@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/foundation/router-waf.js

@@ -0,0 +1,809 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROUTER_WAF_REQUIRED_MANAGED_RULES = exports.ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION = exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION = exports.ROUTER_WAF_CONTRACT_SCHEMA_VERSION = exports.ROUTER_WAF_SCHEMA_VERSION = exports.ROUTER_WAF_REHEARSAL_KIND = exports.ROUTER_WAF_POLICY_KIND = void 0;
+exports.normalizeRouterWafPolicy = normalizeRouterWafPolicy;
+exports.routerWafPolicyDigest = routerWafPolicyDigest;
+exports.normalizeRouterWafBlockingRehearsal = normalizeRouterWafBlockingRehearsal;
+exports.validateRouterWafLiveEvidenceSeed = validateRouterWafLiveEvidenceSeed;
+exports.createRouterWafBlockingRehearsal = createRouterWafBlockingRehearsal;
+exports.reconcileRouterWafBlockingRehearsal = reconcileRouterWafBlockingRehearsal;
+exports.createRouterWafStagePlan = createRouterWafStagePlan;
+exports.createRouterWafRules = createRouterWafRules;
+exports.routerWafContractDigest = routerWafContractDigest;
+const node_crypto_1 = require("node:crypto");
+const node_net_1 = require("node:net");
+const stages_js_1 = require("./stages.js");
+const policy_js_1 = require("../repository-policy/policy.js");
+const router_waf_rate_rehearsal_js_1 = require("./router-waf-rate-rehearsal.js");
+exports.ROUTER_WAF_POLICY_KIND = 'ebk-router-waf-policy';
+exports.ROUTER_WAF_REHEARSAL_KIND = 'ebk-router-waf-blocking-rehearsal';
+exports.ROUTER_WAF_SCHEMA_VERSION = 1;
+exports.ROUTER_WAF_CONTRACT_SCHEMA_VERSION = 1;
+exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION = 4;
+exports.ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION = 4;
+exports.ROUTER_WAF_REQUIRED_MANAGED_RULES = [
+    'AWSManagedRulesCommonRuleSet',
+    'AWSManagedRulesKnownBadInputsRuleSet',
+    'AWSManagedRulesAmazonIpReputationList',
+];
+const POLICY_KEYS = [
+    'deploymentProfile',
+    'kind',
+    'logging',
+    'rateLimitPerIp',
+    'schemaVersion',
+    'stages',
+];
+const LOGGING_KEYS = ['enabled', 'retention'];
+const STAGE_KEYS = ['access', 'allowedCidrs', 'mode'];
+const REHEARSAL_KEYS = [
+    'accountId',
+    'completedAt',
+    'deploymentRoleArn',
+    'evidenceDigest',
+    'kind',
+    'mode',
+    'policyDigest',
+    'region',
+    'schemaVersion',
+    'stage',
+    'status',
+    'wafContractDigest',
+    'workspace',
+];
+const LIVE_EVIDENCE_KEYS = [
+    'accountId',
+    'completedAt',
+    'deploymentRoleArn',
+    'distributionId',
+    'kind',
+    'mode',
+    'policyDigest',
+    'probes',
+    'region',
+    'requiredRules',
+    'result',
+    'schemaVersion',
+    'sourceCommit',
+    'stage',
+    'startedAt',
+    'webAclArn',
+    'webAclScope',
+    'wafContractDigest',
+    'workspace',
+];
+const LIVE_PROBE_KEYS = [
+    'allowedRequestStatus',
+    'cloudWatchMetricsObserved',
+    'countModeTuningObserved',
+    'managedRule',
+    'nonAllowlisted',
+    'rateLimit',
+    'sampledRequestsObserved',
+];
+const OPERATOR_BLOCK_KEYS = [
+    'blockedAt',
+    'marker',
+    'method',
+    'path',
+    'ruleName',
+    'status',
+];
+const RATE_EVIDENCE_KEYS = [
+    'blockedAt',
+    'blockedRequestStatus',
+    'blockedSequence',
+    'burstRequests',
+    'concurrency',
+    'followUpIntervalMs',
+    'followUpRequests',
+    'maximumRequests',
+    'metric',
+    'observationPolls',
+    'requestsSent',
+    'ruleMetricName',
+    'ruleName',
+    'sample',
+    'upstream429Responses',
+];
+const RATE_METRIC_KEYS = [
+    'name',
+    'namespace',
+    'timestamp',
+    'value',
+    'webAclMetricName',
+];
+const RATE_SAMPLE_KEYS = [
+    'action',
+    'markerDigest',
+    'method',
+    'timestamp',
+    'uri',
+];
+const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+function record(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} must be an object.`);
+    }
+    return value;
+}
+function exactKeys(value, expected, label) {
+    const observed = Object.keys(value).sort();
+    const required = [...expected].sort();
+    if (JSON.stringify(observed) !== JSON.stringify(required)) {
+        throw new Error(`${label} must contain exactly ${required.join(', ')}.`);
+    }
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`)
+            .join(',')}}`;
+    }
+    const encoded = JSON.stringify(value);
