@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/generators/slice/built-in-plan-testing-persistence-files.d.ts

@@ -0,0 +1,2 @@
+/** Disposable integration resources are independent of fleet or deployed data. */
+export declare function renderTestingPersistenceFiles(name: string, pascalName: string, sql: boolean): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-testing-persistence-files.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderTestingPersistenceFiles = renderTestingPersistenceFiles;
+/** Disposable integration resources are independent of fleet or deployed data. */
+function renderTestingPersistenceFiles(name, pascalName, sql) {
+    const labels = `    labels:
+      dev.empirebuilderkit.owner: test-integration
+      dev.empirebuilderkit.run: \${EBK_TEST_RUN_ID}
+      dev.empirebuilderkit.slice: ${name}`;
+    return {
+        'database/test-compose.yml': `services:
+  key-value:
+    image: amazon/dynamodb-local@sha256:ff89bd48ff32cd8d9be5fee8873b65b8854dc408f1afe881be6eb00247bc0dab
+    command: [-jar, DynamoDBLocal.jar, -inMemory, -sharedDb]
+${labels}
+    ports:
+      - '127.0.0.1::8000'
+${sql
+            ? `  database:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD: ebk_test
+      POSTGRES_USER: ebk_test
+    healthcheck:
+      test: [CMD-SHELL, "pg_isready -U ebk_test -d postgres"]
+      interval: 1s
+      timeout: 3s
+      retries: 30
+${labels}
+    ports:
+      - '127.0.0.1::5432'
+    tmpfs:
+      - /var/lib/postgresql/data
+`
+            : ''}`,
+        'testing/local-key-value.ts': `import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import { createDynamoPersistence } from '@empire-builder-kit/runtime/key-value';
+
+const endpoint = new URL(process.env.EBK_TEST_DYNAMODB_ENDPOINT ?? 'http://invalid');
+const tableName = process.env.EBK_TEST_DYNAMODB_TABLE;
+if (endpoint.protocol !== 'http:' || endpoint.hostname !== '127.0.0.1' ||
+    !endpoint.port || endpoint.username || endpoint.password || endpoint.search ||
+    endpoint.hash || endpoint.pathname !== '/' ||
+    !tableName || !/^ebk-test-${name}-[a-z0-9]{1,32}-a[12]-w[0-7]$/.test(tableName)) {
+  throw new Error('Integration requires the runner-owned loopback DynamoDB endpoint and worker table.');
+}
+export const localKeyValueClient = new DynamoDBClient({
+  endpoint: endpoint.href, region: 'us-east-1', maxAttempts: 1,
+  credentials: { accessKeyId: 'LOCALFIXTURE', secretAccessKey: 'local-fixture-not-an-aws-credential' },
+});
+export const localKeyValueTable = tableName;
+export function localKeyValueStore(stage = 'development') {
+  return createDynamoPersistence({ client: localKeyValueClient, tableName: localKeyValueTable,
+    stage, slice: '${name}', eventBusName: 'local-integration-events' });
+}
+`,
+        'integration/record.spec.ts': `import { ScanCommand } from '@aws-sdk/client-dynamodb';
+import { afterAll, describe, expect, it, vi } from 'vitest';
+import { build${pascalName}RecordFixture } from '../testing/fixtures/records.js';
+import { localKeyValueClient, localKeyValueStore, localKeyValueTable } from '../testing/local-key-value.js';
+import { getOwnedRecord, mutateRecord, type RecordMutationInput } from '../data/records.js';
+
+vi.mock('../data/key-value.js', async () => {
+  const { localKeyValueStore } = await import('../testing/local-key-value.js');
+  const store = localKeyValueStore();
+  return { dataStore: () => store };
+});
+const seed = process.env.EBK_TEST_SEED;
+if (!seed) throw new Error('EBK_TEST_SEED is required for reproducible integration fixtures.');
+afterAll(() => localKeyValueClient.destroy());
+
+describe('${name} DynamoDB integration', () => {
+  it('atomically creates a subject-owned record and durable event intent', async () => {
+    const fixture = build${pascalName}RecordFixture(seed);
+    const input: RecordMutationInput = { correlationId: fixture.id, name: fixture.name, recordId: fixture.id, now: new Date().toISOString(),
+      runScope: seed, principal: { kind: 'member', actor: { id: 'synthetic-owner', type: 'user' },
