@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/foundation/local-database-contract.js

@@ -6,6 +6,15 @@ exports.postgresIdentifierByteLength = postgresIdentifierByteLength;
 exports.assertPostgresIdentifierLength = assertPostgresIdentifierLength;
 exports.resolveLogicalDatabaseIdentifiers = resolveLogicalDatabaseIdentifiers;
 exports.resolveLocalDatabaseContract = resolveLocalDatabaseContract;
+exports.prepareLocalDatabaseContract = prepareLocalDatabaseContract;
+exports.runLocalDatabaseLifecycle = runLocalDatabaseLifecycle;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const ports_js_1 = require("../local-dev/ports.js");
+const private_state_js_1 = require("../local-dev/private-state.js");
+const task_identity_js_1 = require("../local-dev/task-identity.js");
 exports.POSTGRES_IDENTIFIER_MAX_BYTES = 63;
 function normalizePostgresIdentifier(input) {
     const sanitized = input.replace(/[^A-Za-z0-9_]/g, '_');
@@ -22,7 +31,7 @@ function postgresIdentifierByteLength(identifier) {
 function assertPostgresIdentifierLength(identifier, label) {
     const bytes = postgresIdentifierByteLength(identifier);
     if (bytes > exports.POSTGRES_IDENTIFIER_MAX_BYTES) {
-        throw new Error(`${label} "${identifier}" is ${bytes} UTF-8 bytes; PostgreSQL identifiers must be ${exports.POSTGRES_IDENTIFIER_MAX_BYTES} bytes or fewer. Choose a shorter stage, Slice, or database identifier. Identifiers are never truncated.`);
+        throw new Error(`${label} "${identifier}" is ${bytes} UTF-8 bytes; PostgreSQL identifiers must be ${exports.POSTGRES_IDENTIFIER_MAX_BYTES} bytes or fewer. Shorten a user-selected Slice or database identifier before deployment; framework task stages are not user-selectable. Identifiers are never truncated.`);
     }
 }
 function resolveLogicalDatabaseIdentifiers(options) {
@@ -54,25 +63,265 @@ function resolveLogicalDatabaseIdentifiers(options) {
         readwriteRole,
     };
 }
-function deterministicLocalDatabasePort(key) {
-    let hash = 5381;
-    for (let index = 0; index < key.length; index += 1) {
-        hash = (hash * 33) ^ key.charCodeAt(index);
+function databaseIdentity(options) {
+    if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(options.slice)) {
+        throw new Error('Local Slice must be a DNS-safe identifier.');
     }
-    return 54320 + (Math.abs(hash) % 100);
-}
-function resolveLocalDatabaseContract(options) {
-    const database = normalizePostgresIdentifier(`${options.slice}_${options.database}`);
+    if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(options.database)) {
+        throw new Error('Local database must be a logical database identifier.');
+    }
+    const workspaceRoot = (0, node_fs_1.realpathSync)(options.workspaceRoot ??
+        (0, node_child_process_1.execFileSync)('git', [
+            '--no-optional-locks',
+            '-c',
+            'core.fsmonitor=false',
+            'rev-parse',
+            '--show-toplevel',
+        ], {
+            cwd: process.cwd(),
+            encoding: 'utf8',
+            timeout: 5_000,
+            env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))),
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trim());
+    const { taskId } = (0, task_identity_js_1.resolveTaskIdentity)(workspaceRoot);
+    const stage = (0, task_identity_js_1.taskStage)(taskId);
+    if (options.stage !== undefined && options.stage !== stage) {
+        throw new Error(`Local database stage does not match this worktree's task (${stage}).`);
+    }
+    const readableDatabase = normalizePostgresIdentifier(`t_${taskId}_${options.slice.length}_${options.slice}_${options.database}`);
+    // Preserve every previously valid allocation. Overlength names were never
+    // accepted, so use a bounded task + tuple digest only for that new domain.
