@empire-builder-kit/nx 1.0.0-rc.32 → 1.0.0-rc.34

package/src/foundation/private-smoke-access.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGithubPrivateSmoke = runGithubPrivateSmoke;
+exports.cleanupGithubPrivateSmoke = cleanupGithubPrivateSmoke;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const router_waf_js_1 = require("./router-waf.js");
+const private_smoke_control_plane_js_1 = require("./private-smoke-control-plane.js");
+const private_smoke_admission_js_1 = require("./private-smoke-admission.js");
+function check(condition, message) {
+    if (!condition)
+        throw new Error(`Private smoke access: ${message}`);
+}
+/** Called only inside the source/role-verified protected stage lifecycle. */
+async function runGithubPrivateSmoke(input, dependencies = {}) {
+    return privateSmokeOperation(input, dependencies, false);
+}
+/** Generated protected workflow finalizer. It can only remove an exact admission. */
+async function cleanupGithubPrivateSmoke(input, dependencies = {}) {
+    return privateSmokeOperation({ ...input, url: '', run: async () => undefined }, dependencies, true);
+}
+async function privateSmokeOperation(input, dependencies, cleanupOnly) {
+    const environment = dependencies.environment ?? process.env;
+    const request = dependencies.fetch ?? fetch;
+    const policy = (0, router_waf_js_1.normalizeRouterWafPolicy)(JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(input.root, 'packages/foundation/security/router-waf.json'), 'utf8')));
+    check(policy.deploymentProfile === input.deploymentProfile, 'WAF deployment profile differs from repository policy');
+    const stagePolicy = policy.stages[input.stage];
+    check(stagePolicy, 'inactive WAF stage');
+    if (stagePolicy.access === 'public' || stagePolicy.mode === 'count') {
+        await input.run();
+        return;
+    }
+    const baseline = stagePolicy.allowedCidrs.filter((cidr) => !cidr.includes(':'));
+    check(baseline.length > 0, 'private hosted smoke requires a committed IPv4 baseline');
+    const repository = environment.GITHUB_REPOSITORY ?? '';
+    const ref = `refs/heads/${input.stage === 'production' ? 'main' : 'develop'}`;
+    const workflow = `${repository}/.github/workflows/deploy.yml@${ref}`;
+    check(environment.GITHUB_ACTIONS === 'true' &&
+        /^[\w.-]+\/[\w.-]+$/.test(repository) &&
+        environment.GITHUB_REF === ref &&
+        environment.GITHUB_SHA === input.source &&
+        environment.EBK_GITHUB_JOB_WORKFLOW_REF === workflow &&
+        ((environment.GITHUB_EVENT_NAME === 'workflow_dispatch' &&
+            environment.GITHUB_WORKFLOW_REF === workflow) ||
+            (environment.GITHUB_EVENT_NAME === 'push' &&
+                input.deploymentProfile !== 'starter' &&
+                environment.GITHUB_WORKFLOW_REF ===
+                    `${repository}/.github/workflows/ci.yml@${ref}`)), 'exact protected deployment workflow/source required');
+    const run = environment.GITHUB_RUN_ID ?? '';
+    const attempt = environment.GITHUB_RUN_ATTEMPT ?? '';
+    check(/^[1-9]\d*$/.test(run) &&
+        /^[1-9]\d*$/.test(attempt) &&
+        /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(input.source), 'invalid protected invocation identity');
+    const store = await (dependencies.open ?? private_smoke_control_plane_js_1.openPrivateSmokeControlPlane)({
+        account: input.account,
+        stage: input.stage,
+        workspace: input.workspace,
+        policyDigest: (0, router_waf_js_1.routerWafPolicyDigest)(policy),
+    }, cleanupOnly ? undefined : input.url);
+    await (0, private_smoke_admission_js_1.recoverSmokeAdmission)(store, baseline, async (lease) => {
+        // An old attempt of this run can be recovered only after GitHub confirms it ended.
+        if (lease.run === run && lease.attempt === attempt)
+            return cleanupOnly && lease.source === input.source;
+        const token = environment.GITHUB_TOKEN;
+        check(token, 'stale admission requires actions:read to confirm the exact prior run completed');
+        const response = await request(`https://api.github.com/repos/${repository}/actions/runs/${lease.run}/attempts/${lease.attempt}`, {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/vnd.github+json',
+            },
+            redirect: 'error',
+            signal: AbortSignal.timeout(15_000),
+        });
+        check(response.ok, 'prior workflow status unavailable; admission retained for protected recovery');
+        const prior = (await response.json());
+        const headRepository = prior.head_repository;
+        return (String(prior.id) === lease.run &&
+            String(prior.run_attempt) === lease.attempt &&
+            prior.status === 'completed' &&
+            prior.head_sha === lease.source &&
+            prior.head_branch === ref.slice('refs/heads/'.length) &&
+            headRepository?.full_name === repository &&
+            ((prior.path === '.github/workflows/deploy.yml' &&
+                prior.event === 'workflow_dispatch') ||
+                (input.deploymentProfile !== 'starter' &&
+                    prior.path === '.github/workflows/ci.yml' &&
+                    prior.event === 'push')));
+    });
+    if (cleanupOnly)
+        return;
+    const ipResponse = await request('https://checkip.amazonaws.com', {
+        redirect: 'error',
+        signal: AbortSignal.timeout(15_000),
+    });
+    check(ipResponse.ok, 'runner IPv4 lookup failed');
+    const address = await ipResponse.text();
+    check(address.length <= 64, 'runner IPv4 response exceeds bound');
+    const cidr = (0, private_smoke_admission_js_1.publicRunnerIpv4)(address.trim());
+    const wait = dependencies.wait ??
+        ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    async function observe(allowed) {
+        for (let poll = 0; poll < 24; poll += 1) {
+            const response = await request(input.url, {
+                redirect: 'manual',
+                signal: AbortSignal.timeout(15_000),
+            });
+            // Do not consume or retain an application response body.
