@numa-tech/numa 1.13.4 → 1.14.0

package/dist/platform-build-job-replans/schemas.js

@@ -0,0 +1,150 @@
+import { z } from "zod";
+const NonEmpty = z.string().trim().min(1);
+const OptionalString = NonEmpty.nullable();
+const Sha256 = z.string().regex(/^[0-9a-f]{64}$/u);
+const ApplicationCode = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/u);
+const InstanceCode = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/u);
+const SafeKey = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,199}$/u);
+export const PLATFORM_BUILD_JOB_POLICY = "jenkins-job-plan/v2";
+export const PlatformBuildJobTierSchema = z.enum([
+    "DEVELOP", "STAGING", "PRODUCTION", "UNKNOWN"
+]);
+export const PlatformBuildJobPlanRequestSchema = z.object({
+    applicationCode: ApplicationCode,
+    instanceCode: InstanceCode,
+    tier: PlatformBuildJobTierSchema,
+    clientRequestId: SafeKey,
+    idempotencyKey: SafeKey
+}).strict();
+export const PlatformBuildJobApplyRequestSchema = z.object({
+    planNo: NonEmpty,
+    planHash: Sha256,
+    clientRequestId: SafeKey,
+    idempotencyKey: SafeKey
+}).strict();
+export const PlatformBuildJobActionRequestSchema = z.object({
+    idempotencyKey: SafeKey
+}).strict();
+const PlatformBuildJobPlanObjectSchema = z.object({
+    planNo: NonEmpty,
+    operation: z.literal("USE_EXISTING"),
+    state: z.enum(["READY", "BLOCKED", "CONSUMED", "EXPIRED"]),
+    planHash: Sha256,
+    policyVersion: z.literal(PLATFORM_BUILD_JOB_POLICY),
+    clientRequestId: SafeKey,
+    requestDigest: Sha256,
+    applicationCode: ApplicationCode,
+    instanceCode: InstanceCode,
+    canonicalJobId: z.number().int().positive(),
+    canonicalJobFullName: NonEmpty,
+    repositoryKey: NonEmpty,
+    tier: PlatformBuildJobTierSchema,
+    observedConfigDigest: Sha256,
+    sideEffects: z.array(NonEmpty).default([]),
+    warnings: z.array(NonEmpty).default([]),
+    blockers: z.array(NonEmpty).default([]),
+    expiresAt: NonEmpty
+}).strict();
+export const PlatformBuildJobPlanSchema = PlatformBuildJobPlanObjectSchema.superRefine((plan, context) => {
+    const blockerShape = plan.state === "BLOCKED"
+        ? plan.blockers.length > 0
+        : plan.blockers.length === 0;
+    if (!blockerShape) {
+        context.addIssue({
+            code: "custom",
+            path: ["blockers"],
+            message: "Plan blockers do not match the immutable plan state"
+        });
+    }
+});
+export const PlatformBuildJobRunSchema = z.object({
+    runNo: NonEmpty,
+    planNo: NonEmpty,
+    clientRequestId: SafeKey,
+    requestDigest: Sha256,
+    state: z.enum(["ACCEPTED", "RUNNING", "SUCCEEDED", "UNKNOWN", "FAILED"]),
+    stepCode: NonEmpty,
+    canonicalJobId: z.number().int().positive(),
+    canonicalJobFullName: NonEmpty,
+    bindingId: z.number().int().positive(),
+    observedConfigDigest: Sha256.nullable(),
+    retryable: z.boolean(),
+    errorCode: OptionalString,
+    errorMessage: OptionalString,
+    acceptedAt: NonEmpty,
+    startedAt: OptionalString,
+    completedAt: OptionalString
+}).strict();
+const PlatformBuildJobReplanObjectSchema = z.object({
+    policyVersion: z.literal(PLATFORM_BUILD_JOB_POLICY),
+    plan: PlatformBuildJobPlanSchema,
+    run: PlatformBuildJobRunSchema
+}).strict();
+export const PlatformBuildJobReplanSchema = PlatformBuildJobReplanObjectSchema.superRefine((view, context) => {
+    const exactIdentity = view.plan.state === "CONSUMED"
+        && view.plan.blockers.length === 0
+        && view.run.planNo === view.plan.planNo
+        && view.run.canonicalJobId === view.plan.canonicalJobId
+        && view.run.canonicalJobFullName === view.plan.canonicalJobFullName
+        && (view.run.observedConfigDigest == null
+            || view.run.observedConfigDigest === view.plan.observedConfigDigest);
+    if (!exactIdentity) {
+        context.addIssue({
+            code: "custom",
+            path: ["run"],
+            message: "Replan run does not match its immutable plan"
+        });
+    }
+    if (view.run.state === "SUCCEEDED"
+        && (view.run.observedConfigDigest !== view.plan.observedConfigDigest
+            || view.run.startedAt == null || view.run.completedAt == null
