@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/infrastructure-change/plan.js

@@ -0,0 +1,361 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeMaterialPlanDigest = computeMaterialPlanDigest;
+exports.createInfrastructurePlan = createInfrastructurePlan;
+exports.validateInfrastructurePlanForApply = validateInfrastructurePlanForApply;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const canonical_json_1 = require("@empire-builder-kit/runtime/canonical-json");
+const model_js_1 = require("./model.js");
+const SOURCE_COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+function requireNonEmpty(label, value) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new TypeError(`${label} must be a non-empty string.`);
+    }
+}
+function validateCreationInput(input) {
+    const generatedAt = Date.parse(input.generatedAt);
+    const expiresAt = Date.parse(input.expiresAt);
+    const driftGeneratedAt = Date.parse(input.driftEvidenceGeneratedAt);
+    const driftExpiresAt = Date.parse(input.driftEvidenceExpiresAt);
+    const stateObservedAt = Date.parse(input.state.observedAt);
+    const stateExpiresAt = Date.parse(input.state.expiresAt);
+    if (!Number.isFinite(generatedAt) ||
+        !Number.isFinite(expiresAt) ||
+        expiresAt <= generatedAt) {
+        throw new TypeError('Infrastructure plan expiry must be after its generated time.');
+    }
+    if (!Number.isFinite(driftGeneratedAt) ||
+        !Number.isFinite(driftExpiresAt) ||
+        driftGeneratedAt > generatedAt ||
+        driftExpiresAt <= generatedAt ||
+        expiresAt > driftExpiresAt) {
+        throw new TypeError('Drift evidence must be current for the complete infrastructure plan lifetime.');
+    }
+    if (!Number.isFinite(stateObservedAt) ||
+        !Number.isFinite(stateExpiresAt) ||
+        stateObservedAt > generatedAt ||
+        stateExpiresAt <= generatedAt ||
+        expiresAt > stateExpiresAt) {
+        throw new TypeError('State identity must be current for the complete infrastructure plan lifetime.');
+    }
+    if (!/^[a-f0-9]{64}$/.test(input.driftEvidenceDigest)) {
+        throw new TypeError('driftEvidenceDigest must be a lowercase SHA-256 digest.');
+    }
+    if (!SOURCE_COMMIT.test(input.sourceCommit)) {
+        throw new TypeError('sourceCommit must be a full lowercase Git object identifier.');
+    }
+    if (input.diff.kind !== 'ebk-sst-diff' ||
+        input.diff.schemaVersion !== model_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION ||
+        input.diff.tool.name !== model_js_1.SST_DIFF_TOOL_NAME ||
+        input.diff.tool.version !== model_js_1.SST_DIFF_TOOL_VERSION ||
+        input.diff.sourceBoundary !== 'desired-source-vs-recorded-state') {
+        throw new TypeError(`Infrastructure plan diff must be the SST ${model_js_1.SST_DIFF_TOOL_VERSION} v1 contract.`);
+    }
+    for (const [label, value] of [
+        ['configurationMetadataDigest', input.configurationMetadataDigest],
+        ['driftEvidenceDigest', input.driftEvidenceDigest],
+        ['frameworkVersion', input.frameworkVersion],
+        ['policyProfileDigest', input.policyProfileDigest],
+        ['repository', input.repository],
+        ['sourceCommit', input.sourceCommit],
+        ['state.backend', input.state.backend],
+        ['state.digest', input.state.digest],
+        ['state.expiresAt', input.state.expiresAt],
+        ['state.observedAt', input.state.observedAt],
+        ['state.stack', input.state.stack],
+        ['state.version', input.state.version],
+        ['target.accountFingerprint', input.target.accountFingerprint],
+        ['target.region', input.target.region],
+        ['target.stage', input.target.stage],
+    ]) {
+        requireNonEmpty(label, value);
+    }
+    if (input.projects.length === 0 ||
+        new Set(input.projects).size !== input.projects.length ||
+        input.projects.some((project) => project.trim().length === 0)) {
+        throw new TypeError('projects must contain unique non-empty project names.');
+    }
+    if (!input.diff.complete && input.risk.aggregate !== 'unknown') {
+        throw new TypeError('An incomplete diff must have aggregate unknown risk.');
+    }
+}
+function sortedFindings(findings) {
+    return [...findings].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.resourceId ?? '', right.resourceId ?? '') ||
+        (0, deterministic_order_js_1.compareUtf16)(left.propertyPath ?? '', right.propertyPath ?? '') ||
+        (0, deterministic_order_js_1.compareUtf16)(left.code, right.code) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.class, right.class));
