@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/local-dev/task-native-writer.js

@@ -0,0 +1,329 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertTaskNativeWritersAbsent = assertTaskNativeWritersAbsent;
+exports.acquireTaskNativeWriterLease = acquireTaskNativeWriterLease;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const contract_validation_js_1 = require("./contract-validation.js");
+const errors_js_1 = require("./errors.js");
+const fleet_lock_js_1 = require("./fleet-lock.js");
+const fleet_state_js_1 = require("./fleet-state.js");
+const fleet_web_start_js_1 = require("./fleet-web-start.js");
+const identity_js_1 = require("./identity.js");
+const process_group_js_1 = require("./process-group.js");
+const process_identity_js_1 = require("./process-identity.js");
+const private_state_js_1 = require("./private-state.js");
+const runtime_paths_js_1 = require("./runtime-paths.js");
+const slice_runner_js_1 = require("./slice-runner.js");
+const task_identity_js_1 = require("./task-identity.js");
+function refuse() {
+    throw new errors_js_1.LocalDevContractError('fleet-ownership-ambiguous', 'Task native writer ownership or process absence is not proved; retain recovery evidence and stop the exact writer first.');
+}
+function taskPaths(context, effects) {
+    const task = (0, task_identity_js_1.resolveTaskIdentity)(context.root), root = (0, node_fs_1.realpathSync)(context.root);
+    const names = Object.entries(context.projectsConfigurations?.projects ?? {})
+        .filter(([, project]) => project.tags?.includes('scope:workspace'))
+        .map(([name]) => name);
+    if (names.length !== 1)
+        refuse();
+    return (0, runtime_paths_js_1.fleetRuntimePaths)((0, identity_js_1.createFleetId)({
+        checkoutPath: root,
+        stage: (0, task_identity_js_1.taskStage)(task.taskId),
+        workspaceName: names[0],
+    }), effects.appData);
+}
+function assertGroupAbsent(pid, effects) {
+    if ((effects.groupExists ?? process_group_js_1.exactOwnedProcessGroupExists)(pid))
+        refuse();
+}
+function joinedGroupOwner(context, childPid, effects) {
+    if (process.platform === 'win32')
+        refuse();
+    const pid = Number((0, node_child_process_1.execFileSync)('ps', ['-o', 'pgid=', '-p', String(childPid)], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 3000,
+    }).trim());
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        refuse();
+    const paths = taskPaths(context, effects), state = (0, fleet_state_js_1.readFleetState)(paths.sessionDirectory, effects.security);
+    if (!state || !(0, node_fs_1.existsSync)(paths.runnersDirectory))
+        refuse();
+    const candidates = (0, node_fs_1.readdirSync)(paths.runnersDirectory)
+        .filter((name) => name.endsWith('.state.json'))
+        .map((name) => (0, slice_runner_js_1.readFleetSliceRunnerState)((0, node_path_1.join)(paths.runnersDirectory, name), effects.security))
+        .filter((runner) => runner.fleetId === state.fleetId &&
+        runner.sessionGeneration === state.sessionGeneration &&
+        runner.slice === context.projectName &&
+        runner.child?.pid === pid);
+    if (candidates.length !== 1 ||
+        !candidates[0].child ||
+        (effects.processProbe ?? process_identity_js_1.probeProcessIdentity)(candidates[0].child) !==
+            'matching')
+        refuse();
+    return candidates[0].child;
+}
+/** Read-only legacy/current runner proof; cleanup need not have succeeded to unlock. */
+function assertTaskNativeWritersAbsent(context, effects = {}) {
+    const task = (0, task_identity_js_1.resolveTaskIdentity)(context.root), root = (0, node_fs_1.realpathSync)(context.root);
+    const paths = taskPaths(context, effects);
+    const security = effects.security ?? {}, probe = effects.processProbe ?? process_identity_js_1.probeProcessIdentity;
+    if (!(0, node_fs_1.existsSync)(paths.sessionDirectory))
+        return;
+    (0, private_state_js_1.assertPrivatePath)(paths.sessionDirectory, 'directory', security);
+    const knownEntries = new Set(Object.values(paths)
+        .filter((path) => (0, node_path_1.dirname)(path) === paths.sessionDirectory)
+        .map((path) => (0, node_path_1.basename)(path)));
+    if ((0, node_fs_1.readdirSync)(paths.sessionDirectory).some((name) => !knownEntries.has(name)))
+        refuse();
+    const state = (0, fleet_state_js_1.readFleetState)(paths.sessionDirectory, security);
+    if (!state) {
