@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/executors/sst-lifecycle/schema.json

@@ -27,7 +27,14 @@
     },
     "profile": {
       "type": "string",
-      "description": "Optional AWS profile passed to SST."
+      "minLength": 1,
+      "maxLength": 128,
+      "description": "Optional exact AWS profile exposed to the SST child as AWS_PROFILE."
+    },
+    "expectedRoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+      "description": "Exact temporary-session IAM role expected for local governed deployment. This is verified against STS before mutation."
     },
     "region": {
       "type": "string",

package/src/executors/sst-lifecycle/secret-preflight.d.ts

@@ -1,3 +1,4 @@
+import type { SecretsManagerClientConfig } from '@aws-sdk/client-secrets-manager';
 import type { ExecutorContext } from '@nx/devkit';
 import { type SecretManagementScope, type SecretMetadataControlPlane, type SecretMetadataDeclaration } from '../../secrets/index.js';
 import type { SstCommandInvocation, SstLifecycleOptions } from './run-sst-command.js';
@@ -16,6 +17,7 @@ export interface SecretDeployPreflightDependencies {
 }
 export declare function resolveSecretAwsContext(options: Pick<SstLifecycleOptions, 'profile' | 'region'>, environment?: NodeJS.ProcessEnv): SecretAwsContext;
 export declare function createSecretMetadataControlPlane(context: SecretAwsContext): SecretMetadataControlPlane;
+export declare function secretMetadataClientConfiguration(context: SecretAwsContext): SecretsManagerClientConfig;
 export declare function loadSliceSecretMetadata(input: {
     context: ExecutorContext;
     cwd: string;

package/src/executors/sst-lifecycle/secret-preflight.js

@@ -2,12 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveSecretAwsContext = resolveSecretAwsContext;
 exports.createSecretMetadataControlPlane = createSecretMetadataControlPlane;
+exports.secretMetadataClientConfiguration = secretMetadataClientConfiguration;
 exports.loadSliceSecretMetadata = loadSliceSecretMetadata;
 exports.preflightSliceSecretMetadata = preflightSliceSecretMetadata;
 const credential_providers_1 = require("@aws-sdk/credential-providers");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../secrets/index.js");
+const identity_js_1 = require("../../aws/identity.js");
 const regionPattern = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -46,12 +48,16 @@ function resolveSecretAwsContext(options, environment = process.env) {
 }
 function createSecretMetadataControlPlane(context) {
     return (0, index_js_1.createAwsSecretsManagerMetadataControlPlane)({
-        clientConfiguration: {
-            ...(context.profile
-                ? { credentials: (0, credential_providers_1.fromIni)({ profile: context.profile }) }
-                : {}),
-            region: context.region,
-        },
+        clientConfiguration: secretMetadataClientConfiguration(context),
+    });
+}
+function secretMetadataClientConfiguration(context) {
+    return Object.freeze({
+        ...(context.profile
+            ? { credentials: (0, credential_providers_1.fromIni)({ profile: context.profile }) }
+            : {}),
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('secretsmanager', context.region),
+        region: context.region,
     });
 }
 async function loadSliceSecretMetadata(input) {
@@ -85,7 +91,7 @@ async function loadSliceSecretMetadata(input) {
     });
     (0, index_js_1.validateSecretManagementScope)(scope);
     return Object.freeze({
-        declarations: (0, index_js_1.operatorSecretMetadataDeclarations)(registry),
+        declarations: (0, index_js_1.deployedSecretMetadataDeclarations)(registry),
         scope,
     });
 }

