@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/generated-blueprint-trust-command.js

@@ -0,0 +1,1362 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BLUEPRINT_VERIFICATION_VITEST_CONFIG_SOURCE = void 0;
+exports.renderBlueprintVerificationVitestConfig = renderBlueprintVerificationVitestConfig;
+exports.renderBlueprintTrustCheckCommand = renderBlueprintTrustCheckCommand;
+const blueprint_verification_authority_js_1 = require("./blueprint-verification-authority.js");
+Object.defineProperty(exports, "BLUEPRINT_VERIFICATION_VITEST_CONFIG_SOURCE", { enumerable: true, get: function () { return blueprint_verification_authority_js_1.BLUEPRINT_VERIFICATION_VITEST_CONFIG_SOURCE; } });
+function renderBlueprintVerificationVitestConfig() {
+    return blueprint_verification_authority_js_1.BLUEPRINT_VERIFICATION_VITEST_CONFIG_SOURCE;
+}
+function renderBlueprintTrustCheckCommand() {
+    return String.raw `import {
+  authorizeBlueprintOwnershipInventory,
+  authorizeBlueprintTrust,
+  assertBlueprintVerificationNxAuthority,
+  assertNoMutableBlueprintVerificationConfiguration,
+  assertProtectedGitWorkingTreeAuthority,
+  blueprintContainerRegistry,
+  blueprintGeneratedContentApprovalDigest,
+  blueprintVerificationExecutionReceiptDigest,
+  blueprintVerificationExecutionReceiptPath,
+  blueprintVerificationTargetDependencies,
+  blueprintVerificationTargetClosure,
+  createBlueprintVerificationExecutionReceipt,
+  assertPnpmReviewConfiguration,
+  inspectBlueprintTrustGitAuthority,
+  inspectProtectedGitFileAuthority,
+  planBlueprintVerificationExecution,
+  resolveBlueprintPackageIntegrity,
+  runBlueprintVerificationExecution,
+  scanContainerImageAuthorities,
+  supplyChainDigest,
+} from '@empire-builder-kit/nx/supply-chain';
+import { compareUtf16 } from '@empire-builder-kit/runtime/deterministic-order';
+import {
+  BUILTIN_BLUEPRINT_NAME,
+} from '@empire-builder-kit/nx/blueprints';
+import {
+  hashGeneratedContent,
+  hashOwnedContent,
+  validateFoundationOwnershipRecord,
+} from '@empire-builder-kit/nx/ownership';
+import { createHash, randomBytes } from 'node:crypto';
+import {
+  closeSync,
+  existsSync,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  linkSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { createRequire } from 'node:module';
+import {
+  basename,
+  dirname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+  sep,
+} from 'node:path';
+
+const MAX_INPUT_BYTES = 5 * 1024 * 1024;
+const MAX_LOCK_BYTES = 25 * 1024 * 1024;
+const MAX_OUTPUT_BYTES = 256 * 1024;
+const MAX_SLICE_COUNT = 1_000;
+const workspaceRoot = realpathSync(process.cwd());
+const options = {
+  now: undefined,
+  operation: 'adopt',
+  output: undefined,
+  protectedBranch: undefined,
+  protectedRef: undefined,
+  reviewVerification: false,
+};
+let operationProvided = false;
+
+process.on('uncaughtException', failure);
+process.on('unhandledRejection', failure);
+
+for (const argument of process.argv.slice(2)) {
+  if (argument.startsWith('--operation=')) {
+    if (operationProvided) {
+      throw new Error('Blueprint trust operation was provided more than once.');
+    }
+    operationProvided = true;
+    options.operation = argument.slice('--operation='.length);
+  } else if (argument.startsWith('--output=')) {
+    if (options.output !== undefined) {
+      throw new Error('Blueprint trust output was provided more than once.');
+    }
+    options.output = argument.slice('--output='.length);
+  } else if (argument.startsWith('--now=')) {
+    if (options.now !== undefined) {
+      throw new Error('Blueprint trust time was provided more than once.');
+    }
+    options.now = argument.slice('--now='.length);
+  } else if (argument.startsWith('--protected-ref=')) {
+    if (options.protectedRef !== undefined) {
+      throw new Error(
+        'Blueprint trust protected ref was provided more than once.',
+      );
+    }
+    options.protectedRef = argument.slice('--protected-ref='.length);
+  } else if (argument.startsWith('--protected-branch=')) {
+    if (options.protectedBranch !== undefined) {
+      throw new Error(
+        'Blueprint trust protected branch was provided more than once.',
+      );
+    }
+    options.protectedBranch = argument.slice('--protected-branch='.length);
+  } else if (argument === '--review-verification') {
+    if (options.reviewVerification) {
+      throw new Error(
+        'Blueprint verification review was requested more than once.',
+      );
+    }
+    options.reviewVerification = true;
+  } else {
+    throw new Error('Unsupported Blueprint trust argument: ' + argument);
+  }
+}
+if (!['adopt', 'deploy'].includes(options.operation)) {
+  throw new Error('Blueprint trust operation must equal adopt or deploy.');
+}
+if (options.protectedRef === undefined || options.protectedRef.length === 0) {
+  throw new Error(
+    'Blueprint trust requires one explicit --protected-ref=<commit-or-origin-ref>.',
+  );
+}
+if (!['develop', 'main'].includes(options.protectedBranch)) {
+  throw new Error(
+    'Blueprint trust requires one exact --protected-branch=develop|main route.',
+  );
+}
+if (options.reviewVerification && process.argv[1] !== '-') {
+  throw new Error(
+    'Blueprint verification review is available only through the EBK CLI authority entry.',
+  );
+}
+if (options.reviewVerification && options.now !== undefined) {
+  throw new Error(
+    'Blueprint verification review does not accept caller-controlled time.',
+  );
+}
+if (
+  options.reviewVerification &&
+  process.env.EBK_BLUEPRINT_AUTHORITY_ENTRY !== 'ebk-cli-v1'
+) {
+  throw new Error(
+    'Blueprint verification review requires the controlled EBK CLI authority entry.',
+  );
+}
+
+function insideWorkspace(path) {
+  if (
+    typeof path !== 'string' ||
