@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/secrets/personal-command.js

@@ -8,10 +8,33 @@ exports.removePersonalSstSecret = removePersonalSstSecret;
 const stages_js_1 = require("../foundation/stages.js");
 const model_js_1 = require("./model.js");
 const HUMAN_SECRET_CEREMONY = Symbol('ebk.human-secret-ceremony');
+const markerNamePattern = /^[A-Z][A-Z0-9_]{0,63}$/;
+function humanRequiredMessage(detail) {
+    const code = '(personal-secret-human-required)';
+    if (detail.reason === 'agent-or-ci') {
+        return [
+            `ebk secret set must be run by a human in a terminal that no agent or CI job spawned ${code},`,
+            'because the hidden prompt does not hide the value from the process that owns this terminal.',
+            'Ask the human to open their own terminal and run the same command;',
+            'agents may use the value-blind secret-metadata and status targets instead.',
+            ...(detail.detectedMarker
+                ? [`Detected agent/CI marker: ${detail.detectedMarker}.`]
+                : []),
+        ].join(' ');
+    }
+    if (detail.reason === 'terminal') {
+        return detail.operation === 'set'
+            ? `ebk secret set needs a local interactive terminal for its hidden value prompt ${code}. Run it in a human-operated terminal that no agent or CI job spawned.`
+            : `ebk secret remove needs a local interactive terminal where the human types the hidden REMOVE <logical-name> confirmation ${code}. An agent may start it only in a terminal the human can type into.`;
+    }
+    return `Personal secret command failed ${code}.`;
+}
 class PersonalSecretCommandError extends Error {
     code;
-    constructor(code) {
-        super(`Personal secret command failed (${code}).`);
+    constructor(code, detail) {
+        super(code === 'personal-secret-human-required' && detail
+            ? humanRequiredMessage(detail)
+            : `Personal secret command failed (${code}).`);
         this.name = 'PersonalSecretCommandError';
         this.code = code;
     }
@@ -24,7 +47,7 @@ function rejectUnexpectedProperties(input, allowed) {
         throw new PersonalSecretCommandError('personal-secret-command-invalid');
     }
 }
-function validateEnvironment(input) {
+function validateEnvironment(input, operation) {
     try {
         (0, model_js_1.validateSecretMetadataDeclaration)(input.declaration);
     }
@@ -42,7 +65,7 @@ function validateEnvironment(input) {
         input.accountId !== input.developmentAccountId) {
         throw new PersonalSecretCommandError('personal-secret-account-invalid');
     }
-    assertHumanSecretCeremony(input.ceremony);
+    assertHumanSecretCeremony(input.ceremony, operation);
 }
 /**
  * Issues the in-process capability used by the CLI after it has inspected the
@@ -52,12 +75,19 @@ function validateEnvironment(input) {
 function issueHumanSecretCeremony(input) {
     if (typeof input.agentDelegated !== 'boolean' ||
         typeof input.interactive !== 'boolean' ||
-        typeof input.stdinIsTty !== 'boolean') {
+        typeof input.stdinIsTty !== 'boolean' ||
+        (input.detectedMarker !== undefined &&
+            (!input.agentDelegated ||
+                typeof input.detectedMarker !== 'string' ||
+                !markerNamePattern.test(input.detectedMarker)))) {
         throw new PersonalSecretCommandError('personal-secret-human-required');
     }
     const ceremony = {
         actor: 'human',
         agentDelegated: input.agentDelegated,
+        ...(input.detectedMarker === undefined
+            ? {}
+            : { detectedMarker: input.detectedMarker }),
         interactive: input.interactive,
         stdinIsTty: input.stdinIsTty,
     };
@@ -69,15 +99,39 @@ function issueHumanSecretCeremony(input) {
     });
     return Object.freeze(ceremony);
 }
-function assertHumanSecretCeremony(ceremony) {
+/**
+ * `set` carries a human-supplied value, so it refuses every agent or CI
+ * marker: a real TTY proves nothing when an agent owns the terminal. `remove`
+ * carries no value and only targets the human's personal development stage,
+ * so an agent-delegated session may start it; it still needs a local
+ * interactive terminal where the human types the hidden confirmation.
+ */
+function assertHumanSecretCeremony(ceremony, operation) {
     if (typeof ceremony !== 'object' ||
         ceremony === null ||
         ceremony[HUMAN_SECRET_CEREMONY] !== true ||
         ceremony.actor !== 'human' ||
-        ceremony.agentDelegated ||
-        !ceremony.interactive ||
-        !ceremony.stdinIsTty) {
-        throw new PersonalSecretCommandError('personal-secret-human-required');
+        (operation !== 'set' && operation !== 'remove')) {
+        throw new PersonalSecretCommandError('personal-secret-human-required', {
+            operation: operation === 'remove' ? 'remove' : 'set',
+            reason: 'capability',
+        });
+    }
+    if (operation === 'set' && ceremony.agentDelegated !== false) {
+        throw new PersonalSecretCommandError('personal-secret-human-required', {
+            ...(typeof ceremony.detectedMarker === 'string' &&
+                markerNamePattern.test(ceremony.detectedMarker)
+                ? { detectedMarker: ceremony.detectedMarker }
+                : {}),
+            operation,
+            reason: 'agent-or-ci',
+        });
+    }
+    if (ceremony.interactive !== true || ceremony.stdinIsTty !== true) {
+        throw new PersonalSecretCommandError('personal-secret-human-required', {
+            operation,
+            reason: 'terminal',
+        });
     }
 }
 async function setPersonalSstSecret(input) {
@@ -92,7 +146,7 @@ async function setPersonalSstSecret(input) {
         'store',
         'validator',
     ]);
-    validateEnvironment(input);
+    validateEnvironment(input, 'set');
     let bytes;
     try {
         bytes = await input.hiddenInput.readHidden({
@@ -163,7 +217,7 @@ async function removePersonalSstSecret(input) {
         'stage',
         'store',
     ]);
-    validateEnvironment(input);
+    validateEnvironment(input, 'remove');
     let confirmed;
     try {
         confirmed = await input.confirmation.confirm({