+}
+function planMaterial(plan) {
+    return {
+        action: plan.action,
+        aggregateRisk: plan.aggregateRisk,
+        configurationMetadataDigest: plan.configurationMetadataDigest,
+        diff: plan.diff,
+        driftEvidenceDigest: plan.driftEvidenceDigest,
+        driftEvidenceExpiresAt: plan.driftEvidenceExpiresAt,
+        driftEvidenceGeneratedAt: plan.driftEvidenceGeneratedAt,
+        driftStatus: plan.driftStatus,
+        frameworkVersion: plan.frameworkVersion,
+        kind: plan.kind,
+        policyProfileDigest: plan.policyProfileDigest,
+        projects: plan.projects,
+        requiredApprovals: plan.requiredApprovals,
+        resourceFindings: plan.resourceFindings,
+        schemaVersion: plan.schemaVersion,
+        state: plan.state,
+        target: plan.target,
+        tool: plan.tool,
+        versions: plan.versions,
+    };
+}
+/**
+ * Hashes the material plan contract. generatedAt, expiresAt, repository,
+ * sourceCommit, and approval-record contents are intentionally excluded and
+ * validated independently immediately before apply.
+ */
+function computeMaterialPlanDigest(plan) {
+    return (0, canonical_json_1.canonicalJsonSha256)(planMaterial(plan), {
+        omitUndefinedObjectValues: true,
+    });
+}
+function createInfrastructurePlan(input) {
+    validateCreationInput(input);
+    const withoutDigest = {
+        action: input.action ?? 'deploy',
+        aggregateRisk: input.risk.aggregate,
+        configurationMetadataDigest: input.configurationMetadataDigest,
+        diff: input.diff,
+        driftEvidenceDigest: input.driftEvidenceDigest,
+        driftEvidenceExpiresAt: input.driftEvidenceExpiresAt,
+        driftEvidenceGeneratedAt: input.driftEvidenceGeneratedAt,
+        driftStatus: input.driftStatus,
+        expiresAt: input.expiresAt,
+        frameworkVersion: input.frameworkVersion,
+        generatedAt: input.generatedAt,
+        kind: model_js_1.INFRASTRUCTURE_PLAN_KIND,
+        policyProfileDigest: input.policyProfileDigest,
+        projects: [...input.projects],
+        repository: input.repository,
+        requiredApprovals: [...input.risk.requiredApprovals].sort(),
+        resourceFindings: sortedFindings(input.risk.findings),
+        schemaVersion: model_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION,
+        sourceCommit: input.sourceCommit,
+        state: { ...input.state },
+        target: { ...input.target },
+        tool: {
+            name: model_js_1.SST_DIFF_TOOL_NAME,
+            version: model_js_1.SST_DIFF_TOOL_VERSION,
+        },
+        versions: Object.fromEntries(Object.entries(input.versions).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))),
+    };
+    return {
+        ...withoutDigest,
+        materialDigest: computeMaterialPlanDigest(withoutDigest),
+    };
+}
+function validDate(value) {
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp) ? timestamp : undefined;
+}
+function approvalFindings(plan, approval, now, plannedGeneratedAt) {
+    if (approval === undefined) {
+        return [
+            {
+                code: 'approval-missing',
+                detail: 'The material plan requires a digest-bound decision record.',
+            },
+        ];
+    }
+    const findings = [];
+    const approvedAt = validDate(approval.approvedAt);
+    const approvalExpiry = validDate(approval.expiresAt);
+    const generatedAt = validDate(plannedGeneratedAt);
+    if (approval.materialDigest !== plan.materialDigest ||
+        approval.stage !== plan.target.stage ||
+        approvedAt === undefined ||
+        approvedAt > now ||
+        generatedAt === undefined ||
+        approvedAt < generatedAt ||
+        approvalExpiry === undefined ||
+        approvalExpiry <= now) {
+        findings.push({
+            code: 'approval-invalid',
+            detail: 'Approval identity, stage, time, or expiry is invalid.',
+        });
+    }
+    if (plan.requiredApprovals.length === 0) {
+        if (approval.mode !== 'standing-policy') {
+            findings.push({
+                code: 'approval-invalid',
+                detail: 'No-change and additive plans require a standing-policy decision.',
+            });
+        }
+    }
+    else if (approval.mode === 'standing-policy' ||
+        approval.author === approval.approver ||
+        !approval.codeownerReviewed) {
+        findings.push({
+            code: 'approval-invalid',
