENT_PROFILE', /^(?:starter|production-isolated|fully-isolated)$/);
+const region = required('EBK_POLICY_REGION', /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-[0-9]$/);
+const releaseCandidateArtifactDigest = required('EBK_CANDIDATE_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
+const releaseCandidateArtifactId = required('EBK_CANDIDATE_ARTIFACT_ID', /^[1-9][0-9]*$/);
+const releaseCandidateProducerRunAttempt = required('EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT', /^[1-9][0-9]*$/);
+const releaseCandidateProducerRunId = required('EBK_CANDIDATE_PRODUCER_RUN_ID', /^[1-9][0-9]*$/);
+const releaseSourceCommit = required('EBK_RELEASE_SOURCE_COMMIT', /^[a-f0-9]{40,64}$/);
+const runAttempt = required('GITHUB_RUN_ATTEMPT', /^[1-9][0-9]*$/);
+const runId = required('GITHUB_RUN_ID', /^[1-9][0-9]*$/);
+const stage = required('EBK_STAGE', /^(?:development|staging|production)$/);
+const receipt = JSON.parse(readFileSync('.ebk/evidence/deployment/latest.json', 'utf8'));
+if (
+  receipt?.kind !== 'ebk-deployment-receipt' ||
+  receipt.schemaVersion !== 1 ||
+  receipt.outcome !== 'succeeded' ||
+  receipt.authority !== 'github' ||
+  receipt.account !== accountId ||
+  receipt.profile !== profile ||
+  receipt.region !== region ||
+  receipt.stage !== stage ||
+  receipt.source?.clean !== true ||
+  receipt.source?.commit !== deploymentCommit
+) throw new Error('Successful deployment receipt is absent or cross-paired.');
+const unsigned = {
+  accountId,
+  deploymentCommit,
+  kind: 'ebk-postdeploy-supply-chain-binding',
+  profile,
+  region,
+  releaseCandidateArtifactDigest,
+  releaseCandidateArtifactId,
+  releaseCandidateProducerRunAttempt,
+  releaseCandidateProducerRunId,
+  releaseSourceCommit,
+  runAttempt,
+  runId,
+  schemaVersion: 1,
+  stage,
+};
+const binding = {
+  ...unsigned,
+  materialDigest: createHash('sha256').update(canonical(unsigned)).digest('hex'),
+};
+mkdirSync('.ebk/evidence/deployment', { recursive: true, mode: 0o700 });
+writeFileSync(
+  '.ebk/evidence/deployment/postdeploy-supply-chain.json',
+  JSON.stringify(binding, null, 2) + '\\n',
+  { flag: 'wx', mode: 0o600 },
+);`;
+}
+function renderThinDeployWorkflow(options) {
+    const { actionPins, deploymentProfile, name, toolVersions } = options;
+    return `name: Deploy
+run-name: Deploy \${{ inputs.source_commit || github.sha }}
+
+on:
+${workflowCallTrigger(deploymentProfile)}  workflow_dispatch:
+    inputs:
+      action:
+        description: Native lifecycle action
+        required: true
+        default: deploy
+        type: choice
+        options: [deploy, refresh, unlock, remove]
+      project:
+        description: Required registered project for unlock or remove recovery
+        required: false
+        type: string
+
+concurrency:
+  group: protected-lifecycle-\${{ inputs.source_branch || github.ref_name }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  EBK_DEPLOYMENT_SOURCE_BRANCH: \${{ inputs.source_branch || github.ref_name }}
+  EBK_DEPLOYMENT_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+  EBK_DEPLOYMENT_SOURCE_REF: \${{ inputs.source_ref || github.ref }}
+  EBK_EXPECTED_SST_VERSION: ${toolVersions.sst}
+
+jobs:
+  prepare:
+    name: route protected native lifecycle
+    runs-on: ubuntu-latest
+    outputs:
+      action: \${{ steps.route.outputs.action }}
+      account_id: \${{ steps.account.outputs.account_id }}
+      has_slices: \${{ steps.policy.outputs.has_slices }}
+      ordered_projects: \${{ steps.policy.outputs.ordered_projects }}
+      oidc_audience: \${{ steps.account.outputs.audience }}
+      partition: \${{ steps.account.outputs.partition }}
+      profile: \${{ steps.policy.outputs.deployment_profile }}
+      project: \${{ steps.route.outputs.project }}
+      region: \${{ steps.policy.outputs.deployment_region }}
+      slice_projects: \${{ steps.policy.outputs.slice_projects }}
+      staging_account_id: \${{ steps.policy.outputs.staging_account_id }}
+      stage: \${{ steps.route.outputs.stage }}
+      stage_deploy_role_arn: \${{ steps.account.outputs.role_arn }}
+    steps:
+      - name: Verify exact protected branch tip before setup
+        env:
+          EBK_CONTEXT_REF: \${{ github.ref }}
+          EBK_CONTEXT_REF_NAME: \${{ github.ref_name }}
+          EBK_CONTEXT_RUN_ATTEMPT: \${{ github.run_attempt }}
+          EBK_CONTEXT_RUN_ID: \${{ github.run_id }}
+          EBK_CONTEXT_SHA: \${{ github.sha }}
+          EBK_INPUT_RUN_ATTEMPT: \${{ inputs.verify_run_attempt || '' }}
+          EBK_INPUT_RUN_ID: \${{ inputs.verify_run_id || '' }}
+          EBK_INPUT_SOURCE_BRANCH: \${{ inputs.source_branch || '' }}
+          EBK_INPUT_SOURCE_COMMIT: \${{ inputs.source_commit || '' }}
+          EBK_INPUT_SOURCE_REF: \${{ inputs.source_ref || '' }}