package/src/executors/sst-lifecycle/sst-environment-source.d.ts

@@ -0,0 +1,33 @@
+interface SstEnvironmentSourceSnapshot {
+    absolutePath: string;
+    bytes: Buffer;
+    identity: {
+        birthtimeNs: bigint;
+        dev: bigint;
+        ino: bigint;
+        mode: bigint;
+        nlink: bigint;
+    };
+    relativePath: string;
+}
+export interface SstEnvironmentSourceTreeSnapshot {
+    nextSource?: SstEnvironmentSourceSnapshot;
+    projectRoot: string;
+    rootPythonSourcePath: string;
+    rootSourcePath: string;
+    snapshots: readonly SstEnvironmentSourceSnapshot[];
+    workspaceRoot: string;
+}
+export declare function captureSstEnvironmentSourceTree(input: {
+    projectRoot: string;
+    workspaceRoot: string;
+}): SstEnvironmentSourceTreeSnapshot;
+/** Capture outside the complete Nx child, including its Next build dependencies.
+ * The inner SST boundary alone starts after those dependencies have run. */
+export declare function captureNextEnvironmentSource(input: {
+    projectRoot: string;
+    workspaceRoot: string;
+}): SstEnvironmentSourceSnapshot | undefined;
+export declare function reconcileNextEnvironmentSource(retained: SstEnvironmentSourceSnapshot | undefined, workspaceRoot: string): void;
+export declare function reconcileSstEnvironmentSourceTree(retained: SstEnvironmentSourceTreeSnapshot): void;
+export {};

