@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/executors/local-deploy/local-deploy.js

@@ -0,0 +1,1404 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.localWorkingTreeDigest = localWorkingTreeDigest;
+exports.deployedSourceCommit = deployedSourceCommit;
+exports.localDeploymentProjectOrder = localDeploymentProjectOrder;
+exports.runLocalDeploy = runLocalDeploy;
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const devkit_1 = require("@nx/devkit");
+const client_sts_1 = require("@aws-sdk/client-sts");
+const index_js_1 = require("../../aws-authority/index.js");
+const capacity_migration_js_1 = require("../../repository-policy/capacity-migration.js");
+const affected_lifecycle_js_1 = require("../../workspace-deployment/affected-lifecycle.js");
+const child_environment_js_1 = require("../../aws/child-environment.js");
+const identity_js_1 = require("../../aws/identity.js");
+const index_js_2 = require("../../repository-policy/index.js");
+const production_database_safeguard_js_1 = require("../foundation-profile-preflight/production-database-safeguard.js");
+const private_state_js_1 = require("../../local-dev/private-state.js");
+const federated_credential_transport_js_1 = require("./federated-credential-transport.js");
+const local_approval_js_1 = require("./local-approval.js");
+const container_release_js_1 = require("../../supply-chain/container-release.js");
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+const index_js_3 = require("../../workspace-deployment/index.js");
+const private_smoke_access_js_1 = require("../../foundation/private-smoke-access.js");
+const local_private_smoke_access_js_1 = require("../../foundation/local-private-smoke-access.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const sst_environment_source_js_1 = require("../sst-lifecycle/sst-environment-source.js");
+const SHA = /^[a-f0-9]{40,64}$/u;
+const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/u;
+const MAX_LOCAL_RELEASE_CANDIDATE_FILE_BYTES = 64 * 1024;
+const MAX_LOCAL_RELEASE_ARTIFACTS_BYTES = 64 * 1024 * 1024;
+const MAX_LOCAL_RELEASE_CANDIDATE_FILES = 32;
+const MAX_LOCAL_RELEASE_CANDIDATE_BYTES = MAX_LOCAL_RELEASE_ARTIFACTS_BYTES +
+    (MAX_LOCAL_RELEASE_CANDIDATE_FILES - 1) *
+        MAX_LOCAL_RELEASE_CANDIDATE_FILE_BYTES;
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
+}
+function git(root, args, run) {
+    const result = run('git', args, {
+        cwd: root,
+        encoding: 'utf8',
+        env: process.env,
+        maxBuffer: 32 * 1024 * 1024,
+        shell: false,
+    });
+    if (result.status !== 0) {
+        throw new Error(`Local deployment Git preflight failed: ${String(result.stderr).trim()}`);
+    }
+    return String(result.stdout);
+}
+function confinedWorkspacePath(root, candidate) {
+    if (!candidate || (0, node_path_1.isAbsolute)(candidate) || candidate.includes('\0')) {
+        throw new Error('Working-tree inventory contains an invalid path.');
+    }
+    const absolute = (0, node_path_1.join)(root, candidate);
+    const confined = (0, node_path_1.relative)(root, absolute);
+    if (confined === '..' || confined.startsWith('../') || (0, node_path_1.isAbsolute)(confined)) {
+        throw new Error('Working-tree inventory escapes the workspace.');
+    }
+    return absolute;
+}
+/** Bind a development deployment to the exact tracked diff and untracked
+ * source bytes without requiring a commit. Ignored caches and build output are
+ * intentionally outside this identity. */
+function localWorkingTreeDigest(root, run = node_child_process_1.spawnSync) {
+    const commit = git(root, ['rev-parse', 'HEAD'], run).trim();
+    if (!SHA.test(commit)) {
+        throw new Error('Local deployment could not resolve one exact Git HEAD.');
+    }
+    const status = git(root, ['status', '--porcelain=v1', '--untracked-files=all'], run);
+    const trackedDiff = git(root, ['diff', '--binary', 'HEAD'], run);
+    const untracked = git(root, ['ls-files', '--others', '--exclude-standard', '-z'], run)
+        .split('\0')
+        .filter(Boolean)
+        .sort();
+    const hash = (0, node_crypto_1.createHash)('sha256');
+    hash.update('ebk-working-tree-v1\0');
+    hash.update(commit);
+    hash.update('\0');
+    hash.update(status);
+    hash.update('\0');
+    hash.update(trackedDiff);
+    hash.update('\0');
+    for (const path of untracked) {
+        const absolute = confinedWorkspacePath(root, path);
+        const stat = (0, node_fs_1.lstatSync)(absolute);
+        hash.update(path);
+        hash.update('\0');
+        if (stat.isSymbolicLink()) {
+            hash.update('symlink\0');
+            hash.update((0, node_fs_1.readlinkSync)(absolute));
+        }
+        else if (stat.isFile()) {
+            hash.update('file\0');
+            hash.update((0, node_fs_1.readFileSync)(absolute));
+        }
+        else {
+            throw new Error(`Untracked deployment source ${path} is not a regular file or symbolic link.`);
+        }
+        hash.update('\0');
+    }
+    return { clean: status === '', commit, digest: hash.digest('hex') };
+}
+function assertDeploymentSourceUnchanged(root, expected, run) {
+    const current = localWorkingTreeDigest(root, run);
+    if (current.clean !== expected.clean ||
+        current.commit !== expected.commit ||
+        current.digest !== expected.workingTreeDigest) {
+        throw new Error('Deployment source changed after lifecycle authority was established; downstream execution is blocked.');
+    }
+}
+function projectDescriptors(context) {
+    return Object.entries(context.projectsConfigurations?.projects ?? {}).map(([name, configuration]) => ({
+        name,
+        root: configuration.root,
+        tags: configuration.tags ?? [],
+        targets: configuration.targets ?? {},
+    }));
+}
+function supportsTarget(project, target) {
+    return Object.prototype.hasOwnProperty.call(project.targets, target);
+}
+const LOCAL_CONTAINER_TARGETS = Object.freeze([
+    'release-candidate',
+    'container-release-amd64',
+    'container-release-arm64',
+    'container-release-assemble',
+]);
+function requiresLocalContainerPreparation(profile, stage) {
+    return ((profile === 'starter' && stage === 'production') ||
+        (profile === 'production-isolated' && stage === 'staging'));
+}
+function confinedEvidenceSegments(root, candidate) {
+    const confined = (0, node_path_1.relative)(root, candidate);
+    if (confined === '' ||
+        confined === '..' ||
+        confined.startsWith(`..${node_path_1.sep}`) ||
+        (0, node_path_1.isAbsolute)(confined)) {
+        throw new Error('Local container evidence path escapes the workspace.');
+    }
+    const segments = confined.split(node_path_1.sep);
+    if (segments.some((segment) => segment === '' ||
+        segment === '.' ||
+        segment === '..' ||
+        segment.includes('\0'))) {
+        throw new Error('Local container evidence path is invalid.');
+    }
+    return segments;
+}
+function assertSafeEvidenceTree(path) {
+    let entries = 0;
+    const visit = (directory) => {
+        for (const entry of (0, node_fs_1.readdirSync)(directory, { withFileTypes: true })) {
+            entries += 1;
+            if (entries > 4096) {
+                throw new Error('Local container evidence tree is unexpectedly large.');
+            }
+            const child = (0, node_path_1.join)(directory, entry.name);
+            const identity = (0, node_fs_1.lstatSync)(child);
+            if (identity.isSymbolicLink()) {