+    path.length === 0 ||
+    path.length > 512 ||
+    path !== path.trim() ||
+    isAbsolute(path) ||
+    path.split(/[\\/]/).includes('..') ||
+    /[\u0000-\u001f\u007f-\u009f]/.test(path)
+  ) {
+    throw new Error('Blueprint trust path is not a safe repository-relative path.');
+  }
+  const candidate = resolve(workspaceRoot, path);
+  const child = relative(workspaceRoot, candidate);
+  if (child === '..' || child.startsWith('..' + sep)) {
+    throw new Error('Blueprint trust path escapes the workspace: ' + path);
+  }
+  return candidate;
+}
+
+function assertNoSymlink(candidate, label, allowMissing = false) {
+  const child = relative(workspaceRoot, candidate);
+  if (child === '..' || child.startsWith('..' + sep)) {
+    throw new Error(label + ' resolves outside the workspace.');
+  }
+  let current = workspaceRoot;
+  for (const part of child.split(sep).filter(Boolean)) {
+    current = join(current, part);
+    if (!existsSync(current)) {
+      if (allowMissing) return;
+      throw new Error(label + ' is missing.');
+    }
+    if (lstatSync(current).isSymbolicLink()) {
+      throw new Error(label + ' crosses a symbolic link.');
+    }
+  }
+}
+
+function readBoundedBytes(path, maximum, label) {
+  const candidate = insideWorkspace(path);
+  assertNoSymlink(candidate, label);
+  const metadata = lstatSync(candidate);
+  if (!metadata.isFile() || metadata.size > maximum) {
+    throw new Error(label + ' must be a regular bounded file.');
+  }
+  const real = realpathSync(candidate);
+  const child = relative(workspaceRoot, real);
+  if (child === '..' || child.startsWith('..' + sep)) {
+    throw new Error(label + ' resolves outside the workspace.');
+  }
+  return readFileSync(real);
+}
+
+function readBounded(path, maximum, label) {
+  return readBoundedBytes(path, maximum, label).toString('utf8');
+}
+
+function readJson(path, maximum = MAX_INPUT_BYTES) {
+  try {
+    return JSON.parse(readBounded(path, maximum, path));
+  } catch (error) {
+    throw new Error(
+      path +
+        ' is not valid bounded JSON: ' +
+        (error instanceof Error ? error.message : String(error)),
+    );
+  }
+}
+
+function readOptional(path, maximum, json = false) {
+  const candidate = insideWorkspace(path);
+  if (!existsSync(candidate)) return undefined;
+  const value = readBounded(path, maximum, path);
+  if (!json) return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    throw new Error(path + ' is not valid bounded JSON.');
+  }
+}
+
+function ownershipInventory() {
+  const packagesRoot = insideWorkspace('packages');
+  assertNoSymlink(packagesRoot, 'packages');
+  if (!lstatSync(packagesRoot).isDirectory()) {
+    throw new Error('packages must be a regular directory.');
+  }
+  const entries = readdirSync(packagesRoot, { withFileTypes: true });
+  if (entries.length > MAX_SLICE_COUNT + 100) {
+    throw new Error('Package inventory exceeds its bounded project count.');
+  }
+  const ownership = [];
+  for (const entry of entries.sort((left, right) =>
+    compareUtf16(left.name, right.name),
+  )) {
+    if (entry.isSymbolicLink()) {
+      throw new Error('Package directory crosses a symbolic link: ' + entry.name);
+    }
+    if (!entry.isDirectory()) continue;
+    const projectRoot = join(packagesRoot, entry.name);
+    assertNoSymlink(projectRoot, 'packages/' + entry.name);
+    const realProject = realpathSync(projectRoot);
+    const projectChild = relative(workspaceRoot, realProject);
+    if (projectChild === '..' || projectChild.startsWith('..' + sep)) {
+      throw new Error('Package directory resolves outside the workspace.');
+    }
+    const ownershipPath =
+      'packages/' + entry.name + '/.ebk/ownership.json';
+    if (!existsSync(insideWorkspace(ownershipPath))) {
+      throw new Error(
+        'Top-level package is missing generated ownership: ' + ownershipPath,
+      );
+    }
+    const value = readJson(ownershipPath, 2 * 1024 * 1024);
+    if (ownershipPath === 'packages/foundation/.ebk/ownership.json') {
+      const foundation = validateFoundationOwnershipRecord(value);
+      if (!foundation.valid) {
+        throw new Error(
+          ownershipPath +
+            ' is not valid Foundation ownership: ' +
+            foundation.issues
+              .slice(0, 10)
+              .map(({ path, message }) => path + ': ' + message)
+              .join('; '),
+        );
+      }
+      continue;
+    }
+    ownership.push({ path: ownershipPath, value });
+    if (ownership.length > MAX_SLICE_COUNT) {
+      throw new Error('Generated Slice ownership exceeds 1,000 records.');
+    }
+  }
+  return ownership;
+}
+
+function generatedContentInventory(ownership) {
+  const generated = [];
+  for (const candidate of ownership) {
+    const value = candidate.value;
+    if (value.blueprint?.name === BUILTIN_BLUEPRINT_NAME) continue;
+    const slice = value.slice;
+    if (
+      typeof slice !== 'string' ||
+      !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(slice) ||
+      !Array.isArray(value.verification) ||
+      value.verification.length !== 1 ||
+      value.verification.some(
+        (target) =>
+          typeof target !== 'string' ||
+          !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(target),
+      ) ||
+      !Array.isArray(value.paths)
+    ) {
+      throw new Error(
+        candidate.path +
+          ' must declare local verification target names and owned paths.',
+      );
+    }
+    const projectPath = 'packages/' + slice + '/project.json';
+    const projectOwnership = value.paths.find(
+      (entry) =>
+        entry?.path === 'project.json' &&
+        entry?.origin === 'blueprint' &&
+        entry?.mode === 'managed',
+    );
+    if (!projectOwnership) {
