@empire-builder-kit/nx 1.0.0-rc.44 → 1.0.0-rc.46

package/src/secrets/generated-aws-control-plane.js

@@ -1,16 +1,62 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AwsGeneratedSecretInitializationError = void 0;
+exports.safeGeneratedSecretObservationDiagnostic = safeGeneratedSecretObservationDiagnostic;
 exports.createAwsGeneratedSecretInitializationControlPlane = createAwsGeneratedSecretInitializationControlPlane;
 const node_crypto_1 = require("node:crypto");
 const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
 const model_js_1 = require("./model.js");
+const observationPhases = ['inspect', 'pre-create', 'post-create'];
+const observationPredicates = [
+    'response-record',
+    'arn-type',
+    'arn-name',
+    'name',
+    'description',
+    'deleted-date',
+    'rotation-enabled',
+    'tags-shape',
+    'tags-count',
+    'tag-entry',
+    'tag-duplicate',
+    'tag-value',
+    'version-state',
+    'not-found',
+];
+/** Copy only static labels; never invoke getters or retain provider detail. */
+function safeGeneratedSecretObservationDiagnostic(value) {
+    try {
+        if (!isRecord(value))
+            return undefined;
+        const descriptors = Object.getOwnPropertyDescriptors(value);
+        if (Reflect.ownKeys(descriptors).length !== 2 ||
+            !Object.prototype.hasOwnProperty.call(descriptors.phase ?? {}, 'value') ||
+            !Object.prototype.hasOwnProperty.call(descriptors.predicate ?? {}, 'value')) {
+            return undefined;
+        }
+        const phase = descriptors.phase?.value;
+        const predicate = descriptors.predicate?.value;
+        if (!observationPhases.some((entry) => entry === phase) ||
+            !observationPredicates.some((entry) => entry === predicate)) {
+            return undefined;
+        }
+        return Object.freeze({
+            phase: phase,
+            predicate: predicate,
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
 class AwsGeneratedSecretInitializationError extends Error {
     code;
-    constructor(code) {
+    observationDiagnostic;
+    constructor(code, observationDiagnostic) {
         super(`Generated secret initialization failed (${code}).`);
         this.name = 'AwsGeneratedSecretInitializationError';
         this.code = code;
+        this.observationDiagnostic = safeGeneratedSecretObservationDiagnostic(observationDiagnostic);
     }
 }
 exports.AwsGeneratedSecretInitializationError = AwsGeneratedSecretInitializationError;
@@ -71,21 +117,26 @@ function tagsToAws(tags) {
         .sort()
         .map((Key) => ({ Key, Value: tags[Key] }));
 }
-function exactTags(value, expected) {
-    if (!Array.isArray(value) || value.length !== Object.keys(expected).length) {
-        return false;
-    }
+function tagsDiagnostic(value, expected) {
+    if (!Array.isArray(value))
+        return 'tags-shape';
+    if (value.length !== Object.keys(expected).length)
+        return 'tags-count';
     const observed = {};
     for (const entry of value) {
         if (!isRecord(entry) ||
             typeof entry['Key'] !== 'string' ||
-            typeof entry['Value'] !== 'string' ||
-            Object.prototype.hasOwnProperty.call(observed, entry['Key'])) {
-            return false;
+            typeof entry['Value'] !== 'string') {
+            return 'tag-entry';
+        }
+        if (Object.prototype.hasOwnProperty.call(observed, entry['Key'])) {
+            return 'tag-duplicate';
         }
         observed[entry['Key']] = entry['Value'];
     }
-    return Object.entries(expected).every(([key, expectedValue]) => observed[key] === expectedValue);
+    return Object.entries(expected).every(([key, expectedValue]) => observed[key] === expectedValue)
+        ? undefined
+        : 'tag-value';
 }
 function arnMatchesName(arn, name) {
     if (!(0, model_js_1.isExactSecretArn)(arn))
@@ -108,20 +159,32 @@ function inspectVersionState(output, versionId) {
         ? 'current'
         : 'conflicting';
 }
-function requireDescribeOutput(value, input) {
-    if (!isRecord(value) ||
-        typeof value['ARN'] !== 'string' ||
-        !arnMatchesName(value['ARN'], input.name) ||
-        value['Name'] !== input.name ||
-        value['Description'] !== input.description ||
-        value['DeletedDate'] !== undefined ||
-        value['RotationEnabled'] === true ||
-        !exactTags(value['Tags'], input.tags)) {
-        throw new AwsGeneratedSecretInitializationError('generated-secret-observation-invalid');
