@empire-builder-kit/nx 1.0.0-beta.4

package/src/local-dev/tls.js

@@ -0,0 +1,294 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultLocalDevAppData = defaultLocalDevAppData;
+exports.localTlsPaths = localTlsPaths;
+exports.createLocalIpcPath = createLocalIpcPath;
+exports.assertPrivateKeyPermissions = assertPrivateKeyPermissions;
+exports.createLocalTlsState = createLocalTlsState;
+exports.removeLocalTlsState = removeLocalTlsState;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const identity_js_1 = require("./identity.js");
+function defaultLocalDevAppData(environment = process.env) {
+    if ((0, node_os_1.platform)() === 'win32') {
+        const base = environment.LOCALAPPDATA;
+        if (!base)
+            throw new Error('LOCALAPPDATA is required for EBK machine state.');
+        return (0, node_path_1.join)(base, 'Empire Builder Kit');
+    }
+    if ((0, node_os_1.platform)() === 'darwin') {
+        return (0, node_path_1.join)((0, node_os_1.homedir)(), 'Library', 'Application Support', 'Empire Builder Kit');
+    }
+    return (0, node_path_1.join)(environment.XDG_DATA_HOME ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.local', 'share'), 'empire-builder-kit');
+}
+function localTlsPaths(appData = defaultLocalDevAppData()) {
+    return {
+        appData,
+        capability: (0, node_path_1.join)(appData, 'gateway.capability'),
+        intermediateCertificate: (0, node_path_1.join)(appData, 'intermediate.pem'),
+        intermediateKey: (0, node_path_1.join)(appData, 'intermediate-key.pem'),
+        leafCertificate: (0, node_path_1.join)(appData, 'leaf.pem'),
+        leafKey: (0, node_path_1.join)(appData, 'leaf-key.pem'),
+        rootCertificate: (0, node_path_1.join)(appData, 'root.pem'),
+        rootKey: (0, node_path_1.join)(appData, 'root-key.pem'),
+        gatewayPid: (0, node_path_1.join)(appData, 'gateway.pid'),
+        gatewayState: (0, node_path_1.join)(appData, 'gateway.json'),
+        gatewaySocket: createLocalIpcPath(appData, 'gateway-v1'),
+    };
+}
+function createLocalIpcPath(base, identity) {
+    const digest = (0, node_crypto_1.createHash)('sha256')
+        .update(`${base}\0${identity}`)
+        .digest('hex')
+        .slice(0, 16);
+    if ((0, node_os_1.platform)() === 'win32') {
+        return `\\\\.\\pipe\\ebk-${identity.replace(/[^a-zA-Z0-9-]/g, '-').slice(0, 24)}-${digest}`;
+    }
+    let directory = base;
+    while (true) {
+        const candidate = (0, node_path_1.join)(directory, `.ebk-${identity}-${digest}.sock`);
+        // Darwin's sockaddr_un path is 104 bytes including the terminator. Keep
+        // margin for UTF-8 paths and other Unix implementations.
+        if (Buffer.byteLength(candidate) <= 95 &&
+            ((0, node_fs_1.existsSync)(directory) || directory === base)) {
+            return candidate;
+        }
+        const parent = (0, node_path_1.dirname)(directory);
+        if (parent === directory) {
+            throw new Error('Unable to derive a portable local IPC socket path.');
+        }
+        directory = parent;
+    }
+}
+function openssl(args, cwd) {
+    (0, node_child_process_1.execFileSync)('openssl', args, { cwd, stdio: 'pipe' });
+}
+const WINDOWS_HARDEN_ACL = String.raw `
+$ErrorActionPreference = 'Stop'
+$path = $env:EBK_PRIVATE_PATH
+$kind = $env:EBK_PRIVATE_KIND
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+if ($kind -eq 'directory') {
+  $info = [System.IO.DirectoryInfo]::new($path)
+} else {
+  $info = [System.IO.FileInfo]::new($path)
+}
+$acl = $info.GetAccessControl()
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($rule in @($acl.Access)) {
+  [void]$acl.RemoveAccessRuleSpecific($rule)
+}
+if ($kind -eq 'directory') {
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+    $identity.User,
+    [System.Security.AccessControl.FileSystemRights]::FullControl,
+    [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit',
+    [System.Security.AccessControl.PropagationFlags]::None,
+    [System.Security.AccessControl.AccessControlType]::Allow
+  )
+} else {
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+    $identity.User,
+    [System.Security.AccessControl.FileSystemRights]::FullControl,
+    [System.Security.AccessControl.AccessControlType]::Allow
+  )
+}
+$acl.AddAccessRule($rule)
+$info.SetAccessControl($acl)
+`;
+const WINDOWS_ASSERT_PRIVATE_ACL = String.raw `
+$ErrorActionPreference = 'Stop'
+$path = $env:EBK_PRIVATE_PATH
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+$info = [System.IO.FileInfo]::new($path)
+$acl = $info.GetAccessControl()
+if (-not $acl.AreAccessRulesProtected) {
+  throw 'ACL inheritance is enabled.'
