@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/local-dev/fleet-session.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FleetSession = void 0;
+const contracts_js_1 = require("./contracts.js");
 const deterministic_order_js_1 = require("../deterministic-order.js");
 const errors_js_1 = require("./errors.js");
 const slice_claim_js_1 = require("./slice-claim.js");
@@ -10,6 +11,7 @@ function sessionError(classification, message) {
 class FleetSession {
     routes;
     #allocatePort;
+    #adapters;
     #claimOwner;
     #cleanupStates = new Map();
     #fleetId;
@@ -23,6 +25,7 @@ class FleetSession {
     #sliceClaimsDirectory;
     #started = false;
     constructor(options) {
+        this.#adapters = options.adapters;
         this.#allocatePort = options.allocatePort;
         this.#fleetId = options.fleetId;
         this.#processFactory = options.processFactory;
@@ -47,7 +50,7 @@ class FleetSession {
                     state: 'remote',
                 }));
         for (const route of this.routes) {
-            this.#cleanupStates.set(route.name, route.adapter.adapterVersion === 2 && route.adapter.lifecycle
+            this.#cleanupStates.set(route.name, route.adapter.adapterVersion !== 1 && route.adapter.lifecycle
                 ? 'pending'
                 : 'not-declared');
         }
@@ -78,10 +81,7 @@ class FleetSession {
     }
     up(names) {
         return this.#serialized(async () => {
-            const requested = [...new Set(names)].sort();
-            if (requested.length !== names.length || requested.length === 0) {
-                return sessionError('invalid-input', 'Fleet up requires unique non-empty Slice names.');
-            }
+            const requested = (0, contracts_js_1.resolveFleetSliceOperation)(this.#adapters, 'up', names, this.selectedSlices());
             const changed = requested.filter((name) => !this.#route(name).selected);
             if (changed.length === 0) {
                 return requested.map((name) => {
@@ -102,7 +102,7 @@ class FleetSession {
                     route.upstream = new URL(`http://127.0.0.1:${port}`);
                     route.selected = true;
                     route.state = 'starting';
-                    this.#cleanupStates.set(name, route.adapter.adapterVersion === 2 && route.adapter.lifecycle
+                    this.#cleanupStates.set(name, route.adapter.adapterVersion !== 1 && route.adapter.lifecycle
                         ? 'pending'
                         : 'not-declared');
                     const process = this.#processFactory({
@@ -125,6 +125,7 @@ class FleetSession {
                     const process = this.#processes.get(name);
                     if (process) {
                         try {
+                            (0, contracts_js_1.resolveFleetSliceOperation)(this.#adapters, 'down', [name], this.selectedSlices());
                             await process.stop({ cleanup: true });
                             this.#processes.delete(name);
                         }
@@ -142,7 +143,7 @@ class FleetSession {
                     const route = this.#route(name);
                     route.selected = false;
                     route.state = 'remote';
-                    this.#cleanupStates.set(name, route.adapter.adapterVersion === 2 && route.adapter.lifecycle
+                    this.#cleanupStates.set(name, route.adapter.adapterVersion !== 1 && route.adapter.lifecycle
                         ? 'succeeded'
                         : 'not-declared');
                     delete route.upstream;
@@ -181,7 +182,12 @@ class FleetSession {
                 return sessionError('invalid-input', 'Fleet restart requires unique selected Slice names.');
             }
             const results = [];
-            for (const name of [...names].sort()) {
+            const ordered = (0, contracts_js_1.resolveFleetSliceOperation)(this.#adapters, 'restart', names, this.selectedSlices());
+            for (const name of ordered) {
+                if (!this.#processes.has(name))
+                    return sessionError('not-running', `Product Slice ${name} has no owned process.`);
+            }
+            for (const name of ordered) {
                 const route = this.#route(name);
                 const process = this.#processes.get(name);
                 if (!route.selected || !process) {
@@ -199,14 +205,16 @@ class FleetSession {
             return results;
         });
     }
-    down(names) {
+    async down(names) {
+        this.interruptStartup(names);
         return this.#serialized(async () => {
             if (names.length === 0 || new Set(names).size !== names.length) {
                 return sessionError('invalid-input', 'Fleet down requires unique selected Slice names.');
             }
             const results = [];
             const cleanupFailures = [];
-            for (const name of [...names].sort().reverse()) {
+            const ordered = (0, contracts_js_1.resolveFleetSliceOperation)(this.#adapters, 'down', names, this.selectedSlices());
+            for (const name of ordered) {
                 const route = this.#route(name);
                 const process = this.#processes.get(name);
                 const previousState = route.state;
@@ -220,12 +228,13 @@ class FleetSession {
                     continue;
                 }
                 try {
+                    (0, contracts_js_1.resolveFleetSliceOperation)(this.#adapters, 'down', [name], this.selectedSlices());
                     await process.stop({ cleanup: true });
                     (0, slice_claim_js_1.releaseSliceClaims)(this.#sliceClaimsDirectory, [name], this.#claimOwner, this.#security);
                     this.#processes.delete(name);
                     route.selected = false;
                     route.state = 'remote';
-                    this.#cleanupStates.set(name, route.adapter.adapterVersion === 2 && route.adapter.lifecycle
+                    this.#cleanupStates.set(name, route.adapter.adapterVersion !== 1 && route.adapter.lifecycle
                         ? 'succeeded'
                         : 'not-declared');
                     delete route.upstream;
@@ -261,6 +270,14 @@ class FleetSession {
             .map(({ name }) => name)
             .sort();
     }
+    interruptStartup(names) {
+        // Validate dependency/selection authority before cancelling any wait. The
+        // running up operation owns rollback; down waits for that rollback rather
+        // than racing a second native cleanup against a live writer.
+        const ordered = (0, contracts_js_1.resolveFleetSliceOperation)(this.#adapters, 'down', names, this.selectedSlices());
+        for (const name of ordered)
+            this.#processes.get(name)?.interruptStartup?.();
+    }
     allSlices() {
         return this.routes.map(({ name }) => name).sort();
     }

