@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/foundation/router-waf.js

@@ -1,25 +1,33 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ROUTER_WAF_REQUIRED_MANAGED_RULES = exports.ROUTER_WAF_SCHEMA_VERSION = exports.ROUTER_WAF_REHEARSAL_KIND = exports.ROUTER_WAF_POLICY_KIND = void 0;
+exports.ROUTER_WAF_REQUIRED_MANAGED_RULES = exports.ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION = exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION = exports.ROUTER_WAF_CONTRACT_SCHEMA_VERSION = exports.ROUTER_WAF_SCHEMA_VERSION = exports.ROUTER_WAF_REHEARSAL_KIND = exports.ROUTER_WAF_POLICY_KIND = void 0;
 exports.normalizeRouterWafPolicy = normalizeRouterWafPolicy;
 exports.routerWafPolicyDigest = routerWafPolicyDigest;
 exports.normalizeRouterWafBlockingRehearsal = normalizeRouterWafBlockingRehearsal;
+exports.validateRouterWafLiveEvidenceSeed = validateRouterWafLiveEvidenceSeed;
 exports.createRouterWafBlockingRehearsal = createRouterWafBlockingRehearsal;
 exports.reconcileRouterWafBlockingRehearsal = reconcileRouterWafBlockingRehearsal;
 exports.createRouterWafStagePlan = createRouterWafStagePlan;
 exports.createRouterWafRules = createRouterWafRules;
+exports.routerWafContractDigest = routerWafContractDigest;
 const node_crypto_1 = require("node:crypto");
 const node_net_1 = require("node:net");
 const stages_js_1 = require("./stages.js");
+const policy_js_1 = require("../repository-policy/policy.js");
+const router_waf_rate_rehearsal_js_1 = require("./router-waf-rate-rehearsal.js");
 exports.ROUTER_WAF_POLICY_KIND = 'ebk-router-waf-policy';
 exports.ROUTER_WAF_REHEARSAL_KIND = 'ebk-router-waf-blocking-rehearsal';
 exports.ROUTER_WAF_SCHEMA_VERSION = 1;
+exports.ROUTER_WAF_CONTRACT_SCHEMA_VERSION = 1;
+exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION = 4;
+exports.ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION = 4;
 exports.ROUTER_WAF_REQUIRED_MANAGED_RULES = [
     'AWSManagedRulesCommonRuleSet',
     'AWSManagedRulesKnownBadInputsRuleSet',
     'AWSManagedRulesAmazonIpReputationList',
 ];
 const POLICY_KEYS = [
+    'deploymentProfile',
     'kind',
     'logging',
     'rateLimitPerIp',
@@ -29,18 +37,24 @@ const POLICY_KEYS = [
 const LOGGING_KEYS = ['enabled', 'retention'];
 const STAGE_KEYS = ['access', 'allowedCidrs', 'mode'];
 const REHEARSAL_KEYS = [
+    'accountId',
     'completedAt',
+    'deploymentRoleArn',
     'evidenceDigest',
     'kind',
     'mode',
     'policyDigest',
+    'region',
     'schemaVersion',
     'stage',
     'status',
+    'wafContractDigest',
+    'workspace',
 ];
 const LIVE_EVIDENCE_KEYS = [
     'accountId',
     'completedAt',
+    'deploymentRoleArn',
     'distributionId',
     'kind',
     'mode',
@@ -55,16 +69,57 @@ const LIVE_EVIDENCE_KEYS = [
     'startedAt',
     'webAclArn',
     'webAclScope',
+    'wafContractDigest',
+    'workspace',
 ];
 const LIVE_PROBE_KEYS = [
     'allowedRequestStatus',
-    'blockedManagedRuleStatus',
-    'blockedNonAllowlistedStatus',
-    'blockedRateLimitStatus',
     'cloudWatchMetricsObserved',
     'countModeTuningObserved',
+    'managedRule',
+    'nonAllowlisted',
+    'rateLimit',
     'sampledRequestsObserved',
 ];
+const OPERATOR_BLOCK_KEYS = [
+    'blockedAt',
+    'marker',
+    'method',
+    'path',
+    'ruleName',
+    'status',
+];
+const RATE_EVIDENCE_KEYS = [
+    'blockedAt',
+    'blockedRequestStatus',
+    'blockedSequence',
+    'burstRequests',
+    'concurrency',
+    'followUpIntervalMs',
+    'followUpRequests',
+    'maximumRequests',
+    'metric',
+    'observationPolls',
+    'requestsSent',
+    'ruleMetricName',
+    'ruleName',
+    'sample',
+    'upstream429Responses',
+];
