@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/developer-agent/planning.d.ts

@@ -1,4 +1,4 @@
-import { type DeveloperAgentContext, type DeveloperAgentGeneratorInput, type DeveloperAgentGeneratorPreview, type DeveloperAgentPlan } from './model.js';
+import { type DeveloperAgentAuthorityClass, type DeveloperAgentContext, type DeveloperAgentGeneratorInput, type DeveloperAgentGeneratorPreview, type DeveloperAgentPlan } from './model.js';
 import { type DeveloperAgentOperationRegistry } from './operation-registry.js';
 export interface DeveloperAgentPlanRequest {
     acceptanceCriteriaReference: string;
@@ -15,4 +15,11 @@ export declare class DeveloperAgentPlanInputError extends Error {
     readonly classification: "invalid-input";
     constructor(message: string);
 }
+/**
+ * Names the gate an approval point actually stands for. Development-stage
+ * work through the bounded owners carries no approval point at all; the
+ * remaining points are protected authority, destructive recovery, an explicit
+ * shared-state apply, or host-level consent (dev-setup trust and ports).
+ */
+export declare function approvalPointDescription(authority: DeveloperAgentAuthorityClass): string;
 export declare function planDeveloperAgentWork(context: DeveloperAgentContext, registry: DeveloperAgentOperationRegistry, request: DeveloperAgentPlanRequest, options?: DeveloperAgentPlanOptions): DeveloperAgentPlan;

package/src/developer-agent/planning.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeveloperAgentPlanInputError = void 0;
+exports.approvalPointDescription = approvalPointDescription;
 exports.planDeveloperAgentWork = planDeveloperAgentWork;
 const model_js_1 = require("./model.js");
 const index_js_1 = require("../testing-evidence/index.js");
@@ -93,10 +94,11 @@ function isSafeWorkspacePath(path) {
         (0, workspace_path_js_1.isCanonicalDeveloperAgentWorkspacePath)(path) &&
         path.split('/').every((segment) => segment.length > 0 && segment !== '.'));
 }
-function blockingWarnings(context, readOnly, upgradeTarget) {
+function blockingWarnings(context, readOnly, upgradeTarget, allowDirtyDevelopment = false) {
     const blocking = new Set(model_js_1.DEVELOPER_AGENT_CONTEXT_BLOCKING_FAILURES);
     if (!readOnly) {
-        blocking.add('dirty-worktree');
+        if (!allowDirtyDevelopment)
+            blocking.add('dirty-worktree');
         blocking.add('stale-base');
     }
     const ownershipVersions = context.workspace.ownershipVersions;
@@ -120,16 +122,14 @@ function blockingWarnings(context, readOnly, upgradeTarget) {
         }
         if (upgradeTarget === 'workspace')
             return true;
-        if (upgradeTarget === 'foundation' &&
-            !hasExpectedVersionDrift('workspace')) {
-            return drift.kind === 'foundation' && drift.target === 'foundation';
-        }
-        if (upgradeTarget !== 'foundation' &&
-            !hasExpectedVersionDrift('workspace') &&
-            !hasExpectedVersionDrift('foundation')) {
-            return drift.kind === 'slice' && drift.target === upgradeTarget;
+        if (hasExpectedVersionDrift('workspace'))
+            return false;
+        if (upgradeTarget === 'foundation') {
+            return drift.kind === 'foundation' || drift.kind === 'slice';
         }
-        return false;
+        if (hasExpectedVersionDrift('foundation'))
+            return false;
+        return drift.kind === 'slice';
     };
     return context.warnings.filter((warning) => blocking.has(warning.classification) &&
         !mayConsumeExpectedVersionDrift(warning));
@@ -223,6 +223,27 @@ function policyBlockers(context, operation) {
     }
     return blockers;
 }
+/**
+ * Names the gate an approval point actually stands for. Development-stage
+ * work through the bounded owners carries no approval point at all; the
+ * remaining points are protected authority, destructive recovery, an explicit
+ * shared-state apply, or host-level consent (dev-setup trust and ports).
+ */
+function approvalPointDescription(authority) {
+    switch (authority) {
+        case 'protected-mutate':
+            return 'Matching GitHub environment and OIDC authority';
+        case 'destructive':
+            return 'Explicit human approval of the exact target and retained recovery proof';
+        case 'protected-propose':
+            return 'Human approval before the owning tool applies shared GitHub or AWS state with --apply';
+        case 'development-mutate':
+            return 'Human consent to host trust-store or privileged port-forwarding changes; the human answers any OS credential prompt';
+        case 'local-source':
+        case 'read-only':
+            return 'Explicit human approval before invoking the owning tool';
+    }
+}
 function nextAction(operation, blockers) {
     if (blockers.length > 0) {
         return {
@@ -352,7 +373,9 @@ function planDeveloperAgentWork(context, registry, request, options = {}) {
     const blockers = [
         ...blockingWarnings(context, readOnlyForSourceWarnings, request.generatorInput?.generator === 'upgrade'
             ? request.generatorInput.name
-            : undefined),
+            : undefined, operation.owner === 'source-edit' ||
+            (operation.authority === 'development-mutate' &&
+                context.policy.canonicalStage === 'development')),
         ...concurrentPathBlockers(context, selectedFiles, readOnlyForSourceWarnings),
         ...policyBlockers(context, operation),
     ].filter((blocker, index, values) => values.findIndex((candidate) => candidate.classification === blocker.classification &&
@@ -380,9 +403,7 @@ function planDeveloperAgentWork(context, registry, request, options = {}) {
             ? [
                 {
                     authority: operation.authority,
-                    description: operation.authority === 'protected-mutate'
-                        ? 'Matching GitHub environment and OIDC authority'
-                        : 'Explicit owning-tool approval',
+                    description: approvalPointDescription(operation.authority),
                 },
             ]
             : [],
@@ -438,7 +459,9 @@ function planDeveloperAgentWork(context, registry, request, options = {}) {
         selectedProjects: operation.projects,
         verification: [
             ...new Set([
-                ...context.requiredVerification,
+                ...(operation.owner === 'source-edit'
+                    ? []
+                    : context.requiredVerification),
                 ...operation.requiredVerification,
             ]),
         ].sort(),

