@empire-builder-kit/nx 1.0.0-rc.37 → 1.0.0-rc.39

package/src/performance/scenario.js

@@ -613,101 +613,109 @@ async function cleanupProtectedLoadScenarioEffects(input) {
     });
     let remoteCleanup = 'not-required';
     if (adapter.cleanupPath !== null) {
-        const controller = new AbortController();
-        let timeout;
-        try {
-            const authorization = requestAuthorization({
-                adapter,
-                capacity,
-                hmacKeyId: input.hmacKey.id,
-                operation: 'cleanup',
-                plan: input.plan,
-                requestOrdinal: 1,
-                scenario,
-            });
-            const remainingRuntime = cleanupDeadline - Date.now();
-            if (remainingRuntime <= 0) {
-                throw invalid('cleanup/deadline', 'exhausted the bounded cleanup runtime before the request');
-            }
-            const requestTimeout = Math.min(CLEANUP_MAXIMUM_REQUEST_MILLISECONDS, remainingRuntime);
-            const request = (async () => {
-                const response = await fetchImplementation(scenarioUrl(input.plan, cleanupPath(adapter)), {
-                    body: JSON.stringify({
-                        planMaterialDigest: input.plan.materialDigest,
-                        release: input.plan.release,
-                        requestOrdinal: 1,
-                        runId: input.plan.runId,
-                        scenarioId: input.plan.scenarioId,
-                        workload: input.plan.workload,
-                    }),
-                    headers: {
-                        accept: 'application/json',
-                        'content-type': 'application/json',
-                        ...authorizationHeaders({
-                            authorization,
-                            hmacKey: input.hmacKey,
+        let removedSoFar = 0;
+        for (;;) {
+            const controller = new AbortController();
+            let timeout;
+            try {
+                const authorization = requestAuthorization({
+                    adapter,
+                    capacity,
+                    hmacKeyId: input.hmacKey.id,
+                    operation: 'cleanup',
+                    plan: input.plan,
+                    requestOrdinal: 1,
+                    scenario,
+                });
+                const remainingRuntime = cleanupDeadline - Date.now();
+                if (remainingRuntime <= 0) {
+                    throw invalid('cleanup/deadline', 'exhausted the bounded cleanup runtime before the request');
+                }
+                const requestTimeout = Math.min(CLEANUP_MAXIMUM_REQUEST_MILLISECONDS, remainingRuntime);
+                const request = (async () => {
+                    const response = await fetchImplementation(scenarioUrl(input.plan, cleanupPath(adapter)), {
+                        body: JSON.stringify({
+                            planMaterialDigest: input.plan.materialDigest,
+                            release: input.plan.release,
+                            requestOrdinal: 1,
+                            runId: input.plan.runId,
+                            scenarioId: input.plan.scenarioId,
+                            workload: input.plan.workload,
                         }),
-                        'user-agent': 'empire-builder-kit-protected-load-cleanup/1.0.0',
-                    },
-                    method: 'POST',
-                    redirect: 'manual',
-                    signal: controller.signal,
+                        headers: {
+                            accept: 'application/json',
+                            'content-type': 'application/json',
+                            ...authorizationHeaders({
+                                authorization,
+                                hmacKey: input.hmacKey,
+                            }),
+                            'user-agent': 'empire-builder-kit-protected-load-cleanup/1.0.0',
+                        },
+                        method: 'POST',
+                        redirect: 'manual',
+                        signal: controller.signal,
+                    });
+                    return { body: await response.json(), response };
+                })();
+                const expired = new Promise((_resolve, reject) => {
+                    timeout = setTimeout(() => {
+                        controller.abort();
+                        reject(invalid('cleanup/deadline', 'exceeded the bounded cleanup request deadline'));
+                    }, requestTimeout);
                 });
-                return { body: await response.json(), response };
-            })();
-            const expired = new Promise((_resolve, reject) => {
-                timeout = setTimeout(() => {
-                    controller.abort();
-                    reject(invalid('cleanup/deadline', 'exceeded the bounded cleanup request deadline'));
-                }, requestTimeout);
-            });
-            const { body, response } = await Promise.race([request, expired]);
-            onlyKeys(body, [
-                'kind',