+            || view.run.errorCode != null || view.run.errorMessage != null
+            || view.run.retryable)) {
+        context.addIssue({
+            code: "custom",
+            path: ["run"],
+            message: "Succeeded replan requires exact terminal configuration evidence"
+        });
+    }
+    if (view.run.state === "UNKNOWN"
+        && (view.run.startedAt == null || view.run.errorCode == null
+            || view.run.observedConfigDigest != null || !view.run.retryable
+            || view.run.completedAt != null)) {
+        context.addIssue({
+            code: "custom",
+            path: ["run"],
+            message: "Unknown replan requires retryable non-terminal evidence"
+        });
+    }
+    if (view.run.state === "FAILED"
+        && (view.run.startedAt == null || view.run.errorCode == null
+            || view.run.completedAt == null || view.run.observedConfigDigest != null
+            || view.run.retryable)) {
+        context.addIssue({
+            code: "custom",
+            path: ["run"],
+            message: "Failed replan requires terminal error evidence"
+        });
+    }
+    if (view.run.state === "ACCEPTED"
+        && (view.run.startedAt != null || view.run.completedAt != null
+            || view.run.observedConfigDigest != null || view.run.errorCode != null
+            || view.run.errorMessage != null || view.run.retryable)) {
+        context.addIssue({
+            code: "custom",
+            path: ["run"],
+            message: "Accepted replan cannot carry execution or terminal evidence"
+        });
+    }
+    if (view.run.state === "RUNNING"
+        && (view.run.startedAt == null || view.run.completedAt != null
+            || view.run.observedConfigDigest != null || view.run.errorCode != null
+            || view.run.errorMessage != null || view.run.retryable)) {
+        context.addIssue({
+            code: "custom",
+            path: ["run"],
+            message: "Running replan requires exact non-terminal execution evidence"
+        });
+    }
+});
+//# sourceMappingURL=schemas.js.map

package/dist/platform-build-job-replans/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/platform-build-job-replans/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1C,MAAM,cAAc,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACnD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;AAC/E,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;AAC5E,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAA8B,CAAC;AAExE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,eAAe,EAAE,eAAe;IAChC,YAAY,EAAE,YAAY;IAC1B,IAAI,EAAE,0BAA0B;IAChC,eAAe,EAAE,OAAO;IACxB,cAAc,EAAE,OAAO;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,MAAM;IAChB,eAAe,EAAE,OAAO;IACxB,cAAc,EAAE,OAAO;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,cAAc,EAAE,OAAO;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC1D,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;IACnD,eAAe,EAAE,OAAO;IACxB,aAAa,EAAE,MAAM;IACrB,eAAe,EAAE,eAAe;IAChC,YAAY,EAAE,YAAY;IAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,QAAQ;IAC9B,aAAa,EAAE,QAAQ;IACvB,IAAI,EAAE,0BAA0B;IAChC,oBAAoB,EAAE,MAAM;IAC5B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,QAAQ;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC,WAAW,CACpF,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAChB,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS;QAC3C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,QAAQ;IAChB,eAAe,EAAE,OAAO;IACxB,aAAa,EAAE,MAAM;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACxE,QAAQ,EAAE,QAAQ;IAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,QAAQ;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,oBAAoB,EAAE,MAAM,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,cAAc;IACzB,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,cAAc;IACzB,WAAW,EAAE,cAAc;CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;IACnD,IAAI,EAAE,0BAA0B;IAChC,GAAG,EAAE,yBAAyB;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,kCAAkC,CAAC,WAAW,CACxF,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAChB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU;WAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;WAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;WACpC,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc;WACpD,IAAI,CAAC,GAAG,CAAC,oBAAoB,KAAK,IAAI,CAAC,IAAI,CAAC,oBAAoB;WAChE,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI;eACpC,IAAI,CAAC,GAAG,CAAC,oBAAoB,KAAK,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACzE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,8CAA8C;SACxD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW;WAC3B,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,KAAK,IAAI,CAAC,IAAI,CAAC,oBAAoB;eAC/D,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI;eAC1D,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI;eAC3D,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS;WACzB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI;eACvD,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS;eAC5D,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ;WACxB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI;eACvD,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI;eACrE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU;WAC1B,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI;eACzD,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI;eACnE,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS;WACzB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI;eACzD,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI;eACnE,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,OAAO,EAAE,+DAA+D;SACzE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CACF,CAAC"}

package/dist/platform-build-rollouts/client.d.ts

@@ -0,0 +1,346 @@
+import type { AuthConfig } from "../config.js";
+import { type KeycloakTokenProvider } from "../oauth.js";
+import { type PlatformBuildRolloutApplyRequest, type PlatformBuildRolloutConfigureRequest, type PlatformBuildRolloutPlanRequest } from "./schemas.js";
+export declare const PLATFORM_BUILD_ROLLOUT_API_ROOT = "/api/v1/admin/jenkins";
+export interface PlatformBuildRolloutClientDependencies {
+    fetch?: typeof fetch;
+    tokenProvider?: KeycloakTokenProvider;
+}
+export declare class PlatformBuildRolloutClient {
+    private readonly config;
+    private readonly fetchImpl;
+    private readonly tokenProvider;
+    constructor(config: AuthConfig, dependencies?: PlatformBuildRolloutClientDependencies);
+    private authenticatedFetch;
+    private json;
+    createPlan(input: PlatformBuildRolloutPlanRequest, key: string): Promise<{
+        planNo: string;
+        operation: "DISABLE_PLATFORM" | "ENABLE_PLATFORM";
+        state: "BLOCKED" | "CONSUMED" | "EXPIRED" | "READY";
+        planHash: string;
+        applicationCode: string;
+        instanceCode: string;
+        contractVersion: "gitops-image-delivery/v2" | null;
+        sharedLibraryRevision: string | null;
+        readiness: {
+            verificationMode?: "JENKINS_API_VERIFIED" | undefined;
+            publicConfiguration?: {
+                contractVersion?: "gitops-image-delivery/v2" | null | undefined;
+                sharedLibraryRevision?: string | null | undefined;
+                platformUrl?: string | null | undefined;
+                oidcEndpoint?: string | null | undefined;
+                jenkinsInstanceCode?: string | null | undefined;
+                audience?: string | null | undefined;
+                rolloutMode?: "platform" | null | undefined;
+                legacyFallback?: false | null | undefined;
+                rolloutEntry?: string | null | undefined;
+                snapshotFolderFullName?: "mci-platform-snapshots" | null | undefined;
+            } | undefined;
+            credentialReferences?: {
+                writerCredentialReference?: string | null | undefined;
+            } | undefined;
+            sourcePolicy?: {
+                entrypoint: "platformBuildEntry()";
+                jenkinsfileDigest: string;
+                buildProfileDigest: string;
+                buildProfile: {
+                    contract: "platform-build/v1";
+                    agentLabel: string;
+                    appHome: string;
+                    buildFlow: "DOCKER";
+                    nodeVersion: string | null;
+                    sonarScan: false;
