@empire-builder-kit/nx 1.0.0-rc.2 → 1.0.0-rc.7

package/src/supply-chain/generated-command.js

@@ -6,6 +6,8 @@ function renderSupplyChainCheckCommand() {
   createSupplyChainInventory,
   createInstalledLicenseFindings,
   createSupplyChainScannerInput,
+  assertWorkspaceImporterCoverage,
+  deriveWorkspaceManifestPathsFromPnpmLock,
   discoverLifecycleScripts,
   evaluateSupplyChainPolicy,
   frameworkActionPinInventory,
@@ -15,6 +17,7 @@ function renderSupplyChainCheckCommand() {
   assertSupplyChainScannerSubject,
   requireActiveVendoredSourceRegistry,
   validateReviewedBuildPermissions,
+  workspacePackageGlobs,
   vendoredSourceRegistryDigest,
   verifyActionPinInventory,
 } from '@empire-builder-kit/nx/supply-chain';
@@ -164,48 +167,51 @@ function hasExactKeys(value, keys) {
   );
 }
 
-function workspaceManifests() {
-  const listed = spawnSync(
-    'pnpm',
-    ['list', '--recursive', '--depth=-1', '--json'],
-    {
-      cwd: workspaceRoot,
-      encoding: 'utf8',
-      maxBuffer: MAX_INPUT_BYTES,
-      shell: false,
-    },
-  );
-  if (listed.status !== 0) {
-    throw new Error(
-      'pnpm workspace inventory failed: ' +
-        String(listed.stderr || listed.stdout).trim().slice(0, 2_000),
-    );
-  }
-  let projects;
-  try {
-    const parsed = JSON.parse(listed.stdout);
-    projects = Array.isArray(parsed) ? parsed : [parsed];
-  } catch {
-    throw new Error('pnpm workspace inventory did not return JSON.');
-  }
-  if (projects.length === 0 || projects.length > 2_000) {
-    throw new Error('pnpm workspace inventory is empty or exceeds 2,000 projects.');
-  }
-  const manifests = {};
-  for (const [index, project] of projects.entries()) {
-    if (!project || typeof project !== 'object' || typeof project.path !== 'string') {
-      throw new Error('pnpm workspace project ' + index + ' has no exact path.');
+function discoverGlobbedManifestPaths(globs) {
+  // Walk only the directory depth each glob declares so a manifest present on
+  // disk but absent from the lockfile importers is still observed.
+  const discovered = new Set();
+  const walk = (segments, index, prefix) => {
+    if (index === segments.length) {
+      const manifest = prefix ? prefix + '/package.json' : 'package.json';
+      if (existsSync(insideWorkspace(manifest))) discovered.add(manifest);
+      return;
+    }
+    const segment = segments[index];
+    const directory = prefix ? insideWorkspace(prefix) : workspaceRoot;
+    if (!existsSync(directory) || !statSync(directory).isDirectory()) return;
+    if (segment === '*' || segment === '**') {
+      for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith('.')) continue;
+        if (entry.name === 'node_modules') continue;
+        const next = prefix ? prefix + '/' + entry.name : entry.name;
+        walk(segments, index + 1, next);
+        if (segment === '**') walk(segments, index, next);
+      }
+      return;
     }
-    const root = realpathSync(insideWorkspace(project.path));
-    const child = relative(workspaceRoot, root);
-    if (child === '..' || child.startsWith('..' + sep)) {
-      throw new Error('pnpm workspace project escapes the repository.');
+    if (segment.includes('*')) {
+      throw new Error(
+        'Workspace package glob segment ' + segment + ' is not supported by the manifest drift sweep.',
+      );
     }
-    const path = (child ? child.split(sep).join('/') + '/' : '') + 'package.json';
-    manifests[path] = readJson(path);
+    walk(segments, index + 1, prefix ? prefix + '/' + segment : segment);
+  };
+  for (const glob of globs) {
+    walk(glob.split('/').filter((segment) => segment !== '' && segment !== '.'), 0, '');
   }
-  if (!Object.hasOwn(manifests, 'package.json')) {
-    manifests['package.json'] = readJson('package.json');