package/src/executors/sst-lifecycle/sst-environment-source.js

@@ -0,0 +1,267 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureSstEnvironmentSourceTree = captureSstEnvironmentSourceTree;
+exports.captureNextEnvironmentSource = captureNextEnvironmentSource;
+exports.reconcileNextEnvironmentSource = reconcileNextEnvironmentSource;
+exports.reconcileSstEnvironmentSourceTree = reconcileSstEnvironmentSourceTree;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const sst_environment_source_format_js_1 = require("../../sst-environment-source-format.js");
+const MAX_SST_ENV_SOURCE_BYTES = 1024 * 1024;
+const MAX_SST_ENV_SOURCE_FILES = 64;
+const MAX_PROJECT_DIRECTORY_ENTRIES = 32_768;
+const MAX_PROJECT_DIRECTORY_DEPTH = 32;
+const MAX_RELATIVE_PATH_BYTES = 1024;
+const SKIPPED_DIRECTORIES = new Set([
+    '.git',
+    '.nx',
+    '.sst',
+    'coverage',
+    'dist',
+    'node_modules',
+]);
+function normalizedRelativePath(root, absolutePath) {
+    const path = (0, node_path_1.relative)(root, absolutePath).split('\\').join('/');
+    if (!path ||
+        path === '..' ||
+        path.startsWith('../') ||
+        (0, node_path_1.isAbsolute)(path) ||
+        Buffer.byteLength(path, 'utf8') > MAX_RELATIVE_PATH_BYTES) {
+        throw new Error('SST lifecycle tool-owned source escapes its boundary.');
+    }
+    return path;
+}
+function stableSstEnvironmentSource(absolutePath, workspaceRoot) {
+    const relativePath = normalizedRelativePath(workspaceRoot, absolutePath);
+    const before = (0, node_fs_1.lstatSync)(absolutePath, { bigint: true });
+    if (!before.isFile() ||
+        before.nlink !== 1n ||
+        before.size > BigInt(MAX_SST_ENV_SOURCE_BYTES) ||
+        (0, node_fs_1.realpathSync)(absolutePath) !== absolutePath) {
+        throw new Error(`SST lifecycle tool-owned source ${relativePath} is not one bounded, unaliased regular file.`);
+    }
+    const bytes = (0, node_fs_1.readFileSync)(absolutePath);
+    const after = (0, node_fs_1.lstatSync)(absolutePath, { bigint: true });
+    if (before.dev !== after.dev ||
+        before.ino !== after.ino ||
+        before.mode !== after.mode ||
+        before.nlink !== after.nlink ||
+        before.size !== after.size ||
+        before.mtimeNs !== after.mtimeNs ||
+        before.ctimeNs !== after.ctimeNs ||
+        BigInt(bytes.byteLength) !== after.size) {
+        throw new Error(`SST lifecycle tool-owned source ${relativePath} changed while it was read.`);
+    }
+    return {
+        absolutePath,
+        bytes,
+        identity: {
+            birthtimeNs: before.birthtimeNs,
+            dev: before.dev,
+            ino: before.ino,
+            mode: before.mode,
+            nlink: before.nlink,
+        },
+        relativePath,
+    };
+}
+function discoverSstEnvironmentSources(input) {
+    const queue = [{ absolutePath: input.projectRoot, depth: 0 }];
+    const sources = [];
+    let observedEntries = 0;
+    for (let index = 0; index < queue.length; index += 1) {
+        const current = queue[index];
+        if (!current)
+            break;
+        for (const entry of (0, node_fs_1.readdirSync)(current.absolutePath, {
+            withFileTypes: true,
+        })) {
+            observedEntries += 1;
+            if (observedEntries > MAX_PROJECT_DIRECTORY_ENTRIES) {
+                throw new Error('SST lifecycle project source exceeds the bounded directory inventory.');
+            }
+            const absolutePath = (0, node_path_1.join)(current.absolutePath, entry.name);
+            if (entry.name === 'sst-env.d.ts' ||
+                (entry.name === 'sst.pyi' &&
+                    absolutePath === (0, node_path_1.join)(input.projectRoot, 'sst.pyi'))) {
+                sources.push(stableSstEnvironmentSource(absolutePath, input.workspaceRoot));
+                if (sources.length > MAX_SST_ENV_SOURCE_FILES) {
+                    throw new Error('SST lifecycle project source exceeds the bounded environment-source inventory.');
+                }
+                continue;
+            }
+            if (entry.isDirectory() && !SKIPPED_DIRECTORIES.has(entry.name)) {
+                if (current.depth >= MAX_PROJECT_DIRECTORY_DEPTH) {
+                    throw new Error('SST lifecycle project source exceeds the bounded directory depth.');