+}
+$allowRules = @($acl.Access | Where-Object {
+  $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow
+})
+$unsafeRules = @($allowRules | Where-Object {
+  $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -ne $identity.User.Value
+})
+$selfRules = @($allowRules | Where-Object {
+  $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -eq $identity.User.Value
+})
+if ($unsafeRules.Count -ne 0 -or $selfRules.Count -eq 0) {
+  throw 'ACL grants access beyond the current user or omits the current user.'
+}
+`;
+function windowsPowerShell(script, environment) {
+    const executable = (0, node_path_1.join)(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    const encodedCommand = Buffer.from(script, 'utf16le').toString('base64');
+    (0, node_child_process_1.execFileSync)(executable, [
+        '-NoLogo',
+        '-NoProfile',
+        '-NonInteractive',
+        '-EncodedCommand',
+        encodedCommand,
+    ], {
+        env: { ...process.env, ...environment },
+        stdio: 'pipe',
+        timeout: 15_000,
+        windowsHide: true,
+    });
+}
+function hardenPrivatePath(path, kind) {
+    if ((0, node_os_1.platform)() === 'win32') {
+        windowsPowerShell(WINDOWS_HARDEN_ACL, {
+            EBK_PRIVATE_KIND: kind,
+            EBK_PRIVATE_PATH: path,
+        });
+        return;
+    }
+    (0, node_fs_1.chmodSync)(path, kind === 'directory' ? 0o700 : 0o600);
+}
+function assertPrivateKeyPermissions(path) {
+    if ((0, node_os_1.platform)() === 'win32') {
+        try {
+            windowsPowerShell(WINDOWS_ASSERT_PRIVATE_ACL, {
+                EBK_PRIVATE_PATH: path,
+            });
+        }
+        catch {
+            throw new Error(`${path} must have an inheritance-disabled ACL granting access only to the current user.`);
+        }
+        return;
+    }
+    const mode = (0, node_fs_1.statSync)(path).mode & 0o777;
+    if ((mode & 0o077) !== 0) {
+        throw new Error(`${path} must not be readable or writable by group or other users.`);
+    }
+}
+function createLocalTlsState(options) {
+    const paths = localTlsPaths(options.appData);
+    const hostSuffix = (0, identity_js_1.normalizeFleetHostSuffix)(options.hostSuffix);
+    if ((0, node_fs_1.existsSync)(paths.rootCertificate) && !options.force) {
+        throw new Error(`EBK local TLS state already exists at ${paths.appData}; use the explicit upgrade path to replace it.`);
+    }
+    if (options.force)
+        (0, node_fs_1.rmSync)(paths.appData, { force: true, recursive: true });
+    (0, node_fs_1.mkdirSync)(paths.appData, { mode: 0o700, recursive: true });
+    hardenPrivatePath(paths.appData, 'directory');
+    const intermediateExt = (0, node_path_1.join)(paths.appData, 'intermediate.ext');
+    const leafExt = (0, node_path_1.join)(paths.appData, 'leaf.ext');
+    (0, node_fs_1.writeFileSync)(intermediateExt, `basicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign\nnameConstraints=critical,permitted;DNS:.${hostSuffix},permitted;DNS:*.${hostSuffix},excluded;IP:0.0.0.0/0.0.0.0,excluded;IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid,issuer\n`, { mode: 0o600 });
+    (0, node_fs_1.writeFileSync)(leafExt, `basicConstraints=critical,CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:*.${hostSuffix}\nauthorityKeyIdentifier=keyid,issuer\n`, { mode: 0o600 });
+    try {
+        openssl(['genrsa', '-out', paths.rootKey, '3072'], paths.appData);
+        openssl([
+            'req',
+            '-x509',
+            '-new',
+            '-key',
+            paths.rootKey,
+            '-sha256',
+            '-days',
+            '3650',
+            '-subj',
+            '/CN=Empire Builder Kit Local Root',
+            '-out',
+            paths.rootCertificate,
+            '-addext',
+            'basicConstraints=critical,CA:TRUE,pathlen:1',
+            '-addext',
+            'keyUsage=critical,keyCertSign,cRLSign',
+            '-addext',
+            'subjectKeyIdentifier=hash',
+        ], paths.appData);
+        openssl(['genrsa', '-out', paths.intermediateKey, '3072'], paths.appData);
+        openssl([
+            'req',
+            '-new',
+            '-key',
+            paths.intermediateKey,
+            '-subj',
+            '/CN=Empire Builder Kit Local Intermediate',
+            '-out',
+            'intermediate.csr',
+        ], paths.appData);
+        openssl([
+            'x509',
+            '-req',
+            '-in',
+            'intermediate.csr',
+            '-CA',
+            paths.rootCertificate,
+            '-CAkey',
+            paths.rootKey,
+            '-CAcreateserial',
+            '-out',
+            paths.intermediateCertificate,
+            '-days',
+            '1825',
+            '-sha256',
