@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/executors/router-waf-rehearsal/router-waf-rehearsal.js

@@ -0,0 +1,1229 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRouterWafRehearsalExecutor = createRouterWafRehearsalExecutor;
+const client_cloudwatch_1 = require("@aws-sdk/client-cloudwatch");
+const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
+const client_cloudfront_1 = require("@aws-sdk/client-cloudfront");
+const client_sts_1 = require("@aws-sdk/client-sts");
+const node_https_1 = require("node:https");
+const client_wafv2_1 = require("@aws-sdk/client-wafv2");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../foundation/index.js");
+const router_waf_rate_rehearsal_js_1 = require("../../foundation/router-waf-rate-rehearsal.js");
+const index_js_2 = require("../../aws-authority/index.js");
+const private_smoke_access_js_1 = require("../../foundation/private-smoke-access.js");
+const identity_js_1 = require("../../aws/identity.js");
+const index_js_3 = require("../../repository-policy/index.js");
+const deterministic_order_js_1 = require("../../deterministic-order.js");
+const index_js_4 = require("../../workspace-deployment/index.js");
+const MAX_ROUTER_WAF_EVIDENCE_BYTES = 32 * 1024;
+const FOUNDATION_ROOT = (0, node_path_1.join)('packages', 'foundation');
+const POLICY_PATH = (0, node_path_1.join)('security', 'router-waf.json');
+const EVIDENCE_PATH = (0, node_path_1.join)('security', 'router-waf-live-evidence.json');
+const RECEIPT_PATH = (0, node_path_1.join)('security', 'router-waf-blocking-rehearsal.json');
+const GLOBAL_WAF_REGION = 'us-east-1';
+const REQUEST_TIMEOUT_MS = 15_000;
+const RATE_MARKER_HEADER = 'x-ebk-waf-rate-rehearsal';
+const OPERATOR_MARKER_HEADER = 'x-ebk-waf-rehearsal';
+const RATE_MARKER_NONCE_PATTERN = /^[a-f0-9]{64}$/u;
+const SLICE_HEALTH_PATH = /^\/[a-z0-9]+(?:-[a-z0-9]+)*\/api\/health$/u;
+const WAF_ARN = /^arn:(aws|aws-us-gov):wafv2:us-east-1:(\d{12}):global\/webacl\/([A-Za-z0-9_-]{1,128})\/([a-f0-9-]{36})$/u;
+const WAF_IP_SET_ARN = /^arn:(aws|aws-us-gov):wafv2:us-east-1:(\d{12}):global\/ipset\/([A-Za-z0-9_-]{1,128})\/([a-f0-9-]{36})$/u;
+const WORKSPACE_PATTERN = /^[a-z0-9][a-z0-9-]{0,127}$/u;
+const MAX_ROUTER_WAF_SEED_AGE_MS = 4 * 60 * 60 * 1_000;
+function readBoundedJson(path, label) {
+    const before = (0, node_fs_1.lstatSync)(path, { bigint: true });
+    if (!before.isFile() || before.nlink !== 1n) {
+        throw new Error(`${label} must be one unaliased regular file.`);
+    }
+    if (before.size > BigInt(MAX_ROUTER_WAF_EVIDENCE_BYTES)) {
+        throw new Error(`${label} exceeds the bounded evidence size.`);
+    }
+    const bytes = (0, node_fs_1.readFileSync)(path);
+    const after = (0, node_fs_1.lstatSync)(path, { bigint: true });
+    if (before.dev !== after.dev ||
+        before.ino !== after.ino ||
+        before.mode !== after.mode ||
+        before.size !== after.size ||
+        before.mtimeNs !== after.mtimeNs ||
+        before.ctimeNs !== after.ctimeNs) {
+        throw new Error(`${label} changed while it was being read.`);
+    }
+    try {
+        return JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        throw new Error(`${label} is not valid JSON.`);
+    }
+}
+function writeBoundedJson(path, value, label) {
+    const existing = (0, node_fs_1.lstatSync)(path, { bigint: true });
+    if (!existing.isFile() || existing.nlink !== 1n) {
+        throw new Error(`${label} must be one unaliased regular file.`);
+    }
+    const bytes = `${JSON.stringify(value, null, 2)}\n`;
+    if (Buffer.byteLength(bytes) > MAX_ROUTER_WAF_EVIDENCE_BYTES) {
+        throw new Error(`${label} exceeds its bound.`);
+    }
+    const temporary = `${path}.tmp-${process.pid}`;
+    let descriptor;
+    let cleanupError;
+    try {
+        descriptor = (0, node_fs_1.openSync)(temporary, 'wx', Number(existing.mode & 511n));
+        (0, node_fs_1.writeFileSync)(descriptor, bytes, 'utf8');
+        (0, node_fs_1.closeSync)(descriptor);
+        descriptor = undefined;
+        (0, node_fs_1.renameSync)(temporary, path);
+    }
+    finally {
+        if (descriptor !== undefined)
+            (0, node_fs_1.closeSync)(descriptor);
+        try {
+            (0, node_fs_1.unlinkSync)(temporary);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                cleanupError = error;
+            }
+        }
+    }
+    if (cleanupError)
+        throw cleanupError;
+}
+function partitionForRegion(region) {
+    return region.startsWith('cn-')
+        ? 'aws-cn'
+        : region.startsWith('us-gov-')
+            ? 'aws-us-gov'
+            : 'aws';
+}
+function selectedProfile(options, environment) {
+    const explicit = options.profile?.trim();
+    const internal = environment.AWS_PROFILE?.trim();
+    if (explicit && internal && explicit !== internal) {
+        throw new Error('Router WAF rehearsal explicit profile differs from the invocation AWS_PROFILE.');
+    }
+    const profile = explicit || internal || undefined;
+    if (environment.GITHUB_ACTIONS === 'true') {
+        if (profile) {
+            throw new Error('Protected GitHub Router WAF rehearsal must use its configured OIDC credentials, not an AWS profile.');
+        }
+        return undefined;
+    }
+    if (!profile) {
+        throw new Error('Local Router WAF rehearsal requires the explicit or invocation-private AWS_PROFILE.');
+    }
+    return profile;
+}
+function markerDigest(value) {
+    return `sha256:${(0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex')}`;
+}
+function rateMarker(nonce, sequence) {
+    return `${nonce}:${sequence}`;
+}
+function normalizedProbeUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('Router WAF rate probe URL must be one absolute URL.');
+    }
+    if (url.protocol !== 'https:' ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.hash !== '' ||
+        url.search !== '' ||
+        url.port !== '' ||
+        !SLICE_HEALTH_PATH.test(url.pathname)) {
+        throw new Error('Router WAF rate probe URL must be HTTPS on the default port, contain no credentials/query/fragment, and use /<kebab-slice>/api/health.');
+    }
+    return url;
+}
+function clients(profile, region, dependencies) {
+    const credentials = profile ? (0, credential_providers_1.fromIni)({ profile }) : undefined;
+    const common = credentials ? { credentials } : {};
+    return {
+        cloudFront: (dependencies.createCloudFrontClient ??
+            ((configuration) => new client_cloudfront_1.CloudFrontClient(configuration)))({
+            ...common,
+            region: GLOBAL_WAF_REGION,
+        }),
+        cloudWatch: (dependencies.createCloudWatchClient ??
