@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/executors/infrastructure-plan/schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/schema",
   "version": 2,
-  "title": "Empire Builder Kit protected infrastructure plan",
-  "description": "Run the exact SST JSON diff through EBK normalization, risk, identity, approval, and freshness checks before protected mutation.",
+  "title": "Empire Builder Kit advisory infrastructure plan",
+  "description": "Stream one native pinned SST diff for current advisory review. The output is never retained or used as mutation authority.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -12,66 +12,26 @@
     },
     "stage": {
       "type": "string",
-      "pattern": "^[a-z0-9][a-z0-9-]*$"
+      "enum": ["development", "staging", "production"]
     },
     "stageMode": {
       "type": "string",
       "enum": ["consumer", "foundation"]
     },
-    "action": {
+    "expectedRoleArn": {
       "type": "string",
-      "enum": ["deploy", "refresh", "remove"],
-      "default": "deploy"
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+      "description": "Exact temporary-session IAM role expected for advisory planning. May also be supplied through EBK_EXPECTED_DEPLOYMENT_ROLE_ARN in GitHub."
     },
-    "operation": {
+    "profile": {
       "type": "string",
-      "enum": ["plan", "finalize-convergence"],
-      "default": "plan",
-      "description": "Plan protected infrastructure or finalize a retained successful mutation from exact deployed operational evidence."
+      "pattern": "^[A-Za-z0-9_+=,.@-]{1,128}$",
+      "description": "Optional local AWS shared-config profile used to obtain temporary federated credentials."
     },
-    "descriptorPath": {
+    "region": {
       "type": "string",
-      "description": "Project-relative infrastructure policy descriptor.",
-      "default": "operations/infrastructure-change.json"
-    },
-    "configurationPath": {
-      "type": "string",
-      "description": "Deprecated single project-relative configuration input. Use configurationPaths."
-    },
-    "configurationPaths": {
-      "type": "array",
-      "description": "Project-relative effective generated configuration inputs included in one canonical digest.",
-      "items": { "type": "string" },
-      "uniqueItems": true,
-      "default": [
-        "configuration/declarations.json",
-        "configuration/declarations.ts",
-        "configuration/local-values.json"
-      ]
-    },
-    "approvalPath": {
-      "type": "string",
-      "description": "Optional project-relative reviewed plan and approval record."
-    },
-    "pendingConvergencePath": {
-      "type": "string",
-      "description": "Project-relative apply-complete-unverified convergence record to finalize."
-    },
-    "mutationBindingPath": {
-      "type": "string",
-      "description": "Project-relative exact mutation authorization binding."
-    },
-    "smokeEvidencePath": {
-      "type": "string",
-      "description": "Project-relative exact deployed-smoke result."
-    },
-    "smokeBindingPath": {
-      "type": "string",
-      "description": "Project-relative exact deployment/smoke workflow binding."
-    },
-    "operationalEvidencePath": {
-      "type": "string",
-      "description": "Project-relative sanitized alarm and data-integrity evidence."
+      "pattern": "^[a-z]{2}(-gov)?-[a-z]+(-[a-z]+)*-[0-9]$",
+      "description": "Optional exact AWS Region assertion. It must match the committed deployment Region."
