@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/git-policy/routing.d.ts

@@ -1,15 +1,21 @@
 export type GitPolicyEventName = 'pull_request' | 'push' | 'workflow_dispatch';
+export type GitPolicyDeliveryLane = 'protected-pair' | 'trunk';
 export interface GitPolicyRequest {
     baseIsAncestorOfHead?: boolean;
     baseRef?: string;
+    /** trunk protects main alone: feature pull requests target main and every
+     * main push is a production delivery. Defaults to the protected pair. */
+    deliveryLane?: GitPolicyDeliveryLane;
     eventName: GitPolicyEventName;
+    headRepository?: string;
     headRef?: string;
     mainIsAncestorOfDevelop?: boolean;
     ref?: string;
+    repository?: string;
 }
 export interface GitPolicyDecision {
     allowed: boolean;
     reasons: string[];
-    route?: 'feature-to-develop' | 'develop-to-main' | 'main-to-develop' | 'protected-push' | 'protected-verification';
+    route?: 'feature-to-develop' | 'feature-to-main' | 'develop-to-main' | 'main-to-develop' | 'protected-push' | 'protected-verification';
 }
 export declare function evaluateGitPolicy(request: GitPolicyRequest): GitPolicyDecision;

package/src/git-policy/routing.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.evaluateGitPolicy = evaluateGitPolicy;
 function evaluateGitPolicy(request) {
+    if (request.deliveryLane === 'trunk') {
+        return evaluateTrunkGitPolicy(request);
+    }
     const reasons = [];
     let route;
     if (request.eventName === 'push') {
@@ -33,6 +36,9 @@ function evaluateGitPolicy(request) {
     else if (request.eventName === 'pull_request') {
         const base = request.baseRef;
         const head = request.headRef;
+        const sameRepository = request.headRepository !== undefined &&
+            request.repository !== undefined &&
+            request.headRepository === request.repository;
         if (!base || !head) {
             reasons.push('Pull-request base and head metadata are required.');
         }
@@ -43,13 +49,21 @@ function evaluateGitPolicy(request) {
             if (head !== 'develop') {
                 reasons.push('Only develop may open a production promotion to main.');
             }
+            else if (!sameRepository) {
+                reasons.push('Production promotion must originate from develop in the current repository.');
+            }
             else {
                 route = 'develop-to-main';
             }
         }
         else if (base === 'develop') {
             if (head === 'main') {
-                route = 'main-to-develop';
+                if (!sameRepository) {
+                    reasons.push('Protected sync must originate from main in the current repository.');
+                }
+                else {
+                    route = 'main-to-develop';
+                }
             }
             else if (head === 'develop') {
                 reasons.push('Develop cannot open a pull request to itself.');
@@ -74,4 +88,51 @@ function evaluateGitPolicy(request) {
         ...(route ? { route } : {}),
     };
 }
+/** Trunk lane: main is the only protected branch. Feature pull requests
+ * target main from an up-to-date branch; a main push is a production
+ * delivery; develop is not a protected route. */
+function evaluateTrunkGitPolicy(request) {
+    const reasons = [];
+    let route;
+    if (request.eventName === 'push') {
+        if (request.ref !== 'refs/heads/main') {
+            reasons.push('Trunk delivery pushes must target main.');
+        }
+        else {
+            route = 'protected-push';
+        }
+    }
+    else if (request.eventName === 'workflow_dispatch') {
+        if (request.ref !== 'refs/heads/main') {
+            reasons.push('Trunk delivery manual verification must run from main.');
+        }
+        else {
+            route = 'protected-verification';
+        }
+    }
+    else if (request.eventName === 'pull_request') {
+        const base = request.baseRef;
+        const head = request.headRef;
+        if (!base || !head) {
+            reasons.push('Pull-request base and head metadata are required.');
+        }
+        else if (base !== 'main') {
+            reasons.push('Trunk delivery pull requests must target main.');
+        }
+        else if (head === 'main') {
+            reasons.push('A protected branch cannot open a pull request to itself.');
+        }
+        else {
+            route = 'feature-to-main';
+        }
+        if (route && request.baseIsAncestorOfHead !== true) {
+            reasons.push(`The ${base ?? 'base'} branch is not an ancestor of the proposed ${head ?? 'head'} commit. Refresh the branch without rewriting main.`);
+        }
+    }
+    return {
+        allowed: reasons.length === 0,
+        reasons,
+        ...(route ? { route } : {}),
+    };
+}
 //# sourceMappingURL=routing.js.map

