@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/application/update/approval.d.ts

@@ -0,0 +1,39 @@
+import type { Readable } from 'node:stream';
+export interface UpdateApprovalRequest {
+    fingerprint: string;
+    approvePlan?: string;
+}
+export type UpdateApprovalPrompt = (config: {
+    message: string;
+    default: false;
+}, context: {
+    input: Readable;
+    output: NodeJS.WritableStream;
+}) => Promise<boolean>;
+export interface UpdateApprovalContext {
+    stdin?: Readable;
+    stderr: NodeJS.WritableStream;
+    approveUpdatePlan?: UpdateApprovalPrompt;
+}
+export type UpdateApprovalResult = {
+    status: 'approved';
+    fingerprint: string;
+    method: 'fingerprint' | 'interactive';
+} | {
+    status: 'required';
+    fingerprint: string;
+} | {
+    status: 'declined';
+    fingerprint: string;
+    reason: 'declined' | 'cancelled';
+} | {
+    status: 'mismatch';
+    fingerprint: string;
+    requestedFingerprint: string;
+};
+export declare class InvalidUpdateApprovalError extends Error {
+    readonly field: 'fingerprint' | 'approvePlan';
+    constructor(field: 'fingerprint' | 'approvePlan');
+}
+export declare function isUpdatePlanFingerprint(value: unknown): value is string;
+export declare function requestUpdateApproval({ fingerprint, approvePlan }: UpdateApprovalRequest, context: UpdateApprovalContext): Promise<UpdateApprovalResult>;

package/dist/application/update/approval.js

@@ -0,0 +1,54 @@
+export class InvalidUpdateApprovalError extends Error {
+    field;
+    constructor(field) {
+        super(`${field === 'fingerprint' ? 'The current update plan fingerprint' : 'Flag --approve-plan'} ` +
+            'must contain exactly 64 lowercase hexadecimal characters.');
+        this.field = field;
+        this.name = 'InvalidUpdateApprovalError';
+    }
+}
+export function isUpdatePlanFingerprint(value) {
+    return typeof value === 'string' && value.length === 64 && /^[a-f0-9]{64}$/u.test(value);
+}
+function isPromptCancellation(error) {
+    return error instanceof Error && (error.name === 'ExitPromptError' ||
+        error.name === 'AbortPromptError' ||
+        error.name === 'InteractiveCancelledError');
+}
+// Consent only: the caller must match a preview first and recheck the plan under the project lock before writes.
+export async function requestUpdateApproval({ fingerprint, approvePlan }, context) {
+    if (!isUpdatePlanFingerprint(fingerprint)) {
+        throw new InvalidUpdateApprovalError('fingerprint');
+    }
+    if (approvePlan !== undefined) {
+        if (!isUpdatePlanFingerprint(approvePlan)) {
+            throw new InvalidUpdateApprovalError('approvePlan');
+        }
+        return approvePlan === fingerprint
+            ? { status: 'approved', fingerprint, method: 'fingerprint' }
+            : { status: 'mismatch', fingerprint, requestedFingerprint: approvePlan };
+    }
+    const input = context.stdin;
+    const output = context.stderr;
+    if (!input || input.isTTY !== true || input.destroyed || input.readableEnded || !input.readable ||
+        output.isTTY !== true || output.destroyed || output.writableEnded || !output.writable) {
+        return { status: 'required', fingerprint };
+    }
+    try {
+        const prompt = context.approveUpdatePlan ?? (await import('@inquirer/prompts')).confirm;
+        const approved = await prompt({
+            message: `Apply this exact update plan (${fingerprint})?`,
+            default: false
+        }, { input, output });
+        return approved === true
+            ? { status: 'approved', fingerprint, method: 'interactive' }
+            : { status: 'declined', fingerprint, reason: 'declined' };
+    }
+    catch (error) {
+        if (isPromptCancellation(error)) {
+            return { status: 'declined', fingerprint, reason: 'cancelled' };
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=approval.js.map

package/dist/application/update/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../src/application/update/approval.ts"],"names":[],"mappings":"AAwBA,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC9B,KAAK;IAA1B,YAAqB,KAAoC;QACvD,KAAK,CACH,GAAG,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,qBAAqB,GAAG;YAC3F,2DAA2D,CAC9D,CAAC;qBAJiB,KAAK;QAKxB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,KAAK,IAAI,CAC/B,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAChC,KAAK,CAAC,IAAI,KAAK,kBAAkB;QACjC,KAAK,CAAC,IAAI,KAAK,2BAA2B,CAC3C,CAAC;AACJ,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAE,WAAW,EAAE,WAAW,EAAyB,EACnD,OAA8B;IAE9B,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,0BAA0B,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,WAAW,KAAK,WAAW;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE;YAC5D,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAqD,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,MAItB,CAAC;IACF,IACE,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,QAAQ;QAC3F,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,EACrF,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;QACxF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;YAC5B,OAAO,EAAE,iCAAiC,WAAW,IAAI;YACzD,OAAO,EAAE,KAAK;SACf,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACtB,OAAO,QAAQ,KAAK,IAAI;YACtB,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE;YAC5D,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/application/update/command-guidance.d.ts