+    const database = postgresIdentifierByteLength(`${readableDatabase}_readwrite`) <=
+        exports.POSTGRES_IDENTIFIER_MAX_BYTES
+        ? readableDatabase
+        : `t_${taskId}_${(0, node_crypto_1.createHash)('sha256')
+            .update(JSON.stringify([options.slice, options.database]))
+            .digest('hex')
+            .slice(0, 24)}`;
     const username = `${database}_readwrite`;
     assertPostgresIdentifierLength(database, 'Local database identifier');
     assertPostgresIdentifierLength(username, 'Local read-write role identifier');
+    const directory = (0, node_path_1.join)((0, node_path_1.dirname)((0, task_identity_js_1.taskIdentityPath)(workspaceRoot)), 'databases', taskId);
     return {
+        taskId,
+        stage,
+        directory,
+        path: (0, node_path_1.join)(directory, `${options.slice.length}-${options.slice}-${options.database}.json`),
+        project: `ebk-${taskId}-${options.slice.length}-${options.slice}-${options.database}`,
         database,
-        host: '127.0.0.1',
-        password: options.password ?? `${options.slice}-local-dev`,
-        port: options.port ??
-            deterministicLocalDatabasePort(`${options.slice}_${options.database}`),
         username,
     };
 }
+function readDatabaseContract(options, identity) {
+    if (!allocationExists(identity.path)) {
+        throw new Error(`Local database allocation is missing. Run the ${options.slice} local-database up target before connecting.`);
+    }
+    const record = JSON.parse((0, private_state_js_1.readPrivateFile)(identity.path).toString('utf8'));
+    if (record.schemaVersion !== 1 ||
+        record.taskId !== identity.taskId ||
+        record.slice !== options.slice ||
+        record.logicalDatabase !== options.database ||
+        record.database !== identity.database ||
+        record.username !== identity.username ||
+        record.host !== '127.0.0.1' ||
+        typeof record.password !== 'string' ||
+        !record.password ||
+        !Number.isSafeInteger(record.port) ||
+        record.port < 1024 ||
+        record.port > 65535 ||
+        (options.port !== undefined && options.port !== record.port) ||
+        (options.password !== undefined && options.password !== record.password)) {
+        throw new Error('Local database allocation ownership or connection coordinates do not match; refusing to connect.');
+    }
+    return {
+        database: record.database,
+        host: '127.0.0.1',
+        password: record.password,
+        port: record.port,
+        username: record.username,
+    };
+}
+function allocationExists(path) {
+    try {
+        (0, node_fs_1.lstatSync)(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Read the same private allocation used by Docker, Drizzle, and SST links. */
+function resolveLocalDatabaseContract(options) {
+    return readDatabaseContract(options, databaseIdentity(options));
+}
+/** Prepare coordinates only; Docker's bind remains authoritative against races. */
+async function prepareLocalDatabaseContract(options, isAvailable = ports_js_1.canBindLoopbackPort) {
+    const identity = databaseIdentity(options);
+    if (allocationExists(identity.path))
+        return readDatabaseContract(options, identity);
+    const reserved = new Set();
+    if ((0, node_fs_1.existsSync)(identity.directory)) {
+        for (const name of (0, node_fs_1.readdirSync)(identity.directory)) {
+            if (name.endsWith('.json')) {
+                const sibling = JSON.parse((0, private_state_js_1.readPrivateFile)((0, node_path_1.join)(identity.directory, name)).toString('utf8'));
+                if (Number.isSafeInteger(sibling.port))
+                    reserved.add(sibling.port);
+            }
+        }
+    }
+    let port = options.port;
+    if (port !== undefined) {
+        if (!Number.isSafeInteger(port) ||
+            port < 1024 ||
+            port > 65535 ||
+            reserved.has(port) ||
+            !(await isAvailable(port))) {
+            throw new Error('Requested local database port is invalid, reserved, or occupied.');
+        }
+    }
+    else {
+        port = await (0, ports_js_1.allocateFleetPort)(identity.project, { isAvailable, reserved });
+    }
+    (0, private_state_js_1.publishPrivateFileExclusive)(identity.path, `${JSON.stringify({