+            '-extfile',
+            intermediateExt,
+        ], paths.appData);
+        openssl(['genrsa', '-out', paths.leafKey, '2048'], paths.appData);
+        openssl([
+            'req',
+            '-new',
+            '-key',
+            paths.leafKey,
+            '-subj',
+            `/CN=gateway.${hostSuffix}`,
+            '-out',
+            'leaf.csr',
+        ], paths.appData);
+        openssl([
+            'x509',
+            '-req',
+            '-in',
+            'leaf.csr',
+            '-CA',
+            paths.intermediateCertificate,
+            '-CAkey',
+            paths.intermediateKey,
+            '-CAcreateserial',
+            '-out',
+            'leaf-only.pem',
+            '-days',
+            '397',
+            '-sha256',
+            '-extfile',
+            leafExt,
+        ], paths.appData);
+        (0, node_fs_1.writeFileSync)(paths.leafCertificate, `${(0, node_fs_1.readFileSync)((0, node_path_1.join)(paths.appData, 'leaf-only.pem'), 'utf8').trim()}\n${(0, node_fs_1.readFileSync)(paths.intermediateCertificate, 'utf8').trim()}\n`, { mode: 0o600 });
+        (0, node_fs_1.writeFileSync)(paths.capability, `${options.capability}\n`, { mode: 0o600 });
+        hardenPrivatePath(paths.intermediateKey, 'file');
+        hardenPrivatePath(paths.leafKey, 'file');
+        hardenPrivatePath(paths.capability, 'file');
+        assertPrivateKeyPermissions(paths.intermediateKey);
+        assertPrivateKeyPermissions(paths.leafKey);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(paths.rootKey, { force: true });
+        for (const file of [
+            'intermediate.ext',
+            'leaf.ext',
+            'intermediate.csr',
+            'leaf.csr',
+            'leaf-only.pem',
+            'root.srl',
+            'intermediate.srl',
+        ]) {
+            (0, node_fs_1.rmSync)((0, node_path_1.join)(paths.appData, file), { force: true });
+        }
+    }
+    if ((0, node_fs_1.existsSync)(paths.rootKey)) {
+        throw new Error('Root signing key must not remain in gateway runtime state.');
+    }
+    return paths;
+}
+function removeLocalTlsState(appData = defaultLocalDevAppData()) {
+    const socket = localTlsPaths(appData).gatewaySocket;
+    if ((0, node_os_1.platform)() !== 'win32')
+        (0, node_fs_1.rmSync)(socket, { force: true });
+    (0, node_fs_1.rmSync)(appData, { force: true, recursive: true });
+}
+//# sourceMappingURL=tls.js.map

package/src/local-dev/tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../../../../packages/nx/src/local-dev/tls.ts"],"names":[],"mappings":";;AA6BA,wDAqBC;AAED,sCAgBC;AAED,gDAyBC;AAwGD,kEAmBC;AAED,kDA0JC;AAED,kDAIC;AA5XD,2DAAkD;AAClD,6CAAyC;AACzC,qCAQiB;AACjB,qCAA4C;AAC5C,yCAA0C;AAC1C,+CAAyD;AAgBzD,SAAgB,sBAAsB,CACpC,cAAiC,OAAO,CAAC,GAAG;IAE5C,IAAI,IAAA,kBAAQ,GAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAA,kBAAQ,GAAE,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAA,gBAAI,EACT,IAAA,iBAAO,GAAE,EACT,SAAS,EACT,qBAAqB,EACrB,oBAAoB,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,gBAAI,EACT,WAAW,CAAC,aAAa,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAC/D,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAC3B,OAAO,GAAG,sBAAsB,EAAE;IAElC,OAAO;QACL,OAAO;QACP,UAAU,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,oBAAoB,CAAC;QAC/C,uBAAuB,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,kBAAkB,CAAC;QAC1D,eAAe,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,sBAAsB,CAAC;QACtD,eAAe,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,UAAU,CAAC;QAC1C,OAAO,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,cAAc,CAAC;QACtC,eAAe,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,UAAU,CAAC;QAC1C,OAAO,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,cAAc,CAAC;QACtC,UAAU,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,aAAa,CAAC;QACxC,YAAY,EAAE,IAAA,gBAAI,EAAC,OAAO,EAAE,cAAc,CAAC;QAC3C,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IAC/D,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,IAAI,KAAK,QAAQ,EAAE,CAAC;SAC9B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,IAAI,IAAA,kBAAQ,GAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,oBAAoB,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,QAAQ,QAAQ,IAAI,MAAM,OAAO,CAAC,CAAC;QACrE,wEAAwE;QACxE,yDAAyD;QACzD,IACE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE;YAClC,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,EAC7C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,GAAW;IAC1C,IAAA,iCAAY,EAAC,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCpC,CAAC;AAEF,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;CAqB5C,CAAC;AAEF,SAAS,iBAAiB,CACxB,MAAc,EACd,WAAmC;IAEnC,MAAM,UAAU,GAAG,IAAA,gBAAI,EACrB,