+      throw new Error(projectPath + ' must be whole-file Blueprint managed.');
+    }
+    const project = readJson(projectPath);
+    if (
+      !project ||
+      typeof project !== 'object' ||
+      Array.isArray(project) ||
+      project.name !== slice ||
+      !project.targets ||
+      typeof project.targets !== 'object' ||
+      Array.isArray(project.targets)
+    ) {
+      throw new Error(projectPath + ' must define the exact Slice project.');
+    }
+    const verificationTargets = blueprintVerificationTargetClosure({
+      projectRoot: 'packages/' + slice,
+      roots: value.verification,
+      targets: project.targets,
+    });
+    const blueprintFiles = value.paths
+      .filter((owned) => owned?.origin === 'blueprint')
+      .map((owned) => {
+        if (
+          typeof owned.path !== 'string' ||
+          typeof owned.sha256 !== 'string' ||
+          !['managed', 'seeded'].includes(owned.mode)
+        ) {
+          throw new Error(
+            candidate.path + ' contains an invalid Blueprint-origin path.',
+          );
+        }
+        const blueprintPath = 'packages/' + slice + '/' + owned.path;
+        const bytes = readBoundedBytes(
+          blueprintPath,
+          MAX_INPUT_BYTES,
+          blueprintPath,
+        );
+        const contents = bytes.toString('utf8');
+        if (
+          owned.mode === 'managed' &&
+          hashOwnedContent(contents, owned) !== owned.sha256
+        ) {
+          throw new Error(
+            blueprintPath + ' differs from its Blueprint ownership digest.',
+          );
+        }
+        return {
+          digest: hashGeneratedContent(bytes),
+          mode: owned.mode,
+          path: owned.path,
+        };
+      })
+      .sort((left, right) => compareUtf16(left.path, right.path));
+    if (blueprintFiles.length === 0) {
+      throw new Error(
+        candidate.path + ' must bind at least one Blueprint-origin file.',
+      );
+    }
+    const registries = new Set();
+    for (const owned of value.paths) {
+      if (
+        owned?.origin !== 'blueprint' ||
+        typeof owned.path !== 'string' ||
+        (!/(?:^|\/)Dockerfile$/i.test(owned.path) &&
+          !/\.Dockerfile$/i.test(owned.path))
+      ) {
+        continue;
+      }
+      const dockerfilePath = 'packages/' + slice + '/' + owned.path;
+      const authorities = scanContainerImageAuthorities(
+        dockerfilePath,
+        readBounded(dockerfilePath, MAX_INPUT_BYTES, dockerfilePath),
+      );
+      for (const { reference } of authorities) {
+        registries.add(blueprintContainerRegistry(reference));
+      }
+    }
+    generated.push({
+      blueprintFiles,
+      containerRegistries: [...registries].sort(),
+      projectPath,
+      slice,
+      verificationRoots: [...value.verification].sort(),
+      verificationTargets,
+    });
+  }
+  return generated.sort((left, right) =>
+    compareUtf16(left.slice, right.slice),
+  );
+}
+
+function assertProtectedReviewExecutionConfiguration(input) {
+  const sources = {};
+  for (const [path, label] of [
+    ['package.json', 'package.json'],
+    ['pnpm-workspace.yaml', 'pnpm-workspace.yaml'],
+    ['nx.json', 'nx.json'],
+  ]) {
+    const current = readBoundedBytes(path, MAX_INPUT_BYTES, label);
+    inspectProtectedGitFileAuthority({
+      current,
+      headCommit: input.headCommit,
+      path,
+      protectedCommit: input.protectedCommit,
+      workspaceRoot,
+    });
+    sources[path] = current.toString('utf8');
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(sources['package.json']);
+  } catch {
+    throw new Error(
+      'Blueprint verification requires valid protected package.json and nx.json configuration.',
+    );
+  }
+  if (
+    !manifest ||
+    typeof manifest !== 'object' ||
+    Array.isArray(manifest) ||
+    manifest.packageManager !== input.packageManager
+  ) {
+    throw new Error(
+      'Blueprint verification execution configuration differs from its protected authority.',
+    );
+  }
+  assertPnpmReviewConfiguration(
+    sources['package.json'],
+    sources['pnpm-workspace.yaml'],
+  );
+  assertBlueprintVerificationNxAuthority(sources['nx.json']);
+  for (const path of assertNoMutableBlueprintVerificationConfiguration(
+    workspaceRoot,
+  )) {
+    inspectProtectedGitFileAuthority({
+      current: readBoundedBytes(path, MAX_INPUT_BYTES, path),
+      headCommit: input.headCommit,
+      path,
+      protectedCommit: input.protectedCommit,
+      workspaceRoot,
+    });
+  }
+}
+
+function assertReviewedGeneratedContent(input) {
+  const observed = generatedContentInventory(input.ownership);
+  if (
+    supplyChainDigest(observed) !==
+    supplyChainDigest(input.approvedGeneratedContent)
+  ) {
+    throw new Error(
+      'Blueprint verification generated content differs from the exact protected approval.',
+    );
+  }
+}
+
+function reviewedTargetPlan(
+  content,
+  name,
+  target,
+) {
+  const options = target.options;
+  const plan = planBlueprintVerificationExecution(options);
+  if (!plan) {
+    throw new Error(
+      'Blueprint verification target ' + content.slice + ':' + name +
+        ' has no closed direct execution plan.',
+    );
+  }
+  const approvedPaths = new Set(content.blueprintFiles.map(({ path }) => path));
+  if (plan.kind === 'node') {
+    if (!approvedPaths.has(plan.script)) {
+      throw new Error(
+        'Blueprint verification Node entry must be an approved Blueprint file in its exact Slice.',
+      );
+    }
+    return plan;
+  }
+  if (plan.kind === 'typescript') {
+    if (!approvedPaths.has('tsconfig.json')) {
+      throw new Error(
+        'Blueprint verification TypeScript entry requires one approved Slice tsconfig.json.',
+      );
+    }
+    return plan;
