@msn-control/liftoff 0.11.2 → 0.12.0

package/dist/domain/governance/activation/approvals.d.ts

@@ -1,9 +1,199 @@
-import type { ApprovalCostCeiling, ApprovalDestinationScope, ApprovalEnvelope, ApprovalEvaluation, ApprovalGateKind, ApprovalResourceScope, EvidenceTransitionIdentity, HumanAuthorityQuestionKind, PhaseGraphNode, RequestedTransitionPlan, UserActivationState } from './types.js';
+import type { ActivationConfiguration, ApprovalCostCeiling, ApprovalDestinationScope, ApprovalEnvelope, ApprovalEvaluation, ApprovalGateKind, ApprovalResourceScope, EvidenceTransitionIdentity, HumanAuthorityQuestionKind, PhaseGraphNode, RequestedTransitionPlan, SavedTransitionPlan, PlannedFileChange, TransitionOperation, UserActivationState } from './types.js';
 type ApprovalScope = ApprovalEnvelope | RequestedTransitionPlan;
+export declare const approvalEnvelopeV3Schema: {
+    readonly $schema: 'https://json-schema.org/draft/2020-12/schema';
+    readonly $id: 'https://mission-control.local/liftoff/governance/approval-envelope.schema.v3.json';
+    readonly title: 'Liftoff governance approval envelope v3';
+    readonly type: 'object';
+    readonly additionalProperties: false;
+    readonly required: readonly ['schemaVersion', 'id', 'phaseId', 'gateKind', 'identity', 'baselineSha', 'planDigest', 'resources', 'destinations', 'permissions', 'costCeiling', 'policyExceptions', 'destructiveScope', 'expiresAt', 'approvedAt', 'approver'];
+    readonly properties: {
+        readonly schemaVersion: {
+            readonly const: number;
+        };
+        readonly id: {
+            readonly type: 'string';
+            readonly minLength: 1;
+        };
+        readonly phaseId: {
+            readonly type: 'string';
+        };
+        readonly scope: {
+            readonly enum: readonly ['local', 'activation', 'lifecycle'];
+        };
+        readonly coveredPhases: {
+            readonly type: 'array';
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly enum: readonly ["seed-valid", "seed-verified", "seed-archived", "committed", "pushed", "phase-0-complete", "activation-approved", "bootstrap-workflow-source-ready", "credential-ready", "provider-ready", "state-path-selected", "existing-private-path", "bootstrap-local", "runner-ready", "private-backend-proof", "remote-import-verified", "remote-ready", "application-prerequisites-ready", "workflow-source-ready", "application-artifact-ready", "application-foundation", "dev-proof", "staging-qualified", "production-rehearsed", "green-red-proof", "enforcement-approved", "rulesets-applied", "live-readback", "bootstrap-state-disposed"];
+            };
+        };
+        readonly operationDigests: {
+            readonly type: 'array';
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly type: 'string';
+                readonly pattern: '^[a-f0-9]{64}$';
+            };
+        };
+        readonly phasePlanDigests: {
+            readonly type: 'object';
+            readonly additionalProperties: {
+                readonly type: 'string';
+                readonly pattern: '^[a-f0-9]{64}$';
+            };
+        };
+        readonly gateKind: {
+            readonly type: 'string';
+        };
+        readonly identity: {
+            readonly type: 'object';
+            readonly additionalProperties: false;
+            readonly required: string[];
+            readonly properties: {
+                liftoffVersion: {
+                    const: string;
+                };
+                manifestArtifactVersion: {
+                    const: number;
+                };
+                policyVersion: {
+                    const: string;
+                };
+                activationContractVersion: {
+                    const: number;
+                };
+                phaseGraphSchemaVersion: {
+                    const: number;
+                };
+                phaseGraphHash: {
+                    const: string;
+                };
+                activationStateSchemaVersion: {
+                    const: number;
