@msn-control/liftoff 0.11.3 → 0.12.0

package/dist/governance-activation/github-ports.js

@@ -0,0 +1,4 @@
+export function githubPorts(input) {
+    return input.adapters?.githubActivation ?? {};
+}
+//# sourceMappingURL=github-ports.js.map

package/dist/governance-activation/github-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-ports.js","sourceRoot":"","sources":["../../src/governance-activation/github-ports.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,WAAW,CAAC,KAAsD;IAChF,OAAQ,KAEN,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC;AACtC,CAAC"}

package/dist/governance-activation/github-publication.d.ts

@@ -0,0 +1,3 @@
+import type { PhaseAdapterExecutionInput, PhaseAdapterOutcome, PhasePlanBuild, PhasePlanningInput } from './transition-ports.js';
+export declare function planGitHubPublication(input: PhasePlanningInput): Promise<PhasePlanBuild>;
+export declare function executeGitHubPublication(input: PhaseAdapterExecutionInput): Promise<PhaseAdapterOutcome>;

package/dist/governance-activation/github-publication.js

@@ -0,0 +1,190 @@
+import { inspectGitRepository, reviewedPushUrl } from './phase-publication.js';
+import { commandSucceeded, runGit } from './transition-process.js';
+import { cloneState, readbackProof } from './transition-records.js';
+import { GitHubActivationError, githubRepository, object, positiveId } from '../adapters/github/activation-rest.js';
+import { assertGitHubAuthorized, clientFor, githubOperation, repositoryConfiguration, sourceSha } from './github-config.js';
+export async function planGitHubPublication(input) {
+    const config = repositoryConfiguration(input.inspection);
+    const client = clientFor(input);
+    const git = await inspectGitRepository(input.inspection.projectRoot, input.runner);
+    if (git.issues.length || !git.insideWorkTree || !git.head || git.branch !== config.defaultBranch || git.status.length) {
+        throw new GitHubActivationError('publication-prerequisite', 'Publication requires a clean reviewed local commit on develop at this exact project root; no reset, rebase, or arbitrary staging is permitted.');
+    }
+    const pushUrl = `https://github.com/${config.name}.git`;
+    if (git.remotes.length) {
+        const reviewed = reviewedPushUrl(git);
+        const accepted = [pushUrl, `git@github.com:${config.name}.git`, `ssh://git@github.com/${config.name}.git`];
+        if (!accepted.includes(reviewed))
+            throw new GitHubActivationError('remote-drift', 'The existing origin differs from the explicitly approved github.com destination. It will not be replaced.');
+    }
+    const repository = await client.optional(`/repos/${config.name}`);
+    if (!repository && !config.create) {
+        throw new GitHubActivationError('repository-prerequisite', 'The approved repository is absent or unreadable. Grant access, or explicitly approve repository.create for this exact destination.');
+    }
+    const [owner, name] = config.name.split('/');
+    let ownerKind = 'organization';
+    if (!repository) {
+        const ownerInfo = await client.get(`/users/${owner}`);
+        if (ownerInfo.type === 'User') {
+            const actor = await client.get('/user');
+            if (actor.login !== owner)
+                throw new GitHubActivationError('owner-prerequisite', 'A personal repository can only be created for the authenticated approved owner.');
+            ownerKind = 'user';
+        }
+        else if (ownerInfo.type === 'Organization') {
+            const membership = await client.get(`/user/memberships/orgs/${owner}`);
+            if (membership.state !== 'active')
+                throw new GitHubActivationError('owner-prerequisite', 'An active approved organization identity with repository-create permission is required.');
+        }
+        else
+            throw new GitHubActivationError('owner-prerequisite', 'The approved repository owner is not a supported user or organization.');
+    }
+    else {
+        assertRepositoryBinding(repository, config.name, config.visibility);
+        if (repository.default_branch !== config.defaultBranch) {
+            throw new GitHubActivationError('default-branch-prerequisite', 'An existing repository default branch must be reconciled to develop through a separately reviewed operation; publication will not silently change it.');
+        }
+    }
+    const remote = repository ? await client.optional(`/repos/${config.name}/git/ref/heads/${config.defaultBranch}`) : null;
+    const remoteHead = remote ? sourceSha(object(remote.object).sha) : null;
+    if (remoteHead && remoteHead !== git.head) {
+        const ancestor = await runGit(input.runner, input.inspection.projectRoot, ['merge-base', '--is-ancestor', remoteHead, git.head]);
+        if (!commandSucceeded(ancestor)) {
+            throw new GitHubActivationError('non-fast-forward', 'The remote branch is not a verified ancestor of the reviewed local commit. Fetch/reconcile under owner control; force-push is forbidden.');
+        }
+    }
+    const operations = [
+        githubOperation(input, 'github.repository.ensure', repository ? 'github-read' : 'github-repository-create', {
+            repository: config.name, name, owner, ownerKind, visibility: config.visibility, create: !repository,
+            repositoryId: repository ? positiveId(repository.id) : null, defaultBranch: config.defaultBranch
+        }),
+        ...(!git.remotes.length ? [{
+                adapter: 'git', actionId: 'git.remote.bind', mutationClass: 'git-remote-bind', phaseId: input.phase.id,
+                inputs: { name: 'origin', pushUrl }, destination: { type: 'local', identity: '.git/config' },
+                remote: false, destructive: false
+            }] : []),
+        {
+            adapter: 'git', actionId: remoteHead === git.head ? 'git.verify-existing-push' : 'git.push-approved-ref',
