@msn-control/liftoff 0.10.4 → 0.11.2

package/dist/domain/governance/activation/validators.js

@@ -0,0 +1,1347 @@
+import { activationCompatibility, canonicalPhaseGraph, canonicalPhaseGraphHash, currentActivationIdentity } from './graph.js';
+import { activationContractVersion, activationStateSchemaVersion, approvalEnvelopeSchemaVersion, credentialPolicySchemaVersion, evidenceHeaderSchemaVersion, governanceActivationPolicyVersion, liftoffActivationPackageVersion, liftoffManifestArtifactVersion, phaseGraphSchemaVersion, resolveActivationCompatibility, supersessionSchemaVersion, isHistoricalActivationIdentity } from '../policy/identity.js';
+import { normalizeApprovalCostCeiling, normalizeApprovalDestinations, normalizeApprovalDestructiveScope, normalizeApprovalPermissions, normalizeApprovalPolicyExceptions, normalizeApprovalResources } from './approvals.js';
+import { approvalGateKinds, invalidationInputKinds, mutationClasses, phaseIds, phaseStates, rollbackKinds, runnerPreflightDisplayNameTemplate, runnerPreflightOrganizationPermissions, runnerPreflightPatLifetimeDays, runnerPreflightRepositoryPermissions, runnerPreflightRotationLeadDays, runnerPreflightSecretName } from './types.js';
+const phaseIdSet = new Set(phaseIds);
+const terminalPhaseStateSet = new Set(['approved', 'verified', 'failed', 'inapplicable', 'retained', 'disposed']);
+const resultStateSet = new Set(['verified', 'failed', 'inapplicable', 'retained', 'disposed']);
+const hex64Pattern = /^[a-f0-9]{64}$/;
+const isoLikePattern = /^\d{4}-\d{2}-\d{2}T/;
+const liveReadbackProviderSet = new Set(['github', 'azure']);
+const githubRemoteWriteMutations = new Set(['github-write', 'github-secret-write', 'github-ruleset-write']);
+const azureRemoteWriteMutations = new Set([
+    'azure-provider-register',
+    'azure-network-provision',
+    'azure-state-import',
+    'azure-resource-provision'
+]);
+const transitionAdapterIds = new Set([
+    'local-evidence',
+    'selected-spec-workflow',
+    'git',
+    'github',
+    'azure-opentofu',
+    'local-state'
+]);
+function record(value, path) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error(`${path} must be an object.`);
+    }
+    return value;
+}
+function exact(value, requiredKeys, path) {
+    const item = record(value, path);
+    for (const key of requiredKeys) {
+        if (!Object.hasOwn(item, key)) {
+            throw new Error(`${path}.${key} is required.`);
+        }
+    }
+    const allowed = new Set(requiredKeys);
+    for (const key of Object.keys(item)) {
+        if (!allowed.has(key)) {
+            throw new Error(`${path}.${key} is not allowed.`);
+        }
+    }
+    return item;
+}
+function exactWithOptional(value, requiredKeys, optionalKeys, path) {
+    const item = record(value, path);
+    for (const key of requiredKeys) {
+        if (!Object.hasOwn(item, key)) {
+            throw new Error(`${path}.${key} is required.`);
+        }
+    }
+    const allowed = new Set([...requiredKeys, ...optionalKeys]);
+    for (const key of Object.keys(item)) {
+        if (!allowed.has(key)) {
+            throw new Error(`${path}.${key} is not allowed.`);
+        }
+    }
+    return item;
+}
+function stringField(item, key, path) {
+    const value = item[key];
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`${path}.${key} must be a non-empty string.`);
+    }
+    return value;
+}
+function booleanField(item, key, path) {
+    const value = item[key];
+    if (typeof value !== 'boolean') {
+        throw new Error(`${path}.${key} must be a boolean.`);
+    }
+    return value;
+}
+function numberField(item, key, path) {
+    const value = item[key];
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        throw new Error(`${path}.${key} must be a finite number.`);
+    }
+    return value;
+}
+function integerField(item, key, path) {
+    const value = numberField(item, key, path);
+    if (!Number.isSafeInteger(value)) {
+        throw new Error(`${path}.${key} must be a safe integer.`);
+    }
+    return value;
+}
+function stringArray(value, path) {
+    if (!Array.isArray(value)) {
+        throw new Error(`${path} must be an array.`);
+    }
+    return value.map((entry, index) => {
+        if (typeof entry !== 'string' || entry.length === 0) {
+            throw new Error(`${path}[${index}] must be a non-empty string.`);
+        }
+        return entry;
+    });
+}
+function optionalStringArray(value, path) {
+    return value === undefined ? undefined : stringArray(value, path);
+}
+function pathPartsArray(value, path) {
+    if (!Array.isArray(value)) {
+        throw new Error(`${path} must be an array.`);
+    }
+    return value.map((entry, index) => stringArray(entry, `${path}[${index}]`));
+}
+function enumValue(value, allowed, path) {
+    if (typeof value !== 'string' || !allowed.has(value)) {
+        throw new Error(`${path} contains unsupported value ${JSON.stringify(value)}.`);
+    }
+    return value;
+}
+function requireVersion(value, expected, path) {
+    if (value !== expected) {
+        throw new Error(`${path} must be ${JSON.stringify(expected)}.`);
+    }
+}
+function validateActivationIdentityShape(value, path) {
+    const identity = exact(value, [
+        'liftoffVersion',
+        'manifestArtifactVersion',
+        'policyVersion',
+        'activationContractVersion',
+        'phaseGraphSchemaVersion',
+        'phaseGraphHash',
+        'activationStateSchemaVersion',
+        'evidenceHeaderSchemaVersion',
+        'approvalEnvelopeSchemaVersion',
+        'supersessionSchemaVersion',
+        'credentialPolicySchemaVersion'
+    ], path);
+    requireVersion(identity.liftoffVersion, liftoffActivationPackageVersion, `${path}.liftoffVersion`);
+    requireVersion(identity.manifestArtifactVersion, liftoffManifestArtifactVersion, `${path}.manifestArtifactVersion`);
+    requireVersion(identity.policyVersion, governanceActivationPolicyVersion, `${path}.policyVersion`);
+    requireVersion(identity.activationContractVersion, activationContractVersion, `${path}.activationContractVersion`);
+    requireVersion(identity.phaseGraphSchemaVersion, phaseGraphSchemaVersion, `${path}.phaseGraphSchemaVersion`);
+    requireVersion(identity.activationStateSchemaVersion, activationStateSchemaVersion, `${path}.activationStateSchemaVersion`);
+    requireVersion(identity.evidenceHeaderSchemaVersion, evidenceHeaderSchemaVersion, `${path}.evidenceHeaderSchemaVersion`);
+    requireVersion(identity.approvalEnvelopeSchemaVersion, approvalEnvelopeSchemaVersion, `${path}.approvalEnvelopeSchemaVersion`);
+    requireVersion(identity.supersessionSchemaVersion, supersessionSchemaVersion, `${path}.supersessionSchemaVersion`);
+    requireVersion(identity.credentialPolicySchemaVersion, credentialPolicySchemaVersion, `${path}.credentialPolicySchemaVersion`);
+    const phaseGraphHash = stringField(identity, 'phaseGraphHash', path);
+    if (!hex64Pattern.test(phaseGraphHash)) {
+        throw new Error(`${path}.phaseGraphHash must be a SHA-256 hex digest.`);
+    }
+    return {
+        liftoffVersion: identity.liftoffVersion,
+        manifestArtifactVersion: identity.manifestArtifactVersion,
+        policyVersion: identity.policyVersion,
+        activationContractVersion: identity.activationContractVersion,
+        phaseGraphSchemaVersion: identity.phaseGraphSchemaVersion,
+        phaseGraphHash,
+        activationStateSchemaVersion: identity.activationStateSchemaVersion,
+        evidenceHeaderSchemaVersion: identity.evidenceHeaderSchemaVersion,
+        approvalEnvelopeSchemaVersion: identity.approvalEnvelopeSchemaVersion,
+        supersessionSchemaVersion: identity.supersessionSchemaVersion,
+        credentialPolicySchemaVersion: identity.credentialPolicySchemaVersion
+    };
+}
+export function validateActivationIdentity(value) {
+    if (isHistoricalActivationIdentity(value)) {
+        const historical = resolveActivationCompatibility(value, activationCompatibility);
+        if (!historical.compatible)
+            throw new Error(historical.reason);
+    }
+    const typed = validateActivationIdentityShape(value, 'identity');
+    const compatibility = resolveActivationCompatibility(typed, activationCompatibility);
+    if (!compatibility.compatible) {
+        throw new Error(compatibility.reason);
+    }
+    return typed;
+}
+/** Manifest readability is not execution compatibility; historical vectors are never retagged. */
