@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.11

package/src/supply-chain/inventory.js

@@ -0,0 +1,828 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPPLY_CHAIN_SUPPORTED_PLATFORMS = exports.SUPPLY_CHAIN_INVENTORY_SCHEMA_VERSION = void 0;
+exports.discoverLifecycleScripts = discoverLifecycleScripts;
+exports.workspacePackageGlobs = workspacePackageGlobs;
+exports.assertWorkspaceImporterCoverage = assertWorkspaceImporterCoverage;
+exports.deriveWorkspaceManifestPathsFromPnpmLock = deriveWorkspaceManifestPathsFromPnpmLock;
+exports.validateReviewedBuildPermissions = validateReviewedBuildPermissions;
+exports.validateLifecycleScriptInventory = validateLifecycleScriptInventory;
+exports.scanContainerImageAuthorities = scanContainerImageAuthorities;
+exports.scanContainerRecipe = scanContainerRecipe;
+exports.createSupplyChainInventory = createSupplyChainInventory;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const yaml_1 = require("yaml");
+const validation_js_1 = require("../validation.js");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+exports.SUPPLY_CHAIN_INVENTORY_SCHEMA_VERSION = 2;
+exports.SUPPLY_CHAIN_SUPPORTED_PLATFORMS = [
+    'darwin-arm64',
+    'darwin-x64',
+    'linux-arm64-glibc',
+    'linux-arm64-musl',
+    'linux-x64-glibc',
+    'linux-x64-musl',
+    'win32-arm64',
+    'win32-x64',
+];
+function discoverLifecycleScripts(packageMetadata) {
+    const discovered = new Map();
+    for (const [index, metadata] of packageMetadata.entries()) {
+        if (!(0, validation_js_1.isRecord)(metadata)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `packageMetadata[${index}]`, 'must be a package manifest object');
+        }
+        const scripts = (0, validation_js_1.isRecord)(metadata.scripts) ? metadata.scripts : {};
+        const lifecycle = ['preinstall', 'install', 'postinstall'].filter((name) => typeof scripts[name] === 'string');
+        if (lifecycle.length === 0)
+            continue;
+        if (typeof metadata.name !== 'string' ||
+            !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(metadata.name) ||
+            typeof metadata.version !== 'string' ||
+            metadata.version.trim() === '') {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `packageMetadata[${index}]`, 'a package with lifecycle code must expose exact name and version metadata');
+        }
+        const identity = `${metadata.name}@${metadata.version}`;
+        const existing = discovered.get(identity);
+        if (existing &&
+            existing.scripts.join('\0') !== lifecycle.sort().join('\0')) {
+            throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `packageMetadata[${index}]`, `${identity} has conflicting installed lifecycle metadata`);
+        }
+        discovered.set(identity, {
+            package: metadata.name,
+            scripts: lifecycle.sort(),
+            version: metadata.version,
+        });
+    }
+    return [...discovered.values()].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.package}\0${left.version}`, `${right.package}\0${right.version}`));
+}
+function manifestImporter(path) {
+    if (path === 'package.json')
+        return '.';
+    if (!path.endsWith('/package.json') || path.startsWith('/')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'manifest path must be repository-relative and end with package.json');
+    }
+    const importer = path.slice(0, -'/package.json'.length);
+    if (importer
+        .split('/')
+        .some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'manifest path contains an unsafe segment');
+    }
+    return importer;
+}
+function dependencySections() {
+    return [
+        ['dependencies', 'production'],
+        ['devDependencies', 'development'],
+        ['optionalDependencies', 'optional'],
+        ['peerDependencies', 'peer'],
+    ];
+}
+function lockSection(scope) {
+    switch (scope) {
+        case 'development':
+            return 'devDependencies';
+        case 'optional':
+            return 'optionalDependencies';
+        case 'peer':
+            return 'peerDependencies';
+        case 'production':
+            return 'dependencies';
+    }
+}
+function requirePackageManager(manifest, nodeVersion) {
+    if (typeof manifest.packageManager !== 'string' ||
+        !/^pnpm@\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\+sha512\.[a-f0-9]{128}$/.test(manifest.packageManager)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'package.json#packageManager', 'must pin an exact pnpm version and Corepack SHA-512 artifact digest');
+    }
+    const engines = manifest.engines;
+    if (!(0, validation_js_1.isRecord)(engines) ||
+        typeof engines.node !== 'string' ||
+        engines.node.trim() === '') {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'package.json#engines.node', 'must declare the supported Node.js version policy');
+    }
+    if (!/^\d+\.\d+\.\d+$/.test(nodeVersion)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', '.node-version', 'must pin one exact Node.js patch version');
+    }
+    return { node: nodeVersion, packageManager: manifest.packageManager };
+}
+function parseLockfile(lockfile) {
+    let value;
+    try {
+        value = (0, yaml_1.parse)(lockfile);
+    }
+    catch (error) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-lock.yaml', `cannot be parsed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!(0, validation_js_1.isRecord)(value) ||
+        !['9.0', 9].includes(value.lockfileVersion) ||
+        !(0, validation_js_1.isRecord)(value.importers) ||
+        !(0, validation_js_1.isRecord)(value.packages)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-lock.yaml', `must be a complete pnpm lockfile v9 (version=${String((0, validation_js_1.isRecord)(value) ? value.lockfileVersion : undefined)}, importers=${String((0, validation_js_1.isRecord)(value) && (0, validation_js_1.isRecord)(value.importers))}, packages=${String((0, validation_js_1.isRecord)(value) && (0, validation_js_1.isRecord)(value.packages))})`);
+    }
+    return value;
+}
+const MAX_WORKSPACE_IMPORTERS = 2_000;
+const MAX_WORKSPACE_IMPORTER_LENGTH = 1_024;
+const MAX_WORKSPACE_IMPORTER_SEGMENT_LENGTH = 255;
+const WINDOWS_RESERVED_WORKSPACE_SEGMENT = /^(?:aux|con|nul|prn|com[1-9]|lpt[1-9])(?:\..*)?$/iu;
+function hasControlCharacter(value) {
+    return [...value].some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint <= 0x1f || codePoint === 0x7f;
+    });
+}
+function workspaceManifestPath(importer) {
+    if (importer === '.')