+                }
+                queue.push({ absolutePath, depth: current.depth + 1 });
+            }
+        }
+    }
+    return sources.sort((left, right) => left.relativePath < right.relativePath
+        ? -1
+        : left.relativePath > right.relativePath
+            ? 1
+            : 0);
+}
+function sameIdentity(left, right) {
+    return (left.birthtimeNs === right.birthtimeNs &&
+        left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.mode === right.mode &&
+        left.nlink === right.nlink);
+}
+function restoreExistingSstEnvironmentSource(retained, observed, workspaceRoot) {
+    if (!sameIdentity(retained.identity, observed.identity)) {
+        throw new Error(`SST lifecycle tool-owned source ${retained.relativePath} changed filesystem identity.`);
+    }
+    if (!observed.bytes.equals(retained.bytes)) {
+        const descriptor = (0, node_fs_1.openSync)(retained.absolutePath, 'r+');
+        try {
+            const opened = (0, node_fs_1.fstatSync)(descriptor, { bigint: true });
+            if (!opened.isFile() ||
+                opened.birthtimeNs !== retained.identity.birthtimeNs ||
+                opened.dev !== retained.identity.dev ||
+                opened.ino !== retained.identity.ino ||
+                opened.mode !== retained.identity.mode ||
+                opened.nlink !== 1n) {
+                throw new Error(`SST lifecycle tool-owned source ${retained.relativePath} changed before restoration.`);
+            }
+            (0, node_fs_1.ftruncateSync)(descriptor, 0);
+            (0, node_fs_1.writeFileSync)(descriptor, retained.bytes);
+            (0, node_fs_1.fsyncSync)(descriptor);
+        }
+        finally {
+            (0, node_fs_1.closeSync)(descriptor);
+        }
+    }
+    const restored = stableSstEnvironmentSource(retained.absolutePath, workspaceRoot);
+    if (!restored.bytes.equals(retained.bytes) ||
+        !sameIdentity(retained.identity, restored.identity)) {
+        throw new Error(`SST lifecycle tool-owned source ${retained.relativePath} was not restored exactly.`);
+    }
+}
+function removeGeneratedNestedSource(observed, rootPythonSourcePath, rootSourcePath, workspaceRoot) {
+    if (observed.absolutePath === rootPythonSourcePath) {
+        if (!(0, sst_environment_source_format_js_1.isExactGeneratedRootSstPythonSourceBytes)(observed.bytes)) {
+            throw new Error(`SST lifecycle new tool-owned source ${observed.relativePath} is not exact generated output.`);
+        }
+        const beforeDelete = stableSstEnvironmentSource(observed.absolutePath, workspaceRoot);
+        if (!beforeDelete.bytes.equals(observed.bytes) ||
+            !sameIdentity(beforeDelete.identity, observed.identity)) {
+            throw new Error(`SST lifecycle new tool-owned source ${observed.relativePath} changed before removal.`);
+        }
+        (0, node_fs_1.unlinkSync)(observed.absolutePath);
+        return;
+    }
+    const expectedBytes = (0, sst_environment_source_format_js_1.exactGeneratedNestedSstEnvironmentSourceBytes)(observed.absolutePath, rootSourcePath);
+    if (expectedBytes.length === 0) {
+        throw new Error('SST lifecycle generated environment source has an invalid root reference.');
+    }
+    if (observed.absolutePath === rootSourcePath ||
+        !expectedBytes.some((expected) => expected.equals(observed.bytes))) {
+        throw new Error(`SST lifecycle new tool-owned source ${observed.relativePath} is not exact generated output.`);
+    }
+    const beforeDelete = stableSstEnvironmentSource(observed.absolutePath, workspaceRoot);
+    if (!beforeDelete.bytes.equals(observed.bytes) ||
+        !sameIdentity(beforeDelete.identity, observed.identity)) {
+        throw new Error(`SST lifecycle new tool-owned source ${observed.relativePath} changed before removal.`);
+    }
+    (0, node_fs_1.unlinkSync)(observed.absolutePath);
+}
+function captureSstEnvironmentSourceTree(input) {
+    const workspaceRoot = (0, node_fs_1.realpathSync)(input.workspaceRoot);
+    const projectRoot = (0, node_fs_1.realpathSync)(input.projectRoot);
+    normalizedRelativePath(workspaceRoot, projectRoot);
+    const rootSourcePath = (0, node_path_1.join)(projectRoot, 'sst-env.d.ts');
+    const rootPythonSourcePath = (0, node_path_1.join)(projectRoot, 'sst.pyi');