@@ -0,0 +1,2 @@
+export declare function formatUpdateCommand(projectRoot: string, mode?: 'normal' | 'force' | 'check', platform?: NodeJS.Platform): string;
+export declare function formatUpdateValidationCommands(projectRoot: string, platform?: NodeJS.Platform): string;

package/dist/application/update/command-guidance.js

@@ -0,0 +1,14 @@
+import { commandShellForPlatform, formatShellCommand, formatShellDirectoryCommands } from '../../adapters/process/shell-command.js';
+export function formatUpdateCommand(projectRoot, mode = 'normal', platform = process.platform) {
+    return formatShellCommand({
+        executable: 'liftoff',
+        args: ['update', ...(mode === 'normal' ? [] : [`--${mode}`]), '--project', projectRoot]
+    }, commandShellForPlatform(platform));
+}
+export function formatUpdateValidationCommands(projectRoot, platform = process.platform) {
+    return formatShellDirectoryCommands([
+        { executable: 'liftoff', args: ['validate'] },
+        { executable: 'liftoff', args: ['doctor'] }
+    ], projectRoot, commandShellForPlatform(platform));
+}
+//# sourceMappingURL=command-guidance.js.map

package/dist/application/update/command-guidance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-guidance.js","sourceRoot":"","sources":["../../../src/application/update/command-guidance.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC7B,MAAM,yCAAyC,CAAC;AAEjD,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,IAAI,GAAiC,QAAQ,EAC7C,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,kBAAkB,CAAC;QACxB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC;KACxF,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,WAAmB,EACnB,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,4BAA4B,CAAC;QAClC,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE;QAC7C,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;KAC5C,EAAE,WAAW,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/application/update/inspection.d.ts

@@ -0,0 +1,37 @@
+import { type ProjectFileSnapshot } from '../../adapters/filesystem/project-transaction.js';
+import type { LiftoffManifest, ProjectPlan } from '../../domain/project/contracts.js';
+import type { CommandRunner } from '../../process-runner.js';
+import { type ManagedUpdateReconciliationReport } from './reporting.js';
+export declare class UpdatePlanError extends Error {
+    readonly reasonCode: string;
+    readonly remedy: string;
+    constructor(message: string, reasonCode: string, remedy: string);
+}
+export declare function preserveDiagnosticGovernanceIdentity(target: LiftoffManifest, source: LiftoffManifest): void;
+export declare function findUpdateRepositoryBoundary(projectRoot: string): Promise<string | undefined>;
+export declare function inspectProjectUpdate(projectDirectory: string, options?: {
+    runner?: CommandRunner;
+}): Promise<{
+    projectRoot: string;
+    repositoryRoot: string | undefined;
+    manifest: LiftoffManifest;
+    plan: ProjectPlan;
+    renderPlan: ProjectPlan;
+    render: import("../../domain/project/contracts.js").GeneratedArtifact[];
+    entries: import("../../reconcile.js").ReconcileEntry[];
+    oldByName: Map<string, import("../../domain/project/contracts.js").ManifestManagedArtifact>;
+    provisioningPlans: import("./planning.js").ProvisioningGroupPlan[];
+    snapshots: ProjectFileSnapshot[];
+    stateMigration: import("../../governance-activation/migration.js").ActivationStateMigrationPlan;
+    historyMigration: import("../../governance-activation/migration-history.js").ActivationHistoryMigrationPlan;
+    revalidationSource: import("../../governance-activation/inputs.js").ActivationInputSnapshot | undefined;
+    retainedSource: import("./protected-source.js").RetainedProjectInput[] | undefined;
+    reconciliation: ManagedUpdateReconciliationReport;
+    ownershipMigrationPending: boolean;
+    workloadIntentChanged: boolean;
+    plannedManifestChanges: import("./reporting.js").ManifestChange[];
+    summary: import("./reporting.js").UpdateSummary;
+    hasDrift: boolean;
+}>;
+export type UpdateInspection = Awaited<ReturnType<typeof inspectProjectUpdate>>;
+export declare function uniqueUpdateSnapshots(snapshots: readonly ProjectFileSnapshot[], projectRoot: string): ProjectFileSnapshot[];