+function requireDescribeOutput(value, input, phase) {
+    let predicate;
+    if (!isRecord(value))
+        predicate = 'response-record';
+    else if (typeof value['ARN'] !== 'string')
+        predicate = 'arn-type';
+    else if (!arnMatchesName(value['ARN'], input.name))
+        predicate = 'arn-name';
+    else if (value['Name'] !== input.name)
+        predicate = 'name';
+    else if (value['Description'] !== input.description)
+        predicate = 'description';
+    else if (value['DeletedDate'] !== undefined)
+        predicate = 'deleted-date';
+    else if (value['RotationEnabled'] === true)
+        predicate = 'rotation-enabled';
+    else
+        predicate = tagsDiagnostic(value['Tags'], input.tags);
+    if (predicate !== undefined) {
+        throw new AwsGeneratedSecretInitializationError('generated-secret-observation-invalid', { phase, predicate });
     }
+    // The branches above establish the same shape as the former compound check.
+    const output = value;
     return {
-        arn: value['ARN'],
-        state: inspectVersionState(value, expectedVersionId(input.name, input.generation)),
+        arn: output.ARN,
+        state: inspectVersionState(output, expectedVersionId(input.name, input.generation)),
     };
 }
 function requireCreateOutput(value, input, versionId) {
@@ -161,7 +224,7 @@ function createAwsGeneratedSecretInitializationControlPlane(options = {}) {
     const client = options.client ?? defaultClient(options.clientConfiguration ?? {});
     const generateBytes = options.randomBytes ?? node_crypto_1.randomBytes;
     const wait = options.wait ?? defaultWait;
-    const inspectExact = async (input) => {
+    const inspectExact = async (input, phase) => {
         requireInput(input);
         let rawOutput;
         try {
@@ -172,13 +235,13 @@ function createAwsGeneratedSecretInitializationControlPlane(options = {}) {
                 return { state: 'missing' };
             throw new AwsGeneratedSecretInitializationError('generated-secret-read-failed');
         }
-        return requireDescribeOutput(rawOutput, input);
+        return requireDescribeOutput(rawOutput, input, phase);
     };
     const inspectAfterCreate = async (input) => {
         let finalInspection = { state: 'missing' };
         for (const delay of inspectionDelaysMilliseconds) {
             await wait(delay);
-            finalInspection = await inspectExact(input);
+            finalInspection = await inspectExact(input, 'post-create');
             if (finalInspection.state !== 'missing')
                 return finalInspection;
         }
@@ -186,15 +249,15 @@ function createAwsGeneratedSecretInitializationControlPlane(options = {}) {
     };
     return Object.freeze({
         async inspect(input) {
-            return (await inspectExact(input)).state;
+            return (await inspectExact(input, 'inspect')).state;
         },
         async initializeGenerated(input) {
             requireInput(input);
-            const initial = await inspectExact(input);
+            const initial = await inspectExact(input, 'pre-create');
             if (initial.state === 'current')
                 return 'unchanged';
             if (initial.state !== 'missing') {
-                throw new AwsGeneratedSecretInitializationError('generated-secret-state-conflicting');
+                throw new AwsGeneratedSecretInitializationError('generated-secret-state-conflicting', { phase: 'pre-create', predicate: 'version-state' });
             }
             let idBytes;
             let keyBytes;
@@ -248,11 +311,11 @@ function createAwsGeneratedSecretInitializationControlPlane(options = {}) {
                 return responseAccepted ? 'applied' : 'unchanged';
             }
             if (finalInspection.state === 'conflicting') {
-                throw new AwsGeneratedSecretInitializationError('generated-secret-state-conflicting');
+                throw new AwsGeneratedSecretInitializationError('generated-secret-state-conflicting', { phase: 'post-create', predicate: 'version-state' });
             }
             throw new AwsGeneratedSecretInitializationError(responseAccepted
                 ? 'generated-secret-observation-invalid'
-                : 'generated-secret-write-failed');
+                : 'generated-secret-write-failed', { phase: 'post-create', predicate: 'not-found' });
         },
     });
 }