+    if (encoded === undefined) {
+        throw new Error('Router WAF authority contains an unsupported value.');
+    }
+    return encoded;
+}
+function integerInRange(value, minimum, maximum) {
+    return (typeof value === 'number' &&
+        Number.isSafeInteger(value) &&
+        value >= minimum &&
+        value <= maximum);
+}
+function sameUtcMinute(left, right) {
+    return Math.floor(left / 60_000) === Math.floor(right / 60_000);
+}
+function normalizeRouterWafRateEvidence(input) {
+    const candidate = record(input.value, 'Router WAF rate-limit evidence');
+    exactKeys(candidate, RATE_EVIDENCE_KEYS, 'Router WAF rate-limit evidence');
+    const metric = record(candidate.metric, 'Router WAF rate-limit metric evidence');
+    exactKeys(metric, RATE_METRIC_KEYS, 'Router WAF rate-limit metric evidence');
+    const sample = record(candidate.sample, 'Router WAF rate-limit sample evidence');
+    exactKeys(sample, RATE_SAMPLE_KEYS, 'Router WAF rate-limit sample evidence');
+    const blockedAt = typeof candidate.blockedAt === 'string'
+        ? Date.parse(candidate.blockedAt)
+        : Number.NaN;
+    const sampleAt = typeof sample.timestamp === 'string'
+        ? Date.parse(sample.timestamp)
+        : Number.NaN;
+    const metricAt = typeof metric.timestamp === 'string'
+        ? Date.parse(metric.timestamp)
+        : Number.NaN;
+    const expectedRuleMetricName = (0, router_waf_rate_rehearsal_js_1.routerWafRateRuleMetricName)(input.stage);
+    const expectedWebAclMetricName = input.webAclName;
+    const maximumBurst = Math.min(input.rateLimitPerIp + 160, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_REQUESTS -
+        router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_FOLLOW_UP_REQUESTS);
+    if (candidate.blockedRequestStatus !== 403 ||
+        !integerInRange(candidate.blockedSequence, 1, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_REQUESTS) ||
+        !Number.isFinite(blockedAt) ||
+        blockedAt < input.startedAt ||
+        blockedAt > input.completedAt ||
+        !integerInRange(candidate.burstRequests, 1, maximumBurst) ||
+        candidate.concurrency !== router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_CONCURRENCY ||
+        candidate.followUpIntervalMs !==
+            router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_FOLLOW_UP_INTERVAL_MS ||
+        !integerInRange(candidate.followUpRequests, 0, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_FOLLOW_UP_REQUESTS) ||
+        candidate.maximumRequests !== router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_REQUESTS ||
+        !integerInRange(candidate.observationPolls, 1, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_OBSERVATION_POLLS) ||
+        !integerInRange(candidate.requestsSent, 1, router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_REQUESTS) ||
+        candidate.requestsSent !==
+            candidate.burstRequests + candidate.followUpRequests ||
+        candidate.blockedSequence > candidate.requestsSent ||
+        candidate.ruleName !== router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_RULE_NAME ||
+        candidate.ruleMetricName !== expectedRuleMetricName ||
+        !integerInRange(candidate.upstream429Responses, 0, candidate.requestsSent) ||
+        sample.action !== 'BLOCK' ||
+        typeof sample.markerDigest !== 'string' ||
+        !DIGEST_PATTERN.test(sample.markerDigest) ||
+        sample.method !== 'GET' ||
+        typeof sample.uri !== 'string' ||
+        !/^\/[a-z0-9]+(?:-[a-z0-9]+)*\/api\/health$/.test(sample.uri) ||
+        !Number.isFinite(sampleAt) ||
+        sampleAt < input.startedAt ||
+        sampleAt > input.completedAt ||
+        metric.name !== 'BlockedRequests' ||
+        metric.namespace !== 'AWS/WAFV2' ||
+        typeof expectedWebAclMetricName !== 'string' ||
+        metric.webAclMetricName !== expectedWebAclMetricName ||
+        typeof metric.value !== 'number' ||
+        !Number.isFinite(metric.value) ||
+        metric.value <= 0 ||
+        !Number.isFinite(metricAt) ||
+        !sameUtcMinute(sampleAt, metricAt)) {
+        throw new Error('Router WAF rate-limit evidence lacks one bounded exact RateLimitPerIP BLOCK sample and correlated AWS/WAFV2 metric.');
+    }
+    return candidate;
+}
+function canonicalIpv6(address, prefix) {
