@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/developer-agent/workspace-inspection.js

@@ -0,0 +1,1134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectDeveloperAgentWorkspace = inspectDeveloperAgentWorkspace;
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const semver_1 = require("semver");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../ownership/index.js");
+const index_js_2 = require("../repository-policy/index.js");
+const index_js_3 = require("../work-markers/index.js");
+const feature_registry_js_1 = require("../generators/feature-registry.js");
+const index_js_4 = require("../blueprints/index.js");
+const blueprint_trust_js_1 = require("../supply-chain/blueprint-trust.js");
+const blueprint_trust_git_js_1 = require("../supply-chain/blueprint-trust-git.js");
+const blueprint_verification_authority_js_1 = require("../supply-chain/blueprint-verification-authority.js");
+const generated_blueprint_trust_command_js_1 = require("../supply-chain/generated-blueprint-trust-command.js");
+const blueprint_verification_execution_js_1 = require("../supply-chain/blueprint-verification-execution.js");
+const model_js_1 = require("./model.js");
+const operation_registry_js_1 = require("./operation-registry.js");
+const ordering_js_1 = require("./ordering.js");
+const MAX_PROJECTS = model_js_1.DEVELOPER_AGENT_MAX_PROJECT_NAMES;
+const MAX_TARGETS_PER_PROJECT = 256;
+const MAX_OWNED_PATHS = 8_192;
+const MAX_SELECTED_FILES = 256;
+const MAX_CANDIDATE_BYTES = 1024 * 1024;
+const MAX_CONTROL_JSON_BYTES = 1024 * 1024;
+const MAX_OWNED_FILE_BYTES = 5 * 1024 * 1024;
+const PROJECT_NAME_PATTERN = /^[A-Za-z0-9@][A-Za-z0-9@/._-]{0,255}$/;
+const FOUNDATION_PROJECT_NAME = 'foundation';
+const FOUNDATION_PROJECT_ROOT = 'packages/foundation';
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function warning(classification, sanitizedSummary, upgradeVersionDrift) {
+    return {
+        classification,
+        sanitizedSummary,
+        ...(upgradeVersionDrift ? { upgradeVersionDrift } : {}),
+    };
+}
+function isContained(root, path) {
+    const fromRoot = (0, node_path_1.relative)(root, path);
+    return (fromRoot === '' ||
+        (!fromRoot.startsWith(`..${node_path_1.sep}`) &&
+            fromRoot !== '..' &&
+            !(0, node_path_1.isAbsolute)(fromRoot)));
+}
+function readBoundedWorkspaceFile(root, relativePath, label, maximumBytes) {
+    const path = containedPath(root, relativePath);
+    let real;
+    try {
+        const link = (0, node_fs_1.lstatSync)(path);
+        if (link.isSymbolicLink()) {
+            throw new Error('the final path is a symbolic link');
+        }
+        real = (0, node_fs_1.realpathSync)(path);
+        if (!isContained(root, real)) {
+            throw new Error('a parent path resolves outside the repository');
+        }
+    }
+    catch (error) {
+        throw new Error(`${label} is required as a contained regular non-symlink file at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let descriptor;
+    try {
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_NOFOLLOW);
+        const metadata = (0, node_fs_1.fstatSync)(descriptor);
+        if (!metadata.isFile()) {
+            throw new Error('the resolved path is not a regular file');
+        }
+        if (metadata.size > maximumBytes) {
+            throw new Error(`the file exceeds its ${maximumBytes}-byte bound`);
+        }
+        // Allocate only after the descriptor-backed size check. The extra byte
+        // makes a concurrent growth fail closed without allocating beyond the
+        // declared bound.
+        const capacity = Math.min(maximumBytes + 1, metadata.size + 1);
+        const buffer = Buffer.alloc(capacity);
+        let offset = 0;
+        while (offset < buffer.byteLength) {
+            const count = (0, node_fs_1.readSync)(descriptor, buffer, offset, buffer.byteLength - offset, null);
+            if (count === 0)
+                break;
+            offset += count;
+        }
+        if (offset > maximumBytes || offset > metadata.size) {
+            throw new Error('the file changed while it was read or exceeded its byte bound');
+        }
+        return { bytes: buffer.subarray(0, offset), path: real };
+    }
+    catch (error) {
+        throw new Error(`${label} at ${path} could not be read safely: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        if (descriptor !== undefined)
+            (0, node_fs_1.closeSync)(descriptor);
+    }
+}
+function readJson(root, relativePath, label) {
+    const source = readBoundedWorkspaceFile(root, relativePath, label, MAX_CONTROL_JSON_BYTES).bytes.toString('utf8');
+    try {
+        return JSON.parse(source);
+    }
+    catch {
+        throw new Error(`${label} at ${relativePath} is not valid JSON.`);
+    }
+}
+function formatIssues(issues) {
+    return issues.map(({ message, path }) => `${path}: ${message}`).join('; ');
+}
+function safeRealRoot(repositoryRoot) {
+    if (!(0, node_path_1.isAbsolute)(repositoryRoot)) {
+        throw new Error('Developer-agent repository root must be absolute.');
+    }
+    const root = (0, node_fs_1.realpathSync)(repositoryRoot);
+    if (!(0, node_fs_1.lstatSync)(root).isDirectory()) {
+        throw new Error('Developer-agent repository root must be a directory.');
+    }
+    return root;
+}
+function containedPath(root, relativePath) {
+    if (relativePath.length === 0 ||
+        (0, node_path_1.isAbsolute)(relativePath) ||
+        relativePath.split(/[\\/]/).includes('..')) {
+        throw new Error(`Unsafe workspace-relative path ${relativePath}.`);
+    }
+    const absolute = (0, node_path_1.resolve)(root, ...relativePath.split('/'));
+    const fromRoot = (0, node_path_1.relative)(root, absolute);
+    if (fromRoot === '' ||
+        fromRoot.startsWith(`..${node_path_1.sep}`) ||
+        fromRoot === '..' ||
