@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/executors/dev-task-cleanup/dev-task-cleanup.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDevTaskCleanup = runDevTaskCleanup;
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../aws-authority/index.js");
+const fleet_launcher_js_1 = require("../../local-dev/fleet-launcher.js");
+const local_context_js_1 = require("../../local-dev/local-context.js");
+const task_authority_js_1 = require("../../local-dev/task-authority.js");
+const task_identity_js_1 = require("../../local-dev/task-identity.js");
+const federated_credential_transport_js_1 = require("../local-deploy/federated-credential-transport.js");
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+const task_stack_absence_js_1 = require("./task-stack-absence.js");
+async function preflightTaskRemove(options, context, environment) {
+    const invocation = (0, run_sst_command_js_1.buildSstCommandInvocation)('remove', options, context, environment);
+    await (0, run_sst_command_js_1.runSstLifecyclePreflights)('remove', options, context, invocation, {}, environment);
+    return invocation.cwd;
+}
+/** Internal generated cleanup target: never accepts a caller-selected task. */
+async function runDevTaskCleanup(options, context, dependencies = {}) {
+    let transport;
+    let success = false;
+    let alreadyAbsent = false;
+    try {
+        if (!options ||
+            typeof options !== 'object' ||
+            Array.isArray(options) ||
+            Reflect.ownKeys(options).length !== 0) {
+            throw new Error('Task cleanup accepts no caller options, stage, task, or AWS profile overrides.');
+        }
+        const environment = dependencies.environment ?? process.env;
+        if (environment.GITHUB_ACTIONS === 'true') {
+            throw new Error('Task cleanup is available only in the owning local worktree, not GitHub Actions.');
+        }
+        const projectName = context.projectName;
+        const project = projectName
+            ? context.projectsConfigurations?.projects[projectName]
+            : undefined;
+        if (!projectName ||
+            !project?.tags?.includes('type:slice') ||
+            project.tags.includes('scope:foundation')) {
+            throw new Error('Task cleanup requires one Product Slice, never a Foundation.');
+        }
+        const task = (0, task_identity_js_1.resolveTaskIdentity)(context.root);
+        const saved = (0, local_context_js_1.readSavedLocalDevContext)((0, fleet_launcher_js_1.resolveGitCommonDirectory)(context.root));
+        if (saved.kind !== 'ready') {
+            throw new Error('Task cleanup requires a valid saved local development AWS context. Run ebk dev configure.');
+        }
+        const verified = await (0, task_authority_js_1.verifyTaskEnvironment)(context.root, saved.resolution.context, dependencies.authority);
+        (0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified);
+        const region = verified.region;
+        const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+            accountId: verified.accountId,
+            partition: region.startsWith('cn-')
+                ? 'aws-cn'
+                : region.startsWith('us-gov-')
+                    ? 'aws-us-gov'
+                    : 'aws',
+            region,
+            stage: 'development',
+        }).deploymentRoleArn;
+        transport = await (dependencies.createTransport ?? federated_credential_transport_js_1.createLocalFederatedCredentialTransport)({
+            account: verified.accountId,
+            expectedRoleArn,
+            profile: saved.resolution.context.profile,
+            region,
+        });