package/src/local-dev/fleet-slice-runner-daemon.js

@@ -16,6 +16,10 @@ if (require.main === module) {
         .catch((error) => {
         process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
         process.exitCode = 1;
+    })
+        .finally(() => {
+        if (process.connected)
+            process.disconnect();
     });
 }
 //# sourceMappingURL=fleet-slice-runner-daemon.js.map

package/src/local-dev/fleet-state.d.ts

@@ -12,7 +12,7 @@ export type FleetRouteState = (typeof FLEET_ROUTE_STATES)[number];
 export type FleetCleanupState = (typeof FLEET_CLEANUP_STATES)[number];
 export type FleetOperationState = (typeof FLEET_OPERATION_STATES)[number];
 export interface FleetSliceState {
-    adapterVersion: 1 | 2;
+    adapterVersion: 1 | 2 | 3;
     cleanup: FleetCleanupState;
     lastTransitionAt: string;
     logSequence: number;
@@ -42,7 +42,7 @@ export interface FleetStateRecord {
     frameworkVersion: string;
     gitCommonDirectory: string;
     heartbeatAt: string;
-    identitySource: 'os-account';
+    identitySource: 'worktree-task';
     nxVersion: string;
     operations: FleetOperationStateRecord[];
     origin: string;
@@ -55,6 +55,9 @@ export interface FleetStateRecord {
     supervisor: FleetProcessIdentity;
     workspaceRealpath: string;
 }
+/** An up operation persists its resolved closure before acquiring any claims. */
+export declare function fleetOwnedSliceNames(state: FleetStateRecord): string[];
+export declare function fleetOwnsStartingSlice(state: FleetStateRecord, slice: string, acquiredAt: string): boolean;
 export declare function validateFleetStateRecord(value: unknown): FleetStateRecord;
 export declare function transitionFleetSliceState(value: FleetSliceState, next: FleetRouteState, transitionedAt?: string): FleetSliceState;
 export declare function fleetStatePath(sessionDirectory: string): string;

