@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.11

package/src/supply-chain/blueprint-verification-execution.js

@@ -0,0 +1,639 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertBlueprintVerificationInstalledToolPaths = assertBlueprintVerificationInstalledToolPaths;
+exports.resolveBlueprintVerificationExecution = resolveBlueprintVerificationExecution;
+exports.resolveBlueprintVerificationExecutions = resolveBlueprintVerificationExecutions;
+exports.runBlueprintVerificationExecution = runBlueprintVerificationExecution;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_module_1 = require("node:module");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const semver_1 = require("semver");
+const blueprint_trust_js_1 = require("./blueprint-trust.js");
+const blueprint_trust_process_js_1 = require("./blueprint-trust-process.js");
+const blueprint_verification_authority_js_1 = require("./blueprint-verification-authority.js");
+const MAX_TOOL_BYTES = 256 * 1024 * 1024;
+const PACKAGE_GROUPS = [
+    'dependencies',
+    'devDependencies',
+    'optionalDependencies',
+];
+const PROJECT_ROOT = /^packages\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
+function hasUnsafeWindowsPathCharacter(value) {
+    const metacharacters = new Set([
+        '\r',
+        '\n',
+        '"',
+        '%',
+        '!',
+        '^',
+        '&',
+        '|',
+        '<',
+        '>',
+    ]);
+    return [...value].some((character) => character.codePointAt(0) === 0 || metacharacters.has(character));
+}
+function fileIdentity(metadata) {
+    return {
+        ctimeMs: metadata.ctimeMs,
+        dev: metadata.dev,
+        ino: metadata.ino,
+        mode: metadata.mode,
+        mtimeMs: metadata.mtimeMs,
+        nlink: metadata.nlink,
+        size: metadata.size,
+    };
+}
+function sameFileIdentity(left, right) {
+    return Object.keys(left).every((key) => left[key] ===
+        right[key]);
+}
+function nodeFingerprint(path, metadata, readAuthorityFile) {
+    return {
+        identity: fileIdentity(metadata),
+        path,
+        sha256: (0, node_crypto_1.createHash)('sha256').update(readAuthorityFile(path)).digest('hex'),
+    };
+}
+function assertBlueprintVerificationInstalledToolPaths(input) {
+    const rootNodeModules = (0, node_path_1.join)(input.workspaceRoot, 'node_modules');
+    const rootNodeModulesMetadata = (0, node_fs_1.lstatSync)(rootNodeModules);
+    if (rootNodeModulesMetadata.isSymbolicLink() ||
+        !rootNodeModulesMetadata.isDirectory() ||
+        (0, node_fs_1.realpathSync)(rootNodeModules) !== rootNodeModules) {
+        throw new Error('Blueprint verification requires one canonical root node_modules authority.');
+    }
+    const packageChild = (0, node_path_1.relative)(input.packageRoot, input.binPath);
+    const installedBinChild = (0, node_path_1.relative)(rootNodeModules, input.binPath);
+    const installedManifestChild = (0, node_path_1.relative)(rootNodeModules, input.manifestPath);
+    const binMetadata = (0, node_fs_1.lstatSync)(input.binPath);
+    if (packageChild === '..' ||
+        packageChild.startsWith(`..${node_path_1.sep}`) ||
+        installedBinChild === '' ||
+        installedBinChild === '..' ||
+        installedBinChild.startsWith(`..${node_path_1.sep}`) ||
+        (0, node_path_1.isAbsolute)(installedBinChild) ||
+        installedManifestChild === '' ||
+        installedManifestChild === '..' ||
+        installedManifestChild.startsWith(`..${node_path_1.sep}`) ||
+        (0, node_path_1.isAbsolute)(installedManifestChild) ||
+        binMetadata.isSymbolicLink() ||
+        !binMetadata.isFile() ||
+        binMetadata.size <= 0 ||
+        binMetadata.size > MAX_TOOL_BYTES) {
