@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/infrastructure-change/model.d.ts

@@ -0,0 +1,253 @@
+export declare const INFRASTRUCTURE_CHANGE_SCHEMA_VERSION: 1;
+export declare const INFRASTRUCTURE_PLAN_KIND: "ebk-infrastructure-plan";
+export declare const SST_DIFF_TOOL_NAME: "sst";
+export declare const SST_DIFF_TOOL_VERSION: "4.17.1";
+export declare const INFRASTRUCTURE_OPERATIONS: readonly ["create", "update", "replace", "delete", "import", "read", "unknown"];
+export type InfrastructureOperation = (typeof INFRASTRUCTURE_OPERATIONS)[number];
+export declare const INFRASTRUCTURE_RISK_CLASSES: readonly ["no-change", "additive-low-risk", "in-place-reviewed", "stateless-replacement", "stateful-or-destructive", "security-expansion", "protection-reduction", "material-cost-or-quota", "unknown"];
+export type InfrastructureRiskClass = (typeof INFRASTRUCTURE_RISK_CLASSES)[number];
+export type InfrastructureRiskDisposition = 'allow-standing-policy' | 'review' | 'block';
+export interface InfrastructureChangedPropertyV1 {
+    inputDiff: boolean;
+    kind: 'add' | 'add-replace' | 'delete' | 'delete-replace' | 'update' | 'update-replace' | 'unknown';
+    path: string;
+    sensitive: boolean;
+}
+export interface NormalizedInfrastructureResourceV1 {
+    changedProperties: readonly InfrastructureChangedPropertyV1[];
+    logicalId: string;
+    operation: InfrastructureOperation;
+    providerOperation: string;
+    replacement: boolean;
+    replacementStrategy: 'create-before-delete' | 'delete-before-create' | 'unknown';
+    resourceType: string;
+    sourceIndex: number;
+}
+export interface SstDiffFailureV1 {
+    code: 'diff-command-failed' | 'diff-json-invalid' | 'diff-shape-invalid' | 'diff-tool-version-mismatch' | 'diff-unknown-operation';
+    detail: string;
+    sourceIndex?: number;
+}
+export interface NormalizedSstDiffV1 {
+    complete: boolean;
+    diagnosticCoverage: 'exit-status-only';
+    failures: readonly SstDiffFailureV1[];
+    kind: 'ebk-sst-diff';
+    resources: readonly NormalizedInfrastructureResourceV1[];
+    schemaVersion: typeof INFRASTRUCTURE_CHANGE_SCHEMA_VERSION;
+    sourceBoundary: 'desired-source-vs-recorded-state';
+    stateIdentityCoverage: 'not-emitted-by-diff-json';
+    tool: {
+        name: typeof SST_DIFF_TOOL_NAME;
+        version: typeof SST_DIFF_TOOL_VERSION;
+    };
+}
+export interface InfrastructureRiskFindingV1 {
+    class: InfrastructureRiskClass;
+    code: string;
+    disposition: InfrastructureRiskDisposition;
+    message: string;
+    propertyPath?: string;
+    resourceId?: string;
+}
+export interface InfrastructureRiskAssessmentV1 {
+    aggregate: InfrastructureRiskClass;
+    applyAllowed: boolean;
+    findings: readonly InfrastructureRiskFindingV1[];
+    requiredApprovals: readonly string[];
+}
+export interface InfrastructurePolicySignalV1 {
+    class: 'security-expansion' | 'protection-reduction' | 'material-cost-or-quota' | 'unknown';
+    code: string;
+    propertyPath?: string;
+    resourceId: string;
+}
+export interface IamAccessAnalyzerFindingV1 {
+    code: string;
+    findingType: 'error' | 'security-warning' | 'suggestion' | 'warning';
+    issueCode: string;
+    location?: string;
+}
+export interface IamAccessAnalyzerValidationV1 {
+    accessChange: 'expanded' | 'narrow-or-equal' | 'unknown';
+    analyzer: 'aws-iam-access-analyzer-validate-policy';
+    findings: readonly IamAccessAnalyzerFindingV1[];
+    policyResourceId: string;
+    status: 'complete' | 'failed' | 'unsupported';
+}
+export interface InfrastructureRiskPolicyV1 {
+    /**
+     * Exact provider types whose create operation has been reviewed as a
+     * private, stateless, low-cost addition.