+const RATE_METRIC_KEYS = [
+    'name',
+    'namespace',
+    'timestamp',
+    'value',
+    'webAclMetricName',
+];
+const RATE_SAMPLE_KEYS = [
+    'action',
+    'markerDigest',
+    'method',
+    'timestamp',
+    'uri',
+];
 const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
 function record(value, label) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
@@ -94,6 +149,119 @@ function canonical(value) {
     }
     return encoded;
 }
+function integerInRange(value, minimum, maximum) {
+    return (typeof value === 'number' &&
+        Number.isSafeInteger(value) &&
+        value >= minimum &&
+        value <= maximum);
+}
+function sameUtcMinute(left, right) {
+    return Math.floor(left / 60_000) === Math.floor(right / 60_000);
+}
+function normalizeRouterWafRateEvidence(input) {
+    const candidate = record(input.value, 'Router WAF rate-limit evidence');
+    exactKeys(candidate, RATE_EVIDENCE_KEYS, 'Router WAF rate-limit evidence');
+    const metric = record(candidate.metric, 'Router WAF rate-limit metric evidence');
+    exactKeys(metric, RATE_METRIC_KEYS, 'Router WAF rate-limit metric evidence');
+    const sample = record(candidate.sample, 'Router WAF rate-limit sample evidence');
+    exactKeys(sample, RATE_SAMPLE_KEYS, 'Router WAF rate-limit sample evidence');
+    const blockedAt = typeof candidate.blockedAt === 'string'
+        ? Date.parse(candidate.blockedAt)
+        : Number.NaN;
+    const sampleAt = typeof sample.timestamp === 'string'
+        ? Date.parse(sample.timestamp)
+        : Number.NaN;
+    const metricAt = typeof metric.timestamp === 'string'
+        ? Date.parse(metric.timestamp)
+        : Number.NaN;
+    const expectedRuleMetricName = (0, router_waf_rate_rehearsal_js_1.routerWafRateRuleMetricName)(input.stage);
+    const expectedWebAclMetricName = input.webAclName;
+    const maximumBurst = Math.min(input.rateLimitPerIp + 160, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_REQUESTS -
+        router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_FOLLOW_UP_REQUESTS);
+    if (candidate.blockedRequestStatus !== 403 ||
+        !integerInRange(candidate.blockedSequence, 1, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_REQUESTS) ||
+        !Number.isFinite(blockedAt) ||
+        blockedAt < input.startedAt ||
+        blockedAt > input.completedAt ||
+        !integerInRange(candidate.burstRequests, 1, maximumBurst) ||
+        candidate.concurrency !== router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_CONCURRENCY ||
+        candidate.followUpIntervalMs !==
+            router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_FOLLOW_UP_INTERVAL_MS ||
+        !integerInRange(candidate.followUpRequests, 0, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_FOLLOW_UP_REQUESTS) ||
+        candidate.maximumRequests !== router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_REQUESTS ||
+        !integerInRange(candidate.observationPolls, 1, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_OBSERVATION_POLLS) ||
+        !integerInRange(candidate.requestsSent, 1, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_REQUESTS) ||
+        candidate.requestsSent !==
+            candidate.burstRequests + candidate.followUpRequests ||
+        candidate.blockedSequence > candidate.requestsSent ||
+        candidate.ruleName !== router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_RULE_NAME ||
+        candidate.ruleMetricName !== expectedRuleMetricName ||
+        !integerInRange(candidate.upstream429Responses, 0, candidate.requestsSent) ||
+        sample.action !== 'BLOCK' ||
+        typeof sample.markerDigest !== 'string' ||
+        !DIGEST_PATTERN.test(sample.markerDigest) ||
