@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/secrets/workload-access.js

@@ -118,7 +118,8 @@ function createSecretWorkloadAccessPlan(input) {
     for (const binding of activeBindings) {
         const declaration = declarations.get(binding.logicalName);
         const reference = references.get(binding.logicalName);
-        if (declaration?.source !== 'operator' ||
+        if ((declaration?.source !== 'operator' &&
+            declaration?.source !== 'generated') ||
             reference?.logicalName !== declaration.logicalName) {
             throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
         }
@@ -151,9 +152,16 @@ function personalSecretNamesForWorkload(input) {
         .filter(({ workload }) => workload === input.workload)
         .flatMap(({ logicalName }) => {
         const declaration = declarations.get(logicalName);
-        if (!declaration || declaration.source !== 'operator') {
+        if (!declaration ||
+            (declaration.source !== 'operator' &&
+                declaration.source !== 'generated')) {
             throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
         }
+        // Generated values exist only in canonical deployed stages. They are
+        // valid workload bindings, but never become personal `sst.Secret`
+        // resources during the dirty-tree development loop.
+        if (declaration.source === 'generated')
+            return [];
         return declaration.requiredStages.includes(input.stage)
             ? [logicalName]
             : [];

package/src/sst-environment-source-format.d.ts

@@ -0,0 +1,6 @@
+/** Exact default declaration emitted by the pinned Next 16.3 toolchain. */
+export declare function generatedNextEnvironmentSource(dev?: boolean): string;
+export declare function isExactGeneratedNextEnvironmentSourceBytes(bytes: Buffer): boolean;
+export declare function isExactGeneratedRootSstEnvironmentSourceBytes(bytes: Buffer): boolean;
+export declare function isExactGeneratedRootSstPythonSourceBytes(bytes: Buffer): boolean;
+export declare function exactGeneratedNestedSstEnvironmentSourceBytes(nestedPath: string, rootSourcePath: string): readonly Buffer[];

package/src/sst-environment-source-format.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatedNextEnvironmentSource = generatedNextEnvironmentSource;
+exports.isExactGeneratedNextEnvironmentSourceBytes = isExactGeneratedNextEnvironmentSourceBytes;
+exports.isExactGeneratedRootSstEnvironmentSourceBytes = isExactGeneratedRootSstEnvironmentSourceBytes;
+exports.isExactGeneratedRootSstPythonSourceBytes = isExactGeneratedRootSstPythonSourceBytes;
+exports.exactGeneratedNestedSstEnvironmentSourceBytes = exactGeneratedNestedSstEnvironmentSourceBytes;
+const node_path_1 = require("node:path");
+/** Exact default declaration emitted by the pinned Next 16.3 toolchain. */
+function generatedNextEnvironmentSource(dev = false) {
+    const directory = dev ? '.next/dev' : '.next';
+    return `/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./${directory}/types/routes.d.ts";
+import "./${directory}/types/root-params.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+`;
+}
+function isExactGeneratedNextEnvironmentSourceBytes(bytes) {
+    return [false, true].some((dev) => [
+        generatedNextEnvironmentSource(dev),
+        generatedNextEnvironmentSource(dev).split('\n').join('\r\n'),
+    ].some((source) => bytes.equals(Buffer.from(source))));
+}
+const GENERATED_HEADER = [
+    '/* This file is auto-generated by SST. Do not edit. */',
+    '/* tslint:disable */',
+    '/* eslint-disable */',
+    '/* deno-fmt-ignore-file */',
+    '/* biome-ignore-all lint: auto-generated */',
+    '',
+];
+function exactJsonString(value) {
+    try {
+        const parsed = JSON.parse(value);
+        return typeof parsed === 'string' && JSON.stringify(parsed) === value;
+    }
+    catch {
+        return false;
+    }
+}
+function exactGeneratedResourceMembers(lines) {
+    let depth = 0;
+    for (const line of lines) {
+        const indentation = line.match(/^ */u)?.[0].length ?? 0;
+        if (line.trim() === '}') {
+            if (depth === 0 || indentation !== 4 + (depth - 1) * 2)
+                return false;
+            depth -= 1;
+            continue;
+        }
+        if (indentation !== 4 + depth * 2)
+            return false;
+        const property = line
+            .slice(indentation)
+            .match(/^("(?:[^"\\]|\\.)*"): (.+)$/u);
+        if (!property ||
+            !property[1] ||
+            !property[2] ||
+            !exactJsonString(property[1])) {
+            return false;
+        }
+        if (property[2] === '{') {
+            depth += 1;
+            continue;
+        }
+        // SST emits JSON property names followed by TypeScript type expressions.