+        throw new Error('Blueprint verification installed tool is not one canonical root module.');
+    }
+}
+function readJsonFile(path, label) {
+    const metadata = (0, node_fs_1.lstatSync)(path);
+    if (metadata.isSymbolicLink() ||
+        !metadata.isFile() ||
+        metadata.size <= 0 ||
+        metadata.size > 5 * 1024 * 1024 ||
+        (0, node_fs_1.realpathSync)(path) !== path) {
+        throw new Error(`${label} must be one canonical bounded JSON file.`);
+    }
+    const value = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} must contain one JSON object.`);
+    }
+    return value;
+}
+function dependencySpecifier(manifest, name, label) {
+    const declarations = PACKAGE_GROUPS.flatMap((group) => {
+        const values = manifest[group];
+        return values &&
+            typeof values === 'object' &&
+            !Array.isArray(values) &&
+            Object.prototype.hasOwnProperty.call(values, name)
+            ? [values[name]]
+            : [];
+    });
+    if (declarations.length > 1 ||
+        (declarations.length === 1 && typeof declarations[0] !== 'string')) {
+        throw new Error(`${label} requires at most one exact package declaration.`);
+    }
+    return declarations[0];
+}
+function installedTool(workspaceRoot, parsedLockfile, importer, importerManifest, name, binName, fingerprint, readAuthorityFile) {
+    const specifier = dependencySpecifier(importerManifest, name, `Blueprint verification ${name}`);
+    if (specifier === undefined) {
+        throw new Error(`Blueprint verification ${name} requires one direct importer declaration.`);
+    }
+    const importerManifestPath = (0, node_path_1.join)(workspaceRoot, ...(importer === '.' ? [] : importer.split('/')), 'package.json');
+    const require = (0, node_module_1.createRequire)(importerManifestPath);
+    const manifestPath = (0, node_fs_1.realpathSync)(require.resolve(`${name}/package.json`));
+    const manifest = readJsonFile(manifestPath, `Blueprint verification ${name} installed manifest`);
+    const bin = typeof manifest.bin === 'string'
+        ? manifest.bin
+        : manifest.bin &&
+            typeof manifest.bin === 'object' &&
+            !Array.isArray(manifest.bin)
+            ? manifest.bin[binName]
+            : undefined;
+    if (manifest.name !== name ||
+        typeof manifest.version !== 'string' ||
+        !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(manifest.version) ||
+        typeof bin !== 'string' ||
+        !/^\.\/[A-Za-z0-9._/-]+$/u.test(bin) ||
+        bin.split('/').includes('..')) {
+        throw new Error(`Blueprint verification ${name} has no exact installed package bin.`);
+    }
+    const packageRoot = (0, node_path_1.dirname)(manifestPath);
+    const binPath = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(packageRoot, bin));
+    assertBlueprintVerificationInstalledToolPaths({
+        binPath,
+        manifestPath,
+        packageRoot,
+        workspaceRoot,
+    });
+    const digest = (path) => (0, node_crypto_1.createHash)('sha256').update(readAuthorityFile(path)).digest('hex');
+    const lockedVersion = (0, blueprint_trust_js_1.resolvePnpmImporterPackageVersionFromParsed)(parsedLockfile, importer, name, specifier);
+    if (manifest.version !== lockedVersion) {
+        throw new Error(`Blueprint verification ${name} installed version differs from its exact current lock importer.`);
+    }
+    return {
+        binPath,
+        files: fingerprint
+            ? [
+                { path: manifestPath, sha256: digest(manifestPath) },
+                { path: binPath, sha256: digest(binPath) },
+            ]
+            : [],
+        portable: {
+            bin,
+            importer,