package/src/secrets/operator.d.ts

@@ -1,4 +1,4 @@
-import { AwsGeneratedSecretInitializationError } from './generated-aws-control-plane.js';
+import { AwsGeneratedSecretInitializationError, type GeneratedSecretObservationDiagnostic } from './generated-aws-control-plane.js';
 import { type SecretMetadataFinding, type SecretMetadataMutationIntent, type SecretMetadataPreflightResult, type SecretMetadataReconciliationResult } from './metadata.js';
 import { type ObservedSecretMetadata, type SecretManagementScope, type SecretMetadataDeclaration } from './model.js';
 export interface ListedSecretContainer {
@@ -84,8 +84,9 @@ export type SecretProtectedLifecycleAction = 'deploy' | 'recover' | 'remove' | '
 export declare class SecretOperatorControlPlaneError extends Error {
     readonly operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag';
     readonly diagnosticCode?: AwsGeneratedSecretInitializationError['code'];
+    readonly observationDiagnostic?: GeneratedSecretObservationDiagnostic;
     readonly code: 'secret-control-plane-apply-failed' | 'secret-control-plane-inventory-failed' | 'secret-control-plane-inventory-invalid' | 'secret-control-plane-protected-action-failed';
-    constructor(code: SecretOperatorControlPlaneError['code'], operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag', diagnosticCode?: AwsGeneratedSecretInitializationError['code']);
+    constructor(code: SecretOperatorControlPlaneError['code'], operation: 'create-empty' | 'describe' | 'inventory' | 'initialize-generated' | 'list' | 'recover' | 'retire' | 'tag', diagnosticCode?: AwsGeneratedSecretInitializationError['code'], observationDiagnostic?: GeneratedSecretObservationDiagnostic);
 }
 export interface SecretMetadataOperatorResult {
     after?: SecretMetadataReconciliationResult;

package/src/secrets/operator.js

@@ -13,14 +13,20 @@ const model_js_1 = require("./model.js");
 class SecretOperatorControlPlaneError extends Error {
     operation;
     diagnosticCode;
+    observationDiagnostic;
     code;
-    constructor(code, operation, diagnosticCode) {
+    constructor(code, operation, diagnosticCode, observationDiagnostic) {
+        const safeObservation = (0, generated_aws_control_plane_js_1.safeGeneratedSecretObservationDiagnostic)(observationDiagnostic);
         super(`Secret metadata ${operation} failed (${code}).` +
-            (diagnosticCode ? ` Reason: ${diagnosticCode}.` : ''));
+            (diagnosticCode ? ` Reason: ${diagnosticCode}.` : '') +
+            (safeObservation
+                ? ` Observation: ${safeObservation.phase}/${safeObservation.predicate}.`
+                : ''));
         this.operation = operation;
         this.diagnosticCode = diagnosticCode;
         this.name = 'SecretOperatorControlPlaneError';
         this.code = code;
+        this.observationDiagnostic = safeObservation;
     }
 }
 exports.SecretOperatorControlPlaneError = SecretOperatorControlPlaneError;
@@ -35,14 +41,30 @@ function safeControlPlaneError(error, code, operation) {
     // Preserve only our finite, value-blind diagnostic vocabulary. Never attach
     // the raw SDK error, message, stack, request or cause: they may hold values.
     if (error instanceof generated_aws_control_plane_js_1.AwsGeneratedSecretInitializationError) {
-        const diagnosticCode = Object.getOwnPropertyDescriptor(error, 'code')?.value;
+        let diagnosticCode;
+        try {
+            diagnosticCode = Object.getOwnPropertyDescriptor(error, 'code')?.value;
+        }
+        catch {
+            // A descriptor trap must not replace the safe error with its own.
+            return new SecretOperatorControlPlaneError(code, operation);
+        }
         switch (diagnosticCode) {
             case 'generated-secret-input-invalid':
             case 'generated-secret-observation-invalid':
             case 'generated-secret-read-failed':
             case 'generated-secret-state-conflicting':
-            case 'generated-secret-write-failed':
-                return new SecretOperatorControlPlaneError(code, operation, diagnosticCode);
+            case 'generated-secret-write-failed': {
+                let observationDiagnostic;
+                try {
+                    observationDiagnostic = (0, generated_aws_control_plane_js_1.safeGeneratedSecretObservationDiagnostic)(Object.getOwnPropertyDescriptor(error, 'observationDiagnostic')
+                        ?.value);
+                }
+                catch {
+                    // An optional descriptor trap is untrusted detail, not a new error.
+                }
+                return new SecretOperatorControlPlaneError(code, operation, diagnosticCode, observationDiagnostic);
+            }
         }
     }
     return new SecretOperatorControlPlaneError(code, operation);