+    const halves = address.toLowerCase().split('::');
+    if (halves.length > 2)
+        return null;
+    const left = halves[0] ? halves[0].split(':') : [];
+    const right = halves[1] ? halves[1].split(':') : [];
+    if ([...left, ...right].some((part) => !/^[a-f0-9]{1,4}$/.test(part)) ||
+        (halves.length === 1 && left.length !== 8) ||
+        (halves.length === 2 && left.length + right.length >= 8)) {
+        return null;
+    }
+    const groups = [
+        ...left,
+        ...Array.from({ length: 8 - left.length - right.length }, () => '0'),
+        ...right,
+    ].map((part) => Number.parseInt(part, 16));
+    let numeric = groups.reduce((result, group) => (result << 16n) | BigInt(group), 0n);
+    numeric &= ((1n << BigInt(prefix)) - 1n) << BigInt(128 - prefix);
+    const network = Array.from({ length: 8 }, (_, index) => Number((numeric >> BigInt((7 - index) * 16)) & 0xffffn));
+    let bestStart = -1;
+    let bestLength = 0;
+    for (let index = 0; index < network.length;) {
+        if (network[index] !== 0) {
+            index += 1;
+            continue;
+        }
+        let end = index;
+        while (end < network.length && network[end] === 0)
+            end += 1;
+        if (end - index > bestLength && end - index >= 2) {
+            bestStart = index;
+            bestLength = end - index;
+        }
+        index = end;
+    }
+    const parts = network.map((group) => group.toString(16));
+    const rendered = bestStart === -1
+        ? parts.join(':')
+        : `${parts.slice(0, bestStart).join(':')}::${parts
+            .slice(bestStart + bestLength)
+            .join(':')}`;
+    return `${rendered}/${prefix}`;
+}
+function cidr(value, label) {
+    if (typeof value !== 'string' || value !== value.trim()) {
+        throw new Error(`${label} must be a canonical IPv4 or IPv6 CIDR.`);
+    }
+    const match = /^([^/]+)\/(\d{1,3})$/.exec(value);
+    if (!match) {
+        throw new Error(`${label} must be a canonical IPv4 or IPv6 CIDR.`);
+    }
+    const address = match[1] ?? '';
+    const prefix = Number(match[2]);
+    const family = (0, node_net_1.isIP)(address);
+    if (family === 0 ||
+        prefix === 0 ||
+        !Number.isInteger(prefix) ||
+        (family === 4 && prefix > 32) ||
+        (family === 6 && prefix > 128)) {
+        throw new Error(`${label} must be a canonical IPv4 or IPv6 CIDR.`);
+    }
+    let canonical = null;
+    if (family === 4) {
+        const octets = address.split('.').map(Number);
+        const numeric = octets.reduce((result, octet) => (result << 8) | octet, 0) >>> 0;
+        const mask = prefix === 32 ? 0xffffffff : (0xffffffff << (32 - prefix)) >>> 0;
+        const network = (numeric & mask) >>> 0;
+        canonical = `${[24, 16, 8, 0]
+            .map((shift) => (network >>> shift) & 255)
+            .join('.')}/${prefix}`;
+    }
+    else {
+        canonical = canonicalIpv6(address, prefix);
+    }
+    if (canonical !== value) {
+        throw new Error(`${label} must use its canonical network address.`);
+    }
+    return canonical;
+}
+function stagePolicy(value, stage) {
+    const candidate = record(value, `Router WAF ${stage} policy`);
+    exactKeys(candidate, STAGE_KEYS, `Router WAF ${stage} policy`);
+    if (candidate.access !== 'allowlist' && candidate.access !== 'public') {
+        throw new Error(`Router WAF ${stage} access is invalid.`);
+    }
+    if (candidate.mode !== 'block' && candidate.mode !== 'count') {
+        throw new Error(`Router WAF ${stage} mode is invalid.`);
+    }
+    if (!Array.isArray(candidate.allowedCidrs)) {
+        throw new Error(`Router WAF ${stage} allowedCidrs must be an array.`);
+    }
+    const allowedCidrs = candidate.allowedCidrs.map((value, index) => cidr(value, `Router WAF ${stage} allowedCidrs[${index}]`));
+    if (new Set(allowedCidrs).size !== allowedCidrs.length) {
+        throw new Error(`Router WAF ${stage} allowedCidrs must be unique.`);
+    }
+    if (candidate.access === 'public' && allowedCidrs.length > 0) {
+        throw new Error(`Router WAF ${stage} public access cannot carry an unused allowlist.`);
+    }
+    return {
+        access: candidate.access,
+        allowedCidrs,
+        mode: candidate.mode,
+    };
+}
+function normalizeRouterWafPolicy(value) {
+    const candidate = record(value, 'Router WAF policy');