+            mutationClass: remoteHead === git.head ? 'github-read' : 'git-push', phaseId: input.phase.id,
+            inputs: {
+                repository: config.name, branch: config.defaultBranch, localHead: git.head, remoteHead,
+                pushUrl: git.remotes.length ? reviewedPushUrl(git) : pushUrl
+            },
+            destination: { type: 'repository', identity: pushUrl, repository: config.name, ref: `refs/heads/${config.defaultBranch}` },
+            remote: true, destructive: false
+        }
+    ];
+    if (!repository)
+        operations.push(githubOperation(input, 'github.repository.default-branch', 'github-write', {
+            repository: config.name, defaultBranch: config.defaultBranch
+        }));
+    return { operations };
+}
+function assertRepositoryBinding(repository, expected, visibility) {
+    if (githubRepository(repository.full_name).toLowerCase() !== expected.toLowerCase() ||
+        repository.private !== (visibility === 'private') || repository.archived !== false ||
+        repository.disabled === true || repository.fork === true) {
+        throw new GitHubActivationError('repository-binding', 'Repository identity, visibility, or ownership differs from the reviewed non-archived, non-fork destination.');
+    }
+    positiveId(repository.id);
+}
+export async function executeGitHubPublication(input) {
+    const config = repositoryConfiguration(input.inspection);
+    const client = clientFor(input);
+    const completed = [];
+    try {
+        const ensure = input.plan.operations.find((entry) => entry.actionId === 'github.repository.ensure');
+        if (!ensure)
+            throw new GitHubActivationError('publication-inventory', 'The reviewed repository binding operation is missing.');
+        await assertGitHubAuthorized(input, ensure);
+        let repository = await client.optional(`/repos/${config.name}`);
+        if (!repository) {
+            if (ensure.inputs.create !== true)
+                throw new GitHubActivationError('repository-missing', 'The reviewed existing repository is no longer visible; refusing to create a replacement.');
+            repository = await client.write('POST', ensure.inputs.ownerKind === 'user' ? '/user/repos' : `/orgs/${config.name.split('/')[0]}/repos`, {
+                name: config.name.split('/')[1], private: config.visibility === 'private', auto_init: false, has_issues: true, has_projects: false
+            });
+            completed.push(ensure);
+        }
+        if (!repository)
+            throw new GitHubActivationError('repository-readback', 'Repository creation returned no provider identity.');
+        assertRepositoryBinding(repository, config.name, config.visibility);
+        if (ensure.inputs.repositoryId !== null && repository.id !== ensure.inputs.repositoryId) {
+            throw new GitHubActivationError('repository-drift', 'The repository ID changed after review.');
+        }
+        if (!completed.includes(ensure))
+            completed.push(ensure);
+        for (const op of input.plan.operations.filter((entry) => entry.adapter === 'git')) {
+            await assertGitHubAuthorized(input, op);
+            const git = await inspectGitRepository(input.inspection.projectRoot, input.runner);
+            if (git.issues.length || git.status.length || git.branch !== config.defaultBranch) {
+                throw new GitHubActivationError('publication-drift', 'Local Git inputs changed after publication review.');
+            }
+            if (op.actionId === 'git.remote.bind') {
+                if (!git.remotes.length) {
+                    const result = await runGit(input.runner, input.inspection.projectRoot, ['remote', 'add', 'origin', String(op.inputs.pushUrl)]);
+                    if (!commandSucceeded(result))
+                        throw new GitHubActivationError('remote-bind', 'Git could not bind the approved origin; no existing remote was replaced.');
+                }
+                else if (reviewedPushUrl(git) !== op.inputs.pushUrl)
+                    throw new GitHubActivationError('remote-drift', 'Origin changed before approved binding.');
+                completed.push(op);
+            }
+            else if (op.actionId === 'git.push-approved-ref' || op.actionId === 'git.verify-existing-push') {
+                if (git.head !== op.inputs.localHead || reviewedPushUrl(git) !== op.inputs.pushUrl) {
+                    throw new GitHubActivationError('publication-drift', 'Git HEAD or push URL changed after review.');
+                }
+                const remote = await client.optional(`/repos/${config.name}/git/ref/heads/${config.defaultBranch}`);
+                const sha = remote ? sourceSha(object(remote.object).sha) : null;
+                if (sha !== op.inputs.localHead) {
+                    if (op.actionId !== 'git.push-approved-ref' || sha !== op.inputs.remoteHead) {
+                        throw new GitHubActivationError('remote-drift', 'Remote branch changed concurrently; no force/update was attempted.');
+                    }
+                    const result = await runGit(input.runner, input.inspection.projectRoot, [
+                        'push', String(op.inputs.pushUrl), `${sourceSha(op.inputs.localHead)}:refs/heads/${config.defaultBranch}`
+                    ]);
+                    if (!commandSucceeded(result))
+                        throw new GitHubActivationError('publication-rejected', 'GitHub rejected publication; inspect protected-branch policy and the exact ref. No bypass was attempted.');
+                }
+                completed.push(op);
+            }
+        }
+        const defaultOp = input.plan.operations.find((entry) => entry.actionId === 'github.repository.default-branch');
+        if (defaultOp) {
+            const live = await client.get(`/repos/${config.name}`);
+            if (live.default_branch !== config.defaultBranch) {