+        schemaVersion: 1,
+        taskId: identity.taskId,
+        slice: options.slice,
+        logicalDatabase: options.database,
+        database: identity.database,
+        host: '127.0.0.1',
+        password: options.password ?? `${identity.taskId}-local-dev`,
+        port,
+        username: identity.username,
+    })}\n`);
+    return readDatabaseContract(options, identity);
+}
+/** Exact-owned local Docker lifecycle. Volumes and allocation survive down. */
+async function runLocalDatabaseLifecycle(options, dependencies = {}) {
+    const environment = dependencies.environment ?? process.env;
+    const overrides = Object.keys(environment).filter((key) => key.startsWith('COMPOSE_') && environment[key] !== undefined);
+    if (overrides.length)
+        throw new Error(`Ambient Compose overrides are not allowed: ${overrides.join(', ')}.`);
+    const identity = databaseIdentity(options);
+    let local = allocationExists(identity.path)
+        ? readDatabaseContract(options, identity)
+        : undefined;
+    const env = {
+        ...environment,
+        ...(local
+            ? {
+                EBK_LOCAL_DATABASE: local.database,
+                EBK_LOCAL_DATABASE_PASSWORD: local.password,
+                EBK_LOCAL_DATABASE_PORT: String(local.port),
+                EBK_LOCAL_DATABASE_USERNAME: local.username,
+            }
+            : {}),
+        EBK_LOCAL_DATABASE_PROJECT: identity.project,
+        EBK_LOCAL_DATABASE_TASK: identity.taskId,
+        EBK_LOCAL_DATABASE_SLICE: options.slice,
+        EBK_LOCAL_DATABASE_LOGICAL: options.database,
+    };
+    const docker = dependencies.docker ??
+        ((args, childEnvironment) => (0, node_child_process_1.spawnSync)('docker', args, {
+            env: childEnvironment,
+            encoding: 'utf8',
+            timeout: 120_000,
+            windowsHide: true,
+        }));
+    const run = (args) => {
+        const result = docker(args, env);
+        if (result.error)
+            throw result.error;
+        return result;
+    };
+    const inspect = (kind, name) => {
+        const result = run([kind, 'inspect', name]);
+        if (result.status !== 0) {
+            if (/No such (?:object|container|volume|network)/i.test(result.stderr) ||
+                (kind === 'network' &&
+                    result.stderr.includes(`network ${name} not found`)))
+                return undefined;
+            throw new Error(`Unable to inspect exact local database ${kind}; check Docker availability before retrying.`);
+        }
+        const records = JSON.parse(result.stdout);
+        if (!Array.isArray(records) || records.length !== 1)
+            throw new Error('Ambiguous local database Docker ownership.');
+        const record = records[0];
+        const labels = kind === 'container' ? record.Config?.Labels : record.Labels;
+        if (labels?.['dev.ebk.task'] !== identity.taskId ||
+            labels?.['dev.ebk.slice'] !== options.slice ||
+            labels?.['dev.ebk.database'] !== options.database ||
+            labels?.['com.docker.compose.project'] !== identity.project) {
+            throw new Error(`Local database ${kind} ownership mismatch; refusing creation or cleanup.`);
+        }
+        if (kind === 'container' && local) {
+            const bindings = record.HostConfig?.PortBindings?.['5432/tcp'];
+            if (!Array.isArray(bindings) ||
+                bindings.length !== 1 ||
+                bindings[0].HostIp !== '127.0.0.1' ||
+                bindings[0].HostPort !== String(local.port)) {
+                throw new Error('Local database container port ownership mismatch; refusing to connect.');
+            }
+        }
+        return record;
+    };
+    const container = inspect('container', `${identity.project}-database`);
+    const volume = inspect('volume', `${identity.project}-data`);
+    const network = inspect('network', `${identity.project}-network`);
+    if (!local) {
+        if (container || volume || network) {
+            throw new Error('Local database allocation is missing while exact Docker resources remain. Restore the original private allocation before up or down; no coordinates were created and no resources were removed.');
+        }
+        // Missing coordinates are not absence evidence; exact Docker inspection is.