package/src/secrets/registry.d.ts

@@ -1,9 +1,10 @@
 import { type SecretMetadataDeclaration } from './model.js';
 export declare const SECRET_METADATA_REGISTRY_PATH: "secrets/metadata.json";
-export declare const SECRET_METADATA_REGISTRY_SCHEMA_VERSION: 1;
+export declare const SECRET_METADATA_REGISTRY_SCHEMA_VERSION: 2;
 export interface SecretMetadataRegistry {
     declarations: readonly SecretMetadataDeclaration[];
     schemaVersion: typeof SECRET_METADATA_REGISTRY_SCHEMA_VERSION;
 }
 export declare function parseSecretMetadataRegistry(value: unknown): SecretMetadataRegistry;
 export declare function operatorSecretMetadataDeclarations(registry: SecretMetadataRegistry): readonly SecretMetadataDeclaration[];
+export declare function deployedSecretMetadataDeclarations(registry: SecretMetadataRegistry): readonly SecretMetadataDeclaration[];

package/src/secrets/registry.js

@@ -3,10 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SECRET_METADATA_REGISTRY_SCHEMA_VERSION = exports.SECRET_METADATA_REGISTRY_PATH = void 0;
 exports.parseSecretMetadataRegistry = parseSecretMetadataRegistry;
 exports.operatorSecretMetadataDeclarations = operatorSecretMetadataDeclarations;
+exports.deployedSecretMetadataDeclarations = deployedSecretMetadataDeclarations;
 const deterministic_order_js_1 = require("../deterministic-order.js");
 const model_js_1 = require("./model.js");
 exports.SECRET_METADATA_REGISTRY_PATH = 'secrets/metadata.json';
-exports.SECRET_METADATA_REGISTRY_SCHEMA_VERSION = 1;
+exports.SECRET_METADATA_REGISTRY_SCHEMA_VERSION = 2;
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -19,6 +20,7 @@ function invalidRegistry(path, reason) {
 function parseDeclaration(value, index) {
     if (!isRecord(value) ||
         !hasOnlyProperties(value, [
+            'generation',
             'logicalName',
             'owner',
             'requiredStages',
@@ -36,6 +38,7 @@ function parseDeclaration(value, index) {
             value['rotation']['mode'] !== 'provider-managed') ||
         (value['source'] !== 'aws-managed' &&
             value['source'] !== 'database-bootstrap' &&
+            value['source'] !== 'generated' &&
             value['source'] !== 'operator') ||
         (value['valueKind'] !== 'binary' &&
             value['valueKind'] !== 'json' &&
@@ -43,6 +46,17 @@ function parseDeclaration(value, index) {
         invalidRegistry(`declarations.${index}`, 'must contain only the supported value-free declaration metadata');
     }
     const declaration = Object.freeze({
+        ...(value['generation'] === undefined
+            ? {}
+            : isRecord(value['generation']) &&
+                hasOnlyProperties(value['generation'], ['kind']) &&
+                value['generation']['kind'] === 'hmac-key-ring-v1'
+                ? {
+                    generation: Object.freeze({
+                        kind: value['generation']['kind'],
+                    }),
+                }
+                : invalidRegistry(`declarations.${index}.generation`, 'must select one supported value-blind generator')),
         logicalName: value['logicalName'],
         owner: value['owner'],
         requiredStages: Object.freeze([...value['requiredStages']]),
@@ -83,4 +97,7 @@ function parseSecretMetadataRegistry(value) {
 function operatorSecretMetadataDeclarations(registry) {
     return Object.freeze(registry.declarations.filter(({ source }) => source === 'operator'));
 }
+function deployedSecretMetadataDeclarations(registry) {
+    return Object.freeze(registry.declarations.filter(({ source }) => source === 'operator' || source === 'generated'));
+}
 //# sourceMappingURL=registry.js.map