+                await assertGitHubAuthorized(input, defaultOp);
+                await client.write('PATCH', `/repos/${config.name}`, { default_branch: config.defaultBranch });
+            }
+            completed.push(defaultOp);
+        }
+        const current = await client.get(`/repos/${config.name}`);
+        assertRepositoryBinding(current, config.name, config.visibility);
+        const ref = await client.get(`/repos/${config.name}/git/ref/heads/${config.defaultBranch}`);
+        const head = sourceSha(object(ref.object).sha);
+        const git = await inspectGitRepository(input.inspection.projectRoot, input.runner);
+        if (head !== git.head || current.id !== repository.id || current.default_branch !== config.defaultBranch) {
+            throw new GitHubActivationError('publication-readback', 'Independent repository/ref readback differs from the reviewed local publication.');
+        }
+        const state = cloneState(input.inspection.state);
+        state.remoteBinding = {
+            id: String(current.id), name: config.name, defaultBranch: config.defaultBranch,
+            pushUrl: reviewedPushUrl(git), verifiedAt: input.now.toISOString()
+        };
+        const resourceId = `/repos/${config.name}`;
+        return {
+            status: 'completed', resultState: 'verified', stateOverride: state, completedOperations: completed,
+            evidencePayload: { kind: 'pushed.v1', head, pushUrl: reviewedPushUrl(git), repositoryId: current.id },
+            outputs: { values: { sourceSha: head, repositoryId: positiveId(current.id), repository: config.name },
+                resources: [{ provider: 'github', resourceType: 'repository', resourceId }] },
+            liveReadback: [readbackProof(input, 'github', 'repository', resourceId, {
+                    id: current.id, name: config.name, head, defaultBranch: config.defaultBranch, visibility: config.visibility
+                })]
+        };
+    }
+    catch (error) {
+        return { status: 'blocked', completedOperations: completed,
+            blocker: error instanceof GitHubActivationError ? error.message : 'Publication could not be verified; raw Git/provider diagnostics were withheld.' };
+    }
+}
+//# sourceMappingURL=github-publication.js.map

package/dist/governance-activation/github-publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-publication.js","sourceRoot":"","sources":["../../src/governance-activation/github-publication.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACpH,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE5H,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAyB;IACnE,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnF,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACtH,MAAM,IAAI,qBAAqB,CAAC,0BAA0B,EAAE,gJAAgJ,CAAC,CAAC;IAChN,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,MAAM,CAAC,IAAI,MAAM,CAAC;IACxD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,kBAAkB,MAAM,CAAC,IAAI,MAAM,EAAE,wBAAwB,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;QAC3G,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,cAAc,EAAE,2GAA2G,CAAC,CAAC;IACjM,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,oIAAoI,CAAC,CAAC;IACnM,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IACjE,IAAI,SAAS,GAA4B,cAAc,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;gBAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,iFAAiF,CAAC,CAAC;YACpK,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;aAAM,IAAI,SAAS,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,yFAAyF,CAAC,CAAC;QACtL,CAAC;;YAAM,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,wEAAwE,CAAC,CAAC;IACzI,CAAC;SAAM,CAAC;QACN,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACvD,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,EAAE,uJAAuJ,CAAC,CAAC;QAC1N,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,MAAM,CAAC,IAAI,kBAAkB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxH,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,UAAU,IAAI,UAAU,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACjI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,0IAA0I,CAAC,CAAC;QAClM,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAA0B;QACxC,eAAe,CAAC,KAAK,EAAE,0BAA0B,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,0BAA0B,EAAE;YAC1G,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,UAAU;YACnG,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa;SACjG,CAAC;QACF,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO,EAAE,KAAc,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAA0B,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACxH,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,OAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE;gBACrG,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK;aAClC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACR;YACE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB;YACxG,aAAa,EAAE,UAAU,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YAC5F,MAAM,EAAE;gBACN,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU;gBACtF,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO;aAC7D;YACD,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,MAAM,CAAC,aAAa,EAAE,EAAE;YAC1H,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK;SACjC;KACF,CAAC;IACF,IAAI,CAAC,UAAU;QAAE,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,kCAAkC,EAAE,cAAc,EAAE;YAC1G,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa;SAC7D,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAmC,EAAE,QAAgB,EAAE,UAAgC;IACtH,IAAI,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;QACjF,UAAU,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK;QAClF,UAAU,CAAC,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,6GAA6G,CAAC,CAAC;IACvK,CAAC;IACD,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAiC;IAC9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,0BAA0B,