+        return 'package.json';
+    const segments = importer.split('/');
+    if (importer.length === 0 ||
+        Buffer.byteLength(importer, 'utf8') > MAX_WORKSPACE_IMPORTER_LENGTH ||
+        importer.startsWith('/') ||
+        importer.endsWith('/') ||
+        importer.includes('\\') ||
+        /^[A-Za-z]:/u.test(importer) ||
+        hasControlCharacter(importer) ||
+        segments.some((segment) => segment === '' ||
+            segment === '.' ||
+            segment === '..' ||
+            Buffer.byteLength(segment, 'utf8') >
+                MAX_WORKSPACE_IMPORTER_SEGMENT_LENGTH ||
+            /[<>:"|?*]/u.test(segment) ||
+            /[. ]$/u.test(segment) ||
+            WINDOWS_RESERVED_WORKSPACE_SEGMENT.test(segment))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `pnpm-lock.yaml#importers.${importer}`, 'workspace importer must be one bounded repository-relative POSIX path');
+    }
+    return `${importer}/package.json`;
+}
+/**
+ * Returns the declared workspace package globs so a caller can enumerate the
+ * manifests that must appear as lockfile importers.
+ */
+function workspacePackageGlobs(workspacePolicy) {
+    let parsed;
+    try {
+        parsed = (0, yaml_1.parse)(workspacePolicy);
+    }
+    catch (error) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-workspace.yaml', `cannot be parsed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const packages = (0, validation_js_1.isRecord)(parsed) ? parsed.packages : undefined;
+    if (!Array.isArray(packages) ||
+        packages.length === 0 ||
+        packages.length > MAX_WORKSPACE_IMPORTERS ||
+        packages.some((entry) => typeof entry !== 'string' ||
+            entry.trim() === '' ||
+            entry !== entry.trim() ||
+            entry.startsWith('/') ||
+            entry.split('/').includes('..'))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-workspace.yaml#packages', 'must declare bounded relative workspace package globs');
+    }
+    return packages;
+}
+/**
+ * Fails closed when a manifest the workspace globs select is absent from the
+ * lockfile importers. Deriving the manifest inventory from the importers
+ * alone cannot observe that drift: a manifest stripped from the lockfile
+ * simply disappears from the inventory instead of being reported.
+ */
+function assertWorkspaceImporterCoverage(discoveredManifestPaths, importerManifestPaths) {
+    const importers = new Set(importerManifestPaths);
+    const missing = [...new Set(discoveredManifestPaths)]
+        .filter((path) => !importers.has(path))
+        .sort(deterministic_order_js_1.compareUtf16);
+    if (missing.length > 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-lock-drift', 'pnpm-lock.yaml#importers', `is missing the importer for ${missing.join(', ')}`);
+    }
+}
+/**
+ * Derives the exact manifest inventory from a complete pnpm lockfile rather
+ * than executing a package manager selected from ambient PATH.
