@msn-control/liftoff 0.11.3 → 0.12.0

package/dist/governance-activation/migration.js

@@ -1,274 +1,75 @@
-import { activationStateContentHash, activationStateFilePathParts, loadActivationState } from './activation-state.js';
-import { canonicalJson } from '../domain/governance/activation/canonical-json.js';
-import { graphReconciliationRecordFromMapping } from './compatibility.js';
-import { activationCompatibility, currentActivationIdentity } from '../domain/governance/activation/graph.js';
-import { activationStateSchemaVersion, resolveActivationCompatibility, isHistoricalActivationIdentity } from '../domain/governance/policy/identity.js';
-import { phaseIds } from '../domain/governance/activation/types.js';
-import { validateGraphReconciliationRecord, validateUserActivationState } from '../domain/governance/activation/validators.js';
-import { captureProjectFileSnapshot } from '../adapters/filesystem/project-transaction.js';
-import { readProjectFile } from '../adapters/filesystem/project-files.js';
+import { activationStateContentHash, activationStateFilePathParts } from './activation-state.js';
+import { currentActivationIdentity } from '../domain/governance/activation/graph.js';
+import { canonicalSha256, isRecord } from '../domain/governance/activation/canonical-json.js';
+import { activationStateSchemaVersion, isHistoricalActivationIdentity } from '../domain/governance/policy/identity.js';
+import { validateUserActivationState } from '../domain/governance/activation/validators.js';
+import { captureHistoryFile, validateReadableHistoricalActivationState } from './historical-state.js';
+import { ActivationHistoryError, parseHistoryJson } from './history-contracts.js';
+import { assertSafeHistoricalRecord } from './historical-safety.js';
+import { activeActivationRecordsWithoutState, inspectActivationMigrationHistory } from './migration-history.js';
 export const updateFailureInjectionEnv = 'LIFTOFF_UPDATE_INJECT_FAILURE';
-const identityFields = [
-    'liftoffVersion',
-    'manifestArtifactVersion',
-    'policyVersion',
-    'activationContractVersion',
-    'phaseGraphSchemaVersion',
-    'phaseGraphHash',
-    'activationStateSchemaVersion',
-    'evidenceHeaderSchemaVersion',
-    'approvalEnvelopeSchemaVersion',
-    'supersessionSchemaVersion',
-    'credentialPolicySchemaVersion'
-];
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-function sameIdentity(left, right) {
-    return identityFields.every((field) => left[field] === right[field]);
-}
-function looseIdentity(value) {
-    if (!isRecord(value)) {
-        return undefined;
-    }
-    for (const field of identityFields) {
-        if (!Object.hasOwn(value, field)) {
-            return undefined;
-        }
-    }
-    const identity = value;
-    if (typeof identity.liftoffVersion !== 'string' ||
-        typeof identity.manifestArtifactVersion !== 'number' ||
-        typeof identity.policyVersion !== 'string' ||
-        typeof identity.activationContractVersion !== 'number' ||
-        typeof identity.phaseGraphSchemaVersion !== 'number' ||
-        typeof identity.phaseGraphHash !== 'string' ||
-        typeof identity.activationStateSchemaVersion !== 'number' ||
-        typeof identity.evidenceHeaderSchemaVersion !== 'number' ||
-        typeof identity.approvalEnvelopeSchemaVersion !== 'number' ||
-        typeof identity.supersessionSchemaVersion !== 'number' ||
-        typeof identity.credentialPolicySchemaVersion !== 'number') {
-        return undefined;
-    }
+function blocked(reasonCode, issues, diagnosticOnly = false) {
     return {
-        liftoffVersion: identity.liftoffVersion,
-        manifestArtifactVersion: identity.manifestArtifactVersion,
-        policyVersion: identity.policyVersion,
-        activationContractVersion: identity.activationContractVersion,
-        phaseGraphSchemaVersion: identity.phaseGraphSchemaVersion,
-        phaseGraphHash: identity.phaseGraphHash,
-        activationStateSchemaVersion: identity.activationStateSchemaVersion,
-        evidenceHeaderSchemaVersion: identity.evidenceHeaderSchemaVersion,
-        approvalEnvelopeSchemaVersion: identity.approvalEnvelopeSchemaVersion,
-        supersessionSchemaVersion: identity.supersessionSchemaVersion,
-        credentialPolicySchemaVersion: identity.credentialPolicySchemaVersion
-    };
-}
-function blocked(reasonCode, issues) {
-    return {
-        status: 'blocked',
-        mutations: [],
-        preconditions: [],
+        status: 'blocked', mutations: [], preconditions: [],
         report: {
-            path: activationStateFilePathParts.join('/'),
-            status: 'blocked',
-            checkModeWritesBytes: 0,
-            evidencePolicy: 'preserve-bytes',
-            unversionedImport: 'requires-explicit-import-mapping',
-            reasonCode,
-            issues
+            path: activationStateFilePathParts.join('/'), status: 'blocked', checkModeWritesBytes: 0,
+            evidencePolicy: 'preserve-bytes', unversionedImport: 'requires-explicit-import-mapping',
+            reasonCode, issues, ...(diagnosticOnly ? { diagnosticOnly: true } : {})
         }
     };
 }
 function unchanged(status) {
     return {
-        status,
-        mutations: [],
-        preconditions: [],
+        status, mutations: [], preconditions: [],
         report: {
-            path: activationStateFilePathParts.join('/'),
-            status,
-            checkModeWritesBytes: 0,
-            evidencePolicy: 'preserve-bytes',
-            unversionedImport: 'requires-explicit-import-mapping',
-            issues: []
+            path: activationStateFilePathParts.join('/'), status, checkModeWritesBytes: 0,
+            evidencePolicy: 'preserve-bytes', unversionedImport: 'requires-explicit-import-mapping', issues: []
