@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/local-dev/environment-inspector.js

@@ -0,0 +1,687 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvironmentDeficientError = exports.ENVIRONMENT_INSPECTOR_CHECKS = exports.AWS_ENVIRONMENT_PROBE_TIMEOUT_MS = void 0;
+exports.evaluateDevelopmentFoundationAccount = evaluateDevelopmentFoundationAccount;
+exports.inspectDevelopmentEnvironment = inspectDevelopmentEnvironment;
+exports.assertEnvironmentReady = assertEnvironmentReady;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_util_1 = require("node:util");
+const client_sts_1 = require("@aws-sdk/client-sts");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const semver_1 = require("semver");
+const discovery_js_1 = require("../foundation/discovery.js");
+const preflight_js_1 = require("../foundation/preflight.js");
+const contract_validation_js_1 = require("./contract-validation.js");
+const environment_state_js_1 = require("./environment-state.js");
+const errors_js_1 = require("./errors.js");
+const nx_workspace_js_1 = require("./nx-workspace.js");
+const personal_stage_js_1 = require("./personal-stage.js");
+const tls_js_1 = require("./tls.js");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+exports.AWS_ENVIRONMENT_PROBE_TIMEOUT_MS = 15_000;
+const MAX_AWS_ENVIRONMENT_PROBE_TIMEOUT_MS = 60_000;
+const AWS_NETWORK_PROBE_IDS = new Set([
+    'aws-sdk-credentials',
+    'aws-foundation-access',
+]);
+exports.ENVIRONMENT_INSPECTOR_CHECKS = [
+    {
+        capabilities: ['framework-bootstrap'],
+        id: 'platform',
+        volatile: false,
+    },
+    {
+        capabilities: ['framework-bootstrap'],
+        id: 'node-runtime',
+        volatile: false,
+    },
+    {
+        capabilities: ['framework-bootstrap'],
+        id: 'git',
+        volatile: false,
+    },
+    {
+        capabilities: ['framework-bootstrap'],
+        id: 'corepack',
+        volatile: false,
+    },
+    {
+        capabilities: ['framework-bootstrap'],
+        id: 'pnpm',
+        volatile: false,
+    },
+    {
+        capabilities: ['workspace'],
+        id: 'workspace-write',
+        volatile: true,
+    },
+    {
+        capabilities: ['workspace'],
+        id: 'workspace-nx',
+        volatile: false,
+    },
+    {
+        capabilities: ['fleet-identity'],
+        id: 'personal-stage',
+        volatile: false,
+    },
+    {
+        capabilities: ['fleet-control'],
+        id: 'private-state-location',
+        volatile: true,
+    },
+    {
+        capabilities: ['fleet-https'],
+        id: 'openssl',
+        volatile: false,
+    },
+    {
+        capabilities: ['fleet-https'],
+        id: 'tls-state',
+        volatile: true,
+    },
+    {
+        capabilities: ['containers'],
+        id: 'docker-cli',
+        volatile: false,
+    },
+    {
+        capabilities: ['containers'],
+        id: 'docker-engine',
+        volatile: true,
+    },
+    {
+        capabilities: ['containers'],
+        id: 'docker-compose-v2',
+        volatile: true,
+    },
+    {
+        capabilities: ['aws-foundation'],
+        id: 'aws-sdk-credentials',
+        volatile: true,
+    },
+    {
+        capabilities: ['aws-foundation'],
+        id: 'aws-foundation-access',
+        volatile: true,
+    },
+    {
+        capabilities: ['aws-remediation'],
+        id: 'aws-cli-remediation',
+        volatile: false,
+    },
+];
+function environmentDeficiencyAssessment(assessment) {
+    return {
+        checks: assessment.checks
+            .filter(({ severity, status }) => severity === 'required' && status !== 'ready')
+            .map(({ detectedVersion, id, minimumVersion, remediation, requiredFor, severity, status, }) => ({
+            ...(detectedVersion
+                ? {
+                    detectedVersion: (0, environment_state_js_1.sanitizeEnvironmentEvidence)(detectedVersion).slice(0, 128),
+                }
+                : {}),
+            id,
+            ...(minimumVersion
+                ? {