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,EAAE,uDAAuD,CAAC,CAAC;QAC/H,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,0FAA0F,CAAC,CAAC;YACrL,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;gBACvI,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;aACnI,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,oDAAoD,CAAC,CAAC;QAC9H,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,IAAI,IAAI,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACxF,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,yCAAyC,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,sBAAsB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACnF,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;gBAClF,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,EAAE,oDAAoD,CAAC,CAAC;YAC7G,CAAC;YACD,IAAI,EAAE,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBAChI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,qBAAqB,CAAC,aAAa,EAAE,0EAA0E,CAAC,CAAC;gBAC5J,CAAC;qBAAM,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,qBAAqB,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;gBAClJ,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,EAAE,CAAC,QAAQ,KAAK,uBAAuB,IAAI,EAAE,CAAC,QAAQ,KAAK,0BAA0B,EAAE,CAAC;gBACjG,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnF,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;gBACrG,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,MAAM,CAAC,IAAI,kBAAkB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;gBACpG,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACjE,IAAI,GAAG,KAAK,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBAChC,IAAI,EAAE,CAAC,QAAQ,KAAK,uBAAuB,IAAI,GAAG,KAAK,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;wBAC5E,MAAM,IAAI,qBAAqB,CAAC,cAAc,EAAE,oEAAoE,CAAC,CAAC;oBACxH,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;wBACtE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,MAAM,CAAC,aAAa,EAAE;qBAC1G,CAAC,CAAC;oBACH,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,EAAE,0GAA0G,CAAC,CAAC;gBACrM,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,kCAAkC,CAAC,CAAC;QAC/G,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;gBACjD,MAAM,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC/C,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,IAAI,kBAAkB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACnF,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACzG,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,EAAE,kFAAkF,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACjD,KAAK,CAAC,aAAa,GAAG;YACpB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa;YAC9E,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;SACnE,CAAC;QACF,MAAM,UAAU,GAAG,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS;YAClG,eAAe,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE;YACrG,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE;gBACnG,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE;YAC/E,YAAY,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE;oBACtE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC5G,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS;YACxD,OAAO,EAAE,KAAK,YAAY,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gFAAgF,EAAE,CAAC;IACzJ,CAAC;AACH,CAAC"}

package/dist/governance-activation/historical-common.d.ts

@@ -0,0 +1,98 @@
+import type { ApprovalEnvelope, ApprovalEvaluation, BootstrapStateRetention, EvidenceHeader, EvidenceReference, LiveReadbackProof, PhaseExecutionState, SavedTransitionPlan, TransitionOperation, TransitionOperationDestination, TransitionRollbackPlan } from '../domain/governance/activation/types.js';
+import type { HistoricalActivationIdentity } from '../domain/governance/policy/identity.js';
+import { historicalIdentity } from './history-contracts.js';
+import { historicalPhaseIds, type HistoricalPhaseId } from './historical-v1-phase-contracts.js';
+export { historicalPhaseIds, type HistoricalPhaseId };
+export declare const historicalPhaseStates: readonly ['pending', 'blocked', 'ready', 'approved', 'running', 'verified', 'failed', 'inapplicable', 'retained', 'disposed'];
+export declare const historicalResults: readonly ['verified', 'failed', 'inapplicable', 'retained', 'disposed'];
+export declare const historicalMutationClasses: readonly ['none', 'read-worktree', 'write-activation-state', 'write-evidence', 'write-openspec-seed', 'write-openspec-governance', 'write-local-state', 'delete-local-state', 'write-workflows', 'write-ruleset-source', 'git-commit', 'git-push', 'github-read', 'github-write', 'github-secret-write', 'azure-read', 'azure-provider-register', 'azure-network-provision', 'azure-state-import', 'azure-resource-provision', 'github-ruleset-write'];
+export declare const historicalGateKinds: readonly ['none', 'repository-publish', 'activation-plan', 'credential-enrollment', 'infrastructure-cost', 'enforcement', 'destructive-disposal', 'external-blocker'];
+export declare const historicalQuestionKinds: readonly ['repository-creation-initial-commit-push', 'credential-enrollment', 'billed-infrastructure-policy-exception-cost-ceiling', 'final-enforcement', 'destructive-operation', 'external-blocker'];
+export declare const destinationTypes: readonly ['local', 'repository', 'subscription', 'environment', 'tenant', 'external'];
+export declare const adapterIds: readonly ['local-evidence', 'selected-spec-workflow', 'git', 'github', 'azure-opentofu', 'local-state'];
+export declare const historicalPhaseGates: {
+    readonly 'seed-valid': 'none';
+    readonly 'seed-verified': 'none';
+    readonly 'seed-archived': 'none';
+    readonly committed: 'repository-publish';
+    readonly pushed: 'repository-publish';
+    readonly 'phase-0-complete': 'none';
+    readonly 'activation-approved': 'activation-plan';
+    readonly 'credential-ready': 'credential-enrollment';
+    readonly 'provider-ready': 'infrastructure-cost';
+    readonly 'state-path-selected': 'infrastructure-cost';
