@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/blueprint-trust.js

@@ -0,0 +1,1558 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BLUEPRINT_TRUST_OVERRIDE_MAX_DAYS = exports.BLUEPRINT_TRUST_MAX_FRESHNESS_DAYS = exports.BLUEPRINT_TRUST_LIFECYCLE_STATES = exports.BLUEPRINT_TRUST_SCHEMA_VERSION = void 0;
+exports.blueprintContainerRegistry = blueprintContainerRegistry;
+exports.resolveBlueprintPackageIntegrity = resolveBlueprintPackageIntegrity;
+exports.parsePnpmImporterPackageAuthorityLockfile = parsePnpmImporterPackageAuthorityLockfile;
+exports.resolvePnpmImporterPackageVersionFromParsed = resolvePnpmImporterPackageVersionFromParsed;
+exports.resolvePnpmImporterPackageVersion = resolvePnpmImporterPackageVersion;
+exports.resolvePnpmRootPackageVersion = resolvePnpmRootPackageVersion;
+exports.createBlueprintTrustSnapshot = createBlueprintTrustSnapshot;
+exports.blueprintTrustSnapshotDigest = blueprintTrustSnapshotDigest;
+exports.blueprintGeneratedContentApprovalDigest = blueprintGeneratedContentApprovalDigest;
+exports.blueprintVerificationTargetDigest = blueprintVerificationTargetDigest;
+exports.planBlueprintVerificationExecution = planBlueprintVerificationExecution;
+exports.assertBlueprintVerificationTargetAgentSafe = assertBlueprintVerificationTargetAgentSafe;
+exports.blueprintVerificationTargetDependencies = blueprintVerificationTargetDependencies;
+exports.blueprintVerificationTargetClosure = blueprintVerificationTargetClosure;
+exports.blueprintVerificationExecutionReceiptPath = blueprintVerificationExecutionReceiptPath;
+exports.createBlueprintVerificationExecutionReceipt = createBlueprintVerificationExecutionReceipt;
+exports.blueprintVerificationExecutionReceiptDigest = blueprintVerificationExecutionReceiptDigest;
+exports.blueprintTrustPolicyDigest = blueprintTrustPolicyDigest;
+exports.createBlueprintTrustState = createBlueprintTrustState;
+exports.blueprintTrustStateDigest = blueprintTrustStateDigest;
+exports.authorizeBlueprintTrust = authorizeBlueprintTrust;
+exports.authorizeBlueprintOwnershipInventory = authorizeBlueprintOwnershipInventory;
+exports.planBlueprintTrustSnapshotUpdate = planBlueprintTrustSnapshotUpdate;
+exports.planBlueprintTrustStateTransition = planBlueprintTrustStateTransition;
+exports.validateBlueprintTrustHistory = validateBlueprintTrustHistory;
+const validation_js_1 = require("../validation.js");
+const node_crypto_1 = require("node:crypto");
+const record_js_1 = require("../ownership/record.js");
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const semver_1 = require("semver");
+const yaml_1 = require("yaml");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+exports.BLUEPRINT_TRUST_SCHEMA_VERSION = 1;
+function hasControlCharacter(value) {
+    return [...value].some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+    });
+}
+exports.BLUEPRINT_TRUST_LIFECYCLE_STATES = [
+    'candidate',
+    'verified',
+    'deprecated',
+    'quarantined',
+    'revoked',
+    'retired',
+];
+exports.BLUEPRINT_TRUST_MAX_FRESHNESS_DAYS = 30;
+exports.BLUEPRINT_TRUST_OVERRIDE_MAX_DAYS = 7;
+const BLUEPRINT_REGISTRY_INTEGRITY = /^sha512-[A-Za-z0-9+/]{86}==$/;
+const BLUEPRINT_GENERATED_SLICE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const BLUEPRINT_VERIFICATION_TARGET = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const BLUEPRINT_GENERATED_FILE = /^(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._@+~/-]{1,512}$/;
+const BLUEPRINT_CONTAINER_REGISTRY = /^(?:[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?)(?::\d{1,5})?$/;
+function hasExactProperties(value, allowed) {
+    const keys = Object.keys(value).sort();
+    return (keys.length === allowed.length &&
+        keys.every((key, index) => key === [...allowed].sort()[index]));
+}
+function blueprintContainerRegistry(base) {
+    if (typeof base !== 'string' ||
+        !/^[a-z0-9][a-z0-9._/-]*:[A-Za-z0-9._-]+@sha256:[a-f0-9]{64}$/.test(base)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', 'Blueprint Dockerfile FROM', 'must be one exact digest-pinned base image');
+    }
+    const first = base.split('/')[0] ?? '';
+    const registry = base.includes('/') &&
+        (first.includes('.') || first.includes(':') || first === 'localhost')
+        ? first
+        : 'docker.io';
+    if (!BLUEPRINT_CONTAINER_REGISTRY.test(registry)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'Blueprint Dockerfile FROM', 'uses an invalid container registry authority');
+    }
+    return registry;
+}
+function resolveBlueprintPackageIntegrity(lockfile, name, version) {
+    let parsed;
+    try {
+        parsed = (0, yaml_1.parse)(lockfile);
+    }
+    catch {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'pnpm-lock.yaml', 'cannot be parsed for Blueprint registry integrity');
+    }
+    if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(name) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(version) ||
+        !(0, validation_js_1.isRecord)(parsed) ||
+        !(0, validation_js_1.isRecord)(parsed.packages) ||
+        !(0, validation_js_1.isRecord)(parsed.importers) ||
+        !(0, validation_js_1.isRecord)(parsed.importers['.'])) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${name}@${version}`, 'requires a complete pnpm lockfile and exact package identity');
+    }
+    const rootImporter = parsed.importers['.'];
+    let directDeclarations = 0;
+    for (const group of [
+        'dependencies',
+        'devDependencies',
+        'optionalDependencies',
+    ]) {
+        if (!(0, validation_js_1.isRecord)(rootImporter[group]) ||
+            !Object.prototype.hasOwnProperty.call(rootImporter[group], name)) {
+            continue;
+        }
+        directDeclarations += 1;
+        const declaration = rootImporter[group][name];
+        if (!(0, validation_js_1.isRecord)(declaration) ||
+            declaration.specifier !== version ||
+            typeof declaration.version !== 'string' ||
+            declaration.version.replace(/\(.+$/, '') !== version) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `pnpm-lock.yaml#importers.${group}.${name}`, `must bind exact direct Blueprint version ${version}`);
+        }
+    }
+    if (directDeclarations !== 1) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `pnpm-lock.yaml#importers.${name}`, 'must contain exactly one direct root Blueprint declaration');
+    }
+    const integrities = new Set();
+    for (const [lockKey, metadata] of Object.entries(parsed.packages)) {
+        if (lockKey.replace(/\(.+$/, '') !== `${name}@${version}` ||
+            !(0, validation_js_1.isRecord)(metadata) ||
+            !(0, validation_js_1.isRecord)(metadata.resolution) ||
+            typeof metadata.resolution.integrity !== 'string') {
+            continue;
+        }
+        integrities.add(metadata.resolution.integrity);
+    }
+    if (integrities.size !== 1 ||
+        !BLUEPRINT_REGISTRY_INTEGRITY.test([...integrities][0] ?? '')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${name}@${version}`, 'must have one exact registry SHA-512 integrity in pnpm-lock.yaml');
+    }
+    return [...integrities][0] ?? '';
+}
+/** Resolves one protected importer tool declaration to its exact pnpm lock version. */
+function parsePnpmImporterPackageAuthorityLockfile(lockfile) {
+    let parsed;
+    try {
+        parsed = (0, yaml_1.parse)(lockfile);
+    }
+    catch {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'pnpm-lock.yaml', 'cannot be parsed for protected root tool authority');
+    }
+    return parsed;
+}
+function resolvePnpmImporterPackageVersionFromParsed(parsed, importer, name, specifier) {
+    if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(name) ||
+        typeof specifier !== 'string' ||
+        specifier.length === 0 ||
+        specifier.length > 128 ||
+        (importer !== '.' &&
+            !/^packages\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u.test(importer)) ||
+        !(0, validation_js_1.isRecord)(parsed) ||
+        !(0, validation_js_1.isRecord)(parsed.packages) ||
+        !(0, validation_js_1.isRecord)(parsed.importers) ||
+        !(0, validation_js_1.isRecord)(parsed.importers[importer])) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', name, 'requires one protected root declaration and complete pnpm lockfile');
+    }
+    const protectedImporter = parsed.importers[importer];
+    const declarations = [];
+    for (const group of [
+        'dependencies',
+        'devDependencies',
+        'optionalDependencies',
+    ]) {
+        const values = protectedImporter[group];
+        if ((0, validation_js_1.isRecord)(values) &&
+            Object.prototype.hasOwnProperty.call(values, name)) {
+            declarations.push(values[name]);
+        }
+    }
+    const declaration = declarations[0];
+    const version = (0, validation_js_1.isRecord)(declaration) && typeof declaration.version === 'string'
+        ? declaration.version.replace(/\(.+$/u, '')
+        : undefined;
+    if (declarations.length !== 1 ||
+        !(0, validation_js_1.isRecord)(declaration) ||
+        declaration.specifier !== specifier ||
+        typeof version !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(version) ||
+        !Object.prototype.hasOwnProperty.call(parsed.packages, `${name}@${version}`)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `pnpm-lock.yaml#importers.${name}`, 'must bind one exact protected root package version');
+    }
+    return version;
+}