+        sample.method !== 'GET' ||
+        typeof sample.uri !== 'string' ||
+        !/^\/[a-z0-9]+(?:-[a-z0-9]+)*\/api\/health$/.test(sample.uri) ||
+        !Number.isFinite(sampleAt) ||
+        sampleAt < input.startedAt ||
+        sampleAt > input.completedAt ||
+        metric.name !== 'BlockedRequests' ||
+        metric.namespace !== 'AWS/WAFV2' ||
+        typeof expectedWebAclMetricName !== 'string' ||
+        metric.webAclMetricName !== expectedWebAclMetricName ||
+        typeof metric.value !== 'number' ||
+        !Number.isFinite(metric.value) ||
+        metric.value <= 0 ||
+        !Number.isFinite(metricAt) ||
+        !sameUtcMinute(sampleAt, metricAt)) {
+        throw new Error('Router WAF rate-limit evidence lacks one bounded exact RateLimitPerIP BLOCK sample and correlated AWS/WAFV2 metric.');
+    }
+    return candidate;
+}
+function canonicalIpv6(address, prefix) {
+    const halves = address.toLowerCase().split('::');
+    if (halves.length > 2)
+        return null;
+    const left = halves[0] ? halves[0].split(':') : [];
+    const right = halves[1] ? halves[1].split(':') : [];
+    if ([...left, ...right].some((part) => !/^[a-f0-9]{1,4}$/.test(part)) ||
+        (halves.length === 1 && left.length !== 8) ||
+        (halves.length === 2 && left.length + right.length >= 8)) {
+        return null;
+    }
+    const groups = [
+        ...left,
+        ...Array.from({ length: 8 - left.length - right.length }, () => '0'),
+        ...right,
+    ].map((part) => Number.parseInt(part, 16));
+    let numeric = groups.reduce((result, group) => (result << 16n) | BigInt(group), 0n);
+    numeric &= ((1n << BigInt(prefix)) - 1n) << BigInt(128 - prefix);
+    const network = Array.from({ length: 8 }, (_, index) => Number((numeric >> BigInt((7 - index) * 16)) & 0xffffn));
+    let bestStart = -1;
+    let bestLength = 0;
+    for (let index = 0; index < network.length;) {
+        if (network[index] !== 0) {
+            index += 1;
+            continue;
+        }
+        let end = index;
+        while (end < network.length && network[end] === 0)
+            end += 1;
+        if (end - index > bestLength && end - index >= 2) {
+            bestStart = index;
+            bestLength = end - index;
+        }
+        index = end;
+    }
+    const parts = network.map((group) => group.toString(16));
+    const rendered = bestStart === -1
+        ? parts.join(':')
+        : `${parts.slice(0, bestStart).join(':')}::${parts
+            .slice(bestStart + bestLength)
+            .join(':')}`;
+    return `${rendered}/${prefix}`;
+}
 function cidr(value, label) {
     if (typeof value !== 'string' || value !== value.trim()) {
         throw new Error(`${label} must be a canonical IPv4 or IPv6 CIDR.`);
@@ -106,12 +274,29 @@ function cidr(value, label) {
     const prefix = Number(match[2]);
     const family = (0, node_net_1.isIP)(address);
     if (family === 0 ||
+        prefix === 0 ||
         !Number.isInteger(prefix) ||
         (family === 4 && prefix > 32) ||
         (family === 6 && prefix > 128)) {
         throw new Error(`${label} must be a canonical IPv4 or IPv6 CIDR.`);
     }
-    return value;
+    let canonical = null;
+    if (family === 4) {
+        const octets = address.split('.').map(Number);
+        const numeric = octets.reduce((result, octet) => (result << 8) | octet, 0) >>> 0;
+        const mask = prefix === 32 ? 0xffffffff : (0xffffffff << (32 - prefix)) >>> 0;
+        const network = (numeric & mask) >>> 0;
+        canonical = `${[24, 16, 8, 0]
+            .map((shift) => (network >>> shift) & 255)
+            .join('.')}/${prefix}`;
+    }
+    else {