package/src/local-dev/fleet-state.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FLEET_OPERATION_STATES = exports.FLEET_CLEANUP_STATES = exports.FLEET_ROUTE_STATES = exports.FLEET_STATE_FILE = exports.FLEET_STATE_SCHEMA_VERSION = void 0;
+exports.fleetOwnedSliceNames = fleetOwnedSliceNames;
+exports.fleetOwnsStartingSlice = fleetOwnsStartingSlice;
 exports.validateFleetStateRecord = validateFleetStateRecord;
 exports.transitionFleetSliceState = transitionFleetSliceState;
 exports.fleetStatePath = fleetStatePath;
@@ -34,6 +36,23 @@ exports.FLEET_OPERATION_STATES = [
     'succeeded',
     'failed',
 ];
+/** An up operation persists its resolved closure before acquiring any claims. */
+function fleetOwnedSliceNames(state) {
+    return state.slices
+        .filter((slice) => slice.selected ||
+        state.operations.some((operation) => operation.command === 'up' &&
+            operation.state === 'running' &&
+            operation.slices.includes(slice.name)))
+        .map(({ name }) => name)
+        .sort();
+}
+function fleetOwnsStartingSlice(state, slice, acquiredAt) {
+    return (state.slices.some((entry) => entry.name === slice) &&
+        state.operations.some((operation) => operation.command === 'up' &&
+            operation.state === 'running' &&
+            operation.slices.includes(slice) &&
+            operation.acceptedAt <= acquiredAt));
+}
 const ALLOWED_ROUTE_TRANSITIONS = {
     ready: ['unavailable'],
     remote: ['starting'],
@@ -65,8 +84,10 @@ function validateSliceState(value) {
         'routeState',
         'selected',
     ], ['runnerGeneration'], 'Fleet Slice state');
-    if (value.adapterVersion !== 1 && value.adapterVersion !== 2) {
-        return stateError('Fleet Slice adapterVersion must be 1 or 2.');
+    if (value.adapterVersion !== 1 &&
+        value.adapterVersion !== 2 &&
+        value.adapterVersion !== 3) {
+        return stateError('Fleet Slice adapterVersion must be 1, 2, or 3.');
     }
     if (!exports.FLEET_CLEANUP_STATES.includes(value.cleanup)) {
         return stateError('Fleet Slice cleanup state is invalid.');
@@ -199,7 +220,7 @@ function validateFleetStateRecord(value) {
     ], [], 'Fleet state');
     if (value.schemaVersion !== exports.FLEET_STATE_SCHEMA_VERSION ||
         value.controlProtocolVersion !== control_contract_js_1.FLEET_CONTROL_PROTOCOL_VERSION ||
-        value.identitySource !== 'os-account') {
+        value.identitySource !== 'worktree-task') {
         return stateError('Fleet state schema, control protocol, or identity source is unsupported.');
     }
     if (!Array.isArray(value.slices) || value.slices.length > 128) {
@@ -237,7 +258,7 @@ function validateFleetStateRecord(value) {
         frameworkVersion: (0, contract_validation_js_1.requireBoundedString)(value.frameworkVersion, 'Fleet frameworkVersion', { maximumLength: 128 }),
         gitCommonDirectory: requireAbsolutePath(value.gitCommonDirectory, 'Fleet gitCommonDirectory'),
         heartbeatAt,
-        identitySource: 'os-account',
+        identitySource: 'worktree-task',
         nxVersion: (0, contract_validation_js_1.requireBoundedString)(value.nxVersion, 'Fleet nxVersion', {
             maximumLength: 128,
             pattern: /^[0-9A-Za-z][0-9A-Za-z.+-]{0,127}$/,

package/src/local-dev/fleet-supervisor.d.ts

@@ -1,3 +1,4 @@
+import { type LocalDevAdapter } from './contracts.js';
 import { type FleetControlRequest } from './control-contract.js';
 import { type FleetControlHandler } from './fleet-ipc.js';
 import { type FleetProcessIdentity } from './fleet-lock.js';
@@ -14,6 +15,7 @@ export interface FleetSupervisorMutationHost {
     allSlices(): readonly string[];
     closeProxyWhenEmpty(): Promise<boolean>;
     down(slices: readonly string[]): Promise<FleetSupervisorTargetResult[]>;
+    interruptStartup?(slices: readonly string[]): void;
     restart(slices: readonly string[]): Promise<FleetSupervisorTargetResult[]>;
     selectedSlices(): readonly string[];
     sliceStates(): ReadonlyArray<Pick<FleetSliceState, 'cleanup' | 'name' | 'restartAttempts' | 'routeState' | 'runnerGeneration' | 'selected'>>;
@@ -32,6 +34,7 @@ export interface FleetSupervisorEffects {
     processIdentity?: () => FleetProcessIdentity;
 }
 export interface FleetSupervisorOptions {
+    adapters: ReadonlyMap<string, LocalDevAdapter>;
     heartbeatIntervalMs?: number;
     host: FleetSupervisorMutationHost;
     initialState: FleetStateRecord;