+            await response.body?.cancel();
+            if (allowed
+                ? response.status >= 200 && response.status < 400
+                : response.status === 403)
+                return;
+            if (poll < 23)
+                await wait(5_000);
+        }
+        throw new Error(`Private smoke access: ${allowed ? 'admission' : 'revocation'} was not observed; deployment acceptance prohibited`);
+    }
+    await (0, private_smoke_admission_js_1.withPrivateSmokeAdmission)({
+        store,
+        context: { run, attempt, source: input.source, baseline },
+        cidr,
+        run: input.run,
+        awaitAdmission: () => observe(true),
+        awaitRevocation: () => observe(false),
+    });
+}
+//# sourceMappingURL=private-smoke-access.js.map

package/src/foundation/private-smoke-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-smoke-access.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/private-smoke-access.ts"],"names":[],"mappings":";;AA0CA,sDAKC;AAGD,8DASC;AA3DD,qCAAuC;AACvC,yCAAiC;AAEjC,mDAGyB;AACzB,qFAAgF;AAChF,6EAKsC;AAwBtC,SAAS,KAAK,CAAC,SAAkB,EAAE,OAAe;IAChD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,qBAAqB,CACzC,KAA8B,EAC9B,eAAyC,EAAE;IAE3C,OAAO,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,yBAAyB,CAC7C,KAAmD,EACnD,eAAyC,EAAE;IAE3C,OAAO,qBAAqB,CAC1B,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,EACjD,YAAY,EACZ,IAAI,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAA8B,EAC9B,YAAsC,EACtC,WAAoB;IAEpB,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAA,wCAAwB,EACrC,IAAI,CAAC,KAAK,CACR,IAAA,sBAAY,EACV,IAAA,gBAAI,EAAC,KAAK,CAAC,IAAI,EAAE,8CAA8C,CAAC,EAChE,MAAM,CACP,CACF,CACF,CAAC;IACF,KAAK,CACH,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,EACpD,uDAAuD,CACxD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAC9C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC9B,CAAC;IACF,KAAK,CACH,QAAQ,CAAC,MAAM,GAAG,CAAC,EACnB,yDAAyD,CAC1D,CAAC;IACF,MAAM,UAAU,GAAG,WAAW,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,cAAc,KAAK,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG,UAAU,iCAAiC,GAAG,EAAE,CAAC;IACrE,KAAK,CACH,WAAW,CAAC,cAAc,KAAK,MAAM;QACnC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC;QACrC,WAAW,CAAC,UAAU,KAAK,GAAG;QAC9B,WAAW,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM;QACvC,WAAW,CAAC,2BAA2B,KAAK,QAAQ;QACpD,CAAC,CAAC,WAAW,CAAC,iBAAiB,KAAK,mBAAmB;YACrD,WAAW,CAAC,mBAAmB,KAAK,QAAQ,CAAC;YAC7C,CAAC,WAAW,CAAC,iBAAiB,KAAK,MAAM;gBACvC,KAAK,CAAC,iBAAiB,KAAK,SAAS;gBACrC,WAAW,CAAC,mBAAmB;oBAC7B,GAAG,UAAU,6BAA6B,GAAG,EAAE,CAAC,CAAC,EACzD,qDAAqD,CACtD,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACrD,KAAK,CACH,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1B,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EACtD,uCAAuC,CACxC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI,6DAA4B,CAAC,CACrE;QACE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,IAAA,qCAAqB,EAAC,MAAM,CAAC;KAC5C,EACD,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CACpC,CAAC;IACF,MAAM,IAAA,kDAAqB,EACzB,KAAK,EACL,QAAQ,EACR,KAAK,EAAE,KAA0B,EAAE,EAAE;QACnC,mFAAmF;QACnF,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;YAChD,OAAO,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;QACtD,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC;QACvC,KAAK,CACH,KAAK,EACL,gFAAgF,CACjF,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,gCAAgC,UAAU,iBAAiB,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,OAAO,EAAE,EAChG;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,6BAA6B;aACtC;YACD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CACF,CAAC;QACF,KAAK,CACH,QAAQ,CAAC,EAAE,EACX,8EAA8E,CAC/E,CAAC;QACF,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACjE,MAAM,cAAc,GAAG,KAAK,CAAC,eACO,CAAC;QACrC,OAAO,CACL,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,GAAG;YAC9B,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,OAAO;YAC3C,KAAK,CAAC,MAAM,KAAK,WAAW;YAC5B,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM;YAC/B,KAAK,CAAC,WAAW,KAAK,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC;YACrD,cAAc,EAAE,SAAS,KAAK,UAAU;YACxC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,8BAA8B;gBAC7C,KAAK,CAAC,KAAK,KAAK,mBAAmB,CAAC;gBACpC,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;oBACpC,KAAK,CAAC,IAAI,KAAK,0BAA0B;oBACzC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAC7B,CAAC;IACJ,CAAC,CACF,CAAC;IACF,IAAI,WAAW;QAAE,OAAO;IACxB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,+BAA+B,EAAE;QAChE,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;IACxC,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAA,6CAAgB,EAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GACR,YAAY,CAAC,IAAI;QACjB,CAAC,CAAC,YAAoB,EAAE,EAAE,CACxB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACvE,KAAK,UAAU,OAAO,CAAC,OAAgB;QACrC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACxC,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,yDAAyD;YACzD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,IACE,OAAO;gBACL,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;gBACjD,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAE3B,OAAO;YACT,IAAI,IAAI,GAAG,EAAE;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yBAAyB,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,qDAAqD,CACnH,CAAC;IACJ,CAAC;IACD,MAAM,IAAA,sDAAyB,EAAC;QAC9B,KAAK;QACL,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE;QACzD,IAAI;QACJ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACnC,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACtC,CAAC,CAAC;AACL,CAAC"}

package/src/foundation/private-smoke-admission.d.ts

@@ -0,0 +1,43 @@
+export interface SmokeAdmissionContext {
+    run: string;
+    attempt: string;
+    source: string;
+    baseline: readonly string[];
+}
+export interface SmokeIpSet {
+    addresses: readonly string[];
+    description: string;
+    lockToken: string;
+}
+export interface SmokeIpSetStore {
+    read(): Promise<SmokeIpSet>;