package/src/index.d.ts

@@ -8,3 +8,4 @@ export * from './repository-policy/index.js';
 export * from './supply-chain/index.js';
 export * from './validation.js';
 export * from './work-markers/index.js';
+export * from './workspace-deployment/index.js';

package/src/index.js

@@ -11,4 +11,5 @@ tslib_1.__exportStar(require("./repository-policy/index.js"), exports);
 tslib_1.__exportStar(require("./supply-chain/index.js"), exports);
 tslib_1.__exportStar(require("./validation.js"), exports);
 tslib_1.__exportStar(require("./work-markers/index.js"), exports);
+tslib_1.__exportStar(require("./workspace-deployment/index.js"), exports);
 //# sourceMappingURL=index.js.map

package/src/infrastructure-change/local-capability.d.ts

@@ -0,0 +1,73 @@
+import type { InfrastructureMutationAction, InfrastructurePlanV1 } from './model.js';
+export declare const LOCAL_MUTATION_CAPABILITY_LIFETIME_MS: number;
+export interface LocalMutationAuthorityEnvelopeV1 {
+    accountFingerprint: string;
+    action: Extract<InfrastructureMutationAction, 'deploy' | 'refresh'>;
+    actorArnDigest: string;
+    configurationMetadataDigest: string;
+    deploymentSourceCommit: string;
+    deploymentSourceTree: string;
+    deploymentProfile: 'starter' | 'production-isolated' | 'fully-isolated';
+    expectedRoleArnDigest: string;
+    frameworkVersion: string;
+    planAuthorityPolicyDigest: string;
+    planMaterialDigest: string;
+    policyProfileDigest: string;
+    project: string;
+    region: string;
+    releaseSourceCommit: string;
+    releaseSourceTree: string;
+    stage: 'development' | 'staging' | 'production';
+    state: {
+        backend: string;
+        digest: string;
+        locked: false;
+        stack: string;
+        version: string;
+    };
+    versions: Readonly<Record<string, string>>;
+}
+export interface LocalMutationCapabilityV1 {
+    authority: LocalMutationAuthorityEnvelopeV1;
+    authorityDigest: string;
+    authorizationDigest: string;
+    expiresAt: string;
+    issuedAt: string;
+    kind: 'ebk-local-mutation-capability';
+    nonceDigest: string;
+    planEvidenceDigest: string;
+    schemaVersion: 1;
+}
+export declare function localMutationAuthorityEnvelope(input: {
+    actorArn: string;
+    deploymentProfile: 'starter' | 'production-isolated' | 'fully-isolated';
+    deploymentSourceCommit: string;
+    deploymentSourceTree: string;
+    expectedRoleArn: string;
+    plan: InfrastructurePlanV1;
+    project: string;
+    releaseSourceTree: string;
+}): LocalMutationAuthorityEnvelopeV1;
+export declare function createLocalMutationCapability(input: {
+    actorArn: string;
+    authorizationContents: string;
+    deploymentProfile: 'starter' | 'production-isolated' | 'fully-isolated';
+    deploymentSourceCommit: string;
+    deploymentSourceTree: string;
+    expectedRoleArn: string;
+    issuedAt: Date;
+    nonce: string;
+    plan: InfrastructurePlanV1;
+    planContents: string;
+    project: string;
+    releaseSourceTree: string;
+}): LocalMutationCapabilityV1;
+export declare function computeLocalMutationAuthorityDigest(authority: LocalMutationAuthorityEnvelopeV1): string;
+export declare function validateLocalMutationCapability(input: {
+    authorizationContents: string;
+    capability: LocalMutationCapabilityV1;
+    expectedAuthority: LocalMutationAuthorityEnvelopeV1;
+    nonce: string;
+    now: Date;
+    planContents: string;
+}): void;