+                throw new Error('Local container evidence cleanup refuses symbolic links.');
+            }
+            if (identity.isDirectory()) {
+                visit(child);
+            }
+            else if (!identity.isFile()) {
+                throw new Error('Local container evidence cleanup accepts only regular files and directories.');
+            }
+        }
+    };
+    visit(path);
+}
+function removeExactLocalEvidenceDirectory(root, path) {
+    const segments = confinedEvidenceSegments(root, path);
+    let current = root;
+    const rootIdentity = (0, node_fs_1.lstatSync)(current);
+    if (!rootIdentity.isDirectory() || rootIdentity.isSymbolicLink()) {
+        throw new Error('Local deployment workspace root is absent or unsafe.');
+    }
+    for (const segment of segments) {
+        current = (0, node_path_1.join)(current, segment);
+        if (!(0, node_fs_1.existsSync)(current))
+            return;
+        const identity = (0, node_fs_1.lstatSync)(current);
+        if (!identity.isDirectory() || identity.isSymbolicLink()) {
+            throw new Error('Local container evidence cleanup encountered an unsafe path.');
+        }
+    }
+    assertSafeEvidenceTree(current);
+    (0, node_fs_1.rmSync)(current, { recursive: true });
+}
+function ensurePrivateEvidenceDirectory(root, path) {
+    const segments = confinedEvidenceSegments(root, path);
+    let current = root;
+    for (const segment of segments) {
+        current = (0, node_path_1.join)(current, segment);
+        if ((0, node_fs_1.existsSync)(current)) {
+            const identity = (0, node_fs_1.lstatSync)(current);
+            if (!identity.isDirectory() || identity.isSymbolicLink()) {
+                throw new Error('Local container evidence directory encountered an unsafe path.');
+            }
+        }
+        (0, private_state_js_1.ensurePrivateDirectory)(current);
+    }
+}
+function resetLocalContainerWorkingEvidence(input) {
+    const projectRoot = confinedWorkspacePath(input.root, input.project.root);
+    for (const path of [
+        (0, node_path_1.join)(projectRoot, '.ebk', 'evidence', 'release-candidate'),
+        (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'release-candidate', 'packages', input.project.name),
+        (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'container-release', 'partials', input.stage, input.project.name),
+        (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'container-release', input.stage, 'packages', input.project.name),
+    ]) {
+        removeExactLocalEvidenceDirectory(input.root, path);
+    }
+}
+/** Materialize the same bounded workspace-level candidate layout restored by
+ * protected GitHub deployment. The generated container helper and SST image
+ * resolver both consume this exact path. */
+function materializeLocalReleaseCandidate(input) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(input.project.name)) {
+        throw new Error(`Local container release project ${input.project.name} has an unsafe evidence identity.`);
+    }
+    const projectRoot = confinedWorkspacePath(input.root, input.project.root);
+    const source = (0, node_path_1.join)(projectRoot, '.ebk', 'evidence', 'release-candidate');
+    const sourceIdentity = (0, node_fs_1.lstatSync)(source);
+    if (!sourceIdentity.isDirectory() || sourceIdentity.isSymbolicLink()) {
+        throw new Error(`Local release candidate for ${input.project.name} is absent or unsafe.`);
+    }
+    const entries = (0, node_fs_1.readdirSync)(source, { withFileTypes: true }).sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+    if (entries.length === 0 ||
+        entries.length > MAX_LOCAL_RELEASE_CANDIDATE_FILES ||
+        entries.some((entry) => !entry.isFile() ||
+            entry.isSymbolicLink() ||
+            !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}\.json$/u.test(entry.name))) {
+        throw new Error(`Local release candidate for ${input.project.name} has an invalid file inventory.`);
+    }
+    let totalBytes = 0;
+    const files = entries.map(({ name }) => {
+        const path = (0, node_path_1.join)(source, name);
+        const identity = (0, node_fs_1.lstatSync)(path);
+        const maximumBytes = name === 'release-artifacts.json'
+            ? MAX_LOCAL_RELEASE_ARTIFACTS_BYTES
+            : MAX_LOCAL_RELEASE_CANDIDATE_FILE_BYTES;
+        if (!identity.isFile() ||
+            identity.isSymbolicLink() ||
+            identity.size <= 0 ||
+            identity.size > maximumBytes) {
+            throw new Error(`Local release candidate file ${input.project.name}/${name} is absent or unsafe.`);
+        }
+        totalBytes += identity.size;
+        return { name, path };
+    });
+    if (totalBytes > MAX_LOCAL_RELEASE_CANDIDATE_BYTES) {
+        throw new Error(`Local release candidate for ${input.project.name} exceeds the bounded inventory size.`);
+    }
+    const candidateFiles = files.map(({ name, path }) => ({
+        contents: (0, node_fs_1.readFileSync)(path),
+        name,
+    }));
+    const candidateFile = candidateFiles.find(({ name }) => name === 'candidate.json');
+    let candidate;
+    try {
+        candidate = JSON.parse(candidateFile?.contents.toString('utf8') ?? '');
+    }
+    catch {
+        throw new Error(`Local release candidate for ${input.project.name} is invalid JSON.`);
+    }
+    if (candidate.kind !== 'ebk-release-candidate' ||
+        candidate.schemaVersion !== 1 ||
+        candidate.slice !== input.project.name ||
+        candidate.sourceCommit !== input.sourceCommit) {
+        throw new Error(`Local release candidate for ${input.project.name} differs from the exact deployment source.`);
+    }
+    const destination = (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'release-candidate', 'packages', input.project.name);
+    removeExactLocalEvidenceDirectory(input.root, destination);
+    ensurePrivateEvidenceDirectory(input.root, destination);
+    for (const { contents, name } of candidateFiles) {
+        if (name === 'release-artifacts.json') {
+            (0, private_state_js_1.atomicWritePrivateFileWithMaximumBytes)((0, node_path_1.join)(destination, name), contents, MAX_LOCAL_RELEASE_ARTIFACTS_BYTES);
+        }
+        else {
+            (0, private_state_js_1.atomicWritePrivateFile)((0, node_path_1.join)(destination, name), contents);
+        }
+    }
+}
+function attestLocalContainerBinding(input) {
+    const path = (0, node_path_1.join)(input.root, '.ebk', 'evidence', 'container-release', input.stage, 'packages', input.project.name, 'binding.json');
+    const identity = (0, node_fs_1.lstatSync)(path);
+    if (!identity.isFile() ||
+        identity.isSymbolicLink() ||
+        identity.size <= 0 ||
+        identity.size > 64 * 1024 * 1024) {
+        throw new Error(`Local protected container binding for ${input.project.name} is absent or unsafe.`);
+    }
+    const binding = (0, container_release_js_1.validateContainerReleaseBinding)(JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8')));
+    if (binding.accountId !== input.account ||
+        binding.region !== input.region ||
+        binding.slice !== input.project.name ||
+        binding.sourceCommit !== input.sourceCommit ||
+        binding.stage !== input.stage) {
+        throw new Error(`Local protected container binding for ${input.project.name} differs from the exact deployment authority.`);
+    }
+}
+/** Read only the bounded public outputs SST writes after a successful native
+ * deploy. This is post-operation smoke input, never preview or mutation