+    update(previous: SmokeIpSet, next: Pick<SmokeIpSet, 'addresses' | 'description'>): Promise<void>;
+}
+export interface SmokeAdmissionLease {
+    run: string;
+    attempt: string;
+    source: string;
+    cidr: string;
+    baseline: string;
+    expiresAt: number;
+}
+export declare function runnerAlreadyAllowed(cidr: string, baseline: readonly string[]): boolean;
+export declare function publicRunnerIpv4(value: string): string;
+export declare function parseSmokeAdmissionLease(description: string): SmokeAdmissionLease | undefined;
+/** Remove only this lease's address. Never replace unrelated addresses with a baseline. */
+export declare function cleanupSmokeAdmission(store: SmokeIpSetStore, context: SmokeAdmissionContext): Promise<void>;
+/** A retained lease alone, or its expiry, is not proof that a different run ended. */
+export declare function recoverSmokeAdmission(store: SmokeIpSetStore, baseline: readonly string[], completedRun: (lease: SmokeAdmissionLease) => Promise<boolean>): Promise<void>;
+export declare function withPrivateSmokeAdmission<T>(input: {
+    store: SmokeIpSetStore;
+    context: SmokeAdmissionContext;
+    cidr: string;
+    run: () => Promise<T>;
+    awaitAdmission: () => Promise<void>;
+    awaitRevocation: () => Promise<void>;
+    now?: () => number;
+    signals?: {
+        on(event: 'SIGINT' | 'SIGTERM', listener: () => void): unknown;
+        removeListener(event: 'SIGINT' | 'SIGTERM', listener: () => void): unknown;
+    };
+}): Promise<T>;

package/src/foundation/private-smoke-admission.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runnerAlreadyAllowed = runnerAlreadyAllowed;
+exports.publicRunnerIpv4 = publicRunnerIpv4;
+exports.parseSmokeAdmissionLease = parseSmokeAdmissionLease;
+exports.cleanupSmokeAdmission = cleanupSmokeAdmission;
+exports.recoverSmokeAdmission = recoverSmokeAdmission;
+exports.withPrivateSmokeAdmission = withPrivateSmokeAdmission;
+const node_crypto_1 = require("node:crypto");
+const node_net_1 = require("node:net");
+const prefix = 'ebk-smoke-v1:';
+const sorted = (values) => [...values].sort();
+const same = (a, b) => JSON.stringify(sorted(a)) === JSON.stringify(sorted(b));
+const baselineDigest = (values) => (0, node_crypto_1.createHash)('sha256')
+    .update(JSON.stringify(sorted(values)))
+    .digest('hex');
+function requireCondition(condition, message) {
+    if (!condition)
+        throw new Error(`Private smoke access: ${message}`);
+}
+function runnerAlreadyAllowed(cidr, baseline) {
+    const address = cidr.replace(/\/32$/, '');
+    requireCondition(cidr === publicRunnerIpv4(address), 'admission is not an exact /32');
+    const numeric = (ip) => ip.split('.').reduce((value, octet) => value * 256 + Number(octet), 0) >>>
+        0;
+    return baseline.some((entry) => {
+        const [network, bits] = entry.split('/');
+        requireCondition((0, node_net_1.isIP)(network) === 4 && /^(?:[0-9]|[12][0-9]|3[0-2])$/.test(bits), 'invalid IPv4 baseline');
+        const mask = Number(bits) === 0 ? 0 : (0xffffffff << (32 - Number(bits))) >>> 0;
+        return (numeric(address) & mask) === (numeric(network) & mask);
+    });
+}
+function publicRunnerIpv4(value) {
+    requireCondition((0, node_net_1.isIP)(value) === 4, 'one exact public IPv4 runner address is required');
+    const [a, b] = value.split('.').map(Number);
+    requireCondition(a > 0 &&
+        a < 224 &&
+        a !== 10 &&
+        a !== 127 &&
+        !(a === 169 && b === 254) &&
+        !(a === 172 && b >= 16 && b <= 31) &&
+        !(a === 192 && b === 168) &&
+        !(a === 100 && b >= 64 && b <= 127) &&
+        !(a === 198 && (b === 18 || b === 19)), 'non-public runner address refused');
+    return `${value}/32`;
+}
+function parseSmokeAdmissionLease(description) {
+    if (description === '')
+        return undefined;
+    requireCondition(description.startsWith(prefix) && description.length <= 256, 'unrecognized IP-set description; do not overwrite it');
+    const parts = description.slice(prefix.length).split(',');
+    requireCondition(parts.length === 6, 'malformed admission lease');
+    const [run, attempt, source, cidr, baseline, expires] = parts;
+    requireCondition(/^[1-9][0-9]*$/.test(run) &&
+        /^[1-9][0-9]*$/.test(attempt) &&
+        /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(source) &&
+        /^[a-f0-9]{64}$/.test(baseline) &&
+        /^[0-9]{13}$/.test(expires), 'malformed admission identity');
+    requireCondition(cidr === publicRunnerIpv4(cidr.replace(/\/32$/, '')), 'admission is not an exact /32');
+    return { run, attempt, source, cidr, baseline, expiresAt: Number(expires) };
+}
+function belongsTo(lease, context) {
+    return (lease.run === context.run &&
+        lease.attempt === context.attempt &&
+        lease.source === context.source);
+}
+/** Remove only this lease's address. Never replace unrelated addresses with a baseline. */
+async function cleanupSmokeAdmission(store, context) {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const before = await store.read();
+        const lease = parseSmokeAdmissionLease(before.description);
+        if (!lease) {
+            requireCondition(same(before.addresses, context.baseline), 'allowlist differs from committed baseline; cleanup unproved');
+            return;
+        }
+        requireCondition(belongsTo(lease, context), 'another run owns the admission; use protected stale recovery');
+        requireCondition(lease.baseline === baselineDigest(context.baseline) &&
+            !context.baseline.includes(lease.cidr), 'lease baseline changed; investigate without deleting');
+        try {
+            await store.update(before, {
+                addresses: before.addresses.filter((cidr) => cidr !== lease.cidr),
+                description: '',
+            });
+        }
+        catch {
+            // An update may have succeeded remotely. Read back before retrying it.
