@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/blueprint-trust-git.js

@@ -0,0 +1,1581 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BLUEPRINT_TRUST_SNAPSHOT_PATH = exports.BLUEPRINT_TRUST_POLICY_PATH = void 0;
+exports.protectedWorkspaceHasExternalBlueprintOwnership = protectedWorkspaceHasExternalBlueprintOwnership;
+exports.inspectProtectedWorkspaceExternalBlueprintHistory = inspectProtectedWorkspaceExternalBlueprintHistory;
+exports.protectedWorkspaceHistoryRequiresStrictNxAuthority = protectedWorkspaceHistoryRequiresStrictNxAuthority;
+exports.inspectBlueprintTrustGitAuthority = inspectBlueprintTrustGitAuthority;
+exports.inspectProtectedGitFileAuthority = inspectProtectedGitFileAuthority;
+exports.inspectProtectedGitFileRefAuthority = inspectProtectedGitFileRefAuthority;
+exports.createBlueprintVerificationWorkspaceSnapshot = createBlueprintVerificationWorkspaceSnapshot;
+exports.assertBlueprintVerificationWorkspaceSnapshot = assertBlueprintVerificationWorkspaceSnapshot;
+exports.assertProtectedGitWorkingTreeAuthority = assertProtectedGitWorkingTreeAuthority;
+exports.assertProtectedGitVerificationExecutionAuthority = assertProtectedGitVerificationExecutionAuthority;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const validation_js_1 = require("../validation.js");
+const foundation_record_js_1 = require("../ownership/foundation-record.js");
+const record_js_1 = require("../ownership/record.js");
+const workspace_record_js_1 = require("../ownership/workspace-record.js");
+const blueprint_verification_authority_js_1 = require("./blueprint-verification-authority.js");
+const blueprint_trust_js_1 = require("./blueprint-trust.js");
+const errors_js_1 = require("./errors.js");
+const FULL_GIT_OBJECT_ID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const SAFE_GIT_REFERENCE = /^(?:HEAD|HEAD\^1|refs\/(?:heads|remotes\/origin)\/[A-Za-z0-9][A-Za-z0-9._/-]{0,254}|[a-f0-9]{40}|[a-f0-9]{64})$/;
+const SAFE_PROTECTED_GIT_REFERENCE = /^(?:refs\/remotes\/origin\/[A-Za-z0-9][A-Za-z0-9._/-]{0,254}|[a-f0-9]{40}|[a-f0-9]{64})$/;
+const SAFE_REPOSITORY_PATH = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._@+~/-]{1,512}$/;
+const AMBIGUOUS_TRACKED_PATH_CHARACTER = 
+// eslint-disable-next-line no-control-regex -- C0/C1 characters are deliberately rejected in tracked path names.
+/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069\ufffd]/u;
+const OWNERSHIP_PATH = /^packages\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*\/\.ebk\/ownership\.json$/;
+const OWNERSHIP_PATHSPEC = ':(glob,top)packages/*/.ebk/ownership.json';
+const VERIFICATION_RECEIPT_PATH = /^supply-chain\/blueprint-verification-receipts\/([a-z][a-z0-9]*(?:-[a-z0-9]+)*)\.json$/;
+const VERIFICATION_RECEIPT_DIRECTORY = 'supply-chain/blueprint-verification-receipts';
+const PROTECTED_BLUEPRINT_OWNERSHIP_REFS = [
+    'refs/remotes/origin/develop',
+    'refs/remotes/origin/main',
+];
+const MAX_GIT_OUTPUT_BYTES = 30 * 1024 * 1024;
+const MAX_TRACKED_REPOSITORY_PATH_BYTES = 4 * 1024;
+const MAX_HISTORY_COMMITS = 20_000;
+const MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS = 512;
+const MAX_PREGRAPH_OWNERSHIP_HISTORY_RECORDS = 8_192;
+const MAX_JSON_BYTES = 5 * 1024 * 1024;
+const MAX_OWNERSHIP_RECORDS = 1_000;
+const MAX_EXECUTION_SNAPSHOT_BYTES = 512 * 1024 * 1024;
+const MAX_EXECUTION_SNAPSHOT_ENTRIES = 50_000;
+const MAX_EXECUTION_SNAPSHOT_FILE_BYTES = 25 * 1024 * 1024;
+const TRUSTED_GIT_CONFIGURATION = [
+    '-c',
+    'core.fsmonitor=false',
+    '-c',
+    'core.untrackedCache=false',
+];
+exports.BLUEPRINT_TRUST_POLICY_PATH = 'supply-chain/blueprint-trust-policy.json';
+exports.BLUEPRINT_TRUST_SNAPSHOT_PATH = 'supply-chain/blueprint-trust-snapshot.json';
+function supplyChainGitEnvironment(source) {
+    return Object.fromEntries(['SystemRoot', 'SYSTEMROOT', 'TEMP', 'TMP', 'WINDIR'].flatMap((name) => source[name] === undefined ? [] : [[name, source[name]]]));
+}
+function trustedGitExecutable(workspaceRoot) {
+    const candidates = process.platform === 'win32'
+        ? [
+            'C:\\Program Files\\Git\\cmd\\git.exe',
+            'C:\\Program Files\\Git\\bin\\git.exe',
+            'C:\\Program Files (x86)\\Git\\cmd\\git.exe',
+        ]
+        : ['/usr/bin/git'];
+    for (const candidate of candidates) {
+        if (!(0, node_path_1.isAbsolute)(candidate) || !(0, node_fs_1.existsSync)(candidate))
+            continue;
+        let executable;
+        try {
+            executable = (0, node_fs_1.realpathSync)(candidate);
+        }
+        catch {
+            continue;
+        }
+        const child = (0, node_path_1.relative)(workspaceRoot, executable);
+        if (!(0, node_fs_1.lstatSync)(executable).isFile() ||
+            child === '' ||
+            (child !== '..' && !child.startsWith(`..${node_path_1.sep}`) && !(0, node_path_1.isAbsolute)(child))) {
+            continue;
+        }
+        return executable;
+    }
+    throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git', 'cannot locate a trusted absolute system Git executable outside the workspace');
+}
+function isSameCanonicalDirectory(left, right) {
+    try {
+        const leftPath = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(left));
+        const rightPath = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(right));
+        const leftMetadata = (0, node_fs_1.lstatSync)(leftPath, { bigint: true });
+        const rightMetadata = (0, node_fs_1.lstatSync)(rightPath, { bigint: true });
+        if (!leftMetadata.isDirectory() || !rightMetadata.isDirectory()) {
+            return false;
+        }
+        return ((leftMetadata.ino !== 0n &&
+            leftMetadata.dev === rightMetadata.dev &&
+            leftMetadata.ino === rightMetadata.ino) ||
+            leftPath === rightPath);
+    }
+    catch {
+        return false;
+    }
+}
+function git(context, args, options = {}) {
+    const result = (0, node_child_process_1.spawnSync)(context.executable, [...TRUSTED_GIT_CONFIGURATION, ...args], {
+        cwd: context.workspaceRoot,
+        encoding: 'utf8',
+        env: {
+            ...context.environment,
+            GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null',
+            GIT_CONFIG_NOSYSTEM: '1',
+            GIT_NO_REPLACE_OBJECTS: '1',
+            GIT_OPTIONAL_LOCKS: '0',
+        },
+        maxBuffer: MAX_GIT_OUTPUT_BYTES,
+        shell: false,
+        timeout: 15_000,
+        windowsHide: true,
+    });
+    if (result.error ||
+        result.status !== 0 ||
+        typeof result.stdout !== 'string') {
+        if (options.allowFailure)
+            return undefined;
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git', `cannot establish protected trust history with git ${args[0] ?? 'command'}`);
+    }
+    return result.stdout.replace(/\r\n/g, '\n').replace(/\n$/, '');
+}
+function hashGitBlob(context, value) {
+    const result = (0, node_child_process_1.spawnSync)(context.executable, [...TRUSTED_GIT_CONFIGURATION, 'hash-object', '--stdin'], {
+        cwd: context.workspaceRoot,
+        encoding: 'utf8',
+        env: {
+            ...context.environment,
+            GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null',
+            GIT_CONFIG_NOSYSTEM: '1',
+            GIT_NO_REPLACE_OBJECTS: '1',
+            GIT_OPTIONAL_LOCKS: '0',
+        },
+        input: value,
+        maxBuffer: MAX_GIT_OUTPUT_BYTES,
+        shell: false,
+        timeout: 15_000,
+        windowsHide: true,
+    });
+    const objectId = String(result.stdout ?? '').trim();
+    if (result.error ||
+        result.status !== 0 ||
+        !FULL_GIT_OBJECT_ID.test(objectId)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.fileAuthority', 'cannot hash the exact working-tree bytes with trusted Git');
+    }
+    return objectId;
+}
+function hashGitBlobLocally(value, expectedObjectId) {
+    const algorithm = expectedObjectId.length === 64 ? 'sha256' : 'sha1';
+    return (0, node_crypto_1.createHash)(algorithm)
+        .update(Buffer.from(`blob ${value.byteLength}\0`, 'utf8'))
+        .update(value)
+        .digest('hex');
+}
+function safeRepositoryPath(path, label) {
+    if (!SAFE_REPOSITORY_PATH.test(path) || path.split('/').includes('..')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', label, 'must be a bounded repository-relative path');
+    }
+    return path;
+}
+/**
+ * Git permits ordinary tracked names outside the framework's deliberately
+ * narrow authority-path grammar. Whole-tree review must bind those bytes too,
+ * without making spaces or international product documentation illegal.
