@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/local-dev/browser-verification.js

@@ -0,0 +1,281 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateLocalBrowserTarget = validateLocalBrowserTarget;
+exports.resolveLocalBrowserTarget = resolveLocalBrowserTarget;
+exports.localBrowserLaunchArguments = localBrowserLaunchArguments;
+exports.localBrowserRequestAllowed = localBrowserRequestAllowed;
+exports.validateLocalBrowserReport = validateLocalBrowserReport;
+exports.runLocalBrowserVerification = runLocalBrowserVerification;
+exports.localBrowserFailureGuidance = localBrowserFailureGuidance;
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_module_1 = require("node:module");
+const node_path_1 = require("node:path");
+const errors_js_1 = require("./errors.js");
+const fleet_client_js_1 = require("./fleet-client.js");
+const fleet_lock_js_1 = require("./fleet-lock.js");
+const fleet_state_js_1 = require("./fleet-state.js");
+const identity_js_1 = require("./identity.js");
+const nx_workspace_js_1 = require("./nx-workspace.js");
+const process_identity_js_1 = require("./process-identity.js");
+const runtime_paths_js_1 = require("./runtime-paths.js");
+const task_identity_js_1 = require("./task-identity.js");
+const tls_js_1 = require("./tls.js");
+function refuse(message) {
+    throw new errors_js_1.LocalDevContractError('invalid-state', `Local browser verification: ${message}`);
+}
+/** Validate authenticated IPC state against independently resolved worktree coordinates. */
+function validateLocalBrowserTarget(input) {
+    const state = (0, fleet_state_js_1.validateFleetStateRecord)(input.state);
+    if (state.fleetId !== input.fleetId ||
+        state.workspaceRealpath !== input.workspaceRealpath ||
+        state.resolvedStage !== input.stage ||
+        !/^personal-[a-f0-9]{24}$/.test(input.stage) ||
+        state.identitySource !== 'worktree-task' ||
+        state.sessionGeneration !== input.sessionGeneration) {
+        return refuse('authenticated fleet does not match the current task, checkout, or session.');
+    }
+    const slice = state.slices.find((entry) => entry.name === input.slice);
+    if (!slice?.selected || slice.routeState !== 'ready')
+        return refuse(`Slice ${input.slice} must be selected and ready.`);
+    const origin = new URL(state.origin);
+    if (origin.protocol !== 'https:' ||
+        origin.origin !== state.origin ||
+        origin.username ||
+        origin.password ||
+        !origin.hostname.startsWith(`${input.fleetId}.`))
+        return refuse('fleet origin must be its exact credential-free task HTTPS origin.');
+    const suffix = (0, identity_js_1.normalizeFleetHostSuffix)(origin.hostname.slice(input.fleetId.length + 1));
+    if ((0, identity_js_1.createFleetHostname)(input.fleetId, suffix) !== origin.hostname)
+        return refuse('origin hostname differs from the task.');
+    for (const path of [input.routePrefix, input.healthPath]) {
+        const target = new URL(path, origin);
+        if (!path.startsWith('/') ||
+            target.origin !== origin.origin ||
+            target.pathname !== path ||
+            target.search ||
+            target.hash)
+            return refuse('adapter browser paths must be normalized same-origin paths.');
+    }
+    const certificate = new node_crypto_1.X509Certificate(input.certificatePem);
+    const now = input.now ?? Date.now();
+    if (!certificate.checkHost(origin.hostname) ||
+        now < Date.parse(certificate.validFrom) ||
+        now >= Date.parse(certificate.validTo))
+        return refuse('private fleet certificate does not cover the current origin and time.');
+    return {
+        fleetId: input.fleetId,
+        origin: origin.origin,
+        routePrefix: input.routePrefix,
+        healthPath: input.healthPath,
+        sessionGeneration: state.sessionGeneration,
+        slice: input.slice,
+        stage: input.stage,
+        spkiSha256: (0, node_crypto_1.createHash)('sha256')
+            .update(certificate.publicKey.export({ type: 'spki', format: 'der' }))
+            .digest('base64'),
+    };
+}
+async function resolveLocalBrowserTarget(input) {