package/src/supply-chain/blueprint-verification-authority.js

@@ -439,6 +439,25 @@ function isBlueprintVerificationExecutionAuthorityPath(path) {
         /^(?:vite|vitest)\.config\.[a-z0-9]+$/u.test(name) ||
         /^packages\/[^/]+\/\.ebk\/ownership\.json$/u.test(normalized));
 }
+function isNativeArtifactDependencyBoundary(workspaceRoot, path, candidate) {
+    const match = /^packages\/([a-z][a-z0-9]*(?:-[a-z0-9]+)*)\/\.sst\/artifacts\/[^/]+\/node_modules$/u.exec(path);
+    const slice = match?.[1];
+    if (!slice)
+        return false;
+    const dependencyRoot = (0, node_path_1.join)(workspaceRoot, 'packages', slice, 'node_modules');
+    try {
+        const metadata = (0, node_fs_1.lstatSync)(dependencyRoot);
+        return (metadata.isDirectory() &&
+            !metadata.isSymbolicLink() &&
+            (0, node_fs_1.realpathSync)(dependencyRoot) === dependencyRoot &&
+            (0, node_path_1.toNamespacedPath)((0, node_path_1.resolve)((0, node_path_1.dirname)(candidate), (0, node_fs_1.readlinkSync)(candidate))) ===
+                (0, node_path_1.toNamespacedPath)(dependencyRoot) &&
+            (0, node_fs_1.realpathSync)(candidate) === dependencyRoot);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Inventories every execution-loader configuration outside bounded generated,
  * dependency, cache, and evidence directories. Forbidden ambient config is
@@ -467,15 +486,17 @@ function assertNoMutableBlueprintVerificationConfiguration(workspace) {
             const path = directoryPath
                 ? `${directoryPath}/${entry.name}`
                 : entry.name;
-            const skippedDirectory = entry.isDirectory() &&
-                SKIPPED_CONFIGURATION_DIRECTORIES.has(entry.name.toLowerCase());
+            const candidate = (0, node_path_1.join)(directory, entry.name);
+            const skippedDirectory = (entry.isDirectory() &&
+                SKIPPED_CONFIGURATION_DIRECTORIES.has(entry.name.toLowerCase())) ||
+                (entry.isSymbolicLink() &&
+                    isNativeArtifactDependencyBoundary(workspaceRoot, path, candidate));
             if (entry.isSymbolicLink() && !skippedDirectory) {
                 throw new Error(`Blueprint verification configuration inventory refuses symbolic-link authority at ${path}.`);
             }
             if (forbiddenConfigurationName(entry.name)) {
                 throw new Error(`Blueprint verification refuses mutable environment or package-manager configuration at ${path}.`);
             }
-            const candidate = (0, node_path_1.join)(directory, entry.name);
             if (protectedConfigurationName(entry.name)) {
                 const metadata = (0, node_fs_1.lstatSync)(candidate);
                 const child = (0, node_path_1.relative)(workspaceRoot, candidate);

package/src/supply-chain/generated-files.js

@@ -275,6 +275,15 @@ to generate the effective managed \`pnpm-workspace.yaml\`, then run
 Review the lockfile and rerun affected checks. Never edit the managed YAML or
 ownership hashes. Pins do not waive the existing supply-chain policies.
 