+        if (options.action === 'down')
+            return;
+        local = await prepareLocalDatabaseContract(options, dependencies.isAvailable);
+        Object.assign(env, {
+            EBK_LOCAL_DATABASE: local.database,
+            EBK_LOCAL_DATABASE_PASSWORD: local.password,
+            EBK_LOCAL_DATABASE_PORT: String(local.port),
+            EBK_LOCAL_DATABASE_USERNAME: local.username,
+        });
+    }
+    if (options.action === 'down') {
+        // Never issue project-wide cleanup; use the verified immutable container ID.
+        if (container) {
+            if (typeof container.Id !== 'string' ||
+                !/^[a-f0-9]{64}$/.test(container.Id))
+                throw new Error('Invalid owned container ID.');
+            if (run(['container', 'rm', '--force', container.Id]).status !== 0)
+                throw new Error('Owned local database container cleanup failed; retry down.');
+        }
+        if (network) {
+            if (typeof network.Id !== 'string' || !/^[a-f0-9]{64}$/.test(network.Id))
+                throw new Error('Invalid owned network ID.');
+            if (run(['network', 'rm', network.Id]).status !== 0)
+                throw new Error('Owned local database network cleanup failed; inspect its remaining endpoints.');
+        }
+        return;
+    }
+    if (!container &&
+        !(await (dependencies.isAvailable ?? ports_js_1.canBindLoopbackPort)(local.port))) {
+        throw new Error(`Task database port ${local.port} is occupied by another service. Free that exact port and retry; no connection was made.`);
+    }
+    const result = run([
+        'compose',
+        '--env-file',
+        process.platform === 'win32' ? 'NUL' : '/dev/null',
+        '--project-name',
+        identity.project,
+        '-f',
+        options.composeFile,
+        'up',
+        '-d',
+        '--wait',
+    ]);
+    if (result.status !== 0) {
+        throw new Error(`Task database startup failed (possible port bind race). Run this task's local-database down, resolve the Docker/port conflict, then retry up.`);
+    }
+    if (!inspect('container', `${identity.project}-database`))
+        throw new Error('Docker reported success without the exact owned local database container.');
+}
 //# sourceMappingURL=local-database-contract.js.map

package/src/foundation/local-private-smoke-access.d.ts

@@ -0,0 +1,20 @@
+import { type FleetProcessIdentity, type ProcessIdentityProbe } from '../local-dev/fleet-lock.js';
+import { type PrivateStateSecurity } from '../local-dev/private-state.js';
+import { openPrivateSmokeControlPlane } from './private-smoke-control-plane.js';
+import type { GithubPrivateSmokeInput } from './private-smoke-access.js';
+export interface LocalPrivateSmokeInput extends GithubPrivateSmokeInput {
+    /** Already verified invocation-private transport, never ambient credentials. */
+    credentialEnvironment: NodeJS.ProcessEnv;
+}
+interface Dependencies {
+    fetch?: typeof fetch;
+    open?: typeof openPrivateSmokeControlPlane;
+    capture?: () => FleetProcessIdentity;
+    probe?: (owner: FleetProcessIdentity) => ProcessIdentityProbe;
+    security?: PrivateStateSecurity;
+    wait?: (milliseconds: number) => Promise<void>;
+}
+/** Used after the local lifecycle verifies source, policy and federated role.
+ * A private process receipt proves recovery ownership, not deployment authority. */
+export declare function runLocalPrivateSmoke(input: LocalPrivateSmokeInput, dependencies?: Dependencies): Promise<void>;
+export {};

package/src/foundation/local-private-smoke-access.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runLocalPrivateSmoke = runLocalPrivateSmoke;
+const client_cloudfront_1 = require("@aws-sdk/client-cloudfront");
+const client_wafv2_1 = require("@aws-sdk/client-wafv2");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const process_identity_js_1 = require("../local-dev/process-identity.js");
+const fleet_lock_js_1 = require("../local-dev/fleet-lock.js");
+const private_state_js_1 = require("../local-dev/private-state.js");
+const index_js_1 = require("../repository-policy/index.js");
+const federated_credential_transport_js_1 = require("../executors/local-deploy/federated-credential-transport.js");
+const router_waf_js_1 = require("./router-waf.js");
+const private_smoke_control_plane_js_1 = require("./private-smoke-control-plane.js");
+const private_smoke_admission_js_1 = require("./private-smoke-admission.js");
+function check(value, message) {
+    if (!value)
+        throw new Error(`Local private smoke: ${message}`);
+}
+/** Used after the local lifecycle verifies source, policy and federated role.
