@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/supply-chain/blueprint-trust-git.js

@@ -369,6 +369,24 @@ function historyStates(context, history, policyPath, snapshotPath) {
     }
     return states;
 }
+function optionalBlueprintTrustAuthorityBaseline(context, tip, policyPath = exports.BLUEPRINT_TRUST_POLICY_PATH, snapshotPath = exports.BLUEPRINT_TRUST_SNAPSHOT_PATH) {
+    const stateCommits = commits(context, [tip, '--', policyPath, snapshotPath]);
+    if (stateCommits.length === 0 &&
+        stateAtCommit(context, tip, policyPath, snapshotPath) === undefined) {
+        return undefined;
+    }
+    if (stateCommits.at(-1) !== tip)
+        stateCommits.push(tip);
+    const states = historyStates(context, stateCommits, policyPath, snapshotPath);
+    return states[0]?.commit;
+}
+function blueprintTrustAuthorityBaseline(context, tip, policyPath = exports.BLUEPRINT_TRUST_POLICY_PATH, snapshotPath = exports.BLUEPRINT_TRUST_SNAPSHOT_PATH) {
+    const baseline = optionalBlueprintTrustAuthorityBaseline(context, tip, policyPath, snapshotPath);
+    if (!baseline) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'cannot establish the first protected Blueprint trust authority commit');
+    }
+    return baseline;
+}
 function blueprintIdentity(value, path) {
     if (!(0, validation_js_1.isRecord)(value) ||
         !(0, validation_js_1.isRecord)(value.blueprint) ||
@@ -519,7 +537,11 @@ function changedOwnershipAtCommit(context, commit) {
     if (paths.length > MAX_OWNERSHIP_RECORDS) {
         throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, `changes more than ${MAX_OWNERSHIP_RECORDS} Slice ownership records`);
     }
-    return changedOwnershipValuesAtCommit(context, commit, paths).flatMap(({ path, value }) => historicalOwnershipRecord(commit, path, value));
+    const parent = git(context, ['rev-parse', '--verify', `${commit}^1^{commit}`], { allowFailure: true });
+    if (!parent || !FULL_GIT_OBJECT_ID.test(parent)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'cannot resolve the exact first parent of an ownership change after the trust authority floor');
+    }
+    return [parent, commit].flatMap((revision) => changedOwnershipValuesAtCommit(context, revision, paths).flatMap(({ path, value }) => historicalOwnershipRecord(revision, path, value)));
 }
 function protectedWorkspaceHasExternalBlueprintOwnership(input) {
     if (!FULL_GIT_OBJECT_ID.test(input.commit)) {
@@ -605,20 +627,31 @@ function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
     const tips = [
         ...new Set(before.filter((commit) => commit !== undefined)),
     ];
+    const baselines = new Set();
     const history = new Set();
+    const inspectedCommits = new Set();
     for (const tip of tips) {
+        const baseline = shallowBefore === 'false'
+            ? optionalBlueprintTrustAuthorityBaseline(context, tip)
+            : undefined;
+        if (baseline) {
+            baselines.add(baseline);
+            inspectedCommits.add(baseline);
+        }
         const tipHistory = commits(context, [
             `--max-count=${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS + 1}`,
-            tip,
+            baseline ? `${baseline}..${tip}` : tip,
             '--',
             OWNERSHIP_PATHSPEC,
         ]);
-        if (tipHistory.length > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
+        if (tipHistory.length + (baseline ? 1 : 0) >
+            MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
             throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS} changing commits`);
         }
         for (const commit of tipHistory) {
             history.add(commit);
-            if (history.size > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
+            inspectedCommits.add(commit);
+            if (inspectedCommits.size > MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS) {
                 throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_COMMITS} distinct changing commits`);
             }
         }
@@ -627,8 +660,7 @@ function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
     const externalSliceRoots = new Set();
     let externalRecordFound = false;
     let historicalRecordCount = 0;
-    for (const commit of history) {
-        const inventory = changedOwnershipAtCommit(context, commit);
+    const inspectInventory = (inventory) => {
         historicalRecordCount += inventory.length;
         if (historicalRecordCount > MAX_PREGRAPH_OWNERSHIP_HISTORY_RECORDS) {
             throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', 'blueprintOwnership.history', `protected ownership history exceeds ${MAX_PREGRAPH_OWNERSHIP_HISTORY_RECORDS} aggregate Slice records`);
@@ -643,6 +675,14 @@ function inspectProtectedWorkspaceExternalBlueprintHistory(input) {