+        }
+        const after = await store.read();
+        if (!after.description && !after.addresses.includes(lease.cidr)) {
+            requireCondition(same(after.addresses, context.baseline), 'temporary admission removed but unrelated allowlist drift remains');
+            return;
+        }
+    }
+    throw new Error('Private smoke access: cleanup unproved; deployment acceptance is prohibited. Run protected smoke-access cleanup before retrying.');
+}
+/** A retained lease alone, or its expiry, is not proof that a different run ended. */
+async function recoverSmokeAdmission(store, baseline, completedRun) {
+    const current = await store.read();
+    const lease = parseSmokeAdmissionLease(current.description);
+    if (!lease) {
+        requireCondition(same(current.addresses, baseline), 'unleased allowlist drift requires investigation');
+        return;
+    }
+    requireCondition(lease.baseline === baselineDigest(baseline), 'stale lease baseline differs from committed policy');
+    requireCondition(await completedRun(lease), 'prior admission run is not confirmed complete');
+    await cleanupSmokeAdmission(store, { ...lease, baseline });
+}
+async function withPrivateSmokeAdmission(input) {
+    const { store, context, cidr } = input;
+    requireCondition(cidr === publicRunnerIpv4(cidr.replace(/\/32$/, '')), 'admission is not an exact /32');
+    const before = await store.read();
+    requireCondition(!parseSmokeAdmissionLease(before.description), 'recover the existing admission before starting smoke');
+    requireCondition(same(before.addresses, context.baseline), 'live allowlist differs from committed baseline');
+    const alreadyAllowed = runnerAlreadyAllowed(cidr, context.baseline);
+    const description = prefix +
+        [
+            context.run,
+            context.attempt,
+            context.source,
+            cidr,
+            baselineDigest(context.baseline),
+            (input.now ?? Date.now)() + 40 * 60_000,
+        ].join(',');
+    parseSmokeAdmissionLease(description);
+    const signals = input.signals ?? process;
+    let interrupted = false;
+    const stop = () => {
+        interrupted = true;
+    };
+    signals.on('SIGINT', stop);
+    signals.on('SIGTERM', stop);
+    try {
+        if (!alreadyAllowed)
+            await store.update(before, {
+                addresses: sorted([...context.baseline, cidr]),
+                description,
+            });
+        const after = await store.read();
+        requireCondition(same(after.addresses, alreadyAllowed ? context.baseline : [...context.baseline, cidr]) && after.description === (alreadyAllowed ? '' : description), 'admission readback differs');
+        await input.awaitAdmission();
+        requireCondition(!interrupted, 'interrupted before smoke');
+        const result = await input.run();
+        requireCondition(!interrupted, 'smoke interrupted');
+        return result;
+    }
+    finally {
+        try {
+            await cleanupSmokeAdmission(store, context);
+            if (!alreadyAllowed)
+                await input.awaitRevocation();
+        }
+        finally {
+            signals.removeListener('SIGINT', stop);
+            signals.removeListener('SIGTERM', stop);
+        }
+    }
+}
+//# sourceMappingURL=private-smoke-admission.js.map

package/src/foundation/private-smoke-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-smoke-admission.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/private-smoke-admission.ts"],"names":[],"mappings":";;AA6CA,oDAsBC;AAED,4CAmBC;AAED,4DAwBC;AAcD,sDA2CC;AAGD,sDAuBC;AAED,8DA0EC;AAjRD,6CAAyC;AACzC,uCAAgC;AA6BhC,MAAM,MAAM,GAAG,eAAe,CAAC;AAC/B,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AACjE,MAAM,IAAI,GAAG,CAAC,CAAoB,EAAE,CAAoB,EAAE,EAAE,CAC1D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,MAAM,cAAc,GAAG,CAAC,MAAyB,EAAE,EAAE,CACnD,IAAA,wBAAU,EAAC,QAAQ,CAAC;KACjB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;KACtC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,SAAS,gBAAgB,CACvB,SAAkB,EAClB,OAAe;IAEf,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAgB,oBAAoB,CAClC,IAAY,EACZ,QAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1C,gBAAgB,CACd,IAAI,KAAK,gBAAgB,CAAC,OAAO,CAAC,EAClC,+BAA+B,CAChC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CAC7B,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC;IACJ,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,gBAAgB,CACd,IAAA,eAAI,EAAC,OAAO,CAAC,KAAK,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAChE,uBAAuB,CACxB,CAAC;QACF,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,gBAAgB,CACd,IAAA,eAAI,EAAC,KAAK,CAAC,KAAK,CAAC,EACjB,kDAAkD,CACnD,CAAC;IACF,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,gBAAgB,CACd,CAAC,GAAG,CAAC;QACH,CAAC,GAAG,GAAG;QACP,CAAC,KAAK,EAAE;QACR,CAAC,KAAK,GAAG;QACT,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACzB,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACzB,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;QACnC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EACxC,mCAAmC,CACpC,CAAC;IACF,OAAO,GAAG,KAAK,KAAK,CAAC;AACvB,CAAC;AAED,SAAgB,wBAAwB,CACtC,WAAmB;IAEnB,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACzC,gBAAgB,CACd,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,IAAI,GAAG,EAC3D,sDAAsD,CACvD,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,gBAAgB,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAC9D,gBAAgB,CACd,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7B,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9C,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/B,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC7B,8BAA8B,CAC/B,CAAC;IACF,gBAAgB,CACd,IAAI,KAAK,