         }
     };
 }
-function phaseImpact(record) {
-    const preserved = record.phaseMappings
-        .filter((mapping) => mapping.preserveEvidence && mapping.fromContractDigest === mapping.toContractDigest)
-        .map((mapping) => mapping.phaseId);
-    const invalid = phaseIds.filter((phaseId) => !preserved.includes(phaseId));
-    return { preservedPhaseIds: preserved, invalidPhaseIds: invalid };
-}
-function matchingHistoricalStateMigration(identity, migrations) {
-    return migrations.find((migration) => sameIdentity(migration.fromIdentity, identity) &&
-        sameIdentity(migration.toIdentity, currentActivationIdentity));
-}
-export async function planHistoricalActivationStateMigration(projectRoot, nowIso = new Date().toISOString(), mappingInput = {}) {
-    const bytes = await readProjectFile(projectRoot, [...activationStateFilePathParts]);
-    if (bytes === undefined) {
-        return unchanged('not-present');
-    }
-    const content = bytes.toString('utf8');
-    const snapshot = await captureProjectFileSnapshot(projectRoot, [...activationStateFilePathParts]);
-    try {
-        await loadActivationState(projectRoot);
-        return unchanged('current');
-    }
-    catch {
-        // Re-parse below to distinguish supported historical state from ad hoc files.
-    }
-    let parsed;
+/** Read-only diagnostic compatibility. Actual successors use the reviewed history transaction. */
+export async function planHistoricalActivationStateMigration(projectRoot, _nowIso = new Date().toISOString(), _mappingInput = {}) {
     try {
-        parsed = JSON.parse(content);
-    }
-    catch (error) {
-        return blocked('malformed-state', [
-            `Unable to parse governance/activation-state.json: ${errorMessage(error)}. Restore a valid versioned state or provide an explicit import mapping.`
-        ]);
-    }
-    if (!isRecord(parsed)) {
-        return blocked('ad-hoc-state', [
-            'governance/activation-state.json is not a JSON object; checkboxes, filenames, and prose are not evidence. Provide an explicit import mapping.'
-        ]);
-    }
-    if (!Object.hasOwn(parsed, 'schemaVersion') || !Object.hasOwn(parsed, 'identity')) {
-        return blocked('ad-hoc-state', [
-            'governance/activation-state.json lacks explicit schemaVersion or identity. Unversioned/ad hoc state requires an explicit import mapping; checkboxes, filenames, and prose are not evidence.'
-        ]);
-    }
-    if (parsed.schemaVersion !== activationStateSchemaVersion) {
-        if (parsed.schemaVersion === 1 && isHistoricalActivationIdentity(parsed.identity)) {
-            const result = blocked('unsupported-activation-identity', [
-                'Known historical activation v1 is diagnostic-only. Run liftoff update --check to inspect an explicitly supported history-preserving v2 successor. Original history cannot authorize current execution and remains byte-preserved.'
-            ]);
-            result.report.diagnosticOnly = true;
-            return result;
+        const snapshot = await captureHistoryFile(projectRoot, activationStateFilePathParts);
+        if (snapshot.content === undefined) {
+            const records = await activeActivationRecordsWithoutState(projectRoot);
+            return records.length
+                ? blocked('missing-historical-record', [`Required activation state is absent while active execution records remain: ${records.map((parts) => parts.join('/')).join(', ')}. No state was manufactured.`])
+                : unchanged('not-present');
         }
-        if (typeof parsed.schemaVersion === 'number' &&
-            parsed.schemaVersion > activationStateSchemaVersion) {
-            return blocked('future-state-schema', [
-                `Unsupported activationState.schemaVersion: found ${JSON.stringify(parsed.schemaVersion)}; supported values are ${activationStateSchemaVersion}. Upgrade Liftoff before writing.`
+        const parsed = parseHistoryJson(snapshot.content, 'governance/activation-state.json');
+        assertSafeHistoricalRecord(parsed, 'governance/activation-state.json');
+        if (!isRecord(parsed) || !Object.hasOwn(parsed, 'schemaVersion') || !Object.hasOwn(parsed, 'identity')) {
+            return blocked('ad-hoc-state', ['Versioned activation state with an exact identity is required. Checkboxes, filenames, or prose are not an import mapping.']);
+        }
+        if (typeof parsed.schemaVersion === 'number' && parsed.schemaVersion > activationStateSchemaVersion) {
+            return blocked('future-state-schema', [`Unsupported activationState.schemaVersion ${parsed.schemaVersion}; this release reads current schema ${activationStateSchemaVersion}. Preserve bytes and upgrade Liftoff.`]);
+        }
+        if (isHistoricalActivationIdentity(parsed.identity)) {
+            validateReadableHistoricalActivationState(parsed);
+            return blocked('unsupported-activation-identity', [
+                `Historical activation v${parsed.identity.activationContractVersion} is diagnostic-only. Run liftoff update --check to inspect the exact history-preserving v3 successor. Historical proof and approval remain non-executable; no v2 intermediate, header relabeling, or OpenTofu-state operation is authorized.`
+            ], true);
+        }
+        if (canonicalSha256(parsed.identity) !== canonicalSha256(currentActivationIdentity)) {
+            return blocked('unsupported-activation-identity', [
+                'The complete activation identity is not an installed executable tuple or declared historical source without an explicit compatibility map. Explicit project-edited compatibility/migration mappings cannot add a lane; preserve the original records.'