+The Standard Slice owns an exact local \`@opennextjs/aws\` development dependency.
+Its build wrapper refuses a missing or different local builder; it never invokes
+npx or dlx. Fresh override defaults include the reviewed
+\`@node-minify/core@9.0.2>glob@10.3.3: 10.5.0\` correction. Existing seeded
+policy always wins: explicitly reconcile that entry in the editable JSON before
+the supported workspace report/apply, preserving other decisions. The override
+governs the managed builder tree; OpenNext's nested npm image install remains a
+separate boundary checked by the generated Sharp metadata/native-target guard.
+
 The license lists are organization-owned policy, not legal conclusions.
 Unknown and changed licenses require review. Exceptions are exact-component,
 approved, expiring records with compensating controls and recheck triggers.

package/src/supply-chain/sbom.js

@@ -160,7 +160,8 @@ function createCycloneDxComponentsFromInventory(input) {
     }));
 }
 function canonicalTimestamp(value, path) {
-    if (!Number.isFinite(Date.parse(value)) ||
+    if (typeof value !== 'string' ||
+        !Number.isFinite(Date.parse(value)) ||
         new Date(value).toISOString() !== value) {
         throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', path, 'must be a canonical ISO-8601 timestamp');
     }
@@ -775,8 +776,11 @@ function bindingInput(value) {
 }
 function createSupplyChainReleaseBinding(input) {
     canonicalTimestamp(input.createdAt, 'createdAt');
-    if (!common_js_1.SUPPLY_CHAIN_REFERENCE.test(input.releaseId) ||
-        !common_js_1.SUPPLY_CHAIN_SHA256.test(input.releaseManifestDigest) ||
+    if (typeof input.releaseId !== 'string' ||
+        common_js_1.SUPPLY_CHAIN_REFERENCE.exec(input.releaseId)?.[0] !== input.releaseId ||
+        typeof input.releaseManifestDigest !== 'string' ||
+        common_js_1.SUPPLY_CHAIN_SHA256.exec(input.releaseManifestDigest)?.[0] !==
+            input.releaseManifestDigest ||
         input.artifacts.length === 0 ||
         (0, common_js_1.hasSensitiveSupplyChainShape)(input)) {
         throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding', 'must bind at least one artifact to an exact release manifest');
@@ -785,11 +789,21 @@ function createSupplyChainReleaseBinding(input) {
     const artifacts = [...input.artifacts]
         .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.bindingId, right.bindingId))
         .map((artifact, index) => {
-        if (!common_js_1.SUPPLY_CHAIN_REFERENCE.test(artifact.bindingId) ||
-            !common_js_1.SUPPLY_CHAIN_SHA256.test(artifact.candidateDigest) ||
-            !common_js_1.SUPPLY_CHAIN_SHA256.test(artifact.contentDigest) ||
-            !common_js_1.SUPPLY_CHAIN_SHA256.test(artifact.sbomDigest) ||
-            !/^urn:uuid:[a-f0-9-]{36}$/.test(artifact.sbomSerialNumber) ||
+        if (typeof artifact.bindingId !== 'string' ||
+            common_js_1.SUPPLY_CHAIN_REFERENCE.exec(artifact.bindingId)?.[0] !==
+                artifact.bindingId ||
+            typeof artifact.candidateDigest !== 'string' ||
+            common_js_1.SUPPLY_CHAIN_SHA256.exec(artifact.candidateDigest)?.[0] !==
+                artifact.candidateDigest ||
+            typeof artifact.contentDigest !== 'string' ||
+            common_js_1.SUPPLY_CHAIN_SHA256.exec(artifact.contentDigest)?.[0] !==
+                artifact.contentDigest ||
+            typeof artifact.sbomDigest !== 'string' ||
+            common_js_1.SUPPLY_CHAIN_SHA256.exec(artifact.sbomDigest)?.[0] !==
+                artifact.sbomDigest ||
+            typeof artifact.sbomSerialNumber !== 'string' ||
