@apexops/cli 0.10.0-next.4 → 0.11.0-next.0

package/dist/state-transfer.js

@@ -2,7 +2,7 @@ import { lstat, readFile, readdir } from "node:fs/promises";
 import { isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { BoundEnvelopeTransport } from "@apexops/capabilities";
 import { SECRET_FIELD_PATTERN, SECRET_VALUE_PATTERN } from "@apexops/contracts";
-import { EventJournal, atomicWriteBytes, canonicalJsonBytes, sha256Bytes, sha256Json, } from "@apexops/kernel";
+import { EventJournal, REPEAT_GUARD_FILE, atomicWriteBytes, canonicalJsonBytes, sha256Bytes, sha256Json, } from "@apexops/kernel";
 export const STATE_TRANSFER_KIND = "apex-repository-state";
 export const STATE_TRANSFER_MAX_BUNDLE_BYTES = 16 * 1024 * 1024;
 export const STATE_TRANSFER_MAX_FILE_BYTES = 4 * 1024 * 1024;
@@ -24,6 +24,14 @@ function safeRelativePath(path) {
         posix.normalize(path) === path);
 }
 function prohibitedStatePath(path) {
+    if (path
+        .split("/")
+        .some((part) => part.startsWith(".run-mutation.") ||
+        part === ".run-transaction.json" ||
+        part === ".run-writer-lease.json" ||
+        part === REPEAT_GUARD_FILE)) {
+        return true;
+    }
     return /(?:^|\/)(?:credentials?(?:\.json)?|terraform\.tfstate(?:\.[^/]*)?|[^/]+\.tfplan(?:\.enc)?|state-plans?)(?:\/|$)/i.test(path);
 }
 function requireIdentifier(value, label) {
@@ -98,6 +106,18 @@ async function walkRegularFiles(root, directory = root) {
         const path = join(directory, entry.name);
         if (entry.isSymbolicLink())
             throw new Error(`State transfer source contains a symlink: ${path}`);
+        if (directory === root) {
+            // The writer lease and repeat records describe this machine's worktrees and are never transferred.
+            if (entry.name === ".run-writer-lease.json" || entry.name === REPEAT_GUARD_FILE)
+                continue;
+            if (entry.name === ".run-mutation.lock" || entry.name === ".run-transaction.json") {
+                throw new Error("State transfer requires a quiescent run without pending mutation recovery");
+            }
+            if (entry.isDirectory() &&
+                (entry.name === ".run-mutation.retired" || entry.name.startsWith(".run-mutation.pending-"))) {
+                continue;
+            }
+        }
         if (entry.isDirectory())
             files.push(...(await walkRegularFiles(root, path)));
         else if (entry.isFile())
@@ -186,6 +206,9 @@ export async function createStateTransferBundle(root, options, now = new Date())
         throw new Error("State transfer envelope cannot outlive its writer-transfer claim");
     }
     const runRoot = join(state.apexRoot, "projects", state.selection.projectId, "runs", state.selection.runId);
+    const generationRoot = join(state.apexRoot, "runtime-generations", state.run.runtimeLockHash);
+    const generationAvailable = (await readOptionalRegular(join(generationRoot, "apex.lock.json"), "runtime generation lock")) !== undefined;
+    const runtimeRoot = generationAvailable ? generationRoot : join(state.apexRoot, "runtime");
     const paths = new Set([
         "config.json",
         "apex.lock.json",
@@ -195,11 +218,13 @@ export async function createStateTransferBundle(root, options, now = new Date())
         paths.add(".gitignore");
     }
     try {
-        for (const entry of await readdir(join(state.apexRoot, "runtime"), { withFileTypes: true })) {
-            if (entry.isSymbolicLink())
-                throw new Error(`State transfer runtime contains a symlink: ${entry.name}`);
-            if (entry.isFile() && entry.name.endsWith(".json"))
-                paths.add(`runtime/${entry.name}`);
+        for (const sourceRoot of [...new Set([runtimeRoot, join(state.apexRoot, "runtime")])]) {
+            for (const entry of await readdir(sourceRoot, { withFileTypes: true })) {
+                if (entry.isSymbolicLink())
+                    throw new Error(`State transfer runtime contains a symlink: ${entry.name}`);
+                if (entry.isFile() && entry.name.endsWith(".json"))
+                    paths.add(`runtime/${entry.name}`);
+            }
         }
     }
     catch (error) {
@@ -211,9 +236,21 @@ export async function createStateTransferBundle(root, options, now = new Date())
     }
     const sourceFiles = [];
     for (const path of [...paths].sort()) {
+        let sourcePath = join(state.apexRoot, ...path.split("/"));
+        if (path === "apex.lock.json") {
+            sourcePath = generationAvailable ? join(runtimeRoot, "apex.lock.json") : join(state.apexRoot, "apex.lock.json");
+        }
+        if (path.startsWith("runtime/")) {
+            const relativeRuntimePath = path.slice("runtime/".length);
+            const generationPath = join(runtimeRoot, relativeRuntimePath);
+            sourcePath =
+                (await readOptionalRegular(generationPath, "runtime generation file")) === undefined
+                    ? join(state.apexRoot, "runtime", relativeRuntimePath)
+                    : generationPath;
+        }
         sourceFiles.push({
             path,
-            bytes: await readRegular(join(state.apexRoot, ...path.split("/")), "State transfer file"),
+            bytes: await readRegular(sourcePath, "State transfer file"),
         });
     }
     const runPrefix = `projects/${state.selection.projectId}/runs/${state.selection.runId}/`;

package/dist/target-scope.d.ts

@@ -0,0 +1,4 @@
+export declare const TARGET_SCOPE_PATTERN: RegExp;
+export declare const TARGET_SCOPE_HINT = "local or /subscriptions/<id>[/resourceGroups/<name>]";
+export declare function assertTargetScope(value: string): string;
+//# sourceMappingURL=target-scope.d.ts.map