+/** Resolves one protected importer tool declaration to its exact pnpm lock version. */
+function resolvePnpmImporterPackageVersion(lockfile, importer, name, specifier) {
+    return resolvePnpmImporterPackageVersionFromParsed(parsePnpmImporterPackageAuthorityLockfile(lockfile), importer, name, specifier);
+}
+function resolvePnpmRootPackageVersion(lockfile, name, specifier) {
+    return resolvePnpmImporterPackageVersion(lockfile, '.', name, specifier);
+}
+function timestamp(value, path) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be a canonical ISO-8601 timestamp');
+    }
+    return parsed;
+}
+function validateIntegrity(value, path) {
+    if (!BLUEPRINT_REGISTRY_INTEGRITY.test(value)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be an npm SHA-512 integrity value');
+    }
+}
+function validateEntry(entry, index) {
+    const path = `snapshot.entries[${index}]`;
+    if (!(0, validation_js_1.isRecord)(entry) ||
+        !hasExactProperties(entry, [
+            'compatibleFramework',
+            'evidenceDigest',
+            'integrity',
+            'lifecycle',
+            'name',
+            ...(entry.notice === undefined ? [] : ['notice']),
+            'support',
+            'version',
+        ]) ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(entry.name) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(entry.version) ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(entry.evidenceDigest) ||
+        !exports.BLUEPRINT_TRUST_LIFECYCLE_STATES.includes(entry.lifecycle) ||
+        typeof entry.compatibleFramework !== 'string' ||
+        entry.compatibleFramework.trim() === '' ||
+        (0, semver_1.validRange)(entry.compatibleFramework) === null ||
+        typeof entry.support !== 'string' ||
+        entry.support.trim() === '' ||
+        (entry.notice !== undefined &&
+            (typeof entry.notice !== 'string' || entry.notice.trim() === '')) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(entry)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must bind one exact Blueprint release to reviewed lifecycle evidence');
+    }
+    validateIntegrity(entry.integrity, `${path}.integrity`);
+}
+function createBlueprintTrustSnapshot(input) {
+    timestamp(input.generatedAt, 'snapshot.generatedAt');
+    if (!(0, validation_js_1.isRecord)(input) ||
+        !hasExactProperties(input, [
+            'entries',
+            'generatedAt',
+            'schemaVersion',
+            'sequence',
+            'source',
+        ]) ||
+        input.schemaVersion !== exports.BLUEPRINT_TRUST_SCHEMA_VERSION ||
+        !Number.isSafeInteger(input.sequence) ||
+        input.sequence < 1 ||
+        !(0, validation_js_1.isRecord)(input.source) ||
+        !hasExactProperties(input.source, ['kind', 'reference']) ||
+        input.source.kind !== 'repository-reviewed' ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(input.source.reference) ||
+        !Array.isArray(input.entries) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(input)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'snapshot', 'must be a repository-reviewed trust snapshot v1');
+    }
+    input.entries.forEach(validateEntry);
+    const seen = new Set();
+    const entries = [...input.entries]
+        .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.name}\0${left.version}`, `${right.name}\0${right.version}`))
+        .map((entry, index) => {
+        const identity = `${entry.name}@${entry.version}`;
+        if (seen.has(identity)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `snapshot.entries[${index}]`, `duplicates ${identity}`);
+        }
+        seen.add(identity);
+        return { ...entry };
+    });
+    return { ...input, entries };
+}
+function blueprintTrustSnapshotDigest(snapshot) {
+    return (0, common_js_1.supplyChainDigest)(createBlueprintTrustSnapshot(snapshot));
+}
+function validateOverride(value, index, now, requireActive) {
+    const path = `policy.emergencyOverrides[${index}]`;
+    if (!(0, validation_js_1.isRecord)(value) ||
+        !hasExactProperties(value, [
+            'approvedAt',
+            'approver',
+            'exactIntegrity',
+            'expiresAt',
+            'name',
+            'operations',
+            'reason',
+            'recoveryWork',
+            'version',
+        ]) ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(value.name) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(value.version) ||
+        !Array.isArray(value.operations) ||
+        value.operations.length === 0 ||
+        value.operations.some((operation) => !['adopt', 'deploy'].includes(operation)) ||
+        new Set(value.operations).size !== value.operations.length ||
+        [value.approver, value.reason, value.recoveryWork].some((entry) => typeof entry !== 'string' ||
+            entry.trim() === '' ||
+            entry !== entry.trim()) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(value)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be an exact, attributable, recovery-bound emergency decision');
+    }
+    validateIntegrity(value.exactIntegrity, `${path}.exactIntegrity`);
+    const approvedAt = timestamp(value.approvedAt, `${path}.approvedAt`);
+    const expiresAt = timestamp(value.expiresAt, `${path}.expiresAt`);
+    if (approvedAt > now ||
+        expiresAt <= approvedAt ||
+        expiresAt - approvedAt >
+            exports.BLUEPRINT_TRUST_OVERRIDE_MAX_DAYS * 24 * 60 * 60 * 1_000) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}.expiresAt`, `must expire within ${exports.BLUEPRINT_TRUST_OVERRIDE_MAX_DAYS} days of approval`);
+    }
+    if (requireActive && expiresAt <= now) {
+        throw new errors_js_1.SupplyChainError('supply-chain-exception-expired', `${path}.expiresAt`, 'emergency trust override has expired');
+    }
+}
+function sortedUnique(values) {
+    return (new Set(values).size === values.length &&
+        values.every((value, index) => {
+            const previous = values[index - 1];
+            return index === 0 || (previous !== undefined && previous < value);
+        }));
+}
+function createBlueprintGeneratedContent(value, path) {
+    if (!(0, validation_js_1.isRecord)(value) ||
+        !hasExactProperties(value, [
+            'blueprintFiles',
+            'containerRegistries',
+            'projectPath',
+            'slice',
+            'verificationRoots',
+            'verificationTargets',
+        ]) ||
+        typeof value.slice !== 'string' ||
+        !BLUEPRINT_GENERATED_SLICE.test(value.slice) ||
+        value.projectPath !== `packages/${value.slice}/project.json` ||
+        !Array.isArray(value.containerRegistries) ||
+        value.containerRegistries.length > 32 ||
+        value.containerRegistries.some((registry) => typeof registry !== 'string' ||
+            !BLUEPRINT_CONTAINER_REGISTRY.test(registry)) ||
+        !sortedUnique(value.containerRegistries) ||
+        !Array.isArray(value.blueprintFiles) ||
+        value.blueprintFiles.length === 0 ||
+        value.blueprintFiles.length > 8_192 ||
+        value.blueprintFiles.some((file) => !(0, validation_js_1.isRecord)(file) ||
+            !hasExactProperties(file, ['digest', 'mode', 'path']) ||
+            typeof file.path !== 'string' ||
+            !BLUEPRINT_GENERATED_FILE.test(file.path) ||
+            file.path
+                .split('/')
+                .some((segment) => ['', '.', '..'].includes(segment)) ||
+            typeof file.digest !== 'string' ||
+            !common_js_1.SUPPLY_CHAIN_SHA256.test(file.digest) ||
+            (file.mode !== 'managed' && file.mode !== 'seeded')) ||
+        !sortedUnique(value.blueprintFiles.map(({ path: filePath }) => filePath)) ||
+        !Array.isArray(value.verificationRoots) ||
+        value.verificationRoots.length !== 1 ||
+        value.verificationRoots.some((name) => typeof name !== 'string' || !BLUEPRINT_VERIFICATION_TARGET.test(name)) ||
+        !sortedUnique(value.verificationRoots) ||
+        !Array.isArray(value.verificationTargets) ||
+        value.verificationTargets.length === 0 ||
+        value.verificationTargets.length > 64 ||
+        value.verificationTargets.some((target) => !(0, validation_js_1.isRecord)(target) ||
+            !hasExactProperties(target, ['digest', 'name']) ||
+            typeof target.name !== 'string' ||
+            !BLUEPRINT_VERIFICATION_TARGET.test(target.name) ||
+            typeof target.digest !== 'string' ||
+            !common_js_1.SUPPLY_CHAIN_SHA256.test(target.digest)) ||
+        !sortedUnique(value.verificationTargets.map(({ name }) => name)) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(value)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must bind one exact verification closure, complete Blueprint-origin file inventory, and registry inventory to its Slice project');
+    }
+    const content = value;
+    return {
+        blueprintFiles: content.blueprintFiles.map((file) => ({ ...file })),
+        containerRegistries: [...content.containerRegistries],
+        projectPath: content.projectPath,
+        slice: content.slice,
+        verificationRoots: [...content.verificationRoots],
+        verificationTargets: content.verificationTargets.map((target) => ({
+            ...target,
+        })),
+    };
+}
+/**
+ * Domain-separated approval for one exact Blueprint identity and every byte or
+ * execution authority generated for its Slice. Execution evidence refers to
+ * this digest but is retained as a later, separate object.