+        canonical = canonicalIpv6(address, prefix);
+    }
+    if (canonical !== value) {
+        throw new Error(`${label} must use its canonical network address.`);
+    }
+    return canonical;
 }
 function stagePolicy(value, stage) {
     const candidate = record(value, `Router WAF ${stage} policy`);
@@ -145,11 +330,16 @@ function normalizeRouterWafPolicy(value) {
         candidate.schemaVersion !== exports.ROUTER_WAF_SCHEMA_VERSION) {
         throw new Error('Router WAF policy kind or schemaVersion is invalid.');
     }
+    if (candidate.deploymentProfile !== 'starter' &&
+        candidate.deploymentProfile !== 'production-isolated' &&
+        candidate.deploymentProfile !== 'fully-isolated') {
+        throw new Error('Router WAF deploymentProfile is invalid.');
+    }
     if (typeof candidate.rateLimitPerIp !== 'number' ||
         !Number.isSafeInteger(candidate.rateLimitPerIp) ||
         candidate.rateLimitPerIp < 100 ||
-        candidate.rateLimitPerIp > 2_000_000_000) {
-        throw new Error('Router WAF rateLimitPerIp must be an integer from 100 through 2000000000.');
+        candidate.rateLimitPerIp > router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_RATE_LIMIT) {
+        throw new Error(`Router WAF rateLimitPerIp must be an integer from 100 through ${router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_RATE_LIMIT}, the exact bounded rehearsal maximum.`);
     }
     const logging = record(candidate.logging, 'Router WAF logging policy');
     exactKeys(logging, LOGGING_KEYS, 'Router WAF logging policy');
@@ -164,8 +354,11 @@ function normalizeRouterWafPolicy(value) {
         throw new Error('Router WAF logging retention is invalid or unbounded.');
     }
     const stages = record(candidate.stages, 'Router WAF stages');
-    exactKeys(stages, stages_js_1.FOUNDATION_STAGES, 'Router WAF stages');
+    const deploymentProfile = candidate.deploymentProfile;
+    const activeStages = (0, policy_js_1.activeDeploymentStages)(deploymentProfile);
+    exactKeys(stages, activeStages, 'Router WAF stages');
     return {
+        deploymentProfile,
         kind: exports.ROUTER_WAF_POLICY_KIND,
         logging: {
             enabled: logging.enabled,
@@ -176,7 +369,9 @@ function normalizeRouterWafPolicy(value) {
         stages: {
             development: stagePolicy(stages.development, 'development'),
             production: stagePolicy(stages.production, 'production'),
-            staging: stagePolicy(stages.staging, 'staging'),
+            ...(activeStages.includes('staging')
+                ? { staging: stagePolicy(stages.staging, 'staging') }
+                : {}),
         },
     };
 }
@@ -188,33 +383,69 @@ function normalizeRouterWafBlockingRehearsal(value) {
     if (candidate.status === 'pending') {
         exactKeys(candidate, ['kind', 'schemaVersion', 'status'], 'Pending Router WAF blocking rehearsal');
         if (candidate.kind !== exports.ROUTER_WAF_REHEARSAL_KIND ||
-            candidate.schemaVersion !== exports.ROUTER_WAF_SCHEMA_VERSION) {
+            candidate.schemaVersion !== exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION) {
             throw new Error('Pending Router WAF blocking rehearsal kind or schemaVersion is invalid.');
         }
         return null;
     }
     exactKeys(candidate, REHEARSAL_KEYS, 'Router WAF blocking rehearsal');
     if (candidate.kind !== exports.ROUTER_WAF_REHEARSAL_KIND ||
-        candidate.schemaVersion !== exports.ROUTER_WAF_SCHEMA_VERSION ||
+        candidate.schemaVersion !== exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION ||
         candidate.status !== 'passed' ||
-        candidate.stage !== 'staging' ||