+            name,
+            specifier,
+            version: manifest.version,
+        },
+    };
+}
+function assertInstalledTool(authority, readAuthorityFile) {
+    for (const file of authority.files) {
+        const metadata = (0, node_fs_1.lstatSync)(file.path);
+        if ((0, node_fs_1.realpathSync)(file.path) !== file.path ||
+            metadata.isSymbolicLink() ||
+            !metadata.isFile() ||
+            metadata.size <= 0 ||
+            metadata.size > MAX_TOOL_BYTES ||
+            (0, node_crypto_1.createHash)('sha256')
+                .update(readAuthorityFile(file.path))
+                .digest('hex') !== file.sha256) {
+            throw new Error('Blueprint verification installed tool changed during execution.');
+        }
+    }
+}
+function projectByPackageName(context, packageName) {
+    if (!context.packageIndex) {
+        context.resolutionHooks?.onPackageIndex?.();
+        const index = new Map();
+        const packagesRoot = (0, node_path_1.join)(context.workspaceRoot, 'packages');
+        for (const entry of (0, node_fs_1.readdirSync)(packagesRoot, { withFileTypes: true })) {
+            if (!entry.isDirectory() || entry.isSymbolicLink())
+                continue;
+            const root = `packages/${entry.name}`;
+            if (!PROJECT_ROOT.test(root))
+                continue;
+            const manifestPath = (0, node_path_1.join)(packagesRoot, entry.name, 'package.json');
+            if (!(0, node_fs_1.existsSync)(manifestPath))
+                continue;
+            const manifest = readJsonFile(manifestPath, `Blueprint verification filter package ${root}`);
+            context.projectManifests.set(root, manifest);
+            if (typeof manifest.name !== 'string')
+                continue;
+            const matches = index.get(manifest.name) ?? [];
+            matches.push({ manifest, root });
+            index.set(manifest.name, matches);
+        }
+        context.packageIndex = index;
+    }
+    const matches = context.packageIndex.get(packageName) ?? [];
+    if (matches.length !== 1 || !matches[0]) {
+        throw new Error('Blueprint verification Vitest filter must resolve one exact workspace package.');
+    }
+    return matches[0];
+}
+function prepareResolutionContext(workspace, fingerprint, readAuthorityFile = node_fs_1.readFileSync, resolutionHooks) {
+    const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(workspace));
+    const node = (0, node_fs_1.realpathSync)(process.execPath);
+    const rootManifest = readJsonFile((0, node_path_1.join)(workspaceRoot, 'package.json'), 'Blueprint verification root package manifest');
+    const nodeEngine = rootManifest.engines &&
+        typeof rootManifest.engines === 'object' &&
+        !Array.isArray(rootManifest.engines)
+        ? rootManifest.engines.node
+        : undefined;
+    const nodeVersionPath = (0, node_path_1.join)(workspaceRoot, '.node-version');
+    const nodeVersionMetadata = (0, node_fs_1.lstatSync)(nodeVersionPath);
+    const lockPath = (0, node_path_1.join)(workspaceRoot, 'pnpm-lock.yaml');
+    const lockMetadata = (0, node_fs_1.lstatSync)(lockPath);
+    const nodeMetadata = (0, node_fs_1.lstatSync)(node);
+    const nodeChild = (0, node_path_1.relative)(workspaceRoot, node);
+    const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;
+    if (!(0, node_path_1.isAbsolute)(node) ||
+        (0, node_path_1.dirname)(node).includes(node_path_1.delimiter) ||
+        nodeChild === '' ||
+        (nodeChild !== '..' &&
+            !nodeChild.startsWith(`..${node_path_1.sep}`) &&
+            !(0, node_path_1.isAbsolute)(nodeChild)) ||
+        nodeMetadata.isSymbolicLink() ||
+        !nodeMetadata.isFile() ||