+  }
+  if (!approvedPaths.has(plan.spec)) {
+    throw new Error(
+      'Blueprint verification Vitest entry must be one exact approved Slice spec.',
+    );
+  }
+  return plan;
+}
+
+function runReviewedVerificationRoots(content, reviewAuthority) {
+  const project = readJson(content.projectPath);
+  if (
+    !project ||
+    typeof project !== 'object' ||
+    Array.isArray(project) ||
+    project.name !== content.slice ||
+    !project.targets ||
+    typeof project.targets !== 'object' ||
+    Array.isArray(project.targets) ||
+    supplyChainDigest(
+      blueprintVerificationTargetClosure({
+        projectRoot: 'packages/' + content.slice,
+        roots: content.verificationRoots,
+        targets: project.targets,
+      }),
+    ) !== supplyChainDigest(content.verificationTargets)
+  ) {
+    throw new Error(
+      'Blueprint verification review requires the exact approved target closure.',
+    );
+  }
+  assertProtectedReviewExecutionConfiguration(reviewAuthority);
+  assertReviewedGeneratedContent(reviewAuthority);
+  assertProtectedGitWorkingTreeAuthority({
+    headCommit: reviewAuthority.headCommit,
+    protectedCommit: reviewAuthority.protectedCommit,
+    protectedRef: reviewAuthority.protectedRef,
+    workspaceRoot,
+  });
+  const executed = new Set();
+  const active = new Set();
+  const executionAuthorities = [];
+  let nodeVersion;
+      const executeTarget = (name) => {
+        if (executed.has(name)) return;
+        if (active.has(name)) {
+          throw new Error(
+            'Blueprint verification target dependency cycle reached direct execution.',
+          );
+        }
+        const target = project.targets[name];
+        const dependencies = blueprintVerificationTargetDependencies(
+          name,
+          target,
+          'packages/' + content.slice,
+        );
+        active.add(name);
+        for (const dependency of dependencies) executeTarget(dependency);
+        active.delete(name);
+        const reviewedPlan = reviewedTargetPlan(content, name, target);
+        const targetIdentity = content.slice + ':' + name;
+        const { invocation, result: execution } = runBlueprintVerificationExecution({
+          assertAuthority() {
+            assertReviewedGeneratedContent(reviewAuthority);
+            assertProtectedReviewExecutionConfiguration(reviewAuthority);
+            assertProtectedGitWorkingTreeAuthority({
+              headCommit: reviewAuthority.headCommit,
+              protectedCommit: reviewAuthority.protectedCommit,
+              protectedRef: reviewAuthority.protectedRef,
+              workspaceRoot,
+            });
+          },
+          options: target.options,
+          projectName: content.slice,
+          projectRoot: 'packages/' + content.slice,
+          workspaceRoot,
+        });
+        if (execution.error || execution.status !== 0) {
+          const detail = String(
+            execution.error?.message || execution.stderr || execution.stdout || '',
+          )
+            .replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ')
+            .slice(0, 2_000);
+          throw new Error(
+            'Blueprint verification target ' +
+              targetIdentity +
+              ' failed under the exact direct reviewer: ' +
+              detail,
+          );
+        }
+        if (
+          invocation.plan.kind !== reviewedPlan.kind ||
+          (nodeVersion !== undefined &&
+            nodeVersion !== invocation.nodeVersion)
+        ) {
+          throw new Error(
+            'Blueprint verification execution authority changed across its reviewed closure.',
+          );
+        }
+        nodeVersion = invocation.nodeVersion;
+        if (invocation.plan.kind === 'node') {
+          if (invocation.toolAuthority !== undefined) {
+            throw new Error(
+              'Blueprint verification Node target acquired package execution authority.',
+            );
+          }
+          executionAuthorities.push({ kind: 'node', target: targetIdentity });
+        } else {
+          if (
+            !invocation.toolAuthority ||
+            invocation.toolAuthority.name !== invocation.plan.kind
+          ) {
+            throw new Error(
+              'Blueprint verification package target lacks exact portable execution authority.',
+            );
+          }
+          executionAuthorities.push({
+            ...invocation.toolAuthority,
+            kind: invocation.plan.kind,
+            target: targetIdentity,
+          });
+        }
+        executed.add(name);
+      };
+      for (const root of content.verificationRoots) executeTarget(root);
+  if (
+    typeof nodeVersion !== 'string' ||
+    executionAuthorities.length !== content.verificationTargets.length
+  ) {
+    throw new Error(
+      'Blueprint verification did not execute the complete reviewed target closure.',
+    );
+  }
+  return {
+    executedRoots: content.verificationRoots.map((root) => ({
+      outcome: 'passed',
+      target: content.slice + ':' + root,
+    })),
+    executionAuthorities: executionAuthorities.sort((left, right) =>
+      compareUtf16(left.target, right.target),
+    ),
+    nodeVersion,
+  };
+}
+
+function writeAtomicWorkspaceFile(path, output, label) {
+  const target = insideWorkspace(path);
+  assertNoSymlink(target, path, true);
+  const parent = dirname(target);
+  mkdirSync(parent, { recursive: true, mode: 0o700 });
+  assertNoSymlink(parent, dirname(path));
+  if (existsSync(target)) {
+    const existing = lstatSync(target);
+    if (
+      existing.isSymbolicLink() ||
+      !existing.isFile() ||
+      existing.nlink !== 1 ||
+      realpathSync(target) !== target
+    ) {
+      throw new Error(label + ' target is not one canonical regular file.');