package/src/secrets/verification.js

@@ -12,13 +12,18 @@ const supportedSourceExtension = /(?:\.(?:[cm]?[jt]sx?|bash|env(?:\.[^/]+)?|json
 const ignoredDirectoryNames = new Set([
     '.git',
     '.next',
+    '.open-next',
     '.sst',
+    '.venv',
     'build',
     'coverage',
     'dist',
     'node_modules',
 ]);
 const maximumSourceBytes = 2 * 1024 * 1024;
+function isGeneratedEvidenceDirectory(projectRoot, directory, entryName) {
+    return directory === (0, node_path_1.resolve)(projectRoot, '.ebk') && entryName === 'evidence';
+}
 class SecretStaticVerificationError extends Error {
     code;
     constructor(code) {
@@ -52,8 +57,11 @@ async function collectSourceFiles(projectRoot, directory, declaredSecretNames) {
     const result = [];
     const entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
     for (const entry of entries.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name))) {
-        if (entry.isDirectory() && ignoredDirectoryNames.has(entry.name))
+        if (entry.isDirectory() &&
+            (ignoredDirectoryNames.has(entry.name) ||
+                isGeneratedEvidenceDirectory(projectRoot, directory, entry.name))) {
             continue;
+        }
         const unresolved = (0, node_path_1.resolve)(directory, entry.name);
         const metadata = await (0, promises_1.lstat)(unresolved);
         if (metadata.isSymbolicLink()) {
@@ -79,7 +87,12 @@ async function collectSourceFiles(projectRoot, directory, declaredSecretNames) {
             ...(path === 'scripts/remove-personal-secrets.mjs'
                 ? { allowFrameworkPersonalSstRemove: true }
                 : {}),
-            ...(['jobs/bootstrap-database.mjs', 'jobs/retire-database.mjs'].includes(path)
+            ...([
+                'authorization/machine-client-provisioner.spec.ts',
+                'authorization/machine-client-provisioner.ts',
+                'jobs/bootstrap-database.mjs',
+                'jobs/retire-database.mjs',
+            ].includes(path)
                 ? { allowFrameworkSecretProviderClient: true }
                 : {}),
             ...(path === 'infra/personal-secrets.ts'

package/src/secrets/workload-access.js

@@ -118,7 +118,8 @@ function createSecretWorkloadAccessPlan(input) {
     for (const binding of activeBindings) {
         const declaration = declarations.get(binding.logicalName);
         const reference = references.get(binding.logicalName);
-        if (declaration?.source !== 'operator' ||
+        if ((declaration?.source !== 'operator' &&
+            declaration?.source !== 'generated') ||
             reference?.logicalName !== declaration.logicalName) {
             throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
         }
@@ -151,9 +152,16 @@ function personalSecretNamesForWorkload(input) {
         .filter(({ workload }) => workload === input.workload)
         .flatMap(({ logicalName }) => {
         const declaration = declarations.get(logicalName);
-        if (!declaration || declaration.source !== 'operator') {
+        if (!declaration ||
+            (declaration.source !== 'operator' &&
+                declaration.source !== 'generated')) {
             throw new SecretWorkloadAccessError('secret-workload-reference-invalid');
         }
+        // Generated values exist only in canonical deployed stages. They are
+        // valid workload bindings, but never become personal `sst.Secret`
+        // resources during the dirty-tree development loop.
+        if (declaration.source === 'generated')
+            return [];
         return declaration.requiredStages.includes(input.stage)
             ? [logicalName]
             : [];