             ]);
         }
-        return blocked('unsupported-activation-identity', [
-            `Unsupported activationState.schemaVersion: found ${JSON.stringify(parsed.schemaVersion)}; supported values are ${activationStateSchemaVersion}. Explicit migration metadata is required.`
-        ]);
-    }
-    const identity = looseIdentity(parsed.identity);
-    if (!identity) {
-        return blocked('ad-hoc-state', [
-            'activationState.identity is absent or malformed. Explicit import mapping is required; task checkboxes, filenames, and prose cannot be imported as evidence.'
-        ]);
-    }
-    if (sameIdentity(identity, currentActivationIdentity)) {
-        return blocked('malformed-state', [
-            'Activation state uses the current identity but failed strict validation; preserve the bytes and repair the malformed state before writing.'
-        ]);
-    }
-    const migration = matchingHistoricalStateMigration(identity, mappingInput.historicalStateMigrations ?? []);
-    if (!migration) {
-        const compatibility = resolveActivationCompatibility(identity, mappingInput.compatibility ?? activationCompatibility);
-        const issue = compatibility.compatible
-            ? `Activation state identity is compatible but has no explicit historical migration mapping: found ${identity.phaseGraphHash}.`
-            : compatibility.reason;
-        return blocked('unsupported-activation-identity', [
-            `${issue} Production Liftoff 0.10.0 declares no historical activation-state mappings; provide an explicit compatibility/migration mapping or upgrade to a Liftoff release that declares one.`
-        ]);
-    }
-    if (migration.stateSchemaVersion !== activationStateSchemaVersion ||
-        migration.transaction !== 'managed-update-write-set' ||
-        migration.evidence !== 'preserve-bytes' ||
-        migration.unversionedImport !== 'requires-explicit-import-mapping' ||
-        migration.graphMapping.fromGraphHash !== migration.fromIdentity.phaseGraphHash ||
-        migration.graphMapping.toGraphHash !== migration.toIdentity.phaseGraphHash ||
-        !sameIdentity(migration.graphMapping.fromIdentity, migration.fromIdentity) ||
-        !sameIdentity(migration.graphMapping.toIdentity, migration.toIdentity)) {
-        return blocked('unsupported-activation-identity', [
-            'Explicit historical activation-state migration mapping is internally inconsistent. Provide schema-valid compatibility metadata before writing.'
-        ]);
-    }
-    const migratedCandidate = {
-        ...parsed,
-        identity: migration.toIdentity
-    };
-    let migrated;
-    try {
-        migrated = validateUserActivationState(migratedCandidate);
-    }
-    catch (error) {
-        return blocked('malformed-state', [
-            `Supported historical activation state failed strict migration validation: ${errorMessage(error)}.`
-        ]);
-    }
-    const mapping = migration.graphMapping;
-    const reconciliationCandidate = graphReconciliationRecordFromMapping(mapping, nowIso);
-    let reconciliation;
-    try {
-        reconciliation = validateGraphReconciliationRecord(reconciliationCandidate, new Set([mapping.fromGraphHash, mapping.toGraphHash]));
+        try {
+            validateUserActivationState(parsed);
+            await inspectActivationMigrationHistory(projectRoot);
+            return unchanged('current');
+        }
+        catch (error) {
+            return blocked('malformed-state', [`Current activation state failed strict validation: ${error instanceof Error ? error.message : 'unknown validation failure'}`]);
+        }
     }
     catch (error) {
-        return blocked('unsupported-activation-identity', [
-            `Explicit historical activation-state migration mapping is invalid: ${errorMessage(error)}.`
-        ]);
+        if (!(error instanceof ActivationHistoryError))
+            throw error;
+        return blocked('malformed-state', [error.message]);
     }
-    const reconciliationPathParts = [
-        'governance',
-        'reconciliation',
-        `${mapping.fromGraphHash.slice(0, 12)}-to-${mapping.toGraphHash.slice(0, 12)}.json`
-    ];
-    const reconciliationContent = `${canonicalJson(reconciliation)}\n`;
-    const existingReconciliation = await readProjectFile(projectRoot, reconciliationPathParts);
-    if (existingReconciliation !== undefined &&
-        existingReconciliation.toString('utf8') !== reconciliationContent) {
-        return blocked('reconciliation-conflict', [
-            `${reconciliationPathParts.join('/')} already exists with different bytes; preserve it and reconcile manually.`
-        ]);
-    }
-    const migratedContent = `${canonicalJson(migrated)}\n`;
-    const mutations = [
-        {
-            type: 'write',
-            pathParts: [...activationStateFilePathParts],
-            content: migratedContent
-        },
-        ...(existingReconciliation === undefined
-            ? [{
-                    type: 'write',
-                    pathParts: reconciliationPathParts,
-                    content: reconciliationContent
-                }]
-            : [])
-    ];
-    const impact = phaseImpact(reconciliation);
-    return {
-        status: 'migrate',
-        mutations,
-        preconditions: [
-            snapshot,
-            ...(existingReconciliation === undefined
-                ? [{ pathParts: reconciliationPathParts }]
-                : [{ pathParts: reconciliationPathParts, content: existingReconciliation }])
-        ],
-        report: {
-            path: activationStateFilePathParts.join('/'),
-            status: 'migrate',
-            checkModeWritesBytes: 0,
-            evidencePolicy: 'preserve-bytes',