+     */
+    additiveLowRiskTypes: readonly string[];
+    /**
+     * Exact provider types that can materially change cost or consume quotas.
+     */
+    costOrQuotaTypes: readonly string[];
+    /**
+     * Exact provider types whose delete or replacement can destroy durable
+     * state. Blueprint-defined stores belong here too.
+     */
+    statefulTypes: readonly string[];
+}
+export type InfrastructureDriftStatus = 'not-checked' | 'no-drift' | 'drift-detected' | 'partial-coverage' | 'unsupported' | 'failed';
+export type InfrastructureMutationAction = 'deploy' | 'refresh' | 'remove';
+export interface InfrastructurePlanTargetV1 {
+    accountFingerprint: string;
+    region: string;
+    stage: string;
+}
+export interface InfrastructureStateIdentityV1 {
+    backend: string;
+    digest: string;
+    expiresAt: string;
+    locked: boolean | 'unknown';
+    observedAt: string;
+    stack: string;
+    version: string;
+}
+export interface InfrastructurePlanV1 {
+    action: InfrastructureMutationAction;
+    aggregateRisk: InfrastructureRiskClass;
+    configurationMetadataDigest: string;
+    diff: NormalizedSstDiffV1;
+    driftEvidenceDigest: string;
+    driftEvidenceExpiresAt: string;
+    driftEvidenceGeneratedAt: string;
+    driftStatus: InfrastructureDriftStatus;
+    expiresAt: string;
+    frameworkVersion: string;
+    generatedAt: string;
+    kind: typeof INFRASTRUCTURE_PLAN_KIND;
+    materialDigest: string;
+    policyProfileDigest: string;
+    projects: readonly string[];
+    repository: string;
+    requiredApprovals: readonly string[];
+    resourceFindings: readonly InfrastructureRiskFindingV1[];
+    schemaVersion: typeof INFRASTRUCTURE_CHANGE_SCHEMA_VERSION;
+    sourceCommit: string;
+    state: InfrastructureStateIdentityV1;
+    target: InfrastructurePlanTargetV1;
+    tool: {
+        name: typeof SST_DIFF_TOOL_NAME;
+        version: typeof SST_DIFF_TOOL_VERSION;
+    };
+    versions: Readonly<Record<string, string>>;
+}
+export interface InfrastructureApprovalRecordV1 {
+    acknowledgement?: string;
+    approvedAt: string;
+    approver: string;
+    author: string;
+    codeownerReviewed: boolean;
+    evidenceRefs: Readonly<Record<string, string>>;
+    expiresAt: string;
+    materialDigest: string;
+    mode: 'standing-policy' | 'human-record' | 'environment-reviewer';
+    recordPath?: string;
+    stage: string;
+}
+export type InfrastructurePlanValidationCode = 'approval-invalid' | 'approval-missing' | 'diff-incomplete' | 'drift-unresolved' | 'material-plan-changed' | 'plan-expired' | 'plan-schema-invalid' | 'plan-tool-version-invalid' | 'source-change-invalid' | 'state-lock-unverified' | 'state-locked' | 'unknown-risk';
+export interface InfrastructurePlanValidationFindingV1 {
+    code: InfrastructurePlanValidationCode;
+    detail: string;
+}
+export interface InfrastructurePlanValidationV1 {
+    allowed: boolean;
+    findings: readonly InfrastructurePlanValidationFindingV1[];
+    outcome: 'plan-clean' | 'plan-risk-blocked' | 'plan-stale' | 'state-lock-unverified' | 'state-locked';
+}
+export interface InfrastructureAuthorizationEvidenceV1 {
+    action: InfrastructureMutationAction;
+    approval?: InfrastructureApprovalRecordV1;
+    governanceEvidenceDigests?: Readonly<Record<string, string>>;
+    kind: 'ebk-infrastructure-authorization';
+    plannedMaterialDigest: string;
+    recomputedMaterialDigest: string;
+    schemaVersion: typeof INFRASTRUCTURE_CHANGE_SCHEMA_VERSION;
+    sourceChangesSincePlan: readonly string[];
+    validation: InfrastructurePlanValidationV1;
+}
+export type InfrastructureWorkflowApprovalMode = 'promotion-pr' | 'environment-reviewer';
+export interface InfrastructurePlanSummaryEntryV1 {
+    authorizationDigest: string;
+    authorizationOutcome: InfrastructurePlanValidationV1['outcome'];
+    materialDigest: string;
+    planEvidenceDigest: string;
+    project: string;
+}
+export interface InfrastructurePlanSummaryV1 {
+    action: InfrastructureMutationAction;
+    approvalMode: InfrastructureWorkflowApprovalMode;
+    kind: 'ebk-infrastructure-plan-summary';
+    projects: readonly InfrastructurePlanSummaryEntryV1[];