package/src/sst-environment-source-format.d.ts

@@ -0,0 +1,6 @@
+/** Exact default declaration emitted by the pinned Next 16.3 toolchain. */
+export declare function generatedNextEnvironmentSource(dev?: boolean): string;
+export declare function isExactGeneratedNextEnvironmentSourceBytes(bytes: Buffer): boolean;
+export declare function isExactGeneratedRootSstEnvironmentSourceBytes(bytes: Buffer): boolean;
+export declare function isExactGeneratedRootSstPythonSourceBytes(bytes: Buffer): boolean;
+export declare function exactGeneratedNestedSstEnvironmentSourceBytes(nestedPath: string, rootSourcePath: string): readonly Buffer[];

package/src/sst-environment-source-format.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatedNextEnvironmentSource = generatedNextEnvironmentSource;
+exports.isExactGeneratedNextEnvironmentSourceBytes = isExactGeneratedNextEnvironmentSourceBytes;
+exports.isExactGeneratedRootSstEnvironmentSourceBytes = isExactGeneratedRootSstEnvironmentSourceBytes;
+exports.isExactGeneratedRootSstPythonSourceBytes = isExactGeneratedRootSstPythonSourceBytes;
+exports.exactGeneratedNestedSstEnvironmentSourceBytes = exactGeneratedNestedSstEnvironmentSourceBytes;
+const node_path_1 = require("node:path");
+/** Exact default declaration emitted by the pinned Next 16.3 toolchain. */
+function generatedNextEnvironmentSource(dev = false) {
+    const directory = dev ? '.next/dev' : '.next';
+    return `/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./${directory}/types/routes.d.ts";
+import "./${directory}/types/root-params.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
+`;
+}
+function isExactGeneratedNextEnvironmentSourceBytes(bytes) {
+    return [false, true].some((dev) => [
+        generatedNextEnvironmentSource(dev),
+        generatedNextEnvironmentSource(dev).split('\n').join('\r\n'),
+    ].some((source) => bytes.equals(Buffer.from(source))));
+}
+const GENERATED_HEADER = [
+    '/* This file is auto-generated by SST. Do not edit. */',
+    '/* tslint:disable */',
+    '/* eslint-disable */',
+    '/* deno-fmt-ignore-file */',
+    '/* biome-ignore-all lint: auto-generated */',
+    '',
+];
+function exactJsonString(value) {
+    try {
+        const parsed = JSON.parse(value);
+        return typeof parsed === 'string' && JSON.stringify(parsed) === value;
+    }
+    catch {
+        return false;
+    }
+}
+function exactGeneratedResourceMembers(lines) {
+    let depth = 0;
+    for (const line of lines) {
+        const indentation = line.match(/^ */u)?.[0].length ?? 0;
+        if (line.trim() === '}') {
+            if (depth === 0 || indentation !== 4 + (depth - 1) * 2)
+                return false;
+            depth -= 1;
+            continue;
+        }
+        if (indentation !== 4 + depth * 2)
+            return false;
+        const property = line
+            .slice(indentation)
+            .match(/^("(?:[^"\\]|\\.)*"): (.+)$/u);
+        if (!property ||
+            !property[1] ||
+            !property[2] ||
+            !exactJsonString(property[1])) {
+            return false;
+        }
+        if (property[2] === '{') {
+            depth += 1;
+            continue;
+        }
+        // SST emits JSON property names followed by TypeScript type expressions.
+        // Keep the accepted alphabet deliberately type-only: executable statement
+        // delimiters, comments, assignments, templates, and braces are excluded.
+        if (!/^[A-Za-z0-9_.$@/:"'<>()[\]|&?, -]+$/u.test(property[2])) {
+            return false;
+        }
+    }
+    return depth === 0;
+}
+function isExactGeneratedRootSstEnvironmentSourceBytes(bytes) {
+    const source = bytes.toString('utf8');
+    if (!Buffer.from(source, 'utf8').equals(bytes))
+        return false;
+    const normalized = source.split('\r\n').join('\n');
+    if (normalized.includes('\r'))