-                'hmacKeyId',
-                'planMaterialDigest',
-                'release',
-                'remainingEffectCount',
-                'removedEffectCount',
-                'runId',
-                'scenarioId',
-                'schemaVersion',
-                'status',
-                'target',
-            ], 'cleanup/response');
-            validateRelease(body.release, input.plan.release, 'cleanup/response/release');
-            onlyKeys(body.target, ['accountFingerprint', 'endpoint', 'region', 'slice'], 'cleanup/response/target');
-            if (!response.ok ||
-                body.kind !== 'ebk-protected-load-cleanup-result' ||
-                body.hmacKeyId !== input.hmacKey.id ||
-                body.planMaterialDigest !== input.plan.materialDigest ||
-                typeof body.remainingEffectCount !== 'number' ||
-                !Number.isSafeInteger(body.remainingEffectCount) ||
-                body.remainingEffectCount !== 0 ||
-                typeof body.removedEffectCount !== 'number' ||
-                !Number.isSafeInteger(body.removedEffectCount) ||
-                body.removedEffectCount < 0 ||
-                body.runId !== input.plan.runId ||
-                body.scenarioId !== input.plan.scenarioId ||
-                body.schemaVersion !== 1 ||
-                body.status !== 'run-absent' ||
-                JSON.stringify(body.target) !==
-                    JSON.stringify({
-                        accountFingerprint: input.plan.target.accountFingerprint,
-                        endpoint: scenarioUrl(input.plan, cleanupPath(adapter)),
-                        region: input.plan.target.region,
-                        slice: input.plan.slice,
-                    })) {
-                throw invalid('cleanup/response', 'must prove every protected effect for the exact run is absent');
+                const { body, response } = await Promise.race([request, expired]);
+                onlyKeys(body, [
+                    'kind',
+                    'hmacKeyId',
+                    'planMaterialDigest',
+                    'release',
+                    'remainingEffectCount',
+                    'removedEffectCount',
+                    'runId',
+                    'scenarioId',
+                    'schemaVersion',
+                    'status',
+                    'target',
+                ], 'cleanup/response');
+                validateRelease(body.release, input.plan.release, 'cleanup/response/release');
+                onlyKeys(body.target, ['accountFingerprint', 'endpoint', 'region', 'slice'], 'cleanup/response/target');
+                const incomplete = body.status === 'cleanup-in-progress' &&
+                    body.remainingEffectCount === null;
+                if (!response.ok ||
+                    body.kind !== 'ebk-protected-load-cleanup-result' ||
+                    body.hmacKeyId !== input.hmacKey.id ||
+                    body.planMaterialDigest !== input.plan.materialDigest ||
+                    (!incomplete && body.remainingEffectCount !== 0) ||
+                    typeof body.removedEffectCount !== 'number' ||
+                    !Number.isSafeInteger(body.removedEffectCount) ||
+                    body.removedEffectCount < (incomplete ? 1 : 0) ||
+                    body.removedEffectCount > input.plan.maximumRequests - removedSoFar ||
+                    body.runId !== input.plan.runId ||
+                    body.scenarioId !== input.plan.scenarioId ||
+                    body.schemaVersion !== 1 ||
+                    (!incomplete && body.status !== 'run-absent') ||
+                    JSON.stringify(body.target) !==
+                        JSON.stringify({
+                            accountFingerprint: input.plan.target.accountFingerprint,
+                            endpoint: scenarioUrl(input.plan, cleanupPath(adapter)),
+                            region: input.plan.target.region,
+                            slice: input.plan.slice,
+                        })) {
+                    throw invalid('cleanup/response', 'must prove every protected effect for the exact run is absent');
+                }
+                removedSoFar += body.removedEffectCount;
+                if (incomplete)
+                    continue;
+                remoteCleanup = 'run-proved-absent';
+                break;
+            }
+            catch (error) {
+                throw invalid('cleanup', `did not prove the exact protected run absent (${error instanceof Error ? error.message : String(error)})`);
+            }
+            finally {
+                if (timeout !== undefined)
+                    clearTimeout(timeout);
             }
-            remoteCleanup = 'run-proved-absent';
-        }
-        catch (error) {
-            throw invalid('cleanup', `did not prove the exact protected run absent (${error instanceof Error ? error.message : String(error)})`);
-        }
-        finally {
-            if (timeout !== undefined)
-                clearTimeout(timeout);
         }
     }
     const unsigned = {