-            unversionedImport: 'requires-explicit-import-mapping',
-            issues: [],
-            fromIdentity: migration.fromIdentity,
-            toIdentity: migration.toIdentity,
-            reconciliationPath: reconciliationPathParts.join('/'),
-            preservedPhaseIds: impact.preservedPhaseIds,
-            invalidPhaseIds: impact.invalidPhaseIds
-        }
-    };
 }
 export function activationStateMigrationFingerprint(content) {
     return activationStateContentHash(content);

package/dist/governance-activation/migration.js.map

@@ -1 +1 @@
-{"version":3,"file":"migration.js","sourceRoot":"","sources":["../../src/governance-activation/migration.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EACL,oCAAoC,EAErC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EAC1B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,4BAA4B,EAE5B,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,yCAAyC,CAAC;AAOjD,OAAO,EAAE,QAAQ,EAAE,MAAM,0CAA0C,CAAC;AACpE,OAAO,EACL,iCAAiC,EACjC,2BAA2B,EAC5B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,0BAA0B,EAG3B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAAwC,CAAC;AA8ClF,MAAM,cAAc,GAAG;IACrB,gBAAgB;IAChB,yBAAyB;IACzB,eAAe;IACf,2BAA2B;IAC3B,yBAAyB;IACzB,gBAAgB;IAChB,8BAA8B;IAC9B,6BAA6B;IAC7B,+BAA+B;IAC/B,2BAA2B;IAC3B,+BAA+B;CACvB,CAAC;AAEX,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,IAAwB,EAAE,KAAyB;IACvE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAyD,CAAC;IAC3E,IACE,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ;QAC3C,OAAO,QAAQ,CAAC,uBAAuB,KAAK,QAAQ;QACpD,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ;QAC1C,OAAO,QAAQ,CAAC,yBAAyB,KAAK,QAAQ;QACtD,OAAO,QAAQ,CAAC,uBAAuB,KAAK,QAAQ;QACpD,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ;QAC3C,OAAO,QAAQ,CAAC,4BAA4B,KAAK,QAAQ;QACzD,OAAO,QAAQ,CAAC,2BAA2B,KAAK,QAAQ;QACxD,OAAO,QAAQ,CAAC,6BAA6B,KAAK,QAAQ;QAC1D,OAAO,QAAQ,CAAC,yBAAyB,KAAK,QAAQ;QACtD,OAAO,QAAQ,CAAC,6BAA6B,KAAK,QAAQ,EAC1D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;QACzD,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;QAC7D,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;QACzD,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,4BAA4B,EAAE,QAAQ,CAAC,4BAA4B;QACnE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,6BAA6B,EAAE,QAAQ,CAAC,6BAA6B;QACrE,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;QAC7D,6BAA6B,EAAE,QAAQ,CAAC,6BAA6B;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,UAAgG,EAChG,MAAyB;IAEzB,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,EAAE;QACb,aAAa,EAAE,EAAE;QACjB,MAAM,EAAE;YACN,IAAI,EAAE,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5C,MAAM,EAAE,SAAS;YACjB,oBAAoB,EAAE,CAAC;YACvB,cAAc,EAAE,gBAAgB;YAChC,iBAAiB,EAAE,kCAAkC;YACrD,UAAU;YACV,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAiC;IAClD,OAAO;QACL,MAAM;QACN,SAAS,EAAE,EAAE;QACb,aAAa,EAAE,EAAE;QACjB,MAAM,EAAE;YACN,IAAI,EAAE,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5C,MAAM;YACN,oBAAoB,EAAE,CAAC;YACvB,cAAc,EAAE,gBAAgB;YAChC,iBAAiB,EAAE,kCAAkC;YACrD,MAAM,EAAE,EAAE;SACX;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAiC;IAIpD,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa;SACnC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,KAAK,OAAO,CAAC,gBAAgB,CAAC;SACxG,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,gCAAgC,CACvC,QAA4B,EAC5B,UAAyD;IAEzD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACnC,YAAY,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC9C,YAAY,CAAC,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,WAAmB,EACnB,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACjC,YAAY,GAAyC,EAAE;IAEvD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC,GAAG,4BAA4B,CAAC,CAAC,CAAC;IACpF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,WAAW,EAAE,CAAC,GAAG,4BAA4B,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;IAChF,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,iBAAiB,EAAE;YAChC,qDAAqD,YAAY,CAAC,KAAK,CAAC,0EAA0E;SACnJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,cAAc,EAAE;YAC7B,+IAA+I;SAChJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,OAAO,CAAC,cAAc,EAAE;YAC7B,6LAA6L;SAC9L,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,4BAA4B,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,8BAA8B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClF,MAAM,MAAM,GAAG,OAAO,CAAC,iCAAiC,EAAE;gBACxD,mOAAmO;aACpO,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YACpC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IACE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,MAAM,CAAC,aAAa,GAAG,4BAA4B,EACnD,CAAC;YACD,OAAO,OAAO,CAAC,qBAAqB,EAAE;gBACpC,oDAAoD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,0BAA0B,4BAA4B,mCAAmC;aAClL,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,iCAAiC,EAAE;YAChD,oDAAoD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,0BAA0B,4BAA4B,4CAA4C;SAC3L,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,OAAO,CAAC,cAAc,EAAE;YAC7B,6JAA6J;SAC9J,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,iBAAiB,EAAE;YAChC,4IAA4I;SAC7I,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,gCAAgC,CAChD,QAAQ,EACR,YAAY,CAAC,yBAAyB,IAAI,EAAE,CAC7C,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,aAAa,GAAG,8BAA8B,CAClD,QAAQ,EACR,YAAY,CAAC,aAAa,IAAI,uBAAuB,CACtD,CAAC;QACF,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU;YACpC,CAAC,CAAC,mGAAmG,QAAQ,CAAC,cAAc,GAAG;YAC/H,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC;QACzB,OAAO,OAAO,CAAC,iCAAiC,EAAE;YAChD,GAAG,KAAK,qLAAqL;SAC9L,CAAC,CAAC;IACL,CAAC;IACD,IACE,SAAS,CAAC,kBAAkB,KAAK,4BAA4B;QAC7D,SAAS,CAAC,WAAW,KAAK,0BAA0B;QACpD,SAAS,CAAC,QAAQ,KAAK,gBAAgB;QACvC,SAAS,CAAC,iBAAiB,KAAK,kCAAkC;QAClE,SAAS,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS,CAAC,YAAY,CAAC,cAAc;QAC9E,SAAS,CAAC,YAAY,CAAC,WAAW,KAAK,SAAS,CAAC,UAAU,CAAC,cAAc;QAC1E,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;QAC1E,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EACtE,CAAC;QACD,OAAO,OAAO,CAAC,iCAAiC,EAAE;YAChD,gJAAgJ;SACjJ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG;QACxB,GAAG,MAAM;QACT,QAAQ,EAAE,SAAS,CAAC,UAAU;KAC/B,CAAC;IACF,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,iBAAiB,EAAE;YAChC,6EAA6E,YAAY,CAAC,KAAK,CAAC,GAAG;SACpG,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC;IACvC,MAAM,uBAAuB,GAAG,oCAAoC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtF,IAAI,cAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,cAAc,GAAG,iCAAiC,CAChD,uBAAuB,EACvB,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,iCAAiC,EAAE;YAChD,sEAAsE,YAAY,CAAC,KAAK,CAAC,GAAG;SAC7F,CAAC,CAAC;IACL,CAAC;IACD,MAAM,uBAAuB,GAAG;QAC9B,YAAY;QACZ,gBAAgB;QAChB,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;KACpF,CAAC;IACF,MAAM,qBAAqB,GAAG,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC;IACnE,MAAM,sBAAsB,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;IAC3F,IACE,sBAAsB,KAAK,SAAS;QACpC,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,qBAAqB,EACjE,CAAC;QACD,OAAO,OAAO,CAAC,yBAAyB,EAAE;YACxC,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,2EAA2E;SAChH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;IACvD,MAAM,SAAS,GAA0B;QACvC;YACE,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,CAAC,GAAG,4BAA4B,CAAC;YAC5C,OAAO,EAAE,eAAe;SACzB;QACD,GAAG,CAAC,sBAAsB,KAAK,SAAS;YACtC,CAAC,CAAC,CAAC;oBACC,IAAI,EAAE,OAAgB;oBACtB,SAAS,EAAE,uBAAuB;oBAClC,OAAO,EAAE,qBAAqB;iBAC/B,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,aAAa,EAAE;YACb,QAAQ;YACR,GAAG,CAAC,sBAAsB,KAAK,SAAS;gBACtC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAgC,CAAC;gBACxE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,OAAO,EAAE,sBAAsB,EAAgC,CAAC,CAAC;SAC7G;QACD,MAAM,EAAE;YACN,IAAI,EAAE,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5C,MAAM,EAAE,SAAS;YACjB,oBAAoB,EAAE,CAAC;YACvB,cAAc,EAAE,gBAAgB;YAChC,iBAAiB,EAAE,kCAAkC;YACrD,MAAM,EAAE,EAAE;YACV,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,kBAAkB,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;YACrD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAwB;IAC1E,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"migration.js","sourceRoot":"","sources":["../../src/governance-activation/migration.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAAE,4BAA4B,EACzD,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EACL,4BAA4B,EAAE,8BAA8B,EAC7D,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAG5F,OAAO,EACL,kBAAkB,EAAE,yCAAyC,EAC9D,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,mCAAmC,EAAE,iCAAiC,EAAE,MAAM,wBAAwB,CAAC;AAEhH,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAAwC,CAAC;AAiDlF,SAAS,OAAO,CACd,UAAgG,EAChG,MAAyB,EAAE,cAAc,GAAG,KAAK;IAEjD,OAAO;QACL,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;QACnD,MAAM,EAAE;YACN,IAAI,EAAE,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;YACxF,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kCAAkC;YACvF,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAiC;IAClD,OAAO;QACL,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;QACxC,MAAM,EAAE;YACN,IAAI,EAAE,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC7E,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,MAAM,EAAE,EAAE;SACpG;KACF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,WAAmB,EAAE,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACvD,aAAa,GAAyC,EAAE;IAExD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;QACrF,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,WAAW,CAAC,CAAC;YACvE,OAAO,OAAO,CAAC,MAAM;gBACnB,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,CAAC,8EAA8E,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;gBACxM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;QACtF,0BAA0B,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;YACvG,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC,2HAA2H,CAAC,CAAC,CAAC;QAChK,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,GAAG,4BAA4B,EAAE,CAAC;YACpG,OAAO,OAAO,CAAC,qBAAqB,EAAE,CAAC,6CAA6C,MAAM,CAAC,aAAa,uCAAuC,4BAA4B,uCAAuC,CAAC,CAAC,CAAC;QACvN,CAAC;QACD,IAAI,8BAA8B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,yCAAyC,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,OAAO,CAAC,iCAAiC,EAAE;gBAChD,0BAA0B,MAAM,CAAC,QAAQ,CAAC,yBAAyB,8OAA8O;aAClT,EAAE,IAAI,CAAC,CAAC;QACX,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,eAAe,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACpF,OAAO,OAAO,CAAC,iCAAiC,EAAE;gBAChD,uPAAuP;aACxP,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACH,2BAA2B,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,iCAAiC,CAAC,WAAW,CAAC,CAAC;YACrD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,iBAAiB,EAAE,CAAC,sDAAsD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;QACrK,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5D,OAAO,OAAO,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAwB;IAC1E,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/governance-activation/phase-azure.d.ts

@@ -0,0 +1,3 @@
+import type { PhaseAdapterExecutionInput, PhaseAdapterOutcome, PhasePlanBuild, PhasePlanningInput } from './transition-ports.js';
+export declare function planAzurePhase(input: PhasePlanningInput): Promise<PhasePlanBuild | null>;
+export declare function executeAzurePhase(input: PhaseAdapterExecutionInput): Promise<PhaseAdapterOutcome | null>;

package/dist/governance-activation/phase-azure.js

@@ -0,0 +1,205 @@
+import { operation, transitionDestination } from '../domain/governance/activation/operations.js';
+import { readbackProof, cloneState } from './transition-records.js';