+    const workspaceRealpath = (0, node_fs_1.realpathSync)(input.workspaceRoot);
+    const task = (0, task_identity_js_1.resolveTaskIdentity)(workspaceRealpath);
+    const stage = (0, task_identity_js_1.taskStage)(task.taskId);
+    const plan = await (0, nx_workspace_js_1.loadWorkspaceFleetPlan)();
+    const workspaceNames = Object.entries(plan.projects)
+        .filter(([, project]) => project.tags?.includes('scope:workspace'))
+        .map(([name]) => name);
+    if (workspaceNames.length !== 1)
+        return refuse('exactly one workspace project is required.');
+    const adapter = plan.adapters.get(input.slice);
+    if (!adapter)
+        return refuse(`Slice ${input.slice} has no valid local-dev adapter.`);
+    const fleetId = (0, identity_js_1.createFleetId)({
+        checkoutPath: workspaceRealpath,
+        stage,
+        workspaceName: workspaceNames[0],
+    });
+    const appData = (0, tls_js_1.defaultLocalDevAppData)();
+    const paths = (0, runtime_paths_js_1.fleetRuntimePaths)(fleetId, appData);
+    const lock = (0, fleet_lock_js_1.inspectFleetLock)(paths.lock);
+    if (!lock ||
+        lock.fleetId !== fleetId ||
+        (0, process_identity_js_1.probeProcessIdentity)(lock.owner) !== 'matching')
+        return refuse('an active, ownership-proved fleet is required. Run ebk dev up first.');
+    const state = await new fleet_client_js_1.FleetClient(paths).status();
+    if (JSON.stringify(state.supervisor) !== JSON.stringify(lock.owner))
+        return refuse('authenticated supervisor differs from its private process lease.');
+    return validateLocalBrowserTarget({
+        certificatePem: (0, node_fs_1.readFileSync)((0, tls_js_1.localTlsPaths)(appData).leafCertificate, 'utf8'),
+        fleetId,
+        healthPath: adapter.healthPath,
+        routePrefix: adapter.routePrefix,
+        sessionGeneration: lock.sessionGeneration,
+        slice: input.slice,
+        stage,
+        state,
+        workspaceRealpath,
+    });
+}
+/** Trust only the private leaf key in this disposable Chromium process, never the host. */
+function localBrowserLaunchArguments(target) {
+    const origin = new URL(target.origin);
+    if (origin.protocol !== 'https:' ||
+        origin.origin !== target.origin ||
+        !origin.hostname.startsWith(`${target.fleetId}.`) ||
+        !/^[A-Za-z0-9+/]{43}=$/.test(target.spkiSha256))
+        return refuse('invalid browser launch coordinates.');
+    return [
+        `--ignore-certificate-errors-spki-list=${target.spkiSha256}`,
+        `--host-resolver-rules=MAP ${origin.hostname} 127.0.0.1`,
+        '--no-proxy-server',
+    ];
+}
+function localBrowserRequestAllowed(origin, requested, websocket = false) {
+    try {
+        const url = new URL(requested);
+        if (websocket) {
+            if (url.protocol !== 'wss:')
+                return false;
+            url.protocol = 'https:';
+        }
+        return (url.protocol === 'https:' &&
+            !url.username &&
+            !url.password &&
+            url.origin === origin);
+    }
+    catch {
+        return false;
+    }
+}
+function validateLocalBrowserReport(value) {
+    const report = value;
+    if (!report ||
+        typeof report !== 'object' ||
+        !Array.isArray(report.suites) ||
+        !Array.isArray(report.errors) ||
+        report.errors.length !== 0 ||
+        !report.stats ||
+        report.stats.unexpected !== 0 ||
+        report.stats.skipped !== 0 ||
+        report.stats.flaky !== 0)
+        return refuse('browser report must have no failures, errors, skips, or retries.');
+    let passed = 0;
+    const visit = (suites, depth) => {
+        if (depth > 16)
+            return refuse('browser report nesting exceeds its bound.');
+        for (const raw of suites) {
+            const suite = raw;
+            if (!suite ||
+                !Array.isArray(suite.specs) ||
+                (suite.suites !== undefined && !Array.isArray(suite.suites)))
+                return refuse('browser report suite is malformed.');
+            for (const spec of suite.specs) {
+                if (!Array.isArray(spec.tests) || spec.tests.length === 0)