+                    sendNotify: false;
+                };
+            } | undefined;
+        };
+        sideEffects: string[];
+        blockers: string[];
+        expiresAt: string | null;
+    }>;
+    getPlan(planNo: string): Promise<{
+        planNo: string;
+        operation: "DISABLE_PLATFORM" | "ENABLE_PLATFORM";
+        state: "BLOCKED" | "CONSUMED" | "EXPIRED" | "READY";
+        planHash: string;
+        applicationCode: string;
+        instanceCode: string;
+        contractVersion: "gitops-image-delivery/v2" | null;
+        sharedLibraryRevision: string | null;
+        readiness: {
+            verificationMode?: "JENKINS_API_VERIFIED" | undefined;
+            publicConfiguration?: {
+                contractVersion?: "gitops-image-delivery/v2" | null | undefined;
+                sharedLibraryRevision?: string | null | undefined;
+                platformUrl?: string | null | undefined;
+                oidcEndpoint?: string | null | undefined;
+                jenkinsInstanceCode?: string | null | undefined;
+                audience?: string | null | undefined;
+                rolloutMode?: "platform" | null | undefined;
+                legacyFallback?: false | null | undefined;
+                rolloutEntry?: string | null | undefined;
+                snapshotFolderFullName?: "mci-platform-snapshots" | null | undefined;
+            } | undefined;
+            credentialReferences?: {
+                writerCredentialReference?: string | null | undefined;
+            } | undefined;
+            sourcePolicy?: {
+                entrypoint: "platformBuildEntry()";
+                jenkinsfileDigest: string;
+                buildProfileDigest: string;
+                buildProfile: {
+                    contract: "platform-build/v1";
+                    agentLabel: string;
+                    appHome: string;
+                    buildFlow: "DOCKER";
+                    nodeVersion: string | null;
+                    sonarScan: false;
+                    sendNotify: false;
+                };
+            } | undefined;
+        };
+        sideEffects: string[];
+        blockers: string[];
+        expiresAt: string | null;
+    }>;
+    apply(input: PlatformBuildRolloutApplyRequest, key: string): Promise<{
+        rolloutNo: string;
+        applicationCode: string;
+        instanceCode: string;
+        desiredMode: "DISABLED" | "PLATFORM";
+        status: "ACTION_REQUIRED" | "DISABLED" | "DISABLE_ACTION_REQUIRED" | "READY" | "STALE";
+        contractVersion: "gitops-image-delivery/v2" | null;
+        sharedLibraryRevision: string | null;
+        verificationSource: "JENKINS_API_VERIFIED" | null;
+        verificationReference: string | null;
+        verifiedAt: string | null;
+        version: number;
+        expectedPublicConfiguration: Record<string, never> | {
+            contractVersion: "gitops-image-delivery/v2";
+            sharedLibraryRevision: string;
+            platformUrl: string;
+            oidcEndpoint: string;
+            jenkinsInstanceCode: string;
+            audience: string;
+            rolloutMode: "platform";
+            legacyFallback: false;
+            rolloutEntry: string;
+            snapshotFolderFullName: "mci-platform-snapshots";
+        };
+        expectedCredentialReferences: Record<string, never> | {
+            writerCredentialReference: string;
+        };
+        requiredActions: string[];
+        verificationState: "DRIFTED" | "UNAVAILABLE" | "VERIFIED";
+        configurationDigest: string | null;
+        observedSharedLibraryRevision: string | null;
+        writerCredentialConfigured: boolean;
+        verifiedSourceRevision: string | null;
+        jenkinsfileDigest: string | null;
+    }>;
+    list(options?: {
+        applicationCode?: string;
+        instanceCode?: string;
+    }): Promise<{
+        rolloutNo: string;
+        applicationCode: string;
+        instanceCode: string;
+        desiredMode: "DISABLED" | "PLATFORM";
+        status: "ACTION_REQUIRED" | "DISABLED" | "DISABLE_ACTION_REQUIRED" | "READY" | "STALE";
+        contractVersion: "gitops-image-delivery/v2" | null;
+        sharedLibraryRevision: string | null;