+    }
+  }
+  const temporary = join(
+    parent,
+    '.' +
+      basename(target) +
+      '.ebk-' +
+      process.pid +
+      '-' +
+      randomBytes(12).toString('hex'),
+  );
+  let descriptor;
+  try {
+    descriptor = openSync(temporary, 'wx', 0o600);
+    writeFileSync(descriptor, output, 'utf8');
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    descriptor = undefined;
+    const staged = lstatSync(temporary);
+    if (
+      staged.isSymbolicLink() ||
+      !staged.isFile() ||
+      staged.nlink !== 1 ||
+      realpathSync(temporary) !== temporary ||
+      readFileSync(temporary, 'utf8') !== output ||
+      (process.platform !== 'win32' && (staged.mode & 0o777) !== 0o600)
+    ) {
+      throw new Error(label + ' temporary file changed before retention.');
+    }
+    renameSync(temporary, target);
+    const retained = lstatSync(target);
+    if (
+      retained.isSymbolicLink() ||
+      !retained.isFile() ||
+      retained.nlink !== 1 ||
+      realpathSync(target) !== target ||
+      readFileSync(target, 'utf8') !== output ||
+      (process.platform !== 'win32' && (retained.mode & 0o777) !== 0o600)
+    ) {
+      throw new Error(label + ' was not retained as one exact private file.');
+    }
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+    rmSync(temporary, { force: true });
+  }
+}
+
+function receiptRetentionError(
+  message,
+  classification = 'blueprint-trust-check-failed',
+) {
+  const error = new Error(message);
+  error.classification = classification;
+  error.preserveEvidence = true;
+  return error;
+}
+
+function receiptAlreadyExists(path) {
+  return receiptRetentionError(
+    'Blueprint verification receipt already exists at ' +
+      path +
+      '. Delete the stale receipt in a dedicated protected commit, then rerun the installed EBK verification review from that exact protected successor.',
+    'blueprint-verification-receipt-not-absent',
+  );
+}
+
+function preflightRetainedReceiptPaths(paths) {
+  if (
+    !Array.isArray(paths) ||
+    paths.length > MAX_SLICE_COUNT ||
+    new Set(paths).size !== paths.length ||
+    paths.some((path, index) =>
+      index === 0 ? false : compareUtf16(paths[index - 1], path) >= 0,
+    )
+  ) {
+    throw receiptRetentionError(
+      'Blueprint verification receipt paths are not one bounded canonical order.',
+    );
+  }
+  for (const path of paths) {
+    const target = insideWorkspace(path);
+    assertNoSymlink(target, path, true);
+    if (!existsSync(target)) continue;
+    const existing = lstatSync(target);
+    if (
+      existing.isSymbolicLink() ||
+      !existing.isFile() ||
+      existing.nlink !== 1 ||
+      realpathSync(target) !== target
+    ) {
+      throw receiptRetentionError(
+        'Blueprint verification receipt target is not one absent canonical path: ' +
+          path +
+          '.',
+        'blueprint-verification-receipt-not-absent',
+      );
+    }
+    throw receiptAlreadyExists(path);
+  }
+}
+
+function writeRetainedReceipts(receipts) {
+  const prepared = receipts.map(({ reference, receipt }) => {
+    const output = JSON.stringify(receipt, null, 2) + '\n';
+    if (Buffer.byteLength(output, 'utf8') > MAX_OUTPUT_BYTES) {
+      throw receiptRetentionError(
+        'Blueprint verification receipt exceeds 256 KiB.',
+      );
+    }
+    return { output, reference };
+  });
+  preflightRetainedReceiptPaths(
+    prepared.map(({ reference }) => reference),
+  );
+  const temporaryOwnership = [];
+  const staged = [];
+  const linked = [];
+  try {
+    for (const { output, reference } of prepared) {
+      const target = insideWorkspace(reference);
+      const parent = dirname(target);
+      mkdirSync(parent, { recursive: true, mode: 0o700 });
+      assertNoSymlink(parent, dirname(reference));
+      const temporary = join(
+        parent,
+        '.' +
+          basename(target) +
+          '.ebk-' +
+          process.pid +
+          '-' +
+          randomBytes(12).toString('hex'),
+      );
+      let descriptor;
+      try {
+        descriptor = openSync(temporary, 'wx', 0o600);
+        const opened = fstatSync(descriptor);
+        temporaryOwnership.push({
+          dev: opened.dev,
+          ino: opened.ino,
+          temporary,
+        });
+        writeFileSync(descriptor, output, 'utf8');
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        const metadata = lstatSync(temporary);
+        if (
+          metadata.isSymbolicLink() ||
+          !metadata.isFile() ||
+          metadata.nlink !== 1 ||
+          metadata.dev !== opened.dev ||
+          metadata.ino !== opened.ino ||
+          realpathSync(temporary) !== temporary ||
+          readFileSync(temporary, 'utf8') !== output ||
+          (process.platform !== 'win32' &&
+            (metadata.mode & 0o777) !== 0o600)
+        ) {
+          throw receiptRetentionError(
+            'Blueprint verification receipt temporary file changed before retention.',
+          );
+        }
+        staged.push({
+          dev: opened.dev,
+          ino: opened.ino,
+          output,
+          reference,
+          target,
+          temporary,
+        });
+      } finally {
+        if (descriptor !== undefined) closeSync(descriptor);
+      }
+    }
+    for (const entry of staged) {
+      try {
+        linkSync(entry.temporary, entry.target);
+      } catch (error) {
+        if (error && typeof error === 'object' && error.code === 'EEXIST') {
+          throw receiptAlreadyExists(entry.reference);
+        }
+        throw error;
+      }
+      linked.push(entry);
+    }
+    for (const entry of staged) {
+      const retained = lstatSync(entry.target);
+      const temporary = lstatSync(entry.temporary);
+      if (