+    const snapshots = discoverSstEnvironmentSources({
+        projectRoot,
+        workspaceRoot,
+    });
+    if (!snapshots.some(({ absolutePath }) => absolutePath === rootSourcePath)) {
+        throw new Error('SST lifecycle project lacks its exact root environment source.');
+    }
+    const nextSource = captureNextEnvironmentSource({
+        projectRoot,
+        workspaceRoot,
+    });
+    return {
+        ...(nextSource ? { nextSource } : {}),
+        projectRoot,
+        rootPythonSourcePath,
+        rootSourcePath,
+        snapshots,
+        workspaceRoot,
+    };
+}
+/** Capture outside the complete Nx child, including its Next build dependencies.
+ * The inner SST boundary alone starts after those dependencies have run. */
+function captureNextEnvironmentSource(input) {
+    const nextPath = (0, node_path_1.join)(input.projectRoot, 'web', 'next-env.d.ts');
+    // existsSync follows links and would treat a dangling alias as absence.
+    // Inspect the directory entry so aliases are refused before the child writes.
+    if (!(0, node_fs_1.lstatSync)(nextPath, { throwIfNoEntry: false }))
+        return undefined;
+    const workspaceRoot = (0, node_fs_1.realpathSync)(input.workspaceRoot);
+    const projectRoot = (0, node_fs_1.realpathSync)(input.projectRoot);
+    normalizedRelativePath(workspaceRoot, projectRoot);
+    const nextSource = stableSstEnvironmentSource((0, node_path_1.join)(projectRoot, 'web', 'next-env.d.ts'), workspaceRoot);
+    // Arbitrary declarations remain ordinary source; never normalize or ignore them.
+    return (0, sst_environment_source_format_js_1.isExactGeneratedNextEnvironmentSourceBytes)(nextSource.bytes)
+        ? nextSource
+        : undefined;
+}
+function reconcileNextEnvironmentSource(retained, workspaceRoot) {
+    if (retained) {
+        workspaceRoot = (0, node_fs_1.realpathSync)(workspaceRoot);
+        const current = stableSstEnvironmentSource(retained.absolutePath, workspaceRoot);
+        if (!(0, sst_environment_source_format_js_1.isExactGeneratedNextEnvironmentSourceBytes)(current.bytes))
+            throw new Error('Next lifecycle declaration changed beyond exact generated dev/build output.');
+        restoreExistingSstEnvironmentSource(retained, current, workspaceRoot);
+    }
+}
+function reconcileSstEnvironmentSourceTree(retained) {
+    const failures = [];
+    try {
+        reconcileNextEnvironmentSource(retained.nextSource, retained.workspaceRoot);
+    }
+    catch (error) {
+        failures.push(error);
+    }
+    try {
+        reconcileNativeSstEnvironmentSources(retained);
+    }
+    catch (error) {
+        failures.push(error);
+    }
+    if (failures.length === 1)
+        throw failures[0];
+    if (failures.length > 1)
+        throw new Error(failures
+            .map((error) => error instanceof Error ? error.message : String(error))
+            .join('; '));
+}
+function reconcileNativeSstEnvironmentSources(retained) {
+    const retainedByPath = new Map(retained.snapshots.map((snapshot) => [snapshot.absolutePath, snapshot]));
+    const observed = discoverSstEnvironmentSources(retained);
+    const observedByPath = new Map(observed.map((snapshot) => [snapshot.absolutePath, snapshot]));
+    for (const snapshot of retained.snapshots) {
+        const current = observedByPath.get(snapshot.absolutePath);
+        if (!current) {
+            throw new Error(`SST lifecycle tool-owned source ${snapshot.relativePath} was removed.`);
+        }
+        restoreExistingSstEnvironmentSource(snapshot, current, retained.workspaceRoot);
+    }
+    for (const current of observed) {
+        if (!retainedByPath.has(current.absolutePath)) {
+            removeGeneratedNestedSource(current, retained.rootPythonSourcePath, retained.rootSourcePath, retained.workspaceRoot);
+        }
+    }
+    const finalPaths = discoverSstEnvironmentSources(retained).map(({ absolutePath }) => absolutePath);
+    const retainedPaths = retained.snapshots.map(({ absolutePath }) => absolutePath);
+    if (JSON.stringify(finalPaths) !== JSON.stringify(retainedPaths)) {
+        throw new Error('SST lifecycle environment-source inventory was not restored exactly.');
+    }
+}
+//# sourceMappingURL=sst-environment-source.js.map