+            detail: 'Additional approval requires a non-author CODEOWNER-reviewed decision.',
+        });
+    }
+    for (const requirement of plan.requiredApprovals) {
+        if (!approval.evidenceRefs[requirement]?.trim()) {
+            findings.push({
+                code: 'approval-invalid',
+                detail: `Approval is missing evidence for ${requirement}.`,
+            });
+        }
+    }
+    if (plan.requiredApprovals.includes('point-of-no-return') &&
+        !approval.acknowledgement?.trim()) {
+        findings.push({
+            code: 'approval-invalid',
+            detail: 'The destructive point of no return was not acknowledged.',
+        });
+    }
+    return findings;
+}
+/**
+ * Validates a freshly recomputed plan. The saved plan is evidence only: apply
+ * consumes the recomputed plan after material, source, expiry, state, and
+ * approval checks all pass.
+ */
+function validateInfrastructurePlanForApply(input) {
+    const findings = [];
+    const now = validDate(input.now);
+    if (now === undefined) {
+        throw new TypeError('now must be an ISO date-time.');
+    }
+    for (const [label, plan] of [
+        ['planned', input.planned],
+        ['recomputed', input.recomputed],
+    ]) {
+        if (plan.kind !== model_js_1.INFRASTRUCTURE_PLAN_KIND ||
+            plan.schemaVersion !== model_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION) {
+            findings.push({
+                code: 'plan-schema-invalid',
+                detail: `${label} plan is not an infrastructure plan v1.`,
+            });
+        }
+        if (!SOURCE_COMMIT.test(plan.sourceCommit)) {
+            findings.push({
+                code: 'source-change-invalid',
+                detail: `${label} plan source commit is not a full Git object identifier.`,
+            });
+        }
+        if (plan.tool.name !== model_js_1.SST_DIFF_TOOL_NAME ||
+            plan.tool.version !== model_js_1.SST_DIFF_TOOL_VERSION) {
+            findings.push({
+                code: 'plan-tool-version-invalid',
+                detail: `${label} plan was not produced by SST ${model_js_1.SST_DIFF_TOOL_VERSION}.`,
+            });
+        }
+        if (computeMaterialPlanDigest(plan) !== plan.materialDigest) {
+            findings.push({
+                code: 'material-plan-changed',
+                detail: `${label} plan digest does not match its material contents.`,
+            });
+        }
+        if (!plan.diff.complete) {
+            findings.push({
+                code: 'diff-incomplete',
+                detail: `${label} plan contains an incomplete cloud-backed diff.`,
+            });
+        }
+    }
+    if (input.planned.materialDigest !== input.recomputed.materialDigest) {
+        findings.push({
+            code: 'material-plan-changed',
+            detail: 'The recomputed material plan differs from the reviewed plan.',
+        });
+    }
+    if (input.planned.repository !== input.recomputed.repository) {
+        findings.push({
+            code: 'source-change-invalid',
+            detail: 'The recomputed plan targets a different repository.',
+        });
+    }
+    const planExpiry = validDate(input.planned.expiresAt);
+    if (planExpiry === undefined || planExpiry <= now) {
+        findings.push({
+            code: 'plan-expired',
+            detail: 'The reviewed plan has expired.',
+        });
+    }
+    if (input.recomputed.state.locked === true) {
+        findings.push({
+            code: 'state-locked',
+            detail: 'The target state is locked.',
+        });
+    }
+    else if (input.recomputed.state.locked === 'unknown') {
+        findings.push({
+            code: 'state-lock-unverified',
+            detail: 'The read-only observer could not prove that the target state is unlocked.',
+        });
+    }
+    if (input.recomputed.aggregateRisk === 'unknown') {
+        findings.push({
+            code: 'unknown-risk',
+            detail: 'Unknown infrastructure risk blocks apply.',
+        });
+    }
+    const driftPermitted = input.recomputed.action === 'refresh'
+        ? input.recomputed.driftStatus === 'no-drift' ||
+            input.recomputed.driftStatus === 'drift-detected'
+        : input.recomputed.driftStatus === 'no-drift';
+    if (!driftPermitted) {
+        findings.push({
+            code: 'drift-unresolved',
+            detail: input.recomputed.action === 'refresh'
+                ? 'Protected refresh requires bounded no-drift or exact drift-detected evidence plus its approval record.'
