@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/local-dev/private-state.d.ts

@@ -0,0 +1,17 @@
+export declare const PRIVATE_DIRECTORY_MODE: 448;
+export declare const PRIVATE_FILE_MODE: 384;
+export declare const PRIVATE_STATE_MAX_BYTES: number;
+export type PrivatePathKind = 'directory' | 'file';
+export interface WindowsPrivateAcl {
+    assert(path: string, kind: PrivatePathKind): void;
+    harden(path: string, kind: PrivatePathKind): void;
+}
+export interface PrivateStateSecurity {
+    platform?: NodeJS.Platform;
+    windowsAcl?: WindowsPrivateAcl;
+}
+export declare function assertPrivatePath(path: string, kind: PrivatePathKind, security?: PrivateStateSecurity): void;
+export declare function ensurePrivateDirectory(path: string, security?: PrivateStateSecurity): void;
+export declare function createPrivateFileExclusive(path: string, contents: string | Buffer, security?: PrivateStateSecurity): boolean;
+export declare function atomicWritePrivateFile(path: string, contents: string | Buffer, security?: PrivateStateSecurity): void;
+export declare function readPrivateFile(path: string, security?: PrivateStateSecurity): Buffer;

package/src/local-dev/private-state.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRIVATE_STATE_MAX_BYTES = exports.PRIVATE_FILE_MODE = exports.PRIVATE_DIRECTORY_MODE = void 0;
+exports.assertPrivatePath = assertPrivatePath;
+exports.ensurePrivateDirectory = ensurePrivateDirectory;
+exports.createPrivateFileExclusive = createPrivateFileExclusive;
+exports.atomicWritePrivateFile = atomicWritePrivateFile;
+exports.readPrivateFile = readPrivateFile;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const errors_js_1 = require("./errors.js");
+exports.PRIVATE_DIRECTORY_MODE = 0o700;
+exports.PRIVATE_FILE_MODE = 0o600;
+exports.PRIVATE_STATE_MAX_BYTES = 64 * 1024;
+const WINDOWS_HARDEN_ACL = String.raw `
+$ErrorActionPreference = 'Stop'
+$path = $env:EBK_PRIVATE_PATH
+$kind = $env:EBK_PRIVATE_KIND
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+if ($kind -eq 'directory') {
+  $info = [System.IO.DirectoryInfo]::new($path)
+} else {
+  $info = [System.IO.FileInfo]::new($path)
+}
+$acl = $info.GetAccessControl()
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($rule in @($acl.Access)) {
+  [void]$acl.RemoveAccessRuleSpecific($rule)
+}
+$rights = [System.Security.AccessControl.FileSystemRights]::FullControl
+$type = [System.Security.AccessControl.AccessControlType]::Allow
+if ($kind -eq 'directory') {
+  $inheritance = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'
+  $propagation = [System.Security.AccessControl.PropagationFlags]::None
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+    $identity.User, $rights, $inheritance, $propagation, $type
+  )
+} else {
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+    $identity.User, $rights, $type
+  )
+}
+$acl.AddAccessRule($rule)
+$info.SetAccessControl($acl)
+`;
+const WINDOWS_ASSERT_PRIVATE_ACL = String.raw `
+$ErrorActionPreference = 'Stop'
+$path = $env:EBK_PRIVATE_PATH
+$kind = $env:EBK_PRIVATE_KIND
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+if ($kind -eq 'directory') {
+  $info = [System.IO.DirectoryInfo]::new($path)
+} else {
+  $info = [System.IO.FileInfo]::new($path)
+}
+$acl = $info.GetAccessControl()
+if (-not $acl.AreAccessRulesProtected) {
+  throw 'ACL inheritance is enabled.'
+}
+$allowRules = @($acl.Access | Where-Object {
+  $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow
+})
+$unsafeRules = @($allowRules | Where-Object {
+  $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -ne $identity.User.Value
+})
+$selfRules = @($allowRules | Where-Object {
