@apexops/cli 0.10.0-next.5 → 0.11.0-next.1

package/dist/state-transfer.js

@@ -2,7 +2,7 @@ import { lstat, readFile, readdir } from "node:fs/promises";
 import { isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { BoundEnvelopeTransport } from "@apexops/capabilities";
 import { SECRET_FIELD_PATTERN, SECRET_VALUE_PATTERN } from "@apexops/contracts";
-import { EventJournal, atomicWriteBytes, canonicalJsonBytes, sha256Bytes, sha256Json, } from "@apexops/kernel";
+import { EventJournal, REPEAT_GUARD_FILE, atomicWriteBytes, canonicalJsonBytes, sha256Bytes, sha256Json, } from "@apexops/kernel";
 export const STATE_TRANSFER_KIND = "apex-repository-state";
 export const STATE_TRANSFER_MAX_BUNDLE_BYTES = 16 * 1024 * 1024;
 export const STATE_TRANSFER_MAX_FILE_BYTES = 4 * 1024 * 1024;
@@ -24,6 +24,14 @@ function safeRelativePath(path) {
         posix.normalize(path) === path);
 }
 function prohibitedStatePath(path) {
+    if (path
+        .split("/")
+        .some((part) => part.startsWith(".run-mutation.") ||
+        part === ".run-transaction.json" ||
+        part === ".run-writer-lease.json" ||
+        part === REPEAT_GUARD_FILE)) {
+        return true;
+    }
     return /(?:^|\/)(?:credentials?(?:\.json)?|terraform\.tfstate(?:\.[^/]*)?|[^/]+\.tfplan(?:\.enc)?|state-plans?)(?:\/|$)/i.test(path);
 }
 function requireIdentifier(value, label) {
@@ -98,6 +106,18 @@ async function walkRegularFiles(root, directory = root) {
         const path = join(directory, entry.name);
         if (entry.isSymbolicLink())
             throw new Error(`State transfer source contains a symlink: ${path}`);
+        if (directory === root) {
+            // The writer lease and repeat records describe this machine's worktrees and are never transferred.
+            if (entry.name === ".run-writer-lease.json" || entry.name === REPEAT_GUARD_FILE)
+                continue;
+            if (entry.name === ".run-mutation.lock" || entry.name === ".run-transaction.json") {
+                throw new Error("State transfer requires a quiescent run without pending mutation recovery");
+            }
+            if (entry.isDirectory() &&
+                (entry.name === ".run-mutation.retired" || entry.name.startsWith(".run-mutation.pending-"))) {
+                continue;
+            }
+        }
         if (entry.isDirectory())
             files.push(...(await walkRegularFiles(root, path)));
         else if (entry.isFile())

package/dist/target-scope.d.ts

@@ -0,0 +1,4 @@
+export declare const TARGET_SCOPE_PATTERN: RegExp;
+export declare const TARGET_SCOPE_HINT = "local or /subscriptions/<id>[/resourceGroups/<name>]";
+export declare function assertTargetScope(value: string): string;
+//# sourceMappingURL=target-scope.d.ts.map

package/dist/target-scope.js

@@ -0,0 +1,9 @@
+import { ApexError, EXIT_CODES } from "./errors.js";
+export const TARGET_SCOPE_PATTERN = /^(?:local|\/subscriptions\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?:\/resourceGroups\/[-\w.()]{1,90})?)$/iu;
+export const TARGET_SCOPE_HINT = "local or /subscriptions/<id>[/resourceGroups/<name>]";
+export function assertTargetScope(value) {
+    if (!TARGET_SCOPE_PATTERN.test(value))
+        throw new ApexError("APEX_USAGE", `--target must be ${TARGET_SCOPE_HINT}`, EXIT_CODES.usage);
+    return value;
+}
+//# sourceMappingURL=target-scope.js.map