+        (0, node_path_1.isAbsolute)(fromRoot)) {
+        throw new Error(`Workspace path ${relativePath} escapes its owner root.`);
+    }
+    return absolute;
+}
+function packageVersion(root, packageName) {
+    const relativePath = (0, node_path_1.join)('node_modules', ...packageName.split('/'), 'package.json');
+    const path = containedPath(root, relativePath);
+    if (!(0, node_fs_1.existsSync)(path))
+        return undefined;
+    const manifest = readJson(root, relativePath, `${packageName} package manifest`);
+    if (!manifest ||
+        typeof manifest !== 'object' ||
+        Array.isArray(manifest) ||
+        typeof manifest.version !== 'string') {
+        throw new Error(`${packageName} package manifest has no exact version.`);
+    }
+    return manifest.version;
+}
+function workspaceIdentity(graph) {
+    const candidates = Object.values(graph.nodes).filter((node) => node.data.tags?.includes('scope:workspace'));
+    if (candidates.length !== 1) {
+        throw new Error(`Expected exactly one scope:workspace Nx project; found ${candidates.length}.`);
+    }
+    if (candidates[0].data.root !== '.') {
+        throw new Error('The sole scope:workspace Nx project must be rooted at the repository root.');
+    }
+    return { name: candidates[0].name, node: candidates[0] };
+}
+function foundationIdentity(workspaceRoot, graph) {
+    const candidates = Object.values(graph.nodes).filter((node) => node.data.tags?.includes('scope:foundation'));
+    if (candidates.length > 1) {
+        throw new Error(`Expected at most one scope:foundation Nx project; found ${candidates.length}.`);
+    }
+    if (candidates.length === 0) {
+        const untaggedCanonicalIdentity = Object.values(graph.nodes).some((node) => node.name === FOUNDATION_PROJECT_NAME ||
+            node.data.root.split(node_path_1.sep).join('/') === FOUNDATION_PROJECT_ROOT);
+        if (untaggedCanonicalIdentity) {
+            throw new Error('The canonical Foundation Nx project must declare scope:foundation.');
+        }
+        return undefined;
+    }
+    const foundation = candidates[0];
+    const declaredRoot = foundation.data.root.split(node_path_1.sep).join('/');
+    if (foundation.name !== FOUNDATION_PROJECT_NAME ||
+        declaredRoot !== FOUNDATION_PROJECT_ROOT) {
+        throw new Error('The sole scope:foundation Nx project must be the canonical foundation project.');
+    }
+    if (canonicalGraphProjectRoot(workspaceRoot, foundation) !==
+        (0, node_path_1.resolve)(workspaceRoot, FOUNDATION_PROJECT_ROOT)) {
+        throw new Error('The sole scope:foundation Nx project must resolve to its canonical repository directory.');
+    }
+    return foundation.name;
+}
+function selectedNodes(graph, requested) {
+    const names = requested === undefined
+        ? Object.keys(graph.nodes).sort()
+        : [...requested].sort();
+    if (names.length === 0 ||
+        names.length > MAX_PROJECTS ||
+        new Set(names).size !== names.length) {
+        throw new Error(`Developer-agent project selection must contain 1-${MAX_PROJECTS} unique projects.`);
+    }
+    return names.map((name) => {
+        if (!PROJECT_NAME_PATTERN.test(name)) {
+            throw new Error(`Developer-agent project name ${name} is invalid.`);
+        }
+        const node = graph.nodes[name];
+        if (!node)
+            throw new Error(`Nx project ${name} does not exist.`);
+        return node;
+    });
+}
+function fullGraphProjectNames(graph) {
+    const names = Object.keys(graph.nodes).sort(ordering_js_1.compareDeveloperAgentStrings);
+    if (names.length === 0 || names.length > model_js_1.DEVELOPER_AGENT_MAX_PROJECT_NAMES) {
+        throw new Error(`Developer-agent full Nx project-name inventory must contain 1-${model_js_1.DEVELOPER_AGENT_MAX_PROJECT_NAMES} projects.`);
+    }
+    for (const name of names) {
+        if (!PROJECT_NAME_PATTERN.test(name) || graph.nodes[name]?.name !== name) {
+            throw new Error('Developer-agent full Nx project-name inventory contains an invalid project identity.');
+        }
+    }
+    return names;
+}
+function selectedDependencyClosureNodes(graph, selected) {
+    const closure = new Map(selected.map((node) => [node.name, node]));
+    const pending = [...selected];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        if (!node)
+            continue;
+        for (const { target } of graph.dependencies[node.name] ?? []) {
+            const dependency = graph.nodes[target];
+            if (!dependency || closure.has(target))
+                continue;
+            closure.set(target, dependency);
+            pending.push(dependency);
+            if (closure.size > MAX_PROJECTS) {
+                throw new Error(`Developer-agent project dependency closure exceeds the ${MAX_PROJECTS}-project bound.`);
+            }
+        }
+    }
+    return [...closure.values()].sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.name, right.name));
+}
+function dependencies(graph, name) {
+    return [
+        ...new Set((graph.dependencies[name] ?? [])
+            .map(({ target }) => target)
+            .filter((target) => target in graph.nodes)),
+    ].sort();
+}
+function projectContext(graph, node) {
+    const targets = Object.keys(node.data.targets ?? {}).sort();
+    if (targets.length > MAX_TARGETS_PER_PROJECT) {
+        throw new Error(`Nx project ${node.name} exceeds the ${MAX_TARGETS_PER_PROJECT}-target context bound.`);
+    }
+    return {
+        dependencies: dependencies(graph, node.name),
+        name: node.name,
+        root: node.data.root.split(node_path_1.sep).join('/'),
+        tags: [...(node.data.tags ?? [])].sort(),
+        targets,
+    };
+}
+function canonicalGraphProjectRoot(workspaceRoot, node) {
+    const declaredRoot = node.data.root.split(node_path_1.sep).join('/');
+    if (declaredRoot === '.')