             }
             externalSliceRoots.add(`packages/${record.slice}`);
         }
+    };
+    for (const baseline of baselines) {
+        inspectInventory(ownershipInventoryAtCommit(context, baseline));
+    }
+    for (const commit of history) {
+        if (baselines.has(commit))
+            continue;
+        inspectInventory(changedOwnershipAtCommit(context, commit));
     }
     const after = resolveCommits();
     const shallowAfter = git(context, ['rev-parse', '--is-shallow-repository']);
@@ -698,13 +738,11 @@ function changedOwnershipPaths(context, parent, commit) {
     }
     return paths;
 }
-function historicalOwnershipAudit(context, builtInName, tip) {
-    const roots = commits(context, ['--max-parents=0', tip]);
-    if (roots.length !== 1) {
-        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'must have one exact first-parent repository root');
+function historicalOwnershipAudit(context, builtInName, tip, baseline) {
+    if (!commits(context, [tip]).includes(baseline)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${tip}:ownership`, 'Blueprint trust authority baseline must remain on the exact first-parent lineage');
     }
-    const rootCommit = roots[0];
-    const root = ownershipInventoryAtCommit(context, rootCommit);
+    const root = ownershipInventoryAtCommit(context, baseline);
     const external = new Map();
     const rememberExternal = (record) => {
         if (record.name !== builtInName) {
@@ -712,9 +750,11 @@ function historicalOwnershipAudit(context, builtInName, tip) {
         }
     };
     root.forEach(rememberExternal);
-    for (const commit of commits(context, [tip, '--', OWNERSHIP_PATHSPEC])) {
-        if (commit === rootCommit)
-            continue;
+    for (const commit of commits(context, [
+        `${baseline}..${tip}`,
+        '--',
+        OWNERSHIP_PATHSPEC,
+    ])) {
         const parent = git(context, ['rev-parse', '--verify', `${commit}^1^{commit}`], { allowFailure: true });
         if (!parent || !FULL_GIT_OBJECT_ID.test(parent)) {
             throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${commit}:ownership`, 'cannot resolve the exact first parent of an ownership change');
@@ -764,7 +804,7 @@ function assertNoPathIndependentRelabel(builtInName, current, before, after) {
         return;
     throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${current.path}#blueprint`, `cannot establish built-in provenance while historical external Blueprint ${relatedExternal.name}@${relatedExternal.version} ownership at ${relatedExternal.path} was removed, moved, or reused`);
 }
-function builtInProvenance(context, input, headCommit, protectedCommit) {
+function builtInProvenance(context, input, headCommit, headBaseline, protectedCommit, protectedBaseline) {
     const provenance = [];
     const currentOwnership = currentOwnershipInventory(input);
     const builtInOwnership = currentOwnership.filter(({ name }) => name === input.builtIn.name);
@@ -772,19 +812,25 @@ function builtInProvenance(context, input, headCommit, protectedCommit) {
         return provenance;
     const protectedOwnership = ownershipInventoryAtCommit(context, protectedCommit);
     const headOwnership = ownershipInventoryAtCommit(context, headCommit);
-    const protectedAudit = historicalOwnershipAudit(context, input.builtIn.name, protectedCommit);
+    const protectedAudit = historicalOwnershipAudit(context, input.builtIn.name, protectedCommit, protectedBaseline);
     const audits = headCommit === protectedCommit
         ? [protectedAudit]
         : [
             protectedAudit,
-            historicalOwnershipAudit(context, input.builtIn.name, headCommit),
+            historicalOwnershipAudit(context, input.builtIn.name, headCommit, headBaseline),
         ];
     for (const currentRecord of builtInOwnership) {
         const current = currentRecord;
         const path = current.path;
         const pathCommits = new Set([
-            ...commits(context, [headCommit, '--', path]),
-            ...commits(context, [protectedCommit, '--', path]),
+            headBaseline,
+            ...commits(context, [`${headBaseline}..${headCommit}`, '--', path]),
+            protectedBaseline,
+            ...commits(context, [
+                `${protectedBaseline}..${protectedCommit}`,
+                '--',
+                path,
+            ]),
         ]);
         for (const commit of pathCommits) {
             const historical = readJsonBlob(context, commit, path);
@@ -852,6 +898,17 @@ function repositoryRootCommit(context, tip) {
 }
 function assertCreateOnlyReceiptRetention(context, receiptCommit, executionCommit, paths) {
     const parents = commitParents(context, receiptCommit);
+    // Generated repository governance retains proposals through merge commits.