+        retained.isSymbolicLink() ||
+        !retained.isFile() ||
+        retained.nlink !== 2 ||
+        retained.dev !== entry.dev ||
+        retained.ino !== entry.ino ||
+        temporary.dev !== entry.dev ||
+        temporary.ino !== entry.ino ||
+        readFileSync(entry.target, 'utf8') !== entry.output
+      ) {
+        throw receiptRetentionError(
+          'Blueprint verification receipt link changed before retention.',
+        );
+      }
+    }
+    for (const entry of staged) {
+      unlinkSync(entry.temporary);
+      const retained = lstatSync(entry.target);
+      if (
+        retained.isSymbolicLink() ||
+        !retained.isFile() ||
+        retained.nlink !== 1 ||
+        realpathSync(entry.target) !== entry.target ||
+        readFileSync(entry.target, 'utf8') !== entry.output ||
+        (process.platform !== 'win32' &&
+          (retained.mode & 0o777) !== 0o600)
+      ) {
+        throw receiptRetentionError(
+          'Blueprint verification receipt was not retained as one exact private file.',
+        );
+      }
+    }
+  } catch (error) {
+    for (const entry of [...linked].reverse()) {
+      if (!existsSync(entry.target)) continue;
+      const target = lstatSync(entry.target);
+      if (
+        target.isFile() &&
+        !target.isSymbolicLink() &&
+        target.dev === entry.dev &&
+        target.ino === entry.ino
+      ) {
+        unlinkSync(entry.target);
+      }
+    }
+    throw error;
+  } finally {
+    for (const entry of temporaryOwnership) {
+      if (!existsSync(entry.temporary)) continue;
+      const temporary = lstatSync(entry.temporary);
+      if (
+        temporary.isFile() &&
+        !temporary.isSymbolicLink() &&
+        temporary.dev === entry.dev &&
+        temporary.ino === entry.ino
+      ) {
+        unlinkSync(entry.temporary);
+      }
+    }
+  }
+}
+
+function writeEvidence(path, value) {
+  const output = JSON.stringify(value, null, 2) + '\n';
+  if (Buffer.byteLength(output, 'utf8') > MAX_OUTPUT_BYTES) {
+    throw new Error('Blueprint trust evidence exceeds 256 KiB.');
+  }
+  if (path) {
+    writeAtomicWorkspaceFile(path, output, 'Blueprint trust evidence');
+  }
+  process.stdout.write(output);
+}
+
+function failure(error) {
+  const value = {
+    error: {
+      classification:
+        error &&
+        typeof error === 'object' &&
+        typeof error.classification === 'string'
+          ? error.classification
+          : 'blueprint-trust-check-failed',
+      message: (error instanceof Error ? error.message : String(error))
+        .replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ')
+        .slice(0, 2_000),
+      ...(error &&
+      typeof error === 'object' &&
+      typeof error.path === 'string'
+        ? { path: error.path.slice(0, 512) }
+        : {}),
+    },
+    generatedAt: new Date().toISOString(),
+    kind: 'ebk-blueprint-trust-check',
+    operation: options.operation,
+    outcome: 'failed',
+    schemaVersion: 1,
+  };
+  try {
+    if (error?.preserveEvidence === true) {
+      process.stdout.write(JSON.stringify(value, null, 2) + '\n');
+    } else {
+      writeEvidence(options.output, value);
+    }
+  } catch {
+    process.stdout.write(JSON.stringify(value, null, 2) + '\n');
+  }
+  process.exitCode = 1;
+}
+
+try {
+  const require = createRequire(import.meta.url);
+  const nxPackage = require('@empire-builder-kit/nx/package.json');
+  if (
+    !nxPackage ||
+    typeof nxPackage !== 'object' ||
+    typeof nxPackage.version !== 'string'
+  ) {
+    throw new Error('Installed @empire-builder-kit/nx version is unavailable.');
+  }
+  const ownership = ownershipInventory();
+  const generatedContent = generatedContentInventory(ownership);
+  const reviewReceiptReferences = options.reviewVerification
+    ? generatedContent
+        .map(({ slice }) => blueprintVerificationExecutionReceiptPath(slice))
+        .sort(compareUtf16)
+    : [];
+  if (options.reviewVerification) {
+    preflightRetainedReceiptPaths(reviewReceiptReferences);
+  }
+  const manifestBytes = readBoundedBytes(
+    'package.json',
+    MAX_INPUT_BYTES,
+    'package.json',
+  );
+  let manifest;
+  try {
+    manifest = JSON.parse(manifestBytes.toString('utf8'));
+  } catch {
+    throw new Error('package.json is not valid bounded JSON.');
+  }
+  const currentPolicy = readOptional(
+    'supply-chain/blueprint-trust-policy.json',
+    MAX_INPUT_BYTES,
+    true,
+  );
+  const currentSnapshot = readOptional(
+    'supply-chain/blueprint-trust-snapshot.json',
+    MAX_INPUT_BYTES,
+    true,
+  );
+  if (currentPolicy === undefined || currentSnapshot === undefined) {
+    throw new Error(
+      'Blueprint trust policy and snapshot must both exist before authorization.',
+    );
+  }
+  const authority = inspectBlueprintTrustGitAuthority({
+    builtIn: {
+      name: BUILTIN_BLUEPRINT_NAME,
+      version: nxPackage.version,
+    },
+    current: {
+      policy: currentPolicy,
+      snapshot: currentSnapshot,
+    },
+    ownership,
+    protectedBranch: options.protectedBranch,
+    protectedRef: options.protectedRef,
+    workspaceRoot,
+  });
+  const lockfile = readOptional('pnpm-lock.yaml', MAX_LOCK_BYTES);
+  const nodeVersionSource = readOptional('.node-version', 128);
+  const now = options.now ?? new Date().toISOString();
+  if (options.reviewVerification) {
+    if (options.operation !== 'adopt') {
+      throw new Error(
+        'Blueprint verification review is available only for adoption.',
+      );
+    }
+    if (
+      !manifest ||
+      typeof manifest !== 'object' ||
+      Array.isArray(manifest) ||
+      typeof manifest.name !== 'string' ||
+      typeof manifest.packageManager !== 'string' ||
+      !manifest.engines ||