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          EBK_SOURCE_REF: \${{ env.EBK_DEPLOYMENT_SOURCE_REF }}
+          EBK_TRIGGER: \${{ github.event_name }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          case "$EBK_SOURCE_COMMIT" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          { [ "\${#EBK_SOURCE_COMMIT}" -eq 40 ] || [ "\${#EBK_SOURCE_COMMIT}" -eq 64 ]; } || exit 1
+          case "$EBK_SOURCE_BRANCH:$EBK_SOURCE_REF" in
+            develop:refs/heads/develop|main:refs/heads/main) ;;
+            *) echo 'Protected lifecycle must bind one exact protected branch ref'; exit 1 ;;
+          esac
+          if [ -n "$EBK_INPUT_RUN_ID$EBK_INPUT_RUN_ATTEMPT$EBK_INPUT_SOURCE_BRANCH$EBK_INPUT_SOURCE_COMMIT$EBK_INPUT_SOURCE_REF" ]; then
+            [ "$EBK_TRIGGER" = push ] || { echo 'Automatic deployment requires one protected push Verify caller'; exit 1; }
+            [ -n "$EBK_INPUT_RUN_ID" ] && [ -n "$EBK_INPUT_RUN_ATTEMPT" ] &&
+              [ -n "$EBK_INPUT_SOURCE_BRANCH" ] && [ -n "$EBK_INPUT_SOURCE_COMMIT" ] && [ -n "$EBK_INPUT_SOURCE_REF" ] ||
+              { echo 'Automatic deployment caller binding is incomplete'; exit 1; }
+            [ "$EBK_INPUT_RUN_ID" = "$EBK_CONTEXT_RUN_ID" ] &&
+              [ "$EBK_INPUT_RUN_ATTEMPT" = "$EBK_CONTEXT_RUN_ATTEMPT" ] &&
+              [ "$EBK_INPUT_SOURCE_COMMIT" = "$EBK_CONTEXT_SHA" ] &&
+              [ "$EBK_INPUT_SOURCE_BRANCH" = "$EBK_CONTEXT_REF_NAME" ] &&
+              [ "$EBK_INPUT_SOURCE_REF" = "$EBK_CONTEXT_REF" ] ||
+              { echo 'Automatic deployment differs from its exact Verify caller'; exit 1; }
+          else
+            [ "$EBK_TRIGGER" = workflow_dispatch ] || { echo 'Manual deployment requires workflow dispatch'; exit 1; }
+          fi
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Check out immutable source
+        uses: ${actionPins.checkout}
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+      - uses: ${actionPins.setupNode}
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - id: route
+        name: Resolve protected stage and action
+        env:
+          EBK_DISPATCH_ACTION: \${{ inputs.action || '' }}
+          EBK_DISPATCH_PROJECT: \${{ inputs.project || '' }}
+          EBK_PROFILE: ${deploymentProfile}
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          EBK_TRIGGER: \${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          action=deploy
+          project=
+          if [ "$EBK_TRIGGER" = workflow_dispatch ]; then
+            action="$EBK_DISPATCH_ACTION"
+            project="$EBK_DISPATCH_PROJECT"
+          fi
+          case "$EBK_SOURCE_COMMIT" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          { [ "\${#EBK_SOURCE_COMMIT}" -eq 40 ] || [ "\${#EBK_SOURCE_COMMIT}" -eq 64 ]; } || exit 1
+          case "$action" in deploy|refresh|unlock|remove) ;; *) exit 1 ;; esac
+          case "$project" in ''|*[!A-Za-z0-9_-]*) [ -z "$project" ] || exit 1 ;; esac
+          case "$action" in
+            unlock|remove) [ -n "$project" ] || { echo 'unlock and remove require an explicit project'; exit 1; } ;;
+            deploy|refresh) [ -z "$project" ] || { echo 'deploy and refresh operate on the policy-derived project order'; exit 1; } ;;
+          esac
+          case "$EBK_SOURCE_BRANCH" in
+            main) stage=production ;;
+            develop)
+              if [ "$EBK_PROFILE" = starter ]; then
+                stage=development
+              else
+                stage=staging
+              fi
+              ;;
+            *) echo 'Protected lifecycle must run from develop or main'; exit 1 ;;
+          esac
+          echo "action=$action" >> "$GITHUB_OUTPUT"
+          echo "project=$project" >> "$GITHUB_OUTPUT"
+          echo "stage=$stage" >> "$GITHUB_OUTPUT"
+      - id: policy
+        name: Derive ordered projects from committed policy
+        env:
+          EBK_ACTION: \${{ steps.route.outputs.action }}
+          EBK_PROJECT: \${{ steps.route.outputs.project }}
+          EBK_STAGE: \${{ steps.route.outputs.stage }}
+        run: |
+          set -euo pipefail
+          args=("--action=$EBK_ACTION" "--stage=$EBK_STAGE")
+          if [ -n "$EBK_PROJECT" ]; then args+=("--project=$EBK_PROJECT"); fi
+          pnpm nx run ${name}:deployment-plan -- "\${args[@]}"
+      - name: Bind generated profile
+        env:
+          EBK_RENDERED_PROFILE: ${deploymentProfile}
+          EBK_REPOSITORY_PROFILE: \${{ steps.policy.outputs.deployment_profile }}
+        run: test "$EBK_RENDERED_PROFILE" = "$EBK_REPOSITORY_PROFILE"
+      - id: account
+        name: Derive canonical committed stage authority
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGE: \${{ steps.route.outputs.stage }}
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()}`, 10)}
+
+  immutable-artifacts:
+    name: prepare exact immutable release artifacts