+    // Admit that exact shape, not arbitrary ancestry or an updated execution base.
+    const proposal = parents.length === 2 ? parents[1] : undefined;
+    const proposalParents = proposal ? commitParents(context, proposal) : [];
+    const exactRetentionShape = parents[0] === executionCommit &&
+        (parents.length === 1 ||
+            (proposal !== undefined &&
+                proposalParents.length === 1 &&
+                proposalParents[0] === executionCommit &&
+                treeObjectId(context, receiptCommit) ===
+                    treeObjectId(context, proposal)));
     const changedPaths = (git(context, [
         'diff-tree',
         '-r',
@@ -867,15 +924,14 @@ function assertCreateOnlyReceiptRetention(context, receiptCommit, executionCommi
         .map((changedPath) => safeTrackedRepositoryPath(changedPath, 'git.blueprintVerificationReceiptRetention.changedPath'))
         .sort();
     const retainedPaths = [...paths].sort();
-    if (parents.length !== 1 ||
-        parents[0] !== executionCommit ||
+    if (!exactRetentionShape ||
         retainedPaths.length === 0 ||
         retainedPaths.length !== changedPaths.length ||
         retainedPaths.some((path, index) => path !== changedPaths[index]) ||
         retainedPaths.some((path) => !VERIFICATION_RECEIPT_PATH.test(path) ||
             blobObjectId(context, executionCommit, path) !== undefined ||
             blobObjectId(context, receiptCommit, path) === undefined)) {
-        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${receiptCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'protected Blueprint verification receipt retention must be one literal one-parent, receipt-only, create-only commit whose parent is the exact execution commit shared by the complete final set, whose parent tree lacks every retained receipt path in that set, and whose changed paths equal that set');
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${receiptCommit}:${VERIFICATION_RECEIPT_DIRECTORY}`, 'protected Blueprint verification receipt retention must be one receipt-only, create-only commit whose first parent is the exact execution commit shared by the complete final set; a two-parent PR merge must retain the exact tree of a one-parent proposal directly on that same execution commit. The execution tree must lack every retained receipt path and the changed paths must equal the complete set');
     }
 }
 function latestReceiptSetCommit(context, tip, paths, label) {
@@ -1084,6 +1140,10 @@ function inspectBlueprintTrustGitAuthority(input) {
     }
     const protectedStates = historyStates(context, protectedCommits, policyPath, snapshotPath);
     const protectedHistory = (0, blueprint_trust_js_1.validateBlueprintTrustHistory)(protectedStates);
+    const protectedBaseline = protectedStates[0]?.commit;
+    if (!protectedBaseline) {