+        // Keep the accepted alphabet deliberately type-only: executable statement
+        // delimiters, comments, assignments, templates, and braces are excluded.
+        if (!/^[A-Za-z0-9_.$@/:"'<>()[\]|&?, -]+$/u.test(property[2])) {
+            return false;
+        }
+    }
+    return depth === 0;
+}
+function isExactGeneratedRootSstEnvironmentSourceBytes(bytes) {
+    const source = bytes.toString('utf8');
+    if (!Buffer.from(source, 'utf8').equals(bytes))
+        return false;
+    const normalized = source.split('\r\n').join('\n');
+    if (normalized.includes('\r'))
+        return false;
+    const lines = normalized.endsWith('\n')
+        ? normalized.slice(0, -1).split('\n')
+        : normalized.split('\n');
+    const prefix = [
+        ...GENERATED_HEADER,
+        'declare module "sst" {',
+        '  export interface Resource {',
+    ];
+    const suffix = ['  }', '}', '', 'import "sst"', 'export {}'];
+    if (lines.length < prefix.length + suffix.length ||
+        prefix.some((line, index) => lines[index] !== line) ||
+        suffix.some((line, index) => lines[lines.length - suffix.length + index] !== line)) {
+        return false;
+    }
+    return exactGeneratedResourceMembers(lines.slice(prefix.length, lines.length - suffix.length));
+}
+function exactGeneratedPythonType(value) {
+    if (!/^[A-Za-z0-9_,.[\]| ]+$/u.test(value))
+        return false;
+    const identifiers = value.match(/[A-Za-z_][A-Za-z0-9_]*/gu) ?? [];
+    if (identifiers.some((identifier) => ![
+        'Any',
+        'None',
+        'bool',
+        'dict',
+        'float',
+        'int',
+        'list',
+        'set',
+        'str',
+        'tuple',
+    ].includes(identifier))) {
+        return false;
+    }
+    let depth = 0;
+    for (const character of value) {
+        if (character === '[')
+            depth += 1;
+        if (character === ']')
+            depth -= 1;
+        if (depth < 0)
+            return false;
+    }
+    return depth === 0;
+}
+function isExactGeneratedRootSstPythonSourceBytes(bytes) {
+    const source = bytes.toString('utf8');
+    if (!Buffer.from(source, 'utf8').equals(bytes))
+        return false;
+    const normalized = source.split('\r\n').join('\n');
+    if (normalized.includes('\r'))
+        return false;
+    const lines = normalized.endsWith('\n')
+        ? normalized.slice(0, -1).split('\n')
+        : normalized.split('\n');
+    if (lines.at(-1) === '')
+        lines.pop();
+    if (lines.at(-1) === '')
+        return false;
+    const prefix = [
+        '# Automatically generated by SST',
+        '# pylint: disable=all',
+        '# ruff: noqa',
+        'from typing import Any',
+        '',
+        'class Resource:',
+    ];
+    if (lines.length <= prefix.length ||
+        prefix.some((line, index) => lines[index] !== line)) {
+        return false;
+    }
+    let observedClass = false;
+    let observedMember = false;
+    for (const line of lines.slice(prefix.length)) {
+        const classDeclaration = line.match(/^ {4}class ([A-Za-z_][A-Za-z0-9_]*):$/u);
+        if (classDeclaration) {
+            if (observedClass && !observedMember)
+                return false;
+            observedClass = true;
+            observedMember = false;
+            continue;
+        }
+        const member = line.match(/^ {8}([A-Za-z_][A-Za-z0-9_]*): (.+)$/u);
+        if (!observedClass ||
+            !member?.[2] ||
+            !exactGeneratedPythonType(member[2])) {
+            return false;
+        }
+        observedMember = true;
+    }
+    return observedClass && observedMember;
+}
+function exactGeneratedNestedSstEnvironmentSourceBytes(nestedPath, rootSourcePath) {
+    const reference = (0, node_path_1.relative)((0, node_path_1.dirname)(nestedPath), rootSourcePath)
+        .split('\\')
+        .join('/');
+    if (!reference.startsWith('../') || reference.endsWith('/'))
+        return [];
+    const lines = [
+        ...GENERATED_HEADER,