+        subject: { id: 'synthetic-owner', type: 'user' },
+        authority: { mode: 'direct' } } };
+    const created = await mutateRecord(input, true);
+    expect(created).toMatchObject({ created: true, propagation: 'pending' });
+    await expect(getOwnedRecord(fixture.id, 'synthetic-owner')).resolves.toMatchObject(fixture);
+    await expect(getOwnedRecord(fixture.id, 'different-owner')).resolves.toBeNull();
+    await expect(localKeyValueStore('production').get('application', 'records', fixture.id)).resolves.toBeNull();
+    const rows = await localKeyValueClient.send(new ScanCommand({ TableName: localKeyValueTable, ConsistentRead: true }));
+    expect(rows.LastEvaluatedKey).toBeUndefined();
+    expect(rows.Items?.filter((row) => row.kind?.S === 'outbox')).toHaveLength(1);
+    await expect(mutateRecord(input, true)).resolves.toEqual(created);
+    const repeated = await localKeyValueClient.send(new ScanCommand({ TableName: localKeyValueTable, ConsistentRead: true }));
+    expect(repeated.Items?.filter((row) => row.kind?.S === 'outbox')).toHaveLength(1);
+  });
+});
+`,
+        'integration/performance-load-cleanup.spec.ts': `import { afterAll, describe, expect, it } from 'vitest';
+import type { ProtectedLoadRequestAuthorizationV1 } from '@empire-builder-kit/runtime/performance';
+import { createPerformancePersistence } from '../performance/persistence.js';
+import { localKeyValueClient, localKeyValueStore } from '../testing/local-key-value.js';
+
+afterAll(() => localKeyValueClient.destroy());
+const at = Date.parse('2026-09-12T12:00:00.000Z');
+function authorization(plan: string): ProtectedLoadRequestAuthorizationV1 {
+  return { adapterId: 'ebk-dynamodb-async-v1', configuredMaximum: 40,
+    createdAt: new Date(at).toISOString(), durationSeconds: 60, effectId: 'e'.repeat(64),
+    expiresAt: new Date(at + 3_600_000).toISOString(), hmacKeyId: 'integration-fixture', maximumRequests: 10,
+    operation: 'execute', planMaterialDigest: plan, release: { candidateDigest: 'b'.repeat(64),
+      releaseId: 'local-integration', releaseMaterialDigest: 'c'.repeat(64), sourceCommit: 'd'.repeat(40) },
+    requestOrdinal: 1, runId: 'run-' + plan.slice(0, 4),
+    saturationSignalRef: 'dynamodb:protected-run-unprocessed-effects-percent', scenarioId: 'async-key-value-burst',
+    stage: 'development', target: { accountFingerprint: 'sha256:' + 'f'.repeat(64),
+      endpoint: 'https://fixture.example.test/${name}/__ebk/performance/async-worker', region: 'us-east-1', slice: '${name}' },
+    workload: 'async-worker' };
+}
+const cleanup = (auth: ProtectedLoadRequestAuthorizationV1): ProtectedLoadRequestAuthorizationV1 =>
+  ({ ...auth, operation: 'cleanup', effectId: null });
+
+describe('${name} DynamoDB performance cleanup', () => {
+  it('processes an idempotent effect and tombstones cleanup against late writes', async () => {
+    const persistence = createPerformancePersistence(localKeyValueStore(), () => at);
+    const auth = authorization('1'.repeat(64));
+    await persistence.reserve(auth);
+    await expect(persistence.reserve(auth)).rejects.toThrow('replayed');
+    await expect(persistence.execute(auth.adapterId as 'ebk-dynamodb-async-v1', auth.effectId!, auth)).resolves.toEqual({ effectState: 'created' });
+    await expect(persistence.execute('ebk-dynamodb-async-v1', auth.effectId!, auth)).resolves.toEqual({ effectState: 'already-existed' });
+    await expect(persistence.processAsync()).resolves.toMatchObject({ processed: 1 });
+    await expect(persistence.cleanup(cleanup(auth))).resolves.toEqual({ removedEffectCount: 1, remainingEffectCount: 0 });
+    await expect(persistence.cleanup(cleanup(auth))).resolves.toEqual({ removedEffectCount: 0, remainingEffectCount: 0 });
+    await expect(persistence.execute('ebk-dynamodb-async-v1', auth.effectId!, auth)).rejects.toThrow('collision');
+  });
+
+  it('recovers interruption between reservation and effect without touching another stage', async () => {