+        return workspaceRoot;
+    const candidate = containedPath(workspaceRoot, declaredRoot);
+    if (!(0, node_fs_1.existsSync)(candidate)) {
+        throw new Error(`Nx project ${node.name} root does not exist.`);
+    }
+    const metadata = (0, node_fs_1.lstatSync)(candidate);
+    if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        throw new Error(`Nx project ${node.name} root must be one canonical directory.`);
+    }
+    const canonical = (0, node_fs_1.realpathSync)(candidate);
+    if (!isContained(workspaceRoot, canonical)) {
+        throw new Error(`Nx project ${node.name} root escapes the workspace.`);
+    }
+    return canonical;
+}
+function externalOwnedProjectNames(workspaceRoot, nodes, ownershipRoots, history, foundationProjectName) {
+    const roots = [
+        ...new Set([
+            ...ownershipRoots.map(({ root }) => root),
+            ...history.externalSliceRoots.map((root) => {
+                if (!/^packages\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u.test(root)) {
+                    throw new Error('Protected external Blueprint history contains an invalid Slice root.');
+                }
+                return (0, node_path_1.resolve)(workspaceRoot, ...root.split('/'));
+            }),
+        ]),
+    ];
+    const identities = new Set([
+        ...history.externalProjectNames,
+        ...ownershipRoots.flatMap(({ projects, slice }) => [slice, ...projects]),
+    ]);
+    if (roots.length === 0 && identities.size === 0 && history.complete) {
+        return [];
+    }
+    const packagesRoot = (0, node_path_1.resolve)(workspaceRoot, 'packages');
+    return nodes.flatMap((node) => {
+        const projectRoot = canonicalGraphProjectRoot(workspaceRoot, node);
+        const owners = roots.filter((root) => isContained(root, projectRoot));
+        if (owners.length > 1) {
+            throw new Error(`Nx project ${node.name} has ambiguous external Blueprint ownership.`);
+        }
+        const incompletePackageAuthority = !history.complete &&
+            node.name !== foundationProjectName &&
+            isContained(packagesRoot, projectRoot);
+        return owners.length === 1 ||
+            identities.has(node.name) ||
+            incompletePackageAuthority
+            ? [node.name]
+            : [];
+    });
+}
+function normalizeSelectedFilePath(value) {
+    if (value.length === 0 ||
+        value.length > 1024 ||
+        value !== value.trim() ||
+        (0, node_path_1.isAbsolute)(value) ||
+        /^[A-Za-z]:[\\/]/.test(value) ||
+        value.includes('\\') ||
+        [...value].some((character) => {
+            const codePoint = character.codePointAt(0) ?? 0;
+            return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+        })) {
+        throw new Error('Selected files must be bounded canonical workspace-relative paths.');
+    }
+    const segments = value.split('/');
+    if (segments.some((segment) => segment.length === 0 || segment === '.' || segment === '..')) {
+        throw new Error('Selected files must be bounded canonical workspace-relative paths.');
+    }
+    return segments.join('/');
+}
+function selectedFilePath(root, relativePath) {
+    const segments = relativePath.split('/');
+    let current = root;
+    for (const [index, segment] of segments.entries()) {
+        current = (0, node_path_1.join)(current, segment);
+        if (!(0, node_fs_1.existsSync)(current)) {
+            const unresolved = (0, node_path_1.resolve)(current, ...segments.slice(index + 1));
+            if (!isContained(root, unresolved)) {
+                throw new Error(`Selected file ${relativePath} escapes the repository.`);
+            }
+            return unresolved;
+        }
+        const metadata = (0, node_fs_1.lstatSync)(current);
+        if (metadata.isSymbolicLink()) {
+            throw new Error(`Selected file ${relativePath} traverses a symbolic link.`);
+        }
+        if (index < segments.length - 1 && !metadata.isDirectory()) {
+            throw new Error(`Selected file ${relativePath} has a non-directory parent.`);
+        }
+        if (index === segments.length - 1 && !metadata.isFile()) {
+            throw new Error(`Selected file ${relativePath} is not a regular file path.`);
+        }
+    }
+    if (!isContained(root, current)) {
+        throw new Error(`Selected file ${relativePath} escapes the repository.`);
+    }
+    return current;
+}
+function projectRootPath(root, node) {
+    const declared = node.data.root.split(node_path_1.sep).join('/');
+    const absolute = declared === '.' ? root : containedPath(root, declared);
+    const metadata = (0, node_fs_1.lstatSync)(absolute);
+    if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        throw new Error(`Nx project ${node.name} root must be a contained non-symlink directory.`);
+    }
+    const real = (0, node_fs_1.realpathSync)(absolute);
+    if (!isContained(root, real)) {
+        throw new Error(`Nx project ${node.name} root escapes the repository.`);
+    }
+    return real;
+}
+function selectedFileContexts(root, graph, selected, records, requested) {
+    const paths = (requested ?? []).map(normalizeSelectedFilePath);
+    if (paths.length > MAX_SELECTED_FILES ||
+        new Set(paths).size !== paths.length) {
+        throw new Error(`Selected files must contain at most ${MAX_SELECTED_FILES} unique paths.`);
+    }
+    const selectedNames = new Set(selected.map(({ name }) => name));
+    const projectRoots = Object.values(graph.nodes).map((node) => ({
+        node,
+        root: projectRootPath(root, node),
+    }));
+    return paths
+        .map((path) => {
+        const absolute = selectedFilePath(root, path);
+        const owners = projectRoots
+            .filter(({ root: projectRoot }) => isContained(projectRoot, absolute))
+            .sort((left, right) => right.root.length - left.root.length ||
+            (0, ordering_js_1.compareDeveloperAgentStrings)(left.node.name, right.node.name));
+        if (owners.length === 0) {
+            throw new Error(`Selected file ${path} has no owning Nx project.`);
+        }
+        if (owners[1] && owners[0].root === owners[1].root) {
+            throw new Error(`Selected file ${path} has ambiguous most-specific Nx project ownership.`);
+        }
+        const project = owners[0].node.name;
+        if (!selectedNames.has(project)) {
+            throw new Error(`Selected file ${path} belongs to unselected Nx project ${project}.`);
+        }
+        const claims = records.flatMap((record) => record.paths
+            .filter((entry) => containedPath(record.root, entry.path) === absolute)
+            .map((entry) => ({
+            mode: entry.mode,
+            record: record.path,
+        })));
+        if (claims.length > 1) {
+            throw new Error(`Selected file ${path} has conflicting ownership records ${claims
+                .map(({ record }) => record)
+                .join(', ')}.`);
+        }
+        return {
+            ownershipMode: claims[0]?.mode ?? 'adopter-owned',
+            path,
+            project,
+        };
+    })
+        .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.path, right.path));
+}