package/src/repository-policy/deployment-plan.d.ts

@@ -1,4 +1,4 @@
-import type { DeploymentAccountTopology, DeploymentProfile, ProductionApprovalMode, ProductionFoundationProfile, RepositoryOperatingPolicy } from './policy.js';
+import type { ConfiguredDeploymentAccounts, DeploymentProfile, ProductionApprovalMode, ProductionFoundationProfile, RepositoryOperatingPolicy } from './policy.js';
 export declare const PROTECTED_DEPLOYMENT_ACTIONS: readonly ["deploy", "refresh", "remove", "unlock"];
 export declare const PROTECTED_DEPLOYMENT_STAGES: readonly ["staging", "production"];
 export type ProtectedDeploymentAction = (typeof PROTECTED_DEPLOYMENT_ACTIONS)[number];
@@ -10,7 +10,7 @@ export interface DeploymentPlanProject {
 }
 export interface ProtectedDeploymentPlan {
     action: ProtectedDeploymentAction;
-    deploymentAccounts: DeploymentAccountTopology;
+    deploymentAccounts: ConfiguredDeploymentAccounts;
     deploymentProfile: DeploymentProfile;
     deploymentRegion: string;
     effectiveProductionProfile?: ProductionFoundationProfile;

package/src/repository-policy/deployment-plan.js

@@ -20,7 +20,8 @@ function compareCodePoints(left, right) {
     return left.name < right.name ? -1 : left.name > right.name ? 1 : 0;
 }
 function createProtectedDeploymentPlan(policy, options) {
-    const deploymentAccounts = (0, policy_js_1.configuredDeploymentAccountTopology)(policy.deploymentProfile, policy.deploymentAccounts);
+    (0, policy_js_1.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, options.stage);
+    const deploymentAccounts = { ...policy.deploymentAccounts };
     const deploymentRegion = (0, policy_js_1.configuredDeploymentRegion)(policy.deploymentRegion);
     const foundations = options.projects.filter((project) => hasTag(project, 'scope:foundation') &&
         supportsAction(project, options.action));

package/src/repository-policy/policy.js

@@ -137,10 +137,35 @@ function configuredDeploymentAccountTopology(profile, accounts) {
         staging: accounts.staging,
     });
 }
+function validateConfiguredIsolatedAccounts(accounts) {
+    const configured = new Set();
+    for (const stage of ['development', 'staging', 'production']) {
+        const account = accounts[stage];
+        if (account === null)
+            continue;
+        if (typeof account !== 'string' || !/^\d{12}$/.test(account)) {
+            throw new Error(`Deployment account for ${stage} must be null or an exact 12-digit AWS account ID.`);
+        }
+        if (configured.has(account)) {
+            throw new Error('The fully-isolated deployment profile requires distinct configured AWS accounts.');
+        }
+        configured.add(account);
+    }
+}
 function configuredDeploymentAccountForStage(profile, accounts, stage) {
     if (!isActiveDeploymentStage(profile, stage)) {
         throw new Error(`Deployment stage ${stage} is inactive for the ${profile} deployment profile.`);
     }
+    // Fresh isolated accounts can be provisioned independently. This does not
+    // relax production rehearsal or migrated-workspace tuple requirements.
+    if (profile === 'fully-isolated' && stage !== 'production') {
+        validateConfiguredIsolatedAccounts(accounts);
+        const account = accounts[stage];
+        if (account === null) {
+            throw new Error(`Deployment account for active stage ${stage} is not configured.`);
+        }
+        return account;
+    }
     const topology = configuredDeploymentAccountTopology(profile, accounts);
     const account = topology[stage];
     if (account === null) {
@@ -330,6 +355,18 @@ function validateRepositoryOperatingPolicy(value) {
                 });
             }
         }
+        if (value.deploymentProfile === 'fully-isolated' &&
+            Object.values(value.deploymentAccounts).some((account) => account === null)) {
+            try {
+                validateConfiguredIsolatedAccounts(value.deploymentAccounts);
+            }
+            catch (error) {
+                issues.push({
+                    message: error instanceof Error ? error.message : String(error),
+                    path: 'policy.deploymentAccounts',
+                });
+            }
+        }
         if (isOneOf(value.deploymentProfile, exports.DEPLOYMENT_PROFILES) &&
             typeof value.deploymentAccounts.development === 'string' &&
             typeof value.deploymentAccounts.production === 'string' &&
@@ -599,9 +636,7 @@ function createIncubationRepositoryPolicy(deploymentProfile = 'starter', workspa
         productionAccess: 'disabled',
         productionApproval: { mode: 'promotion-pr' },
         productionFoundation: {
-            profile: deploymentProfile === 'starter'
-                ? 'cost-optimized'
-                : exports.DEFAULT_RECOVERY_PRODUCTION_FOUNDATION_PROFILE,
+            profile: 'cost-optimized',
         },
         schemaVersion: exports.REPOSITORY_POLICY_SCHEMA_VERSION,
         slices: {},