+        (candidate.stage !== 'development' && candidate.stage !== 'staging') ||
         candidate.mode !== 'block' ||
+        typeof candidate.accountId !== 'string' ||
+        !/^\d{12}$/.test(candidate.accountId) ||
+        typeof candidate.region !== 'string' ||
+        !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(candidate.region) ||
+        typeof candidate.deploymentRoleArn !== 'string' ||
+        !new RegExp(`^arn:(?:aws|aws-us-gov):iam::${candidate.accountId}:role/[A-Za-z0-9+=,.@_/-]{1,512}$`).test(candidate.deploymentRoleArn) ||
+        typeof candidate.workspace !== 'string' ||
+        !/^[a-z0-9][a-z0-9-]{0,127}$/.test(candidate.workspace) ||
         typeof candidate.completedAt !== 'string' ||
         !Number.isFinite(Date.parse(candidate.completedAt)) ||
         typeof candidate.evidenceDigest !== 'string' ||
         !DIGEST_PATTERN.test(candidate.evidenceDigest) ||
         typeof candidate.policyDigest !== 'string' ||
-        !DIGEST_PATTERN.test(candidate.policyDigest)) {
+        !DIGEST_PATTERN.test(candidate.policyDigest) ||
+        typeof candidate.wafContractDigest !== 'string' ||
+        !DIGEST_PATTERN.test(candidate.wafContractDigest)) {
         throw new Error('Router WAF blocking rehearsal is invalid.');
     }
     return candidate;
 }
-function createRouterWafBlockingRehearsal(input) {
+function operatorBlockEvidence(input) {
+    const candidate = record(input.value, `Router WAF ${input.expected} operator evidence`);
+    exactKeys(candidate, OPERATOR_BLOCK_KEYS, `Router WAF ${input.expected} operator evidence`);
+    const blockedAt = typeof candidate.blockedAt === 'string'
+        ? Date.parse(candidate.blockedAt)
+        : Number.NaN;
+    const expectedRule = input.expected === 'nonallowlisted'
+        ? candidate.ruleName === 'StageIpAllowlist'
+        : candidate.ruleName ===
+            'AWSManagedRulesCommonRuleSet#NoUserAgent_HEADER';
+    if (candidate.status !== 403 ||
+        candidate.method !== 'GET' ||
+        typeof candidate.path !== 'string' ||
+        !/^\/[a-z0-9]+(?:-[a-z0-9]+)*\/api\/health$/.test(candidate.path) ||
+        typeof candidate.marker !== 'string' ||
+        !/^[a-f0-9]{64}:(?:managed|nonallowlisted)$/.test(candidate.marker) ||
+        !candidate.marker.endsWith(`:${input.expected}`) ||
+        !expectedRule ||
+        !Number.isFinite(blockedAt) ||
+        blockedAt < input.startedAt ||
+        blockedAt > input.completedAt) {
+        throw new Error(`Router WAF ${input.expected} operator evidence is not one bounded exact BLOCK request.`);
+    }
+    return candidate;
+}
+function validateRouterWafLiveEvidenceSeed(input) {
     const evidence = record(input.evidence, 'Router WAF live evidence');
     exactKeys(evidence, LIVE_EVIDENCE_KEYS, 'Router WAF live evidence');
     const probes = record(evidence.probes, 'Router WAF live evidence probes');
     exactKeys(probes, LIVE_PROBE_KEYS, 'Router WAF live evidence probes');
     const policyDigest = routerWafPolicyDigest(input.policy);
+    const wafContractDigest = routerWafContractDigest(input.policy);
     const startedAt = typeof evidence.startedAt === 'string'
         ? Date.parse(evidence.startedAt)
         : Number.NaN;
@@ -226,26 +457,37 @@ function createRouterWafBlockingRehearsal(input) {
         'RateLimitPerIP',
         ...exports.ROUTER_WAF_REQUIRED_MANAGED_RULES,
     ];
-    if (input.policy.stages.staging.mode !== 'block' ||
-        input.policy.stages.staging.access !== 'allowlist' ||
-        input.policy.stages.staging.allowedCidrs.length === 0 ||
+    const rehearsalStage = (0, policy_js_1.productionRehearsalStage)(input.policy.deploymentProfile);
