@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/executors/router-waf-rehearsal/router-waf-rehearsal.js

@@ -1,14 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRouterWafRehearsalExecutor = createRouterWafRehearsalExecutor;
+const client_cloudwatch_1 = require("@aws-sdk/client-cloudwatch");
+const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
+const client_cloudfront_1 = require("@aws-sdk/client-cloudfront");
+const client_sts_1 = require("@aws-sdk/client-sts");
+const client_wafv2_1 = require("@aws-sdk/client-wafv2");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const devkit_1 = require("@nx/devkit");
 const index_js_1 = require("../../foundation/index.js");
+const router_waf_rate_rehearsal_js_1 = require("../../foundation/router-waf-rate-rehearsal.js");
+const index_js_2 = require("../../aws-authority/index.js");
+const identity_js_1 = require("../../aws/identity.js");
+const index_js_3 = require("../../repository-policy/index.js");
+const deterministic_order_js_1 = require("../../deterministic-order.js");
+const index_js_4 = require("../../workspace-deployment/index.js");
 const MAX_ROUTER_WAF_EVIDENCE_BYTES = 32 * 1024;
 const FOUNDATION_ROOT = (0, node_path_1.join)('packages', 'foundation');
 const POLICY_PATH = (0, node_path_1.join)('security', 'router-waf.json');
 const EVIDENCE_PATH = (0, node_path_1.join)('security', 'router-waf-live-evidence.json');
 const RECEIPT_PATH = (0, node_path_1.join)('security', 'router-waf-blocking-rehearsal.json');
+const GLOBAL_WAF_REGION = 'us-east-1';
+const REQUEST_TIMEOUT_MS = 15_000;
+const RATE_MARKER_HEADER = 'x-ebk-waf-rate-rehearsal';
+const OPERATOR_MARKER_HEADER = 'x-ebk-waf-rehearsal';
+const RATE_MARKER_NONCE_PATTERN = /^[a-f0-9]{64}$/u;
+const SLICE_HEALTH_PATH = /^\/[a-z0-9]+(?:-[a-z0-9]+)*\/api\/health$/u;
+const WAF_ARN = /^arn:(aws|aws-us-gov):wafv2:us-east-1:(\d{12}):global\/webacl\/([A-Za-z0-9_-]{1,128})\/([a-f0-9-]{36})$/u;
+const WAF_IP_SET_ARN = /^arn:(aws|aws-us-gov):wafv2:us-east-1:(\d{12}):global\/ipset\/([A-Za-z0-9_-]{1,128})\/([a-f0-9-]{36})$/u;
+const WORKSPACE_PATTERN = /^[a-z0-9][a-z0-9-]{0,127}$/u;
+const MAX_ROUTER_WAF_SEED_AGE_MS = 4 * 60 * 60 * 1_000;
 function readBoundedJson(path, label) {
     const before = (0, node_fs_1.lstatSync)(path, { bigint: true });
     if (!before.isFile() || before.nlink !== 1n) {
@@ -34,14 +58,14 @@ function readBoundedJson(path, label) {
         throw new Error(`${label} is not valid JSON.`);
     }
 }
-function writeReceipt(path, receipt) {
+function writeBoundedJson(path, value, label) {
     const existing = (0, node_fs_1.lstatSync)(path, { bigint: true });
     if (!existing.isFile() || existing.nlink !== 1n) {
-        throw new Error('Router WAF blocking rehearsal receipt must be one unaliased regular file.');
+        throw new Error(`${label} must be one unaliased regular file.`);
     }
-    const bytes = `${JSON.stringify(receipt, null, 2)}\n`;
+    const bytes = `${JSON.stringify(value, null, 2)}\n`;
     if (Buffer.byteLength(bytes) > MAX_ROUTER_WAF_EVIDENCE_BYTES) {
-        throw new Error('Router WAF blocking rehearsal receipt exceeds its bound.');
+        throw new Error(`${label} exceeds its bound.`);
     }
     const temporary = `${path}.tmp-${process.pid}`;
     let descriptor;
@@ -68,27 +92,888 @@ function writeReceipt(path, receipt) {
     if (cleanupError)
         throw cleanupError;
 }
-const executor = async (_, context) => {
+function partitionForRegion(region) {
+    return region.startsWith('cn-')
+        ? 'aws-cn'
+        : region.startsWith('us-gov-')
+            ? 'aws-us-gov'
+            : 'aws';
+}
+function selectedProfile(options, environment) {
+    const explicit = options.profile?.trim();
+    const internal = environment.AWS_PROFILE?.trim();
+    if (explicit && internal && explicit !== internal) {
+        throw new Error('Router WAF rehearsal explicit profile differs from the invocation AWS_PROFILE.');
+    }
+    const profile = explicit || internal || undefined;
+    if (environment.GITHUB_ACTIONS === 'true') {
+        if (profile) {
+            throw new Error('Protected GitHub Router WAF rehearsal must use its configured OIDC credentials, not an AWS profile.');
+        }
+        return undefined;
+    }
+    if (!profile) {
+        throw new Error('Local Router WAF rehearsal requires the explicit or invocation-private AWS_PROFILE.');
+    }
+    return profile;
+}
+function markerDigest(value) {
+    return `sha256:${(0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex')}`;
+}
+function rateMarker(nonce, sequence) {
+    return `${nonce}:${sequence}`;
+}
+function normalizedProbeUrl(value) {
+    let url;
     try {
-        const root = (0, node_path_1.join)(context.root, FOUNDATION_ROOT);
-        const policy = (0, index_js_1.normalizeRouterWafPolicy)(readBoundedJson((0, node_path_1.join)(root, POLICY_PATH), 'Router WAF policy'));
-        const receipt = (0, index_js_1.createRouterWafBlockingRehearsal)({
-            evidence: readBoundedJson((0, node_path_1.join)(root, EVIDENCE_PATH), 'Router WAF live evidence'),
-            policy,
-        });
-        writeReceipt((0, node_path_1.join)(root, RECEIPT_PATH), receipt);
-        devkit_1.logger.info(JSON.stringify({
-            evidenceDigest: receipt.evidenceDigest,
-            policyDigest: receipt.policyDigest,
-            sealed: true,
-            stage: receipt.stage,
-        }));
-        return { success: true };
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('Router WAF rate probe URL must be one absolute URL.');
+    }
+    if (url.protocol !== 'https:' ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.hash !== '' ||
+        url.search !== '' ||
+        url.port !== '' ||
+        !SLICE_HEALTH_PATH.test(url.pathname)) {
+        throw new Error('Router WAF rate probe URL must be HTTPS on the default port, contain no credentials/query/fragment, and use /<kebab-slice>/api/health.');
+    }
+    return url;
+}
+function clients(profile, region, dependencies) {
+    const credentials = profile ? (0, credential_providers_1.fromIni)({ profile }) : undefined;
+    const common = credentials ? { credentials } : {};
+    return {
+        cloudFront: (dependencies.createCloudFrontClient ??