package/src/schemas/blueprint-v1.json

@@ -13,15 +13,16 @@
         "capabilities": {
           "items": {
             "enum": [
-              "network",
+              "key-value",
               "routing",
-              "container-compute",
-              "postgres",
               "identity",
               "events",
               "observability",
               "configuration",
-              "deployment"
+              "deployment",
+              "network",
+              "container-compute",
+              "postgres"
             ],
             "type": "string"
           },

package/src/schemas/foundation-requirement-v1.json

@@ -6,15 +6,16 @@
     "capabilities": {
       "items": {
         "enum": [
-          "network",
+          "key-value",
           "routing",
-          "container-compute",
-          "postgres",
           "identity",
           "events",
           "observability",
           "configuration",
-          "deployment"
+          "deployment",
+          "network",
+          "container-compute",
+          "postgres"
         ],
         "type": "string"
       },

package/src/schemas/testing-evidence-result-v1.json

@@ -254,7 +254,7 @@
           }
         },
         "commit": {
-          "type": "string",
+          "type": ["string", "null"],
           "pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$"
         },
         "frameworkCandidate": {

package/src/secrets/operator.d.ts

@@ -1,3 +1,4 @@
+import { AwsGeneratedSecretInitializationError } from './generated-aws-control-plane.js';
 import { type SecretMetadataFinding, type SecretMetadataMutationIntent, type SecretMetadataPreflightResult, type SecretMetadataReconciliationResult } from './metadata.js';
 import { type ObservedSecretMetadata, type SecretManagementScope, type SecretMetadataDeclaration } from './model.js';
 export interface ListedSecretContainer {
@@ -82,8 +83,9 @@ export interface ProtectedSecretOperatorAuthorization {
 export type SecretProtectedLifecycleAction = 'deploy' | 'recover' | 'remove' | 'unlock';
 export declare class SecretOperatorControlPlaneError extends Error {
     readonly operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag';
+    readonly diagnosticCode?: AwsGeneratedSecretInitializationError['code'];
     readonly code: 'secret-control-plane-apply-failed' | 'secret-control-plane-inventory-failed' | 'secret-control-plane-inventory-invalid' | 'secret-control-plane-protected-action-failed';
-    constructor(code: SecretOperatorControlPlaneError['code'], operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag');
+    constructor(code: SecretOperatorControlPlaneError['code'], operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag', diagnosticCode?: AwsGeneratedSecretInitializationError['code']);
 }
 export interface SecretMetadataOperatorResult {
     after?: SecretMetadataReconciliationResult;