+export function validateReadableActivationIdentity(value) {
+    if (isHistoricalActivationIdentity(value))
+        return { ...value };
+    return validateActivationIdentity(value);
+}
+export function validateManifestActivationForExecution(manifest) {
+    const governance = manifest.governance;
+    if (governance.profile !== 'none' && governance.profile !== 'unspecified' && governance.activationIdentity !== undefined) {
+        validateActivationIdentity(governance.activationIdentity);
+    }
+}
+function hexDigest(value, path) {
+    if (typeof value !== 'string' || !hex64Pattern.test(value)) {
+        throw new Error(`${path} must be a SHA-256 hex digest.`);
+    }
+    return value;
+}
+function isoTimestamp(value, path) {
+    if (typeof value !== 'string' || !isoLikePattern.test(value) || Number.isNaN(Date.parse(value))) {
+        throw new Error(`${path} must be a valid ISO timestamp.`);
+    }
+    return value;
+}
+function dateDaysBetween(start, end) {
+    return (Date.parse(end) - Date.parse(start)) / (24 * 60 * 60 * 1000);
+}
+function addDaysIso(start, days) {
+    return new Date(Date.parse(start) + days * 24 * 60 * 60 * 1000).toISOString();
+}
+function exactStringSet(value, expected, path) {
+    const sortedValue = [...value].sort();
+    const sortedExpected = [...expected].sort();
+    if (sortedValue.length !== sortedExpected.length ||
+        sortedValue.some((entry, index) => entry !== sortedExpected[index])) {
+        throw new Error(`${path} must exactly equal ${expected.join(', ')}.`);
+    }
+    return expected;
+}
+function assertNoDuplicateStrings(value, path) {
+    const seen = new Set();
+    for (const entry of value) {
+        if (seen.has(entry)) {
+            throw new Error(`${path} contains duplicate value ${entry}.`);
+        }
+        seen.add(entry);
+    }
+}
+function validateCredentialRepositoryIdentity(value, path) {
+    const repository = exact(value, ['id', 'owner', 'name', 'fullName'], path);
+    const owner = stringField(repository, 'owner', path);
+    const name = stringField(repository, 'name', path);
+    const fullName = stringField(repository, 'fullName', path);
+    if (fullName !== `${owner}/${name}`) {
+        throw new Error(`${path}.fullName must equal owner/name.`);
+    }
+    return {
+        id: stringField(repository, 'id', path),
+        owner,
+        name,
+        fullName
+    };
+}
+function assertTimestampNotExpired(value, path, now) {
+    if (Date.parse(value) <= now.getTime()) {
+        throw new Error(`${path} must be in the future.`);
+    }
+}
+function validateEvidenceTransitionIdentity(value, path) {
+    const transition = exact(value, ['phaseId', 'baselineSha', 'inputDigest', 'transitionDigest'], path);
+    return {
+        phaseId: enumValue(transition.phaseId, phaseIdSet, `${path}.phaseId`),
+        baselineSha: hexDigest(transition.baselineSha, `${path}.baselineSha`),
+        inputDigest: hexDigest(transition.inputDigest, `${path}.inputDigest`),
+        transitionDigest: hexDigest(transition.transitionDigest, `${path}.transitionDigest`)
+    };
+}
+function validateDependency(value, path) {
+    const dependency = exact(value, ['anyOf', 'accepts', 'description'], path);
+    const anyOf = stringArray(dependency.anyOf, `${path}.anyOf`).map((id) => enumValue(id, phaseIdSet, `${path}.anyOf`));
+    if (anyOf.length === 0) {
+        throw new Error(`${path}.anyOf must not be empty.`);
+    }
+    const accepts = stringArray(dependency.accepts, `${path}.accepts`).map((state) => enumValue(state, terminalPhaseStateSet, `${path}.accepts`));
+    if (accepts.length === 0) {
+        throw new Error(`${path}.accepts must not be empty.`);
+    }
+    return { anyOf, accepts, description: stringField(dependency, 'description', path) };
+}
+function validateApplicability(value, path) {
+    const base = record(value, path);
+    if (base.kind === 'always') {
+        exact(value, ['kind'], path);
+        return { kind: 'always' };
+    }
+    const applicability = exact(value, [
+        'kind',
+        'discriminator',
+        'when',
+        'inapplicableWhen',
+        'exclusiveWith'
+    ], path);
+    enumValue(applicability.kind, new Set(['conditional']), `${path}.kind`);
+    const discriminator = enumValue(applicability.discriminator, new Set(['state-path', 'private-staging-dast', 'credential-required']), `${path}.discriminator`);
+    const exclusiveWith = stringArray(applicability.exclusiveWith, `${path}.exclusiveWith`).map((id) => enumValue(id, phaseIdSet, `${path}.exclusiveWith`));
+    return {
+        kind: 'conditional',
+        discriminator,
+        when: stringField(applicability, 'when', path),
+        inapplicableWhen: stringField(applicability, 'inapplicableWhen', path),
+        exclusiveWith
+    };
+}
+function validateMutations(value, path) {
+    const mutations = exact(value, ['local', 'remote'], path);
+    const mutationSet = new Set(mutationClasses);
+    const local = stringArray(mutations.local, `${path}.local`).map((entry) => enumValue(entry, mutationSet, `${path}.local`));
+    const remote = stringArray(mutations.remote, `${path}.remote`).map((entry) => enumValue(entry, mutationSet, `${path}.remote`));
+    for (const [label, entries] of [['local', local], ['remote', remote]]) {
+        if (entries.length === 0) {
+            throw new Error(`${path}.${label} must not be empty.`);
+        }
+        if (entries.includes('none') && entries.length > 1) {
+            throw new Error(`${path}.${label} cannot combine none with other mutations.`);
+        }
+    }
+    return { local, remote };
+}
+function validateNode(value, path) {
+    const node = exact(value, [
+        'id',
+        'label',
+        'dependencies',
+        'applicability',
+        'allowedMutations',
+        'evidence',
+        'approvalGate',
+        'invalidationInputs',
+        'rollback',
+        'terminalStates'
+    ], path);
+    const id = enumValue(node.id, phaseIdSet, `${path}.id`);
+    const label = stringField(node, 'label', path);
+    if (!Array.isArray(node.dependencies)) {
+        throw new Error(`${path}.dependencies must be an array.`);
+    }
+    const dependencies = node.dependencies.map((dependency, index) => validateDependency(dependency, `${path}.dependencies[${index}]`));
+    const applicability = validateApplicability(node.applicability, `${path}.applicability`);
+    const allowedMutations = validateMutations(node.allowedMutations, `${path}.allowedMutations`);
+    const evidence = exact(node.evidence, ['schema', 'required', 'headerSchemaVersion', 'liveReadbackProviders'], `${path}.evidence`);
+    requireVersion(evidence.headerSchemaVersion, evidenceHeaderSchemaVersion, `${path}.evidence.headerSchemaVersion`);
+    const liveReadbackProviders = stringArray(evidence.liveReadbackProviders, `${path}.evidence.liveReadbackProviders`).map((provider) => enumValue(provider, liveReadbackProviderSet, `${path}.evidence.liveReadbackProviders`));
+    if (new Set(liveReadbackProviders).size !== liveReadbackProviders.length) {
+        throw new Error(`${path}.evidence.liveReadbackProviders must not contain duplicates.`);
+    }
+    const approvalGate = exact(node.approvalGate, ['kind', 'required', 'envelopeSchemaVersion'], `${path}.approvalGate`);
+    const approvalKind = enumValue(approvalGate.kind, new Set(approvalGateKinds), `${path}.approvalGate.kind`);
+    requireVersion(approvalGate.envelopeSchemaVersion, approvalEnvelopeSchemaVersion, `${path}.approvalGate.envelopeSchemaVersion`);
+    const invalidationSet = new Set(invalidationInputKinds);
+    const invalidationInputs = stringArray(node.invalidationInputs, `${path}.invalidationInputs`).map((entry) => enumValue(entry, invalidationSet, `${path}.invalidationInputs`));
+    const rollback = exact(node.rollback, ['kind', 'target', 'description'], `${path}.rollback`);
+    const rollbackKind = enumValue(rollback.kind, new Set(rollbackKinds), `${path}.rollback.kind`);
+    const target = rollback.target === null
+        ? null
+        : enumValue(rollback.target, phaseIdSet, `${path}.rollback.target`);
+    const terminalStates = stringArray(node.terminalStates, `${path}.terminalStates`).map((state) => enumValue(state, terminalPhaseStateSet, `${path}.terminalStates`));
+    if (terminalStates.length === 0) {
+        throw new Error(`${path}.terminalStates must not be empty.`);
+    }
+    return {
+        id,