+            ((configuration) => new client_cloudfront_1.CloudFrontClient(configuration)))({
+            ...common,
+            region: GLOBAL_WAF_REGION,
+        }),
+        cloudWatch: (dependencies.createCloudWatchClient ??
+            ((configuration) => new client_cloudwatch_1.CloudWatchClient(configuration)))({
+            ...common,
+            region: GLOBAL_WAF_REGION,
+        }),
+        cloudWatchLogs: (dependencies.createCloudWatchLogsClient ??
+            ((configuration) => new client_cloudwatch_logs_1.CloudWatchLogsClient(configuration)))({
+            ...common,
+            region: GLOBAL_WAF_REGION,
+        }),
+        sts: (dependencies.createStsClient ??
+            ((configuration) => new client_sts_1.STSClient(configuration)))({
+            ...common,
+            endpoint: (0, identity_js_1.canonicalStsEndpoint)(region),
+            region,
+        }),
+        waf: (dependencies.createWafClient ??
+            ((configuration) => new client_wafv2_1.WAFV2Client(configuration)))({
+            ...common,
+            region: GLOBAL_WAF_REGION,
+        }),
+    };
+}
+async function attestCloudFrontDistribution(input) {
+    const expectedArn = `arn:${input.partition}:cloudfront::${input.accountId}:distribution/${input.distributionId}`;
+    const [result, tagResult] = await Promise.all([
+        input.cloudFront.send(new client_cloudfront_1.GetDistributionCommand({ Id: input.distributionId })),
+        input.cloudFront.send(new client_cloudfront_1.ListTagsForResourceCommand({ Resource: expectedArn })),
+    ]);
+    const distribution = result.Distribution;
+    const configuration = distribution?.DistributionConfig;
+    const aliases = configuration?.Aliases?.Items ?? [];
+    if (distribution?.ARN !== expectedArn ||
+        distribution?.Id !== input.distributionId ||
+        distribution.Status !== 'Deployed' ||
+        configuration?.Staging !== false ||
+        !distribution.DomainName ||
+        !configuration ||
+        configuration.Enabled !== true ||
+        configuration.WebACLId !== input.webAclArn ||
+        (input.probeHost !== distribution.DomainName &&
+            !aliases.includes(input.probeHost))) {
+        throw new Error('Router WAF rehearsal probe is not bound to the exact enabled deployed CloudFront distribution, Web ACL, DomainName, or Alias.');
+    }
+    const tags = new Map((tagResult.Tags?.Items ?? []).flatMap((tag) => tag.Key && tag.Value ? [[tag.Key, tag.Value]] : []));
+    if (tags.get('ebk:managed-by') !== 'empire-builder-kit' ||
+        tags.get('ebk:owner') !== 'foundation' ||
+        tags.get('ebk:stage') !== input.stage ||
+        tags.get('ebk:workspace') !== input.workspace) {
+        throw new Error('Live CloudFront distribution lacks the exact generated workspace, stage, owner, or managed identity tags.');
+    }
+}
+function liveRecord(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} is not one object.`);
+    }
+    return value;
+}
+function exactLiveKeys(value, expected, label) {
+    const observed = Object.entries(value)
+        .filter(([, item]) => item !== undefined)
+        .map(([key]) => key)
+        .sort();
+    const required = [...expected].sort();
+    if (JSON.stringify(observed) !== JSON.stringify(required)) {
+        throw new Error(`${label} has an unexpected live shape.`);
+    }
+}
+function emptyLiveObject(value, label) {
+    const candidate = liveRecord(value, label);
+    exactLiveKeys(candidate, [], label);
+}
+function canonicalLive(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalLive).join(',')}]`;
+    }
+    if (value && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([key, item]) => `${JSON.stringify(key)}:${canonicalLive(item)}`)
+            .join(',')}}`;
+    }
+    const encoded = JSON.stringify(value);
+    if (encoded === undefined) {
+        throw new Error('Router WAF live contract contains an unsupported value.');
+    }
+    return encoded;
+}
+function canonicalRulesForComparison(rules) {
+    const normalized = structuredClone(rules);
+    const allowlist = normalized.find(({ name }) => name === 'StageIpAllowlist');
+    const statement = allowlist?.statement;
+    const references = statement?.notStatement?.statement?.orStatement?.statements;
+    if (references) {
+        references.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(canonicalLive(left), canonicalLive(right)));
+    }
+    return canonicalLive(normalized);
+}
+function normalizedLiveVisibility(value, expectedMetricName, label) {
+    const candidate = liveRecord(value, `${label} visibility`);
+    exactLiveKeys(candidate, ['CloudWatchMetricsEnabled', 'MetricName', 'SampledRequestsEnabled'], `${label} visibility`);
+    if (candidate.CloudWatchMetricsEnabled !== true ||
+        candidate.SampledRequestsEnabled !== true ||
+        candidate.MetricName !== expectedMetricName) {
+        throw new Error(`${label} visibility differs from the generated plan.`);
+    }
+    return {
+        cloudwatchMetricsEnabled: true,
+        metricName: expectedMetricName,
+        sampledRequestsEnabled: true,
+    };
+}
+function normalizedIpSetReference(value, label) {
+    const candidate = liveRecord(value, label);
+    exactLiveKeys(candidate, ['ARN'], label);
+    if (typeof candidate.ARN !== 'string') {
+        throw new Error(`${label} ARN is invalid.`);
+    }
+    return {
+        arn: candidate.ARN,
+        normalized: { ipSetReferenceStatement: { arn: candidate.ARN } },
+    };
+}
+function normalizedLiveRules(input) {
+    const prefix = `Ebk${input.stage[0].toUpperCase()}${input.stage.slice(1)}`;
+    const expectedNames = [
+        'StageIpAllowlist',
+        router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_RULE_NAME,
+        'AWSManagedRulesCommonRuleSet',
+        'AWSManagedRulesKnownBadInputsRuleSet',
+        'AWSManagedRulesAmazonIpReputationList',
+    ];
+    if (input.rules.length !== expectedNames.length ||
+        input.rules.some((rule, index) => liveRecord(rule, `Router WAF rule ${index}`).Name !==