+    needs: prepare
+    if: >-
+      needs.prepare.outputs.action == 'deploy' &&
+      (
+        needs.prepare.outputs.has_slices == 'true' ||
+        (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter')
+      )
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+    outputs:
+      artifact_digest: \${{ steps.current.outputs.artifact_digest || steps.staging.outputs.artifact_digest }}
+      artifact_id: \${{ steps.current.outputs.artifact_id || steps.staging.outputs.artifact_id }}
+      candidate_material_digest: \${{ steps.staging.outputs.candidate_material_digest }}
+      container_artifact_digest: \${{ steps.staging.outputs.container_artifact_digest }}
+      container_artifact_id: \${{ steps.staging.outputs.container_artifact_id }}
+      staging_deployment_run_attempt: \${{ steps.staging.outputs.deployment_run_attempt }}
+      staging_deployment_run_id: \${{ steps.staging.outputs.deployment_run_id }}
+      producer_run_attempt: \${{ steps.current.outputs.producer_run_attempt || steps.staging.outputs.producer_run_attempt }}
+      producer_run_id: \${{ steps.current.outputs.producer_run_id || steps.staging.outputs.producer_run_id }}
+      source_commit: \${{ steps.current.outputs.source_commit || steps.staging.outputs.source_commit }}
+    steps:
+      - name: Check out immutable production ancestry
+        if: needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter'
+        uses: ${actionPins.checkout}
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - id: current
+        name: Select exact successful current-source CI candidate
+        if: >-
+          needs.prepare.outputs.has_slices == 'true' &&
+          (needs.prepare.outputs.stage != 'production' || needs.prepare.outputs.profile == 'starter')
+        env:
+          EBK_CALLER_RUN_ATTEMPT: \${{ inputs.verify_run_attempt || '' }}
+          EBK_CALLER_RUN_ID: \${{ inputs.verify_run_id || '' }}
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          if [ -n "$EBK_CALLER_RUN_ID" ]; then
+            [ -n "$EBK_CALLER_RUN_ATTEMPT" ] || exit 1
+            run_id="$EBK_CALLER_RUN_ID"
+            run_attempt="$EBK_CALLER_RUN_ATTEMPT"
+          else
+            runs="$(gh api "/repos/$GH_REPO/actions/workflows/ci.yml/runs?event=push&branch=$EBK_SOURCE_BRANCH&head_sha=$EBK_SOURCE_COMMIT&status=success&per_page=100")"
+            producer="$(printf '%s' "$runs" | jq -c --arg branch "$EBK_SOURCE_BRANCH" --arg source "$EBK_SOURCE_COMMIT" \
+              '[.workflow_runs[] | select(.head_sha == $source and .head_branch == $branch and .event == "push" and .conclusion == "success" and .path == ".github/workflows/ci.yml")] | if length == 1 then .[0] else empty end')"
+            [ -n "$producer" ] || { echo 'Exact successful CI candidate producer is absent or ambiguous'; exit 1; }
+            run_id="$(printf '%s' "$producer" | jq -r '.id // empty')"
+            run_attempt="$(printf '%s' "$producer" | jq -r '.run_attempt // empty')"
+          fi
+          artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$run_id/artifacts?per_page=100")"
+          artifact="$(printf '%s' "$artifacts" | jq -c --arg source "$EBK_SOURCE_COMMIT" \
+            '[.artifacts[] | select(.name == "release-candidate-" + $source and .expired == false)] | if length == 1 then .[0] else empty end')"
+          [ -n "$artifact" ] || { echo 'Exact release candidate artifact is absent or ambiguous'; exit 1; }
+          artifact_id="$(printf '%s' "$artifact" | jq -r '.id // empty')"
+          artifact_digest="$(printf '%s' "$artifact" | jq -r '.digest // empty')"
+          case "$run_id:$run_attempt:$artifact_id" in *[!0-9:]*) exit 1 ;; esac
+          case "$artifact_digest" in sha256:????????????????????????????????????????????????????????????????) ;; *) exit 1 ;; esac
+          echo "artifact_digest=$artifact_digest" >> "$GITHUB_OUTPUT"
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+          echo "producer_run_attempt=$run_attempt" >> "$GITHUB_OUTPUT"
+          echo "producer_run_id=$run_id" >> "$GITHUB_OUTPUT"
+          echo "source_commit=$EBK_SOURCE_COMMIT" >> "$GITHUB_OUTPUT"
+      - id: staging-receipt
+        name: Select exact successful staging deployment receipt
+        if: needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter'
+        env:
+          EBK_DEPLOYMENT_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          parents="$(git rev-list --parents -n 1 "$EBK_DEPLOYMENT_SOURCE_COMMIT")"
+          set -- $parents
+          [ "$#" -eq 3 ] || { echo 'Isolated production requires one exact two-parent promotion merge'; exit 1; }
+          [ "$1" = "$EBK_DEPLOYMENT_SOURCE_COMMIT" ] || exit 1
+          staging_source="$3"
+          git merge-base --is-ancestor "$staging_source" "$EBK_DEPLOYMENT_SOURCE_COMMIT" || {
