@msn-control/liftoff 0.10.3 → 0.11.1

package/dist/domain/governance/activation/types.d.ts

@@ -0,0 +1,399 @@
+export declare const phaseIds: readonly ['seed-valid', 'seed-verified', 'seed-archived', 'committed', 'pushed', 'phase-0-complete', 'activation-approved', 'credential-ready', 'provider-ready', 'state-path-selected', 'existing-private-path', 'bootstrap-local', 'runner-ready', 'private-backend-proof', 'remote-import-verified', 'remote-ready', 'application-foundation', 'workflow-source-ready', 'dev-proof', 'staging-qualified', 'production-rehearsed', 'green-red-proof', 'enforcement-approved', 'rulesets-applied', 'live-readback', 'bootstrap-state-disposed'];
+export type PhaseId = typeof phaseIds[number];
+export declare const phaseStates: readonly ['pending', 'blocked', 'ready', 'approved', 'running', 'verified', 'failed', 'inapplicable', 'retained', 'disposed'];
+export type PhaseState = typeof phaseStates[number];
+export type TerminalPhaseState = Extract<PhaseState, 'approved' | 'verified' | 'failed' | 'inapplicable' | 'retained' | 'disposed'>;
+export declare const mutationClasses: readonly ['none', 'read-worktree', 'write-activation-state', 'write-evidence', 'write-openspec-seed', 'write-seed-tasks', 'write-openspec-governance', 'write-local-state', 'delete-local-state', 'write-workflows', 'write-ruleset-source', 'git-commit', 'git-push', 'github-read', 'github-write', 'github-secret-write', 'azure-read', 'azure-provider-register', 'azure-network-provision', 'azure-state-import', 'azure-resource-provision', 'github-ruleset-write'];
+export type MutationClass = typeof mutationClasses[number];
+export declare const approvalGateKinds: readonly ['none', 'repository-publish', 'activation-plan', 'credential-enrollment', 'infrastructure-cost', 'enforcement', 'destructive-disposal', 'external-blocker'];
+export type ApprovalGateKind = typeof approvalGateKinds[number];
+export declare const humanAuthorityQuestionKinds: readonly ['repository-creation-initial-commit-push', 'credential-enrollment', 'billed-infrastructure-policy-exception-cost-ceiling', 'final-enforcement', 'destructive-operation', 'external-blocker'];
+export type HumanAuthorityQuestionKind = typeof humanAuthorityQuestionKinds[number];
+export declare const invalidationInputKinds: readonly ['activation-identity', 'graph-hash', 'baseline-sha', 'project-files', 'policy', 'approval-envelope', 'credentials', 'provider-inventory', 'runner-inventory', 'remote-state', 'workflow-source', 'live-readback', 'security-evidence', 'ruleset-readback'];
+export type InvalidationInputKind = typeof invalidationInputKinds[number];
+export declare const rollbackKinds: readonly ['none', 'retain', 'reverse-to', 'dispose'];
+export type RollbackKind = typeof rollbackKinds[number];
+export interface ActivationIdentity {
+    liftoffVersion: string;
+    manifestArtifactVersion: number;
+    policyVersion: string;
+    activationContractVersion: number;
+    phaseGraphSchemaVersion: number;
+    phaseGraphHash: string;
+    activationStateSchemaVersion: number;
+    evidenceHeaderSchemaVersion: number;
+    approvalEnvelopeSchemaVersion: number;
+    supersessionSchemaVersion: number;
+    credentialPolicySchemaVersion: number;
+}
+export interface GraphVersionIdentity {
+    liftoffVersion: string;
+    policyVersion: string;
+    activationContractVersion: number;
+    phaseGraphSchemaVersion: number;
+}
+export interface PhaseDependency {
+    anyOf: readonly PhaseId[];
+    accepts: readonly TerminalPhaseState[];
+    description: string;
+}
+export type PhaseApplicability = {
+    kind: 'always';
+} | {
+    kind: 'conditional';
+    discriminator: 'state-path' | 'private-staging-dast' | 'credential-required';
+    when: string;
+    inapplicableWhen: string;
+    exclusiveWith: readonly PhaseId[];
+};
+export interface ApprovalGate {
+    kind: ApprovalGateKind;