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EACpD,+BAA+B,CAChC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAChB,KAA0B,EAC1B,OAA8B;IAE9B,OAAO,CACL,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QACzB,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QACjC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAChC,CAAC;AACJ,CAAC;AAED,2FAA2F;AACpF,KAAK,UAAU,qBAAqB,CACzC,KAAsB,EACtB,OAA8B;IAE9B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,gBAAgB,CACd,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EACxC,6DAA6D,CAC9D,CAAC;YACF,OAAO;QACT,CAAC;QACD,gBAAgB,CACd,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,EACzB,8DAA8D,CAC/D,CAAC;QACF,gBAAgB,CACd,KAAK,CAAC,QAAQ,KAAK,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;YACjD,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EACxC,sDAAsD,CACvD,CAAC;QACF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;gBACjE,WAAW,EAAE,EAAE;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,gBAAgB,CACd,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EACvC,mEAAmE,CACpE,CAAC;YACF,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kIAAkI,CACnI,CAAC;AACJ,CAAC;AAED,sFAAsF;AAC/E,KAAK,UAAU,qBAAqB,CACzC,KAAsB,EACtB,QAA2B,EAC3B,YAA8D;IAE9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,gBAAgB,CACd,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EACjC,iDAAiD,CAClD,CAAC;QACF,OAAO;IACT,CAAC;IACD,gBAAgB,CACd,KAAK,CAAC,QAAQ,KAAK,cAAc,CAAC,QAAQ,CAAC,EAC3C,oDAAoD,CACrD,CAAC;IACF,gBAAgB,CACd,MAAM,YAAY,CAAC,KAAK,CAAC,EACzB,+CAA+C,CAChD,CAAC;IACF,MAAM,qBAAqB,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC7D,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAAI,KAYlD;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvC,gBAAgB,CACd,IAAI,KAAK,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EACpD,+BAA+B,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,gBAAgB,CACd,CAAC,wBAAwB,CAAC,MAAM,CAAC,WAAW,CAAC,EAC7C,sDAAsD,CACvD,CAAC;IACF,gBAAgB,CACd,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EACxC,gDAAgD,CACjD,CAAC;IACF,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,WAAW,GACf,MAAM;QACN;YACE,OAAO,CAAC,GAAG;YACX,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,MAAM;YACd,IAAI;YACJ,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;YAChC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM;SACxC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;IACzC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,cAAc;YACjB,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;gBACzB,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC9C,WAAW;aACZ,CAAC,CAAC;QACL,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,gBAAgB,CACd,IAAI,CACF,KAAK,CAAC,SAAS,EACf,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAChE,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAC9D,4BAA4B,CAC7B,CAAC;QACF,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC;QAC7B,gBAAgB,CAAC,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QACjC,gBAAgB,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,cAAc;gBAAE,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvC,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;AACH,CAAC"}

package/src/foundation/private-smoke-control-plane.d.ts

@@ -0,0 +1,18 @@
+import { WAFV2Client } from '@aws-sdk/client-wafv2';
+import { CloudFrontClient } from '@aws-sdk/client-cloudfront';
+import type { SmokeIpSetStore } from './private-smoke-admission.js';
+import type { CanonicalDeploymentStage } from '../repository-policy/index.js';
+export interface PrivateSmokeResourceIdentity {
+    account: string;
+    stage: CanonicalDeploymentStage;
+    workspace: string;
+    policyDigest: string;
+}
+export interface PrivateSmokeClients {
+    waf: Pick<WAFV2Client, 'send'>;
+    cloudfront: Pick<CloudFrontClient, 'send'>;
+}
+/** Only global WAF resources attached to the exact generated Router are eligible. */
+export declare function openPrivateSmokeControlPlane(identity: PrivateSmokeResourceIdentity, smokeUrl: string | undefined, clients?: PrivateSmokeClients): Promise<SmokeIpSetStore & {
+    arn: string;
+}>;

package/src/foundation/private-smoke-control-plane.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openPrivateSmokeControlPlane = openPrivateSmokeControlPlane;
+const client_wafv2_1 = require("@aws-sdk/client-wafv2");
+const client_cloudfront_1 = require("@aws-sdk/client-cloudfront");
+function check(condition, message) {
+    if (!condition)
+        throw new Error(`Private smoke access: ${message}`);
+}
+/** Only global WAF resources attached to the exact generated Router are eligible. */
+async function openPrivateSmokeControlPlane(identity, smokeUrl, clients = {
+    waf: new client_wafv2_1.WAFV2Client({
+        region: 'us-east-1',
+        endpoint: 'https://wafv2.us-east-1.amazonaws.com',
+        maxAttempts: 3,
+        requestHandler: { connectionTimeout: 10_000, requestTimeout: 30_000 },
+    }),
+    cloudfront: new client_cloudfront_1.CloudFrontClient({
+        region: 'us-east-1',
+        endpoint: 'https://cloudfront.amazonaws.com',
+        maxAttempts: 3,
+        requestHandler: { connectionTimeout: 10_000, requestTimeout: 30_000 },
+    }),
+}) {
+    check(/^\d{12}$/.test(identity.account) &&
+        /^[a-z0-9][a-z0-9-]{0,62}$/.test(identity.workspace) &&
+        ['development', 'staging', 'production'].includes(identity.stage) &&
+        /^sha256:[a-f0-9]{64}$/.test(identity.policyDigest), 'invalid committed resource identity');
+    const url = smokeUrl === undefined ? undefined : new URL(smokeUrl);
+    if (url)
+        check(url.protocol === 'https:' && !url.username && !url.password && !url.port, 'credential-free HTTPS Router required');