+                    minimumVersion: (0, environment_state_js_1.sanitizeEnvironmentEvidence)(minimumVersion).slice(0, 128),
+                }
+                : {}),
+            ...(remediation
+                ? {
+                    remediation: (0, environment_state_js_1.sanitizeEnvironmentEvidence)(remediation).slice(0, 512),
+                }
+                : {}),
+            requiredFor: requiredFor
+                .slice(0, 8)
+                .map((profile) => (0, environment_state_js_1.sanitizeEnvironmentEvidence)(profile).slice(0, 64)),
+            severity,
+            status,
+        }))
+            .slice(0, 32),
+        state: 'deficient',
+    };
+}
+class EnvironmentDeficientError extends errors_js_1.LocalDevContractError {
+    environmentAssessment;
+    constructor(environmentAssessment) {
+        const failures = environmentAssessment.checks.map(({ detectedVersion, id, minimumVersion, remediation, requiredFor, status, }) => [
+            `${id}=${status}`,
+            requiredFor.length > 0
+                ? `required for ${requiredFor.join(', ')}`
+                : undefined,
+            detectedVersion ? `detected ${detectedVersion}` : undefined,
+            minimumVersion ? `minimum ${minimumVersion}` : undefined,
+            remediation ? `remediation: ${remediation}` : undefined,
+        ]
+            .filter((part) => part !== undefined)
+            .join('; '));
+        super('environment-deficient', `Required development environment capabilities are deficient: ${failures.join('. ')}. Run ebk dev doctor --refresh.`);
+        this.environmentAssessment = environmentAssessment;
+        this.name = 'EnvironmentDeficientError';
+    }
+}
+exports.EnvironmentDeficientError = EnvironmentDeficientError;
+function environmentError(message) {
+    throw new errors_js_1.LocalDevContractError('environment-deficient', message);
+}
+class AwsEnvironmentProbeTimeoutError extends Error {
+    probeId;
+    timeoutMs;
+    constructor(probeId, timeoutMs) {
+        super(`AWS environment probe ${probeId} timed out after ${timeoutMs}ms.`);
+        this.probeId = probeId;
+        this.timeoutMs = timeoutMs;
+        this.name = 'AwsEnvironmentProbeTimeoutError';
+    }
+}
+function resolveAwsProbeTimeout(dependencies) {
+    const timeoutMs = dependencies.awsProbeTimeoutMs ?? exports.AWS_ENVIRONMENT_PROBE_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs < 1 ||
+        timeoutMs > MAX_AWS_ENVIRONMENT_PROBE_TIMEOUT_MS) {
+        return environmentError(`AWS environment probe timeout must be an integer from 1 through ${MAX_AWS_ENVIRONMENT_PROBE_TIMEOUT_MS}ms.`);
+    }
+    return timeoutMs;
+}
+async function withAwsProbeTimeout(probeId, timeoutMs, effect) {
+    const controller = new AbortController();
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            const error = new AwsEnvironmentProbeTimeoutError(probeId, timeoutMs);
+            controller.abort(error);
+            reject(error);
+        }, timeoutMs);
+    });
+    try {
+        return await Promise.race([effect(controller.signal), timeout]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+function commandRequirements(command, adapters, force = false) {
+    const checks = {};
+    for (const definition of exports.ENVIRONMENT_INSPECTOR_CHECKS) {
+        checks[definition.id] = force ? 'advisory' : 'unverified';
+    }
+    for (const id of [
+        'platform',
+        'node-runtime',
+        'git',
+        'corepack',
+        'pnpm',
+        'workspace-write',
+    ]) {
+        checks[id] = 'required';
+    }
+    if (command === 'configure') {
+        checks['personal-stage'] = 'required';
+    }
+    else if (command === 'setup') {
+        checks['openssl'] = 'required';
+        checks['private-state-location'] = 'required';
+    }
+    else if (command === 'secret') {
+        for (const id of [
+            'workspace-nx',
+            'personal-stage',
+            'private-state-location',
+            'aws-sdk-credentials',