+  $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -eq $identity.User.Value
+})
+if ($unsafeRules.Count -ne 0 -or $selfRules.Count -eq 0) {
+  throw 'ACL grants access beyond the current user or omits the current user.'
+}
+`;
+function runWindowsAclScript(script, path, kind) {
+    const systemRoot = process.env.SystemRoot;
+    if (!systemRoot) {
+        throw new Error('SystemRoot is unavailable.');
+    }
+    const powershell = (0, node_path_1.join)(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    (0, node_child_process_1.execFileSync)(powershell, [
+        '-NoLogo',
+        '-NoProfile',
+        '-NonInteractive',
+        '-EncodedCommand',
+        Buffer.from(script, 'utf16le').toString('base64'),
+    ], {
+        env: {
+            ...process.env,
+            EBK_PRIVATE_KIND: kind,
+            EBK_PRIVATE_PATH: path,
+        },
+        stdio: 'pipe',
+        timeout: 15_000,
+        windowsHide: true,
+    });
+}
+const defaultWindowsAcl = {
+    assert(path, kind) {
+        runWindowsAclScript(WINDOWS_ASSERT_PRIVATE_ACL, path, kind);
+    },
+    harden(path, kind) {
+        runWindowsAclScript(WINDOWS_HARDEN_ACL, path, kind);
+    },
+};
+function platformFor(security) {
+    return security.platform ?? (0, node_os_1.platform)();
+}
+function windowsAclFor(security) {
+    return security.windowsAcl ?? defaultWindowsAcl;
+}
+function assertNotSymbolicLink(path, kind) {
+    const status = (0, node_fs_1.lstatSync)(path);
+    if (status.isSymbolicLink()) {
+        throw new errors_js_1.LocalDevContractError('invalid-state', `Private ${kind} ${path} must not be a symbolic link.`);
+    }
+    if ((kind === 'directory' && !status.isDirectory()) ||
+        (kind === 'file' && !status.isFile())) {
+        throw new errors_js_1.LocalDevContractError('invalid-state', `Private path ${path} is not a ${kind}.`);
+    }
+}
+function hardenPrivatePath(path, kind, security) {
+    try {
+        if (platformFor(security) === 'win32') {
+            windowsAclFor(security).harden(path, kind);
+        }
+        else {
+            (0, node_fs_1.chmodSync)(path, kind === 'directory' ? exports.PRIVATE_DIRECTORY_MODE : exports.PRIVATE_FILE_MODE);
+        }
+    }
+    catch (error) {
+        throw new errors_js_1.LocalDevContractError('invalid-state', `Unable to restrict private ${kind} ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function assertPrivatePath(path, kind, security = {}) {
+    try {
+        assertNotSymbolicLink(path, kind);
+        if (platformFor(security) === 'win32') {
+            windowsAclFor(security).assert(path, kind);
+            return;
+        }
+        const expected = kind === 'directory' ? exports.PRIVATE_DIRECTORY_MODE : exports.PRIVATE_FILE_MODE;
+        const mode = (0, node_fs_1.statSync)(path).mode & 0o777;
+        if (mode !== expected) {
+            throw new Error(`mode is ${mode.toString(8)} instead of ${expected.toString(8)}`);
+        }
+    }
+    catch (error) {
+        if (error instanceof errors_js_1.LocalDevContractError) {
+            throw error;
+        }
+        throw new errors_js_1.LocalDevContractError('invalid-state', `Private ${kind} ${path} is not current-user-only: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function ensurePrivateDirectory(path, security = {}) {
+    if ((0, node_fs_1.existsSync)(path)) {
+        assertNotSymbolicLink(path, 'directory');
+    }
+    else {
+        (0, node_fs_1.mkdirSync)(path, { mode: exports.PRIVATE_DIRECTORY_MODE, recursive: true });
+        assertNotSymbolicLink(path, 'directory');
+    }
+    hardenPrivatePath(path, 'directory', security);
+    assertPrivatePath(path, 'directory', security);