+ */
+function blueprintGeneratedContentApprovalDigest(blueprint, content) {
+    if (!(0, validation_js_1.isRecord)(blueprint) ||
+        !hasExactProperties(blueprint, ['integrity', 'name', 'version']) ||
+        typeof blueprint.name !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(blueprint.name) ||
+        typeof blueprint.version !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(blueprint.version) ||
+        typeof blueprint.integrity !== 'string') {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'blueprintGeneratedContentApproval.blueprint', 'must identify one exact Blueprint release and integrity');
+    }
+    validateIntegrity(blueprint.integrity, 'blueprintGeneratedContentApproval.blueprint.integrity');
+    return (0, common_js_1.supplyChainDigest)({
+        blueprint: { ...blueprint },
+        content: createBlueprintGeneratedContent(content, 'blueprintGeneratedContentApproval.content'),
+        kind: 'ebk-blueprint-generated-content-approval',
+        schemaVersion: exports.BLUEPRINT_TRUST_SCHEMA_VERSION,
+    });
+}
+const BLUEPRINT_VERIFICATION_TARGET_PROPERTIES = new Set([
+    'cache',
+    'configurations',
+    'continuous',
+    'defaultConfiguration',
+    'dependsOn',
+    'executor',
+    'inputs',
+    'metadata',
+    'options',
+    'outputs',
+    'parallelism',
+    'syncGenerators',
+]);
+const BLUEPRINT_VERIFICATION_PROJECT_ROOT = /^packages\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const BLUEPRINT_VERIFICATION_SCRIPT = /^(?:scripts|testing)\/[a-z0-9][a-z0-9._/-]*\.mjs$/;
+const BLUEPRINT_GENERATED_OUTPUT_PATH = /(?:^|\/)\.(?:next|open-next)(?:\/|$)/u;
+const BLUEPRINT_VERIFICATION_PACKAGE = /^@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/;
+const BLUEPRINT_MUTATING_TARGET = /(?:^|-)(?:apply|backfill|cleanup|create|delete|deploy|destroy|dev|down|drain|generate|migrate|promote|provision|publish|purge|recover|redrive|refresh|release|remove|reconcile|restore|retire|rollback|rotate|seed|start|sync|unlock|up|update|upload|write)(?:-|$)/;
+const BLUEPRINT_MUTATING_COMMAND_TOKEN = /(?:^|[./_-])(?:apply|backfill|cleanup|create|delete|deploy|destroy|dev|down|drain|generate|migrate|promote|provision|publish|purge|recover|redrive|refresh|release|remove|reconcile|restore|retire|rollback|rotate|seed|start|sync|unlock|up|update|upload|write)(?=$|[./_-])/;
+function sameJson(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+/**
+ * Reduces an effective Nx target to the authored execution contract used by
+ * protected Blueprint review. Nx adds empty configuration/parallelism fields;
+ * stripping only those two inert values makes the raw project.json and
+ * effective project graph converge without concealing target-default
+ * dependencies, inputs, or cache behavior.
+ */
+function normalizeBlueprintVerificationTarget(name, value) {
+    if (!BLUEPRINT_VERIFICATION_TARGET.test(name) ||
+        !(0, validation_js_1.isRecord)(value) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(value)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `blueprintVerificationTarget.${name}`, 'must be one bounded, non-sensitive Nx target definition');
+    }
+    const normalized = { ...value };
+    if ((0, validation_js_1.isRecord)(normalized.configurations) &&
+        Object.keys(normalized.configurations).length === 0) {
+        delete normalized.configurations;
+    }
+    if (normalized.parallelism === true)
+        delete normalized.parallelism;
+    return normalized;
+}
+function blueprintVerificationTargetDigest(name, value) {
+    return (0, common_js_1.supplyChainDigest)(normalizeBlueprintVerificationTarget(name, value));
+}
+function blueprintTargetContainsRuntimeInput(value) {
+    if (Array.isArray(value)) {
+        return value.some(blueprintTargetContainsRuntimeInput);
+    }
+    if (!(0, validation_js_1.isRecord)(value))
+        return false;
+    if (Object.prototype.hasOwnProperty.call(value, 'runtime'))
+        return true;
+    return Object.values(value).some(blueprintTargetContainsRuntimeInput);
+}
+/**
+ * Parses the complete protected Blueprint verification option language. The
+ * same structured plan is consumed by validation, recurring Nx execution, and
+ * receipt review so accepted options cannot acquire a shell meaning.
+ */
+function planBlueprintVerificationExecution(options) {
+    if (!(0, validation_js_1.isRecord)(options) || typeof options.kind !== 'string')
+        return undefined;
+    if (options.kind === 'typescript' && Object.keys(options).length === 1) {
+        return { kind: 'typescript' };
+    }
+    if (options.kind === 'node') {
+        const keys = Object.keys(options);
+        const script = options.script;
+        const mode = options.mode;
+        const action = options.action;
+        if (keys.some((key) => !['action', 'kind', 'mode', 'script'].includes(key)) ||
+            typeof script !== 'string' ||
+            !BLUEPRINT_VERIFICATION_SCRIPT.test(script) ||
+            BLUEPRINT_GENERATED_OUTPUT_PATH.test(script) ||
+            script.includes('..') ||
+            BLUEPRINT_MUTATING_COMMAND_TOKEN.test(script) ||
+            (mode !== undefined && mode !== 'strip-types' && mode !== 'test') ||
+            (action !== undefined && action !== 'check' && action !== 'report')) {
+            return undefined;
+        }
+        if (mode === 'test') {
+            if (action !== undefined || !script.startsWith('testing/')) {
+                return undefined;
+            }
+        }
+        const nodeMode = mode === 'strip-types' || mode === 'test' ? mode : undefined;
+        const nodeAction = action === 'check' || action === 'report' ? action : undefined;
+        const arguments_ = [];
+        if (nodeMode === 'strip-types')
+            arguments_.push('--experimental-strip-types');
+        if (nodeMode === 'test')
+            arguments_.push('--test');
+        arguments_.push(script);
+        if (nodeAction !== undefined)
+            arguments_.push(nodeAction);
+        return {
+            ...(nodeAction === undefined ? {} : { action: nodeAction }),
+            arguments: arguments_,
+            kind: 'node',
+            ...(nodeMode === undefined ? {} : { mode: nodeMode }),
+            script,
+        };
+    }
+    if (options.kind !== 'vitest' ||
+        Object.keys(options).sort().join(',') !== 'filterPackage,kind,spec' ||
+        typeof options.filterPackage !== 'string' ||
+        !BLUEPRINT_VERIFICATION_PACKAGE.test(options.filterPackage) ||
+        typeof options.spec !== 'string' ||
+        !/^testing\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*\.spec\.ts$/u.test(options.spec)) {
+        return undefined;
+    }
+    return {
+        filterPackage: options.filterPackage,
+        kind: 'vitest',
+        spec: options.spec,
+    };
+}
+function blueprintVerificationOptionsAreClosed(value) {
+    return planBlueprintVerificationExecution(value) !== undefined;
+}
+/**
+ * Enforces the execution-shape boundary shared by protected Blueprint review,
+ * workspace inspection, and Developer-Agent exposure. Review authenticates
+ * exact bytes; it does not turn Nx runtime inputs, target configurations,
+ * synchronization hooks, continuous processes, or an unauthenticated cache
+ * contract into safe agent operations.
+ */
+function assertBlueprintVerificationTargetAgentSafe(name, value, projectRoot) {
+    const normalized = normalizeBlueprintVerificationTarget(name, value);
+    const configurations = (0, validation_js_1.isRecord)(value) ? value.configurations : undefined;
+    const syncGenerators = (0, validation_js_1.isRecord)(value) ? value.syncGenerators : undefined;
+    const cache = (0, validation_js_1.isRecord)(value) ? value.cache : undefined;
+    const inputs = (0, validation_js_1.isRecord)(value) ? value.inputs : undefined;
+    const executor = (0, validation_js_1.isRecord)(value) ? value.executor : undefined;
+    const options = (0, validation_js_1.isRecord)(value) ? value.options : undefined;
+    if (!BLUEPRINT_VERIFICATION_PROJECT_ROOT.test(projectRoot) ||
+        BLUEPRINT_MUTATING_TARGET.test(name) ||
+        !(0, validation_js_1.isRecord)(value) ||
+        Object.keys(value).some((property) => !BLUEPRINT_VERIFICATION_TARGET_PROPERTIES.has(property)) ||
+        executor !== '@empire-builder-kit/nx:blueprint-verification' ||
+        !blueprintVerificationOptionsAreClosed(options) ||
+        cache !== false ||
+        !Array.isArray(value.dependsOn) ||
+        value.dependsOn.length > 1 ||
+        !sameJson(inputs, []) ||
+        !sameJson(syncGenerators, []) ||
+        (configurations !== undefined &&
+            (!(0, validation_js_1.isRecord)(configurations) || Object.keys(configurations).length > 0)) ||
+        ((0, validation_js_1.isRecord)(value) && value.defaultConfiguration !== undefined) ||
+        blueprintTargetContainsRuntimeInput(inputs) ||
+        ((0, validation_js_1.isRecord)(value) &&
+            value.parallelism !== undefined &&
+            value.parallelism !== true) ||
+        ((0, validation_js_1.isRecord)(value) &&
+            value.continuous !== undefined &&
+            value.continuous !== false) ||
+        ((0, validation_js_1.isRecord)(value) && value.metadata !== undefined) ||
+        blueprintTargetContainsRuntimeInput(normalized)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `blueprintVerificationTarget.${name}`, 'must use the structured no-shell external verification executor without inherited target-default dependencies, runtime inputs, configurations, sync hooks, continuous processes, metadata, or unauthenticated cache behavior');
+    }
+}
+function blueprintVerificationTargetDependencies(name, value, projectRoot) {
+    assertBlueprintVerificationTargetAgentSafe(name, value, projectRoot);
+    const dependsOn = normalizeBlueprintVerificationTarget(name, value).dependsOn;
+    if (dependsOn === undefined)
+        return [];
+    if (!Array.isArray(dependsOn) ||
+        dependsOn.some((dependency) => typeof dependency !== 'string' ||
+            !BLUEPRINT_VERIFICATION_TARGET.test(dependency))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `blueprintVerificationTarget.${name}.dependsOn`, 'must contain only exact same-project target names');
+    }
+    return dependsOn;
+}
+/**
+ * Resolves the exact, same-project dependency closure of publisher-declared
+ * verification roots. Dynamic/cross-project Nx dependency syntax is refused:
+ * a protected review must describe a closed local verification program rather
+ * than inheriting an unbounded project-graph expansion.