+ * A private process receipt proves recovery ownership, not deployment authority. */
+async function runLocalPrivateSmoke(input, dependencies = {}) {
+    check(!(0, index_js_1.requiresGithubDeployment)(input.deploymentProfile, input.stage), 'stage requires protected GitHub authority');
+    const policy = (0, router_waf_js_1.normalizeRouterWafPolicy)(JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(input.root, 'packages/foundation/security/router-waf.json'), 'utf8')));
+    check(policy.deploymentProfile === input.deploymentProfile, 'deployment profile differs');
+    const stagePolicy = policy.stages[input.stage];
+    check(stagePolicy, 'stage is inactive');
+    if (stagePolicy.access === 'public' || stagePolicy.mode === 'count') {
+        await input.run();
+        return;
+    }
+    const allowedCidrs = stagePolicy.allowedCidrs.filter((cidr) => !cidr.includes(':'));
+    // Temporary admission has its own empty set; never update the baseline.
+    const baseline = [];
+    check(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(input.source), 'source identity is invalid');
+    const policyDigest = (0, router_waf_js_1.routerWafPolicyDigest)(policy);
+    const identity = {
+        account: input.account,
+        stage: input.stage,
+        workspace: input.workspace,
+        policyDigest,
+    };
+    const open = dependencies.open ??
+        (async (resourceIdentity, url) => {
+            const environment = input.credentialEnvironment;
+            check(environment.AWS_PROFILE &&
+                environment.AWS_CONFIG_FILE &&
+                environment.AWS_SHARED_CREDENTIALS_FILE, 'verified private credential transport is missing');
+            const credentials = (0, credential_providers_1.fromIni)({
+                profile: environment.AWS_PROFILE,
+                configFilepath: environment.AWS_CONFIG_FILE,
+                filepath: environment.AWS_SHARED_CREDENTIALS_FILE,
+                // The invocation refreshes this same file before smoke. Ownership
+                // checks may already have populated Smithy's shared ini-file cache.
+                ignoreCache: true,
+            });
+            const options = {
+                credentials,
+                region: 'us-east-1',
+                maxAttempts: 3,
+                requestHandler: { connectionTimeout: 10_000, requestTimeout: 30_000 },
+            };
+            return (0, private_smoke_control_plane_js_1.openPrivateSmokeControlPlane)(resourceIdentity, url, {
+                waf: new client_wafv2_1.WAFV2Client({
+                    ...options,
+                    endpoint: 'https://wafv2.us-east-1.amazonaws.com',
+                }),
+                cloudfront: new client_cloudfront_1.CloudFrontClient({
+                    ...options,
+                    endpoint: 'https://cloudfront.amazonaws.com',
+                }),
+            });
+        });
+    const store = await open(identity, input.url);
+    const request = dependencies.fetch ?? fetch;
+    const wait = dependencies.wait ??