+        if ((0, node_fs_1.readdirSync)(paths.sessionDirectory).length)
+            refuse();
+        return;
+    }
+    const lock = (0, fleet_lock_js_1.inspectFleetLock)(paths.lock, security);
+    if (!lock ||
+        state.fleetId !== lock.fleetId ||
+        state.sessionGeneration !== lock.sessionGeneration ||
+        state.workspaceRealpath !== root ||
+        state.resolvedStage !== (0, task_identity_js_1.taskStage)(task.taskId) ||
+        JSON.stringify(state.supervisor) !== JSON.stringify(lock.owner))
+        refuse();
+    if (probe(state.supervisor) === 'ambiguous' ||
+        state.operations.some((o) => o.state === 'accepted' || o.state === 'running'))
+        refuse();
+    const seen = new Set();
+    if ((0, node_fs_1.existsSync)(paths.runnersDirectory))
+        (0, private_state_js_1.assertPrivatePath)(paths.runnersDirectory, 'directory', security);
+    for (const name of (0, node_fs_1.existsSync)(paths.runnersDirectory)
+        ? (0, node_fs_1.readdirSync)(paths.runnersDirectory)
+        : []) {
+        if (!/^[a-z0-9][a-z0-9-]{0,62}-[a-f0-9]{20}\.(state|request|restart|web-start)\.json$/.test(name))
+            refuse();
+        const file = (0, node_path_1.join)(paths.runnersDirectory, name.replace(/\.(request|restart|web-start)\.json$/, '.state.json'));
+        const runner = (0, slice_runner_js_1.readFleetSliceRunnerState)(file, security);
+        if (runner.fleetId !== state.fleetId ||
+            runner.sessionGeneration !== state.sessionGeneration ||
+            !state.slices.some((s) => s.name === runner.slice) ||
+            (0, slice_runner_js_1.fleetSliceRunnerPaths)(paths.runnersDirectory, runner.slice, runner.runnerGeneration).state !== file)
+            refuse();
+        if (probe(runner.runner) !== 'absent' ||
+            (runner.child && probe(runner.child) !== 'absent'))
+            refuse();
+        // Windows records no owned POSIX group for a runner child; its identity
+        // absence above is the proof there, as when the child was recorded.
+        if (runner.child && process.platform !== 'win32')
+            assertGroupAbsent(runner.child.pid, effects);
+        if (!name.endsWith('.state.json')) {
+            const requestPath = file.replace(/\.state\.json$/, '.request.json');
+            const request = (0, slice_runner_js_1.readFleetSliceRunnerRequest)(requestPath, security);
+            if (request.fleetId !== runner.fleetId ||
+                request.sessionGeneration !== runner.sessionGeneration ||
+                request.runnerGeneration !== runner.runnerGeneration ||
+                request.slice !== runner.slice ||
+                request.workspaceRealpath !== root ||
+                request.startupPath !== paths.startup ||
+                request.heartbeatPath !== paths.heartbeat ||
+                JSON.stringify(request.parent) !== JSON.stringify(state.supervisor))
+                refuse();
+            if (name.endsWith('.restart.json')) {
+                const restart = (0, slice_runner_js_1.validateFleetSliceRunnerRestartRequest)(JSON.parse((0, private_state_js_1.readPrivateFile)((0, node_path_1.join)(paths.runnersDirectory, name), security).toString('utf8')));
+                if (restart.fleetId !== request.fleetId ||
+                    restart.sessionGeneration !== request.sessionGeneration ||
+                    restart.runnerGeneration !== request.runnerGeneration ||
+                    restart.slice !== request.slice)
+                    refuse();
+            }
+            if (name.endsWith('.web-start.json') &&
+                !(0, fleet_web_start_js_1.hasFleetWebStarted)(requestPath, request, security))
+                refuse();
+        }
+        seen.add(runner.slice);
+    }
+    if (state.slices.some((s) => s.selected && !seen.has(s.name)))
+        refuse();
+}
+/** One native invocation per exact worktree/task/Slice, never a global task lock. */
+function acquireTaskNativeWriterLease(context, taskId, unlock, effects = {}) {
+    const root = (0, node_fs_1.realpathSync)(context.root), task = (0, task_identity_js_1.resolveTaskIdentity)(root), project = context.projectName;
+    if (task.taskId !== taskId ||
+        !project ||
+        !/^[a-z][a-z0-9-]{0,62}$/.test(project))
+        refuse();
+    const security = effects.security ?? {}, probe = effects.processProbe ?? process_identity_js_1.probeProcessIdentity;