+    const rehearsalStagePolicy = input.policy.stages[rehearsalStage];
+    const webAclIdentity = typeof evidence.webAclArn === 'string'
+        ? /^arn:(?:aws|aws-us-gov):wafv2:us-east-1:(\d{12}):global\/webacl\/([A-Za-z0-9_-]{1,128})\/[a-f0-9-]{36}$/.exec(evidence.webAclArn)
+        : null;
+    if (!rehearsalStagePolicy ||
+        rehearsalStagePolicy.mode !== 'block' ||
+        rehearsalStagePolicy.access !== 'allowlist' ||
+        rehearsalStagePolicy.allowedCidrs.length === 0 ||
         evidence.kind !== 'ebk-router-waf-live-evidence' ||
-        evidence.schemaVersion !== exports.ROUTER_WAF_SCHEMA_VERSION ||
-        evidence.stage !== 'staging' ||
+        evidence.schemaVersion !== exports.ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION ||
+        evidence.stage !== rehearsalStage ||
         evidence.mode !== 'block' ||
         evidence.result !== 'passed' ||
         evidence.webAclScope !== 'CLOUDFRONT' ||
         evidence.policyDigest !== policyDigest ||
+        evidence.wafContractDigest !== wafContractDigest ||
         typeof evidence.accountId !== 'string' ||
         !/^\d{12}$/.test(evidence.accountId) ||
+        typeof evidence.deploymentRoleArn !== 'string' ||
+        !new RegExp(`^arn:(?:aws|aws-us-gov):iam::${evidence.accountId}:role/[A-Za-z0-9+=,.@_/-]{1,512}$`).test(evidence.deploymentRoleArn) ||
         typeof evidence.region !== 'string' ||
         !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(evidence.region) ||
         typeof evidence.sourceCommit !== 'string' ||
-        !/^[a-f0-9]{40}$/.test(evidence.sourceCommit) ||
+        !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(evidence.sourceCommit) ||
+        typeof evidence.workspace !== 'string' ||
+        !/^[a-z0-9][a-z0-9-]{0,127}$/.test(evidence.workspace) ||
         typeof evidence.distributionId !== 'string' ||
         !/^[A-Z0-9]{8,32}$/.test(evidence.distributionId) ||
-        typeof evidence.webAclArn !== 'string' ||
-        !new RegExp(`^arn:(?:aws|aws-us-gov):wafv2:us-east-1:${evidence.accountId}:global/webacl/[A-Za-z0-9_-]{1,128}/[a-f0-9-]{36}$`).test(evidence.webAclArn) ||
+        !webAclIdentity ||
+        webAclIdentity[1] !== evidence.accountId ||
         !Number.isFinite(startedAt) ||
         !Number.isFinite(completedAt) ||
         completedAt < startedAt ||
@@ -255,26 +497,77 @@ function createRouterWafBlockingRehearsal(input) {
         typeof probes.allowedRequestStatus !== 'number' ||
         probes.allowedRequestStatus < 200 ||
         probes.allowedRequestStatus > 399 ||
-        probes.blockedManagedRuleStatus !== 403 ||
-        probes.blockedNonAllowlistedStatus !== 403 ||
-        probes.blockedRateLimitStatus !== 403 ||
         probes.cloudWatchMetricsObserved !== true ||
-        probes.countModeTuningObserved !== true ||
+        typeof probes.countModeTuningObserved !== 'boolean' ||
         probes.sampledRequestsObserved !== true) {
-        throw new Error('Router WAF live evidence does not prove the exact staging blocking baseline.');
+        throw new Error(`Router WAF live evidence does not prove the exact ${rehearsalStage} blocking baseline.`);
     }
+    operatorBlockEvidence({
+        completedAt,
+        expected: 'managed',
+        startedAt,
+        value: probes.managedRule,
+    });
+    operatorBlockEvidence({
+        completedAt,
+        expected: 'nonallowlisted',
+        startedAt,
+        value: probes.nonAllowlisted,
+    });
+    return {
+        accountId: evidence.accountId,
+        completedAt,
+        deploymentRoleArn: evidence.deploymentRoleArn,
+        distributionId: evidence.distributionId,
+        probes,
+        region: evidence.region,