+  return [...discovered];
+}
+
+function workspaceManifests(lockfile, workspacePolicy) {
+  const importerPaths = deriveWorkspaceManifestPathsFromPnpmLock(lockfile);
+  assertWorkspaceImporterCoverage(
+    discoverGlobbedManifestPaths(workspacePackageGlobs(workspacePolicy)),
+    importerPaths,
+  );
+  const manifests = {};
+  for (const path of importerPaths) {
+    manifests[path] = readJson(path);
   }
   return manifests;
 }
@@ -392,6 +398,11 @@ const workspacePolicy = readBounded(
   MAX_INPUT_BYTES,
   'pnpm workspace policy',
 );
+const lockfile = readBounded(
+  'pnpm-lock.yaml',
+  MAX_LOCK_BYTES,
+  'pnpm lockfile',
+);
 const packageMetadata = installedPackageMetadata();
 const lifecycleScripts = discoverLifecycleScripts(packageMetadata);
 const buildPermissions = records(
@@ -434,8 +445,8 @@ const inventory = createSupplyChainInventory({
     'supply-chain/downloaded-tools.json',
   ),
   lifecycleScripts,
-  lockfile: readBounded('pnpm-lock.yaml', MAX_LOCK_BYTES, 'pnpm lockfile'),
-  manifests: workspaceManifests(),
+  lockfile,
+  manifests: workspaceManifests(lockfile, workspacePolicy),
   nodeVersion: readBounded(
     '.node-version',
     64,
@@ -464,7 +475,7 @@ const containerInventoryDigest = digest({
 if (options.protected) {
   const normalizedScanner = createSupplyChainScannerInput(scannerInput);
   const requiredCoverage = [
-    ...(inventory.resolvedPackages.length > 0 ? ['npm'] : []),
+    'npm',
     ...(inventory.containers.length > 0 || workflowContainers.length > 0
       ? ['container']
       : []),
@@ -486,6 +497,78 @@ if (options.protected) {
     resultDigests.push(reference);
     const result = JSON.parse(bytes);
     if (reference.coverage === 'npm') {
+      const packageManager =
+        /^pnpm@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\+sha512\.[a-f0-9]{128}$/.exec(
+          inventory.packageManager,
+        );
+      if (!packageManager?.[1]) {
+        throw new Error(
+          'Supply-chain inventory package manager is not one exact pnpm authority.',
+        );
+      }
+      const expectedPackageManagerInput = {
+        results: [
+          {
+            packages: [
+              {
+                package: {
+                  ecosystem: 'npm',
+                  name: 'pnpm',
+                  version: packageManager[1],
+                },
+              },
+            ],
+          },
+        ],
+      };
+      const expectedPackageManagerInputBytes =
+        JSON.stringify(expectedPackageManagerInput, null, 2) + '\n';
+      if (
+        !hasExactKeys(result, [
+          'kind',
+          'lockfile',
+          'packageManager',
+          'schemaVersion',
+        ]) ||
+        result.kind !== 'ebk-osv-npm-results' ||
+        result.schemaVersion !== 1 ||
+        !hasExactKeys(result.packageManager, [
+          'authority',
+          'input',
+          'inputSha256',
+          'result',
+        ]) ||
+        result.packageManager.authority !== inventory.packageManager ||
+        JSON.stringify(canonical(result.packageManager.input)) !==
+          JSON.stringify(canonical(expectedPackageManagerInput)) ||
+        result.packageManager.inputSha256 !==
+          digest(expectedPackageManagerInputBytes)
+      ) {
+        throw new Error(
+          'npm scanner result does not bind the exact package-manager authority and custom input.',
+        );
+      }
+      const packageManagerResults = result.packageManager.result;
+      const scannedPackageManagers =
+        packageManagerResults && Array.isArray(packageManagerResults.results)
+          ? packageManagerResults.results.flatMap((entry) =>
+              entry && Array.isArray(entry.packages)
+                ? entry.packages
+                    .map((scanned) => scanned?.package)