package/src/secrets/operator.js

@@ -7,14 +7,18 @@ exports.runSecretDeployPreflight = runSecretDeployPreflight;
 exports.runGeneratedSecretRetirement = runGeneratedSecretRetirement;
 exports.runProtectedSecretLifecycle = runProtectedSecretLifecycle;
 const deterministic_order_js_1 = require("../deterministic-order.js");
+const generated_aws_control_plane_js_1 = require("./generated-aws-control-plane.js");
 const metadata_js_1 = require("./metadata.js");
 const model_js_1 = require("./model.js");
 class SecretOperatorControlPlaneError extends Error {
     operation;
+    diagnosticCode;
     code;
-    constructor(code, operation) {
-        super(`Secret metadata ${operation} failed (${code}).`);
+    constructor(code, operation, diagnosticCode) {
+        super(`Secret metadata ${operation} failed (${code}).` +
+            (diagnosticCode ? ` Reason: ${diagnosticCode}.` : ''));
         this.operation = operation;
+        this.diagnosticCode = diagnosticCode;
         this.name = 'SecretOperatorControlPlaneError';
         this.code = code;
     }
@@ -28,6 +32,19 @@ function safeControlPlaneError(error, code, operation) {
     if (error instanceof SecretOperatorControlPlaneError) {
         return error;
     }
+    // Preserve only our finite, value-blind diagnostic vocabulary. Never attach
+    // the raw SDK error, message, stack, request or cause: they may hold values.
+    if (error instanceof generated_aws_control_plane_js_1.AwsGeneratedSecretInitializationError) {
+        const diagnosticCode = Object.getOwnPropertyDescriptor(error, 'code')?.value;
+        switch (diagnosticCode) {
+            case 'generated-secret-input-invalid':
+            case 'generated-secret-observation-invalid':
+            case 'generated-secret-read-failed':
+            case 'generated-secret-state-conflicting':
+            case 'generated-secret-write-failed':
+                return new SecretOperatorControlPlaneError(code, operation, diagnosticCode);
+        }
+    }
     return new SecretOperatorControlPlaneError(code, operation);
 }
 async function collectSecretMetadata(controlPlane, scope, options = {}) {
@@ -316,7 +333,9 @@ async function runGeneratedSecretInitializer(input) {
         throw safeControlPlaneError(error, 'secret-control-plane-inventory-failed', 'initialize-generated');
     }
     if (finalInspection !== 'current') {
-        throw new SecretOperatorControlPlaneError('secret-control-plane-apply-failed', 'initialize-generated');
+        throw new SecretOperatorControlPlaneError('secret-control-plane-apply-failed', 'initialize-generated', finalInspection === 'conflicting'
+            ? 'generated-secret-state-conflicting'
+            : 'generated-secret-observation-invalid');
     }
     // The exact-name control-plane inspection above is the postcondition.
     // ListSecrets is eventually consistent and can omit a newly created secret

package/src/sst-environment-source-format.d.ts

@@ -1,3 +1,6 @@
+/** Exact default declaration emitted by the pinned Next 16.3 toolchain. */
+export declare function generatedNextEnvironmentSource(dev?: boolean): string;
+export declare function isExactGeneratedNextEnvironmentSourceBytes(bytes: Buffer): boolean;
 export declare function isExactGeneratedRootSstEnvironmentSourceBytes(bytes: Buffer): boolean;
 export declare function isExactGeneratedRootSstPythonSourceBytes(bytes: Buffer): boolean;
 export declare function exactGeneratedNestedSstEnvironmentSourceBytes(nestedPath: string, rootSourcePath: string): readonly Buffer[];