+ * authority. Stage and project identity prevent a stale output file from
+ * selecting another deployment. */
+function readDeployedSmokeTarget(workspaceRoot, project, stage) {
+    const projectRoot = confinedWorkspacePath(workspaceRoot, project.root);
+    const outputPath = (0, node_path_1.join)(projectRoot, '.sst', 'outputs.json');
+    const identity = (0, node_fs_1.lstatSync)(outputPath);
+    if (!identity.isFile() ||
+        identity.isSymbolicLink() ||
+        identity.size < 2 ||
+        identity.size > 64 * 1024) {
+        throw new Error(`Native SST outputs for ${project.name} are absent or unsafe.`);
+    }
+    const value = JSON.parse((0, node_fs_1.readFileSync)(outputPath, 'utf8'));
+    let api;
+    let web;
+    try {
+        api = new URL(String(value.apiUrl ?? ''));
+        web = new URL(String(value.webUrl ?? ''));
+    }
+    catch {
+        throw new Error(`Native SST outputs for ${project.name} contain invalid smoke URLs.`);
+    }
+    const credentialFreeHttps = (url) => url.protocol === 'https:' &&
+        !url.username &&
+        !url.password &&
+        !url.search &&
+        !url.hash;
+    if (value.name !== project.name ||
+        value.stage !== stage ||
+        !credentialFreeHttps(api) ||
+        !credentialFreeHttps(web) ||
+        api.pathname !== '/' ||
+        web.pathname.replace(/\/$/u, '') !== `/${project.name}` ||
+        !/^[a-z0-9]{1,128}$/u.test(String(value.authClientId ?? '')) ||
+        !/^[A-Za-z0-9_-]{1,128}_[A-Za-z0-9]{1,128}$/u.test(String(value.authUserPoolId ?? ''))) {
+        throw new Error(`Native SST outputs for ${project.name} do not match the deployed stage and smoke target.`);
+    }
+    return {
+        apiUrl: api.href,
+        clientId: String(value.authClientId),
+        userPoolId: String(value.authUserPoolId),
+        webUrl: web.href,
+    };
+}
+const GIT_SHA = /^[a-f0-9]{40,64}$/u;
+// A trunk promotion deploys the immutable artifacts built from the release
+// source (EBK_RELEASE_SOURCE_COMMIT, the staging-built head) while it runs
+// under the promotion commit. The deployed smoke must expect the build
+// identity the deployed Functions report, not the commit the workflow runs
+// under (EBK-INT-2026-086); receipts keep binding the promotion commit.
+function deployedSourceCommit(sourceCommit, environment = process.env) {
+    const release = environment.EBK_RELEASE_SOURCE_COMMIT ?? '';
+    return GIT_SHA.test(release) ? release : sourceCommit;
+}
+const RUN_NUMBER = /^[1-9][0-9]*$/u;
+/** Resolve which projects this deployment must touch. Anything that cannot be
+ * proven unchanged since the baseline receipt deploys; governing changes deploy
+ * everything. Local runs default to the full lifecycle. */
+function baselineRunIdentity(value) {
+    if (typeof value === 'number') {
+        return Number.isSafeInteger(value) && value >= 1 ? String(value) : '';
+    }
+    return value?.trim() ?? '';
+}
+function resolveLifecycleScope(input) {
+    const requestedMode = input.options.lifecycleScope === 'affected' ? 'affected' : 'full';
+    const receiptPath = input.options.baselineReceipt?.trim() ?? '';
+    // Nx parses digits-only arguments as numbers; the workflow passes the run
+    // id and attempt as digits (EBK-INT-2026-084).
+    const runId = baselineRunIdentity(input.options.baselineRunId);
+    const runAttempt = baselineRunIdentity(input.options.baselineRunAttempt);
+    const withoutBaseline = (reason) => ({
+        baseline: null,
+        mode: 'full',
+        projects: Object.fromEntries(input.orderedProjects.map((project) => [project, 'deploy'])),
+        reason,
+    });
+    if (requestedMode === 'full')
+        return withoutBaseline('requested-full');
+    if (receiptPath === '')
+        return withoutBaseline('no-baseline');
+    if ((0, node_path_1.isAbsolute)(receiptPath) === false && receiptPath.includes('..')) {
+        return withoutBaseline('baseline-path-rejected');
+    }
+    if (!RUN_NUMBER.test(runId) || !RUN_NUMBER.test(runAttempt)) {
+        return withoutBaseline('baseline-run-rejected');
+    }
+    let receipt;
+    try {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(receiptPath, 'utf8'));
+        receipt = validateBaselineReceipt(parsed);
+    }
+    catch (error) {
+        devkit_1.logger.warn(`[lifecycle-scope] baseline receipt rejected: ${error instanceof Error ? error.message : String(error)}`);
+        return withoutBaseline('baseline-receipt-rejected');
+    }
+    const baselineCommit = receipt.source.commit;
+    const git = (args) => input.run('git', args, {
+        cwd: input.context.root,
+        encoding: 'utf8',
+        maxBuffer: 16 * 1024 * 1024,
+    });
+    const ancestry = git([
+        'merge-base',
+        '--is-ancestor',
+        baselineCommit,
+        input.source.commit,
+    ]);
+    if (ancestry.status !== 0)
+        return withoutBaseline('baseline-not-ancestor');
+    const governing = git([
+        'diff',
+        '--name-only',
+        `${baselineCommit}..${input.source.commit}`,
+        '--',
+        ...affected_lifecycle_js_1.LIFECYCLE_GOVERNING_FILES,
+    ]);
+    if (governing.status !== 0)
+        return withoutBaseline('governing-diff-unavailable');
+    const changedGoverningFiles = String(governing.stdout)
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    const affected = input.run(process.execPath, [
+        (0, node_path_1.join)(input.context.root, 'node_modules', 'nx', 'dist', 'bin', 'nx.js'),
+        'show',
+        'projects',
+        '--affected',
+        `--base=${baselineCommit}`,
+        `--head=${input.source.commit}`,
+        '--json',
+    ], {
+        cwd: input.context.root,
+        encoding: 'utf8',
+        env: { ...process.env, NX_DAEMON: 'false' },
+        maxBuffer: 16 * 1024 * 1024,
+    });
+    let affectedProjects = null;
+    if (affected.status === 0) {
+        try {
+            const parsed = JSON.parse(String(affected.stdout));
+            affectedProjects = Array.isArray(parsed)
+                ? parsed.filter((entry) => typeof entry === 'string')
+                : null;
+        }
+        catch {
+            affectedProjects = null;
+        }
+    }
+    return (0, affected_lifecycle_js_1.selectLifecycleScope)({
+        affectedProjects,
+        baseline: { commit: baselineCommit, receipt, runAttempt, runId },
+        changedGoverningFiles,
+        frameworkVersion: input.frameworkVersion,
+        orderedProjects: input.orderedProjects,
+        requestedMode,
+        stage: input.options.stage,
+    });
+}
+function validateBaselineReceipt(value) {
+    const record = value;
+    if (!record ||
+        typeof record !== 'object' ||
+        Object.prototype.hasOwnProperty.call(record, 'selectedSlices') ||
+        record.kind !== 'ebk-deployment-receipt' ||
+        record.schemaVersion !== 1 ||
+        typeof record.outcome !== 'string' ||
+        typeof record.stage !== 'string' ||
+        typeof record.frameworkVersion !== 'string' ||
+        !record.source ||
+        typeof record.source !== 'object' ||
+        !GIT_SHA.test(String(record.source.commit ?? '')) ||
+        !Array.isArray(record.children) ||
+        record.children.some((child) => !child ||
+            typeof child !== 'object' ||
+            typeof child.project !== 'string' ||
+            typeof child.target !== 'string' ||
+            typeof child.outcome !== 'string')) {
+        throw new Error('Baseline deployment receipt is malformed.');
+    }
+    return {
+        children: record.children,
