@apexops/contracts 0.10.0-next.5 → 0.11.0-next.1

package/dist/onboarding.d.ts

@@ -1,15 +1,196 @@
 import { type Static } from "@sinclair/typebox";
-export declare const BootstrapClientSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"github-copilot-vscode">, import("@sinclair/typebox").TLiteral<"github-copilot-cli">]>;
+export declare const BootstrapClientSchema: import("@sinclair/typebox").TLiteral<"github-copilot-cli">;
 export declare const OnboardingConfigV1Schema: import("@sinclair/typebox").TObject<{
     schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
-    projectId: import("@sinclair/typebox").TString;
+    projectId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     displayName: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
-    client: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"github-copilot-vscode">, import("@sinclair/typebox").TLiteral<"github-copilot-cli">]>>;
+    client: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TLiteral<"github-copilot-cli">>;
     environment: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     targetScope: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     iacTool: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"bicep">, import("@sinclair/typebox").TLiteral<"terraform">]>>;
+    riskOwner: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"partner">, import("@sinclair/typebox").TLiteral<"customer">]>>;
     createRepository: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
 export type BootstrapClient = Static<typeof BootstrapClientSchema>;
 export type OnboardingConfigV1 = Static<typeof OnboardingConfigV1Schema>;
+export declare const BootstrapPlanV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+    config: import("@sinclair/typebox").TObject<{
+        schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+        projectId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        displayName: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        client: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TLiteral<"github-copilot-cli">>;
+        environment: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        targetScope: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        iacTool: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"bicep">, import("@sinclair/typebox").TLiteral<"terraform">]>>;
+        riskOwner: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"partner">, import("@sinclair/typebox").TLiteral<"customer">]>>;
+        createRepository: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    }>;
+    configHash: import("@sinclair/typebox").TString;
+    runtimeVersion: import("@sinclair/typebox").TString;
+    scope: import("@sinclair/typebox").TLiteral<"local-bootstrap-preflight-v1">;
+    status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"ready">, import("@sinclair/typebox").TLiteral<"pending">, import("@sinclair/typebox").TLiteral<"blocked">]>;
+    checks: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        id: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"repository">, import("@sinclair/typebox").TLiteral<"workspace-runtime">, import("@sinclair/typebox").TLiteral<"apex-state">]>;
+        status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"ready">, import("@sinclair/typebox").TLiteral<"pending">, import("@sinclair/typebox").TLiteral<"blocked">]>;
+        reason: import("@sinclair/typebox").TString;
+    }>>;
+    unassessed: import("@sinclair/typebox").TTuple<[import("@sinclair/typebox").TLiteral<"machine-prerequisites">, import("@sinclair/typebox").TLiteral<"client-health">, import("@sinclair/typebox").TLiteral<"remote-coe">, import("@sinclair/typebox").TLiteral<"github-repository">, import("@sinclair/typebox").TLiteral<"governance-oidc">, import("@sinclair/typebox").TLiteral<"reviewed-baseline">]>;
+    filesModified: import("@sinclair/typebox").TLiteral<false>;
+    executionAuthorized: import("@sinclair/typebox").TLiteral<false>;
+}>;
+export type BootstrapPlanV1 = Static<typeof BootstrapPlanV1Schema>;
+export declare const RepositoryPublishConfigV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+    owner: import("@sinclair/typebox").TString;
+    name: import("@sinclair/typebox").TString;
+    visibility: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"private">, import("@sinclair/typebox").TLiteral<"internal">, import("@sinclair/typebox").TLiteral<"public">]>;
+    branch: import("@sinclair/typebox").TString;
+    remote: import("@sinclair/typebox").TLiteral<"origin">;
+}>;
+export type RepositoryPublishConfigV1 = Static<typeof RepositoryPublishConfigV1Schema>;
+export declare const RepositoryPublishPlanV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+    config: import("@sinclair/typebox").TObject<{
+        schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+        owner: import("@sinclair/typebox").TString;
+        name: import("@sinclair/typebox").TString;
+        visibility: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"private">, import("@sinclair/typebox").TLiteral<"internal">, import("@sinclair/typebox").TLiteral<"public">]>;
+        branch: import("@sinclair/typebox").TString;
+        remote: import("@sinclair/typebox").TLiteral<"origin">;
+    }>;
+    evidenceHash: import("@sinclair/typebox").TString;
+    planHash: import("@sinclair/typebox").TString;