+        label,
+        dependencies,
+        applicability,
+        allowedMutations,
+        evidence: {
+            schema: stringField(evidence, 'schema', `${path}.evidence`),
+            required: booleanField(evidence, 'required', `${path}.evidence`),
+            headerSchemaVersion: evidenceHeaderSchemaVersion,
+            liveReadbackProviders
+        },
+        approvalGate: {
+            kind: approvalKind,
+            required: booleanField(approvalGate, 'required', `${path}.approvalGate`),
+            envelopeSchemaVersion: approvalEnvelopeSchemaVersion
+        },
+        invalidationInputs,
+        rollback: {
+            kind: rollbackKind,
+            target,
+            description: stringField(rollback, 'description', `${path}.rollback`)
+        },
+        terminalStates
+    };
+}
+function hasDependency(node, phaseId) {
+    return node.dependencies.some((dependency) => dependency.anyOf.includes(phaseId));
+}
+function assertReachableToFinal(nodes) {
+    const adjacency = new Map();
+    for (const id of phaseIds) {
+        adjacency.set(id, []);
+    }
+    for (const node of nodes) {
+        for (const dependency of node.dependencies) {
+            for (const parent of dependency.anyOf) {
+                adjacency.get(parent)?.push(node.id);
+            }
+        }
+    }
+    for (const start of phaseIds) {
+        if (start === 'bootstrap-state-disposed') {
+            continue;
+        }
+        let reachesFinal = false;
+        const seen = new Set();
+        const stack = [start];
+        while (stack.length > 0) {
+            const id = stack.pop();
+            if (id === 'bootstrap-state-disposed') {
+                reachesFinal = true;
+                break;
+            }
+            if (seen.has(id)) {
+                continue;
+            }
+            seen.add(id);
+            stack.push(...(adjacency.get(id) ?? []));
+        }
+        if (!reachesFinal) {
+            throw new Error(`${start} cannot reach terminal bootstrap-state-disposed.`);
+        }
+    }
+}
+export function validateManagedPhaseGraph(value) {
+    const graph = exact(value, ['schemaVersion', 'versions', 'phases'], 'phaseGraph');
+    requireVersion(graph.schemaVersion, phaseGraphSchemaVersion, 'phaseGraph.schemaVersion');
+    const versions = exact(graph.versions, [
+        'liftoffVersion',
+        'policyVersion',
+        'activationContractVersion',
+        'phaseGraphSchemaVersion'
+    ], 'phaseGraph.versions');
+    requireVersion(versions.liftoffVersion, liftoffActivationPackageVersion, 'phaseGraph.versions.liftoffVersion');
+    requireVersion(versions.policyVersion, governanceActivationPolicyVersion, 'phaseGraph.versions.policyVersion');
+    requireVersion(versions.activationContractVersion, activationContractVersion, 'phaseGraph.versions.activationContractVersion');
+    requireVersion(versions.phaseGraphSchemaVersion, phaseGraphSchemaVersion, 'phaseGraph.versions.phaseGraphSchemaVersion');
+    if (!Array.isArray(graph.phases)) {
+        throw new Error('phaseGraph.phases must be an array.');
+    }
+    const nodes = graph.phases.map((node, index) => validateNode(node, `phaseGraph.phases[${index}]`));
+    if (nodes.length !== phaseIds.length) {
+        throw new Error('phaseGraph must declare every canonical phase exactly once.');
+    }
+    const seen = new Set();
+    for (const [index, node] of nodes.entries()) {
+        if (seen.has(node.id)) {
+            throw new Error(`Duplicate phase id ${node.id}.`);
+        }
+        seen.add(node.id);
+        if (node.id !== phaseIds[index]) {
+            throw new Error(`Phase ${node.id} is not in canonical order at index ${index}.`);
+        }
+        for (const dependency of node.dependencies) {
+            for (const dependencyId of dependency.anyOf) {
+                const dependencyIndex = phaseIds.indexOf(dependencyId);
+                if (dependencyIndex >= index) {
+                    throw new Error(`Reversed dependency order: ${node.id} depends on ${dependencyId}.`);
+                }
+            }
+        }
+        if (node.rollback.target !== null && phaseIds.indexOf(node.rollback.target) >= index) {
+            throw new Error(`Rollback target for ${node.id} must be an earlier phase.`);
+        }
+        if (node.approvalGate.required && node.approvalGate.kind === 'none') {
+            throw new Error(`${node.id} cannot require approval gate none.`);
+        }
+        if (!node.approvalGate.required && node.approvalGate.kind !== 'none') {
+            throw new Error(`${node.id} has a non-none optional approval gate.`);
+        }
+        const requiredLiveReadbackProviders = [
+            ...(node.allowedMutations.remote.some((mutation) => githubRemoteWriteMutations.has(mutation)) ? ['github'] : []),
+            ...(node.allowedMutations.remote.some((mutation) => azureRemoteWriteMutations.has(mutation)) ? ['azure'] : [])
+        ];
+        for (const provider of requiredLiveReadbackProviders) {
+            if (!node.evidence.liveReadbackProviders.includes(provider)) {
+                throw new Error(`${node.id} must declare ${provider} live readback proof for remote mutation evidence.`);
+            }
+        }
+        if (node.applicability.kind === 'conditional') {
+            for (const exclusiveId of node.applicability.exclusiveWith) {
+                const other = nodes.find((candidate) => candidate.id === exclusiveId);
+                if (!other || other.applicability.kind !== 'conditional') {
+                    throw new Error(`${node.id} exclusive phase ${exclusiveId} must be conditional.`);
+                }
+            }
+            if (!node.terminalStates.includes('inapplicable')) {
+                throw new Error(`${node.id} conditional phase must permit inapplicable terminal state.`);
+            }
+        }
+    }
+    for (const id of phaseIds) {
+        if (!seen.has(id)) {
+            throw new Error(`Missing canonical phase ${id}.`);
+        }
+    }
+    const byId = Object.fromEntries(nodes.map((node) => [node.id, node]));
+    if (!hasDependency(byId['bootstrap-local'], 'provider-ready')) {
+        throw new Error('bootstrap-local must depend on provider-ready.');
+    }
+    if (!hasDependency(byId['private-backend-proof'], 'runner-ready')) {
+        throw new Error('private-backend-proof must depend on runner-ready.');
+    }
+    if (!hasDependency(byId['remote-import-verified'], 'private-backend-proof')) {
+        throw new Error('remote-import-verified must depend on private-backend-proof.');
+    }
+    if (!hasDependency(byId['remote-ready'], 'remote-import-verified')) {
+        throw new Error('remote-ready must depend on remote-import-verified.');
+    }
+    const visiting = new Set();
+    const visited = new Set();
+    const visit = (id) => {
+        if (visiting.has(id)) {
+            throw new Error(`Cycle detected at ${id}.`);
+        }
+        if (visited.has(id)) {
+            return;
+        }
+        visiting.add(id);
+        for (const dependency of byId[id].dependencies) {
+            for (const dependencyId of dependency.anyOf) {
+                visit(dependencyId);
+            }
+        }
+        visiting.delete(id);
+        visited.add(id);
+    };
+    for (const id of phaseIds) {
+        visit(id);
+    }
+    assertReachableToFinal(nodes);
+    return {
+        schemaVersion: phaseGraphSchemaVersion,
+        versions: {
+            liftoffVersion: liftoffActivationPackageVersion,
+            policyVersion: governanceActivationPolicyVersion,
+            activationContractVersion,
+            phaseGraphSchemaVersion
+        },
+        phases: nodes
+    };
+}
+export function assertCanonicalGraphValid() {
+    validateManagedPhaseGraph(canonicalPhaseGraph);
+}
+function validateEvidenceReference(value, path) {
+    const reference = exact(value, ['phaseId', 'evidenceId', 'headerDigest', 'result'], path);
+    const phaseId = enumValue(reference.phaseId, phaseIdSet, `${path}.phaseId`);
+    const result = enumValue(reference.result, resultStateSet, `${path}.result`);
+    const headerDigest = stringField(reference, 'headerDigest', path);
+    if (!hex64Pattern.test(headerDigest)) {
+        throw new Error(`${path}.headerDigest must be a SHA-256 hex digest.`);
+    }
+    return {
+        phaseId,
+        evidenceId: stringField(reference, 'evidenceId', path),