package/src/local-dev/fleet-supervisor.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FleetSupervisor = void 0;
 const node_crypto_1 = require("node:crypto");
+const contracts_js_1 = require("./contracts.js");
 const node_fs_1 = require("node:fs");
 const control_contract_js_1 = require("./control-contract.js");
 const errors_js_1 = require("./errors.js");
@@ -11,6 +12,7 @@ const fleet_state_js_1 = require("./fleet-state.js");
 const private_state_js_1 = require("./private-state.js");
 const process_identity_js_1 = require("./process-identity.js");
 const slice_claim_js_1 = require("./slice-claim.js");
+const fleet_runner_evidence_js_1 = require("./fleet-runner-evidence.js");
 function supervisorError(classification, message) {
     throw new errors_js_1.LocalDevContractError(classification, message);
 }
@@ -33,6 +35,7 @@ function failureClassification(error) {
 }
 class FleetSupervisor {
     #closed = false;
+    #adapters;
     #closedWaiters = [];
     #controlServer;
     #effects;
@@ -49,6 +52,7 @@ class FleetSupervisor {
     #state;
     #stopping = false;
     constructor(options, effects = {}) {
+        this.#adapters = options.adapters;
         this.#host = options.host;
         this.#paths = options.paths;
         this.#security = options.security ?? {};
@@ -167,7 +171,13 @@ class FleetSupervisor {
                 ? [...this.#host.allSlices()]
                 : [...this.#host.selectedSlices()]
             : [...request.payload.selector.slices];
-        return [...selected].sort();
+        // An empty all-down selector is an idle Fleet, not malformed caller input.
+        // Keep explicit empty/duplicate roots rejected by the dependency resolver.
+        if (request.payload.command === 'down' &&
+            request.payload.selector.all &&
+            selected.length === 0)
+            return [];
+        return (0, contracts_js_1.resolveFleetSliceOperation)(this.#adapters, request.payload.command, selected, this.#host.selectedSlices());
     }
     #syncSliceStates(results) {
         const byName = new Map(results.map((result) => [result.name, result]));
@@ -252,6 +262,8 @@ class FleetSupervisor {
             this.#shutdownAfterOperations.add(operation.id);
         }
         this.#persistState();
+        if (request.payload.command === 'down')
+            this.#host.interruptStartup?.(slices);
         this.#operationQueue = this.#operationQueue
             .then(() => this.#runOperation(operation.id))
             .finally(() => {
@@ -272,11 +284,13 @@ class FleetSupervisor {
         this.#state.operations[index] = { ...operation, state: 'running' };
         this.#persistState();
         try {
+            // Recheck at execution: queued operations may have changed dependency ownership.
+            const slices = (0, contracts_js_1.resolveFleetSliceOperation)(this.#adapters, operation.command, operation.slices, this.#host.selectedSlices());
             const results = operation.command === 'up'
-                ? await this.#host.up(operation.slices)
+                ? await this.#host.up(slices)
                 : operation.command === 'restart'
-                    ? await this.#host.restart(operation.slices)
-                    : await this.#host.down(operation.slices);
+                    ? await this.#host.restart(slices)
+                    : await this.#host.down(slices);
             this.#syncSliceStates(results);
             this.#syncLiveSliceStates();
             this.#state.operations[index] = {
@@ -290,7 +304,11 @@ class FleetSupervisor {
                 const timer = setTimeout(() => {
                     if (!this.#closed && !this.#stopping) {
                         this.#stopping = true;
-                        void this.stopGracefully();
+                        void this.stopGracefully().catch(() => {