+ */
+function deriveWorkspaceManifestPathsFromPnpmLock(lockfileSource) {
+    const lockfile = parseLockfile(lockfileSource);
+    const importers = lockfile.importers;
+    const entries = Object.entries(importers).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right));
+    if (entries.length === 0 || entries.length > MAX_WORKSPACE_IMPORTERS) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-lock.yaml#importers', `must contain from 1 through ${MAX_WORKSPACE_IMPORTERS} workspace importers`);
+    }
+    if (!Object.prototype.hasOwnProperty.call(importers, '.')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', 'pnpm-lock.yaml#importers', 'must contain the root workspace importer');
+    }
+    const paths = entries.map(([importer, value]) => {
+        if (!(0, validation_js_1.isRecord)(value)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `pnpm-lock.yaml#importers.${importer}`, 'workspace importer must be an object');
+        }
+        return workspaceManifestPath(importer);
+    });
+    const portableIdentities = new Set();
+    for (const path of paths) {
+        const identity = path.normalize('NFC').toLowerCase();
+        if (portableIdentities.has(identity)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-lock.yaml#importers', 'workspace importers must not alias on supported filesystems');
+        }
+        portableIdentities.add(identity);
+    }
+    return paths;
+}
+function collectDependencies(manifests, lockfile) {
+    const importers = lockfile.importers;
+    const entries = [];
+    for (const [manifestPath, manifestValue] of Object.entries(manifests).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))) {
+        if (!(0, validation_js_1.isRecord)(manifestValue)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', manifestPath, 'package manifest must be an object');
+        }
+        const importerName = manifestImporter(manifestPath);
+        const importer = importers[importerName];
+        if (!(0, validation_js_1.isRecord)(importer)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-lock-drift', `pnpm-lock.yaml#importers.${importerName}`, `is missing the importer for ${manifestPath}`);
+        }
+        for (const [manifestSection, scope] of dependencySections()) {
+            const declared = manifestValue[manifestSection];
+            if (declared === undefined)
+                continue;
+            if (!(0, validation_js_1.isRecord)(declared)) {
+                throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${manifestPath}#${manifestSection}`, 'must be an object');
+            }
+            const locked = importer[lockSection(scope)];
+            if (!(0, validation_js_1.isRecord)(locked) && Object.keys(declared).length > 0) {
+                throw new errors_js_1.SupplyChainError('supply-chain-lock-drift', `pnpm-lock.yaml#importers.${importerName}.${lockSection(scope)}`, 'is missing declared dependencies');
+            }
+            for (const [dependency, specifier] of Object.entries(declared).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))) {
+                if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(dependency) ||
+                    typeof specifier !== 'string' ||
+                    specifier.trim() === '') {
+                    throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${manifestPath}#${manifestSection}.${dependency}`, 'must be a valid package name and non-empty specifier');
+                }
+                const lockEntry = (0, validation_js_1.isRecord)(locked) ? locked[dependency] : undefined;
+                if (!(0, validation_js_1.isRecord)(lockEntry) ||
+                    lockEntry.specifier !== specifier ||
+                    typeof lockEntry.version !== 'string' ||
+                    lockEntry.version.trim() === '') {
+                    throw new errors_js_1.SupplyChainError('supply-chain-lock-drift', `pnpm-lock.yaml#importers.${importerName}.${lockSection(scope)}.${dependency}`, `does not exactly bind manifest specifier ${specifier}`);
+                }
+                entries.push({
+                    importer: importerName,
+                    name: dependency,
+                    resolved: lockEntry.version,
+                    scope,
+                    specifier,
+                });
+            }
+        }
+    }
+    return entries.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)([
+        left.importer,
+        left.scope,
+        left.name,
+        left.specifier,
+        left.resolved,
+    ].join('\0'), [
+        right.importer,
+        right.scope,
+        right.name,
+        right.specifier,
+        right.resolved,
+    ].join('\0')));
+}
+function parseLockPackageIdentity(lockKey) {
+    const withoutPeers = lockKey.replace(/\(.+$/, '');
+    const separator = withoutPeers.lastIndexOf('@');
+    if (separator <= 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `pnpm-lock.yaml#packages.${lockKey}`, 'cannot derive package name and exact version from lock key');
+    }
+    const name = withoutPeers.slice(0, separator);
+    const version = withoutPeers.slice(separator + 1);
+    if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(name) ||
+        version.length === 0 ||
+        /^(?:link|workspace|file):/.test(version)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `pnpm-lock.yaml#packages.${lockKey}`, 'must identify a registry package and exact resolved version');
+    }
+    return { name, version };
+}
+function packageDependencyReference(value, path) {