+        return false;
+    const lines = normalized.endsWith('\n')
+        ? normalized.slice(0, -1).split('\n')
+        : normalized.split('\n');
+    const prefix = [
+        ...GENERATED_HEADER,
+        'declare module "sst" {',
+        '  export interface Resource {',
+    ];
+    const suffix = ['  }', '}', '', 'import "sst"', 'export {}'];
+    if (lines.length < prefix.length + suffix.length ||
+        prefix.some((line, index) => lines[index] !== line) ||
+        suffix.some((line, index) => lines[lines.length - suffix.length + index] !== line)) {
+        return false;
+    }
+    return exactGeneratedResourceMembers(lines.slice(prefix.length, lines.length - suffix.length));
+}
+function exactGeneratedPythonType(value) {
+    if (!/^[A-Za-z0-9_,.[\]| ]+$/u.test(value))
+        return false;
+    const identifiers = value.match(/[A-Za-z_][A-Za-z0-9_]*/gu) ?? [];
+    if (identifiers.some((identifier) => ![
+        'Any',
+        'None',
+        'bool',
+        'dict',
+        'float',
+        'int',
+        'list',
+        'set',
+        'str',
+        'tuple',
+    ].includes(identifier))) {
+        return false;
+    }
+    let depth = 0;
+    for (const character of value) {
+        if (character === '[')
+            depth += 1;
+        if (character === ']')
+            depth -= 1;
+        if (depth < 0)
+            return false;
+    }
+    return depth === 0;
+}
+function isExactGeneratedRootSstPythonSourceBytes(bytes) {
+    const source = bytes.toString('utf8');
+    if (!Buffer.from(source, 'utf8').equals(bytes))
+        return false;
+    const normalized = source.split('\r\n').join('\n');
+    if (normalized.includes('\r'))
+        return false;
+    const lines = normalized.endsWith('\n')
+        ? normalized.slice(0, -1).split('\n')
+        : normalized.split('\n');
+    if (lines.at(-1) === '')
+        lines.pop();
+    if (lines.at(-1) === '')
+        return false;
+    const prefix = [
+        '# Automatically generated by SST',
+        '# pylint: disable=all',
+        '# ruff: noqa',
+        'from typing import Any',
+        '',
+        'class Resource:',
+    ];
+    if (lines.length <= prefix.length ||
+        prefix.some((line, index) => lines[index] !== line)) {
+        return false;
+    }
+    let observedClass = false;
+    let observedMember = false;
+    for (const line of lines.slice(prefix.length)) {
+        const classDeclaration = line.match(/^ {4}class ([A-Za-z_][A-Za-z0-9_]*):$/u);
+        if (classDeclaration) {
+            if (observedClass && !observedMember)
+                return false;
+            observedClass = true;
+            observedMember = false;
+            continue;
+        }
+        const member = line.match(/^ {8}([A-Za-z_][A-Za-z0-9_]*): (.+)$/u);
+        if (!observedClass ||
+            !member?.[2] ||
+            !exactGeneratedPythonType(member[2])) {
+            return false;
+        }
+        observedMember = true;
+    }
+    return observedClass && observedMember;
+}
+function exactGeneratedNestedSstEnvironmentSourceBytes(nestedPath, rootSourcePath) {
+    const reference = (0, node_path_1.relative)((0, node_path_1.dirname)(nestedPath), rootSourcePath)
+        .split('\\')
+        .join('/');
+    if (!reference.startsWith('../') || reference.endsWith('/'))
+        return [];
+    const lines = [
+        ...GENERATED_HEADER,
+        `/// <reference path="${reference}" />`,
+        '',
+        'import "sst"',
+        'export {}',
+    ];
+    const lf = lines.join('\n');
+    const crlf = lines.join('\r\n');
+    return [
+        Buffer.from(lf, 'utf8'),
+        Buffer.from(`${lf}\n`, 'utf8'),
+        Buffer.from(crlf, 'utf8'),
+        Buffer.from(`${crlf}\r\n`, 'utf8'),
+    ];
+}
+//# sourceMappingURL=sst-environment-source-format.js.map