+            expectedNames[index])) {
+        throw new Error('Live Router WAF ordered rule inventory differs from the generated blocking plan.');
+    }
+    const ipSetArns = [];
+    const rules = input.rules.map((value, index) => {
+        const name = expectedNames[index] ?? '';
+        const rule = liveRecord(value, `Router WAF rule ${name}`);
+        const managed = name.startsWith('AWSManagedRules');
+        exactLiveKeys(rule, managed
+            ? [
+                'Name',
+                'OverrideAction',
+                'Priority',
+                'Statement',
+                'VisibilityConfig',
+            ]
+            : ['Action', 'Name', 'Priority', 'Statement', 'VisibilityConfig'], `Router WAF rule ${name}`);
+        if (rule.Name !== name || rule.Priority !== index) {
+            throw new Error(`Live Router WAF rule ${name} priority differs from the generated plan.`);
+        }
+        const visibilityConfig = normalizedLiveVisibility(rule.VisibilityConfig, `${prefix}${name}`, `Router WAF rule ${name}`);
+        const statement = liveRecord(rule.Statement, `Router WAF rule ${name} statement`);
+        if (name === 'StageIpAllowlist') {
+            const action = liveRecord(rule.Action, 'StageIpAllowlist action');
+            exactLiveKeys(action, ['Block'], 'StageIpAllowlist action');
+            emptyLiveObject(action.Block, 'StageIpAllowlist Block action');
+            exactLiveKeys(statement, ['NotStatement'], 'StageIpAllowlist statement');
+            const notStatement = liveRecord(statement.NotStatement, 'StageIpAllowlist not statement');
+            exactLiveKeys(notStatement, ['Statement'], 'StageIpAllowlist not statement');
+            const nested = liveRecord(notStatement.Statement, 'StageIpAllowlist nested statement');
+            let normalizedNested;
+            if ('IPSetReferenceStatement' in nested) {
+                exactLiveKeys(nested, ['IPSetReferenceStatement'], 'StageIpAllowlist nested statement');
+                const reference = normalizedIpSetReference(nested.IPSetReferenceStatement, 'StageIpAllowlist IP set reference');
+                ipSetArns.push(reference.arn);
+                normalizedNested = reference.normalized;
+            }
+            else {
+                exactLiveKeys(nested, ['OrStatement'], 'StageIpAllowlist nested statement');
+                const orStatement = liveRecord(nested.OrStatement, 'StageIpAllowlist OR statement');
+                exactLiveKeys(orStatement, ['Statements'], 'StageIpAllowlist OR statement');
+                if (!Array.isArray(orStatement.Statements) ||
+                    orStatement.Statements.length !== 2) {
+                    throw new Error('StageIpAllowlist OR statement must contain the exact generated IPv4 and IPv6 references.');
+                }
+                const references = orStatement.Statements.map((item, referenceIndex) => {
+                    const wrapper = liveRecord(item, `StageIpAllowlist reference ${referenceIndex}`);
+                    exactLiveKeys(wrapper, ['IPSetReferenceStatement'], `StageIpAllowlist reference ${referenceIndex}`);
+                    const reference = normalizedIpSetReference(wrapper.IPSetReferenceStatement, `StageIpAllowlist reference ${referenceIndex}`);
+                    ipSetArns.push(reference.arn);
+                    return reference.normalized;
+                });
+                normalizedNested = { orStatement: { statements: references } };
+            }
+            return {
+                action: { block: {} },
+                name,
+                priority: index,
+                statement: {
+                    notStatement: { statement: normalizedNested },
+                },
+                visibilityConfig,
+            };
+        }
+        if (name === router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_RULE_NAME) {
+            const action = liveRecord(rule.Action, 'RateLimitPerIP action');
+            exactLiveKeys(action, ['Block'], 'RateLimitPerIP action');
+            emptyLiveObject(action.Block, 'RateLimitPerIP Block action');
+            exactLiveKeys(statement, ['RateBasedStatement'], 'RateLimitPerIP statement');
+            const rate = liveRecord(statement.RateBasedStatement, 'RateLimitPerIP rate statement');
+            const rateKeys = Object.entries(rate)
+                .filter(([, item]) => item !== undefined)
+                .map(([key]) => key)
+                .sort();
+            if (JSON.stringify(rateKeys) !==
+                JSON.stringify([
+                    'AggregateKeyType',
+                    ...(rate.EvaluationWindowSec === undefined
+                        ? []
+                        : ['EvaluationWindowSec']),
+                    'Limit',
+                ].sort()) ||
+                rate.AggregateKeyType !== 'IP' ||
+                typeof rate.Limit !== 'number' ||
+                (rate.EvaluationWindowSec !== undefined &&
+                    rate.EvaluationWindowSec !== 300)) {
+                throw new Error('Live RateLimitPerIP contains an unexpected scope-down, forwarded-IP, custom-key, evaluation-window, or limit shape.');
+            }
+            return {
+                action: { block: {} },
+                name,
+                priority: index,
+                statement: {
+                    rateBasedStatement: {
+                        aggregateKeyType: 'IP',
+                        limit: rate.Limit,
+                    },
+                },
+                visibilityConfig,
+            };
+        }
+        const overrideAction = liveRecord(rule.OverrideAction, `Router WAF rule ${name} override action`);
+        exactLiveKeys(overrideAction, ['None'], `Router WAF rule ${name} override action`);
+        emptyLiveObject(overrideAction.None, `Router WAF rule ${name} None action`);
+        exactLiveKeys(statement, ['ManagedRuleGroupStatement'], `Router WAF rule ${name} statement`);