+        ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const path = (0, node_path_1.join)((0, node_fs_1.realpathSync)(input.root), '.ebk/evidence/local-smoke', `${input.stage}.json`);
+    const security = dependencies.security;
+    const readOwner = () => {
+        const value = JSON.parse((0, private_state_js_1.readPrivateFile)(path, security).toString('utf8'));
+        check(value?.kind === 'ebk-local-smoke-owner' &&
+            value.schemaVersion === 1 &&
+            value.account === input.account &&
+            value.stage === input.stage &&
+            value.workspace === input.workspace &&
+            value.policyDigest === policyDigest, 'retained owner or policy differs; preserve recovery evidence');
+        (0, fleet_lock_js_1.validateFleetProcessIdentity)(value.owner);
+        check(value.context?.authority === 'local' &&
+            /^[a-f0-9]{32}$/.test(value.context.run) &&
+            /^[1-9]\d*$/.test(value.context.attempt) &&
+            /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value.context.source) &&
+            JSON.stringify(value.context.baseline) === JSON.stringify(baseline), 'retained admission context is invalid');
+        return value;
+    };
+    const releaseOwner = (expected) => {
+        check(JSON.stringify(readOwner()) === JSON.stringify(expected), 'private owner changed; cleanup not accepted');
+        const retired = `${path}.${expected.context.run}.completed`;
+        check(!(0, node_fs_1.existsSync)(retired), 'prior recovery completion is unresolved');
+        (0, node_fs_1.renameSync)(path, retired);
+        if ((0, private_state_js_1.readPrivateFile)(retired, security).toString('utf8') !==
+            JSON.stringify(expected)) {
+            if (!(0, node_fs_1.existsSync)(path))
+                (0, node_fs_1.renameSync)(retired, path);
+            throw new Error('Local private smoke: owner changed during retirement');
+        }
+        (0, node_fs_1.unlinkSync)(retired);
+    };
+    if ((0, node_fs_1.existsSync)(path)) {
+        (0, private_state_js_1.assertPrivatePath)((0, node_path_1.join)(input.root, '.ebk/evidence/local-smoke'), 'directory', security);
+        const previous = readOwner();
+        check((dependencies.probe ?? process_identity_js_1.probeProcessIdentity)(previous.owner) === 'absent', 'prior smoke process is active or ambiguous');
+        await (0, private_smoke_admission_js_1.recoverSmokeAdmission)(store, baseline, async (lease) => lease.authority === 'local' &&
+            lease.run === previous.context.run &&
+            lease.attempt === previous.context.attempt &&
+            lease.source === previous.context.source);
+        releaseOwner(previous);
+    }
+    else {
+        // Foreign/local-without-receipt and hosted leases must not be claimed.
+        await (0, private_smoke_admission_js_1.recoverSmokeAdmission)(store, baseline, async () => false);
+    }
+    const ipResponse = await request('https://checkip.amazonaws.com', {
+        redirect: 'error',
+        signal: AbortSignal.timeout(15_000),
+    });
+    check(ipResponse.ok, 'operator IPv4 lookup failed');
+    const address = await ipResponse.text();
+    check(address.length <= 64, 'operator IPv4 response exceeds bound');
+    const cidr = (0, private_smoke_admission_js_1.publicRunnerIpv4)(address.trim());
+    if ((0, private_smoke_admission_js_1.runnerAlreadyAllowed)(cidr, allowedCidrs)) {
+        await input.run();
+        return;
+    }
+    const owner = (dependencies.capture ?? process_identity_js_1.captureProcessIdentity)();
+    const context = {
+        authority: 'local',
+        run: (0, node_crypto_1.randomBytes)(16).toString('hex'),
+        attempt: String(owner.pid),
+        source: input.source,
+        baseline,
+    };
+    const record = {
+        kind: 'ebk-local-smoke-owner',
+        schemaVersion: 1,
+        ...identity,
+        owner,
+        context,
+    };
+    check((0, private_state_js_1.createPrivateFileExclusive)(path, JSON.stringify(record), security), 'another invocation owns local smoke');
+    async function observe(allowed, signal) {
+        for (let i = 0; i < 24; i++) {
+            signal?.throwIfAborted();
+            const response = await request(input.url, {
+                redirect: 'manual',
+                signal: signal
+                    ? AbortSignal.any([signal, AbortSignal.timeout(15_000)])
+                    : AbortSignal.timeout(15_000),
+            });
+            await response.body?.cancel();
+            if (allowed
+                ? response.status >= 200 && response.status < 400
+                : response.status === 403)
+                return;
+            if (i < 23)
+                await wait(5_000);
+        }
+        throw new Error(`Local private smoke: ${allowed ? 'admission' : 'revocation'} not observed; deployment acceptance prohibited`);
+    }
+    const unregister = (0, federated_credential_transport_js_1.registerGovernedSignalCleanup)(async () => {
+        await (0, private_smoke_admission_js_1.cleanupSmokeAdmission)(store, context);
+    }, 90);
+    try {
+        await (0, private_smoke_admission_js_1.withPrivateSmokeAdmission)({
+            store,
+            context,
+            cidr,
+            run: input.run,
+            awaitAdmission: (signal) => observe(true, signal),
+            awaitRevocation: () => observe(false),
+        });
+    }
+    finally {
+        try {
+            // A failed smoke may still have cleaned up correctly. Retain this receipt
+            // only when remote cleanup is unproved, for exact next-run recovery.