+        await transport.refresh();
+        // Recheck ownership after asynchronous authority acquisition, before mutation.
+        (0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified);
+        if ((0, task_identity_js_1.resolveTaskIdentity)(context.root).taskId !== task.taskId) {
+            throw new Error('Task ownership changed during cleanup authorization.');
+        }
+        const nativeOptions = {
+            expectedRoleArn,
+            foundationStage: 'development',
+            profile: transport.profile,
+            region,
+            stage: (0, task_identity_js_1.taskStage)(task.taskId),
+            stageMode: 'consumer',
+        };
+        const childEnvironment = {
+            ...transport.childEnvironment(environment),
+            AWS_EXPECTED_ACCOUNT_ID: verified.accountId,
+            AWS_REGION: region,
+            EBK_NX_TASK_CLEANUP: task.taskId,
+        };
+        // An absence result must pass the same role/project/task/ownership gates
+        // as removal. Present state still goes through the unchanged native runner.
+        const projectRoot = await (dependencies.preflight ?? preflightTaskRemove)(nativeOptions, context, childEnvironment);
+        const metadata = await (dependencies.inspectStack ?? task_stack_absence_js_1.inspectNeverCreatedTaskStack)({
+            workspaceRoot: context.root,
+            projectRoot,
+            projectName,
+            taskId: task.taskId,
+            verifiedEnvironment: verified,
+            awsEnvironment: childEnvironment,
+        });
+        (0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified);
+        if ((0, task_identity_js_1.resolveTaskIdentity)(context.root).taskId !== task.taskId)
+            throw new Error('Task ownership changed during cleanup inspection.');
+        if (metadata.status === 'already-absent') {
+            alreadyAbsent = true;
+            success = true;
+            devkit_1.logger.info('Task cloud stack is already absent (verified native metadata; no SST removal executed).');
+        }
+        else {
+            const removed = (await (dependencies.run ?? run_sst_command_js_1.runSstCommand)('remove', nativeOptions, context, { environment: childEnvironment })).success;
+            if (removed) {
+                await (dependencies.verifyStack ?? task_stack_absence_js_1.verifyRemovedTaskStack)({
+                    workspaceRoot: context.root,
+                    projectRoot,
+                    projectName,
+                    taskId: task.taskId,
+                    verifiedEnvironment: verified,
+                    awsEnvironment: childEnvironment,
+                });
+                (0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified);
+                if ((0, task_identity_js_1.resolveTaskIdentity)(context.root).taskId !== task.taskId)
+                    throw new Error('Task ownership changed during cleanup verification.');
+            }
+            success = removed;
+        }
+    }
+    catch (error) {
+        devkit_1.logger.error(`Task cloud cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        try {
+            transport?.cleanup();
+        }
+        catch (error) {
+            success = false;
+            devkit_1.logger.error(`Task cleanup credential removal failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return {
+        success,
+        ...(success && alreadyAbsent
+            ? { taskStack: 'already-absent' }
+            : {}),
+    };
+}
+const executor = (options, context) => runDevTaskCleanup(options, context);
+exports.default = executor;
+//# sourceMappingURL=dev-task-cleanup.js.map