+ * Reject only names whose decoding or repository-relative resolution in the
+ * current checkout is ambiguous.
+ */
+function safeTrackedRepositoryPath(path, label) {
+    const segments = path.split('/');
+    if (path.length === 0 ||
+        Buffer.byteLength(path, 'utf8') > MAX_TRACKED_REPOSITORY_PATH_BYTES ||
+        path.startsWith('/') ||
+        /^[A-Za-z]:\//u.test(path) ||
+        path.includes('\\') ||
+        AMBIGUOUS_TRACKED_PATH_CHARACTER.test(path) ||
+        segments.some((segment) => segment.length === 0 || segment === '.' || segment === '..')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', label, 'protected tree contains an unsafe or ambiguous tracked path');
+    }
+    return path;
+}
+function exactCommit(context, reference) {
+    if (!SAFE_GIT_REFERENCE.test(reference)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'protectedRef', 'must be an exact protected branch, HEAD parent, or Git object ID');
+    }
+    const commit = git(context, [
+        'rev-parse',
+        '--verify',
+        `${reference}^{commit}`,
+    ]);
+    if (!commit || !FULL_GIT_OBJECT_ID.test(commit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'protectedRef', `cannot resolve ${reference} to one full Git commit`);
+    }
+    return commit;
+}
+function protectedCommit(context, input) {
+    if (!SAFE_PROTECTED_GIT_REFERENCE.test(input.protectedRef)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'protectedRef', 'must be an explicit full Git object ID or refs/remotes/origin/* default-base ref');
+    }
+    return exactCommit(context, input.protectedRef);
+}
+function commits(context, args) {
+    const output = git(context, [
+        'rev-list',
+        '--first-parent',
+        '--reverse',
+        ...args,
+    ]);
+    const values = output === '' ? [] : (output ?? '').split('\n');
+    if (values.length > MAX_HISTORY_COMMITS ||
+        values.some((commit) => !FULL_GIT_OBJECT_ID.test(commit))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.history', `must contain at most ${MAX_HISTORY_COMMITS} exact first-parent commits`);
+    }
+    return values;
+}
+function commitParents(context, commit) {
+    if (!FULL_GIT_OBJECT_ID.test(commit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'git.commit', 'must be a full Git object ID');
+    }
+    const line = git(context, ['rev-list', '--parents', '-n', '1', commit]);
+    const values = line?.split(' ') ?? [];
+    if (values[0] !== commit ||
+        values.some((value) => !FULL_GIT_OBJECT_ID.test(value))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:parents`, 'cannot establish one exact Git parent list');
+    }
+    return values.slice(1);
+}
+function treeObjectId(context, commit) {
+    const tree = git(context, ['rev-parse', '--verify', `${commit}^{tree}`]);
+    if (!tree || !FULL_GIT_OBJECT_ID.test(tree)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:tree`, 'cannot establish one exact Git tree');
+    }
+    return tree;
+}
+function blobObjectId(context, commit, path) {
+    const repositoryPath = safeRepositoryPath(path, 'git.path');
+    const object = git(context, ['rev-parse', '--verify', `${commit}:${repositoryPath}`], { allowFailure: true });
+    if (object === undefined)
+        return undefined;
+    if (!FULL_GIT_OBJECT_ID.test(object) ||
+        git(context, ['cat-file', '-t', object]) !== 'blob') {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${repositoryPath}`, 'must resolve to one exact Git blob');
+    }
+    return object;
+}
+function readBlob(context, commit, path) {
+    if (!FULL_GIT_OBJECT_ID.test(commit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'git.commit', 'must be a full Git object ID');
+    }
+    const repositoryPath = safeRepositoryPath(path, 'git.path');
+    const treeEntry = git(context, [
+        'ls-tree',
+        '--name-only',
+        '-z',
+        commit,
+        '--',
+        repositoryPath,
+    ]);
+    if (treeEntry === '')
+        return undefined;
+    if (treeEntry !== `${repositoryPath}\0`) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${repositoryPath}`, 'historical trust path did not resolve to one exact Git tree entry');
+    }
+    const value = git(context, ['show', `${commit}:${repositoryPath}`]);
+    if (value === undefined) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${repositoryPath}`, 'historical trust blob could not be read');
+    }
+    if (Buffer.byteLength(value, 'utf8') > MAX_JSON_BYTES) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', repositoryPath, 'historical trust input exceeds 5 MiB');
+    }
+    return value;
+}
+function readRawBlob(context, commit, path, maximumBytes) {
+    if (!FULL_GIT_OBJECT_ID.test(commit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'git.commit', 'must be a full Git object ID');
+    }
+    const repositoryPath = safeRepositoryPath(path, 'git.path');
+    if (git(context, [
+        'ls-tree',
+        '--name-only',
+        '-z',
+        commit,
+        '--',
+        repositoryPath,
+    ]) !== `${repositoryPath}\0`) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${repositoryPath}`, 'historical execution authority is not one exact Git tree entry');
+    }
+    const result = (0, node_child_process_1.spawnSync)(context.executable, [...TRUSTED_GIT_CONFIGURATION, 'show', `${commit}:${repositoryPath}`], {
+        cwd: context.workspaceRoot,
+        encoding: null,
+        env: {
+            ...context.environment,
+            GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null',
+            GIT_CONFIG_NOSYSTEM: '1',
+            GIT_NO_REPLACE_OBJECTS: '1',
+            GIT_OPTIONAL_LOCKS: '0',
+        },
+        maxBuffer: Math.min(MAX_GIT_OUTPUT_BYTES, maximumBytes + 1),
+        shell: false,
+        timeout: 15_000,
+        windowsHide: true,
+    });
+    if (result.error ||
+        result.status !== 0 ||
+        !Buffer.isBuffer(result.stdout) ||
+        result.stdout.length <= 0 ||
+        result.stdout.length > maximumBytes) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${repositoryPath}`, 'historical execution authority cannot be read within its byte bound');
+    }
+    return result.stdout;
+}
+function readJsonBlob(context, commit, path) {
+    const value = readBlob(context, commit, path);
+    if (value === undefined)
+        return undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${path}`, 'historical trust input is not valid JSON');
+    }
+}
+function stateAtCommit(context, commit, policyPath, snapshotPath) {
+    const policy = readJsonBlob(context, commit, policyPath);
+    const snapshot = readJsonBlob(context, commit, snapshotPath);
+    if (policy === undefined && snapshot === undefined)
+        return undefined;
+    if (policy === undefined || snapshot === undefined) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', commit, 'historical trust policy and snapshot must be introduced and retained as one pair');
+    }
+    return (0, blueprint_trust_js_1.createBlueprintTrustState)({
+        policy: policy,
+        snapshot: snapshot,
+    });
+}
+function historyStates(context, history, policyPath, snapshotPath) {
+    const states = [];
+    let pairIntroduced = false;
+    let lastDigest;
+    for (const commit of history) {
+        const state = stateAtCommit(context, commit, policyPath, snapshotPath);
+        if (!state) {
+            if (pairIntroduced) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', commit, 'cannot remove the protected Blueprint trust pair from Git history');
+            }
+            continue;
+        }
+        pairIntroduced = true;
+        const digest = (0, blueprint_trust_js_1.blueprintTrustStateDigest)(state);
+        if (digest !== lastDigest) {
+            states.push({ ...state, commit });
+            lastDigest = digest;
+        }
+        else if (commit === history.at(-1)) {
+            states.push({ ...state, commit });
+        }
+    }
+    if (states.length === 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.history', 'does not contain a committed Blueprint trust pair');
+    }
+    return states;
+}
+function blueprintIdentity(value, path) {
+    if (!(0, validation_js_1.isRecord)(value) ||
+        !(0, validation_js_1.isRecord)(value.blueprint) ||
+        typeof value.blueprint.name !== 'string' ||