package/src/infrastructure-change/local-capability.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCAL_MUTATION_CAPABILITY_LIFETIME_MS = void 0;
+exports.localMutationAuthorityEnvelope = localMutationAuthorityEnvelope;
+exports.createLocalMutationCapability = createLocalMutationCapability;
+exports.computeLocalMutationAuthorityDigest = computeLocalMutationAuthorityDigest;
+exports.validateLocalMutationCapability = validateLocalMutationCapability;
+const canonical_json_1 = require("@empire-builder-kit/runtime/canonical-json");
+const SHA = /^[a-f0-9]{40}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
+const ACTOR = /^arn:(aws|aws-us-gov|aws-cn):sts::\d{12}:assumed-role\/[A-Za-z0-9+=,.@_-]{1,128}\/[A-Za-z0-9+=,.@_-]{1,128}$/;
+exports.LOCAL_MUTATION_CAPABILITY_LIFETIME_MS = 10 * 60_000;
+function sha256(value) {
+    return (0, canonical_json_1.canonicalJsonSha256)(value, { omitUndefinedObjectValues: true });
+}
+function localMutationAuthorityEnvelope(input) {
+    const { plan } = input;
+    const planAuthorityPolicyDigest = plan.versions['plan-authority-policy'];
+    if ((plan.action !== 'deploy' && plan.action !== 'refresh') ||
+        plan.projects.length !== 1 ||
+        plan.projects[0] !== input.project ||
+        !input.project ||
+        !ACTOR.test(input.actorArn) ||
+        !SHA.test(plan.sourceCommit) ||
+        !SHA.test(input.deploymentSourceCommit) ||
+        !SHA.test(input.deploymentSourceTree) ||
+        !SHA.test(input.releaseSourceTree) ||
+        !ROLE.test(input.expectedRoleArn) ||
+        !SHA256.test(plan.materialDigest) ||
+        !SHA256.test(plan.configurationMetadataDigest) ||
+        !SHA256.test(plan.policyProfileDigest) ||
+        !SHA256.test(plan.state.digest) ||
+        plan.state.locked !== false ||
+        !planAuthorityPolicyDigest ||
+        !SHA256.test(planAuthorityPolicyDigest)) {
+        throw new Error('Local mutation authority requires one exact source, project, policy, artifact, role, and state envelope.');
+    }
+    if (plan.target.stage !== 'development' &&
+        plan.target.stage !== 'staging' &&
+        plan.target.stage !== 'production') {
+        throw new Error('Local mutation authority requires one canonical stage.');
+    }
+    return {
+        accountFingerprint: plan.target.accountFingerprint,
+        action: plan.action,
+        actorArnDigest: sha256(input.actorArn),
+        configurationMetadataDigest: plan.configurationMetadataDigest,
+        deploymentSourceCommit: input.deploymentSourceCommit,
+        deploymentSourceTree: input.deploymentSourceTree,
+        deploymentProfile: input.deploymentProfile,
+        expectedRoleArnDigest: sha256(input.expectedRoleArn),