+    exactKeys(candidate, POLICY_KEYS, 'Router WAF policy');
+    if (candidate.kind !== exports.ROUTER_WAF_POLICY_KIND ||
+        candidate.schemaVersion !== exports.ROUTER_WAF_SCHEMA_VERSION) {
+        throw new Error('Router WAF policy kind or schemaVersion is invalid.');
+    }
+    if (candidate.deploymentProfile !== 'starter' &&
+        candidate.deploymentProfile !== 'production-isolated' &&
+        candidate.deploymentProfile !== 'fully-isolated') {
+        throw new Error('Router WAF deploymentProfile is invalid.');
+    }
+    if (typeof candidate.rateLimitPerIp !== 'number' ||
+        !Number.isSafeInteger(candidate.rateLimitPerIp) ||
+        candidate.rateLimitPerIp < 100 ||
+        candidate.rateLimitPerIp > router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_RATE_LIMIT) {
+        throw new Error(`Router WAF rateLimitPerIp must be an integer from 100 through ${router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_REHEARSAL_MAX_RATE_LIMIT}, the exact bounded rehearsal maximum.`);
+    }
+    const logging = record(candidate.logging, 'Router WAF logging policy');
+    exactKeys(logging, LOGGING_KEYS, 'Router WAF logging policy');
+    if (typeof logging.enabled !== 'boolean') {
+        throw new Error('Router WAF logging enabled must be boolean.');
+    }
+    if (logging.retention !== '1 day' &&
+        logging.retention !== '3 days' &&
+        logging.retention !== '5 days' &&
+        logging.retention !== '1 week' &&
+        logging.retention !== '2 weeks') {
+        throw new Error('Router WAF logging retention is invalid or unbounded.');
+    }
+    const stages = record(candidate.stages, 'Router WAF stages');
+    const deploymentProfile = candidate.deploymentProfile;
+    const activeStages = (0, policy_js_1.activeDeploymentStages)(deploymentProfile);
+    exactKeys(stages, activeStages, 'Router WAF stages');
+    return {
+        deploymentProfile,
+        kind: exports.ROUTER_WAF_POLICY_KIND,
+        logging: {
+            enabled: logging.enabled,
+            retention: logging.retention,
+        },
+        rateLimitPerIp: candidate.rateLimitPerIp,
+        schemaVersion: exports.ROUTER_WAF_SCHEMA_VERSION,
+        stages: {
+            development: stagePolicy(stages.development, 'development'),
+            production: stagePolicy(stages.production, 'production'),
+            ...(activeStages.includes('staging')
+                ? { staging: stagePolicy(stages.staging, 'staging') }
+                : {}),
+        },
+    };
+}
+function routerWafPolicyDigest(policy) {
+    return `sha256:${(0, node_crypto_1.createHash)('sha256').update(canonical(policy)).digest('hex')}`;
+}
+function normalizeRouterWafBlockingRehearsal(value) {
+    const candidate = record(value, 'Router WAF blocking rehearsal');
+    if (candidate.status === 'pending') {
+        exactKeys(candidate, ['kind', 'schemaVersion', 'status'], 'Pending Router WAF blocking rehearsal');
+        if (candidate.kind !== exports.ROUTER_WAF_REHEARSAL_KIND ||
+            candidate.schemaVersion !== exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION) {
+            throw new Error('Pending Router WAF blocking rehearsal kind or schemaVersion is invalid.');
+        }
+        return null;
+    }
+    exactKeys(candidate, REHEARSAL_KEYS, 'Router WAF blocking rehearsal');
+    if (candidate.kind !== exports.ROUTER_WAF_REHEARSAL_KIND ||
+        candidate.schemaVersion !== exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION ||
+        candidate.status !== 'passed' ||
+        (candidate.stage !== 'development' && candidate.stage !== 'staging') ||
+        candidate.mode !== 'block' ||
+        typeof candidate.accountId !== 'string' ||
+        !/^\d{12}$/.test(candidate.accountId) ||
+        typeof candidate.region !== 'string' ||
+        !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(candidate.region) ||
+        typeof candidate.deploymentRoleArn !== 'string' ||
+        !new RegExp(`^arn:(?:aws|aws-us-gov):iam::${candidate.accountId}:role/[A-Za-z0-9+=,.@_/-]{1,512}$`).test(candidate.deploymentRoleArn) ||
+        typeof candidate.workspace !== 'string' ||
+        !/^[a-z0-9][a-z0-9-]{0,127}$/.test(candidate.workspace) ||
+        typeof candidate.completedAt !== 'string' ||
+        !Number.isFinite(Date.parse(candidate.completedAt)) ||