+        `/// <reference path="${reference}" />`,
+        '',
+        'import "sst"',
+        'export {}',
+    ];
+    const lf = lines.join('\n');
+    const crlf = lines.join('\r\n');
+    return [
+        Buffer.from(lf, 'utf8'),
+        Buffer.from(`${lf}\n`, 'utf8'),
+        Buffer.from(crlf, 'utf8'),
+        Buffer.from(`${crlf}\r\n`, 'utf8'),
+    ];
+}
+//# sourceMappingURL=sst-environment-source-format.js.map

package/src/supply-chain/action-pins.js

@@ -9,22 +9,71 @@ exports.ACTION_PIN_INVENTORY_SCHEMA_VERSION = 1;
 const GITHUB_ACTION_SHA = /^[a-f0-9]{40}$/;
 const ACTION_REFERENCE = /^(?<action>[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_./-]+)?)@(?<sha>[a-f0-9]{40})$/;
 const CONTAINER_REFERENCE = /^(?:docker:\/\/)?(?<image>[a-z0-9][a-z0-9._/-]*):(?<tag>[A-Za-z0-9._-]+)@sha256:(?<sha>[a-f0-9]{64})$/;
-function findUses(value, uses) {
+const LOCAL_REUSABLE_WORKFLOW = /^\.\/\.github\/workflows\/[A-Za-z0-9_.-]+\.yml$/;
+const WORKFLOW_DOCUMENT = /^\.github\/workflows\/[A-Za-z0-9_.-]+\.ya?ml$/;
+function findUses(value, uses, location = []) {
     if (Array.isArray(value)) {
-        value.forEach((entry) => findUses(entry, uses));
+        value.forEach((entry, index) => findUses(entry, uses, [...location, index]));
         return;
     }
     if (!value || typeof value !== 'object')
         return;
     for (const [key, child] of Object.entries(value)) {
         if (key === 'uses' && typeof child === 'string') {
-            uses.push(child);
+            uses.push({ location: [...location, key], reference: child });
         }
         else {
-            findUses(child, uses);
+            findUses(child, uses, [...location, key]);
         }
     }
 }
+function isJobLevelWorkflowUse(location) {
+    return (location.length === 3 &&
+        location[0] === 'jobs' &&
+        typeof location[1] === 'string' &&
+        location[2] === 'uses');
+}
+function declaresWorkflowCall(document) {
+    if (!document || typeof document !== 'object' || Array.isArray(document)) {
+        return false;
+    }
+    const trigger = document['on'];
+    if (trigger === 'workflow_call')
+        return true;
+    if (Array.isArray(trigger))
+        return trigger.includes('workflow_call');
+    return (trigger !== null &&
+        typeof trigger === 'object' &&
+        !Array.isArray(trigger) &&
+        Object.prototype.hasOwnProperty.call(trigger, 'workflow_call'));
+}
+function verifyLocalReusableWorkflow(use, files, callerPath) {
+    const { location, reference } = use;
+    if (reference.includes('${{')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} is a dynamic executable input`);
+    }
+    if (!WORKFLOW_DOCUMENT.test(callerPath) || !isJobLevelWorkflowUse(location)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} is a repository-local action; only static job-level reusable workflows are admitted`);
+    }
+    if (!LOCAL_REUSABLE_WORKFLOW.test(reference)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} must be an exact ./.github/workflows/*.yml reusable-workflow path without traversal`);
+    }
+    const targetPath = reference.slice(2);
+    const targetSource = files[targetPath];
+    if (targetSource === undefined) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} does not resolve to a repository workflow`);
+    }
+    let targetDocument;
+    try {
+        targetDocument = (0, yaml_1.parse)(targetSource);
+    }
+    catch (error) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', targetPath, `cannot parse reusable workflow: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!declaresWorkflowCall(targetDocument)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} does not declare workflow_call`);
+    }
+}
 function workflowContainerReferences(document, path) {
     if (!document || typeof document !== 'object' || Array.isArray(document)) {
         return [];
@@ -133,11 +182,16 @@ function verifyActionPinInventory(files, inventory, scope) {
         findUses(document, uses);