+        frameworkVersion: record.frameworkVersion,
+        outcome: record.outcome,
+        source: { commit: String(record.source.commit) },
+        stage: record.stage,
+    };
+}
+/** Determine the one native deployment order. Foundation is always first and
+ * production Slice admission remains a committed policy decision. */
+function localDeploymentProjectOrder(policy, context, stage, requestedSlices) {
+    if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
+        throw new Error(`Deployment stage ${stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
+    }
+    const projects = projectDescriptors(context);
+    const foundations = projects.filter((project) => project.tags.includes('scope:foundation') &&
+        supportsTarget(project, 'deploy'));
+    if (foundations.length !== 1) {
+        throw new Error(`Local deployment requires exactly one deployable Foundation; found ${foundations.length}.`);
+    }
+    const slices = projects
+        .filter((project) => project.tags.includes('type:slice') &&
+        supportsTarget(project, 'deploy'))
+        .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+    if (stage === 'production') {
+        const missing = slices
+            .filter(({ name }) => policy.slices[name] === undefined)
+            .map(({ name }) => name);
+        if (missing.length > 0) {
+            throw new Error(`Registered Product Slices lack an explicit production policy: ${missing.join(', ')}.`);
+        }
+    }
+    const eligibleSlices = stage === 'production'
+        ? slices.filter(({ name }) => {
+            const status = policy.slices[name]?.productionStatus;
+            return status === 'pilot' || status === 'ready';
+        })
+        : slices;
+    if (requestedSlices !== undefined &&
+        (!Array.isArray(requestedSlices) ||
+            requestedSlices.length === 0 ||
+            requestedSlices.length > 64 ||
+            new Set(requestedSlices).size !== requestedSlices.length ||
+            requestedSlices.some((name) => typeof name !== 'string' || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(name)))) {
+        throw new Error('Local deployment Slice selection must contain unique, bounded Slice names.');
+    }
+    for (const name of requestedSlices ?? []) {
+        if (!eligibleSlices.some((slice) => slice.name === name)) {
+            throw new Error(`Selected Slice ${name} is not deployable in ${stage}; inspect its project and committed production policy.`);
+        }
+    }
+    const selectedSlices = requestedSlices === undefined
+        ? eligibleSlices
+        : eligibleSlices.filter(({ name }) => requestedSlices.includes(name));
+    const selected = [
+        { kind: 'foundation', name: foundations[0]?.name ?? '' },
+        ...selectedSlices.map(({ name }) => ({ kind: 'slice', name })),
+    ];
+    const decision = (0, index_js_2.evaluateRepositoryPolicyRequest)(policy, {
+        action: 'deploy',
+        projects: selected,
+        stage,
+    });
+    if (!decision.allowed) {
+        throw new Error(`Repository Operating Policy rejected local deployment:\n${decision.reasons.map((reason) => `- ${reason}`).join('\n')}`);
+    }
+    return selected.map(({ name }) => name);
+}
+function frameworkVersion(root) {
+    const candidates = [
+        (0, node_path_1.join)(root, 'node_modules', '@empire-builder-kit', 'nx', 'package.json'),
+        (0, node_path_1.join)(root, 'package.json'),
+    ];
+    for (const path of candidates) {
+        try {
+            const value = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+            if (value.name === '@empire-builder-kit/nx' && value.version) {
+                return value.version;
+            }
+            const dependency = value.devDependencies?.['@empire-builder-kit/nx'] ??
+                value.dependencies?.['@empire-builder-kit/nx'];
+            if (dependency)
+                return dependency;
+        }
+        catch {
+            // Try the next deterministic package identity.
+        }
+    }
+    return 'unknown';
+}
+function prepareReceiptDestination(root) {
+    const directory = (0, node_path_1.join)(root, '.ebk', 'evidence', 'deployment');
+    ensurePrivateEvidenceDirectory(root, directory);
+    const path = (0, node_path_1.join)(directory, 'latest.json');
+    if ((0, node_fs_1.existsSync)(path))
+        (0, private_state_js_1.assertPrivatePath)(path, 'file');
+    return path;
+}
+function writeReceipt(root, receipt) {
+    (0, private_state_js_1.atomicWritePrivateFile)(prepareReceiptDestination(root), `${JSON.stringify(receipt, null, 2)}\n`);
+}
+function invalidatePriorReceipt(root) {
+    const path = prepareReceiptDestination(root);
+    if (!(0, node_fs_1.existsSync)(path))
+        return;
+    (0, private_state_js_1.assertPrivatePath)(path, 'file');
+    (0, node_fs_1.rmSync)(path, { force: true });
+    if ((0, node_fs_1.existsSync)(path)) {
+        throw new Error('Prior deployment receipt invalidation failed.');
+    }
+}
+class NativeChildReconciliationError extends Error {
+    constructor(primary, reconciliation) {
+        const describe = (error) => error instanceof Error ? error.message : String(error);
+        super(`${describe(primary)}; source reconciliation also failed: ${describe(reconciliation)}`);
+    }
+}
+async function runNxTarget(input) {
+    const forwarded = [
+        `--stage=${input.stage}`,
+        `--expectedRoleArn=${input.expectedRoleArn}`,
+        `--region=${input.region}`,
+        ...(input.profile ? [`--profile=${input.profile}`] : []),
+    ];
+    const args = [
+        (0, node_path_1.join)(input.context.root, 'node_modules', 'nx', 'dist', 'bin', 'nx.js'),
+        'run',
+        `${input.project}:${input.target}`,
+        '--',
+        ...forwarded,
+    ];
+    const projectRoot = input.context.projectsConfigurations?.projects[input.project]?.root;
+    if (!projectRoot)
+        throw new Error(`Deployment project ${input.project} lacks its source root.`);
+    const nextSource = (0, sst_environment_source_js_1.captureNextEnvironmentSource)({
+        projectRoot: confinedWorkspacePath(input.context.root, projectRoot),
+        workspaceRoot: input.context.root,
+    });
+    let primaryFailure;
+    try {
+        const result = input.runSync
+            ? input.runSync(process.execPath, args, {
+                cwd: input.context.root,
+                env: input.environment,
+                shell: false,
+                stdio: 'inherit',
+            })
+            : await (0, run_sst_command_js_1.runGovernedChildProcess)({
+                args,
+                cwd: input.context.root,
+                environment: input.environment,
+                executable: process.execPath,
+                ...(input.spawnChild ? { spawnChild: input.spawnChild } : {}),
+            });
+        if (result.error || result.signal || result.status !== 0) {
+            throw new Error(result.error
+                ? `${input.target} failed for ${input.project}: ${result.error.message}`
+                : result.signal
+                    ? `${input.target} failed for ${input.project} with signal ${result.signal}.`
+                    : `${input.target} failed for ${input.project} with status ${result.status ?? 'unknown'}.`);
+        }
+    }
+    catch (error) {
+        primaryFailure = { error };
+    }
+    // Reconcile after every settled child, retaining its error until cleanup ends.
+    // Native Next may run in an Nx dependency before the SST executor starts.