+ */
+function blueprintVerificationTargetClosure(input) {
+    if (!Array.isArray(input.roots) ||
+        input.roots.length !== 1 ||
+        input.roots.some((name) => typeof name !== 'string' || !BLUEPRINT_VERIFICATION_TARGET.test(name)) ||
+        new Set(input.roots).size !== input.roots.length ||
+        typeof input.projectRoot !== 'string' ||
+        !BLUEPRINT_VERIFICATION_PROJECT_ROOT.test(input.projectRoot) ||
+        !(0, validation_js_1.isRecord)(input.targets)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'blueprintVerificationTargetClosure', 'requires one canonical Slice project root, exactly one local verification root, and one target map');
+    }
+    const visiting = new Set();
+    const visited = new Set();
+    const resolved = [];
+    const visit = (name) => {
+        if (visited.has(name))
+            return;
+        if (visiting.has(name)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `blueprintVerificationTargetClosure.${name}`, 'contains a verification dependency cycle');
+        }
+        const target = input.targets[name];
+        if (!(0, validation_js_1.isRecord)(target)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `blueprintVerificationTargetClosure.${name}`, 'is missing one exact local target definition');
+        }
+        assertBlueprintVerificationTargetAgentSafe(name, target, input.projectRoot);
+        const normalized = normalizeBlueprintVerificationTarget(name, target);
+        const dependsOn = normalized.dependsOn ?? [];
+        if (!Array.isArray(dependsOn) ||
+            dependsOn.length > 1 ||
+            dependsOn.some((dependency) => typeof dependency !== 'string' ||
+                !BLUEPRINT_VERIFICATION_TARGET.test(dependency))) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `blueprintVerificationTargetClosure.${name}.dependsOn`, 'must contain at most one exact same-project target name');
+        }
+        visiting.add(name);
+        for (const dependency of dependsOn)
+            visit(dependency);
+        visiting.delete(name);
+        visited.add(name);
+        resolved.push({
+            digest: blueprintVerificationTargetDigest(name, target),
+            name,
+        });
+        if (resolved.length > 64) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'blueprintVerificationTargetClosure', 'exceeds the 64-target dependency bound');
+        }
+    };
+    for (const root of input.roots)
+        visit(root);
+    return resolved.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name));
+}
+function blueprintVerificationExecutionReceiptPath(slice) {
+    if (!BLUEPRINT_GENERATED_SLICE.test(slice)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'blueprintVerificationExecutionReceipt.slice', 'must be one canonical Slice identifier');
+    }
+    return `supply-chain/blueprint-verification-receipts/${slice}.json`;
+}
+function createBlueprintVerificationExecutionReceipt(value, expected) {
+    const path = 'blueprintVerificationExecutionReceipt';
+    if (!(0, validation_js_1.isRecord)(value) ||
+        !hasExactProperties(value, [
+            'approvalDigest',
+            'blueprint',
+            'blueprintFiles',
+            'containerRegistries',
+            'executedRoots',
+            'executionAuthorities',
+            'executionCommit',
+            'generatedAt',
+            'kind',
+            'lockfileSha256',
+            'nodeEngine',
+            'nodeVersion',
+            'nodeVersionDeclaration',
+            'projectPath',
+            'repositoryRootCommit',
+            'schemaVersion',
+            'slice',
+            'verificationRoots',
+            'verificationTargets',
+            'workspace',
+        ]) ||
+        value.kind !== 'ebk-blueprint-verification-execution' ||
+        value.schemaVersion !== exports.BLUEPRINT_TRUST_SCHEMA_VERSION ||
+        typeof value.approvalDigest !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(value.approvalDigest) ||
+        typeof value.workspace !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(value.workspace) ||
+        typeof value.executionCommit !== 'string' ||
+        !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value.executionCommit) ||
+        typeof value.repositoryRootCommit !== 'string' ||
+        !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value.repositoryRootCommit) ||
+        !(0, validation_js_1.isRecord)(value.blueprint) ||
+        !hasExactProperties(value.blueprint, ['integrity', 'name', 'version']) ||
+        typeof value.blueprint.name !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(value.blueprint.name) ||
+        typeof value.blueprint.version !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(value.blueprint.version) ||
+        typeof value.blueprint.integrity !== 'string' ||
+        !Array.isArray(value.executedRoots) ||
+        !Array.isArray(value.executionAuthorities) ||
+        !Array.isArray(value.verificationRoots) ||
+        value.executedRoots.length !== value.verificationRoots.length ||
+        value.executedRoots.some((execution, index) => !(0, validation_js_1.isRecord)(execution) ||
+            !hasExactProperties(execution, ['outcome', 'target']) ||
+            execution.outcome !== 'passed' ||
+            execution.target !==
+                `${value.slice}:${String(value.verificationRoots[index])}`) ||
+        typeof value.nodeVersion !== 'string' ||
+        !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(value.nodeVersion) ||
+        typeof value.nodeEngine !== 'string' ||
+        value.nodeEngine.length === 0 ||
+        value.nodeEngine.length > 256 ||
+        value.nodeEngine.trim() !== value.nodeEngine ||
+        hasControlCharacter(value.nodeEngine) ||
+        (0, semver_1.validRange)(value.nodeEngine) === null ||
+        typeof value.nodeVersionDeclaration !== 'string' ||
+        !/^\d+\.\d+\.\d+$/u.test(value.nodeVersionDeclaration) ||
+        !(0, semver_1.satisfies)(value.nodeVersion, value.nodeEngine) ||
+        !(0, semver_1.satisfies)(value.nodeVersionDeclaration, value.nodeEngine) ||
+        typeof value.lockfileSha256 !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(value.lockfileSha256) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(value)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be one bounded, exact-root, passed Blueprint verification execution receipt');
+    }
+    validateIntegrity(value.blueprint.integrity, `${path}.blueprint.integrity`);
+    const generatedAt = timestamp(value.generatedAt, `${path}.generatedAt`);
+    const content = createBlueprintGeneratedContent({
+        blueprintFiles: value.blueprintFiles,
+        containerRegistries: value.containerRegistries,
+        projectPath: value.projectPath,
+        slice: value.slice,
+        verificationRoots: value.verificationRoots,
+        verificationTargets: value.verificationTargets,
+    }, `${path}.content`);
+    const receipt = value;
+    if (receipt.executionAuthorities.length !==
+        content.verificationTargets.length ||
+        receipt.executionAuthorities.some((authority, index) => {
+            const target = `${content.slice}:${String(content.verificationTargets[index]?.name)}`;
+            if (!(0, validation_js_1.isRecord)(authority) || authority.target !== target)
+                return true;
+            if (authority.kind === 'node') {
+                return !hasExactProperties(authority, ['kind', 'target']);
+            }
+            if (authority.kind !== 'typescript' && authority.kind !== 'vitest') {
+                return true;
+            }
+            return (!hasExactProperties(authority, [
+                'bin',
+                'importer',
+                'kind',
+                'name',
+                'specifier',
+                'target',
+                'version',
+            ]) ||
+                authority.name !== authority.kind ||
+                typeof authority.bin !== 'string' ||
+                !/^\.\/[A-Za-z0-9._/-]+$/u.test(authority.bin) ||
+                authority.bin.split('/').includes('..') ||
+                (authority.importer !== '.' &&
+                    (typeof authority.importer !== 'string' ||
+                        !BLUEPRINT_VERIFICATION_PROJECT_ROOT.test(authority.importer))) ||
+                typeof authority.specifier !== 'string' ||
+                authority.specifier.length === 0 ||
+                authority.specifier.length > 256 ||
+                hasControlCharacter(authority.specifier) ||
+                typeof authority.version !== 'string' ||
+                !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(authority.version));
+        })) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${path}.executionAuthorities`, 'must bind every executed target to one exact portable Node or locked package execution authority');
+    }
+    const selfApprovalDigest = blueprintGeneratedContentApprovalDigest(receipt.blueprint, content);
+    if (receipt.approvalDigest !== selfApprovalDigest) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${path}.approvalDigest`, 'does not bind the exact Blueprint identity and generated content carried by this execution receipt');
+    }
+    if (expected !== undefined &&
+        (receipt.approvalDigest !== expected.approvalDigest ||
+            receipt.workspace !== expected.workspace ||
+            receipt.executionCommit !== expected.executionCommit ||
+            receipt.repositoryRootCommit !== expected.repositoryRootCommit ||
+            !sameJson(receipt.blueprint, expected.blueprint) ||
+            !sameJson(content, expected.content) ||
+            generatedAt <
+                timestamp(expected.reviewedAt, `${path}.expected.reviewedAt`))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', path, 'does not postdate and bind the exact protected approval, repository, execution commit, workspace, Blueprint release, generated bytes, registry authorities, or verification closure');
+    }
+    return {
+        ...receipt,
+        blueprint: { ...receipt.blueprint },
+        blueprintFiles: content.blueprintFiles,