+                : 'Protected apply requires a bounded read-only no-drift result.',
+        });
+    }
+    const recordPath = input.approval?.recordPath;
+    const allowedSourceChanges = input.approval !== undefined &&
+        input.approval.mode === 'human-record' &&
+        recordPath !== undefined &&
+        input.planned.sourceCommit !== input.recomputed.sourceCommit
+        ? [recordPath]
+        : [];
+    const actualSourceChanges = [...new Set(input.sourceChangesSincePlan)].sort();
+    if (input.planned.sourceCommit !== input.recomputed.sourceCommit &&
+        actualSourceChanges.length === 0) {
+        findings.push({
+            code: 'source-change-invalid',
+            detail: 'Source commit changed without a declared path delta.',
+        });
+    }
+    if (actualSourceChanges.length !== allowedSourceChanges.length ||
+        actualSourceChanges.some((path, index) => path !== [...allowedSourceChanges].sort()[index])) {
+        findings.push({
+            code: 'source-change-invalid',
+            detail: 'Source changed beyond the exact approval-record file after planning.',
+        });
+    }
+    findings.push(...approvalFindings(input.recomputed, input.approval, now, input.planned.generatedAt));
+    const codes = new Set(findings.map(({ code }) => code));
+    const outcome = codes.has('state-locked')
+        ? 'state-locked'
+        : codes.has('state-lock-unverified')
+            ? 'state-lock-unverified'
+            : [...codes].some((code) => [
+                'material-plan-changed',
+                'plan-expired',
+                'plan-schema-invalid',
+                'plan-tool-version-invalid',
+                'source-change-invalid',
+            ].includes(code))
+                ? 'plan-stale'
+                : findings.length > 0
+                    ? 'plan-risk-blocked'
+                    : 'plan-clean';
+    return {
+        allowed: findings.length === 0,
+        findings,
+        outcome,
+    };
+}
+//# sourceMappingURL=plan.js.map

package/src/infrastructure-change/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../../../packages/nx/src/infrastructure-change/plan.ts"],"names":[],"mappings":";;AAuLA,8DAMC;AAED,4DAwCC;AAoFD,gFAsKC;AAjeD,sEAAyD;AACzD,+EAAiF;AACjF,yCAeoB;AAEpB,MAAM,aAAa,GAAG,iCAAiC,CAAC;AAuBxD,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAsC;IACnE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,SAAS,IAAI,WAAW,EACxB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,gBAAgB,GAAG,WAAW;QAC9B,cAAc,IAAI,WAAW;QAC7B,SAAS,GAAG,cAAc,EAC1B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,eAAe,GAAG,WAAW;QAC7B,cAAc,IAAI,WAAW;QAC7B,SAAS,GAAG,cAAc,EAC1B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CACjB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc;QAClC,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,+CAAoC;QACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,6BAAkB;QAC3C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,gCAAqB;QACjD,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,kCAAkC,EAChE,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,4CAA4C,gCAAqB,eAAe,CACjF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,6BAA6B,EAAE,KAAK,CAAC,2BAA2B,CAAC;QAClE,CAAC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CAAC;QAClD,CAAC,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,CAAC;QAC5C,CAAC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CAAC;QAClD,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC;QACpC,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,CAAC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC1C,CAAC,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5C,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,CAAC,2BAA2B,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC9D,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QACtC,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;KAC5B,EAAE,CAAC;QACX,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC3B,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;QACtD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7D,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,QAAoD;IAEpD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAA,qCAAY,EAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3D,IAAA,qCAAY,EAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;QAC/D,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QACnC,IAAA,qCAAY,EAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAkD;IAElD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;QACvD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CACvC,IAAyE;IAEzE,OAAO,IAAA,oCAAmB,EAAC,YAAY,CAAC,IAAI,CAAC,EAAE;QAC7C,yBAAyB,EAAE,IAAI;KAChC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAsC;IAEtC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,aAAa,GAAiD;QAClE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ;QAChC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;QACnC,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,mCAAwB;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE;QAC3D,gBAAgB,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrD,aAAa,EAAE,+CAAoC;QACnD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE;QAC3B,IAAI,EAAE;YACJ,IAAI,EAAE,6BAAkB;YACxB,OAAO,EAAE,gCAAqB;SAC/B;QACD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CACtD,IAAA,qCAAY,EAAC,IAAI,EAAE,KAAK,CAAC,CAC1B,CACF;KACF,CAAC;IACF,OAAO;QACL,GAAG,aAAa;QAChB,cAAc,EAAE,yBAAyB,CAAC,aAAa,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CACvB,IAA0B,EAC1B,QAAoD,EACpD,GAAW,EACX,kBAA0B;IAE1B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL;gBACE,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,4DAA4D;aACrE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA4C,EAAE,CAAC;IAC7D,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,IACE,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;QAC/C,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK;QACpC,UAAU,KAAK,SAAS;QACxB,UAAU,GAAG,GAAG;QAChB,WAAW,KAAK,SAAS;QACzB,UAAU,GAAG,WAAW;QACxB,cAAc,KAAK,SAAS;QAC5B,cAAc,IAAI,GAAG,EACrB,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,uDAAuD;SAChE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EACJ,kEAAkE;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IACL,QAAQ,CAAC,IAAI,KAAK,iBAAiB;QACnC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ;QACrC,CAAC,QAAQ,CAAC,iBAAiB,EAC3B,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,MAAM,EACJ,wEAAwE;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,oCAAoC,WAAW,GAAG;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IACE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACrD,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,EAAE,EACjC,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,0DAA0D;SACnE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAgB,kCAAkC,CAAC,KAMlD;IACC,MAAM,QAAQ,GAA4C,EAAE,CAAC;IAC7D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI;QAC1B,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC;KACxB,EAAE,CAAC;QACX,IACE,IAAI,CAAC,IAAI,KAAK,mCAAwB;YACtC,IAAI,CAAC,aAAa,KAAK,+CAAoC,EAC3D,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,GAAG,KAAK,yCAAyC;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,GAAG,KAAK,0DAA0D;aAC3E,CAAC,CAAC;QACL,CAAC;QACD,IACE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,6BAAkB;YACrC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,gCAAqB,EAC3C,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,2BAA2B;gBACjC,MAAM,EAAE,GAAG,KAAK,iCAAiC,gCAAqB,GAAG;aAC1E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,GAAG,KAAK,oDAAoD;aACrE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG,KAAK,iDAAiD;aAClE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,8DAA8D;SACvE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,qDAAqD;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,gCAAgC;SACzC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EACJ,2EAA2E;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,2CAA2C;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAClB,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS;QACnC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,KAAK,UAAU;YAC3C,KAAK,CAAC,UAAU,CAAC,WAAW,KAAK,gBAAgB;QACnD,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,KAAK,UAAU,CAAC;IAClD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,MAAM,EACJ,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS;gBACnC,CAAC,CAAC,wGAAwG;gBAC1G,CAAC,CAAC,+DAA+D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9C,MAAM,oBAAoB,GACxB,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,cAAc;QACtC,UAAU,KAAK,SAAS;QACxB,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,UAAU,CAAC,YAAY;QAC1D,CAAC,CAAC,CAAC,UAAU,CAAC;QACd,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,IACE,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,UAAU,CAAC,YAAY;QAC5D,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,sDAAsD;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,IACE,mBAAmB,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM;QAC1D,mBAAmB,CAAC,IAAI,CACtB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAClE,EACD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EACJ,sEAAsE;SACzE,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,IAAI,CACX,GAAG,gBAAgB,CACjB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,QAAQ,EACd,GAAG,EACH,KAAK,CAAC,OAAO,CAAC,WAAW,CAC1B,CACF,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;QACvC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAClC,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACrB;gBACE,uBAAuB;gBACvB,cAAc;gBACd,qBAAqB;gBACrB,2BAA2B;gBAC3B,uBAAuB;aACxB,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjB;gBACH,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;oBACnB,CAAC,CAAC,mBAAmB;oBACrB,CAAC,CAAC,YAAY,CAAC;IACvB,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC9B,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}

