@empire-builder-kit/nx 1.0.0-rc.2 → 1.0.0-rc.21

package/src/sst-environment-source-format.js

@@ -0,0 +1,179 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isExactGeneratedRootSstEnvironmentSourceBytes = isExactGeneratedRootSstEnvironmentSourceBytes;
+exports.isExactGeneratedRootSstPythonSourceBytes = isExactGeneratedRootSstPythonSourceBytes;
+exports.exactGeneratedNestedSstEnvironmentSourceBytes = exactGeneratedNestedSstEnvironmentSourceBytes;
+const node_path_1 = require("node:path");
+const GENERATED_HEADER = [
+    '/* This file is auto-generated by SST. Do not edit. */',
+    '/* tslint:disable */',
+    '/* eslint-disable */',
+    '/* deno-fmt-ignore-file */',
+    '/* biome-ignore-all lint: auto-generated */',
+    '',
+];
+function exactJsonString(value) {
+    try {
+        const parsed = JSON.parse(value);
+        return typeof parsed === 'string' && JSON.stringify(parsed) === value;
+    }
+    catch {
+        return false;
+    }
+}
+function exactGeneratedResourceMembers(lines) {
+    let depth = 0;
+    for (const line of lines) {
+        const indentation = line.match(/^ */u)?.[0].length ?? 0;
+        if (line.trim() === '}') {
+            if (depth === 0 || indentation !== 4 + (depth - 1) * 2)
+                return false;
+            depth -= 1;
+            continue;
+        }
+        if (indentation !== 4 + depth * 2)
+            return false;
+        const property = line
+            .slice(indentation)
+            .match(/^("(?:[^"\\]|\\.)*"): (.+)$/u);
+        if (!property ||
+            !property[1] ||
+            !property[2] ||
+            !exactJsonString(property[1])) {
+            return false;
+        }
+        if (property[2] === '{') {
+            depth += 1;
+            continue;
+        }
+        // SST emits JSON property names followed by TypeScript type expressions.
+        // Keep the accepted alphabet deliberately type-only: executable statement
+        // delimiters, comments, assignments, templates, and braces are excluded.
+        if (!/^[A-Za-z0-9_.$@/:"'<>()[\]|&?, -]+$/u.test(property[2])) {
+            return false;
+        }
+    }
+    return depth === 0;
+}
+function isExactGeneratedRootSstEnvironmentSourceBytes(bytes) {
+    const source = bytes.toString('utf8');
+    if (!Buffer.from(source, 'utf8').equals(bytes))
+        return false;
+    const normalized = source.split('\r\n').join('\n');
+    if (normalized.includes('\r'))
+        return false;
+    const lines = normalized.endsWith('\n')
+        ? normalized.slice(0, -1).split('\n')
+        : normalized.split('\n');
+    const prefix = [
+        ...GENERATED_HEADER,
+        'declare module "sst" {',
+        '  export interface Resource {',
+    ];
+    const suffix = ['  }', '}', '', 'import "sst"', 'export {}'];
+    if (lines.length < prefix.length + suffix.length ||
+        prefix.some((line, index) => lines[index] !== line) ||
+        suffix.some((line, index) => lines[lines.length - suffix.length + index] !== line)) {
+        return false;
+    }
+    return exactGeneratedResourceMembers(lines.slice(prefix.length, lines.length - suffix.length));
+}
+function exactGeneratedPythonType(value) {
+    if (!/^[A-Za-z0-9_,.[\]| ]+$/u.test(value))
+        return false;
+    const identifiers = value.match(/[A-Za-z_][A-Za-z0-9_]*/gu) ?? [];
+    if (identifiers.some((identifier) => ![
+        'Any',
+        'None',
+        'bool',
+        'dict',
+        'float',
+        'int',
+        'list',
+        'set',
+        'str',
+        'tuple',
+    ].includes(identifier))) {
+        return false;
+    }
+    let depth = 0;
+    for (const character of value) {
+        if (character === '[')
+            depth += 1;
+        if (character === ']')
+            depth -= 1;
+        if (depth < 0)
+            return false;
+    }
+    return depth === 0;
+}
+function isExactGeneratedRootSstPythonSourceBytes(bytes) {
+    const source = bytes.toString('utf8');
+    if (!Buffer.from(source, 'utf8').equals(bytes))
+        return false;
+    const normalized = source.split('\r\n').join('\n');