+                };
+                evidenceHeaderSchemaVersion: {
+                    const: number;
+                };
+                approvalEnvelopeSchemaVersion: {
+                    const: number;
+                };
+                supersessionSchemaVersion: {
+                    const: number;
+                };
+                credentialPolicySchemaVersion: {
+                    const: number;
+                };
+            };
+        };
+        readonly baselineSha: {
+            readonly type: 'string';
+            readonly pattern: '^[a-f0-9]{64}$';
+        };
+        readonly planDigest: {
+            readonly type: 'string';
+            readonly pattern: '^[a-f0-9]{64}$';
+        };
+        readonly resources: {
+            readonly type: 'array';
+            readonly items: {
+                readonly type: 'object';
+                readonly additionalProperties: false;
+                readonly required: readonly ['type', 'identity'];
+                readonly properties: {
+                    readonly type: {
+                        readonly type: 'string';
+                        readonly minLength: 1;
+                    };
+                    readonly identity: {
+                        readonly type: 'string';
+                        readonly minLength: 1;
+                    };
+                };
+            };
+        };
+        readonly destinations: {
+            readonly type: 'array';
+            readonly items: {
+                readonly type: 'object';
+                readonly additionalProperties: false;
+                readonly required: readonly ['type', 'identity', 'repository', 'subscriptionId'];
+                readonly properties: {
+                    readonly type: {
+                        readonly enum: readonly ['repository', 'subscription', 'environment', 'tenant', 'local', 'external'];
+                    };
+                    readonly identity: {
+                        readonly type: 'string';
+                        readonly minLength: 1;
+                    };
+                    readonly repository: {
+                        readonly type: readonly ['string', 'null'];
+                    };
+                    readonly subscriptionId: {
+                        readonly type: readonly ['string', 'null'];
+                    };
+                };
+            };
+        };
+        readonly permissions: {
+            readonly type: 'array';
+            readonly items: {
+                readonly type: 'string';
+                readonly minLength: 1;
+            };
+        };
+        readonly costCeiling: {
+            readonly type: 'object';
+            readonly additionalProperties: false;
+            readonly required: readonly ['currency', 'fixedMonthlyCents', 'usageMonthlyCents'];
+            readonly properties: {
+                readonly currency: {
+                    readonly type: 'string';
+                    readonly pattern: '^[A-Z]{3}$';
+                };
+                readonly fixedMonthlyCents: {
+                    readonly type: 'integer';
+                    readonly minimum: 0;
+                };
+                readonly usageMonthlyCents: {
+                    readonly type: 'integer';
+                    readonly minimum: 0;
+                };
+            };
+        };
+        readonly policyExceptions: {
+            readonly type: 'array';
+            readonly items: {
+                readonly type: 'string';
+                readonly minLength: 1;
+            };
+        };
+        readonly destructiveScope: {
+            readonly type: 'array';
+            readonly items: {
+                readonly type: 'string';
+                readonly minLength: 1;
+            };
+        };
+        readonly expiresAt: {
+            readonly type: 'string';
+            readonly format: 'date-time';
+        };
+        readonly approvedAt: {
+            readonly type: 'string';