+    readonly 'existing-private-path': 'none';
+    readonly 'bootstrap-local': 'infrastructure-cost';
+    readonly 'runner-ready': 'infrastructure-cost';
+    readonly 'private-backend-proof': 'none';
+    readonly 'remote-import-verified': 'infrastructure-cost';
+    readonly 'remote-ready': 'none';
+    readonly 'application-foundation': 'infrastructure-cost';
+    readonly 'workflow-source-ready': 'none';
+    readonly 'dev-proof': 'none';
+    readonly 'staging-qualified': 'none';
+    readonly 'production-rehearsed': 'none';
+    readonly 'green-red-proof': 'none';
+    readonly 'enforcement-approved': 'enforcement';
+    readonly 'rulesets-applied': 'enforcement';
+    readonly 'live-readback': 'none';
+    readonly 'bootstrap-state-disposed': 'destructive-disposal';
+};
+export interface HistoricalActivationState {
+    schemaVersion: 1;
+    identity: HistoricalActivationIdentity;
+    repository: {
+        id: string;
+        name: string;
+        defaultBranch: string;
+    };
+    activeChange: {
+        id: string;
+        kind: 'openspec' | 'spec-kit';
+    } | null;
+    applicability: {
+        statePath: 'existing-private' | 'bootstrap-local' | 'none';
+        privateStagingDast: boolean;
+        credentialRequired: boolean;
+    };
+    bootstrapState?: BootstrapStateRetention;
+    phases: Record<HistoricalPhaseId, PhaseExecutionState>;
+    createdAt: string;
+    updatedAt: string;
+}
+export type HistoricalEvidenceHeader = Pick<EvidenceHeader, 'repositoryId' | 'phaseGraphHash' | 'phaseId' | 'phaseContractDigest' | 'inputDigest' | 'baselineSha' | 'transition' | 'producedAt' | 'producer' | 'result'> & {
+    schemaVersion: 1;
+    identity: HistoricalActivationIdentity;
+};
+export type HistoricalLiveReadbackProof = Omit<LiveReadbackProof, 'schemaVersion' | 'identity'> & {
+    schemaVersion: 1;
+    identity: HistoricalActivationIdentity;
+};
+export interface HistoricalEvidenceRecord {
+    evidenceId: string;
+    header: HistoricalEvidenceHeader;
+    payload?: unknown;
+    liveReadback?: HistoricalLiveReadbackProof[];
+}
+export type HistoricalApprovalEnvelope = Pick<ApprovalEnvelope, 'id' | 'phaseId' | 'gateKind' | 'baselineSha' | 'planDigest' | 'resources' | 'destinations' | 'permissions' | 'costCeiling' | 'policyExceptions' | 'destructiveScope' | 'expiresAt' | 'approvedAt' | 'approver'> & {
+    schemaVersion: 1;
+    identity: HistoricalActivationIdentity;
+};
+export type HistoricalSavedTransitionPlan = Pick<SavedTransitionPlan, 'phaseId' | 'createdAt' | 'expiresAt' | 'graphHash' | 'stateHash' | 'baselineDigest' | 'inputDigest' | 'transitionDigest' | 'planDigest' | 'mutationClasses' | 'operations' | 'approval' | 'rollbackPlan' | 'noSecrets'> & {
+    schemaVersion: 1;
+    identity: HistoricalActivationIdentity;
+};
+export declare function phaseId(value: unknown, label: string): HistoricalPhaseId;
+export declare function assertHistoricalPhasesComplete<T>(phases: Partial<Record<HistoricalPhaseId, T>>): asserts phases is Record<HistoricalPhaseId, T>;
+export declare function readHistoricalEvidenceReference(value: unknown, label: string): EvidenceReference;
+export declare function validateHistoricalBootstrapState(value: unknown, label: string): BootstrapStateRetention;
+export declare function readHistoricalEvidenceTransition(value: unknown, label: string): EvidenceHeader['transition'];
+export declare function validateHistoricalEmbeddedPaths(value: unknown, label: string): void;
+export declare function uniqueSorted<T>(values: T[], key: (value: T) => string, label: string): T[];
+export declare function nullableString(value: unknown, label: string): string | null;
+export declare function readHistoricalApprovalFields(value: unknown): Omit<HistoricalApprovalEnvelope, 'schemaVersion' | 'identity'>;
+export declare function operationDestination(value: unknown, label: string): TransitionOperationDestination;
+export declare function operation(value: unknown, label: string, mutationClasses?: readonly TransitionOperation['mutationClass'][]): TransitionOperation;
+export declare function evaluation(value: unknown, label: string): ApprovalEvaluation;
+export declare function rollbackPlan(value: unknown, label: string, mutationClasses?: readonly TransitionOperation['mutationClass'][]): TransitionRollbackPlan;
+export declare function readHistoricalSavedTransitionPlan(value: unknown, identityReader: typeof historicalIdentity): HistoricalSavedTransitionPlan;

package/dist/governance-activation/historical-common.js

@@ -0,0 +1,269 @@
+import { isRecord } from '../domain/governance/activation/canonical-json.js';
+import { historyArray, historyBoolean, historyDigest, historyEnum, historyExact, historyFail, historyLiteral, historyPathParts, historyRecord, historyRecordId, historyString, historyStrings, historyTimestamp } from './history-contracts.js';
+import { assertSafeHistoricalRecord } from './historical-safety.js';
+import { historicalPhaseIds } from './historical-v1-phase-contracts.js';
+export { historicalPhaseIds };
+export const historicalPhaseStates = [
+    'pending', 'blocked', 'ready', 'approved', 'running', 'verified', 'failed', 'inapplicable', 'retained', 'disposed'
+];
+export const historicalResults = ['verified', 'failed', 'inapplicable', 'retained', 'disposed'];
+export const historicalMutationClasses = [
+    'none', 'read-worktree', 'write-activation-state', 'write-evidence', 'write-openspec-seed',
+    'write-openspec-governance', 'write-local-state', 'delete-local-state', 'write-workflows',
+    'write-ruleset-source', 'git-commit', 'git-push', 'github-read', 'github-write',
+    'github-secret-write', 'azure-read', 'azure-provider-register', 'azure-network-provision',
+    'azure-state-import', 'azure-resource-provision', 'github-ruleset-write'
+];
+export const historicalGateKinds = [
+    'none', 'repository-publish', 'activation-plan', 'credential-enrollment', 'infrastructure-cost',