+    status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"ready">, import("@sinclair/typebox").TLiteral<"pending">, import("@sinclair/typebox").TLiteral<"blocked">]>;
+    repository: import("@sinclair/typebox").TObject<{
+        fullName: import("@sinclair/typebox").TString;
+        owner: import("@sinclair/typebox").TString;
+        ownerType: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"user">, import("@sinclair/typebox").TLiteral<"organization">, import("@sinclair/typebox").TLiteral<"unknown">]>;
+        visibility: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"private">, import("@sinclair/typebox").TLiteral<"internal">, import("@sinclair/typebox").TLiteral<"public">]>;
+        exists: import("@sinclair/typebox").TBoolean;
+    }>;
+    actions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"create-repository">, import("@sinclair/typebox").TLiteral<"add-remote">, import("@sinclair/typebox").TLiteral<"push-branch">]>>;
+    push: import("@sinclair/typebox").TObject<{
+        branch: import("@sinclair/typebox").TString;
+        commit: import("@sinclair/typebox").TString;
+        commitCount: import("@sinclair/typebox").TInteger;
+        files: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        filesTruncated: import("@sinclair/typebox").TBoolean;
+        uncommittedChanges: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        forcePush: import("@sinclair/typebox").TLiteral<false>;
+    }>;
+    blockers: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    pendingActions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    filesModified: import("@sinclair/typebox").TLiteral<false>;
+    executionAuthorized: import("@sinclair/typebox").TLiteral<false>;
+    deploymentAuthorized: import("@sinclair/typebox").TLiteral<false>;
+}>;
+export type RepositoryPublishPlanV1 = Static<typeof RepositoryPublishPlanV1Schema>;
+export declare const GovernanceSetupConfigV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+    repository: import("@sinclair/typebox").TString;
+    tenantId: import("@sinclair/typebox").TString;
+    subscriptionId: import("@sinclair/typebox").TString;
+    managementGroupId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    identity: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+        mode: import("@sinclair/typebox").TLiteral<"reuse">;
+        clientId: import("@sinclair/typebox").TString;
+        principalId: import("@sinclair/typebox").TString;
+    }>, import("@sinclair/typebox").TObject<{
+        mode: import("@sinclair/typebox").TLiteral<"create">;
+        displayName: import("@sinclair/typebox").TString;
+    }>]>;
+}>;
+export type GovernanceSetupConfigV1 = Static<typeof GovernanceSetupConfigV1Schema>;
+export declare const GovernanceSetupPlanV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+    config: import("@sinclair/typebox").TObject<{
+        schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+        repository: import("@sinclair/typebox").TString;
+        tenantId: import("@sinclair/typebox").TString;
+        subscriptionId: import("@sinclair/typebox").TString;
+        managementGroupId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        identity: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+            mode: import("@sinclair/typebox").TLiteral<"reuse">;
+            clientId: import("@sinclair/typebox").TString;
+            principalId: import("@sinclair/typebox").TString;
+        }>, import("@sinclair/typebox").TObject<{
+            mode: import("@sinclair/typebox").TLiteral<"create">;
+            displayName: import("@sinclair/typebox").TString;
+        }>]>;
+    }>;
+    evidenceHash: import("@sinclair/typebox").TString;
+    status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"pending">, import("@sinclair/typebox").TLiteral<"blocked">]>;
+    federation: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        issuer: import("@sinclair/typebox").TLiteral<"https://token.actions.githubusercontent.com">;
+        audience: import("@sinclair/typebox").TLiteral<"api://AzureADTokenExchange">;
+        subject: import("@sinclair/typebox").TString;
+    }>>;
+    environment: import("@sinclair/typebox").TLiteral<"governance">;
+    proposedRole: import("@sinclair/typebox").TObject<{
+        id: import("@sinclair/typebox").TLiteral<"acdd72a7-3385-48ef-bd42-f606fba81ae7">;
+        name: import("@sinclair/typebox").TLiteral<"Reader">;
+        scope: import("@sinclair/typebox").TString;
+    }>;
+    variables: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TString>;
+    blockers: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    pendingActions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    filesModified: import("@sinclair/typebox").TLiteral<false>;
+    executionAuthorized: import("@sinclair/typebox").TLiteral<false>;
+    deploymentAuthorized: import("@sinclair/typebox").TLiteral<false>;
+    planHash: import("@sinclair/typebox").TString;
+}>;
+export type GovernanceSetupPlanV1 = Static<typeof GovernanceSetupPlanV1Schema>;
+export declare const GovernanceProvisionPlanV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+    setup: import("@sinclair/typebox").TObject<{
+        schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+        config: import("@sinclair/typebox").TObject<{
+            schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+            repository: import("@sinclair/typebox").TString;