+            readonly format: 'date-time';
+        };
+        readonly approver: {
+            readonly type: 'string';
+            readonly minLength: 1;
+        };
+    };
+};
+/** @deprecated Use approvalEnvelopeV3Schema for current execution. */
 export declare const approvalEnvelopeV2Schema: {
     readonly $schema: 'https://json-schema.org/draft/2020-12/schema';
-    readonly $id: 'https://mission-control.local/liftoff/governance/approval-envelope.schema.v2.json';
-    readonly title: 'Liftoff governance approval envelope v2';
+    readonly $id: 'https://mission-control.local/liftoff/governance/approval-envelope.schema.v3.json';
+    readonly title: 'Liftoff governance approval envelope v3';
     readonly type: 'object';
     readonly additionalProperties: false;
     readonly required: readonly ['schemaVersion', 'id', 'phaseId', 'gateKind', 'identity', 'baselineSha', 'planDigest', 'resources', 'destinations', 'permissions', 'costCeiling', 'policyExceptions', 'destructiveScope', 'expiresAt', 'approvedAt', 'approver'];
@@ -18,6 +208,31 @@ export declare const approvalEnvelopeV2Schema: {
         readonly phaseId: {
             readonly type: 'string';
         };
+        readonly scope: {
+            readonly enum: readonly ['local', 'activation', 'lifecycle'];
+        };
+        readonly coveredPhases: {
+            readonly type: 'array';
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly enum: readonly ["seed-valid", "seed-verified", "seed-archived", "committed", "pushed", "phase-0-complete", "activation-approved", "bootstrap-workflow-source-ready", "credential-ready", "provider-ready", "state-path-selected", "existing-private-path", "bootstrap-local", "runner-ready", "private-backend-proof", "remote-import-verified", "remote-ready", "application-prerequisites-ready", "workflow-source-ready", "application-artifact-ready", "application-foundation", "dev-proof", "staging-qualified", "production-rehearsed", "green-red-proof", "enforcement-approved", "rulesets-applied", "live-readback", "bootstrap-state-disposed"];
+            };
+        };
+        readonly operationDigests: {
+            readonly type: 'array';
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly type: 'string';
+                readonly pattern: '^[a-f0-9]{64}$';
+            };
+        };
+        readonly phasePlanDigests: {
+            readonly type: 'object';
+            readonly additionalProperties: {
+                readonly type: 'string';
+                readonly pattern: '^[a-f0-9]{64}$';
+            };
+        };
         readonly gateKind: {
             readonly type: 'string';
         };
@@ -164,11 +379,11 @@ export declare const approvalEnvelopeV2Schema: {
         };
     };
 };
-/** @deprecated The current schema is v2. */
+/** @deprecated Use the immutable historical contracts to read v1 artifacts. */
 export declare const approvalEnvelopeV1Schema: {
     readonly $schema: 'https://json-schema.org/draft/2020-12/schema';
-    readonly $id: 'https://mission-control.local/liftoff/governance/approval-envelope.schema.v2.json';
-    readonly title: 'Liftoff governance approval envelope v2';
+    readonly $id: 'https://mission-control.local/liftoff/governance/approval-envelope.schema.v3.json';
+    readonly title: 'Liftoff governance approval envelope v3';
     readonly type: 'object';
     readonly additionalProperties: false;
     readonly required: readonly ['schemaVersion', 'id', 'phaseId', 'gateKind', 'identity', 'baselineSha', 'planDigest', 'resources', 'destinations', 'permissions', 'costCeiling', 'policyExceptions', 'destructiveScope', 'expiresAt', 'approvedAt', 'approver'];
@@ -183,6 +398,31 @@ export declare const approvalEnvelopeV1Schema: {
         readonly phaseId: {
             readonly type: 'string';
         };
+        readonly scope: {
+            readonly enum: readonly ['local', 'activation', 'lifecycle'];
+        };
+        readonly coveredPhases: {
+            readonly type: 'array';