package/src/developer-agent/preview-changes.d.ts

@@ -21,6 +21,8 @@ export declare class DeferredDeveloperAgentTree implements Tree {
     isFile(path: string): boolean;
     children(path: string): string[];
     listChanges(): FileChange[];
+    /** Inspect pending configuration without adding parent edits to this transaction. */
+    hasPendingChange(path: string): boolean;
     changePermissions(path: string, mode: Mode): void;
     apply(): void;
 }

package/src/developer-agent/preview-changes.js

@@ -64,7 +64,9 @@ function developerAgentPreviewOwnershipModes(tree, target) {
         }
         add('', result.value);
     }
-    if (target === 'foundation') {
+    if (target === 'foundation' ||
+        (target !== 'workspace' &&
+            tree.exists('packages/foundation/.ebk/ownership.json'))) {
         const source = tree.read('packages/foundation/.ebk/ownership.json', 'utf8');
         const result = (0, index_js_1.validateFoundationOwnershipRecord)(JSON.parse(source ?? 'null'));
         if (!result.valid) {
@@ -72,7 +74,7 @@ function developerAgentPreviewOwnershipModes(tree, target) {
         }
         add('packages/foundation', result.value);
     }
-    else if (target !== 'workspace') {
+    if (target !== 'workspace' && target !== 'foundation') {
         const prefix = `packages/${target}`;
         const source = tree.read(`${prefix}/.ebk/ownership.json`, 'utf8');
         const result = (0, index_js_1.validateGeneratedOwnershipRecord)(JSON.parse(source ?? 'null'));
@@ -181,6 +183,16 @@ class DeferredDeveloperAgentTree {
         }))
             .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.path, right.path));
     }
+    /** Inspect pending configuration without adding parent edits to this transaction. */
+    hasPendingChange(path) {
+        const normalized = canonicalPath(path);
+        return (this.changes.has(normalized) ||
+            (this.source instanceof DeferredDeveloperAgentTree
+                ? this.source.hasPendingChange(normalized)
+                : this.source
+                    .listChanges()
+                    .some((change) => change.path === normalized)));
+    }
     changePermissions(path, mode) {
         const contents = this.current(path);
         if (contents === null) {