+        nodeMetadata.nlink !== 1 ||
+        nodeMetadata.size <= 0 ||
+        nodeMetadata.size > MAX_TOOL_BYTES ||
+        nodeVersionMetadata.isSymbolicLink() ||
+        !nodeVersionMetadata.isFile() ||
+        nodeVersionMetadata.nlink !== 1 ||
+        nodeVersionMetadata.size <= 0 ||
+        nodeVersionMetadata.size > 128 ||
+        (0, node_fs_1.realpathSync)(nodeVersionPath) !== nodeVersionPath ||
+        lockMetadata.isSymbolicLink() ||
+        !lockMetadata.isFile() ||
+        lockMetadata.nlink !== 1 ||
+        lockMetadata.size <= 0 ||
+        lockMetadata.size > 25 * 1024 * 1024 ||
+        (0, node_fs_1.realpathSync)(lockPath) !== lockPath ||
+        (process.platform === 'win32' &&
+            (typeof systemRoot !== 'string' ||
+                !(0, node_path_1.isAbsolute)(systemRoot) ||
+                systemRoot.includes(node_path_1.delimiter) ||
+                hasUnsafeWindowsPathCharacter(systemRoot) ||
+                hasUnsafeWindowsPathCharacter(node)))) {
+        throw new Error('Blueprint verification cannot bind the current Node executable.');
+    }
+    const nodeVersionSource = (0, node_fs_1.readFileSync)(nodeVersionPath, 'utf8');
+    const declaredNodeVersion = nodeVersionSource.slice(0, -1);
+    const lockfile = (0, node_fs_1.readFileSync)(lockPath, 'utf8');
+    if (typeof nodeEngine !== 'string' ||
+        !(0, semver_1.satisfies)(process.versions.node, nodeEngine) ||
+        !/^\d+\.\d+\.\d+\n$/u.test(nodeVersionSource) ||
+        !(0, semver_1.satisfies)(declaredNodeVersion, nodeEngine)) {
+        throw new Error('Blueprint verification requires exact engine-compatible Node declarations.');
+    }
+    const parsedLockfile = (0, blueprint_trust_js_1.parsePnpmImporterPackageAuthorityLockfile)(lockfile);
+    resolutionHooks?.onLockfileParse?.();
+    return {
+        fingerprint,
+        installedTools: new Map(),
+        lockfile,
+        node,
+        ...(fingerprint
+            ? {
+                nodeAuthority: nodeFingerprint(node, nodeMetadata, readAuthorityFile),
+            }
+            : {}),
+        parsedLockfile,
+        projectManifests: new Map(),
+        readAuthorityFile,
+        ...(resolutionHooks === undefined ? {} : { resolutionHooks }),
+        rootManifest,
+        workspaceRoot,
+    };
+}
+function contextProjectManifest(context, projectRoot, label) {
+    const cached = context.projectManifests.get(projectRoot);
+    if (cached)
+        return cached;
+    const manifest = readJsonFile((0, node_path_1.join)(context.workspaceRoot, ...projectRoot.split('/'), 'package.json'), label);
+    context.projectManifests.set(projectRoot, manifest);
+    return manifest;
+}
+function contextInstalledTool(context, importer, importerManifest, name, binName) {
+    const key = `${importer}\u0000${name}`;
+    const cached = context.installedTools.get(key);
+    if (cached)
+        return cached;
+    context.resolutionHooks?.onInstalledToolResolution?.(importer, name);
+    const authority = installedTool(context.workspaceRoot, context.parsedLockfile, importer, importerManifest, name, binName, context.fingerprint, context.readAuthorityFile);
+    context.installedTools.set(key, authority);
+    return authority;
+}
+function resolveInvocation(input, fingerprint, prepared, readAuthorityFile = node_fs_1.readFileSync) {
+    const requestedWorkspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.workspaceRoot));
+    if (!PROJECT_ROOT.test(input.projectRoot) ||
+        input.projectRoot !== `packages/${input.projectName}`) {
+        throw new Error('Blueprint verification executor requires its exact Slice project identity.');
+    }
+    const context = prepared ??