+            await (0, private_smoke_admission_js_1.cleanupSmokeAdmission)(store, context);
+            releaseOwner(record);
+        }
+        finally {
+            unregister();
+        }
+    }
+}
+//# sourceMappingURL=local-private-smoke-access.js.map

package/src/foundation/preflight.js

@@ -73,19 +73,34 @@ async function evaluateFoundationPreflight(options) {
         result.invalidNames.forEach((name) => invalidNames.add(name));
         result.values.forEach((value, name) => values.set(name, value));
     }
+    const value = (key) => values.get((0, discovery_js_1.foundationSsmPath)(foundationStage, key)) ?? '';
+    const capabilities = value('capabilities')
+        .split(',')
+        .map((capability) => capability.trim())
+        .filter(Boolean);
+    const hasPostgres = capabilities.includes('postgres');
+    const resourceNames = (0, discovery_js_1.foundationSsmKeysForCapabilities)(capabilities.filter(requirements_js_1.isStandardFoundationCapability))
+        .map((key) => (0, discovery_js_1.foundationSsmPath)(foundationStage, key))
+        .filter((name) => !names.includes(name));
+    for (const batch of chunks(resourceNames, 10)) {
+        const result = await options.readParameters(batch);
+        result.invalidNames.forEach((name) => invalidNames.add(name));
+        result.values.forEach((value, name) => values.set(name, value));
+    }
+    names.push(...resourceNames);
     const issues = names
         .filter((name) => invalidNames.has(name) || !values.get(name))
         .map((name) => `missing required parameter ${name}`);
     const allRequiredParametersMissing = names.every((name) => invalidNames.has(name) || !values.has(name));
-    const value = (key) => values.get((0, discovery_js_1.foundationSsmPath)(foundationStage, key)) ?? '';
     const schemaVersion = Number(value('schemaVersion'));
     if (schemaVersion !== discovery_js_1.FOUNDATION_SSM_SCHEMA_VERSION) {
         issues.push(`Foundation discovery schema ${value('schemaVersion') || 'missing'} does not match ${discovery_js_1.FOUNDATION_SSM_SCHEMA_VERSION}`);
     }
     const databasePort = Number(value('databasePort'));
-    if (!Number.isSafeInteger(databasePort) ||
-        databasePort < 1 ||
-        databasePort > 65535) {
+    if (hasPostgres &&
+        (!Number.isSafeInteger(databasePort) ||
+            databasePort < 1 ||
+            databasePort > 65535)) {
         issues.push('Foundation discovery databasePort must be from 1 through 65535');
     }
     const accountMonthlyMaximumUsd = Number(value('accountMonthlyMaximumUsd'));
@@ -103,10 +118,6 @@ async function evaluateFoundationPreflight(options) {
     if (!isExactCognitoTokenEndpoint(value('identityTokenEndpoint'), options.region)) {
         issues.push('Foundation discovery identityTokenEndpoint must be the exact Cognito HTTPS token endpoint for the selected AWS Region');
     }
-    const capabilities = value('capabilities')
-        .split(',')
-        .map((capability) => capability.trim())
-        .filter(Boolean);
     const compatibility = (0, requirements_js_1.validateFoundationCompatibility)(options.requirement, {
         capabilities,
         contractVersion: value('contractVersion'),
@@ -128,15 +139,21 @@ async function evaluateFoundationPreflight(options) {
             accountMonthlyMaximumUsd,
             alertTopicArn: value('alertTopicArn'),
             capabilities: compatibility.value.capabilities,
-            clusterId: value('clusterId'),
+            ...(capabilities.includes('container-compute')
+                ? { clusterId: value('clusterId') }
+                : {}),
             contractVersion: compatibility.value.contractVersion,
-            databaseClusterArn: value('databaseClusterArn'),
-            databaseClusterEndpoint: value('databaseClusterEndpoint'),
-            databaseClusterId: value('databaseClusterId'),
-            databaseClusterResourceId: value('databaseClusterResourceId'),
-            databaseHost: value('databaseHost'),
-            databaseMasterSecretArn: value('databaseMasterSecretArn'),