+}
+function assertBoundedContents(contents) {
+    if (Buffer.byteLength(contents) > exports.PRIVATE_STATE_MAX_BYTES) {
+        throw new errors_js_1.LocalDevContractError('invalid-state', `Private state exceeds ${exports.PRIVATE_STATE_MAX_BYTES} bytes.`);
+    }
+}
+function writeOpenedFile(descriptor, contents) {
+    (0, node_fs_1.writeFileSync)(descriptor, contents);
+    (0, node_fs_1.fsyncSync)(descriptor);
+}
+function createPrivateFileExclusive(path, contents, security = {}) {
+    assertBoundedContents(contents);
+    ensurePrivateDirectory((0, node_path_1.dirname)(path), security);
+    let descriptor;
+    let created = false;
+    try {
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_CREAT | node_fs_1.constants.O_EXCL | node_fs_1.constants.O_WRONLY, exports.PRIVATE_FILE_MODE);
+        created = true;
+        writeOpenedFile(descriptor, contents);
+        (0, node_fs_1.closeSync)(descriptor);
+        descriptor = undefined;
+        hardenPrivatePath(path, 'file', security);
+        assertPrivatePath(path, 'file', security);
+        return true;
+    }
+    catch (error) {
+        if (descriptor !== undefined) {
+            (0, node_fs_1.closeSync)(descriptor);
+        }
+        if (error &&
+            typeof error === 'object' &&
+            'code' in error &&
+            error.code === 'EEXIST') {
+            return false;
+        }
+        if (created && (0, node_fs_1.existsSync)(path)) {
+            try {
+                (0, node_fs_1.unlinkSync)(path);
+            }
+            catch {
+                // Preserve the original failure; callers will classify residual state.
+            }
+        }
+        throw error;
+    }
+}
+function atomicWritePrivateFile(path, contents, security = {}) {
+    assertBoundedContents(contents);
+    const directory = (0, node_path_1.dirname)(path);
+    ensurePrivateDirectory(directory, security);
+    if ((0, node_fs_1.existsSync)(path)) {
+        assertPrivatePath(path, 'file', security);
+    }
+    const temporaryPath = (0, node_path_1.join)(directory, `.${(0, node_path_1.basename)(path)}.${process.pid}.${(0, node_crypto_1.randomBytes)(8).toString('hex')}.tmp`);
+    let descriptor;
+    try {
+        descriptor = (0, node_fs_1.openSync)(temporaryPath, node_fs_1.constants.O_CREAT | node_fs_1.constants.O_EXCL | node_fs_1.constants.O_WRONLY, exports.PRIVATE_FILE_MODE);
+        writeOpenedFile(descriptor, contents);
+        (0, node_fs_1.closeSync)(descriptor);
+        descriptor = undefined;
+        hardenPrivatePath(temporaryPath, 'file', security);
+        assertPrivatePath(temporaryPath, 'file', security);
+        (0, node_fs_1.renameSync)(temporaryPath, path);
+        assertPrivatePath(path, 'file', security);
+    }
+    catch (error) {
+        if (descriptor !== undefined) {
+            (0, node_fs_1.closeSync)(descriptor);
+        }
+        if ((0, node_fs_1.existsSync)(temporaryPath)) {
+            try {
+                (0, node_fs_1.unlinkSync)(temporaryPath);
+            }
+            catch {
+                // Preserve the original failure and leave a private diagnostic remnant.
+            }
+        }
+        throw error;
+    }
+}
+function readPrivateFile(path, security = {}) {
+    assertPrivatePath(path, 'file', security);
+    const status = (0, node_fs_1.statSync)(path);
+    if (status.size > exports.PRIVATE_STATE_MAX_BYTES) {
+        throw new errors_js_1.LocalDevContractError('invalid-state', `Private state ${path} exceeds ${exports.PRIVATE_STATE_MAX_BYTES} bytes.`);
+    }
+    return (0, node_fs_1.readFileSync)(path);
+}
+//# sourceMappingURL=private-state.js.map