+    schemaVersion: typeof INFRASTRUCTURE_CHANGE_SCHEMA_VERSION;
+    sourceCommit: string;
+    stage: string;
+    summaryDigest: string;
+}
+export type DriftAdapterKind = 'aws-config' | 'cloudformation' | 'service-native';
+export interface DriftAdapterCoverageV1 {
+    adapter: DriftAdapterKind;
+    propertyPaths: readonly string[];
+    readPermissions: readonly string[];
+    resourceId: string;
+    status: 'supported' | 'unsupported' | 'failed';
+    unsupportedPropertyPaths: readonly string[];
+}
+export interface DriftObservationV1 {
+    adapter: DriftAdapterKind;
+    firstObservedAt: string;
+    lastObservedAt: string;
+    likelyOwner: string;
+    propertyPath: string;
+    resourceId: string;
+    safetyImpact: 'none' | 'security' | 'protection' | 'data' | 'unknown';
+    status: 'in-sync' | 'modified' | 'deleted' | 'unknown';
+}
+export interface DriftAdapterReportV1 {
+    adapter: DriftAdapterKind;
+    coverage: readonly DriftAdapterCoverageV1[];
+    invokedRefresh: boolean;
+    mode: 'read-only';
+    observations: readonly DriftObservationV1[];
+}
+export interface InfrastructureDriftEvaluationV1 {
+    findings: readonly DriftObservationV1[];
+    status: InfrastructureDriftStatus;
+    unsupported: readonly {
+        propertyPaths: readonly string[];
+        resourceId: string;
+    }[];
+}
+export interface DriftDecisionV1 {
+    approvalRef?: string;
+    decision: 'adopt' | 'externally-owned' | 'investigate' | 'revert';
+    driftResourceId: string;
+    narrowOwnershipDeclarationRef?: string;
+    postDecisionPlanEmpty?: boolean;
+    reviewedSourceChangeRef?: string;
+    runbookRef?: string;
+}
+export interface DriftDecisionValidationV1 {
+    complete: boolean;
+    errors: readonly string[];
+    lifecycleBlocked: boolean;
+}
+export interface PostApplyCheckV1 {
+    id: string;
+    status: 'passed' | 'failed' | 'not-run';
+}
+export interface PostPlanExplanationV1 {
+    propertyPath: string;
+    resourceId: string;
+    ownershipRuleRef: string;
+}
+export type InfrastructureOperationOutcome = 'apply-complete-unverified' | 'apply-failed-no-change' | 'apply-partial' | 'cleanup-incomplete' | 'converged' | 'recovery-required';
+export interface InfrastructureConvergenceV1 {
+    converged: boolean;
+    findings: readonly string[];
+    outcome: InfrastructureOperationOutcome;
+}

package/src/infrastructure-change/model.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INFRASTRUCTURE_RISK_CLASSES = exports.INFRASTRUCTURE_OPERATIONS = exports.SST_DIFF_TOOL_VERSION = exports.SST_DIFF_TOOL_NAME = exports.INFRASTRUCTURE_PLAN_KIND = exports.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION = void 0;
+exports.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION = 1;
+exports.INFRASTRUCTURE_PLAN_KIND = 'ebk-infrastructure-plan';
+exports.SST_DIFF_TOOL_NAME = 'sst';
+exports.SST_DIFF_TOOL_VERSION = '4.17.1';
+exports.INFRASTRUCTURE_OPERATIONS = [
+    'create',
+    'update',
+    'replace',
+    'delete',
+    'import',
+    'read',
+    'unknown',
+];
+exports.INFRASTRUCTURE_RISK_CLASSES = [
+    'no-change',
+    'additive-low-risk',
+    'in-place-reviewed',
+    'stateless-replacement',
+    'stateful-or-destructive',
+    'security-expansion',
+    'protection-reduction',
+    'material-cost-or-quota',
+    'unknown',
+];
+//# sourceMappingURL=model.js.map

package/src/infrastructure-change/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../packages/nx/src/infrastructure-change/model.ts"],"names":[],"mappings":";;;AAAa,QAAA,oCAAoC,GAAG,CAAU,CAAC;AAClD,QAAA,wBAAwB,GAAG,yBAAkC,CAAC;AAC9D,QAAA,kBAAkB,GAAG,KAAc,CAAC;AACpC,QAAA,qBAAqB,GAAG,QAAiB,CAAC;AAE1C,QAAA,yBAAyB,GAAG;IACvC,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,SAAS;CACD,CAAC;AAKE,QAAA,2BAA2B,GAAG;IACzC,WAAW;IACX,mBAAmB;IACnB,mBAAmB;IACnB,uBAAuB;IACvB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,wBAAwB;IACxB,SAAS;CACD,CAAC"}

package/src/infrastructure-change/normalize.d.ts

@@ -0,0 +1,12 @@
+import { type NormalizedSstDiffV1 } from './model.js';
+/**
+ * Normalizes only the fields emitted by SST 4.17.1's renderDiffJSON:
+ * Pulumi StepEventMetadata op, urn, type, keys and detailedDiff entries.