+            ((configuration) => new client_cloudwatch_1.CloudWatchClient(configuration)))({
+            ...common,
+            region: GLOBAL_WAF_REGION,
+        }),
+        cloudWatchLogs: (dependencies.createCloudWatchLogsClient ??
+            ((configuration) => new client_cloudwatch_logs_1.CloudWatchLogsClient(configuration)))({
+            ...common,
+            region: GLOBAL_WAF_REGION,
+        }),
+        sts: (dependencies.createStsClient ??
+            ((configuration) => new client_sts_1.STSClient(configuration)))({
+            ...common,
+            endpoint: (0, identity_js_1.canonicalStsEndpoint)(region),
+            region,
+        }),
+        waf: (dependencies.createWafClient ??
+            ((configuration) => new client_wafv2_1.WAFV2Client(configuration)))({
+            ...common,
+            region: GLOBAL_WAF_REGION,
+        }),
+    };
+}
+async function attestCloudFrontDistribution(input) {
+    const expectedArn = `arn:${input.partition}:cloudfront::${input.accountId}:distribution/${input.distributionId}`;
+    const [result, tagResult] = await Promise.all([
+        input.cloudFront.send(new client_cloudfront_1.GetDistributionCommand({ Id: input.distributionId })),
+        input.cloudFront.send(new client_cloudfront_1.ListTagsForResourceCommand({ Resource: expectedArn })),
+    ]);
+    const distribution = result.Distribution;
+    const configuration = distribution?.DistributionConfig;
+    const aliases = configuration?.Aliases?.Items ?? [];
+    if (distribution?.ARN !== expectedArn ||
+        distribution?.Id !== input.distributionId ||
+        distribution.Status !== 'Deployed' ||
+        configuration?.Staging !== false ||
+        !distribution.DomainName ||
+        !configuration ||
+        configuration.Enabled !== true ||
+        configuration.WebACLId !== input.webAclArn ||
+        (input.probeHost !== distribution.DomainName &&
+            !aliases.includes(input.probeHost))) {
+        throw new Error('Router WAF rehearsal probe is not bound to the exact enabled deployed CloudFront distribution, Web ACL, DomainName, or Alias.');
+    }
+    const tags = new Map((tagResult.Tags?.Items ?? []).flatMap((tag) => tag.Key && tag.Value ? [[tag.Key, tag.Value]] : []));
+    if (tags.get('ebk:managed-by') !== 'empire-builder-kit' ||
+        tags.get('ebk:owner') !== 'foundation' ||
+        tags.get('ebk:stage') !== input.stage ||
+        tags.get('ebk:workspace') !== input.workspace) {
+        throw new Error('Live CloudFront distribution lacks the exact generated workspace, stage, owner, or managed identity tags.');
+    }
+}
+function liveRecord(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} is not one object.`);
+    }
+    return value;
+}
+function exactLiveKeys(value, expected, label) {
+    const observed = Object.entries(value)
+        .filter(([, item]) => item !== undefined)
+        .map(([key]) => key)
+        .sort();
+    const required = [...expected].sort();
+    if (JSON.stringify(observed) !== JSON.stringify(required)) {
+        throw new Error(`${label} has an unexpected live shape.`);
+    }
+}
+function emptyLiveObject(value, label) {
+    const candidate = liveRecord(value, label);
+    exactLiveKeys(candidate, [], label);
+}
+function canonicalLive(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalLive).join(',')}]`;
+    }
+    if (value && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([key, item]) => `${JSON.stringify(key)}:${canonicalLive(item)}`)
+            .join(',')}}`;
+    }
+    const encoded = JSON.stringify(value);
+    if (encoded === undefined) {
+        throw new Error('Router WAF live contract contains an unsupported value.');
+    }
+    return encoded;
+}
+function canonicalRulesForComparison(rules) {
+    const normalized = structuredClone(rules);
+    const allowlist = normalized.find(({ name }) => name === 'StageIpAllowlist');
+    const statement = allowlist?.statement;
+    const references = statement?.notStatement?.statement?.orStatement?.statements;
+    if (references) {
+        references.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(canonicalLive(left), canonicalLive(right)));
+    }
+    return canonicalLive(normalized);
+}
+function normalizedLiveVisibility(value, expectedMetricName, label) {
+    const candidate = liveRecord(value, `${label} visibility`);
+    exactLiveKeys(candidate, ['CloudWatchMetricsEnabled', 'MetricName', 'SampledRequestsEnabled'], `${label} visibility`);
+    if (candidate.CloudWatchMetricsEnabled !== true ||
+        candidate.SampledRequestsEnabled !== true ||
+        candidate.MetricName !== expectedMetricName) {
+        throw new Error(`${label} visibility differs from the generated plan.`);
+    }
+    return {
+        cloudwatchMetricsEnabled: true,
+        metricName: expectedMetricName,
+        sampledRequestsEnabled: true,
+    };
+}
+function normalizedIpSetReference(value, label) {
+    const candidate = liveRecord(value, label);
+    exactLiveKeys(candidate, ['ARN'], label);
+    if (typeof candidate.ARN !== 'string') {
+        throw new Error(`${label} ARN is invalid.`);
+    }
+    return {
+        arn: candidate.ARN,
+        normalized: { ipSetReferenceStatement: { arn: candidate.ARN } },
+    };
+}
+function normalizedLiveRules(input) {
+    const prefix = `Ebk${input.stage[0].toUpperCase()}${input.stage.slice(1)}`;
+    const expectedNames = [
+        'StageIpAllowlist',
+        router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_RULE_NAME,
+        'AWSManagedRulesCommonRuleSet',
+        'AWSManagedRulesKnownBadInputsRuleSet',
+        'AWSManagedRulesAmazonIpReputationList',
+    ];
+    if (input.rules.length !== expectedNames.length ||
+        input.rules.some((rule, index) => liveRecord(rule, `Router WAF rule ${index}`).Name !==
+            expectedNames[index])) {
+        throw new Error('Live Router WAF ordered rule inventory differs from the generated blocking plan.');
+    }
+    const ipSetArns = [];
+    const rules = input.rules.map((value, index) => {
+        const name = expectedNames[index] ?? '';
+        const rule = liveRecord(value, `Router WAF rule ${name}`);
+        const managed = name.startsWith('AWSManagedRules');
+        exactLiveKeys(rule, managed
+            ? [
+                'Name',
+                'OverrideAction',
+                'Priority',
+                'Statement',
+                'VisibilityConfig',
+            ]
+            : ['Action', 'Name', 'Priority', 'Statement', 'VisibilityConfig'], `Router WAF rule ${name}`);
+        if (rule.Name !== name || rule.Priority !== index) {
+            throw new Error(`Live Router WAF rule ${name} priority differs from the generated plan.`);
+        }
+        const visibilityConfig = normalizedLiveVisibility(rule.VisibilityConfig, `${prefix}${name}`, `Router WAF rule ${name}`);
+        const statement = liveRecord(rule.Statement, `Router WAF rule ${name} statement`);
+        if (name === 'StageIpAllowlist') {
+            const action = liveRecord(rule.Action, 'StageIpAllowlist action');
+            exactLiveKeys(action, ['Block'], 'StageIpAllowlist action');
+            emptyLiveObject(action.Block, 'StageIpAllowlist Block action');
+            exactLiveKeys(statement, ['NotStatement'], 'StageIpAllowlist statement');
+            const notStatement = liveRecord(statement.NotStatement, 'StageIpAllowlist not statement');