package/src/executors/dev-task-cleanup/schema.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit internal task cloud cleanup",
+  "description": "Remove only this worktree's owned task Slice stack through verified development authority.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {}
+}

package/src/executors/dev-task-cleanup/task-stack-absence.d.ts

@@ -0,0 +1,27 @@
+import { S3Client, type S3ClientConfig } from '@aws-sdk/client-s3';
+import { SSMClient, type SSMClientConfig } from '@aws-sdk/client-ssm';
+import { type TaskEnvironment } from '../../local-dev/task-identity.js';
+declare const NATIVE_VERSION = "4.17.1";
+export interface TaskStackAbsenceInput {
+    workspaceRoot: string;
+    projectRoot: string;
+    projectName: string;
+    taskId: string;
+    verifiedEnvironment: TaskEnvironment;
+    awsEnvironment: NodeJS.ProcessEnv;
+}
+export interface TaskStackAbsenceDependencies {
+    s3Client?: (config: S3ClientConfig) => S3Client;
+    ssmClient?: (config: SSMClientConfig) => SSMClient;
+}
+export type TaskStackMetadata = {
+    status: 'present' | 'already-absent';
+    nativeVersion: typeof NATIVE_VERSION;
+};
+/** Accept only the generated static app/home contract; never evaluate config. */
+export declare function resolveStaticTaskApp(input: Pick<TaskStackAbsenceInput, 'workspaceRoot' | 'projectRoot' | 'projectName'>): string;
+/** Read-only, task-exact metadata proof. It grants no permission to remove. */
+export declare function inspectNeverCreatedTaskStack(input: TaskStackAbsenceInput, dependencies?: TaskStackAbsenceDependencies): Promise<TaskStackMetadata>;
+/** A successful native exit cannot conceal retained resources or pending work. */
+export declare function verifyRemovedTaskStack(input: TaskStackAbsenceInput, dependencies?: TaskStackAbsenceDependencies): Promise<void>;
+export {};