+    const directory = (0, node_path_1.join)((0, node_path_1.dirname)((0, task_identity_js_1.taskIdentityPath)(root)), 'native-writers', taskId);
+    const gateFile = (0, node_path_1.join)((0, node_path_1.dirname)(directory), `${taskId}.gate.json`);
+    const file = (0, node_path_1.join)(directory, `${project}.json`), childFile = (0, node_path_1.join)(directory, `${project}.child.json`);
+    const groupFile = (0, node_path_1.join)(directory, `${project}.group.json`);
+    const binding = (0, contract_validation_js_1.sha256Digest)({ root, taskId, project });
+    const fleetId = `task-${taskId}`;
+    const validate = (record) => {
+        if (record.fleetId !== fleetId || record.sessionGeneration !== binding)
+            refuse();
+    };
+    const retire = (location, record) => {
+        if ((0, fleet_lock_js_1.classifyFleetLock)(record, { processProbe: probe(record.owner) }) !==
+            'stale')
+            refuse();
+        const bytes = (0, private_state_js_1.readPrivateFile)(location, security);
+        if (!(0, private_state_js_1.publishPrivateFileExclusive)((0, node_path_1.join)((0, node_path_1.dirname)(directory), 'retired-writers', `${taskId}-${project}-${(0, node_crypto_1.randomUUID)()}.json`), bytes, security))
+            refuse();
+        (0, fleet_lock_js_1.releaseFleetLock)(location, record, security);
+    };
+    const gateBinding = (0, contract_validation_js_1.sha256Digest)({ root, taskId });
+    const existingGate = (0, fleet_lock_js_1.inspectFleetLock)(gateFile, security);
+    if (existingGate) {
+        if (!unlock ||
+            existingGate.fleetId !== fleetId ||
+            existingGate.sessionGeneration !== gateBinding)
+            refuse();
+        retire(gateFile, existingGate);
+    }
+    const gate = (0, fleet_lock_js_1.acquireFleetLock)(gateFile, {
+        fleetId,
+        owner: (0, process_identity_js_1.captureProcessIdentity)(),
+        sessionGeneration: gateBinding,
+    }, security);
+    if (gate.kind !== 'acquired')
+        refuse();
+    let gateHeld = true;
+    const releaseGate = () => {
+        if (gateHeld) {
+            (0, fleet_lock_js_1.releaseFleetLock)(gateFile, gate.record, security);
+            gateHeld = false;
+        }
+    };
+    try {
+        if (unlock) {
+            assertTaskNativeWritersAbsent(context, effects);
+            // Any other native task writer, including a direct Nx invocation without
+            // Fleet records, prevents recovery. Never infer absence from PID alone.
+            for (const entry of (0, node_fs_1.existsSync)(directory) ? (0, node_fs_1.readdirSync)(directory) : []) {
+                if (!/^[a-z][a-z0-9-]{0,62}(?:\.(?:child|group))?\.json$/.test(entry))
+                    refuse();
+                const record = (0, fleet_lock_js_1.inspectFleetLock)((0, node_path_1.join)(directory, entry), security);
+                const entryProject = entry.replace(/(?:\.(?:child|group))?\.json$/, '');
+                if (!record ||
+                    record.fleetId !== fleetId ||
+                    record.sessionGeneration !==
+                        (0, contract_validation_js_1.sha256Digest)({ root, taskId, project: entryProject }) ||
+                    (0, fleet_lock_js_1.classifyFleetLock)(record, { processProbe: probe(record.owner) }) !==
+                        'stale')
+                    refuse();
+                // Windows has no owned POSIX group: retained group or child records
+                // are a refusal there, never a crash on the absence probe.
+                if (process.platform === 'win32' &&
+                    (entry.endsWith('.group.json') || entry.endsWith('.child.json')))
+                    refuse();
+                if (entry.endsWith('.group.json'))
+                    assertGroupAbsent(record.owner.pid, effects);
+                if (entry.endsWith('.child.json') &&
+                    !(0, fleet_lock_js_1.inspectFleetLock)((0, node_path_1.join)(directory, `${entryProject}.group.json`), security))
+                    refuse();
+            }
+        }
+        const existing = (0, fleet_lock_js_1.inspectFleetLock)(file, security), existingChild = (0, fleet_lock_js_1.inspectFleetLock)(childFile, security);
+        const existingGroup = (0, fleet_lock_js_1.inspectFleetLock)(groupFile, security);
+        if (existing || existingChild || existingGroup) {
+            if (!unlock) {
+                // The executor may exit before its signal-cleanup callback settles the
