@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/blueprint-trust-git.d.ts

@@ -0,0 +1,130 @@
+import { readFileSync } from 'node:fs';
+import { type BlueprintBuiltInProvenance, type BlueprintProtectedVerificationReceipt, type BlueprintTrustHistoryReceipt, type BlueprintTrustState, type BlueprintTrustTransitionReceipt } from './blueprint-trust.js';
+export declare const BLUEPRINT_TRUST_POLICY_PATH: "supply-chain/blueprint-trust-policy.json";
+export declare const BLUEPRINT_TRUST_SNAPSHOT_PATH: "supply-chain/blueprint-trust-snapshot.json";
+export interface BlueprintTrustGitAuthorityInput {
+    builtIn: {
+        name: string;
+        version: string;
+    };
+    current: BlueprintTrustState;
+    environment?: Readonly<Record<string, string | undefined>>;
+    ownership: readonly {
+        path: string;
+        value: unknown;
+    }[];
+    policyPath?: string;
+    protectedBranch: 'develop' | 'main';
+    protectedRef: string;
+    snapshotPath?: string;
+    workspaceRoot: string;
+}
+export interface BlueprintTrustGitAuthorityReport {
+    authorization: BlueprintTrustState;
+    builtInProvenance: readonly BlueprintBuiltInProvenance[];
+    candidateHistory: BlueprintTrustHistoryReceipt;
+    headCommit: string;
+    protectedCommit: string;
+    protectedHistory: BlueprintTrustHistoryReceipt;
+    protectedVerificationReceipts: readonly BlueprintProtectedVerificationReceipt[];
+    repositoryRootCommit: string;
+    workingTreeTransition?: BlueprintTrustTransitionReceipt;
+}
+export interface ProtectedGitFileAuthorityInput {
+    current: string | Uint8Array;
+    environment?: Readonly<Record<string, string | undefined>>;
+    headCommit: string;
+    path: string;
+    protectedCommit: string;
+    workspaceRoot: string;
+}
+export interface ProtectedGitFileAuthority {
+    blobObjectId: string;
+    headCommit: string;
+    path: string;
+    protectedCommit: string;
+}
+export interface ProtectedGitFileRefAuthorityInput {
+    current: string | Uint8Array;
+    environment?: Readonly<Record<string, string | undefined>>;
+    path: string;
+    protectedRef: 'refs/remotes/origin/develop' | 'refs/remotes/origin/main';
+    workspaceRoot: string;
+}
+export interface ProtectedGitWorkingTreeAuthorityInput {
+    environment?: Readonly<Record<string, string | undefined>>;
+    headCommit: string;
+    protectedCommit: string;
+    protectedRef: 'refs/remotes/origin/develop' | 'refs/remotes/origin/main';
+    workspaceRoot: string;
+}
+export interface BlueprintVerificationWorkspaceSnapshotEntry {
+    mode: '100644' | '100755';
+    path: string;
+    sha256: string;
+    size: number;
+}
+export interface BlueprintVerificationWorkspaceSnapshot {
+    authorityPaths: readonly string[];
+    entries: readonly BlueprintVerificationWorkspaceSnapshotEntry[];
+    workspaceRoot: string;
+}
+export interface ProtectedWorkspaceExternalBlueprintHistory {
+    complete: boolean;
+    externalProjectNames: readonly string[];
+    externalSliceRoots: readonly string[];
+    requiresStrictNxAuthority: boolean;
+}
+export declare function protectedWorkspaceHasExternalBlueprintOwnership(input: {
+    builtInName: string;
+    commit: string;
+    workspaceRoot: string;
+}): boolean;
+/**
+ * Determines whether an external Blueprint appears anywhere in the bounded
+ * first-parent ownership histories of current HEAD or either fixed protected
+ * remote ref before Nx is allowed to load workspace plugins. The workspace's
+ * mutable defaultBase is deliberately not an authority for this decision, and
+ * the stricter pre-graph boundary remains permanently enabled after a
+ * protected external adoption is later removed or relabeled. A missing fixed
+ * remote ref makes the inventory incomplete and conservatively enables the
+ * strict boundary; it does not prevent a local-only repository with safe Nx
+ * configuration from being inspected. A shallow repository likewise enables
+ * the strict boundary because hidden history cannot prove permanent absence.
+ * HEAD is always required and clone/ref state is re-resolved after the
+ * immutable commit inventories are inspected so a concurrent rewrite fails
+ * closed.
+ */
+export declare function inspectProtectedWorkspaceExternalBlueprintHistory(input: {
+    builtInName: string;
+    workspaceRoot: string;
+}): ProtectedWorkspaceExternalBlueprintHistory;
+export declare function protectedWorkspaceHistoryRequiresStrictNxAuthority(input: {
+    builtInName: string;
+    workspaceRoot: string;
+}): boolean;
+export declare function inspectBlueprintTrustGitAuthority(input: BlueprintTrustGitAuthorityInput): BlueprintTrustGitAuthorityReport;
+/**
+ * Binds one working-tree file byte-for-byte to both commits already admitted by
+ * the protected Blueprint trust inspection. `git hash-object --stdin` computes
+ * the repository's native object id without writing an object, so this remains
+ * correct for either SHA-1 or SHA-256 repositories and does not normalize text.
+ */
+export declare function inspectProtectedGitFileAuthority(input: ProtectedGitFileAuthorityInput): ProtectedGitFileAuthority;
+export declare function inspectProtectedGitFileRefAuthority(input: ProtectedGitFileRefAuthorityInput): ProtectedGitFileAuthority;
+/**
+ * Captures the exact entry bytes of every tracked/nonignored path plus every
+ * ignored ownership-managed or Blueprint-origin path. Verification targets may
+ * write ignored evidence/cache outputs, but cannot mutate subsequent target
+ * authority without failing their own executor result.
+ */
+export declare function createBlueprintVerificationWorkspaceSnapshot(workspace: string, additionalAuthorityPaths?: readonly string[]): BlueprintVerificationWorkspaceSnapshot;
+export declare function assertBlueprintVerificationWorkspaceSnapshot(snapshot: BlueprintVerificationWorkspaceSnapshot): void;
+export declare function assertProtectedGitWorkingTreeAuthority(input: ProtectedGitWorkingTreeAuthorityInput): void;
+/**
+ * Keeps ordinary source edits available while binding every receipt execution
+ * authority byte, index entry, mode, and non-ignored untracked match to the
+ * current protected commit. Reading working bytes directly also defeats Git
+ * skip-worktree/assume-unchanged hints.
+ */
+export declare function assertProtectedGitVerificationExecutionAuthority(input: ProtectedGitWorkingTreeAuthorityInput, readAuthorityFile?: typeof readFileSync): void;