+    const separator = value.startsWith('@')
+        ? value.indexOf('@', value.indexOf('/') + 1)
+        : value.indexOf('@');
+    const name = value.slice(0, separator);
+    const reference = value.slice(separator + 1);
+    if (separator <= 0 ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(name) ||
+        reference.trim() === '') {
+        throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', path, 'must identify a package name and exact lock reference');
+    }
+    return { name, reference };
+}
+function effectivePackagePlatforms(roots, packages) {
+    const byLockKey = new Map(packages.map((entry) => [entry.lockKey, entry]));
+    const byIdentity = new Map();
+    for (const entry of packages) {
+        const identity = `${entry.name}\0${entry.version}`;
+        byIdentity.set(identity, [...(byIdentity.get(identity) ?? []), entry]);
+    }
+    const targetFor = (name, reference, path) => {
+        if (/^(?:file|link|workspace):/.test(reference))
+            return undefined;
+        let targetName = name;
+        let targetReference = reference;
+        if (reference.startsWith('npm:')) {
+            const alias = packageDependencyReference(reference.slice(4), path);
+            targetName = alias.name;
+            targetReference = alias.reference;
+        }
+        const exact = byLockKey.get(`${targetName}@${targetReference}`);
+        if (exact)
+            return exact;
+        const aliasSeparator = targetReference.startsWith('@')
+            ? targetReference.indexOf('@', targetReference.indexOf('/') + 1)
+            : targetReference.indexOf('@');
+        const aliasName = targetReference.slice(0, aliasSeparator);
+        const aliasReference = targetReference.slice(aliasSeparator + 1);
+        if (aliasSeparator > 0 &&
+            common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(aliasName) &&
+            aliasReference.trim() !== '') {
+            targetName = aliasName;
+            targetReference = aliasReference;
+            const aliased = byLockKey.get(`${targetName}@${targetReference}`);
+            if (aliased)
+                return aliased;
+        }
+        const peerlessReference = targetReference.replace(/\(.+$/, '');
+        const candidates = byIdentity.get(`${targetName}\0${peerlessReference}`) ?? [];
+        if (candidates.length !== 1) {
+            throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', path, candidates.length === 0
+                ? `has no package snapshot for ${targetName}@${targetReference}`
+                : `does not select one exact peer context for ${targetName}@${targetReference}`);
+        }
+        return candidates[0];
+    };
+    const effective = new Map();
+    const queue = [];
+    const include = (entry, platforms) => {
+        const current = effective.get(entry.lockKey) ?? new Set();
+        const previousSize = current.size;
+        for (const platform of platforms) {
+            if (entry.applicablePlatforms.includes(platform))
+                current.add(platform);
+        }
+        effective.set(entry.lockKey, current);
+        if (current.size !== previousSize)
+            queue.push(entry.lockKey);
+    };
+    for (const [index, root] of roots.entries()) {
+        const target = targetFor(root.name, root.resolved, `dependencies[${index}].resolved`);
+        if (target)
+            include(target, target.applicablePlatforms);
+    }
+    for (let index = 0; index < queue.length; index += 1) {
+        const parentKey = queue[index];
+        const parent = parentKey ? byLockKey.get(parentKey) : undefined;
+        if (!parent)
+            continue;
+        const parentPlatforms = effective.get(parent.lockKey) ?? new Set();
+        for (const [dependencyIndex, dependency] of parent.dependencies.entries()) {
+            const parsed = packageDependencyReference(dependency, `pnpm-lock.yaml#snapshots.${parent.lockKey}.dependencies[${dependencyIndex}]`);
+            const child = targetFor(parsed.name, parsed.reference, `pnpm-lock.yaml#snapshots.${parent.lockKey}.dependencies[${dependencyIndex}]`);
+            if (child)
+                include(child, [...parentPlatforms]);
+        }
+    }
+    return packages.map((entry) => {
+        const platforms = effective.get(entry.lockKey) ?? new Set();
+        return {
+            ...entry,
+            applicablePlatforms: exports.SUPPLY_CHAIN_SUPPORTED_PLATFORMS.filter((platform) => platforms.has(platform)),
+        };
+    });
+}
+function collectResolvedPackages(lockfile, roots) {
+    const packages = lockfile.packages;
+    const snapshots = (0, validation_js_1.isRecord)(lockfile.snapshots) ? lockfile.snapshots : {};
+    const packageMetadata = new Map();
+    for (const [packageKey, metadata] of Object.entries(packages).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))) {
+        if (packageKey.replace(/\(.+$/, '') !== packageKey) {
+            throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `pnpm-lock.yaml#packages.${packageKey}`, 'package metadata keys must be peerless; peer contexts belong in snapshots');
+        }
+        parseLockPackageIdentity(packageKey);
+        if (!(0, validation_js_1.isRecord)(metadata) ||
+            !(0, validation_js_1.isRecord)(metadata.resolution) ||
+            typeof metadata.resolution.integrity !== 'string' ||
+            !/^sha512-[A-Za-z0-9+/]{43,}={0,2}$/.test(metadata.resolution.integrity)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `pnpm-lock.yaml#packages.${packageKey}.resolution.integrity`, 'registry package must retain its SHA-512 integrity');