+      typeof manifest.engines !== 'object' ||
+      Array.isArray(manifest.engines) ||
+      typeof manifest.engines.node !== 'string' ||
+      typeof nodeVersionSource !== 'string' ||
+      !/^\d+\.\d+\.\d+\n$/.test(nodeVersionSource) ||
+      !manifest.devDependencies ||
+      typeof manifest.devDependencies !== 'object' ||
+      Array.isArray(manifest.devDependencies) ||
+      typeof lockfile !== 'string'
+    ) {
+      throw new Error(
+        'Blueprint verification review requires one named workspace, exact development dependencies, and pnpm lockfile.',
+      );
+    }
+    if (authority.headCommit !== authority.protectedCommit) {
+      throw new Error(
+        'Blueprint verification roots execute only from the exact protected static-approval commit.',
+      );
+    }
+    inspectProtectedGitFileAuthority({
+      current: manifestBytes,
+      headCommit: authority.headCommit,
+      path: 'package.json',
+      protectedCommit: authority.protectedCommit,
+      workspaceRoot,
+    });
+    const blueprintBySlice = new Map();
+    const reviewBySlice = new Map();
+    for (const content of generatedContent) {
+      const owned = ownership.find(
+        (candidate) => candidate.value?.slice === content.slice,
+      );
+      const blueprint = owned?.value?.blueprint;
+      if (
+        !blueprint ||
+        typeof blueprint.name !== 'string' ||
+        typeof blueprint.version !== 'string' ||
+        manifest.devDependencies[blueprint.name] !== blueprint.version
+      ) {
+        throw new Error(
+          'Blueprint verification review requires an exact external Blueprint dependency for ' +
+            content.slice +
+            '.',
+        );
+      }
+      const integrity = resolveBlueprintPackageIntegrity(
+        lockfile,
+        blueprint.name,
+        blueprint.version,
+      );
+      const decision = authorizeBlueprintTrust({
+        frameworkVersion: nxPackage.version,
+        integrity,
+        name: blueprint.name,
+        now,
+        operation: 'adopt',
+        policy: authority.authorization.policy,
+        snapshot: authority.authorization.snapshot,
+        version: blueprint.version,
+      });
+      if (decision.decision !== 'allow') {
+        throw new Error(
+          'External Blueprint lifecycle denies verification review for ' +
+            blueprint.name +
+            '@' +
+            blueprint.version +
+          '.',
+        );
+      }
+      const exactBlueprint = {
+        integrity,
+        name: blueprint.name,
+        version: blueprint.version,
+      };
+      const approvalDigest = blueprintGeneratedContentApprovalDigest(
+        exactBlueprint,
+        content,
+      );
+      const review = authority.authorization.policy.generatedReviews.find(
+        (candidate) =>
+          candidate.blueprint.name === exactBlueprint.name &&
+          candidate.blueprint.version === exactBlueprint.version &&
+          candidate.blueprint.integrity === exactBlueprint.integrity &&
+          candidate.slice === content.slice &&
+          candidate.projectPath === content.projectPath &&
+          supplyChainDigest(candidate.verificationTargets) ===
+            supplyChainDigest(content.verificationTargets) &&
+          supplyChainDigest(candidate.blueprintFiles) ===
+            supplyChainDigest(content.blueprintFiles) &&
+          supplyChainDigest(candidate.verificationRoots) ===
+            supplyChainDigest(content.verificationRoots) &&
+          supplyChainDigest(candidate.allowedContainerRegistries) ===
+            supplyChainDigest(content.containerRegistries) &&
+          candidate.evidenceDigest === approvalDigest,
+      );
+      if (!review) {
+        throw new Error(
+          'Blueprint verification roots cannot execute before protected Git admits the exact generated-content approval for ' +
+            content.slice +
+            ' (expected evidence digest ' +
+            approvalDigest +
+            ').',
+        );
+      }
+      if (Date.parse(now) < Date.parse(review.reviewedAt)) {
+        throw new Error(
+          'Blueprint verification roots cannot execute before the exact protected generated-content approval timestamp for ' +
+            content.slice +
+            '.',
+        );
+      }
+      blueprintBySlice.set(content.slice, exactBlueprint);
+      reviewBySlice.set(content.slice, review);
+    }
+    preflightRetainedReceiptPaths(reviewReceiptReferences);
+    const executionsBySlice = new Map();
+    for (const content of generatedContent) {
+      executionsBySlice.set(
+        content.slice,
+        runReviewedVerificationRoots(content, {
+          approvedGeneratedContent: generatedContent,
+          headCommit: authority.headCommit,
+          lockfile,
+          manifest,
+          ownership,
+          packageManager: manifest.packageManager,
+          protectedCommit: authority.protectedCommit,
+          protectedRef: options.protectedRef,
+        }),
+      );
+    }
+    assertProtectedGitWorkingTreeAuthority({
+      headCommit: authority.headCommit,
+      protectedCommit: authority.protectedCommit,
+      protectedRef: options.protectedRef,
+      workspaceRoot,
+    });
+    const completedAt = options.now ?? new Date().toISOString();
+    if (
+      !Number.isFinite(Date.parse(now)) ||
+      !Number.isFinite(Date.parse(completedAt)) ||
+      Date.parse(completedAt) < Date.parse(now)
+    ) {
+      throw new Error(
+        'Blueprint verification completion time must not precede authorization.',
+      );
+    }
+    for (const blueprint of blueprintBySlice.values()) {
+      const completionDecision = authorizeBlueprintTrust({
+        frameworkVersion: nxPackage.version,
+        integrity: blueprint.integrity,