+            exactLiveKeys(notStatement, ['Statement'], 'StageIpAllowlist not statement');
+            const nested = liveRecord(notStatement.Statement, 'StageIpAllowlist nested statement');
+            let normalizedNested;
+            if ('IPSetReferenceStatement' in nested) {
+                exactLiveKeys(nested, ['IPSetReferenceStatement'], 'StageIpAllowlist nested statement');
+                const reference = normalizedIpSetReference(nested.IPSetReferenceStatement, 'StageIpAllowlist IP set reference');
+                ipSetArns.push(reference.arn);
+                normalizedNested = reference.normalized;
+            }
+            else {
+                exactLiveKeys(nested, ['OrStatement'], 'StageIpAllowlist nested statement');
+                const orStatement = liveRecord(nested.OrStatement, 'StageIpAllowlist OR statement');
+                exactLiveKeys(orStatement, ['Statements'], 'StageIpAllowlist OR statement');
+                if (!Array.isArray(orStatement.Statements) ||
+                    orStatement.Statements.length < 2 ||
+                    orStatement.Statements.length > 3) {
+                    throw new Error('StageIpAllowlist OR statement must contain the exact generated baseline and smoke references.');
+                }
+                const references = orStatement.Statements.map((item, referenceIndex) => {
+                    const wrapper = liveRecord(item, `StageIpAllowlist reference ${referenceIndex}`);
+                    exactLiveKeys(wrapper, ['IPSetReferenceStatement'], `StageIpAllowlist reference ${referenceIndex}`);
+                    const reference = normalizedIpSetReference(wrapper.IPSetReferenceStatement, `StageIpAllowlist reference ${referenceIndex}`);
+                    ipSetArns.push(reference.arn);
+                    return reference.normalized;
+                });
+                normalizedNested = { orStatement: { statements: references } };
+            }
+            return {
+                action: { block: {} },
+                name,
+                priority: index,
+                statement: {
+                    notStatement: { statement: normalizedNested },
+                },
+                visibilityConfig,
+            };
+        }
+        if (name === router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_RULE_NAME) {
+            const action = liveRecord(rule.Action, 'RateLimitPerIP action');
+            exactLiveKeys(action, ['Block'], 'RateLimitPerIP action');
+            emptyLiveObject(action.Block, 'RateLimitPerIP Block action');
+            exactLiveKeys(statement, ['RateBasedStatement'], 'RateLimitPerIP statement');
+            const rate = liveRecord(statement.RateBasedStatement, 'RateLimitPerIP rate statement');
+            const rateKeys = Object.entries(rate)
+                .filter(([, item]) => item !== undefined)
+                .map(([key]) => key)
+                .sort();
+            if (JSON.stringify(rateKeys) !==
+                JSON.stringify([
+                    'AggregateKeyType',
+                    ...(rate.EvaluationWindowSec === undefined
+                        ? []
+                        : ['EvaluationWindowSec']),
+                    'Limit',
+                ].sort()) ||
+                rate.AggregateKeyType !== 'IP' ||
+                typeof rate.Limit !== 'number' ||
+                (rate.EvaluationWindowSec !== undefined &&
+                    rate.EvaluationWindowSec !== 300)) {
+                throw new Error('Live RateLimitPerIP contains an unexpected scope-down, forwarded-IP, custom-key, evaluation-window, or limit shape.');
+            }
+            return {
+                action: { block: {} },
+                name,
+                priority: index,
+                statement: {
+                    rateBasedStatement: {
+                        aggregateKeyType: 'IP',
+                        limit: rate.Limit,
+                    },
+                },
+                visibilityConfig,
+            };
+        }
+        const overrideAction = liveRecord(rule.OverrideAction, `Router WAF rule ${name} override action`);
+        exactLiveKeys(overrideAction, ['None'], `Router WAF rule ${name} override action`);
+        emptyLiveObject(overrideAction.None, `Router WAF rule ${name} None action`);
+        exactLiveKeys(statement, ['ManagedRuleGroupStatement'], `Router WAF rule ${name} statement`);
+        const managedStatement = liveRecord(statement.ManagedRuleGroupStatement, `Router WAF rule ${name} managed statement`);
+        const common = name === 'AWSManagedRulesCommonRuleSet';
+        exactLiveKeys(managedStatement, common
+            ? ['Name', 'RuleActionOverrides', 'VendorName']
+            : ['Name', 'VendorName'], `Router WAF rule ${name} managed statement`);
+        if (managedStatement.Name !== name ||
+            managedStatement.VendorName !== 'AWS') {
+            throw new Error(`Live Router WAF rule ${name} managed group differs from the generated plan.`);
+        }
+        let ruleActionOverrides;
+        if (common) {
+            if (!Array.isArray(managedStatement.RuleActionOverrides) ||
+                managedStatement.RuleActionOverrides.length !== 1) {
+                throw new Error('AWSManagedRulesCommonRuleSet must retain the exact SizeRestrictions_BODY Count override.');
+            }
+            const override = liveRecord(managedStatement.RuleActionOverrides[0], 'SizeRestrictions_BODY override');
+            exactLiveKeys(override, ['ActionToUse', 'Name'], 'SizeRestrictions_BODY override');
+            const actionToUse = liveRecord(override.ActionToUse, 'SizeRestrictions_BODY action');
+            exactLiveKeys(actionToUse, ['Count'], 'SizeRestrictions_BODY action');
+            emptyLiveObject(actionToUse.Count, 'SizeRestrictions_BODY Count action');
+            if (override.Name !== 'SizeRestrictions_BODY') {
+                throw new Error('AWSManagedRulesCommonRuleSet override targets an unexpected rule.');
+            }
+            ruleActionOverrides = [
+                {
+                    actionToUse: { count: {} },
+                    name: 'SizeRestrictions_BODY',
+                },
+            ];
+        }
+        return {
+            name,
+            overrideAction: { none: {} },
+            priority: index,
+            statement: {
+                managedRuleGroupStatement: {
+                    name,
+                    ...(common ? { ruleActionOverrides } : {}),
+                    vendorName: 'AWS',
+                },
+            },
+            visibilityConfig,
+        };
+    });
+    return { ipSetArns, rules };
+}
+function requiredIdentityTags(input) {
+    return {
+        'ebk:managed-by': 'empire-builder-kit',
+        'ebk:owner': 'foundation',
+        'ebk:policy-digest': input.policyDigest,
+        'ebk:stage': input.stage,
+        'ebk:workspace': input.workspace,
+    };
+}
+function attestWafTags(tagsResult, resourceArn, expected, label) {
+    const result = liveRecord(tagsResult, `${label} tag response`);
+    const tagInfo = liveRecord(result.TagInfoForResource, `${label} tag information`);
+    if (tagInfo.ResourceARN !== resourceArn || !Array.isArray(tagInfo.TagList)) {
+        throw new Error(`${label} tag response does not identify the exact ARN.`);
+    }
+    const tags = new Map(tagInfo.TagList.flatMap((value) => {
+        const tag = liveRecord(value, `${label} tag`);