+                    .filter(Boolean)
+                : [],
+            )
+          : [];
+      if (
+        scannedPackageManagers.length !== 1 ||
+        scannedPackageManagers[0].ecosystem !== 'npm' ||
+        scannedPackageManagers[0].name !== 'pnpm' ||
+        scannedPackageManagers[0].version !== packageManager[1]
+      ) {
+        throw new Error(
+          'npm scanner result does not prove the exact package-manager scan.',
+        );
+      }
       normalizedVulnerabilities.push(
         ...normalizeOsvScannerResults({
           coverage: 'npm',
@@ -494,7 +577,11 @@ if (options.protected) {
           resultGroups: [
             {
               context: { releases: [], scope: 'unknown', slices: [] },
-              document: result,
+              document: result.lockfile,
+            },
+            {
+              context: { releases: [], scope: 'unknown', slices: [] },
+              document: packageManagerResults,
             },
           ],
         }),

package/src/supply-chain/generated-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"generated-command.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/generated-command.ts"],"names":[],"mappings":";;AAAA,sEA0qBC;AA1qBD,SAAgB,6BAA6B;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwqBlB,CAAC;AACF,CAAC"}
+{"version":3,"file":"generated-command.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/generated-command.ts"],"names":[],"mappings":";;AAAA,sEAiwBC;AAjwBD,SAAgB,6BAA6B;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+vBlB,CAAC;AACF,CAAC"}

package/src/supply-chain/generated-scanner-command.js

@@ -9,12 +9,15 @@ function renderSupplyChainScannerCommand() {
   createInstalledLicenseFindings,
   createSupplyChainInventory,
   createSupplyChainScannerInput,
+  assertWorkspaceImporterCoverage,
+  deriveWorkspaceManifestPathsFromPnpmLock,
   discoverLifecycleScripts,
   frameworkActionPinInventory,
   normalizeOsvScannerResults,
   requireActiveVendoredSourceRegistry,
   vendoredSourceRegistryDigest,
   verifyActionPinInventory,
+  workspacePackageGlobs,
 } from '@empire-builder-kit/nx/supply-chain';
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
@@ -170,52 +173,51 @@ function atomicWrite(path, contents, mode = 0o600) {
   renameSync(temporary, target);
 }
 
-function workspaceManifests() {
-  const arguments_ = ['list', '--recursive', '--depth=-1', '--json'];
-  const listed =
-    process.platform === 'win32'
-      ? spawnSync(
-          process.env.ComSpec ?? 'cmd.exe',
-          ['/d', '/s', '/c', ['pnpm.cmd', ...arguments_].join(' ')],
-          {
-            cwd: workspaceRoot,
-            encoding: 'utf8',
-            maxBuffer: MAX_INPUT_BYTES,
-            shell: false,
-          },
-        )
-      : spawnSync('pnpm', arguments_, {
-          cwd: workspaceRoot,
-          encoding: 'utf8',
-          maxBuffer: MAX_INPUT_BYTES,
-          shell: false,
-        });
-  if (listed.status !== 0) {
-    throw new Error(
-      'pnpm workspace inventory failed: ' +
-        String(listed.stderr || listed.stdout).trim().slice(0, 2_000),
-    );
-  }
-  const parsed = JSON.parse(listed.stdout);
-  const projects = Array.isArray(parsed) ? parsed : [parsed];
-  if (projects.length === 0 || projects.length > 2_000) {
-    throw new Error('pnpm workspace inventory is empty or exceeds 2,000 projects.');
-  }
-  const manifests = {};
-  for (const project of projects) {
-    if (!project || typeof project.path !== 'string') {
-      throw new Error('pnpm workspace project has no exact path.');
+function discoverGlobbedManifestPaths(globs) {
+  // Walk only the directory depth each glob declares so a manifest present on
+  // disk but absent from the lockfile importers is still observed.