+        const managedStatement = liveRecord(statement.ManagedRuleGroupStatement, `Router WAF rule ${name} managed statement`);
+        const common = name === 'AWSManagedRulesCommonRuleSet';
+        exactLiveKeys(managedStatement, common
+            ? ['Name', 'RuleActionOverrides', 'VendorName']
+            : ['Name', 'VendorName'], `Router WAF rule ${name} managed statement`);
+        if (managedStatement.Name !== name ||
+            managedStatement.VendorName !== 'AWS') {
+            throw new Error(`Live Router WAF rule ${name} managed group differs from the generated plan.`);
+        }
+        let ruleActionOverrides;
+        if (common) {
+            if (!Array.isArray(managedStatement.RuleActionOverrides) ||
+                managedStatement.RuleActionOverrides.length !== 1) {
+                throw new Error('AWSManagedRulesCommonRuleSet must retain the exact SizeRestrictions_BODY Count override.');
+            }
+            const override = liveRecord(managedStatement.RuleActionOverrides[0], 'SizeRestrictions_BODY override');
+            exactLiveKeys(override, ['ActionToUse', 'Name'], 'SizeRestrictions_BODY override');
+            const actionToUse = liveRecord(override.ActionToUse, 'SizeRestrictions_BODY action');
+            exactLiveKeys(actionToUse, ['Count'], 'SizeRestrictions_BODY action');
+            emptyLiveObject(actionToUse.Count, 'SizeRestrictions_BODY Count action');
+            if (override.Name !== 'SizeRestrictions_BODY') {
+                throw new Error('AWSManagedRulesCommonRuleSet override targets an unexpected rule.');
+            }
+            ruleActionOverrides = [
+                {
+                    actionToUse: { count: {} },
+                    name: 'SizeRestrictions_BODY',
+                },
+            ];
+        }
+        return {
+            name,
+            overrideAction: { none: {} },
+            priority: index,
+            statement: {
+                managedRuleGroupStatement: {
+                    name,
+                    ...(common ? { ruleActionOverrides } : {}),
+                    vendorName: 'AWS',
+                },
+            },
+            visibilityConfig,
+        };
+    });
+    return { ipSetArns, rules };
+}
+function requiredIdentityTags(input) {
+    return {
+        'ebk:managed-by': 'empire-builder-kit',
+        'ebk:owner': 'foundation',
+        'ebk:policy-digest': input.policyDigest,
+        'ebk:stage': input.stage,
+        'ebk:workspace': input.workspace,
+    };
+}
+function attestWafTags(tagsResult, resourceArn, expected, label) {
+    const result = liveRecord(tagsResult, `${label} tag response`);
+    const tagInfo = liveRecord(result.TagInfoForResource, `${label} tag information`);
+    if (tagInfo.ResourceARN !== resourceArn || !Array.isArray(tagInfo.TagList)) {
+        throw new Error(`${label} tag response does not identify the exact ARN.`);
+    }
+    const tags = new Map(tagInfo.TagList.flatMap((value) => {
+        const tag = liveRecord(value, `${label} tag`);
+        return typeof tag.Key === 'string' && typeof tag.Value === 'string'
+            ? [[tag.Key, tag.Value]]
+            : [];
+    }));
+    if (Object.entries(expected).some(([key, value]) => tags.get(key) !== value)) {
+        throw new Error(`${label} lacks the exact generated identity tags.`);
+    }
+}
+async function attestIpSet(input) {
+    const arn = WAF_IP_SET_ARN.exec(input.arn);
+    if (!arn || arn[2] !== input.accountId) {
+        throw new Error('Router WAF IP set ARN has the wrong account or scope.');
+    }
+    const name = arn[3] ?? '';
+    const id = arn[4] ?? '';
+    const [ipSetResult, tagsResult] = await Promise.all([
+        input.waf.send(new client_wafv2_1.GetIPSetCommand({ Id: id, Name: name, Scope: 'CLOUDFRONT' })),
+        input.waf.send(new client_wafv2_1.ListTagsForResourceCommand({ ResourceARN: input.arn })),
+    ]);
+    const ipSet = ipSetResult.IPSet;
+    const expectedCidrs = ipSet?.IPAddressVersion === 'IPV4'
+        ? input.expectedIpv4Cidrs
+        : input.expectedIpv6Cidrs;
+    if (ipSet?.ARN !== input.arn ||
+        ipSet.Id !== id ||
+        ipSet.Name !== name ||
+        (ipSet.IPAddressVersion !== 'IPV4' && ipSet.IPAddressVersion !== 'IPV6') ||
+        JSON.stringify([...(ipSet.Addresses ?? [])].sort()) !==
+            JSON.stringify([...expectedCidrs].sort())) {
+        throw new Error('Live Router WAF IP set identity, address family, or exact CIDRs differ from the generated plan.');
+    }
+    attestWafTags(tagsResult, input.arn, input.expectedTags, 'Router WAF IP set');
+    return ipSet.IPAddressVersion;
+}
+async function attestLoggingConfiguration(input) {
+    let configuration;
+    try {
+        const result = await input.waf.send(new client_wafv2_1.GetLoggingConfigurationCommand({ ResourceArn: input.webAclArn }));
+        configuration = result.LoggingConfiguration;
     }
     catch (error) {
-        devkit_1.logger.error(error instanceof Error ? error.message : String(error));
-        return { success: false };
+        if (input.plan.logging === false &&
+            error instanceof Error &&
+            error.name === 'WAFNonexistentItemException') {
+            return;
+        }
+        throw error;
+    }
+    if (input.plan.logging === false) {
+        if (configuration !== undefined) {
+            throw new Error('Router WAF logging exists even though committed policy disables it.');
+        }
+        return;
     }
-};
+    const live = liveRecord(configuration, 'Router WAF logging configuration');
+    if (live.ResourceArn !== input.webAclArn ||
+        !Array.isArray(live.LogDestinationConfigs) ||
+        live.LogDestinationConfigs.length !== 1 ||
+        typeof live.LogDestinationConfigs[0] !== 'string' ||
+        !new RegExp(`^arn:(?:aws|aws-us-gov):logs:us-east-1:${input.accountId}:log-group:(aws-waf-logs-foundation-${input.plan.stage}-FoundationRouter-[A-Za-z0-9]{1,32})$`).test(live.LogDestinationConfigs[0]) ||
+        live.ManagedByFirewallManager !== false ||
+        live.LogScope !== 'CUSTOMER' ||