+        prepareResolutionContext(requestedWorkspaceRoot, fingerprint, readAuthorityFile);
+    if (context.workspaceRoot !== requestedWorkspaceRoot ||
+        context.fingerprint !== fingerprint) {
+        throw new Error('Blueprint verification resolution context differs from its workspace authority.');
+    }
+    const workspaceRoot = context.workspaceRoot;
+    const projectRoot = (0, node_path_1.join)(workspaceRoot, ...input.projectRoot.split('/'));
+    if (!(0, node_path_1.isAbsolute)(projectRoot) ||
+        (0, node_fs_1.realpathSync)(projectRoot) !== projectRoot ||
+        (0, node_path_1.relative)(workspaceRoot, projectRoot).startsWith(`..${node_path_1.sep}`)) {
+        throw new Error('Blueprint verification executor project resolves outside its workspace.');
+    }
+    const plan = (0, blueprint_trust_js_1.planBlueprintVerificationExecution)(input.options);
+    if (!plan) {
+        throw new Error('Blueprint verification executor options are not one exact structured plan.');
+    }
+    const node = context.node;
+    const rootManifest = context.rootManifest;
+    const nodeAuthority = context.nodeAuthority;
+    if (plan.kind === 'node') {
+        return {
+            invocation: {
+                arguments: plan.arguments,
+                command: node,
+                cwd: projectRoot,
+                nodeVersion: process.versions.node,
+                plan,
+            },
+            ...(nodeAuthority === undefined ? {} : { nodeAuthority }),
+        };
+    }
+    if (plan.kind === 'typescript') {
+        const projectManifest = contextProjectManifest(context, input.projectRoot, 'Blueprint verification Slice package manifest');
+        const localSpecifier = dependencySpecifier(projectManifest, 'typescript', 'Blueprint verification Slice TypeScript');
+        const importer = (localSpecifier === undefined ? '.' : input.projectRoot);
+        const importerManifest = importer === '.' ? rootManifest : projectManifest;
+        const installed = contextInstalledTool(context, importer, importerManifest, 'typescript', 'tsc');
+        return {
+            installedTool: installed,
+            invocation: {
+                arguments: [installed.binPath, '--noEmit', '-p', 'tsconfig.json'],
+                command: node,
+                cwd: projectRoot,
+                nodeVersion: process.versions.node,
+                plan,
+                toolAuthority: installed.portable,
+            },
+            ...(nodeAuthority === undefined ? {} : { nodeAuthority }),
+        };
+    }
+    const filter = projectByPackageName(context, plan.filterPackage);
+    const reviewedManifest = contextProjectManifest(context, input.projectRoot, 'Blueprint verification reviewed Slice package manifest');
+    if (filter.root !== input.projectRoot) {
+        const dependencies = reviewedManifest.dependencies;
+        const ownership = readJsonFile((0, node_path_1.join)(projectRoot, '.ebk', 'ownership.json'), 'Blueprint verification reviewed Slice ownership');
+        const consumes = ownership.contracts &&
+            typeof ownership.contracts === 'object' &&
+            !Array.isArray(ownership.contracts)
+            ? ownership.contracts.consumes
+            : undefined;
+        const inputs = ownership.inputs;
+        const consumeApiContract = inputs && typeof inputs === 'object' && !Array.isArray(inputs)
+            ? inputs.consumeApiContract
+            : undefined;
+        if (!dependencies ||
+            typeof dependencies !== 'object' ||
+            Array.isArray(dependencies) ||
+            dependencies[plan.filterPackage] !==
+                'workspace:*' ||
+            !Array.isArray(consumes) ||
+            !consumes.some((publication) => typeof publication === 'string' &&
+                publication.startsWith(`${plan.filterPackage}/`)) ||
+            (consumeApiContract !== undefined &&
+                (typeof consumeApiContract !== 'string' ||