+        return typeof tag.Key === 'string' && typeof tag.Value === 'string'
+            ? [[tag.Key, tag.Value]]
+            : [];
+    }));
+    if (Object.entries(expected).some(([key, value]) => tags.get(key) !== value)) {
+        throw new Error(`${label} lacks the exact generated identity tags.`);
+    }
+}
+async function attestIpSet(input) {
+    const arn = WAF_IP_SET_ARN.exec(input.arn);
+    if (!arn || arn[2] !== input.accountId) {
+        throw new Error('Router WAF IP set ARN has the wrong account or scope.');
+    }
+    const name = arn[3] ?? '';
+    const id = arn[4] ?? '';
+    const smoke = name ===
+        `foundation-${input.expectedTags['ebk:stage']}-router-smoke-access`;
+    const [ipSetResult, tagsResult] = await Promise.all([
+        input.waf.send(new client_wafv2_1.GetIPSetCommand({ Id: id, Name: name, Scope: 'CLOUDFRONT' })),
+        input.waf.send(new client_wafv2_1.ListTagsForResourceCommand({ ResourceARN: input.arn })),
+    ]);
+    const ipSet = ipSetResult.IPSet;
+    const expectedCidrs = smoke
+        ? input.admittedCidr
+            ? [input.admittedCidr]
+            : []
+        : ipSet?.IPAddressVersion === 'IPV4'
+            ? input.expectedIpv4Cidrs
+            : input.expectedIpv6Cidrs;
+    if (ipSet?.ARN !== input.arn ||
+        ipSet.Id !== id ||
+        ipSet.Name !== name ||
+        (smoke && ipSet.IPAddressVersion !== 'IPV4') ||
+        (ipSet.IPAddressVersion !== 'IPV4' && ipSet.IPAddressVersion !== 'IPV6') ||
+        JSON.stringify([...(ipSet.Addresses ?? [])].sort()) !==
+            JSON.stringify([...expectedCidrs].sort())) {
+        throw new Error('Live Router WAF IP set identity, address family, or exact CIDRs differ from the generated plan.');
+    }
+    const expectedTags = smoke
+        ? {
+            ...Object.fromEntries(Object.entries(input.expectedTags).filter(([key]) => key !== 'ebk:policy-digest')),
+            'ebk:purpose': 'private-smoke-access',
+        }
+        : input.expectedTags;
+    attestWafTags(tagsResult, input.arn, expectedTags, 'Router WAF IP set');
+    return smoke ? 'SMOKE' : ipSet.IPAddressVersion;
+}
+async function attestLoggingConfiguration(input) {
+    let configuration;
+    try {
+        const result = await input.waf.send(new client_wafv2_1.GetLoggingConfigurationCommand({ ResourceArn: input.webAclArn }));
+        configuration = result.LoggingConfiguration;
+    }
+    catch (error) {
+        if (input.plan.logging === false &&
+            error instanceof Error &&
+            error.name === 'WAFNonexistentItemException') {
+            return;
+        }
+        throw error;
+    }
+    if (input.plan.logging === false) {
+        if (configuration !== undefined) {
+            throw new Error('Router WAF logging exists even though committed policy disables it.');
+        }
+        return;
+    }
+    const live = liveRecord(configuration, 'Router WAF logging configuration');
+    if (live.ResourceArn !== input.webAclArn ||
+        !Array.isArray(live.LogDestinationConfigs) ||
+        live.LogDestinationConfigs.length !== 1 ||
+        typeof live.LogDestinationConfigs[0] !== 'string' ||
+        !new RegExp(`^arn:(?:aws|aws-us-gov):logs:us-east-1:${input.accountId}:log-group:(aws-waf-logs-foundation-${input.plan.stage}-FoundationRouter-[A-Za-z0-9]{1,32})$`).test(live.LogDestinationConfigs[0]) ||
+        live.ManagedByFirewallManager !== false ||
+        live.LogScope !== 'CUSTOMER' ||
+        live.LogType !== 'WAF_LOGS') {
+        throw new Error('Router WAF logging destination differs from the generated blocking log contract.');
+    }
+    const destinationArn = live.LogDestinationConfigs[0];
+    const logGroupName = destinationArn.slice(destinationArn.indexOf(':log-group:') + 11);
+    const logGroups = await input.cloudWatchLogs.send(new client_cloudwatch_logs_1.DescribeLogGroupsCommand({
+        includeLinkedAccounts: false,
+        logGroupNamePrefix: logGroupName,
+    }));
+    const exactLogGroups = (logGroups.logGroups ?? []).filter(({ logGroupName: candidate }) => candidate === logGroupName);
+    if (exactLogGroups.length !== 1 ||
+        exactLogGroups[0]?.logGroupArn !== destinationArn ||
+        exactLogGroups[0]?.arn !== `${destinationArn}:*` ||
+        exactLogGroups[0]?.logGroupClass !== 'STANDARD' ||
+        exactLogGroups[0]?.retentionInDays !==
+            ({ '1 day': 1, '3 days': 3, '5 days': 5, '1 week': 7, '2 weeks': 14 }[input.plan.logging.retention] ?? -1)) {
+        throw new Error('Router WAF CloudWatch Logs destination identity, class, or retention differs from committed policy.');
+    }
+    const expectedRedactions = [
+        { queryString: {} },
+        { singleHeader: { name: 'authorization' } },
+        { singleHeader: { name: 'cookie' } },
+        { singleHeader: { name: 'x-api-key' } },
+    ];
+    const redactions = Array.isArray(live.RedactedFields)
+        ? live.RedactedFields.map((value) => {
+            const field = liveRecord(value, 'Router WAF redacted field');
+            if ('QueryString' in field) {
+                exactLiveKeys(field, ['QueryString'], 'Router WAF query redaction');
+                emptyLiveObject(field.QueryString, 'Router WAF query redaction');
+                return { queryString: {} };
+            }
+            exactLiveKeys(field, ['SingleHeader'], 'Router WAF header redaction');
+            const header = liveRecord(field.SingleHeader, 'Router WAF header redaction');
+            exactLiveKeys(header, ['Name'], 'Router WAF header redaction');
+            return { singleHeader: { name: header.Name } };
+        })
+        : [];
+    const filter = liveRecord(live.LoggingFilter, 'Router WAF logging filter');
+    exactLiveKeys(filter, ['DefaultBehavior', 'Filters'], 'Router WAF logging filter');
+    if (canonicalLive([...redactions].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(canonicalLive(left), canonicalLive(right)))) !==
+        canonicalLive([...expectedRedactions].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(canonicalLive(left), canonicalLive(right)))) ||
+        filter.DefaultBehavior !== 'DROP' ||
+        !Array.isArray(filter.Filters) ||
+        filter.Filters.length !== 1) {
+        throw new Error('Router WAF logging redaction or blocked-only filter differs from committed policy.');
+    }
+    const retainedFilter = liveRecord(filter.Filters[0], 'Router WAF log filter');
+    exactLiveKeys(retainedFilter, ['Behavior', 'Conditions', 'Requirement'], 'Router WAF log filter');
+    if (retainedFilter.Behavior !== 'KEEP' ||
+        retainedFilter.Requirement !== 'MEETS_ANY' ||
+        !Array.isArray(retainedFilter.Conditions) ||
+        retainedFilter.Conditions.length !== 1 ||
+        canonicalLive(retainedFilter.Conditions) !==
+            canonicalLive([{ ActionCondition: { Action: 'BLOCK' } }])) {
+        throw new Error('Router WAF logging filter does not retain only blocked requests.');
+    }
+}
+async function attestRouterWafBaseline(input) {
+    const arn = WAF_ARN.exec(input.webAclArn);
+    if (!arn || arn[2] !== input.accountId) {
+        throw new Error('Router WAF rehearsal Web ACL ARN does not match the committed account and global scope.');
+    }
+    const name = arn[3] ?? '';
+    const id = arn[4] ?? '';
+    const [webAclResult, tagsResult] = await Promise.all([
+        input.waf.send(new client_wafv2_1.GetWebACLCommand({ Id: id, Name: name, Scope: 'CLOUDFRONT' })),