+  const discovered = new Set();
+  const walk = (segments, index, prefix) => {
+    if (index === segments.length) {
+      const manifest = prefix ? prefix + '/package.json' : 'package.json';
+      if (existsSync(insideWorkspace(manifest))) discovered.add(manifest);
+      return;
     }
-    const root = realpathSync(insideWorkspace(project.path));
-    const child = relative(workspaceRoot, root);
-    if (child === '..' || child.startsWith('..' + sep)) {
-      throw new Error('pnpm workspace project escapes the repository.');
+    const segment = segments[index];
+    const directory = prefix ? insideWorkspace(prefix) : workspaceRoot;
+    if (!existsSync(directory) || !statSync(directory).isDirectory()) return;
+    if (segment === '*' || segment === '**') {
+      for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith('.')) continue;
+        if (entry.name === 'node_modules') continue;
+        const next = prefix ? prefix + '/' + entry.name : entry.name;
+        walk(segments, index + 1, next);
+        if (segment === '**') walk(segments, index, next);
+      }
+      return;
     }
-    const path = (child ? child.split(sep).join('/') + '/' : '') + 'package.json';
-    manifests[path] = readJson(path);
+    if (segment.includes('*')) {
+      throw new Error(
+        'Workspace package glob segment ' + segment + ' is not supported by the manifest drift sweep.',
+      );
+    }
+    walk(segments, index + 1, prefix ? prefix + '/' + segment : segment);
+  };
+  for (const glob of globs) {
+    walk(glob.split('/').filter((segment) => segment !== '' && segment !== '.'), 0, '');
   }
-  if (!Object.hasOwn(manifests, 'package.json')) {
-    manifests['package.json'] = readJson('package.json');
+  return [...discovered];
+}
+
+function workspaceManifests(lockfile, workspacePolicy) {
+  const importerPaths = deriveWorkspaceManifestPathsFromPnpmLock(lockfile);
+  assertWorkspaceImporterCoverage(
+    discoverGlobbedManifestPaths(workspacePackageGlobs(workspacePolicy)),
+    importerPaths,
+  );
+  const manifests = {};
+  for (const path of importerPaths) {
+    manifests[path] = readJson(path);
   }
   return manifests;
 }
@@ -528,6 +530,16 @@ const containers = sourceFilesBelow(
   '.',
   (path) => /(?:^|\/)Dockerfile$/i.test(path) || /\.Dockerfile$/i.test(path),
 );
+const lockfile = readBounded(
+  'pnpm-lock.yaml',
+  MAX_LOCK_BYTES,
+  'pnpm lockfile',
+);
+const workspacePolicy = readBounded(
+  'pnpm-workspace.yaml',
+  MAX_INPUT_BYTES,
+  'pnpm workspace policy',
+);
 const inventory = createSupplyChainInventory({
   containers,
   downloadedTools: records(
@@ -535,8 +547,8 @@ const inventory = createSupplyChainInventory({
     'supply-chain/downloaded-tools.json',
   ),
   lifecycleScripts: discoverLifecycleScripts(metadata),
-  lockfile: readBounded('pnpm-lock.yaml', MAX_LOCK_BYTES, 'pnpm lockfile'),
-  manifests: workspaceManifests(),
+  lockfile,
+  manifests: workspaceManifests(lockfile, workspacePolicy),
   nodeVersion: readBounded(
     '.node-version',
     64,
@@ -552,18 +564,14 @@ const inventory = createSupplyChainInventory({
     revision: record.identity.revision,
     sha256: record.retrieval.sha256,
   })),
-  workspacePolicy: readBounded(
-    'pnpm-workspace.yaml',
-    MAX_INPUT_BYTES,
-    'pnpm workspace policy',
-  ),
+  workspacePolicy,
 });
 const containerInventoryDigest = digest({
   recipes: inventory.containers,
   workflowExecutables: workflowContainers,
 });
 const requiredCoverage = [
-  ...(inventory.resolvedPackages.length > 0 ? ['npm'] : []),
+  'npm',
   ...(inventory.containers.length > 0 || workflowContainers.length > 0
     ? ['container']
     : []),
@@ -577,14 +585,61 @@ const resultDigests = [];
 const vulnerabilities = [];
 
 if (requiredCoverage.includes('npm')) {
-  const npmResult = runOsv(osv.path, [
+  const lockfileResult = runOsv(osv.path, [