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EACvC,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAA,iCAAY,EACV,UAAU,EACV;QACE,SAAS;QACT,YAAY;QACZ,iBAAiB;QACjB,iBAAiB;QACjB,cAAc;KACf,EACD;QACE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE;QACvC,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,IAAI;KAClB,CACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,IAA0B;IACjE,IAAI,IAAA,kBAAQ,GAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,iBAAiB,CAAC,kBAAkB,EAAE;YACpC,gBAAgB,EAAE,IAAI;YACtB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAA,mBAAS,EAAC,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,2BAA2B,CAAC,IAAY;IACtD,IAAI,IAAA,kBAAQ,GAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,iBAAiB,CAAC,0BAA0B,EAAE;gBAC5C,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kFAAkF,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,4DAA4D,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAKnC;IACC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAA,sCAAwB,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,CAAC,OAAO,gDAAgD,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK;QAAE,IAAA,gBAAM,EAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAA,mBAAS,EAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAChD,IAAA,uBAAa,EACX,eAAe,EACf,+HAA+H,UAAU,oBAAoB,UAAU,4IAA4I,EACnT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,IAAA,uBAAa,EACX,OAAO,EACP,6IAA6I,UAAU,yCAAyC,EAChM,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,CACL;YACE,KAAK;YACL,OAAO;YACP,MAAM;YACN,MAAM;YACN,KAAK,CAAC,OAAO;YACb,SAAS;YACT,OAAO;YACP,MAAM;YACN,OAAO;YACP,mCAAmC;YACnC,MAAM;YACN,KAAK,CAAC,eAAe;YACrB,SAAS;YACT,6CAA6C;YAC7C,SAAS;YACT,uCAAuC;YACvC,SAAS;YACT,2BAA2B;SAC5B,EACD,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1E,OAAO,CACL;YACE,KAAK;YACL,MAAM;YACN,MAAM;YACN,KAAK,CAAC,eAAe;YACrB,OAAO;YACP,2CAA2C;YAC3C,MAAM;YACN,kBAAkB;SACnB,EACD,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,CACL;YACE,MAAM;YACN,MAAM;YACN,KAAK;YACL,kBAAkB;YAClB,KAAK;YACL,KAAK,CAAC,eAAe;YACrB,QAAQ;YACR,KAAK,CAAC,OAAO;YACb,iBAAiB;YACjB,MAAM;YACN,KAAK,CAAC,uBAAuB;YAC7B,OAAO;YACP,MAAM;YACN,SAAS;YACT,UAAU;YACV,eAAe;SAChB,EACD,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,CACL;YACE,KAAK;YACL,MAAM;YACN,MAAM;YACN,KAAK,CAAC,OAAO;YACb,OAAO;YACP,eAAe,UAAU,EAAE;YAC3B,MAAM;YACN,UAAU;SACX,EACD,KAAK,CAAC,OAAO,CACd,CAAC;QACF,OAAO,CACL;YACE,MAAM;YACN,MAAM;YACN,KAAK;YACL,UAAU;YACV,KAAK;YACL,KAAK,CAAC,uBAAuB;YAC7B,QAAQ;YACR,KAAK,CAAC,eAAe;YACrB,iBAAiB;YACjB,MAAM;YACN,eAAe;YACf,OAAO;YACP,KAAK;YACL,SAAS;YACT,UAAU;YACV,OAAO;SACR,EACD,KAAK,CAAC,OAAO,CACd,CAAC;QACF,IAAA,uBAAa,EACX,KAAK,CAAC,eAAe,EACrB,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,IAAA,sBAAY,EAAC,KAAK,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EACvI,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,IAAA,uBAAa,EAAC,KAAK,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,iBAAiB,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACjD,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACnD,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI;YACjB,kBAAkB;YAClB,UAAU;YACV,kBAAkB;YAClB,UAAU;YACV,eAAe;YACf,UAAU;YACV,kBAAkB;SACnB,EAAE,CAAC;YACF,IAAA,gBAAM,EAAC,IAAA,gBAAI,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAAO,GAAG,sBAAsB,EAAE;IACpE,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;IACpD,IAAI,IAAA,kBAAQ,GAAE,KAAK,OAAO;QAAE,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAA,gBAAM,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/src/ownership/composition.d.ts

@@ -0,0 +1,16 @@
+import type { Tree } from '@nx/devkit';
+import { type GeneratedPathMode } from './record.js';
+export interface CompositionOwnedPath {
+    managedJsonPointers?: string[];
+    mode?: GeneratedPathMode;
+    path: string;
+}
+export interface RecordCompositionOwnershipOptions {
+    paths: CompositionOwnedPath[];
+    projects?: string[];
+    slice: string;
+}
+export declare function restampProductSliceOwnership(tree: Tree, slice: string): void;
+export declare function restampFoundationOwnership(tree: Tree): void;
+export declare function restampWorkspaceOwnership(tree: Tree): void;
+export declare function recordCompositionOwnership(tree: Tree, options: RecordCompositionOwnershipOptions): void;

package/src/ownership/composition.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.restampProductSliceOwnership = restampProductSliceOwnership;
+exports.restampFoundationOwnership = restampFoundationOwnership;
+exports.restampWorkspaceOwnership = restampWorkspaceOwnership;
+exports.recordCompositionOwnership = recordCompositionOwnership;
+const node_path_1 = require("node:path");
+const json_ownership_js_1 = require("./json-ownership.js");
+const foundation_record_js_1 = require("./foundation-record.js");