+        typeof candidate.evidenceDigest !== 'string' ||
+        !DIGEST_PATTERN.test(candidate.evidenceDigest) ||
+        typeof candidate.policyDigest !== 'string' ||
+        !DIGEST_PATTERN.test(candidate.policyDigest) ||
+        typeof candidate.wafContractDigest !== 'string' ||
+        !DIGEST_PATTERN.test(candidate.wafContractDigest)) {
+        throw new Error('Router WAF blocking rehearsal is invalid.');
+    }
+    return candidate;
+}
+function operatorBlockEvidence(input) {
+    const candidate = record(input.value, `Router WAF ${input.expected} operator evidence`);
+    exactKeys(candidate, OPERATOR_BLOCK_KEYS, `Router WAF ${input.expected} operator evidence`);
+    const blockedAt = typeof candidate.blockedAt === 'string'
+        ? Date.parse(candidate.blockedAt)
+        : Number.NaN;
+    const expectedRule = input.expected === 'nonallowlisted'
+        ? candidate.ruleName === 'StageIpAllowlist'
+        : candidate.ruleName ===
+            'AWSManagedRulesCommonRuleSet#NoUserAgent_HEADER';
+    if (candidate.status !== 403 ||
+        candidate.method !== 'GET' ||
+        typeof candidate.path !== 'string' ||
+        !/^\/[a-z0-9]+(?:-[a-z0-9]+)*\/api\/health$/.test(candidate.path) ||
+        typeof candidate.marker !== 'string' ||
+        !/^[a-f0-9]{64}:(?:managed|nonallowlisted)$/.test(candidate.marker) ||
+        !candidate.marker.endsWith(`:${input.expected}`) ||
+        !expectedRule ||
+        !Number.isFinite(blockedAt) ||
+        blockedAt < input.startedAt ||
+        blockedAt > input.completedAt) {
+        throw new Error(`Router WAF ${input.expected} operator evidence is not one bounded exact BLOCK request.`);
+    }
+    return candidate;
+}
+function validateRouterWafLiveEvidenceSeed(input) {
+    const evidence = record(input.evidence, 'Router WAF live evidence');
+    exactKeys(evidence, LIVE_EVIDENCE_KEYS, 'Router WAF live evidence');
+    const probes = record(evidence.probes, 'Router WAF live evidence probes');
+    exactKeys(probes, LIVE_PROBE_KEYS, 'Router WAF live evidence probes');
+    const policyDigest = routerWafPolicyDigest(input.policy);
+    const wafContractDigest = routerWafContractDigest(input.policy);
+    const startedAt = typeof evidence.startedAt === 'string'
+        ? Date.parse(evidence.startedAt)
+        : Number.NaN;
+    const completedAt = typeof evidence.completedAt === 'string'
+        ? Date.parse(evidence.completedAt)
+        : Number.NaN;
+    const expectedRules = [
+        'StageIpAllowlist',
+        'RateLimitPerIP',
+        ...exports.ROUTER_WAF_REQUIRED_MANAGED_RULES,
+    ];
+    const rehearsalStage = (0, policy_js_1.productionRehearsalStage)(input.policy.deploymentProfile);
+    const rehearsalStagePolicy = input.policy.stages[rehearsalStage];
+    const webAclIdentity = typeof evidence.webAclArn === 'string'
+        ? /^arn:(?:aws|aws-us-gov):wafv2:us-east-1:(\d{12}):global\/webacl\/([A-Za-z0-9_-]{1,128})\/[a-f0-9-]{36}$/.exec(evidence.webAclArn)
+        : null;
+    if (!rehearsalStagePolicy ||
+        rehearsalStagePolicy.mode !== 'block' ||
+        rehearsalStagePolicy.access !== 'allowlist' ||
+        rehearsalStagePolicy.allowedCidrs.length === 0 ||
+        evidence.kind !== 'ebk-router-waf-live-evidence' ||
+        evidence.schemaVersion !== exports.ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION ||
+        evidence.stage !== rehearsalStage ||
+        evidence.mode !== 'block' ||
+        evidence.result !== 'passed' ||
+        evidence.webAclScope !== 'CLOUDFRONT' ||
+        evidence.policyDigest !== policyDigest ||
+        evidence.wafContractDigest !== wafContractDigest ||
+        typeof evidence.accountId !== 'string' ||
+        !/^\d{12}$/.test(evidence.accountId) ||
+        typeof evidence.deploymentRoleArn !== 'string' ||
+        !new RegExp(`^arn:(?:aws|aws-us-gov):iam::${evidence.accountId}:role/[A-Za-z0-9+=,.@_/-]{1,512}$`).test(evidence.deploymentRoleArn) ||
+        typeof evidence.region !== 'string' ||
+        !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(evidence.region) ||
+        typeof evidence.sourceCommit !== 'string' ||
+        !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(evidence.sourceCommit) ||
+        typeof evidence.workspace !== 'string' ||
+        !/^[a-z0-9][a-z0-9-]{0,127}$/.test(evidence.workspace) ||
+        typeof evidence.distributionId !== 'string' ||