+        live.LogType !== 'WAF_LOGS') {
+        throw new Error('Router WAF logging destination differs from the generated blocking log contract.');
+    }
+    const destinationArn = live.LogDestinationConfigs[0];
+    const logGroupName = destinationArn.slice(destinationArn.indexOf(':log-group:') + 11);
+    const logGroups = await input.cloudWatchLogs.send(new client_cloudwatch_logs_1.DescribeLogGroupsCommand({
+        includeLinkedAccounts: false,
+        logGroupNamePrefix: logGroupName,
+    }));
+    const exactLogGroups = (logGroups.logGroups ?? []).filter(({ logGroupName: candidate }) => candidate === logGroupName);
+    if (exactLogGroups.length !== 1 ||
+        exactLogGroups[0]?.logGroupArn !== destinationArn ||
+        exactLogGroups[0]?.arn !== `${destinationArn}:*` ||
+        exactLogGroups[0]?.logGroupClass !== 'STANDARD' ||
+        exactLogGroups[0]?.retentionInDays !==
+            ({ '1 day': 1, '3 days': 3, '5 days': 5, '1 week': 7, '2 weeks': 14 }[input.plan.logging.retention] ?? -1)) {
+        throw new Error('Router WAF CloudWatch Logs destination identity, class, or retention differs from committed policy.');
+    }
+    const expectedRedactions = [
+        { queryString: {} },
+        { singleHeader: { name: 'authorization' } },
+        { singleHeader: { name: 'cookie' } },
+        { singleHeader: { name: 'x-api-key' } },
+    ];
+    const redactions = Array.isArray(live.RedactedFields)
+        ? live.RedactedFields.map((value) => {
+            const field = liveRecord(value, 'Router WAF redacted field');
+            if ('QueryString' in field) {
+                exactLiveKeys(field, ['QueryString'], 'Router WAF query redaction');
+                emptyLiveObject(field.QueryString, 'Router WAF query redaction');
+                return { queryString: {} };
+            }
+            exactLiveKeys(field, ['SingleHeader'], 'Router WAF header redaction');
+            const header = liveRecord(field.SingleHeader, 'Router WAF header redaction');
+            exactLiveKeys(header, ['Name'], 'Router WAF header redaction');
+            return { singleHeader: { name: header.Name } };
+        })
+        : [];
+    const filter = liveRecord(live.LoggingFilter, 'Router WAF logging filter');
+    exactLiveKeys(filter, ['DefaultBehavior', 'Filters'], 'Router WAF logging filter');
+    if (canonicalLive([...redactions].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(canonicalLive(left), canonicalLive(right)))) !==
+        canonicalLive([...expectedRedactions].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(canonicalLive(left), canonicalLive(right)))) ||
+        filter.DefaultBehavior !== 'DROP' ||
+        !Array.isArray(filter.Filters) ||
+        filter.Filters.length !== 1) {
+        throw new Error('Router WAF logging redaction or blocked-only filter differs from committed policy.');
+    }
+    const retainedFilter = liveRecord(filter.Filters[0], 'Router WAF log filter');
+    exactLiveKeys(retainedFilter, ['Behavior', 'Conditions', 'Requirement'], 'Router WAF log filter');
+    if (retainedFilter.Behavior !== 'KEEP' ||
+        retainedFilter.Requirement !== 'MEETS_ANY' ||
+        !Array.isArray(retainedFilter.Conditions) ||
+        retainedFilter.Conditions.length !== 1 ||
+        canonicalLive(retainedFilter.Conditions) !==
+            canonicalLive([{ ActionCondition: { Action: 'BLOCK' } }])) {
+        throw new Error('Router WAF logging filter does not retain only blocked requests.');
+    }
+}
+async function attestRouterWafBaseline(input) {
+    const arn = WAF_ARN.exec(input.webAclArn);
+    if (!arn || arn[2] !== input.accountId) {
+        throw new Error('Router WAF rehearsal Web ACL ARN does not match the committed account and global scope.');
+    }
+    const name = arn[3] ?? '';
+    const id = arn[4] ?? '';
+    const [webAclResult, tagsResult] = await Promise.all([
+        input.waf.send(new client_wafv2_1.GetWebACLCommand({ Id: id, Name: name, Scope: 'CLOUDFRONT' })),
+        input.waf.send(new client_wafv2_1.ListTagsForResourceCommand({ ResourceARN: input.webAclArn })),
+    ]);
+    const webAcl = webAclResult.WebACL;
+    if (webAcl?.ARN !== input.webAclArn ||
+        webAcl.Id !== id ||
+        webAcl.Name !== name ||
+        !webAcl.DefaultAction?.Allow ||
+        Object.keys(webAcl.DefaultAction).some((key) => key !== 'Allow') ||
+        webAcl.VisibilityConfig?.CloudWatchMetricsEnabled !== true ||
+        webAcl.VisibilityConfig.SampledRequestsEnabled !== true ||
+        webAcl.VisibilityConfig.MetricName !== input.webAclMetricName) {
+        throw new Error('Live Router WAF identity, default action, or Web ACL visibility differs from the generated plan.');
+    }
+    emptyLiveObject(webAcl.DefaultAction.Allow, 'Router WAF Web ACL default Allow action');
+    const expectedTags = requiredIdentityTags(input);
+    attestWafTags(tagsResult, input.webAclArn, expectedTags, 'Router WAF Web ACL');
+    const normalized = normalizedLiveRules({
+        rules: webAcl.Rules ?? [],
+        stage: input.stage,
+    });
+    const expectedIpSetCount = Number(input.plan.ipv4Cidrs.length > 0) +
+        Number(input.plan.ipv6Cidrs.length > 0);
+    if (normalized.ipSetArns.length !== expectedIpSetCount) {
+        throw new Error('Live StageIpAllowlist has an unexpected number of generated IP set references.');
+    }
+    if (new Set(normalized.ipSetArns).size !== normalized.ipSetArns.length) {
+        throw new Error('Live StageIpAllowlist reuses an IP set instead of the exact generated address-family inventory.');
+    }
+    const ipSetResults = await Promise.all(normalized.ipSetArns.map(async (ipSetArn) => {
+        const version = await attestIpSet({
+            accountId: input.accountId,
+            arn: ipSetArn,
+            expectedIpv4Cidrs: input.plan.ipv4Cidrs,
+            expectedIpv6Cidrs: input.plan.ipv6Cidrs,
+            expectedTags,
+            waf: input.waf,
+        });
+        return { arn: ipSetArn, version };
+    }));