+    if (normalized.includes('\r'))
+        return false;
+    const lines = normalized.endsWith('\n')
+        ? normalized.slice(0, -1).split('\n')
+        : normalized.split('\n');
+    if (lines.at(-1) === '')
+        lines.pop();
+    if (lines.at(-1) === '')
+        return false;
+    const prefix = [
+        '# Automatically generated by SST',
+        '# pylint: disable=all',
+        '# ruff: noqa',
+        'from typing import Any',
+        '',
+        'class Resource:',
+    ];
+    if (lines.length <= prefix.length ||
+        prefix.some((line, index) => lines[index] !== line)) {
+        return false;
+    }
+    let observedClass = false;
+    let observedMember = false;
+    for (const line of lines.slice(prefix.length)) {
+        const classDeclaration = line.match(/^ {4}class ([A-Za-z_][A-Za-z0-9_]*):$/u);
+        if (classDeclaration) {
+            if (observedClass && !observedMember)
+                return false;
+            observedClass = true;
+            observedMember = false;
+            continue;
+        }
+        const member = line.match(/^ {8}([A-Za-z_][A-Za-z0-9_]*): (.+)$/u);
+        if (!observedClass ||
+            !member?.[2] ||
+            !exactGeneratedPythonType(member[2])) {
+            return false;
+        }
+        observedMember = true;
+    }
+    return observedClass && observedMember;
+}
+function exactGeneratedNestedSstEnvironmentSourceBytes(nestedPath, rootSourcePath) {
+    const reference = (0, node_path_1.relative)((0, node_path_1.dirname)(nestedPath), rootSourcePath)
+        .split('\\')
+        .join('/');
+    if (!reference.startsWith('../') || reference.endsWith('/'))
+        return [];
+    const lines = [
+        ...GENERATED_HEADER,
+        `/// <reference path="${reference}" />`,
+        '',
+        'import "sst"',
+        'export {}',
+    ];
+    const lf = lines.join('\n');
+    const crlf = lines.join('\r\n');
+    return [
+        Buffer.from(lf, 'utf8'),
+        Buffer.from(`${lf}\n`, 'utf8'),
+        Buffer.from(crlf, 'utf8'),
+        Buffer.from(`${crlf}\r\n`, 'utf8'),
+    ];
+}
+//# sourceMappingURL=sst-environment-source-format.js.map

package/src/sst-environment-source-format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sst-environment-source-format.js","sourceRoot":"","sources":["../../../../packages/nx/src/sst-environment-source-format.ts"],"names":[],"mappings":";;AAuDA,sGA4BC;AAiCD,4FAiDC;AAED,sGAwBC;AA/LD,yCAA8C;AAE9C,MAAM,gBAAgB,GAAG;IACvB,wDAAwD;IACxD,sBAAsB;IACtB,sBAAsB;IACtB,4BAA4B;IAC5B,6CAA6C;IAC7C,EAAE;CACH,CAAC;AAEF,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAwB;IAC7D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACxB,IAAI,KAAK,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrE,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,WAAW,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI;aAClB,KAAK,CAAC,WAAW,CAAC;aAClB,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACzC,IACE,CAAC,QAAQ;YACT,CAAC,QAAQ,CAAC,CAAC,CAAC;YACZ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACZ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,KAAK,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,6CAA6C,CAC3D,KAAa;IAEb,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG;QACb,GAAG,gBAAgB;QACnB,wBAAwB;QACxB,+BAA+B;KAChC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAC7D,IACE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;QACnD,MAAM,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,CACtE,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,6BAA6B,CAClC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;IAClE,IACE,WAAW,CAAC,IAAI,CACd,CAAC,UAAU,EAAE,EAAE,CACb,CAAC;QACC,KAAK;QACL,MAAM;QACN,MAAM;QACN,MAAM;QACN,OAAO;QACP,KAAK;QACL,MAAM;QACN,KAAK;QACL,KAAK;QACL,OAAO;KACR,CAAC,QAAQ,CAAC,UAAU,CAAC,CACzB,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,SAAS,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;QAClC,IAAI,SAAS,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,KAAK,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,wCAAwC,CACtD,KAAa;IAEb,