+            'aws-foundation-access',
+            'aws-cli-remediation',
+        ]) {
+            checks[id] = 'required';
+        }
+    }
+    else if (command === 'up' || command === 'restart') {
+        for (const id of [
+            'workspace-nx',
+            'personal-stage',
+            'private-state-location',
+            'openssl',
+            'tls-state',
+            'aws-sdk-credentials',
+            'aws-foundation-access',
+        ]) {
+            checks[id] = 'required';
+        }
+        if (adapters.some(({ databaseMode }) => databaseMode === 'local')) {
+            checks['docker-cli'] = 'required';
+            checks['docker-engine'] = 'required';
+            checks['docker-compose-v2'] = 'required';
+        }
+        else {
+            checks['docker-cli'] = 'not-required';
+            checks['docker-engine'] = 'not-required';
+            checks['docker-compose-v2'] = 'not-required';
+        }
+    }
+    else if (command === 'doctor') {
+        for (const id of [
+            'workspace-nx',
+            'personal-stage',
+            'private-state-location',
+            'openssl',
+            'tls-state',
+            'aws-sdk-credentials',
+            'aws-foundation-access',
+        ]) {
+            checks[id] = 'advisory';
+        }
+    }
+    return { checks, id: `${command}${force ? '-refresh' : ''}` };
+}
+async function commandVersion(executable, args, timeout = 5_000) {
+    const result = await execFileAsync(executable, [...args], {
+        encoding: 'utf8',
+        maxBuffer: 64 * 1024,
+        timeout,
+        windowsHide: true,
+    });
+    return `${result.stdout}${result.stderr}`.trim().split(/\r?\n/, 1)[0] ?? '';
+}
+function commandProbe(executable, args, remediation, minimumVersion) {
+    return async () => {
+        try {
+            const version = await commandVersion(executable, args);
+            return {
+                detectedVersion: (0, environment_state_js_1.sanitizeEnvironmentEvidence)(version).slice(0, 128),
+                ...(minimumVersion ? { minimumVersion } : {}),
+                status: 'ready',
+            };
+        }
+        catch (error) {
+            const candidate = error;
+            return {
+                evidence: (0, environment_state_js_1.sanitizeEnvironmentEvidence)(error instanceof Error ? error.message : String(error)),
+                remediation,
+                status: candidate.code === 'ENOENT' ? 'missing' : 'unavailable',
+            };
+        }
+    };
+}
+function evaluateDevelopmentFoundationAccount(accountId, eventBusArn) {
+    const expectedAccount = /^arn:[^:]+:events:[^:]+:(\d{12}):event-bus\//.exec(eventBusArn)?.[1];
+    if (!expectedAccount || expectedAccount !== accountId) {
+        return {
+            evidence: expectedAccount
+                ? `Selected account ${accountId} does not match development Foundation account ${expectedAccount}.`
+                : 'Development Foundation eventBusArn does not contain a valid account.',
+            remediation: 'Select the saved profile for the development Foundation account before running local development.',
+            status: 'incompatible',
+        };
+    }
+    return {
+        evidence: `AWS account ${accountId}; bounded development Foundation SSM access is ready.`,
+        status: 'ready',
+    };
+}
+function createAbortableCredentialRequestHandler(context, abortSignal) {
+    const transportClient = new client_sts_1.STSClient({
+        region: context.region,
+    });
+    const delegate = transportClient.config.requestHandler;
+    return {
+        destroy: () => transportClient.destroy(),
+        requestHandler: {
+            ...(delegate.metadata ? { metadata: delegate.metadata } : {}),
+            handle: (request, handlerOptions) => delegate.handle(request, {
+                ...handlerOptions,
+                abortSignal,
+            }),
+        },
+    };
+}
+async function resolveProfileCredentials(context, abortSignal) {