+    required: boolean;
+    envelopeSchemaVersion: number;
+}
+export interface AllowedMutations {
+    local: readonly MutationClass[];
+    remote: readonly MutationClass[];
+}
+export type LiveReadbackProvider = 'github' | 'azure';
+export interface EvidenceRequirement {
+    schema: string;
+    required: boolean;
+    headerSchemaVersion: number;
+    liveReadbackProviders: readonly LiveReadbackProvider[];
+}
+export interface RollbackBehavior {
+    kind: RollbackKind;
+    target: PhaseId | null;
+    description: string;
+}
+export interface PhaseGraphNode {
+    id: PhaseId;
+    label: string;
+    dependencies: readonly PhaseDependency[];
+    applicability: PhaseApplicability;
+    allowedMutations: AllowedMutations;
+    evidence: EvidenceRequirement;
+    approvalGate: ApprovalGate;
+    invalidationInputs: readonly InvalidationInputKind[];
+    rollback: RollbackBehavior;
+    terminalStates: readonly TerminalPhaseState[];
+}
+export interface ManagedPhaseGraph {
+    schemaVersion: number;
+    versions: GraphVersionIdentity;
+    phases: readonly PhaseGraphNode[];
+}
+export interface EvidenceReference {
+    phaseId: PhaseId;
+    evidenceId: string;
+    headerDigest: string;
+    result: Extract<TerminalPhaseState, 'verified' | 'failed' | 'inapplicable' | 'retained' | 'disposed'>;
+}
+export interface EvidenceTransitionIdentity {
+    phaseId: PhaseId;
+    baselineSha: string;
+    inputDigest: string;
+    transitionDigest: string;
+}
+export interface PhaseExecutionState {
+    state: PhaseState;
+    updatedAt: string;
+    evidence: readonly EvidenceReference[];
+    approvals: readonly string[];
+    blockers: readonly string[];
+}
+export interface UserActivationState {
+    schemaVersion: number;
+    identity: ActivationIdentity;
+    repository: {
+        id: string;
+        name: string;
+        defaultBranch: string;
+    };
+    remoteBinding?: {
+        id: string;
+        name: string;
+        defaultBranch: string;
+        pushUrl: string;
+        verifiedAt: string;
+    };
+    activeChange: {
+        id: string;
+        kind: 'openspec' | 'spec-kit';
+    } | null;
+    applicability: {
+        statePath: 'existing-private' | 'bootstrap-local' | 'none';
+        privateStagingDast: boolean | 'unknown';
+        credentialRequired: boolean | 'unknown';
+    };
+    bootstrapState?: BootstrapStateRetention;
+    phases: Record<PhaseId, PhaseExecutionState>;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface EvidenceHeader {
+    schemaVersion: number;
+    repositoryId: string;
+    identity: ActivationIdentity;
+    phaseGraphHash: string;
+    phaseId: PhaseId;
+    phaseContractDigest: string;
+    inputDigest: string;
+    baselineSha: string;
+    transition: EvidenceTransitionIdentity;
+    producedAt: string;
+    producer: string;
+    bodyDigest: string;
+    remoteBindingDigest?: string;
+    result: Extract<TerminalPhaseState, 'verified' | 'failed' | 'inapplicable' | 'retained' | 'disposed'>;
+}
+export interface LiveReadbackProof {
+    schemaVersion: number;
+    repositoryId: string;
+    identity: ActivationIdentity;
+    phaseGraphHash: string;
+    phaseId: PhaseId;
+    baselineSha: string;
+    inputDigest: string;
+    transition: EvidenceTransitionIdentity;
+    observedAt: string;
+    provider: LiveReadbackProvider;
+    resourceType: string;
+    resourceId: string;
+    sourceDigest: string;
+    readbackDigest: string;
+    matches: boolean;
+}
+export interface PhaseEvidenceRecord {
+    evidenceId: string;
+    header: EvidenceHeader;
+    liveReadback?: readonly LiveReadbackProof[];
+    payload?: unknown;
+}
+export type TransitionAdapterId = 'local-evidence' | 'selected-spec-workflow' | 'git' | 'github' | 'azure-opentofu' | 'local-state';
+export interface TransitionOperationDestination {