+        headerDigest,
+        result
+    };
+}
+export function validateUserActivationState(value) {
+    const state = exactWithOptional(value, [
+        'schemaVersion',
+        'identity',
+        'repository',
+        'activeChange',
+        'applicability',
+        'phases',
+        'createdAt',
+        'updatedAt'
+    ], ['bootstrapState', 'remoteBinding'], 'activationState');
+    requireVersion(state.schemaVersion, activationStateSchemaVersion, 'activationState.schemaVersion');
+    const identity = validateActivationIdentity(state.identity);
+    if (identity.phaseGraphHash !== canonicalPhaseGraphHash) {
+        throw new Error('activationState.identity.phaseGraphHash does not match canonical graph.');
+    }
+    const repository = exact(state.repository, ['id', 'name', 'defaultBranch'], 'activationState.repository');
+    if (repository.id === 'unbound')
+        throw new Error('Persisted activation state must have an explicitly established immutable local execution anchor.');
+    let remoteBinding;
+    if (state.remoteBinding !== undefined) {
+        const binding = exact(state.remoteBinding, ['id', 'name', 'defaultBranch', 'pushUrl', 'verifiedAt'], 'activationState.remoteBinding');
+        remoteBinding = {
+            id: stringField(binding, 'id', 'activationState.remoteBinding'),
+            name: stringField(binding, 'name', 'activationState.remoteBinding'),
+            defaultBranch: stringField(binding, 'defaultBranch', 'activationState.remoteBinding'),
+            pushUrl: stringField(binding, 'pushUrl', 'activationState.remoteBinding'),
+            verifiedAt: isoTimestamp(binding.verifiedAt, 'activationState.remoteBinding.verifiedAt')
+        };
+        const remote = /^(?:https:\/\/github\.com\/|git@github\.com:)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/.exec(remoteBinding.pushUrl);
+        if (!remote || remote[1].toLowerCase() !== remoteBinding.name.toLowerCase()) {
+            throw new Error('activationState.remoteBinding must match one credential-free GitHub push destination.');
+        }
+    }
+    let activeChange = null;
+    if (state.activeChange !== null) {
+        const change = exact(state.activeChange, ['id', 'kind'], 'activationState.activeChange');
+        activeChange = {
+            id: stringField(change, 'id', 'activationState.activeChange'),
+            kind: enumValue(change.kind, new Set(['openspec', 'spec-kit']), 'activationState.activeChange.kind')
+        };
+    }
+    const applicability = exact(state.applicability, [
+        'statePath',
+        'privateStagingDast',
+        'credentialRequired'
+    ], 'activationState.applicability');
+    const phases = record(state.phases, 'activationState.phases');
+    const phaseStatesById = {};
+    for (const id of phaseIds) {
+        if (!Object.hasOwn(phases, id)) {
+            throw new Error(`activationState.phases.${id} is required.`);
+        }
+        const phase = exact(phases[id], ['state', 'updatedAt', 'evidence', 'approvals', 'blockers'], `activationState.phases.${id}`);
+        const phaseState = enumValue(phase.state, new Set(phaseStates), `activationState.phases.${id}.state`);
+        if (!Array.isArray(phase.evidence) || !Array.isArray(phase.approvals) || !Array.isArray(phase.blockers)) {
+            throw new Error(`activationState.phases.${id} evidence, approvals, and blockers must be arrays.`);
+        }
+        phaseStatesById[id] = {
+            state: phaseState,
+            updatedAt: stringField(phase, 'updatedAt', `activationState.phases.${id}`),
+            evidence: phase.evidence.map((entry, index) => validateEvidenceReference(entry, `activationState.phases.${id}.evidence[${index}]`)),
+            approvals: stringArray(phase.approvals, `activationState.phases.${id}.approvals`),
+            blockers: stringArray(phase.blockers, `activationState.phases.${id}.blockers`)
+        };
+    }
+    for (const key of Object.keys(phases)) {
+        if (!phaseIdSet.has(key)) {
+            throw new Error(`activationState.phases.${key} is not a canonical phase.`);
+        }
+    }
+    let bootstrapState;
+    if (state.bootstrapState !== undefined) {
+        const retention = exactWithOptional(state.bootstrapState, [
+            'status',
+            'remoteImportEvidenceId',
+            'remoteImportEvidenceDigest',
+            'retainedAt',
+            'disposeAfter',
+            'encryptedStatePathParts',
+            'encryptionKeyPathParts'
+        ], ['disposedAt', 'deletionEvidenceId', 'incompleteCleanup'], 'activationState.bootstrapState');
+        const retainedAt = isoTimestamp(retention.retainedAt, 'activationState.bootstrapState.retainedAt');
+        const disposeAfter = isoTimestamp(retention.disposeAfter, 'activationState.bootstrapState.disposeAfter');
+        if (Date.parse(disposeAfter) - Date.parse(retainedAt) !== 30 * 24 * 60 * 60 * 1000) {
+            throw new Error('activationState.bootstrapState.disposeAfter must be exactly 30 days after retainedAt.');
+        }
+        const status = enumValue(retention.status, new Set(['retained', 'disposed']), 'activationState.bootstrapState.status');
+        if (status === 'disposed' && retention.disposedAt === undefined) {
+            throw new Error('activationState.bootstrapState.disposedAt is required when status is disposed.');
+        }
+        bootstrapState = {
+            status,
+            remoteImportEvidenceId: stringField(retention, 'remoteImportEvidenceId', 'activationState.bootstrapState'),
+            remoteImportEvidenceDigest: hexDigest(retention.remoteImportEvidenceDigest, 'activationState.bootstrapState.remoteImportEvidenceDigest'),
+            retainedAt,
+            disposeAfter,
+            encryptedStatePathParts: pathPartsArray(retention.encryptedStatePathParts, 'activationState.bootstrapState.encryptedStatePathParts'),
+            encryptionKeyPathParts: pathPartsArray(retention.encryptionKeyPathParts, 'activationState.bootstrapState.encryptionKeyPathParts'),
+            ...(retention.disposedAt !== undefined ? { disposedAt: isoTimestamp(retention.disposedAt, 'activationState.bootstrapState.disposedAt') } : {}),
+            ...(retention.deletionEvidenceId !== undefined ? { deletionEvidenceId: stringField(retention, 'deletionEvidenceId', 'activationState.bootstrapState') } : {}),
+            ...(retention.incompleteCleanup !== undefined ? { incompleteCleanup: stringArray(retention.incompleteCleanup, 'activationState.bootstrapState.incompleteCleanup') } : {})
+        };
+    }
+    return {
+        schemaVersion: activationStateSchemaVersion,
+        identity,
+        repository: {
+            id: stringField(repository, 'id', 'activationState.repository'),
+            name: stringField(repository, 'name', 'activationState.repository'),
+            defaultBranch: stringField(repository, 'defaultBranch', 'activationState.repository')
+        },
+        activeChange,
+        applicability: {
+            statePath: enumValue(applicability.statePath, new Set(['existing-private', 'bootstrap-local', 'none']), 'activationState.applicability.statePath'),
+            privateStagingDast: applicability.privateStagingDast === 'unknown' ? 'unknown' : booleanField(applicability, 'privateStagingDast', 'activationState.applicability'),
+            credentialRequired: applicability.credentialRequired === 'unknown' ? 'unknown' : booleanField(applicability, 'credentialRequired', 'activationState.applicability')
+        },
+        ...(remoteBinding ? { remoteBinding } : {}),
+        ...(bootstrapState ? { bootstrapState } : {}),
+        phases: phaseStatesById,
+        createdAt: stringField(state, 'createdAt', 'activationState'),
+        updatedAt: stringField(state, 'updatedAt', 'activationState')
+    };
+}
+export function validateEvidenceHeader(value) {
+    const header = exactWithOptional(value, [
+        'schemaVersion',
+        'repositoryId',
+        'identity',
+        'phaseGraphHash',
+        'phaseId',
+        'phaseContractDigest',
+        'inputDigest',
+        'baselineSha',
+        'transition',
+        'producedAt',
+        'producer',
+        'bodyDigest',
+        'result'
+    ], ['remoteBindingDigest'], 'evidenceHeader');
+    requireVersion(header.schemaVersion, evidenceHeaderSchemaVersion, 'evidenceHeader.schemaVersion');
+    const identity = validateActivationIdentity(header.identity);