+                    !consumeApiContract.startsWith(`${plan.filterPackage}/`)))) {
+            throw new Error('Blueprint verification Vitest filter lacks an exact cross-Slice consumption contract.');
+        }
+    }
+    if (!context.vitestConfig) {
+        const candidate = (0, node_path_1.join)(workspaceRoot, 'tools/blueprint-verification-vitest.config.mjs');
+        const metadata = (0, node_fs_1.lstatSync)(candidate);
+        if (metadata.isSymbolicLink() ||
+            !metadata.isFile() ||
+            metadata.nlink !== 1 ||
+            metadata.size <= 0 ||
+            metadata.size > 5 * 1024 * 1024 ||
+            (0, node_fs_1.realpathSync)(candidate) !== candidate ||
+            (0, node_fs_1.readFileSync)(candidate, 'utf8') !==
+                blueprint_verification_authority_js_1.BLUEPRINT_VERIFICATION_VITEST_CONFIG_SOURCE) {
+            throw new Error('Blueprint verification Vitest requires the exact managed configuration.');
+        }
+        context.vitestConfig = candidate;
+    }
+    const vitestConfig = context.vitestConfig;
+    const installed = contextInstalledTool(context, '.', rootManifest, 'vitest', 'vitest');
+    return {
+        installedTool: installed,
+        invocation: {
+            arguments: [
+                installed.binPath,
+                'run',
+                '--config',
+                vitestConfig,
+                '--root',
+                projectRoot,
+                plan.spec,
+            ],
+            command: node,
+            cwd: (0, node_path_1.join)(workspaceRoot, ...filter.root.split('/')),
+            nodeVersion: process.versions.node,
+            plan,
+            toolAuthority: installed.portable,
+        },
+        ...(nodeAuthority === undefined ? {} : { nodeAuthority }),
+    };
+}
+/**
+ * Resolves the exact structured invocation and portable package authority
+ * without starting a child. Receipt authentication and recurring execution
+ * use this same derivation so package-manager semantics cannot drift between
+ * the two routes.
+ */
+function resolveBlueprintVerificationExecution(input) {
+    return resolveInvocation(input, false).invocation;
+}
+function resolveBlueprintVerificationExecutions(inputs, readAuthorityFile = node_fs_1.readFileSync, resolutionHooks) {
+    if (inputs.length === 0 || inputs.length > 64 || !inputs[0]) {
+        throw new Error('Blueprint verification portable authority resolution requires 1-64 targets.');
+    }
+    const context = prepareResolutionContext(inputs[0].workspaceRoot, false, readAuthorityFile, resolutionHooks);
+    return inputs.map((input) => resolveInvocation(input, false, context).invocation);
+}
+function removePrivateExecutionEnvironment(privateRoot) {
+    (0, node_fs_1.rmSync)(privateRoot, { force: true, recursive: true });
+    if ((0, node_fs_1.existsSync)(privateRoot)) {
+        throw new Error('Blueprint verification private environment cleanup was incomplete.');
+    }
+}
+function withPrivateExecutionEnvironment(workspaceRoot, callback) {
+    const canonicalWorkspaceRoot = (0, node_fs_1.realpathSync)(workspaceRoot);
+    const canonicalTemporaryRoot = (0, node_fs_1.realpathSync)((0, node_os_1.tmpdir)());
+    const privateRoot = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)(canonicalTemporaryRoot, 'ebk-blueprint-execution-'));
+    try {
+        if (process.platform !== 'win32')
+            (0, node_fs_1.chmodSync)(privateRoot, 0o700);
+        const privateChild = (0, node_path_1.relative)(canonicalWorkspaceRoot, privateRoot);
+        const privateMetadata = (0, node_fs_1.lstatSync)(privateRoot);
+        if ((0, node_fs_1.realpathSync)(privateRoot) !== privateRoot ||
+            privateMetadata.isSymbolicLink() ||
+            !privateMetadata.isDirectory() ||
+            privateChild === '' ||
+            (privateChild !== '..' &&
+                !privateChild.startsWith(`..${node_path_1.sep}`) &&