+                            // Keep authenticated control available when terminal evidence
+                            // cannot be retired. Never turn an archival failure into exit.
+                            this.#stopping = false;
+                        });
                     }
                 }, this.#shutdownGraceMs);
                 timer.unref();
@@ -332,11 +350,16 @@ class FleetSupervisor {
             case 'submit':
                 return this.#queueOperation(request);
             case 'shutdown':
-                if (this.#host.selectedSlices().length > 0) {
-                    return supervisorError('operation-conflict', 'Fleet shutdown requires all selected Slices down first.');
+                if (this.#state.operations.some(({ state }) => state === 'accepted' || state === 'running')) {
+                    return supervisorError('operation-conflict', 'Fleet shutdown requires all accepted operations to finish first.');
                 }
+                this.#assertShutdownOwnership();
                 this.#stopping = true;
-                setImmediate(() => void this.stopGracefully());
+                setImmediate(() => {
+                    void this.stopGracefully().catch(() => {
+                        this.#stopping = false;
+                    });
+                });
                 return { accepted: true };
         }
     }
@@ -356,10 +379,17 @@ class FleetSupervisor {
             return;
         this.#stopping = true;
         await this.waitForIdle();
-        if (this.#host.selectedSlices().length > 0) {
-            return supervisorError('operation-conflict', 'Graceful supervisor shutdown requires every Slice down.');
+        try {
+            this.#assertShutdownOwnership();
+            await this.#host.closeProxyWhenEmpty();
+            (0, fleet_runner_evidence_js_1.retireFleetRunnerEvidence)(this.#state, this.#paths, {
+                security: this.#security,
+            });
+        }
+        catch (error) {
+            this.#stopping = false;
+            throw error;
         }
-        await this.#host.closeProxyWhenEmpty();
         if (this.#heartbeat)
             clearInterval(this.#heartbeat);
         this.#heartbeat = undefined;
@@ -374,11 +404,36 @@ class FleetSupervisor {
         removeExactPrivateFile(this.#paths.startup);
         removeExactPrivateFile(this.#paths.supervisorPid);
         removeExactPrivateFile(this.#paths.state);
+        // Retire only this empty session, never unknown files or a new owner.
+        // Leaving an empty directory makes inventory report a missing-authority
+        // session even though governed shutdown completed successfully.
+        try {
+            (0, node_fs_1.rmdirSync)(this.#paths.sessionDirectory);
+        }
+        catch (error) {
+            if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(error.code ?? '')) {
+                throw error;
+            }
+        }
         this.#closed = true;
         for (const resolvePromise of this.#closedWaiters.splice(0)) {
             resolvePromise();
         }
     }
+    #assertShutdownOwnership() {
+        this.#syncLiveSliceStates();
+        if (this.#host.selectedSlices().length > 0) {
+            return supervisorError('operation-conflict', 'Graceful supervisor shutdown requires every Slice down.');
+        }
+        if (this.#host
+            .sliceStates()
+            .some(({ cleanup, runnerGeneration }) => cleanup === 'failed' || (cleanup === 'pending' && runnerGeneration))) {
+            return supervisorError('operation-conflict', 'Fleet shutdown requires all owned runner cleanup to succeed first.');
+        }
+        (0, fleet_runner_evidence_js_1.retireFleetRunnerEvidence)(this.#state, this.#paths, {
+            security: this.#security,
+        });
+    }
 }
 exports.FleetSupervisor = FleetSupervisor;
 //# sourceMappingURL=fleet-supervisor.js.map