package/dist/version.d.ts

@@ -1,2 +1,4 @@
-export declare const APEX_VERSION: "0.10.0-next.5";
+export declare const APEX_VERSION: "0.11.0-next.1";
+export declare const MINIMUM_NODE_VERSION: "24.21.0";
+export declare function meetsMinimumVersion(current: string, minimum: string): boolean;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,20 @@
-export const APEX_VERSION = "0.10.0-next.5";
+export const APEX_VERSION = "0.11.0-next.1";
+export const MINIMUM_NODE_VERSION = "24.21.0";
+export function meetsMinimumVersion(current, minimum) {
+    const currentParts = current.split(".").map(Number);
+    const minimumParts = minimum.split(".").map(Number);
+    if (currentParts.length !== 3 ||
+        minimumParts.length !== 3 ||
+        currentParts.some((part) => !Number.isInteger(part) || part < 0) ||
+        minimumParts.some((part) => !Number.isInteger(part) || part < 0)) {
+        return false;
+    }
+    for (let index = 0; index < 3; index += 1) {
+        const currentPart = currentParts[index] ?? 0;
+        const minimumPart = minimumParts[index] ?? 0;
+        if (currentPart !== minimumPart)
+            return currentPart > minimumPart;
+    }
+    return true;
+}
 //# sourceMappingURL=version.js.map

package/dist/workflow-validators.d.ts

@@ -1,5 +1,5 @@
-import { type ApprovalEvidenceV1, type ArchitectureAvailabilityV1, type ExecutionPlanAttestationV1, type GateRecordV1, type ImplementationIntentV1, type OperationRecordV1, type QualityMeasurementsV1, type QualityScorecardV1, type ResourceInventoryV1, type RunConfigV1, type DeploymentPreviewV1 } from "@apexops/contracts";
-import { type ValidatorRegistry } from "@apexops/kernel";
+import { type ApprovalEvidenceV1, type ArchitectureAvailabilityV1, type ExecutionPlanAttestationV1, type GateRecordV1, type IacBindingV1, type ImplementationIntentV1, type LogicalResourceManifestV1, type OperationRecordV1, type PolicyValidationBinding, type QualityMeasurementsV1, type QualityScorecardV1, type ResourceInventoryV1, type RunConfigV1, type DeploymentPreviewV1 } from "@apexops/contracts";
+import { type ValidationIssue, type ValidatorRegistry } from "@apexops/kernel";
 export interface WorkflowTaskValidatorContext {
     readonly nodeId: string;
     readonly now: string;
@@ -14,6 +14,7 @@ export interface WorkflowTaskValidatorContext {
     readonly availabilityEvidence?: ArchitectureAvailabilityV1;
     readonly deploymentOperation?: OperationRecordV1;
     readonly deploymentInventory?: ResourceInventoryV1;
+    readonly importedPolicyEffects?: readonly string[];
 }
 export interface WorkflowGateValidatorContext {
     readonly gateNumber: number;
@@ -26,7 +27,6 @@ export interface WorkflowGateValidatorContext {
     readonly reviewBlockers: readonly string[];
     readonly expectedDependencyHash?: string;
     readonly currentDependencyRevision: string;
-    readonly legacyRequirements: boolean;
     readonly expectedApprovalRecipientIdentity: string;
     readonly provedPreviewTransferClaimHash?: string;
     readonly preview?: DeploymentPreviewV1;
@@ -44,7 +44,12 @@ export interface WorkflowPreviewValidatorContext {
     readonly currentDependencyRevision: string;
     readonly expectedResourceIds: readonly string[];
     readonly intendedExecutionRecipientIdentity: string;
+    readonly ownershipIssues?: readonly ValidationIssue[];
+    readonly protectedResourceIds?: readonly string[];
     readonly attestation?: ExecutionPlanAttestationV1;
+    readonly policyValidationBinding?: PolicyValidationBinding & {
+        readonly receiptHash: string;
+    };
 }
 export interface WorkflowDeployValidatorContext {
     readonly now: string;
@@ -64,6 +69,18 @@ export interface WorkflowDeployValidatorContext {
         readonly validatorIds: readonly string[];
     };
 }
+export interface NativeBicepResourceOwnership {
+    readonly expectedResourceIds: readonly string[];
+    readonly resourceIdsByLogicalId: Readonly<Record<string, string>>;
+    readonly protectedResourceIds: readonly string[];
+    readonly issues: readonly ValidationIssue[];
+}
+export declare function resolveNativeBicepResourceOwnership(context: {
+    readonly intent: ImplementationIntentV1;
+    readonly binding: IacBindingV1;
+    readonly manifest: LogicalResourceManifestV1;
+    readonly targetScope: string;
+}): NativeBicepResourceOwnership;
 export interface WorkflowInventoryValidatorContext {
     readonly run: RunConfigV1;
     readonly preview: DeploymentPreviewV1;