package/dist/application/update/inspection.js

@@ -0,0 +1,235 @@
+import { lstat, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { captureProjectFileSnapshot } from '../../adapters/filesystem/project-transaction.js';
+import { readProjectFile } from '../../adapters/filesystem/project-files.js';
+import { errorCode } from '../../adapters/filesystem/errors.js';
+import { FileSystemError } from '../../domain/project/errors.js';
+import { manifestHadFilteredLegacyNonDurableOwnership } from '../../domain/project/manifest/reader.js';
+import { activationStateFilePathParts } from '../../governance-activation/activation-state.js';
+import { planHistoricalActivationStateMigration } from '../../governance-activation/migration.js';
+import { planActivationHistoryMigration } from '../../governance-activation/migration-history.js';
+import { migrationStateFilePathParts } from '../../governance-activation/history-contracts.js';
+import { readActivationInputSnapshot } from '../../governance-activation/inputs.js';
+import { phaseIds } from '../../domain/governance/activation/types.js';
+import { inspectReviewedUpdateTransaction } from '../../adapters/filesystem/reviewed-update-transaction.js';
+import { captureRetainedProjectInputs } from './protected-source.js';
+import { formatUpdateCommand } from './command-guidance.js';
+import { hasDrift, reconcileProject } from '../../reconcile.js';
+import { compareSemver } from '../../semver.js';
+import { buildManifest } from '../../templates.js';
+import { liftoffVersion } from '../../version.js';
+import { loadManifest } from '../project/manifest.js';
+import { buildProjectPlan, loadConfigOptions } from '../project/planning.js';
+import { buildUpdateArtifacts, captureUpdateSnapshots, inspectProvisioningGroups, planWithBlockedProvisioning, requestedProvisioningGroups, sameWorkloadIntent } from './planning.js';
+import { activeChangeReconciliationReport, combineReconciliationReports, manifestChanges, stateMigrationReconciliation, summarizeEntries } from './reporting.js';
+export class UpdatePlanError extends Error {
+    reasonCode;
+    remedy;
+    constructor(message, reasonCode, remedy) {
+        super(message);
+        this.reasonCode = reasonCode;
+        this.remedy = remedy;
+        this.name = 'UpdatePlanError';
+    }
+}
+export function preserveDiagnosticGovernanceIdentity(target, source) {
+    if (target.governance.profile === 'none' || target.governance.profile === 'unspecified' ||
+        source.governance.profile === 'none' || source.governance.profile === 'unspecified')
+        return;
+    target.governance.policyVersion = source.governance.policyVersion;
+    if (source.governance.activationIdentity) {
+        target.governance.activationIdentity = source.governance.activationIdentity;
+    }
+    else {
+        delete target.governance.activationIdentity;
+    }
+}
+export async function findUpdateRepositoryBoundary(projectRoot) {
+    let current = projectRoot;
+    while (true) {
+        try {
+            const marker = await lstat(path.join(current, '.git'));
+            if (!marker.isDirectory() && !marker.isFile()) {
+                throw new FileSystemError('The Git boundary must be a regular file or directory, not a symlink.');
+            }
+            return await realpath(current);
+        }
+        catch (error) {
+            if (errorCode(error) !== 'ENOENT')
+                throw error;
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+async function assertUpdateIntent(projectRoot, manifest, plan) {
+    const recorded = manifest.project.workload;
+    const separateMigration = 'Restore liftoff.config.json or perform a separately reviewed project migration.';
+    if (plan.projectName !== manifest.project.name) {
+        throw new UpdatePlanError(`Project name changes (${manifest.project.name} -> ${plan.projectName}) are a migration, not an update.`, 'project-identity-change', separateMigration);
+    }
+    if (plan.workload !== recorded.kind) {
+        throw new UpdatePlanError(`Project type changes (${recorded.kind} -> ${plan.workload}) are not supported by update.`, 'workload-change', separateMigration);
+    }
+    for (const [label, from, to] of [
+        ['Cloud', recorded.cloud, plan.provider.id],
+        ['Region', recorded.region, plan.region.slug],
+        ['API stack', recorded.apiStack, plan.apiStack.id]
+    ]) {
+        if (from !== to) {
+            throw new UpdatePlanError(`${label} changes (${from} -> ${to}) are a migration, not an update.`, 'workload-identity-change', separateMigration);
+        }
+    }
+    const recordedPattern = recorded.kind === 'genai' ? recorded.pattern : undefined;
+    const desiredPattern = plan.workload === 'genai' ? plan.pattern.id : undefined;
+    if (recordedPattern !== desiredPattern) {
+        throw new UpdatePlanError(`Pattern changes (${recordedPattern ?? 'none'} -> ${desiredPattern ?? 'none'}) are a migration, not an update.`, 'pattern-change', separateMigration);
+    }
+    if (manifest.governance.profile !== 'none' && manifest.governance.profile !== 'unspecified' &&
+        plan.governanceProfile.id === 'none' &&
+        await readProjectFile(projectRoot, [...activationStateFilePathParts]) !== undefined) {
+        throw new UpdatePlanError('Repository governance cannot be disabled by update while governance/activation-state.json exists.', 'deactivation-required', 'Restore liftoff.config.json or use a separately supported deactivation workflow; update does not infer the absence of live enforcement.');
+    }
+    if (plan.specWorkflow.id !== manifest.project.specWorkflow) {
+        throw new UpdatePlanError(`Spec workflow changes (${manifest.project.specWorkflow} -> ${plan.specWorkflow.id}) require official framework initialization and are not supported by liftoff update.`, 'framework-change', separateMigration);
+    }
+    if (manifest.framework.state === 'initialized' && (plan.agents.length !== manifest.project.agents.length ||
+        plan.agents.some((agent, index) => agent.id !== manifest.project.agents[index]) ||
+        plan.defaultAgent?.id !== manifest.project.defaultAgent)) {
+        throw new UpdatePlanError('AI agent or default-agent changes require official framework initialization and are not supported by liftoff update.', 'agent-change', 'Restore the integrations recorded in liftoff.manifest.json.');
+    }
+}
+export async function inspectProjectUpdate(projectDirectory, options = {}) {
+    const projectRoot = await realpath(projectDirectory);
+    const initialSnapshots = [
+        await captureProjectFileSnapshot(projectRoot, ['liftoff.manifest.json'])
+    ];
+    const manifest = await loadManifest(projectRoot);
+    const interrupted = await inspectReviewedUpdateTransaction(projectRoot);
+    if (interrupted.status !== 'absent') {
+        throw new UpdatePlanError('An existing update transaction requires recovery before a new preview.', 'transaction-recovery-required', `Review the reported transaction and run ${formatUpdateCommand(projectRoot)} for bounded recovery.`);
+    }
+    if (compareSemver(manifest.liftoffVersion, liftoffVersion) > 0) {
+        throw new UpdatePlanError(`This project was written by Liftoff ${manifest.liftoffVersion}, which is newer than this CLI (${liftoffVersion}).`, 'newer-project', 'Upgrade the CLI first.');
+    }
+    initialSnapshots.push(await captureProjectFileSnapshot(projectRoot, ['liftoff.config.json']));