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG;QACb,kCAAkC;QAClC,uBAAuB;QACvB,cAAc;QACd,wBAAwB;QACxB,EAAE;QACF,iBAAiB;KAClB,CAAC;IACF,IACE,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CACjC,wCAAwC,CACzC,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,aAAa,IAAI,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YACnD,aAAa,GAAG,IAAI,CAAC;YACrB,cAAc,GAAG,KAAK,CAAC;YACvB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACnE,IACE,CAAC,aAAa;YACd,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACZ,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EACpC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,aAAa,IAAI,cAAc,CAAC;AACzC,CAAC;AAED,SAAgB,6CAA6C,CAC3D,UAAkB,EAClB,cAAsB;IAEtB,MAAM,SAAS,GAAG,IAAA,oBAAQ,EAAC,IAAA,mBAAO,EAAC,UAAU,CAAC,EAAE,cAAc,CAAC;SAC5D,KAAK,CAAC,IAAI,CAAC;SACX,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvE,MAAM,KAAK,GAAG;QACZ,GAAG,gBAAgB;QACnB,wBAAwB,SAAS,MAAM;QACvC,EAAE;QACF,cAAc;QACd,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO;QACL,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,MAAM,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/src/supply-chain/blueprint-trust-git.js

@@ -369,6 +369,24 @@ function historyStates(context, history, policyPath, snapshotPath) {
     }
     return states;
 }
+function optionalBlueprintTrustAuthorityBaseline(context, tip, policyPath = exports.BLUEPRINT_TRUST_POLICY_PATH, snapshotPath = exports.BLUEPRINT_TRUST_SNAPSHOT_PATH) {
+    const stateCommits = commits(context, [tip, '--', policyPath, snapshotPath]);
+    if (stateCommits.length === 0 &&
+        stateAtCommit(context, tip, policyPath, snapshotPath) === undefined) {
+        return undefined;
+    }
+    if (stateCommits.at(-1) !== tip)
+        stateCommits.push(tip);
+    const states = historyStates(context, stateCommits, policyPath, snapshotPath);
+    return states[0]?.commit;
+}
+function blueprintTrustAuthorityBaseline(context, tip, policyPath = exports.BLUEPRINT_TRUST_POLICY_PATH, snapshotPath = exports.BLUEPRINT_TRUST_SNAPSHOT_PATH) {
+    const baseline = optionalBlueprintTrustAuthorityBaseline(context, tip, policyPath, snapshotPath);
+    if (!baseline) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'cannot establish the first protected Blueprint trust authority commit');
+    }
+    return baseline;
+}
 function blueprintIdentity(value, path) {
     if (!(0, validation_js_1.isRecord)(value) ||
         !(0, validation_js_1.isRecord)(value.blueprint) ||
@@ -519,7 +537,11 @@ function changedOwnershipAtCommit(context, commit) {
     if (paths.length > MAX_OWNERSHIP_RECORDS) {
         throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, `changes more than ${MAX_OWNERSHIP_RECORDS} Slice ownership records`);
     }
-    return changedOwnershipValuesAtCommit(context, commit, paths).flatMap(({ path, value }) => historicalOwnershipRecord(commit, path, value));
+    const parent = git(context, ['rev-parse', '--verify', `${commit}^1^{commit}`], { allowFailure: true });
+    if (!parent || !FULL_GIT_OBJECT_ID.test(parent)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'cannot resolve the exact first parent of an ownership change after the trust authority floor');
+    }
+    return [parent, commit].flatMap((revision) => changedOwnershipValuesAtCommit(context, revision, paths).flatMap(({ path, value }) => historicalOwnershipRecord(revision, path, value)));
 }
 function protectedWorkspaceHasExternalBlueprintOwnership(input) {
     if (!FULL_GIT_OBJECT_ID.test(input.commit)) {
@@ -605,20 +627,31 @@ function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
     const tips = [
         ...new Set(before.filter((commit) => commit !== undefined)),
     ];
+    const baselines = new Set();
     const history = new Set();
+    const inspectedCommits = new Set();
     for (const tip of tips) {
+        const baseline = shallowBefore === 'false'
+            ? optionalBlueprintTrustAuthorityBaseline(context, tip)
+            : undefined;
+        if (baseline) {
+            baselines.add(baseline);
+            inspectedCommits.add(baseline);
+        }