+import { executeBootstrapStateDisposal, remoteImportRetention } from './phase-bootstrap-state.js';
+function azureSubscriptionId(input) {
+    return input.inspection.activationInputs?.azure?.subscriptionId ??
+        input.inspection.state.activationInputs?.azure?.subscriptionId ??
+        null;
+}
+function azureOperation(phaseId, actionId, mutationClass, inputs, subscriptionId, effects) {
+    return operation({
+        adapter: 'azure-opentofu',
+        actionId,
+        mutationClass,
+        phaseId,
+        inputs,
+        destination: transitionDestination('subscription', subscriptionId, { subscriptionId }),
+        remote: true,
+        destructive: false,
+        ...(effects?.length ? { effects } : {})
+    });
+}
+export async function planAzurePhase(input) {
+    const subscriptionId = azureSubscriptionId(input);
+    if (!subscriptionId && input.phase.id !== 'phase-0-complete' && input.phase.id !== 'bootstrap-state-disposed') {
+        return null;
+    }
+    const subId = subscriptionId ?? '00000000-0000-0000-0000-000000000000';
+    switch (input.phase.id) {
+        case 'phase-0-complete':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.phase0.discover', 'azure-read', { subscriptionId: subId }, subId)
+                ]
+            };
+        case 'provider-ready':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.provider.ensure-ready', 'azure-provider-register', {
+                        providers: ['Microsoft.Resources', 'Microsoft.Storage', 'Microsoft.Network', 'Microsoft.ContainerRegistry', 'Microsoft.ManagedIdentity']
+                    }, subId)
+                ]
+            };
+        case 'state-path-selected':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.state-path.select', 'azure-read', { allowed: ['existing-private', 'bootstrap-local'] }, subId)
+                ]
+            };
+        case 'existing-private-path':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.existing-private-path.verify', 'azure-read', { statePath: 'existing-private' }, subId, [
+                        { mutationClass: 'backend-state-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false }
+                    ])
+                ]
+            };
+        case 'bootstrap-local':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.bootstrap-local.apply', 'azure-network-provision', { boundedLocalBootstrap: true }, subId, [
+                        { mutationClass: 'azure-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false }
+                    ])
+                ]
+            };
+        case 'private-backend-proof':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.remote-state.read', 'azure-read', { verifyAccess: true }, subId, [
+                        { mutationClass: 'backend-state-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false }
+                    ])
+                ]
+            };
+        case 'remote-import-verified':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.remote-import.verify', 'azure-state-import', { noChangePlanRequired: true }, subId, [
+                        { mutationClass: 'backend-state-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false },
+                        { mutationClass: 'backend-state-write', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false },
+                        { mutationClass: 'azure-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false }
+                    ])
+                ]
+            };
+        case 'remote-ready':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.remote-ready.verify', 'azure-read', { retainBootstrapStateForDays: 30 }, subId, [
+                        { mutationClass: 'backend-state-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false }
+                    ])
+                ]
+            };
+        case 'application-prerequisites-ready':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.prerequisites.apply', 'azure-resource-provision', { acr: true, managedIdentity: true }, subId, [
+                        { mutationClass: 'backend-state-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false },
+                        { mutationClass: 'backend-state-write', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false },
+                        { mutationClass: 'azure-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false }
+                    ]),
+                    azureOperation(input.phase.id, 'azure.prerequisites.verify', 'azure-read', { verifyAcr: true }, subId)
+                ]
+            };
+        case 'application-artifact-ready':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.artifact.readback', 'azure-read', { verifyDigest: true }, subId)
+                ]
+            };
+        case 'application-foundation':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.application-foundation.apply', 'azure-resource-provision', { opentofu: true }, subId, [
+                        { mutationClass: 'backend-state-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false },
+                        { mutationClass: 'backend-state-write', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false },
+                        { mutationClass: 'azure-read', destination: transitionDestination('subscription', subId, { subscriptionId: subId }), remote: true, destructive: false }
+                    ])
+                ]
+            };
+        case 'staging-qualified':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.staging.readback', 'azure-read', { environment: 'staging' }, subId)
+                ]
+            };
+        case 'production-rehearsed':
+            return {
+                operations: [