+                // receipt. A later invocation can settle only a complete, exact POSIX
+                // writer/child/group trio whose former processes and group are absent.
+                // This task gate excludes another acquisition during inspection and
+                // archival. It never unlocks native state or retires another Slice.
+                if (process.platform === 'win32' ||
+                    !existing ||
+                    !existingChild ||
+                    !existingGroup)
+                    refuse();
+                // Validate the entire trio before archiving any member. Partial,
+                // malformed, live, or ambiguous evidence remains a recovery refusal.
+                for (const record of [existing, existingChild, existingGroup]) {
+                    validate(record);
+                    if (probe(record.owner) !== 'absent')
+                        refuse();
+                }
+                assertGroupAbsent(existingGroup.owner.pid, effects);
+            }
+            for (const [location, record] of [
+                [file, existing],
+                [childFile, existingChild],
+                [groupFile, existingGroup],
+            ]) {
+                if (!record)
+                    continue;
+                validate(record);
+                retire(location, record);
+            }
+        }
+        const acquired = (0, fleet_lock_js_1.acquireFleetLock)(file, { fleetId, owner: (0, process_identity_js_1.captureProcessIdentity)(), sessionGeneration: binding }, security);
+        if (acquired.kind !== 'acquired')
+            refuse();
+        if (!unlock)
+            releaseGate();
+        let childRecord;
+        let groupRecord, childOwnsGroup = false;
+        const assertOwnership = () => {
+            if ((0, task_identity_js_1.resolveTaskIdentity)(root).taskId !== taskId)
+                refuse();
+            const current = (0, fleet_lock_js_1.inspectFleetLock)(file, security);
+            if (JSON.stringify(current) !== JSON.stringify(acquired.record))
+                refuse();
+            if (unlock &&
+                JSON.stringify((0, fleet_lock_js_1.inspectFleetLock)(gateFile, security)) !==
+                    JSON.stringify(gate.record))
+                refuse();
+        };
+        const assertCurrent = () => {
+            assertOwnership();
+            if (unlock)
+                assertTaskNativeWritersAbsent(context, effects);
+        };
+        return {
+            assertCurrent,
+            recordChild(pid, ownsProcessGroup = true) {
+                assertOwnership();
+                const result = (0, fleet_lock_js_1.acquireFleetLock)(childFile, {
+                    fleetId,
+                    owner: (0, process_identity_js_1.captureProcessIdentity)(pid),
+                    sessionGeneration: binding,
+                }, security);
+                if (result.kind !== 'acquired')
+                    refuse();
+                childRecord = result.record;
+                if (process.platform !== 'win32') {
+                    const owner = ownsProcessGroup
+                        ? childRecord.owner
+                        : joinedGroupOwner(context, pid, effects);
+                    const group = (0, fleet_lock_js_1.acquireFleetLock)(groupFile, { fleetId, owner, sessionGeneration: binding }, security);
+                    if (group.kind !== 'acquired')
+                        refuse();
+                    groupRecord = group.record;
+                    childOwnsGroup = ownsProcessGroup;
+                }
+            },
+            release() {
+                assertOwnership();
+                if (childRecord) {
+                    if (probe(childRecord.owner) !== 'absent')
+                        refuse();
+                    if (groupRecord && childOwnsGroup)
+                        assertGroupAbsent(groupRecord.owner.pid, effects);
+                    if (groupRecord)
+                        (0, fleet_lock_js_1.releaseFleetLock)(groupFile, groupRecord, security);
+                    (0, fleet_lock_js_1.releaseFleetLock)(childFile, childRecord, security);
+                }
+                (0, fleet_lock_js_1.releaseFleetLock)(file, acquired.record, security);
+                releaseGate();
+            },
+        };
+    }
+    catch (error) {
+        releaseGate();
+        throw error;
+    }
+}
+//# sourceMappingURL=task-native-writer.js.map