+ * Old/new state, inputs, outputs, provider references, and physical IDs are
+ * intentionally discarded so values cannot enter an EBK report.
+ */
+export declare function normalizeSstDiffV4_17_1(input: {
+    exitCode: number;
+    stdout: string | unknown;
+    toolVersion: string;
+}): NormalizedSstDiffV1;

package/src/infrastructure-change/normalize.js

@@ -0,0 +1,245 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeSstDiffV4_17_1 = normalizeSstDiffV4_17_1;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const node_crypto_1 = require("node:crypto");
+const model_js_1 = require("./model.js");
+const PROVIDER_OPERATIONS = new Set([
+    'create',
+    'create-replacement',
+    'delete',
+    'delete-replaced',
+    'discard',
+    'discard-replaced',
+    'import',
+    'import-replacement',
+    'read',
+    'read-replacement',
+    'refresh',
+    'remove-pending-replace',
+    'replace',
+    'same',
+    'update',
+]);
+const PROPERTY_DIFF_KINDS = new Set([
+    'add',
+    'add-replace',
+    'delete',
+    'delete-replace',
+    'update',
+    'update-replace',
+]);
+const REPLACEMENT_OPERATIONS = new Set([
+    'create-replacement',
+    'delete-replaced',
+    'import-replacement',
+    'read-replacement',
+    'replace',
+]);
+const SENSITIVE_PATH_TOKENS = new Set([
+    'authorization',
+    'credential',
+    'password',
+    'secret',
+    'session',
+    'token',
+    'uri',
+    'url',
+]);
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function logicalResourceId(urn) {
+    const segments = urn.split('::');
+    const logicalName = segments.at(-1)?.trim();
+    if (logicalName) {
+        return logicalName;
+    }
+    return `resource-${(0, node_crypto_1.createHash)('sha256').update(urn).digest('hex').slice(0, 16)}`;
+}
+function isSensitivePath(path) {
+    const words = path
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter(Boolean);
+    const phrase = words.join(' ');
+    return (words.some((word) => SENSITIVE_PATH_TOKENS.has(word)) ||
+        /(?:access key|client secret|connection string|private key)/.test(phrase));
+}
+function normalizeOperation(providerOperation) {
+    switch (providerOperation) {
+        case 'create':
+            return 'create';
+        case 'update':
+            return 'update';
+        case 'delete':
+            return 'delete';
+        case 'replace':
+        case 'create-replacement':
+        case 'delete-replaced':
+        case 'read-replacement':
+        case 'import-replacement':
+            return 'replace';
+        case 'import':
+            return 'import';
+        case 'read':
+            return 'read';
+        default:
+            return 'unknown';
+    }
+}
+function normalizeProperty(path, raw) {
+    if (!isRecord(raw)) {
+        return undefined;
+    }
+    const diffKind = raw['diffKind'];
+    const inputDiff = raw['inputDiff'];
+    const sensitive = isSensitivePath(path);
+    return {
+        inputDiff: inputDiff === true,
+        kind: typeof diffKind === 'string' && PROPERTY_DIFF_KINDS.has(diffKind)
+            ? diffKind
+            : 'unknown',
+        path: sensitive ? '[REDACTED]' : path,
+        sensitive,
+    };
+}
+function failure(code, detail, sourceIndex) {
+    return {
+        code,
+        detail,
+        ...(sourceIndex === undefined ? {} : { sourceIndex }),
+    };
+}
+/**
+ * Normalizes only the fields emitted by SST 4.17.1's renderDiffJSON:
+ * Pulumi StepEventMetadata op, urn, type, keys and detailedDiff entries.