+    type: 'local' | 'repository' | 'subscription' | 'environment' | 'tenant' | 'external';
+    identity: string;
+    pathParts?: readonly string[];
+    repository?: string;
+    subscriptionId?: string;
+    ref?: string;
+}
+export interface TransitionOperation {
+    adapter: TransitionAdapterId;
+    actionId: string;
+    mutationClass: MutationClass;
+    phaseId: PhaseId;
+    inputs: Record<string, unknown>;
+    destination: TransitionOperationDestination;
+    remote: boolean;
+    destructive: boolean;
+}
+export interface RollbackOperation {
+    adapter: TransitionAdapterId;
+    actionId: string;
+    mutationClass: MutationClass;
+    phaseId: PhaseId;
+    inputs: Record<string, unknown>;
+    destination: TransitionOperationDestination;
+    remote: boolean;
+    destructive: boolean;
+}
+export interface TransitionRollbackPlan {
+    phaseId: PhaseId;
+    strategy: RollbackKind;
+    target: PhaseId | null;
+    operations: readonly RollbackOperation[];
+    retained: readonly string[];
+    cleanupWarnings: readonly string[];
+}
+export interface SavedTransitionPlan {
+    schemaVersion: 1;
+    phaseId: PhaseId;
+    createdAt: string;
+    expiresAt: string;
+    identity: ActivationIdentity;
+    graphHash: string;
+    stateHash: string | null;
+    baselineDigest: string;
+    inputDigest: string;
+    transitionDigest: string;
+    planDigest: string;
+    mutationClasses: AllowedMutations;
+    operations: readonly TransitionOperation[];
+    approval: {
+        gateKind: ApprovalGateKind;
+        required: boolean;
+        evaluation: ApprovalEvaluation;
+        envelopeId: string | null;
+        envelopeHash: string | null;
+    };
+    rollbackPlan: TransitionRollbackPlan;
+    noSecrets: true;
+}
+export interface BootstrapStateRetention {
+    status: 'retained' | 'disposed';
+    remoteImportEvidenceId: string;
+    remoteImportEvidenceDigest: string;
+    retainedAt: string;
+    disposeAfter: string;
+    encryptedStatePathParts: readonly (readonly string[])[];
+    encryptionKeyPathParts: readonly (readonly string[])[];
+    disposedAt?: string;
+    deletionEvidenceId?: string;
+    incompleteCleanup?: readonly string[];
+}
+export interface GraphReconciliationPhaseMapping {
+    phaseId: PhaseId;
+    fromContractDigest: string;
+    toContractDigest: string;
+    preserveEvidence: boolean;
+}
+export interface GraphReconciliationRecord {
+    schemaVersion: number;
+    fromGraphHash: string;
+    toGraphHash: string;
+    fromIdentity: ActivationIdentity;
+    toIdentity: ActivationIdentity;
+    phaseMappings: readonly GraphReconciliationPhaseMapping[];
+    reconciledAt: string;
+    producer: string;
+}
+export interface ApprovalResourceScope {
+    type: string;
+    identity: string;
+}
+export interface ApprovalDestinationScope {
+    type: 'repository' | 'subscription' | 'environment' | 'tenant' | 'local' | 'external';
+    identity: string;
+    repository: string | null;
+    subscriptionId: string | null;
+}
+export interface ApprovalCostCeiling {
+    currency: string;
+    fixedMonthlyCents: number;
+    usageMonthlyCents: number;
+}
+export interface ApprovalEnvelope {
+    schemaVersion: number;
+    id: string;
+    phaseId: PhaseId;
+    gateKind: ApprovalGateKind;
+    identity: ActivationIdentity;
+    baselineSha: string;
+    planDigest: string;
+    resources: readonly ApprovalResourceScope[];
+    destinations: readonly ApprovalDestinationScope[];
+    permissions: readonly string[];
+    costCeiling: ApprovalCostCeiling;
+    policyExceptions: readonly string[];
+    destructiveScope: readonly string[];
+    expiresAt: string;
+    /**
+     * Approval metadata is validated and persisted for audit display, but it is
+     * deliberately excluded from the canonical approval-envelope hash so retries
+     * inside the same reviewed scope remain hash-stable.