+    const ipv4Arn = ipSetResults.find(({ version }) => version === 'IPV4')?.arn;
+    const ipv6Arn = ipSetResults.find(({ version }) => version === 'IPV6')?.arn;
+    if (Boolean(ipv4Arn) !== Boolean(input.plan.ipv4Cidrs.length) ||
+        Boolean(ipv6Arn) !== Boolean(input.plan.ipv6Cidrs.length)) {
+        throw new Error('Live Router WAF IP set address families differ from the generated plan.');
+    }
+    const expectedRules = (0, index_js_1.createRouterWafRules)(input.plan, {
+        ...(ipv4Arn ? { ipv4Arn } : {}),
+        ...(ipv6Arn ? { ipv6Arn } : {}),
+    });
+    if (canonicalRulesForComparison(normalized.rules) !==
+        canonicalRulesForComparison(expectedRules)) {
+        throw new Error('Live Router WAF ordered rules differ from the exact generated blocking plan.');
+    }
+    await attestLoggingConfiguration({
+        accountId: input.accountId,
+        cloudWatchLogs: input.cloudWatchLogs,
+        plan: input.plan,
+        waf: input.waf,
+        webAclArn: input.webAclArn,
+    });
+    return name;
+}
+function matchesManagedSampledRule(input) {
+    if (!input.group || !input.subrule)
+        return false;
+    return (input.observed === input.subrule ||
+        input.observed === `AWS#${input.group}#${input.subrule}`);
+}
+async function attestOperatorBlock(input) {
+    const [managedGroup, managedSubrule] = input.evidence.ruleName.split('#');
+    const metricName = input.type === 'nonallowlisted'
+        ? `Ebk${input.stage[0].toUpperCase()}${input.stage.slice(1)}StageIpAllowlist`
+        : `Ebk${input.stage[0].toUpperCase()}${input.stage.slice(1)}${managedGroup}`;
+    const blockedAt = new Date(input.evidence.blockedAt);
+    const sampled = await input.waf.send(new client_wafv2_1.GetSampledRequestsCommand({
+        MaxItems: 500,
+        RuleMetricName: metricName,
+        Scope: 'CLOUDFRONT',
+        TimeWindow: {
+            EndTime: new Date(blockedAt.getTime() + 60_000),
+            StartTime: new Date(blockedAt.getTime() - 60_000),
+        },
+        WebAclArn: input.webAclArn,
+    }));
+    const matches = (sampled.SampledRequests ?? []).filter((sample) => {
+        const headers = sample.Request?.Headers ?? [];
+        const marker = headers.find(({ Name }) => Name?.toLowerCase() === OPERATOR_MARKER_HEADER)?.Value;
+        const timestamp = sample.Timestamp?.getTime();
+        return (sample.Action === 'BLOCK' &&
+            sample.Request?.Method === input.evidence.method &&
+            sample.Request.URI === input.evidence.path &&
+            marker === input.evidence.marker &&
+            timestamp !== undefined &&
+            Math.abs(timestamp - blockedAt.getTime()) <= 60_000 &&
+            (input.type === 'nonallowlisted'
+                ? sample.RuleNameWithinRuleGroup === undefined
+                : matchesManagedSampledRule({
+                    group: managedGroup,
+                    observed: sample.RuleNameWithinRuleGroup,
+                    subrule: managedSubrule,
+                })));
+    });
+    if (matches.length !== 1) {
+        throw new Error(`Router WAF ${input.type} operator evidence does not correlate to one exact sampled BLOCK request.`);
+    }
+}
+async function observeRateLimit(input) {
+    const [sampled, metric] = await Promise.all([
+        input.waf.send(new client_wafv2_1.GetSampledRequestsCommand({
+            MaxItems: 500,
+            RuleMetricName: input.ruleMetricName,
+            Scope: 'CLOUDFRONT',
+            TimeWindow: {
+                EndTime: input.endTime,
+                StartTime: input.startTime,
+            },
+            WebAclArn: input.webAclArn,
+        })),
+        input.cloudWatch.send(new client_cloudwatch_1.GetMetricDataCommand({
+            EndTime: input.endTime,
+            MetricDataQueries: [
+                {
+                    Id: 'rateblocked',
+                    MetricStat: {
+                        Metric: {
+                            Dimensions: [
+                                { Name: 'Rule', Value: input.ruleMetricName },
+                                { Name: 'WebACL', Value: input.webAclMetricName },
+                            ],
+                            MetricName: 'BlockedRequests',
+                            Namespace: 'AWS/WAFV2',
+                        },
+                        Period: 60,
+                        Stat: 'Sum',
+                    },
+                    ReturnData: true,
+                },
+            ],
+            ScanBy: 'TimestampDescending',
+            StartTime: input.startTime,
+        })),
+    ]);
+    const result = metric.MetricDataResults?.find((candidate) => candidate.Id === 'rateblocked');
+    const metrics = (result?.Timestamps ?? []).flatMap((timestamp, index) => {
+        const value = result?.Values?.[index];
+        return timestamp && typeof value === 'number'
+            ? [
+                {
+                    name: 'BlockedRequests',
+                    namespace: 'AWS/WAFV2',
+                    ruleMetricName: input.ruleMetricName,
+                    timestamp,
+                    value,
+                    webAclMetricName: input.webAclMetricName,
+                },
+            ]
+            : [];
+    });
+    const samples = (sampled.SampledRequests ?? []).flatMap((sample) => {
+        const markerHeader = sample.Request?.Headers?.find((header) => header.Name?.toLowerCase() === RATE_MARKER_HEADER &&
+            header.Value === input.marker);
+        return sample.Timestamp &&
+            typeof sample.Action === 'string' &&
+            sample.Request?.Method === 'GET' &&
+            sample.Request.URI === input.probePath &&
+            markerHeader
+            ? [
+                {
+                    action: sample.Action,
+                    markerDigest: input.markerDigest,
+                    method: 'GET',
+                    ruleMetricName: input.ruleMetricName,
+                    ruleName: router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_RULE_NAME,