package/src/developer-agent/preview-source.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.developerAgentGeneratorPreviewSource = developerAgentGeneratorPreviewSource;
 function developerAgentGeneratorPreviewSource(context) {
+    if (context.git.commit === null) {
+        throw new Error('Commit-bound generator previews require an initial Git commit; local orientation and feature checks do not establish committed-source authority.');
+    }
     return {
         blueprintVersions: [...context.workspace.blueprintVersions],
         ...(context.workspace.candidateProvenance

package/src/developer-agent/validation.js

@@ -54,7 +54,11 @@ const OPERATION_OWNER_SET = new Set(model_js_1.DEVELOPER_AGENT_OPERATION_OWNERS)
 const POLICY_LIFECYCLE_ACTION_SET = new Set(model_js_1.DEVELOPER_AGENT_POLICY_LIFECYCLE_ACTIONS);
 const STABLE_GENERATOR_SET = new Set(model_js_1.DEVELOPER_AGENT_STABLE_GENERATORS);
 const GENERATOR_MODE_SET = new Set(model_js_1.DEVELOPER_AGENT_GENERATOR_MODES);
-const PRODUCTION_PROFILE_SET = new Set(['cost-optimized', 'standard']);
+const PRODUCTION_PROFILE_SET = new Set([
+    'cost-optimized',
+    'balanced',
+    'standard',
+]);
 const BLOCKING_FAILURES = new Set([
     'unsupported-operation',
     'invalid-input',
@@ -478,10 +482,20 @@ function validateGitContext(value, path, issues) {
         return false;
     requireInteger(record.ahead, `${path}.ahead`, issues, 0, 1_000_000);
     requireInteger(record.behind, `${path}.behind`, issues, 0, 1_000_000);
-    requireSafeString(record.commit, `${path}.commit`, issues, {
-        maximumLength: 64,
-        pattern: COMMIT_PATTERN,
-    });
+    if (record.commit !== null) {
+        requireSafeString(record.commit, `${path}.commit`, issues, {
+            maximumLength: 64,
+            pattern: COMMIT_PATTERN,
+        });
+    }
+    else if (typeof record.branch !== 'string' ||
+        record.ahead !== 0 ||
+        record.behind !== 0 ||
+        has(record, 'upstream') ||
+        has(record, 'baseCommit') ||
+        has(record, 'headCommit')) {
+        addIssue(issues, `${path}.commit`, 'uncommitted state requires a symbolic branch without upstream or comparison authority');
+    }
     requireBoolean(record.concurrentChangeInspectionComplete, `${path}.concurrentChangeInspectionComplete`, issues);
     const concurrentChanges = requireArray(record.concurrentChanges, `${path}.concurrentChanges`, issues, MAX_CONCURRENT_PATHS);
     const concurrentPaths = new Set();
@@ -516,10 +530,12 @@ function validateGitContext(value, path, issues) {
         }
         requireInteger(concurrent.worktreeCount, `${entryPath}.worktreeCount`, issues, 1, 64);
     });
-    requireSafeString(record.defaultBaseCommit, `${path}.defaultBaseCommit`, issues, {
-        maximumLength: 64,
-        pattern: COMMIT_PATTERN,
-    });
+    if (record.defaultBaseCommit !== null) {
+        requireSafeString(record.defaultBaseCommit, `${path}.defaultBaseCommit`, issues, {
+            maximumLength: 64,
+            pattern: COMMIT_PATTERN,
+        });
+    }
     requireSafeString(record.defaultBaseRef, `${path}.defaultBaseRef`, issues, {
         maximumLength: MAX_PATH_LENGTH,
     });