+    const config = await loadConfigOptions('liftoff.config.json', projectRoot);
+    if (config.cloud !== undefined && config.cloud !== manifest.project.workload.cloud) {
+        throw new UpdatePlanError(`Cloud changes (${manifest.project.workload.cloud} -> ${config.cloud}) are a migration, not an update.`, 'workload-identity-change', 'Restore liftoff.config.json or perform a separately reviewed project migration.');
+    }
+    const plan = buildProjectPlan(config, { requireProjectName: true });
+    await assertUpdateIntent(projectRoot, manifest, plan);
+    initialSnapshots.push(await captureProjectFileSnapshot(projectRoot, [...activationStateFilePathParts]));
+    initialSnapshots.push(await captureProjectFileSnapshot(projectRoot, [...migrationStateFilePathParts]));
+    const desiredRenderPlan = manifest.framework.state === 'legacy'
+        ? { ...plan, agents: [], defaultAgent: undefined }
+        : plan;
+    const stateMigration = await planHistoricalActivationStateMigration(projectRoot);
+    let historyMigration = await planActivationHistoryMigration(projectRoot);
+    if (historyMigration.status === 'blocked' &&
+        historyMigration.reasonCode === 'unreviewed-historical-records' && historyMigration.unreviewedPathParts) {
+        historyMigration = await planActivationHistoryMigration(projectRoot, {
+            reviewedUnreferencedPathParts: historyMigration.unreviewedPathParts
+        });
+    }
+    const desiredRender = buildUpdateArtifacts(desiredRenderPlan, manifest);
+    let provisioningPlans = await inspectProvisioningGroups(projectRoot, desiredRender, requestedProvisioningGroups(manifest, desiredRenderPlan));
+    if (historyMigration.status === 'eligible' || stateMigration.report.diagnosticOnly === true) {
+        provisioningPlans = provisioningPlans.map((group) => ({
+            ...group, entries: [], blocked: true,
+            reason: 'Activation migration defers new component provisioning until a fresh post-migration preview.'
+        }));
+    }
+    const renderPlan = planWithBlockedProvisioning(desiredRenderPlan, manifest.project.workload, provisioningPlans);
+    const render = buildUpdateArtifacts(renderPlan, manifest);
+    const scopedRender = [
+        ...render.filter((artifact) => artifact.lifecycle === 'managed-core'),
+        ...desiredRender.filter((artifact) => artifact.lifecycle === 'project' &&
+            provisioningPlans.some((group) => !group.blocked && group.group === artifact.provisioningGroup))
+    ];
+    const snapshots = await captureUpdateSnapshots(projectRoot, manifest, scopedRender, initialSnapshots);
+    if (historyMigration.status === 'eligible') {
+        snapshots.push(...historyMigration.preconditions);
+    }
+    else if (historyMigration.status === 'current' && historyMigration.history.status === 'committed') {
+        snapshots.push(await captureProjectFileSnapshot(projectRoot, historyMigration.history.journal.historyIndexPathParts), ...await Promise.all(historyMigration.history.index.files.map((file) => captureProjectFileSnapshot(projectRoot, file.copyPathParts))));
+    }
+    const entries = await reconcileProject(manifest, render, projectRoot);
+    const ownershipMigrationPending = manifest.artifactVersion !== 7 ||
+        manifestHadFilteredLegacyNonDurableOwnership(manifest);
+    const plannedManifest = buildManifest(renderPlan, render, {
+        frameworkState: manifest.framework.state, projectArtifacts: manifest.projectArtifacts
+    });
+    if (stateMigration.report.diagnosticOnly === true && historyMigration.status !== 'eligible') {
+        preserveDiagnosticGovernanceIdentity(plannedManifest, manifest);
+    }
+    const workloadIntentChanged = !sameWorkloadIntent(plannedManifest.project.workload, manifest.project.workload);
+    const historicalReconciliation = historyMigration.status === 'blocked' ? {
+        status: 'blocked', changedIdentityFields: [],
+        phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [] },
+        issues: historyMigration.issues,
+        remedy: 'Repair the exact historical compatibility or record issue; force cannot authorize an unsupported migration.'
+    } : historyMigration.status === 'eligible' ? {
+        status: 'reconciliation-required',
+        changedIdentityFields: [{
+                field: 'governance.activationIdentity',
+                from: historyMigration.semanticPlan.sourceIdentity,
+                to: historyMigration.semanticPlan.targetIdentity
+            }],
+        phaseImpact: { preservedPhaseIds: [], invalidPhaseIds: [...phaseIds] },
+        issues: ['Original v1 history will be preserved; current v2 proof must be established by approved local revalidation.'],
+        remedy: 'Review the history-preserving successor plan and explicitly approve the matching preview.'
+    } : stateMigrationReconciliation(stateMigration);
+    const activeChangeReport = await activeChangeReconciliationReport(projectRoot, historyMigration.status === 'eligible' ? historyMigration.inventory.state.activeChange : undefined);
+    if (historyMigration.status === 'eligible' && activeChangeReport.status !== 'not-required') {
+        activeChangeReport.status = 'blocked';
+    }
+    const reconciliation = combineReconciliationReports([historicalReconciliation, activeChangeReport]);
+    const hasMigrationHistory = historyMigration.status === 'eligible' ||
+        historyMigration.status === 'current' && historyMigration.history.status === 'committed';
+    const revalidationSource = hasMigrationHistory
+        ? await readActivationInputSnapshot(projectRoot, manifest, options.runner)
+        : undefined;
+    const retainedSource = hasMigrationHistory ? await captureRetainedProjectInputs(projectRoot) : undefined;
+    return {
+        projectRoot,
+        repositoryRoot: await findUpdateRepositoryBoundary(projectRoot),
+        manifest,
+        plan,
+        renderPlan,
+        render,
+        entries,
+        oldByName: new Map(manifest.managedArtifacts.map((artifact) => [artifact.logicalName, artifact])),
+        provisioningPlans,
+        snapshots: uniqueUpdateSnapshots(snapshots, projectRoot),
+        stateMigration,
+        historyMigration,
+        revalidationSource,
+        retainedSource,
+        reconciliation,
+        ownershipMigrationPending,
+        workloadIntentChanged,
+        plannedManifestChanges: manifestChanges(manifest, plannedManifest),
+        summary: summarizeEntries(entries),
+        hasDrift: hasDrift(entries) || ownershipMigrationPending || workloadIntentChanged ||
+            provisioningPlans.length > 0 || stateMigration.status === 'migrate' ||
+            historyMigration.status === 'eligible'
+    };
+}
+export function uniqueUpdateSnapshots(snapshots, projectRoot) {
+    const unique = new Map();
+    for (const snapshot of snapshots) {
+        const key = snapshot.pathParts.join('\0');
+        const previous = unique.get(key);
+        if (previous && ((previous.content === undefined) !== (snapshot.content === undefined) ||
+            previous.mode !== snapshot.mode ||
+            previous.content?.equals(snapshot.content) === false)) {
+            throw new UpdatePlanError(`Project input changed during preview: ${snapshot.pathParts.join('/')}`, 'inputs-changed', `Run ${formatUpdateCommand(projectRoot, 'check')} again.`);
+        }
+        unique.set(key, snapshot);
+    }
+    return [...unique.values()];
+}
+//# sourceMappingURL=inspection.js.map