+    const phaseGraphHash = hexDigest(header.phaseGraphHash, 'evidenceHeader.phaseGraphHash');
+    if (phaseGraphHash !== identity.phaseGraphHash) {
+        throw new Error('evidenceHeader.phaseGraphHash must match evidenceHeader.identity.phaseGraphHash.');
+    }
+    const phaseId = enumValue(header.phaseId, phaseIdSet, 'evidenceHeader.phaseId');
+    const phaseContractDigest = hexDigest(header.phaseContractDigest, 'evidenceHeader.phaseContractDigest');
+    const inputDigest = hexDigest(header.inputDigest, 'evidenceHeader.inputDigest');
+    const baselineSha = hexDigest(header.baselineSha, 'evidenceHeader.baselineSha');
+    const transition = validateEvidenceTransitionIdentity(header.transition, 'evidenceHeader.transition');
+    if (transition.phaseId !== phaseId) {
+        throw new Error('evidenceHeader.transition.phaseId must match evidenceHeader.phaseId.');
+    }
+    if (transition.baselineSha !== baselineSha) {
+        throw new Error('evidenceHeader.transition.baselineSha must match evidenceHeader.baselineSha.');
+    }
+    if (transition.inputDigest !== inputDigest) {
+        throw new Error('evidenceHeader.transition.inputDigest must match evidenceHeader.inputDigest.');
+    }
+    return {
+        schemaVersion: evidenceHeaderSchemaVersion,
+        repositoryId: stringField(header, 'repositoryId', 'evidenceHeader'),
+        identity,
+        phaseGraphHash,
+        phaseId,
+        phaseContractDigest,
+        inputDigest,
+        baselineSha,
+        transition,
+        producedAt: isoTimestamp(header.producedAt, 'evidenceHeader.producedAt'),
+        producer: stringField(header, 'producer', 'evidenceHeader'),
+        bodyDigest: hexDigest(header.bodyDigest, 'evidenceHeader.bodyDigest'),
+        ...(header.remoteBindingDigest !== undefined ? {
+            remoteBindingDigest: hexDigest(header.remoteBindingDigest, 'evidenceHeader.remoteBindingDigest')
+        } : {}),
+        result: enumValue(header.result, resultStateSet, 'evidenceHeader.result')
+    };
+}
+export function validateLiveReadbackProof(value) {
+    const proof = exact(value, [
+        'schemaVersion',
+        'repositoryId',
+        'identity',
+        'phaseGraphHash',
+        'phaseId',
+        'baselineSha',
+        'inputDigest',
+        'transition',
+        'observedAt',
+        'provider',
+        'resourceType',
+        'resourceId',
+        'sourceDigest',
+        'readbackDigest',
+        'matches'
+    ], 'liveReadbackProof');
+    requireVersion(proof.schemaVersion, evidenceHeaderSchemaVersion, 'liveReadbackProof.schemaVersion');
+    const identity = validateActivationIdentity(proof.identity);
+    const phaseGraphHash = hexDigest(proof.phaseGraphHash, 'liveReadbackProof.phaseGraphHash');
+    if (phaseGraphHash !== identity.phaseGraphHash) {
+        throw new Error('liveReadbackProof.phaseGraphHash must match liveReadbackProof.identity.phaseGraphHash.');
+    }
+    const phaseId = enumValue(proof.phaseId, phaseIdSet, 'liveReadbackProof.phaseId');
+    const baselineSha = hexDigest(proof.baselineSha, 'liveReadbackProof.baselineSha');
+    const inputDigest = hexDigest(proof.inputDigest, 'liveReadbackProof.inputDigest');
+    const transition = validateEvidenceTransitionIdentity(proof.transition, 'liveReadbackProof.transition');
+    if (transition.phaseId !== phaseId) {
+        throw new Error('liveReadbackProof.transition.phaseId must match liveReadbackProof.phaseId.');
+    }
+    if (transition.baselineSha !== baselineSha) {
+        throw new Error('liveReadbackProof.transition.baselineSha must match liveReadbackProof.baselineSha.');
+    }
+    if (transition.inputDigest !== inputDigest) {
+        throw new Error('liveReadbackProof.transition.inputDigest must match liveReadbackProof.inputDigest.');
+    }
+    return {
+        schemaVersion: evidenceHeaderSchemaVersion,
+        repositoryId: stringField(proof, 'repositoryId', 'liveReadbackProof'),
+        identity,
+        phaseGraphHash,
+        phaseId,
+        baselineSha,
+        inputDigest,
+        transition,
+        observedAt: isoTimestamp(proof.observedAt, 'liveReadbackProof.observedAt'),
+        provider: enumValue(proof.provider, new Set(['github', 'azure']), 'liveReadbackProof.provider'),
+        resourceType: stringField(proof, 'resourceType', 'liveReadbackProof'),
+        resourceId: stringField(proof, 'resourceId', 'liveReadbackProof'),
+        sourceDigest: hexDigest(proof.sourceDigest, 'liveReadbackProof.sourceDigest'),
+        readbackDigest: hexDigest(proof.readbackDigest, 'liveReadbackProof.readbackDigest'),
+        matches: booleanField(proof, 'matches', 'liveReadbackProof')
+    };
+}
+function validateApprovalResource(value, path) {
+    const resource = exact(value, ['type', 'identity'], path);
+    return {
+        type: stringField(resource, 'type', path),
+        identity: stringField(resource, 'identity', path)
+    };
+}
+function validateApprovalDestination(value, path) {
+    const destination = exact(value, ['type', 'identity', 'repository', 'subscriptionId'], path);
+    return {
+        type: enumValue(destination.type, new Set(['repository', 'subscription', 'environment', 'tenant', 'local', 'external']), `${path}.type`),
+        identity: stringField(destination, 'identity', path),
+        repository: destination.repository === null ? null : stringField(destination, 'repository', path),
+        subscriptionId: destination.subscriptionId === null ? null : stringField(destination, 'subscriptionId', path)
+    };
+}
+function identityMatches(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+export function validateApprovalEnvelope(value, options = {}) {
+    const envelope = exact(value, [
+        'schemaVersion',
+        'id',
+        'phaseId',
+        'gateKind',
+        'identity',
+        'baselineSha',
+        'planDigest',
+        'resources',
+        'destinations',
+        'permissions',
+        'costCeiling',
+        'policyExceptions',
+        'destructiveScope',
+        'expiresAt',
+        'approvedAt',
+        'approver'
+    ], 'approvalEnvelope');
+    requireVersion(envelope.schemaVersion, approvalEnvelopeSchemaVersion, 'approvalEnvelope.schemaVersion');
+    const cost = exact(envelope.costCeiling, [
+        'currency',
+        'fixedMonthlyCents',
+        'usageMonthlyCents'
+    ], 'approvalEnvelope.costCeiling');
+    const baselineSha = stringField(envelope, 'baselineSha', 'approvalEnvelope');
+    const planDigest = stringField(envelope, 'planDigest', 'approvalEnvelope');
+    if (!hex64Pattern.test(baselineSha) || !hex64Pattern.test(planDigest)) {
+        throw new Error('approvalEnvelope baselineSha and planDigest must be SHA-256 hex digests.');
+    }
+    const identity = validateActivationIdentity(envelope.identity);
+    if (options.expectedIdentity && !identityMatches(identity, options.expectedIdentity)) {
+        throw new Error('approvalEnvelope.identity does not match the active activation identity.');
+    }
+    const expiresAt = isoTimestamp(envelope.expiresAt, 'approvalEnvelope.expiresAt');
+    const approvedAt = isoTimestamp(envelope.approvedAt, 'approvalEnvelope.approvedAt');
+    if (Date.parse(approvedAt) >= Date.parse(expiresAt))
+        throw new Error('Approval requires approvedAt < expiresAt.');
+    if (options.requireUnexpired) {
+        assertTimestampNotExpired(expiresAt, 'approvalEnvelope.expiresAt', options.now ?? new Date());
+        if (Date.parse(approvedAt) > (options.now ?? new Date()).getTime())
+            throw new Error('Approval approvedAt is in the future.');
+    }
+    const resources = Array.isArray(envelope.resources)
+        ? normalizeApprovalResources(envelope.resources.map((entry, index) => validateApprovalResource(entry, `approvalEnvelope.resources[${index}]`)))
+        : (() => { throw new Error('approvalEnvelope.resources must be an array.'); })();
+    const destinations = Array.isArray(envelope.destinations)
+        ? normalizeApprovalDestinations(envelope.destinations.map((entry, index) => validateApprovalDestination(entry, `approvalEnvelope.destinations[${index}]`)))
+        : (() => { throw new Error('approvalEnvelope.destinations must be an array.'); })();
+    const permissions = normalizeApprovalPermissions(stringArray(envelope.permissions, 'approvalEnvelope.permissions'));
+    const policyExceptions = normalizeApprovalPolicyExceptions(stringArray(envelope.policyExceptions, 'approvalEnvelope.policyExceptions'));