+function readOwnershipRecords(root, nodes) {
+    const records = [];
+    const warnings = [];
+    const workspaceValidation = (0, index_js_1.validateWorkspaceOwnershipRecord)(readJson(root, '.ebk/ownership.json', 'Workspace ownership record'));
+    if (!workspaceValidation.valid) {
+        throw new Error(`Workspace ownership record is invalid: ${formatIssues(workspaceValidation.issues)}`);
+    }
+    records.push({
+        frameworkVersion: workspaceValidation.value.frameworkVersion,
+        kind: 'workspace',
+        path: '.ebk/ownership.json',
+        paths: workspaceValidation.value.paths,
+        root,
+    });
+    for (const node of nodes) {
+        const tags = new Set(node.data.tags ?? []);
+        if (!tags.has('scope:foundation') && !tags.has('type:slice'))
+            continue;
+        const relativeOwnership = `${node.data.root.split(node_path_1.sep).join('/')}/.ebk/ownership.json`;
+        const ownershipFile = readBoundedWorkspaceFile(root, relativeOwnership, `${node.name} ownership record`, MAX_CONTROL_JSON_BYTES);
+        const projectRoot = (0, node_fs_1.realpathSync)(containedPath(root, node.data.root));
+        if (!isContained(root, projectRoot) ||
+            !(0, node_fs_1.lstatSync)(projectRoot).isDirectory()) {
+            throw new Error(`Nx project ${node.name} root must resolve to a contained directory.`);
+        }
+        let ownershipValue;
+        try {
+            ownershipValue = JSON.parse(ownershipFile.bytes.toString('utf8'));
+        }
+        catch {
+            throw new Error(`${node.name} ownership record at ${relativeOwnership} is not valid JSON.`);
+        }
+        if (tags.has('scope:foundation')) {
+            const validation = (0, index_js_1.validateFoundationOwnershipRecord)(ownershipValue);
+            if (!validation.valid) {
+                throw new Error(`Foundation ownership record is invalid: ${formatIssues(validation.issues)}`);
+            }
+            records.push({
+                frameworkVersion: validation.value.frameworkVersion,
+                kind: 'foundation',
+                path: relativeOwnership,
+                paths: validation.value.paths,
+                root: projectRoot,
+            });
+            continue;
+        }
+        const validation = (0, index_js_1.validateGeneratedOwnershipRecord)(ownershipValue);
+        if (!validation.valid) {
+            throw new Error(`Product Slice ${node.name} ownership record is invalid: ${formatIssues(validation.issues)}`);
+        }
+        if (validation.value.slice !== node.name) {
+            warnings.push(warning('ownership-conflict', `Nx project ${node.name} disagrees with its Product Slice ownership identity.`));
+        }
+        records.push({
+            kind: 'slice',
+            path: relativeOwnership,
+            paths: validation.value.paths,
+            root: projectRoot,
+            slice: validation.value,
+        });
+    }
+    return { records, warnings };
+}
+function ownershipWarnings(records) {
+    const warnings = [];
+    let ownedPathCount = 0;
+    const claims = new Map();
+    for (const record of records) {
+        ownedPathCount += record.paths.length;
+        if (ownedPathCount > MAX_OWNED_PATHS) {
+            throw new Error(`Ownership inventory exceeds the ${MAX_OWNED_PATHS}-path bound.`);
+        }
+        for (const entry of record.paths) {
+            const absolute = containedPath(record.root, entry.path);
+            const prior = claims.get(absolute);
+            if (prior &&
+                (prior.mode !== entry.mode || prior.record !== record.path)) {
+                warnings.push(warning('ownership-conflict', `Ownership records ${prior.record} and ${record.path} both claim one generated path.`));
+            }
+            else {
+                claims.set(absolute, { mode: entry.mode, record: record.path });
+            }
+            if (entry.mode !== 'managed')
+                continue;
+            if (!(0, node_fs_1.existsSync)(absolute) || !(0, node_fs_1.lstatSync)(absolute).isFile()) {
+                warnings.push(warning('generated-drift', `Managed path ${entry.path} is missing from ${record.path}.`));
+                continue;
+            }
+            const current = readBoundedWorkspaceFile(record.root, entry.path, `Managed path ${entry.path} from ${record.path}`, MAX_OWNED_FILE_BYTES).bytes.toString('utf8');
+            if ((0, index_js_1.hashOwnedContent)(current, entry) !== entry.sha256) {
+                warnings.push(warning('generated-drift', `Managed path ${entry.path} differs from ${record.path}.`));
+            }
+        }
+    }
+    return warnings;
+}
+function versionContext(root, identity, records) {
+    const warnings = [];
+    const installedNx = packageVersion(root, '@empire-builder-kit/nx');
+    const installedRuntime = packageVersion(root, '@empire-builder-kit/runtime');
+    if (!installedNx || !installedRuntime) {
+        warnings.push(warning('prerequisite-missing', 'Exact installed @empire-builder-kit/nx and runtime package identities are required.'));
+    }
+    if (installedNx !== undefined &&
+        installedRuntime !== undefined &&
+        installedNx !== installedRuntime) {
+        warnings.push(warning('ownership-conflict', 'Installed framework Nx and Runtime packages are not the same exact candidate version.'));
+    }
+    const ownershipVersions = records
+        .map((record) => {
+        const target = record.kind === 'slice'
+            ? (record.slice?.slice ?? 'unavailable')
+            : record.kind;
+        const blueprintName = record.slice?.blueprint.name;
+        const installedBlueprintVersion = blueprintName === undefined
+            ? undefined
+            : blueprintName === '@empire-builder-kit/blueprint-standard'
+                ? installedNx
+                : packageVersion(root, blueprintName);
+        return {
+            ...(blueprintName ? { blueprintName } : {}),
+            ...(installedBlueprintVersion ? { installedBlueprintVersion } : {}),
+            ...(installedNx ? { installedFrameworkVersion: installedNx } : {}),
+            kind: record.kind,
+            ...(record.slice
+                ? {
+                    recordedBlueprintVersion: record.slice.blueprint.version,
+                }
+                : {}),
+            ...(record.frameworkVersion
+                ? { recordedFrameworkVersion: record.frameworkVersion }
+                : {}),
+            target,
+        };
+    })
+        .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.target, right.target) ||
+        (0, ordering_js_1.compareDeveloperAgentStrings)(left.kind, right.kind));
+    for (const state of ownershipVersions) {
+        const frameworkDrift = state.installedFrameworkVersion !== undefined &&
+            state.recordedFrameworkVersion !== undefined &&
+            state.installedFrameworkVersion !== state.recordedFrameworkVersion;
+        const blueprintDrift = state.installedBlueprintVersion !== undefined &&
+            state.recordedBlueprintVersion !== undefined &&
+            state.installedBlueprintVersion !== state.recordedBlueprintVersion;
+        if (frameworkDrift || blueprintDrift) {