+        frameworkVersion: plan.frameworkVersion,
+        planAuthorityPolicyDigest,
+        planMaterialDigest: plan.materialDigest,
+        policyProfileDigest: plan.policyProfileDigest,
+        project: input.project,
+        region: plan.target.region,
+        releaseSourceCommit: plan.sourceCommit,
+        releaseSourceTree: input.releaseSourceTree,
+        stage: plan.target.stage,
+        state: {
+            backend: plan.state.backend,
+            digest: plan.state.digest,
+            locked: false,
+            stack: plan.state.stack,
+            version: plan.state.version,
+        },
+        versions: { ...plan.versions },
+    };
+}
+function createLocalMutationCapability(input) {
+    if (!input.nonce || input.nonce.length < 32) {
+        throw new Error('Local mutation capability nonce is absent or too short.');
+    }
+    const authority = localMutationAuthorityEnvelope(input);
+    const issuedAt = input.issuedAt.toISOString();
+    const expiresAt = new Date(input.issuedAt.getTime() + exports.LOCAL_MUTATION_CAPABILITY_LIFETIME_MS).toISOString();
+    return {
+        authority,
+        authorityDigest: sha256(authority),
+        authorizationDigest: sha256(input.authorizationContents),
+        expiresAt,
+        issuedAt,
+        kind: 'ebk-local-mutation-capability',
+        nonceDigest: sha256(input.nonce),
+        planEvidenceDigest: sha256(input.planContents),
+        schemaVersion: 1,
+    };
+}
+function computeLocalMutationAuthorityDigest(authority) {
+    return sha256(authority);
+}
+function validateLocalMutationCapability(input) {
+    const issuedAt = Date.parse(input.capability.issuedAt);
+    const expiresAt = Date.parse(input.capability.expiresAt);
+    const now = input.now.getTime();
+    if (input.capability.kind !== 'ebk-local-mutation-capability' ||
+        input.capability.schemaVersion !== 1 ||
+        !Number.isFinite(issuedAt) ||
+        !Number.isFinite(expiresAt) ||
+        issuedAt > now ||
+        expiresAt <= now ||
+        expiresAt - issuedAt !== exports.LOCAL_MUTATION_CAPABILITY_LIFETIME_MS ||
+        input.capability.nonceDigest !== sha256(input.nonce) ||
+        input.capability.planEvidenceDigest !== sha256(input.planContents) ||
+        input.capability.authorizationDigest !==
+            sha256(input.authorizationContents) ||
+        input.capability.authorityDigest !== sha256(input.capability.authority) ||
+        input.capability.authorityDigest !== sha256(input.expectedAuthority)) {
+        throw new Error('Local mutation capability is malformed, expired, replayed, or no longer bound to retained evidence.');
+    }
+}
+//# sourceMappingURL=local-capability.js.map