+                    timestamp: sample.Timestamp,
+                    uri: input.probePath,
+                },
+            ]
+            : [];
+    });
+    return { metrics, samples };
+}
+function mergeRateEvidence(evidence, allowedRequestStatus, rateLimit, completedAt) {
+    const candidate = evidence;
+    const probes = candidate.probes;
+    return {
+        ...candidate,
+        completedAt,
+        probes: { ...probes, allowedRequestStatus, rateLimit },
+    };
+}
+function createRouterWafRehearsalExecutor(dependencies = {}) {
+    return async (options, context) => {
+        try {
+            const environment = dependencies.environment ?? process.env;
+            const root = (0, node_path_1.join)(context.root, FOUNDATION_ROOT);
+            const policy = (0, index_js_1.normalizeRouterWafPolicy)(readBoundedJson((0, node_path_1.join)(root, POLICY_PATH), 'Router WAF policy'));
+            const workspaceManifest = liveRecord(readBoundedJson((0, node_path_1.join)(context.root, 'package.json'), 'Workspace manifest'), 'Workspace manifest');
+            const workspace = workspaceManifest.name;
+            if (typeof workspace !== 'string' || !WORKSPACE_PATTERN.test(workspace)) {
+                throw new Error('Router WAF rehearsal workspace must match the exact generated root package name.');
+            }
+            const operatingPolicy = (0, index_js_3.readRepositoryOperatingPolicy)(context.root);
+            if (operatingPolicy.deploymentProfile !== policy.deploymentProfile) {
+                throw new Error('Router WAF policy deployment profile differs from the committed repository policy.');
+            }
+            const stage = (0, index_js_3.productionRehearsalStage)(operatingPolicy.deploymentProfile);
+            const accountId = (0, index_js_3.configuredDeploymentAccountForStage)(operatingPolicy.deploymentProfile, operatingPolicy.deploymentAccounts, stage);
+            const region = (0, index_js_3.configuredDeploymentRegion)(operatingPolicy.deploymentRegion);
+            for (const candidate of [
+                environment.AWS_REGION?.trim(),
+                environment.AWS_DEFAULT_REGION?.trim(),
+            ]) {
+                if (candidate && candidate !== region) {
+                    throw new Error(`Router WAF rehearsal ambient Region ${candidate} differs from committed deployment Region ${region}.`);
+                }
+            }
+            const partition = partitionForRegion(region);
+            const expectedRoleArn = (0, index_js_2.createStageAuthorityIdentity)({
+                accountId,
+                partition,
+                region,
+                stage,
+            }).deploymentRoleArn;
+            const wafContractDigest = (0, index_js_1.routerWafContractDigest)(policy);
+            const plan = (0, index_js_1.createRouterWafStagePlan)({
+                policy,
+                rehearsal: null,
+                stage,
+            });
+            const evidencePath = (0, node_path_1.join)(root, EVIDENCE_PATH);
+            const retainedEvidence = readBoundedJson(evidencePath, 'Router WAF live evidence');
+            const seed = (0, index_js_1.validateRouterWafLiveEvidenceSeed)({
+                evidence: retainedEvidence,
+                policy,
+            });
+            if (seed.stage !== stage ||
+                seed.accountId !== accountId ||
+                seed.region !== region ||
+                seed.deploymentRoleArn !== expectedRoleArn ||
+                seed.workspace !== workspace ||
+                seed.wafContractDigest !== wafContractDigest) {
+                throw new Error('Router WAF live evidence stage, account, Region, deployment role, workspace, or WAF contract differs from committed authority.');
+            }
+            const invocationStartedAt = (dependencies.now ?? (() => new Date()))();
+            if (!Number.isFinite(invocationStartedAt.getTime()) ||
+                seed.startedAt > invocationStartedAt.getTime() ||
+                seed.completedAt > invocationStartedAt.getTime() ||
+                invocationStartedAt.getTime() - seed.completedAt >
+                    MAX_ROUTER_WAF_SEED_AGE_MS) {
+                throw new Error('Router WAF live evidence seed is stale or future-dated; no live request was made.');
+            }
+            const receiptPath = (0, node_path_1.join)(root, RECEIPT_PATH);
+            const retainedReceipt = (0, index_js_1.normalizeRouterWafBlockingRehearsal)(readBoundedJson(receiptPath, 'Router WAF blocking rehearsal receipt'));
+            if (retainedReceipt) {
+                throw new Error('Router WAF blocking rehearsal receipt must be reset to its exact pending seed before another live probe.');
+            }
+            const url = normalizedProbeUrl(options.probeUrl);
+            const profile = selectedProfile(options, environment);
+            const aws = clients(profile, region, dependencies);
+            const identity = await aws.sts.send(new client_sts_1.GetCallerIdentityCommand({}));
+            if (identity.Account !== accountId ||
+                typeof identity.Arn !== 'string' ||
+                !(0, identity_js_1.matchesExpectedAssumedRoleArn)(accountId, identity.Arn, expectedRoleArn)) {
+                throw new Error('Router WAF rehearsal caller does not match the committed account and exact stage deployment role.');
+            }
+            await (dependencies.ownership ?? index_js_4.assertWorkspaceStageOwnershipForWorkspace)(context.root, stage, profile ? { profile } : {});
+            const webAclVisibilityMetricName = (0, router_waf_rate_rehearsal_js_1.routerWafWebAclMetricName)(stage);
+            const [, webAclMetricName] = await Promise.all([
+                attestCloudFrontDistribution({
+                    accountId,
+                    cloudFront: aws.cloudFront,
+                    distributionId: seed.distributionId,
+                    partition,
+                    probeHost: url.hostname,
+                    stage,