+        typeof value.blueprint.version !== 'string' ||
+        typeof value.slice !== 'string') {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'historical ownership does not retain an exact Blueprint identity');
+    }
+    return {
+        name: value.blueprint.name,
+        slice: value.slice,
+        version: value.blueprint.version,
+    };
+}
+function ownershipRecordsAtCommit(context, commit, paths) {
+    if (paths.some((path) => !OWNERSHIP_PATH.test(path))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'contains a noncanonical or ambiguous Slice ownership path');
+    }
+    if (paths.length > MAX_OWNERSHIP_RECORDS) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, `contains more than ${MAX_OWNERSHIP_RECORDS} Slice ownership records`);
+    }
+    return paths.flatMap((path) => {
+        const value = readJsonBlob(context, commit, path);
+        if (value === undefined) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${path}`, 'historical ownership disappeared during exact tree inspection');
+        }
+        return historicalOwnershipRecord(commit, path, value);
+    });
+}
+function historicalOwnershipRecord(commit, path, value) {
+    if (path === 'packages/foundation/.ebk/ownership.json') {
+        const foundation = (0, foundation_record_js_1.validateFoundationOwnershipRecord)(value);
+        if (!foundation.valid) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${path}`, 'historical Foundation ownership is malformed');
+        }
+        return [];
+    }
+    const validation = (0, record_js_1.validateGeneratedOwnershipRecord)(value);
+    const slice = path.split('/')[1];
+    if (!validation.valid || validation.value.slice !== slice) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${path}`, 'historical Slice ownership is malformed or ambiguous');
+    }
+    return [
+        {
+            name: validation.value.blueprint.name,
+            path,
+            projects: validation.value.projects,
+            slice: validation.value.slice,
+            version: validation.value.blueprint.version,
+        },
+    ];
+}
+function changedOwnershipValuesAtCommit(context, commit, paths) {
+    if (paths.length === 0)
+        return [];
+    const specifications = paths.map((path) => `${commit}:${path}`);
+    const result = (0, node_child_process_1.spawnSync)(context.executable, [...TRUSTED_GIT_CONFIGURATION, 'cat-file', '--batch'], {
+        cwd: context.workspaceRoot,
+        env: {
+            ...context.environment,
+            GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null',
+            GIT_CONFIG_NOSYSTEM: '1',
+            GIT_NO_REPLACE_OBJECTS: '1',
+            GIT_OPTIONAL_LOCKS: '0',
+        },
+        input: Buffer.from(`${specifications.join('\n')}\n`, 'utf8'),
+        maxBuffer: MAX_GIT_OUTPUT_BYTES,
+        shell: false,
+        timeout: 15_000,
+        windowsHide: true,
+    });
+    if (result.error || result.status !== 0 || !Buffer.isBuffer(result.stdout)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'historical ownership changes could not be read within their aggregate byte bound');
+    }
+    const output = result.stdout;
+    const values = [];
+    let offset = 0;
+    for (const [index, specification] of specifications.entries()) {
+        const path = paths[index];
+        if (path === undefined) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'historical ownership batch input lost its path identity');
+        }
+        const headerEnd = output.indexOf(0x0a, offset);
+        if (headerEnd < 0) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'historical ownership batch output ended before its declared entries');
+        }
+        const header = output.subarray(offset, headerEnd).toString('utf8');
+        offset = headerEnd + 1;
+        if (header === `${specification} missing`)
+            continue;
+        const match = /^([a-f0-9]{40}|[a-f0-9]{64}) blob ([1-9][0-9]*)$/u.exec(header);
+        const size = match?.[2] ? Number.parseInt(match[2], 10) : Number.NaN;
+        if (!match?.[1] ||
+            !Number.isSafeInteger(size) ||
+            size > MAX_JSON_BYTES ||
+            offset + size >= output.length ||
+            output[offset + size] !== 0x0a) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${path}`, 'historical ownership batch output is not one bounded Git blob');
+        }
+        let value;
+        try {
+            value = JSON.parse(output.subarray(offset, offset + size).toString('utf8'));
+        }
+        catch {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:${path}`, 'historical ownership batch input is not valid JSON');
+        }
+        values.push({ path, value });
+        offset += size + 1;
+    }
+    if (offset !== output.length) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'historical ownership batch output contains undeclared trailing bytes');
+    }
+    return values;
+}
+function ownershipInventoryAtCommit(context, commit) {
+    const output = git(context, [
+        'ls-tree',
+        '-r',
+        '--name-only',
+        '-z',
+        commit,
+        '--',
+        'packages',
+    ]);
+    const paths = (output === '' ? [] : (output ?? '').split('\0'))
+        .filter((path) => path !== '')
+        .filter((path) => path.endsWith('/.ebk/ownership.json'));
+    return ownershipRecordsAtCommit(context, commit, paths);
+}
+function changedOwnershipAtCommit(context, commit) {
+    const output = git(context, [
+        'diff-tree',
+        '--root',
+        '--first-parent',
+        '-m',
+        '--no-commit-id',
+        '-r',
+        '--name-only',
+        '-z',
+        commit,
+        '--',
+        OWNERSHIP_PATHSPEC,
+    ]);
+    const paths = (output === '' ? [] : (output ?? '').split('\0')).filter((path) => path !== '');
+    if (paths.some((path) => !OWNERSHIP_PATH.test(path))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'contains a noncanonical or ambiguous changed Slice ownership path');
+    }
+    if (paths.length > MAX_OWNERSHIP_RECORDS) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, `changes more than ${MAX_OWNERSHIP_RECORDS} Slice ownership records`);
+    }
+    return changedOwnershipValuesAtCommit(context, commit, paths).flatMap(({ path, value }) => historicalOwnershipRecord(commit, path, value));
+}
+function protectedWorkspaceHasExternalBlueprintOwnership(input) {
+    if (!FULL_GIT_OBJECT_ID.test(input.commit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'blueprintOwnership.commit', 'protected ownership inventory requires one full commit object ID');
+    }
+    const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.workspaceRoot));
+    const context = {
+        environment: supplyChainGitEnvironment(process.env),
+        executable: trustedGitExecutable(workspaceRoot),
+        workspaceRoot,
+    };
+    const gitRoot = git(context, ['rev-parse', '--show-toplevel']);
+    const commit = git(context, [
+        'rev-parse',
+        '--verify',
+        `${input.commit}^{commit}`,
+    ]);
+    if (!gitRoot ||
+        !isSameCanonicalDirectory(gitRoot, workspaceRoot) ||
+        commit !== input.commit) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.commit', 'protected ownership inventory requires the exact Git worktree and commit');
+    }
+    return ownershipInventoryAtCommit(context, commit).some(({ name }) => name !== input.builtInName);
+}
+/**
+ * Determines whether an external Blueprint appears anywhere in the bounded
+ * first-parent ownership histories of current HEAD or either fixed protected
+ * remote ref before Nx is allowed to load workspace plugins. The workspace's
+ * mutable defaultBase is deliberately not an authority for this decision, and
+ * the stricter pre-graph boundary remains permanently enabled after a
+ * protected external adoption is later removed or relabeled. A missing fixed
+ * remote ref makes the inventory incomplete and conservatively enables the
+ * strict boundary; it does not prevent a local-only repository with safe Nx
+ * configuration from being inspected. A shallow repository likewise enables
+ * the strict boundary because hidden history cannot prove permanent absence.
+ * HEAD is always required and clone/ref state is re-resolved after the
+ * immutable commit inventories are inspected so a concurrent rewrite fails
+ * closed.