package/src/executors/sst-lifecycle/task-unlock.d.ts

@@ -0,0 +1,15 @@
+import { type ExecutorContext } from '@nx/devkit';
+import { type TaskAuthorityEffects } from '../../local-dev/task-authority.js';
+import { type TaskNativeWriterEffects } from '../../local-dev/task-native-writer.js';
+import { createLocalFederatedCredentialTransport } from '../local-deploy/federated-credential-transport.js';
+import { runSstCommand, type SstLifecycleOptions } from './run-sst-command.js';
+export interface TaskUnlockDependencies {
+    authority?: TaskAuthorityEffects;
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    environment?: NodeJS.ProcessEnv;
+    run?: typeof runSstCommand;
+    writers?: TaskNativeWriterEffects;
+}
+export declare function runCurrentTaskUnlock(options: SstLifecycleOptions, context: ExecutorContext, dependencies?: TaskUnlockDependencies): Promise<{
+    success: boolean;
+}>;

package/src/executors/sst-lifecycle/task-unlock.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCurrentTaskUnlock = runCurrentTaskUnlock;
+const devkit_1 = require("@nx/devkit");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../../aws-authority/index.js");
+const fleet_launcher_js_1 = require("../../local-dev/fleet-launcher.js");
+const local_context_js_1 = require("../../local-dev/local-context.js");
+const task_authority_js_1 = require("../../local-dev/task-authority.js");
+const task_identity_js_1 = require("../../local-dev/task-identity.js");
+const task_native_writer_js_1 = require("../../local-dev/task-native-writer.js");
+const task_stack_absence_js_1 = require("../dev-task-cleanup/task-stack-absence.js");
+const federated_credential_transport_js_1 = require("../local-deploy/federated-credential-transport.js");
+const local_deploy_js_1 = require("../local-deploy/local-deploy.js");
+const run_sst_command_js_1 = require("./run-sst-command.js");
+async function runCurrentTaskUnlock(options, context, dependencies = {}) {
+    let transport, success = false;
+    try {
+        const environment = dependencies.environment ?? process.env;
+        if (Object.keys(options).some((key) => ![
+            'args',
+            'cwd',
+            'expectedRoleArn',
+            'foundationStage',
+            'profile',
+            'region',
+            'stage',
+            'stageMode',
+            'target',
+        ].includes(key)))
+            throw new Error('Task unlock received an unsupported option.');
+        if (environment.GITHUB_ACTIONS === 'true')
+            throw new Error('Task unlock is local to the current owning worktree.');
+        const task = (0, task_identity_js_1.resolveTaskIdentity)(context.root), stage = (0, task_identity_js_1.taskStage)(task.taskId);
+        const project = context.projectName
+            ? context.projectsConfigurations?.projects[context.projectName]
+            : undefined;
+        if (options.stage !== stage ||
+            options.stageMode !== 'consumer' ||
+            !project?.tags?.includes('type:slice') ||
+            project.tags.includes('scope:foundation'))
+            throw new Error('Task unlock requires the exact current task and one Product Slice.');
+        if (options.profile !== undefined ||
+            options.region !== undefined ||
+            options.expectedRoleArn !== undefined ||
+            options.target !== undefined ||
+            (options.args !== undefined &&
+                (!Array.isArray(options.args) || options.args.length !== 0)) ||
+            (options.foundationStage !== undefined &&
+                options.foundationStage !== 'development'))
+            throw new Error('Task unlock does not accept AWS, target, argument, or Foundation overrides.');
+        const projectRoot = (0, node_fs_1.realpathSync)((0, node_path_1.join)(context.root, project.root));
+        if (options.cwd !== undefined &&
+            (0, node_fs_1.realpathSync)((0, node_path_1.isAbsolute)(options.cwd) ? options.cwd : (0, node_path_1.join)(context.root, options.cwd)) !== projectRoot)
+            throw new Error('Task unlock cwd must equal its generated Slice project root.');
+        (0, task_stack_absence_js_1.resolveStaticTaskApp)({
+            workspaceRoot: context.root,
+            projectRoot,
+            projectName: context.projectName,
+        });
+        const saved = (0, local_context_js_1.readSavedLocalDevContext)((0, fleet_launcher_js_1.resolveGitCommonDirectory)(context.root));
+        if (saved.kind !== 'ready')
+            throw new Error('Task unlock requires the saved development AWS context. Run ebk dev configure.');
+        const verified = await (0, task_authority_js_1.verifyTaskEnvironment)(context.root, saved.resolution.context, dependencies.authority);
+        (0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified);
+        const source = (0, local_deploy_js_1.localWorkingTreeDigest)(context.root);
+        (0, task_native_writer_js_1.assertTaskNativeWritersAbsent)(context, dependencies.writers);
+        const region = verified.region;
+        const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+            accountId: verified.accountId,
+            region,
+            stage: 'development',
+            partition: region.startsWith('cn-')
+                ? 'aws-cn'
+                : region.startsWith('us-gov-')
+                    ? 'aws-us-gov'
+                    : 'aws',
+        }).deploymentRoleArn;
+        transport = await (dependencies.createTransport ?? federated_credential_transport_js_1.createLocalFederatedCredentialTransport)({
+            account: verified.accountId,
+            expectedRoleArn,
+            profile: saved.resolution.context.profile,
+            region,
+        });
+        await transport.refresh();
+        if ((0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified).taskId !==
+            task.taskId ||
+            JSON.stringify((0, local_deploy_js_1.localWorkingTreeDigest)(context.root)) !==
+                JSON.stringify(source))
+            throw new Error('Task unlock source or ownership changed during authorization.');
+        (0, task_native_writer_js_1.assertTaskNativeWritersAbsent)(context, dependencies.writers);
+        success = (await (dependencies.run ?? run_sst_command_js_1.runSstCommand)('unlock', {
+            stage,
+            stageMode: 'consumer',
+            foundationStage: 'development',
+            profile: transport.profile,
+            region,
+            expectedRoleArn,
+        }, context, {
+            environment: {
+                ...transport.childEnvironment(environment),
+                AWS_EXPECTED_ACCOUNT_ID: verified.accountId,
+                AWS_REGION: region,
+                EBK_NX_TASK_UNLOCK: task.taskId,
+                EBK_SOURCE_COMMIT: source.commit,
+                EBK_LOCAL_SOURCE_TREE: source.digest,
+            },
+            taskNativeWriterEffects: dependencies.writers,
+        })).success;
+    }
+    catch (error) {
+        devkit_1.logger.error(`Task unlock failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        try {
+            transport?.cleanup();
+        }
+        catch {
+            success = false;
+            devkit_1.logger.error('Task unlock credential cleanup failed; acceptance is blocked.');
+        }
+    }
+    return { success };
+}
+//# sourceMappingURL=task-unlock.js.map