+ * Old/new state, inputs, outputs, provider references, and physical IDs are
+ * intentionally discarded so values cannot enter an EBK report.
+ */
+function normalizeSstDiffV4_17_1(input) {
+    const failures = [];
+    let raw = input.stdout;
+    if (input.toolVersion !== model_js_1.SST_DIFF_TOOL_VERSION) {
+        failures.push(failure('diff-tool-version-mismatch', `expected SST ${model_js_1.SST_DIFF_TOOL_VERSION}; received an unsupported version`));
+    }
+    if (typeof raw === 'string') {
+        try {
+            raw = JSON.parse(raw);
+        }
+        catch {
+            failures.push(failure('diff-json-invalid', 'stdout was not one JSON document'));
+            raw = [];
+        }
+    }
+    if (!Array.isArray(raw)) {
+        failures.push(failure('diff-shape-invalid', 'SST diff JSON must be an array'));
+        raw = [];
+    }
+    const entries = Array.isArray(raw) ? raw : [];
+    if (!Number.isSafeInteger(input.exitCode) || input.exitCode !== 0) {
+        failures.push(failure('diff-command-failed', 'SST diff did not complete with exit code zero'));
+    }
+    const resources = [];
+    for (const [sourceIndex, entry] of entries.entries()) {
+        if (!isRecord(entry)) {
+            failures.push(failure('diff-shape-invalid', 'resource metadata must be an object', sourceIndex));
+            continue;
+        }
+        const urn = entry['urn'];
+        const resourceType = entry['type'];
+        const providerOperation = entry['op'];
+        if (typeof urn !== 'string' ||
+            urn.length === 0 ||
+            typeof resourceType !== 'string' ||
+            resourceType.length === 0 ||
+            typeof providerOperation !== 'string') {
+            failures.push(failure('diff-shape-invalid', 'resource metadata requires string urn, type, and op fields', sourceIndex));
+            continue;
+        }
+        if (!PROVIDER_OPERATIONS.has(providerOperation) ||
+            providerOperation === 'same' ||
+            normalizeOperation(providerOperation) === 'unknown') {
+            failures.push(failure('diff-unknown-operation', 'resource operation is not a supported SST 4.17.1 diff action', sourceIndex));
+        }
+        const detailedDiff = entry['detailedDiff'];
+        const changedProperties = [];
+        if (detailedDiff !== null) {
+            if (!isRecord(detailedDiff)) {
+                failures.push(failure('diff-shape-invalid', 'detailedDiff must be an object or null', sourceIndex));
+            }
+            else {
+                for (const [path, rawProperty] of Object.entries(detailedDiff).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))) {
+                    const property = normalizeProperty(path, rawProperty);
+                    if (property === undefined) {
+                        failures.push(failure('diff-shape-invalid', 'detailedDiff values must be objects', sourceIndex));
+                        continue;
+                    }
+                    if (property.kind === 'unknown') {
+                        failures.push(failure('diff-shape-invalid', 'property diff kind is not supported by SST 4.17.1', sourceIndex));
+                    }
+                    if (!isRecord(rawProperty) ||
+                        typeof rawProperty['inputDiff'] !== 'boolean') {
+                        failures.push(failure('diff-shape-invalid', 'property inputDiff must be a boolean', sourceIndex));
+                    }
+                    changedProperties.push(property);
+                }
+            }
+        }
+        const keys = entry['keys'];
+        const hasReplacementKeys = Array.isArray(keys) &&
+            keys.length > 0 &&
+            keys.every((key) => typeof key === 'string');
+        const replacement = REPLACEMENT_OPERATIONS.has(providerOperation) ||
+            hasReplacementKeys ||
+            changedProperties.some((property) => property.kind.endsWith('-replace'));
+        resources.push({
+            changedProperties,
+            logicalId: logicalResourceId(urn),
+            operation: normalizeOperation(providerOperation),
+            providerOperation,
+            replacement,
+            replacementStrategy: 'unknown',
+            resourceType,
+            sourceIndex,
+        });
+    }
+    const replacementSequences = new Map();
+    for (const resource of resources) {