package/src/infrastructure-change/risk.d.ts

@@ -0,0 +1,7 @@
+import type { IamAccessAnalyzerValidationV1, InfrastructurePolicySignalV1, InfrastructureRiskAssessmentV1, InfrastructureRiskPolicyV1, NormalizedSstDiffV1 } from './model.js';
+export declare function classifyInfrastructureRisk(input: {
+    diff: NormalizedSstDiffV1;
+    iamValidations?: readonly IamAccessAnalyzerValidationV1[];
+    policy: InfrastructureRiskPolicyV1;
+    policySignals?: readonly InfrastructurePolicySignalV1[];
+}): InfrastructureRiskAssessmentV1;

package/src/infrastructure-change/risk.js

@@ -0,0 +1,269 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyInfrastructureRisk = classifyInfrastructureRisk;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const RISK_PRECEDENCE = {
+    'no-change': 0,
+    'additive-low-risk': 1,
+    'in-place-reviewed': 2,
+    'stateless-replacement': 3,
+    'material-cost-or-quota': 4,
+    'stateful-or-destructive': 5,
+    'security-expansion': 6,
+    'protection-reduction': 7,
+    unknown: 8,
+};
+const DISPOSITIONS = {
+    'no-change': 'allow-standing-policy',
+    'additive-low-risk': 'allow-standing-policy',
+    'in-place-reviewed': 'review',
+    'stateless-replacement': 'review',
+    'stateful-or-destructive': 'block',
+    'security-expansion': 'review',
+    'protection-reduction': 'block',
+    'material-cost-or-quota': 'review',
+    unknown: 'block',
+};
+const SENSITIVE_POLICY_PATH = /(?:iam|policy|principal|trust|assumeRole|public|ingress|egress|cidr|deletionProtection|retain|retention|backup|encrypt|kms|keyPolicy|objectLock|versioning|waf)/i;
+const COST_POLICY_PATH = /(?:desiredCount|instance|natGateway|provisionedConcurrency|retentionInDays|schedule|capacity|throughput|quota)/i;
+function finding(riskClass, code, message, resource, propertyPath) {
+    return {
+        class: riskClass,
+        code,
+        disposition: DISPOSITIONS[riskClass],
+        message,
+        ...(propertyPath === undefined ? {} : { propertyPath }),
+        ...(resource === undefined ? {} : { resourceId: resource.logicalId }),
+    };
+}
+function policySignalMessage(riskClass) {
+    switch (riskClass) {
+        case 'security-expansion':
+            return 'Synthesized source reports a security expansion.';
+        case 'protection-reduction':
+            return 'Synthesized source reports a protection reduction.';
+        case 'material-cost-or-quota':
+            return 'Synthesized source reports a material cost or quota change.';
+        case 'unknown':
+            return 'Synthesized source reports an unclassified material change.';
+    }
+}
+function riskForResource(resource, policy) {
+    if (resource.operation === 'unknown') {
+        return [
+            finding('unknown', 'provider-operation-unknown', 'The provider action cannot be classified safely.', resource),
+        ];
+    }
+    if (resource.changedProperties.some(({ kind }) => kind === 'unknown')) {
+        return [
+            finding('unknown', 'property-diff-unknown', 'At least one changed property has an unsupported diff kind.', resource),
+        ];
+    }
+    if ((resource.operation === 'replace' || resource.operation === 'delete') &&
+        policy.statefulTypes.includes(resource.resourceType)) {
+        return [
+            finding('stateful-or-destructive', 'stateful-delete-or-replacement', 'A durable resource is deleted or replaced.', resource),
+        ];
+    }
+    if (resource.operation === 'delete' || resource.operation === 'import') {
+        return [
+            finding('stateful-or-destructive', resource.operation === 'delete' ? 'resource-delete' : 'resource-import', 'Deletion and import require an explicit ownership and recovery path.', resource),
+        ];
+    }
+    if (resource.resourceType.startsWith('aws:iam/')) {
+        const policyBearing = [
+            'aws:iam/policy:Policy',
+            'aws:iam/role:Role',
+            'aws:iam/rolePolicy:RolePolicy',
+        ].includes(resource.resourceType);
+        return [
+            finding('security-expansion', policyBearing
+                ? 'iam-policy-document-change'
+                : 'iam-non-policy-resource-change', policyBearing
+                ? 'A proposed IAM policy or trust document requires explicit security review.'