+    'enforcement', 'destructive-disposal', 'external-blocker'
+];
+export const historicalQuestionKinds = [
+    'repository-creation-initial-commit-push', 'credential-enrollment',
+    'billed-infrastructure-policy-exception-cost-ceiling', 'final-enforcement',
+    'destructive-operation', 'external-blocker'
+];
+export const destinationTypes = ['local', 'repository', 'subscription', 'environment', 'tenant', 'external'];
+export const adapterIds = ['local-evidence', 'selected-spec-workflow', 'git', 'github', 'azure-opentofu', 'local-state'];
+export const historicalPhaseGates = {
+    'seed-valid': 'none', 'seed-verified': 'none', 'seed-archived': 'none',
+    committed: 'repository-publish', pushed: 'repository-publish', 'phase-0-complete': 'none',
+    'activation-approved': 'activation-plan', 'credential-ready': 'credential-enrollment',
+    'provider-ready': 'infrastructure-cost', 'state-path-selected': 'infrastructure-cost',
+    'existing-private-path': 'none', 'bootstrap-local': 'infrastructure-cost',
+    'runner-ready': 'infrastructure-cost', 'private-backend-proof': 'none',
+    'remote-import-verified': 'infrastructure-cost', 'remote-ready': 'none',
+    'application-foundation': 'infrastructure-cost', 'workflow-source-ready': 'none',
+    'dev-proof': 'none', 'staging-qualified': 'none', 'production-rehearsed': 'none',
+    'green-red-proof': 'none', 'enforcement-approved': 'enforcement', 'rulesets-applied': 'enforcement',
+    'live-readback': 'none', 'bootstrap-state-disposed': 'destructive-disposal'
+};
+export function phaseId(value, label) {
+    return historyEnum(value, historicalPhaseIds, label);
+}
+export function assertHistoricalPhasesComplete(phases) {
+    for (const id of historicalPhaseIds) {
+        if (phases[id] === undefined)
+            historyFail(`phases.${id}`, 'is required.');
+    }
+}
+export function readHistoricalEvidenceReference(value, label) {
+    const item = historyExact(value, ['phaseId', 'evidenceId', 'headerDigest', 'result'], label);
+    return {
+        phaseId: phaseId(item.phaseId, `${label}.phaseId`),
+        evidenceId: historyRecordId(item.evidenceId, `${label}.evidenceId`),
+        headerDigest: historyDigest(item.headerDigest, `${label}.headerDigest`),
+        result: historyEnum(item.result, historicalResults, `${label}.result`)
+    };
+}
+export function validateHistoricalBootstrapState(value, label) {
+    const item = historyExact(value, [
+        'status', 'remoteImportEvidenceId', 'remoteImportEvidenceDigest', 'retainedAt', 'disposeAfter',
+        'encryptedStatePathParts', 'encryptionKeyPathParts'
+    ], label, ['disposedAt', 'deletionEvidenceId', 'incompleteCleanup']);
+    const status = historyEnum(item.status, ['retained', 'disposed'], `${label}.status`);
+    const retainedAt = historyTimestamp(item.retainedAt, `${label}.retainedAt`);
+    const disposeAfter = historyTimestamp(item.disposeAfter, `${label}.disposeAfter`);
+    if (Date.parse(disposeAfter) - Date.parse(retainedAt) !== 30 * 24 * 60 * 60 * 1000) {
+        historyFail(label, 'disposeAfter must be exactly 30 days after retainedAt.');
+    }
+    if (status === 'disposed' && !Object.hasOwn(item, 'disposedAt'))
+        historyFail(label, 'disposedAt is required for disposed state.');
+    return {
+        status,
+        remoteImportEvidenceId: historyRecordId(item.remoteImportEvidenceId, `${label}.remoteImportEvidenceId`),
+        remoteImportEvidenceDigest: historyDigest(item.remoteImportEvidenceDigest, `${label}.remoteImportEvidenceDigest`),
+        retainedAt, disposeAfter,
+        encryptedStatePathParts: historyArray(item.encryptedStatePathParts, `${label}.encryptedStatePathParts`)
+            .map((entry) => historyPathParts(entry, `${label}.encryptedStatePathParts`)),
+        encryptionKeyPathParts: historyArray(item.encryptionKeyPathParts, `${label}.encryptionKeyPathParts`)
+            .map((entry) => historyPathParts(entry, `${label}.encryptionKeyPathParts`)),
+        ...(Object.hasOwn(item, 'disposedAt') ? { disposedAt: historyTimestamp(item.disposedAt, `${label}.disposedAt`) } : {}),
+        ...(Object.hasOwn(item, 'deletionEvidenceId') ? { deletionEvidenceId: historyRecordId(item.deletionEvidenceId, `${label}.deletionEvidenceId`) } : {}),
+        ...(Object.hasOwn(item, 'incompleteCleanup') ? { incompleteCleanup: historyStrings(item.incompleteCleanup, `${label}.incompleteCleanup`) } : {})
+    };
+}
+export function readHistoricalEvidenceTransition(value, label) {
+    const item = historyExact(value, ['phaseId', 'baselineSha', 'inputDigest', 'transitionDigest'], label);
+    return {
+        phaseId: phaseId(item.phaseId, `${label}.phaseId`),
+        baselineSha: historyDigest(item.baselineSha, `${label}.baselineSha`),
+        inputDigest: historyDigest(item.inputDigest, `${label}.inputDigest`),
+        transitionDigest: historyDigest(item.transitionDigest, `${label}.transitionDigest`)
+    };
+}
+export function validateHistoricalEmbeddedPaths(value, label) {
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => validateHistoricalEmbeddedPaths(entry, `${label}[${index}]`));
+    }
+    else if (isRecord(value)) {
+        for (const [key, entry] of Object.entries(value)) {
+            if (key === 'pathParts' || key.endsWith('PathParts')) {
+                const parts = historyArray(entry, `${label}.${key}`);
+                if (parts.length === 0 && ['cwdPathParts', 'encryptedStatePathParts', 'encryptionKeyPathParts', 'deletedPathParts'].includes(key))
+                    continue;
+                if (parts.length > 0 && Array.isArray(parts[0]))
+                    parts.forEach((item) => historyPathParts(item, `${label}.${key}`));
+                else
+                    historyPathParts(parts, `${label}.${key}`);
+            }
+            else