+        const key = `${resource.logicalId}\u0000${resource.resourceType}`;
+        const sequence = replacementSequences.get(key) ?? [];
+        sequence.push(resource.providerOperation);
+        replacementSequences.set(key, sequence);
+    }
+    for (const resource of resources) {
+        if (!resource.replacement)
+            continue;
+        const sequence = replacementSequences.get(`${resource.logicalId}\u0000${resource.resourceType}`) ?? [];
+        const createIndex = sequence.indexOf('create-replacement');
+        const deleteIndex = sequence.indexOf('delete-replaced');
+        if (createIndex >= 0 && deleteIndex >= 0) {
+            resource.replacementStrategy =
+                createIndex < deleteIndex
+                    ? 'create-before-delete'
+                    : 'delete-before-create';
+        }
+    }
+    return {
+        complete: failures.length === 0,
+        diagnosticCoverage: 'exit-status-only',
+        failures,
+        kind: 'ebk-sst-diff',
+        resources: resources.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+            (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType) ||
+            left.sourceIndex - right.sourceIndex),
+        schemaVersion: model_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION,
+        sourceBoundary: 'desired-source-vs-recorded-state',
+        stateIdentityCoverage: 'not-emitted-by-diff-json',
+        tool: {
+            name: model_js_1.SST_DIFF_TOOL_NAME,
+            version: model_js_1.SST_DIFF_TOOL_VERSION,
+        },
+    };
+}
+//# sourceMappingURL=normalize.js.map

package/src/infrastructure-change/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../../../packages/nx/src/infrastructure-change/normalize.ts"],"names":[],"mappings":";;AAqJA,0DAsMC;AA3VD,sEAAyD;AACzD,6CAAyC;AACzC,yCASoB;AAEpB,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ;IACR,oBAAoB;IACpB,QAAQ;IACR,iBAAiB;IACjB,SAAS;IACT,kBAAkB;IAClB,QAAQ;IACR,oBAAoB;IACpB,MAAM;IACN,kBAAkB;IAClB,SAAS;IACT,wBAAwB;IACxB,SAAS;IACT,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,aAAa;IACb,QAAQ;IACR,gBAAgB;IAChB,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,kBAAkB;IAClB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,eAAe;IACf,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,SAAS;IACT,OAAO;IACP,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,YAAY,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,4DAA4D,CAAC,IAAI,CAAC,MAAM,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,iBAAyB;IAEzB,QAAQ,iBAAiB,EAAE,CAAC;QAC1B,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS,CAAC;QACf,KAAK,oBAAoB,CAAC;QAC1B,KAAK,iBAAiB,CAAC;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB;YACvB,OAAO,SAAS,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,GAAY;IAEZ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO;QACL,SAAS,EAAE,SAAS,KAAK,IAAI;QAC7B,IAAI,EACF,OAAO,QAAQ,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/D,CAAC,CAAE,QAAoD;YACvD,CAAC,CAAC,SAAS;QACf,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QACrC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,IAA8B,EAC9B,MAAc,EACd,WAAoB;IAEpB,OAAO;QACL,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAIvC;IACC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,GAAG,GAAY,KAAK,CAAC,MAAM,CAAC;IAChC,IAAI,KAAK,CAAC,WAAW,KAAK,gCAAqB,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,4BAA4B,EAC5B,gBAAgB,gCAAqB,mCAAmC,CACzE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CACjE,CAAC;YACF,GAAG,GAAG,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAChE,CAAC;QACF,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAuB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,qBAAqB,EACrB,+CAA+C,CAChD,CACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAyC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,qCAAqC,EACrC,WAAW,CACZ,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,CAAC,MAAM,KAAK,CAAC;YAChB,OAAO,YAAY,KAAK,QAAQ;YAChC,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,OAAO,iBAAiB,KAAK,QAAQ,EACrC,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,4DAA4D,EAC5D,WAAW,CACZ,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IACE,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC3C,iBAAiB,KAAK,MAAM;YAC5B,kBAAkB,CAAC,iBAAiB,CAAC,KAAK,SAAS,EACnD,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,wBAAwB,EACxB,8DAA8D,EAC9D,WAAW,CACZ,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