package/src/infrastructure-change/model.d.ts

@@ -2,7 +2,7 @@ export declare const INFRASTRUCTURE_CHANGE_SCHEMA_VERSION: 1;
 export declare const INFRASTRUCTURE_PLAN_KIND: "ebk-infrastructure-plan";
 export declare const SST_DIFF_TOOL_NAME: "sst";
 export declare const SST_DIFF_TOOL_VERSION: "4.17.1";
-export declare const INFRASTRUCTURE_OPERATIONS: readonly ["create", "update", "replace", "delete", "import", "read", "unknown"];
+export declare const INFRASTRUCTURE_OPERATIONS: readonly ["create", "update", "replace", "delete", "discard", "import", "read", "unknown"];
 export type InfrastructureOperation = (typeof INFRASTRUCTURE_OPERATIONS)[number];
 export declare const INFRASTRUCTURE_RISK_CLASSES: readonly ["no-change", "additive-low-risk", "in-place-reviewed", "stateless-replacement", "stateful-or-destructive", "security-expansion", "protection-reduction", "material-cost-or-quota", "unknown"];
 export type InfrastructureRiskClass = (typeof INFRASTRUCTURE_RISK_CLASSES)[number];
@@ -76,11 +76,23 @@ export interface IamAccessAnalyzerValidationV1 {
     status: 'complete' | 'failed' | 'unsupported';
 }
 export interface InfrastructureRiskPolicyV1 {
+    /**
+     * Exact provider imports whose ownership transition is already bound to a
+     * committed authority, deterministic private identifier, retain behavior,
+     * and recovery runbook. Every other import remains blocked.
+     */
+    adoptedImports: readonly AdoptedInfrastructureImportV1[];
     /**
      * Exact provider types whose create operation has been reviewed as a
      * private, stateless, low-cost addition.
      */
     additiveLowRiskTypes: readonly string[];
+    /**
+     * Exact provider types whose create operation is expected but still
+     * requires a digest-bound deployment review. Undeclared additions remain
+     * unknown and fail closed.
+     */
+    additiveReviewedTypes: readonly string[];
     /**
      * Exact provider types that can materially change cost or consume quotas.
      */
@@ -91,6 +103,14 @@ export interface InfrastructureRiskPolicyV1 {
      */
     statefulTypes: readonly string[];
 }
+export interface AdoptedInfrastructureImportV1 {
+    authority: 'workload-role-account-baseline';
+    logicalId: string;
+    privateIdentifierTemplate: string;
+    recoveryRunbookRef: string;
+    removalBehavior: 'retain';
+    resourceType: string;
+}
 export type InfrastructureDriftStatus = 'not-checked' | 'no-drift' | 'drift-detected' | 'partial-coverage' | 'unsupported' | 'failed';
 export type InfrastructureMutationAction = 'deploy' | 'refresh' | 'remove';
 export interface InfrastructurePlanTargetV1 {
@@ -145,11 +165,11 @@ export interface InfrastructureApprovalRecordV1 {
     evidenceRefs: Readonly<Record<string, string>>;
     expiresAt: string;
     materialDigest: string;
-    mode: 'standing-policy' | 'human-record' | 'environment-reviewer';
+    mode: 'standing-policy' | 'human-record' | 'environment-reviewer' | 'operator-acknowledgement';
     recordPath?: string;
     stage: string;
 }
-export type InfrastructurePlanValidationCode = 'approval-invalid' | 'approval-missing' | 'diff-incomplete' | 'drift-unresolved' | 'material-plan-changed' | 'plan-expired' | 'plan-schema-invalid' | 'plan-tool-version-invalid' | 'source-change-invalid' | 'state-lock-unverified' | 'state-locked' | 'unknown-risk';
+export type InfrastructurePlanValidationCode = 'approval-invalid' | 'approval-missing' | 'authority-envelope-changed' | 'approval-required-change' | 'diff-incomplete' | 'drift-unresolved' | 'material-plan-changed' | 'plan-expired' | 'plan-schema-invalid' | 'plan-tool-version-invalid' | 'source-change-invalid' | 'state-lock-unverified' | 'state-locked' | 'unknown-risk';
 export interface InfrastructurePlanValidationFindingV1 {
     code: InfrastructurePlanValidationCode;
     detail: string;
@@ -164,6 +184,7 @@ export interface InfrastructureAuthorizationEvidenceV1 {
     approval?: InfrastructureApprovalRecordV1;
     governanceEvidenceDigests?: Readonly<Record<string, string>>;
     kind: 'ebk-infrastructure-authorization';
+    localGovernance?: unknown;
     plannedMaterialDigest: string;
     recomputedMaterialDigest: string;
     schemaVersion: typeof INFRASTRUCTURE_CHANGE_SCHEMA_VERSION;
@@ -245,7 +266,7 @@ export interface PostPlanExplanationV1 {
     resourceId: string;
     ownershipRuleRef: string;
 }
-export type InfrastructureOperationOutcome = 'apply-complete-unverified' | 'apply-failed-no-change' | 'apply-partial' | 'cleanup-incomplete' | 'converged' | 'recovery-required';
+export type InfrastructureOperationOutcome = 'apply-complete-unverified' | 'refresh-complete-replan-required' | 'apply-failed-no-change' | 'apply-partial' | 'cleanup-incomplete' | 'converged' | 'recovery-required';
 export interface InfrastructureConvergenceV1 {
     converged: boolean;
     findings: readonly string[];