+            warnings.push(warning('ownership-conflict', `${state.kind} ${state.target} ownership records expected version drift from the installed framework candidate.`, { kind: state.kind, target: state.target }));
+        }
+        if (state.blueprintName !== undefined &&
+            state.installedBlueprintVersion === undefined) {
+            warnings.push(warning('prerequisite-missing', `Exact installed Blueprint package identity is required for Product Slice ${state.target}.`));
+        }
+    }
+    const blueprintVersions = records
+        .filter((record) => record.slice !== undefined)
+        .map(({ slice }) => ({
+        name: `${slice.slice}:${slice.blueprint.name}`,
+        version: slice.blueprint.version,
+    }))
+        .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.name, right.name));
+    const hasConflict = warnings.some(({ classification }) => classification === 'ownership-conflict');
+    return {
+        warnings,
+        workspace: {
+            blueprintVersions,
+            frameworkVersion: installedNx ?? 'unavailable',
+            identity,
+            ownershipVersions,
+            ownershipAgreement: hasConflict
+                ? 'conflict'
+                : installedNx
+                    ? 'agrees'
+                    : 'unavailable',
+            repositoryRoot: root,
+        },
+    };
+}
+function protectedExternalBlueprintVerification(root, frameworkVersion, records, graph, registryProjectNames, now, git) {
+    const external = records.filter((record) => record.slice !== undefined &&
+        record.slice.blueprint.name !== index_js_4.BUILTIN_BLUEPRINT_NAME &&
+        [record.slice.slice, ...record.slice.projects].some((name) => registryProjectNames.has(name)));
+    if (external.length === 0)
+        return { reviews: [], warnings: [] };
+    const unavailable = () => ({
+        reviews: [],
+        warnings: [
+            warning('prerequisite-missing', 'External Blueprint verification lacks an exact protected review and matching exact-root execution receipt for its target closure and managed bytes.'),
+        ],
+    });
+    try {
+        const protectedBranch = git.defaultBaseRef === 'origin/main' ||
+            git.defaultBaseRef === 'refs/remotes/origin/main'
+            ? 'main'
+            : git.defaultBaseRef === 'origin/develop' ||
+                git.defaultBaseRef === 'refs/remotes/origin/develop'
+                ? 'develop'
+                : undefined;
+        if (!protectedBranch)
+            return unavailable();
+        const configurationPaths = (0, blueprint_verification_authority_js_1.assertNoMutableBlueprintVerificationConfiguration)(root);
+        (0, blueprint_verification_authority_js_1.assertBlueprintVerificationNxAuthority)(readBoundedWorkspaceFile(root, 'nx.json', 'Blueprint verification Nx authority', MAX_CONTROL_JSON_BYTES).bytes.toString('utf8'));
+        const policy = readJson(root, 'supply-chain/blueprint-trust-policy.json', 'Blueprint trust policy');
+        const snapshot = readJson(root, 'supply-chain/blueprint-trust-snapshot.json', 'Blueprint trust snapshot');
+        const authority = (0, blueprint_trust_git_js_1.inspectBlueprintTrustGitAuthority)({
+            builtIn: { name: index_js_4.BUILTIN_BLUEPRINT_NAME, version: frameworkVersion },
+            current: { policy, snapshot },
+            ownership: records.flatMap((record) => record.slice ? [{ path: record.path, value: record.slice }] : []),
+            protectedBranch,
+            protectedRef: git.defaultBaseCommit,
+            workspaceRoot: root,
+        });
+        const assertCurrentExecutionAuthority = () => {
+            const currentConfigurationPaths = (0, blueprint_verification_authority_js_1.assertNoMutableBlueprintVerificationConfiguration)(root);
+            if (!(0, node_util_1.isDeepStrictEqual)(currentConfigurationPaths, configurationPaths)) {
+                throw new Error('Blueprint verification configuration inventory changed during inspection.');
+            }
+            (0, blueprint_verification_authority_js_1.assertBlueprintVerificationNxAuthority)(readBoundedWorkspaceFile(root, 'nx.json', 'Blueprint verification Nx authority', MAX_CONTROL_JSON_BYTES).bytes.toString('utf8'));
+            (0, blueprint_trust_git_js_1.assertProtectedGitVerificationExecutionAuthority)({
+                headCommit: authority.headCommit,
+                protectedCommit: authority.protectedCommit,
+                protectedRef: `refs/remotes/origin/${protectedBranch}`,
+                workspaceRoot: root,
+            });
+            for (const path of currentConfigurationPaths) {
+                (0, blueprint_trust_git_js_1.inspectProtectedGitFileAuthority)({
+                    current: readBoundedWorkspaceFile(root, path, `Blueprint verification configuration ${path}`, MAX_CONTROL_JSON_BYTES).bytes,
+                    headCommit: authority.headCommit,
+                    path,
+                    protectedCommit: authority.protectedCommit,
+                    workspaceRoot: root,
+                });
+            }
+        };
+        assertCurrentExecutionAuthority();
+        const lockfileBytes = readBoundedWorkspaceFile(root, 'pnpm-lock.yaml', 'pnpm-lock.yaml', 25 * 1024 * 1024).bytes;
+        const lockfile = lockfileBytes.toString('utf8');
+        const nodeVersionSource = readBoundedWorkspaceFile(root, '.node-version', '.node-version', 128).bytes.toString('utf8');
+        const manifest = readJson(root, 'package.json', 'Workspace package.json');
+        if (readBoundedWorkspaceFile(root, 'tools/blueprint-verification-vitest.config.mjs', 'Blueprint verification Vitest config', MAX_CONTROL_JSON_BYTES).bytes.toString('utf8') !== generated_blueprint_trust_command_js_1.BLUEPRINT_VERIFICATION_VITEST_CONFIG_SOURCE) {
+            return unavailable();
+        }
+        if (!isRecord(manifest) || typeof manifest.name !== 'string') {
+            return unavailable();
+        }
+        const devDependencies = manifest.devDependencies;
+        if (!isRecord(devDependencies))
+            return unavailable();
+        const otherDeclarationGroups = ['dependencies', 'optionalDependencies']
+            .map((group) => manifest[group])
+            .filter(isRecord);
+        const reviews = [];
+        for (const record of external) {
+            const blueprint = record.slice.blueprint;
+            if (devDependencies[blueprint.name] !== blueprint.version ||
+                otherDeclarationGroups.some((group) => Object.prototype.hasOwnProperty.call(group, blueprint.name))) {
+                return unavailable();
+            }
+            const integrity = (0, blueprint_trust_js_1.resolveBlueprintPackageIntegrity)(lockfile, blueprint.name, blueprint.version);
+            const decision = (0, blueprint_trust_js_1.authorizeBlueprintTrust)({
+                frameworkVersion,
+                integrity,
+                name: blueprint.name,
+                now,
+                operation: 'adopt',
+                policy: authority.authorization.policy,
+                snapshot: authority.authorization.snapshot,
+                version: blueprint.version,
+            });
+            if (decision.decision !== 'allow')