+                    webAclArn: seed.webAclArn,
+                    workspace,
+                }),
+                attestRouterWafBaseline({
+                    accountId,
+                    cloudWatchLogs: aws.cloudWatchLogs,
+                    plan,
+                    policyDigest: (0, index_js_1.routerWafPolicyDigest)(policy),
+                    stage,
+                    waf: aws.waf,
+                    webAclArn: seed.webAclArn,
+                    webAclMetricName: webAclVisibilityMetricName,
+                    workspace,
+                }),
+            ]);
+            await Promise.all([
+                attestOperatorBlock({
+                    evidence: seed.probes.managedRule,
+                    stage,
+                    type: 'managed',
+                    waf: aws.waf,
+                    webAclArn: seed.webAclArn,
+                }),
+                attestOperatorBlock({
+                    evidence: seed.probes
+                        .nonAllowlisted,
+                    stage,
+                    type: 'nonallowlisted',
+                    waf: aws.waf,
+                    webAclArn: seed.webAclArn,
+                }),
+            ]);
+            const fetchRequest = dependencies.fetch ?? fetch;
+            const baselineResponse = await fetchRequest(url, {
+                cache: 'no-store',
+                headers: { 'cache-control': 'no-cache' },
+                redirect: 'manual',
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            });
+            const allowedRequestStatus = baselineResponse.status;
+            await baselineResponse.body?.cancel();
+            if (allowedRequestStatus < 200 || allowedRequestStatus > 399) {
+                throw new Error(`Router WAF rehearsal health preflight returned unexpected HTTP ${allowedRequestStatus}; rate traffic was not sent.`);
+            }
+            const nonce = (dependencies.createNonce ?? (() => (0, node_crypto_1.randomBytes)(32).toString('hex')))();
+            if (!RATE_MARKER_NONCE_PATTERN.test(nonce)) {
+                throw new Error('Router WAF rehearsal invocation nonce is not one opaque 256-bit lowercase hexadecimal value.');
+            }
+            const rateLimit = await (dependencies.runRateRehearsal ?? router_waf_rate_rehearsal_js_1.runRouterWafRateRehearsal)({
+                dependencies: {
+                    ...(dependencies.now ? { now: dependencies.now } : {}),
+                    observe: ({ endTime, markerDigest: expectedMarkerDigest, ruleMetricName, sequence, startTime, webAclMetricName: expectedWebAclMetricName, }) => {
+                        const marker = rateMarker(nonce, sequence);
+                        if (expectedWebAclMetricName !== webAclMetricName) {
+                            throw new Error('Router WAF rate observation metric dimension differs from the attested physical Web ACL name.');
+                        }
+                        if (markerDigest(marker) !== expectedMarkerDigest) {
+                            throw new Error('Router WAF rate observation marker differs from the exact blocked request.');
+                        }
+                        return observeRateLimit({
+                            cloudWatch: aws.cloudWatch,
+                            endTime,
+                            marker,
+                            markerDigest: expectedMarkerDigest,
+                            probePath: url.pathname,
+                            ruleMetricName,
+                            startTime,
+                            waf: aws.waf,
+                            webAclArn: seed.webAclArn,
+                            webAclMetricName: expectedWebAclMetricName,
+                        });
+                    },
+                    request: async (sequence) => {
+                        const marker = rateMarker(nonce, sequence);
+                        const response = await fetchRequest(url, {
+                            cache: 'no-store',
+                            headers: {
+                                'cache-control': 'no-cache',
+                                [RATE_MARKER_HEADER]: marker,
+                            },
+                            redirect: 'manual',
+                            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                        });
+                        await response.body?.cancel();
+                        return {
+                            markerDigest: markerDigest(marker),
+                            status: response.status,
+                        };
+                    },
+                    ...(dependencies.sleep ? { sleep: dependencies.sleep } : {}),
+                },
+                rateLimitPerIp: policy.rateLimitPerIp,
+                stage,
+                webAclMetricName,
+            });
+            const completedAt = (dependencies.now ?? (() => new Date()))().toISOString();
+            const evidence = mergeRateEvidence(retainedEvidence, allowedRequestStatus, rateLimit, completedAt);
+            const receipt = (0, index_js_1.createRouterWafBlockingRehearsal)({ evidence, policy });
+            writeBoundedJson(evidencePath, evidence, 'Router WAF live evidence');
+            writeBoundedJson(receiptPath, receipt, 'Router WAF blocking rehearsal receipt');
+            devkit_1.logger.info(JSON.stringify({
+                evidenceDigest: receipt.evidenceDigest,
+                accountId: receipt.accountId,
+                policyDigest: receipt.policyDigest,
+                rateRequests: rateLimit.requestsSent,
+                region: receipt.region,
+                sealed: true,
+                stage: receipt.stage,
+            }));
+            return { success: true };
+        }
+        catch (error) {
+            devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+            return { success: false };
+        }
+    };
+}
+const executor = createRouterWafRehearsalExecutor();
 exports.default = executor;
 //# sourceMappingURL=router-waf-rehearsal.js.map