package/src/executors/unlock/unlock.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
-const executor = (options, context) => (0, run_sst_command_js_1.runSstCommand)('unlock', options, context);
+const governed_native_operation_js_1 = require("../sst-lifecycle/governed-native-operation.js");
+const executor = (options, context) => (0, governed_native_operation_js_1.runGovernedNativeOperation)('unlock', options, context);
 exports.default = executor;
 //# sourceMappingURL=unlock.js.map

package/src/foundation/capability-plan.d.ts

@@ -0,0 +1,43 @@
+/** Resource capability version, independent of the requirement-document schema. */
+export declare const FOUNDATION_CAPABILITY_CONTRACT_VERSION: "2.0.0";
+/** Known generated-source migration only; never accepted as a live v2 contract. */
+export declare const LEGACY_STANDARD_FOUNDATION_CAPABILITIES: readonly ["network", "routing", "container-compute", "postgres", "identity", "events", "observability", "configuration", "deployment"];
+export declare const FOUNDATION_BASE_CAPABILITIES: readonly ["key-value", "routing", "identity", "events", "observability", "configuration", "deployment"];
+export declare const FOUNDATION_CAPABILITY_VOCABULARY: readonly ["key-value", "routing", "identity", "events", "observability", "configuration", "deployment", "network", "container-compute", "postgres"];
+export type FoundationCapability = (typeof FOUNDATION_CAPABILITY_VOCABULARY)[number];
+export interface FoundationCapabilityDescriptor {
+    contractVersion: typeof FOUNDATION_CAPABILITY_CONTRACT_VERSION;
+    capabilities: FoundationCapability[];
+}
+export interface FoundationCapabilityRequirement {
+    contract: string;
+    capabilities: FoundationCapability[];
+}
+export interface StandardSqlDeclaration {
+    reason: string;
+}
+export interface FoundationCapabilityPlan {
+    descriptor: FoundationCapabilityDescriptor;
+    added: FoundationCapability[];
+    retained: FoundationCapability[];
+    migratedFromContract: '1.0.0' | null;
+    resources: {
+        containerCompute: boolean;
+        network: boolean;
+        postgres: boolean;
+    };
+}
+/** Absence means DynamoDB-first; false/null is never a database retirement instruction. */
+export declare function readStandardSqlDeclaration(inputs: unknown): StandardSqlDeclaration | null;
+export declare function standardPersistenceRequirement(inputs: unknown, compositions?: readonly {
+    kind: string;
+}[]): FoundationCapabilityRequirement;
+/**
+ * Pure generation plan. Existing declarations are monotonic: removing a Slice
+ * cannot remove a database, network, or cluster. Retirement is a separate operation.
+ * This function never reads AWS and does not attest that resources are deployed.
+ */
+export declare function planFoundationCapabilities(options: {
+    current?: unknown;
+    requirements: readonly unknown[];
+}): FoundationCapabilityPlan;