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly enum: readonly ["seed-valid", "seed-verified", "seed-archived", "committed", "pushed", "phase-0-complete", "activation-approved", "bootstrap-workflow-source-ready", "credential-ready", "provider-ready", "state-path-selected", "existing-private-path", "bootstrap-local", "runner-ready", "private-backend-proof", "remote-import-verified", "remote-ready", "application-prerequisites-ready", "workflow-source-ready", "application-artifact-ready", "application-foundation", "dev-proof", "staging-qualified", "production-rehearsed", "green-red-proof", "enforcement-approved", "rulesets-applied", "live-readback", "bootstrap-state-disposed"];
+            };
+        };
+        readonly operationDigests: {
+            readonly type: 'array';
+            readonly uniqueItems: true;
+            readonly items: {
+                readonly type: 'string';
+                readonly pattern: '^[a-f0-9]{64}$';
+            };
+        };
+        readonly phasePlanDigests: {
+            readonly type: 'object';
+            readonly additionalProperties: {
+                readonly type: 'string';
+                readonly pattern: '^[a-f0-9]{64}$';
+            };
+        };
         readonly gateKind: {
             readonly type: 'string';
         };
@@ -347,5 +587,22 @@ export declare function determineHumanAuthorityQuestion(plan: RequestedTransitio
 export declare function evaluateApprovalForTransitionPlan(plan: RequestedTransitionPlan, envelopes: readonly ApprovalEnvelope[], options?: {
     now?: Date;
 }): ApprovalEvaluation;
-export declare function transitionPlanForPhase(phase: PhaseGraphNode, state: UserActivationState, transition: EvidenceTransitionIdentity, _projectRoot?: string, publicationDestination?: string): RequestedTransitionPlan;
+export declare function authorityOperations(operations: readonly TransitionOperation[]): readonly TransitionOperation[];
+export declare function transitionAuthorityDigest(input: {
+    phase: PhaseGraphNode;
+    transitionDigest: string;
+    operations?: readonly TransitionOperation[];
+    configuration?: ActivationConfiguration;
+    fileChanges?: readonly PlannedFileChange[];
+    recovery?: boolean;
+}): string;
+export declare function transitionPlanForPhase(phase: PhaseGraphNode, state: UserActivationState, transition: EvidenceTransitionIdentity, _projectRoot?: string, publicationDestination?: string, planned?: {
+    operations: readonly TransitionOperation[];
+    configuration?: ActivationConfiguration;
+    fileChanges?: readonly PlannedFileChange[];
+    recovery?: boolean;
+}): RequestedTransitionPlan;
+export declare function approvalRequestForSavedPlan(plan: SavedTransitionPlan, phase: PhaseGraphNode, state: UserActivationState): RequestedTransitionPlan;
+export declare function savedPlanAuthorityDigest(plan: SavedTransitionPlan, phase: PhaseGraphNode): string;
+export declare function combineApprovalRequests(plans: readonly RequestedTransitionPlan[]): RequestedTransitionPlan;
 export {};

package/dist/domain/governance/activation/approvals.js

@@ -1,6 +1,7 @@
 import { canonicalJson, canonicalSha256 } from './canonical-json.js';
-import { currentActivationIdentity } from './graph.js';
+import { canonicalPhaseGraph, currentActivationIdentity } from './graph.js';
 import { githubRepositoryFromPushUrl, remoteRepository } from './inputs.js';
+import { phaseIds, phaseScope } from './types.js';
 const destinationTypes = new Set([
     'repository',
     'subscription',
@@ -25,10 +26,10 @@ const activationIdentityProperties = {
     supersessionSchemaVersion: { const: currentActivationIdentity.supersessionSchemaVersion },
     credentialPolicySchemaVersion: { const: currentActivationIdentity.credentialPolicySchemaVersion }
 };
-export const approvalEnvelopeV2Schema = {
+export const approvalEnvelopeV3Schema = {
     $schema: 'https://json-schema.org/draft/2020-12/schema',
-    $id: 'https://mission-control.local/liftoff/governance/approval-envelope.schema.v2.json',
-    title: 'Liftoff governance approval envelope v2',