+        }
+        packageMetadata.set(packageKey, {
+            applicablePlatforms: supportedPackagePlatforms(metadata, `pnpm-lock.yaml#packages.${packageKey}`),
+            integrity: metadata.resolution.integrity,
+        });
+    }
+    const coveredPackageKeys = new Set();
+    const resolvedPackages = Object.entries(snapshots)
+        .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
+        .map(([lockKey, snapshot]) => {
+        const packageKey = lockKey.replace(/\(.+$/, '');
+        const identity = parseLockPackageIdentity(lockKey);
+        const metadata = packageMetadata.get(packageKey);
+        if (!metadata) {
+            throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `pnpm-lock.yaml#snapshots.${lockKey}`, `peer context has no exact peerless package metadata at packages.${packageKey}`);
+        }
+        const packageIdentity = parseLockPackageIdentity(packageKey);
+        if (packageIdentity.name !== identity.name ||
+            packageIdentity.version !== identity.version ||
+            !(0, validation_js_1.isRecord)(snapshot)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `pnpm-lock.yaml#snapshots.${lockKey}`, 'must be an object that resolves to the same peerless package identity');
+        }
+        coveredPackageKeys.add(packageKey);
+        const dependencies = ['dependencies', 'optionalDependencies'].flatMap((section) => {
+            const entries = snapshot[section];
+            if (entries === undefined)
+                return [];
+            if (!(0, validation_js_1.isRecord)(entries)) {
+                throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `pnpm-lock.yaml#snapshots.${lockKey}.${section}`, 'must be an exact dependency map');
+            }
+            return Object.entries(entries)
+                .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
+                .map(([name, version]) => {
+                if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(name) ||
+                    typeof version !== 'string' ||
+                    version.trim() === '') {
+                    throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `pnpm-lock.yaml#snapshots.${lockKey}.${section}.${name}`, 'must bind a package name to one exact lock reference');
+                }
+                return `${name}@${version}`;
+            });
+        });
+        return {
+            applicablePlatforms: metadata.applicablePlatforms,
+            dependencies: [...new Set(dependencies)].sort(),
+            integrity: metadata.integrity,
+            lockKey,
+            ...identity,
+        };
+    });
+    for (const packageKey of packageMetadata.keys()) {
+        if (!coveredPackageKeys.has(packageKey)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `pnpm-lock.yaml#packages.${packageKey}`, 'peerless package metadata has no exact dependency snapshot');
+        }
+    }
+    return effectivePackagePlatforms(roots, resolvedPackages);
+}
+function platformParts(platform) {
+    const [os, cpu, libc] = platform.split('-');
+    return {
+        cpu: cpu ?? '',
+        ...(libc ? { libc } : {}),
+        os: os ?? '',
+    };
+}
+function packageConstraint(metadata, field, path) {
+    const value = metadata[field];
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) ||
+        value.length === 0 ||
+        value.some((entry) => typeof entry !== 'string' ||
+            !/^!?[a-z0-9][a-z0-9._-]{0,31}$/.test(entry)) ||
+        new Set(value).size !== value.length) {
+        throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', `${path}.${field}`, 'must be a unique bounded package-platform constraint list');
+    }
+    return value;
+}
+function constraintMatches(constraints, actual) {
+    if (constraints.length === 0)
+        return true;
+    const excluded = new Set(constraints
+        .filter((value) => value.startsWith('!'))
+        .map((value) => value.slice(1)));
+    if (actual !== undefined && excluded.has(actual))
+        return false;
+    const included = constraints.filter((value) => !value.startsWith('!'));
+    return (included.length === 0 || (actual !== undefined && included.includes(actual)));
+}
+function supportedPackagePlatforms(metadata, path) {
+    const cpu = packageConstraint(metadata, 'cpu', path);
+    const libc = packageConstraint(metadata, 'libc', path);
+    const os = packageConstraint(metadata, 'os', path);
+    return exports.SUPPLY_CHAIN_SUPPORTED_PLATFORMS.filter((platform) => {
+        const candidate = platformParts(platform);
+        return (constraintMatches(os, candidate.os) &&
+            constraintMatches(cpu, candidate.cpu) &&
+            constraintMatches(libc, candidate.libc));
+    });
+}
+function parseWorkspacePolicy(value) {
+    let parsed;
+    try {
+        parsed = (0, yaml_1.parse)(value);
+    }
+    catch (error) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-workspace.yaml', `cannot be parsed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!(0, validation_js_1.isRecord)(parsed)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-workspace.yaml', 'must be an object');
+    }
+    const allowBuilds = parsed.allowBuilds;
+    if (allowBuilds !== undefined && !(0, validation_js_1.isRecord)(allowBuilds)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-workspace.yaml#allowBuilds', 'must be an exact package-to-boolean map');
+    }
+    const normalized = {};
+    for (const [name, allowed] of Object.entries(allowBuilds ?? {}).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))) {