+    const destructiveScope = normalizeApprovalDestructiveScope(stringArray(envelope.destructiveScope, 'approvalEnvelope.destructiveScope'));
+    const costCeiling = normalizeApprovalCostCeiling({
+        currency: stringField(cost, 'currency', 'approvalEnvelope.costCeiling'),
+        fixedMonthlyCents: integerField(cost, 'fixedMonthlyCents', 'approvalEnvelope.costCeiling'),
+        usageMonthlyCents: integerField(cost, 'usageMonthlyCents', 'approvalEnvelope.costCeiling')
+    });
+    const phaseId = enumValue(envelope.phaseId, phaseIdSet, 'approvalEnvelope.phaseId');
+    const gateKind = enumValue(envelope.gateKind, new Set(approvalGateKinds), 'approvalEnvelope.gateKind');
+    const expectedGateKind = canonicalPhaseGraph.phases.find((phase) => phase.id === phaseId)?.approvalGate.kind;
+    if (expectedGateKind !== gateKind) {
+        throw new Error(`approvalEnvelope.gateKind ${gateKind} does not match phase ${phaseId} gate ${expectedGateKind}.`);
+    }
+    return {
+        schemaVersion: approvalEnvelopeSchemaVersion,
+        id: stringField(envelope, 'id', 'approvalEnvelope'),
+        phaseId,
+        gateKind,
+        identity,
+        baselineSha,
+        planDigest,
+        resources,
+        destinations,
+        permissions,
+        costCeiling,
+        policyExceptions,
+        destructiveScope,
+        expiresAt,
+        approvedAt,
+        approver: stringField(envelope, 'approver', 'approvalEnvelope')
+    };
+}
+function validateOperationDestination(value, path) {
+    const destination = exactWithOptional(value, ['type', 'identity'], ['pathParts', 'repository', 'subscriptionId', 'ref'], path);
+    const normalized = {
+        type: enumValue(destination.type, new Set(['local', 'repository', 'subscription', 'environment', 'tenant', 'external']), `${path}.type`),
+        identity: stringField(destination, 'identity', path),
+        ...(destination.pathParts !== undefined ? { pathParts: stringArray(destination.pathParts, `${path}.pathParts`) } : {}),
+        ...(destination.repository !== undefined ? { repository: stringField(destination, 'repository', path) } : {}),
+        ...(destination.subscriptionId !== undefined ? { subscriptionId: stringField(destination, 'subscriptionId', path) } : {}),
+        ...(destination.ref !== undefined ? { ref: stringField(destination, 'ref', path) } : {})
+    };
+    return normalized;
+}
+function validateTransitionOperation(value, path) {
+    const operation = exact(value, [
+        'adapter',
+        'actionId',
+        'mutationClass',
+        'phaseId',
+        'inputs',
+        'destination',
+        'remote',
+        'destructive'
+    ], path);
+    return {
+        adapter: enumValue(operation.adapter, transitionAdapterIds, `${path}.adapter`),
+        actionId: stringField(operation, 'actionId', path),
+        mutationClass: enumValue(operation.mutationClass, new Set(mutationClasses), `${path}.mutationClass`),
+        phaseId: enumValue(operation.phaseId, phaseIdSet, `${path}.phaseId`),
+        inputs: record(operation.inputs, `${path}.inputs`),
+        destination: validateOperationDestination(operation.destination, `${path}.destination`),
+        remote: booleanField(operation, 'remote', path),
+        destructive: booleanField(operation, 'destructive', path)
+    };
+}
+function validateApprovalEvaluation(value, path) {
+    const evaluation = exact(value, [
+        'phaseId',
+        'gateKind',
+        'questionKind',
+        'approvalRequired',
+        'status',
+        'envelopeId',
+        'envelopeHash',
+        'reasons',
+        'expansionReasons'
+    ], path);
+    const question = evaluation.questionKind === null
+        ? null
+        : enumValue(evaluation.questionKind, new Set([
+            'repository-creation-initial-commit-push',
+            'credential-enrollment',
+            'billed-infrastructure-policy-exception-cost-ceiling',
+            'final-enforcement',
+            'destructive-operation',
+            'external-blocker'
+        ]), `${path}.questionKind`);
+    const envelopeHash = evaluation.envelopeHash === null
+        ? null
+        : hexDigest(evaluation.envelopeHash, `${path}.envelopeHash`);
+    return {
+        phaseId: enumValue(evaluation.phaseId, phaseIdSet, `${path}.phaseId`),
+        gateKind: enumValue(evaluation.gateKind, new Set(approvalGateKinds), `${path}.gateKind`),
+        questionKind: question,
+        approvalRequired: booleanField(evaluation, 'approvalRequired', path),
+        status: enumValue(evaluation.status, new Set(['not-required', 'approval-required', 'reused', 'expired', 'invalidated']), `${path}.status`),
+        envelopeId: evaluation.envelopeId === null ? null : stringField(evaluation, 'envelopeId', path),
+        envelopeHash,
+        reasons: stringArray(evaluation.reasons, `${path}.reasons`),
+        expansionReasons: stringArray(evaluation.expansionReasons, `${path}.expansionReasons`)
+    };
+}
+function validateRollbackPlan(value, path) {
+    const rollbackPlan = exact(value, [
+        'phaseId',
+        'strategy',
+        'target',
+        'operations',
+        'retained',
+        'cleanupWarnings'
+    ], path);
+    return {
+        phaseId: enumValue(rollbackPlan.phaseId, phaseIdSet, `${path}.phaseId`),
+        strategy: enumValue(rollbackPlan.strategy, new Set(rollbackKinds), `${path}.strategy`),
+        target: rollbackPlan.target === null ? null : enumValue(rollbackPlan.target, phaseIdSet, `${path}.target`),
+        operations: Array.isArray(rollbackPlan.operations)
+            ? rollbackPlan.operations.map((operation, index) => {
+                const validated = validateTransitionOperation(operation, `${path}.operations[${index}]`);
+                return {
+                    adapter: validated.adapter,
+                    actionId: validated.actionId,
+                    mutationClass: validated.mutationClass,
+                    phaseId: validated.phaseId,
+                    inputs: validated.inputs,
+                    destination: validated.destination,
+                    remote: validated.remote,
+                    destructive: validated.destructive
+                };
+            })
+            : (() => { throw new Error(`${path}.operations must be an array.`); })(),
+        retained: stringArray(rollbackPlan.retained, `${path}.retained`),
+        cleanupWarnings: stringArray(rollbackPlan.cleanupWarnings, `${path}.cleanupWarnings`)
+    };
+}
+export function validateSavedTransitionPlan(value) {
+    const plan = exact(value, [
+        'schemaVersion',
+        'phaseId',
+        'createdAt',
+        'expiresAt',
+        'identity',
+        'graphHash',
+        'stateHash',
+        'baselineDigest',
+        'inputDigest',
+        'transitionDigest',
+        'planDigest',
+        'mutationClasses',
+        'operations',
+        'approval',
+        'rollbackPlan',
+        'noSecrets'
+    ], 'transitionPlan');
+    requireVersion(plan.schemaVersion, 1, 'transitionPlan.schemaVersion');
+    const identity = validateActivationIdentity(plan.identity);
+    const graphHash = hexDigest(plan.graphHash, 'transitionPlan.graphHash');
+    if (graphHash !== identity.phaseGraphHash) {
+        throw new Error('transitionPlan.graphHash must match identity.phaseGraphHash.');
+    }
+    const phaseId = enumValue(plan.phaseId, phaseIdSet, 'transitionPlan.phaseId');
+    const mutationClassesValue = exact(plan.mutationClasses, ['local', 'remote'], 'transitionPlan.mutationClasses');
+    const approval = exact(plan.approval, [
+        'gateKind',
+        'required',
+        'evaluation',
+        'envelopeId',
+        'envelopeHash'
+    ], 'transitionPlan.approval');
+    const operations = Array.isArray(plan.operations)
+        ? plan.operations.map((operation, index) => validateTransitionOperation(operation, `transitionPlan.operations[${index}]`))
+        : (() => { throw new Error('transitionPlan.operations must be an array.'); })();
+    for (const operation of operations) {
+        if (operation.phaseId !== phaseId) {
+            throw new Error(`transitionPlan operation ${operation.actionId} phaseId must match ${phaseId}.`);
+        }
+    }
+    const evaluation = validateApprovalEvaluation(approval.evaluation, 'transitionPlan.approval.evaluation');
+    const envelopeHash = approval.envelopeHash === null