package/src/local-dev/tls.js

@@ -141,6 +141,10 @@ if ($unsafeRules.Count -ne 0 -or $selfRules.Count -eq 0) {
   throw 'ACL grants access beyond the current user or omits the current user.'
 }
 `;
+// Hosted Windows and freshly started developer sessions can spend more than
+// 15 seconds loading Windows PowerShell before the bounded ACL script runs.
+// Keep a finite host-tool budget while allowing one cold startup to complete.
+const WINDOWS_POWERSHELL_TIMEOUT_MS = 45_000;
 function windowsPowerShell(script, environment) {
     const executable = (0, node_path_1.join)(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
     const encodedCommand = Buffer.from(script, 'utf16le').toString('base64');
@@ -153,7 +157,7 @@ function windowsPowerShell(script, environment) {
     ], {
         env: { ...process.env, ...environment },
         stdio: 'pipe',
-        timeout: 15_000,
+        timeout: WINDOWS_POWERSHELL_TIMEOUT_MS,
         windowsHide: true,
     });
 }
@@ -196,7 +200,9 @@ function createLocalTlsState(options) {
     hardenPrivatePath(paths.appData, 'directory');
     const intermediateExt = (0, node_path_1.join)(paths.appData, 'intermediate.ext');
     const leafExt = (0, node_path_1.join)(paths.appData, 'leaf.ext');
-    (0, node_fs_1.writeFileSync)(intermediateExt, `basicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign\nnameConstraints=critical,permitted;DNS:.${hostSuffix},permitted;DNS:*.${hostSuffix},excluded;IP:0.0.0.0/0.0.0.0,excluded;IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid,issuer\n`, { mode: 0o600 });
+    // The leading-dot DNS subtree admits wildcard leaf hosts; spelling a
+    // wildcard in the CA constraint itself is rejected by macOS LibreSSL.
+    (0, node_fs_1.writeFileSync)(intermediateExt, `basicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign\nnameConstraints=critical,permitted;DNS:.${hostSuffix},excluded;IP:0.0.0.0/0.0.0.0,excluded;IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid,issuer\n`, { mode: 0o600 });
     (0, node_fs_1.writeFileSync)(leafExt, `basicConstraints=critical,CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:*.${hostSuffix}\nauthorityKeyIdentifier=keyid,issuer\n`, { mode: 0o600 });
     try {
         openssl(['genrsa', '-out', paths.rootKey, '3072'], paths.appData);