     }
   },
   "required": ["stage", "stageMode"]

package/src/executors/local-deploy/federated-credential-transport.d.ts

@@ -0,0 +1,48 @@
+import { type PrivateStateSecurity } from '../../local-dev/private-state.js';
+declare const CHILD_PROFILE = "ebk-sst-federated";
+declare const GOVERNED_SIGNALS: readonly ["SIGINT", "SIGTERM"];
+type GovernedSignal = (typeof GOVERNED_SIGNALS)[number];
+interface GovernedSignalCleanup {
+    readonly priority: number;
+    run(signal: GovernedSignal): Promise<void> | void;
+}
+/** Coordinate an exact child shutdown or private-state cleanup before the
+ * current process preserves its normal SIGINT/SIGTERM behavior. Higher
+ * priorities run first so mutation children stop before credentials vanish. */
+export declare function registerGovernedSignalCleanup(run: GovernedSignalCleanup['run'], priority?: number): () => void;
+export declare function governedSignalCleanupInProgress(): boolean;
+interface FederatedCredentialIdentity {
+    accessKeyId: string;
+    expiration?: Date;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+export interface LocalFederatedCredentialTransport {
+    readonly profile: typeof CHILD_PROFILE;
+    childEnvironment(ambient: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+    cleanup(): void;
+    refresh(): Promise<{
+        actorArn: string;
+        expiresAt: string;
+    }>;
+}
+export interface LocalFederatedCredentialTransportInput {
+    account: string;
+    expectedRoleArn: string;
+    profile?: string;
+    region: string;
+}
+export interface LocalFederatedCredentialTransportDependencies {
+    identify?: (credentials: FederatedCredentialIdentity, region: string) => Promise<{
+        Account?: string;
+        Arn?: string;
+    }>;
+    now?: () => Date;
+    removeDirectory?: (path: string) => void;
+    resolve?: () => Promise<FederatedCredentialIdentity>;
+    security?: PrivateStateSecurity;
+}
+/** Materialize temporary federated credentials for tools that cannot resolve a
+ * modern IAM Identity Center source-profile chain themselves. */
+export declare function createLocalFederatedCredentialTransport(input: LocalFederatedCredentialTransportInput, dependencies?: LocalFederatedCredentialTransportDependencies): Promise<LocalFederatedCredentialTransport>;
+export {};

package/src/executors/local-deploy/federated-credential-transport.js

@@ -0,0 +1,252 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerGovernedSignalCleanup = registerGovernedSignalCleanup;
+exports.governedSignalCleanupInProgress = governedSignalCleanupInProgress;
+exports.createLocalFederatedCredentialTransport = createLocalFederatedCredentialTransport;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const client_sts_1 = require("@aws-sdk/client-sts");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const child_environment_js_1 = require("../../aws/child-environment.js");
+const identity_js_1 = require("../../aws/identity.js");
+const private_state_js_1 = require("../../local-dev/private-state.js");
+const CHILD_PROFILE = 'ebk-sst-federated';
+const MINIMUM_REMAINING_LIFETIME_MS = 30 * 60 * 1000;
+const PROFILE = /^[A-Za-z0-9_+=,.@-]{1,128}$/u;
+const REGION = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/u;
+const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/u;
+const AMBIENT_CREDENTIAL_KEYS = [
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+    'AWS_SECURITY_TOKEN',
+    'AWS_ROLE_ARN',
+    'AWS_ROLE_SESSION_NAME',
+    'AWS_WEB_IDENTITY_TOKEN_FILE',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE',
+    'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+    'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
+    'AWS_CONFIG_FILE',
+    'AWS_CREDENTIAL_EXPIRATION',
+    'AWS_DEFAULT_PROFILE',
+    'AWS_DEFAULT_REGION',
+    'AWS_SHARED_CREDENTIALS_FILE',
+    'AWS_PROFILE',
+    'AWS_REGION',
+    'EBK_GOVERNED_PROCESS_GROUP',
+];
+const GOVERNED_SIGNALS = ['SIGINT', 'SIGTERM'];
+const governedSignalCleanups = new Set();
+const governedSignalHandlers = new Map();
+let governedSignalInProgress;
+function removeGovernedSignalHandlers() {
+    if (governedSignalCleanups.size > 0 || governedSignalInProgress)
+        return;
+    for (const [signal, handler] of governedSignalHandlers) {
+        process.removeListener(signal, handler);
+    }