+        !/^[A-Z0-9]{8,32}$/.test(evidence.distributionId) ||
+        !webAclIdentity ||
+        webAclIdentity[1] !== evidence.accountId ||
+        !Number.isFinite(startedAt) ||
+        !Number.isFinite(completedAt) ||
+        completedAt < startedAt ||
+        completedAt - startedAt > 4 * 60 * 60 * 1_000 ||
+        !Array.isArray(evidence.requiredRules) ||
+        JSON.stringify(evidence.requiredRules) !== JSON.stringify(expectedRules) ||
+        typeof probes.allowedRequestStatus !== 'number' ||
+        probes.allowedRequestStatus < 200 ||
+        probes.allowedRequestStatus > 399 ||
+        probes.cloudWatchMetricsObserved !== true ||
+        typeof probes.countModeTuningObserved !== 'boolean' ||
+        probes.sampledRequestsObserved !== true) {
+        throw new Error(`Router WAF live evidence does not prove the exact ${rehearsalStage} blocking baseline.`);
+    }
+    operatorBlockEvidence({
+        completedAt,
+        expected: 'managed',
+        startedAt,
+        value: probes.managedRule,
+    });
+    operatorBlockEvidence({
+        completedAt,
+        expected: 'nonallowlisted',
+        startedAt,
+        value: probes.nonAllowlisted,
+    });
+    return {
+        accountId: evidence.accountId,
+        completedAt,
+        deploymentRoleArn: evidence.deploymentRoleArn,
+        distributionId: evidence.distributionId,
+        probes,
+        region: evidence.region,
+        stage: rehearsalStage,
+        startedAt,
+        wafContractDigest,
+        webAclArn: evidence.webAclArn,
+        webAclName: webAclIdentity[2],
+        workspace: evidence.workspace,
+    };
+}
+function createRouterWafBlockingRehearsal(input) {
+    const seed = validateRouterWafLiveEvidenceSeed(input);
+    const evidence = input.evidence;
+    let rateLimitEvidence;
+    try {
+        rateLimitEvidence = normalizeRouterWafRateEvidence({
+            completedAt: seed.completedAt,
+            rateLimitPerIp: input.policy.rateLimitPerIp,
+            stage: seed.stage,
+            startedAt: seed.startedAt,
+            value: seed.probes.rateLimit,
+            webAclName: seed.webAclName,
+        });
+    }
+    catch {
+        throw new Error(`Router WAF live evidence does not prove the exact ${seed.stage} blocking baseline.`);
+    }
+    if (rateLimitEvidence.blockedRequestStatus !== 403) {
+        throw new Error(`Router WAF live evidence does not prove the exact ${seed.stage} blocking baseline.`);
+    }
+    const policyDigest = routerWafPolicyDigest(input.policy);
+    const authorityEvidence = { ...evidence };
+    const evidenceDigest = `sha256:${(0, node_crypto_1.createHash)('sha256')
+        .update(canonical(authorityEvidence))
+        .digest('hex')}`;
+    return {
+        accountId: seed.accountId,
+        completedAt: evidence.completedAt,
+        deploymentRoleArn: seed.deploymentRoleArn,
+        evidenceDigest,
+        kind: exports.ROUTER_WAF_REHEARSAL_KIND,
+        mode: 'block',
+        policyDigest,
+        region: seed.region,
+        schemaVersion: exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION,
+        stage: seed.stage,
+        status: 'passed',
+        wafContractDigest: seed.wafContractDigest,
+        workspace: seed.workspace,
+    };
+}
+function reconcileRouterWafBlockingRehearsal(input) {
+    const retained = normalizeRouterWafBlockingRehearsal(input.receipt);
+    if (!retained)
+        return null;
+    const observed = createRouterWafBlockingRehearsal({
+        evidence: input.evidence,
+        policy: input.policy,
+    });
+    for (const key of [
+        'accountId',
+        'deploymentRoleArn',
+        'region',
+        'stage',
+        'wafContractDigest',
+        'workspace',
+    ]) {
+        if (observed[key] !== input.expected[key]) {
+            throw new Error(`Router WAF blocking rehearsal ${key} does not match committed production reconciliation authority.`);
+        }
+    }
+    if (canonical(retained) !== canonical(observed)) {
+        throw new Error('Router WAF blocking rehearsal receipt does not match its exact live evidence.');
+    }
+    return retained;
+}
+function createRouterWafStagePlan(input) {
+    const stage = (0, stages_js_1.requireFoundationStage)(input.stage);
+    if (!(0, policy_js_1.isActiveDeploymentStage)(input.policy.deploymentProfile, stage)) {