+ */
+function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
+    const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.workspaceRoot));
+    const context = {
+        environment: supplyChainGitEnvironment(process.env),
+        executable: trustedGitExecutable(workspaceRoot),
+        workspaceRoot,
+    };
+    const gitRoot = git(context, ['rev-parse', '--show-toplevel']);
+    if (!gitRoot || !isSameCanonicalDirectory(gitRoot, workspaceRoot)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', 'protected ownership history requires the exact Git worktree root');
+    }
+    const shallowBefore = git(context, ['rev-parse', '--is-shallow-repository']);
+    if (!['true', 'false'].includes(shallowBefore ?? '')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', 'protected ownership history could not establish clone completeness');
+    }
+    const resolveCommits = () => {
+        const head = exactCommit(context, 'HEAD');
+        const output = git(context, [
+            'for-each-ref',
+            '--format=%(refname) %(objectname)',
+            ...PROTECTED_BLUEPRINT_OWNERSHIP_REFS,
+        ]);
+        const resolved = new Map();
+        for (const line of output === '' ? [] : (output ?? '').split('\n')) {
+            const match = /^(refs\/remotes\/origin\/(?:develop|main)) ([a-f0-9]{40}|[a-f0-9]{64})$/u.exec(line);
+            if (!match?.[1] ||
+                !match[2] ||
+                !PROTECTED_BLUEPRINT_OWNERSHIP_REFS.includes(match[1]) ||
+                resolved.has(match[1])) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', 'protected ownership refs could not be enumerated exactly');
+            }
+            const commit = exactCommit(context, match[1]);
+            if (commit !== match[2]) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', match[1], 'protected ownership ref changed while it was resolved');
+            }
+            resolved.set(match[1], commit);
+        }
+        return [
+            head,
+            ...PROTECTED_BLUEPRINT_OWNERSHIP_REFS.map((reference) => resolved.get(reference)),
+        ];
+    };
+    const before = resolveCommits();
+    const tips = [
+        ...new Set(before.filter((commit) => commit !== undefined)),
+    ];
+    const history = new Set();
+    for (const tip of tips) {
+        const tipHistory = commits(context, [
+            `--max-count=${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS + 1}`,
+            tip,
+            '--',
+            OWNERSHIP_PATHSPEC,
+        ]);
+        if (tipHistory.length > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS} changing commits`);
+        }
+        for (const commit of tipHistory) {
+            history.add(commit);
+            if (history.size > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS} distinct changing commits`);
+            }
+        }
+    }
+    const externalProjectNames = new Set();
+    const externalSliceRoots = new Set();
+    let externalRecordFound = false;
+    let historicalRecordCount = 0;
+    for (const commit of history) {
+        const inventory = changedOwnershipAtCommit(context, commit);
+        historicalRecordCount += inventory.length;
+        if (historicalRecordCount > MAX_PREGRAPH_OWNERSHIP_HISTORY_RECORDS) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_RECORDS} aggregate Slice records`);
+        }
+        for (const record of inventory) {
+            if (record.name === input.builtInName)
+                continue;
+            externalRecordFound = true;
+            externalProjectNames.add(record.slice);
+            for (const project of record.projects ?? []) {
+                externalProjectNames.add(project);
+            }
+            externalSliceRoots.add(`packages/${record.slice}`);
+        }
+    }
+    const after = resolveCommits();
+    const shallowAfter = git(context, ['rev-parse', '--is-shallow-repository']);
+    if (shallowAfter !== shallowBefore ||
+        before.length !== after.length ||
+        before.some((commit, index) => commit !== after[index])) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', 'HEAD or a protected ownership ref changed during pre-graph inspection');
+    }
+    const protectedInventoryComplete = before
+        .slice(1)
+        .every((commit) => commit !== undefined);
+    const complete = shallowBefore === 'false' && protectedInventoryComplete;
+    return {
+        complete,
+        externalProjectNames: [...externalProjectNames].sort(deterministic_order_js_1.compareUtf16),
+        externalSliceRoots: [...externalSliceRoots].sort(deterministic_order_js_1.compareUtf16),
+        requiresStrictNxAuthority: !complete || externalRecordFound,
+    };
+}
+function protectedWorkspaceHistoryRequiresStrictNxAuthority(input) {
+    return inspectProtectedWorkspaceExternalBlueprintHistory(input)
+        .requiresStrictNxAuthority;
+}
+function currentOwnershipInventory(input) {
+    if (input.ownership.length > MAX_OWNERSHIP_RECORDS) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'ownership', `contains more than ${MAX_OWNERSHIP_RECORDS} Slice ownership records`);
+    }
+    return input.ownership.flatMap(({ path, value }) => {
+        const repositoryPath = safeRepositoryPath(path, 'ownership.path');
+        return historicalOwnershipRecord('working-tree', repositoryPath, value);
+    });
+}
+function ownershipIdentity(record) {
+    return `${record.path}\0${record.slice}\0${record.name}\0${record.version}`;
+}
+function changedOwnershipPaths(context, parent, commit) {
+    const output = git(context, [
+        'diff-tree',
+        '-r',
+        '--no-commit-id',
+        '--name-only',
+        '--no-renames',
+        '-z',
+        parent,
+        commit,
+        '--',
+        OWNERSHIP_PATHSPEC,
+    ]);
+    const paths = (output === '' ? [] : (output ?? '').split('\0')).filter((path) => path !== '');
+    if (paths.length > MAX_OWNERSHIP_RECORDS ||
+        paths.some((path) => !OWNERSHIP_PATH.test(path))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, `changes more than ${MAX_OWNERSHIP_RECORDS} canonical Slice ownership records`);
+    }
+    return paths;
+}
+function historicalOwnershipAudit(context, builtInName, tip) {
+    const roots = commits(context, ['--max-parents=0', tip]);
+    if (roots.length !== 1) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'must have one exact first-parent repository root');
+    }
+    const rootCommit = roots[0];
+    const root = ownershipInventoryAtCommit(context, rootCommit);
+    const external = new Map();
+    const rememberExternal = (record) => {
+        if (record.name !== builtInName) {
+            external.set(ownershipIdentity(record), record);
+        }
+    };
+    root.forEach(rememberExternal);
+    for (const commit of commits(context, [tip, '--', OWNERSHIP_PATHSPEC])) {
+        if (commit === rootCommit)
+            continue;
+        const parent = git(context, ['rev-parse', '--verify', `${commit}^1^{commit}`], { allowFailure: true });
+        if (!parent || !FULL_GIT_OBJECT_ID.test(parent)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'cannot resolve the exact first parent of an ownership change');
+        }
+        for (const path of changedOwnershipPaths(context, parent, commit)) {
+            if (path === 'packages/foundation/.ebk/ownership.json')
+                continue;
+            const beforeValue = readJsonBlob(context, parent, path);
+            const afterValue = readJsonBlob(context, commit, path);
+            const before = beforeValue
+                ? historicalOwnershipRecord(parent, path, beforeValue)[0]
+                : undefined;
+            const after = afterValue
+                ? historicalOwnershipRecord(commit, path, afterValue)[0]
+                : undefined;
+            if (before)
+                rememberExternal(before);
+            if (after)
+                rememberExternal(after);
+        }
+    }
+    return {
+        external: [...external.values()],
+    };
+}
+function assertNoHistoricalPathIndependentRelabel(current, audits) {
+    for (const audit of audits) {
+        const ambiguous = audit.external.find((record) => ownershipLineageOverlaps(record, current));
+        if (!ambiguous)
+            continue;
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${current.path}#blueprint`, `cannot establish built-in provenance while historical external Blueprint ${ambiguous.name}@${ambiguous.version} ownership at ${ambiguous.path} was removed, moved, or reused`);
+    }
+}
+function ownershipLineageOverlaps(left, right) {
+    const rightProjects = new Set(right.projects ?? []);
+    return (left.slice === right.slice ||
+        left.path === right.path ||
+        left.projects?.some((project) => rightProjects.has(project)) === true);
+}
+function assertNoPathIndependentRelabel(builtInName, current, before, after) {
+    const afterExternal = new Set(after.filter(({ name }) => name !== builtInName).map(ownershipIdentity));
+    const relatedExternal = [...before, ...after].find((record) => record.name !== builtInName &&
+        ownershipLineageOverlaps(record, current) &&
+        (!before.includes(record) ||
+            !afterExternal.has(ownershipIdentity(record))));
+    if (!relatedExternal)
+        return;
+    throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${current.path}#blueprint`, `cannot establish built-in provenance while historical external Blueprint ${relatedExternal.name}@${relatedExternal.version} ownership at ${relatedExternal.path} was removed, moved, or reused`);
+}
+function builtInProvenance(context, input, headCommit, protectedCommit) {
+    const provenance = [];
+    const currentOwnership = currentOwnershipInventory(input);
+    const builtInOwnership = currentOwnership.filter(({ name }) => name === input.builtIn.name);
+    if (builtInOwnership.length === 0)
+        return provenance;
+    const protectedOwnership = ownershipInventoryAtCommit(context, protectedCommit);
+    const headOwnership = ownershipInventoryAtCommit(context, headCommit);
+    const protectedAudit = historicalOwnershipAudit(context, input.builtIn.name, protectedCommit);
+    const audits = headCommit === protectedCommit
+        ? [protectedAudit]
+        : [
+            protectedAudit,
+            historicalOwnershipAudit(context, input.builtIn.name, headCommit),
+        ];
+    for (const currentRecord of builtInOwnership) {
+        const current = currentRecord;
+        const path = current.path;
+        const pathCommits = new Set([
+            ...commits(context, [headCommit, '--', path]),
+            ...commits(context, [protectedCommit, '--', path]),
+        ]);