+     */
+    approvedAt: string;
+    approver: string;
+}
+export interface RequestedTransitionPlan {
+    phaseId: PhaseId;
+    gateKind: ApprovalGateKind;
+    identity: ActivationIdentity;
+    baselineSha: string;
+    planDigest: string;
+    resources: readonly ApprovalResourceScope[];
+    destinations: readonly ApprovalDestinationScope[];
+    permissions: readonly string[];
+    costCeiling: ApprovalCostCeiling;
+    policyExceptions: readonly string[];
+    destructiveScope: readonly string[];
+}
+export interface ApprovalEvaluation {
+    phaseId: PhaseId;
+    gateKind: ApprovalGateKind;
+    questionKind: HumanAuthorityQuestionKind | null;
+    approvalRequired: boolean;
+    status: 'not-required' | 'approval-required' | 'reused' | 'expired' | 'invalidated';
+    envelopeId: string | null;
+    envelopeHash: string | null;
+    reasons: readonly string[];
+    expansionReasons: readonly string[];
+}
+export interface SupersessionRecord {
+    schemaVersion: number;
+    identity: ActivationIdentity;
+    supersededChangeId: string;
+    supersedingChangeId: string;
+    reason: string;
+    approvedAt: string;
+    approver: string;
+}
+export declare const runnerPreflightDisplayNameTemplate: '<repo>-runner-preflight-read';
+export declare const runnerPreflightSecretName: 'RUNNER_CONFIGURATION_READ_TOKEN';
+export declare const runnerPreflightPatLifetimeDays: 30;
+export declare const runnerPreflightRotationLeadDays: 7;
+export declare const runnerPreflightRepositoryPermissions: readonly ['metadata:read'];
+export declare const runnerPreflightOrganizationPermissions: readonly ['hosted-runners:read', 'network-configurations:read'];
+export type CredentialAuthKind = 'github-app' | 'fine-grained-pat';
+export type CredentialStatus = 'active' | 'expiring' | 'expired' | 'compromised';
+export interface CredentialRepositoryIdentity {
+    id: string;
+    owner: string;
+    name: string;
+    fullName: string;
+}
+export interface CredentialPermissionSet {
+    repository: readonly string[];
+    organization: readonly string[];
+}
+export interface CredentialWorkflowAllowlistEntry {
+    path: string;
+    jobs: readonly string[];
+}
+export interface GitHubAppCredentialMetadata {
+    installationId: number;
+    appSlug: string;
+    selection: 'selected-repository';
+    repositoryFullName: string;
+    permissionsVerifiedAt: string;
+    token: {
+        strategy: 'installation-token';
+        ttlSeconds: number;
+        generatedBy: 'github-app';
+    };
+}
+export interface FineGrainedPatCredentialMetadata {
+    lifetimeDays: typeof runnerPreflightPatLifetimeDays;
+    selectedRepositoryOnly: true;
+    createdBy: 'manual-masked-entry';
+}
+export interface CredentialPolicyProofMetadata {
+    verifiedAt: string;
+    readbackDigest: string;
+    readbackProvider: 'github-api' | 'adapter-fixture';
+    payloadFree: true;
+}
+export interface CredentialPolicy {
+    schemaVersion: number;
+    identity: ActivationIdentity;
+    repository: CredentialRepositoryIdentity;
+    owner: string;
+    authKind: CredentialAuthKind;
+    displayNameTemplate: typeof runnerPreflightDisplayNameTemplate;
+    displayName: string;
+    secretName: typeof runnerPreflightSecretName;
+    createdAt: string;
+    expiresAt: string;
+    rotationLeadDays: typeof runnerPreflightRotationLeadDays;
+    rotationDueAt: string;
+    permissions: CredentialPermissionSet;
+    allowedWorkflows: readonly CredentialWorkflowAllowlistEntry[];
+    nonForwarding: true;
+    status: CredentialStatus;