+                validateHistoricalEmbeddedPaths(entry, `${label}.${key}`);
+        }
+    }
+}
+export function uniqueSorted(values, key, label) {
+    if (new Set(values.map(key)).size !== values.length)
+        historyFail(label, 'contains duplicate scope entries.');
+    return values.sort((a, b) => key(a).localeCompare(key(b), 'en'));
+}
+export function nullableString(value, label) {
+    return value === null ? null : historyString(value, label);
+}
+export function readHistoricalApprovalFields(value) {
+    const label = 'historicalApprovalEnvelope';
+    assertSafeHistoricalRecord(value, label);
+    const item = historyExact(value, [
+        'schemaVersion', 'id', 'phaseId', 'gateKind', 'identity', 'baselineSha', 'planDigest', 'resources',
+        'destinations', 'permissions', 'costCeiling', 'policyExceptions', 'destructiveScope', 'expiresAt', 'approvedAt', 'approver'
+    ], label);
+    const id = phaseId(item.phaseId, `${label}.phaseId`);
+    const gateKind = historyEnum(item.gateKind, historicalGateKinds, `${label}.gateKind`);
+    if (gateKind !== historicalPhaseGates[id])
+        historyFail(label, 'approval gate does not match the historical phase.');
+    const cost = historyExact(item.costCeiling, ['currency', 'fixedMonthlyCents', 'usageMonthlyCents'], `${label}.costCeiling`);
+    const resources = historyArray(item.resources, `${label}.resources`).map((entry, index) => {
+        const resource = historyExact(entry, ['type', 'identity'], `${label}.resources[${index}]`);
+        return { type: historyString(resource.type, `${label}.resources[${index}].type`).toLowerCase(), identity: historyString(resource.identity, `${label}.resources[${index}].identity`) };
+    });
+    const destinations = historyArray(item.destinations, `${label}.destinations`).map((entry, index) => {
+        const destination = historyExact(entry, ['type', 'identity', 'repository', 'subscriptionId'], `${label}.destinations[${index}]`);
+        return {
+            type: historyEnum(destination.type, destinationTypes, `${label}.destinations[${index}].type`),
+            identity: historyString(destination.identity, `${label}.destinations[${index}].identity`),
+            repository: nullableString(destination.repository, `${label}.destinations[${index}].repository`),
+            subscriptionId: nullableString(destination.subscriptionId, `${label}.destinations[${index}].subscriptionId`)
+        };
+    });
+    return {
+        id: historyRecordId(item.id, `${label}.id`), phaseId: id, gateKind,
+        baselineSha: historyDigest(item.baselineSha, `${label}.baselineSha`),
+        planDigest: historyDigest(item.planDigest, `${label}.planDigest`),
+        resources: uniqueSorted(resources, (entry) => `${entry.type}:${entry.identity}`, `${label}.resources`),
+        destinations: uniqueSorted(destinations, (entry) => `${entry.type}:${entry.identity}`, `${label}.destinations`),
+        permissions: uniqueSorted(historyStrings(item.permissions, `${label}.permissions`).map((entry) => entry.toLowerCase()), (entry) => entry, `${label}.permissions`),
+        costCeiling: {
+            currency: historyString(cost.currency, `${label}.costCeiling.currency`),
+            fixedMonthlyCents: Math.max(0, Math.trunc(Number(cost.fixedMonthlyCents))),
+            usageMonthlyCents: Math.max(0, Math.trunc(Number(cost.usageMonthlyCents)))
+        },
+        policyExceptions: uniqueSorted(historyStrings(item.policyExceptions, `${label}.policyExceptions`), (entry) => entry, `${label}.policyExceptions`),
+        destructiveScope: uniqueSorted(historyStrings(item.destructiveScope, `${label}.destructiveScope`), (entry) => entry, `${label}.destructiveScope`),
+        expiresAt: historyTimestamp(item.expiresAt, `${label}.expiresAt`),
+        approvedAt: historyTimestamp(item.approvedAt, `${label}.approvedAt`),
+        approver: historyString(item.approver, `${label}.approver`)
+    };
+}
+export function operationDestination(value, label) {
+    const item = historyExact(value, ['type', 'identity'], label, ['pathParts', 'repository', 'subscriptionId', 'ref']);
+    return {
+        type: historyEnum(item.type, destinationTypes, `${label}.type`),
+        identity: historyString(item.identity, `${label}.identity`),
+        ...(Object.hasOwn(item, 'pathParts') ? { pathParts: historyPathParts(item.pathParts, `${label}.pathParts`) } : {}),
+        ...(Object.hasOwn(item, 'repository') ? { repository: historyString(item.repository, `${label}.repository`) } : {}),
+        ...(Object.hasOwn(item, 'subscriptionId') ? { subscriptionId: historyString(item.subscriptionId, `${label}.subscriptionId`) } : {}),
+        ...(Object.hasOwn(item, 'ref') ? { ref: historyString(item.ref, `${label}.ref`) } : {})
+    };
+}
+export function operation(value, label, mutationClasses = historicalMutationClasses) {
+    const item = historyExact(value, ['adapter', 'actionId', 'mutationClass', 'phaseId', 'inputs', 'destination', 'remote', 'destructive'], label);
+    const inputs = historyRecord(item.inputs, `${label}.inputs`);
+    validateHistoricalEmbeddedPaths(inputs, `${label}.inputs`);
+    return {
+        adapter: historyEnum(item.adapter, adapterIds, `${label}.adapter`),
+        actionId: historyString(item.actionId, `${label}.actionId`),
+        mutationClass: historyEnum(item.mutationClass, mutationClasses, `${label}.mutationClass`),
+        phaseId: phaseId(item.phaseId, `${label}.phaseId`), inputs,
+        destination: operationDestination(item.destination, `${label}.destination`),
+        remote: historyBoolean(item.remote, `${label}.remote`), destructive: historyBoolean(item.destructive, `${label}.destructive`)
+    };
+}
+export function evaluation(value, label) {
+    const item = historyExact(value, [
+        'phaseId', 'gateKind', 'questionKind', 'approvalRequired', 'status', 'envelopeId', 'envelopeHash', 'reasons', 'expansionReasons'
+    ], label);