+    const name = `foundation-${identity.stage}-router-ipv4-allowlist`;
+    const ipSets = [];
+    let marker;
+    const seen = new Set();
+    do {
+        const page = await clients.waf.send(new client_wafv2_1.ListIPSetsCommand({
+            Scope: 'CLOUDFRONT',
+            Limit: 100,
+            NextMarker: marker,
+        }));
+        ipSets.push(...(page.IPSets ?? []));
+        marker = page.NextMarker;
+        check(!marker || !seen.has(marker), 'IP-set pagination did not advance');
+        if (marker)
+            seen.add(marker);
+        check(seen.size <= 100, 'IP-set inventory exceeds bounded inspection');
+    } while (marker);
+    const matches = ipSets.filter((set) => set.Name === name);
+    check(matches.length === 1 && matches[0].Id, 'exact stage IPv4 IP set missing or ambiguous; configure a baseline IPv4 CIDR before private hosted smoke');
+    const selected = matches[0];
+    const arn = `arn:aws:wafv2:us-east-1:${identity.account}:global/ipset/${name}/${selected.Id}`;
+    check(selected.ARN === arn, 'IP-set account/scope/identity mismatch');
+    const expectedTags = {
+        'ebk:managed-by': 'empire-builder-kit',
+        'ebk:owner': 'foundation',
+        'ebk:stage': identity.stage,
+        'ebk:workspace': identity.workspace,
+        'ebk:policy-digest': identity.policyDigest,
+    };
+    async function attestTags(resourceArn) {
+        const tags = {};
+        let tagMarker;
+        const markers = new Set();
+        do {
+            const page = await clients.waf.send(new client_wafv2_1.ListTagsForResourceCommand({
+                ResourceARN: resourceArn,
+                NextMarker: tagMarker,
+                Limit: 100,
+            }));
+            for (const tag of page.TagInfoForResource?.TagList ?? []) {
+                if (tag.Key && tag.Value)
+                    tags[tag.Key] = tag.Value;
+            }
+            tagMarker = page.NextMarker;
+            check(!tagMarker || !markers.has(tagMarker), 'tag pagination did not advance');
+            if (tagMarker)
+                markers.add(tagMarker);
+            check(markers.size <= 10, 'tag inventory exceeds bounded inspection');
+        } while (tagMarker);
+        for (const [key, value] of Object.entries(expectedTags))
+            check(tags[key] === value, 'WAF ownership or committed policy differs');
+    }
+    await attestTags(arn);
+    // Cleanup never expands access; exact tagged IP-set identity and lease are sufficient.
+    // Admission additionally proves the Router-to-ACL-to-IP-set attachment.
+    if (url) {
+        const distributions = [];
+        marker = undefined;
+        seen.clear();
+        do {
+            const page = await clients.cloudfront.send(new client_cloudfront_1.ListDistributionsCommand({ Marker: marker }));
+            distributions.push(...(page.DistributionList?.Items ?? []));
+            marker = page.DistributionList?.NextMarker;
+            check(!page.DistributionList?.IsTruncated || marker, 'truncated Router inventory has no continuation');
+            check(!marker || !seen.has(marker), 'Router pagination did not advance');
+            if (marker)
+                seen.add(marker);
+            check(seen.size <= 100, 'Router inventory exceeds bounded inspection');
+        } while (marker);
+        const routers = distributions.filter((router) => router.DomainName === url.hostname ||
+            router.Aliases?.Items?.includes(url.hostname));
+        check(routers.length === 1 &&
+            routers[0].Enabled &&
+            routers[0].ARN?.startsWith(`arn:aws:cloudfront::${identity.account}:distribution/`), 'exact account Router missing, disabled, or ambiguous');
+        const acls = [];
+        marker = undefined;
+        seen.clear();
+        do {
+            const page = await clients.waf.send(new client_wafv2_1.ListWebACLsCommand({
+                Scope: 'CLOUDFRONT',
+                Limit: 100,
+                NextMarker: marker,
+            }));
+            acls.push(...(page.WebACLs ?? []));
+            marker = page.NextMarker;
+            check(!marker || !seen.has(marker), 'Web ACL pagination did not advance');
+            if (marker)
+                seen.add(marker);
+            check(seen.size <= 100, 'Web ACL inventory exceeds bounded inspection');
+        } while (marker);
+        const attached = acls.filter((acl) => acl.ARN === routers[0].WebACLId);
+        check(attached.length === 1 &&
+            attached[0].Id &&
+            attached[0].Name &&
+            attached[0].ARN?.startsWith(`arn:aws:wafv2:us-east-1:${identity.account}:global/webacl/`), 'Router Web ACL is outside the exact account/scope');
+        const acl = attached[0];
+        await attestTags(acl.ARN);
+        const { WebACL } = await clients.waf.send(new client_wafv2_1.GetWebACLCommand({ Scope: 'CLOUDFRONT', Name: acl.Name, Id: acl.Id }));
+        check(WebACL?.ARN === acl.ARN, 'Web ACL readback identity differs');
+        const rules = WebACL?.Rules?.filter((rule) => rule.Name === 'StageIpAllowlist') ?? [];
+        const statement = rules[0]?.Statement?.NotStatement?.Statement;
+        const refs = statement?.IPSetReferenceStatement
+            ? [statement.IPSetReferenceStatement]
+            : statement?.OrStatement?.Statements?.map((item) => item.IPSetReferenceStatement);
+        check(rules.length === 1 &&
+            rules[0].Action?.Block &&
+            refs?.length &&
+            refs.every((ref) => ref?.ARN) &&
+            refs.filter((ref) => ref?.ARN === arn).length === 1, 'Router blocking rule does not reference the exact IP set');
+        // A dual-stack rule may have only its same-stage IPv6 companion, never an arbitrary second set.