package/src/executors/dev-task-cleanup/task-stack-absence.js

@@ -0,0 +1,281 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveStaticTaskApp = resolveStaticTaskApp;
+exports.inspectNeverCreatedTaskStack = inspectNeverCreatedTaskStack;
+exports.verifyRemovedTaskStack = verifyRemovedTaskStack;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const ts = require("typescript");
+const identity_js_1 = require("../../aws/identity.js");
+const personal_secret_runtime_js_1 = require("../../cli/personal-secret-runtime.js");
+const task_identity_js_1 = require("../../local-dev/task-identity.js");
+const task_stack_checkpoint_js_1 = require("./task-stack-checkpoint.js");
+// These are provider layout facts, not an alternative SST state engine.
+// SST v4.17.1: pkg/project/provider/aws.go Bootstrap (version 5),
+// pathForData, and provider.go PullState/Lock/Unlock (symbol references, not
+// unstable line numbers).
+// https://github.com/anomalyco/sst/blob/v4.17.1/pkg/project/provider/aws.go
+// https://github.com/anomalyco/sst/blob/v4.17.1/pkg/project/provider/provider.go
+const NATIVE_VERSION = '4.17.1';
+const MAX_PAGES = 4;
+const PAGE_SIZE = 100;
+function refuse(reason) {
+    throw new Error(`Task stack absence could not be proven: ${reason}.`);
+}
+function propertyName(node) {
+    return ts.isIdentifier(node) || ts.isStringLiteral(node)
+        ? node.text
+        : undefined;
+}
+/** Accept only the generated static app/home contract; never evaluate config. */
+function resolveStaticTaskApp(input) {
+    const root = (0, node_fs_1.realpathSync)(input.workspaceRoot);
+    const project = (0, node_fs_1.realpathSync)(input.projectRoot);
+    const path = (0, node_path_1.join)(project, 'sst.config.ts');
+    const child = (0, node_path_1.relative)(root, project);
+    if (!child || child.startsWith('..') || (0, node_path_1.isAbsolute)(child))
+        refuse('the Slice configuration is outside its workspace');
+    if (!(0, node_fs_1.lstatSync)(path).isFile() || (0, node_fs_1.realpathSync)(path) !== path)
+        refuse('the Slice configuration is not a regular owned path');
+    const source = (0, node_fs_1.readFileSync)(path, 'utf8');
+    if (Buffer.byteLength(source) > 1024 * 1024)
+        refuse('the Slice configuration exceeds the inspection bound');
+    const file = ts.createSourceFile(path, source, ts.ScriptTarget.Latest, true);
+    if (ts
+        .transpileModule(source, { fileName: path, reportDiagnostics: true })
+        .diagnostics?.some((diagnostic) => diagnostic.category === ts.DiagnosticCategory.Error))
+        refuse('the Slice configuration has invalid syntax');
+    const exports = file.statements.filter(ts.isExportAssignment);
+    const expression = exports[0]?.expression;
+    if (exports.length !== 1 ||
+        exports[0].isExportEquals ||
+        !expression ||
+        !ts.isCallExpression(expression) ||
+        !ts.isIdentifier(expression.expression) ||
+        expression.expression.text !== '$config' ||
+        expression.arguments.length !== 1 ||
+        !ts.isObjectLiteralExpression(expression.arguments[0]))
+        refuse('the Slice app declaration is not the supported static shape');
+    const config = expression.arguments[0];
+    if (config.properties.some((p) => !p.name || propertyName(p.name) === undefined))
+        refuse('the Slice configuration contains dynamic properties');
+    const apps = config.properties.filter((p) => p.name && propertyName(p.name) === 'app');
+    const app = apps[0];
+    if (apps.length !== 1 || !app || !ts.isMethodDeclaration(app) || !app.body)
+        refuse('the Slice app declaration is dynamic');
+    const statements = app.body.statements;
+    const returned = statements.at(-1);
+    if (statements.slice(0, -1).some((s) => !ts.isVariableStatement(s)) ||
+        !returned ||
+        !ts.isReturnStatement(returned) ||
+        !returned.expression ||
+        !ts.isObjectLiteralExpression(returned.expression))
+        refuse('the Slice app return is dynamic');
+    const properties = returned.expression.properties;
+    if (properties.some((p) => !p.name || propertyName(p.name) === undefined))
+        refuse('the Slice app return contains dynamic properties');
+    const literal = (name) => {
+        const matches = properties.filter((p) => p.name && propertyName(p.name) === name);
+        const property = matches[0];
+        if (matches.length !== 1 ||
+            !property ||
+            !ts.isPropertyAssignment(property) ||
+            !ts.isStringLiteral(property.initializer))
+            refuse(`the Slice ${name} is not an exact literal`);
+        return property.initializer.text;
+    };
+    const name = literal('name');