+    try {
+        (0, sst_environment_source_js_1.reconcileNextEnvironmentSource)(nextSource, input.context.root);
+    }
+    catch (error) {
+        if (primaryFailure)
+            throw new NativeChildReconciliationError(primaryFailure.error, error);
+        throw error;
+    }
+    if (primaryFailure)
+        throw primaryFailure.error;
+}
+const FOUNDATION_DESCRIPTOR_PATH = 'packages/foundation/contracts/foundation.json';
+/** The committed Foundation declaration is the only SQL signal; the generated
+ * Foundation publishes database discovery exactly when it declares postgres. */
+function productionFoundationDeclaresPostgres(root) {
+    let descriptor;
+    try {
+        descriptor = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, FOUNDATION_DESCRIPTOR_PATH), 'utf8'));
+    }
+    catch {
+        throw new Error(`Production deployment requires the committed Foundation capability declaration ${FOUNDATION_DESCRIPTOR_PATH}.`);
+    }
+    return (0, capability_plan_js_1.planFoundationCapabilities)({ current: descriptor, requirements: [] })
+        .resources.postgres;
+}
+/** Declarations are monotonic: a SQL-free Foundation must never observe, gain,
+ * or lose a production database during a native deployment. The
+ * `priorDiscovery` check is a redundant second line: the preflight already
+ * rejects an existing database before any child deploys, so a prior `existing`
+ * state cannot reach the postflights today and no spec exercises that branch. */
+function assertSqlFreeProductionDatabase(discovery, priorDiscovery) {
+    if (discovery.state !== 'absent' || priorDiscovery?.state === 'existing') {
+        throw new Error('Production Foundation database discovery is present although the Foundation does not declare postgres; deployment is blocked.');
+    }
+}
+function productionConfirmation(account, region, commit) {
+    return `deploy:production:${account}:${region}:${commit}`;
+}
+async function defaultIdentifyGithubCaller(region) {
+    return new client_sts_1.STSClient({
+        endpoint: (0, identity_js_1.canonicalStsEndpoint)(region),
+        region,
+    }).send(new client_sts_1.GetCallerIdentityCommand({}));
+}
+function assertGithubDeploymentAuthority(input) {
+    const repository = process.env.GITHUB_REPOSITORY?.trim() ?? '';
+    const ref = process.env.GITHUB_REF?.trim() ?? '';
+    const eventName = process.env.GITHUB_EVENT_NAME?.trim() ?? '';
+    const callerWorkflow = process.env.GITHUB_WORKFLOW_REF?.trim() ?? '';
+    const calledWorkflow = process.env.EBK_GITHUB_JOB_WORKFLOW_REF?.trim() ?? '';
+    const expectedBranch = input.stage === 'production' ? 'main' : 'develop';
+    const expectedRef = `refs/heads/${expectedBranch}`;
+    const expectedCalledWorkflow = `${repository}/.github/workflows/deploy.yml@${expectedRef}`;
+    const expectedCallerWorkflow = eventName === 'push'
+        ? `${repository}/.github/workflows/ci.yml@${expectedRef}`
+        : eventName === 'workflow_dispatch'
+            ? expectedCalledWorkflow
+            : undefined;
+    const allowedEvent = eventName === 'workflow_dispatch' ||
+        (eventName === 'push' && input.policy.deploymentProfile !== 'starter');
+    if (process.env.GITHUB_ACTIONS !== 'true' ||
+        !repository ||
+        !allowedEvent ||
+        process.env.GITHUB_SHA !== input.commit ||
+        ref !== expectedRef ||
+        callerWorkflow !== expectedCallerWorkflow ||
+        calledWorkflow !== expectedCalledWorkflow) {
+        throw new Error('Protected deployment requires the exact generated GitHub caller and reusable deploy workflows, branch, and immutable source commit.');
+    }
+    if (input.policy.deploymentProfile === 'starter' &&
+        input.stage === 'staging') {
+        throw new Error('The starter deployment profile has no staging stage.');
+    }
+    const clean = git(input.root, ['status', '--porcelain=v1', '--untracked-files=all'], input.run);
+    if (clean !== '') {
+        throw new Error('Protected GitHub deployment requires a clean checkout.');
+    }
+}
+async function runLocalDeploy(options, context, dependencies = {}) {
+    const run = dependencies.run ?? node_child_process_1.spawnSync;
+    const now = dependencies.now ?? (() => new Date());
+    const startedAt = now().toISOString();
+    const children = [];
+    const migrations = {};
+    const smoke = {};
+    let lifecycleScope;
+    let selectedSlices;
+    let account = '';
+    let actor = '';
+    let policy;
+    let region = '';
+    let source = { clean: false, commit: '', workingTreeDigest: '' };
+    let transport;
+    let productionDatabaseBefore;
+    let productionDatabaseAfterFoundation;
+    let productionPostgresDeclared = true;
+    let outcome = 'failed';
+    let failure;
+    let finalPhase = 'validation';
+    let receiptDestinationPrepared = false;
+    const githubAuthority = process.env.GITHUB_ACTIONS === 'true';
+    const retain = () => {
+        if (!policy || !receiptDestinationPrepared)
+            return;
+        writeReceipt(context.root, {
+            account,
+            actor,
+            authority: githubAuthority ? 'github' : 'local',
+            children,
+            completedAt: now().toISOString(),
+            frameworkVersion: frameworkVersion(context.root),
+            ...(failure ? { failure } : {}),
+            kind: 'ebk-deployment-receipt',
+            ...(lifecycleScope ? { lifecycleScope } : {}),
+            migrations,
+            outcome,
+            profile: policy.deploymentProfile,
+            region,
+            schemaVersion: 1,
+            ...(selectedSlices ? { selectedSlices } : {}),
+            smoke,
+            source,
+            stage: options.stage,
+            startedAt,
+        });
+    };
+    try {
+        invalidatePriorReceipt(context.root);
+        receiptDestinationPrepared = true;
+        (0, run_sst_command_js_1.assertGovernedAwsLifecyclePlatform)(dependencies.platform);
+        policy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
+        if (options.stage === 'production') {
+            (0, capacity_migration_js_1.assertWorkspaceCapacityMigrationChoice)(context.root, policy.productionFoundation.profile);
+        }
+        if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, options.stage)) {
+            throw new Error(`Deployment stage ${options.stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
+        }
+        if (!githubAuthority &&
+            (0, index_js_2.requiresGithubDeployment)(policy.deploymentProfile, options.stage)) {
+            throw new Error(`The ${policy.deploymentProfile} profile requires GitHub deployment authority for ${options.stage}.`);
+        }
+        if (!ROLE.test(options.expectedRoleArn)) {
+            throw new Error('Local deployment requires one exact IAM role ARN.');
+        }
+        region = (0, index_js_2.configuredDeploymentRegion)(policy.deploymentRegion);
+        account = (0, index_js_2.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, options.stage);
+        const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+            accountId: account,
+            partition: partitionForRegion(region),
+            region,
+            stage: options.stage,
+        }).deploymentRoleArn;
+        if (options.expectedRoleArn !== expectedRoleArn) {
+            throw new Error(`Deployment role must equal the committed ${options.stage} stage authority role ${expectedRoleArn}.`);
+        }
+        if (options.slices !== undefined &&
+            (githubAuthority || options.lifecycleScope === 'affected')) {
+            throw new Error('Explicit Slice selection is local-only and cannot be combined with affected lifecycle or protected GitHub deployment.');
+        }
+        const orderedProjects = localDeploymentProjectOrder(policy, context, options.stage, options.slices);
+        if (options.slices)
+            selectedSlices = orderedProjects.slice(1);
+        const identity = localWorkingTreeDigest(context.root, run);
+        source = {
+            clean: identity.clean,
+            commit: identity.commit,
+            workingTreeDigest: identity.digest,
+        };
+        if ((githubAuthority || options.stage !== 'development') && !source.clean) {
+            throw new Error(`Local ${options.stage} deployment requires a completely clean source tree.`);
+        }
+        if (options.stage === 'production') {
+            // Read only after the clean-source check so the declaration is bound to
+            // the digested tree, and before any AWS authority or transport exists.