         const executableReferences = [
             ...uses,
-            ...workflowContainerReferences(document, path),
+            ...workflowContainerReferences(document, path).map((reference) => ({
+                location: ['jobs', 'container'],
+                reference,
+            })),
         ];
-        for (const reference of executableReferences) {
+        for (const use of executableReferences) {
+            const { reference } = use;
             if (reference.startsWith('./')) {
-                throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `${reference} is a repository-local action, which the v1 exact pin inventory does not admit`);
+                verifyLocalReusableWorkflow(use, files, path);
+                continue;
             }
             const container = CONTAINER_REFERENCE.exec(reference);
             if (reference.startsWith('docker://') || container) {

package/src/supply-chain/blueprint-trust-git.js

@@ -369,6 +369,24 @@ function historyStates(context, history, policyPath, snapshotPath) {
     }
     return states;
 }
+function optionalBlueprintTrustAuthorityBaseline(context, tip, policyPath = exports.BLUEPRINT_TRUST_POLICY_PATH, snapshotPath = exports.BLUEPRINT_TRUST_SNAPSHOT_PATH) {
+    const stateCommits = commits(context, [tip, '--', policyPath, snapshotPath]);
+    if (stateCommits.length === 0 &&
+        stateAtCommit(context, tip, policyPath, snapshotPath) === undefined) {
+        return undefined;
+    }
+    if (stateCommits.at(-1) !== tip)
+        stateCommits.push(tip);
+    const states = historyStates(context, stateCommits, policyPath, snapshotPath);
+    return states[0]?.commit;
+}
+function blueprintTrustAuthorityBaseline(context, tip, policyPath = exports.BLUEPRINT_TRUST_POLICY_PATH, snapshotPath = exports.BLUEPRINT_TRUST_SNAPSHOT_PATH) {
+    const baseline = optionalBlueprintTrustAuthorityBaseline(context, tip, policyPath, snapshotPath);
+    if (!baseline) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'cannot establish the first protected Blueprint trust authority commit');
+    }
+    return baseline;
+}
 function blueprintIdentity(value, path) {
     if (!(0, validation_js_1.isRecord)(value) ||
         !(0, validation_js_1.isRecord)(value.blueprint) ||
@@ -519,7 +537,11 @@ function changedOwnershipAtCommit(context, commit) {
     if (paths.length > MAX_OWNERSHIP_RECORDS) {
         throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, `changes more than ${MAX_OWNERSHIP_RECORDS} Slice ownership records`);
     }
-    return changedOwnershipValuesAtCommit(context, commit, paths).flatMap(({ path, value }) => historicalOwnershipRecord(commit, path, value));
+    const parent = git(context, ['rev-parse', '--verify', `${commit}^1^{commit}`], { allowFailure: true });
+    if (!parent || !FULL_GIT_OBJECT_ID.test(parent)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'cannot resolve the exact first parent of an ownership change after the trust authority floor');
+    }
+    return [parent, commit].flatMap((revision) => changedOwnershipValuesAtCommit(context, revision, paths).flatMap(({ path, value }) => historicalOwnershipRecord(revision, path, value)));
 }
 function protectedWorkspaceHasExternalBlueprintOwnership(input) {
     if (!FULL_GIT_OBJECT_ID.test(input.commit)) {
@@ -605,20 +627,31 @@ function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
     const tips = [
         ...new Set(before.filter((commit) => commit !== undefined)),
     ];
+    const baselines = new Set();
     const history = new Set();
+    const inspectedCommits = new Set();
     for (const tip of tips) {
+        const baseline = shallowBefore === 'false'
+            ? optionalBlueprintTrustAuthorityBaseline(context, tip)
+            : undefined;
+        if (baseline) {
+            baselines.add(baseline);
+            inspectedCommits.add(baseline);
+        }
         const tipHistory = commits(context, [
             `--max-count=${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS + 1}`,