+        input.waf.send(new client_wafv2_1.ListTagsForResourceCommand({ ResourceARN: input.webAclArn })),
+    ]);
+    const webAcl = webAclResult.WebACL;
+    if (webAcl?.ARN !== input.webAclArn ||
+        webAcl.Id !== id ||
+        webAcl.Name !== name ||
+        !webAcl.DefaultAction?.Allow ||
+        Object.keys(webAcl.DefaultAction).some((key) => key !== 'Allow') ||
+        webAcl.VisibilityConfig?.CloudWatchMetricsEnabled !== true ||
+        webAcl.VisibilityConfig.SampledRequestsEnabled !== true ||
+        webAcl.VisibilityConfig.MetricName !== input.webAclMetricName) {
+        throw new Error('Live Router WAF identity, default action, or Web ACL visibility differs from the generated plan.');
+    }
+    emptyLiveObject(webAcl.DefaultAction.Allow, 'Router WAF Web ACL default Allow action');
+    const expectedTags = requiredIdentityTags(input);
+    attestWafTags(tagsResult, input.webAclArn, expectedTags, 'Router WAF Web ACL');
+    const normalized = normalizedLiveRules({
+        rules: webAcl.Rules ?? [],
+        stage: input.stage,
+    });
+    const expectedIpSetCount = Number(input.plan.ipv4Cidrs.length > 0) +
+        Number(input.plan.ipv6Cidrs.length > 0) +
+        1;
+    if (normalized.ipSetArns.length !== expectedIpSetCount) {
+        throw new Error('Live StageIpAllowlist has an unexpected number of generated IP set references.');
+    }
+    if (new Set(normalized.ipSetArns).size !== normalized.ipSetArns.length) {
+        throw new Error('Live StageIpAllowlist reuses an IP set instead of the exact generated address-family inventory.');
+    }
+    const ipSetResults = await Promise.all(normalized.ipSetArns.map(async (ipSetArn) => {
+        const version = await attestIpSet({
+            accountId: input.accountId,
+            arn: ipSetArn,
+            ...(input.admittedCidr ? { admittedCidr: input.admittedCidr } : {}),
+            // Admission owns only the separate smoke set. Baselines stay exact.
+            expectedIpv4Cidrs: input.plan.ipv4Cidrs,
+            expectedIpv6Cidrs: input.plan.ipv6Cidrs,
+            expectedTags,
+            waf: input.waf,
+        });
+        return { arn: ipSetArn, version };
+    }));
+    const ipv4Arn = ipSetResults.find(({ version }) => version === 'IPV4')?.arn;
+    const ipv6Arn = ipSetResults.find(({ version }) => version === 'IPV6')?.arn;
+    const smokeArn = ipSetResults.find(({ version }) => version === 'SMOKE')?.arn;
+    if (!smokeArn ||
+        Boolean(ipv4Arn) !== Boolean(input.plan.ipv4Cidrs.length) ||
+        Boolean(ipv6Arn) !== Boolean(input.plan.ipv6Cidrs.length)) {
+        throw new Error('Live Router WAF IP set address families differ from the generated plan.');
+    }
+    const expectedRules = (0, index_js_1.createRouterWafRules)(input.plan, {
+        smokeArn,
+        ...(ipv4Arn ? { ipv4Arn } : {}),
+        ...(ipv6Arn ? { ipv6Arn } : {}),
+    });
+    if (canonicalRulesForComparison(normalized.rules) !==
+        canonicalRulesForComparison(expectedRules)) {
+        throw new Error('Live Router WAF ordered rules differ from the exact generated blocking plan.');
+    }
+    await attestLoggingConfiguration({
+        accountId: input.accountId,
+        cloudWatchLogs: input.cloudWatchLogs,
+        plan: input.plan,
+        waf: input.waf,
+        webAclArn: input.webAclArn,
+    });
+    return { ipSetArns: normalized.ipSetArns, name };
+}
+function matchesManagedSampledRule(input) {
+    if (!input.group || !input.subrule)
+        return false;
+    return (input.observed === input.subrule ||
+        input.observed === `AWS#${input.group}#${input.subrule}`);
+}
+async function attestOperatorBlock(input) {
+    const [managedGroup, managedSubrule] = input.evidence.ruleName.split('#');
+    const metricName = input.type === 'nonallowlisted'
+        ? `Ebk${input.stage[0].toUpperCase()}${input.stage.slice(1)}StageIpAllowlist`
+        : `Ebk${input.stage[0].toUpperCase()}${input.stage.slice(1)}${managedGroup}`;
+    const blockedAt = new Date(input.evidence.blockedAt);
+    const sampled = await input.waf.send(new client_wafv2_1.GetSampledRequestsCommand({
+        MaxItems: 500,
+        RuleMetricName: metricName,
+        Scope: 'CLOUDFRONT',
+        TimeWindow: {
+            EndTime: new Date(blockedAt.getTime() + 60_000),
+            StartTime: new Date(blockedAt.getTime() - 60_000),
+        },
+        WebAclArn: input.webAclArn,
+    }));
+    const matches = (sampled.SampledRequests ?? []).filter((sample) => {
+        const headers = sample.Request?.Headers ?? [];
+        const marker = headers.find(({ Name }) => Name?.toLowerCase() === OPERATOR_MARKER_HEADER)?.Value;
+        const timestamp = sample.Timestamp?.getTime();
+        return (sample.Action === 'BLOCK' &&
+            sample.Request?.Method === input.evidence.method &&
+            sample.Request.URI === input.evidence.path &&
+            marker === input.evidence.marker &&
+            timestamp !== undefined &&
+            Math.abs(timestamp - blockedAt.getTime()) <= 60_000 &&
+            (input.type === 'nonallowlisted'
+                ? sample.RuleNameWithinRuleGroup === undefined
+                : matchesManagedSampledRule({
+                    group: managedGroup,
+                    observed: sample.RuleNameWithinRuleGroup,
+                    subrule: managedSubrule,
+                })));
+    });
+    if (matches.length !== 1) {
+        throw new Error(`Router WAF ${input.type} operator evidence does not correlate to one exact sampled BLOCK request.`);
+    }
+}
+async function observeRateLimit(input) {
+    const [sampled, metric] = await Promise.all([
+        input.waf.send(new client_wafv2_1.GetSampledRequestsCommand({
+            MaxItems: 500,
+            RuleMetricName: input.ruleMetricName,
+            Scope: 'CLOUDFRONT',
+            TimeWindow: {
+                EndTime: input.endTime,
+                StartTime: input.startTime,
+            },
+            WebAclArn: input.webAclArn,
+        })),
+        input.cloudWatch.send(new client_cloudwatch_1.GetMetricDataCommand({
+            EndTime: input.endTime,
+            MetricDataQueries: [
+                {
+                    Id: 'rateblocked',
+                    MetricStat: {
+                        Metric: {
+                            Dimensions: [
+                                { Name: 'Rule', Value: input.ruleMetricName },
+                                { Name: 'WebACL', Value: input.webAclMetricName },
+                            ],
+                            MetricName: 'BlockedRequests',
+                            Namespace: 'AWS/WAFV2',
+                        },
+                        Period: 60,
+                        Stat: 'Sum',
+                    },
+                    ReturnData: true,
+                },
+            ],
+            ScanBy: 'TimestampDescending',
+            StartTime: input.startTime,
+        })),
+    ]);
+    const result = metric.MetricDataResults?.find((candidate) => candidate.Id === 'rateblocked');
+    const metrics = (result?.Timestamps ?? []).flatMap((timestamp, index) => {
+        const value = result?.Values?.[index];
+        return timestamp && typeof value === 'number'
+            ? [
+                {
+                    name: 'BlockedRequests',
+                    namespace: 'AWS/WAFV2',
+                    ruleMetricName: input.ruleMetricName,
+                    timestamp,