package/src/local-dev/private-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-state.js","sourceRoot":"","sources":["../../../../../packages/nx/src/local-dev/private-state.ts"],"names":[],"mappings":";;;AAoMA,8CA8BC;AAED,wDAYC;AAgBD,gEA2CC;AAED,wDA0CC;AAED,0CAaC;AAtWD,2DAAkD;AAClD,6CAA0C;AAC1C,qCAciB;AACjB,qCAAsD;AACtD,yCAAoD;AAEpD,2CAAoD;AAEvC,QAAA,sBAAsB,GAAG,KAAc,CAAC;AACxC,QAAA,iBAAiB,GAAG,KAAc,CAAC;AACnC,QAAA,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAcjD,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BpC,CAAC;AAEF,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0B5C,CAAC;AAEF,SAAS,mBAAmB,CAC1B,MAAc,EACd,IAAY,EACZ,IAAqB;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,UAAU,GAAG,IAAA,gBAAI,EACrB,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,CAAC;IACF,IAAA,iCAAY,EACV,UAAU,EACV;QACE,SAAS;QACT,YAAY;QACZ,iBAAiB;QACjB,iBAAiB;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAClD,EACD;QACE,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,gBAAgB,EAAE,IAAI;YACtB,gBAAgB,EAAE,IAAI;SACvB;QACD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,IAAI;KAClB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,MAAM,CAAC,IAAI,EAAE,IAAI;QACf,mBAAmB,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,IAAI;QACf,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;CACF,CAAC;AAEF,SAAS,WAAW,CAAC,QAA8B;IACjD,OAAO,QAAQ,CAAC,QAAQ,IAAI,IAAA,kBAAe,GAAE,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,QAA8B;IACnD,OAAO,QAAQ,CAAC,UAAU,IAAI,iBAAiB,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,IAAqB;IAChE,MAAM,MAAM,GAAG,IAAA,mBAAS,EAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,iCAAqB,CAC7B,eAAe,EACf,WAAW,IAAI,IAAI,IAAI,+BAA+B,CACvD,CAAC;IACJ,CAAC;IACD,IACE,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/C,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EACrC,CAAC;QACD,MAAM,IAAI,iCAAqB,CAC7B,eAAe,EACf,gBAAgB,IAAI,aAAa,IAAI,GAAG,CACzC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,IAAqB,EACrB,QAA8B;IAE9B,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACtC,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,IAAA,mBAAS,EACP,IAAI,EACJ,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,8BAAsB,CAAC,CAAC,CAAC,yBAAiB,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iCAAqB,CAC7B,eAAe,EACf,8BAA8B,IAAI,IAAI,IAAI,KACxC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,iBAAiB,CAC/B,IAAY,EACZ,IAAqB,EACrB,WAAiC,EAAE;IAEnC,IAAI,CAAC;QACH,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACtC,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GACZ,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,8BAAsB,CAAC,CAAC,CAAC,yBAAiB,CAAC;QACpE,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACzC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iCAAqB,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,iCAAqB,CAC7B,eAAe,EACf,WAAW,IAAI,IAAI,IAAI,8BACrB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,IAAY,EACZ,WAAiC,EAAE;IAEnC,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,IAAA,mBAAS,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,8BAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IACD,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC/C,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAyB;IACtD,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,+BAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,iCAAqB,CAC7B,eAAe,EACf,yBAAyB,+BAAuB,SAAS,CAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAyB;IACpE,IAAA,uBAAa,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACpC,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;AACxB,CAAC;AAED,SAAgB,0BAA0B,CACxC,IAAY,EACZ,QAAyB,EACzB,WAAiC,EAAE;IAEnC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,sBAAsB,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,UAA8B,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,UAAU,GAAG,IAAA,kBAAQ,EACnB,IAAI,EACJ,mBAAS,CAAC,OAAO,GAAG,mBAAS,CAAC,MAAM,GAAG,mBAAS,CAAC,QAAQ,EACzD,yBAAiB,CAClB,CAAC;QACF,OAAO,GAAG,IAAI,CAAC;QACf,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACtB,UAAU,GAAG,SAAS,CAAC;QACvB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QACD,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,IAAA,oBAAU,EAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,IAAY,EACZ,QAAyB,EACzB,WAAiC,EAAE;IAEnC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,aAAa,GAAG,IAAA,gBAAI,EACxB,SAAS,EACT,IAAI,IAAA,oBAAQ,EAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC1E,CAAC;IACF,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,IAAA,kBAAQ,EACnB,aAAa,EACb,mBAAS,CAAC,OAAO,GAAG,mBAAS,CAAC,MAAM,GAAG,mBAAS,CAAC,QAAQ,EACzD,yBAAiB,CAClB,CAAC;QACF,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACtB,UAAU,GAAG,SAAS,CAAC;QACvB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnD,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAA,oBAAU,EAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAChC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,IAAA,oBAAU,EAAC,aAAa,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAA,oBAAU,EAAC,aAAa,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;YAC1E,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAC7B,IAAY,EACZ,WAAiC,EAAE;IAEnC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,IAAI,GAAG,+BAAuB,EAAE,CAAC;QAC1C,MAAM,IAAI,iCAAqB,CAC7B,eAAe,EACf,iBAAiB,IAAI,YAAY,+BAAuB,SAAS,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/src/local-dev/process-identity.d.ts