package/src/developer-agent/workspace-inspection.js

@@ -6,6 +6,7 @@ const node_util_1 = require("node:util");
 const semver_1 = require("semver");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const contracts_js_1 = require("../local-dev/contracts.js");
 const index_js_1 = require("../ownership/index.js");
 const index_js_2 = require("../repository-policy/index.js");
 const index_js_3 = require("../work-markers/index.js");
@@ -222,7 +223,22 @@ function selectedDependencyClosureNodes(graph, selected) {
         const node = pending.pop();
         if (!node)
             continue;
-        for (const { target } of graph.dependencies[node.name] ?? []) {
+        let localDependencies = [];
+        try {
+            const adapter = (0, contracts_js_1.validateLocalDevAdapter)(node.data.metadata?.['ebk']
+                ?.localDev);
+            if (adapter.adapterVersion === 3) {
+                localDependencies = adapter.dependencySlices;
+            }
+        }
+        catch {
+            // The operation registry rejects malformed metadata; do not traverse it.
+        }
+        const dependencyNames = new Set([
+            ...(graph.dependencies[node.name] ?? []).map(({ target }) => target),
+            ...localDependencies,
+        ]);
+        for (const target of dependencyNames) {
             const dependency = graph.nodes[target];
             if (!dependency || closure.has(target))
                 continue;
@@ -612,7 +628,7 @@ function protectedExternalBlueprintVerification(root, frameworkVersion, records,
                 git.defaultBaseRef === 'refs/remotes/origin/develop'
                 ? 'develop'
                 : undefined;
-        if (!protectedBranch)
+        if (!protectedBranch || !git.commit || !git.defaultBaseCommit)
             return unavailable();
         const configurationPaths = (0, blueprint_verification_authority_js_1.assertNoMutableBlueprintVerificationConfiguration)(root);
         (0, blueprint_verification_authority_js_1.assertBlueprintVerificationNxAuthority)(readBoundedWorkspaceFile(root, 'nx.json', 'Blueprint verification Nx authority', MAX_CONTROL_JSON_BYTES).bytes.toString('utf8'));
@@ -862,6 +878,23 @@ function policyContext(root, stage, policy, nodes) {
         };
     });
     const fields = [
+        {
+            name: 'workspaceDeploymentId',
+            value: policy.workspaceDeploymentId,
+        },
+        {
+            name: 'workspaceDeploymentProvenance.kind',
+            value: policy.workspaceDeploymentProvenance.kind,
+        },
+        { name: 'deploymentProfile', value: policy.deploymentProfile },
+        {
+            name: 'deploymentRegion',
+            value: policy.deploymentRegion ?? 'unconfigured',
+        },
+        ...['development', 'staging', 'production'].map((stage) => ({
+            name: `deploymentAccounts.${stage}`,
+            value: policy.deploymentAccounts[stage] ?? 'unconfigured',
+        })),
         { name: 'productionAccess', value: policy.productionAccess },
         {
             name: 'productionApproval.mode',
@@ -886,11 +919,16 @@ function policyContext(root, stage, policy, nodes) {
         decisions,
         policy: {
             $schema: policy.$schema ?? null,
+            deploymentAccounts: policy.deploymentAccounts,
+            deploymentProfile: policy.deploymentProfile,
+            deploymentRegion: policy.deploymentRegion,
             productionAccess: policy.productionAccess,
             productionApproval: policy.productionApproval,
             productionFoundation: policy.productionFoundation,
             schemaVersion: policy.schemaVersion,
             slices: Object.fromEntries(Object.entries(policy.slices).sort(([left], [right]) => (0, ordering_js_1.compareDeveloperAgentStrings)(left, right))),