+        if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(name) || allowed !== true) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `pnpm-workspace.yaml#allowBuilds.${name}`, 'must name an exact package allowed with the boolean true');
+        }
+        normalized[name] = true;
+    }
+    return {
+        allowBuilds: normalized,
+        strictDepBuilds: parsed.strictDepBuilds === true,
+    };
+}
+function validateReviewedBuildPermissions(workspacePolicy, permissions) {
+    const policy = parseWorkspacePolicy(workspacePolicy);
+    const reviewed = new Map();
+    for (const [index, permission] of permissions.entries()) {
+        if (!permission ||
+            typeof permission !== 'object' ||
+            !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(permission.package) ||
+            typeof permission.approvedAt !== 'string' ||
+            new Date(permission.approvedAt).toISOString() !== permission.approvedAt ||
+            [permission.owner, permission.rationale, permission.workItem].some((entry) => typeof entry !== 'string' ||
+                entry.trim() === '' ||
+                entry !== entry.trim()) ||
+            reviewed.has(permission.package)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-script-unreviewed', `buildPermissions[${index}]`, 'must be a unique, attributable exact-package approval');
+        }
+        reviewed.set(permission.package, permission);
+    }
+    for (const name of Object.keys(policy.allowBuilds)) {
+        if (!reviewed.has(name)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-script-unreviewed', `pnpm-workspace.yaml#allowBuilds.${name}`, 'has no owner, rationale, approval time, and work item');
+        }
+    }
+    for (const name of reviewed.keys()) {
+        if (!policy.allowBuilds[name]) {
+            throw new errors_js_1.SupplyChainError('supply-chain-script-unreviewed', `buildPermissions.${name}`, 'does not correspond to an active allowBuilds entry');
+        }
+    }
+}
+function validateLifecycleScriptInventory(lifecycleScripts, workspacePolicy) {
+    const { allowBuilds, strictDepBuilds } = parseWorkspacePolicy(workspacePolicy);
+    if (!strictDepBuilds) {
+        throw new errors_js_1.SupplyChainError('supply-chain-script-unreviewed', 'pnpm-workspace.yaml#strictDepBuilds', 'must equal true so newly introduced dependency scripts fail closed');
+    }
+    const seen = new Set();
+    for (const [index, entry] of lifecycleScripts.entries()) {
+        if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(entry.package) ||
+            typeof entry.version !== 'string' ||
+            entry.version.trim() === '' ||
+            entry.scripts.length === 0 ||
+            entry.scripts.some((script) => !['preinstall', 'install', 'postinstall'].includes(script)) ||
+            new Set(entry.scripts).size !== entry.scripts.length ||
+            seen.has(`${entry.package}@${entry.version}`)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `lifecycleScripts[${index}]`, 'must uniquely identify exact packages and declared lifecycle hooks');
+        }
+        seen.add(`${entry.package}@${entry.version}`);
+        if (!allowBuilds[entry.package]) {
+            throw new errors_js_1.SupplyChainError('supply-chain-script-unreviewed', `lifecycleScripts[${index}]`, `${entry.package}@${entry.version} has lifecycle code but is not reviewed in allowBuilds`);
+        }
+    }
+}
+function dockerfileInstructions(path, source) {
+    if (source.includes('\0')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'container recipe contains a NUL byte');
+    }
+    const instructions = [];
+    let pending = '';
+    let pendingLine = 0;
+    for (const [index, raw] of source
+        .replace(/\r\n/g, '\n')
+        .split('\n')
+        .entries()) {
+        const trimmed = raw.trim();
+        if (pending === '' && (trimmed === '' || trimmed.startsWith('#')))
+            continue;
+        if (pending === '')
+            pendingLine = index + 1;
+        const trailingBackslashes = /\\+$/.exec(trimmed)?.[0].length ?? 0;
+        const continued = trailingBackslashes % 2 === 1;
+        const fragment = continued ? trimmed.slice(0, -1).trimEnd() : trimmed;
+        pending = pending === '' ? fragment : `${pending} ${fragment}`;
+        if (continued)
+            continue;
+        if (/\s<<[-~]?\s*['"]?[^\s'"]+['"]?(?:\s|$)/u.test(pending)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#line[${pendingLine}]`, 'Blueprint container recipes may not use heredoc instructions');
+        }
+        instructions.push({ line: pendingLine, value: pending });
+        pending = '';
+    }
+    if (pending !== '') {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#line[${pendingLine}]`, 'container recipe ends inside a continued instruction');
+    }
+    return instructions;
+}
+function pinnedContainerImage(reference, label) {
+    if (!/^[a-z0-9][a-z0-9._/-]*:[A-Za-z0-9._-]+@sha256:[a-f0-9]{64}$/.test(reference)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', label, 'container image authority must retain a readable tag and pin a lowercase SHA-256 digest');
+    }
+    return reference;
+}
+function externalImageAuthority(reference, stages, stageCount, label) {
+    if (/^\d+$/u.test(reference)) {
+        const index = Number(reference);
+        if (Number.isSafeInteger(index) && index >= 0 && index < stageCount) {
+            return undefined;
+        }
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', label, 'container stage index does not identify a prior stage');