+    $id: 'https://mission-control.local/liftoff/governance/approval-envelope.schema.v3.json',
+    title: 'Liftoff governance approval envelope v3',
     type: 'object',
     additionalProperties: false,
     required: [
@@ -53,6 +54,10 @@ export const approvalEnvelopeV2Schema = {
         schemaVersion: { const: currentActivationIdentity.approvalEnvelopeSchemaVersion },
         id: { type: 'string', minLength: 1 },
         phaseId: { type: 'string' },
+        scope: { enum: ['local', 'activation', 'lifecycle'] },
+        coveredPhases: { type: 'array', uniqueItems: true, items: { enum: phaseIds } },
+        operationDigests: { type: 'array', uniqueItems: true, items: { type: 'string', pattern: '^[a-f0-9]{64}$' } },
+        phasePlanDigests: { type: 'object', additionalProperties: { type: 'string', pattern: '^[a-f0-9]{64}$' } },
         gateKind: { type: 'string' },
         identity: {
             type: 'object',
@@ -106,8 +111,10 @@ export const approvalEnvelopeV2Schema = {
         approver: { type: 'string', minLength: 1 }
     }
 };
-/** @deprecated The current schema is v2. */
-export const approvalEnvelopeV1Schema = approvalEnvelopeV2Schema;
+/** @deprecated Use approvalEnvelopeV3Schema for current execution. */
+export const approvalEnvelopeV2Schema = approvalEnvelopeV3Schema;
+/** @deprecated Use the immutable historical contracts to read v1 artifacts. */
+export const approvalEnvelopeV1Schema = approvalEnvelopeV3Schema;
 function cleanString(value, path) {
     if (typeof value !== 'string') {
         throw new Error(`${path} must be a string.`);
@@ -213,6 +220,20 @@ export function normalizeApprovalDestructiveScope(scope) {
     return sortedUnique(scope, 'approvalEnvelope.destructiveScope', (value, index) => normalizePlainScope(value, index, 'destructiveScope'), (value) => value);
 }
 export function normalizeApprovalScope(scope) {
+    const coveredPhases = scope.coveredPhases === undefined ? undefined : sortedUnique(scope.coveredPhases, 'approvalEnvelope.coveredPhases', (value) => {
+        if (!phaseIds.includes(value))
+            throw new Error(`Unsupported covered phase ${value}.`);
+        return value;
+    }, (value) => value);
+    const operationDigests = scope.operationDigests === undefined ? undefined : sortedUnique(scope.operationDigests, 'approvalEnvelope.operationDigests', (value) => digest(value, 'approvalEnvelope.operationDigests'), (value) => value);
+    const phasePlanDigests = {};
+    if (scope.phasePlanDigests) {
+        for (const id of Object.keys(scope.phasePlanDigests)) {
+            if (!phaseIds.includes(id))
+                throw new Error('An approval bundle contains an unknown phase.');
+            phasePlanDigests[id] = digest(scope.phasePlanDigests[id], `approvalEnvelope.phasePlanDigests.${id}`);
+        }
+    }
     return {
         phaseId: scope.phaseId,
         gateKind: scope.gateKind,
@@ -224,7 +245,11 @@ export function normalizeApprovalScope(scope) {
         permissions: normalizeApprovalPermissions(scope.permissions),
         costCeiling: normalizeApprovalCostCeiling(scope.costCeiling),
         policyExceptions: normalizeApprovalPolicyExceptions(scope.policyExceptions),
-        destructiveScope: normalizeApprovalDestructiveScope(scope.destructiveScope)
+        destructiveScope: normalizeApprovalDestructiveScope(scope.destructiveScope),
+        ...(scope.scope === undefined ? {} : { scope: scope.scope }),
+        ...(coveredPhases ? { coveredPhases } : {}),
+        ...(operationDigests ? { operationDigests } : {}),
+        ...(scope.phasePlanDigests ? { phasePlanDigests } : {})
     };
 }
 /**
@@ -245,6 +270,10 @@ export function canonicalApprovalEnvelopeScope(envelope) {
         costCeiling: normalized.costCeiling,
         policyExceptions: normalized.policyExceptions,
         destructiveScope: normalized.destructiveScope,
+        ...(normalized.scope === undefined ? {} : { scope: normalized.scope }),
+        ...(normalized.coveredPhases === undefined ? {} : { coveredPhases: normalized.coveredPhases }),