+                    value,
+                    webAclMetricName: input.webAclMetricName,
+                },
+            ]
+            : [];
+    });
+    const samples = (sampled.SampledRequests ?? []).flatMap((sample) => {
+        const markerHeader = sample.Request?.Headers?.find((header) => header.Name?.toLowerCase() === RATE_MARKER_HEADER &&
+            header.Value === input.marker);
+        return sample.Timestamp &&
+            typeof sample.Action === 'string' &&
+            sample.Request?.Method === 'GET' &&
+            sample.Request.URI === input.probePath &&
+            markerHeader
+            ? [
+                {
+                    action: sample.Action,
+                    markerDigest: input.markerDigest,
+                    method: 'GET',
+                    ruleMetricName: input.ruleMetricName,
+                    ruleName: router_waf_rate_rehearsal_js_1.ROUTER_WAF_RATE_RULE_NAME,
+                    timestamp: sample.Timestamp,
+                    uri: input.probePath,
+                },
+            ]
+            : [];
+    });
+    return { metrics, samples };
+}
+function mergeRateEvidence(evidence, allowedRequestStatus, rateLimit, completedAt) {
+    const candidate = evidence;
+    const probes = candidate.probes;
+    return {
+        ...candidate,
+        completedAt,
+        probes: { ...probes, allowedRequestStatus, rateLimit },
+    };
+}
+const SEED_ATTESTATION_RETRIES = 12;
+const SEED_ATTESTATION_INTERVAL_MS = 10_000;
+function rawGet(url, headers) {
+    return new Promise((resolve, reject) => {
+        const request = (0, node_https_1.request)(url, { headers, method: 'GET', timeout: REQUEST_TIMEOUT_MS }, (response) => {
+            response.resume();
+            resolve({ status: response.statusCode ?? 0 });
+        });
+        request.on('timeout', () => request.destroy(new Error('timeout')));
+        request.on('error', reject);
+        request.end();
+    });
+}
+async function attestOperatorBlocks(input) {
+    // AWS WAF publishes sampled requests with a short delay; a seeded run
+    // probed moments ago, so its attestation waits a bounded number of times.
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            await Promise.all([
+                attestOperatorBlock({
+                    evidence: input.seed.probes
+                        .managedRule,
+                    stage: input.stage,
+                    type: 'managed',
+                    waf: input.waf,
+                    webAclArn: input.seed.webAclArn,
+                }),
+                attestOperatorBlock({
+                    evidence: input.seed.probes
+                        .nonAllowlisted,
+                    stage: input.stage,
+                    type: 'nonallowlisted',
+                    waf: input.waf,
+                    webAclArn: input.seed.webAclArn,
+                }),
+            ]);
+            return;
+        }
+        catch (error) {
+            if (attempt >= input.retries)
+                throw error;
+            await input.sleep(SEED_ATTESTATION_INTERVAL_MS);
+        }
+    }
+}
+async function discoverRouterDistribution(input) {
+    const items = [];
+    let marker;
+    const seen = new Set();
+    do {
+        const page = await input.cloudFront.send(new client_cloudfront_1.ListDistributionsCommand({ Marker: marker }));
+        items.push(...(page.DistributionList?.Items ?? []));
+        marker = page.DistributionList?.NextMarker;
+        if (marker && seen.has(marker)) {
+            throw new Error('Router inventory pagination did not advance.');
+        }
+        if (marker)
+            seen.add(marker);
+        if (seen.size > 100) {
+            throw new Error('Router inventory exceeds bounded inspection.');
+        }
+    } while (marker);
+    const routers = items.filter((router) => router.DomainName === input.probeHost ||
+        router.Aliases?.Items?.includes(input.probeHost));
+    const router = routers[0];
+    if (routers.length !== 1 ||
+        !router?.Enabled ||
+        typeof router.Id !== 'string' ||
+        router.ARN !==
+            `arn:${input.partition}:cloudfront::${input.accountId}:distribution/${router.Id}` ||
+        typeof router.WebACLId !== 'string' ||
+        !WAF_ARN.test(router.WebACLId) ||
+        WAF_ARN.exec(router.WebACLId)?.[2] !== input.accountId) {
+        throw new Error('Managed rehearsal probe host does not resolve to one exact enabled Router distribution with an account-owned Web ACL.');
+    }
+    return { distributionId: router.Id, webAclArn: router.WebACLId };
+}
+function createRouterWafRehearsalExecutor(dependencies = {}) {
+    return async (options, context) => {
+        try {
+            const environment = dependencies.environment ?? process.env;
+            const root = (0, node_path_1.join)(context.root, FOUNDATION_ROOT);
+            const policy = (0, index_js_1.normalizeRouterWafPolicy)(readBoundedJson((0, node_path_1.join)(root, POLICY_PATH), 'Router WAF policy'));
+            const workspaceManifest = liveRecord(readBoundedJson((0, node_path_1.join)(context.root, 'package.json'), 'Workspace manifest'), 'Workspace manifest');
+            const workspace = workspaceManifest.name;
+            if (typeof workspace !== 'string' || !WORKSPACE_PATTERN.test(workspace)) {
+                throw new Error('Router WAF rehearsal workspace must match the exact generated root package name.');
+            }
+            const operatingPolicy = (0, index_js_3.readRepositoryOperatingPolicy)(context.root);
+            if (operatingPolicy.deploymentProfile !== policy.deploymentProfile) {
+                throw new Error('Router WAF policy deployment profile differs from the committed repository policy.');
+            }
+            const stage = (0, index_js_3.productionRehearsalStage)(operatingPolicy.deploymentProfile);
+            const accountId = (0, index_js_3.configuredDeploymentAccountForStage)(operatingPolicy.deploymentProfile, operatingPolicy.deploymentAccounts, stage);
+            const region = (0, index_js_3.configuredDeploymentRegion)(operatingPolicy.deploymentRegion);
+            for (const candidate of [
+                environment.AWS_REGION?.trim(),
+                environment.AWS_DEFAULT_REGION?.trim(),
+            ]) {
+                if (candidate && candidate !== region) {
+                    throw new Error(`Router WAF rehearsal ambient Region ${candidate} differs from committed deployment Region ${region}.`);
+                }
+            }
+            const partition = partitionForRegion(region);
+            const expectedRoleArn = (0, index_js_2.createStageAuthorityIdentity)({
+                accountId,
+                partition,
+                region,
+                stage,
+            }).deploymentRoleArn;
+            const wafContractDigest = (0, index_js_1.routerWafContractDigest)(policy);
+            const plan = (0, index_js_1.createRouterWafStagePlan)({
+                policy,
+                rehearsal: null,
+                stage,
+            });
+            const evidencePath = (0, node_path_1.join)(root, EVIDENCE_PATH);
+            const url = normalizedProbeUrl(options.probeUrl);
+            const profile = selectedProfile(options, environment);
+            const aws = clients(profile, region, dependencies);
+            const seedProbes = options.seedProbes === true;
+            const sleep = dependencies.sleep ??