+        verificationSource: "JENKINS_API_VERIFIED" | null;
+        verificationReference: string | null;
+        verifiedAt: string | null;
+        version: number;
+        expectedPublicConfiguration: Record<string, never> | {
+            contractVersion: "gitops-image-delivery/v2";
+            sharedLibraryRevision: string;
+            platformUrl: string;
+            oidcEndpoint: string;
+            jenkinsInstanceCode: string;
+            audience: string;
+            rolloutMode: "platform";
+            legacyFallback: false;
+            rolloutEntry: string;
+            snapshotFolderFullName: "mci-platform-snapshots";
+        };
+        expectedCredentialReferences: Record<string, never> | {
+            writerCredentialReference: string;
+        };
+        requiredActions: string[];
+        verificationState: "DRIFTED" | "UNAVAILABLE" | "VERIFIED";
+        configurationDigest: string | null;
+        observedSharedLibraryRevision: string | null;
+        writerCredentialConfigured: boolean;
+        verifiedSourceRevision: string | null;
+        jenkinsfileDigest: string | null;
+    }[]>;
+    get(rolloutNo: string): Promise<{
+        rolloutNo: string;
+        applicationCode: string;
+        instanceCode: string;
+        desiredMode: "DISABLED" | "PLATFORM";
+        status: "ACTION_REQUIRED" | "DISABLED" | "DISABLE_ACTION_REQUIRED" | "READY" | "STALE";
+        contractVersion: "gitops-image-delivery/v2" | null;
+        sharedLibraryRevision: string | null;
+        verificationSource: "JENKINS_API_VERIFIED" | null;
+        verificationReference: string | null;
+        verifiedAt: string | null;
+        version: number;
+        expectedPublicConfiguration: Record<string, never> | {
+            contractVersion: "gitops-image-delivery/v2";
+            sharedLibraryRevision: string;
+            platformUrl: string;
+            oidcEndpoint: string;
+            jenkinsInstanceCode: string;
+            audience: string;
+            rolloutMode: "platform";
+            legacyFallback: false;
+            rolloutEntry: string;
+            snapshotFolderFullName: "mci-platform-snapshots";
+        };
+        expectedCredentialReferences: Record<string, never> | {
+            writerCredentialReference: string;
+        };
+        requiredActions: string[];
+        verificationState: "DRIFTED" | "UNAVAILABLE" | "VERIFIED";
+        configurationDigest: string | null;
+        observedSharedLibraryRevision: string | null;
+        writerCredentialConfigured: boolean;
+        verifiedSourceRevision: string | null;
+        jenkinsfileDigest: string | null;
+    }>;
+    configure(rolloutNo: string, input: PlatformBuildRolloutConfigureRequest, key: string): Promise<{
+        rolloutNo: string;
+        applicationCode: string;
+        instanceCode: string;
+        desiredMode: "DISABLED" | "PLATFORM";
+        status: "ACTION_REQUIRED" | "DISABLED" | "DISABLE_ACTION_REQUIRED" | "READY" | "STALE";
+        contractVersion: "gitops-image-delivery/v2" | null;
+        sharedLibraryRevision: string | null;
+        verificationSource: "JENKINS_API_VERIFIED" | null;
+        verificationReference: string | null;
+        verifiedAt: string | null;
+        version: number;
+        expectedPublicConfiguration: Record<string, never> | {
+            contractVersion: "gitops-image-delivery/v2";
+            sharedLibraryRevision: string;
+            platformUrl: string;
+            oidcEndpoint: string;
+            jenkinsInstanceCode: string;
+            audience: string;
+            rolloutMode: "platform";
+            legacyFallback: false;
+            rolloutEntry: string;
+            snapshotFolderFullName: "mci-platform-snapshots";
+        };
+        expectedCredentialReferences: Record<string, never> | {
+            writerCredentialReference: string;
+        };
+        requiredActions: string[];
+        verificationState: "DRIFTED" | "UNAVAILABLE" | "VERIFIED";
+        configurationDigest: string | null;
+        observedSharedLibraryRevision: string | null;
+        writerCredentialConfigured: boolean;
+        verifiedSourceRevision: string | null;
+        jenkinsfileDigest: string | null;