+        stage: rehearsalStage,
+        startedAt,
+        wafContractDigest,
+        webAclArn: evidence.webAclArn,
+        webAclName: webAclIdentity[2],
+        workspace: evidence.workspace,
+    };
+}
+function createRouterWafBlockingRehearsal(input) {
+    const seed = validateRouterWafLiveEvidenceSeed(input);
+    const evidence = input.evidence;
+    let rateLimitEvidence;
+    try {
+        rateLimitEvidence = normalizeRouterWafRateEvidence({
+            completedAt: seed.completedAt,
+            rateLimitPerIp: input.policy.rateLimitPerIp,
+            stage: seed.stage,
+            startedAt: seed.startedAt,
+            value: seed.probes.rateLimit,
+            webAclName: seed.webAclName,
+        });
+    }
+    catch {
+        throw new Error(`Router WAF live evidence does not prove the exact ${seed.stage} blocking baseline.`);
+    }
+    if (rateLimitEvidence.blockedRequestStatus !== 403) {
+        throw new Error(`Router WAF live evidence does not prove the exact ${seed.stage} blocking baseline.`);
+    }
+    const policyDigest = routerWafPolicyDigest(input.policy);
+    const authorityEvidence = { ...evidence };
     const evidenceDigest = `sha256:${(0, node_crypto_1.createHash)('sha256')
-        .update(canonical(evidence))
+        .update(canonical(authorityEvidence))
         .digest('hex')}`;
     return {
+        accountId: seed.accountId,
         completedAt: evidence.completedAt,
+        deploymentRoleArn: seed.deploymentRoleArn,
         evidenceDigest,
         kind: exports.ROUTER_WAF_REHEARSAL_KIND,
         mode: 'block',
         policyDigest,
-        schemaVersion: exports.ROUTER_WAF_SCHEMA_VERSION,
-        stage: 'staging',
+        region: seed.region,
+        schemaVersion: exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION,
+        stage: seed.stage,
         status: 'passed',
+        wafContractDigest: seed.wafContractDigest,
+        workspace: seed.workspace,
     };
 }
 function reconcileRouterWafBlockingRehearsal(input) {
@@ -285,6 +578,18 @@ function reconcileRouterWafBlockingRehearsal(input) {
         evidence: input.evidence,
         policy: input.policy,
     });
+    for (const key of [
+        'accountId',
+        'deploymentRoleArn',
+        'region',
+        'stage',
+        'wafContractDigest',
+        'workspace',
+    ]) {
+        if (observed[key] !== input.expected[key]) {
+            throw new Error(`Router WAF blocking rehearsal ${key} does not match committed production reconciliation authority.`);
+        }
+    }
     if (canonical(retained) !== canonical(observed)) {
         throw new Error('Router WAF blocking rehearsal receipt does not match its exact live evidence.');
     }
@@ -292,7 +597,13 @@ function reconcileRouterWafBlockingRehearsal(input) {
 }
 function createRouterWafStagePlan(input) {
     const stage = (0, stages_js_1.requireFoundationStage)(input.stage);
+    if (!(0, policy_js_1.isActiveDeploymentStage)(input.policy.deploymentProfile, stage)) {
+        throw new Error(`Router WAF stage ${stage} is inactive for the ${input.policy.deploymentProfile} deployment profile.`);
+    }
     const stagePolicy = input.policy.stages[stage];
+    if (!stagePolicy) {
+        throw new Error(`Router WAF ${stage} policy is missing.`);
+    }
     const policyDigest = routerWafPolicyDigest(input.policy);
     if (stagePolicy.access === 'allowlist' &&
         stagePolicy.allowedCidrs.length === 0) {
@@ -302,8 +613,11 @@ function createRouterWafStagePlan(input) {
         if (stagePolicy.mode !== 'block') {
             throw new Error('Production Router WAF must deploy in blocking mode.');
         }
-        if (!input.rehearsal || input.rehearsal.policyDigest !== policyDigest) {