package/dist/application/update/inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspection.js","sourceRoot":"","sources":["../../../src/application/update/inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,0BAA0B,EAA4B,MAAM,kDAAkD,CAAC;AACxH,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,4CAA4C,EAAE,MAAM,yCAAyC,CAAC;AAEvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,sCAAsC,EAAE,MAAM,0CAA0C,CAAC;AAClG,OAAO,EAAE,8BAA8B,EAAE,MAAM,kDAAkD,CAAC;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,6CAA6C,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,eAAe,EACf,4BAA4B,EAC5B,gBAAgB,EAEjB,MAAM,gBAAgB,CAAC;AAExB,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAG7B,UAAU;IACV,MAAM;IAHjB,YACE,OAAe,EACN,UAAkB,EAClB,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;0BAHN,UAAU;sBACV,MAAM;QAGf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,UAAU,oCAAoC,CAClD,MAAuB,EACvB,MAAuB;IAEvB,IACE,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,aAAa;QACnF,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,aAAa;QACnF,OAAO;IACT,MAAM,CAAC,UAAU,CAAC,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACzC,MAAM,CAAC,UAAU,CAAC,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,OAAO,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,WAAmB;IACpE,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC9C,MAAM,IAAI,eAAe,CAAC,sEAAsE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,QAAyB,EACzB,IAAiB;IAEjB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3C,MAAM,iBAAiB,GAAG,iFAAiF,CAAC;IAC5G,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,eAAe,CACvB,yBAAyB,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,mCAAmC,EACxG,yBAAyB,EAAE,iBAAiB,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CACvB,yBAAyB,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,gCAAgC,EAC1F,iBAAiB,EAAE,iBAAiB,CACrC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI;QAC9B,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7C,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;KAC1C,EAAE,CAAC;QACX,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACvB,GAAG,KAAK,aAAa,IAAI,OAAO,EAAE,mCAAmC,EACrE,0BAA0B,EAAE,iBAAiB,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CACvB,oBAAoB,eAAe,IAAI,MAAM,OAAO,cAAc,IAAI,MAAM,mCAAmC,EAC/G,gBAAgB,EAAE,iBAAiB,CACpC,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,KAAK,aAAa;QACvF,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,MAAM;QACpC,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC,GAAG,4BAA4B,CAAC,CAAC,KAAK,SAAS,EACnF,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,mGAAmG,EACnG,uBAAuB,EACvB,yIAAyI,CAC1I,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC3D,MAAM,IAAI,eAAe,CACvB,0BAA0B,QAAQ,CAAC,OAAO,CAAC,YAAY,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,sFAAsF,EACxK,kBAAkB,EAAE,iBAAiB,CACtC,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,aAAa,IAAI,CAC5C,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM;QACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,YAAY,CACxD,EACD,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,sHAAsH,EACtH,cAAc,EAAE,6DAA6D,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,gBAAwB,EACxB,OAAO,GAA+B,EAAE;IAExC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG;QACvB,MAAM,0BAA0B,CAAC,WAAW,EAAE,CAAC,uBAAuB,CAAC,CAAC;KACzE,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,gCAAgC,CAAC,WAAW,CAAC,CAAC;IACxE,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CACvB,wEAAwE,EACxE,+BAA+B,EAC/B,2CAA2C,mBAAmB,CAAC,WAAW,CAAC,wBAAwB,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,eAAe,CACvB,uCAAuC,QAAQ,CAAC,cAAc,mCAAmC,cAAc,IAAI,EACnH,eAAe,EAAE,wBAAwB,CAC1C,CAAC;IACJ,CAAC;IACD,gBAAgB,CAAC,IAAI,CAAC,MAAM,0BAA0B,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnF,MAAM,IAAI,eAAe,CACvB,kBAAkB,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,MAAM,CAAC,KAAK,mCAAmC,EACvG,0BAA0B,EAAE,iFAAiF,CAC9G,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,0BAA0B,CAAC,WAAW,EAAE,CAAC,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAC;IACxG,gBAAgB,CAAC,IAAI,CAAC,MAAM,0BAA0B,CAAC,WAAW,EAAE,CAAC,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,iBAAiB,GAAgB,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,QAAQ;QAC1E,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE;QAClD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,cAAc,GAAG,MAAM,sCAAsC,CAAC,WAAW,CAAC,CAAC;IACjF,IAAI,gBAAgB,GAAG,MAAM,8BAA8B,CAAC,WAAW,CAAC,CAAC;IACzE,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS;QACvC,gBAAgB,CAAC,UAAU,KAAK,+BAA+B,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,CAAC;QAC1G,gBAAgB,GAAG,MAAM,8BAA8B,CAAC,WAAW,EAAE;YACnE,6BAA6B,EAAE,gBAAgB,CAAC,mBAAmB;SACpE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACxE,IAAI,iBAAiB,GAAG,MAAM,yBAAyB,CACrD,WAAW,EAAE,aAAa,EAAE,2BAA2B,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CACrF,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,UAAU,IAAI,cAAc,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5F,iBAAiB,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpD,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI;YACpC,MAAM,EAAE,8FAA8F;SACvG,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,UAAU,GAAG,2BAA2B,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG;QACnB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,KAAK,cAAc,CAAC;QACrE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACnC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAChC,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,iBAAiB,CAAC,CAChG;KACF,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACtG,IAAI,gBAAgB,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACpG,SAAS,CAAC,IAAI,CACZ,MAAM,0BAA0B,CAAC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,EACrG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrE,0BAA0B,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAC5D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACtE,MAAM,yBAAyB,GAAG,QAAQ,CAAC,eAAe,KAAK,CAAC;QAC9D,4CAA4C,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE;QACxD,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;KACtF,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,gBAAgB,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5F,oCAAoC,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,qBAAqB,GAAG,CAAC,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/G,MAAM,wBAAwB,GAC5B,gBAAgB,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC;QACtC,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,EAAE;QAC5C,WAAW,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE;QAC3D,MAAM,EAAE,gBAAgB,CAAC,MAAM;QAC/B,MAAM,EAAE,6GAA6G;KACtH,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC;QAC3C,MAAM,EAAE,yBAAyB;QACjC,qBAAqB,EAAE,CAAC;gBACtB,KAAK,EAAE,+BAA+B;gBACtC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,cAAc;gBAClD,EAAE,EAAE,gBAAgB,CAAC,YAAY,CAAC,cAAc;aACjD,CAAC;QACF,WAAW,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE;QACtE,MAAM,EAAE,CAAC,6GAA6G,CAAC;QACvH,MAAM,EAAE,2FAA2F;KACpG,CAAC,CAAC,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,kBAAkB,GAAG,MAAM,gCAAgC,CAAC,WAAW,EAC3E,gBAAgB,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtG,IAAI,gBAAgB,CAAC,MAAM,KAAK,UAAU,IAAI,kBAAkB,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC3F,kBAAkB,CAAC,MAAM,GAAG,SAAS,CAAC;IACxC,CAAC;IACD,MAAM,cAAc,GAAG,4BAA4B,CAAC,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACpG,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,KAAK,UAAU;QAChE,gBAAgB,CAAC,MAAM,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC;IAC3F,MAAM,kBAAkB,GAAG,mBAAmB;QAC5C,CAAC,CAAC,MAAM,2BAA2B,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;QAC1E,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,cAAc,GAAG,mBAAmB,CAAC,CAAC,CAAC,MAAM,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,OAAO;QACL,WAAW;QACX,cAAc,EAAE,MAAM,4BAA4B,CAAC,WAAW,CAAC;QAC/D,QAAQ;QACR,IAAI;QACJ,UAAU;QACV,MAAM;QACN,OAAO;QACP,SAAS,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjG,iBAAiB;QACjB,SAAS,EAAE,qBAAqB,CAAC,SAAS,EAAE,WAAW,CAAC;QACxD,cAAc;QACd,gBAAgB;QAChB,kBAAkB;QAClB,cAAc;QACd,cAAc;QACd,yBAAyB;QACzB,qBAAqB;QACrB,sBAAsB,EAAE,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC;QAClE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAClC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,yBAAyB,IAAI,qBAAqB;YAC/E,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS;YACnE,gBAAgB,CAAC,MAAM,KAAK,UAAU;KACzC,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,qBAAqB,CACnC,SAAyC,EACzC,WAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,IAAI,CACd,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC;YACrE,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAQ,CAAC,KAAK,KAAK,CACtD,EAAE,CAAC;YACF,MAAM,IAAI,eAAe,CACvB,yCAAyC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EACvE,gBAAgB,EAAE,OAAO,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC"}