+        throw new Error(`Router WAF stage ${stage} is inactive for the ${input.policy.deploymentProfile} deployment profile.`);
+    }
+    const stagePolicy = input.policy.stages[stage];
+    if (!stagePolicy) {
+        throw new Error(`Router WAF ${stage} policy is missing.`);
+    }
+    const policyDigest = routerWafPolicyDigest(input.policy);
+    if (stagePolicy.access === 'allowlist' &&
+        stagePolicy.allowedCidrs.length === 0) {
+        throw new Error(`Router WAF ${stage} allowlist requires at least one explicit CIDR before deployment.`);
+    }
+    if (stage === 'production') {
+        if (stagePolicy.mode !== 'block') {
+            throw new Error('Production Router WAF must deploy in blocking mode.');
+        }
+        if (!input.rehearsal ||
+            input.rehearsal.policyDigest !== policyDigest ||
+            input.rehearsal.wafContractDigest !==
+                routerWafContractDigest(input.policy)) {
+            throw new Error(`Production Router WAF requires a passed ${(0, policy_js_1.productionRehearsalStage)(input.policy.deploymentProfile)} blocking rehearsal for the exact policy digest.`);
+        }
+    }
+    return {
+        access: stagePolicy.access,
+        ipv4Cidrs: stagePolicy.allowedCidrs.filter((value) => (0, node_net_1.isIP)(value.split('/')[0] ?? '') === 4),
+        ipv6Cidrs: stagePolicy.allowedCidrs.filter((value) => (0, node_net_1.isIP)(value.split('/')[0] ?? '') === 6),
+        logging: input.policy.logging.enabled
+            ? {
+                include: 'blocked',
+                redact: {
+                    headers: ['authorization', 'cookie', 'x-api-key'],
+                    queryString: true,
+                },
+                retention: input.policy.logging.retention,
+            }
+            : false,
+        mode: stagePolicy.mode,
+        policyDigest,
+        rateLimitPerIp: input.policy.rateLimitPerIp,
+        stage,
+    };
+}
+function visibility(metricName) {
+    return {
+        cloudwatchMetricsEnabled: true,
+        metricName,
+        sampledRequestsEnabled: true,
+    };
+}
+function createRouterWafRules(plan, ipSets) {
+    const prefix = `Ebk${plan.stage[0]?.toUpperCase()}${plan.stage.slice(1)}`;
+    const rules = [];
+    let priority = 0;
+    if (plan.access === 'allowlist') {
+        if (ipSets.ipv4Arn === undefined && ipSets.ipv6Arn === undefined) {
+            throw new Error('Router WAF allowlist is missing its exact IP set ARN.');
+        }
+        const references = [ipSets.ipv4Arn, ipSets.ipv6Arn, ipSets.smokeArn]
+            .filter((value) => value !== undefined)
+            .map((arn) => ({ ipSetReferenceStatement: { arn } }));
+        if (references.length === 0) {
+            throw new Error('Router WAF allowlist is missing its exact IP set ARN.');
+        }
+        rules.push({
+            action: plan.mode === 'block' ? { block: {} } : { count: {} },
+            name: 'StageIpAllowlist',
+            priority: priority++,
+            statement: {
+                notStatement: {
+                    statement: references.length === 1
+                        ? references[0]
+                        : { orStatement: { statements: references } },
+                },
+            },
+            visibilityConfig: visibility(`${prefix}StageIpAllowlist`),
+        });
+    }
+    rules.push({
+        action: plan.mode === 'block' ? { block: {} } : { count: {} },
+        name: 'RateLimitPerIP',
+        priority: priority++,
+        statement: {
+            rateBasedStatement: {
+                aggregateKeyType: 'IP',
+                limit: plan.rateLimitPerIp,
+            },
+        },
+        visibilityConfig: visibility(`${prefix}RateLimitPerIP`),
+    });
+    for (const name of exports.ROUTER_WAF_REQUIRED_MANAGED_RULES) {
+        rules.push({
+            name,
+            overrideAction: plan.mode === 'block' ? { none: {} } : { count: {} },
+            priority: priority++,
+            statement: {
+                managedRuleGroupStatement: {
+                    name,
+                    ...(name === 'AWSManagedRulesCommonRuleSet'
+                        ? {
+                            // Preserve SST's safe baseline for legitimate request bodies
+                            // larger than WAF's managed-rule inspection limit.