+                return unavailable();
+            const projectNode = graph.nodes[record.slice.slice];
+            if (!projectNode)
+                return unavailable();
+            const project = {
+                context: projectContext(graph, projectNode),
+                targets: (projectNode.data.targets ?? {}),
+            };
+            const verificationTargets = (0, blueprint_trust_js_1.blueprintVerificationTargetClosure)({
+                projectRoot: project.context.root,
+                roots: record.slice.verification,
+                targets: project.targets,
+            });
+            const blueprintFiles = record.slice.paths
+                .filter(({ origin }) => origin === 'blueprint')
+                .map((owned) => {
+                const currentBytes = readBoundedWorkspaceFile(record.root, owned.path, `Blueprint-origin path ${owned.path}`, MAX_OWNED_FILE_BYTES).bytes;
+                const current = currentBytes.toString('utf8');
+                if (owned.mode === 'managed' &&
+                    (0, index_js_1.hashOwnedContent)(current, owned) !== owned.sha256) {
+                    throw new Error('Blueprint-managed content differs from ownership.');
+                }
+                return {
+                    digest: (0, index_js_1.hashGeneratedContent)(currentBytes),
+                    mode: owned.mode,
+                    path: owned.path,
+                };
+            })
+                .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.path, right.path));
+            const exactBlueprint = {
+                integrity,
+                name: blueprint.name,
+                version: blueprint.version,
+            };
+            const review = authority.authorization.policy.generatedReviews.find((candidate) => {
+                const candidateContent = {
+                    blueprintFiles,
+                    containerRegistries: [...candidate.allowedContainerRegistries],
+                    projectPath: `packages/${record.slice.slice}/project.json`,
+                    slice: record.slice.slice,
+                    verificationRoots: [...candidate.verificationRoots],
+                    verificationTargets,
+                };
+                return (candidate.blueprint.name === blueprint.name &&
+                    candidate.blueprint.version === blueprint.version &&
+                    candidate.blueprint.integrity === integrity &&
+                    candidate.slice === record.slice.slice &&
+                    candidate.projectPath ===
+                        `packages/${record.slice.slice}/project.json` &&
+                    (0, node_util_1.isDeepStrictEqual)(candidate.verificationRoots, [...record.slice.verification].sort(ordering_js_1.compareDeveloperAgentStrings)) &&
+                    (0, node_util_1.isDeepStrictEqual)(candidate.verificationTargets, verificationTargets) &&
+                    (0, node_util_1.isDeepStrictEqual)(candidate.blueprintFiles, blueprintFiles) &&
+                    candidate.evidenceDigest ===
+                        (0, blueprint_trust_js_1.blueprintGeneratedContentApprovalDigest)(exactBlueprint, candidateContent));
+            });
+            if (!review)
+                return unavailable();
+            const content = {
+                blueprintFiles,
+                containerRegistries: [...review.allowedContainerRegistries],
+                projectPath: `packages/${record.slice.slice}/project.json`,
+                slice: record.slice.slice,
+                verificationRoots: [...review.verificationRoots],
+                verificationTargets,
+            };
+            const receiptPath = (0, blueprint_trust_js_1.blueprintVerificationExecutionReceiptPath)(record.slice.slice);
+            const protectedReceipt = authority.protectedVerificationReceipts.find(({ reference }) => reference === receiptPath);
+            if (!protectedReceipt)
+                return unavailable();
+            const receipt = (0, blueprint_trust_js_1.createBlueprintVerificationExecutionReceipt)(protectedReceipt.receipt, {
+                approvalDigest: review.evidenceDigest,
+                blueprint: exactBlueprint,
+                content,
+                executionCommit: protectedReceipt.receipt.executionCommit,
+                repositoryRootCommit: authority.repositoryRootCommit,
+                reviewedAt: review.reviewedAt,
+                workspace: manifest.name,
+            });
+            const nodeEngine = isRecord(manifest.engines)
+                ? manifest.engines.node
+                : undefined;
+            if (typeof nodeEngine !== 'string' ||
+                nodeEngine !== receipt.nodeEngine ||
+                nodeVersionSource !== `${receipt.nodeVersionDeclaration}\n` ||
+                !(0, semver_1.satisfies)(receipt.nodeVersion, nodeEngine) ||
+                (0, node_crypto_1.createHash)('sha256').update(lockfileBytes).digest('hex') !==
+                    receipt.lockfileSha256) {
+                return unavailable();
+            }
+            const invocations = (0, blueprint_verification_execution_js_1.resolveBlueprintVerificationExecutions)(verificationTargets.map(({ name }) => {
+                const target = project.targets[name];
+                return {
+                    options: target?.options ?? {},
+                    projectName: record.slice.slice,
+                    projectRoot: project.context.root,
+                    workspaceRoot: root,
+                };
+            }));
+            const currentExecutionAuthorities = verificationTargets.map(({ name }, index) => {
+                const invocation = invocations[index];
+                if (!invocation) {
+                    throw new Error('Blueprint verification target lost its portable invocation.');
+                }
+                const targetIdentity = `${record.slice.slice}:${name}`;
+                if (invocation.plan.kind === 'node') {
+                    if (invocation.toolAuthority !== undefined) {
+                        throw new Error('Blueprint verification Node target acquired package authority.');
+                    }
+                    return { kind: 'node', target: targetIdentity };
+                }
+                if (!invocation.toolAuthority ||
+                    invocation.toolAuthority.name !== invocation.plan.kind) {
+                    throw new Error('Blueprint verification target lost its portable package authority.');
+                }
+                return {
+                    ...invocation.toolAuthority,
+                    kind: invocation.plan.kind,
+                    target: targetIdentity,
+                };
+            });
+            if (!(0, node_util_1.isDeepStrictEqual)(currentExecutionAuthorities, receipt.executionAuthorities)) {
+                return unavailable();
+            }
+            reviews.push({
+                project: record.slice.slice,
+                roots: [...review.verificationRoots],
+                verificationTargets,
+            });
+        }
+        assertCurrentExecutionAuthority();
+        return { reviews, warnings: [] };
+    }
+    catch {
+        return unavailable();
+    }
+}