@@ -0,0 +1,9 @@
+import type { FleetProcessIdentity, ProcessIdentityProbe } from './fleet-lock.js';
+export interface ProcessIdentityEffects {
+    exists?: (path: string) => boolean;
+    platform?: NodeJS.Platform;
+    readFile?: (path: string) => string;
+    run?: (executable: string, arguments_: readonly string[]) => string;
+}
+export declare function captureProcessIdentity(pid?: number, now?: Date, effects?: ProcessIdentityEffects): FleetProcessIdentity;
+export declare function probeProcessIdentity(identity: FleetProcessIdentity, effects?: ProcessIdentityEffects): ProcessIdentityProbe;

package/src/local-dev/process-identity.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureProcessIdentity = captureProcessIdentity;
+exports.probeProcessIdentity = probeProcessIdentity;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const contract_validation_js_1 = require("./contract-validation.js");
+function processMarker(pid, effects = {}) {
+    const targetPlatform = effects.platform ?? (0, node_os_1.platform)();
+    const exists = effects.exists ?? node_fs_1.existsSync;
+    const readFile = effects.readFile ?? ((path) => (0, node_fs_1.readFileSync)(path, 'utf8'));
+    const run = effects.run ??
+        ((executable, arguments_) => (0, node_child_process_1.execFileSync)(executable, [...arguments_], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 3_000,
+            windowsHide: true,
+        }).trim());
+    try {
+        if (targetPlatform === 'linux') {
+            const path = `/proc/${pid}/stat`;
+            if (!exists(path))
+                return undefined;
+            const value = readFile(path);
+            const closing = value.lastIndexOf(')');
+            if (closing === -1)
+                return undefined;
+            const fields = value.slice(closing + 2).split(' ');
+            const startTicks = fields[19];
+            return startTicks ? `linux:${pid}:${startTicks}` : undefined;
+        }
+        if (targetPlatform === 'darwin') {
+            const marker = run('ps', ['-o', 'lstart=', '-p', String(pid)]);
+            return marker ? `darwin:${pid}:${marker}` : undefined;
+        }
+        if (targetPlatform === 'win32') {
+            const marker = run('powershell.exe', [
+                '-NoLogo',
+                '-NoProfile',
+                '-NonInteractive',
+                '-Command',
+                `(Get-CimInstance Win32_Process -Filter "ProcessId=${pid}").CreationDate.ToUniversalTime().ToString('o')`,
+            ]);
+            return marker ? `win32:${pid}:${marker}` : undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+function captureProcessIdentity(pid = process.pid, now = new Date(), effects = {}) {
+    const marker = processMarker(pid, effects);
+    if (!marker) {
+        throw new Error(`The operating system cannot provide a PID-reuse-safe identity for process ${pid}.`);
+    }
+    return {
+        pid,
+        processIdentity: (0, contract_validation_js_1.sha256Digest)(marker),
+        startedAt: now.toISOString(),
+    };
+}
+function probeProcessIdentity(identity, effects = {}) {
+    const marker = processMarker(identity.pid, effects);
+    if (!marker) {
+        try {
+            process.kill(identity.pid, 0);
+            return 'ambiguous';
+        }
+        catch {
+            return 'absent';
+        }
+    }
+    return (0, contract_validation_js_1.sha256Digest)(marker) === identity.processIdentity
+        ? 'matching'
+        : 'absent';
+}
+//# sourceMappingURL=process-identity.js.map

package/src/local-dev/process-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-identity.js","sourceRoot":"","sources":["../../../../../packages/nx/src/local-dev/process-identity.ts"],"names":[],"mappings":";;AAiEA,wDAgBC;AAED,oDAgBC;AAnGD,2DAAkD;AAClD,qCAAmD;AACnD,qCAAmC;AAEnC,qEAAwD;AAaxD,SAAS,aAAa,CACpB,GAAW,EACX,UAAkC,EAAE;IAEpC,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAA,kBAAQ,GAAE,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,oBAAU,CAAC;IAC5C,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GACP,OAAO,CAAC,GAAG;QACX,CAAC,CAAC,UAAkB,EAAE,UAA6B,EAAE,EAAE,CACrD,IAAA,iCAAY,EAAC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE;YACxC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACf,IAAI,CAAC;QACH,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,CAAC;QACD,IAAI,cAAc,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/D,OAAO,MAAM,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,CAAC;QACD,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,EAAE;gBACnC,SAAS;gBACT,YAAY;gBACZ,iBAAiB;gBACjB,UAAU;gBACV,qDAAqD,GAAG,iDAAiD;aAC1G,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,sBAAsB,CACpC,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,6EAA6E,GAAG,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG;QACH,eAAe,EAAE,IAAA,qCAAY,EAAC,MAAM,CAAC;QACrC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAClC,QAA8B,EAC9B,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9B,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,IAAA,qCAAY,EAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,eAAe;QACtD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC"}

package/src/local-dev/runtime-paths.d.ts

@@ -0,0 +1,17 @@
+export interface FleetRuntimePaths {
+    appData: string;
+    capability: string;
+    controlSocket: string;
+    heartbeat: string;
+    lock: string;
+    logDirectory: string;
+    personalSecretLedgersDirectory: string;
+    runnersDirectory: string;
+    sessionDirectory: string;
+    sessionsDirectory: string;
+    sliceClaimsDirectory: string;
+    startup: string;
+    state: string;
+    supervisorPid: string;
+}
+export declare function fleetRuntimePaths(fleetId: string, appData?: string): FleetRuntimePaths;