+        throw new errors_js_1.SupplyChainError('supply-chain-blueprint-untrusted', `${authorityCommit}:ownership`, 'cannot establish the first protected Blueprint trust authority commit');
+    }
     const authorization = (0, blueprint_trust_js_1.createBlueprintTrustState)(protectedStates.at(-1));
     const mergeBase = git(context, ['merge-base', authorityCommit, headCommit]);
     if (!mergeBase || !FULL_GIT_OBJECT_ID.test(mergeBase)) {
@@ -1102,6 +1162,7 @@ function inspectBlueprintTrustGitAuthority(input) {
         candidateCommits.push(headCommit);
     const candidateStates = historyStates(context, candidateCommits, policyPath, snapshotPath);
     const candidateHistory = (0, blueprint_trust_js_1.validateBlueprintTrustHistory)(candidateStates);
+    const headBaseline = blueprintTrustAuthorityBaseline(context, headCommit, policyPath, snapshotPath);
     const head = (0, blueprint_trust_js_1.createBlueprintTrustState)(candidateStates.at(-1));
     if ((0, blueprint_trust_js_1.blueprintTrustStateDigest)(authorization) !== (0, blueprint_trust_js_1.blueprintTrustStateDigest)(head)) {
         (0, blueprint_trust_js_1.planBlueprintTrustStateTransition)(authorization, head);
@@ -1112,7 +1173,7 @@ function inspectBlueprintTrustGitAuthority(input) {
         : (0, blueprint_trust_js_1.planBlueprintTrustStateTransition)(head, current).receipt;
     return {
         authorization,
-        builtInProvenance: builtInProvenance(context, input, headCommit, authorityCommit),
+        builtInProvenance: builtInProvenance(context, input, headCommit, headBaseline, authorityCommit, protectedBaseline),
         candidateHistory,
         headCommit,
         protectedCommit: authorityCommit,

package/src/supply-chain/blueprint-verification-authority.js

@@ -212,6 +212,38 @@ function readExternalNxConfiguration(path, label) {
  * project identity into Foundation or another Product Slice.
  */
 function assertExternalBlueprintNxProjectConfinement(input) {
+    assertExternalBlueprintNxProjectConfinementInternal(input, false);
+}
+function workspaceCacheIsIgnored(workspaceRoot) {
+    const ignorePath = (0, node_path_1.join)(workspaceRoot, '.gitignore');
+    if (!(0, node_fs_1.existsSync)(ignorePath))
+        return false;
+    const lines = readExternalNxConfiguration(ignorePath, 'Developer-Agent workspace ignore authority').split(/\r?\n/gu);
+    let cacheRule = -1;
+    for (const [index, line] of lines.entries()) {
+        if ([
+            '.ebk',
+            '.ebk/',
+            '.ebk/cache',
+            '.ebk/cache/',
+            '/.ebk',
+            '/.ebk/',
+            '/.ebk/cache',
+            '/.ebk/cache/',
+        ].includes(line)) {
+            cacheRule = index;
+        }
+    }
+    return (cacheRule >= 0 &&
+        lines.slice(cacheRule + 1).every((line) => {
+            if (!line.startsWith('!'))