,iBAAiB,GAAsC,EAAE,CAAC;QAChE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,wCAAwC,EACxC,WAAW,CACZ,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CACjE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAC/C,EAAE,CAAC;oBACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;oBACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,qCAAqC,EACrC,WAAW,CACZ,CACF,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,mDAAmD,EACnD,WAAW,CACZ,CACF,CAAC;oBACJ,CAAC;oBACD,IACE,CAAC,QAAQ,CAAC,WAAW,CAAC;wBACtB,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,SAAS,EAC7C,CAAC;wBACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,sCAAsC,EACtC,WAAW,CACZ,CACF,CAAC;oBACJ,CAAC;oBACD,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,kBAAkB,GACtB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,IAAI,CAAC,MAAM,GAAG,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC;QAC/C,MAAM,WAAW,GACf,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC7C,kBAAkB;YAClB,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3E,SAAS,CAAC,IAAI,CAAC;YACb,iBAAiB;YACjB,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACjC,SAAS,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;YAChD,iBAAiB;YACjB,WAAW;YACX,mBAAmB,EAAE,SAAS;YAC9B,YAAY;YACZ,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,YAAY,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC1C,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,WAAW;YAAE,SAAS;QACpC,MAAM,QAAQ,GACZ,oBAAoB,CAAC,GAAG,CACtB,GAAG,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,YAAY,EAAE,CACtD,IAAI,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACxD,IAAI,WAAW,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,mBAAmB;gBAC1B,WAAW,GAAG,WAAW;oBACvB,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,sBAAsB,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,kBAAkB,EAAE,kBAAkB;QACtC,QAAQ;QACR,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,SAAS,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAA,qCAAY,EAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;YAC7C,IAAA,qCAAY,EAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC;YACnD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CACvC;QACD,aAAa,EAAE,+CAAoC;QACnD,cAAc,EAAE,kCAAkC;QAClD,qBAAqB,EAAE,0BAA0B;QACjD,IAAI,EAAE;YACJ,IAAI,EAAE,6BAAkB;YACxB,OAAO,EAAE,gCAAqB;SAC/B;KACF,CAAC;AACJ,CAAC"}

package/src/infrastructure-change/plan.d.ts

@@ -0,0 +1,40 @@
+import { type InfrastructureApprovalRecordV1, type InfrastructurePlanV1, type InfrastructurePlanValidationV1, type InfrastructureRiskAssessmentV1, type InfrastructureStateIdentityV1, type InfrastructurePlanTargetV1, type NormalizedSstDiffV1, type InfrastructureDriftStatus, type InfrastructureMutationAction } from './model.js';
+export interface CreateInfrastructurePlanInputV1 {
+    action?: InfrastructureMutationAction;
+    configurationMetadataDigest: string;
+    diff: NormalizedSstDiffV1;
+    driftEvidenceDigest: string;
+    driftEvidenceExpiresAt: string;
+    driftEvidenceGeneratedAt: string;
+    driftStatus: InfrastructureDriftStatus;
+    expiresAt: string;
+    frameworkVersion: string;
+    generatedAt: string;
+    policyProfileDigest: string;
+    projects: readonly string[];
+    repository: string;
+    risk: InfrastructureRiskAssessmentV1;
+    sourceCommit: string;
+    state: InfrastructureStateIdentityV1;
+    target: InfrastructurePlanTargetV1;
+    versions: Readonly<Record<string, string>>;
+}
+/**
+ * Hashes the material plan contract. generatedAt, expiresAt, repository,
+ * sourceCommit, and approval-record contents are intentionally excluded and
+ * validated independently immediately before apply.
+ */
+export declare function computeMaterialPlanDigest(plan: Omit<InfrastructurePlanV1, 'materialDigest'> | InfrastructurePlanV1): string;
+export declare function createInfrastructurePlan(input: CreateInfrastructurePlanInputV1): InfrastructurePlanV1;
+/**
+ * Validates a freshly recomputed plan. The saved plan is evidence only: apply
+ * consumes the recomputed plan after material, source, expiry, state, and
+ * approval checks all pass.
+ */
+export declare function validateInfrastructurePlanForApply(input: {
+    approval?: InfrastructureApprovalRecordV1;
+    now: string;
+    planned: InfrastructurePlanV1;
+    recomputed: InfrastructurePlanV1;
+    sourceChangesSincePlan: readonly string[];
+}): InfrastructurePlanValidationV1;