package/dist/application/update/migration-runtime.d.ts

@@ -0,0 +1,14 @@
+import { type ProjectFileMutation } from '../../adapters/filesystem/project-transaction.js';
+import { type MigrationJournal } from '../../governance-activation/history-contracts.js';
+import type { ExecutionContext } from '../context.js';
+import { type UpdateInspection } from './inspection.js';
+import type { UpdateMigrationSummary, UpdateRevalidationSummary } from './output.js';
+import type { ReviewedUpdatePlan } from './review-plan.js';
+export declare function describeUpdateMigration(inspection: UpdateInspection): UpdateMigrationSummary;
+export declare function describeUpdateRevalidation(review: ReviewedUpdatePlan): UpdateRevalidationSummary;
+export declare function materializeUpdateMutations(inspection: UpdateInspection, review: ReviewedUpdatePlan, now: Date): {
+    mutations: ProjectFileMutation[];
+    journal?: MigrationJournal;
+};
+export declare function verifyHistoryBeforeReplacement(inspection: UpdateInspection, mutation: ProjectFileMutation): Promise<void>;
+export declare function runUpdateRevalidation(inspection: UpdateInspection, review: ReviewedUpdatePlan, context: ExecutionContext, validateReview?: () => Promise<void>): Promise<UpdateRevalidationSummary>;