+            productionPostgresDeclared = productionFoundationDeclaresPostgres(context.root);
+        }
+        if (githubAuthority) {
+            if (options.profile) {
+                throw new Error('Protected GitHub deployment must use ambient OIDC credentials, not a local AWS profile.');
+            }
+            assertGithubDeploymentAuthority({
+                commit: source.commit,
+                policy,
+                root: context.root,
+                run,
+                stage: options.stage,
+            });
+            const caller = await (dependencies.identifyGithubCaller ?? defaultIdentifyGithubCaller)(region);
+            if (caller.Account?.trim() !== account ||
+                !(0, identity_js_1.matchesExpectedAssumedRoleArn)(account, caller.Arn?.trim() ?? '', expectedRoleArn)) {
+                throw new Error('Protected GitHub deployment caller does not match the committed account and exact assumed role.');
+            }
+            actor = process.env.GITHUB_ACTOR?.trim() ?? '';
+            if (!actor) {
+                throw new Error('Protected GitHub deployment actor is absent.');
+            }
+        }
+        else if (options.stage === 'staging') {
+            const challenge = `approve:deploy:staging:${source.commit}`;
+            let acknowledged = false;
+            try {
+                acknowledged = await (dependencies.approve ?? (0, local_approval_js_1.createTtyLocalMutationApprover)())({
+                    action: 'deploy',
+                    challenge,
+                    sourceCommit: source.commit,
+                    stage: options.stage,
+                });
+            }
+            catch (error) {
+                if (error instanceof local_approval_js_1.LocalMutationApprovalUnavailableError) {
+                    outcome = 'review-required';
+                }
+                throw error;
+            }
+            if (!acknowledged) {
+                outcome = 'review-required';
+                throw new Error('Local staging deployment acknowledgement was declined.');
+            }
+        }
+        if (!githubAuthority && options.stage === 'production') {
+            const expected = productionConfirmation(account, region, source.commit);
+            let acknowledged = false;
+            try {
+                acknowledged = await (dependencies.approve ?? (0, local_approval_js_1.createTtyLocalMutationApprover)())({
+                    action: 'deploy',
+                    challenge: expected,
+                    sourceCommit: source.commit,
+                    stage: options.stage,
+                });
+            }
+            catch (error) {
+                if (error instanceof local_approval_js_1.LocalMutationApprovalUnavailableError) {
+                    outcome = 'review-required';
+                }
+                throw error;
+            }
+            if (!acknowledged) {
+                outcome = 'review-required';
+                throw new Error('Local production deployment acknowledgement was declined.');
+            }
+        }
+        lifecycleScope = resolveLifecycleScope({
+            context,
+            frameworkVersion: frameworkVersion(context.root),
+            options,
+            orderedProjects,
+            run: dependencies.run ?? node_child_process_1.spawnSync,
+            source,
+        });
+        devkit_1.logger.info(`[lifecycle-scope] ${lifecycleScope.mode} (${lifecycleScope.reason}): ` +
+            orderedProjects
+                .map((project) => `${project}=${lifecycleScope?.projects[project]}`)
+                .join(' '));
+        const descriptors = projectDescriptors(context);
+        const localProtectedContainerStage = !githubAuthority &&
+            requiresLocalContainerPreparation(policy.deploymentProfile, options.stage)
+            ? options.stage
+            : undefined;
+        const localProtectedContainerProjects = localProtectedContainerStage
+            ? orderedProjects
+                .map((project) => descriptors.find((candidate) => candidate.name === project))
+                .filter((project) => project?.tags.includes('type:slice') === true)
+            : [];
+        for (const project of localProtectedContainerProjects) {
+            const missingTargets = LOCAL_CONTAINER_TARGETS.filter((target) => !supportsTarget(project, target));
+            if (missingTargets.length > 0) {
+                throw new Error(`Local ${policy.deploymentProfile} ${options.stage} requires the complete immutable OCI target set for ${project.name}: ${missingTargets.join(', ')}.`);
+            }
+        }
+        if (!githubAuthority) {
+            transport = await (dependencies.createTransport ?? federated_credential_transport_js_1.createLocalFederatedCredentialTransport)({
+                account,
+                expectedRoleArn,
+                ...(options.profile ? { profile: options.profile } : {}),
+                region,
+            });
+            const firstIdentity = await transport.refresh();
+            actor = firstIdentity.actorArn;
+        }
+        const ownershipEnvironment = transport
+            ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+            : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                preserveVerifiedGithubCredentials: true,
+            });
+        await (dependencies.ownership ?? index_js_3.assertWorkspaceStageOwnershipForWorkspace)(context.root, options.stage, {
+            ...(ownershipEnvironment.AWS_CONFIG_FILE
+                ? { configFilepath: ownershipEnvironment.AWS_CONFIG_FILE }
+                : {}),
+            ...(ownershipEnvironment.AWS_SHARED_CREDENTIALS_FILE
+                ? {
+                    credentialsFilepath: ownershipEnvironment.AWS_SHARED_CREDENTIALS_FILE,
+                }
+                : {}),
+            ...(transport ? { profile: transport.profile } : {}),
+        });
+        if (options.stage === 'production') {
+            if (transport)
+                await transport.refresh();
+            const boundaryEnvironment = transport
+                ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                    preserveVerifiedGithubCredentials: true,
+                });
+            productionDatabaseBefore = await (dependencies.attestProductionDatabase ??
+                production_database_safeguard_js_1.attestProductionDatabaseLifecycle)({
+                ...(boundaryEnvironment.AWS_CONFIG_FILE
+                    ? { configFilepath: boundaryEnvironment.AWS_CONFIG_FILE }
+                    : {}),
+                ...(boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE
+                    ? {
+                        credentialsFilepath: boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE,
+                    }
+                    : {}),
+                expectedAccountId: account,
+                expectedRegion: region,
+                expectedRoleArn,
+                now: now(),
+                ...(transport ? { profile: transport.profile } : {}),
+                requireExisting: false,
+            });
+            // Fail before any mutation: deploying a SQL-free Foundation over an
+            // existing database would retire it outside the separate retirement path.