+                    return refuse('browser report spec has no executed test.');
+                for (const test of spec.tests) {
+                    if (test.expectedStatus !== 'passed' ||
+                        test.results?.length !== 1 ||
+                        test.results[0].status !== 'passed' ||
+                        test.results[0].retry !== 0 ||
+                        ++passed > 512)
+                        return refuse('browser report contains an expected failure, nonpassing result, retry, or excess test.');
+                }
+            }
+            visit(suite.suites ?? [], depth + 1);
+        }
+    };
+    visit(report.suites, 0);
+    if (passed < 2 || passed !== report.stats.expected)
+        return refuse('browser report must account for at least two passing checks.');
+    return passed;
+}
+async function runLocalBrowserVerification(input) {
+    const target = await resolveLocalBrowserTarget(input);
+    const workspaceRoot = (0, node_fs_1.realpathSync)(input.workspaceRoot);
+    const plan = await (0, nx_workspace_js_1.loadWorkspaceFleetPlan)();
+    const projectRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(workspaceRoot, plan.projects[input.slice].root));
+    const within = (0, node_path_1.relative)(workspaceRoot, projectRoot);
+    if (!within || within.startsWith('..') || within.includes(':'))
+        return refuse('Slice root must be inside the current workspace.');
+    const require = (0, node_module_1.createRequire)((0, node_path_1.join)(projectRoot, 'package.json'));
+    const manifest = require.resolve('@playwright/test/package.json');
+    const packageDirectory = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(manifest, '..'));
+    const cli = (0, node_fs_1.realpathSync)((0, node_path_1.join)(packageDirectory, 'cli.js'));
+    if ((0, node_path_1.relative)(packageDirectory, cli).startsWith('..'))
+        return refuse('Playwright CLI escapes its installed package.');
+    const environment = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('EBK_SMOKE_') &&
+        ![
+            'NODE_OPTIONS',
+            'NODE_PATH',
+            'NODE_TLS_REJECT_UNAUTHORIZED',
+            'NODE_EXTRA_CA_CERTS',
+            'PW_TEST_CONNECT_WS_ENDPOINT',
+            'PW_TEST_REUSE_CONTEXT',
+        ].includes(key)));
+    let report;
+    let status = 'failed';
+    try {
+        const stdout = (0, node_child_process_1.execFileSync)(process.execPath, [cli, 'test', '--config=playwright.local.config.ts', '--reporter=json'], {
+            cwd: projectRoot,
+            env: environment,
+            encoding: 'utf8',
+            maxBuffer: 2 * 1024 * 1024,
+            timeout: 120_000,
+            windowsHide: true,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        report = JSON.parse(stdout);
+        validateLocalBrowserReport(report);
+        status = 'passed';
+    }
+    catch (error) {
+        return refuse(localBrowserFailureGuidance(error));
+    }
+    finally {
+        const evidence = (0, node_path_1.join)(projectRoot, '.ebk/evidence');
+        (0, node_fs_1.mkdirSync)(evidence, { recursive: true });
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(evidence, 'local-browser.json'), JSON.stringify({
+            schemaVersion: 1,
+            proofLayer: 'local-browser',
+            browser: 'chromium',
+            origin: target.origin,
+            stage: target.stage,
+            slice: target.slice,
+            sessionGeneration: target.sessionGeneration,
+            status,
+            passedTests: status === 'passed' ? report?.stats?.expected : 0,
+        }) + '\n', { mode: 0o600 });
+    }
+}
+/** @internal Only classify a known prerequisite; never echo test output or local paths. */
+function localBrowserFailureGuidance(error) {
+    const stdout = error !== null && typeof error === 'object' && 'stdout' in error
+        ? error.stdout
+        : undefined;
+    const text = typeof stdout === 'string'
+        ? stdout
+        : Buffer.isBuffer(stdout)
+            ? stdout.toString('utf8')
+            : '';
+    let missingBrowser = false;