+        for (const commit of pathCommits) {
+            const historical = readJsonBlob(context, commit, path);
+            if (!historical)
+                continue;
+            const identity = blueprintIdentity(historical, `${commit}:${path}`);
+            if (identity.name !== input.builtIn.name) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${path}#blueprint`, `cannot relabel historical external Blueprint ${identity.name}@${identity.version} as built-in`);
+            }
+        }
+        assertNoHistoricalPathIndependentRelabel(currentRecord, audits);
+        const head = readJsonBlob(context, headCommit, path);
+        const protectedValue = readJsonBlob(context, protectedCommit, path);
+        const headIdentity = head
+            ? blueprintIdentity(head, `${headCommit}:${path}`)
+            : undefined;
+        const protectedIdentity = protectedValue
+            ? blueprintIdentity(protectedValue, `${protectedCommit}:${path}`)
+            : undefined;
+        const matches = (identity) => identity?.name === current.name && identity.version === current.version;
+        const protectedLineage = protectedOwnership.some((record) => record.path === path &&
+            record.slice === current.slice &&
+            record.name === input.builtIn.name);
+        if (!protectedLineage) {
+            const headLineage = headOwnership.some((record) => record.path === path &&
+                record.slice === current.slice &&
+                record.name === input.builtIn.name);
+            assertNoPathIndependentRelabel(input.builtIn.name, currentRecord, headLineage ? protectedOwnership : headOwnership, headLineage ? headOwnership : currentOwnership);
+        }
+        if (matches(protectedIdentity)) {
+            provenance.push({
+                authority: 'protected-git-history',
+                commit: protectedCommit,
+                name: current.name,
+                path,
+                version: current.version,
+            });
+        }
+        else if (matches(headIdentity)) {
+            provenance.push({
+                authority: 'candidate-git-history',
+                commit: headCommit,
+                name: current.name,
+                path,
+                version: current.version,
+            });
+        }
+        else {
+            provenance.push({
+                authority: 'working-tree-adoption',
+                name: current.name,
+                path,
+                version: current.version,
+            });
+        }
+    }
+    return provenance;
+}
+function repositoryRootCommit(context, tip) {
+    const roots = commits(context, ['--max-parents=0', tip]);
+    if (roots.length !== 1 || !roots[0]) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.repositoryRoot', 'protected Blueprint authority must descend from one exact repository root commit');
+    }
+    return roots[0];
+}
+function assertCreateOnlyReceiptRetention(context, receiptCommit, executionCommit, paths) {
+    const parents = commitParents(context, receiptCommit);
+    const changedPaths = (git(context, [
+        'diff-tree',
+        '-r',
+        '--no-commit-id',
+        '--name-only',
+        '--no-renames',
+        '-z',
+        executionCommit,
+        receiptCommit,
+    ]) ?? '')
+        .split('\0')
+        .filter(Boolean)
+        .map((changedPath) => safeTrackedRepositoryPath(changedPath, 'git.blueprintVerificationReceiptRetention.changedPath'))
+        .sort();
+    const retainedPaths = [...paths].sort();
+    if (parents.length !== 1 ||
+        parents[0] !== executionCommit ||
+        retainedPaths.length === 0 ||
+        retainedPaths.length !== changedPaths.length ||
+        retainedPaths.some((path, index) => path !== changedPaths[index]) ||
+        retainedPaths.some((path) => !VERIFICATION_RECEIPT_PATH.test(path) ||
+            blobObjectId(context, executionCommit, path) !== undefined ||
+            blobObjectId(context, receiptCommit, path) === undefined)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${receiptCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'protected Blueprint verification receipt retention must be one literal one-parent, receipt-only, create-only commit whose parent is the exact execution commit shared by the complete final set, whose parent tree lacks every retained receipt path in that set, and whose changed paths equal that set');
+    }
+}
+function latestReceiptSetCommit(context, tip, paths, label) {
+    const latest = paths.map((path) => commits(context, [tip, '--', path]).at(-1));
+    const commit = latest[0];
+    if (!commit || latest.some((candidate) => candidate !== commit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:${VERIFICATION_RECEIPT_DIRECTORY}`, `${label} must bind the complete final Blueprint verification receipt set through one exact commit`);
+    }
+    return commit;
+}
+function protectedReceiptCommit(context, input, protectedCommit, paths, executionCommit, policyPath, snapshotPath) {
+    const protectedFirstParent = commits(context, [protectedCommit]);
+    const directReceiptCommit = latestReceiptSetCommit(context, protectedCommit, paths, input.protectedBranch === 'main'
+        ? 'production promotion'
+        : 'protected receipt retention');
+    const directExecutionIndex = protectedFirstParent.indexOf(executionCommit);
+    const directRetentionIndex = protectedFirstParent.indexOf(directReceiptCommit);
+    if (input.protectedBranch !== 'main') {
+        if (directExecutionIndex !== -1 &&
+            directRetentionIndex !== -1 &&
+            directExecutionIndex < directRetentionIndex) {
+            assertCreateOnlyReceiptRetention(context, directReceiptCommit, executionCommit, paths);
+            return directReceiptCommit;
+        }
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'execution evidence must originate at an earlier first-parent protected commit and be retained by a later protected Git commit');
+    }
+    if (directRetentionIndex === -1) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'production Blueprint receipt must be retained by one exact commit on the selected main first-parent history');
+    }
+    const promotionCommit = directReceiptCommit;
+    const parents = commitParents(context, promotionCommit);
+    if (parents.length !== 2) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${promotionCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'production Blueprint receipt authority requires one literal two-parent develop-to-main promotion merge');
+    }
+    const developAuthorityCommit = exactCommit(context, 'refs/remotes/origin/develop');
+    const promotedParent = parents[1];
+    const developFirstParent = commits(context, [developAuthorityCommit]);
+    const mainRoot = repositoryRootCommit(context, protectedCommit);
+    if (!developFirstParent.includes(promotedParent) ||
+        repositoryRootCommit(context, developAuthorityCommit) !== mainRoot ||
+        repositoryRootCommit(context, promotedParent) !== mainRoot) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${promotionCommit}:parents[1]`, 'production Blueprint receipt authority requires its promoted parent on the exact fetched protected develop first-parent lineage in the same repository history');
+    }
+    for (const parityPath of [policyPath, snapshotPath, ...paths]) {
+        const promotedBlob = blobObjectId(context, promotedParent, parityPath);
+        const protectedBlob = blobObjectId(context, promotionCommit, parityPath);
+        if (!promotedBlob || !protectedBlob || promotedBlob !== protectedBlob) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${promotionCommit}:${parityPath}`, 'production promotion must retain the exact develop-parent trust and receipt blob');
+        }
+    }
+    if (treeObjectId(context, promotedParent) !==
+        treeObjectId(context, promotionCommit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${promotionCommit}:tree`, 'production promotion tree must equal its exact reviewed develop parent');
+    }
+    const promotedFirstParent = commits(context, [promotedParent]);
+    const promotedReceiptCommit = latestReceiptSetCommit(context, promotedParent, paths, 'promoted develop receipt retention');
+    const promotedExecutionIndex = promotedFirstParent.indexOf(executionCommit);
+    const promotedRetentionIndex = promotedFirstParent.indexOf(promotedReceiptCommit);
+    if (promotedExecutionIndex === -1 ||
+        promotedRetentionIndex === -1 ||
+        promotedExecutionIndex >= promotedRetentionIndex) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${promotionCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'promoted execution evidence must originate at an earlier first-parent develop commit and be retained by a later first-parent develop commit');
+    }
+    assertCreateOnlyReceiptRetention(context, promotedReceiptCommit, executionCommit, paths);
+    if (exactCommit(context, 'refs/remotes/origin/develop') !==
+        developAuthorityCommit) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'refs/remotes/origin/develop', 'protected develop authority changed during production receipt inspection');
+    }
+    return promotedReceiptCommit;
+}
+function protectedVerificationReceipts(context, input, protectedCommit, repositoryRoot, policyPath, snapshotPath) {
+    const output = git(context, [
+        'ls-tree',
+        '-r',
+        '--name-only',
+        '-z',
+        protectedCommit,
+        '--',
+        VERIFICATION_RECEIPT_DIRECTORY,
+    ]);
+    const paths = (output === '' ? [] : (output ?? '').split('\0')).filter((path) => path !== '');
+    if (paths.length > MAX_OWNERSHIP_RECORDS ||
+        paths.some((path) => !VERIFICATION_RECEIPT_PATH.test(path))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:blueprintVerificationReceipts`, `must contain at most ${MAX_OWNERSHIP_RECORDS} canonical protected receipt blobs`);
+    }
+    const receipts = paths.map((path) => {
+        const value = readJsonBlob(context, protectedCommit, path);
+        if (value === undefined) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${path}`, 'protected Blueprint verification receipt disappeared during exact tree inspection');
+        }
+        const receipt = (0, blueprint_trust_js_1.createBlueprintVerificationExecutionReceipt)(value);
+        if (path !== (0, blueprint_trust_js_1.blueprintVerificationExecutionReceiptPath)(receipt.slice)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${path}`, 'protected Blueprint verification receipt path does not match its Slice');
+        }