+            echo 'Staging promotion source is not an ancestor of production'; exit 1;
+          }
+          [ "$(git rev-parse "$EBK_DEPLOYMENT_SOURCE_COMMIT^{tree}")" = "$(git rev-parse "$staging_source^{tree}")" ] || {
+            echo 'Production merge tree differs from the promoted staging source'; exit 1;
+          }
+          git show-ref --verify --quiet refs/remotes/origin/develop || {
+            echo 'Protected develop lineage is absent from the immutable checkout'; exit 1;
+          }
+          git rev-list --first-parent refs/remotes/origin/develop > "$RUNNER_TEMP/develop-first-parent"
+          grep -Fxq "$staging_source" "$RUNNER_TEMP/develop-first-parent" || {
+            echo 'Staging promotion source is absent from protected develop first-parent history'; exit 1;
+          }
+          runs="$(gh api "/repos/$GH_REPO/actions/workflows/ci.yml/runs?event=push&branch=develop&head_sha=$staging_source&status=success&per_page=100")"
+          producer="$(printf '%s' "$runs" | jq -c --arg source "$staging_source" \
+            '[.workflow_runs[] | select(.head_sha == $source and .head_branch == "develop" and .event == "push" and .conclusion == "success" and .path == ".github/workflows/ci.yml")] | if length == 1 then .[0] else empty end')"
+          [ -n "$producer" ] || { echo 'Exact successful staging Verify deployment is absent or ambiguous'; exit 1; }
+          run_id="$(printf '%s' "$producer" | jq -r '.id // empty')"
+          run_attempt="$(printf '%s' "$producer" | jq -r '.run_attempt // empty')"
+          artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$run_id/artifacts?per_page=100")"
+          receipt_name="deployment-receipt-staging-$run_id-$run_attempt"
+          receipt="$(printf '%s' "$artifacts" | jq -c --arg name "$receipt_name" \
+            '[.artifacts[] | select(.name == $name and .expired == false)] | if length == 1 then .[0] else empty end')"
+          [ -n "$receipt" ] || { echo 'Exact successful staging deployment receipt is absent or ambiguous'; exit 1; }
+          artifact_id="$(printf '%s' "$receipt" | jq -r '.id // empty')"
+          artifact_digest="$(printf '%s' "$receipt" | jq -r '.digest // empty')"
+          case "$run_id:$run_attempt:$artifact_id" in *[!0-9:]*) exit 1 ;; esac
+          case "$artifact_digest" in sha256:????????????????????????????????????????????????????????????????) ;; *) exit 1 ;; esac
+          echo "artifact_digest=$artifact_digest" >> "$GITHUB_OUTPUT"
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+          echo "run_attempt=$run_attempt" >> "$GITHUB_OUTPUT"
+          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+          echo "source_commit=$staging_source" >> "$GITHUB_OUTPUT"
+      - name: Restore exact staging deployment receipt
+        if: needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter'
+        uses: ${actionPins.downloadArtifact}
+        with:
+          artifact-ids: \${{ steps.staging-receipt.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: \${{ runner.temp }}/staging-deployment-receipt
+          run-id: \${{ steps.staging-receipt.outputs.run_id }}
+      - id: staging
+        name: Bind exact staging deployment and release evidence
+        if: needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter'
+        env:
+          EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT: \${{ steps.staging-receipt.outputs.run_attempt }}
+          EBK_STAGING_DEPLOYMENT_RUN_ID: \${{ steps.staging-receipt.outputs.run_id }}
+          EBK_EXPECTED_HAS_SLICES: \${{ needs.prepare.outputs.has_slices }}
+          EBK_EXPECTED_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+          EBK_EXPECTED_DEPLOYMENT_REGION: \${{ needs.prepare.outputs.region }}
+          EBK_EXPECTED_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
+          EBK_STAGING_RECEIPT_ARTIFACT_DIGEST: \${{ steps.staging-receipt.outputs.artifact_digest }}
+          EBK_STAGING_RECEIPT_ARTIFACT_ID: \${{ steps.staging-receipt.outputs.artifact_id }}
+          EBK_STAGING_RECEIPT_ROOT: \${{ runner.temp }}/staging-deployment-receipt
+          EBK_STAGING_SOURCE_COMMIT: \${{ steps.staging-receipt.outputs.source_commit }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
+          NODE
+          if [ "$EBK_EXPECTED_HAS_SLICES" = true ]; then
+            promotion="$EBK_STAGING_RECEIPT_ROOT/promotion.json"
+            candidate_run_id="$(jq -r '.candidate.producerRunId' "$promotion")"
+            candidate_run_attempt="$(jq -r '.candidate.producerRunAttempt' "$promotion")"
+            candidate_artifact_id="$(jq -r '.candidate.artifactId' "$promotion")"
+            candidate_artifact_digest="$(jq -r '.candidate.artifactDigest' "$promotion")"
+            container_artifact_id="$(jq -r '.container.artifactId' "$promotion")"
+            container_artifact_digest="$(jq -r '.container.artifactDigest' "$promotion")"