+                !(0, node_path_1.isAbsolute)(privateChild)) ||
+            (process.platform !== 'win32' && (privateMetadata.mode & 0o777) !== 0o700)) {
+            throw new Error('Blueprint verification private environment must be outside the workspace.');
+        }
+    }
+    catch (error) {
+        (0, node_fs_1.rmSync)(privateRoot, { force: true, recursive: true });
+        throw error;
+    }
+    let directories;
+    const userConfig = (0, node_path_1.join)(privateRoot, 'npmrc');
+    const globalConfig = (0, node_path_1.join)(privateRoot, 'npmrc-global');
+    let pnpmConfig;
+    try {
+        directories = Object.fromEntries(['cache', 'config', 'data', 'home', 'state', 'temporary'].map((name) => {
+            const directory = (0, node_path_1.join)(privateRoot, name);
+            (0, node_fs_1.mkdirSync)(directory, { mode: 0o700 });
+            if (process.platform !== 'win32')
+                (0, node_fs_1.chmodSync)(directory, 0o700);
+            return [name, directory];
+        }));
+        if (process.platform === 'win32' &&
+            [
+                canonicalTemporaryRoot,
+                privateRoot,
+                ...Object.values(directories),
+                userConfig,
+                globalConfig,
+            ].some((value) => !(0, node_path_1.isAbsolute)(value) ||
+                value.includes(node_path_1.delimiter) ||
+                hasUnsafeWindowsPathCharacter(value))) {
+            throw new Error('Blueprint verification requires metacharacter-free Windows private paths.');
+        }
+        (0, node_fs_1.writeFileSync)(userConfig, '', { encoding: 'utf8', mode: 0o400 });
+        (0, node_fs_1.writeFileSync)(globalConfig, '', { encoding: 'utf8', mode: 0o400 });
+        const pnpmConfigDirectory = (0, node_path_1.join)(directories.config, 'pnpm');
+        (0, node_fs_1.mkdirSync)(pnpmConfigDirectory, { mode: 0o700 });
+        if (process.platform !== 'win32')
+            (0, node_fs_1.chmodSync)(pnpmConfigDirectory, 0o700);
+        pnpmConfig = (0, node_path_1.join)(pnpmConfigDirectory, 'config.yaml');
+        (0, node_fs_1.writeFileSync)(pnpmConfig, '', { encoding: 'utf8', mode: 0o400 });
+    }
+    catch (error) {
+        (0, node_fs_1.rmSync)(privateRoot, { force: true, recursive: true });
+        throw error;
+    }
+    const assertPrivateEnvironment = () => {
+        const rootMetadata = (0, node_fs_1.lstatSync)(privateRoot);
+        if ((0, node_fs_1.realpathSync)(privateRoot) !== privateRoot ||
+            rootMetadata.isSymbolicLink() ||
+            !rootMetadata.isDirectory() ||
+            (process.platform !== 'win32' && (rootMetadata.mode & 0o777) !== 0o700)) {
+            throw new Error('Blueprint verification private environment changed during execution.');
+        }
+        for (const directory of Object.values(directories)) {
+            const metadata = (0, node_fs_1.lstatSync)(directory);
+            if ((0, node_fs_1.realpathSync)(directory) !== directory ||
+                metadata.isSymbolicLink() ||
+                !metadata.isDirectory() ||
+                (process.platform !== 'win32' && (metadata.mode & 0o777) !== 0o700)) {
+                throw new Error('Blueprint verification private directory changed during execution.');
+            }
+        }
+        for (const configuration of [userConfig, globalConfig, pnpmConfig]) {
+            const metadata = (0, node_fs_1.lstatSync)(configuration);
+            if ((0, node_fs_1.realpathSync)(configuration) !== configuration ||
+                metadata.isSymbolicLink() ||
+                !metadata.isFile() ||
+                metadata.nlink !== 1 ||
+                metadata.size !== 0 ||
+                (0, node_fs_1.readFileSync)(configuration, 'utf8') !== '' ||
+                (process.platform !== 'win32' && (metadata.mode & 0o777) !== 0o400)) {