+    }
+    if (stages.has(reference.toLowerCase()))
+        return undefined;
+    return pinnedContainerImage(reference, label);
+}
+function scanContainerImageAuthorities(path, source) {
+    const authorities = [];
+    if (source.startsWith('\uFEFF')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#encoding`, 'container recipe must not use a byte-order mark that can alter parser-directive recognition');
+    }
+    const escapeDirectives = [
+        ...source.matchAll(/^\s*#\s*escape\s*=\s*(\S+)\s*$/gim),
+    ];
+    if (escapeDirectives.length > 1) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#escape`, 'container recipe must declare at most one escape parser directive');
+    }
+    if (escapeDirectives.length === 1 && escapeDirectives[0]?.[1] !== '\\') {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#escape`, 'Blueprint container recipes must use the default backslash escape so image-authority parsing cannot diverge from Docker');
+    }
+    const syntaxDirectives = [
+        ...source.matchAll(/^\s*#\s*syntax\s*=\s*(\S+)\s*$/gim),
+    ];
+    if (syntaxDirectives.length > 1) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#syntax`, 'container recipe must declare at most one syntax frontend');
+    }
+    for (const [index, directive] of syntaxDirectives.entries()) {
+        const value = (directive[1] ?? '').replace(/^docker-image:\/\//u, '');
+        const reference = pinnedContainerImage(value, `${path}#syntax[${index}]`);
+        authorities.push({ instruction: 'syntax', reference });
+    }
+    const stages = new Set();
+    let stageCount = 0;
+    for (const { line, value } of dockerfileInstructions(path, source)) {
+        const instruction = value.replace(/^ONBUILD\s+/iu, '');
+        if (/^FROM\b/iu.test(instruction)) {
+            const match = /^FROM\s+(?:(?:--platform=\S+)\s+)*(\S+)(?:\s+AS\s+([A-Za-z0-9][A-Za-z0-9._-]{0,127}))?$/iu.exec(instruction);
+            if (!match) {
+                throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#line[${line}]`, 'container FROM instruction is not in the supported exact form');
+            }
+            const base = match[1] ?? '';
+            const external = externalImageAuthority(base, stages, stageCount, `${path}#FROM[${stageCount}]`);
+            if (external)
+                authorities.push({ instruction: 'FROM', reference: external });
+            const alias = match[2]?.toLowerCase();
+            if (alias) {
+                if (/^\d+$/u.test(alias) || stages.has(alias)) {
+                    throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#FROM[${stageCount}]`, 'container stage aliases must be unique non-numeric identities');
+                }
+                stages.add(alias);
+            }
+            stageCount += 1;
+            continue;
+        }
+        if (/^COPY\b/iu.test(instruction)) {
+            const fromTokens = [...instruction.matchAll(/(?:^|\s)--from=(\S+)/giu)];
+            if (/--from\b/iu.test(instruction) && fromTokens.length !== 1) {
+                throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#line[${line}]`, 'container COPY --from must name one exact prior stage or image');
+            }
+            if (fromTokens.length === 1) {
+                const external = externalImageAuthority(fromTokens[0]?.[1] ?? '', stages, stageCount, `${path}#COPY-from[line-${line}]`);
+                if (external)
+                    authorities.push({ instruction: 'COPY', reference: external });
+            }
+        }
+        if (/^RUN\b/iu.test(instruction)) {
+            for (const [mountIndex, mount] of [
+                ...instruction.matchAll(/(?:^|\s)--mount=([^\s]+)/giu),
+            ].entries()) {
+                const from = (mount[1] ?? '')
+                    .split(',')
+                    .filter((field) => field.startsWith('from='));
+                if (from.length > 1) {
+                    throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}#RUN-mount[${mountIndex}]`, 'container RUN mount must name at most one image or prior stage');
+                }
+                if (from.length === 1) {
+                    const external = externalImageAuthority(from[0]?.slice('from='.length) ?? '', stages, stageCount, `${path}#RUN-mount[${mountIndex}]`);
+                    if (external) {
+                        authorities.push({ instruction: 'RUN-mount', reference: external });
+                    }
+                }
+            }
+        }
+    }
+    if (!authorities.some(({ instruction }) => instruction === 'FROM')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'container recipe contains no external FROM image authority');
+    }
+    return authorities;
+}
+function scanContainerRecipe(path, source) {
+    const authorities = scanContainerImageAuthorities(path, source);
+    for (const [index, directive] of [
+        ...source.matchAll(/^\s*#\s*syntax\s*=\s*(\S+)\s*$/gim),
+    ].entries()) {
+        if (!/@sha256:[a-f0-9]{64}$/.test(directive[1] ?? '')) {
+            throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', `${path}#syntax[${index}]`, 'Dockerfile frontend directives must pin an exact SHA-256 digest');
+        }
+    }
+    const bases = authorities
+        .filter(({ instruction }) => instruction === 'FROM')
+        .map(({ reference }) => reference);
+    if (/(?:^|\s)npm\s+(?:i|install|ci)(?:\s|$)/im.test(source)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', path, 'npm installation may re-resolve outside the reviewed pnpm lockfile');