+    }>;
+    private configureRecovery;
+    reconcileConfigure(rolloutNo: string, input: PlatformBuildRolloutConfigureRequest, key: string): Promise<{
+        rolloutNo: string;
+        idempotencyKey: string;
+        requestDigest: string;
+        expectedVersion: number;
+        state: "FAILED" | "PENDING" | "RECOVERING" | "SUCCEEDED" | "UNKNOWN";
+        disposition: "CONFLICT" | "FAILED" | "PENDING" | "READBACK_UNKNOWN" | "RECOVERING" | "UNTOUCHED" | "VERIFIED" | "WRITE_UNKNOWN";
+        resultVersion: number | null;
+        errorCode: string | null;
+        retryable: boolean;
+        reapplyAllowed: boolean;
+        recoveryStartedAt: string | null;
+        rollout: {
+            rolloutNo: string;
+            applicationCode: string;
+            instanceCode: string;
+            desiredMode: "DISABLED" | "PLATFORM";
+            status: "ACTION_REQUIRED" | "DISABLED" | "DISABLE_ACTION_REQUIRED" | "READY" | "STALE";
+            contractVersion: "gitops-image-delivery/v2" | null;
+            sharedLibraryRevision: string | null;
+            verificationSource: "JENKINS_API_VERIFIED" | null;
+            verificationReference: string | null;
+            verifiedAt: string | null;
+            version: number;
+            expectedPublicConfiguration: Record<string, never> | {
+                contractVersion: "gitops-image-delivery/v2";
+                sharedLibraryRevision: string;
+                platformUrl: string;
+                oidcEndpoint: string;
+                jenkinsInstanceCode: string;
+                audience: string;
+                rolloutMode: "platform";
+                legacyFallback: false;
+                rolloutEntry: string;
+                snapshotFolderFullName: "mci-platform-snapshots";
+            };
+            expectedCredentialReferences: Record<string, never> | {
+                writerCredentialReference: string;
+            };
+            requiredActions: string[];
+            verificationState: "DRIFTED" | "UNAVAILABLE" | "VERIFIED";
+            configurationDigest: string | null;
+            observedSharedLibraryRevision: string | null;
+            writerCredentialConfigured: boolean;
+            verifiedSourceRevision: string | null;
+            jenkinsfileDigest: string | null;
+        };
+    }>;
+    reapplyConfigure(rolloutNo: string, input: PlatformBuildRolloutConfigureRequest, key: string): Promise<{
+        rolloutNo: string;
+        idempotencyKey: string;
+        requestDigest: string;
+        expectedVersion: number;
+        state: "FAILED" | "PENDING" | "RECOVERING" | "SUCCEEDED" | "UNKNOWN";
+        disposition: "CONFLICT" | "FAILED" | "PENDING" | "READBACK_UNKNOWN" | "RECOVERING" | "UNTOUCHED" | "VERIFIED" | "WRITE_UNKNOWN";
+        resultVersion: number | null;
+        errorCode: string | null;
+        retryable: boolean;
+        reapplyAllowed: boolean;
+        recoveryStartedAt: string | null;
+        rollout: {
+            rolloutNo: string;
+            applicationCode: string;
+            instanceCode: string;
+            desiredMode: "DISABLED" | "PLATFORM";
+            status: "ACTION_REQUIRED" | "DISABLED" | "DISABLE_ACTION_REQUIRED" | "READY" | "STALE";
+            contractVersion: "gitops-image-delivery/v2" | null;
+            sharedLibraryRevision: string | null;
+            verificationSource: "JENKINS_API_VERIFIED" | null;
+            verificationReference: string | null;
+            verifiedAt: string | null;
+            version: number;
+            expectedPublicConfiguration: Record<string, never> | {
+                contractVersion: "gitops-image-delivery/v2";
+                sharedLibraryRevision: string;
+                platformUrl: string;
+                oidcEndpoint: string;
+                jenkinsInstanceCode: string;
+                audience: string;
+                rolloutMode: "platform";
+                legacyFallback: false;
+                rolloutEntry: string;
+                snapshotFolderFullName: "mci-platform-snapshots";
+            };
+            expectedCredentialReferences: Record<string, never> | {
+                writerCredentialReference: string;