+    if (name !== input.projectName ||
+        !/^[a-z][a-z0-9-]{0,62}$/.test(name) ||
+        literal('home') !== 'aws')
+        refuse('the Slice app/home differs from the selected generated project');
+    return name;
+}
+/** Read-only, task-exact metadata proof. It grants no permission to remove. */
+async function inspectNeverCreatedTaskStack(input, dependencies = {}) {
+    return inspectTaskStack(input, dependencies, false);
+}
+/** A successful native exit cannot conceal retained resources or pending work. */
+async function verifyRemovedTaskStack(input, dependencies = {}) {
+    await inspectTaskStack(input, dependencies, true);
+}
+async function inspectTaskStack(input, dependencies, verifyRemoval) {
+    const assertOwner = () => {
+        if ((0, task_identity_js_1.assertCurrentTaskEnvironment)(input.workspaceRoot, input.verifiedEnvironment).taskId !== input.taskId)
+            refuse('task ownership changed');
+    };
+    assertOwner();
+    if ((0, personal_secret_runtime_js_1.resolveWorkspaceSstRuntime)(input.workspaceRoot).version !== NATIVE_VERSION)
+        refuse('the native SST version has no reviewed metadata layout');
+    const app = resolveStaticTaskApp(input);
+    const stage = (0, task_identity_js_1.taskStage)(input.taskId);
+    const { accountId, region } = input.verifiedEnvironment;
+    const profile = input.awsEnvironment.AWS_PROFILE;
+    const configFilepath = input.awsEnvironment.AWS_CONFIG_FILE;
+    const filepath = input.awsEnvironment.AWS_SHARED_CREDENTIALS_FILE;
+    if (!profile || !configFilepath || !filepath)
+        refuse('the private authorized AWS credential transport is incomplete');
+    const credentials = (0, credential_providers_1.fromIni)({
+        profile,
+        configFilepath,
+        filepath,
+        clientConfig: {
+            region,
+            endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('sts', region),
+            ignoreConfiguredEndpointUrls: true,
+        },
+    });
+    const common = {
+        region,
+        credentials,
+        maxAttempts: 1,
+        ignoreConfiguredEndpointUrls: true,
+    };
+    const ssm = (dependencies.ssmClient ?? ((config) => new client_ssm_1.SSMClient(config)))({
+        ...common,
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('ssm', region),
+    });
+    // identity.ts validates the Region; replace only the fixed service label.
+    const s3 = (dependencies.s3Client ?? ((config) => new client_s3_1.S3Client(config)))({
+        ...common,
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('ssm', region).replace('https://ssm.', 'https://s3.'),
+    });
+    const signal = AbortSignal.timeout(20_000);
+    try {
+        const bootstrap = await ssm.send(new client_ssm_1.GetParameterCommand({
+            Name: '/sst/bootstrap',
+            WithDecryption: false,
+        }), { abortSignal: signal });
+        if (bootstrap.Parameter?.Name !== '/sst/bootstrap' ||
+            bootstrap.Parameter.Type !== 'String' ||
+            !bootstrap.Parameter.Value ||
+            Buffer.byteLength(bootstrap.Parameter.Value) > 16_384)
+            refuse('the native bootstrap metadata is missing or malformed');
+        let data;
+        try {
+            data = JSON.parse(bootstrap.Parameter.Value);
+        }
+        catch {
+            refuse('the native bootstrap metadata is not JSON');
+        }
+        if (!data ||
+            data.version !== 5 ||
+            typeof data.state !== 'string' ||
+            !/^sst-state-[a-z0-9]{12}$/.test(data.state))
+            refuse('the native bootstrap version or bucket identity is unsupported');
+        const owner = { Bucket: data.state, ExpectedBucketOwner: accountId };
+        const versioning = await s3.send(new client_s3_1.GetBucketVersioningCommand(owner), {
+            abortSignal: signal,
+        });
+        if (versioning.Status !== 'Enabled')
+            refuse('the native state bucket is not versioned');
+        const stateKey = `app/${app}/${stage}.json`;
+        const lockKey = `lock/${app}/${stage}.json`;
+        const contains = async (key) => {
+            let token;
+            const seen = new Set();
+            for (let page = 0; page < MAX_PAGES; page++) {
+                const result = await s3.send(new client_s3_1.ListObjectsV2Command({
+                    ...owner,
+                    Prefix: key,
+                    MaxKeys: PAGE_SIZE,
+                    ...(token ? { ContinuationToken: token } : {}),
+                }), { abortSignal: signal });
+                if (typeof result.IsTruncated !== 'boolean' ||
+                    (result.Contents !== undefined && !Array.isArray(result.Contents)))