+                : 'A non-policy IAM resource change is not applicable to Access Analyzer but still requires explicit security review.', resource),
+            ...(resource.operation === 'replace'
+                ? [
+                    finding('stateless-replacement', 'iam-resource-replacement', 'IAM replacement requires exact recovery and cutover review.', resource),
+                ]
+                : []),
+        ];
+    }
+    if (resource.operation === 'replace') {
+        if (resource.replacementStrategy === 'unknown') {
+            return [
+                finding('unknown', 'replacement-strategy-unknown', 'Replacement ordering is unknown; cutover and rollback cannot be reviewed safely.', resource),
+            ];
+        }
+        return [
+            finding('stateless-replacement', 'stateless-replacement', 'A resource replacement requires rollout and recovery review.', resource),
+        ];
+    }
+    const propertyFindings = resource.changedProperties.flatMap((property) => {
+        if (property.sensitive) {
+            return [
+                finding('unknown', 'sensitive-property-change', 'A sensitive property changed; its value remains redacted.', resource, property.path),
+            ];
+        }
+        if (SENSITIVE_POLICY_PATH.test(property.path)) {
+            return [
+                finding('unknown', 'policy-direction-unproven', 'A security or protection property changed, but the value-free diff cannot prove its direction.', resource, property.path),
+            ];
+        }
+        if (COST_POLICY_PATH.test(property.path)) {
+            return [
+                finding('material-cost-or-quota', 'cost-or-quota-shape-change', 'A property that can affect cost or quota changed.', resource, property.path),
+            ];
+        }
+        return [];
+    });
+    if (propertyFindings.length > 0) {
+        return propertyFindings;
+    }
+    if (resource.operation === 'create' &&
+        policy.additiveLowRiskTypes.includes(resource.resourceType)) {
+        return [
+            finding('additive-low-risk', 'reviewed-low-risk-addition', 'A policy-declared private, stateless resource is added.', resource),
+        ];
+    }
+    if (policy.costOrQuotaTypes.includes(resource.resourceType) &&
+        (resource.operation === 'create' || resource.operation === 'update')) {
+        return [
+            finding('material-cost-or-quota', 'cost-or-quota-resource-change', 'The resource type can materially affect cost or quota.', resource),
+        ];
+    }
+    if (resource.operation === 'update') {
+        return [
+            finding('in-place-reviewed', 'in-place-update', 'An in-place resource update requires review and post-apply proof.', resource),
+        ];
+    }
+    if (resource.operation === 'read') {
+        return [
+            finding('in-place-reviewed', 'provider-read', 'A provider read must be verified as intentional and non-mutating.', resource),
+        ];
+    }
+    return [
+        finding('unknown', 'addition-not-policy-classified', 'The added resource type is not in the reviewed low-risk policy.', resource),
+    ];
+}
+function iamFindings(validation) {
+    if (validation.status !== 'complete') {
+        return [
+            {
+                class: 'unknown',
+                code: 'iam-validation-incomplete',
+                disposition: 'block',
+                message: 'IAM Access Analyzer validation did not complete.',
+                resourceId: validation.policyResourceId,
+            },
+        ];
+    }
+    const findings = validation.findings
+        .filter(({ findingType }) => findingType === 'error' || findingType === 'security-warning')
+        .map(({ findingType, issueCode, location }) => ({
+        class: findingType === 'security-warning' ? 'security-expansion' : 'unknown',
+        code: `iam-access-analyzer:${issueCode}`,
+        disposition: 'block',
+        message: findingType === 'security-warning'
+            ? 'IAM Access Analyzer reported a security warning.'