+            };
+            requiredActions: string[];
+            verificationState: "DRIFTED" | "UNAVAILABLE" | "VERIFIED";
+            configurationDigest: string | null;
+            observedSharedLibraryRevision: string | null;
+            writerCredentialConfigured: boolean;
+            verifiedSourceRevision: string | null;
+            jenkinsfileDigest: string | null;
+        };
+    }>;
+}

package/dist/platform-build-rollouts/client.js

@@ -0,0 +1,153 @@
+import { resolveBackendUrl } from "../backend.js";
+import { ensureAccessToken, fetchWithKeycloakIdentity } from "../oauth.js";
+import { PipelineError, redactPipelineText } from "../pipeline/errors.js";
+import { ApiErrorSchema } from "../pipeline/schemas.js";
+import { PlatformBuildRolloutApplyRequestSchema, PlatformBuildRolloutConfigureRequestSchema, PlatformBuildRolloutConfigureActionSchema, PlatformBuildRolloutListSchema, PlatformBuildRolloutPlanRequestSchema, PlatformBuildRolloutPlanSchema, PlatformBuildRolloutSchema } from "./schemas.js";
+export const PLATFORM_BUILD_ROLLOUT_API_ROOT = "/api/v1/admin/jenkins";
+function stableIdentifier(value, label, maximum = 160) {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > maximum
+        || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(trimmed)) {
+        throw new PipelineError(`${label} is invalid.`, "JENKINS_PLATFORM_BUILD_ROLLOUT_INPUT_INVALID");
+    }
+    return trimmed;
+}
+function idempotencyKey(value) {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > 200
+        || !/^[A-Za-z0-9][A-Za-z0-9._:/+-]*$/u.test(trimmed)) {
+        throw new PipelineError("idempotency-key must be 1-200 safe opaque characters.", "JENKINS_PLATFORM_BUILD_ROLLOUT_IDEMPOTENCY_INVALID");
+    }
+    return trimmed;
+}
+function queryPath(path, values) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(values)) {
+        if (value != null && value !== "")
+            query.set(key, value);
+    }
+    return query.size ? `${path}?${query.toString()}` : path;
+}
+async function responseBody(response) {
+    const text = await response.text();
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function requestIdFrom(response, body) {
+    if (body && typeof body === "object" && "requestId" in body
+        && typeof body.requestId === "string")
+        return body.requestId;
+    return response.headers.get("x-request-id") ?? undefined;
+}
+function apiFailure(response, body) {
+    const parsed = ApiErrorSchema.safeParse(body);
+    const message = parsed.success
+        ? parsed.data.message ?? response.statusText ?? "Platform-build rollout API request failed."
+        : typeof body === "string" ? body
+            : response.statusText || "Platform-build rollout API request failed.";
+    return new PipelineError(`Platform-build rollout API HTTP ${response.status}: ${redactPipelineText(message)}`, parsed.success
+        ? parsed.data.code ?? "JENKINS_PLATFORM_BUILD_ROLLOUT_API_ERROR"
+        : "JENKINS_PLATFORM_BUILD_ROLLOUT_API_ERROR", response.status, requestIdFrom(response, body));
+}
+export class PlatformBuildRolloutClient {
+    config;
+    fetchImpl;
+    tokenProvider;
+    constructor(config, dependencies = {}) {
+        this.config = config;
+        this.fetchImpl = dependencies.fetch ?? fetch;
+        this.tokenProvider = dependencies.tokenProvider ?? ensureAccessToken;
+    }
+    async authenticatedFetch(path, init = {}) {
+        const method = String(init.method ?? "GET").toUpperCase();
+        const url = resolveBackendUrl(this.config, { method, path });
+        const headers = new Headers(init.headers);
+        headers.set("Accept", "application/json");
+        if (init.body != null)
+            headers.set("Content-Type", "application/json");
+        return fetchWithKeycloakIdentity(this.config, url, () => ({ ...init, headers }), {
+            fetch: this.fetchImpl,
+            tokenProvider: this.tokenProvider
+        });
+    }
+    async json(path, schema, init = {}, expectedStatuses) {
+        const response = await this.authenticatedFetch(path, init);
+        const body = await responseBody(response);
+        if (!response.ok)
+            throw apiFailure(response, body);