+            tenantId: import("@sinclair/typebox").TString;
+            subscriptionId: import("@sinclair/typebox").TString;
+            managementGroupId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            identity: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+                mode: import("@sinclair/typebox").TLiteral<"reuse">;
+                clientId: import("@sinclair/typebox").TString;
+                principalId: import("@sinclair/typebox").TString;
+            }>, import("@sinclair/typebox").TObject<{
+                mode: import("@sinclair/typebox").TLiteral<"create">;
+                displayName: import("@sinclair/typebox").TString;
+            }>]>;
+        }>;
+        evidenceHash: import("@sinclair/typebox").TString;
+        status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"pending">, import("@sinclair/typebox").TLiteral<"blocked">]>;
+        federation: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            issuer: import("@sinclair/typebox").TLiteral<"https://token.actions.githubusercontent.com">;
+            audience: import("@sinclair/typebox").TLiteral<"api://AzureADTokenExchange">;
+            subject: import("@sinclair/typebox").TString;
+        }>>;
+        environment: import("@sinclair/typebox").TLiteral<"governance">;
+        proposedRole: import("@sinclair/typebox").TObject<{
+            id: import("@sinclair/typebox").TLiteral<"acdd72a7-3385-48ef-bd42-f606fba81ae7">;
+            name: import("@sinclair/typebox").TLiteral<"Reader">;
+            scope: import("@sinclair/typebox").TString;
+        }>;
+        variables: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TString>;
+        blockers: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        pendingActions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        filesModified: import("@sinclair/typebox").TLiteral<false>;
+        executionAuthorized: import("@sinclair/typebox").TLiteral<false>;
+        deploymentAuthorized: import("@sinclair/typebox").TLiteral<false>;
+        planHash: import("@sinclair/typebox").TString;
+    }>;
+    contextHash: import("@sinclair/typebox").TString;
+    evidenceHash: import("@sinclair/typebox").TString;
+    planHash: import("@sinclair/typebox").TString;
+    status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"ready">, import("@sinclair/typebox").TLiteral<"blocked">]>;
+    applicationObjectId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    federationName: import("@sinclair/typebox").TString;
+    actions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"create-federation">, import("@sinclair/typebox").TLiteral<"assign-reader">]>>;
+    blockers: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    executionAuthorized: import("@sinclair/typebox").TLiteral<false>;
+    deploymentAuthorized: import("@sinclair/typebox").TLiteral<false>;
+}>;
+export type GovernanceProvisionPlanV1 = Static<typeof GovernanceProvisionPlanV1Schema>;
 //# sourceMappingURL=onboarding.d.ts.map

package/dist/onboarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAStD,eAAO,MAAM,qBAAqB,iKAGhC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;EAYpC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACnE,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAWtD,eAAO,MAAM,qBAAqB,4DAAqC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;EAapC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACnE,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;EA+BjC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEnE,eAAO,MAAM,+BAA+B;;;;;;;EAU3C,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAEvF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwCzC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAKnF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;EAwBzC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEnF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAE/E,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmB3C,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/onboarding.js

@@ -1,17 +1,133 @@
 import { Type } from "@sinclair/typebox";
-import { ContractVersionSchema, EnvironmentSchema, IacToolSchema, NonEmptyStringSchema, ProjectIdSchema, } from "./common.js";
-export const BootstrapClientSchema = Type.Union([
-    Type.Literal("github-copilot-vscode"),
-    Type.Literal("github-copilot-cli"),
-]);
+import { ContractVersionSchema, EnvironmentSchema, IacToolSchema, NonEmptyStringSchema, ProjectIdSchema, RiskOwnerSchema, Sha256Schema, } from "./common.js";
+export const BootstrapClientSchema = Type.Literal("github-copilot-cli");
 export const OnboardingConfigV1Schema = Type.Object({
     schemaVersion: ContractVersionSchema,
-    projectId: ProjectIdSchema,
+    projectId: Type.Optional(ProjectIdSchema),
     displayName: Type.Optional(NonEmptyStringSchema),
     client: Type.Optional(BootstrapClientSchema),
     environment: Type.Optional(EnvironmentSchema),
     targetScope: Type.Optional(NonEmptyStringSchema),
     iacTool: Type.Optional(IacToolSchema),
+    riskOwner: Type.Optional(RiskOwnerSchema),
     createRepository: Type.Optional(Type.Boolean()),
 }, { $id: "https://schemas.apexops.dev/onboarding-config-v1.json", additionalProperties: false });
+export const BootstrapPlanV1Schema = Type.Object({
+    schemaVersion: ContractVersionSchema,
+    config: OnboardingConfigV1Schema,
+    configHash: Sha256Schema,
+    runtimeVersion: NonEmptyStringSchema,