     'scan',
     'source',
     '--format=json',
     '--lockfile=pnpm-lock.yaml',
   ]);
+  const packageManager =
+    /^pnpm@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\+sha512\.[a-f0-9]{128}$/.exec(
+      inventory.packageManager,
+    );
+  if (!packageManager?.[1]) {
+    throw new Error(
+      'Supply-chain inventory package manager is not one exact pnpm authority.',
+    );
+  }
+  const packageManagerInputPath =
+    '.ebk/evidence/supply-chain/osv-package-manager-input.json';
+  const packageManagerInput = {
+    results: [
+      {
+        packages: [
+          {
+            package: {
+              ecosystem: 'npm',
+              name: 'pnpm',
+              version: packageManager[1],
+            },
+          },
+        ],
+      },
+    ],
+  };
+  const packageManagerInputBytes =
+    JSON.stringify(packageManagerInput, null, 2) + '\n';
+  atomicWrite(packageManagerInputPath, packageManagerInputBytes);
+  const packageManagerResult = runOsv(osv.path, [
+    'scan',
+    'source',
+    '--format=json',
+    '--all-packages',
+    '--lockfile=osv-scanner:' + packageManagerInputPath,
+  ]);
   const path = '.ebk/evidence/supply-chain/osv-npm.json';
-  const bytes = JSON.stringify(npmResult, null, 2) + '\n';
+  const report = {
+    kind: 'ebk-osv-npm-results',
+    lockfile: lockfileResult,
+    packageManager: {
+      authority: inventory.packageManager,
+      input: packageManagerInput,
+      inputSha256: digest(packageManagerInputBytes),
+      result: packageManagerResult,
+    },
+    schemaVersion: 1,
+  };
+  const bytes = JSON.stringify(report, null, 2) + '\n';
   atomicWrite(path, bytes);
   resultDigests.push({ coverage: 'npm', path, sha256: digest(bytes) });
   vulnerabilities.push(
@@ -595,7 +650,11 @@ if (requiredCoverage.includes('npm')) {
       resultGroups: [
         {
           context: { releases: [], scope: 'unknown', slices: [] },
-          document: npmResult,
+          document: lockfileResult,
+        },
+        {
+          context: { releases: [], scope: 'unknown', slices: [] },
+          document: packageManagerResult,
         },
       ],
     }),

package/src/supply-chain/generated-scanner-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"generated-scanner-command.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/generated-scanner-command.ts"],"names":[],"mappings":";;AAAA,0EAysBC;AAzsBD,SAAgB,+BAA+B;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAusBlB,CAAC;AACF,CAAC"}
+{"version":3,"file":"generated-scanner-command.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/generated-scanner-command.ts"],"names":[],"mappings":";;AAAA,0EAowBC;AApwBD,SAAgB,+BAA+B;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkwBlB,CAAC;AACF,CAAC"}

package/src/supply-chain/inventory.d.ts

@@ -72,6 +72,23 @@ export interface SupplyChainInventoryInput {
     workspacePolicy: string;
 }
 export declare function discoverLifecycleScripts(packageMetadata: readonly unknown[]): readonly LifecycleScriptInventoryEntry[];
+/**
+ * Returns the declared workspace package globs so a caller can enumerate the
+ * manifests that must appear as lockfile importers.
+ */
+export declare function workspacePackageGlobs(workspacePolicy: string): readonly string[];
+/**
+ * Fails closed when a manifest the workspace globs select is absent from the
+ * lockfile importers. Deriving the manifest inventory from the importers
+ * alone cannot observe that drift: a manifest stripped from the lockfile
+ * simply disappears from the inventory instead of being reported.
+ */
+export declare function assertWorkspaceImporterCoverage(discoveredManifestPaths: readonly string[], importerManifestPaths: readonly string[]): void;
+/**
+ * Derives the exact manifest inventory from a complete pnpm lockfile rather
+ * than executing a package manager selected from ambient PATH.