+    const transport = createAbortableCredentialRequestHandler(context, abortSignal);
+    try {
+        return await (0, credential_providers_1.fromIni)({
+            clientConfig: {
+                region: context.region,
+                requestHandler: transport.requestHandler,
+            },
+            profile: context.profile,
+        })();
+    }
+    finally {
+        transport.destroy();
+    }
+}
+const defaultProbes = {
+    platform: async () => {
+        const supported = ['darwin', 'linux', 'win32'].includes((0, node_os_1.platform)()) &&
+            ['arm64', 'x64'].includes((0, node_os_1.arch)());
+        return supported
+            ? { evidence: `${(0, node_os_1.platform)()} ${(0, node_os_1.arch)()}`, status: 'ready' }
+            : {
+                evidence: `${(0, node_os_1.platform)()} ${(0, node_os_1.arch)()}`,
+                remediation: 'Use a supported x64 or arm64 macOS, Linux, or Windows host.',
+                status: 'incompatible',
+            };
+    },
+    'node-runtime': async () => ({
+        detectedVersion: process.versions.node,
+        minimumVersion: '22.12.0',
+        remediation: 'Install Node.js 22.12.0 or newer within major 22.',
+        status: (0, semver_1.satisfies)(process.versions.node, '>=22.12.0')
+            ? 'ready'
+            : 'incompatible',
+    }),
+    git: commandProbe('git', ['--version'], 'Install Git and ensure it is available on PATH.'),
+    corepack: commandProbe('corepack', ['--version'], 'Install or enable the Node.js Corepack shim.'),
+    pnpm: commandProbe('pnpm', ['--version'], 'Activate the workspace-pinned pnpm release through Corepack.'),
+    'workspace-write': async ({ workspaceRoot }) => {
+        try {
+            (0, node_fs_1.accessSync)(workspaceRoot, node_fs_1.constants.R_OK | node_fs_1.constants.W_OK);
+            return { status: 'ready' };
+        }
+        catch (error) {
+            return {
+                evidence: String(error),
+                remediation: 'Restore current-user read/write access to the checkout.',
+                status: 'unavailable',
+            };
+        }
+    },
+    'workspace-nx': async ({ workspaceRoot }) => {
+        try {
+            const runtime = (0, nx_workspace_js_1.resolveWorkspaceNxRuntime)(workspaceRoot);
+            return { detectedVersion: runtime.version, status: 'ready' };
+        }
+        catch (error) {
+            return {
+                evidence: String(error),
+                remediation: 'Install the workspace-pinned supported Nx dependencies.',
+                status: 'unavailable',
+            };
+        }
+    },
+    'personal-stage': async ({ identity }) => (0, personal_stage_js_1.isFrameworkPersonalStage)(identity.stage)
+        ? { evidence: identity.stage, status: 'ready' }
+        : {
+            remediation: 'Repair operating-system account identity resolution.',
+            status: 'unavailable',
+        },
+    'private-state-location': async ({ appData }) => {
+        try {
+            const existing = (0, node_fs_1.existsSync)(appData) ? appData : (0, node_path_1.join)(appData, '..');
+            (0, node_fs_1.accessSync)(existing, node_fs_1.constants.R_OK | node_fs_1.constants.W_OK);
+            return { status: 'ready' };
+        }
+        catch (error) {
+            return {
+                evidence: String(error),
+                remediation: 'Restore current-user access to the EBK application-data directory.',
+                status: 'unavailable',
+            };
+        }
+    },
+    openssl: commandProbe('openssl', ['version'], 'Install a supported OpenSSL executable on PATH.'),
+    'tls-state': async ({ appData }) => {
+        const paths = (0, tls_js_1.localTlsPaths)(appData);
+        const required = [
+            paths.rootCertificate,
+            paths.intermediateCertificate,
+            paths.leafCertificate,
+            paths.leafKey,
+            paths.capability,
+        ];
+        return required.every(node_fs_1.existsSync)