+const record_js_1 = require("./record.js");
+const workspace_record_js_1 = require("./workspace-record.js");
+function json(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function restampProductSliceOwnership(tree, slice) {
+    const root = node_path_1.posix.join('packages', slice);
+    const ownershipPath = node_path_1.posix.join(root, '.ebk/ownership.json');
+    const source = tree.read(ownershipPath, 'utf8');
+    if (source === null) {
+        throw new Error(`Product Slice ownership metadata is missing at ${ownershipPath}.`);
+    }
+    const result = (0, record_js_1.validateGeneratedOwnershipRecord)(JSON.parse(source));
+    if (!result.valid) {
+        throw new Error('Product Slice ownership metadata is invalid after generation.');
+    }
+    tree.write(ownershipPath, json({
+        ...result.value,
+        paths: result.value.paths.map((entry) => {
+            const contents = tree.read(node_path_1.posix.join(root, entry.path), 'utf8');
+            if (contents === null) {
+                throw new Error(`Generated owned path does not exist: ${entry.path}.`);
+            }
+            return { ...entry, sha256: (0, json_ownership_js_1.hashOwnedContent)(contents, entry) };
+        }),
+    }));
+}
+function restampFoundationOwnership(tree) {
+    const root = 'packages/foundation';
+    const ownershipPath = node_path_1.posix.join(root, '.ebk/ownership.json');
+    const source = tree.read(ownershipPath, 'utf8');
+    if (source === null) {
+        throw new Error('Standard Foundation ownership metadata is missing.');
+    }
+    const result = (0, foundation_record_js_1.validateFoundationOwnershipRecord)(JSON.parse(source));
+    if (!result.valid) {
+        throw new Error('Standard Foundation ownership metadata is invalid after generation.');
+    }
+    tree.write(ownershipPath, json({
+        ...result.value,
+        paths: result.value.paths.map((entry) => {
+            const contents = tree.read(node_path_1.posix.join(root, entry.path), 'utf8');
+            if (contents === null) {
+                throw new Error(`Generated Foundation path does not exist: ${entry.path}.`);
+            }
+            return { ...entry, sha256: (0, json_ownership_js_1.hashOwnedContent)(contents, entry) };
+        }),
+    }));
+}
+function restampWorkspaceOwnership(tree) {
+    const ownershipPath = '.ebk/ownership.json';
+    const source = tree.read(ownershipPath, 'utf8');
+    if (source === null) {
+        throw new Error('Workspace ownership metadata is missing.');
+    }
+    const result = (0, workspace_record_js_1.validateWorkspaceOwnershipRecord)(JSON.parse(source));
+    if (!result.valid) {
+        throw new Error('Workspace ownership metadata is invalid after generation.');
+    }
+    tree.write(ownershipPath, json({
+        ...result.value,
+        paths: result.value.paths.map((entry) => {
+            const contents = tree.read(entry.path, 'utf8');
+            if (contents === null) {
+                throw new Error(`Generated workspace path does not exist: ${entry.path}.`);
+            }
+            return { ...entry, sha256: (0, json_ownership_js_1.hashOwnedContent)(contents, entry) };
+        }),
+    }));
+}
+function recordCompositionOwnership(tree, options) {
+    const root = node_path_1.posix.join('packages', options.slice);
+    const ownershipPath = node_path_1.posix.join(root, '.ebk/ownership.json');
+    const source = tree.read(ownershipPath, 'utf8');
+    if (source === null) {
+        throw new Error(`Product Slice ownership metadata is missing at ${ownershipPath}.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch (error) {
+        throw new Error(`Product Slice ownership metadata is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const result = (0, record_js_1.validateGeneratedOwnershipRecord)(parsed);
+    if (!result.valid) {
+        throw new Error(`Product Slice ownership metadata is invalid:\n${result.issues
+            .map((issue) => `- ${issue.path}: ${issue.message}`)
+            .join('\n')}`);
+    }
+    const paths = new Map(result.value.paths.map((entry) => [entry.path, entry]));
+    for (const owned of options.paths) {
+        const contents = tree.read(node_path_1.posix.join(root, owned.path), 'utf8');
+        if (contents === null) {
+            throw new Error(`Composed owned path does not exist: ${owned.path}.`);
+        }
+        const previous = paths.get(owned.path);
+        const managedJsonPointers = owned.managedJsonPointers ?? previous?.managedJsonPointers;
+        paths.set(owned.path, {
+            ...(managedJsonPointers ? { managedJsonPointers } : {}),
+            mode: owned.mode ?? 'managed',
+            origin: previous?.origin ?? 'composition',