package/src/infrastructure-change/model.js

@@ -10,6 +10,7 @@ exports.INFRASTRUCTURE_OPERATIONS = [
     'update',
     'replace',
     'delete',
+    'discard',
     'import',
     'read',
     'unknown',

package/src/infrastructure-change/normalize.d.ts

@@ -6,7 +6,11 @@ import { type NormalizedSstDiffV1 } from './model.js';
  * intentionally discarded so values cannot enter an EBK report.
  */
 export declare function normalizeSstDiffV4_17_1(input: {
+    errorCode?: string | null;
     exitCode: number;
+    signal?: string | null;
+    spawnError?: boolean;
+    stderr?: string;
     stdout: string | unknown;
     toolVersion: string;
 }): NormalizedSstDiffV1;

package/src/infrastructure-change/normalize.js

@@ -32,6 +32,7 @@ const PROPERTY_DIFF_KINDS = new Set([
 const REPLACEMENT_OPERATIONS = new Set([
     'create-replacement',
     'delete-replaced',
+    'discard-replaced',
     'import-replacement',
     'read-replacement',
     'replace',
@@ -75,9 +76,12 @@ function normalizeOperation(providerOperation) {
             return 'update';
         case 'delete':
             return 'delete';
+        case 'discard':
+            return 'discard';
         case 'replace':
         case 'create-replacement':
         case 'delete-replaced':
+        case 'discard-replaced':
         case 'read-replacement':
         case 'import-replacement':
             return 'replace';
@@ -89,6 +93,34 @@ function normalizeOperation(providerOperation) {
             return 'unknown';
     }
 }
+function compareNormalizedResources(left, right) {
+    return ((0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.operation, right.operation) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.providerOperation, right.providerOperation) ||
+        Number(left.replacement) - Number(right.replacement) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.replacementStrategy, right.replacementStrategy) ||
+        (0, deterministic_order_js_1.compareUtf16)(JSON.stringify(left.changedProperties), JSON.stringify(right.changedProperties)) ||
+        left.sourceIndex - right.sourceIndex);
+}
+function externalResourceLogicalId(entry, providerOperation, resourceType) {
+    const state = providerOperation === 'discard' || providerOperation === 'discard-replaced'
+        ? entry['old']
+        : providerOperation === 'read' || providerOperation === 'read-replacement'
+            ? entry['new']
+            : undefined;
+    if (!isRecord(state))
+        return undefined;
+    const id = state['id'];
+    if (typeof id !== 'string' || id.length === 0)
+        return undefined;
+    return `external-${(0, node_crypto_1.createHash)('sha256')
+        .update(resourceType)
+        .update('\0')
+        .update(id)
+        .digest('hex')
+        .slice(0, 24)}`;
+}
 function normalizeProperty(path, raw) {
     if (!isRecord(raw)) {
         return undefined;
@@ -138,9 +170,6 @@ function normalizeSstDiffV4_17_1(input) {
         raw = [];
     }
     const entries = Array.isArray(raw) ? raw : [];
-    if (!Number.isSafeInteger(input.exitCode) || input.exitCode !== 0) {
-        failures.push(failure('diff-command-failed', 'SST diff did not complete with exit code zero'));
-    }
     const resources = [];
     for (const [sourceIndex, entry] of entries.entries()) {
         if (!isRecord(entry)) {
@@ -188,15 +217,25 @@ function normalizeSstDiffV4_17_1(input) {
             }
         }
         const keys = entry['keys'];
+        if (keys !== undefined &&
+            keys !== null &&
+            (!Array.isArray(keys) || !keys.every((key) => typeof key === 'string'))) {
+            failures.push(failure('diff-shape-invalid', 'replacement keys must be an array of strings when present', sourceIndex));
+        }
         const hasReplacementKeys = Array.isArray(keys) &&
             keys.length > 0 &&
             keys.every((key) => typeof key === 'string');
         const replacement = REPLACEMENT_OPERATIONS.has(providerOperation) ||
             hasReplacementKeys ||
             changedProperties.some((property) => property.kind.endsWith('-replace'));
+        const externalLogicalId = externalResourceLogicalId(entry, providerOperation, resourceType);
+        if (['discard', 'discard-replaced', 'read', 'read-replacement'].includes(providerOperation) &&
+            externalLogicalId === undefined) {
+            failures.push(failure('diff-shape-invalid', 'external resource operations require one exact physical identifier', sourceIndex));
+        }
         resources.push({
             changedProperties,
-            logicalId: logicalResourceId(urn),
+            logicalId: externalLogicalId ?? logicalResourceId(urn),
             operation: normalizeOperation(providerOperation),
             providerOperation,
             replacement,
@@ -225,14 +264,15 @@ function normalizeSstDiffV4_17_1(input) {
                     : 'delete-before-create';
         }
     }
+    if (!Number.isSafeInteger(input.exitCode) || input.exitCode !== 0) {
+        failures.push(failure('diff-command-failed', 'SST diff did not produce an authorized complete command outcome'));
+    }
     return {
         complete: failures.length === 0,
         diagnosticCoverage: 'exit-status-only',
         failures,
         kind: 'ebk-sst-diff',
-        resources: resources.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
-            (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType) ||
-            left.sourceIndex - right.sourceIndex),
+        resources: resources.sort(compareNormalizedResources),
         schemaVersion: model_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION,
         sourceBoundary: 'desired-source-vs-recorded-state',
         stateIdentityCoverage: 'not-emitted-by-diff-json',