+    governedSignalHandlers.clear();
+}
+async function handleGovernedSignal(signal, handler) {
+    if (governedSignalInProgress)
+        return;
+    governedSignalInProgress = signal;
+    const hasExternalListener = process
+        .listeners(signal)
+        .some((listener) => listener !== handler);
+    let cleanupFailed = false;
+    for (const cleanup of [...governedSignalCleanups].sort((left, right) => right.priority - left.priority)) {
+        try {
+            await cleanup.run(signal);
+        }
+        catch {
+            cleanupFailed = true;
+        }
+    }
+    governedSignalInProgress = undefined;
+    removeGovernedSignalHandlers();
+    if (cleanupFailed) {
+        process.stderr.write('Governed signal cleanup failed; private recovery evidence was retained.\n');
+    }
+    if (!hasExternalListener) {
+        const retainedHandler = governedSignalHandlers.get(signal);
+        if (retainedHandler) {
+            process.removeListener(signal, retainedHandler);
+            governedSignalHandlers.delete(signal);
+        }
+        process.kill(process.pid, signal);
+    }
+}
+function ensureGovernedSignalHandlers() {
+    for (const signal of GOVERNED_SIGNALS) {
+        if (governedSignalHandlers.has(signal))
+            continue;
+        const handler = () => {
+            void handleGovernedSignal(signal, handler);
+        };
+        governedSignalHandlers.set(signal, handler);
+        process.prependListener(signal, handler);
+    }
+}
+/** Coordinate an exact child shutdown or private-state cleanup before the
+ * current process preserves its normal SIGINT/SIGTERM behavior. Higher
+ * priorities run first so mutation children stop before credentials vanish. */
+function registerGovernedSignalCleanup(run, priority = 0) {
+    const cleanup = { priority, run };
+    governedSignalCleanups.add(cleanup);
+    ensureGovernedSignalHandlers();
+    let registered = true;
+    return () => {
+        if (!registered)
+            return;
+        registered = false;
+        governedSignalCleanups.delete(cleanup);
+        removeGovernedSignalHandlers();
+    };
+}
+function governedSignalCleanupInProgress() {
+    return governedSignalInProgress !== undefined;
+}
+function requireCredentialValue(value, label) {
+    if (!value || value !== value.trim() || /[\r\n]/u.test(value)) {
+        throw new Error(`Temporary federated ${label} is missing or malformed.`);
+    }
+    return value;
+}
+function credentialsFile(identity) {
+    return `[${CHILD_PROFILE}]\naws_access_key_id = ${requireCredentialValue(identity.accessKeyId, 'access key')}\naws_secret_access_key = ${requireCredentialValue(identity.secretAccessKey, 'secret key')}\naws_session_token = ${requireCredentialValue(identity.sessionToken, 'session token')}\n`;
+}
+function configFile(region) {
+    return `[profile ${CHILD_PROFILE}]\nregion = ${region}\noutput = json\n`;
+}
+/** Materialize temporary federated credentials for tools that cannot resolve a
+ * modern IAM Identity Center source-profile chain themselves. */
+async function createLocalFederatedCredentialTransport(input, dependencies = {}) {
+    if (!/^\d{12}$/u.test(input.account) ||
+        !ROLE.test(input.expectedRoleArn) ||
+        (input.profile !== undefined && !PROFILE.test(input.profile)) ||
+        !REGION.test(input.region)) {
+        throw new Error('Local federated credential transport input is invalid.');
+    }
+    const security = dependencies.security ?? {};
+    const directory = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ebk-sst-federated-'));
+    const configurationPath = (0, node_path_1.join)(directory, 'config');
+    const credentialsPath = (0, node_path_1.join)(directory, 'credentials');
+    let closed = false;
+    let disposed = false;
+    let actorArn = '';
+    let expiresAt = '';
+    let unregisterSignalCleanup = () => undefined;
+    (0, private_state_js_1.hardenPrivatePath)(directory, 'directory', security);
+    (0, private_state_js_1.assertPrivatePath)(directory, 'directory', security);
+    const cleanupFiles = (signalCoordinator = false) => {
+        if (disposed)
+            return true;
+        closed = true;
+        if (governedSignalInProgress && !signalCoordinator)
+            return false;
+        try {
+            (dependencies.removeDirectory ??