+            path: owned.path,
+            sha256: (0, json_ownership_js_1.hashOwnedContent)(contents, { managedJsonPointers }),
+        });
+    }
+    const ownership = {
+        ...result.value,
+        paths: [...paths.values()].sort((left, right) => left.path.localeCompare(right.path)),
+        projects: [
+            ...new Set([...result.value.projects, ...(options.projects ?? [])]),
+        ].sort(),
+    };
+    tree.write(ownershipPath, json(ownership));
+}
+//# sourceMappingURL=composition.js.map

package/src/ownership/composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition.js","sourceRoot":"","sources":["../../../../../packages/nx/src/ownership/composition.ts"],"names":[],"mappings":";;AA0BA,oEA8BC;AAED,gEA4BC;AAED,8DA2BC;AAED,gEA0DC;AA9KD,yCAAkC;AAClC,2DAAuD;AACvD,iEAA2E;AAC3E,2CAGqB;AACrB,+DAAyE;AAczE,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,SAAgB,4BAA4B,CAAC,IAAU,EAAE,KAAa;IACpE,MAAM,IAAI,GAAG,iBAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,iBAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,kDAAkD,aAAa,GAAG,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,4CAAgC,EAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CACR,aAAa,EACb,IAAI,CAAC;QACH,GAAG,MAAM,CAAC,KAAK;QACf,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,CAAC,IAAI,GAAG,CACtD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAA,oCAAgB,EAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACjE,CAAC,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,IAAU;IACnD,MAAM,IAAI,GAAG,qBAAqB,CAAC;IACnC,MAAM,aAAa,GAAG,iBAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,wDAAiC,EAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CACR,aAAa,EACb,IAAI,CAAC;QACH,GAAG,MAAM,CAAC,KAAK;QACf,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,6CAA6C,KAAK,CAAC,IAAI,GAAG,CAC3D,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAA,oCAAgB,EAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACjE,CAAC,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAgB,yBAAyB,CAAC,IAAU;IAClD,MAAM,aAAa,GAAG,qBAAqB,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,sDAAgC,EAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CACR,aAAa,EACb,IAAI,CAAC;QACH,GAAG,MAAM,CAAC,KAAK;QACf,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,IAAI,GAAG,CAC1D,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAA,oCAAgB,EAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACjE,CAAC,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CACxC,IAAU,EACV,OAA0C;IAE1C,MAAM,IAAI,GAAG,iBAAK,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,iBAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,kDAAkD,aAAa,GAAG,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uDAAuD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,4CAAgC,EAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,MAAM;aAC3D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,mBAAmB,GACvB,KAAK,CAAC,mBAAmB,IAAI,QAAQ,EAAE,mBAAmB,CAAC;QAC7D,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;YACpB,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS;YAC7B,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,aAAa;YACzC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,IAAA,oCAAgB,EAAC,QAAQ,EAAE,EAAE,mBAAmB,EAAE,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG;QAChB,GAAG,MAAM,CAAC,KAAK;QACf,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CACpC;QACD,QAAQ,EAAE;YACR,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;SACpE,CAAC,IAAI,EAAE;KACT,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/src/ownership/foundation-record.d.ts

@@ -0,0 +1,66 @@
+import { type ValidationResult } from '../validation.js';
+import { type GeneratedPathOwnership } from './record.js';
+export declare const FOUNDATION_OWNERSHIP_SCHEMA_VERSION: 2;
+export interface FoundationOwnershipRecord {
+    frameworkVersion: string;
+    kind: 'foundation';
+    paths: GeneratedPathOwnership[];
+    schemaVersion: typeof FOUNDATION_OWNERSHIP_SCHEMA_VERSION;
+}
+export declare function validateFoundationOwnershipRecord(value: unknown): ValidationResult<FoundationOwnershipRecord>;
+export declare const foundationOwnershipSchema: {
+    readonly $id: "https://empirebuilderkit.dev/schemas/foundation-ownership-v2.json";
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly frameworkVersion: {
+            readonly minLength: 1;
+            readonly type: "string";
+        };
+        readonly kind: {
+            readonly const: "foundation";
+        };
+        readonly paths: {
+            readonly items: {
+                readonly additionalProperties: false;
+                readonly properties: {
+                    readonly managedJsonPointers: {
+                        readonly items: {