+            /^urn:uuid:[a-f0-9-]{36}$/.exec(artifact.sbomSerialNumber)?.[0] !==
+                artifact.sbomSerialNumber ||
             seen.has(artifact.bindingId)) {
             throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', `releaseBinding.artifacts[${index}]`, 'must uniquely bind artifact and SBOM digests');
         }
@@ -810,14 +824,62 @@ function createSupplyChainReleaseBinding(input) {
     };
 }
 function validateSupplyChainReleaseBinding(value, expected) {
+    const exactKeys = (record, keys) => [Object.prototype, null].includes(Object.getPrototypeOf(record)) &&
+        Object.keys(record).sort(deterministic_order_js_1.compareUtf16).join('\0') ===
+            [...keys].sort(deterministic_order_js_1.compareUtf16).join('\0');
     if (!(0, validation_js_1.isRecord)(value) ||
+        !exactKeys(value, [
+            'artifacts',
+            'createdAt',
+            'kind',
+            'materialDigest',
+            'releaseId',
+            'releaseManifestDigest',
+            'schemaVersion',
+        ]) ||
         value.kind !== exports.SUPPLY_CHAIN_RELEASE_BINDING_KIND ||
         value.schemaVersion !== exports.SUPPLY_CHAIN_SBOM_SCHEMA_VERSION ||
-        !common_js_1.SUPPLY_CHAIN_SHA256.test(String(value.materialDigest)) ||
-        !Array.isArray(value.artifacts)) {
-        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding', 'must be an EBK supply-chain release binding v1');
+        typeof value.materialDigest !== 'string' ||
+        common_js_1.SUPPLY_CHAIN_SHA256.exec(value.materialDigest)?.[0] !==
+            value.materialDigest ||
+        typeof value.createdAt !== 'string' ||
+        typeof value.releaseId !== 'string' ||
+        typeof value.releaseManifestDigest !== 'string' ||
+        !Array.isArray(value.artifacts) ||
+        !value.artifacts.length) {
+        throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding', 'must be an exact EBK supply-chain release binding v1');
+    }
+    const artifacts = [];
+    for (const artifact of value.artifacts) {
+        if (!(0, validation_js_1.isRecord)(artifact) ||
+            !exactKeys(artifact, [
+                'bindingId',
+                'candidateDigest',
+                'contentDigest',
+                'sbomDigest',
+                'sbomSerialNumber',
+            ]) ||
+            typeof artifact.bindingId !== 'string' ||
+            typeof artifact.candidateDigest !== 'string' ||
+            typeof artifact.contentDigest !== 'string' ||
+            typeof artifact.sbomDigest !== 'string' ||
+            typeof artifact.sbomSerialNumber !== 'string') {
+            throw new errors_js_1.SupplyChainError('supply-chain-input-invalid', 'releaseBinding.artifacts', 'must contain exact string artifact fields');
+        }
+        artifacts.push({
+            bindingId: artifact.bindingId,
+            candidateDigest: artifact.candidateDigest,
+            contentDigest: artifact.contentDigest,
+            sbomDigest: artifact.sbomDigest,
+            sbomSerialNumber: artifact.sbomSerialNumber,
+        });
     }
-    const recreated = createSupplyChainReleaseBinding(value);
+    const recreated = createSupplyChainReleaseBinding({
+        artifacts,
+        createdAt: value.createdAt,
+        releaseId: value.releaseId,
+        releaseManifestDigest: value.releaseManifestDigest,
+    });
     if (recreated.materialDigest !== value.materialDigest) {
         throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'releaseBinding.materialDigest', 'does not match the canonical binding bytes');
     }