+                ((path) => (0, node_fs_1.rmSync)(path, { force: true, recursive: true })))(directory);
+            disposed = true;
+            unregisterSignalCleanup();
+            return true;
+        }
+        catch {
+            throw new Error('Local federated credential transport cleanup failed.');
+        }
+    };
+    const onExit = () => {
+        try {
+            cleanupFiles(true);
+        }
+        catch {
+            // Credentials are temporary and the directory remains user-private if
+            // process-exit cleanup itself cannot report an error.
+        }
+    };
+    unregisterSignalCleanup = registerGovernedSignalCleanup(() => {
+        cleanupFiles(true);
+        process.removeListener('exit', onExit);
+    });
+    process.once('exit', onExit);
+    const resolve = dependencies.resolve ??
+        (input.profile
+            ? (0, credential_providers_1.fromIni)({ profile: input.profile })
+            : (0, credential_providers_1.fromNodeProviderChain)());
+    const identify = dependencies.identify ??
+        (async (credentials, region) => new client_sts_1.STSClient({
+            credentials,
+            endpoint: (0, identity_js_1.canonicalStsEndpoint)(region),
+            region,
+        }).send(new client_sts_1.GetCallerIdentityCommand({})));
+    const refresh = async () => {
+        if (closed || disposed) {
+            throw new Error('Local federated credential transport is already closed.');
+        }
+        const identity = await resolve();
+        requireCredentialValue(identity.accessKeyId, 'access key');
+        requireCredentialValue(identity.secretAccessKey, 'secret key');
+        requireCredentialValue(identity.sessionToken, 'session token');
+        const expiration = identity.expiration;
+        const now = (dependencies.now ?? (() => new Date()))();
+        if (!(expiration instanceof Date) ||
+            !Number.isFinite(expiration.getTime()) ||
+            expiration.getTime() - now.getTime() < MINIMUM_REMAINING_LIFETIME_MS) {
+            throw new Error('Local deployment requires temporary federated credentials with at least 30 minutes remaining.');
+        }
+        const caller = await identify(identity, input.region);
+        const callerArn = caller.Arn?.trim() ?? '';
+        if (caller.Account?.trim() !== input.account ||
+            !(0, identity_js_1.matchesExpectedAssumedRoleArn)(input.account, callerArn, input.expectedRoleArn)) {
+            throw new Error('Temporary SST child credentials do not match the committed account and exact assumed role.');
+        }
+        (0, private_state_js_1.atomicWritePrivateFile)(configurationPath, configFile(input.region), security);
+        (0, private_state_js_1.atomicWritePrivateFile)(credentialsPath, credentialsFile(identity), security);
+        (0, private_state_js_1.assertPrivatePath)(directory, 'directory', security);
+        (0, private_state_js_1.assertPrivatePath)(configurationPath, 'file', security);
+        (0, private_state_js_1.assertPrivatePath)(credentialsPath, 'file', security);
+        actorArn = callerArn;
+        expiresAt = expiration.toISOString();
+        return { actorArn, expiresAt };
+    };
+    try {
+        await refresh();
+    }
+    catch (error) {
+        if (cleanupFiles())
+            process.removeListener('exit', onExit);
+        throw error;
+    }
+    return {
+        profile: CHILD_PROFILE,
+        childEnvironment(ambient) {
+            if (closed || disposed || !expiresAt) {
+                throw new Error('Local federated credential transport is unavailable.');
+            }
+            (0, private_state_js_1.assertPrivatePath)(directory, 'directory', security);
+            (0, private_state_js_1.assertPrivatePath)(configurationPath, 'file', security);
+            (0, private_state_js_1.assertPrivatePath)(credentialsPath, 'file', security);
+            const environment = (0, child_environment_js_1.sanitizeGovernedAwsChildEnvironment)(ambient);
+            for (const key of AMBIENT_CREDENTIAL_KEYS)
+                delete environment[key];
+            return {
+                ...environment,