         const tipHistory = commits(context, [
             `--max-count=${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS + 1}`,
-            tip,
+            baseline ? `${baseline}..${tip}` : tip,
             '--',
             OWNERSHIP_PATHSPEC,
         ]);
-        if (tipHistory.length > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
+        if (tipHistory.length + (baseline ? 1 : 0) >
+            MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
             throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS} changing commits`);
         }
         for (const commit of tipHistory) {
             history.add(commit);
-            if (history.size > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
+            inspectedCommits.add(commit);
+            if (inspectedCommits.size > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
                 throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS} distinct changing commits`);
             }
         }
@@ -627,8 +660,7 @@ function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
     const externalSliceRoots = new Set();
     let externalRecordFound = false;
     let historicalRecordCount = 0;
-    for (const commit of history) {
-        const inventory = changedOwnershipAtCommit(context, commit);
+    const inspectInventory = (inventory) => {
         historicalRecordCount += inventory.length;
         if (historicalRecordCount > MAX_PREGRAPH_OWNERSHIP_HISTORY_RECORDS) {
             throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_RECORDS} aggregate Slice records`);
@@ -643,6 +675,14 @@ function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
             }
             externalSliceRoots.add(`packages/${record.slice}`);
         }
+    };
+    for (const baseline of baselines) {
+        inspectInventory(ownershipInventoryAtCommit(context, baseline));
+    }
+    for (const commit of history) {
+        if (baselines.has(commit))
+            continue;
+        inspectInventory(changedOwnershipAtCommit(context, commit));
     }
     const after = resolveCommits();
     const shallowAfter = git(context, ['rev-parse', '--is-shallow-repository']);
@@ -698,13 +738,11 @@ function changedOwnershipPaths(context, parent, commit) {
     }
     return paths;
 }
-function historicalOwnershipAudit(context, builtInName, tip) {
-    const roots = commits(context, ['--max-parents=0', tip]);
-    if (roots.length !== 1) {
-        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'must have one exact first-parent repository root');
+function historicalOwnershipAudit(context, builtInName, tip, baseline) {
+    if (!commits(context, [tip]).includes(baseline)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'Blueprint trust authority baseline must remain on the exact first-parent lineage');
     }
-    const rootCommit = roots[0];
-    const root = ownershipInventoryAtCommit(context, rootCommit);
+    const root = ownershipInventoryAtCommit(context, baseline);
     const external = new Map();
     const rememberExternal = (record) => {
         if (record.name !== builtInName) {
@@ -712,9 +750,11 @@ function historicalOwnershipAudit(context, builtInName, tip) {
         }
     };
     root.forEach(rememberExternal);
-    for (const commit of commits(context, [tip, '--', OWNERSHIP_PATHSPEC])) {
-        if (commit === rootCommit)
-            continue;
+    for (const commit of commits(context, [
+        `${baseline}..${tip}`,
+        '--',
+        OWNERSHIP_PATHSPEC,
+    ])) {
         const parent = git(context, ['rev-parse', '--verify', `${commit}^1^{commit}`], { allowFailure: true });
         if (!parent || !FULL_GIT_OBJECT_ID.test(parent)) {
             throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'cannot resolve the exact first parent of an ownership change');
@@ -764,7 +804,7 @@ function assertNoPathIndependentRelabel(builtInName, current, before, after) {
         return;
     throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${current.path}#blueprint`, `cannot establish built-in provenance while historical external Blueprint ${relatedExternal.name}@${relatedExternal.version} ownership at ${relatedExternal.path} was removed, moved, or reused`);
 }
-function builtInProvenance(context, input, headCommit, protectedCommit) {
+function builtInProvenance(context, input, headCommit, headBaseline, protectedCommit, protectedBaseline) {
     const provenance = [];
     const currentOwnership = currentOwnershipInventory(input);
     const builtInOwnership = currentOwnership.filter(({ name }) => name === input.builtIn.name);
@@ -772,19 +812,25 @@ function builtInProvenance(context, input, headCommit, protectedCommit) {
         return provenance;
     const protectedOwnership = ownershipInventoryAtCommit(context, protectedCommit);
     const headOwnership = ownershipInventoryAtCommit(context, headCommit);
-    const protectedAudit = historicalOwnershipAudit(context, input.builtIn.name, protectedCommit);
+    const protectedAudit = historicalOwnershipAudit(context, input.builtIn.name, protectedCommit, protectedBaseline);
     const audits = headCommit === protectedCommit
         ? [protectedAudit]
         : [
             protectedAudit,
-            historicalOwnershipAudit(context, input.builtIn.name, headCommit),
+            historicalOwnershipAudit(context, input.builtIn.name, headCommit, headBaseline),
         ];
     for (const currentRecord of builtInOwnership) {
         const current = currentRecord;
         const path = current.path;
         const pathCommits = new Set([
-            ...commits(context, [headCommit, '--', path]),
-            ...commits(context, [protectedCommit, '--', path]),
+            headBaseline,
+            ...commits(context, [`${headBaseline}..${headCommit}`, '--', path]),
+            protectedBaseline,
+            ...commits(context, [
+                `${protectedBaseline}..${protectedCommit}`,
+                '--',
+                path,
+            ]),
         ]);
         for (const commit of pathCommits) {
             const historical = readJsonBlob(context, commit, path);
@@ -1084,6 +1130,10 @@ function inspectBlueprintTrustGitAuthority(input) {
     }
     const protectedStates = historyStates(context, protectedCommits, policyPath, snapshotPath);
     const protectedHistory = (0, blueprint_trust_js_1.validateBlueprintTrustHistory)(protectedStates);
+    const protectedBaseline = protectedStates[0]?.commit;
+    if (!protectedBaseline) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${authorityCommit}:ownership`, 'cannot establish the first protected Blueprint trust authority commit');
+    }
     const authorization = (0, blueprint_trust_js_1.createBlueprintTrustState)(protectedStates.at(-1));
     const mergeBase = git(context, ['merge-base', authorityCommit, headCommit]);
     if (!mergeBase || !FULL_GIT_OBJECT_ID.test(mergeBase)) {
@@ -1102,6 +1152,7 @@ function inspectBlueprintTrustGitAuthority(input) {
         candidateCommits.push(headCommit);
     const candidateStates = historyStates(context, candidateCommits, policyPath, snapshotPath);
     const candidateHistory = (0, blueprint_trust_js_1.validateBlueprintTrustHistory)(candidateStates);
+    const headBaseline = blueprintTrustAuthorityBaseline(context, headCommit, policyPath, snapshotPath);
     const head = (0, blueprint_trust_js_1.createBlueprintTrustState)(candidateStates.at(-1));
     if ((0, blueprint_trust_js_1.blueprintTrustStateDigest)(authorization) !== (0, blueprint_trust_js_1.blueprintTrustStateDigest)(head)) {
         (0, blueprint_trust_js_1.planBlueprintTrustStateTransition)(authorization, head);
@@ -1112,7 +1163,7 @@ function inspectBlueprintTrustGitAuthority(input) {
         : (0, blueprint_trust_js_1.planBlueprintTrustStateTransition)(head, current).receipt;
     return {
         authorization,
-        builtInProvenance: builtInProvenance(context, input, headCommit, authorityCommit),
+        builtInProvenance: builtInProvenance(context, input, headCommit, headBaseline, authorityCommit, protectedBaseline),
         candidateHistory,
         headCommit,
         protectedCommit: authorityCommit,