+            if (!productionPostgresDeclared) {
+                assertSqlFreeProductionDatabase(productionDatabaseBefore);
+            }
+        }
+        const localContainerRunId = localProtectedContainerProjects.length === 0
+            ? ''
+            : ((0, node_crypto_1.randomBytes)(8).readBigUInt64BE() + 1n).toString();
+        for (const project of localProtectedContainerProjects) {
+            resetLocalContainerWorkingEvidence({
+                project,
+                root: context.root,
+                stage: localProtectedContainerStage,
+            });
+            for (const target of LOCAL_CONTAINER_TARGETS) {
+                if (transport)
+                    await transport.refresh();
+                const environment = {
+                    ...(transport
+                        ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                        : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env)),
+                    AWS_EXPECTED_ACCOUNT_ID: account,
+                    AWS_REGION: region,
+                    EBK_LOCAL_CONTAINER_RUN_ID: localContainerRunId,
+                    EBK_LOCAL_DEPLOYMENT_MODE: 'federated',
+                    EBK_DEPLOYMENT_PROFILE: policy.deploymentProfile,
+                    EBK_NX_STAGE_LIFECYCLE: 'local',
+                    EBK_RELEASE_SOURCE_COMMIT: source.commit,
+                    EBK_SOURCE_COMMIT: source.commit,
+                    EBK_STAGE: options.stage,
+                    EBK_WORKING_TREE_DIRTY: 'false',
+                };
+                assertDeploymentSourceUnchanged(context.root, source, run);
+                const childStartedAt = now().toISOString();
+                try {
+                    await runNxTarget({
+                        context,
+                        environment,
+                        expectedRoleArn,
+                        ...(transport ? { profile: transport.profile } : {}),
+                        project: project.name,
+                        region,
+                        ...(dependencies.run ? { runSync: dependencies.run } : {}),
+                        ...(dependencies.spawnChild
+                            ? { spawnChild: dependencies.spawnChild }
+                            : {}),
+                        stage: options.stage,
+                        target,
+                    });
+                    if (target === 'release-candidate') {
+                        materializeLocalReleaseCandidate({
+                            project,
+                            root: context.root,
+                            sourceCommit: source.commit,
+                        });
+                    }
+                    if (target === 'container-release-assemble') {
+                        (dependencies.attestContainerBinding ?? attestLocalContainerBinding)({
+                            account,
+                            project,
+                            region,
+                            root: context.root,
+                            sourceCommit: source.commit,
+                            stage: options.stage,
+                        });
+                    }
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'succeeded',
+                        project: project.name,
+                        startedAt: childStartedAt,
+                        target,
+                    });
+                }
+                catch (error) {
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'failed',
+                        project: project.name,
+                        startedAt: childStartedAt,
+                        target,
+                    });
+                    throw error;
+                }
+            }
+        }
+        for (const project of orderedProjects) {
+            const descriptor = descriptors.find((candidate) => candidate.name === project);
+            if (!descriptor) {
+                throw new Error(`Local deployment project ${project} disappeared.`);
+            }
+            if (lifecycleScope?.projects[project] === 'skip-unchanged' &&
+                lifecycleScope.baseline) {
+                const skippedAt = now().toISOString();
+                children.push({
+                    completedAt: skippedAt,
+                    outcome: 'skipped-unchanged',
+                    project,
+                    reused: lifecycleScope.baseline,
+                    startedAt: skippedAt,
+                    target: 'deploy',
+                });
+                migrations[project] = 'unchanged-since-baseline';
+                smoke[project] = 'unchanged-since-baseline';
+                continue;
+            }
+            if (transport)
+                await transport.refresh();
+            const environment = {
+                ...(transport
+                    ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                    : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                        preserveVerifiedGithubCredentials: true,
+                    })),
+                AWS_EXPECTED_ACCOUNT_ID: account,
+                AWS_REGION: region,
+                EBK_LOCAL_SOURCE_TREE: source.workingTreeDigest,
+                EBK_NX_STAGE_LIFECYCLE: githubAuthority ? 'github' : 'local',
+                EBK_SOURCE_COMMIT: source.commit,
+                EBK_WORKING_TREE_DIRTY: source.clean ? 'false' : 'true',
+            };
+            assertDeploymentSourceUnchanged(context.root, source, run);
+            const childStartedAt = now().toISOString();
+            try {
+                await runNxTarget({
+                    context,
+                    environment,
+                    expectedRoleArn,
+                    ...(transport ? { profile: transport.profile } : {}),
+                    project,
+                    region,
+                    ...(dependencies.run ? { runSync: dependencies.run } : {}),
+                    ...(dependencies.spawnChild
+                        ? { spawnChild: dependencies.spawnChild }
+                        : {}),
+                    stage: options.stage,
+                    target: 'deploy',
+                });
+                children.push({
+                    completedAt: now().toISOString(),
+                    outcome: 'succeeded',
+                    project,
+                    startedAt: childStartedAt,
+                    target: 'deploy',
+                });
+            }
+            catch (error) {
+                children.push({
+                    completedAt: now().toISOString(),
+                    outcome: 'failed',
+                    project,
+                    startedAt: childStartedAt,
+                    target: 'deploy',
+                });
+                throw error;
+            }
+            if (options.stage === 'production' &&
+                descriptor.tags.includes('scope:foundation')) {
+                if (transport)
+                    await transport.refresh();
+                const boundaryEnvironment = transport
+                    ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                    : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                        preserveVerifiedGithubCredentials: true,
+                    });
+                const postflightStartedAt = now().toISOString();
+                const profile = (0, index_js_2.productionFoundationProfileContract)(policy.productionFoundation.profile).contract;
+                try {
+                    productionDatabaseAfterFoundation = await (dependencies.attestProductionDatabase ??
+                        production_database_safeguard_js_1.attestProductionDatabaseLifecycle)({
+                        ...(boundaryEnvironment.AWS_CONFIG_FILE
+                            ? { configFilepath: boundaryEnvironment.AWS_CONFIG_FILE }
+                            : {}),
+                        ...(boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE
+                            ? {
+                                credentialsFilepath: boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE,
+                            }
+                            : {}),
+                        expectedAccountId: account,
+                        ...(productionPostgresDeclared
+                            ? {
+                                expectedCapacity: {
+                                    max: Number.parseFloat(profile.aurora.max),
+                                    min: Number.parseFloat(profile.aurora.min),
+                                },
+                            }
+                            : {}),
+                        expectedRegion: region,
+                        expectedRoleArn,
+                        now: now(),
+                        priorDiscovery: productionDatabaseBefore,
+                        ...(transport ? { profile: transport.profile } : {}),
+                        requireExisting: productionPostgresDeclared,
+                    });
+                    if (!productionPostgresDeclared) {
+                        assertSqlFreeProductionDatabase(productionDatabaseAfterFoundation, productionDatabaseBefore);
+                    }
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'succeeded',
+                        project,
+                        startedAt: postflightStartedAt,
+                        target: 'production-database-postflight',
+                    });
+                }
+                catch (error) {
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'failed',
+                        project,
+                        startedAt: postflightStartedAt,
+                        target: 'production-database-postflight',
+                    });
+                    throw error;
+                }
+            }
+            migrations[project] = supportsTarget(descriptor, 'db-migrate')
+                ? 'completed-by-deploy-target'
+                : 'not-applicable';
+            if (supportsTarget(descriptor, 'smoke-deployed')) {
+                if (transport)
+                    await transport.refresh();
+                const smokeTarget = readDeployedSmokeTarget(context.root, descriptor, options.stage);