+            : 'IAM Access Analyzer reported an invalid or unproven policy.',
+        ...(location === undefined ? {} : { propertyPath: location }),
+        resourceId: validation.policyResourceId,
+    }));
+    if (validation.accessChange === 'expanded') {
+        findings.push({
+            class: 'security-expansion',
+            code: 'iam-access-expanded',
+            disposition: 'review',
+            message: 'IAM actions, resources, conditions, principals, or trust expanded.',
+            resourceId: validation.policyResourceId,
+        });
+    }
+    else if (validation.accessChange !== 'narrow-or-equal') {
+        findings.push({
+            class: 'unknown',
+            code: 'iam-access-change-unproven',
+            disposition: 'block',
+            message: 'IAM Access Analyzer validation did not prove access direction.',
+            resourceId: validation.policyResourceId,
+        });
+    }
+    return findings;
+}
+function classifyInfrastructureRisk(input) {
+    const findings = [];
+    if (!input.diff.complete) {
+        findings.push(finding('unknown', 'diff-incomplete', 'The cloud-backed diff is incomplete and cannot authorize apply.'));
+    }
+    for (const resource of input.diff.resources) {
+        findings.push(...riskForResource(resource, input.policy));
+    }
+    for (const signal of input.policySignals ?? []) {
+        findings.push({
+            class: signal.class,
+            code: signal.code,
+            disposition: DISPOSITIONS[signal.class],
+            message: policySignalMessage(signal.class),
+            ...(signal.propertyPath === undefined
+                ? {}
+                : { propertyPath: signal.propertyPath }),
+            resourceId: signal.resourceId,
+        });
+    }
+    for (const validation of input.iamValidations ?? []) {
+        findings.push(...iamFindings(validation));
+    }
+    const validations = input.iamValidations ?? [];
+    for (const resource of input.diff.resources.filter(({ operation, resourceType }) => operation !== 'delete' &&
+        [
+            'aws:iam/policy:Policy',
+            'aws:iam/role:Role',
+            'aws:iam/rolePolicy:RolePolicy',
+        ].includes(resourceType))) {
+        if (!validations.some(({ policyResourceId }) => policyResourceId === resource.logicalId)) {
+            findings.push(finding('unknown', 'iam-access-analyzer-evidence-missing', 'An IAM change lacks resource-bound Access Analyzer evidence.', resource));
+        }
+    }
+    const deduplicated = [
+        ...new Map(findings.map((item) => [
+            [
+                item.class,
+                item.code,
+                item.resourceId ?? '',
+                item.propertyPath ?? '',
+            ].join('\u0000'),
+            item,
+        ])).values(),
+    ].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(right.resourceId ?? '', left.resourceId ?? '') ||
+        (0, deterministic_order_js_1.compareUtf16)(right.code, left.code));
+    const aggregate = deduplicated.reduce((highest, item) => RISK_PRECEDENCE[item.class] > RISK_PRECEDENCE[highest]
+        ? item.class
+        : highest, 'no-change');
+    const requiredApprovals = new Set();
+    for (const item of deduplicated) {
+        if (item.disposition === 'review') {
+            requiredApprovals.add('deployment-review');
+        }
+        if (item.class === 'security-expansion') {
+            requiredApprovals.add('security-review');
+        }
+        if (item.class === 'stateful-or-destructive') {
+            requiredApprovals.add('data-owner-and-recovery');
+            requiredApprovals.add('point-of-no-return');
+        }
+        if (item.class === 'protection-reduction') {
+            requiredApprovals.add('protection-exception');
+        }
+        if (item.class === 'material-cost-or-quota') {
+            requiredApprovals.add('cost-and-quota-review');
+        }
+    }
+    return {
+        aggregate,
+        applyAllowed: input.diff.complete &&
+            deduplicated.every(({ disposition }) => disposition !== 'block'),
+        findings: deduplicated,
+        requiredApprovals: [...requiredApprovals].sort(),
+    };
+}
+//# sourceMappingURL=risk.js.map