package/src/local-dev/web-launch.d.ts

@@ -0,0 +1,9 @@
+import { spawn } from 'node:child_process';
+/** @internal The native web-start command is not proof of fresh deployment:
+ * SST can start it using retained dev outputs while reconciling infrastructure. */
+export declare function runNativeWebCommand(slice: string, options?: {
+    cwd?: string;
+    environment?: NodeJS.ProcessEnv;
+    spawnChild?: typeof spawn;
+    resolveNext?: (cwd: string) => string;
+}): Promise<number>;

package/src/local-dev/web-launch.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runNativeWebCommand = runNativeWebCommand;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_module_1 = require("node:module");
+const node_path_1 = require("node:path");
+const errors_js_1 = require("./errors.js");
+const fleet_web_start_js_1 = require("./fleet-web-start.js");
+const fleet_startup_js_1 = require("./fleet-startup.js");
+const slice_runner_js_1 = require("./slice-runner.js");
+const process_identity_js_1 = require("./process-identity.js");
+const runtime_paths_js_1 = require("./runtime-paths.js");
+/** @internal The native web-start command is not proof of fresh deployment:
+ * SST can start it using retained dev outputs while reconciling infrastructure. */
+async function runNativeWebCommand(slice, options = {}) {
+    const cwd = (0, node_fs_1.realpathSync)(options.cwd ?? process.cwd());
+    const environment = { ...(options.environment ?? process.env) };
+    const port = Number(environment.EBK_DEV_PORT ?? '3000');
+    if (!Number.isInteger(port) || port < 1 || port > 65_535)
+        throw new errors_js_1.LocalDevContractError('invalid-input', 'Native web development port is invalid.');
+    const requestPath = environment.EBK_FLEET_SLICE_RUNNER_REQUEST;
+    if (environment.EBK_FLEET_ORIGIN && !requestPath)
+        throw new errors_js_1.LocalDevContractError('invalid-state', 'Fleet web launch is missing its owned runner request.');
+    if (requestPath) {
+        const request = (0, slice_runner_js_1.readFleetSliceRunnerRequest)(requestPath);
+        const startup = (0, fleet_startup_js_1.readFleetStartupRequest)(request.startupPath);
+        const runtimePaths = (0, runtime_paths_js_1.fleetRuntimePaths)(startup.fleetId, startup.appData);
+        const paths = (0, slice_runner_js_1.fleetSliceRunnerPaths)(runtimePaths.runnersDirectory, request.slice, request.runnerGeneration);
+        const state = (0, slice_runner_js_1.readFleetSliceRunnerState)(paths.state);
+        if (paths.request !== requestPath ||
+            request.slice !== slice ||
+            request.port !== port ||
+            request.startupPath !== runtimePaths.startup ||
+            request.heartbeatPath !== runtimePaths.heartbeat ||
+            cwd !==
+                (0, node_fs_1.realpathSync)((0, node_path_1.join)(request.workspaceRealpath, 'packages', slice)) ||
+            startup.workspaceRealpath !== request.workspaceRealpath ||
+            startup.fleetId !== request.fleetId ||
+            startup.sessionGeneration !== request.sessionGeneration ||
+            startup.identity.stage !== environment.EBK_CONSUMER_STAGE ||
+            startup.identity.stage !== environment.EBK_STAGE ||
+            request.origin !== environment.EBK_FLEET_ORIGIN ||
+            state.fleetId !== request.fleetId ||
+            state.slice !== slice ||
+            state.runnerGeneration !== request.runnerGeneration ||
+            state.sessionGeneration !== request.sessionGeneration ||
+            state.cleanup !== 'pending' ||
+            (0, process_identity_js_1.probeProcessIdentity)(request.parent) !== 'matching' ||
+            (0, process_identity_js_1.probeProcessIdentity)(state.runner) !== 'matching' ||
+            !state.child ||
+            (0, process_identity_js_1.probeProcessIdentity)(state.child) !== 'matching')