-            databasePort,
+            ...(hasPostgres
+                ? {
+                    databaseClusterArn: value('databaseClusterArn'),
+                    databaseClusterEndpoint: value('databaseClusterEndpoint'),
+                    databaseClusterId: value('databaseClusterId'),
+                    databaseClusterResourceId: value('databaseClusterResourceId'),
+                    databaseHost: value('databaseHost'),
+                    databaseMasterSecretArn: value('databaseMasterSecretArn'),
+                    databasePort,
+                }
+                : {}),
             eventBusArn: value('eventBusArn'),
             eventBusName: value('eventBusName'),
             hasPublicDomain: value('hasPublicDomain') === 'true',
@@ -147,7 +164,7 @@ async function evaluateFoundationPreflight(options) {
             routerDistributionId: value('routerDistributionId'),
             routerUrl: value('routerUrl'),
             schemaVersion: discovery_js_1.FOUNDATION_SSM_SCHEMA_VERSION,
-            vpcId: value('vpcId'),
+            ...(capabilities.includes('network') ? { vpcId: value('vpcId') } : {}),
         },
         consumerStage,
         foundationStage,
@@ -163,7 +180,9 @@ function formatFoundationPreflightReport(report) {
     ];
     report.issues.forEach((issue) => lines.push(`  - ${issue}`));
     if (!report.ok) {
-        lines.push(`  Deploy the Foundation first: pnpm nx run foundation:deploy --stage=${report.foundationStage}`);
+        lines.push(report.foundationStage === 'development'
+            ? '  Establish Foundation through ebk deploy development --profile=<approved-profile> --expectedRoleArn=<approved-development-role>; the governed stage lifecycle deploys Foundation before eligible Slices.'
+            : `  Establish Foundation through the governed ${report.foundationStage} stage lifecycle under the repository deployment profile; follow its protected deployment runbook.`);
     }
     return lines.join('\n');
 }

package/src/foundation/private-smoke-access.js

@@ -30,8 +30,9 @@ async function privateSmokeOperation(input, dependencies, cleanupOnly) {
         await input.run();
         return;
     }
-    const baseline = stagePolicy.allowedCidrs.filter((cidr) => !cidr.includes(':'));
-    check(baseline.length > 0, 'private hosted smoke requires a committed IPv4 baseline');
+    const allowedCidrs = stagePolicy.allowedCidrs.filter((cidr) => !cidr.includes(':'));
+    // Temporary admission has its own empty set; never update the baseline.
+    const baseline = [];
     const repository = environment.GITHUB_REPOSITORY ?? '';
     const ref = `refs/heads/${input.stage === 'production' ? 'main' : 'develop'}`;
     const workflow = `${repository}/.github/workflows/deploy.yml@${ref}`;
@@ -58,6 +59,9 @@ async function privateSmokeOperation(input, dependencies, cleanupOnly) {
         policyDigest: (0, router_waf_js_1.routerWafPolicyDigest)(policy),
     }, cleanupOnly ? undefined : input.url);
     await (0, private_smoke_admission_js_1.recoverSmokeAdmission)(store, baseline, async (lease) => {
+        // A local process lease has no GitHub run authority; never infer one.
+        if (lease.authority === 'local')
+            return false;
         // An old attempt of this run can be recovered only after GitHub confirms it ended.
         if (lease.run === run && lease.attempt === attempt)
             return cleanupOnly && lease.source === input.source;
@@ -96,6 +100,10 @@ async function privateSmokeOperation(input, dependencies, cleanupOnly) {
     const address = await ipResponse.text();
     check(address.length <= 64, 'runner IPv4 response exceeds bound');
     const cidr = (0, private_smoke_admission_js_1.publicRunnerIpv4)(address.trim());
+    if ((0, private_smoke_admission_js_1.runnerAlreadyAllowed)(cidr, allowedCidrs)) {
+        await input.run();
+        return;
+    }
     const wait = dependencies.wait ??
         ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
     async function observe(allowed) {