+    const store = localKeyValueStore();
+    const auth = authorization('2'.repeat(64));
+    await createPerformancePersistence(store, () => at).reserve(auth);
+    const restarted = createPerformancePersistence(localKeyValueStore(), () => at);
+    await expect(restarted.cleanup(cleanup(auth))).resolves.toEqual({ removedEffectCount: 0, remainingEffectCount: 0 });
+    await expect(restarted.reserve(auth)).rejects.toThrow('collision');
+    await expect(localKeyValueStore('production').get('system', 'performance-runs', auth.planMaterialDigest)).resolves.toBeNull();
+  });
+
+  it('retains durable deadline telemetry until acknowledgement, independently of TTL deletion', async () => {
+    let clock = at;
+    const persistence = createPerformancePersistence(localKeyValueStore(), () => clock);
+    const auth = authorization('3'.repeat(64));
+    await persistence.reserve(auth);
+    await persistence.execute('ebk-dynamodb-async-v1', auth.effectId!, auth);
+    clock += 49 * 60 * 60 * 1_000;
+    await expect(persistence.expire()).resolves.toMatchObject({ removedEffects: 1, completeScan: true });
+    await expect(persistence.reportDeadlines(async () => { throw new Error('metric-transport'); })).rejects.toThrow('metric-transport');
+    const metrics: number[] = [];
+    await expect(persistence.reportDeadlines(async value => { metrics.push(value); })).resolves.toMatchObject({ reported: 1 });
+    expect(metrics).toEqual([1]);
+    await expect(persistence.reportDeadlines(async () => {})).resolves.toMatchObject({ reported: 0 });
+  });
+});
+`,
+        ...(sql
+            ? {
+                'integration/migrations.spec.ts': `import { Client } from 'pg';
+import { describe, expect, it } from 'vitest';
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) throw new Error('DATABASE_URL is required for declared SQL integration proof.');
+describe('${name} optional SQL migrations', () => {
+  it('applies committed migrations to an isolated worker database without creating a SQL framework core', async () => {
+    const client = new Client({ connectionString: databaseUrl });
+    await client.connect();
+    try {
+      const result = await client.query("SELECT to_regclass('public.data_lifecycle_outbox')::text AS intents");
+      expect(result.rows).toEqual([{ intents: 'data_lifecycle_outbox' }]);
+    } finally { await client.end(); }
+  });
+});
+`,
+            }
+            : {}),
+    };
+}
+//# sourceMappingURL=built-in-plan-testing-persistence-files.js.map

package/src/generators/slice/built-in-plan-thin-release-files.d.ts

@@ -0,0 +1,11 @@
+import type { DeploymentProfile } from '../../repository-policy/index.js';
+/**
+ * Prerelease release-manifest and rollout scripts used Pulumi previews as
+ * deployment authorization. The thin SST lifecycle keeps immutable candidate
+ * capture, but deployment evidence is the post-operation receipt emitted by
+ * the shared lifecycle adapter. Those old scripts are deliberately not
+ * generated.
+ */
+export declare const RETIRED_PREVIEW_RELEASE_PATHS: readonly ["scripts/release-lifecycle.mjs", "scripts/release-manifest.mjs", "scripts/release-rollout-proof.mjs", "scripts/release-rollout.mjs"];
+/** @internal */
+export declare function renderProductThinReleaseFiles(name: string, configurationSeed: string, deploymentProfile: DeploymentProfile, sql?: boolean): Readonly<Record<string, string>>;

package/src/generators/slice/built-in-plan-thin-release-files.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RETIRED_PREVIEW_RELEASE_PATHS = void 0;
+exports.renderProductThinReleaseFiles = renderProductThinReleaseFiles;
+const built_in_plan_release_files_js_1 = require("./built-in-plan-release-files.js");
+/**
+ * Prerelease release-manifest and rollout scripts used Pulumi previews as
+ * deployment authorization. The thin SST lifecycle keeps immutable candidate
+ * capture, but deployment evidence is the post-operation receipt emitted by
+ * the shared lifecycle adapter. Those old scripts are deliberately not
+ * generated.