+        containerRegistries: content.containerRegistries,
+        executedRoots: receipt.executedRoots.map((execution) => ({
+            ...execution,
+        })),
+        executionAuthorities: receipt.executionAuthorities.map((authority) => ({
+            ...authority,
+        })),
+        verificationRoots: content.verificationRoots,
+        verificationTargets: content.verificationTargets,
+    };
+}
+function blueprintVerificationExecutionReceiptDigest(value, expected) {
+    return (0, common_js_1.supplyChainDigest)(createBlueprintVerificationExecutionReceipt(value, expected));
+}
+function validateGeneratedReview(value, index, now) {
+    const path = `policy.generatedReviews[${index}]`;
+    if (!(0, validation_js_1.isRecord)(value) ||
+        !hasExactProperties(value, [
+            'allowedContainerRegistries',
+            'blueprint',
+            'blueprintFiles',
+            'evidenceDigest',
+            'projectPath',
+            'reference',
+            'reviewedAt',
+            'slice',
+            'verificationRoots',
+            'verificationTargets',
+        ]) ||
+        !(0, validation_js_1.isRecord)(value.blueprint) ||
+        !hasExactProperties(value.blueprint, ['integrity', 'name', 'version']) ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(value.blueprint.name) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(value.blueprint.version) ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(value.evidenceDigest) ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(value.reference) ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(value)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must bind one exact generated-content approval to one Blueprint Slice');
+    }
+    validateIntegrity(value.blueprint.integrity, `${path}.blueprint.integrity`);
+    const content = createBlueprintGeneratedContent({
+        blueprintFiles: value.blueprintFiles,
+        containerRegistries: value.allowedContainerRegistries,
+        projectPath: value.projectPath,
+        slice: value.slice,
+        verificationRoots: value.verificationRoots,
+        verificationTargets: value.verificationTargets,
+    }, `${path}.content`);
+    if (value.evidenceDigest !==
+        blueprintGeneratedContentApprovalDigest(value.blueprint, content)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${path}.evidenceDigest`, 'must equal the deterministic exact generated-content approval digest');
+    }
+    if (timestamp(value.reviewedAt, `${path}.reviewedAt`) > now) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `${path}.reviewedAt`, 'cannot be later than its repository-reviewed snapshot');
+    }
+}
+function validatePolicy(policy, now, requireActive) {
+    if (!(0, validation_js_1.isRecord)(policy) ||
+        !hasExactProperties(policy, [
+            'emergencyOverrides',
+            'generatedReviews',
+            'maxAgeDays',
+            'schemaVersion',
+            'snapshotDigest',
+        ]) ||
+        policy.schemaVersion !== exports.BLUEPRINT_TRUST_SCHEMA_VERSION ||
+        !common_js_1.SUPPLY_CHAIN_SHA256.test(policy.snapshotDigest) ||
+        !Number.isSafeInteger(policy.maxAgeDays) ||
+        policy.maxAgeDays < 1 ||
+        policy.maxAgeDays > exports.BLUEPRINT_TRUST_MAX_FRESHNESS_DAYS ||
+        !Array.isArray(policy.emergencyOverrides) ||
+        !Array.isArray(policy.generatedReviews) ||
+        policy.generatedReviews.length > 1_000 ||
+        (0, common_js_1.hasSensitiveSupplyChainShape)(policy)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'policy', `must pin a snapshot and bound freshness to ${exports.BLUEPRINT_TRUST_MAX_FRESHNESS_DAYS} days`);
+    }
+    const identities = new Set();
+    policy.emergencyOverrides.forEach((override, index) => {
+        validateOverride(override, index, now, requireActive);
+        const identity = `${override.name}@${override.version}`;
+        if (identities.has(identity)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `policy.emergencyOverrides[${index}]`, `duplicates the emergency decision for ${identity}`);
+        }
+        identities.add(identity);
+    });
+    const reviewReferences = new Set();
+    policy.generatedReviews.forEach((review, index) => {
+        validateGeneratedReview(review, index, now);
+        if (reviewReferences.has(review.reference)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `policy.generatedReviews[${index}].reference`, 'must uniquely identify one append-only generated-content review');
+        }
+        reviewReferences.add(review.reference);
+    });
+}
+function blueprintTrustPolicyDigest(policy) {
+    return (0, common_js_1.supplyChainDigest)(policy);
+}
+function createBlueprintTrustState(input) {
+    const snapshot = createBlueprintTrustSnapshot(input.snapshot);
+    validatePolicy(input.policy, timestamp(snapshot.generatedAt, 'snapshot.generatedAt'), false);
+    const snapshotDigest = blueprintTrustSnapshotDigest(snapshot);
+    if (input.policy.snapshotDigest !== snapshotDigest) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'policy.snapshotDigest', 'does not match its repository-reviewed snapshot');
+    }
+    for (const [index, review] of input.policy.generatedReviews.entries()) {
+        const entry = snapshot.entries.find(({ name, version }) => name === review.blueprint.name && version === review.blueprint.version);
+        if (!entry || entry.integrity !== review.blueprint.integrity) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `policy.generatedReviews[${index}].blueprint`, 'must bind an exact release and integrity retained by the snapshot');
+        }
+    }
+    return {
+        policy: {
+            ...input.policy,
+            emergencyOverrides: input.policy.emergencyOverrides.map((override) => ({
+                ...override,
+                operations: [...override.operations],
+            })),
+            generatedReviews: input.policy.generatedReviews.map((review) => ({
+                ...review,
+                allowedContainerRegistries: [...review.allowedContainerRegistries],
+                blueprint: { ...review.blueprint },
+                blueprintFiles: review.blueprintFiles.map((file) => ({ ...file })),
+                verificationRoots: [...review.verificationRoots],
+                verificationTargets: review.verificationTargets.map((target) => ({
+                    ...target,
+                })),
+            })),
+        },
+        snapshot,
+    };
+}
+function blueprintTrustStateDigest(input) {
+    const state = createBlueprintTrustState(input);
+    return (0, common_js_1.supplyChainDigest)({
+        policy: state.policy,
+        snapshot: state.snapshot,
+    });
+}
+function authorizeBlueprintTrust(input) {
+    const now = timestamp(input.now, 'now');
+    if (!common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(input.frameworkVersion) ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(input.name) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(input.version) ||
+        !['adopt', 'deploy'].includes(input.operation)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'blueprintTrust', 'requires exact package, release, framework, and operation identities');
+    }
+    validateIntegrity(input.integrity, 'integrity');
+    const snapshot = createBlueprintTrustSnapshot(input.snapshot);
+    validatePolicy(input.policy, now, true);
+    if (timestamp(snapshot.generatedAt, 'snapshot.generatedAt') > now) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'snapshot.generatedAt', 'reviewed trust snapshot cannot be generated in the future');
+    }
+    const digest = blueprintTrustSnapshotDigest(snapshot);
+    if (digest !== input.policy.snapshotDigest) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'policy.snapshotDigest', 'does not match the reviewed local snapshot bytes');
+    }
+    if (now - timestamp(snapshot.generatedAt, 'snapshot.generatedAt') >
+        input.policy.maxAgeDays * 24 * 60 * 60 * 1_000) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-snapshot-stale', 'snapshot.generatedAt', 'reviewed trust snapshot is outside the declared freshness bound');
+    }
+    const entry = snapshot.entries.find(({ name, version }) => name === input.name && version === input.version);
+    if (!entry || entry.integrity !== input.integrity) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${input.name}@${input.version}`, 'is absent from the snapshot or has different registry integrity');
+    }
+    if (!(0, semver_1.satisfies)(input.frameworkVersion, entry.compatibleFramework)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${input.name}@${input.version}`, `is not reviewed for framework ${input.frameworkVersion}`);
+    }
+    if (entry.lifecycle === 'verified') {
+        return {
+            decision: 'allow',
+            entry: {
+                lifecycle: entry.lifecycle,
+                name: entry.name,
+                version: entry.version,
+            },
+            reason: 'verified',
+        };
+    }
+    if (entry.lifecycle === 'deprecated') {
+        return {
+            decision: 'allow',
+            entry: {
+                lifecycle: entry.lifecycle,
+                name: entry.name,
+                version: entry.version,
+            },
+            reason: 'deprecated',
+        };
+    }
+    const override = input.policy.emergencyOverrides.find((candidate) => candidate.name === entry.name &&
+        candidate.version === entry.version &&
+        candidate.exactIntegrity === entry.integrity &&
+        candidate.operations.includes(input.operation));
+    if (override) {
+        return {
+            decision: 'allow',
+            entry: {
+                lifecycle: entry.lifecycle,
+                name: entry.name,
+                version: entry.version,
+            },
+            override: {
+                approver: override.approver,
+                expiresAt: override.expiresAt,
+                recoveryWork: override.recoveryWork,
+            },
+            reason: 'emergency-override',
+        };
+    }
+    const result = {
+        decision: 'deny',