+                            ruleActionOverrides: [
+                                {
+                                    actionToUse: { count: {} },
+                                    name: 'SizeRestrictions_BODY',
+                                },
+                            ],
+                        }
+                        : {}),
+                    vendorName: 'AWS',
+                },
+            },
+            visibilityConfig: visibility(`${prefix}${name}`),
+        });
+    }
+    return rules;
+}
+function contractStagePlan(policy, stage) {
+    const stagePolicy = policy.stages[stage];
+    if (!stagePolicy) {
+        throw new Error(`Router WAF ${stage} contract policy is missing.`);
+    }
+    return {
+        access: stagePolicy.access,
+        ipv4Cidrs: stagePolicy.allowedCidrs.filter((value) => (0, node_net_1.isIP)(value.split('/')[0] ?? '') === 4),
+        ipv6Cidrs: stagePolicy.allowedCidrs.filter((value) => (0, node_net_1.isIP)(value.split('/')[0] ?? '') === 6),
+        logging: policy.logging.enabled
+            ? {
+                include: 'blocked',
+                redact: {
+                    headers: ['authorization', 'cookie', 'x-api-key'],
+                    queryString: true,
+                },
+                retention: policy.logging.retention,
+            }
+            : false,
+        mode: stagePolicy.mode,
+        policyDigest: routerWafPolicyDigest(policy),
+        rateLimitPerIp: policy.rateLimitPerIp,
+        stage,
+    };
+}
+function routerWafContractDigest(policy) {
+    const stages = (0, policy_js_1.activeDeploymentStages)(policy.deploymentProfile).map((stage) => {
+        const plan = contractStagePlan(policy, stage);
+        return {
+            plan,
+            rules: createRouterWafRules(plan, {
+                ...(plan.ipv4Cidrs.length > 0
+                    ? { ipv4Arn: `<ipv4-ip-set:${stage}>` }
+                    : {}),
+                ...(plan.ipv6Cidrs.length > 0
+                    ? { ipv6Arn: `<ipv6-ip-set:${stage}>` }
+                    : {}),
+                ...(plan.access === 'allowlist'
+                    ? { smokeArn: `<smoke-ip-set:${stage}>` }
+                    : {}),
+            }),
+        };
+    });
+    const implementation = {
+        cloudFront: {
+            enabled: true,
+            identityTags: [
+                'ebk:managed-by',
+                'ebk:owner',
+                'ebk:stage',
+                'ebk:workspace',
+            ],
+            staging: false,
+            webAclAttachment: 'exact-arn',
+        },
+        evidenceSchemaVersion: exports.ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION,
+        kind: 'ebk-router-waf-generated-contract',
+        receiptSchemaVersion: exports.ROUTER_WAF_REHEARSAL_SCHEMA_VERSION,
+        schemaVersion: exports.ROUTER_WAF_CONTRACT_SCHEMA_VERSION,
+        stages,
+        webAcl: {
+            defaultAction: 'allow',
+            identityTags: [
+                'ebk:managed-by',
+                'ebk:owner',
+                'ebk:policy-digest',
+                'ebk:stage',
+                'ebk:workspace',
+            ],
+            ipSetTags: [
+                'ebk:managed-by',
+                'ebk:owner',
+                'ebk:policy-digest',
+                'ebk:stage',
+                'ebk:workspace',
+            ],
+            smokeIpSetTags: [
+                'ebk:managed-by',
+                'ebk:owner',
+                'ebk:purpose',
+                'ebk:stage',
+                'ebk:workspace',
+            ],
+            logging: policy.logging,
+            scope: 'CLOUDFRONT',
+        },
+    };
+    return `sha256:${(0, node_crypto_1.createHash)('sha256')
+        .update(canonical({ implementation, policy }))
+        .digest('hex')}`;
+}
+//# sourceMappingURL=router-waf.js.map