+    proof: CredentialPolicyProofMetadata;
+    app: GitHubAppCredentialMetadata | null;
+    pat: FineGrainedPatCredentialMetadata | null;
+}

package/dist/domain/governance/activation/types.js

@@ -0,0 +1,109 @@
+export const phaseIds = [
+    'seed-valid',
+    'seed-verified',
+    'seed-archived',
+    'committed',
+    'pushed',
+    'phase-0-complete',
+    'activation-approved',
+    'credential-ready',
+    'provider-ready',
+    'state-path-selected',
+    'existing-private-path',
+    'bootstrap-local',
+    'runner-ready',
+    'private-backend-proof',
+    'remote-import-verified',
+    'remote-ready',
+    'application-foundation',
+    'workflow-source-ready',
+    'dev-proof',
+    'staging-qualified',
+    'production-rehearsed',
+    'green-red-proof',
+    'enforcement-approved',
+    'rulesets-applied',
+    'live-readback',
+    'bootstrap-state-disposed'
+];
+export const phaseStates = [
+    'pending',
+    'blocked',
+    'ready',
+    'approved',
+    'running',
+    'verified',
+    'failed',
+    'inapplicable',
+    'retained',
+    'disposed'
+];
+export const mutationClasses = [
+    'none',
+    'read-worktree',
+    'write-activation-state',
+    'write-evidence',
+    'write-openspec-seed',
+    'write-seed-tasks',
+    'write-openspec-governance',
+    'write-local-state',
+    'delete-local-state',
+    'write-workflows',
+    'write-ruleset-source',
+    'git-commit',
+    'git-push',
+    'github-read',
+    'github-write',
+    'github-secret-write',
+    'azure-read',
+    'azure-provider-register',
+    'azure-network-provision',
+    'azure-state-import',
+    'azure-resource-provision',
+    'github-ruleset-write'
+];
+export const approvalGateKinds = [
+    'none',
+    'repository-publish',
+    'activation-plan',
+    'credential-enrollment',
+    'infrastructure-cost',
+    'enforcement',
+    'destructive-disposal',
+    'external-blocker'
+];
+export const humanAuthorityQuestionKinds = [
+    'repository-creation-initial-commit-push',
+    'credential-enrollment',
+    'billed-infrastructure-policy-exception-cost-ceiling',
+    'final-enforcement',
+    'destructive-operation',
+    'external-blocker'
+];
+export const invalidationInputKinds = [
+    'activation-identity',
+    'graph-hash',
+    'baseline-sha',
+    'project-files',
+    'policy',
+    'approval-envelope',
+    'credentials',
+    'provider-inventory',
+    'runner-inventory',
+    'remote-state',
+    'workflow-source',
+    'live-readback',
+    'security-evidence',
+    'ruleset-readback'
+];
+export const rollbackKinds = ['none', 'retain', 'reverse-to', 'dispose'];
+export const runnerPreflightDisplayNameTemplate = '<repo>-runner-preflight-read';
+export const runnerPreflightSecretName = 'RUNNER_CONFIGURATION_READ_TOKEN';
+export const runnerPreflightPatLifetimeDays = 30;
+export const runnerPreflightRotationLeadDays = 7;
+export const runnerPreflightRepositoryPermissions = ['metadata:read'];
+export const runnerPreflightOrganizationPermissions = [
+    'hosted-runners:read',
+    'network-configurations:read'
+];
+//# sourceMappingURL=types.js.map