+        ...(normalized.operationDigests === undefined ? {} : { operationDigests: normalized.operationDigests }),
+        ...(normalized.phasePlanDigests === undefined ? {} : { phasePlanDigests: normalized.phasePlanDigests }),
         expiresAt: timestamp(envelope.expiresAt, 'approvalEnvelope.expiresAt'),
         approvedAt: timestamp(envelope.approvedAt, 'approvalEnvelope.approvedAt'),
         approver: cleanString(envelope.approver, 'approvalEnvelope.approver')
@@ -326,6 +355,10 @@ function expansionReasons(approved, requested) {
     reasons.push(...exceptionMisses.map((exception) => `policy exception added: ${exception}`));
     const destructiveMisses = containsAll(approved.destructiveScope, requested.destructiveScope, (value) => value);
     reasons.push(...destructiveMisses.map((scope) => `destructive scope expanded: ${scope}`));
+    const phaseMisses = containsAll(approved.coveredPhases ?? [approved.phaseId], requested.coveredPhases ?? [requested.phaseId], (value) => value);
+    reasons.push(...phaseMisses.map((phase) => `phase scope expanded: ${phase}`));
+    const operationMisses = containsAll(approved.operationDigests ?? [], requested.operationDigests ?? [], (value) => value);
+    reasons.push(...operationMisses.map((operation) => `operation scope expanded: ${operation}`));
     return reasons;
 }
 function invalidationReasons(approved, requested) {
@@ -333,16 +366,20 @@ function invalidationReasons(approved, requested) {
     if (!sameIdentity(approved.identity, requested.identity)) {
         reasons.push('activation identity changed');
     }
-    if (approved.phaseId !== requested.phaseId) {
+    if (approved.phaseId !== requested.phaseId && !approved.coveredPhases?.includes(requested.phaseId)) {
         reasons.push(`phase changed from ${approved.phaseId} to ${requested.phaseId}`);
     }
+    if ((approved.scope ?? phaseScope(approved.phaseId)) !== (requested.scope ?? phaseScope(requested.phaseId))) {
+        reasons.push('governance execution scope changed');
+    }
     if (approved.gateKind !== requested.gateKind) {
         reasons.push(`approval gate changed from ${approved.gateKind} to ${requested.gateKind}`);
     }
     if (approved.baselineSha !== requested.baselineSha) {
         reasons.push('baseline SHA changed');
     }
-    if (approved.planDigest !== requested.planDigest) {
+    if (approved.planDigest !== requested.planDigest &&
+        (requested.phasePlanDigests !== undefined || approved.phasePlanDigests?.[requested.phaseId] !== requested.planDigest)) {
         reasons.push('plan authority digest changed');
     }
     return reasons;
@@ -474,12 +511,15 @@ function destinationsForPhase(phase, state, publicationDestination) {
                 subscriptionId: null
             });
         }
-        else if (mutation.startsWith('azure-')) {
+        else if (mutation.startsWith('azure-') || mutation.startsWith('backend-state-') || mutation === 'registry-publish') {
+            const subscriptionId = state.activationInputs?.azure?.subscriptionId;
+            if (!subscriptionId)
+                continue;
             destinations.set('subscription', {
                 type: 'subscription',
-                identity: 'phase-0-discovered-subscription',
+                identity: subscriptionId,
                 repository: null,
-                subscriptionId: 'phase-0-discovered-subscription'
+                subscriptionId
             });
         }
         else {
@@ -493,27 +533,59 @@ function destinationsForPhase(phase, state, publicationDestination) {
     }
     return [...destinations.values()];
 }
-export function transitionPlanForPhase(phase, state, transition, _projectRoot, publicationDestination) {
-    const mutations = [...phase.allowedMutations.local, ...phase.allowedMutations.remote]
-        .filter((mutation) => mutation !== 'none');
+export function authorityOperations(operations) {
+    return operations.filter((operation) => operation.actionId !== 'governance.evidence.write' && operation.actionId !== 'governance.activation-state.write');