+        if (receipt.repositoryRootCommit !== repositoryRoot) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${path}#repositoryRootCommit`, 'protected Blueprint verification receipt belongs to a different Git repository history');
+        }
+        return { path, receipt };
+    });
+    const firstReceipt = receipts[0];
+    if (!firstReceipt)
+        return [];
+    const executionCommit = firstReceipt.receipt.executionCommit;
+    if (receipts.some(({ receipt }) => receipt.executionCommit !== executionCommit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'the complete final Blueprint verification receipt set must share one exact execution commit');
+    }
+    const receiptCommit = protectedReceiptCommit(context, input, protectedCommit, paths, executionCommit, policyPath, snapshotPath);
+    return receipts.map(({ path, receipt }) => {
+        const executionLockfile = readRawBlob(context, receipt.executionCommit, 'pnpm-lock.yaml', 25 * 1024 * 1024);
+        if ((0, node_crypto_1.createHash)('sha256').update(executionLockfile).digest('hex') !==
+            receipt.lockfileSha256) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${path}#lockfileSha256`, 'protected receipt does not bind the exact execution-commit pnpm lockfile blob');
+        }
+        const executionManifestBytes = readRawBlob(context, receipt.executionCommit, 'package.json', MAX_JSON_BYTES);
+        const executionNodeVersion = readRawBlob(context, receipt.executionCommit, '.node-version', 128).toString('utf8');
+        let executionManifest;
+        try {
+            executionManifest = JSON.parse(executionManifestBytes.toString('utf8'));
+        }
+        catch {
+            executionManifest = undefined;
+        }
+        const executionNodeEngine = (0, validation_js_1.isRecord)(executionManifest) && (0, validation_js_1.isRecord)(executionManifest.engines)
+            ? executionManifest.engines.node
+            : undefined;
+        if (executionNodeEngine !== receipt.nodeEngine ||
+            executionNodeVersion !== `${receipt.nodeVersionDeclaration}\n`) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${path}#nodeEngine`, 'protected receipt does not bind the exact execution-commit Node declarations');
+        }
+        const changedExecutionAuthority = git(context, [
+            'diff-tree',
+            '-r',
+            '--no-commit-id',
+            '--name-only',
+            '--no-renames',
+            '-z',
+            receipt.executionCommit,
+            protectedCommit,
+        ]);
+        const changedSelectedAuthority = (changedExecutionAuthority ?? '')
+            .split('\0')
+            .filter(Boolean)
+            .map((entry) => safeTrackedRepositoryPath(entry, 'git.verificationExecutionAuthority.changedPath'))
+            .filter(blueprint_verification_authority_js_1.isBlueprintVerificationExecutionAuthorityPath);
+        if (changedSelectedAuthority.length > 0) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${path}#executionCommit`, 'protected Blueprint verification execution authority changed after receipt execution; rerun the review from the current protected commit');
+        }
+        const executionState = stateAtCommit(context, receipt.executionCommit, policyPath, snapshotPath);
+        const review = executionState?.policy.generatedReviews.find(({ evidenceDigest }) => evidenceDigest === receipt.approvalDigest);
+        if (!executionState || !review) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${path}#approvalDigest`, 'execution commit does not contain the exact protected static approval');
+        }
+        const decision = (0, blueprint_trust_js_1.authorizeBlueprintTrust)({
+            frameworkVersion: input.builtIn.version,
+            integrity: receipt.blueprint.integrity,
+            name: receipt.blueprint.name,
+            now: receipt.generatedAt,
+            operation: 'adopt',
+            policy: executionState.policy,
+            snapshot: executionState.snapshot,
+            version: receipt.blueprint.version,
+        });
+        if (decision.decision !== 'allow') {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${protectedCommit}:${path}#executionCommit`, 'execution commit did not authorize the exact Blueprint release');
+        }
+        return {
+            protectedCommit: receiptCommit,
+            receipt,
+            reference: path,
+        };
+    });
+}
+function inspectBlueprintTrustGitAuthority(input) {
+    if (!['develop', 'main'].includes(input.protectedBranch)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'protectedBranch', 'must explicitly identify develop or main protected-route authority');
+    }
+    const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.workspaceRoot));
+    const context = {
+        environment: supplyChainGitEnvironment(input.environment ?? process.env),
+        executable: trustedGitExecutable(workspaceRoot),
+        workspaceRoot,
+    };
+    const gitRoot = git(context, ['rev-parse', '--show-toplevel']);
+    if (!gitRoot) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git', 'workspace is not backed by Git history');
+    }
+    if (!isSameCanonicalDirectory(gitRoot, workspaceRoot)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git', 'workspace root must equal the protected Git worktree root');
+    }
+    if (git(context, ['rev-parse', '--is-shallow-repository']) !== 'false') {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.history', 'must be complete; fetch full protected history before Blueprint authorization');
+    }
+    const policyPath = safeRepositoryPath(input.policyPath ?? exports.BLUEPRINT_TRUST_POLICY_PATH, 'policyPath');
+    const snapshotPath = safeRepositoryPath(input.snapshotPath ?? exports.BLUEPRINT_TRUST_SNAPSHOT_PATH, 'snapshotPath');
+    const headCommit = exactCommit(context, 'HEAD');
+    const authorityCommit = protectedCommit(context, input);
+    const rootCommit = repositoryRootCommit(context, authorityCommit);
+    const protectedCommits = commits(context, [
+        authorityCommit,
+        '--',
+        policyPath,
+        snapshotPath,
+    ]);
+    if (protectedCommits.at(-1) !== authorityCommit) {
+        protectedCommits.push(authorityCommit);
+    }
+    const protectedStates = historyStates(context, protectedCommits, policyPath, snapshotPath);
+    const protectedHistory = (0, blueprint_trust_js_1.validateBlueprintTrustHistory)(protectedStates);
+    const authorization = (0, blueprint_trust_js_1.createBlueprintTrustState)(protectedStates.at(-1));
+    const mergeBase = git(context, ['merge-base', authorityCommit, headCommit]);
+    if (!mergeBase || !FULL_GIT_OBJECT_ID.test(mergeBase)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.history', 'candidate and protected history do not share one exact merge base');
+    }
+    const candidateCommits = [
+        mergeBase,
+        ...commits(context, [
+            `${mergeBase}..${headCommit}`,
+            '--',
+            policyPath,
+            snapshotPath,
+        ]),
+    ].filter((commit, index, values) => values.indexOf(commit) === index);
+    if (candidateCommits.at(-1) !== headCommit)
+        candidateCommits.push(headCommit);
+    const candidateStates = historyStates(context, candidateCommits, policyPath, snapshotPath);
+    const candidateHistory = (0, blueprint_trust_js_1.validateBlueprintTrustHistory)(candidateStates);
+    const head = (0, blueprint_trust_js_1.createBlueprintTrustState)(candidateStates.at(-1));
+    if ((0, blueprint_trust_js_1.blueprintTrustStateDigest)(authorization) !== (0, blueprint_trust_js_1.blueprintTrustStateDigest)(head)) {
+        (0, blueprint_trust_js_1.planBlueprintTrustStateTransition)(authorization, head);
+    }
+    const current = (0, blueprint_trust_js_1.createBlueprintTrustState)(input.current);
+    const workingTreeTransition = (0, blueprint_trust_js_1.blueprintTrustStateDigest)(head) === (0, blueprint_trust_js_1.blueprintTrustStateDigest)(current)
+        ? undefined
+        : (0, blueprint_trust_js_1.planBlueprintTrustStateTransition)(head, current).receipt;
+    return {
+        authorization,
+        builtInProvenance: builtInProvenance(context, input, headCommit, authorityCommit),
+        candidateHistory,
+        headCommit,
+        protectedCommit: authorityCommit,
+        protectedHistory,
+        protectedVerificationReceipts: protectedVerificationReceipts(context, input, authorityCommit, rootCommit, policyPath, snapshotPath),
+        repositoryRootCommit: rootCommit,
+        ...(workingTreeTransition ? { workingTreeTransition } : {}),
+    };
+}
+/**
+ * Binds one working-tree file byte-for-byte to both commits already admitted by
+ * the protected Blueprint trust inspection. `git hash-object --stdin` computes
+ * the repository's native object id without writing an object, so this remains
+ * correct for either SHA-1 or SHA-256 repositories and does not normalize text.
+ */
+function inspectProtectedGitFileAuthority(input) {
+    if (!FULL_GIT_OBJECT_ID.test(input.headCommit) ||
+        !FULL_GIT_OBJECT_ID.test(input.protectedCommit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'git.fileAuthority', 'head and protected authority must be full Git commit object ids');
+    }
+    const repositoryPath = safeRepositoryPath(input.path, 'git.fileAuthority.path');
+    const current = Buffer.from(input.current);
+    if (current.byteLength === 0 || current.byteLength > MAX_JSON_BYTES) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', repositoryPath, 'protected working-tree authority must be a non-empty file of at most 5 MiB');
+    }
+    const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.workspaceRoot));
+    const context = {
+        environment: supplyChainGitEnvironment(input.environment ?? process.env),
+        executable: trustedGitExecutable(workspaceRoot),
+        workspaceRoot,
+    };
+    const gitRoot = git(context, ['rev-parse', '--show-toplevel']);
+    if (!gitRoot || !isSameCanonicalDirectory(gitRoot, workspaceRoot)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', repositoryPath, 'protected file authority requires the exact Git worktree root');
+    }
+    const currentObjectId = hashGitBlob(context, current);
+    const headObjectId = blobObjectId(context, input.headCommit, repositoryPath);
+    const protectedObjectId = blobObjectId(context, input.protectedCommit, repositoryPath);
+    if (!headObjectId ||
+        !protectedObjectId ||
+        currentObjectId !== headObjectId ||
+        currentObjectId !== protectedObjectId) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', repositoryPath, 'working, HEAD, and protected Git file bytes must be exactly identical');
+    }
+    return {
+        blobObjectId: currentObjectId,