+        name: blueprint.name,
+        now: completedAt,
+        operation: 'adopt',
+        policy: authority.authorization.policy,
+        snapshot: authority.authorization.snapshot,
+        version: blueprint.version,
+      });
+      if (completionDecision.decision !== 'allow') {
+        throw new Error(
+          'External Blueprint lifecycle expired or changed before verification completed for ' +
+            blueprint.name +
+            '@' +
+            blueprint.version +
+            '.',
+        );
+      }
+    }
+    const refreshedContent = generatedContentInventory(ownership);
+    if (
+      supplyChainDigest(refreshedContent) !== supplyChainDigest(generatedContent)
+    ) {
+      throw new Error(
+        'Blueprint verification roots changed their reviewed generated-content inventory.',
+      );
+    }
+    const receipts = [];
+    for (const content of refreshedContent) {
+      const blueprint = blueprintBySlice.get(content.slice);
+      const review = reviewBySlice.get(content.slice);
+      if (!blueprint || !review) {
+        throw new Error(
+          'Blueprint verification review lost its exact approved authority.',
+        );
+      }
+      const execution = executionsBySlice.get(content.slice);
+      if (!execution) {
+        throw new Error(
+          'Blueprint verification review lost its exact execution authority.',
+        );
+      }
+      const receipt = createBlueprintVerificationExecutionReceipt(
+        {
+          approvalDigest: review.evidenceDigest,
+          blueprint,
+          blueprintFiles: content.blueprintFiles,
+          containerRegistries: content.containerRegistries,
+          executedRoots: execution.executedRoots,
+          executionAuthorities: execution.executionAuthorities,
+          executionCommit: authority.headCommit,
+          generatedAt: completedAt,
+          kind: 'ebk-blueprint-verification-execution',
+          lockfileSha256: createHash('sha256')
+            .update(lockfile, 'utf8')
+            .digest('hex'),
+          nodeEngine: manifest.engines.node,
+          nodeVersion: execution.nodeVersion,
+          nodeVersionDeclaration: nodeVersionSource.slice(0, -1),
+          projectPath: content.projectPath,
+          repositoryRootCommit: authority.repositoryRootCommit,
+          schemaVersion: 1,
+          slice: content.slice,
+          verificationRoots: content.verificationRoots,
+          verificationTargets: content.verificationTargets,
+          workspace: manifest.name,
+        },
+        {
+          approvalDigest: review.evidenceDigest,
+          blueprint,
+          content,
+          executionCommit: authority.headCommit,
+          repositoryRootCommit: authority.repositoryRootCommit,
+          reviewedAt: review.reviewedAt,
+          workspace: manifest.name,
+        },
+      );
+      const reference = blueprintVerificationExecutionReceiptPath(
+        content.slice,
+      );
+      receipts.push({
+        receiptDigest: blueprintVerificationExecutionReceiptDigest(receipt),
+        reference,
+        receipt,
+        slice: content.slice,
+      });
+    }
+    receipts.sort((left, right) => compareUtf16(left.reference, right.reference));
+    if (
+      supplyChainDigest(receipts.map(({ reference }) => reference)) !==
+      supplyChainDigest(reviewReceiptReferences)
+    ) {
+      throw receiptRetentionError(
+        'Blueprint verification receipt paths changed after reviewed execution.',
+      );
+    }
+    writeRetainedReceipts(receipts);
+    writeEvidence(options.output, {
+      generatedAt: completedAt,
+      kind: 'ebk-blueprint-verification-review',
+      operation: 'adopt',
+      outcome: 'passed',
+      receipts: receipts.map(({ receiptDigest, reference, slice }) => ({
+        reference,
+        receiptDigest,
+        slice,
+      })),
+      schemaVersion: 1,
+      trustAuthority: {
+        candidateHistory: authority.candidateHistory,
+        headCommit: authority.headCommit,
+        protectedCommit: authority.protectedCommit,
+        protectedHistory: authority.protectedHistory,
+        repositoryRootCommit: authority.repositoryRootCommit,
+      },
+    });
+  } else {
+    const verificationReceipts = authority.protectedVerificationReceipts;
+  const report = authorizeBlueprintOwnershipInventory({
+    builtIn: {
+      name: BUILTIN_BLUEPRINT_NAME,
+      provenance: authority.builtInProvenance,
+      version: nxPackage.version,
+    },
+    generatedContent,
+    lockfile,
+    manifest,
+    nodeVersionSource,
+    now,
+    operation: options.operation,
+    ownership,
+    policy: authority.authorization.policy,
+    repositoryRootCommit: authority.repositoryRootCommit,
+    snapshot: authority.authorization.snapshot,
+    verificationReceipts,
+  });
+  writeEvidence(options.output, {
+    ...report,
+    outcome: 'passed',
+    trustAuthority: {
+      candidateHistory: authority.candidateHistory,
+      headCommit: authority.headCommit,
+      protectedCommit: authority.protectedCommit,
+      protectedHistory: authority.protectedHistory,
+      protectedVerificationReceipts:
+        authority.protectedVerificationReceipts.map(
+          ({ protectedCommit, reference, receipt }) => ({
+            protectedCommit,
+            receiptDigest:
+              blueprintVerificationExecutionReceiptDigest(receipt),
+            reference,
+          }),
+        ),
+      repositoryRootCommit: authority.repositoryRootCommit,
+      ...(authority.workingTreeTransition
+        ? { workingTreeTransition: authority.workingTreeTransition }
+        : {}),
+    },
+  });
+  }
+} catch (error) {
+  failure(error);
+}
+`;
+}
+//# sourceMappingURL=generated-blueprint-trust-command.js.map