+            candidate_run="$(gh api "/repos/$GH_REPO/actions/runs/$candidate_run_id")"
+            printf '%s' "$candidate_run" | jq -e \
+              --arg source "$EBK_STAGING_SOURCE_COMMIT" \
+              --arg attempt "$candidate_run_attempt" \
+              '.head_sha == $source and .head_branch == "develop" and .event == "push" and .path == ".github/workflows/ci.yml" and .conclusion == "success" and (.run_attempt | tostring) == $attempt' >/dev/null
+            candidate_artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$candidate_run_id/artifacts?per_page=100")"
+            printf '%s' "$candidate_artifacts" | jq -e \
+              --arg id "$candidate_artifact_id" \
+              --arg digest "$candidate_artifact_digest" \
+              --arg name "release-candidate-$EBK_STAGING_SOURCE_COMMIT" \
+              '[.artifacts[] | select((.id | tostring) == $id and .name == $name and .digest == $digest and .expired == false)] | length == 1' >/dev/null
+            staging_artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_STAGING_DEPLOYMENT_RUN_ID/artifacts?per_page=100")"
+            printf '%s' "$staging_artifacts" | jq -e \
+              --arg id "$container_artifact_id" \
+              --arg digest "$container_artifact_digest" \
+              --arg name "container-release-staging-$EBK_STAGING_DEPLOYMENT_RUN_ID-$EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT" \
+              '[.artifacts[] | select((.id | tostring) == $id and .name == $name and .digest == $digest and .expired == false)] | length == 1' >/dev/null
+          fi
+
+  container-platform:
+    name: native \${{ needs.prepare.outputs.stage }} OCI \${{ matrix.platform }}
+    needs: [prepare, immutable-artifacts]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      needs.prepare.outputs.action == 'deploy' &&
+      needs.prepare.outputs.has_slices == 'true' &&
+      (
+        needs.prepare.outputs.stage == 'staging' ||
+        (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile == 'starter')
+      )
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - architecture: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+            target: container-release-amd64
+          - architecture: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            target: container-release-arm64
+    runs-on: \${{ matrix.runner }}
+    environment: \${{ needs.prepare.outputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+    steps:
+      - name: Check out immutable container source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before container authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Restore exact immutable release candidate for container build
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the current stage deployment role for container build
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-container-\${{ matrix.architecture }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact container build authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+          [ "$(aws sts get-caller-identity --query Account --output text)" = "$EBK_POLICY_ACCOUNT_ID" ]
+      - name: Build and run exact native OCI artifacts
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Container build', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            pnpm nx run "$project:\${{ matrix.target }}"
+          done
+      - name: Retain native platform evidence
+        uses: ${actionPins.uploadArtifact}
+        with:
+          name: container-platform-\${{ needs.prepare.outputs.stage }}-\${{ matrix.architecture }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 30
+          path: .ebk/evidence/container-release/partials/\${{ needs.prepare.outputs.stage }}/*/\${{ matrix.architecture }}
+
+  container-assemble:
+    name: assemble \${{ needs.prepare.outputs.stage }} OCI indexes
+    needs: [prepare, immutable-artifacts, container-platform]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      needs.container-platform.result == 'success' &&
+      needs.prepare.outputs.action == 'deploy' &&
+      needs.prepare.outputs.has_slices == 'true'
+    runs-on: ubuntu-latest
+    environment: \${{ needs.prepare.outputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    outputs:
+      artifact_digest: \${{ steps.retain.outputs.artifact-digest }}
+      artifact_id: \${{ steps.retain.outputs.artifact-id }}
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+    steps:
+      - name: Check out immutable container source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before container authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Restore exact immutable release candidate for container assembly
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Restore both native platform records