+        ? null
+        : hexDigest(approval.envelopeHash, 'transitionPlan.approval.envelopeHash');
+    return {
+        schemaVersion: 1,
+        phaseId,
+        createdAt: isoTimestamp(plan.createdAt, 'transitionPlan.createdAt'),
+        expiresAt: isoTimestamp(plan.expiresAt, 'transitionPlan.expiresAt'),
+        identity,
+        graphHash,
+        stateHash: plan.stateHash === null ? null : hexDigest(plan.stateHash, 'transitionPlan.stateHash'),
+        baselineDigest: hexDigest(plan.baselineDigest, 'transitionPlan.baselineDigest'),
+        inputDigest: hexDigest(plan.inputDigest, 'transitionPlan.inputDigest'),
+        transitionDigest: hexDigest(plan.transitionDigest, 'transitionPlan.transitionDigest'),
+        planDigest: hexDigest(plan.planDigest, 'transitionPlan.planDigest'),
+        mutationClasses: {
+            local: stringArray(mutationClassesValue.local, 'transitionPlan.mutationClasses.local').map((entry) => enumValue(entry, new Set(mutationClasses), 'transitionPlan.mutationClasses.local')),
+            remote: stringArray(mutationClassesValue.remote, 'transitionPlan.mutationClasses.remote').map((entry) => enumValue(entry, new Set(mutationClasses), 'transitionPlan.mutationClasses.remote'))
+        },
+        operations,
+        approval: {
+            gateKind: enumValue(approval.gateKind, new Set(approvalGateKinds), 'transitionPlan.approval.gateKind'),
+            required: booleanField(approval, 'required', 'transitionPlan.approval'),
+            evaluation,
+            envelopeId: approval.envelopeId === null ? null : stringField(approval, 'envelopeId', 'transitionPlan.approval'),
+            envelopeHash
+        },
+        rollbackPlan: validateRollbackPlan(plan.rollbackPlan, 'transitionPlan.rollbackPlan'),
+        noSecrets: plan.noSecrets === true ? true : (() => { throw new Error('transitionPlan.noSecrets must be true.'); })()
+    };
+}
+export function validateSupersessionRecord(value) {
+    const supersession = exact(value, [
+        'schemaVersion',
+        'identity',
+        'supersededChangeId',
+        'supersedingChangeId',
+        'reason',
+        'approvedAt',
+        'approver'
+    ], 'supersession');
+    requireVersion(supersession.schemaVersion, supersessionSchemaVersion, 'supersession.schemaVersion');
+    return {
+        schemaVersion: supersessionSchemaVersion,
+        identity: validateActivationIdentity(supersession.identity),
+        supersededChangeId: stringField(supersession, 'supersededChangeId', 'supersession'),
+        supersedingChangeId: stringField(supersession, 'supersedingChangeId', 'supersession'),
+        reason: stringField(supersession, 'reason', 'supersession'),
+        approvedAt: stringField(supersession, 'approvedAt', 'supersession'),
+        approver: stringField(supersession, 'approver', 'supersession')
+    };
+}
+export function validateGraphReconciliationRecord(value, recognizedGraphHashes = new Set([canonicalPhaseGraphHash])) {
+    const reconciliation = exact(value, [
+        'schemaVersion',
+        'fromGraphHash',
+        'toGraphHash',
+        'fromIdentity',
+        'toIdentity',
+        'phaseMappings',
+        'reconciledAt',
+        'producer'
+    ], 'graphReconciliation');
+    requireVersion(reconciliation.schemaVersion, activationStateSchemaVersion, 'graphReconciliation.schemaVersion');
+    const fromGraphHash = hexDigest(reconciliation.fromGraphHash, 'graphReconciliation.fromGraphHash');
+    const toGraphHash = hexDigest(reconciliation.toGraphHash, 'graphReconciliation.toGraphHash');
+    if (!recognizedGraphHashes.has(fromGraphHash)) {
+        throw new Error(`graphReconciliation.fromGraphHash is not a recognized graph hash: ${fromGraphHash}.`);
+    }
+    if (!recognizedGraphHashes.has(toGraphHash)) {
+        throw new Error(`graphReconciliation.toGraphHash is not a recognized graph hash: ${toGraphHash}.`);
+    }
+    const fromIdentity = validateActivationIdentityShape(reconciliation.fromIdentity, 'graphReconciliation.fromIdentity');
+    const toIdentity = validateActivationIdentityShape(reconciliation.toIdentity, 'graphReconciliation.toIdentity');
+    if (fromIdentity.phaseGraphHash !== fromGraphHash) {
+        throw new Error('graphReconciliation.fromIdentity.phaseGraphHash must match fromGraphHash.');
+    }
+    if (toIdentity.phaseGraphHash !== toGraphHash) {
+        throw new Error('graphReconciliation.toIdentity.phaseGraphHash must match toGraphHash.');
+    }
+    if (!Array.isArray(reconciliation.phaseMappings)) {
+        throw new Error('graphReconciliation.phaseMappings must be an array.');
+    }
+    const seen = new Set();
+    const phaseMappings = reconciliation.phaseMappings.map((entry, index) => {
+        const mapping = exact(entry, [
+            'phaseId',
+            'fromContractDigest',
+            'toContractDigest',
+            'preserveEvidence'
+        ], `graphReconciliation.phaseMappings[${index}]`);
+        const phaseId = enumValue(mapping.phaseId, phaseIdSet, `graphReconciliation.phaseMappings[${index}].phaseId`);
+        if (seen.has(phaseId)) {
+            throw new Error(`graphReconciliation.phaseMappings contains duplicate phase ${phaseId}.`);
+        }
+        seen.add(phaseId);
+        const fromContractDigest = hexDigest(mapping.fromContractDigest, `graphReconciliation.phaseMappings[${index}].fromContractDigest`);
+        const toContractDigest = hexDigest(mapping.toContractDigest, `graphReconciliation.phaseMappings[${index}].toContractDigest`);
+        const preserveEvidence = booleanField(mapping, 'preserveEvidence', `graphReconciliation.phaseMappings[${index}]`);
+        if (preserveEvidence && fromContractDigest !== toContractDigest) {
+            throw new Error(`graphReconciliation.phaseMappings[${index}] cannot preserve evidence for changed phase ${phaseId}.`);
+        }
+        return {
+            phaseId,
+            fromContractDigest,
+            toContractDigest,
+            preserveEvidence
+        };
+    });
+    for (const phaseId of phaseIds) {
+        if (!seen.has(phaseId)) {
+            throw new Error(`graphReconciliation.phaseMappings.${phaseId} is required.`);
+        }
+    }
+    return {
+        schemaVersion: activationStateSchemaVersion,
+        fromGraphHash,
+        toGraphHash,
+        fromIdentity,
+        toIdentity,
+        phaseMappings,
+        reconciledAt: isoTimestamp(reconciliation.reconciledAt, 'graphReconciliation.reconciledAt'),
+        producer: stringField(reconciliation, 'producer', 'graphReconciliation')
+    };
+}
+export function validateCredentialPolicy(value) {
+    const policy = exact(value, [
+        'schemaVersion',
+        'identity',
+        'repository',
+        'owner',
+        'authKind',
+        'displayNameTemplate',
+        'displayName',
+        'secretName',
+        'createdAt',
+        'expiresAt',
+        'rotationLeadDays',
+        'rotationDueAt',
+        'permissions',
+        'allowedWorkflows',
+        'nonForwarding',
+        'status',
+        'proof',
+        'app',
+        'pat'
+    ], 'credentialPolicy');
+    requireVersion(policy.schemaVersion, credentialPolicySchemaVersion, 'credentialPolicy.schemaVersion');
+    const permissions = exact(policy.permissions, ['repository', 'organization'], 'credentialPolicy.permissions');
+    if (policy.nonForwarding !== true) {
+        throw new Error('credentialPolicy.nonForwarding must be true.');
+    }
+    if (policy.secretName !== runnerPreflightSecretName) {
+        throw new Error(`credentialPolicy.secretName must be ${runnerPreflightSecretName}.`);
+    }
+    if (policy.displayNameTemplate !== runnerPreflightDisplayNameTemplate) {
+        throw new Error(`credentialPolicy.displayNameTemplate must be ${runnerPreflightDisplayNameTemplate}.`);
+    }
+    if (!Array.isArray(policy.allowedWorkflows)) {
+        throw new Error('credentialPolicy.allowedWorkflows must be an array.');
+    }
+    if (policy.allowedWorkflows.length === 0) {
+        throw new Error('credentialPolicy.allowedWorkflows must contain at least one workflow.');
+    }
+    const repository = validateCredentialRepositoryIdentity(policy.repository, 'credentialPolicy.repository');
+    if (policy.owner !== repository.owner) {
+        throw new Error('credentialPolicy.owner must match credentialPolicy.repository.owner.');
+    }
+    const displayName = stringField(policy, 'displayName', 'credentialPolicy');