package/src/supply-chain/action-pins.js

@@ -9,22 +9,71 @@ exports.ACTION_PIN_INVENTORY_SCHEMA_VERSION = 1;
 const GITHUB_ACTION_SHA = /^[a-f0-9]{40}$/;
 const ACTION_REFERENCE = /^(?<action>[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_./-]+)?)@(?<sha>[a-f0-9]{40})$/;
 const CONTAINER_REFERENCE = /^(?:docker:\/\/)?(?<image>[a-z0-9][a-z0-9._/-]*):(?<tag>[A-Za-z0-9._-]+)@sha256:(?<sha>[a-f0-9]{64})$/;
-function findUses(value, uses) {
+const LOCAL_REUSABLE_WORKFLOW = /^\.\/\.github\/workflows\/[A-Za-z0-9_.-]+\.yml$/;
+const WORKFLOW_DOCUMENT = /^\.github\/workflows\/[A-Za-z0-9_.-]+\.ya?ml$/;
+function findUses(value, uses, location = []) {
     if (Array.isArray(value)) {
-        value.forEach((entry) => findUses(entry, uses));
+        value.forEach((entry, index) => findUses(entry, uses, [...location, index]));
         return;
     }
     if (!value || typeof value !== 'object')
         return;
     for (const [key, child] of Object.entries(value)) {
         if (key === 'uses' && typeof child === 'string') {
-            uses.push(child);
+            uses.push({ location: [...location, key], reference: child });
         }
         else {
-            findUses(child, uses);
+            findUses(child, uses, [...location, key]);
         }
     }
 }
+function isJobLevelWorkflowUse(location) {
+    return (location.length === 3 &&
+        location[0] === 'jobs' &&
+        typeof location[1] === 'string' &&
+        location[2] === 'uses');
+}
+function declaresWorkflowCall(document) {
+    if (!document || typeof document !== 'object' || Array.isArray(document)) {
+        return false;
+    }
+    const trigger = document['on'];
+    if (trigger === 'workflow_call')
+        return true;
+    if (Array.isArray(trigger))
+        return trigger.includes('workflow_call');
+    return (trigger !== null &&
+        typeof trigger === 'object' &&
+        !Array.isArray(trigger) &&
+        Object.prototype.hasOwnProperty.call(trigger, 'workflow_call'));
+}
+function verifyLocalReusableWorkflow(use, files, callerPath) {
+    const { location, reference } = use;
+    if (reference.includes('${{')) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} is a dynamic executable input`);
+    }
+    if (!WORKFLOW_DOCUMENT.test(callerPath) || !isJobLevelWorkflowUse(location)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} is a repository-local action; only static job-level reusable workflows are admitted`);
+    }
+    if (!LOCAL_REUSABLE_WORKFLOW.test(reference)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} must be an exact ./.github/workflows/*.yml reusable-workflow path without traversal`);
+    }
+    const targetPath = reference.slice(2);
+    const targetSource = files[targetPath];
+    if (targetSource === undefined) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} does not resolve to a repository workflow`);
+    }
+    let targetDocument;
+    try {
+        targetDocument = (0, yaml_1.parse)(targetSource);
+    }
+    catch (error) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', targetPath, `cannot parse reusable workflow: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!declaresWorkflowCall(targetDocument)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', callerPath, `${reference} does not declare workflow_call`);
+    }
+}
 function workflowContainerReferences(document, path) {
     if (!document || typeof document !== 'object' || Array.isArray(document)) {
         return [];
@@ -133,11 +182,16 @@ function verifyActionPinInventory(files, inventory, scope) {
         findUses(document, uses);
         const executableReferences = [
             ...uses,
-            ...workflowContainerReferences(document, path),
+            ...workflowContainerReferences(document, path).map((reference) => ({
+                location: ['jobs', 'container'],
+                reference,
+            })),
         ];
-        for (const reference of executableReferences) {
+        for (const use of executableReferences) {
+            const { reference } = use;
             if (reference.startsWith('./')) {
-                throw new errors_js_1.SupplyChainError('supply-chain-action-unpinned', path, `${reference} is a repository-local action, which the v1 exact pin inventory does not admit`);
+                verifyLocalReusableWorkflow(use, files, path);
+                continue;
             }
             const container = CONTAINER_REFERENCE.exec(reference);
             if (reference.startsWith('docker://') || container) {