+                            readonly pattern: "^(?:/(?:[^~/]|~[01])*)+$";
+                            readonly type: "string";
+                        };
+                        readonly minItems: 1;
+                        readonly type: "array";
+                        readonly uniqueItems: true;
+                    };
+                    readonly mode: {
+                        readonly enum: readonly ["managed", "seeded"];
+                    };
+                    readonly origin: {
+                        readonly const: "framework";
+                    };
+                    readonly path: {
+                        readonly minLength: 1;
+                        readonly not: {
+                            readonly pattern: "(^[\\\\/])|(^|[\\\\/])\\.\\.([\\\\/]|$)";
+                        };
+                        readonly type: "string";
+                    };
+                    readonly sha256: {
+                        readonly pattern: "^[a-f0-9]{64}$";
+                        readonly type: "string";
+                    };
+                };
+                readonly required: readonly ["path", "mode", "origin", "sha256"];
+                readonly type: "object";
+            };
+            readonly type: "array";
+        };
+        readonly schemaVersion: {
+            readonly const: 2;
+        };
+    };
+    readonly required: readonly ["schemaVersion", "kind", "frameworkVersion", "paths"];
+    readonly title: "Empire Builder Kit Standard Foundation Ownership Record v2";
+    readonly type: "object";
+};

package/src/ownership/foundation-record.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.foundationOwnershipSchema = exports.FOUNDATION_OWNERSHIP_SCHEMA_VERSION = void 0;
+exports.validateFoundationOwnershipRecord = validateFoundationOwnershipRecord;
+const validation_js_1 = require("../validation.js");
+const record_js_1 = require("./record.js");
+const hash_js_1 = require("./hash.js");
+exports.FOUNDATION_OWNERSHIP_SCHEMA_VERSION = 2;
+function isSafeWorkspacePath(value) {
+    return (value !== '' &&
+        !value.startsWith('/') &&
+        !value.startsWith('\\') &&
+        !value.split(/[\\/]/).includes('..'));
+}
+function validateFoundationOwnershipRecord(value) {
+    if (!(0, validation_js_1.isRecord)(value)) {
+        return {
+            valid: false,
+            issues: [{ message: 'must be an object', path: 'ownership' }],
+        };
+    }
+    const issues = [];
+    if (value.schemaVersion !== exports.FOUNDATION_OWNERSHIP_SCHEMA_VERSION) {
+        issues.push({ message: 'must equal 2', path: 'ownership.schemaVersion' });
+    }
+    if (value.kind !== 'foundation') {
+        issues.push({ message: 'must equal foundation', path: 'ownership.kind' });
+    }
+    if (typeof value.frameworkVersion !== 'string' ||
+        value.frameworkVersion.trim() === '') {
+        issues.push({
+            message: 'must be a non-empty string',
+            path: 'ownership.frameworkVersion',
+        });
+    }
+    if (!Array.isArray(value.paths)) {
+        issues.push({ message: 'must be an array', path: 'ownership.paths' });
+    }
+    else {
+        value.paths.forEach((entry, index) => {
+            const entryPath = `ownership.paths[${index}]`;
+            if (!(0, validation_js_1.isRecord)(entry)) {
+                issues.push({ message: 'must be an object', path: entryPath });
+                return;
+            }
+            if (typeof entry.path !== 'string' || !isSafeWorkspacePath(entry.path)) {
+                issues.push({
+                    message: 'must be a safe Foundation-relative path',
+                    path: `${entryPath}.path`,
+                });
+            }
+            if (!record_js_1.GENERATED_PATH_MODES.includes(entry.mode)) {
+                issues.push({
+                    message: 'must equal managed or seeded',
+                    path: `${entryPath}.mode`,
+                });
+            }
+            if (entry.origin !== 'framework') {
+                issues.push({
+                    message: 'must equal framework',
+                    path: `${entryPath}.origin`,
+                });
+            }
+            if (typeof entry.sha256 !== 'string' ||
+                !hash_js_1.GENERATED_CONTENT_HASH_PATTERN.test(entry.sha256)) {
+                issues.push({
+                    message: 'must be a lowercase SHA-256 digest',
+                    path: `${entryPath}.sha256`,
+                });
+            }
+            (0, record_js_1.validateManagedJsonPointers)(entry, entryPath, issues);
+        });
+    }
+    return (0, validation_js_1.validationResult)(value, issues);
+}
+exports.foundationOwnershipSchema = {