+            ? { status: 'ready' }
+            : {
+                remediation: 'Run ebk dev setup, inspect the root, then explicitly run ebk dev setup --trust.',
+                status: 'missing',
+            };
+    },
+    'docker-cli': commandProbe('docker', ['--version'], 'Install Docker with the Docker CLI.'),
+    'docker-engine': commandProbe('docker', ['info', '--format', '{{.ServerVersion}}'], 'Start the Docker engine and confirm current-user access.'),
+    'docker-compose-v2': commandProbe('docker', ['compose', 'version', '--short'], 'Install or enable Docker Compose v2.'),
+    'aws-sdk-credentials': async ({ context }, abortSignal) => {
+        try {
+            const credentials = await resolveProfileCredentials(context, abortSignal);
+            return credentials.accessKeyId
+                ? { evidence: 'AWS SDK provider chain resolved.', status: 'ready' }
+                : {
+                    remediation: `Repair AWS credentials for profile ${context.profile}.`,
+                    status: 'unavailable',
+                };
+        }
+        catch (error) {
+            return {
+                evidence: String(error),
+                remediation: `Refresh the AWS SDK credential source for profile ${context.profile}. If it is an SSO profile, run aws sso login --profile ${context.profile}.`,
+                status: 'unavailable',
+            };
+        }
+    },
+    'aws-foundation-access': async ({ accountId, accountResolutionFailure, context, identity }, abortSignal) => {
+        if (!accountId) {
+            return {
+                evidence: accountResolutionFailure ??
+                    'AWS account identity could not be resolved by the bounded STS probe.',
+                remediation: `Repair AWS credentials for profile ${context.profile}, then retry the bounded development Foundation check.`,
+                status: 'unavailable',
+            };
+        }
+        try {
+            const credentials = await resolveProfileCredentials(context, abortSignal);
+            const reader = (0, preflight_js_1.createFoundationParameterReader)({
+                abortSignal,
+                credentials,
+                region: context.region,
+            });
+            try {
+                const report = await (0, preflight_js_1.evaluateFoundationPreflight)({
+                    consumerStage: identity.stage,
+                    foundationStage: 'development',
+                    readParameters: reader.read,
+                    region: context.region,
+                    requirement: discovery_js_1.STANDARD_FOUNDATION_REQUIREMENT,
+                });
+                if (!report.ok || !report.discovery) {
+                    return {
+                        evidence: report.issues.join('; '),
+                        remediation: `Grant profile ${context.profile} bounded ssm:GetParameters access to the development Foundation contract in ${context.region}.`,
+                        status: 'unavailable',
+                    };
+                }
+                return evaluateDevelopmentFoundationAccount(accountId, report.discovery.eventBusArn);
+            }
+            finally {
+                reader.destroy();
+            }
+        }
+        catch (error) {
+            return {
+                evidence: error instanceof Error ? error.message : String(error),
+                remediation: `Grant profile ${context.profile} bounded ssm:GetParameters access to /ebk/development/foundation/* in ${context.region}.`,
+                status: 'unavailable',
+            };
+        }
+    },
+    'aws-cli-remediation': commandProbe('aws', ['--version'], 'Install AWS CLI v2 only when the selected SSO profile requires aws sso login remediation.', '2'),
+};
+async function resolveCurrentAwsAccountId(context, abortSignal) {
+    const credentials = await resolveProfileCredentials(context, abortSignal);
+    const client = new client_sts_1.STSClient({
+        credentials,