-            tip,
+            baseline ? `${baseline}..${tip}` : tip,
             '--',
             OWNERSHIP_PATHSPEC,
         ]);
-        if (tipHistory.length > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
+        if (tipHistory.length + (baseline ? 1 : 0) >
+            MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
             throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS} changing commits`);
         }
         for (const commit of tipHistory) {
             history.add(commit);
-            if (history.size > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
+            inspectedCommits.add(commit);
+            if (inspectedCommits.size > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
                 throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS} distinct changing commits`);
             }
         }
@@ -627,8 +660,7 @@ function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
     const externalSliceRoots = new Set();
     let externalRecordFound = false;
     let historicalRecordCount = 0;
-    for (const commit of history) {
-        const inventory = changedOwnershipAtCommit(context, commit);
+    const inspectInventory = (inventory) => {
         historicalRecordCount += inventory.length;
         if (historicalRecordCount > MAX_PREGRAPH_OWNERSHIP_HISTORY_RECORDS) {
             throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_RECORDS} aggregate Slice records`);
@@ -643,6 +675,14 @@ function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
             }
             externalSliceRoots.add(`packages/${record.slice}`);
         }
+    };
+    for (const baseline of baselines) {
+        inspectInventory(ownershipInventoryAtCommit(context, baseline));
+    }
+    for (const commit of history) {
+        if (baselines.has(commit))
+            continue;
+        inspectInventory(changedOwnershipAtCommit(context, commit));
     }
     const after = resolveCommits();
     const shallowAfter = git(context, ['rev-parse', '--is-shallow-repository']);
@@ -698,13 +738,11 @@ function changedOwnershipPaths(context, parent, commit) {
     }
     return paths;
 }
-function historicalOwnershipAudit(context, builtInName, tip) {
-    const roots = commits(context, ['--max-parents=0', tip]);
-    if (roots.length !== 1) {
-        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'must have one exact first-parent repository root');
+function historicalOwnershipAudit(context, builtInName, tip, baseline) {
+    if (!commits(context, [tip]).includes(baseline)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'Blueprint trust authority baseline must remain on the exact first-parent lineage');
     }
-    const rootCommit = roots[0];
-    const root = ownershipInventoryAtCommit(context, rootCommit);
+    const root = ownershipInventoryAtCommit(context, baseline);
     const external = new Map();
     const rememberExternal = (record) => {
         if (record.name !== builtInName) {
@@ -712,9 +750,11 @@ function historicalOwnershipAudit(context, builtInName, tip) {
         }
     };
     root.forEach(rememberExternal);
-    for (const commit of commits(context, [tip, '--', OWNERSHIP_PATHSPEC])) {
-        if (commit === rootCommit)
-            continue;
+    for (const commit of commits(context, [
+        `${baseline}..${tip}`,
+        '--',
+        OWNERSHIP_PATHSPEC,
+    ])) {
         const parent = git(context, ['rev-parse', '--verify', `${commit}^1^{commit}`], { allowFailure: true });
         if (!parent || !FULL_GIT_OBJECT_ID.test(parent)) {
             throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'cannot resolve the exact first parent of an ownership change');
@@ -764,7 +804,7 @@ function assertNoPathIndependentRelabel(builtInName, current, before, after) {
         return;
     throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${current.path}#blueprint`, `cannot establish built-in provenance while historical external Blueprint ${relatedExternal.name}@${relatedExternal.version} ownership at ${relatedExternal.path} was removed, moved, or reused`);