package/src/sst-environment-source-format.js

@@ -1,9 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatedNextEnvironmentSource = generatedNextEnvironmentSource;
+exports.isExactGeneratedNextEnvironmentSourceBytes = isExactGeneratedNextEnvironmentSourceBytes;
 exports.isExactGeneratedRootSstEnvironmentSourceBytes = isExactGeneratedRootSstEnvironmentSourceBytes;
 exports.isExactGeneratedRootSstPythonSourceBytes = isExactGeneratedRootSstPythonSourceBytes;
 exports.exactGeneratedNestedSstEnvironmentSourceBytes = exactGeneratedNestedSstEnvironmentSourceBytes;
 const node_path_1 = require("node:path");
+/** Exact default declaration emitted by the pinned Next 16.3 toolchain. */
+function generatedNextEnvironmentSource(dev = false) {
+    const directory = dev ? '.next/dev' : '.next';
+    return `/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./${directory}/types/routes.d.ts";
+import "./${directory}/types/root-params.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+`;
+}
+function isExactGeneratedNextEnvironmentSourceBytes(bytes) {
+    return [false, true].some((dev) => [
+        generatedNextEnvironmentSource(dev),
+        generatedNextEnvironmentSource(dev).split('\n').join('\r\n'),
+    ].some((source) => bytes.equals(Buffer.from(source))));
+}
 const GENERATED_HEADER = [
     '/* This file is auto-generated by SST. Do not edit. */',
     '/* tslint:disable */',

package/src/supply-chain/blueprint-trust-git.js

@@ -898,6 +898,17 @@ function repositoryRootCommit(context, tip) {
 }
 function assertCreateOnlyReceiptRetention(context, receiptCommit, executionCommit, paths) {
     const parents = commitParents(context, receiptCommit);
+    // Generated repository governance retains proposals through merge commits.
+    // Admit that exact shape, not arbitrary ancestry or an updated execution base.
+    const proposal = parents.length === 2 ? parents[1] : undefined;
+    const proposalParents = proposal ? commitParents(context, proposal) : [];
+    const exactRetentionShape = parents[0] === executionCommit &&
+        (parents.length === 1 ||
+            (proposal !== undefined &&
+                proposalParents.length === 1 &&
+                proposalParents[0] === executionCommit &&
+                treeObjectId(context, receiptCommit) ===
+                    treeObjectId(context, proposal)));
     const changedPaths = (git(context, [
         'diff-tree',
         '-r',
@@ -913,15 +924,14 @@ function assertCreateOnlyReceiptRetention(context, receiptCommit, executionCommi
         .map((changedPath) => safeTrackedRepositoryPath(changedPath, 'git.blueprintVerificationReceiptRetention.changedPath'))
         .sort();
     const retainedPaths = [...paths].sort();
-    if (parents.length !== 1 ||
-        parents[0] !== executionCommit ||
+    if (!exactRetentionShape ||
         retainedPaths.length === 0 ||
         retainedPaths.length !== changedPaths.length ||
         retainedPaths.some((path, index) => path !== changedPaths[index]) ||
         retainedPaths.some((path) => !VERIFICATION_RECEIPT_PATH.test(path) ||
             blobObjectId(context, executionCommit, path) !== undefined ||
             blobObjectId(context, receiptCommit, path) === undefined)) {
-        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${receiptCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'protected Blueprint verification receipt retention must be one literal one-parent, receipt-only, create-only commit whose parent is the exact execution commit shared by the complete final set, whose parent tree lacks every retained receipt path in that set, and whose changed paths equal that set');
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${receiptCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'protected Blueprint verification receipt retention must be one receipt-only, create-only commit whose first parent is the exact execution commit shared by the complete final set; a two-parent PR merge must retain the exact tree of a one-parent proposal directly on that same execution commit. The execution tree must lack every retained receipt path and the changed paths must equal the complete set');
     }
 }
 function latestReceiptSetCommit(context, tip, paths, label) {