+    if (Buffer.byteLength(text) <= 2 * 1024 * 1024) {
+        try {
+            JSON.parse(text, (key, value) => {
+                if (key === 'message' &&
+                    typeof value === 'string' &&
+                    value.startsWith("browserType.launch: Executable doesn't exist at "))
+                    missingBrowser = true;
+                return value;
+            });
+        }
+        catch {
+            missingBrowser = false;
+        }
+    }
+    if (missingBrowser) {
+        return 'the pinned Chromium browser is missing. From the Slice project directory, run pnpm exec playwright install chromium, then rerun its verify-local-browser target. No browser download or host-trust change was performed by this check.';
+    }
+    return 'local Chromium checks failed. Inspect .ebk/evidence/local-browser-artifacts in the Slice project directory, then rerun its verify-local-browser target. No deployed smoke or host-trust action was attempted.';
+}
+//# sourceMappingURL=browser-verification.js.map

package/src/local-dev/contracts.d.ts

@@ -1,5 +1,7 @@
 export declare const LOCAL_DEV_ADAPTER_VERSION: 1;
 export declare const LOCAL_DEV_ADAPTER_VERSION_V2: 2;
+export declare const LOCAL_DEV_ADAPTER_VERSION_V3: 3;
+export declare const MAX_LOCAL_DEV_DEPENDENCY_SLICES: 64;
 export declare const GATEWAY_PROTOCOL_VERSION: 1;
 export declare const SESSION_MANIFEST_VERSION: 1;
 export type LocalDatabaseMode = 'deployed' | 'local' | 'none';
@@ -25,7 +27,11 @@ export interface WebLocalDevAdapterV2 extends Omit<WebLocalDevAdapterV1, 'adapte
     adapterVersion: typeof LOCAL_DEV_ADAPTER_VERSION_V2;
     lifecycle?: LocalDevLifecycleV2;
 }
-export type LocalDevAdapter = WebLocalDevAdapterV1 | WebLocalDevAdapterV2;
+export interface WebLocalDevAdapterV3 extends Omit<WebLocalDevAdapterV2, 'adapterVersion'> {
+    adapterVersion: typeof LOCAL_DEV_ADAPTER_VERSION_V3;
+    dependencySlices: string[];
+}
+export type LocalDevAdapter = WebLocalDevAdapterV1 | WebLocalDevAdapterV2 | WebLocalDevAdapterV3;
 export interface FleetRoute {
     adapter?: LocalDevAdapter;
     name: string;
@@ -34,6 +40,9 @@ export interface FleetRoute {
     upstream?: URL;
 }
 export declare function validateLocalDevAdapter(value: unknown): LocalDevAdapter;
+/** Resolve metadata, not Nx build dependencies or caller-supplied ordering. */
+export declare function resolveFleetSliceDependencies(adapters: ReadonlyMap<string, LocalDevAdapter>, roots: readonly string[]): string[];
+export declare function resolveFleetSliceOperation(adapters: ReadonlyMap<string, LocalDevAdapter>, command: 'up' | 'restart' | 'down', roots: readonly string[], selected: readonly string[]): string[];
 export declare function validateFleetAdapters(entries: readonly {
     adapter: unknown;
     name: string;

package/src/local-dev/contracts.js

@@ -1,10 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SESSION_MANIFEST_VERSION = exports.GATEWAY_PROTOCOL_VERSION = exports.LOCAL_DEV_ADAPTER_VERSION_V2 = exports.LOCAL_DEV_ADAPTER_VERSION = void 0;
+exports.SESSION_MANIFEST_VERSION = exports.GATEWAY_PROTOCOL_VERSION = exports.MAX_LOCAL_DEV_DEPENDENCY_SLICES = exports.LOCAL_DEV_ADAPTER_VERSION_V3 = exports.LOCAL_DEV_ADAPTER_VERSION_V2 = exports.LOCAL_DEV_ADAPTER_VERSION = void 0;
 exports.validateLocalDevAdapter = validateLocalDevAdapter;
+exports.resolveFleetSliceDependencies = resolveFleetSliceDependencies;
+exports.resolveFleetSliceOperation = resolveFleetSliceOperation;
 exports.validateFleetAdapters = validateFleetAdapters;
+const errors_js_1 = require("./errors.js");
 exports.LOCAL_DEV_ADAPTER_VERSION = 1;
 exports.LOCAL_DEV_ADAPTER_VERSION_V2 = 2;
+exports.LOCAL_DEV_ADAPTER_VERSION_V3 = 3;
+exports.MAX_LOCAL_DEV_DEPENDENCY_SLICES = 64;
 exports.GATEWAY_PROTOCOL_VERSION = 1;
 exports.SESSION_MANIFEST_VERSION = 1;
 const namePattern = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
@@ -44,6 +49,7 @@ function validateLocalDevAdapter(value) {
         'adapterVersion',
         'auth',
         'databaseMode',
+        'dependencySlices',
         'healthPath',
         'kind',
         'lifecycle',