+                AWS_CONFIG_FILE: configurationPath,
+                AWS_DEFAULT_REGION: input.region,
+                AWS_PROFILE: CHILD_PROFILE,
+                AWS_REGION: input.region,
+                AWS_SDK_LOAD_CONFIG: '1',
+                AWS_SHARED_CREDENTIALS_FILE: credentialsPath,
+            };
+        },
+        cleanup() {
+            if (cleanupFiles())
+                process.removeListener('exit', onExit);
+        },
+        refresh,
+    };
+}
+//# sourceMappingURL=federated-credential-transport.js.map

package/src/executors/local-deploy/local-approval.d.ts

@@ -0,0 +1,18 @@
+import type { ReadStream, WriteStream } from 'node:tty';
+export interface LocalMutationApprovalRequest {
+    action: 'deploy';
+    challenge: string;
+    sourceCommit: string;
+    stage: 'production' | 'staging';
+}
+export type LocalMutationApprover = (request: LocalMutationApprovalRequest) => Promise<boolean>;
+export declare class LocalMutationApprovalUnavailableError extends Error {
+    constructor();
+}
+interface LocalApprovalTerminal {
+    input: ReadStream;
+    output: WriteStream;
+}
+/** Active operator acknowledgement, not an independent-review claim. */
+export declare function createTtyLocalMutationApprover(terminal?: LocalApprovalTerminal): LocalMutationApprover;
+export {};

package/src/executors/local-deploy/local-approval.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalMutationApprovalUnavailableError = void 0;
+exports.createTtyLocalMutationApprover = createTtyLocalMutationApprover;
+const promises_1 = require("node:readline/promises");
+class LocalMutationApprovalUnavailableError extends Error {
+    constructor() {
+        super('Local protected-stage mutation requires a human at an interactive TTY to type the exact acknowledgement challenge. Development needs no acknowledgement. An agent without a terminal should hand the human the exact command to run in their own terminal, or propose the change through the protected GitHub workflow.');
+        this.name = 'LocalMutationApprovalUnavailableError';
+    }
+}
+exports.LocalMutationApprovalUnavailableError = LocalMutationApprovalUnavailableError;
+/** Active operator acknowledgement, not an independent-review claim. */
+function createTtyLocalMutationApprover(terminal = {
+    input: process.stdin,
+    output: process.stderr,
+}) {
+    return async ({ challenge }) => {
+        if (!terminal.input.isTTY || !terminal.output.isTTY) {
+            throw new LocalMutationApprovalUnavailableError();
+        }
+        const prompt = (0, promises_1.createInterface)({
+            input: terminal.input,
+            output: terminal.output,
+            terminal: true,
+        });
+        try {
+            const response = await prompt.question(`Type ${challenge} to continue: `);
+            return response === challenge;
+        }
+        catch {
+            throw new LocalMutationApprovalUnavailableError();
+        }
+        finally {
+            prompt.close();
+        }
+    };
+}
+//# sourceMappingURL=local-approval.js.map

package/src/executors/local-deploy/local-deploy.d.ts

@@ -0,0 +1,112 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
+import { type LifecycleBaseline, type LifecycleMode, type LifecycleScope } from '../../workspace-deployment/affected-lifecycle.js';
+import { type CanonicalDeploymentStage, type RepositoryOperatingPolicy } from '../../repository-policy/index.js';
+import { attestProductionDatabaseLifecycle } from '../foundation-profile-preflight/production-database-safeguard.js';
+import { createLocalFederatedCredentialTransport } from './federated-credential-transport.js';
+import { type LocalMutationApprover } from './local-approval.js';
+import { assertWorkspaceStageOwnershipForWorkspace } from '../../workspace-deployment/index.js';
+import { runGithubPrivateSmoke } from '../../foundation/private-smoke-access.js';
+import { runLocalPrivateSmoke } from '../../foundation/local-private-smoke-access.js';
+interface LocalDeployOptions {
+    /** Newest successful deployment receipt on this branch (protected runs). */
+    baselineReceipt?: string;
+    baselineRunAttempt?: string | number;