package/src/local-dev/runtime-paths.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fleetRuntimePaths = fleetRuntimePaths;
+const node_path_1 = require("node:path");
+const errors_js_1 = require("./errors.js");
+const fleet_lock_js_1 = require("./fleet-lock.js");
+const tls_js_1 = require("./tls.js");
+function fleetRuntimePaths(fleetId, appData = (0, tls_js_1.defaultLocalDevAppData)()) {
+    const normalizedFleetId = (0, fleet_lock_js_1.validateFleetIdentitySlug)(fleetId, 'Fleet runtime fleetId');
+    if (!(0, node_path_1.isAbsolute)(appData)) {
+        throw new errors_js_1.LocalDevContractError('invalid-input', 'Fleet application-data path must be absolute.');
+    }
+    const normalizedAppData = (0, node_path_1.resolve)(appData);
+    const sessionsDirectory = (0, node_path_1.join)(normalizedAppData, 'sessions');
+    const sessionDirectory = (0, node_path_1.join)(sessionsDirectory, normalizedFleetId);
+    return {
+        appData: normalizedAppData,
+        capability: (0, node_path_1.join)(sessionDirectory, 'control.capability'),
+        controlSocket: (0, tls_js_1.createLocalIpcPath)(sessionDirectory, `fleet-control-${normalizedFleetId}`),
+        heartbeat: (0, node_path_1.join)(sessionDirectory, 'heartbeat.json'),
+        lock: (0, node_path_1.join)(sessionDirectory, 'fleet.lock'),
+        logDirectory: (0, node_path_1.join)(normalizedAppData, 'logs', normalizedFleetId),
+        personalSecretLedgersDirectory: (0, node_path_1.join)(normalizedAppData, 'personal-secret-ledgers'),
+        runnersDirectory: (0, node_path_1.join)(sessionDirectory, 'runners'),
+        sessionDirectory,
+        sessionsDirectory,
+        sliceClaimsDirectory: (0, node_path_1.join)(normalizedAppData, 'slice-claims'),
+        startup: (0, node_path_1.join)(sessionDirectory, 'startup.json'),
+        state: (0, node_path_1.join)(sessionDirectory, 'control-state.json'),
+        supervisorPid: (0, node_path_1.join)(sessionDirectory, 'supervisor.pid'),
+    };
+}
+//# sourceMappingURL=runtime-paths.js.map

package/src/local-dev/runtime-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-paths.js","sourceRoot":"","sources":["../../../../../packages/nx/src/local-dev/runtime-paths.ts"],"names":[],"mappings":";;AAuBA,8CAuCC;AA9DD,yCAAsD;AAEtD,2CAAoD;AACpD,mDAA4D;AAC5D,qCAAsE;AAmBtE,SAAgB,iBAAiB,CAC/B,OAAe,EACf,OAAO,GAAG,IAAA,+BAAsB,GAAE;IAElC,MAAM,iBAAiB,GAAG,IAAA,yCAAyB,EACjD,OAAO,EACP,uBAAuB,CACxB,CAAC;IACF,IAAI,CAAC,IAAA,sBAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,iCAAqB,CAC7B,eAAe,EACf,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,iBAAiB,GAAG,IAAA,gBAAI,EAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,IAAA,gBAAI,EAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IACpE,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,IAAA,gBAAI,EAAC,gBAAgB,EAAE,oBAAoB,CAAC;QACxD,aAAa,EAAE,IAAA,2BAAkB,EAC/B,gBAAgB,EAChB,iBAAiB,iBAAiB,EAAE,CACrC;QACD,SAAS,EAAE,IAAA,gBAAI,EAAC,gBAAgB,EAAE,gBAAgB,CAAC;QACnD,IAAI,EAAE,IAAA,gBAAI,EAAC,gBAAgB,EAAE,YAAY,CAAC;QAC1C,YAAY,EAAE,IAAA,gBAAI,EAAC,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,CAAC;QAChE,8BAA8B,EAAE,IAAA,gBAAI,EAClC,iBAAiB,EACjB,yBAAyB,CAC1B;QACD,gBAAgB,EAAE,IAAA,gBAAI,EAAC,gBAAgB,EAAE,SAAS,CAAC;QACnD,gBAAgB;QAChB,iBAAiB;QACjB,oBAAoB,EAAE,IAAA,gBAAI,EAAC,iBAAiB,EAAE,cAAc,CAAC;QAC7D,OAAO,EAAE,IAAA,gBAAI,EAAC,gBAAgB,EAAE,cAAc,CAAC;QAC/C,KAAK,EAAE,IAAA,gBAAI,EAAC,gBAAgB,EAAE,oBAAoB,CAAC;QACnD,aAAa,EAAE,IAAA,gBAAI,EAAC,gBAAgB,EAAE,gBAAgB,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/src/local-dev/secret-slice-claim.d.ts

@@ -0,0 +1,17 @@
+import { inspectFleetLock, type ProcessIdentityProbe } from './fleet-lock.js';
+import { readFleetState } from './fleet-state.js';
+import { probeProcessIdentity } from './process-identity.js';
+import { inspectSliceClaim } from './slice-claim.js';
+export interface SecretSliceClaimAuthorityInput {
+    appData: string;
+    slice: string;
+    stage: string;
+    workspaceName: string;
+    workspaceRoot: string;
+}
+export declare function assertSecretSliceClaimAuthority(input: SecretSliceClaimAuthorityInput, effects?: {
+    inspectLock?: typeof inspectFleetLock;
+    inspect?: typeof inspectSliceClaim;
+    processProbe?: (identity: Parameters<typeof probeProcessIdentity>[0]) => ProcessIdentityProbe;
+    readState?: typeof readFleetState;
+}): void;