+            throw new errors_js_1.LocalDevContractError('invalid-state', 'Native web launch does not match the active task, workspace, port and runner generation.');
+        // SST EnvFor owns assuming the linked dev-server role. Do not silently
+        // start with its infrastructure profile if that native handoff failed.
+        // No credential value or private profile path belongs in the diagnostic.
+        if (!environment.AWS_ACCESS_KEY_ID ||
+            !environment.AWS_SECRET_ACCESS_KEY ||
+            !environment.AWS_SESSION_TOKEN ||
+            environment.AWS_REGION !== startup.context.region)
+            throw new errors_js_1.LocalDevContractError('prerequisite-unavailable', `Native SST runtime credentials are unavailable for ${slice} web development. Inspect ebk dev logs ${slice} for the native AssumeRole failure, reconcile the generated development stage authority, then run ebk dev restart ${slice}. No web process was started.`);
+        // The Node SDK selects AWS_PROFILE ahead of environment credentials.
+        // SST's runtime session must be the only credential source handed to Next;
+        // deployment profile files and alternative providers stay with the parent.
+        const deploymentCredentialSelectors = new Set([
+            'AWS_PROFILE',
+            'AWS_DEFAULT_PROFILE',
+            'AWS_CONFIG_FILE',
+            'AWS_SHARED_CREDENTIALS_FILE',
+            'AWS_SDK_LOAD_CONFIG',
+            'AWS_ROLE_ARN',
+            'AWS_ROLE_SESSION_NAME',
+            'AWS_WEB_IDENTITY_TOKEN_FILE',
+            'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+            'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
+            'AWS_CONTAINER_AUTHORIZATION_TOKEN',
+            'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE',
+        ]);
+        for (const key of Object.keys(environment))
+            if (deploymentCredentialSelectors.has(key.toUpperCase()))
+                delete environment[key];
+        environment.AWS_EC2_METADATA_DISABLED = 'true';
+        (0, fleet_web_start_js_1.publishFleetWebStarted)(requestPath, request);
+    }
+    // Private coordination never becomes Next application configuration.
+    delete environment.EBK_FLEET_SLICE_RUNNER_REQUEST;
+    const next = (options.resolveNext ??
+        ((root) => (0, node_module_1.createRequire)((0, node_path_1.join)(root, 'package.json')).resolve('next/dist/bin/next')))(cwd);
+    return new Promise((resolve, reject) => {
+        // The generated Slice's Webpack extension aliases resolve its shared
+        // Node-ESM TypeScript modules; pinned Next's Turbopack does not.
+        const child = (options.spawnChild ?? node_child_process_1.spawn)(process.execPath, [
+            next,
+            'dev',
+            '--webpack',
+            'web',
+            '--hostname',
+            '127.0.0.1',
+            '--port',
+            String(port),
+        ], {
+            cwd,
+            env: environment,
+            shell: false,
+            stdio: 'inherit',
+            windowsHide: true,
+        });
+        const interrupt = (signal) => {
+            if (child.exitCode === null && child.signalCode === null)
+                child.kill(signal);
+        };
+        const sigint = () => interrupt('SIGINT');
+        const sigterm = () => interrupt('SIGTERM');
+        process.on('SIGINT', sigint);
+        process.on('SIGTERM', sigterm);
+        const dispose = () => {
+            process.removeListener('SIGINT', sigint);
+            process.removeListener('SIGTERM', sigterm);
+        };
+        child.once('error', (error) => {
+            dispose();
+            reject(error);
+        });
+        child.once('close', (code, signal) => {
+            dispose();
+            resolve(signal ? 1 : (code ?? 1));
+        });
+    });
+}
+//# sourceMappingURL=web-launch.js.map