+    }
+    if (/\bcorepack\s+enable\b/i.test(source)) {
+        const descriptors = [
+            ...source.matchAll(/\bcorepack\s+prepare\s+(pnpm@\S+)\s+--activate\b/gim),
+        ].map((match) => match[1] ?? '');
+        if (descriptors.length !== 1 ||
+            !/^pnpm@\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\+sha512\.[a-f0-9]{128}$/.test(descriptors[0] ?? '')) {
+            throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', `${path}#corepack`, 'Corepack must install one exact pnpm artifact with a SHA-512 descriptor');
+        }
+    }
+    const fetchCommands = [
+        ...source.matchAll(/^\s*RUN\s+.*\bpnpm\b.*\bfetch\b.*$/gim),
+    ].map(([command]) => command ?? '');
+    for (const command of fetchCommands) {
+        if (!command.includes('--frozen-lockfile')) {
+            throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', path, 'pnpm fetch must retain the reviewed lockfile');
+        }
+    }
+    for (const install of source.matchAll(/^\s*RUN\s+.*\bpnpm\b.*\binstall\b.*$/gim)) {
+        const command = install[0] ?? '';
+        if (!command.includes('--frozen-lockfile') ||
+            !command.includes('--offline')) {
+            throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', path, 'pnpm install must be both frozen and offline after lockfile fetch');
+        }
+    }
+    for (const deploy of source.matchAll(/^\s*RUN\s+.*\bpnpm\b.*\bdeploy\b.*$/gim)) {
+        const command = deploy[0] ?? '';
+        if (!/^\s*RUN\s+--network=none(?:\s|$)/i.test(command) ||
+            !command.includes('--prod') ||
+            !command.includes('--offline') ||
+            !command.includes('--frozen-lockfile') ||
+            !command.includes('--trust-lockfile') ||
+            !fetchCommands.some((fetch) => fetch.includes('--frozen-lockfile')) ||
+            command.includes('--legacy')) {
+            throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', path, 'pnpm deploy must trust one previously verified frozen lockfile and assemble its offline production closure with BuildKit network access disabled');
+        }
+    }
+    return {
+        bases,
+        path,
+        recipeDigest: (0, common_js_1.supplyChainDigest)(source.replace(/\r\n/g, '\n')),
+    };
+}
+function createSupplyChainInventory(input) {
+    const lockfile = parseLockfile(input.lockfile);
+    const rootManifest = input.manifests['package.json'];
+    if (!(0, validation_js_1.isRecord)(rootManifest)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', 'package.json', 'root manifest is required');
+    }
+    const toolchain = requirePackageManager(rootManifest, input.nodeVersion);
+    const dependencies = collectDependencies(input.manifests, lockfile);
+    const resolvedPackages = collectResolvedPackages(lockfile, dependencies);
+    validateLifecycleScriptInventory(input.lifecycleScripts ?? [], input.workspacePolicy);
+    const containers = Object.entries(input.containers ?? {})
+        .sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))
+        .map(([path, source]) => scanContainerRecipe(path, source));
+    const registries = [...(input.registries ?? ['https://registry.npmjs.org'])]
+        .sort()
+        .filter((entry, index, values) => index === 0 || entry !== values[index - 1]);
+    if (registries.length === 0 ||
+        registries.some((registry) => !/^https:\/\/[A-Za-z0-9.-]+(?::\d+)?(?:\/[A-Za-z0-9._~/-]*)?$/.test(registry))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'registries', 'must contain explicit HTTPS registry origins');
+    }
+    for (const [index, tool] of (input.downloadedTools ?? []).entries()) {
+        if (!common_js_1.SUPPLY_CHAIN_SHA256.test(tool.digest) ||
+            [tool.name, tool.source, tool.version].some((value) => typeof value !== 'string' || value.trim() === '') ||
+            !/^https:\/\//.test(tool.source)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `downloadedTools[${index}]`, 'must bind a named version to an HTTPS source and SHA-256 digest');
+        }
+    }
+    for (const [index, vendored] of (input.vendoredInputs ?? []).entries()) {
+        if (!common_js_1.SUPPLY_CHAIN_SHA256.test(vendored.sha256) ||
+            [vendored.identity, vendored.revision].some((value) => typeof value !== 'string' || value.trim() === '')) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `vendoredInputs[${index}]`, 'must bind identity and immutable revision to a SHA-256 digest');
+        }
+    }
+    return {
+        containers,
+        dependencies,
+        downloadedTools: [...(input.downloadedTools ?? [])].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.name}\0${left.version}`, `${right.name}\0${right.version}`)),
+        lifecycleScripts: [...(input.lifecycleScripts ?? [])]
+            .map((entry) => ({ ...entry, scripts: [...entry.scripts].sort() }))
+            .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.package}\0${left.version}`, `${right.package}\0${right.version}`)),
+        lockfileDigest: (0, common_js_1.supplyChainDigest)(input.lockfile.replace(/\r\n/g, '\n')),
+        nodeVersion: toolchain.node,
+        packageManager: toolchain.packageManager,
+        registries,
+        resolvedPackages,
+        schemaVersion: exports.SUPPLY_CHAIN_INVENTORY_SCHEMA_VERSION,
+        vendoredInputs: [...(input.vendoredInputs ?? [])].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.identity}\0${left.revision}`, `${right.identity}\0${right.revision}`)),
+    };
+}
+//# sourceMappingURL=inventory.js.map