+                ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+            const receiptPath = (0, node_path_1.join)(root, RECEIPT_PATH);
+            const retainSealedRehearsal = (sealed) => {
+                writeBoundedJson(evidencePath, sealed.evidence, 'Router WAF live evidence');
+                writeBoundedJson(receiptPath, sealed.receipt, 'Router WAF blocking rehearsal receipt');
+                devkit_1.logger.info(JSON.stringify({
+                    evidenceDigest: sealed.receipt.evidenceDigest,
+                    accountId: sealed.receipt.accountId,
+                    policyDigest: sealed.receipt.policyDigest,
+                    rateRequests: sealed.rateRequests,
+                    region: sealed.receipt.region,
+                    sealed: true,
+                    stage: sealed.receipt.stage,
+                }));
+            };
+            // `defer` keeps every file write out of the seal: the managed rehearsal
+            // retains its receipt only after the admission is removed and the live
+            // allowlist reads back exactly as committed.
+            const seal = async (options = {}) => {
+                const retainedEvidence = options.seedEvidence ??
+                    readBoundedJson(evidencePath, 'Router WAF live evidence');
+                const seed = (0, index_js_1.validateRouterWafLiveEvidenceSeed)({
+                    evidence: retainedEvidence,
+                    policy,
+                });
+                if (seed.stage !== stage ||
+                    seed.accountId !== accountId ||
+                    seed.region !== region ||
+                    seed.deploymentRoleArn !== expectedRoleArn ||
+                    seed.workspace !== workspace ||
+                    seed.wafContractDigest !== wafContractDigest) {
+                    throw new Error('Router WAF live evidence stage, account, Region, deployment role, workspace, or WAF contract differs from committed authority.');
+                }
+                const invocationStartedAt = (dependencies.now ?? (() => new Date()))();
+                if (!Number.isFinite(invocationStartedAt.getTime()) ||
+                    seed.startedAt > invocationStartedAt.getTime() ||
+                    seed.completedAt > invocationStartedAt.getTime() ||
+                    invocationStartedAt.getTime() - seed.completedAt >
+                        MAX_ROUTER_WAF_SEED_AGE_MS) {
+                    throw new Error('Router WAF live evidence seed is stale or future-dated; no live request was made.');
+                }
+                const retainedReceipt = (0, index_js_1.normalizeRouterWafBlockingRehearsal)(readBoundedJson(receiptPath, 'Router WAF blocking rehearsal receipt'));
+                if (retainedReceipt) {
+                    throw new Error('Router WAF blocking rehearsal receipt must be reset to its exact pending seed before another live probe.');
+                }
+                const identity = await aws.sts.send(new client_sts_1.GetCallerIdentityCommand({}));
+                if (identity.Account !== accountId ||
+                    typeof identity.Arn !== 'string' ||
+                    !(0, identity_js_1.matchesExpectedAssumedRoleArn)(accountId, identity.Arn, expectedRoleArn)) {
+                    throw new Error('Router WAF rehearsal caller does not match the committed account and exact stage deployment role.');
+                }
+                await (dependencies.ownership ?? index_js_4.assertWorkspaceStageOwnershipForWorkspace)(context.root, stage, profile ? { profile } : {});
+                const webAclVisibilityMetricName = (0, router_waf_rate_rehearsal_js_1.routerWafWebAclMetricName)(stage);
+                const [, baselineAttestation] = await Promise.all([
+                    attestCloudFrontDistribution({
+                        accountId,
+                        cloudFront: aws.cloudFront,
+                        distributionId: seed.distributionId,
+                        partition,
+                        probeHost: url.hostname,
+                        stage,
+                        webAclArn: seed.webAclArn,
+                        workspace,
+                    }),
+                    attestRouterWafBaseline({
+                        accountId,
+                        ...(options.admittedCidr
+                            ? { admittedCidr: options.admittedCidr }
+                            : {}),
+                        cloudWatchLogs: aws.cloudWatchLogs,
+                        plan,
+                        policyDigest: (0, index_js_1.routerWafPolicyDigest)(policy),
+                        stage,
+                        waf: aws.waf,
+                        webAclArn: seed.webAclArn,
+                        webAclMetricName: webAclVisibilityMetricName,
+                        workspace,
+                    }),
+                ]);
+                const webAclMetricName = baselineAttestation.name;
+                await attestOperatorBlocks({
+                    retries: seedProbes ? SEED_ATTESTATION_RETRIES : 0,
+                    seed,
+                    sleep,
+                    stage,
+                    waf: aws.waf,
+                });
+                const fetchRequest = dependencies.fetch ?? fetch;
+                const baselineResponse = await fetchRequest(url, {
+                    cache: 'no-store',
+                    headers: { 'cache-control': 'no-cache' },
+                    redirect: 'manual',
+                    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                });
+                const allowedRequestStatus = baselineResponse.status;
+                await baselineResponse.body?.cancel();
+                if (allowedRequestStatus < 200 || allowedRequestStatus > 399) {
+                    throw new Error(`Router WAF rehearsal health preflight returned unexpected HTTP ${allowedRequestStatus}; rate traffic was not sent.`);
+                }
+                const nonce = (dependencies.createNonce ?? (() => (0, node_crypto_1.randomBytes)(32).toString('hex')))();
+                if (!RATE_MARKER_NONCE_PATTERN.test(nonce)) {
+                    throw new Error('Router WAF rehearsal invocation nonce is not one opaque 256-bit lowercase hexadecimal value.');
+                }
+                const rateLimit = await (dependencies.runRateRehearsal ?? router_waf_rate_rehearsal_js_1.runRouterWafRateRehearsal)({
+                    dependencies: {
+                        ...(dependencies.now ? { now: dependencies.now } : {}),
+                        observe: ({ endTime, markerDigest: expectedMarkerDigest, ruleMetricName, sequence, startTime, webAclMetricName: expectedWebAclMetricName, }) => {
+                            const marker = rateMarker(nonce, sequence);
+                            if (expectedWebAclMetricName !== webAclMetricName) {
+                                throw new Error('Router WAF rate observation metric dimension differs from the attested physical Web ACL name.');
+                            }
+                            if (markerDigest(marker) !== expectedMarkerDigest) {
+                                throw new Error('Router WAF rate observation marker differs from the exact blocked request.');
+                            }
+                            return observeRateLimit({
+                                cloudWatch: aws.cloudWatch,
+                                endTime,
+                                marker,
+                                markerDigest: expectedMarkerDigest,
+                                probePath: url.pathname,
+                                ruleMetricName,
+                                startTime,
+                                waf: aws.waf,
+                                webAclArn: seed.webAclArn,
+                                webAclMetricName: expectedWebAclMetricName,
+                            });
+                        },
+                        request: async (sequence) => {
+                            const marker = rateMarker(nonce, sequence);
+                            const response = await fetchRequest(url, {
+                                cache: 'no-store',
+                                headers: {
+                                    'cache-control': 'no-cache',
+                                    [RATE_MARKER_HEADER]: marker,
+                                },
+                                redirect: 'manual',
+                                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                            });
+                            await response.body?.cancel();
+                            return {
+                                markerDigest: markerDigest(marker),
+                                status: response.status,
+                            };
+                        },
+                        ...(dependencies.sleep ? { sleep: dependencies.sleep } : {}),
+                    },
+                    rateLimitPerIp: policy.rateLimitPerIp,
+                    stage,
+                    webAclMetricName,
+                });
+                const completedAt = (dependencies.now ?? (() => new Date()))().toISOString();
+                const evidence = mergeRateEvidence(retainedEvidence, allowedRequestStatus, rateLimit, completedAt);
+                const receipt = (0, index_js_1.createRouterWafBlockingRehearsal)({ evidence, policy });
+                const sealed = {
+                    evidence,
+                    expectedTags: requiredIdentityTags({
+                        policyDigest: (0, index_js_1.routerWafPolicyDigest)(policy),
+                        stage,
+                        workspace,
+                    }),
+                    ipSetArns: baselineAttestation.ipSetArns,
+                    rateRequests: rateLimit.requestsSent,
+                    receipt,
+                };
+                if (!options.defer)
+                    retainSealedRehearsal(sealed);
+                return sealed;
+            };
+            if (!seedProbes) {
+                await seal();
+                return { success: true };
+            }
+            // Managed rehearsal: the protected dispatch performs the operator probes
+            // itself. The non-allowlisted probe runs before the runner is admitted;
+            // the managed-rule probe and the rest of the rehearsal run inside the
+            // temporary allowlist admission that private smoke already governs.