+                    refuse('the current-object listing is malformed');
+                if ((result.Contents?.length ?? 0) > PAGE_SIZE)
+                    refuse('the current-object page exceeds the inspection bound');
+                for (const object of result.Contents ?? []) {
+                    if (typeof object.Key !== 'string' || !object.Key.startsWith(key))
+                        refuse('the object listing escaped its exact prefix');
+                    if (object.Key === key)
+                        return true;
+                }
+                if (!result.IsTruncated)
+                    return false;
+                token = result.NextContinuationToken;
+                if (!token || seen.has(token))
+                    refuse('the object listing cursor is ambiguous');
+                seen.add(token);
+            }
+            refuse('the object listing exceeded its bounded page count');
+        };
+        if (await contains(lockKey))
+            refuse('the exact task native lock is present');
+        if (await contains(stateKey)) {
+            if (verifyRemoval) {
+                await (0, task_stack_checkpoint_js_1.verifyRemovedTaskCheckpoint)(s3, owner, stateKey, `organization/${app}/${stage}`, signal);
+                if (await contains(lockKey))
+                    refuse('the exact task native lock appeared after removal');
+            }
+            assertOwner();
+            if (resolveStaticTaskApp(input) !== app)
+                refuse('the Slice app changed during inspection');
+            return { status: 'present', nativeVersion: NATIVE_VERSION };
+        }
+        let keyMarker;
+        let versionMarker;
+        const seen = new Set();
+        let complete = false;
+        for (let page = 0; page < MAX_PAGES; page++) {
+            const result = await s3.send(new client_s3_1.ListObjectVersionsCommand({
+                ...owner,
+                Prefix: stateKey,
+                MaxKeys: PAGE_SIZE,
+                ...(keyMarker ? { KeyMarker: keyMarker } : {}),
+                ...(versionMarker ? { VersionIdMarker: versionMarker } : {}),
+            }), { abortSignal: signal });
+            if (typeof result.IsTruncated !== 'boolean' ||
+                [result.Versions, result.DeleteMarkers].some((entries) => entries !== undefined && !Array.isArray(entries)))
+                refuse('the version listing is malformed');
+            for (const entry of [
+                ...(result.Versions ?? []),
+                ...(result.DeleteMarkers ?? []),
+            ]) {
+                if (typeof entry.Key !== 'string' || !entry.Key.startsWith(stateKey))
+                    refuse('the version listing escaped its exact prefix');
+                if (entry.Key === stateKey)
+                    refuse('the exact task state has retained versions or delete markers');
+            }
+            if ((result.Versions?.length ?? 0) + (result.DeleteMarkers?.length ?? 0) >
+                PAGE_SIZE)
+                refuse('the version page exceeds the inspection bound');
+            if (!result.IsTruncated) {
+                complete = true;
+                break;
+            }
+            keyMarker = result.NextKeyMarker;
+            versionMarker = result.NextVersionIdMarker;
+            const cursor = JSON.stringify([keyMarker, versionMarker]);
+            if (!keyMarker || !keyMarker.startsWith(stateKey) || seen.has(cursor))
+                refuse('the version listing cursor is ambiguous');
+            seen.add(cursor);
+        }
+        if (!complete)
+            refuse('the version listing exceeded its bounded page count');
+        // Close the metadata observation window before returning an absence result.
+        if ((await contains(stateKey)) || (await contains(lockKey)))
+            refuse('task state or lock appeared during the absence inspection');
+        assertOwner();
+        if (resolveStaticTaskApp(input) !== app)
+            refuse('the Slice app changed during inspection');
+        return { status: 'already-absent', nativeVersion: NATIVE_VERSION };
+    }
+    catch (error) {
+        if (error instanceof task_stack_checkpoint_js_1.NativeTaskCheckpointError ||
+            (error instanceof Error &&
+                error.message.startsWith('Task stack absence could not be proven:')))
+            throw error;
+        // Provider errors can contain private bucket names or request details.
+        refuse('a required native metadata read or ownership recheck failed');
+    }
+    finally {
+        s3.destroy();
+        ssm.destroy();
+    }
+}
+//# sourceMappingURL=task-stack-absence.js.map