+                return true;
+            const pattern = line.slice(1);
+            return !(/^\/?\.ebk(?:$|\/|[*?[])/u.test(pattern) ||
+                /^\*\*\/\.ebk(?:$|\/|[*?[])/u.test(pattern));
+        }));
+}
+function assertExternalBlueprintNxProjectConfinementInternal(input, ignoreWorkspaceCache) {
     const workspaceRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(input.workspaceRoot));
     const packagesRoot = (0, node_path_1.join)(workspaceRoot, 'packages');
     const roots = new Set();
@@ -290,8 +322,28 @@ function assertExternalBlueprintNxProjectConfinement(input) {
                     continue;
                 }
                 const candidate = (0, node_path_1.join)(directory, entry.name);
+                if (ignoreWorkspaceCache &&
+                    root === '.' &&
+                    relativePath === '.ebk/cache') {
+                    if (!entry.isDirectory() || (0, node_fs_1.realpathSync)(candidate) !== candidate) {
+                        throw new Error('Developer-Agent Nx configuration requires one canonical workspace cache directory.');
+                    }
+                    continue;
+                }
                 if (entry.isSymbolicLink()) {
-                    throw new Error(`External Blueprint Nx configuration refuses symbolic-link authority at ${root}/${relativePath}.`);
+                    let targetIsDirectory = true;
+                    try {
+                        targetIsDirectory = (0, node_fs_1.statSync)(candidate).isDirectory();
+                    }
+                    catch {
+                        throw new Error(`External Blueprint Nx configuration refuses unresolved symbolic-link authority at ${root}/${relativePath}.`);
+                    }
+                    const normalizedName = entry.name.normalize('NFC').toLowerCase();
+                    if (targetIsDirectory ||
+                        ['package.json', 'project.json'].includes(normalizedName)) {
+                        throw new Error(`External Blueprint Nx configuration refuses symbolic-link authority at ${root}/${relativePath}.`);
+                    }
+                    continue;
                 }
                 if (entry.isDirectory()) {
                     if ((0, node_fs_1.realpathSync)(candidate) !== candidate) {
@@ -342,12 +394,12 @@ function assertExternalBlueprintNxProjectConfinement(input) {
  */
 function assertDeveloperAgentNxProjectConfinement(workspaceRoot) {
     const canonicalRoot = (0, node_fs_1.realpathSync)((0, node_path_1.resolve)(workspaceRoot));
-    assertExternalBlueprintNxProjectConfinement({
+    assertExternalBlueprintNxProjectConfinementInternal({
         externalRoots: [],
         includeWorkspaceRoot: true,
         packageNxPathMatchers: workspacePackageMatchers(canonicalRoot),
         workspaceRoot: canonicalRoot,
-    });
+    }, workspaceCacheIsIgnored(canonicalRoot));
 }
 function forbiddenConfigurationName(name) {
     const normalized = name.toLowerCase();

package/src/supply-chain/build-output-bounds.d.ts

@@ -0,0 +1,2 @@
+/** Exact internal enforcement seam for portable mutation tests. */
+export declare function assertBuildOutputDirectoryInventoryBound(visitedDirectories: number, pointer: string): void;

package/src/supply-chain/build-output-bounds.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertBuildOutputDirectoryInventoryBound = assertBuildOutputDirectoryInventoryBound;
+const errors_js_1 = require("./errors.js");
+const MAX_DIRECTORIES = 4_096;
+/** Exact internal enforcement seam for portable mutation tests. */
+function assertBuildOutputDirectoryInventoryBound(visitedDirectories, pointer) {
+    if (visitedDirectories > MAX_DIRECTORIES) {
+        throw new errors_js_1.SupplyChainError('supply-chain-sbom-omission', pointer, 'exceeds the bounded build-output directory inventory');
+    }
+}
+//# sourceMappingURL=build-output-bounds.js.map

package/src/supply-chain/build-output.d.ts

@@ -1,6 +1,6 @@
 import type { CycloneDxComponentInput } from './sbom.js';
 export declare const NEXTJS_BUILD_OUTPUT_INVENTORY_KIND: "ebk-nextjs-build-output-inventory";
-export declare const NEXTJS_BUILD_OUTPUT_INVENTORY_SCHEMA_VERSION: 1;
+export declare const NEXTJS_BUILD_OUTPUT_INVENTORY_SCHEMA_VERSION: 2;
 export interface NextJsBuildOutputInventory {
     artifactFamily: 'nextjs-build-output';
     artifactId: string;
@@ -13,6 +13,12 @@ export interface NextJsBuildOutputInventory {
         size: number;
     }[];
     kind: typeof NEXTJS_BUILD_OUTPUT_INVENTORY_KIND;
+    links: readonly {
+        path: string;
+        target: string;
+        targetKind: 'directory' | 'file';
+        targetTextSha256: string;
+    }[];
     materialDigest: string;
     schemaVersion: typeof NEXTJS_BUILD_OUTPUT_INVENTORY_SCHEMA_VERSION;
     sourceCommit: string;