+            if (environment.GITHUB_ACTIONS !== 'true' || stage !== 'staging') {
+                throw new Error('Managed Router WAF rehearsal seeding runs only from the protected GitHub staging dispatch.');
+            }
+            const pendingEvidence = readBoundedJson(evidencePath, 'Router WAF live evidence');
+            if (pendingEvidence?.status !== 'pending') {
+                throw new Error('Managed Router WAF rehearsal seeding requires the exact pending live evidence seed; reset both seeds before another rehearsal.');
+            }
+            const sourceCommit = environment.EBK_SOURCE_COMMIT?.trim() ||
+                environment.GITHUB_SHA?.trim() ||
+                '';
+            if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sourceCommit)) {
+                throw new Error('Managed Router WAF rehearsal seeding requires the exact protected source commit.');
+            }
+            const identity = await aws.sts.send(new client_sts_1.GetCallerIdentityCommand({}));
+            if (identity.Account !== accountId ||
+                typeof identity.Arn !== 'string' ||
+                !(0, identity_js_1.matchesExpectedAssumedRoleArn)(accountId, identity.Arn, expectedRoleArn)) {
+                throw new Error('Router WAF rehearsal caller does not match the committed account and exact stage deployment role.');
+            }
+            const discovered = await discoverRouterDistribution({
+                accountId,
+                cloudFront: aws.cloudFront,
+                partition,
+                probeHost: url.hostname,
+            });
+            const now = dependencies.now ?? (() => new Date());
+            const get = dependencies.rawGet ?? rawGet;
+            const nonce = (dependencies.createNonce ?? (() => (0, node_crypto_1.randomBytes)(32).toString('hex')))();
+            if (!RATE_MARKER_NONCE_PATTERN.test(nonce)) {
+                throw new Error('Router WAF rehearsal invocation nonce is not one opaque 256-bit lowercase hexadecimal value.');
+            }
+            const startedAt = now().toISOString();
+            const operatorProbe = async (type, ruleName) => {
+                const marker = `${nonce}:${type}`;
+                const response = await get(url, {
+                    'cache-control': 'no-cache',
+                    [OPERATOR_MARKER_HEADER]: marker,
+                });
+                const blockedAt = now().toISOString();
+                if (response.status !== 403) {
+                    throw new Error(`Managed Router WAF ${type} probe returned HTTP ${response.status} instead of the expected 403 BLOCK.`);
+                }
+                return {
+                    blockedAt,
+                    marker,
+                    method: 'GET',
+                    path: url.pathname,
+                    ruleName,
+                    status: 403,
+                };
+            };
+            const nonAllowlisted = await operatorProbe('nonallowlisted', 'StageIpAllowlist');
+            let sealed;
+            await (dependencies.privateSmoke ?? private_smoke_access_js_1.runGithubPrivateSmoke)({
+                account: accountId,
+                deploymentProfile: operatingPolicy.deploymentProfile,
+                root: context.root,
+                run: async (lease) => {
+                    const managedRule = await operatorProbe('managed', 'AWSManagedRulesCommonRuleSet#NoUserAgent_HEADER');
+                    const seedEvidence = {
+                        accountId,
+                        completedAt: now().toISOString(),
+                        deploymentRoleArn: expectedRoleArn,
+                        distributionId: discovered.distributionId,
+                        kind: 'ebk-router-waf-live-evidence',
+                        mode: 'block',
+                        policyDigest: (0, index_js_1.routerWafPolicyDigest)(policy),
+                        probes: {
+                            allowedRequestStatus: 200,
+                            cloudWatchMetricsObserved: true,
+                            countModeTuningObserved: false,
+                            managedRule,
+                            nonAllowlisted,
+                            rateLimit: null,
+                            sampledRequestsObserved: true,
+                        },
+                        region,
+                        requiredRules: [
+                            'StageIpAllowlist',
+                            'RateLimitPerIP',
+                            ...index_js_1.ROUTER_WAF_REQUIRED_MANAGED_RULES,
+                        ],
+                        result: 'passed',
+                        schemaVersion: index_js_1.ROUTER_WAF_LIVE_EVIDENCE_SCHEMA_VERSION,
+                        sourceCommit,
+                        stage,
+                        startedAt,
+                        wafContractDigest,
+                        webAclArn: discovered.webAclArn,
+                        webAclScope: 'CLOUDFRONT',
+                        workspace,
+                    };
+                    sealed = await seal({
+                        ...(lease ? { admittedCidr: lease.cidr } : {}),
+                        defer: true,
+                        seedEvidence: JSON.parse(JSON.stringify(seedEvidence)),
+                    });
+                },
+                source: sourceCommit,
+                stage,
+                url: url.href,
+                workspace,
+            }, {
+                ...(dependencies.environment
+                    ? { environment: dependencies.environment }
+                    : {}),
+                ...(dependencies.fetch ? { fetch: dependencies.fetch } : {}),
+            });
+            if (!sealed) {
+                throw new Error('Managed Router WAF rehearsal did not seal inside the admission.');
+            }
+            // The admission is removed and its revocation observed. Nothing is
+            // retained until the live allowlist reads back exactly as committed, so
+            // a cleanup failure never leaves a usable passed receipt.
+            const restored = sealed;
+            await Promise.all(restored.ipSetArns.map((arn) => attestIpSet({
+                accountId,
+                arn,
+                expectedIpv4Cidrs: plan.ipv4Cidrs,
+                expectedIpv6Cidrs: plan.ipv6Cidrs,
+                expectedTags: restored.expectedTags,
+                waf: aws.waf,
+            })));
+            retainSealedRehearsal(restored);
+            return { success: true };
+        }
+        catch (error) {
+            devkit_1.logger.error(error instanceof Error ? error.message : String(error));
+            return { success: false };
+        }
+    };
+}
+const executor = createRouterWafRehearsalExecutor();
+exports.default = executor;
+//# sourceMappingURL=router-waf-rehearsal.js.map