+    scope: Type.Literal("local-bootstrap-preflight-v1"),
+    status: Type.Union([Type.Literal("ready"), Type.Literal("pending"), Type.Literal("blocked")]),
+    checks: Type.Array(Type.Object({
+        id: Type.Union([Type.Literal("repository"), Type.Literal("workspace-runtime"), Type.Literal("apex-state")]),
+        status: Type.Union([Type.Literal("ready"), Type.Literal("pending"), Type.Literal("blocked")]),
+        reason: Type.String({ minLength: 1, maxLength: 1024 }),
+    }, { additionalProperties: false }), { minItems: 3, maxItems: 3 }),
+    unassessed: Type.Tuple([
+        Type.Literal("machine-prerequisites"),
+        Type.Literal("client-health"),
+        Type.Literal("remote-coe"),
+        Type.Literal("github-repository"),
+        Type.Literal("governance-oidc"),
+        Type.Literal("reviewed-baseline"),
+    ]),
+    filesModified: Type.Literal(false),
+    executionAuthorized: Type.Literal(false),
+}, { $id: "https://schemas.apexops.dev/bootstrap-plan-v1.json", additionalProperties: false });
+export const RepositoryPublishConfigV1Schema = Type.Object({
+    schemaVersion: ContractVersionSchema,
+    owner: Type.String({ pattern: "^[A-Za-z0-9][A-Za-z0-9-]{0,38}$(?![\\s\\S])" }),
+    name: Type.String({ pattern: "^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$(?![\\s\\S])" }),
+    visibility: Type.Union([Type.Literal("private"), Type.Literal("internal"), Type.Literal("public")]),
+    branch: Type.String({ pattern: "^[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$(?![\\s\\S])" }),
+    remote: Type.Literal("origin"),
+}, { $id: "https://schemas.apexops.dev/repository-publish-config-v1.json", additionalProperties: false });
+export const RepositoryPublishPlanV1Schema = Type.Object({
+    schemaVersion: ContractVersionSchema,
+    config: RepositoryPublishConfigV1Schema,
+    evidenceHash: Sha256Schema,
+    planHash: Sha256Schema,
+    status: Type.Union([Type.Literal("ready"), Type.Literal("pending"), Type.Literal("blocked")]),
+    repository: Type.Object({
+        fullName: Type.String({ minLength: 3, maxLength: 140 }),
+        owner: Type.String({ minLength: 1, maxLength: 39 }),
+        ownerType: Type.Union([Type.Literal("user"), Type.Literal("organization"), Type.Literal("unknown")]),
+        visibility: Type.Union([Type.Literal("private"), Type.Literal("internal"), Type.Literal("public")]),
+        exists: Type.Boolean(),
+    }, { additionalProperties: false }),
+    actions: Type.Array(Type.Union([Type.Literal("create-repository"), Type.Literal("add-remote"), Type.Literal("push-branch")]), { maxItems: 3, uniqueItems: true }),
+    push: Type.Object({
+        branch: Type.String({ minLength: 1, maxLength: 255 }),
+        commit: Type.String({ pattern: "^[0-9a-f]{40}$(?![\\s\\S])" }),
+        commitCount: Type.Integer({ minimum: 0, maximum: 1_000_000 }),
+        files: Type.Array(Type.String({ minLength: 1, maxLength: 1024 }), { maxItems: 512 }),
+        filesTruncated: Type.Boolean(),
+        uncommittedChanges: Type.Array(Type.String({ minLength: 1, maxLength: 1024 }), { maxItems: 512 }),
+        forcePush: Type.Literal(false),
+    }, { additionalProperties: false }),
+    blockers: Type.Array(Type.String({ minLength: 1, maxLength: 512 }), { maxItems: 16 }),
+    pendingActions: Type.Array(Type.String({ minLength: 1, maxLength: 256 }), { maxItems: 16 }),
+    filesModified: Type.Literal(false),
+    executionAuthorized: Type.Literal(false),
+    deploymentAuthorized: Type.Literal(false),
+}, { $id: "https://schemas.apexops.dev/repository-publish-plan-v1.json", additionalProperties: false });
+const AzureId = Type.String({
+    pattern: "^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$(?![\\s\\S])",
+});
+export const GovernanceSetupConfigV1Schema = Type.Object({
+    schemaVersion: ContractVersionSchema,
+    repository: Type.String({ pattern: "^[A-Za-z0-9][A-Za-z0-9-]{0,38}/[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$(?![\\s\\S])" }),
+    tenantId: AzureId,
+    subscriptionId: AzureId,
+    managementGroupId: Type.Optional(Type.String({ pattern: "^[A-Za-z0-9](?:[A-Za-z0-9_().-]{0,88}[A-Za-z0-9_()-])?$(?![\\s\\S])" })),
+    identity: Type.Union([
+        Type.Object({ mode: Type.Literal("reuse"), clientId: AzureId, principalId: AzureId }, { additionalProperties: false }),
+        Type.Object({
+            mode: Type.Literal("create"),
+            displayName: Type.String({ pattern: "^[A-Za-z][A-Za-z0-9_.-]{0,79}$(?![\\s\\S])" }),
+        }, { additionalProperties: false }),
+    ]),
+}, { $id: "https://schemas.apexops.dev/governance-setup-config-v1.json", additionalProperties: false });
+export const GovernanceSetupPlanV1Schema = Type.Object({
+    schemaVersion: ContractVersionSchema,
+    config: GovernanceSetupConfigV1Schema,
+    evidenceHash: Sha256Schema,
+    status: Type.Union([Type.Literal("pending"), Type.Literal("blocked")]),
+    federation: Type.Optional(Type.Object({
+        issuer: Type.Literal("https://token.actions.githubusercontent.com"),
+        audience: Type.Literal("api://AzureADTokenExchange"),
+        subject: Type.String({ minLength: 1, maxLength: 512 }),
+    }, { additionalProperties: false })),
+    environment: Type.Literal("governance"),
+    proposedRole: Type.Object({
+        id: Type.Literal("acdd72a7-3385-48ef-bd42-f606fba81ae7"),
+        name: Type.Literal("Reader"),
+        scope: Type.String({ minLength: 1, maxLength: 256 }),