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          pattern: container-platform-\${{ needs.prepare.outputs.stage }}-*-\${{ github.run_id }}-\${{ github.run_attempt }}
+          merge-multiple: true
+          path: .ebk/evidence/container-release/partials/\${{ needs.prepare.outputs.stage }}
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the current stage deployment role for container assembly
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-container-assemble-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact container assembly authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+          [ "$(aws sts get-caller-identity --query Account --output text)" = "$EBK_POLICY_ACCOUNT_ID" ]
+      - name: Assemble exact dual-architecture indexes
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Container assembly', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            pnpm nx run "$project:container-release-assemble"
+            binding=".ebk/evidence/container-release/$EBK_STAGE/packages/$project/binding.json"
+            sidecar=".ebk/evidence/container-release/$EBK_STAGE/packages/$project/release-bound-binding.json"
+            test -f "$binding" && test ! -e "$sidecar"
+            cp "$binding" "$sidecar"
+            cmp "$binding" "$sidecar"
+          done
+      - id: retain
+        name: Retain exact predeploy container bundle
+        uses: ${actionPins.uploadArtifact}
+        with:
+          name: container-release-\${{ needs.prepare.outputs.stage }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 30
+          path: .ebk/evidence/container-release
+
+  container-promote-production:
+    name: promote reviewed OCI indexes to production
+    needs: [prepare, immutable-artifacts]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      needs.prepare.outputs.action == 'deploy' &&
+      needs.prepare.outputs.stage == 'production' &&
+      needs.prepare.outputs.profile != 'starter' &&
+      needs.prepare.outputs.has_slices == 'true'
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    outputs:
+      artifact_digest: \${{ steps.retain.outputs.artifact-digest }}
+      artifact_id: \${{ steps.retain.outputs.artifact-id }}
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_PRODUCTION_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_POLICY_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: production
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+    steps:
+      - name: Check out immutable production source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before container authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Restore exact immutable release candidate for promotion
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Restore exact staging container bundle
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.container_artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/container-release
+          run-id: \${{ needs.immutable-artifacts.outputs.staging_deployment_run_id }}
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume exact staging registry pull role
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+          role-session-name: ebk-staging-container-pull-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
+      - name: Authenticate exact staging source registry
+        env:
+          AWS_STAGING_PROMOTION_PULL_ROLE_ARN: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
+          EBK_STAGING_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+        run: |
+          set -euo pipefail
+          [ "$EBK_STAGING_ACCOUNT_ID" = "$EBK_POLICY_STAGING_ACCOUNT_ID" ]
+          [ "$EBK_STAGING_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStagingPromotionPullGuardScript(), 10)}
+          [ "$EBK_STAGING_ACCOUNT_ID" != "$AWS_EXPECTED_ACCOUNT_ID" ]
+          registry_suffix=.com
+          case "$EBK_STAGING_REGION" in cn-*) registry_suffix=.com.cn ;; esac
+          aws ecr get-login-password --region "$EBK_STAGING_REGION" |
+            docker login --username AWS --password-stdin \
+              "$EBK_STAGING_ACCOUNT_ID.dkr.ecr.$EBK_STAGING_REGION.amazonaws$registry_suffix"
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the production deployment role for container promotion
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-production-container-push-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Promote exact staging indexes without rebuilding
+        env:
+          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_PROMOTION_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPECTED_ACCOUNT_ID'), 10)}
+          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            export EBK_CONTAINER_PROMOTION_SOURCE_BINDING_PATH="../../.ebk/evidence/container-release/staging/packages/$project/binding.json"