+ */
+export declare function deriveWorkspaceManifestPathsFromPnpmLock(lockfileSource: string): readonly string[];
 export declare function validateReviewedBuildPermissions(workspacePolicy: string, permissions: readonly ReviewedBuildPermission[]): void;
 export declare function validateLifecycleScriptInventory(lifecycleScripts: readonly LifecycleScriptInventoryEntry[], workspacePolicy: string): void;
 export declare function scanContainerImageAuthorities(path: string, source: string): readonly ContainerImageAuthority[];

package/src/supply-chain/inventory.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SUPPLY_CHAIN_SUPPORTED_PLATFORMS = exports.SUPPLY_CHAIN_INVENTORY_SCHEMA_VERSION = void 0;
 exports.discoverLifecycleScripts = discoverLifecycleScripts;
+exports.workspacePackageGlobs = workspacePackageGlobs;
+exports.assertWorkspaceImporterCoverage = assertWorkspaceImporterCoverage;
+exports.deriveWorkspaceManifestPathsFromPnpmLock = deriveWorkspaceManifestPathsFromPnpmLock;
 exports.validateReviewedBuildPermissions = validateReviewedBuildPermissions;
 exports.validateLifecycleScriptInventory = validateLifecycleScriptInventory;
 exports.scanContainerImageAuthorities = scanContainerImageAuthorities;
@@ -119,6 +122,109 @@ function parseLockfile(lockfile) {
     }
     return value;
 }
+const MAX_WORKSPACE_IMPORTERS = 2_000;
+const MAX_WORKSPACE_IMPORTER_LENGTH = 1_024;
+const MAX_WORKSPACE_IMPORTER_SEGMENT_LENGTH = 255;
+const WINDOWS_RESERVED_WORKSPACE_SEGMENT = /^(?:aux|con|nul|prn|com[1-9]|lpt[1-9])(?:\..*)?$/iu;
+function hasControlCharacter(value) {
+    return [...value].some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint <= 0x1f || codePoint === 0x7f;
+    });
+}
+function workspaceManifestPath(importer) {
+    if (importer === '.')
+        return 'package.json';
+    const segments = importer.split('/');
+    if (importer.length === 0 ||
+        Buffer.byteLength(importer, 'utf8') > MAX_WORKSPACE_IMPORTER_LENGTH ||
+        importer.startsWith('/') ||
+        importer.endsWith('/') ||
+        importer.includes('\\') ||
+        /^[A-Za-z]:/u.test(importer) ||
+        hasControlCharacter(importer) ||
+        segments.some((segment) => segment === '' ||
+            segment === '.' ||
+            segment === '..' ||
+            Buffer.byteLength(segment, 'utf8') >
+                MAX_WORKSPACE_IMPORTER_SEGMENT_LENGTH ||
+            /[<>:"|?*]/u.test(segment) ||
+            /[. ]$/u.test(segment) ||
+            WINDOWS_RESERVED_WORKSPACE_SEGMENT.test(segment))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `pnpm-lock.yaml#importers.${importer}`, 'workspace importer must be one bounded repository-relative POSIX path');
+    }
+    return `${importer}/package.json`;
+}
+/**
+ * Returns the declared workspace package globs so a caller can enumerate the
+ * manifests that must appear as lockfile importers.
+ */
+function workspacePackageGlobs(workspacePolicy) {
+    let parsed;
+    try {
+        parsed = (0, yaml_1.parse)(workspacePolicy);
+    }
+    catch (error) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-workspace.yaml', `cannot be parsed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const packages = (0, validation_js_1.isRecord)(parsed) ? parsed.packages : undefined;
+    if (!Array.isArray(packages) ||
+        packages.length === 0 ||
+        packages.length > MAX_WORKSPACE_IMPORTERS ||
+        packages.some((entry) => typeof entry !== 'string' ||
+            entry.trim() === '' ||
+            entry !== entry.trim() ||
+            entry.startsWith('/') ||
+            entry.split('/').includes('..'))) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-workspace.yaml#packages', 'must declare bounded relative workspace package globs');
+    }
+    return packages;
+}
+/**
+ * Fails closed when a manifest the workspace globs select is absent from the
+ * lockfile importers. Deriving the manifest inventory from the importers
+ * alone cannot observe that drift: a manifest stripped from the lockfile
+ * simply disappears from the inventory instead of being reported.