package/src/local-dev/secret-slice-claim.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertSecretSliceClaimAuthority = assertSecretSliceClaimAuthority;
+const node_fs_1 = require("node:fs");
+const errors_js_1 = require("./errors.js");
+const fleet_lock_js_1 = require("./fleet-lock.js");
+const fleet_state_js_1 = require("./fleet-state.js");
+const identity_js_1 = require("./identity.js");
+const process_identity_js_1 = require("./process-identity.js");
+const runtime_paths_js_1 = require("./runtime-paths.js");
+const slice_claim_js_1 = require("./slice-claim.js");
+function assertSecretSliceClaimAuthority(input, effects = {}) {
+    let workspaceRealpath;
+    try {
+        workspaceRealpath = (0, node_fs_1.realpathSync)(input.workspaceRoot);
+    }
+    catch {
+        throw new errors_js_1.LocalDevContractError('invalid-state', 'Personal secret Slice-claim authorization requires a canonical checkout.');
+    }
+    const fleetId = (0, identity_js_1.createFleetId)({
+        checkoutPath: workspaceRealpath,
+        stage: input.stage,
+        workspaceName: input.workspaceName,
+    });
+    const paths = (0, runtime_paths_js_1.fleetRuntimePaths)(fleetId, input.appData);
+    let claim;
+    try {
+        claim = (effects.inspect ?? slice_claim_js_1.inspectSliceClaim)(paths.sliceClaimsDirectory, input.slice);
+    }
+    catch {
+        throw new errors_js_1.LocalDevContractError('slice-claim-ambiguous', `Slice ${input.slice} claim cannot be validated; recover it with ebk dev ps/prune before changing personal secrets.`);
+    }
+    if (!claim)
+        return;
+    const ownerPaths = (0, runtime_paths_js_1.fleetRuntimePaths)(claim.fleetId, input.appData);
+    let state;
+    let lock;
+    try {
+        state = (effects.readState ?? fleet_state_js_1.readFleetState)(ownerPaths.sessionDirectory);
+        lock = (effects.inspectLock ?? fleet_lock_js_1.inspectFleetLock)(ownerPaths.lock);
+    }
+    catch {
+        throw new errors_js_1.LocalDevContractError('slice-claim-ambiguous', `Slice ${input.slice} claim has unreadable Fleet authority; recover it with ebk dev ps/prune before changing personal secrets.`);
+    }
+    if (!state ||
+        !lock ||
+        state.fleetId !== claim.fleetId ||
+        state.sessionGeneration !== claim.sessionGeneration ||
+        state.supervisor.pid !== claim.owner.pid ||
+        state.supervisor.processIdentity !== claim.owner.processIdentity ||
+        state.supervisor.startedAt !== claim.owner.startedAt ||
+        !state.slices.some(({ name, selected }) => name === input.slice && selected) ||
+        lock.fleetId !== claim.fleetId ||
+        lock.sessionGeneration !== claim.sessionGeneration ||
+        lock.owner.pid !== state.supervisor.pid ||
+        lock.owner.processIdentity !== state.supervisor.processIdentity ||
+        lock.owner.startedAt !== state.supervisor.startedAt) {
+        throw new errors_js_1.LocalDevContractError('slice-claim-ambiguous', `Slice ${input.slice} claim does not match exact Fleet state and lock authority; recover it with ebk dev ps/prune before changing personal secrets.`);
+    }
+    const processProbe = (effects.processProbe ?? process_identity_js_1.probeProcessIdentity)(lock.owner);
+    if (claim.fleetId === fleetId &&
+        state.workspaceRealpath === workspaceRealpath &&
+        state.resolvedStage === input.stage &&
+        processProbe === 'matching') {
+        return;
+    }
+    if (claim.fleetId === fleetId) {
+        throw new errors_js_1.LocalDevContractError('slice-claim-ambiguous', `Slice ${input.slice} claim does not identify the current canonical checkout and personal stage exactly.`);
+    }
+    if (processProbe === 'matching') {
+        throw new errors_js_1.LocalDevContractError('slice-active-elsewhere', `Slice ${input.slice} is actively claimed by another canonical checkout.`);
+    }
+    throw new errors_js_1.LocalDevContractError('slice-claim-ambiguous', `Slice ${input.slice} has stale or ambiguous claim state; recover it with ebk dev ps/prune before changing personal secrets.`);
+}
+//# sourceMappingURL=secret-slice-claim.js.map