+function candidateReference(root, requestedPath) {
+    if (!requestedPath)
+        return undefined;
+    const relativePath = requestedPath;
+    const bytes = readBoundedWorkspaceFile(root, relativePath, `Candidate provenance reference ${relativePath}`, MAX_CANDIDATE_BYTES).bytes;
+    return {
+        digest: `sha256:${(0, node_crypto_1.createHash)('sha256').update(bytes).digest('hex')}`,
+        reference: relativePath,
+    };
+}
+function policyContext(root, stage, policy, nodes) {
+    const selected = nodes
+        .filter((node) => node.data.tags?.includes('scope:foundation') ||
+        node.data.tags?.includes('type:slice'))
+        .map((node) => ({
+        kind: node.data.tags?.includes('scope:foundation')
+            ? 'foundation'
+            : 'slice',
+        name: node.name,
+    }))
+        .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.name, right.name));
+    const selectedPolicyProjects = selected.map(({ name }) => name);
+    const decisions = model_js_1.DEVELOPER_AGENT_POLICY_LIFECYCLE_ACTIONS.map((action) => {
+        const decision = (0, index_js_2.evaluateRepositoryPolicyRequest)(policy, {
+            action,
+            projects: selected,
+            stage,
+        });
+        return {
+            action,
+            allowed: decision.allowed,
+            ...(decision.effectiveProductionProfile
+                ? {
+                    effectiveProductionProfile: decision.effectiveProductionProfile,
+                }
+                : {}),
+            projects: selectedPolicyProjects,
+            reasons: [...decision.reasons],
+            stage,
+        };
+    });
+    const fields = [
+        { name: 'productionAccess', value: policy.productionAccess },
+        {
+            name: 'productionApproval.mode',
+            value: policy.productionApproval.mode,
+        },
+        {
+            name: 'productionFoundation.profile',
+            value: policy.productionFoundation.profile,
+        },
+        ...Object.entries(policy.slices)
+            .sort(([left], [right]) => (0, ordering_js_1.compareDeveloperAgentStrings)(left, right))
+            .map(([slice, value]) => ({
+            name: `slices.${slice}.productionStatus`,
+            value: value.productionStatus,
+        })),
+        ...decisions.map(({ action, allowed }) => ({
+            name: `effective.${stage}.${action}`,
+            value: allowed ? 'allowed' : 'blocked',
+        })),
+    ];
+    const canonicalPolicyMaterial = JSON.stringify({
+        decisions,
+        policy: {
+            $schema: policy.$schema ?? null,
+            productionAccess: policy.productionAccess,
+            productionApproval: policy.productionApproval,
+            productionFoundation: policy.productionFoundation,
+            schemaVersion: policy.schemaVersion,
+            slices: Object.fromEntries(Object.entries(policy.slices).sort(([left], [right]) => (0, ordering_js_1.compareDeveloperAgentStrings)(left, right))),
+        },
+        selected,
+        stage,
+    });
+    return {
+        canonicalStage: stage,
+        effectiveDecisions: decisions,
+        effectivePolicyDigest: `sha256:${(0, node_crypto_1.createHash)('sha256')
+            .update(canonicalPolicyMaterial)
+            .digest('hex')}`,
+        effectivePolicyReferences: [
+            'ebk.repository-policy.json',
+            'docs/repository-operating-policy.md',
+        ].filter((path) => (0, node_fs_1.existsSync)((0, node_path_1.join)(root, path))),
+        repositoryPolicyFields: fields,
+    };
+}
+function selectedSliceRecord(records, selectedSlice) {
+    if (!selectedSlice)
+        return undefined;
+    const record = records.find(({ slice }) => slice?.slice === selectedSlice);
+    if (!record?.slice) {
+        throw new Error(`Selected Product Slice ${selectedSlice} has no valid ownership record.`);
+    }
+    return record;
+}
+function selectionContext(record, feature, projectInventory) {
+    if (!record) {
+        if (feature)
+            throw new Error('A feature selection requires one Product Slice.');
+        return { contracts: [], foundationCapabilities: [], projectInventory };
+    }
+    if (feature) {
+        const registryPath = 'operations/features.json';
+        const registry = (0, feature_registry_js_1.parseSliceFeatureRegistry)(readJson(record.root, registryPath, `Product Slice ${record.slice.slice} feature registry`), `Product Slice ${record.slice.slice} feature registry`);
+        if (!registry.features.some(({ id }) => id === feature)) {
+            throw new Error(`Feature ${feature} is not registered for Product Slice ${record.slice.slice}.`);
+        }
+    }
+    return {
+        contracts: [
+            ...record.slice.contracts.consumes.map((reference) => ({
+                class: 'other',
+                reference: `consumes:${reference}`,
+            })),
+            ...record.slice.contracts.publishes.map((reference) => ({
+                class: 'other',
+                reference: `publishes:${reference}`,
+            })),
+        ].sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.reference, right.reference)),
+        ...(feature ? { feature } : {}),
+        foundationCapabilities: [...record.slice.foundation.capabilities].sort(),
+        projectInventory,
+        slice: record.slice.slice,
+    };
+}
+function markerContext(root) {
+    const report = (0, index_js_3.scanWorkMarkers)(root);
+    const markers = report.markers.map((marker) => ({
+        blocking: marker.kind === 'BLOCKER' || marker.kind === 'SECURITY',
+        path: marker.path,
+        reference: marker.reference,
+        sanitizedSummary: `EBK-${marker.kind} marker in ${marker.ownership} source.`,
+    }));
+    const warnings = [
+        ...(report.blockingMarkers.length > 0
+            ? [
+                warning('marker-blocked', `${report.blockingMarkers.length} work marker(s) block protected promotion.`),
+            ]
+            : []),
+        ...report.issues.map((issue) => warning(issue.code === 'ownership-conflict' ||
+            issue.code === 'managed-file-marker'
+            ? 'ownership-conflict'
+            : 'marker-blocked', `Work-marker validation reported ${issue.code} at ${issue.path}:${issue.line}.`)),
+    ];
+    return { markers, warnings };
+}
+function reportContexts(warnings, markers) {
+    const ownershipFailed = warnings.some(({ classification }) => ['generated-drift', 'ownership-conflict'].includes(classification));
+    return [
+        {
+            name: 'ownership-and-version',
+            outcome: ownershipFailed ? 'failed' : 'passed',
+            reference: '.ebk/ownership.json',
+        },
+        {
+            name: 'repository-policy',
+            outcome: warnings.some(({ classification }) => classification === 'policy-conflict')
+                ? 'failed'
+                : 'passed',
+            reference: 'ebk.repository-policy.json',
+        },
+        {
+            name: 'work-markers',
+            outcome: markers.some(({ blocking }) => blocking)
+                ? 'blocked'
+                : 'passed',
+            reference: 'AGENTS.md',
+        },
+        {
+            name: 'github-bootstrap',