+    if (displayName !== `${repository.name.toLowerCase()}-runner-preflight-read`) {
+        throw new Error('credentialPolicy.displayName must be derived from the canonical repository name.');
+    }
+    const createdAt = isoTimestamp(policy.createdAt, 'credentialPolicy.createdAt');
+    const expiresAt = isoTimestamp(policy.expiresAt, 'credentialPolicy.expiresAt');
+    const rotationLeadDays = integerField(policy, 'rotationLeadDays', 'credentialPolicy');
+    requireVersion(rotationLeadDays, runnerPreflightRotationLeadDays, 'credentialPolicy.rotationLeadDays');
+    const rotationDueAt = isoTimestamp(policy.rotationDueAt, 'credentialPolicy.rotationDueAt');
+    if (rotationDueAt !== addDaysIso(expiresAt, -runnerPreflightRotationLeadDays)) {
+        throw new Error('credentialPolicy.rotationDueAt must equal expiresAt minus the rotation lead.');
+    }
+    const repositoryPermissions = stringArray(permissions.repository, 'credentialPolicy.permissions.repository');
+    const organizationPermissions = stringArray(permissions.organization, 'credentialPolicy.permissions.organization');
+    assertNoDuplicateStrings(repositoryPermissions, 'credentialPolicy.permissions.repository');
+    assertNoDuplicateStrings(organizationPermissions, 'credentialPolicy.permissions.organization');
+    exactStringSet(repositoryPermissions, runnerPreflightRepositoryPermissions, 'credentialPolicy.permissions.repository');
+    exactStringSet(organizationPermissions, runnerPreflightOrganizationPermissions, 'credentialPolicy.permissions.organization');
+    const authKind = enumValue(policy.authKind, new Set(['github-app', 'fine-grained-pat']), 'credentialPolicy.authKind');
+    const proof = exact(policy.proof, ['verifiedAt', 'readbackDigest', 'readbackProvider', 'payloadFree'], 'credentialPolicy.proof');
+    if (proof.payloadFree !== true) {
+        throw new Error('credentialPolicy.proof.payloadFree must be true.');
+    }
+    const app = policy.app === null
+        ? null
+        : exact(policy.app, [
+            'installationId',
+            'appSlug',
+            'selection',
+            'repositoryFullName',
+            'permissionsVerifiedAt',
+            'token'
+        ], 'credentialPolicy.app');
+    const pat = policy.pat === null
+        ? null
+        : exact(policy.pat, [
+            'lifetimeDays',
+            'selectedRepositoryOnly',
+            'createdBy'
+        ], 'credentialPolicy.pat');
+    if (authKind === 'github-app') {
+        if (app === null || pat !== null) {
+            throw new Error('credentialPolicy.github-app requires app metadata and no PAT metadata.');
+        }
+        if (integerField(app, 'installationId', 'credentialPolicy.app') <= 0) {
+            throw new Error('credentialPolicy.app.installationId must be positive.');
+        }
+        if (app.selection !== 'selected-repository') {
+            throw new Error('credentialPolicy.app.selection must be selected-repository.');
+        }
+        if (stringField(app, 'repositoryFullName', 'credentialPolicy.app') !== repository.fullName) {
+            throw new Error('credentialPolicy.app.repositoryFullName must match the policy repository.');
+        }
+    }
+    else {
+        if (pat === null || app !== null) {
+            throw new Error('credentialPolicy.fine-grained-pat requires PAT metadata and no App metadata.');
+        }
+        requireVersion(pat.lifetimeDays, runnerPreflightPatLifetimeDays, 'credentialPolicy.pat.lifetimeDays');
+        if (dateDaysBetween(createdAt, expiresAt) !== runnerPreflightPatLifetimeDays) {
+            throw new Error('credentialPolicy fine-grained PAT expiry must be exactly 30 days after creation.');
+        }
+        if (pat.selectedRepositoryOnly !== true) {
+            throw new Error('credentialPolicy.pat.selectedRepositoryOnly must be true.');
+        }
+        if (pat.createdBy !== 'manual-masked-entry') {
+            throw new Error('credentialPolicy.pat.createdBy must be manual-masked-entry.');
+        }
+    }
+    const typedApp = app === null
+        ? null
+        : {
+            installationId: integerField(app, 'installationId', 'credentialPolicy.app'),
+            appSlug: stringField(app, 'appSlug', 'credentialPolicy.app'),
+            selection: enumValue(app.selection, new Set(['selected-repository']), 'credentialPolicy.app.selection'),
+            repositoryFullName: stringField(app, 'repositoryFullName', 'credentialPolicy.app'),
+            permissionsVerifiedAt: isoTimestamp(app.permissionsVerifiedAt, 'credentialPolicy.app.permissionsVerifiedAt'),
+            token: (() => {
+                const token = exact(app.token, ['strategy', 'ttlSeconds', 'generatedBy'], 'credentialPolicy.app.token');
+                const ttlSeconds = integerField(token, 'ttlSeconds', 'credentialPolicy.app.token');
+                if (ttlSeconds <= 0 || ttlSeconds > 3600) {
+                    throw new Error('credentialPolicy.app.token.ttlSeconds must be between 1 and 3600.');
+                }
+                return {
+                    strategy: enumValue(token.strategy, new Set(['installation-token']), 'credentialPolicy.app.token.strategy'),
+                    ttlSeconds,
+                    generatedBy: enumValue(token.generatedBy, new Set(['github-app']), 'credentialPolicy.app.token.generatedBy')
+                };
+            })()
+        };
+    return {
+        schemaVersion: credentialPolicySchemaVersion,
+        identity: validateActivationIdentity(policy.identity),
+        repository,
+        owner: stringField(policy, 'owner', 'credentialPolicy'),
+        authKind,
+        displayNameTemplate: runnerPreflightDisplayNameTemplate,
+        displayName,
+        secretName: runnerPreflightSecretName,
+        createdAt,
+        expiresAt,
+        rotationLeadDays: runnerPreflightRotationLeadDays,
+        rotationDueAt,
+        permissions: {
+            repository: [...runnerPreflightRepositoryPermissions],
+            organization: [...runnerPreflightOrganizationPermissions]
+        },
+        allowedWorkflows: (() => {
+            const workflowPaths = new Set();
+            return policy.allowedWorkflows.map((entry, index) => {
+                const workflow = exact(entry, ['path', 'jobs'], `credentialPolicy.allowedWorkflows[${index}]`);
+                const jobs = stringArray(workflow.jobs, `credentialPolicy.allowedWorkflows[${index}].jobs`);
+                if (jobs.length === 0) {
+                    throw new Error(`credentialPolicy.allowedWorkflows[${index}].jobs must contain at least one job.`);
+                }
+                assertNoDuplicateStrings(jobs, `credentialPolicy.allowedWorkflows[${index}].jobs`);
+                const workflowPath = stringField(workflow, 'path', `credentialPolicy.allowedWorkflows[${index}]`);
+                if (!workflowPath.startsWith('.github/workflows/')) {
+                    throw new Error(`credentialPolicy.allowedWorkflows[${index}].path must be a GitHub Actions workflow path.`);
+                }
+                if (workflowPaths.has(workflowPath)) {
+                    throw new Error(`credentialPolicy.allowedWorkflows contains duplicate workflow ${workflowPath}.`);
+                }
+                workflowPaths.add(workflowPath);
+                return {
+                    path: workflowPath,
+                    jobs
+                };
+            });
+        })(),
+        nonForwarding: true,
+        status: enumValue(policy.status, new Set(['active', 'expiring', 'expired', 'compromised']), 'credentialPolicy.status'),
+        proof: {
+            verifiedAt: isoTimestamp(proof.verifiedAt, 'credentialPolicy.proof.verifiedAt'),
+            readbackDigest: hexDigest(proof.readbackDigest, 'credentialPolicy.proof.readbackDigest'),
+            readbackProvider: enumValue(proof.readbackProvider, new Set(['github-api', 'adapter-fixture']), 'credentialPolicy.proof.readbackProvider'),
+            payloadFree: true
+        },
+        app: typedApp,
+        pat: pat === null
+            ? null
+            : {
+                lifetimeDays: runnerPreflightPatLifetimeDays,
+                selectedRepositoryOnly: true,
+                createdBy: 'manual-masked-entry'
+            }
+    };
+}
+export function validFixtureIdentity() {
+    return currentActivationIdentity;
+}
+//# sourceMappingURL=validators.js.map