+            workspaceDeploymentId: policy.workspaceDeploymentId,
+            workspaceDeploymentProvenance: policy.workspaceDeploymentProvenance,
         },
         selected,
         stage,
@@ -1047,8 +1085,7 @@ function inspectDeveloperAgentWorkspace(options) {
     let policy;
     const policyWarnings = [];
     try {
-        const policySource = readBoundedWorkspaceFile(root, index_js_2.REPOSITORY_POLICY_FILE, 'Repository Operating Policy', MAX_CONTROL_JSON_BYTES).bytes.toString('utf8');
-        policy = (0, index_js_2.parseRepositoryOperatingPolicy)(policySource, index_js_2.REPOSITORY_POLICY_FILE);
+        policy = (0, index_js_2.readRepositoryOperatingPolicy)(root);
     }
     catch {
         policyWarnings.push(warning('policy-conflict', 'Repository Operating Policy is missing, malformed, or contradictory.'));
@@ -1062,12 +1099,17 @@ function inspectDeveloperAgentWorkspace(options) {
     const marker = markerContext(root);
     const projectTargets = registryNodes.map((node) => ({
         context: projectContext(options.graph, node),
+        localDev: node.data.metadata?.['ebk']?.localDev,
         targets: (node.data.targets ?? {}),
     }));
     const externalVerification = protectedExternalBlueprintVerification(root, versions.workspace.frameworkVersion, ownership.records, options.graph, new Set(registryNodes.map(({ name }) => name)), options.blueprintTrustNow ?? new Date().toISOString(), options.git);
     const operationRegistry = (0, operation_registry_js_1.createDeveloperAgentOperationRegistry)(projectTargets, {
+        allSliceProjectNames: Object.values(options.graph.nodes)
+            .filter((node) => node.data.tags?.includes('type:slice'))
+            .map(({ name }) => name),
         exposedProjectNames: nodes.map(({ name }) => name),
         externalOwnedProjectNames: externalOwnedProjectNames(root, registryNodes, externalOwnershipRoots, options.externalOwnershipHistory, foundationProjectName),
+        externalOwnershipHistoryComplete: options.externalOwnershipHistory.complete,
         namedInputDefinitions: [
             options.workspaceNamedInputs ?? { runtime: 'uninspected' },
             ...Object.values(options.graph.nodes).map((node) => node.data.namedInputs ?? {}),
@@ -1088,13 +1130,26 @@ function inspectDeveloperAgentWorkspace(options) {
         ...externalVerification.warnings,
         ...unsupportedWarnings,
     ]);
+    // The name "verify" alone is not a framework verification obligation.
+    // Adopter-owned authoring projects may run arbitrary recipe checks; they
+    // remain visible but cannot inject authority into an unrelated operation.
+    // Keep generated obligations even when their implementation is tampered
+    // with, so planning still refuses unauthenticated required verification.
+    const governedProjectNames = new Set([
+        identity.name,
+        ...(foundationProjectName ? [foundationProjectName] : []),
+        ...ownership.records.flatMap(({ slice }) => slice ? [slice.slice, ...slice.projects] : []),
+    ]);
+    const authenticatedTargets = new Set(operationRegistry.authenticatedTargets);
     const requiredVerification = [
         ...new Set([
             ...ownership.records.flatMap((record) => record.slice && selectedProjectNames.has(record.slice.slice)
                 ? record.slice.verification.map((target) => `${record.slice.slice}:${target}`)
                 : []),
             ...projects
-                .filter(({ targets }) => targets.includes('verify'))
+                .filter(({ name, targets }) => targets.includes('verify') &&
+                (governedProjectNames.has(name) ||
+                    authenticatedTargets.has(`${name}:verify`)))
                 .map(({ name }) => `${name}:verify`),
         ]),
     ].sort();