package/dist/application/update/migration-runtime.js

@@ -0,0 +1,178 @@
+import { applyProjectFileTransaction, captureProjectFileSnapshot } from '../../adapters/filesystem/project-transaction.js';
+import { withProjectMutationLock } from '../../adapters/filesystem/project-lock.js';
+import { canonicalJson } from '../../domain/governance/activation/canonical-json.js';
+import { manifestDisplayPath } from '../../domain/project/paths.js';
+import { activationHistoryIndexPathParts, historicalActivationStatePathParts, migrationStateFilePathParts, parseHistoryJson, rawHistoryDigest, validateMigrationJournal } from '../../governance-activation/history-contracts.js';
+import { finalizeActivationHistoryMigration } from '../../governance-activation/migration-history.js';
+import { UpdatePlanError } from './inspection.js';
+import { executeLocalRevalidation } from './revalidation.js';
+import { postUpdateProtectedInputs } from './revalidation-plan.js';
+import { formatUpdateCommand } from './command-guidance.js';
+export function describeUpdateMigration(inspection) {
+    const history = inspection.historyMigration;
+    if (history.status === 'eligible') {
+        const indexPath = activationHistoryIndexPathParts(history.index.snapshotId);
+        return {
+            status: 'available',
+            sourceIdentity: history.semanticPlan.sourceIdentity,
+            targetIdentity: history.semanticPlan.targetIdentity,
+            snapshotId: history.index.snapshotId,
+            historyPaths: history.index.files.map((file) => manifestDisplayPath(file.originalPathParts)),
+            operations: [
+                ...(history.historyDisposition === 'create'
+                    ? [...history.index.files.map((file) => file.copyPathParts), indexPath].map((parts) => ({
+                        type: 'write', path: manifestDisplayPath(parts)
+                    })) : []),
+                ...history.requiredRetirements.map((entry) => ({ type: 'delete', path: manifestDisplayPath(entry.pathParts) })),
+                { type: 'write', path: manifestDisplayPath([...historicalActivationStatePathParts]) },
+                { type: 'write', path: manifestDisplayPath([...migrationStateFilePathParts]) }
+            ],
+            issues: ['Preserve original v1 bytes, create a linked v2 successor, and establish fresh local proof.']
+        };
+    }
+    if (history.status === 'blocked') {
+        return {
+            status: 'blocked', reasonCode: history.reasonCode, sourceIdentity: null, targetIdentity: null,
+            historyPaths: [], issues: history.issues
+        };
+    }
+    if (history.status === 'current' && history.history.status === 'committed') {
+        return {
+            status: 'committed',
+            sourceIdentity: history.history.journal.sourceIdentity,
+            targetIdentity: history.history.journal.targetIdentity,
+            snapshotId: history.history.journal.snapshotId,
+            historyPaths: history.history.index.files.map((file) => manifestDisplayPath(file.originalPathParts)),
+            issues: []
+        };
+    }
+    return { status: 'not-required', sourceIdentity: null, targetIdentity: null, historyPaths: [], issues: [] };
+}
+export function describeUpdateRevalidation(review) {
+    if (!review.revalidation)
+        return { status: 'not-required', nextPhase: null, issues: [] };
+    const issues = review.revalidation.preview.phases.flatMap((phase) => phase.blockers.map((blocker) => `${phase.phaseId}: ${blocker}`));
+    return {
+        status: issues.length ? 'blocked' : review.needsRevalidation ? 'pending' : 'complete',
+        nextPhase: review.revalidation.preview.phases[0]?.phaseId ?? null,
+        issues,
+        preview: review.revalidation.preview
+    };
+}
+export function materializeUpdateMutations(inspection, review, now) {
+    if (inspection.historyMigration.status !== 'eligible') {
+        return { mutations: review.writePlan.mutations };
+    }
+    const history = inspection.historyMigration;
+    const finalized = finalizeActivationHistoryMigration(history, review.descriptor.fingerprint, now);
+    const snapshotKeys = new Set([
+        activationHistoryIndexPathParts(history.index.snapshotId).join('\0'),
+        ...history.index.files.map((file) => file.copyPathParts.join('\0'))
+    ]);
+    const before = finalized.mutations.filter((mutation) => snapshotKeys.has(mutation.pathParts.join('\0')));
+    const successor = finalized.mutations.filter((mutation) => !snapshotKeys.has(mutation.pathParts.join('\0')));
+    const core = review.writePlan.mutations.filter((mutation) => mutation.pathParts.join('\0') !== 'liftoff.manifest.json');
+    const manifest = review.writePlan.mutations.filter((mutation) => mutation.pathParts.join('\0') === 'liftoff.manifest.json');
+    if (manifest.length !== 1) {
+        throw new UpdatePlanError('The successor has no uniquely planned manifest write.', 'invalid-successor-plan', `Run ${formatUpdateCommand(inspection.projectRoot, 'check')} again.`);
+    }
+    return { mutations: [...before, ...core, ...successor, ...manifest], journal: finalized.journal };
+}
+export async function verifyHistoryBeforeReplacement(inspection, mutation) {
+    if (inspection.historyMigration.status !== 'eligible')
+        return;
+    const original = inspection.historyMigration.index.files.find((file) => file.originalPathParts.join('\0') === mutation.pathParts.join('\0'));
+    if (!original)
+        return;
+    const copy = await captureProjectFileSnapshot(inspection.projectRoot, original.copyPathParts);
+    if (!copy.content || rawHistoryDigest(copy.content) !== original.digest) {