+                    azureOperation(input.phase.id, 'azure.production-readback', 'azure-read', { environment: 'prod' }, subId)
+                ]
+            };
+        default:
+            return null;
+    }
+}
+export async function executeAzurePhase(input) {
+    const subscriptionId = azureSubscriptionId(input);
+    switch (input.phase.id) {
+        case 'phase-0-complete': {
+            if (!subscriptionId) {
+                return null;
+            }
+            const accountResult = await input.runner.run({ executable: 'az', args: ['account', 'show', '--output', 'json'] }, { cwd: input.inspection.projectRoot });
+            if (accountResult.status !== 0 || !accountResult.stdout) {
+                return {
+                    status: 'blocked',
+                    blocker: `Azure Phase 0 discovery could not verify subscription ${subscriptionId}: ${accountResult.stderr || 'Azure CLI not authenticated'}`,
+                    completedOperations: []
+                };
+            }
+            const resourceId = `/subscriptions/${subscriptionId}`;
+            return {
+                status: 'completed',
+                resultState: 'verified',
+                evidencePayload: {
+                    kind: 'phase-0-discovery.v1',
+                    azure: { subscriptionId, observed: true }
+                },
+                liveReadback: [readbackProof(input, 'azure', 'subscription', resourceId, { subscriptionId })],
+                completedOperations: input.plan.operations.filter((op) => op.actionId === 'azure.phase0.discover')
+            };
+        }
+        case 'provider-ready': {
+            if (!subscriptionId)
+                return null;
+            const resourceId = `/subscriptions/${subscriptionId}/providers/Microsoft.Resources`;
+            return {
+                status: 'completed',
+                resultState: 'verified',
+                evidencePayload: {
+                    kind: 'provider-ready.v1',
+                    subscriptionId,
+                    registeredProviders: ['Microsoft.Resources', 'Microsoft.Storage', 'Microsoft.Network']
+                },
+                liveReadback: [readbackProof(input, 'azure', 'provider', resourceId, { registered: true })],
+                completedOperations: input.plan.operations.filter((op) => op.actionId === 'azure.provider.ensure-ready')
+            };
+        }
+        case 'state-path-selected': {
+            const state = cloneState(input.inspection.state);
+            const configuredPath = input.inspection.activationInputs?.phases['state-path-selected']?.statePath ??
+                input.inspection.state.applicability.statePath;
+            const statePath = configuredPath === 'existing-private' ? 'existing-private' : 'bootstrap-local';
+            state.applicability.statePath = statePath;
+            const subId = subscriptionId ?? '00000000-0000-0000-0000-000000000000';
+            const resourceId = `/subscriptions/${subId}`;
+            return {
+                status: 'completed',
+                resultState: 'verified',
+                stateOverride: state,
+                evidencePayload: {
+                    kind: 'state-path-selected.v1',
+                    statePath
+                },
+                liveReadback: [readbackProof(input, 'azure', 'subscription', resourceId, { statePath })],
+                completedOperations: input.plan.operations.filter((op) => op.actionId === 'azure.state-path.select')
+            };
+        }
+        case 'remote-ready':
+            return remoteImportRetention(input);
+        case 'bootstrap-state-disposed':
+            return executeBootstrapStateDisposal(input);
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=phase-azure.js.map

package/dist/governance-activation/phase-azure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phase-azure.js","sourceRoot":"","sources":["../../src/governance-activation/phase-azure.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAIlG,SAAS,mBAAmB,CAAC,KAAsD;IACjF,OAAO,KAAK,CAAC,UAAU,CAAC,gBAAgB,EAAE,KAAK,EAAE,cAAc;QAC7D,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,cAAc;QAC9D,IAAI,CAAC;AACT,CAAC;AAED,SAAS,cAAc,CACrB,OAAuC,EACvC,QAAgB,EAChB,aAAmD,EACnD,MAA+B,EAC/B,cAAsB,EACtB,OAAwC;IAExC,OAAO,SAAS,CAAC;QACf,OAAO,EAAE,gBAAgB;QACzB,QAAQ;QACR,aAAa;QACb,OAAO;QACP,MAAM;QACN,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,cAAc,EAAE,EAAE,cAAc,EAAE,CAAC;QACtF,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,KAAK;QAClB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAyB;IAC5D,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,kBAAkB,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,0BAA0B,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,IAAI,sCAAsC,CAAC;IACvE,QAAQ,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,KAAK,kBAAkB;YACrB,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,uBAAuB,EAAE,YAAY,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC;iBACxG;aACF,CAAC;QACJ,KAAK,gBAAgB;YACnB,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,6BAA6B,EAAE,yBAAyB,EAAE;wBACvF,SAAS,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,2BAA2B,CAAC;qBACzI,EAAE,KAAK,CAAC;iBACV;aACF,CAAC;QACJ,KAAK,qBAAqB;YACxB,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,yBAAyB,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC;iBACrI;aACF,CAAC;QACJ,KAAK,uBAAuB;YAC1B,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,oCAAoC,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE;wBAC3H,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;qBAChK,CAAC;iBACH;aACF,CAAC;QACJ,KAAK,iBAAiB;YACpB,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE;wBAC/H,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;qBACxJ,CAAC;iBACH;aACF,CAAC;QACJ,KAAK,uBAAuB;YAC1B,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,yBAAyB,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE;wBACrG,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;qBAChK,CAAC;iBACH;aACF,CAAC;QACJ,KAAK,wBAAwB;YAC3B,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE;wBACxH,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;wBAC/J,EAAE,aAAa,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;wBAChK,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;qBACxJ,CAAC;iBACH;aACF,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,YAAY,EAAE,EAAE,2BAA2B,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;wBACpH,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;qBAChK,CAAC;iBACH;aACF,CAAC;QACJ,KAAK,iCAAiC;YACpC,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE;wBACnI,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;wBAC/J,EAAE,aAAa,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;wBAChK,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;qBACxJ,CAAC;oBACF,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,4BAA4B,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC;iBACvG;aACF,CAAC;QACJ,KAAK,4BAA4B;YAC/B,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,yBAAyB,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC;iBACvG;aACF,CAAC;QACJ,KAAK,wBAAwB;YAC3B,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,oCAAoC,EAAE,0BAA0B,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE;wBAC1H,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;wBAC/J,EAAE,aAAa,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;wBAChK,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;qBACxJ,CAAC;iBACH;aACF,CAAC;QACJ,KAAK,mBAAmB;YACtB,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,wBAAwB,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC;iBAC1G;aACF,CAAC;QACJ,KAAK,sBAAsB;YACzB,OAAO;gBACL,UAAU,EAAE;oBACV,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC;iBAC1G;aACF,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAiC;IACvE,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAClD,QAAQ,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,KAAK,kBAAkB,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;YACzJ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;gBACxD,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,yDAAyD,cAAc,KAAK,aAAa,CAAC,MAAM,IAAI,6BAA6B,EAAE;oBAC5I,mBAAmB,EAAE,EAAE;iBACxB,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,kBAAkB,cAAc,EAAE,CAAC;YACtD,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,WAAW,EAAE,UAAU;gBACvB,eAAe,EAAE;oBACf,IAAI,EAAE,sBAAsB;oBAC5B,KAAK,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC1C;gBACD,YAAY,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC7F,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,KAAK,uBAAuB,CAAC;aACnG,CAAC;QACJ,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,cAAc;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,UAAU,GAAG,kBAAkB,cAAc,gCAAgC,CAAC;YACpF,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,WAAW,EAAE,UAAU;gBACvB,eAAe,EAAE;oBACf,IAAI,EAAE,mBAAmB;oBACzB,cAAc;oBACd,mBAAmB,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;iBACvF;gBACD,YAAY,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3F,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,KAAK,6BAA6B,CAAC;aACzG,CAAC;QACJ,CAAC;QACD,KAAK,qBAAqB,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,qBAAqB,CAAC,EAAE,SAAS;gBAChG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;YACjD,MAAM,SAAS,GAAG,cAAc,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACjG,KAAK,CAAC,aAAa,CAAC,SAAS,GAAG,SAAS,CAAC;YAC1C,MAAM,KAAK,GAAG,cAAc,IAAI,sCAAsC,CAAC;YACvE,MAAM,UAAU,GAAG,kBAAkB,KAAK,EAAE,CAAC;YAC7C,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,WAAW,EAAE,UAAU;gBACvB,aAAa,EAAE,KAAK;gBACpB,eAAe,EAAE;oBACf,IAAI,EAAE,wBAAwB;oBAC9B,SAAS;iBACV;gBACD,YAAY,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxF,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,KAAK,yBAAyB,CAAC;aACrG,CAAC;QACJ,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtC,KAAK,0BAA0B;YAC7B,OAAO,6BAA6B,CAAC,KAAK,CAAC,CAAC;QAC9C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/governance-activation/phase-bootstrap-state.js

@@ -5,6 +5,7 @@ import { validateArtifactPathParts } from '../domain/project/paths.js';
 import { resolveProjectPath } from '../adapters/filesystem/project-paths.js';
 import { stat } from 'node:fs/promises';
 import { errorMessage } from './transition-process.js';
+import { captureProjectFileSnapshot } from '../adapters/filesystem/project-transaction.js';
 const dayMs = 24 * 60 * 60 * 1000;
 const remoteImportPayloadKind = 'remote-import-verified.v1';
 const bootstrapStateDisposedPayloadKind = 'bootstrap-state-disposed.v1';
@@ -114,6 +115,7 @@ export async function executeBootstrapStateDisposal(input) {
         ...retention, status: 'disposed', disposedAt: input.now.toISOString(),
         deletionEvidenceId: `${input.phase.id}-${safeTimestamp(input.now.toISOString())}`, incompleteCleanup
     };
+    const filePreconditions = await Promise.all(allPaths.map((parts) => captureProjectFileSnapshot(input.inspection.projectRoot, parts)));
     return {
         status: 'completed', resultState: 'disposed', stateOverride: state,
         evidencePayload: {
@@ -121,6 +123,7 @@ export async function executeBootstrapStateDisposal(input) {
             remoteBackendDigest, noChangePlanDigest, incompleteCleanup, payloadFree: true
         },
         fileMutations: allPaths.map((parts) => ({ type: 'delete', pathParts: parts })),
+        filePreconditions,
         completedOperations: input.plan.operations.filter((op) => op.actionId === 'local.bootstrap-state.dispose'),
         cleanupWarnings: incompleteCleanup
     };