package/src/supply-chain/build-output.js

@@ -233,6 +233,7 @@ function createNextJsBuildOutputInventory(input) {
     const files = new Map();
     const links = new Map();
     const materialFiles = new Map();
+    const compilerCacheDirectories = new Set();
     let visitedDirectories = 0;
     let discoveredBytes = 0;
     const addLink = (absoluteInput, pointer) => {
@@ -347,6 +348,15 @@ function createNextJsBuildOutputInventory(input) {
         catch {
             throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'does not identify an existing build-output material path');
         }
+        // Only Next's direct compiler cache is outside emitted build material.
+        // Traces are still resolved through addFile, so a runtime reference into
+        // this directory cannot escape the normal bounds or content inventory.
+        if (compilerCacheDirectories.has(absolute)) {
+            if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+                throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'Next.js compiler cache must be a real directory');
+            }
+            return;
+        }
         if (metadata.isSymbolicLink()) {
             addLink(absolute, pointer);
             return;
@@ -372,6 +382,11 @@ function createNextJsBuildOutputInventory(input) {
     if (materialPaths.some(({ path }, index) => materialPaths.some(({ path: other }, otherIndex) => index !== otherIndex && other.startsWith(`${path}/`)))) {
         throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'materialPaths', 'must contain disjoint non-overlapping build-output boundaries');
     }
+    for (const { absolute } of materialPaths) {
+        if ((0, node_path_1.basename)(absolute) === '.next') {
+            compilerCacheDirectories.add((0, node_path_1.join)(absolute, 'cache'));
+        }
+    }
     materialPaths.forEach(({ absolute }, index) => visitMaterial(absolute, `materialPaths[${index}]`));
     const traces = [...materialFiles.values()].filter(({ path }) => path.endsWith('.nft.json'));
     if (traces.length === 0) {

package/src/supply-chain/generated-blueprint-trust-command.js

@@ -774,9 +774,26 @@ function preflightRetainedReceiptPaths(paths) {
   }
 }
 
+function serializeRetainedReceipt(receipt) {
+  let output = JSON.stringify(receipt, null, 2);
+  // These are the receipt schema's only primitive-array fields. Match the
+  // generated JSON format without loading mutable workspace formatter code or
+  // configuration in this protected execution child. Object arrays stay multiline.
+  for (const field of ['containerRegistries', 'verificationRoots']) {
+    const values = receipt[field];
+    const compact = '  ' + JSON.stringify(field) + ': [' +
+      values.map((value) => JSON.stringify(value)).join(', ') + ']';
+    if (compact.length + 1 <= 80) {
+      const expanded = JSON.stringify({ [field]: values }, null, 2).slice(2, -2);
+      output = output.replace(expanded, compact);
+    }
+  }
+  return output + '\n';
+}
+
 function writeRetainedReceipts(receipts) {
   const prepared = receipts.map(({ reference, receipt }) => {
-    const output = JSON.stringify(receipt, null, 2) + '\n';
+    const output = serializeRetainedReceipt(receipt);
     if (Buffer.byteLength(output, 'utf8') > MAX_OUTPUT_BYTES) {
       throw receiptRetentionError(
         'Blueprint verification receipt exceeds 256 KiB.',

package/src/testing-evidence/fixture-scope.d.ts

@@ -8,7 +8,8 @@ export interface LocalTestIsolationCapabilities {
 }
 export interface LocalTestScopeIdentity {
     attempt: number;
-    commit: string;
+    /** Null is an unborn local development worktree, not a deployed identity. */
+    commit: string | null;
     runId: string;
     seed: string;
     stage: string;

package/src/testing-evidence/fixture-scope.js

@@ -30,7 +30,9 @@ function isCanonicalTimestamp(value) {
 function requireIdentity(value) {
     if (!slugPattern.test(value.workspace) ||
         !slugPattern.test(value.stage) ||
-        !commitPattern.test(value.commit) ||
+        (value.commit === null
+            ? value.stage !== 'development'
+            : !commitPattern.test(value.commit)) ||
         !seedPattern.test(value.runId) ||
         !seedPattern.test(value.seed) ||
         !Number.isSafeInteger(value.attempt) ||
@@ -59,7 +61,7 @@ function createLocalTestScope(options) {
         .update([
         identity.workspace,
         identity.stage,
-        identity.commit,
+        identity.commit ?? 'unborn-local-worktree',
         identity.runId,
         String(identity.attempt),
         String(identity.worker),

package/src/testing-evidence/result.d.ts

@@ -18,7 +18,8 @@ export interface TestingEvidenceSource {
      * relationship rather than this result contract.
      */
     blueprintCandidates: readonly string[];
-    commit: string;
+    /** Null denotes an unborn local worktree, never committed or deployed proof. */
+    commit: string | null;
     frameworkCandidate: string;
 }
 export interface TestingEvidenceOperation {