-            throw new Error('Production Router WAF requires a passed staging blocking rehearsal for the exact policy digest.');
+        if (!input.rehearsal ||
+            input.rehearsal.policyDigest !== policyDigest ||
+            input.rehearsal.wafContractDigest !==
+                routerWafContractDigest(input.policy)) {
+            throw new Error(`Production Router WAF requires a passed ${(0, policy_js_1.productionRehearsalStage)(input.policy.deploymentProfile)} blocking rehearsal for the exact policy digest.`);
         }
     }
     return {
@@ -398,4 +712,85 @@ function createRouterWafRules(plan, ipSets) {
     }
     return rules;
 }
+function contractStagePlan(policy, stage) {
+    const stagePolicy = policy.stages[stage];
+    if (!stagePolicy) {
+        throw new Error(`Router WAF ${stage} contract policy is missing.`);
+    }
+    return {
+        access: stagePolicy.access,
+        ipv4Cidrs: stagePolicy.allowedCidrs.filter((value) => (0, node_net_1.isIP)(value.split('/')[0] ?? '') === 4),
+        ipv6Cidrs: stagePolicy.allowedCidrs.filter((value) => (0, node_net_1.isIP)(value.split('/')[0] ?? '') === 6),
+        logging: policy.logging.enabled
+            ? {
+                include: 'blocked',
+                redact: {
+                    headers: ['authorization', 'cookie', 'x-api-key'],
+                    queryString: true,
+                },
+                retention: policy.logging.retention,
+            }
+            : false,
+        mode: stagePolicy.mode,
+        policyDigest: routerWafPolicyDigest(policy),
+        rateLimitPerIp: policy.rateLimitPerIp,
+        stage,
+    };
+}
+function routerWafContractDigest(policy) {
+    const stages = (0, policy_js_1.activeDeploymentStages)(policy.deploymentProfile).map((stage) => {
+        const plan = contractStagePlan(policy, stage);
+        return {
+            plan,
+            rules: createRouterWafRules(plan, {
+                ...(plan.ipv4Cidrs.length > 0
+                    ? { ipv4Arn: `<ipv4-ip-set:${stage}>` }
+                    : {}),
+                ...(plan.ipv6Cidrs.length > 0
+                    ? { ipv6Arn: `<ipv6-ip-set:${stage}>` }
+                    : {}),
+            }),
+        };
+    });
+    const implementation = {
+        cloudFront: {
+            enabled: true,
+            identityTags: [
+                'ebk:managed-by',
+                'ebk:owner',
+                'ebk:stage',
+                'ebk:workspace',
+            ],
+            staging: false,
+            webAclAttachment: 'exact-arn',
+        },
+        evidenceSchemaVersion: exports.ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION,
+        kind: 'ebk-router-waf-generated-contract',
+        receiptSchemaVersion: exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION,
+        schemaVersion: exports.ROUTER_WAF_CONTRACT_SCHEMA_VERSION,
+        stages,
+        webAcl: {
+            defaultAction: 'allow',
+            identityTags: [
+                'ebk:managed-by',
+                'ebk:owner',
+                'ebk:policy-digest',
+                'ebk:stage',
+                'ebk:workspace',
+            ],
+            ipSetTags: [
+                'ebk:managed-by',
+                'ebk:owner',
+                'ebk:policy-digest',
+                'ebk:stage',
+                'ebk:workspace',
+            ],
+            logging: policy.logging,
+            scope: 'CLOUDFRONT',
+        },
+    };
+    return `sha256:${(0, node_crypto_1.createHash)('sha256')
+        .update(canonical({ implementation, policy }))
+        .digest('hex')}`;
+}
 //# sourceMappingURL=router-waf.js.map