+ */
+exports.RETIRED_PREVIEW_RELEASE_PATHS = Object.freeze([
+    'scripts/release-lifecycle.mjs',
+    'scripts/release-manifest.mjs',
+    'scripts/release-rollout-proof.mjs',
+    'scripts/release-rollout.mjs',
+]);
+function activeStages(profile) {
+    return profile === 'starter'
+        ? ['development', 'production']
+        : ['development', 'staging', 'production'];
+}
+function locallyAdmittedReleaseStages(profile) {
+    switch (profile) {
+        case 'starter':
+            return ['development', 'production'];
+        case 'production-isolated':
+            return ['development', 'staging'];
+        case 'fully-isolated':
+            return ['development'];
+    }
+}
+function renderStageList(stages) {
+    return `[${stages.map((stage) => `'${stage}'`).join(', ')}]`;
+}
+function replaceLocalReleaseAdmission(source, profile, originalMessage, subject) {
+    const original = `policy.deploymentProfile !== 'starter' ||\n    !['development', 'staging'].includes(localStage)`;
+    const replacement = `policy.deploymentProfile !== '${profile}' ||\n    !${renderStageList(locallyAdmittedReleaseStages(profile))}.includes(localStage)`;
+    if (!source.includes(original) || !source.includes(originalMessage)) {
+        throw new Error(`Generated ${subject} local admission contract drifted.`);
+    }
+    return source
+        .replace(original, replacement)
+        .replace(originalMessage, `Local ${subject} requires the exact ${profile} profile and one of its locally admitted stages: ${locallyAdmittedReleaseStages(profile).join(', ')}.`);
+}
+function renderThinReleaseRunbook(profile) {
+    const stages = activeStages(profile).join(', ');
+    return `# Release and configuration
+
+The immutable release candidate binds the clean source commit, framework
+version, build provenance, compatibility evidence, and every generated
+artifact input. Protected deployment restores that exact candidate from the
+successful CI run for the deployed commit and assumes the stage deployment
+role through GitHub OIDC. The native SST deployment receipt is post-operation
+evidence; a provider preview is advisory and is never release authority.
+
+For Next.js, release material excludes only the compiler-cache directory directly
+under the declared .next output. Emitted application files and every referenced
+runtime trace dependency remain inventoried with the same content and size checks.
+Do not delete caches or increase evidence bounds to repair a release build.
+
+Active stages for this deployment profile are: ${stages}. Configuration
+declarations are typed and value-free. Evidence records provider identities and
+digests, never secret or flag values. Flags cannot grant authorization.
+
+Application regression recovery uses a reviewed source revert deployed through
+the ordinary protected workflow. Do not rebuild old source and call it an
+immutable artifact. Retain the candidate, deployment receipt, migrations, and
+smoke evidence for each accepted protected deployment.
+`;
+}
+/** @internal */
+function renderProductThinReleaseFiles(name, configurationSeed, deploymentProfile, sql = false) {
+    const files = {
+        ...(0, built_in_plan_release_files_js_1.renderProductReleaseFiles)(name, configurationSeed, sql),
+    };
+    for (const path of exports.RETIRED_PREVIEW_RELEASE_PATHS)
+        delete files[path];
+    const requiredStages = activeStages(deploymentProfile);
+    const declarations = JSON.parse(files['configuration/declarations.json'] ?? '{}');
+    if (!Array.isArray(declarations.declarations)) {
+        throw new Error('Generated configuration declarations are absent.');
+    }
+    declarations.declarations = declarations.declarations.map((declaration) => ({
+        ...declaration,
+        requiredStages,
+    }));
+    files['configuration/declarations.json'] =
+        JSON.stringify(declarations, null, 2) + '\n';
+    const declarationsSource = files['configuration/declarations.ts'];
+    if (!declarationsSource) {
+        throw new Error('Generated typed configuration declarations are absent.');
+    }
+    files['configuration/declarations.ts'] = declarationsSource
+        .split("requiredStages: ['development', 'staging', 'production']")
+        .join(`requiredStages: ${JSON.stringify(requiredStages)}`);
+    const releaseArtifacts = files['scripts/release-artifacts.mjs'];
+    if (!releaseArtifacts) {
+        throw new Error('Generated release artifact capture is absent.');
+    }
+    files['scripts/release-artifacts.mjs'] = replaceLocalReleaseAdmission(releaseArtifacts
+        .split("'sst-plan-residual'")
+        .join("'sst-native-deployment-receipt'"), deploymentProfile, 'Local release artifact capture requires a locally admitted exact starter deployment target; production requires protected GitHub authority.', 'release artifact capture');
+    const releaseCandidate = files['scripts/release-candidate.mjs'];
+    if (!releaseCandidate) {
+        throw new Error('Generated immutable release candidate capture is absent.');
+    }
+    files['scripts/release-candidate.mjs'] = replaceLocalReleaseAdmission(releaseCandidate, deploymentProfile, 'Local release candidates require a locally admitted exact starter deployment target; production requires protected GitHub authority.', 'release candidate capture');
+    const controls = JSON.parse(files['operations/release.json'] ?? '{}');
+    if (!Array.isArray(controls.artifactInventory)) {
+        throw new Error('Generated release artifact inventory is absent.');
+    }
+    // These handlers are native SST artifacts, not a second, nonexistent OCI image.