+        check(refs.every((ref) => ref?.ARN === arn ||
+            ref?.ARN?.startsWith(`arn:aws:wafv2:us-east-1:${identity.account}:global/ipset/foundation-${identity.stage}-router-ipv6-allowlist/`)), 'Router allowlist contains an out-of-stage reference');
+    }
+    const key = { Name: name, Id: selected.Id, Scope: 'CLOUDFRONT' };
+    return {
+        arn,
+        async read() {
+            await attestTags(arn);
+            const { IPSet, LockToken } = await clients.waf.send(new client_wafv2_1.GetIPSetCommand(key));
+            check(IPSet?.ARN === arn &&
+                IPSet.Name === name &&
+                IPSet.IPAddressVersion === 'IPV4' &&
+                LockToken &&
+                Array.isArray(IPSet.Addresses), 'live IP-set identity mismatch');
+            return {
+                addresses: IPSet.Addresses,
+                description: IPSet.Description ?? '',
+                lockToken: LockToken,
+            };
+        },
+        async update(previous, next) {
+            await attestTags(arn);
+            await clients.waf.send(new client_wafv2_1.UpdateIPSetCommand({
+                ...key,
+                LockToken: previous.lockToken,
+                Addresses: [...next.addresses],
+                Description: next.description || undefined,
+            }));
+        },
+    };
+}
+//# sourceMappingURL=private-smoke-control-plane.js.map

package/src/foundation/private-smoke-control-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-smoke-control-plane.js","sourceRoot":"","sources":["../../../../../packages/nx/src/foundation/private-smoke-control-plane.ts"],"names":[],"mappings":";;AAqCA,oEA6NC;AAlQD,wDAU+B;AAC/B,kEAIoC;AAiBpC,SAAS,KAAK,CAAC,SAAkB,EAAE,OAAe;IAChD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,4BAA4B,CAChD,QAAsC,EACtC,QAA4B,EAC5B,UAA+B;IAC7B,GAAG,EAAE,IAAI,0BAAW,CAAC;QACnB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,uCAAuC;QACjD,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE;KACtE,CAAC;IACF,UAAU,EAAE,IAAI,oCAAgB,CAAC;QAC/B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,kCAAkC;QAC5C,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE;KACtE,CAAC;CACH;IAED,KAAK,CACH,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC/B,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpD,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjE,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EACrD,qCAAqC,CACtC,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,GAAG;QACL,KAAK,CACH,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EACxE,uCAAuC,CACxC,CAAC;IACJ,MAAM,IAAI,GAAG,cAAc,QAAQ,CAAC,KAAK,wBAAwB,CAAC;IAClE,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,IAAI,MAA0B,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACjC,IAAI,gCAAiB,CAAC;YACpB,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,MAAM;SACnB,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QACzB,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,mCAAmC,CAAC,CAAC;QACzE,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,6CAA6C,CAAC,CAAC;IACzE,CAAC,QAAQ,MAAM,EAAE;IACjB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC1D,KAAK,CACH,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACrC,0GAA0G,CAC3G,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,2BAA2B,QAAQ,CAAC,OAAO,iBAAiB,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC9F,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,wCAAwC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG;QACnB,gBAAgB,EAAE,oBAAoB;QACtC,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,QAAQ,CAAC,KAAK;QAC3B,eAAe,EAAE,QAAQ,CAAC,SAAS;QACnC,mBAAmB,EAAE,QAAQ,CAAC,YAAY;KAC3C,CAAC;IACF,KAAK,UAAU,UAAU,CAAC,WAAmB;QAC3C,MAAM,IAAI,GAA2B,EAAE,CAAC;QACxC,IAAI,SAA6B,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACjC,IAAI,yCAA0B,CAAC;gBAC7B,WAAW,EAAE,WAAW;gBACxB,UAAU,EAAE,SAAS;gBACrB,KAAK,EAAE,GAAG;aACX,CAAC,CACH,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;gBACzD,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;YACtD,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;YAC5B,KAAK,CACH,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EACrC,gCAAgC,CACjC,CAAC;YACF,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACxE,CAAC,QAAQ,SAAS,EAAE;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,2CAA2C,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAEtB,uFAAuF;IACvF,wEAAwE;IACxE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,aAAa,GAA0B,EAAE,CAAC;QAChD,MAAM,GAAG,SAAS,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CACxC,IAAI,4CAAwB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACjD,CAAC;YACF,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5D,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC;YAC3C,KAAK,CACH,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,IAAI,MAAM,EAC7C,gDAAgD,CACjD,CAAC;YACF,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,mCAAmC,CAAC,CAAC;YACzE,IAAI,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,6CAA6C,CAAC,CAAC;QACzE,CAAC,QAAQ,MAAM,EAAE;QACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAClC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,UAAU,KAAK,GAAG,CAAC,QAAQ;YAClC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAChD,CAAC;QACF,KAAK,CACH,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;YAClB,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CACxB,uBAAuB,QAAQ,CAAC,OAAO,gBAAgB,CACxD,EACH,sDAAsD,CACvD,CAAC;QACF,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,MAAM,GAAG,SAAS,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACjC,IAAI,iCAAkB,CAAC;gBACrB,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,GAAG;gBACV,UAAU,EAAE,MAAM;aACnB,CAAC,CACH,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YACzB,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,oCAAoC,CAAC,CAAC;YAC1E,IAAI,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,8CAA8C,CAAC,CAAC;QAC1E,CAAC,QAAQ,MAAM,EAAE;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvE,KAAK,CACH,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACd,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YAChB,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CACzB,2BAA2B,QAAQ,CAAC,OAAO,iBAAiB,CAC7D,EACH,mDAAmD,CACpD,CAAC;QACF,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,UAAU,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACvC,IAAI,+BAAgB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAC1E,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACpE,MAAM,KAAK,GACT,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC;QAC/D,MAAM,IAAI,GAAG,SAAS,EAAE,uBAAuB;YAC7C,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC;YACrC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CACvC,CAAC;QACN,KAAK,CACH,KAAK,CAAC,MAAM,KAAK,CAAC;YAChB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EACrD,0DAA0D,CAC3D,CAAC;QACF,gGAAgG;QAChG,KAAK,CACH,IAAI,CAAC,KAAK,CACR,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,EAAE,GAAG,KAAK,GAAG;YAChB,GAAG,EAAE,GAAG,EAAE,UAAU,CAClB,2BAA2B,QAAQ,CAAC,OAAO,4BAA4B,QAAQ,CAAC,KAAK,yBAAyB,CAC/G,CACJ,EACD,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,YAAqB,EAAE,CAAC;IAC1E,OAAO;QACL,GAAG;QACH,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACjD,IAAI,8BAAe,CAAC,GAAG,CAAC,CACzB,CAAC;YACF,KAAK,CACH,KAAK,EAAE,GAAG,KAAK,GAAG;gBAChB,KAAK,CAAC,IAAI,KAAK,IAAI;gBACnB,KAAK,CAAC,gBAAgB,KAAK,MAAM;gBACjC,SAAS;gBACT,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAChC,+BAA+B,CAChC,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;gBACpC,SAAS,EAAE,SAAS;aACrB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI;YACzB,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CACpB,IAAI,iCAAkB,CAAC;gBACrB,GAAG,GAAG;gBACN,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC9B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,SAAS;aAC3C,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/src/generators/preset/dependency-overrides.d.ts

@@ -0,0 +1,8 @@
+export declare const DEPENDENCY_OVERRIDES_PATH = "supply-chain/dependency-overrides.json";
+export interface DependencyOverrides {
+    schemaVersion: 1;
+    overrides: Record<string, string>;
+}
+/** Seeded pins are data, never package-manager hooks or alternate registries. */
+export declare function parseDependencyOverrides(value: unknown): DependencyOverrides;
+export declare function renderDependencyOverridesYaml(value: DependencyOverrides): string;

package/src/generators/preset/dependency-overrides.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPENDENCY_OVERRIDES_PATH = void 0;
+exports.parseDependencyOverrides = parseDependencyOverrides;
+exports.renderDependencyOverridesYaml = renderDependencyOverridesYaml;
+const semver_1 = require("semver");
+const deterministic_order_js_1 = require("../../deterministic-order.js");
+exports.DEPENDENCY_OVERRIDES_PATH = 'supply-chain/dependency-overrides.json';
+function isSelector(value) {
+    const parts = value.split('>');
+    if (parts.length > 2)
+        return false;
+    return parts.every((part) => {
+        const match = /^((?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*)(?:@(.+))?$/u.exec(part);
+        return (match !== null &&
+            (match[2] === undefined || (0, semver_1.validRange)(match[2]) !== null));
+    });
+}
+/** Seeded pins are data, never package-manager hooks or alternate registries. */
+function parseDependencyOverrides(value) {
+    const fail = () => {
+        throw new Error(`${exports.DEPENDENCY_OVERRIDES_PATH} must contain schemaVersion 1 and at most 256 npm selectors mapped to exact versions.`);
+    };
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return fail();
+    const record = value;
+    if (record.schemaVersion !== 1 ||
+        Object.keys(record).some((key) => key !== 'schemaVersion' && key !== 'overrides'))
+        return fail();
+    if (typeof record.overrides !== 'object' ||
+        record.overrides === null ||
+        Array.isArray(record.overrides))
+        return fail();
+    const entries = Object.entries(record.overrides);
+    if (entries.length > 256)
+        return fail();
+    for (const [selector, version] of entries) {
+        if (selector.length > 256 ||
+            !isSelector(selector) ||
+            typeof version !== 'string' ||
+            (0, semver_1.valid)(version) !== version)
+            return fail();
+    }
+    return {
+        schemaVersion: 1,
+        overrides: Object.fromEntries(entries.sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))),
+    };
+}
+function renderDependencyOverridesYaml(value) {
+    const entries = Object.entries(value.overrides);
+    return entries.length === 0
+        ? ''
+        : `overrides:\n${entries.map(([selector, version]) => `  ${JSON.stringify(selector)}: ${JSON.stringify(version)}`).join('\n')}\n`;
+}
+//# sourceMappingURL=dependency-overrides.js.map

package/src/generators/preset/dependency-overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-overrides.js","sourceRoot":"","sources":["../../../../../../packages/nx/src/generators/preset/dependency-overrides.ts"],"names":[],"mappings":";;;AA2BA,4DAuCC;AAED,sEAOC;AA3ED,mCAA2C;AAC3C,yEAA4D;AAE/C,QAAA,yBAAyB,GACpC,wCAAwC,CAAC;AAO3C,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,GACT,iEAAiE,CAAC,IAAI,CACpE,IAAI,CACL,CAAC;QACJ,OAAO,CACL,KAAK,KAAK,IAAI;YACd,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAA,mBAAU,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,SAAgB,wBAAwB,CAAC,KAAc;IACrD,MAAM,IAAI,GAAG,GAAU,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,iCAAyB,uFAAuF,CACpH,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrE,OAAO,IAAI,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IACE,MAAM,CAAC,aAAa,KAAK,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,WAAW,CACxD;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,MAAM,CAAC,SAAS,KAAK,IAAI;QACzB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAE/B,OAAO,IAAI,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,IACE,QAAQ,CAAC,MAAM,GAAG,GAAG;YACrB,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrB,OAAO,OAAO,KAAK,QAAQ;YAC3B,IAAA,cAAK,EAAC,OAAO,CAAC,KAAK,OAAO;YAE1B,OAAO,IAAI,EAAE,CAAC;IAClB,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACnC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAC3C,KAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACtI,CAAC"}