@@ -57,8 +63,25 @@ function validateLocalDevAdapter(value) {
         throw new Error(`Local-dev adapter has unknown member ${unknown[0]}.`);
     }
     if (candidate.adapterVersion !== exports.LOCAL_DEV_ADAPTER_VERSION &&
-        candidate.adapterVersion !== exports.LOCAL_DEV_ADAPTER_VERSION_V2) {
-        throw new Error(`Local-dev adapter version must be ${exports.LOCAL_DEV_ADAPTER_VERSION} or ${exports.LOCAL_DEV_ADAPTER_VERSION_V2}.`);
+        candidate.adapterVersion !== exports.LOCAL_DEV_ADAPTER_VERSION_V2 &&
+        candidate.adapterVersion !== exports.LOCAL_DEV_ADAPTER_VERSION_V3) {
+        throw new Error('Local-dev adapter version must be 1, 2, or 3.');
+    }
+    let dependencySlices = [];
+    if (candidate.adapterVersion === exports.LOCAL_DEV_ADAPTER_VERSION_V3) {
+        if (!Array.isArray(candidate.dependencySlices) ||
+            candidate.dependencySlices.length > exports.MAX_LOCAL_DEV_DEPENDENCY_SLICES ||
+            candidate.dependencySlices.some((name) => typeof name !== 'string' ||
+                name.length > 63 ||
+                !namePattern.test(name)) ||
+            new Set(candidate.dependencySlices).size !==
+                candidate.dependencySlices.length) {
+            throw new Error('Local-dev adapter v3 dependencySlices must contain at most 64 unique DNS-safe Slice names.');
+        }
+        dependencySlices = [...candidate.dependencySlices].sort();
+    }
+    else if (candidate.dependencySlices !== undefined) {
+        throw new Error('Local-dev dependencySlices requires adapter v3.');
     }
     if (candidate.adapterVersion === exports.LOCAL_DEV_ADAPTER_VERSION &&
         candidate.lifecycle !== undefined) {
@@ -103,7 +126,8 @@ function validateLocalDevAdapter(value) {
         throw new Error('Local-dev adapter routePrefix must identify a slice path.');
     }
     let lifecycle;
-    if (candidate.adapterVersion === exports.LOCAL_DEV_ADAPTER_VERSION_V2) {
+    if (candidate.adapterVersion === exports.LOCAL_DEV_ADAPTER_VERSION_V2 ||
+        candidate.adapterVersion === exports.LOCAL_DEV_ADAPTER_VERSION_V3) {
         if (candidate.lifecycle !== undefined) {
             if (!candidate.lifecycle ||
                 typeof candidate.lifecycle !== 'object' ||
@@ -131,10 +155,12 @@ function validateLocalDevAdapter(value) {
             };
         }
         if (candidate.databaseMode === 'local' && !lifecycle) {
-            throw new Error('Local-dev adapter v2 with databaseMode local requires lifecycle cleanup.');
+            throw new Error('Local-dev adapter v2/v3 with databaseMode local requires lifecycle cleanup.');
         }
-        if (candidate.databaseMode !== 'local' && lifecycle) {
-            throw new Error('Local-dev adapter lifecycle cleanup is supported only for local database resources.');
+        if (lifecycle &&
+            candidate.databaseMode !== 'local' &&
+            !(candidate.adapterVersion === 3 && candidate.databaseMode === 'none')) {
+            throw new Error('Local-dev adapter lifecycle cleanup requires local database resources or v3 task-owned resources without a local database.');
         }
     }
     const common = {
@@ -152,17 +178,92 @@ function validateLocalDevAdapter(value) {
             adapterVersion: exports.LOCAL_DEV_ADAPTER_VERSION,
             ...common,
         }
-        : {
-            adapterVersion: exports.LOCAL_DEV_ADAPTER_VERSION_V2,
-            ...(lifecycle ? { lifecycle } : {}),
-            ...common,
-        };
+        : candidate.adapterVersion === exports.LOCAL_DEV_ADAPTER_VERSION_V2
+            ? {
+                adapterVersion: exports.LOCAL_DEV_ADAPTER_VERSION_V2,
+                ...(lifecycle ? { lifecycle } : {}),
+                ...common,
+            }
+            : {
+                adapterVersion: exports.LOCAL_DEV_ADAPTER_VERSION_V3,
+                dependencySlices,
+                ...(lifecycle ? { lifecycle } : {}),
+                ...common,
+            };
+}
+/** Resolve metadata, not Nx build dependencies or caller-supplied ordering. */
+function resolveFleetSliceDependencies(adapters, roots) {
+    const ordered = [];
+    const visited = new Set();