+            outcome: 'unavailable',
+            reference: 'github-bootstrap',
+        },
+        {
+            name: 'infrastructure-drift',
+            outcome: 'unavailable',
+            reference: 'infrastructure-drift',
+        },
+    ];
+}
+function uniqueWarnings(values) {
+    const seen = new Set();
+    return values
+        .filter(({ classification, sanitizedSummary }) => {
+        const key = `${classification}\0${sanitizedSummary}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    })
+        .sort((left, right) => (0, ordering_js_1.compareDeveloperAgentStrings)(left.classification, right.classification) ||
+        (0, ordering_js_1.compareDeveloperAgentStrings)(left.sanitizedSummary, right.sanitizedSummary));
+}
+function inspectDeveloperAgentWorkspace(options) {
+    const root = safeRealRoot(options.repositoryRoot);
+    const projectNames = fullGraphProjectNames(options.graph);
+    const identity = workspaceIdentity(options.graph);
+    const foundationProjectName = foundationIdentity(root, options.graph);
+    const nodes = selectedNodes(options.graph, options.selectedProjects);
+    const registryNodes = selectedDependencyClosureNodes(options.graph, [
+        ...new Map([...nodes, identity.node].map((node) => [node.name, node])).values(),
+    ]);
+    if (options.selectedSlice &&
+        !nodes.some((node) => node.name === options.selectedSlice)) {
+        throw new Error('The selected Product Slice must be included in the bounded project selection.');
+    }
+    const projects = nodes.map((node) => projectContext(options.graph, node));
+    const selectedProjectNames = new Set(nodes.map(({ name }) => name));
+    const ownershipNodes = Object.values(options.graph.nodes).filter((node) => node.data.tags?.some((tag) => tag === 'scope:foundation' || tag === 'type:slice'));
+    const ownership = readOwnershipRecords(root, ownershipNodes);
+    const externalOwnershipRoots = (0, blueprint_verification_authority_js_1.externalBlueprintOwnershipRoots)(root);
+    const versions = versionContext(root, identity.name, ownership.records);
+    const provenance = candidateReference(root, options.candidateProvenancePath);
+    const ownedWarnings = ownershipWarnings(ownership.records);
+    const hasOwnershipConflict = [...ownership.warnings, ...ownedWarnings].some(({ classification }) => classification === 'ownership-conflict');
+    const workspace = {
+        ...versions.workspace,
+        ...(provenance ? { candidateProvenance: provenance } : {}),
+        ...(hasOwnershipConflict
+            ? { ownershipAgreement: 'conflict' }
+            : {}),
+    };
+    let policy;
+    const policyWarnings = [];
+    try {
+        const policySource = readBoundedWorkspaceFile(root, index_js_2.REPOSITORY_POLICY_FILE, 'Repository Operating Policy', MAX_CONTROL_JSON_BYTES).bytes.toString('utf8');
+        policy = (0, index_js_2.parseRepositoryOperatingPolicy)(policySource, index_js_2.REPOSITORY_POLICY_FILE);
+    }
+    catch {
+        policyWarnings.push(warning('policy-conflict', 'Repository Operating Policy is missing, malformed, or contradictory.'));
+        throw new Error(policyWarnings[0].sanitizedSummary);
+    }
+    const selectedRecord = selectedSliceRecord(ownership.records, options.selectedSlice);
+    const selection = {
+        ...selectionContext(selectedRecord, options.selectedFeature, options.selectedProjects === undefined ? 'full' : 'bounded'),
+        files: selectedFileContexts(root, options.graph, nodes, ownership.records, options.selectedFiles),
+    };
+    const marker = markerContext(root);
+    const projectTargets = registryNodes.map((node) => ({
+        context: projectContext(options.graph, node),
+        targets: (node.data.targets ?? {}),
+    }));
+    const externalVerification = protectedExternalBlueprintVerification(root, versions.workspace.frameworkVersion, ownership.records, options.graph, new Set(registryNodes.map(({ name }) => name)), options.blueprintTrustNow ?? new Date().toISOString(), options.git);
+    const operationRegistry = (0, operation_registry_js_1.createDeveloperAgentOperationRegistry)(projectTargets, {
+        exposedProjectNames: nodes.map(({ name }) => name),
+        externalOwnedProjectNames: externalOwnedProjectNames(root, registryNodes, externalOwnershipRoots, options.externalOwnershipHistory, foundationProjectName),
+        namedInputDefinitions: [
+            options.workspaceNamedInputs ?? { runtime: 'uninspected' },
+            ...Object.values(options.graph.nodes).map((node) => node.data.namedInputs ?? {}),
+        ],
+        reviewedExternalVerification: externalVerification.reviews,
+    });
+    const intentionallyNonPlannable = new Set(operationRegistry.nonPlannableTargets.map(({ target }) => target));
+    const unsupportedWarnings = operationRegistry.unsupportedTargets
+        .filter((target) => !intentionallyNonPlannable.has(target))
+        .filter((target) => (0, operation_registry_js_1.operationLooksMutating)(target.slice(target.lastIndexOf(':') + 1)))
+        .map(() => warning('unsupported-operation', 'One mutation-shaped Nx target has no declared Developer-Agent authority contract.'));
+    const warnings = uniqueWarnings([
+        ...ownership.warnings,
+        ...versions.warnings,
+        ...ownedWarnings,
+        ...policyWarnings,
+        ...marker.warnings,
+        ...externalVerification.warnings,
+        ...unsupportedWarnings,
+    ]);
+    const requiredVerification = [
+        ...new Set([
+            ...ownership.records.flatMap((record) => record.slice && selectedProjectNames.has(record.slice.slice)
+                ? record.slice.verification.map((target) => `${record.slice.slice}:${target}`)
+                : []),
+            ...projects
+                .filter(({ targets }) => targets.includes('verify'))
+                .map(({ name }) => `${name}:verify`),
+        ]),
+    ].sort();
+    const documentationPaths = [
+        'AGENTS.md',
+        'docs/architecture.md',
+        'docs/developer-agent.md',
+        'docs/git-workflow.md',
+        'docs/repository-operating-policy.md',
+        'docs/work-markers.md',
+    ].filter((path) => (0, node_fs_1.existsSync)((0, node_path_1.join)(root, path)));
+    return {
+        ...(options.affected ? { affected: options.affected } : {}),
+        authenticatedTargets: operationRegistry.authenticatedTargets,
+        documentationPaths,
+        evidenceClasses: [
+            'source',
+            'local-integration',
+            'protected-promotion-proof',
+        ],
+        git: options.git,
+        kind: model_js_1.DEVELOPER_AGENT_CONTEXT_KIND,
+        markers: marker.markers,
+        nonPlannableTargets: operationRegistry.nonPlannableTargets,
+        policy: policyContext(root, options.canonicalStage ?? 'development', policy, registryNodes),
+        projectNames,
+        projects,
+        reports: reportContexts(warnings, marker.markers),
+        requiredVerification,
+        schemaVersion: model_js_1.DEVELOPER_AGENT_CONTRACT_SCHEMA_VERSION,
+        selection,
+        supportedOperations: operationRegistry.operations,
+        warnings,
+        workspace,
+    };
+}
+//# sourceMappingURL=workspace-inspection.js.map