package/src/executors/dev-task-cleanup/task-stack-checkpoint.d.ts

@@ -0,0 +1,12 @@
+import { type S3Client } from '@aws-sdk/client-s3';
+export declare class NativeTaskCheckpointError extends Error {
+}
+/**
+ * Read-only postcondition for the pinned SST checkpoint envelope. It does not
+ * decrypt, retain, repair, or infer physical identities from resource contents.
+ * An empty checkpoint is necessary, not independent physical-absence proof.
+ */
+export declare function verifyRemovedTaskCheckpoint(s3: S3Client, owner: {
+    Bucket: string;
+    ExpectedBucketOwner: string;
+}, key: string, stack: string, signal: AbortSignal): Promise<void>;

package/src/executors/dev-task-cleanup/task-stack-checkpoint.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NativeTaskCheckpointError = void 0;
+exports.verifyRemovedTaskCheckpoint = verifyRemovedTaskCheckpoint;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const MAX_CHECKPOINT_BYTES = 8 * 1024 * 1024;
+class NativeTaskCheckpointError extends Error {
+}
+exports.NativeTaskCheckpointError = NativeTaskCheckpointError;
+function refuse(reason) {
+    throw new NativeTaskCheckpointError(`Native task cleanup is incomplete: ${reason}.`);
+}
+function object(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Read-only postcondition for the pinned SST checkpoint envelope. It does not
+ * decrypt, retain, repair, or infer physical identities from resource contents.
+ * An empty checkpoint is necessary, not independent physical-absence proof.
+ */
+async function verifyRemovedTaskCheckpoint(s3, owner, key, stack, signal) {
+    try {
+        const result = await s3.send(new client_s3_1.GetObjectCommand({ ...owner, Key: key }), {
+            abortSignal: signal,
+        });
+        const body = result.Body;
+        if (!body ||
+            !('destroy' in body) ||
+            typeof body.destroy !== 'function' ||
+            !(Symbol.asyncIterator in body))
+            refuse('the checkpoint stream is unavailable');
+        const stream = body;
+        const abort = () => stream.destroy();
+        signal.addEventListener('abort', abort, { once: true });
+        let bytes;
+        try {
+            if (!Number.isSafeInteger(result.ContentLength) ||
+                !result.ContentLength ||
+                result.ContentLength < 0 ||
+                result.ContentLength > MAX_CHECKPOINT_BYTES ||
+                !result.VersionId ||
+                result.VersionId === 'null' ||
+                !result.ETag)
+                refuse('the checkpoint size or version is unsupported');
+            signal.throwIfAborted();
+            let size = 0;
+            const chunks = [];
+            for await (const chunk of stream) {
+                signal.throwIfAborted();
+                if (!(chunk instanceof Uint8Array))
+                    refuse('the checkpoint stream is malformed');
+                size += chunk.byteLength;
+                if (size > MAX_CHECKPOINT_BYTES || size > result.ContentLength)
+                    refuse('the checkpoint exceeded its bounded size');
+                chunks.push(Buffer.from(chunk));
+            }
+            signal.throwIfAborted();
+            if (size !== result.ContentLength)
+                refuse('the checkpoint read was incomplete');
+            bytes = Buffer.concat(chunks);
+        }
+        finally {
+            signal.removeEventListener('abort', abort);
+            stream.destroy();
+        }
+        // Parse errors and SDK errors must never include checkpoint or secret data.
+        const value = JSON.parse(bytes.toString('utf8'));
+        if (!object(value) ||
+            value.version !== 3 ||
+            !object(value.checkpoint) ||
+            value.checkpoint.stack !== stack ||
+            !object(value.checkpoint.latest))
+            refuse('the checkpoint format or exact stack identity differs');
+        for (const field of ['resources', 'pending_operations']) {
+            const entries = value.checkpoint.latest[field];
+            // The native serializer omits empty collections after complete removal.
+            if (entries !== undefined && !Array.isArray(entries))
+                refuse('the checkpoint collections are malformed');
+            if (Array.isArray(entries) && entries.length > 0)
+                refuse(`${entries.length} ${field === 'resources' ? 'resource records' : 'pending operations'} remain; preserve native diagnostics and resolve the interrupted operation before retrying task cleanup`);
+        }
+        const current = await s3.send(new client_s3_1.HeadObjectCommand({ ...owner, Key: key, IfMatch: result.ETag }), { abortSignal: signal });
+        if (current.VersionId !== result.VersionId || current.ETag !== result.ETag)
+            refuse('the checkpoint changed during verification');
+    }
+    catch (error) {
+        if (error instanceof NativeTaskCheckpointError)
+            throw error;
+        refuse('the required checkpoint read or validation failed');
+    }
+}
+//# sourceMappingURL=task-stack-checkpoint.js.map

package/src/executors/fleet/fleet.js

@@ -87,7 +87,7 @@ const executor = async (options, context) => {
     try {
         const command = fleetExecutorCommand(options);
         const plan = await (0, nx_workspace_js_1.loadWorkspaceFleetPlan)();
-        const identity = (0, personal_stage_js_1.createPersonalStageResolver)().resolve();
+        const identity = (0, personal_stage_js_1.createPersonalStageResolver)().resolve(context.root);
         const gitCommonDirectory = (0, fleet_launcher_js_1.resolveGitCommonDirectory)(context.root);
         const saved = (0, local_context_js_1.readSavedLocalDevContext)(gitCommonDirectory);
         if (saved.kind === 'invalid') {