 }
-function builtInProvenance(context, input, headCommit, protectedCommit) {
+function builtInProvenance(context, input, headCommit, headBaseline, protectedCommit, protectedBaseline) {
     const provenance = [];
     const currentOwnership = currentOwnershipInventory(input);
     const builtInOwnership = currentOwnership.filter(({ name }) => name === input.builtIn.name);
@@ -772,19 +812,25 @@ function builtInProvenance(context, input, headCommit, protectedCommit) {
         return provenance;
     const protectedOwnership = ownershipInventoryAtCommit(context, protectedCommit);
     const headOwnership = ownershipInventoryAtCommit(context, headCommit);
-    const protectedAudit = historicalOwnershipAudit(context, input.builtIn.name, protectedCommit);
+    const protectedAudit = historicalOwnershipAudit(context, input.builtIn.name, protectedCommit, protectedBaseline);
     const audits = headCommit === protectedCommit
         ? [protectedAudit]
         : [
             protectedAudit,
-            historicalOwnershipAudit(context, input.builtIn.name, headCommit),
+            historicalOwnershipAudit(context, input.builtIn.name, headCommit, headBaseline),
         ];
     for (const currentRecord of builtInOwnership) {
         const current = currentRecord;
         const path = current.path;
         const pathCommits = new Set([
-            ...commits(context, [headCommit, '--', path]),
-            ...commits(context, [protectedCommit, '--', path]),
+            headBaseline,
+            ...commits(context, [`${headBaseline}..${headCommit}`, '--', path]),
+            protectedBaseline,
+            ...commits(context, [
+                `${protectedBaseline}..${protectedCommit}`,
+                '--',
+                path,
+            ]),
         ]);
         for (const commit of pathCommits) {
             const historical = readJsonBlob(context, commit, path);
@@ -852,6 +898,17 @@ function repositoryRootCommit(context, tip) {
 }
 function assertCreateOnlyReceiptRetention(context, receiptCommit, executionCommit, paths) {
     const parents = commitParents(context, receiptCommit);
+    // Generated repository governance retains proposals through merge commits.
+    // Admit that exact shape, not arbitrary ancestry or an updated execution base.
+    const proposal = parents.length === 2 ? parents[1] : undefined;
+    const proposalParents = proposal ? commitParents(context, proposal) : [];
+    const exactRetentionShape = parents[0] === executionCommit &&
+        (parents.length === 1 ||
+            (proposal !== undefined &&
+                proposalParents.length === 1 &&
+                proposalParents[0] === executionCommit &&
+                treeObjectId(context, receiptCommit) ===
+                    treeObjectId(context, proposal)));
     const changedPaths = (git(context, [
         'diff-tree',
         '-r',
@@ -867,15 +924,14 @@ function assertCreateOnlyReceiptRetention(context, receiptCommit, executionCommi
         .map((changedPath) => safeTrackedRepositoryPath(changedPath, 'git.blueprintVerificationReceiptRetention.changedPath'))
         .sort();
     const retainedPaths = [...paths].sort();
-    if (parents.length !== 1 ||
-        parents[0] !== executionCommit ||
+    if (!exactRetentionShape ||
         retainedPaths.length === 0 ||
         retainedPaths.length !== changedPaths.length ||
         retainedPaths.some((path, index) => path !== changedPaths[index]) ||
         retainedPaths.some((path) => !VERIFICATION_RECEIPT_PATH.test(path) ||
             blobObjectId(context, executionCommit, path) !== undefined ||
             blobObjectId(context, receiptCommit, path) === undefined)) {