+            export EBK_CONTAINER_PROMOTION_SOURCE_SIDECAR_PATH="../../.ebk/evidence/container-release/staging/packages/$project/release-bound-binding.json"
+            pnpm nx run "$project:container-release-promote"
+          done
+      - id: retain
+        name: Retain production target container binding
+        uses: ${actionPins.uploadArtifact}
+        with:
+          name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 90
+          path: .ebk/evidence/container-release
+
+  execute:
+    name: native \${{ needs.prepare.outputs.action }} \${{ needs.prepare.outputs.stage }}
+    needs: [prepare, immutable-artifacts, container-assemble, container-promote-production]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      (
+        needs.prepare.outputs.action != 'deploy' ||
+        (
+          needs.prepare.outputs.has_slices != 'true' &&
+          (needs.prepare.outputs.stage != 'production' || needs.prepare.outputs.profile == 'starter')
+        ) || (
+          needs.immutable-artifacts.result == 'success' &&
+          (
+            needs.prepare.outputs.has_slices != 'true' ||
+            needs.prepare.outputs.stage == 'development' ||
+            (
+              (
+                needs.prepare.outputs.stage == 'staging' ||
+                (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile == 'starter')
+              ) &&
+              needs.container-assemble.result == 'success'
+            ) ||
+            (
+              needs.prepare.outputs.stage == 'production' &&
+              needs.prepare.outputs.profile != 'starter' &&
+              needs.container-promote-production.result == 'success'
+            )
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    environment: \${{ needs.prepare.outputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: \${{ needs.prepare.outputs.action }}
+      EBK_ALLOW_PRODUCTION_REMOVE: \${{ vars.EBK_ALLOW_PRODUCTION_REMOVE }}
+      EBK_CANDIDATE_ARTIFACT_DIGEST: \${{ needs.immutable-artifacts.outputs.artifact_digest }}
+      EBK_CANDIDATE_ARTIFACT_ID: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+      EBK_CANDIDATE_MATERIAL_DIGEST: \${{ needs.immutable-artifacts.outputs.candidate_material_digest }}
+      EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT: \${{ needs.immutable-artifacts.outputs.producer_run_attempt }}
+      EBK_CANDIDATE_PRODUCER_RUN_ID: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_ORDERED_PROJECTS: \${{ needs.prepare.outputs.ordered_projects }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit || inputs.source_commit || github.sha }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+    steps:
+      - name: Check out immutable deployment source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Restore exact immutable release candidate
+        if: needs.prepare.outputs.action == 'deploy' && needs.prepare.outputs.has_slices == 'true'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Restore exact current-stage container binding
+        if: >-
+          needs.prepare.outputs.action == 'deploy' &&
+          needs.prepare.outputs.has_slices == 'true' &&
+          (
+            needs.prepare.outputs.stage == 'staging' ||
+            (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile == 'starter')
+          )
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          name: container-release-\${{ needs.prepare.outputs.stage }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: .ebk/evidence/container-release
+      - name: Restore exact promoted production container binding
+        if: >-
+          needs.prepare.outputs.action == 'deploy' &&
+          needs.prepare.outputs.has_slices == 'true' &&
+          needs.prepare.outputs.stage == 'production' &&
+          needs.prepare.outputs.profile != 'starter'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: .ebk/evidence/container-release
+      - name: Verify exact predeploy container binding inventory
+        if: >-
+          needs.prepare.outputs.action == 'deploy' &&
+          needs.prepare.outputs.has_slices == 'true' &&
+          needs.prepare.outputs.stage != 'development'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            test -f ".ebk/evidence/container-release/$EBK_STAGE/packages/$project/binding.json" || {
+              echo "Exact predeploy container binding is absent for $project"
+              exit 1
+            }
+          done
+      - name: Verify exact restored staging-tested release candidate
+        if: env.EBK_ACTION == 'deploy' && env.EBK_STAGE == 'production' && needs.prepare.outputs.profile != 'starter' && needs.prepare.outputs.has_slices == 'true'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(restoredCandidateValidationScript(), 10)}
+          NODE
+      - name: Authorize deployed Blueprint trust before protected mutation