package/src/executors/blueprint-trust/blueprint-trust.js

@@ -16,6 +16,12 @@ const TARGET_OPTIONS = Object.freeze({
         protectedBranch: 'develop',
         protectedRef: 'refs/remotes/origin/develop',
     }),
+    'blueprint-trust-check-main': Object.freeze({
+        operation: 'adopt',
+        output: '.ebk/evidence/supply-chain/blueprint-trust.json',
+        protectedBranch: 'main',
+        protectedRef: 'refs/remotes/origin/main',
+    }),
     'blueprint-trust-check-protected': Object.freeze({
         operation: 'deploy',
         output: '.ebk/evidence/supply-chain/blueprint-trust.json',

package/src/executors/deployment-plan/deployment-plan.d.ts

@@ -7,3 +7,5 @@ interface DeploymentPlanOptions {
 }
 declare const executor: PromiseExecutor<DeploymentPlanOptions>;
 export default executor;
+/** Derive protected OCI work from the committed inventory, not Slice existence. */
+export declare function hasContainerArtifacts(value: unknown): boolean;

package/src/executors/deployment-plan/deployment-plan.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasContainerArtifacts = hasContainerArtifacts;
 const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
 const devkit_1 = require("@nx/devkit");
 const index_js_1 = require("../../repository-policy/index.js");
 const index_js_2 = require("../../work-markers/index.js");
@@ -10,11 +12,22 @@ function writeGithubOutputs(plan) {
         return;
     (0, node_fs_1.appendFileSync)(output, [
         `foundation_project=${plan.foundationProject ?? ''}`,
+        `deployment_profile=${plan.deploymentProfile}`,
+        `deployment_region=${plan.deploymentRegion}`,
+        `development_account_id=${plan.deploymentAccounts.development ?? ''}`,
+        `staging_account_id=${plan.deploymentAccounts.staging ?? ''}`,
+        `production_account_id=${plan.deploymentAccounts.production ?? ''}`,
         `foundation_profile=${plan.effectiveProductionProfile ?? ''}`,
         `has_slices=${plan.sliceProjects.length > 0 ? 'true' : 'false'}`,
         `ordered_projects=${plan.orderedProjects.join(',')}`,
         `production_approval_mode=${plan.productionApprovalMode}`,
         `slice_projects=${plan.sliceProjects.join(',')}`,
+        // One matrix row per selected Slice so the protected OCI build fans out
+        // per Slice and architecture instead of looping on one runner.
+        `slice_matrix=${JSON.stringify(plan.sliceProjects.map((project) => ({ project })))}`,
+        `has_containers=${plan.containerProjects.length > 0 ? 'true' : 'false'}`,
+        `container_projects=${plan.containerProjects.join(',')}`,
+        `container_matrix=${JSON.stringify(plan.containerProjects.map((project) => ({ project })))}`,
         '',
     ].join('\n'), 'utf8');
 }
@@ -38,8 +51,23 @@ const executor = async (options, context) => {
                 : {}),
             stage: options.stage,
         });
-        devkit_1.logger.info(`[ebk-deployment-plan] validated before AWS access\n${JSON.stringify(plan, null, 2)}`);
-        writeGithubOutputs(plan);
+        const containerProjects = options.action === 'deploy'
+            ? plan.sliceProjects.filter((name) => {
+                const project = context.projectsConfigurations?.projects[name];
+                if (!project?.root)
+                    throw new Error(`Release inventory root is absent for ${name}.`);
+                const inventoryPath = (0, node_path_1.resolve)(context.root, project.root, 'operations/release.json');
+                const local = (0, node_path_1.relative)(context.root, inventoryPath);
+                if ((0, node_path_1.isAbsolute)(local) ||
+                    local === '..' ||
+                    local.startsWith('../') ||
+                    local.startsWith('..\\'))
+                    throw new Error(`Release inventory for ${name} is outside the workspace.`);
+                return hasContainerArtifacts(JSON.parse((0, node_fs_1.readFileSync)(inventoryPath, 'utf8')));
+            })
+            : [];
+        devkit_1.logger.info(`[ebk-deployment-plan] validated before AWS access\n${JSON.stringify({ ...plan, containerProjects }, null, 2)}`);
+        writeGithubOutputs({ ...plan, containerProjects });
         return { success: true };
     }
     catch (error) {
@@ -48,4 +76,31 @@ const executor = async (options, context) => {
     }
 };
 exports.default = executor;
+/** Derive protected OCI work from the committed inventory, not Slice existence. */
+function hasContainerArtifacts(value) {
+    const inventory = value;
+    if (inventory?.schemaVersion !== 1 ||
+        !Array.isArray(inventory.artifactInventory) ||
+        inventory.artifactInventory.length === 0)
+        throw new Error('Release inventory is absent or malformed.');
+    let containers = false;
+    for (const artifact of inventory.artifactInventory) {
+        if (!artifact ||
+            !artifact.finalArtifact ||
+            typeof artifact.finalArtifact.family !== 'string')
+            throw new Error('Release artifact identity is malformed.');
+        if (artifact.finalArtifact.family === 'sst-provider-artifact') {
+            if (artifact.finalArtifact.support !== 'unsupported')
+                throw new Error('Provider artifacts require their declared support boundary.');
+            continue;
+        }
+        if (artifact.finalArtifact.family !== 'oci-image')
+            throw new Error('Release artifact family is unsupported.');
+        if (artifact.finalArtifact.support !== 'supported' ||
+            artifact.finalArtifact.imageConsumption !== 'digest-qualified')
+            throw new Error('OCI artifacts require supported digest-qualified release identity.');
+        containers = true;
+    }
+    return containers;
+}
 //# sourceMappingURL=deployment-plan.js.map