package/src/executors/foundation-preflight/foundation-preflight.d.ts

@@ -5,6 +5,7 @@ interface FoundationPreflightOptions {
     capabilities?: FoundationRequirement['capabilities'];
     contract?: string;
     deployIfMissing?: boolean;
+    expectedRoleArn?: string;
     foundationProject?: string;
     foundationStage?: string;
     profile?: string;

package/src/executors/foundation-preflight/foundation-preflight.js

@@ -6,7 +6,7 @@ const discovery_js_1 = require("../../foundation/discovery.js");
 const stages_js_1 = require("../../foundation/stages.js");
 const index_js_1 = require("../../repository-policy/index.js");
 const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
-async function deployFoundation(options, context, foundationStage) {
+async function deployFoundation(options, context, foundationStage, region) {
     const project = options.foundationProject?.trim() || 'foundation';
     const root = context.projectsConfigurations?.projects[project]?.root;
     if (!root) {
@@ -16,7 +16,11 @@ async function deployFoundation(options, context, foundationStage) {
     devkit_1.logger.info(`[foundation-preflight] deploying ${project} at canonical stage ${foundationStage}.`);
     const result = await (0, run_sst_command_js_1.runSstCommand)('deploy', {
         cwd: root,
+        ...(options.expectedRoleArn?.trim()
+            ? { expectedRoleArn: options.expectedRoleArn.trim() }
+            : {}),
         ...(options.profile?.trim() ? { profile: options.profile.trim() } : {}),
+        region,
         stage: foundationStage,
         stageMode: 'foundation',
     }, { ...context, projectName: project });
@@ -78,7 +82,7 @@ const executor = async (options, context) => {
                 devkit_1.logger.error(`[foundation-preflight] ${stages.foundationStage} Foundation is absent. Protected workflows must run the Foundation target and its profile capability preflight before Product Slices; Foundation auto-deploy is disabled for protected stages.`);
                 return { success: false };
             }
-            const deployed = await deployFoundation(options, context, stages.foundationStage);
+            const deployed = await deployFoundation(options, context, stages.foundationStage, region);
             if (!deployed)
                 return { success: false };
             report = await (0, preflight_js_1.evaluateFoundationPreflight)({

package/src/executors/foundation-preflight/schema.json

@@ -17,6 +17,11 @@
     },
     "region": { "type": "string" },
     "profile": { "type": "string" },
+    "expectedRoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$",
+      "description": "Exact temporary-session IAM role expected for local governed deployment. This is verified against STS before mutation."
+    },
     "contract": { "type": "string", "default": "^1.0.0" },
     "capabilities": {
       "type": "array",

package/src/executors/foundation-profile-preflight/foundation-profile-preflight.d.ts

@@ -1,8 +1,19 @@
 import { type PromiseExecutor } from '@nx/devkit';
+import { type ProductionDatabaseSafeguardReader } from './production-database-safeguard.js';
 interface FoundationProfilePreflightOptions {
+    expectedRoleArn?: string;
     profile?: string;
     region?: string;
     stage: string;
 }
-declare const executor: PromiseExecutor<FoundationProfilePreflightOptions>;
-export default executor;
+export interface FoundationProfilePreflightDependencies {
+    createProductionDatabaseReader?: (options: {
+        profile?: string;
+        region: string;
+        stage: 'production';
+    }) => ProductionDatabaseSafeguardReader;
+    now?: () => Date;
+}
+export declare function createFoundationProfilePreflightExecutor(dependencies?: FoundationProfilePreflightDependencies): PromiseExecutor<FoundationProfilePreflightOptions>;
+declare const _default: PromiseExecutor<FoundationProfilePreflightOptions>;
+export default _default;