+    return {
+        phaseId: phaseId(item.phaseId, `${label}.phaseId`),
+        gateKind: historyEnum(item.gateKind, historicalGateKinds, `${label}.gateKind`),
+        questionKind: item.questionKind === null ? null : historyEnum(item.questionKind, historicalQuestionKinds, `${label}.questionKind`),
+        approvalRequired: historyBoolean(item.approvalRequired, `${label}.approvalRequired`),
+        status: historyEnum(item.status, ['not-required', 'approval-required', 'reused', 'expired', 'invalidated'], `${label}.status`),
+        envelopeId: item.envelopeId === null ? null : historyRecordId(item.envelopeId, `${label}.envelopeId`),
+        envelopeHash: item.envelopeHash === null ? null : historyDigest(item.envelopeHash, `${label}.envelopeHash`),
+        reasons: historyStrings(item.reasons, `${label}.reasons`), expansionReasons: historyStrings(item.expansionReasons, `${label}.expansionReasons`)
+    };
+}
+export function rollbackPlan(value, label, mutationClasses = historicalMutationClasses) {
+    const item = historyExact(value, ['phaseId', 'strategy', 'target', 'operations', 'retained', 'cleanupWarnings'], label);
+    return {
+        phaseId: phaseId(item.phaseId, `${label}.phaseId`),
+        strategy: historyEnum(item.strategy, ['none', 'retain', 'reverse-to', 'dispose'], `${label}.strategy`),
+        target: item.target === null ? null : phaseId(item.target, `${label}.target`),
+        operations: historyArray(item.operations, `${label}.operations`).map((entry, index) => operation(entry, `${label}.operations[${index}]`, mutationClasses)),
+        retained: historyStrings(item.retained, `${label}.retained`), cleanupWarnings: historyStrings(item.cleanupWarnings, `${label}.cleanupWarnings`)
+    };
+}
+export function readHistoricalSavedTransitionPlan(value, identityReader) {
+    const label = 'historicalTransitionPlan';
+    assertSafeHistoricalRecord(value, label);
+    const item = historyExact(value, [
+        'schemaVersion', 'phaseId', 'createdAt', 'expiresAt', 'identity', 'graphHash', 'stateHash',
+        'baselineDigest', 'inputDigest', 'transitionDigest', 'planDigest', 'mutationClasses', 'operations',
+        'approval', 'rollbackPlan', 'noSecrets'
+    ], label);
+    const identity = identityReader(item.identity, `${label}.identity`);
+    const allowedMutationClasses = identity.activationContractVersion === 1
+        ? historicalMutationClasses : [...historicalMutationClasses, 'write-seed-tasks'];
+    const graphHash = historyDigest(item.graphHash, `${label}.graphHash`);
+    if (graphHash !== identity.phaseGraphHash)
+        historyFail(label, 'graphHash contradicts the historical identity.');
+    const id = phaseId(item.phaseId, `${label}.phaseId`);
+    const operations = historyArray(item.operations, `${label}.operations`).map((entry, index) => operation(entry, `${label}.operations[${index}]`, allowedMutationClasses));
+    if (operations.some((entry) => entry.phaseId !== id))
+        historyFail(label, 'operation phase differs from its plan.');
+    const mutations = historyExact(item.mutationClasses, ['local', 'remote'], `${label}.mutationClasses`);
+    const approval = historyExact(item.approval, ['gateKind', 'required', 'evaluation', 'envelopeId', 'envelopeHash'], `${label}.approval`);
+    const approvalEvaluation = evaluation(approval.evaluation, `${label}.approval.evaluation`);
+    const gateKind = historyEnum(approval.gateKind, historicalGateKinds, `${label}.approval.gateKind`);
+    const required = historyBoolean(approval.required, `${label}.approval.required`);
+    const envelopeId = approval.envelopeId === null ? null : historyRecordId(approval.envelopeId, `${label}.approval.envelopeId`);
+    const envelopeHash = approval.envelopeHash === null ? null : historyDigest(approval.envelopeHash, `${label}.approval.envelopeHash`);
+    if (gateKind !== historicalPhaseGates[id] || required !== (gateKind !== 'none') ||
+        approvalEvaluation.phaseId !== id || approvalEvaluation.gateKind !== gateKind ||
+        approvalEvaluation.envelopeId !== envelopeId || approvalEvaluation.envelopeHash !== envelopeHash ||
+        (envelopeId === null) !== (envelopeHash === null)) {
+        historyFail(label, 'approval references or gate contradict the historical phase.');
+    }
+    const rollback = rollbackPlan(item.rollbackPlan, `${label}.rollbackPlan`, allowedMutationClasses);
+    if (rollback.phaseId !== id)
+        historyFail(label, 'rollback names another phase.');
+    return {
+        schemaVersion: historyLiteral(item.schemaVersion, 1, `${label}.schemaVersion`), phaseId: id,
+        createdAt: historyTimestamp(item.createdAt, `${label}.createdAt`),
+        expiresAt: historyTimestamp(item.expiresAt, `${label}.expiresAt`), identity, graphHash,
+        stateHash: item.stateHash === null ? null : historyDigest(item.stateHash, `${label}.stateHash`),
+        baselineDigest: historyDigest(item.baselineDigest, `${label}.baselineDigest`),
+        inputDigest: historyDigest(item.inputDigest, `${label}.inputDigest`),
+        transitionDigest: historyDigest(item.transitionDigest, `${label}.transitionDigest`),
+        planDigest: historyDigest(item.planDigest, `${label}.planDigest`),
+        mutationClasses: {
+            local: historyStrings(mutations.local, `${label}.mutationClasses.local`).map((entry) => historyEnum(entry, allowedMutationClasses, `${label}.mutationClasses.local`)),
+            remote: historyStrings(mutations.remote, `${label}.mutationClasses.remote`).map((entry) => historyEnum(entry, allowedMutationClasses, `${label}.mutationClasses.remote`))
+        },
+        operations,
+        approval: { gateKind, required, evaluation: approvalEvaluation, envelopeId, envelopeHash },
+        rollbackPlan: rollback,
+        noSecrets: historyLiteral(item.noSecrets, true, `${label}.noSecrets`)
+    };
+}
+//# sourceMappingURL=historical-common.js.map