package/dist/domain/governance/activation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/domain/governance/activation/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,YAAY;IACZ,eAAe;IACf,eAAe;IACf,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,qBAAqB;IACrB,kBAAkB;IAClB,gBAAgB;IAChB,qBAAqB;IACrB,uBAAuB;IACvB,iBAAiB;IACjB,cAAc;IACd,uBAAuB;IACvB,wBAAwB;IACxB,cAAc;IACd,wBAAwB;IACxB,uBAAuB;IACvB,WAAW;IACX,mBAAmB;IACnB,sBAAsB;IACtB,iBAAiB;IACjB,sBAAsB;IACtB,kBAAkB;IAClB,eAAe;IACf,0BAA0B;CAClB,CAAC;AAIX,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,SAAS;IACT,SAAS;IACT,OAAO;IACP,UAAU;IACV,SAAS;IACT,UAAU;IACV,QAAQ;IACR,cAAc;IACd,UAAU;IACV,UAAU;CACF,CAAC;AAQX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,MAAM;IACN,eAAe;IACf,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,kBAAkB;IAClB,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,iBAAiB;IACjB,sBAAsB;IACtB,YAAY;IACZ,UAAU;IACV,aAAa;IACb,cAAc;IACd,qBAAqB;IACrB,YAAY;IACZ,yBAAyB;IACzB,yBAAyB;IACzB,oBAAoB;IACpB,0BAA0B;IAC1B,sBAAsB;CACd,CAAC;AAIX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,oBAAoB;IACpB,iBAAiB;IACjB,uBAAuB;IACvB,qBAAqB;IACrB,aAAa;IACb,sBAAsB;IACtB,kBAAkB;CACV,CAAC;AAIX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,yCAAyC;IACzC,uBAAuB;IACvB,qDAAqD;IACrD,mBAAmB;IACnB,uBAAuB;IACvB,kBAAkB;CACV,CAAC;AAIX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,qBAAqB;IACrB,YAAY;IACZ,cAAc;IACd,eAAe;IACf,QAAQ;IACR,mBAAmB;IACnB,aAAa;IACb,oBAAoB;IACpB,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,mBAAmB;IACnB,kBAAkB;CACV,CAAC;AAIX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAU,CAAC;AAyWlF,MAAM,CAAC,MAAM,kCAAkC,GAAG,8BAAuC,CAAC;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,iCAA0C,CAAC;AACpF,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAW,CAAC;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAU,CAAC;AAC1D,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,eAAe,CAAU,CAAC;AAC/E,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,qBAAqB;IACrB,6BAA6B;CACrB,CAAC"}

package/dist/domain/governance/activation/validators.d.ts

@@ -0,0 +1,22 @@
+import { type CurrentActivationIdentity, type ReadableActivationIdentity } from '../policy/identity.js';
+import type { ActivationIdentity, ApprovalEnvelope, CredentialPolicy, EvidenceHeader, GraphReconciliationRecord, LiveReadbackProof, ManagedPhaseGraph, SavedTransitionPlan, SupersessionRecord, UserActivationState } from './types.js';
+import type { LiftoffManifest } from '../../project/contracts.js';
+export declare function validateActivationIdentity(value: unknown): CurrentActivationIdentity;
+/** Manifest readability is not execution compatibility; historical vectors are never retagged. */
+export declare function validateReadableActivationIdentity(value: unknown): ReadableActivationIdentity;
+export declare function validateManifestActivationForExecution(manifest: Pick<LiftoffManifest, 'governance'>): void;
+export declare function validateManagedPhaseGraph(value: unknown): ManagedPhaseGraph;
+export declare function assertCanonicalGraphValid(): void;
+export declare function validateUserActivationState(value: unknown): UserActivationState;
+export declare function validateEvidenceHeader(value: unknown): EvidenceHeader;
+export declare function validateLiveReadbackProof(value: unknown): LiveReadbackProof;
+export declare function validateApprovalEnvelope(value: unknown, options?: {
+    expectedIdentity?: ActivationIdentity;
+    now?: Date;
+    requireUnexpired?: boolean;
+}): ApprovalEnvelope;
+export declare function validateSavedTransitionPlan(value: unknown): SavedTransitionPlan;
+export declare function validateSupersessionRecord(value: unknown): SupersessionRecord;
+export declare function validateGraphReconciliationRecord(value: unknown, recognizedGraphHashes?: ReadonlySet<string>): GraphReconciliationRecord;
+export declare function validateCredentialPolicy(value: unknown): CredentialPolicy;
+export declare function validFixtureIdentity(): ActivationIdentity;