+    // SQL added later retains its own migration/retirement images without moving
+    // the original DynamoDB records or maintenance into the database.
+    controls.artifactInventory = controls.artifactInventory.filter((artifact) => artifact.id !== `${name}.job.data-retention` &&
+        (sql ||
+            ![
+                `${name}.job.database-migration`,
+                `${name}.job.database-retirement`,
+            ].includes(String(artifact.id))));
+    const lambda = controls.artifactInventory.find((artifact) => artifact.id === `${name}.lambda`);
+    const candidate = lambda?.candidate;
+    if (!candidate?.materialPaths ||
+        !candidate.sourceInputPaths ||
+        !candidate.recipePaths)
+        throw new Error('Native retention requires the exact Lambda artifact inventory.');
+    const nativeInputs = [
+        'authorization',
+        'data',
+        'secrets',
+        'jobs/data-retention/src',
+    ].map((path) => `packages/${name}/${path}`);
+    candidate.materialPaths = [
+        ...new Set([...candidate.materialPaths, ...nativeInputs]),
+    ];
+    candidate.sourceInputPaths = [
+        ...new Set([...candidate.sourceInputPaths, ...nativeInputs]),
+    ];
+    candidate.recipePaths.push(`packages/${name}/jobs/data-retention/package.json`);
+    controls.artifactInventory = controls.artifactInventory.map((artifact) => artifact.classification === 'stage-specific'
+        ? {
+            ...artifact,
+            providerEvidence: 'sst-native-deployment-receipt',
+            reason: 'SST packages this provider artifact for the exact source during the native stage deployment.',
+        }
+        : artifact);
+    controls.artifactClasses = {
+        job: 'stage-neutral-digest-qualified-oci',
+        lambda: 'source-bound-native-sst-provider-artifact',
+        web: 'source-bound-native-sst-provider-artifact',
+    };
+    delete controls.lifecycle;
+    delete controls.recovery;
+    delete controls.rollout;
+    files['operations/release.json'] = JSON.stringify(controls, null, 2) + '\n';
+    files['docs/runbooks/release-and-configuration.md'] =
+        renderThinReleaseRunbook(deploymentProfile);
+    return files;
+}
+//# sourceMappingURL=built-in-plan-thin-release-files.js.map

package/src/generators/slice/built-in-plan-verification-files.js

@@ -13,6 +13,7 @@ export default defineConfig({
       ...configDefaults.exclude,
       '**/dist/**',
       'e2e/**',
+      'local-e2e/**',
       'integration/**',
     ],
   },
@@ -108,7 +109,9 @@ test('proves the deployed product, auth, database, and event journey', async ({
   await expect(page.getByRole('heading', { name: 'Sign in' })).toBeVisible();
   await page.getByLabel('Email').fill(email);
   await page.getByLabel('Password').fill(password);
-  await page.getByRole('button', { name: 'Sign in' }).click();
+  const principalSignIn = page.getByRole('button', { name: 'Sign in' });
+  await expect(principalSignIn).toBeEnabled();
+  await principalSignIn.click();
   await expect(page.getByRole('status')).toHaveText('Signed in.');
 
   const protectedUrl = productEndpoint(productUrl, '/api/protected');
@@ -218,7 +221,9 @@ test('proves the deployed product, auth, database, and event journey', async ({
     await page.getByRole('link', { name: 'Sign in' }).click();
     await page.getByLabel('Email').fill(reviewerEmail);
     await page.getByLabel('Password').fill(reviewerPassword);
-    await page.getByRole('button', { name: 'Sign in' }).click();
+    const reviewerSignIn = page.getByRole('button', { name: 'Sign in' });
+    await expect(reviewerSignIn).toBeEnabled();
+    await reviewerSignIn.click();
     await expect(page.getByRole('status')).toHaveText('Signed in.');
     const reviewerAccessToken = (
       await page.context().cookies(productUrl.href)
@@ -344,6 +349,75 @@ test('proves the deployed product, auth, database, and event journey', async ({
   await expect(signOutResponse.json()).resolves.toEqual({ ok: true });
   expect((await page.request.get(protectedUrl)).status()).toBe(401);
 });
+`,
+        'scripts/verify-local-browser.mjs': `import { resolve } from 'node:path';