package/src/ownership/composition.d.ts

@@ -1,5 +1,5 @@
 import type { Tree } from '@nx/devkit';
-import { type GeneratedCompositionOwnership, type GeneratedPathMode } from './record.js';
+import { type GeneratedCompositionOwnership, type GeneratedPathMode, type GeneratedOwnershipRecord } from './record.js';
 export interface CompositionOwnedPath {
     managedJsonPointers?: string[];
     mode?: GeneratedPathMode;
@@ -7,6 +7,7 @@ export interface CompositionOwnedPath {
 }
 export interface RecordCompositionOwnershipOptions {
     compositions: GeneratedCompositionOwnership[];
+    foundation?: GeneratedOwnershipRecord['foundation'];
     paths: CompositionOwnedPath[];
     projects?: string[];
     slice: string;

package/src/ownership/composition.js

@@ -131,6 +131,7 @@ function recordCompositionOwnership(tree, options) {
     }
     const ownership = {
         ...result.value,
+        ...(options.foundation ? { foundation: options.foundation } : {}),
         compositions: [...compositions.values()].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.kind}\0${left.name}`, `${right.kind}\0${right.name}`)),
         paths: [...paths.values()].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path)),
         projects: [

package/src/performance/cost-collection.d.ts

@@ -23,7 +23,7 @@ export interface AwsBillingEnvironmentV1 {
     accountFingerprint: string;
     region: string;
     slice: string;
-    stage: 'production' | 'staging';
+    stage: 'development' | 'production' | 'staging';
     workspace: string;
 }
 export interface AwsBillingPeriodV1 {

package/src/performance/cost-collection.js

@@ -113,8 +113,10 @@ function exactEnvironment(value, pointer) {
     }
     requiredReference(value.slice, `${pointer}/slice`);
     requiredReference(value.workspace, `${pointer}/workspace`);
-    if (value.stage !== 'production' && value.stage !== 'staging') {
-        throw invalid(`${pointer}/stage`, 'must be production or staging');
+    if (value.stage !== 'development' &&
+        value.stage !== 'production' &&
+        value.stage !== 'staging') {
+        throw invalid(`${pointer}/stage`, 'must be development, production, or staging');
     }
     return value;
 }

package/src/performance/cost-controls.d.ts

@@ -28,7 +28,7 @@ export interface PerformanceCostBudgetPlanV1 {
                 tags: {
                     key: 'user:ebk:stage';
                     matchOptions: readonly ['EQUALS'];
-                    values: readonly ['staging'];
+                    values: readonly ['development' | 'staging'];
                 };
             }
         ];
@@ -45,9 +45,10 @@ export interface PerformanceCostBudgetPlanV1 {
 }
 export interface PerformanceCostAnomalyPlanV1 {
     monitor: {
-        monitorSpecification: string;
-        monitorType: 'CUSTOM';
-        name: string;
+        dimension: 'SERVICE';
+        monitorType: 'DIMENSIONAL';
+        owner: 'foundation';
+        scope: 'production-account';
     };
     subscription: {
         frequency: 'IMMEDIATE';
@@ -92,6 +93,7 @@ export interface FoundationAccountCostPolicyV1 {
     workspace: string;
 }
 export interface FoundationAccountCostControlPlanV1 {
+    anomaly: PerformanceCostAnomalyPlanV1 | null;
     authority: FoundationAccountCostAuthorityV1;
     budget: PerformanceCostBudgetPlanV1 | null;
     kind: 'ebk-foundation-account-cost-control-plan';
@@ -117,6 +119,7 @@ export declare function requireExactFoundationAccountCostAuthority(input: {
 export declare function createFoundationAccountCostControlPlan(input: {
     evaluatedAt: string;
     policy: unknown;
+    rehearsalStage?: 'development' | 'staging';
     region?: string;
     stage: string;
     workspace: string;
@@ -125,6 +128,7 @@ export declare function createPerformanceCostControlPlan(input: {
     accountBudgetAuthority: unknown;
     evaluatedAt: string;
     policy: unknown;
+    rehearsalStage?: 'development' | 'staging';
     region?: string;
     stage: string;
     workspace: string;