+        entry: {
+            lifecycle: entry.lifecycle,
+            name: entry.name,
+            version: entry.version,
+        },
+        reason: 'lifecycle-denied',
+    };
+    if (entry.lifecycle === 'revoked') {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-revoked', `${entry.name}@${entry.version}`, `is revoked for ${input.operation}; use the reviewed recovery or exact emergency path`);
+    }
+    return result;
+}
+function authorizeBlueprintOwnershipInventory(input) {
+    timestamp(input.now, 'now');
+    if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(input.builtIn.name) ||
+        !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(input.builtIn.version) ||
+        !Array.isArray(input.builtIn.provenance) ||
+        input.builtIn.provenance.length > 1_000 ||
+        !Array.isArray(input.generatedContent) ||
+        input.generatedContent.length > 1_000 ||
+        !['adopt', 'deploy'].includes(input.operation) ||
+        !Array.isArray(input.ownership) ||
+        input.ownership.length > 1_000 ||
+        !(0, validation_js_1.isRecord)(input.manifest) ||
+        typeof input.manifest.name !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(input.manifest.name) ||
+        !Array.isArray(input.verificationReceipts) ||
+        input.verificationReceipts.length > 1_000 ||
+        !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(input.repositoryRootCommit)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'blueprintOwnership', 'requires one exact in-process Blueprint identity, a bounded ownership inventory, and a workspace manifest');
+    }
+    const byIdentity = new Map();
+    const provenanceByPath = new Map();
+    for (const [index, provenance] of input.builtIn.provenance.entries()) {
+        const candidate = provenance;
+        if (!(0, validation_js_1.isRecord)(candidate) ||
+            !hasExactProperties(candidate, [
+                'authority',
+                ...(candidate.commit === undefined ? [] : ['commit']),
+                'name',
+                'path',
+                'version',
+            ]) ||
+            typeof candidate.authority !== 'string' ||
+            ![
+                'candidate-git-history',
+                'protected-git-history',
+                'working-tree-adoption',
+            ].includes(candidate.authority) ||
+            typeof candidate.path !== 'string' ||
+            typeof candidate.name !== 'string' ||
+            typeof candidate.version !== 'string' ||
+            !common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(candidate.name) ||
+            !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(candidate.version) ||
+            !/^packages\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*\/\.ebk\/ownership\.json$/.test(candidate.path) ||
+            (candidate.commit !== undefined &&
+                (typeof candidate.commit !== 'string' ||
+                    !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(candidate.commit))) ||
+            (candidate.authority === 'working-tree-adoption' &&
+                candidate.commit !== undefined) ||
+            (candidate.authority !== 'working-tree-adoption' &&
+                candidate.commit === undefined) ||
+            provenanceByPath.has(candidate.path)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `blueprintOwnership.builtIn.provenance[${index}]`, 'must be one unique Git-derived built-in provenance decision');
+        }
+        provenanceByPath.set(candidate.path, candidate);
+    }
+    const generatedContentBySlice = new Map();
+    for (const [index, candidate] of input.generatedContent.entries()) {
+        const content = createBlueprintGeneratedContent(candidate, `blueprintOwnership.generatedContent[${index}]`);
+        if (generatedContentBySlice.has(content.slice)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `blueprintOwnership.generatedContent[${index}]`, `duplicates Slice ${content.slice}`);
+        }
+        generatedContentBySlice.set(content.slice, content);
+    }
+    const verificationReceiptBySlice = new Map();
+    const workspaceNodeEngine = (0, validation_js_1.isRecord)(input.manifest.engines)
+        ? input.manifest.engines.node
+        : undefined;
+    for (const [index, candidate] of input.verificationReceipts.entries()) {
+        if (!(0, validation_js_1.isRecord)(candidate) ||
+            !hasExactProperties(candidate, [
+                'protectedCommit',
+                'receipt',
+                'reference',
+            ]) ||
+            typeof candidate.protectedCommit !== 'string' ||
+            !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(candidate.protectedCommit)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `blueprintOwnership.verificationReceipts[${index}]`, 'must be one exact protected-Git receipt blob');
+        }
+        const receipt = createBlueprintVerificationExecutionReceipt(candidate.receipt);
+        if (typeof input.lockfile !== 'string' ||
+            (0, node_crypto_1.createHash)('sha256').update(input.lockfile, 'utf8').digest('hex') !==
+                receipt.lockfileSha256) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `blueprintOwnership.verificationReceipts[${index}].receipt.lockfileSha256`, 'must bind the exact current bounded pnpm lockfile bytes');
+        }
+        if (typeof workspaceNodeEngine !== 'string' ||
+            workspaceNodeEngine !== receipt.nodeEngine ||
+            input.nodeVersionSource !== `${receipt.nodeVersionDeclaration}\n` ||
+            !(0, semver_1.satisfies)(receipt.nodeVersion, workspaceNodeEngine)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `blueprintOwnership.verificationReceipts[${index}].receipt.nodeVersion`, 'must record an execution Node version allowed by the protected workspace engine contract');
+        }
+        if (candidate.reference !==
+            blueprintVerificationExecutionReceiptPath(receipt.slice)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `blueprintOwnership.verificationReceipts[${index}].reference`, 'must equal the canonical protected receipt path for its Slice');
+        }
+        if (verificationReceiptBySlice.has(receipt.slice)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `blueprintOwnership.verificationReceipts[${index}]`, `duplicates Slice ${receipt.slice}`);
+        }
+        verificationReceiptBySlice.set(receipt.slice, receipt);
+    }
+    const seenSlices = new Set();
+    const externalSlices = new Set();
+    const blueprintFileShapesBySlice = new Map();
+    for (const [index, candidate] of input.ownership.entries()) {
+        if (!(0, validation_js_1.isRecord)(candidate) ||
+            typeof candidate.path !== 'string' ||
+            !Object.prototype.hasOwnProperty.call(candidate, 'value')) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `blueprintOwnership[${index}]`, 'must bind one ownership value to its repository-relative path');
+        }
+        const validated = (0, record_js_1.validateGeneratedOwnershipRecord)(candidate.value);
+        if (!validated.valid) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', candidate.path, validated.issues
+                .slice(0, 10)
+                .map(({ message, path }) => `${path}: ${message}`)
+                .join('; '));
+        }
+        const ownership = validated.value;
+        const expectedPath = `packages/${ownership.slice}/.ebk/ownership.json`;
+        if (candidate.path !== expectedPath || seenSlices.has(ownership.slice)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', candidate.path, candidate.path !== expectedPath
+                ? `must equal ${expectedPath}`
+                : `duplicates Slice ${ownership.slice}`);
+        }
+        seenSlices.add(ownership.slice);
+        const source = ownership.blueprint.name === input.builtIn.name
+            ? 'built-in'
+            : 'external';
+        if (!common_js_1.SUPPLY_CHAIN_PACKAGE_NAME.test(ownership.blueprint.name) ||
+            !common_js_1.SUPPLY_CHAIN_EXACT_VERSION.test(ownership.blueprint.version) ||
+            (source === 'built-in' &&
+                ownership.blueprint.version !== input.builtIn.version)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${candidate.path}#blueprint`, source === 'built-in'
+                ? `must match in-process ${input.builtIn.name}@${input.builtIn.version}`
+                : 'must identify an exact external package release');
+        }
+        if (source === 'built-in') {
+            const provenance = provenanceByPath.get(candidate.path);
+            if (!provenance ||
+                provenance.name !== ownership.blueprint.name ||
+                provenance.version !== ownership.blueprint.version ||
+                (input.operation === 'deploy' &&
+                    provenance.authority !== 'protected-git-history')) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${candidate.path}#blueprint`, input.operation === 'deploy'
+                    ? 'built-in provenance must be established by the protected Git history before deployment'
+                    : 'built-in provenance must be established by Git history or a new working-tree adoption');
+            }
+        }
+        else {
+            externalSlices.add(ownership.slice);
+            blueprintFileShapesBySlice.set(ownership.slice, ownership.paths
+                .filter(({ origin }) => origin === 'blueprint')
+                .map(({ mode, path }) => ({ mode, path }))
+                .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path)));
+        }
+        const identity = `${ownership.blueprint.name}@${ownership.blueprint.version}`;
+        const existing = byIdentity.get(identity);
+        if (existing) {
+            existing.slices.add(ownership.slice);
+        }
+        else {
+            byIdentity.set(identity, {
+                name: ownership.blueprint.name,
+                slices: new Set([ownership.slice]),
+                source,
+                version: ownership.blueprint.version,
+            });
+        }
+    }
+    if (generatedContentBySlice.size !== externalSlices.size ||