+ */
+function assertWorkspaceImporterCoverage(discoveredManifestPaths, importerManifestPaths) {
+    const importers = new Set(importerManifestPaths);
+    const missing = [...new Set(discoveredManifestPaths)]
+        .filter((path) => !importers.has(path))
+        .sort(deterministic_order_js_1.compareUtf16);
+    if (missing.length > 0) {
+        throw new errors_js_1.SupplyChainError('supply-chain-lock-drift', 'pnpm-lock.yaml#importers', `is missing the importer for ${missing.join(', ')}`);
+    }
+}
+/**
+ * Derives the exact manifest inventory from a complete pnpm lockfile rather
+ * than executing a package manager selected from ambient PATH.
+ */
+function deriveWorkspaceManifestPathsFromPnpmLock(lockfileSource) {
+    const lockfile = parseLockfile(lockfileSource);
+    const importers = lockfile.importers;
+    const entries = Object.entries(importers).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right));
+    if (entries.length === 0 || entries.length > MAX_WORKSPACE_IMPORTERS) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-lock.yaml#importers', `must contain from 1 through ${MAX_WORKSPACE_IMPORTERS} workspace importers`);
+    }
+    if (!Object.prototype.hasOwnProperty.call(importers, '.')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-inventory-incomplete', 'pnpm-lock.yaml#importers', 'must contain the root workspace importer');
+    }
+    const paths = entries.map(([importer, value]) => {
+        if (!(0, validation_js_1.isRecord)(value)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `pnpm-lock.yaml#importers.${importer}`, 'workspace importer must be an object');
+        }
+        return workspaceManifestPath(importer);
+    });
+    const portableIdentities = new Set();
+    for (const path of paths) {
+        const identity = path.normalize('NFC').toLowerCase();
+        if (portableIdentities.has(identity)) {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'pnpm-lock.yaml#importers', 'workspace importers must not alias on supported filesystems');
+        }
+        portableIdentities.add(identity);
+    }
+    return paths;
+}
 function collectDependencies(manifests, lockfile) {
     const importers = lockfile.importers;
     const entries = [];
@@ -637,8 +743,11 @@ function scanContainerRecipe(path, source) {
             throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', `${path}#corepack`, 'Corepack must install one exact pnpm artifact with a SHA-512 descriptor');
         }
     }
-    for (const fetch of source.matchAll(/^\s*RUN\s+.*\bpnpm\b.*\bfetch\b.*$/gim)) {
-        if (!(fetch[0] ?? '').includes('--frozen-lockfile')) {
+    const fetchCommands = [
+        ...source.matchAll(/^\s*RUN\s+.*\bpnpm\b.*\bfetch\b.*$/gim),
+    ].map(([command]) => command ?? '');
+    for (const command of fetchCommands) {
+        if (!command.includes('--frozen-lockfile')) {
             throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', path, 'pnpm fetch must retain the reviewed lockfile');
         }
     }
@@ -655,8 +764,10 @@ function scanContainerRecipe(path, source) {
             !command.includes('--prod') ||
             !command.includes('--offline') ||
             !command.includes('--frozen-lockfile') ||
+            !command.includes('--trust-lockfile') ||
+            !fetchCommands.some((fetch) => fetch.includes('--frozen-lockfile')) ||
             command.includes('--legacy')) {
-            throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', path, 'pnpm deploy must assemble one frozen, offline production closure with BuildKit network access disabled');
+            throw new errors_js_1.SupplyChainError('supply-chain-container-mutable', path, 'pnpm deploy must trust one previously verified frozen lockfile and assemble its offline production closure with BuildKit network access disabled');
         }
     }
     return {