+                assertDeploymentSourceUnchanged(context.root, source, run);
+                const smokeStartedAt = now().toISOString();
+                try {
+                    const runSmoke = () => runNxTarget({
+                        context,
+                        environment: {
+                            ...(transport
+                                ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                                : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                                    preserveVerifiedGithubCredentials: true,
+                                })),
+                            AWS_EXPECTED_ACCOUNT_ID: account,
+                            AWS_REGION: region,
+                            EBK_NX_STAGE_LIFECYCLE: githubAuthority ? 'github' : 'local',
+                            EBK_SOURCE_COMMIT: source.commit,
+                            EBK_DEPLOYED_SOURCE_COMMIT: deployedSourceCommit(source.commit),
+                            EBK_SMOKE_API_URL: smokeTarget.apiUrl,
+                            EBK_SMOKE_AUTHORITY_VERSION: 'cognito-admin-cloudwatch-observe-v1',
+                            EBK_SMOKE_CLIENT_ID: smokeTarget.clientId,
+                            EBK_SMOKE_URL: smokeTarget.webUrl,
+                            EBK_SMOKE_USER_POOL_ID: smokeTarget.userPoolId,
+                            EBK_STAGE: options.stage,
+                        },
+                        expectedRoleArn,
+                        ...(transport ? { profile: transport.profile } : {}),
+                        project,
+                        region,
+                        ...(dependencies.run ? { runSync: dependencies.run } : {}),
+                        ...(dependencies.spawnChild
+                            ? { spawnChild: dependencies.spawnChild }
+                            : {}),
+                        stage: options.stage,
+                        target: 'smoke-deployed',
+                    });
+                    if (githubAuthority) {
+                        await (dependencies.privateSmoke ?? private_smoke_access_js_1.runGithubPrivateSmoke)({
+                            account,
+                            deploymentProfile: policy.deploymentProfile,
+                            root: context.root,
+                            source: source.commit,
+                            stage: options.stage,
+                            url: smokeTarget.webUrl,
+                            workspace: JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(context.root, 'package.json'), 'utf8')).name,
+                            run: runSmoke,
+                        });
+                    }
+                    else {
+                        if (!transport)
+                            throw new Error('Local smoke requires the verified federated transport.');
+                        await (dependencies.localPrivateSmoke ?? local_private_smoke_access_js_1.runLocalPrivateSmoke)({
+                            account,
+                            deploymentProfile: policy.deploymentProfile,
+                            root: context.root,
+                            source: source.commit,
+                            stage: options.stage,
+                            url: smokeTarget.webUrl,
+                            workspace: JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(context.root, 'package.json'), 'utf8')).name,
+                            credentialEnvironment: transport.childEnvironment({}),
+                            run: runSmoke,
+                        });
+                    }
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'succeeded',
+                        project,
+                        startedAt: smokeStartedAt,
+                        target: 'smoke-deployed',
+                    });
+                    smoke[project] = 'passed';
+                }
+                catch (error) {
+                    children.push({
+                        completedAt: now().toISOString(),
+                        outcome: 'failed',
+                        project,
+                        startedAt: smokeStartedAt,
+                        target: 'smoke-deployed',
+                    });
+                    throw error;
+                }
+            }
+            else {
+                smoke[project] = 'not-applicable';
+            }
+        }
+        if (options.stage === 'production') {
+            if (!productionDatabaseAfterFoundation) {
+                throw new Error('Production Foundation database postflight was not completed before final deployment acceptance.');
+            }
+            if (transport)
+                await transport.refresh();
+            const boundaryEnvironment = transport
+                ? transport.childEnvironment((0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env))
+                : (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(process.env, {
+                    preserveVerifiedGithubCredentials: true,
+                });
+            const finalPostflightStartedAt = now().toISOString();
+            const foundationProject = orderedProjects[0] ?? 'foundation';
+            const profile = (0, index_js_2.productionFoundationProfileContract)(policy.productionFoundation.profile).contract;
+            try {
+                const finalDiscovery = await (dependencies.attestProductionDatabase ??
+                    production_database_safeguard_js_1.attestProductionDatabaseLifecycle)({
+                    ...(boundaryEnvironment.AWS_CONFIG_FILE
+                        ? { configFilepath: boundaryEnvironment.AWS_CONFIG_FILE }
+                        : {}),
+                    ...(boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE
+                        ? {
+                            credentialsFilepath: boundaryEnvironment.AWS_SHARED_CREDENTIALS_FILE,
+                        }
+                        : {}),
+                    expectedAccountId: account,
+                    ...(productionPostgresDeclared
+                        ? {
+                            expectedCapacity: {
+                                max: Number.parseFloat(profile.aurora.max),
+                                min: Number.parseFloat(profile.aurora.min),
+                            },
+                        }
+                        : {}),
+                    expectedRegion: region,
+                    expectedRoleArn,
+                    now: now(),
+                    priorDiscovery: productionDatabaseAfterFoundation,
+                    ...(transport ? { profile: transport.profile } : {}),
+                    requireExisting: productionPostgresDeclared,
+                });
+                if (!productionPostgresDeclared) {
+                    assertSqlFreeProductionDatabase(finalDiscovery, productionDatabaseAfterFoundation);
+                }
+                children.push({
+                    completedAt: now().toISOString(),
+                    outcome: 'succeeded',
+                    project: foundationProject,
+                    startedAt: finalPostflightStartedAt,
+                    target: 'production-database-final-postflight',
+                });
+            }
+            catch (error) {
+                children.push({
+                    completedAt: now().toISOString(),
+                    outcome: 'failed',
+                    project: foundationProject,
+                    startedAt: finalPostflightStartedAt,
+                    target: 'production-database-final-postflight',
+                });
+                throw error;
+            }
+        }
+        finalPhase = 'final-source-validation';
+        assertDeploymentSourceUnchanged(context.root, source, run);
+        if (transport) {
+            finalPhase = 'credential-cleanup';
+            transport.cleanup();
+            transport = undefined;
+        }
+        outcome = 'succeeded';
+        retain();
+        devkit_1.logger.info(`${githubAuthority ? 'Protected GitHub' : 'Local'} ${options.stage} deployment completed through native SST for ${children.filter(({ target }) => target === 'deploy').length} project(s).`);
+        return { success: true };
+    }
+    catch (error) {
+        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+        if (transport) {
+            try {
+                transport.cleanup();
+                transport = undefined;
+            }
+            catch {
+                finalPhase = 'credential-cleanup';
+                devkit_1.logger.error('Local federated credential transport cleanup failed; deployment acceptance is blocked.');
+            }
+        }
+        const failedChild = [...children]
+            .reverse()
+            .find((child) => child.outcome === 'failed');
+        const project = failedChild?.project ?? context.projectName ?? 'workspace';
+        failure = {
+            project,
+            operation: 'deploy',
+            ...(error instanceof NativeChildReconciliationError
+                ? { secondaryPhases: ['source-reconciliation'] }
+                : {}),
+            phase: finalPhase === 'credential-cleanup'
+                ? finalPhase
+                : (failedChild?.target ?? finalPhase),
+            mutationStatus: children.some((child) => child.target === 'deploy')
+                ? 'may-have-changed'
+                : 'not-attempted',
+            nextAction: githubAuthority
+                ? 'Resolve the reported native failure, then retry the protected Deploy workflow for this source and stage.'
+                : `Resolve the reported native failure, then rerun pnpm nx run ${context.projectName ?? 'workspace'}:deploy-local -- --stage=${options.stage} --expectedRoleArn=<stage-role-arn> with the configured temporary credential profile.`,
+        };
+        devkit_1.logger.error(`Deployment failed: project=${failure.project}; operation=${failure.operation}; phase=${failure.phase}; mutation=${failure.mutationStatus}. ${failure.nextAction}`);
+        retain();
+        return { success: false };
+    }
+}
+const executor = (options, context) => runLocalDeploy(options, context);
+exports.default = executor;
+//# sourceMappingURL=local-deploy.js.map