package/dist/target-scope.js

@@ -0,0 +1,9 @@
+import { ApexError, EXIT_CODES } from "./errors.js";
+export const TARGET_SCOPE_PATTERN = /^(?:local|\/subscriptions\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?:\/resourceGroups\/[-\w.()]{1,90})?)$/iu;
+export const TARGET_SCOPE_HINT = "local or /subscriptions/<id>[/resourceGroups/<name>]";
+export function assertTargetScope(value) {
+    if (!TARGET_SCOPE_PATTERN.test(value))
+        throw new ApexError("APEX_USAGE", `--target must be ${TARGET_SCOPE_HINT}`, EXIT_CODES.usage);
+    return value;
+}
+//# sourceMappingURL=target-scope.js.map

package/dist/version.d.ts

@@ -1,2 +1,4 @@
-export declare const APEX_VERSION: "0.10.0-next.4";
+export declare const APEX_VERSION: "0.11.0-next.0";
+export declare const MINIMUM_NODE_VERSION: "24.21.0";
+export declare function meetsMinimumVersion(current: string, minimum: string): boolean;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,20 @@
-export const APEX_VERSION = "0.10.0-next.4";
+export const APEX_VERSION = "0.11.0-next.0";
+export const MINIMUM_NODE_VERSION = "24.21.0";
+export function meetsMinimumVersion(current, minimum) {
+    const currentParts = current.split(".").map(Number);
+    const minimumParts = minimum.split(".").map(Number);
+    if (currentParts.length !== 3 ||
+        minimumParts.length !== 3 ||
+        currentParts.some((part) => !Number.isInteger(part) || part < 0) ||
+        minimumParts.some((part) => !Number.isInteger(part) || part < 0)) {
+        return false;
+    }
+    for (let index = 0; index < 3; index += 1) {
+        const currentPart = currentParts[index] ?? 0;
+        const minimumPart = minimumParts[index] ?? 0;
+        if (currentPart !== minimumPart)
+            return currentPart > minimumPart;
+    }
+    return true;
+}
 //# sourceMappingURL=version.js.map

package/dist/workflow-validators.d.ts

@@ -1,5 +1,5 @@
-import { type ApprovalEvidenceV1, type ArchitectureAvailabilityV1, type ExecutionPlanAttestationV1, type GateRecordV1, type ImplementationIntentV1, type OperationRecordV1, type QualityMeasurementsV1, type QualityScorecardV1, type ResourceInventoryV1, type RunConfigV1, type DeploymentPreviewV1 } from "@apexops/contracts";
-import { type ValidatorRegistry } from "@apexops/kernel";
+import { type ApprovalEvidenceV1, type ArchitectureAvailabilityV1, type ExecutionPlanAttestationV1, type GateRecordV1, type IacBindingV1, type ImplementationIntentV1, type LogicalResourceManifestV1, type OperationRecordV1, type PolicyValidationBinding, type QualityMeasurementsV1, type QualityScorecardV1, type ResourceInventoryV1, type RunConfigV1, type DeploymentPreviewV1 } from "@apexops/contracts";
+import { type ValidationIssue, type ValidatorRegistry } from "@apexops/kernel";
 export interface WorkflowTaskValidatorContext {
     readonly nodeId: string;
     readonly now: string;
@@ -14,6 +14,7 @@ export interface WorkflowTaskValidatorContext {
     readonly availabilityEvidence?: ArchitectureAvailabilityV1;
     readonly deploymentOperation?: OperationRecordV1;
     readonly deploymentInventory?: ResourceInventoryV1;
+    readonly importedPolicyEffects?: readonly string[];
 }
 export interface WorkflowGateValidatorContext {
     readonly gateNumber: number;
@@ -26,7 +27,6 @@ export interface WorkflowGateValidatorContext {
     readonly reviewBlockers: readonly string[];
     readonly expectedDependencyHash?: string;
     readonly currentDependencyRevision: string;
-    readonly legacyRequirements: boolean;
     readonly expectedApprovalRecipientIdentity: string;
     readonly provedPreviewTransferClaimHash?: string;
     readonly preview?: DeploymentPreviewV1;
@@ -44,7 +44,12 @@ export interface WorkflowPreviewValidatorContext {
     readonly currentDependencyRevision: string;
     readonly expectedResourceIds: readonly string[];
     readonly intendedExecutionRecipientIdentity: string;
+    readonly ownershipIssues?: readonly ValidationIssue[];
+    readonly protectedResourceIds?: readonly string[];
     readonly attestation?: ExecutionPlanAttestationV1;
+    readonly policyValidationBinding?: PolicyValidationBinding & {
+        readonly receiptHash: string;
+    };
 }
 export interface WorkflowDeployValidatorContext {
     readonly now: string;
@@ -64,6 +69,18 @@ export interface WorkflowDeployValidatorContext {
         readonly validatorIds: readonly string[];
     };
 }
+export interface NativeBicepResourceOwnership {
+    readonly expectedResourceIds: readonly string[];
+    readonly resourceIdsByLogicalId: Readonly<Record<string, string>>;
+    readonly protectedResourceIds: readonly string[];
+    readonly issues: readonly ValidationIssue[];
+}
+export declare function resolveNativeBicepResourceOwnership(context: {
+    readonly intent: ImplementationIntentV1;
+    readonly binding: IacBindingV1;
+    readonly manifest: LogicalResourceManifestV1;
+    readonly targetScope: string;
+}): NativeBicepResourceOwnership;
 export interface WorkflowInventoryValidatorContext {
     readonly run: RunConfigV1;
     readonly preview: DeploymentPreviewV1;