+    $id: 'https://empirebuilderkit.dev/schemas/foundation-ownership-v2.json',
+    $schema: 'https://json-schema.org/draft/2020-12/schema',
+    additionalProperties: false,
+    properties: {
+        frameworkVersion: { minLength: 1, type: 'string' },
+        kind: { const: 'foundation' },
+        paths: {
+            items: {
+                additionalProperties: false,
+                properties: {
+                    managedJsonPointers: record_js_1.managedJsonPointersSchema,
+                    mode: { enum: [...record_js_1.GENERATED_PATH_MODES] },
+                    origin: { const: 'framework' },
+                    path: {
+                        minLength: 1,
+                        not: { pattern: '(^[\\\\/])|(^|[\\\\/])\\.\\.([\\\\/]|$)' },
+                        type: 'string',
+                    },
+                    sha256: { pattern: '^[a-f0-9]{64}$', type: 'string' },
+                },
+                required: ['path', 'mode', 'origin', 'sha256'],
+                type: 'object',
+            },
+            type: 'array',
+        },
+        schemaVersion: { const: exports.FOUNDATION_OWNERSHIP_SCHEMA_VERSION },
+    },
+    required: ['schemaVersion', 'kind', 'frameworkVersion', 'paths'],
+    title: 'Empire Builder Kit Standard Foundation Ownership Record v2',
+    type: 'object',
+};
+//# sourceMappingURL=foundation-record.js.map

package/src/ownership/foundation-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foundation-record.js","sourceRoot":"","sources":["../../../../../packages/nx/src/ownership/foundation-record.ts"],"names":[],"mappings":";;;AAiCA,8EAmEC;AApGD,oDAK0B;AAC1B,2CAMqB;AACrB,uCAA2D;AAE9C,QAAA,mCAAmC,GAAG,CAAU,CAAC;AAS9D,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,CACL,KAAK,KAAK,EAAE;QACZ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACvB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAgB,iCAAiC,CAC/C,KAAc;IAEd,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,aAAa,KAAK,2CAAmC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;QAC1C,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EACpC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,4BAA4B;YACrC,IAAI,EAAE,4BAA4B;SACnC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,SAAS,GAAG,mBAAmB,KAAK,GAAG,CAAC;YAC9C,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvE,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,yCAAyC;oBAClD,IAAI,EAAE,GAAG,SAAS,OAAO;iBAC1B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,gCAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAyB,CAAC,EAAE,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,GAAG,SAAS,OAAO;iBAC1B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,sBAAsB;oBAC/B,IAAI,EAAE,GAAG,SAAS,SAAS;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,IACE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAChC,CAAC,wCAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAClD,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,oCAAoC;oBAC7C,IAAI,EAAE,GAAG,SAAS,SAAS;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,IAAA,uCAA2B,EAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAA,gCAAgB,EAA4B,KAAK,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAEY,QAAA,yBAAyB,GAAG;IACvC,GAAG,EAAE,mEAAmE;IACxE,OAAO,EAAE,8CAA8C;IACvD,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClD,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;QAC7B,KAAK,EAAE;YACL,KAAK,EAAE;gBACL,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,mBAAmB,EAAE,qCAAyB;oBAC9C,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,gCAAoB,CAAC,EAAE;oBACzC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;oBAC9B,IAAI,EAAE;wBACJ,SAAS,EAAE,CAAC;wBACZ,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE;wBAC3D,IAAI,EAAE,QAAQ;qBACf;oBACD,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACtD;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;gBAC9C,IAAI,EAAE,QAAQ;aACf;YACD,IAAI,EAAE,OAAO;SACd;QACD,aAAa,EAAE,EAAE,KAAK,EAAE,2CAAmC,EAAE;KAC9D;IACD,QAAQ,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,CAAC;IAChE,KAAK,EAAE,4DAA4D;IACnE,IAAI,EAAE,QAAQ;CACN,CAAC"}

package/src/ownership/hash.d.ts

@@ -0,0 +1,2 @@
+export declare const GENERATED_CONTENT_HASH_PATTERN: RegExp;
+export declare function hashGeneratedContent(contents: string): string;

package/src/ownership/hash.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENERATED_CONTENT_HASH_PATTERN = void 0;
+exports.hashGeneratedContent = hashGeneratedContent;
+const node_crypto_1 = require("node:crypto");
+exports.GENERATED_CONTENT_HASH_PATTERN = /^[a-f0-9]{64}$/;
+function hashGeneratedContent(contents) {
+    return (0, node_crypto_1.createHash)('sha256').update(contents, 'utf8').digest('hex');
+}
+//# sourceMappingURL=hash.js.map