+}
+export function transitionAuthorityDigest(input) {
+    return canonicalSha256({
+        scope: phaseScope(input.phase.id),
+        phaseId: input.phase.id,
+        gateKind: input.phase.approvalGate.kind,
+        transitionDigest: input.transitionDigest,
+        allowedMutations: input.phase.allowedMutations,
+        operations: input.operations === undefined ? null : authorityOperations(input.operations),
+        configuration: input.configuration ?? null,
+        fileChanges: input.fileChanges ?? [],
+        recovery: input.recovery ?? false
+    });
+}
+export function transitionPlanForPhase(phase, state, transition, _projectRoot, publicationDestination, planned) {
+    const operations = planned === undefined ? undefined : authorityOperations(planned.operations);
+    const effects = operations?.flatMap((operation) => [operation, ...(operation.effects ?? [])]);
+    const mutations = effects ? [...new Set(effects.map((effect) => effect.mutationClass))] :
+        [...phase.allowedMutations.local, ...phase.allowedMutations.remote].filter((mutation) => mutation !== 'none');
+    const destinations = effects === undefined ? destinationsForPhase(phase, state, publicationDestination) :
+        [...new Map(effects.map(({ destination }) => {
+                const scope = {
+                    type: destination.type, identity: destination.identity,
+                    repository: destination.repository ?? null, subscriptionId: destination.subscriptionId ?? null
+                };
+                return [canonicalJson(scope), scope];
+            })).values()];
+    const budget = (phase.approvalGate.kind === 'activation-plan' || phase.approvalGate.kind === 'infrastructure-cost')
+        ? planned?.configuration?.budget ?? state.activationInputs?.budget : undefined;
     return normalizeApprovalScope({
+        scope: phaseScope(phase.id),
         phaseId: phase.id,
+        coveredPhases: [phase.id],
+        ...(operations ? { operationDigests: [...new Set(operations.map((operation) => canonicalSha256(operation)))] } : {}),
         gateKind: phase.approvalGate.kind,
         identity: state.identity,
         baselineSha: transition.baselineSha,
-        planDigest: canonicalSha256({
-            phaseId: phase.id,
-            gateKind: phase.approvalGate.kind,
-            transitionDigest: transition.transitionDigest,
-            allowedMutations: phase.allowedMutations
+        planDigest: transitionAuthorityDigest({
+            phase, transitionDigest: transition.transitionDigest,
+            operations, configuration: planned?.configuration, fileChanges: planned?.fileChanges, recovery: planned?.recovery
         }),
-        resources: mutations.map((mutation) => ({
+        resources: effects ? [...new Map(effects.map((effect) => {
+                const resource = { type: effect.mutationClass, identity: effect.destination.identity };
+                return [canonicalJson(resource), resource];
+            })).values()] : mutations.map((mutation) => ({
             type: mutation,
             identity: `${phase.id}:${mutation}`
         })),
-        destinations: destinationsForPhase(phase, state, publicationDestination),
+        destinations,
         permissions: mutations,
-        costCeiling: {
+        costCeiling: budget ?? {
             currency: 'USD',
             fixedMonthlyCents: 0,
             usageMonthlyCents: 0
@@ -525,4 +597,75 @@ export function transitionPlanForPhase(phase, state, transition, _projectRoot, p
             : []
     });
 }
+export function approvalRequestForSavedPlan(plan, phase, state) {
+    const primary = transitionPlanForPhase(phase, state, {
+        phaseId: plan.phaseId, baselineSha: plan.baselineDigest,
+        inputDigest: plan.inputDigest, transitionDigest: plan.transitionDigest
+    }, undefined, undefined, { operations: plan.operations, configuration: plan.configuration, fileChanges: plan.fileChanges, recovery: plan.recovery });