+    }, { additionalProperties: false }),
+    variables: Type.Record(Type.String({ pattern: "^[A-Z_]+$" }), Type.String({ maxLength: 256 })),
+    blockers: Type.Array(Type.String({ minLength: 1, maxLength: 512 }), { maxItems: 16 }),
+    pendingActions: Type.Array(Type.String({ minLength: 1, maxLength: 256 }), { maxItems: 16 }),
+    filesModified: Type.Literal(false),
+    executionAuthorized: Type.Literal(false),
+    deploymentAuthorized: Type.Literal(false),
+    planHash: Sha256Schema,
+}, { $id: "https://schemas.apexops.dev/governance-setup-plan-v1.json", additionalProperties: false });
+export const GovernanceProvisionPlanV1Schema = Type.Object({
+    schemaVersion: ContractVersionSchema,
+    setup: GovernanceSetupPlanV1Schema,
+    contextHash: Sha256Schema,
+    evidenceHash: Sha256Schema,
+    planHash: Sha256Schema,
+    status: Type.Union([Type.Literal("ready"), Type.Literal("blocked")]),
+    applicationObjectId: Type.Optional(AzureId),
+    federationName: Type.String({ pattern: "^apex-governance-[a-f0-9]{24}$" }),
+    actions: Type.Array(Type.Union([Type.Literal("create-federation"), Type.Literal("assign-reader")]), {
+        maxItems: 2,
+        uniqueItems: true,
+    }),
+    blockers: Type.Array(Type.String({ minLength: 1, maxLength: 512 }), { maxItems: 16 }),
+    executionAuthorized: Type.Literal(false),
+    deploymentAuthorized: Type.Literal(false),
+}, { $id: "https://schemas.apexops.dev/governance-provision-plan-v1.json", additionalProperties: false });
 //# sourceMappingURL=onboarding.js.map

package/dist/onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CACjD;IACE,aAAa,EAAE,qBAAqB;IACpC,SAAS,EAAE,eAAe;IAC1B,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAChD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAC5C,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC7C,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAChD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;IACrC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;CAChD,EACD,EAAE,GAAG,EAAE,uDAAuD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC9F,CAAC"}
+{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CACjD;IACE,aAAa,EAAE,qBAAqB;IACpC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;IACzC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAChD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAC5C,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC7C,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAChD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;IACrC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;IACzC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;CAChD,EACD,EAAE,GAAG,EAAE,uDAAuD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC9F,CAAC;AAKF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAC9C;IACE,aAAa,EAAE,qBAAqB;IACpC,MAAM,EAAE,wBAAwB;IAChC,UAAU,EAAE,YAAY;IACxB,cAAc,EAAE,oBAAoB;IACpC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;IACnD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7F,MAAM,EAAE,IAAI,CAAC,KAAK,CAChB,IAAI,CAAC,MAAM,CACT;QACE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3G,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7F,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACvD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,EACD,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAC7B;IACD,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;KAClC,CAAC;IACF,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;CACzC,EACD,EAAE,GAAG,EAAE,oDAAoD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC3F,CAAC;AAIF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC,MAAM,CACxD;IACE,aAAa,EAAE,qBAAqB;IACpC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;IAC9E,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IAC/E,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnG,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IACnF,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC/B,EACD,EAAE,GAAG,EAAE,+DAA+D,EAAE,oBAAoB,EAAE,KAAK,EAAE,CACtG,CAAC;AAGF,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC,MAAM,CACtD;IACE,aAAa,EAAE,qBAAqB;IACpC,MAAM,EAAE,+BAA+B;IACvC,YAAY,EAAE,YAAY;IAC1B,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7F,UAAU,EAAE,IAAI,CAAC,MAAM,CACrB;QACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACvD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACnD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACpG,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnG,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;KACvB,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC;IACD,OAAO,EAAE,IAAI,CAAC,KAAK,CACjB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EACxG,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CACnC;IACD,IAAI,EAAE,IAAI,CAAC,MAAM,CACf;QACE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACrD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;QAC9D,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC7D,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACpF,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE;QAC9B,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACjG,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;KAC/B,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC;IACD,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrF,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3F,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,EACD,EAAE,GAAG,EAAE,6DAA6D,EAAE,oBAAoB,EAAE,KAAK,EAAE,CACpG,CAAC;AAGF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,2FAA2F;CACrG,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC,MAAM,CACtD;IACE,aAAa,EAAE,qBAAqB;IACpC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,6EAA6E,EAAE,CAAC;IACnH,QAAQ,EAAE,OAAO;IACjB,cAAc,EAAE,OAAO;IACvB,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qEAAqE,EAAE,CAAC,CAChG;IACD,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,CACT,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EACxE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC;QACD,IAAI,CAAC,MAAM,CACT;YACE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC5B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;SACpF,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC;KACF,CAAC;CACH,EACD,EAAE,GAAG,EAAE,6DAA6D,EAAE,oBAAoB,EAAE,KAAK,EAAE,CACpG,CAAC;AAGF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,MAAM,CACpD;IACE,aAAa,EAAE,qBAAqB;IACpC,MAAM,EAAE,6BAA6B;IACrC,YAAY,EAAE,YAAY;IAC1B,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,UAAU,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,MAAM,CACT;QACE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,6CAA6C,CAAC;QACnE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC;QACpD,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;KACvD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CACF;IACD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IACvC,YAAY,EAAE,IAAI,CAAC,MAAM,CACvB;QACE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,sCAAsC,CAAC;QACxD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;KACrD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC;IACD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9F,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrF,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3F,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,QAAQ,EAAE,YAAY;CACvB,EACD,EAAE,GAAG,EAAE,2DAA2D,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAClG,CAAC;AAGF,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC,MAAM,CACxD;IACE,aAAa,EAAE,qBAAqB;IACpC,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,YAAY;IAC1B,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC3C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IAC1E,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QAClG,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,IAAI;KAClB,CAAC;IACF,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrF,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,EACD,EAAE,GAAG,EAAE,+DAA+D,EAAE,oBAAoB,EAAE,KAAK,EAAE,CACtG,CAAC"}

package/dist/policy-validation.d.ts

@@ -0,0 +1,45 @@
+import { type Static } from "@sinclair/typebox";
+import { PolicyPropertyMapV1Schema } from "./targets.js";
+export declare const PolicyValidationV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+    projectId: import("@sinclair/typebox").TString;
+    runId: import("@sinclair/typebox").TString;
+    track: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"bicep">, import("@sinclair/typebox").TLiteral<"terraform">]>;
+    sourceHash: import("@sinclair/typebox").TString;
+    policyMapHash: import("@sinclair/typebox").TString;
+    policyMapContentHash: import("@sinclair/typebox").TString;
+    logicalResourceManifestHash: import("@sinclair/typebox").TString;
+    inputHash: import("@sinclair/typebox").TString;
+    outcome: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"pass">, import("@sinclair/typebox").TLiteral<"fail">, import("@sinclair/typebox").TLiteral<"unsupported">]>;
+    results: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        mappingIndex: import("@sinclair/typebox").TInteger;
+        mappingHash: import("@sinclair/typebox").TString;
+        policyAssignmentId: import("@sinclair/typebox").TString;
+        policyDefinitionId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        policyDefinitionReferenceId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        effect: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"deny">, import("@sinclair/typebox").TLiteral<"modify">, import("@sinclair/typebox").TLiteral<"append">, import("@sinclair/typebox").TLiteral<"audit">, import("@sinclair/typebox").TLiteral<"deployIfNotExists">, import("@sinclair/typebox").TLiteral<"disabled">]>;
+        disposition: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"satisfied">, import("@sinclair/typebox").TLiteral<"planned">, import("@sinclair/typebox").TLiteral<"exempt">, import("@sinclair/typebox").TLiteral<"blocked">, import("@sinclair/typebox").TLiteral<"not-applicable">]>;
+        logicalResourceId: import("@sinclair/typebox").TString;
+        propertyPath: import("@sinclair/typebox").TString;
+        expectedValueDigest: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        observedValueDigest: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        outcome: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"pass">, import("@sinclair/typebox").TLiteral<"fail">, import("@sinclair/typebox").TLiteral<"unsupported">]>;