+        region: context.region,
+    });
+    try {
+        const account = (await client.send(new client_sts_1.GetCallerIdentityCommand({}), { abortSignal })).Account;
+        if (!account || !/^\d{12}$/.test(account)) {
+            throw new Error('AWS STS did not return an exact 12-digit account ID.');
+        }
+        return account;
+    }
+    finally {
+        client.destroy();
+    }
+}
+function hashFile(path) {
+    if (!(0, node_fs_1.existsSync)(path))
+        return (0, contract_validation_js_1.sha256Digest)({ missing: true, path: path.split('/').pop() });
+    const status = (0, node_fs_1.statSync)(path);
+    return (0, contract_validation_js_1.sha256Digest)({
+        contentSha256: (0, node_crypto_1.createHash)('sha256')
+            .update((0, node_fs_1.readFileSync)(path))
+            .digest('hex'),
+        mtimeMs: status.mtimeMs,
+        size: status.size,
+    });
+}
+function fingerprintFor(input, profile, accountId, executableVersions) {
+    return (0, environment_state_js_1.createEnvironmentFingerprint)({
+        accountId: accountId ?? 'unresolved',
+        architecture: (0, node_os_1.arch)(),
+        executableResolutionDigest: (0, contract_validation_js_1.sha256Digest)({
+            path: process.env.PATH ?? '',
+            pathExt: process.env.PATHEXT ?? '',
+        }),
+        executableVersions: {
+            node: process.versions.node,
+            ...executableVersions,
+        },
+        frameworkVersion: input.frameworkVersion,
+        localContextDigest: (0, contract_validation_js_1.sha256Digest)(input.context),
+        lockfileDigest: hashFile((0, node_path_1.join)(input.workspaceRoot, 'pnpm-lock.yaml')),
+        personalStageResolverVersion: input.identity.resolverVersion,
+        platform: (0, node_os_1.platform)(),
+        profile: input.context.profile,
+        region: input.context.region,
+        requirementProfile: profile.id,
+        resolvedStage: input.identity.stage,
+        workspaceConfigurationDigest: (0, contract_validation_js_1.sha256Digest)({
+            nx: hashFile((0, node_path_1.join)(input.workspaceRoot, 'nx.json')),
+            package: hashFile((0, node_path_1.join)(input.workspaceRoot, 'package.json')),
+        }),
+    });
+}
+function checkResult(definition, profile, observation) {
+    const requirement = profile.checks[definition.id] ?? 'unverified';
+    return {
+        capabilities: [...definition.capabilities],
+        ...(observation.detectedVersion
+            ? { detectedVersion: observation.detectedVersion }
+            : {}),
+        ...(observation.evidence
+            ? { evidence: (0, environment_state_js_1.sanitizeEnvironmentEvidence)(observation.evidence) }
+            : {}),
+        id: definition.id,
+        ...(observation.minimumVersion
+            ? { minimumVersion: observation.minimumVersion }
+            : {}),
+        ...(observation.remediation
+            ? { remediation: observation.remediation }
+            : {}),
+        requiredFor: requirement === 'required' || requirement === 'advisory'
+            ? [profile.id]
+            : [],
+        severity: requirement === 'required' ? 'required' : 'advisory',
+        status: observation.status,
+    };
+}
+async function inspectDevelopmentEnvironment(input, dependencies = {}) {
+    if (!(0, node_path_1.isAbsolute)(input.workspaceRoot)) {
+        return environmentError('Environment inspection requires an absolute workspace root.');
+    }
+    const profile = commandRequirements(input.command, input.adapters ?? [], input.force);
+    const accountRequirement = profile.checks['aws-foundation-access'];
+    const awsProbeTimeoutMs = resolveAwsProbeTimeout(dependencies);
+    let accountId;
+    let accountResolutionFailure;
+    if (accountRequirement === 'required' || accountRequirement === 'advisory') {
+        try {
+            accountId = await withAwsProbeTimeout('aws-account-identity', awsProbeTimeoutMs, (abortSignal) => (dependencies.resolveAccountId ?? resolveCurrentAwsAccountId)(input.context, abortSignal));