+        [...generatedContentBySlice.keys()].some((slice) => !externalSlices.has(slice)) ||
+        verificationReceiptBySlice.size !== externalSlices.size ||
+        [...verificationReceiptBySlice.keys()].some((slice) => !externalSlices.has(slice))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.generatedContent', 'must cover every and only externally generated Slice');
+    }
+    const devDependencies = (0, validation_js_1.isRecord)(input.manifest.devDependencies)
+        ? input.manifest.devDependencies
+        : {};
+    const decisions = [];
+    for (const blueprint of [...byIdentity.values()].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(`${left.name}\0${left.version}`, `${right.name}\0${right.version}`))) {
+        const slices = [...blueprint.slices].sort();
+        if (blueprint.source === 'built-in') {
+            const authorities = slices.map((slice) => {
+                const provenance = provenanceByPath.get(`packages/${slice}/.ebk/ownership.json`);
+                if (!provenance) {
+                    throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `packages/${slice}/.ebk/ownership.json#blueprint`, 'is missing built-in provenance');
+                }
+                return provenance.authority;
+            });
+            decisions.push({
+                name: blueprint.name,
+                provenance: authorities.includes('working-tree-adoption')
+                    ? 'working-tree-adoption'
+                    : authorities.includes('candidate-git-history')
+                        ? 'candidate-git-history'
+                        : 'protected-git-history',
+                reason: 'in-process',
+                slices,
+                source: blueprint.source,
+                version: blueprint.version,
+            });
+            continue;
+        }
+        if (devDependencies[blueprint.name] !== blueprint.version) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `package.json#devDependencies.${blueprint.name}`, `must declare exact generated Blueprint version ${blueprint.version}`);
+        }
+        if (typeof input.lockfile !== 'string' ||
+            input.policy === undefined ||
+            input.snapshot === undefined) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${blueprint.name}@${blueprint.version}`, 'requires the exact lockfile and reviewed offline trust inputs');
+        }
+        const integrity = resolveBlueprintPackageIntegrity(input.lockfile, blueprint.name, blueprint.version);
+        const decision = authorizeBlueprintTrust({
+            frameworkVersion: input.builtIn.version,
+            integrity,
+            name: blueprint.name,
+            now: input.now,
+            operation: input.operation,
+            policy: input.policy,
+            snapshot: input.snapshot,
+            version: blueprint.version,
+        });
+        if (decision.decision !== 'allow' ||
+            decision.reason === 'lifecycle-denied') {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${blueprint.name}@${blueprint.version}`, `${decision.entry.lifecycle} lifecycle denies ${input.operation}`);
+        }
+        for (const slice of slices) {
+            const content = generatedContentBySlice.get(slice);
+            if (!content) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `packages/${slice}/project.json`, 'has no exact generated-content inventory');
+            }
+            const expectedFileShapes = blueprintFileShapesBySlice.get(slice);
+            const actualFileShapes = content.blueprintFiles.map(({ mode, path }) => ({
+                mode,
+                path,
+            }));
+            if (expectedFileShapes === undefined ||
+                !sameJson(actualFileShapes, expectedFileShapes)) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `packages/${slice}/.ebk/ownership.json#paths`, 'every and only Blueprint-origin managed and seeded file must appear in the exact full-byte approval inventory');
+            }
+            const receipt = verificationReceiptBySlice.get(slice);
+            if (!receipt) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', blueprintVerificationExecutionReceiptPath(slice), 'is required for every externally generated Slice');
+            }
+            const exactBlueprint = {
+                integrity,
+                name: blueprint.name,
+                version: blueprint.version,
+            };
+            const approvalDigest = blueprintGeneratedContentApprovalDigest(exactBlueprint, content);
+            const review = input.policy.generatedReviews.find((review) => review.blueprint.name === blueprint.name &&
+                review.blueprint.version === blueprint.version &&
+                review.blueprint.integrity === integrity &&
+                review.slice === slice &&
+                review.projectPath === content.projectPath &&
+                (0, common_js_1.supplyChainDigest)(review.verificationTargets) ===
+                    (0, common_js_1.supplyChainDigest)(content.verificationTargets) &&
+                (0, common_js_1.supplyChainDigest)(review.blueprintFiles) ===
+                    (0, common_js_1.supplyChainDigest)(content.blueprintFiles) &&
+                (0, common_js_1.supplyChainDigest)(review.verificationRoots) ===
+                    (0, common_js_1.supplyChainDigest)(content.verificationRoots) &&
+                (0, common_js_1.supplyChainDigest)(review.allowedContainerRegistries) ===
+                    (0, common_js_1.supplyChainDigest)(content.containerRegistries) &&
+                review.evidenceDigest === approvalDigest);
+            if (!review) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `packages/${slice}/project.json`, 'verification roots, target closure, full Blueprint-origin bytes, or Blueprint-authored container registries lack an exact protected generated-content approval');
+            }
+            blueprintVerificationExecutionReceiptDigest(receipt, {
+                approvalDigest: review.evidenceDigest,
+                blueprint: exactBlueprint,
+                content,
+                executionCommit: receipt.executionCommit,
+                repositoryRootCommit: input.repositoryRootCommit,
+                reviewedAt: review.reviewedAt,
+                workspace: input.manifest.name,
+            });
+        }
+        decisions.push({
+            integrity,
+            lifecycle: decision.entry.lifecycle,
+            name: blueprint.name,
+            reason: decision.reason,
+            slices,
+            source: blueprint.source,
+            version: blueprint.version,
+        });
+    }
+    return {
+        decisions,
+        generatedAt: input.now,
+        kind: 'ebk-blueprint-trust-check',
+        operation: input.operation,
+        schemaVersion: exports.BLUEPRINT_TRUST_SCHEMA_VERSION,
+    };
+}
+const ALLOWED_TRANSITIONS = {
+    candidate: ['verified', 'quarantined', 'revoked'],
+    deprecated: ['quarantined', 'retired', 'revoked', 'verified'],
+    quarantined: ['deprecated', 'retired', 'revoked', 'verified'],
+    retired: [],
+    revoked: [],
+    verified: ['deprecated', 'quarantined', 'revoked'],
+};
+function planBlueprintTrustSnapshotUpdate(currentInput, proposedInput) {
+    const current = createBlueprintTrustSnapshot(currentInput);
+    const proposed = createBlueprintTrustSnapshot(proposedInput);
+    if (proposed.sequence <= current.sequence ||
+        timestamp(proposed.generatedAt, 'proposed.generatedAt') <=
+            timestamp(current.generatedAt, 'current.generatedAt')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'proposed', 'must advance both snapshot sequence and generation time');
+    }
+    const proposedByIdentity = new Map(proposed.entries.map((entry) => [`${entry.name}@${entry.version}`, entry]));
+    const changes = [];
+    for (const currentEntry of current.entries) {
+        const identity = `${currentEntry.name}@${currentEntry.version}`;
+        const next = proposedByIdentity.get(identity);
+        if (!next) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.entries.${identity}`, 'cannot remove an exact release and erase its revocation history');
+        }
+        if (next.integrity !== currentEntry.integrity ||
+            next.compatibleFramework !== currentEntry.compatibleFramework) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.entries.${identity}`, 'cannot rewrite immutable package integrity or compatibility identity');
+        }
+        const metadataChanged = next.notice !== currentEntry.notice ||
+            next.support !== currentEntry.support;
+        if (next.lifecycle !== currentEntry.lifecycle) {
+            if (!ALLOWED_TRANSITIONS[currentEntry.lifecycle].includes(next.lifecycle)) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.entries.${identity}.lifecycle`, `cannot transition ${currentEntry.lifecycle} to ${next.lifecycle}`);
+            }
+            if (next.evidenceDigest === currentEntry.evidenceDigest) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.entries.${identity}.evidenceDigest`, 'lifecycle transition requires new reviewed evidence');
+            }
+            changes.push({
+                from: currentEntry.lifecycle,
+                identity,
+                kind: 'lifecycle',
+                to: next.lifecycle,
+            });
+        }
+        else if (metadataChanged) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.entries.${identity}`, 'snapshot-only planning cannot rewrite reviewed support metadata');
+        }
+        else if (next.evidenceDigest !== currentEntry.evidenceDigest) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.entries.${identity}.evidenceDigest`, 'cannot rewrite evidence without a trust decision change');
+        }
+    }
+    const currentIdentities = new Set(current.entries.map(({ name, version }) => `${name}@${version}`));
+    for (const entry of proposed.entries) {
+        const identity = `${entry.name}@${entry.version}`;
+        if (!currentIdentities.has(identity)) {
+            changes.push({
+                identity,