+        headCommit: input.headCommit,
+        path: repositoryPath,
+        protectedCommit: input.protectedCommit,
+    };
+}
+function inspectProtectedGitFileRefAuthority(input) {
+    if (!['refs/remotes/origin/develop', 'refs/remotes/origin/main'].includes(input.protectedRef)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'git.fileAuthority.protectedRef', 'protected file authority requires one exact remote protected ref');
+    }
+    const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.workspaceRoot));
+    const context = {
+        environment: supplyChainGitEnvironment(input.environment ?? process.env),
+        executable: trustedGitExecutable(workspaceRoot),
+        workspaceRoot,
+    };
+    const headCommit = git(context, ['rev-parse', '--verify', 'HEAD^{commit}']);
+    const protectedCommit = git(context, [
+        'rev-parse',
+        '--verify',
+        `${input.protectedRef}^{commit}`,
+    ]);
+    if (!headCommit ||
+        !protectedCommit ||
+        !FULL_GIT_OBJECT_ID.test(headCommit) ||
+        !FULL_GIT_OBJECT_ID.test(protectedCommit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', input.path, 'protected file authority cannot resolve exact HEAD and remote commits');
+    }
+    return inspectProtectedGitFileAuthority({
+        current: input.current,
+        environment: input.environment,
+        headCommit,
+        path: input.path,
+        protectedCommit,
+        workspaceRoot,
+    });
+}
+function readExecutionSnapshotFile(workspaceRoot, path, maximumBytes) {
+    const repositoryPath = safeTrackedRepositoryPath(path, 'blueprintVerification.workspaceSnapshot.path');
+    const absolute = (0, node_path_1.join)(workspaceRoot, repositoryPath);
+    const metadata = (0, node_fs_1.lstatSync)(absolute);
+    if (metadata.isSymbolicLink() ||
+        !metadata.isFile() ||
+        metadata.nlink !== 1 ||
+        metadata.size <= 0 ||
+        metadata.size > maximumBytes ||
+        (0, node_fs_1.realpathSync)(absolute) !== absolute) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', repositoryPath, 'workspace execution snapshot requires one canonical bounded file');
+    }
+    const bytes = (0, node_fs_1.readFileSync)(absolute);
+    if (bytes.byteLength !== metadata.size) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', repositoryPath, 'workspace execution snapshot file changed while read');
+    }
+    return bytes;
+}
+function executionSnapshotOwnedPaths(workspaceRoot) {
+    const paths = new Set();
+    const addOwnedPaths = (prefix, owned) => {
+        for (const entry of owned) {
+            if (entry.mode !== 'managed' && entry.origin !== 'blueprint')
+                continue;
+            paths.add(safeTrackedRepositoryPath(prefix ? `${prefix}/${entry.path}` : entry.path, 'blueprintVerification.workspaceSnapshot.ownedPath'));
+        }
+    };
+    const rootOwnershipPath = (0, node_path_1.join)(workspaceRoot, '.ebk', 'ownership.json');
+    if ((0, node_fs_1.existsSync)(rootOwnershipPath)) {
+        const rootOwnership = readExecutionSnapshotFile(workspaceRoot, '.ebk/ownership.json', MAX_JSON_BYTES);
+        let value;
+        try {
+            value = JSON.parse(rootOwnership.toString('utf8'));
+        }
+        catch {
+            value = undefined;
+        }
+        const validation = (0, workspace_record_js_1.validateWorkspaceOwnershipRecord)(value);
+        if (!validation.valid) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', '.ebk/ownership.json', 'workspace execution snapshot requires valid workspace ownership');
+        }
+        paths.add('.ebk/ownership.json');
+        addOwnedPaths('', validation.value.paths);
+    }
+    const packagesRoot = (0, node_path_1.join)(workspaceRoot, 'packages');
+    if (!(0, node_fs_1.existsSync)(packagesRoot))
+        return [...paths];
+    const packagesMetadata = (0, node_fs_1.lstatSync)(packagesRoot);
+    if (packagesMetadata.isSymbolicLink() ||
+        !packagesMetadata.isDirectory() ||
+        (0, node_fs_1.realpathSync)(packagesRoot) !== packagesRoot) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'packages', 'workspace execution snapshot requires one canonical packages directory');
+    }
+    const packages = (0, node_fs_1.readdirSync)(packagesRoot, { withFileTypes: true }).sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+    if (packages.length > 2_000) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'packages', 'workspace execution snapshot exceeds 2,000 package entries');
+    }
+    const identities = new Set();
+    for (const entry of packages) {
+        const identity = entry.name.normalize('NFC').toLowerCase();
+        if (identities.has(identity) || entry.isSymbolicLink()) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `packages/${entry.name}`, 'workspace execution snapshot refuses ambiguous or symbolic-link packages');
+        }
+        identities.add(identity);
+        if (!entry.isDirectory())
+            continue;
+        const prefix = safeTrackedRepositoryPath(`packages/${entry.name}`, 'blueprintVerification.workspaceSnapshot.package');
+        const ownershipPath = `${prefix}/.ebk/ownership.json`;
+        if (!(0, node_fs_1.existsSync)((0, node_path_1.join)(workspaceRoot, ownershipPath)))
+            continue;
+        const ownership = readExecutionSnapshotFile(workspaceRoot, ownershipPath, MAX_JSON_BYTES);
+        let value;
+        try {
+            value = JSON.parse(ownership.toString('utf8'));
+        }
+        catch {
+            value = undefined;
+        }
+        paths.add(ownershipPath);
+        if (entry.name === 'foundation') {
+            const foundation = (0, foundation_record_js_1.validateFoundationOwnershipRecord)(value);
+            if (!foundation.valid) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', ownershipPath, 'workspace execution snapshot requires valid Foundation ownership');
+            }
+            addOwnedPaths(prefix, foundation.value.paths);
+            continue;
+        }
+        const generated = (0, record_js_1.validateGeneratedOwnershipRecord)(value);
+        if (!generated.valid || generated.value.slice !== entry.name) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', ownershipPath, 'workspace execution snapshot requires valid unambiguous Slice ownership');
+        }
+        addOwnedPaths(prefix, generated.value.paths);
+    }
+    return [...paths];
+}
+/**
+ * Captures the exact entry bytes of every tracked/nonignored path plus every
+ * ignored ownership-managed or Blueprint-origin path. Verification targets may
+ * write ignored evidence/cache outputs, but cannot mutate subsequent target
+ * authority without failing their own executor result.
+ */
+function createBlueprintVerificationWorkspaceSnapshot(workspace, additionalAuthorityPaths = []) {
+    const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(workspace));
+    const context = {
+        environment: supplyChainGitEnvironment(process.env),
+        executable: trustedGitExecutable(workspaceRoot),
+        workspaceRoot,
+    };
+    const gitRoot = git(context, ['rev-parse', '--show-toplevel']);
+    if (!gitRoot || !isSameCanonicalDirectory(gitRoot, workspaceRoot)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.workingTreeSnapshot', 'workspace execution snapshot requires the exact Git worktree root');
+    }
+    const inventory = git(context, [
+        'ls-files',
+        '--cached',
+        '--others',
+        '--exclude-standard',
+        '-z',
+    ]);
+    const paths = new Set((inventory ?? '')
+        .split('\0')
+        .filter(Boolean)
+        .map((path) => safeTrackedRepositoryPath(path, 'blueprintVerification.workspaceSnapshot.path')));
+    const authorityPaths = [...new Set(additionalAuthorityPaths)]
+        .map((path) => safeTrackedRepositoryPath(path, 'blueprintVerification.workspaceSnapshot.authorityPath'))
+        .sort();
+    for (const path of authorityPaths)
+        paths.add(path);
+    for (const path of executionSnapshotOwnedPaths(workspaceRoot)) {
+        paths.add(path);
+    }
+    if (paths.size > MAX_EXECUTION_SNAPSHOT_ENTRIES) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.workingTreeSnapshot', 'workspace execution snapshot exceeds 50,000 files');
+    }
+    const aliases = new Set();
+    let totalBytes = 0;
+    const entries = [...paths]
+        .sort()
+        .map((path) => {
+        const alias = path.normalize('NFC').toLowerCase();
+        if (aliases.has(alias)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'workspace execution snapshot contains a case or Unicode path alias');
+        }
+        aliases.add(alias);
+        const absolute = (0, node_path_1.join)(workspaceRoot, path);
+        const metadata = (0, node_fs_1.lstatSync)(absolute);
+        if (metadata.isSymbolicLink() ||
+            !metadata.isFile() ||
+            metadata.nlink !== 1 ||
+            metadata.size > MAX_EXECUTION_SNAPSHOT_FILE_BYTES ||
+            (0, node_fs_1.realpathSync)(absolute) !== absolute) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'workspace execution snapshot requires one canonical bounded file');
+        }
+        totalBytes += metadata.size;
+        if (totalBytes > MAX_EXECUTION_SNAPSHOT_BYTES) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'workspace execution snapshot exceeds its 512 MiB byte bound');
+        }
+        const bytes = (0, node_fs_1.readFileSync)(absolute);
+        if (bytes.byteLength !== metadata.size) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'workspace execution snapshot file changed while read');
+        }
+        return {
+            mode: process.platform === 'win32' || (metadata.mode & 0o111) === 0
+                ? '100644'
+                : '100755',
+            path,
+            sha256: (0, node_crypto_1.createHash)('sha256').update(bytes).digest('hex'),
+            size: metadata.size,
+        };
+    });
+    return { authorityPaths, entries, workspaceRoot };
+}
+function assertBlueprintVerificationWorkspaceSnapshot(snapshot) {
+    const current = createBlueprintVerificationWorkspaceSnapshot(snapshot.workspaceRoot, snapshot.authorityPaths);
+    if (JSON.stringify(current.entries) !== JSON.stringify(snapshot.entries)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.workingTreeSnapshot', 'workspace execution authority changed during recurring verification');
+    }
+}
+/**
+ * Proves that every tracked and non-ignored workspace byte still represents
+ * the exact protected commit selected for receipt-minting execution. Ignored
+ * dependency/cache state remains outside this local-integrity boundary and is
+ * constrained separately by the generated reviewer.