+            if (!/^\d{12}$/.test(accountId)) {
+                accountId = undefined;
+                accountResolutionFailure =
+                    'AWS account identity probe returned an invalid account identifier.';
+            }
+        }
+        catch (error) {
+            accountId = undefined;
+            accountResolutionFailure =
+                error instanceof AwsEnvironmentProbeTimeoutError
+                    ? error.message
+                    : 'AWS account identity probe failed.';
+        }
+    }
+    const fingerprintContext = {
+        ...(accountId ? { accountId } : {}),
+        ...(accountResolutionFailure ? { accountResolutionFailure } : {}),
+        appData: input.appData ?? (0, tls_js_1.defaultLocalDevAppData)(),
+        context: input.context,
+        identity: input.identity,
+        workspaceRoot: input.workspaceRoot,
+    };
+    const executableVersions = Object.fromEntries(await Promise.all(['corepack', 'git', 'pnpm'].map(async (id) => {
+        const observation = await (dependencies.probes?.[id] ?? defaultProbes[id])(fingerprintContext, new AbortController().signal);
+        return [
+            id,
+            (0, environment_state_js_1.sanitizeEnvironmentEvidence)(observation.detectedVersion ?? observation.status).slice(0, 128),
+        ];
+    })));
+    const fingerprint = fingerprintFor(input, profile, accountId, executableVersions);
+    const cachedState = (0, environment_state_js_1.readSavedEnvironmentAssessment)(input.workspaceRoot, dependencies.security);
+    const cached = cachedState.kind === 'ready' ? cachedState.assessment : undefined;
+    const plan = (0, environment_state_js_1.planEnvironmentAssessment)({
+        cached,
+        catalog: exports.ENVIRONMENT_INSPECTOR_CHECKS,
+        fingerprint,
+        force: input.force,
+        profile,
+    });
+    const context = fingerprintContext;
+    const definitions = new Map(plan.catalog.map((entry) => [entry.id, entry]));
+    const passiveProbeSignal = new AbortController().signal;
+    const probeResults = await Promise.all(plan.checksToRun.map(async (id) => {
+        const definition = definitions.get(id);
+        const probe = dependencies.probes?.[id] ??
+            defaultProbes[id];
+        if (!probe) {
+            return checkResult(definition, profile, {
+                remediation: `Framework probe ${id} is unavailable.`,
+                status: 'unavailable',
+            });
+        }
+        let observation;
+        try {
+            observation = AWS_NETWORK_PROBE_IDS.has(id)
+                ? await withAwsProbeTimeout(id, awsProbeTimeoutMs, (abortSignal) => probe(context, abortSignal))
+                : await probe(context, passiveProbeSignal);
+        }
+        catch (error) {
+            observation = {
+                evidence: error instanceof Error ? error.message : String(error),
+                remediation: `Retry ${id} after repairing the reported prerequisite.`,
+                status: 'unavailable',
+            };
+        }
+        return checkResult(definition, profile, observation);
+    }));
+    const assessment = (0, environment_state_js_1.completeEnvironmentAssessment)(plan, probeResults, {
+        architecture: (0, node_os_1.arch)(),
+        frameworkVersion: input.frameworkVersion,
+        identity: input.identity,
+        localContextDigest: (0, contract_validation_js_1.sha256Digest)(input.context),
+        platform: (0, node_os_1.platform)(),
+        profile: input.context.profile,
+        region: input.context.region,
+    });
+    (0, environment_state_js_1.writeSavedEnvironmentAssessment)(input.workspaceRoot, assessment, dependencies.security);
+    return assessment;
+}
+function assertEnvironmentReady(assessment) {
+    if (assessment.state !== 'deficient')
+        return;
+    throw new EnvironmentDeficientError(environmentDeficiencyAssessment(assessment));
+}
+//# sourceMappingURL=environment-inspector.js.map