+        reason: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"matched">, import("@sinclair/typebox").TLiteral<"value-mismatch">, import("@sinclair/typebox").TLiteral<"missing-property">, import("@sinclair/typebox").TLiteral<"blocked">, import("@sinclair/typebox").TLiteral<"missing-expected-value">, import("@sinclair/typebox").TLiteral<"unverified-exemption">, import("@sinclair/typebox").TLiteral<"unsupported-effect">, import("@sinclair/typebox").TLiteral<"unsupported-path">, import("@sinclair/typebox").TLiteral<"unsupported-expression">, import("@sinclair/typebox").TLiteral<"resource-not-bound">, import("@sinclair/typebox").TLiteral<"resource-not-found">, import("@sinclair/typebox").TLiteral<"ambiguous-resource">, import("@sinclair/typebox").TLiteral<"unsupported-resource">, import("@sinclair/typebox").TLiteral<"invalid-source">, import("@sinclair/typebox").TLiteral<"not-applicable">, import("@sinclair/typebox").TLiteral<"platform-remediated">]>;
+    }>>;
+    receiptHash: import("@sinclair/typebox").TString;
+}>;
+export type PolicyValidationV1 = Static<typeof PolicyValidationV1Schema>;
+export declare function hasActionablePolicyMappings(policyMap: Static<typeof PolicyPropertyMapV1Schema>): boolean;
+export type PolicyValidationResultV1 = PolicyValidationV1["results"][number];
+export type PolicyValidationBinding = Pick<PolicyValidationV1, "track" | "sourceHash" | "policyMapHash" | "policyMapContentHash" | "logicalResourceManifestHash" | "inputHash">;
+export declare const POLICY_VALIDATION_LIMITS: Readonly<{
+    bytes: number;
+    depth: 64;
+    nodes: 100000;
+    mappings: 1000;
+}>;
+export declare function assertPolicyValidationJson(value: unknown): void;
+export declare function calculatePolicyValidationDigest(value: unknown): string;
+export declare function calculatePolicyValidationHash(receipt: Omit<PolicyValidationV1, "receiptHash">): string;
+export declare function hasValidPolicyValidation(value: unknown, binding: PolicyValidationBinding): value is PolicyValidationV1;
+//# sourceMappingURL=policy-validation.d.ts.map

package/dist/policy-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-validation.d.ts","sourceRoot":"","sources":["../src/policy-validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAUtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAKzD,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoDpC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,yBAAyB,CAAC,GAAG,OAAO,CAExG;AACD,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7E,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,kBAAkB,EAClB,OAAO,GAAG,YAAY,GAAG,eAAe,GAAG,sBAAsB,GAAG,6BAA6B,GAAG,WAAW,CAChH,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;EAKnC,CAAC;AAEH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAyC/D;AAqBD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKtE;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,GAAG,MAAM,CAEtG;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,uBAAuB,GAC/B,KAAK,IAAI,kBAAkB,CA0D7B"}

package/dist/policy-validation.js

@@ -0,0 +1,194 @@
+import { createHash } from "node:crypto";
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { ContractVersionSchema, IacToolSchema, NonEmptyStringSchema, ProjectIdSchema, RunIdSchema, Sha256Schema, } from "./common.js";
+import { PolicyPropertyMapV1Schema } from "./targets.js";
+const OutcomeSchema = Type.Union([Type.Literal("pass"), Type.Literal("fail"), Type.Literal("unsupported")]);
+const mappingProperties = PolicyPropertyMapV1Schema.properties.mappings.items.properties;
+export const PolicyValidationV1Schema = Type.Object({
+    schemaVersion: ContractVersionSchema,
+    projectId: ProjectIdSchema,
+    runId: RunIdSchema,
+    track: IacToolSchema,
+    sourceHash: Sha256Schema,
+    policyMapHash: Sha256Schema,
+    policyMapContentHash: Sha256Schema,
+    logicalResourceManifestHash: Sha256Schema,
+    inputHash: Sha256Schema,
+    outcome: OutcomeSchema,
+    results: Type.Array(Type.Object({
+        mappingIndex: Type.Integer({ minimum: 0 }),
+        mappingHash: Sha256Schema,
+        policyAssignmentId: NonEmptyStringSchema,
+        policyDefinitionId: Type.Optional(NonEmptyStringSchema),
+        policyDefinitionReferenceId: Type.Optional(NonEmptyStringSchema),
+        effect: mappingProperties.effect,
+        disposition: mappingProperties.disposition,
+        logicalResourceId: NonEmptyStringSchema,
+        propertyPath: NonEmptyStringSchema,
+        expectedValueDigest: Type.Optional(Sha256Schema),
+        observedValueDigest: Type.Optional(Sha256Schema),
+        outcome: OutcomeSchema,
+        reason: Type.Union([
+            Type.Literal("matched"),
+            Type.Literal("value-mismatch"),
+            Type.Literal("missing-property"),
+            Type.Literal("blocked"),
+            Type.Literal("missing-expected-value"),
+            Type.Literal("unverified-exemption"),
+            Type.Literal("unsupported-effect"),
+            Type.Literal("unsupported-path"),
+            Type.Literal("unsupported-expression"),
+            Type.Literal("resource-not-bound"),
+            Type.Literal("resource-not-found"),
+            Type.Literal("ambiguous-resource"),
+            Type.Literal("unsupported-resource"),
+            Type.Literal("invalid-source"),
+            Type.Literal("not-applicable"),
+            Type.Literal("platform-remediated"),
+        ]),
+    }, { additionalProperties: false })),
+    receiptHash: Sha256Schema,
+}, { $id: "https://schemas.apexops.dev/policy-validation-v1.json", additionalProperties: false });
+export function hasActionablePolicyMappings(policyMap) {
+    return policyMap.mappings.some(({ disposition }) => disposition !== "not-applicable");
+}
+export const POLICY_VALIDATION_LIMITS = Object.freeze({
+    bytes: 16 * 1024 * 1024,
+    depth: 64,