-        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${receiptCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'protected Blueprint verification receipt retention must be one literal one-parent, receipt-only, create-only commit whose parent is the exact execution commit shared by the complete final set, whose parent tree lacks every retained receipt path in that set, and whose changed paths equal that set');
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${receiptCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'protected Blueprint verification receipt retention must be one receipt-only, create-only commit whose first parent is the exact execution commit shared by the complete final set; a two-parent PR merge must retain the exact tree of a one-parent proposal directly on that same execution commit. The execution tree must lack every retained receipt path and the changed paths must equal the complete set');
     }
 }
 function latestReceiptSetCommit(context, tip, paths, label) {
@@ -1084,6 +1140,10 @@ function inspectBlueprintTrustGitAuthority(input) {
     }
     const protectedStates = historyStates(context, protectedCommits, policyPath, snapshotPath);
     const protectedHistory = (0, blueprint_trust_js_1.validateBlueprintTrustHistory)(protectedStates);
+    const protectedBaseline = protectedStates[0]?.commit;
+    if (!protectedBaseline) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${authorityCommit}:ownership`, 'cannot establish the first protected Blueprint trust authority commit');
+    }
     const authorization = (0, blueprint_trust_js_1.createBlueprintTrustState)(protectedStates.at(-1));
     const mergeBase = git(context, ['merge-base', authorityCommit, headCommit]);
     if (!mergeBase || !FULL_GIT_OBJECT_ID.test(mergeBase)) {
@@ -1102,6 +1162,7 @@ function inspectBlueprintTrustGitAuthority(input) {
         candidateCommits.push(headCommit);
     const candidateStates = historyStates(context, candidateCommits, policyPath, snapshotPath);
     const candidateHistory = (0, blueprint_trust_js_1.validateBlueprintTrustHistory)(candidateStates);
+    const headBaseline = blueprintTrustAuthorityBaseline(context, headCommit, policyPath, snapshotPath);
     const head = (0, blueprint_trust_js_1.createBlueprintTrustState)(candidateStates.at(-1));
     if ((0, blueprint_trust_js_1.blueprintTrustStateDigest)(authorization) !== (0, blueprint_trust_js_1.blueprintTrustStateDigest)(head)) {
         (0, blueprint_trust_js_1.planBlueprintTrustStateTransition)(authorization, head);
@@ -1112,7 +1173,7 @@ function inspectBlueprintTrustGitAuthority(input) {
         : (0, blueprint_trust_js_1.planBlueprintTrustStateTransition)(head, current).receipt;
     return {
         authorization,
-        builtInProvenance: builtInProvenance(context, input, headCommit, authorityCommit),
+        builtInProvenance: builtInProvenance(context, input, headCommit, headBaseline, authorityCommit, protectedBaseline),
         candidateHistory,
         headCommit,
         protectedCommit: authorityCommit,

package/src/supply-chain/blueprint-verification-authority.js

@@ -212,6 +212,38 @@ function readExternalNxConfiguration(path, label) {
  * project identity into Foundation or another Product Slice.
  */
 function assertExternalBlueprintNxProjectConfinement(input) {
+    assertExternalBlueprintNxProjectConfinementInternal(input, false);
+}
+function workspaceCacheIsIgnored(workspaceRoot) {
+    const ignorePath = (0, node_path_1.join)(workspaceRoot, '.gitignore');
+    if (!(0, node_fs_1.existsSync)(ignorePath))
+        return false;
+    const lines = readExternalNxConfiguration(ignorePath, 'Developer-Agent workspace ignore authority').split(/\r?\n/gu);
+    let cacheRule = -1;
+    for (const [index, line] of lines.entries()) {
+        if ([
+            '.ebk',
+            '.ebk/',
+            '.ebk/cache',
+            '.ebk/cache/',
+            '/.ebk',
+            '/.ebk/',
+            '/.ebk/cache',
+            '/.ebk/cache/',
+        ].includes(line)) {
+            cacheRule = index;
+        }
+    }
+    return (cacheRule >= 0 &&
+        lines.slice(cacheRule + 1).every((line) => {
+            if (!line.startsWith('!'))