+    const active = new Set();
+    const visit = (name, owner = name) => {
+        if (active.has(name)) {
+            throw new errors_js_1.LocalDevContractError('invalid-adapter', `Product Slice ${owner} has a dependency cycle through ${name}.`);
+        }
+        if (visited.has(name))
+            return;
+        if (visited.size + active.size >= exports.MAX_LOCAL_DEV_DEPENDENCY_SLICES) {
+            throw new errors_js_1.LocalDevContractError('invalid-adapter', `Product Slice ${owner} exceeds the 64-Slice dependency closure limit.`);
+        }
+        const raw = adapters.get(name);
+        if (!raw) {
+            throw new errors_js_1.LocalDevContractError('invalid-adapter', `Product Slice ${owner} requires ${name}, which has no valid local-dev adapter.`);
+        }
+        let adapter;
+        try {
+            adapter = validateLocalDevAdapter(raw);
+        }
+        catch (error) {
+            throw new errors_js_1.LocalDevContractError('invalid-adapter', `Product Slice ${name} has invalid local-dev metadata: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        active.add(name);
+        for (const dependency of adapter.adapterVersion === 3
+            ? adapter.dependencySlices
+            : []) {
+            if (dependency === name) {
+                throw new errors_js_1.LocalDevContractError('invalid-adapter', `Product Slice ${name} must not depend on itself.`);
+            }
+            visit(dependency, name);
+        }
+        active.delete(name);
+        visited.add(name);
+        ordered.push(name);
+    };
+    for (const name of [...roots].sort())
+        visit(name);
+    return ordered;
+}
+function resolveFleetSliceOperation(adapters, command, roots, selected) {
+    if (roots.length === 0 || new Set(roots).size !== roots.length) {
+        throw new errors_js_1.LocalDevContractError('invalid-input', `Fleet ${command} requires unique non-empty Slice names.`);
+    }
+    const closure = resolveFleetSliceDependencies(adapters, roots);
+    if (command === 'up')
+        return closure;
+    const requested = new Set(roots);
+    if (command === 'down') {
+        for (const dependent of selected) {
+            if (requested.has(dependent))
+                continue;
+            const removed = resolveFleetSliceDependencies(adapters, [dependent]).find((name) => requested.has(name));
+            if (removed) {
+                throw new errors_js_1.LocalDevContractError('invalid-input', `Cannot remove dependency ${removed} while Product Slice ${dependent} remains selected.`);
+            }
+        }
+        return closure.filter((name) => requested.has(name)).reverse();
+    }
+    for (const name of closure) {
+        if (!selected.includes(name)) {
+            throw new errors_js_1.LocalDevContractError('not-running', `Product Slice ${name} is not selected; start the dependency closure before restart.`);
+        }
+    }
+    return closure.filter((name) => requested.has(name));
 }
 function validateFleetAdapters(entries) {
     const adapters = new Map();
     const prefixes = new Map();
     for (const { adapter: raw, name } of entries) {
-        if (!namePattern.test(name)) {
+        if (name.length > 63 || !namePattern.test(name)) {
             throw new Error(`Product Slice name ${name} is not DNS-safe.`);
         }
         const adapter = validateLocalDevAdapter(raw);

package/src/local-dev/dev-command-core.js

@@ -11,10 +11,26 @@ function foregroundWait(launch, command, signal, idempotencyKey, reportCleanupFa
         return undefined;
     const stop = async () => {
         try {
-            const down = await launch.client.submit('down', { all: true, slices: [] }, idempotencyKey());
-            await launch.client.waitForOperation(down.operationId, {
-                timeoutMs: command.timeoutMs ?? 120_000,
-            });
+            let down;
+            try {
+                down = await launch.client.submit('down', { all: true, slices: [] }, idempotencyKey());
+            }
+            catch (error) {
+                // A failed up can leave a live foreground supervisor with no Slices.