+    nodes: 100_000,
+    mappings: 1_000,
+});
+export function assertPolicyValidationJson(value) {
+    const pending = [{ value, depth: 0, exit: false }];
+    const ancestors = new Set();
+    let nodes = 1;
+    let bytes = 0;
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current.exit) {
+            ancestors.delete(current.value);
+            continue;
+        }
+        if (current.depth > POLICY_VALIDATION_LIMITS.depth)
+            throw new TypeError("POLICY_VALIDATION_LIMIT_EXCEEDED");
+        const child = current.value;
+        if (child !== null && typeof child === "object") {
+            if ((!Array.isArray(child) && Object.getPrototypeOf(child) !== Object.prototype) || ancestors.has(child))
+                throw new TypeError("POLICY_VALIDATION_NON_JSON_VALUE");
+            ancestors.add(child);
+            pending.push({ ...current, exit: true });
+            const keys = Array.isArray(child) ? undefined : Object.keys(child);
+            const length = keys === undefined ? child.length : keys.length;
+            nodes += length;
+            if (nodes > POLICY_VALIDATION_LIMITS.nodes)
+                throw new TypeError("POLICY_VALIDATION_LIMIT_EXCEEDED");
+            bytes += 2 + Math.max(0, length - 1);
+            for (let index = 0; index < length; index++) {
+                const key = keys?.[index];
+                const entry = key === undefined ? child[index] : child[key];
+                if (key !== undefined)
+                    bytes += Buffer.byteLength(JSON.stringify(key), "utf8") + 1;
+                pending.push({ value: entry, depth: current.depth + 1, exit: false });
+            }
+        }
+        else if (child === null ||
+            typeof child === "string" ||
+            typeof child === "boolean" ||
+            (typeof child === "number" && Number.isFinite(child))) {
+            bytes += Buffer.byteLength(JSON.stringify(child), "utf8");
+        }
+        else {
+            throw new TypeError("POLICY_VALIDATION_NON_JSON_VALUE");
+        }
+        if (bytes > POLICY_VALIDATION_LIMITS.bytes)
+            throw new TypeError("POLICY_VALIDATION_LIMIT_EXCEEDED");
+    }
+}
+function canonicalValue(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    if (value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([key, child]) => [key, canonicalValue(child)]));
+    }
+    if (value === null ||
+        typeof value === "string" ||
+        typeof value === "boolean" ||
+        (typeof value === "number" && Number.isFinite(value)))
+        return value;
+    throw new TypeError("POLICY_VALIDATION_NON_JSON_VALUE");
+}
+export function calculatePolicyValidationDigest(value) {
+    assertPolicyValidationJson(value);
+    return createHash("sha256")
+        .update(JSON.stringify(canonicalValue(value)))
+        .digest("hex");
+}
+export function calculatePolicyValidationHash(receipt) {
+    return calculatePolicyValidationDigest(receipt);
+}
+export function hasValidPolicyValidation(value, binding) {
+    try {
+        assertPolicyValidationJson(value);
+        assertPolicyValidationJson(binding);
+    }
+    catch {
+        return false;
+    }
+    if (binding === null || typeof binding !== "object" || Array.isArray(binding))
+        return false;
+    if (!Value.Check(PolicyValidationV1Schema, value))
+        return false;
+    if (value.results.length > POLICY_VALIDATION_LIMITS.mappings)
+        return false;
+    const { receiptHash, ...receipt } = value;
+    const keys = [
+        "track",
+        "sourceHash",
+        "policyMapHash",
+        "policyMapContentHash",
+        "logicalResourceManifestHash",
+        "inputHash",
+    ];
+    if (keys.some((key) => receipt[key] !== binding[key]))
+        return false;
+    const outcome = receipt.results.some((result) => result.outcome === "fail")
+        ? "fail"
+        : receipt.results.length === 0 || receipt.results.some((result) => result.outcome === "unsupported")
+            ? "unsupported"
+            : "pass";
+    if (receipt.outcome !== outcome)
+        return false;
+    if (!receipt.results.every((result, index) => {
+        if (result.mappingIndex !== index)
+            return false;
+        if (result.reason === "matched") {
+            return (result.outcome === "pass" &&
+                result.expectedValueDigest !== undefined &&
+                result.expectedValueDigest === result.observedValueDigest &&
+                result.disposition !== "blocked" &&
+                result.disposition !== "exempt" &&
+                result.disposition !== "not-applicable" &&
+                result.effect !== "disabled");
+        }
+        if (result.reason === "not-applicable")
+            return result.outcome === "pass" && result.disposition === "not-applicable";
+        if (result.reason === "platform-remediated")
+            return (result.outcome === "pass" &&
+                ["modify", "deployIfNotExists"].includes(result.effect) &&
+                ["satisfied", "planned"].includes(result.disposition));
+        if (["blocked", "value-mismatch", "missing-property"].includes(result.reason))
+            return result.outcome === "fail";
+        return result.outcome === "unsupported";
+    }))
+        return false;
+    try {
+        return receiptHash === calculatePolicyValidationHash(receipt);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=policy-validation.js.map