package/src/local-dev/secret-slice-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-slice-claim.js","sourceRoot":"","sources":["../../../../../packages/nx/src/local-dev/secret-slice-claim.ts"],"names":[],"mappings":";;AAkBA,0EAqGC;AAvHD,qCAAuC;AAEvC,2CAAoD;AACpD,mDAA8E;AAC9E,qDAAkD;AAClD,+CAA8C;AAC9C,+DAA6D;AAC7D,yDAAuD;AACvD,qDAAqD;AAUrD,SAAgB,+BAA+B,CAC7C,KAAqC,EACrC,UAOI,EAAE;IAEN,IAAI,iBAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,iBAAiB,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iCAAqB,CAC7B,eAAe,EACf,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,2BAAa,EAAC;QAC5B,YAAY,EAAE,iBAAiB;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAA,oCAAiB,EAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,KAA2C,CAAC;IAChD,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,kCAAiB,CAAC,CAC5C,KAAK,CAAC,oBAAoB,EAC1B,KAAK,CAAC,KAAK,CACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iCAAqB,CAC7B,uBAAuB,EACvB,SAAS,KAAK,CAAC,KAAK,gGAAgG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,UAAU,GAAG,IAAA,oCAAiB,EAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,KAAwC,CAAC;IAC7C,IAAI,IAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,+BAAc,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC3E,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,gCAAgB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iCAAqB,CAC7B,uBAAuB,EACvB,SAAS,KAAK,CAAC,KAAK,2GAA2G,CAChI,CAAC;IACJ,CAAC;IACD,IACE,CAAC,KAAK;QACN,CAAC,IAAI;QACL,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC/B,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;QACnD,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG;QACxC,KAAK,CAAC,UAAU,CAAC,eAAe,KAAK,KAAK,CAAC,KAAK,CAAC,eAAe;QAChE,KAAK,CAAC,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS;QACpD,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAChB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,IAAI,QAAQ,CACzD;QACD,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;QAClD,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,UAAU,CAAC,GAAG;QACvC,IAAI,CAAC,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,UAAU,CAAC,eAAe;QAC/D,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,CAAC,SAAS,EACnD,CAAC;QACD,MAAM,IAAI,iCAAqB,CAC7B,uBAAuB,EACvB,SAAS,KAAK,CAAC,KAAK,gIAAgI,CACrJ,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,0CAAoB,CAAC,CACjE,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IACE,KAAK,CAAC,OAAO,KAAK,OAAO;QACzB,KAAK,CAAC,iBAAiB,KAAK,iBAAiB;QAC7C,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK;QACnC,YAAY,KAAK,UAAU,EAC3B,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,iCAAqB,CAC7B,uBAAuB,EACvB,SAAS,KAAK,CAAC,KAAK,qFAAqF,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,iCAAqB,CAC7B,wBAAwB,EACxB,SAAS,KAAK,CAAC,KAAK,qDAAqD,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,iCAAqB,CAC7B,uBAAuB,EACvB,SAAS,KAAK,CAAC,KAAK,yGAAyG,CAC9H,CAAC;AACJ,CAAC"}

package/src/local-dev/slice-claim.d.ts

@@ -0,0 +1,36 @@
+import { type FleetProcessIdentity } from './fleet-lock.js';
+import { type PrivateStateSecurity } from './private-state.js';
+export declare const SLICE_CLAIM_SCHEMA_VERSION: 1;
+export interface SliceClaimRecord {
+    acquiredAt: string;
+    fleetId: string;
+    heartbeatAt: string;
+    owner: FleetProcessIdentity;
+    schemaVersion: typeof SLICE_CLAIM_SCHEMA_VERSION;
+    sessionGeneration: string;
+    slice: string;
+}
+export interface SliceClaimOwner {
+    fleetId: string;
+    owner: FleetProcessIdentity;
+    sessionGeneration: string;
+}
+export interface SliceClaimAcquisition {
+    acquired: readonly string[];
+    alreadyOwned: readonly string[];
+    claims: readonly SliceClaimRecord[];
+}
+export type SliceClaimClassification = 'active' | 'ambiguous' | 'owned' | 'stale';
+export declare function validateSliceClaimRecord(value: unknown): SliceClaimRecord;
+export declare function sliceClaimPath(directory: string, slice: string): string;
+export declare function inspectSliceClaim(directory: string, slice: string, security?: PrivateStateSecurity): SliceClaimRecord | undefined;
+export declare function acquireSliceClaims(directory: string, slices: readonly string[], owner: SliceClaimOwner, options?: {
+    now?: string;
+    security?: PrivateStateSecurity;
+}): SliceClaimAcquisition;
+export declare function releaseSliceClaims(directory: string, slices: readonly string[], owner: SliceClaimOwner, security?: PrivateStateSecurity): void;
+export declare function heartbeatSliceClaim(directory: string, slice: string, owner: SliceClaimOwner, heartbeatAt?: string, security?: PrivateStateSecurity): SliceClaimRecord;
+export declare function classifySliceClaim(record: SliceClaimRecord, input: {
+    expected?: SliceClaimOwner;
+    processProbe: 'absent' | 'ambiguous' | 'matching';
+}): SliceClaimClassification;