package/src/infrastructure-change/plan.d.ts

@@ -20,9 +20,21 @@ export interface CreateInfrastructurePlanInputV1 {
     versions: Readonly<Record<string, string>>;
 }
 /**
- * Hashes the material plan contract. generatedAt, expiresAt, repository,
- * sourceCommit, and approval-record contents are intentionally excluded and
- * validated independently immediately before apply.
+ * Returns the value-free resource projection used by plan and drift digests.
+ * SST's BucketFiles dynamic provider reports rebuilt file arrays by ephemeral
+ * list index. The committed source and release-candidate authorities bind the
+ * bytes; the plan binds the mutation kind without turning array scheduling
+ * into a new approval identity. Every unrecognized path remains exact.
+ *
+ * @internal
+ */
+export declare function materialNormalizedSstDiffResources(diff: NormalizedSstDiffV1): readonly unknown[];
+/**
+ * Hashes the material plan contract. Diagnostic source positions, observation
+ * timestamps, generatedAt, expiresAt, repository, sourceCommit, and
+ * approval-record contents are intentionally excluded. Freshness, repository,
+ * source, and approval authority are validated independently immediately
+ * before apply.
  */
 export declare function computeMaterialPlanDigest(plan: Omit<InfrastructurePlanV1, 'materialDigest'> | InfrastructurePlanV1): string;
 export declare function createInfrastructurePlan(input: CreateInfrastructurePlanInputV1): InfrastructurePlanV1;
@@ -38,3 +50,18 @@ export declare function validateInfrastructurePlanForApply(input: {
     recomputed: InfrastructurePlanV1;
     sourceChangesSincePlan: readonly string[];
 }): InfrastructurePlanValidationV1;
+/**
+ * Validates a fresh protected-workflow plan against source-bound deployment
+ * authority. The retained provider preview remains review evidence, but
+ * provider observations are not treated as a replayable transaction. Every
+ * approval-required resource and operation in the fresh plan must have been
+ * present in the reviewed plan.
+ */
+export declare function validateInfrastructurePlanForProtectedApply(input: {
+    approval?: InfrastructureApprovalRecordV1;
+    environmentReviewerApproved?: boolean;
+    now: string;
+    planned: InfrastructurePlanV1;
+    recomputed: InfrastructurePlanV1;
+    sourceChangesSincePlan: readonly string[];
+}): InfrastructurePlanValidationV1;