+    if (!plan.approvalBundle?.length)
+        return primary;
+    const secondary = plan.approvalBundle.map((entry) => {
+        const node = canonicalPhaseForApproval(entry.phaseId);
+        return transitionPlanForPhase(node, state, {
+            phaseId: entry.phaseId, baselineSha: plan.baselineDigest, inputDigest: entry.inputDigest,
+            transitionDigest: entry.transitionDigest
+        }, undefined, undefined, { operations: entry.operations, configuration: plan.configuration, fileChanges: entry.fileChanges });
+    });
+    return combineApprovalRequests([primary, ...secondary]);
+}
+export function savedPlanAuthorityDigest(plan, phase) {
+    const primary = transitionAuthorityDigest({
+        phase, transitionDigest: plan.transitionDigest, operations: plan.operations,
+        configuration: plan.configuration, fileChanges: plan.fileChanges, recovery: plan.recovery
+    });
+    if (!plan.approvalBundle?.length)
+        return primary;
+    const phasePlanDigests = Object.fromEntries([
+        [phase.id, primary],
+        ...plan.approvalBundle.map((entry) => [entry.phaseId, transitionAuthorityDigest({
+                phase: canonicalPhaseForApproval(entry.phaseId), transitionDigest: entry.transitionDigest,
+                operations: entry.operations, fileChanges: entry.fileChanges, configuration: plan.configuration
+            })])
+    ]);
+    return canonicalSha256({ scope: phaseScope(phase.id), phasePlanDigests });
+}
+function canonicalPhaseForApproval(id) {
+    const phase = canonicalPhaseGraph.phases.find((entry) => entry.id === id);
+    if (!phase)
+        throw new Error(`Unknown approval phase ${id}.`);
+    return phase;
+}
+export function combineApprovalRequests(plans) {
+    if (plans.length === 0)
+        throw new Error('An approval bundle must name at least one resolved phase plan.');
+    const requests = plans.map(normalizeApprovalScope);
+    const first = requests[0];
+    if (requests.some((request) => !sameIdentity(first.identity, request.identity) ||
+        request.baselineSha !== first.baselineSha || request.gateKind !== first.gateKind ||
+        (request.scope ?? phaseScope(request.phaseId)) !== (first.scope ?? phaseScope(first.phaseId)) ||
+        request.costCeiling.currency !== first.costCeiling.currency || request.phasePlanDigests !== undefined)) {
+        throw new Error('An approval bundle requires one identity, baseline, scope, authority gate, and currency; nested bundles are not supported.');
+    }
+    if (new Set(requests.map((request) => request.phaseId)).size !== requests.length)
+        throw new Error('An approval bundle cannot repeat a phase.');
+    const distinct = (values) => [...new Map(values.map((value) => [canonicalJson(value), value])).values()];
+    const phasePlanDigests = Object.fromEntries(requests.map((request) => [request.phaseId, request.planDigest]));
+    return normalizeApprovalScope({
+        ...first,
+        planDigest: canonicalSha256({ scope: first.scope ?? phaseScope(first.phaseId), phasePlanDigests }),
+        coveredPhases: requests.map((request) => request.phaseId),
+        operationDigests: distinct(requests.flatMap((request) => request.operationDigests ?? [])),
+        phasePlanDigests,
+        resources: distinct(requests.flatMap((request) => request.resources)),
+        destinations: distinct(requests.flatMap((request) => request.destinations)),
+        permissions: distinct(requests.flatMap((request) => request.permissions)),
+        policyExceptions: distinct(requests.flatMap((request) => request.policyExceptions)),
+        destructiveScope: distinct(requests.flatMap((request) => request.destructiveScope)),
+        costCeiling: {
+            currency: first.costCeiling.currency,
+            fixedMonthlyCents: requests.reduce((sum, request) => sum + request.costCeiling.fixedMonthlyCents, 0),
+            usageMonthlyCents: requests.reduce((sum, request) => sum + request.costCeiling.usageMonthlyCents, 0)
+        }
+    });
+}
 //# sourceMappingURL=approvals.js.map