+                return true;
+            const pattern = line.slice(1);
+            return !(/^\/?\.ebk(?:$|\/|[*?[])/u.test(pattern) ||
+                /^\*\*\/\.ebk(?:$|\/|[*?[])/u.test(pattern));
+        }));
+}
+function assertExternalBlueprintNxProjectConfinementInternal(input, ignoreWorkspaceCache) {
     const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.workspaceRoot));
     const packagesRoot = (0, node_path_1.join)(workspaceRoot, 'packages');
     const roots = new Set();
@@ -290,8 +322,28 @@ function assertExternalBlueprintNxProjectConfinement(input) {
                     continue;
                 }
                 const candidate = (0, node_path_1.join)(directory, entry.name);
+                if (ignoreWorkspaceCache &&
+                    root === '.' &&
+                    relativePath === '.ebk/cache') {
+                    if (!entry.isDirectory() || (0, node_fs_1.realpathSync)(candidate) !== candidate) {
+                        throw new Error('Developer-Agent Nx configuration requires one canonical workspace cache directory.');
+                    }
+                    continue;
+                }
                 if (entry.isSymbolicLink()) {
-                    throw new Error(`External Blueprint Nx configuration refuses symbolic-link authority at ${root}/${relativePath}.`);
+                    let targetIsDirectory = true;
+                    try {
+                        targetIsDirectory = (0, node_fs_1.statSync)(candidate).isDirectory();
+                    }
+                    catch {
+                        throw new Error(`External Blueprint Nx configuration refuses unresolved symbolic-link authority at ${root}/${relativePath}.`);
+                    }
+                    const normalizedName = entry.name.normalize('NFC').toLowerCase();
+                    if (targetIsDirectory ||
+                        ['package.json', 'project.json'].includes(normalizedName)) {
+                        throw new Error(`External Blueprint Nx configuration refuses symbolic-link authority at ${root}/${relativePath}.`);
+                    }
+                    continue;
                 }
                 if (entry.isDirectory()) {
                     if ((0, node_fs_1.realpathSync)(candidate) !== candidate) {
@@ -342,12 +394,12 @@ function assertExternalBlueprintNxProjectConfinement(input) {
  */
 function assertDeveloperAgentNxProjectConfinement(workspaceRoot) {
     const canonicalRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(workspaceRoot));
-    assertExternalBlueprintNxProjectConfinement({
+    assertExternalBlueprintNxProjectConfinementInternal({
         externalRoots: [],
         includeWorkspaceRoot: true,
         packageNxPathMatchers: workspacePackageMatchers(canonicalRoot),
         workspaceRoot: canonicalRoot,
-    });
+    }, workspaceCacheIsIgnored(canonicalRoot));
 }
 function forbiddenConfigurationName(name) {
     const normalized = name.toLowerCase();

package/src/supply-chain/build-output-bounds.d.ts

@@ -0,0 +1,2 @@
+/** Exact internal enforcement seam for portable mutation tests. */
+export declare function assertBuildOutputDirectoryInventoryBound(visitedDirectories: number, pointer: string): void;

package/src/supply-chain/build-output-bounds.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertBuildOutputDirectoryInventoryBound = assertBuildOutputDirectoryInventoryBound;
+const errors_js_1 = require("./errors.js");
+const MAX_DIRECTORIES = 4_096;
+/** Exact internal enforcement seam for portable mutation tests. */
+function assertBuildOutputDirectoryInventoryBound(visitedDirectories, pointer) {
+    if (visitedDirectories > MAX_DIRECTORIES) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'exceeds the bounded build-output directory inventory');
+    }
+}
+//# sourceMappingURL=build-output-bounds.js.map