+                // Its authenticated shutdown still independently refuses active owners.
+                if (!(error instanceof errors_js_1.LocalDevContractError) ||
+                    error.classification !== 'not-running') {
+                    throw error;
+                }
+            }
+            if (down) {
+                const operation = await launch.client.waitForOperation(down.operationId, {
+                    timeoutMs: command.timeoutMs ?? 120_000,
+                });
+                if (operation.state !== 'succeeded') {
+                    throw new errors_js_1.LocalDevContractError(operation.failureClassification ?? 'operation-conflict', 'Foreground Fleet down did not complete successfully; ownership was retained.');
+                }
+            }
             await launch.client.shutdown(idempotencyKey());
         }
         catch (error) {
@@ -22,7 +38,10 @@ function foregroundWait(launch, command, signal, idempotencyKey, reportCleanupFa
         }
     };
     const onAbort = () => void stop();
-    signal.addEventListener('abort', onAbort, { once: true });
+    if (signal.aborted)
+        onAbort();
+    else
+        signal.addEventListener('abort', onAbort, { once: true });
     return launch.runtime.supervisor.waitUntilStopped().finally(() => {
         signal.removeEventListener('abort', onAbort);
     });

package/src/local-dev/docker-credential-health.d.ts

@@ -0,0 +1,14 @@
+export declare const DOCKER_CREDENTIAL_PROBE_TIMEOUT_MS = 5000;
+/** Check helper liveness through the optional metadata-only list operation. Never
+ * request a password, retain helper output, or modify Docker configuration. */
+export declare function inspectDockerCredentialHelpers(options?: {
+    configDirectory?: string;
+    /** Docker registry keys for the images being used, not every host login. */
+    registries?: readonly string[];
+    probe?: (executable: string) => Promise<void>;
+}): Promise<{
+    status: 'ready' | 'unavailable';
+    evidence: string;
+    remediation?: string;
+}>;
+export declare function probeDockerCredentialHelper(executable: string): Promise<void>;

package/src/local-dev/docker-credential-health.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DOCKER_CREDENTIAL_PROBE_TIMEOUT_MS = void 0;
+exports.inspectDockerCredentialHelpers = inspectDockerCredentialHelpers;
+exports.probeDockerCredentialHelper = probeDockerCredentialHelper;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+exports.DOCKER_CREDENTIAL_PROBE_TIMEOUT_MS = 5_000;
+const remediation = 'If a required image pull fails, repair or unlock its selected Docker credential helper, then run ebk dev doctor --refresh. The optional list probe is advisory; do not delete host credentials, remove helpers, or prune shared builders.';
+/** Check helper liveness through the optional metadata-only list operation. Never
+ * request a password, retain helper output, or modify Docker configuration. */
+async function inspectDockerCredentialHelpers(options = {}) {
+    try {
+        const directory = options.configDirectory ??
+            process.env.DOCKER_CONFIG ??
+            (0, node_path_1.join)((0, node_os_1.homedir)(), '.docker');
+        if (!(0, node_path_1.isAbsolute)(directory))
+            throw new Error('invalid configuration');
+        let file;
+        try {
+            file = (0, node_fs_1.openSync)((0, node_path_1.join)(directory, 'config.json'), 'r');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return {
+                    status: 'ready',
+                    evidence: 'No explicit Docker credential helper is configured.',
+                };
+            throw error;
+        }
+        let config;
+        try {
+            const stat = (0, node_fs_1.fstatSync)(file);
+            if (!stat.isFile() || stat.size > 64 * 1024)
+                throw new Error('invalid configuration');
+            config = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+        }
+        finally {
+            (0, node_fs_1.closeSync)(file);
+        }
+        if (!config || typeof config !== 'object' || Array.isArray(config))
+            throw new Error('invalid configuration');
+        let registryHelpers = {};
+        if (config.credHelpers !== undefined) {
+            if (!config.credHelpers ||
+                typeof config.credHelpers !== 'object' ||
+                Array.isArray(config.credHelpers))
+                throw new Error('invalid configuration');
+            registryHelpers = config.credHelpers;
+        }
+        // Fleet dependency images currently use Docker Hub. Exact registry helpers
+        // override the global store, as Docker does; unrelated logins are untouched.