+        throw new UpdatePlanError(`The original bytes were not safely preserved before replacement: ${manifestDisplayPath(mutation.pathParts)}`, 'history-preservation-failed', 'Preserve the original data and review the transaction recovery report.');
+    }
+}
+export async function runUpdateRevalidation(inspection, review, context, validateReview) {
+    if (!review.revalidation)
+        return { status: 'not-required', nextPhase: null, issues: [] };
+    const prepared = review.revalidation;
+    const now = context.updateNow ?? (() => new Date());
+    return withProjectMutationLock(inspection.projectRoot, async () => {
+        await validateReview?.();
+        let journalSnapshot = await captureProjectFileSnapshot(inspection.projectRoot, [...migrationStateFilePathParts]);
+        if (!journalSnapshot.content) {
+            throw new UpdatePlanError('The committed migration journal is missing.', 'migration-journal-missing', 'Preserve v2 and restore the declared migration history before retrying.');
+        }
+        let journal = validateMigrationJournal(parseHistoryJson(journalSnapshot.content, 'governance/migration-state.json'));
+        const snapshotId = journal.snapshotId;
+        let progressWrites = 0;
+        const maximumProgressWrites = 2 * (prepared.preview.phases.length + prepared.preview.reusedPhases.length) + 2;
+        const protectedInputs = postUpdateProtectedInputs(inspection, review.writePlan, prepared, context.runner);
+        async function recordProgress(progress) {
+            if (++progressWrites > maximumProgressWrites) {
+                throw new UpdatePlanError('Local revalidation exceeded its approved progress-write bound.', 'revalidation-scope-changed', 'Run a fresh update check before continuing.');
+            }
+            const activePhase = progress.phaseId ?? (progress.status === 'blocked'
+                ? journal.revalidation.phases.find((phase) => !progress.phaseResults.some((result) => result.phaseId === phase.phaseId &&
+                    (result.status === 'verified' || result.status === 'already-complete')))?.phaseId ?? journal.revalidation.phases[0]?.phaseId
+                : undefined);
+            const phases = journal.revalidation.phases.map((phase) => {
+                const result = progress.phaseResults.find((entry) => entry.phaseId === phase.phaseId);
+                const reused = prepared.preview.reusedPhases.find((entry) => entry.phaseId === phase.phaseId);
+                if (result?.status === 'verified' || result?.status === 'already-complete') {
+                    const evidenceId = result.evidence?.evidenceId ?? reused?.evidenceId;
+                    if (!evidenceId)
+                        throw new Error(`Revalidation supplied no evidence reference for ${phase.phaseId}.`);
+                    return { ...phase, status: 'complete', evidenceIds: [evidenceId], blockers: [] };
+                }
+                if (result?.status === 'blocked') {
+                    return { ...phase, status: 'blocked', evidenceIds: [], blockers: [...result.blockers] };
+                }
+                if (activePhase === phase.phaseId) {
+                    return {
+                        ...phase, status: progress.status === 'blocked' ? 'blocked' : 'running',
+                        evidenceIds: [], blockers: progress.status === 'blocked' ? [...progress.blockers] : []
+                    };
+                }
+                if (reused)
+                    return { ...phase, status: 'complete', evidenceIds: [reused.evidenceId], blockers: [] };
+                if (prepared.preview.phases.some((entry) => entry.phaseId === phase.phaseId)) {
+                    return { ...phase, status: 'pending', evidenceIds: [], blockers: [] };
+                }
+                return phase;
+            });
+            const status = progress.status === 'complete' && phases.some((phase) => phase.status !== 'complete')
+                ? 'blocked' : progress.status;
+            const nextAction = status === 'complete' ? null :
+                progress.blockers.join('; ') || 'Continue only the next separately reviewed supported governance phase.';
+            const next = validateMigrationJournal({
+                ...journal,
+                revalidation: { status, updatedAt: now().toISOString(), phases, nextAction }
+            });
+            if (next.snapshotId !== snapshotId)
+                throw new Error('The active migration identity changed.');
+            const content = canonicalJson(next);
+            await applyProjectFileTransaction(inspection.projectRoot, [{
+                    type: 'write', pathParts: [...migrationStateFilePathParts], content
+                }], { preconditions: [journalSnapshot] });
+            journal = next;
+            journalSnapshot = {
+                pathParts: [...migrationStateFilePathParts],
+                content: Buffer.from(content),
+                mode: journalSnapshot.mode
+            };
+        }
+        const result = await executeLocalRevalidation({
+            approvedPreview: prepared.preview,
+            protectedInputs,
+            runner: context.runner,
+            clock: now,
+            onProgress: recordProgress
+        });
+        return {
+            status: result.status === 'complete' && journal.revalidation.status === 'complete' ? 'complete' : 'blocked',
+            nextPhase: result.nextIncompletePhase,
+            issues: result.blockers.length ? result.blockers : journal.revalidation.nextAction ? [journal.revalidation.nextAction] : [],
+            preview: prepared.preview,
+            phaseResults: result.phaseResults
+        };
+    });
+}
+//# sourceMappingURL=migration-runtime.js.map