+                kind: 'added',
+                to: entry.lifecycle,
+            });
+        }
+    }
+    if (changes.length === 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'proposed', 'contains no trust decision change');
+    }
+    return {
+        applies: false,
+        changes: changes.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.identity, right.identity)),
+        currentDigest: blueprintTrustSnapshotDigest(current),
+        proposedDigest: blueprintTrustSnapshotDigest(proposed),
+        schemaVersion: exports.BLUEPRINT_TRUST_SCHEMA_VERSION,
+    };
+}
+function compareTrustChange(left, right) {
+    const leftKey = `${left.identity}\0${left.kind}`;
+    const rightKey = `${right.identity}\0${right.kind}`;
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+}
+function emergencyOverrideIdentity(value) {
+    return `${value.name}@${value.version}`;
+}
+function transitionStateIdentity(state) {
+    return {
+        policyDigest: blueprintTrustPolicyDigest(state.policy),
+        sequence: state.snapshot.sequence,
+        snapshotDigest: blueprintTrustSnapshotDigest(state.snapshot),
+        stateDigest: blueprintTrustStateDigest(state),
+    };
+}
+function planBlueprintTrustStateTransition(currentInput, proposedInput) {
+    const current = createBlueprintTrustState(currentInput);
+    const proposed = createBlueprintTrustState(proposedInput);
+    if (proposed.snapshot.sequence <= current.snapshot.sequence ||
+        timestamp(proposed.snapshot.generatedAt, 'proposed.snapshot.generatedAt') <=
+            timestamp(current.snapshot.generatedAt, 'current.snapshot.generatedAt')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'proposed', 'must advance both snapshot sequence and generation time');
+    }
+    const proposedByIdentity = new Map(proposed.snapshot.entries.map((entry) => [
+        `${entry.name}@${entry.version}`,
+        entry,
+    ]));
+    const changes = [];
+    for (const currentEntry of current.snapshot.entries) {
+        const identity = `${currentEntry.name}@${currentEntry.version}`;
+        const next = proposedByIdentity.get(identity);
+        if (!next) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.snapshot.entries.${identity}`, 'cannot remove an exact release and erase its trust history');
+        }
+        if (next.integrity !== currentEntry.integrity ||
+            next.compatibleFramework !== currentEntry.compatibleFramework) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.snapshot.entries.${identity}`, 'cannot rewrite immutable package integrity or compatibility identity');
+        }
+        const lifecycleChanged = next.lifecycle !== currentEntry.lifecycle;
+        const metadataChanged = next.notice !== currentEntry.notice ||
+            next.support !== currentEntry.support;
+        const evidenceChanged = next.evidenceDigest !== currentEntry.evidenceDigest;
+        if (lifecycleChanged) {
+            if (!ALLOWED_TRANSITIONS[currentEntry.lifecycle].includes(next.lifecycle)) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.snapshot.entries.${identity}.lifecycle`, `cannot transition ${currentEntry.lifecycle} to ${next.lifecycle}`);
+            }
+            if (!evidenceChanged) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.snapshot.entries.${identity}.evidenceDigest`, 'lifecycle transition requires new reviewed evidence');
+            }
+            changes.push({
+                from: currentEntry.lifecycle,
+                identity,
+                kind: 'lifecycle',
+                to: next.lifecycle,
+            });
+        }
+        else if (metadataChanged || evidenceChanged) {
+            if (!evidenceChanged) {
+                throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.snapshot.entries.${identity}.evidenceDigest`, 'reviewed support metadata change requires new evidence');
+            }
+            changes.push({ identity, kind: 'reviewed-evidence' });
+        }
+    }
+    const currentIdentities = new Set(current.snapshot.entries.map(({ name, version }) => `${name}@${version}`));
+    for (const entry of proposed.snapshot.entries) {
+        const identity = `${entry.name}@${entry.version}`;
+        if (!currentIdentities.has(identity)) {
+            changes.push({ identity, kind: 'added', to: entry.lifecycle });
+        }
+    }
+    if (current.policy.maxAgeDays !== proposed.policy.maxAgeDays) {
+        changes.push({
+            from: current.policy.maxAgeDays,
+            identity: 'policy.maxAgeDays',
+            kind: 'freshness',
+            to: proposed.policy.maxAgeDays,
+        });
+    }
+    const currentOverrides = new Map(current.policy.emergencyOverrides.map((override) => [
+        emergencyOverrideIdentity(override),
+        override,
+    ]));
+    const proposedOverrides = new Map(proposed.policy.emergencyOverrides.map((override) => [
+        emergencyOverrideIdentity(override),
+        override,
+    ]));
+    for (const [identity, override] of currentOverrides) {
+        const next = proposedOverrides.get(identity);
+        if (!next) {
+            changes.push({ identity, kind: 'emergency-override-removed' });
+            continue;
+        }
+        if ((0, common_js_1.supplyChainDigest)(next) !== (0, common_js_1.supplyChainDigest)(override)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.policy.emergencyOverrides.${identity}`, 'cannot rewrite an attributable emergency decision in place');
+        }
+    }
+    for (const [identity, override] of proposedOverrides) {
+        if (currentOverrides.has(identity))
+            continue;
+        const entry = proposedByIdentity.get(identity);
+        if (!entry || entry.integrity !== override.exactIntegrity) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.policy.emergencyOverrides.${identity}`, 'must bind an exact release and integrity retained by the snapshot');
+        }
+        changes.push({ identity, kind: 'emergency-override-added' });
+    }
+    const currentReviews = new Map(current.policy.generatedReviews.map((review) => [review.reference, review]));
+    const proposedReviews = new Map(proposed.policy.generatedReviews.map((review) => [
+        review.reference,
+        review,
+    ]));
+    for (const [reference, review] of currentReviews) {
+        const next = proposedReviews.get(reference);
+        if (!next) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.policy.generatedReviews.${reference}`, 'cannot remove an append-only generated-content review');
+        }
+        if ((0, common_js_1.supplyChainDigest)(next) !== (0, common_js_1.supplyChainDigest)(review)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `proposed.policy.generatedReviews.${reference}`, 'cannot rewrite an append-only generated-content review');
+        }
+    }
+    for (const reference of proposedReviews.keys()) {
+        if (!currentReviews.has(reference)) {
+            changes.push({
+                identity: reference,
+                kind: 'generated-content-review-added',
+            });
+        }
+    }
+    if (changes.length === 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'proposed', 'contains no trust or policy decision change');
+    }
+    if (proposed.snapshot.source.reference === current.snapshot.source.reference) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'proposed.snapshot.source.reference', 'must identify the new repository review for this transition');
+    }
+    const currentIdentity = transitionStateIdentity(current);
+    const proposedIdentity = transitionStateIdentity(proposed);
+    const receiptWithoutDigest = {
+        changes: changes.sort(compareTrustChange),
+        current: currentIdentity,
+        kind: 'ebk-blueprint-trust-transition',
+        proposed: proposedIdentity,
+        reference: proposed.snapshot.source.reference,
+        reviewedAt: proposed.snapshot.generatedAt,
+        schemaVersion: exports.BLUEPRINT_TRUST_SCHEMA_VERSION,
+    };
+    return {
+        applies: false,
+        receipt: {
+            ...receiptWithoutDigest,
+            transitionDigest: (0, common_js_1.supplyChainDigest)(receiptWithoutDigest),
+        },
+        schemaVersion: exports.BLUEPRINT_TRUST_SCHEMA_VERSION,
+    };
+}
+function validateBlueprintTrustHistory(input) {
+    if (!Array.isArray(input) || input.length === 0 || input.length > 10_000) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'blueprintTrustHistory', 'must contain one through 10,000 first-parent Git states');
+    }
+    const commits = new Set();
+    const transitions = [];
+    let previous;
+    let previousDigest;
+    for (const [index, candidate] of input.entries()) {
+        if (!(0, validation_js_1.isRecord)(candidate) ||
+            typeof candidate.commit !== 'string' ||
+            !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(candidate.commit) ||
+            commits.has(candidate.commit)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `blueprintTrustHistory[${index}].commit`, 'must be a unique full Git object ID in first-parent order');
+        }
+        const commit = candidate.commit;
+        commits.add(commit);
+        const current = createBlueprintTrustState(candidate);
+        const currentDigest = blueprintTrustStateDigest(current);
+        if (previous && currentDigest !== previousDigest) {
+            transitions.push({
+                ...planBlueprintTrustStateTransition(previous, current).receipt,
+                commit,
+            });
+        }
+        previous = current;
+        previousDigest = currentDigest;
+    }
+    const first = input[0];
+    const last = input.at(-1);
+    if (!first || !last || !previousDigest) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'blueprintTrustHistory', 'could not resolve its anchor and head states');
+    }
+    return {
+        anchorCommit: first.commit,
+        headCommit: last.commit,
+        kind: 'ebk-blueprint-trust-history',
+        schemaVersion: exports.BLUEPRINT_TRUST_SCHEMA_VERSION,
+        stateDigest: previousDigest,
+        transitions,
+    };
+}
+//# sourceMappingURL=blueprint-trust.js.map