+        if (expectedStatuses && !expectedStatuses.includes(response.status)) {
+            throw new PipelineError(`Platform-build rollout API returned HTTP ${response.status}; expected ${expectedStatuses.join(" or ")}.`, "JENKINS_PLATFORM_BUILD_ROLLOUT_INVALID_RESPONSE", response.status, requestIdFrom(response, body));
+        }
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            throw new PipelineError(`Platform-build rollout API returned an invalid response: ${parsed.error.message}`, "JENKINS_PLATFORM_BUILD_ROLLOUT_INVALID_RESPONSE", response.status, requestIdFrom(response, body));
+        }
+        return parsed.data;
+    }
+    createPlan(input, key) {
+        const parsed = PlatformBuildRolloutPlanRequestSchema.safeParse(input);
+        if (!parsed.success) {
+            throw new PipelineError(`Platform-build rollout plan input is invalid: ${parsed.error.message}`, "JENKINS_PLATFORM_BUILD_ROLLOUT_INPUT_INVALID");
+        }
+        return this.json(`${PLATFORM_BUILD_ROLLOUT_API_ROOT}/platform-build-rollout-plans`, PlatformBuildRolloutPlanSchema, {
+            method: "POST",
+            headers: { "Idempotency-Key": idempotencyKey(key) },
+            body: JSON.stringify(parsed.data)
+        }, [200]);
+    }
+    getPlan(planNo) {
+        return this.json(`${PLATFORM_BUILD_ROLLOUT_API_ROOT}/platform-build-rollout-plans/${encodeURIComponent(stableIdentifier(planNo, "plan-no", 120))}`, PlatformBuildRolloutPlanSchema);
+    }
+    apply(input, key) {
+        const parsed = PlatformBuildRolloutApplyRequestSchema.safeParse(input);
+        if (!parsed.success) {
+            throw new PipelineError(`Platform-build rollout apply input is invalid: ${parsed.error.message}`, "JENKINS_PLATFORM_BUILD_ROLLOUT_INPUT_INVALID");
+        }
+        return this.json(`${PLATFORM_BUILD_ROLLOUT_API_ROOT}/platform-build-rollouts`, PlatformBuildRolloutSchema, {
+            method: "POST",
+            headers: { "Idempotency-Key": idempotencyKey(key) },
+            body: JSON.stringify(parsed.data)
+        }, [202]);
+    }
+    list(options = {}) {
+        return this.json(queryPath(`${PLATFORM_BUILD_ROLLOUT_API_ROOT}/platform-build-rollouts`, options), PlatformBuildRolloutListSchema);
+    }
+    get(rolloutNo) {
+        return this.json(`${PLATFORM_BUILD_ROLLOUT_API_ROOT}/platform-build-rollouts/${encodeURIComponent(stableIdentifier(rolloutNo, "rollout-no", 120))}`, PlatformBuildRolloutSchema);
+    }
+    configure(rolloutNo, input, key) {
+        const parsed = PlatformBuildRolloutConfigureRequestSchema.safeParse(input);
+        if (!parsed.success) {
+            throw new PipelineError(`Platform-build rollout configure input is invalid: ${parsed.error.message}`, "JENKINS_PLATFORM_BUILD_ROLLOUT_INPUT_INVALID");
+        }
+        return this.json(`${PLATFORM_BUILD_ROLLOUT_API_ROOT}/platform-build-rollouts/${encodeURIComponent(stableIdentifier(rolloutNo, "rollout-no", 120))}/configure`, PlatformBuildRolloutSchema, {
+            method: "POST",
+            headers: { "Idempotency-Key": idempotencyKey(key) },
+            body: JSON.stringify(parsed.data)
+        }, [200]);
+    }
+    configureRecovery(operation, rolloutNo, input, key) {
+        const parsed = PlatformBuildRolloutConfigureRequestSchema.safeParse(input);
+        if (!parsed.success) {
+            throw new PipelineError(`Platform-build rollout configure recovery input is invalid: ${parsed.error.message}`, "JENKINS_PLATFORM_BUILD_ROLLOUT_INPUT_INVALID");
+        }
+        return this.json(`${PLATFORM_BUILD_ROLLOUT_API_ROOT}/platform-build-rollouts/${encodeURIComponent(stableIdentifier(rolloutNo, "rollout-no", 120))}/configure/${operation}`, PlatformBuildRolloutConfigureActionSchema, {
+            method: "POST",
+            headers: { "Idempotency-Key": idempotencyKey(key) },
+            body: JSON.stringify(parsed.data)
+        }, [200]);
+    }
+    reconcileConfigure(rolloutNo, input, key) {
+        return this.configureRecovery("reconcile", rolloutNo, input, key);
+    }
+    reapplyConfigure(rolloutNo, input, key) {
+        return this.configureRecovery("reapply", rolloutNo, input, key);
+    }
+}
+//# sourceMappingURL=client.js.map