+        const helpers = (options.registries ?? ['https://index.docker.io/v1/'])
+            .map((registry) => registryHelpers[registry] ?? config.credsStore)
+            .filter((helper) => helper !== undefined && helper !== '');
+        const unique = [...new Set(helpers)];
+        if (unique.length > 16 ||
+            unique.some((helper) => typeof helper !== 'string' ||
+                !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(helper)))
+            throw new Error('invalid configuration');
+        const probe = options.probe ?? probeDockerCredentialHelper;
+        await Promise.all(unique.map((helper) => probe(`docker-credential-${helper}`)));
+        return {
+            status: 'ready',
+            evidence: `${unique.length} selected Docker credential helper(s) responded to the optional list probe; output discarded. Image authentication is checked by Docker when pulling.`,
+        };
+    }
+    catch {
+        return {
+            status: 'unavailable',
+            evidence: 'Docker credential configuration or optional list liveness is unverified. This does not prove required image pulls will fail.',
+            remediation,
+        };
+    }
+}
+function probeDockerCredentialHelper(executable) {
+    return new Promise((resolve, reject) => {
+        // list returns registry/username metadata, not passwords. Even that metadata
+        // is discarded. Never serialize execFile's error (it carries stdout/stderr).
+        const child = (0, node_child_process_1.execFile)(executable, ['list'], {
+            timeout: exports.DOCKER_CREDENTIAL_PROBE_TIMEOUT_MS,
+            killSignal: 'SIGKILL',
+            maxBuffer: 64 * 1024,
+            windowsHide: true,
+            shell: false,
+        }, (error) => error
+            ? reject(new Error('Docker credential helper unavailable.'))
+            : resolve());
+        child.stdin?.end();
+    });
+}
+//# sourceMappingURL=docker-credential-health.js.map

package/src/local-dev/environment-inspector.d.ts

@@ -1,3 +1,4 @@
+import { type FoundationPreflightReport } from '../foundation/preflight.js';
 import type { LocalDevAdapter } from './contracts.js';
 import { type DevelopmentEnvironmentAssessment, type EnvironmentCheckResult } from './environment-state.js';
 import { LocalDevContractError } from './errors.js';
@@ -61,6 +62,10 @@ export declare const ENVIRONMENT_INSPECTOR_CHECKS: readonly [{
     readonly capabilities: readonly ["containers"];
     readonly id: "docker-compose-v2";
     readonly volatile: true;
+}, {
+    readonly capabilities: readonly ["containers"];
+    readonly id: "docker-credential-helpers";
+    readonly volatile: true;
 }, {
     readonly capabilities: readonly ["aws-foundation"];
     readonly id: "aws-sdk-credentials";
@@ -122,5 +127,7 @@ export declare class EnvironmentDeficientError extends LocalDevContractError {
 }
 export declare function evaluateEnvironmentExecutableVersion(detectedVersion: string, minimumVersion: string, remediation: string): EnvironmentProbeObservation;
 export declare function evaluateDevelopmentFoundationAccount(accountId: string, eventBusArn: string): EnvironmentProbeObservation;
+export declare function evaluateDevelopmentFoundationReport(report: FoundationPreflightReport, accountId: string, context: LocalDevContext): EnvironmentProbeObservation;
+export declare function resolveCurrentAwsAccountId(context: LocalDevContext, abortSignal: AbortSignal): Promise<string>;
 export declare function inspectDevelopmentEnvironment(input: InspectEnvironmentInput, dependencies?: EnvironmentInspectorDependencies): Promise<DevelopmentEnvironmentAssessment>;
 export declare function assertEnvironmentReady(assessment: DevelopmentEnvironmentAssessment): void;