package/src/local-dev/fleet-web-start.d.ts

@@ -0,0 +1,12 @@
+import type { FleetSliceRunnerRequest } from './slice-runner.js';
+import { type PrivateStateSecurity } from './private-state.js';
+type WebStartOwner = Pick<FleetSliceRunnerRequest, 'fleetId' | 'runnerGeneration' | 'sessionGeneration' | 'slice' | 'port' | 'workspaceRealpath'>;
+export declare function fleetWebStartPath(requestPath: string): string;
+/** A private, generation-bound notification, never deployment authority or
+ * proof of application health. Only the native web-command wrapper publishes it.
+ * A duplicate for this generation is idempotent and cannot reset a health clock. */
+export declare function hasFleetWebStarted(requestPath: string, owner: WebStartOwner, security?: PrivateStateSecurity): boolean;
+export declare function publishFleetWebStarted(requestPath: string, owner: WebStartOwner, security?: PrivateStateSecurity): void;
+/** Called only after the native child group and declared cleanup have settled. */
+export declare function retireFleetWebStarted(requestPath: string, owner: WebStartOwner, security?: PrivateStateSecurity): void;
+export {};

package/src/local-dev/fleet-web-start.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fleetWebStartPath = fleetWebStartPath;
+exports.hasFleetWebStarted = hasFleetWebStarted;
+exports.publishFleetWebStarted = publishFleetWebStarted;
+exports.retireFleetWebStarted = retireFleetWebStarted;
+const node_fs_1 = require("node:fs");
+const contract_validation_js_1 = require("./contract-validation.js");
+const errors_js_1 = require("./errors.js");
+const private_state_js_1 = require("./private-state.js");
+function fleetWebStartPath(requestPath) {
+    if (!requestPath.endsWith('.request.json'))
+        throw new errors_js_1.LocalDevContractError('invalid-state', 'Invalid web-start owner path.');
+    return requestPath.replace(/\.request\.json$/, '.web-start.json');
+}
+function record(owner) {
+    return {
+        fleetId: owner.fleetId,
+        port: owner.port,
+        runnerGeneration: owner.runnerGeneration,
+        schemaVersion: 1,
+        sessionGeneration: owner.sessionGeneration,
+        slice: owner.slice,
+        workspaceRealpath: owner.workspaceRealpath,
+    };
+}
+/** A private, generation-bound notification, never deployment authority or
+ * proof of application health. Only the native web-command wrapper publishes it.
+ * A duplicate for this generation is idempotent and cannot reset a health clock. */
+function hasFleetWebStarted(requestPath, owner, security = {}) {
+    const path = fleetWebStartPath(requestPath);
+    if (!(0, node_fs_1.existsSync)(path))
+        return false;
+    const value = JSON.parse((0, private_state_js_1.readPrivateFile)(path, security).toString('utf8'));
+    if ((0, contract_validation_js_1.canonicalJson)(value) !== (0, contract_validation_js_1.canonicalJson)(record(owner)))
+        throw new errors_js_1.LocalDevContractError('invalid-state', 'Web-start notification does not match the exact Fleet runner generation.');
+    return true;
+}
+function publishFleetWebStarted(requestPath, owner, security = {}) {
+    (0, private_state_js_1.publishPrivateFileExclusive)(fleetWebStartPath(requestPath), `${(0, contract_validation_js_1.canonicalJson)(record(owner))}\n`, security);
+    hasFleetWebStarted(requestPath, owner, security);
+}
+/** Called only after the native child group and declared cleanup have settled. */
+function retireFleetWebStarted(requestPath, owner, security = {}) {
+    if (hasFleetWebStarted(requestPath, owner, security))
+        (0, node_fs_1.unlinkSync)(fleetWebStartPath(requestPath));
+}
+//# sourceMappingURL=fleet-web-start.js.map

package/src/local-dev/identity.js

@@ -6,9 +6,7 @@ exports.normalizeFleetHostSuffix = normalizeFleetHostSuffix;
 exports.createFleetHostname = createFleetHostname;
 exports.isLoopbackAddress = isLoopbackAddress;
 exports.resolveFleetHostname = resolveFleetHostname;
-const node_crypto_1 = require("node:crypto");
 const node_dns_1 = require("node:dns");
-const node_fs_1 = require("node:fs");
 const personal_stage_js_1 = require("./personal-stage.js");
 const dnsLabelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 function label(value) {
@@ -30,18 +28,9 @@ function createFleetId(options) {
     const workspace = label(options.workspaceName);
     if (!workspace)
         throw new Error('Workspace name cannot form a DNS label.');
-    let checkout;
-    try {
-        checkout = (0, node_fs_1.realpathSync)(options.checkoutPath);
-    }
-    catch {
-        checkout = options.checkoutPath;
-    }
-    const digest = (0, node_crypto_1.createHash)('sha256')
-        .update(`${checkout}\0${workspace}\0${stage}`)
-        .digest('hex')
-        .slice(0, 10);
-    const suffix = `-${stage}-${digest}`;
+    // The random task stage owns identity; checkout paths are ownership bindings,
+    // not identity entropy. Explicit reattachment must preserve the origin.
+    const suffix = `-${stage}`;
     const available = 63 - suffix.length;
     const prefix = workspace.slice(0, Math.max(1, available)).replace(/-+$/g, '');
     const result = `${prefix}${suffix}`;

package/src/local-dev/index.d.ts

@@ -1,4 +1,5 @@
 export * from './contracts.js';
+export * from './browser-verification.js';
 export * from './gateway.js';
 export * from './identity.js';
 export * from './personal-secret-ledger.js';

package/src/local-dev/index.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./contracts.js"), exports);
+tslib_1.__exportStar(require("./browser-verification.js"), exports);
 tslib_1.__exportStar(require("./gateway.js"), exports);
 tslib_1.__exportStar(require("./identity.js"), exports);
 tslib_1.__exportStar(require("./personal-secret-ledger.js"), exports);

package/src/local-dev/native-completion.d.ts

@@ -0,0 +1,9 @@
+export type NativeDevelopmentCompletion = 'pending' | 'succeeded' | 'failed';
+/** Read only SST 4.17.1's current native completion. Never retain its body:
+ * links, outputs and resources can contain private application material.
+ * This observes deployment, not preview/state authority or application health. */
+export declare function readNativeDevelopmentCompletion(input: {
+    projectRoot: string;
+    stage: string;
+    startedAt: string;
+}, signal: AbortSignal): Promise<NativeDevelopmentCompletion>;