+                throw new Error('Blueprint verification private package-manager configuration changed during execution.');
+            }
+        }
+    };
+    try {
+        assertPrivateEnvironment();
+        const result = callback({
+            ...(0, blueprint_trust_process_js_1.controlledBlueprintTrustEnvironment)(),
+            COREPACK_ENABLE_DOWNLOAD_PROMPT: '0',
+            HOME: directories.home,
+            NPM_CONFIG_GLOBALCONFIG: globalConfig,
+            NPM_CONFIG_IGNORE_PNPMFILE: 'true',
+            NPM_CONFIG_NODE_OPTIONS: '',
+            NPM_CONFIG_SCRIPT_SHELL: '',
+            NPM_CONFIG_USERCONFIG: userConfig,
+            PNPM_CONFIG_IGNORE_PNPMFILE: 'true',
+            PNPM_CONFIG_NODE_OPTIONS: '',
+            PNPM_CONFIG_NPMRC_AUTH_FILE: userConfig,
+            PNPM_CONFIG_SCRIPT_SHELL: '',
+            TEMP: directories.temporary,
+            TMP: directories.temporary,
+            TMPDIR: directories.temporary,
+            USERPROFILE: directories.home,
+            XDG_CACHE_HOME: directories.cache,
+            XDG_CONFIG_HOME: directories.config,
+            XDG_DATA_HOME: directories.data,
+            XDG_STATE_HOME: directories.state,
+            npm_config_globalconfig: globalConfig,
+            npm_config_ignore_pnpmfile: 'true',
+            npm_config_node_options: '',
+            npm_config_script_shell: '',
+            npm_config_userconfig: userConfig,
+            pnpm_config_ignore_pnpmfile: 'true',
+            pnpm_config_node_options: '',
+            pnpm_config_npmrc_auth_file: userConfig,
+            pnpm_config_script_shell: '',
+        });
+        assertPrivateEnvironment();
+        return result;
+    }
+    finally {
+        try {
+            assertPrivateEnvironment();
+        }
+        finally {
+            removePrivateExecutionEnvironment(privateRoot);
+        }
+    }
+}
+function runBlueprintVerificationExecution(input, spawn = node_child_process_1.spawnSync, readAuthorityFile = node_fs_1.readFileSync) {
+    const { installedTool: tool, invocation, nodeAuthority, } = resolveInvocation(input, true, undefined, readAuthorityFile);
+    if (!nodeAuthority) {
+        throw new Error('Blueprint verification execution lacks Node authority.');
+    }
+    const assertAuthority = (rehash) => {
+        const nodeMetadata = (0, node_fs_1.lstatSync)(nodeAuthority.path);
+        if ((0, node_fs_1.realpathSync)(nodeAuthority.path) !== nodeAuthority.path ||
+            nodeMetadata.isSymbolicLink() ||
+            !nodeMetadata.isFile() ||
+            nodeMetadata.nlink !== 1 ||
+            nodeMetadata.size <= 0 ||
+            nodeMetadata.size > MAX_TOOL_BYTES ||
+            !sameFileIdentity(nodeAuthority.identity, fileIdentity(nodeMetadata)) ||
+            (rehash &&
+                (0, node_crypto_1.createHash)('sha256')
+                    .update(readAuthorityFile(nodeAuthority.path))
+                    .digest('hex') !== nodeAuthority.sha256)) {
+            throw new Error('Blueprint verification Node authority changed during execution.');
+        }
+        if (rehash && tool)
+            assertInstalledTool(tool, readAuthorityFile);
+        input.validateToolAuthority?.(invocation.toolAuthority);
+        input.assertAuthority?.(invocation);
+    };
+    assertAuthority(false);
+    const result = withPrivateExecutionEnvironment(input.workspaceRoot, (environment) => {
+        try {
+            return spawn(invocation.command, invocation.arguments, {
+                cwd: invocation.cwd,
+                encoding: 'utf8',
+                env: environment,
+                maxBuffer: 5 * 1024 * 1024,
+                shell: false,
+                timeout: input.timeoutMs ?? 10 * 60 * 1_000,
+                windowsHide: true,
+            });
+        }
+        finally {
+            assertAuthority(true);
+        }
+    });
+    return { invocation, result };
+}
+//# sourceMappingURL=blueprint-verification-execution.js.map