+    baselineRunId?: string | number;
+    expectedRoleArn: string;
+    /** affected: skip Slices unchanged since the baseline; full: deploy all. */
+    lifecycleScope?: LifecycleMode;
+    profile?: string;
+    /** Local explicit selection; never a protected full-stage baseline. */
+    slices?: string[];
+    stage: CanonicalDeploymentStage;
+}
+interface LocalDeployDependencies {
+    approve?: LocalMutationApprover;
+    attestContainerBinding?: typeof attestLocalContainerBinding;
+    attestProductionDatabase?: typeof attestProductionDatabaseLifecycle;
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    identifyGithubCaller?: (region: string) => Promise<{
+        Account?: string;
+        Arn?: string;
+    }>;
+    now?: () => Date;
+    ownership?: typeof assertWorkspaceStageOwnershipForWorkspace;
+    platform?: NodeJS.Platform;
+    run?: typeof spawnSync;
+    spawnChild?: typeof spawn;
+    privateSmoke?: typeof runGithubPrivateSmoke;
+    localPrivateSmoke?: typeof runLocalPrivateSmoke;
+}
+interface ProjectDescriptor {
+    name: string;
+    root: string;
+    tags: readonly string[];
+    targets: Readonly<Record<string, unknown>>;
+}
+interface ChildReceipt {
+    completedAt: string;
+    outcome: 'failed' | 'skipped-unchanged' | 'succeeded';
+    reused?: LifecycleBaseline;
+    project: string;
+    startedAt: string;
+    target: 'container-release-amd64' | 'container-release-arm64' | 'container-release-assemble' | 'deploy' | 'production-database-final-postflight' | 'production-database-postflight' | 'profile-preflight' | 'release-candidate' | 'smoke-deployed';
+}
+export interface DeploymentReceipt {
+    account: string;
+    actor: string;
+    authority: 'github' | 'local';
+    children: readonly ChildReceipt[];
+    completedAt: string;
+    frameworkVersion: string;
+    failure?: {
+        project: string;
+        operation: 'deploy';
+        phase: string;
+        mutationStatus: 'not-attempted' | 'may-have-changed';
+        nextAction: string;
+        secondaryPhases?: readonly ['source-reconciliation'];
+    };
+    kind: 'ebk-deployment-receipt';
+    lifecycleScope?: LifecycleScope;
+    migrations: Readonly<Record<string, 'completed-by-deploy-target' | 'not-applicable' | 'unchanged-since-baseline'>>;
+    outcome: 'failed' | 'review-required' | 'succeeded';
+    profile: RepositoryOperatingPolicy['deploymentProfile'];
+    region: string;
+    schemaVersion: 1;
+    /** Present only for explicit local selection, not complete-stage acceptance. */
+    selectedSlices?: readonly string[];
+    smoke: Readonly<Record<string, 'not-applicable' | 'passed' | 'unchanged-since-baseline'>>;
+    source: {
+        clean: boolean;
+        commit: string;
+        workingTreeDigest: string;
+    };
+    stage: CanonicalDeploymentStage;
+    startedAt: string;
+}
+/** Bind a development deployment to the exact tracked diff and untracked
+ * source bytes without requiring a commit. Ignored caches and build output are
+ * intentionally outside this identity. */
+export declare function localWorkingTreeDigest(root: string, run?: typeof spawnSync): {
+    clean: boolean;
+    commit: string;
+    digest: string;
+};
+declare function attestLocalContainerBinding(input: {
+    account: string;
+    project: ProjectDescriptor;
+    region: string;
+    root: string;
+    sourceCommit: string;
+    stage: CanonicalDeploymentStage;
+}): void;
+export declare function deployedSourceCommit(sourceCommit: string, environment?: NodeJS.ProcessEnv): string;
+/** Determine the one native deployment order. Foundation is always first and
+ * production Slice admission remains a committed policy decision. */
+export declare function localDeploymentProjectOrder(policy: RepositoryOperatingPolicy, context: ExecutorContext, stage: CanonicalDeploymentStage, requestedSlices?: readonly string[]): string[];
+export declare function runLocalDeploy(options: LocalDeployOptions, context: ExecutorContext, dependencies?: LocalDeployDependencies): Promise<{
+    success: boolean;
+}>;
+declare const executor: PromiseExecutor<LocalDeployOptions>;
+export default executor;