+ */
+function assertProtectedGitTreeAuthority(input, pathSelector, allowHeadDifference = false, readAuthorityFile = node_fs_1.readFileSync) {
+    if (!FULL_GIT_OBJECT_ID.test(input.headCommit) ||
+        !FULL_GIT_OBJECT_ID.test(input.protectedCommit) ||
+        (!allowHeadDifference && input.headCommit !== input.protectedCommit) ||
+        !['refs/remotes/origin/develop', 'refs/remotes/origin/main'].includes(input.protectedRef)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.workingTreeAuthority', 'working-tree authority requires one exact protected HEAD commit');
+    }
+    const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.workspaceRoot));
+    const context = {
+        environment: supplyChainGitEnvironment(input.environment ?? process.env),
+        executable: trustedGitExecutable(workspaceRoot),
+        workspaceRoot,
+    };
+    const head = git(context, ['rev-parse', '--verify', 'HEAD^{commit}']);
+    const protectedCommit = git(context, [
+        'rev-parse',
+        '--verify',
+        `${input.protectedRef}^{commit}`,
+    ]);
+    const treeOutput = git(context, [
+        'ls-tree',
+        '-rz',
+        '--full-tree',
+        input.headCommit,
+    ]);
+    const protectedTreeOutput = allowHeadDifference
+        ? git(context, ['ls-tree', '-rz', '--full-tree', input.protectedCommit])
+        : treeOutput;
+    const indexOutput = git(context, ['ls-files', '--stage', '-z']);
+    const untracked = git(context, [
+        'ls-files',
+        '--others',
+        '--exclude-standard',
+        '-z',
+    ]);
+    const tree = new Map();
+    const treeAliases = new Set();
+    for (const entry of (treeOutput ?? '').split('\0').filter(Boolean)) {
+        const separator = entry.indexOf('\t');
+        const rawPath = separator === -1 ? '' : entry.slice(separator + 1);
+        if (pathSelector && !pathSelector(rawPath))
+            continue;
+        const match = /^(100644|100755|120000) blob ([a-f0-9]{40}|[a-f0-9]{64})\t(.+)$/u.exec(entry);
+        if (!match || !match[1] || !match[2] || !match[3]) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.workingTreeAuthority', 'protected tree contains an unsupported tracked entry');
+        }
+        const path = safeTrackedRepositoryPath(match[3], 'git.workingTreeAuthority.path');
+        const alias = path.normalize('NFC').toLowerCase();
+        if (tree.has(path) || treeAliases.has(alias)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'protected tree contains a duplicate, case, or Unicode aliased tracked path');
+        }
+        treeAliases.add(alias);
+        tree.set(path, { mode: match[1], objectId: match[2] });
+    }
+    const protectedTree = new Map();
+    const protectedTreeAliases = new Set();
+    for (const entry of (protectedTreeOutput ?? '').split('\0').filter(Boolean)) {
+        const separator = entry.indexOf('\t');
+        const rawPath = separator === -1 ? '' : entry.slice(separator + 1);
+        if (pathSelector && !pathSelector(rawPath))
+            continue;
+        const match = /^(100644|100755|120000) blob ([a-f0-9]{40}|[a-f0-9]{64})\t(.+)$/u.exec(entry);
+        if (!match || !match[1] || !match[2] || !match[3]) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.workingTreeAuthority', 'protected authority tree contains an unsupported tracked entry');
+        }
+        const path = safeTrackedRepositoryPath(match[3], 'git.workingTreeAuthority.path');
+        const alias = path.normalize('NFC').toLowerCase();
+        if (protectedTree.has(path) || protectedTreeAliases.has(alias)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'protected authority tree contains a duplicate, case, or Unicode aliased tracked path');
+        }
+        protectedTreeAliases.add(alias);
+        protectedTree.set(path, { mode: match[1], objectId: match[2] });
+    }
+    const index = new Map();
+    const indexAliases = new Set();
+    for (const entry of (indexOutput ?? '').split('\0').filter(Boolean)) {
+        const separator = entry.indexOf('\t');
+        const rawPath = separator === -1 ? '' : entry.slice(separator + 1);
+        if (pathSelector && !pathSelector(rawPath))
+            continue;
+        const match = /^(100644|100755|120000) ([a-f0-9]{40}|[a-f0-9]{64}) 0\t(.+)$/u.exec(entry);
+        if (!match || !match[1] || !match[2] || !match[3]) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.workingTreeAuthority', 'index contains an unsupported or unresolved tracked entry');
+        }
+        const path = safeTrackedRepositoryPath(match[3], 'git.workingTreeAuthority.path');
+        const alias = path.normalize('NFC').toLowerCase();
+        if (index.has(path) || indexAliases.has(alias)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'index contains a duplicate, case, or Unicode aliased tracked path');
+        }
+        indexAliases.add(alias);
+        index.set(path, { mode: match[1], objectId: match[2] });
+    }
+    const selectedUntracked = (untracked ?? '')
+        .split('\0')
+        .filter(Boolean)
+        .filter((path) => !pathSelector || pathSelector(path))
+        .map((path) => safeTrackedRepositoryPath(path, 'git.workingTreeAuthority.path'));
+    const untrackedAliases = new Set();
+    for (const path of selectedUntracked) {
+        const alias = path.normalize('NFC').toLowerCase();
+        if (untrackedAliases.has(alias) || treeAliases.has(alias)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'untracked authority contains a duplicate, case, or Unicode alias');
+        }
+        untrackedAliases.add(alias);
+    }
+    if (head !== input.headCommit ||
+        protectedCommit !== input.protectedCommit ||
+        selectedUntracked.length > 0 ||
+        tree.size !== index.size ||
+        tree.size !== protectedTree.size) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.workingTreeAuthority', 'protected review requires a clean current tree at the exact protected commit');
+    }
+    const assertCurrentWorkingBytes = (path, expected) => {
+        const candidate = (0, node_path_1.join)(workspaceRoot, ...path.split('/'));
+        const metadata = (0, node_fs_1.lstatSync)(candidate);
+        if (!Number.isSafeInteger(metadata.size) ||
+            metadata.size < 0 ||
+            metadata.size > MAX_GIT_OUTPUT_BYTES) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'working authority file exceeds the bounded byte contract');
+        }
+        const bytes = expected.mode === '120000'
+            ? Buffer.from((0, node_fs_1.readlinkSync)(candidate), 'utf8')
+            : readAuthorityFile(candidate);
+        if ((expected.mode === '120000') !== metadata.isSymbolicLink() ||
+            (expected.mode !== '120000' && !metadata.isFile()) ||
+            (process.platform !== 'win32' &&
+                expected.mode !== '120000' &&
+                ((metadata.mode & 0o111) !== 0) !== (expected.mode === '100755')) ||
+            (expected.mode !== '120000' && bytes.byteLength !== metadata.size) ||
+            hashGitBlobLocally(bytes, expected.objectId) !== expected.objectId) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'working bytes must equal the exact protected tree');
+        }
+    };
+    for (const [path, expected] of tree) {
+        const staged = index.get(path);
+        const protectedExpected = protectedTree.get(path);
+        if (!staged ||
+            !protectedExpected ||
+            staged.mode !== expected.mode ||
+            staged.objectId !== expected.objectId ||
+            protectedExpected.mode !== expected.mode ||
+            protectedExpected.objectId !== expected.objectId) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'index bytes must equal the exact protected tree');
+        }
+        assertCurrentWorkingBytes(path, expected);
+    }
+    for (const [path, expected] of tree) {
+        assertCurrentWorkingBytes(path, expected);
+    }
+    const finalHead = git(context, ['rev-parse', '--verify', 'HEAD^{commit}']);
+    const finalProtectedCommit = git(context, [
+        'rev-parse',
+        '--verify',
+        `${input.protectedRef}^{commit}`,
+    ]);
+    const finalIndexOutput = git(context, ['ls-files', '--stage', '-z']);
+    const finalUntracked = git(context, [
+        'ls-files',
+        '--others',
+        '--exclude-standard',
+        '-z',
+    ]);
+    const selectedIndexSignature = (output) => (output ?? '')
+        .split('\0')
+        .filter(Boolean)
+        .filter((entry) => {
+        const separator = entry.indexOf('\t');
+        const path = separator === -1 ? '' : entry.slice(separator + 1);
+        return !pathSelector || pathSelector(path);
+    })
+        .sort()
+        .join('\0');
+    const selectedUntrackedSignature = (output) => (output ?? '')
+        .split('\0')
+        .filter(Boolean)
+        .filter((path) => !pathSelector || pathSelector(path))
+        .sort()
+        .join('\0');
+    if (finalHead !== head ||
+        finalProtectedCommit !== protectedCommit ||
+        selectedIndexSignature(finalIndexOutput) !==
+            selectedIndexSignature(indexOutput) ||
+        selectedUntrackedSignature(finalUntracked) !==
+            selectedUntrackedSignature(untracked)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'git.workingTreeAuthority', 'working-tree authority changed during exact inspection');
+    }
+}
+function assertProtectedGitWorkingTreeAuthority(input) {
+    assertProtectedGitTreeAuthority(input);
+}
+/**
+ * Keeps ordinary source edits available while binding every receipt execution
+ * authority byte, index entry, mode, and non-ignored untracked match to the
+ * current protected commit. Reading working bytes directly also defeats Git
+ * skip-worktree/assume-unchanged hints.
+ */
+function assertProtectedGitVerificationExecutionAuthority(input, readAuthorityFile = node_fs_1.readFileSync) {
+    assertProtectedGitTreeAuthority(input, blueprint_verification_authority_js_1.isBlueprintVerificationExecutionAuthorityPath, true, readAuthorityFile);
+}
+//# sourceMappingURL=blueprint-trust-git.js.map