+        if: env.EBK_ACTION == 'deploy'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_PROTECTED_BLUEPRINT_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+        run: |
+          set -euo pipefail
+          case "$EBK_PROTECTED_BLUEPRINT_COMMIT" in
+            ''|*[!0-9a-f]*) echo 'Protected Blueprint authority must be one full lowercase Git object ID'; exit 1 ;;
+          esac
+          test "\${#EBK_PROTECTED_BLUEPRINT_COMMIT}" -eq 40 ||
+            test "\${#EBK_PROTECTED_BLUEPRINT_COMMIT}" -eq 64 ||
+            { echo 'Protected Blueprint authority must be one full Git object ID'; exit 1; }
+          test "$(git rev-parse HEAD)" = "$EBK_PROTECTED_BLUEPRINT_COMMIT" ||
+            { echo 'Protected Blueprint authority differs from the exact workflow checkout'; exit 1; }
+          case "$EBK_STAGE" in
+            staging) protected_branch=develop ;;
+            production) protected_branch=main ;;
+            *) exit 1 ;;
+          esac
+          node tools/blueprint-trust-check.mjs \
+            --operation=deploy \
+            --protected-branch="$protected_branch" \
+            --protected-ref="$EBK_PROTECTED_BLUEPRINT_COMMIT" \
+            --output=.ebk/evidence/supply-chain/blueprint-trust.json
+      - name: Produce subject-bound protected scanner evidence
+        if: env.EBK_ACTION == 'deploy'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:supply-chain-scan
+      - name: Enforce protected supply-chain policy before mutation
+        if: env.EBK_ACTION == 'deploy'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:supply-chain-check-protected
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the one stage deployment role
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-native-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact stage authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Native lifecycle', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+      - name: Run ordered native lifecycle targets
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+        run: |
+          set -euo pipefail
+          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'Stage deployment role is absent'; exit 1; }
+          if [ "$EBK_ACTION" = deploy ]; then
+            pnpm nx run ${name}:deploy-local -- \
+              --stage="$EBK_STAGE" \
+              --expectedRoleArn="$AWS_DEPLOY_ROLE_ARN"
+          else
+            [ -n "$EBK_ORDERED_PROJECTS" ] || { echo 'Committed deployment order is empty'; exit 1; }
+            IFS=',' read -r -a projects <<< "$EBK_ORDERED_PROJECTS"
+            seen=,
+            for project in "\${projects[@]}"; do
+              case "$project" in ''|*[!A-Za-z0-9_-]*) exit 1 ;; esac
+              case "$seen" in *,"$project",*) echo "Duplicate lifecycle project: $project"; exit 1 ;; esac
+              seen="$seen$project,"
+              pnpm nx run "$project:$EBK_ACTION" -- --stage="$EBK_STAGE" --region="$AWS_REGION" --expectedRoleArn="$AWS_DEPLOY_ROLE_ARN"
+            done
+          fi
+      - name: Seal exact staging promotion receipt
+        if: env.EBK_ACTION == 'deploy' && env.EBK_STAGE == 'staging' && needs.prepare.outputs.profile != 'starter'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_CONTAINER_ARTIFACT_DIGEST: \${{ needs.container-assemble.outputs.artifact_digest }}
+          EBK_CONTAINER_ARTIFACT_ID: \${{ needs.container-assemble.outputs.artifact_id }}
+          EBK_HAS_SLICES: \${{ needs.prepare.outputs.has_slices }}
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(stagingPromotionSealScript(), 10)}
+          NODE
+      - name: Seal exact postdeploy supply-chain binding
+        if: env.EBK_ACTION == 'deploy' && env.EBK_STAGE != 'development' && needs.prepare.outputs.has_slices == 'true'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(postdeploySupplyChainBindingScript(), 10)}
+          NODE
+      - name: Retain bounded deployment receipt
+        if: always() && needs.prepare.outputs.action == 'deploy'
+        uses: ${actionPins.uploadArtifact}
+        with:
+          if-no-files-found: warn
+          name: deployment-receipt-\${{ needs.prepare.outputs.stage }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: |
+            .ebk/evidence/deployment/latest.json
+            .ebk/evidence/deployment/postdeploy-supply-chain.json
+            .ebk/evidence/deployment/promotion.json
+            .ebk/evidence/container-release/**
+          retention-days: 30
+`;
+}
+function renderThinDeployWorkflowFilePlan(options) {
+    assertOptions(options);
+    return {
+        files: {
+            [exports.THIN_DEPLOY_WORKFLOW_PATH]: renderThinDeployWorkflow(options),
+        },
+        managedPaths: [exports.THIN_DEPLOY_WORKFLOW_PATH],
+    };
+}
+//# sourceMappingURL=workspace-files-thin-deploy.js.map