package/src/executors/dev-doctor/dev-doctor.js

@@ -85,11 +85,10 @@ function effectiveProbeAuthorities(rootCertificatePath) {
     return (0, node_fs_1.readFileSync)(rootCertificatePath);
 }
 async function inspectLocalDevelopment(options, context, dependencies = {}) {
-    const stage = (dependencies.personalStageResolver ?? (0, personal_stage_js_1.createPersonalStageResolver)()).resolve().stage;
     const hostname = options.hostname?.trim() ||
         (0, identity_js_1.createFleetHostname)((0, identity_js_1.createFleetId)({
             checkoutPath: context.root,
-            stage,
+            stage: (dependencies.personalStageResolver ?? (0, personal_stage_js_1.createPersonalStageResolver)()).resolve(context.root).stage,
             workspaceName: context.projectName ?? 'workspace',
         }));
     const paths = (0, tls_js_1.localTlsPaths)(options.appData);
@@ -147,9 +146,17 @@ async function inspectLocalDevelopment(options, context, dependencies = {}) {
     const trust = (dependencies.inspectTrust ?? inspectCertificateTrust)(paths.rootCertificate, paths.intermediateCertificate, paths.leafCertificate, hostname);
     let authorities;
     let connectivity = 'missing';
-    if (trust === 'ready' && resolver.length > 0) {
+    {
         try {
-            authorities = effectiveProbeAuthorities(paths.rootCertificate);
+            // Prove the fleet's exact private chain without installing it into the
+            // operating system. Browser automation admits only this chain/origin.
+            authorities =
+                trust === 'ready'
+                    ? effectiveProbeAuthorities(paths.rootCertificate)
+                    : [
+                        (0, node_fs_1.readFileSync)(paths.rootCertificate),
+                        (0, node_fs_1.readFileSync)(paths.intermediateCertificate),
+                    ];
             await (dependencies.probeExplicitTls ?? effects_js_1.probeEphemeralTlsEndpoint)({
                 ca: authorities,
                 certificate: (0, node_fs_1.readFileSync)(paths.leafCertificate),
@@ -162,8 +169,8 @@ async function inspectLocalDevelopment(options, context, dependencies = {}) {
             issues.push(`Supported explicit-port TLS effect probe failed: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
-    else {
-        issues.push('The generated certificate chain is not trusted by the detected user trust provider.');
+    if (trust !== 'ready') {
+        issues.push('System trust is not installed. Use the generated verify-local-browser target for browser-scoped trust; human browsers may require explicit ebk dev setup --trust after reviewing the root.');
     }
     let state;
     if ((0, node_fs_1.existsSync)(paths.gatewayState)) {

package/src/executors/dev-task-cleanup/dev-task-cleanup.d.ts

@@ -0,0 +1,23 @@
+import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
+import { type TaskAuthorityEffects } from '../../local-dev/task-authority.js';
+import { createLocalFederatedCredentialTransport } from '../local-deploy/federated-credential-transport.js';
+import { runSstCommand, type SstLifecycleOptions } from '../sst-lifecycle/run-sst-command.js';
+import { inspectNeverCreatedTaskStack, verifyRemovedTaskStack } from './task-stack-absence.js';
+export type DevTaskCleanupOptions = Record<string, never>;
+export interface DevTaskCleanupDependencies {
+    authority?: TaskAuthorityEffects;
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    environment?: NodeJS.ProcessEnv;
+    preflight?: typeof preflightTaskRemove;
+    inspectStack?: typeof inspectNeverCreatedTaskStack;
+    verifyStack?: typeof verifyRemovedTaskStack;
+    run?: typeof runSstCommand;
+}
+declare function preflightTaskRemove(options: SstLifecycleOptions, context: ExecutorContext, environment: NodeJS.ProcessEnv): Promise<string>;
+/** Internal generated cleanup target: never accepts a caller-selected task. */
+export declare function runDevTaskCleanup(options: DevTaskCleanupOptions, context: ExecutorContext, dependencies?: DevTaskCleanupDependencies): Promise<{
+    success: boolean;
+    taskStack?: 'already-absent';
+}>;
+declare const executor: PromiseExecutor<DevTaskCleanupOptions>;
+export default executor;