+import { runLocalBrowserVerification } from '@empire-builder-kit/nx/local-dev';
+await runLocalBrowserVerification({ workspaceRoot: resolve(import.meta.dirname, '../../..'), slice: '${name}' });
+`,
+        'playwright.local.config.ts': `import { defineConfig } from '@playwright/test';
+import { resolve } from 'node:path';
+import { localBrowserLaunchArguments, resolveLocalBrowserTarget } from '@empire-builder-kit/nx/local-dev';
+const target = await resolveLocalBrowserTarget({ workspaceRoot: resolve(import.meta.dirname, '../..'), slice: '${name}' });
+export default defineConfig({
+  forbidOnly: true,
+  retries: 0,
+  workers: 1,
+  testDir: './local-e2e',
+  outputDir: './.ebk/evidence/local-browser-artifacts',
+  projects: [{ name: 'local-chromium', use: {
+    browserName: 'chromium',
+    ignoreHTTPSErrors: false,
+    serviceWorkers: 'block',
+    launchOptions: { args: localBrowserLaunchArguments(target) },
+  } }],
+});
+`,
+        'local-e2e/fixture.ts': `import { test as base, expect } from '@playwright/test';
+import { resolve } from 'node:path';
+import { localBrowserRequestAllowed, resolveLocalBrowserTarget } from '@empire-builder-kit/nx/local-dev';
+export const target = await resolveLocalBrowserTarget({ workspaceRoot: resolve(import.meta.dirname, '../../..'), slice: '${name}' });
+export const test = base.extend({
+  page: async ({ context }, use) => {
+    const page = await context.newPage();
+    const session = await context.newCDPSession(page);
+    // CDP checks every redirect hop. No process-wide certificate bypass is used.
+    session.on('Fetch.requestPaused', async ({ requestId, request }) => {
+      await session.send(localBrowserRequestAllowed(target.origin, request.url) ? 'Fetch.continueRequest' : 'Fetch.failRequest', {
+        requestId,
+        ...(!localBrowserRequestAllowed(target.origin, request.url) ? { errorReason: 'BlockedByClient' } : {}),
+      }).catch(() => undefined);
+    });
+    await session.send('Fetch.enable', { patterns: [{ urlPattern: '*' }] });
+    await context.route('**/*', async (route) => {
+      let ownedPage = false;
+      try { ownedPage = route.request().frame().page() === page; } catch { /* Workers are outside this bounded proof. */ }
+      if (ownedPage && localBrowserRequestAllowed(target.origin, route.request().url())) await route.continue();
+      else await route.abort('blockedbyclient');
+    });
+    await context.routeWebSocket('**/*', (socket) => {
+      if (localBrowserRequestAllowed(target.origin, socket.url(), true)) socket.connectToServer();
+      else socket.close();
+    });
+    try { await use(page); } finally { await page.close(); await session.detach().catch(() => undefined); }
+  },
+});
+export { expect };
+`,
+        'local-e2e/product.spec.ts': `import { expect, target, test } from './fixture';
+test('proves the ready task-local web health', async ({ page }) => {
+  const response = await page.goto(new URL(target.healthPath, target.origin).href);
+  expect(response?.status()).toBe(200);
+  expect(response?.headers()['x-ebk-upstream']).toBe('local');
+  expect(response?.headers()['x-ebk-consumer-stage']).toBe(target.stage);
+  expect(await response?.json()).toMatchObject({ service: '${name}-web', stage: target.stage, status: 'ok' });
+});
+test('renders the Slice through its exact task HTTPS origin', async ({ page }) => {
+  const response = await page.goto(new URL(target.routePrefix, target.origin).href);
+  expect(response?.status()).toBe(200);
+  expect(response?.headers()['x-ebk-upstream']).toBe('local');
+  expect(new URL(page.url()).origin).toBe(target.origin);
+  await expect(page.getByRole('heading', { name: '${pascalName}', exact: true })).toBeVisible();
+});
 `,
         'playwright.config.ts': `import { defineConfig } from '@playwright/test';
 export default defineConfig({

package/src/generators/slice/built-in-plan-web-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderProductWebFiles(name: string, pascalName: string, workspace: string): Readonly<Record<string, string>>;
+export declare function renderProductWebFiles(name: string, pascalName: string, workspace: string, sql?: boolean): Readonly<Record<string, string>>;