@tiangong-lca/cli 0.0.25 → 0.0.26

package/dist/src/lib/dataset-maintenance-protected-freeze.js

@@ -0,0 +1,230 @@
+import path from 'node:path';
+import { buildAliasPlanRequest } from './dataset-maintenance-alias-request.js';
+import { readProtectedJsonArtifact, materializePrivateArtifactDirectoryAtomically, writePrivateImmutableJson, writePrivateImmutableText, } from './dataset-maintenance-protected-artifacts.js';
+import { validateProtectedBeforeState, } from './dataset-maintenance-protected-before.js';
+import { parseMaintenancePlan, sha256Json, sha256Text, stableJsonText, } from './dataset-maintenance-contract.js';
+import { PROTECTED_EXECUTION_COUNTS, } from './dataset-maintenance-protected-contract.js';
+import { assertProtectedPreparationPlanSha256, assertProtectedProductionProjectRef, buildProtectedApprovalRequest, buildProtectedFreeze, deriveProtectedDerivativeSnapshotTargets, } from './dataset-maintenance-protected-preparation.js';
+import { fetchMaintenanceAccountRows, resolveMaintenanceRemoteContext, } from './dataset-maintenance-remote.js';
+import { parseProtectedToolchainEvidence, } from './dataset-maintenance-protected-toolchain.js';
+import { CliError } from './errors.js';
+export const PROTECTED_FREEZE_ARTIFACTS = {
+    alias_plan_request: 'protected-alias-plan-request.json',
+    derivative_baselines: 'protected-derivative-baselines.json',
+    freeze: 'protected-execution-freeze.json',
+    approval_request: 'protected-approval-request.json',
+    approval_text: 'protected-approval-request.txt',
+    report: 'protected-freeze-report.json',
+};
+const DEFAULT_FREEZE_DEPENDENCIES = {
+    readArtifact: readProtectedJsonArtifact,
+    parsePlan: parseMaintenancePlan,
+    buildAliasPlan: buildAliasPlanRequest,
+    resolveContext: resolveMaintenanceRemoteContext,
+    fetchAccountRows: fetchMaintenanceAccountRows,
+    parseToolchain: parseProtectedToolchainEvidence,
+    deriveTargets: deriveProtectedDerivativeSnapshotTargets,
+    validateBefore: validateProtectedBeforeState,
+    buildFreeze: buildProtectedFreeze,
+    buildApprovalRequest: buildProtectedApprovalRequest,
+    writeJson: writePrivateImmutableJson,
+    writeText: writePrivateImmutableText,
+    materializeArtifacts: materializePrivateArtifactDirectoryAtomically,
+};
+function requiredToken(value, label) {
+    if (!value || value.trim() !== value) {
+        throw new CliError(`${label} must be a non-empty canonical string.`, {
+            code: 'DATASET_MAINTENANCE_PROTECTED_FREEZE_INPUT_INVALID',
+            exitCode: 2,
+        });
+    }
+    return value;
+}
+function assertContext(options) {
+    const account = options.context.account;
+    if (options.context.project_ref !== options.expectedProjectRef ||
+        account.user_id !== options.plan.account.user_id ||
+        account.email !== options.plan.account.email ||
+        account.email !== options.confirm) {
+        throw new CliError('Authenticated context does not match the explicitly confirmed production project and plan account.', {
+            code: 'DATASET_MAINTENANCE_PROTECTED_FREEZE_CONTEXT_MISMATCH',
+            exitCode: 1,
+            details: {
+                expected_project_ref: options.expectedProjectRef,
+                observed_project_ref: options.context.project_ref,
+                expected_user_id: options.plan.account.user_id,
+                observed_user_id: account.user_id,
+            },
+        });
+    }
+    return { user_id: account.user_id, email: account.email };
+}
+function assertCanonicalToolchainArtifact(options) {
+    if (options.artifactText !== `${stableJsonText(options.evidence)}\n`) {
+        throw new CliError('Toolchain evidence must be canonical JSON with exactly one final newline.', {
+            code: 'DATASET_MAINTENANCE_PROTECTED_TOOLCHAIN_NONCANONICAL',
+            exitCode: 2,
+        });
+    }
+}
+function artifactPaths(outDir) {
+    const resolved = path.resolve(outDir);
+    return Object.fromEntries(Object.entries(PROTECTED_FREEZE_ARTIFACTS).map(([key, name]) => [
+        key,
+        path.join(resolved, name),
+    ]));
+}
+function buildBaselineManifest(options) {
+    const snapshots = options.validation.derivative_snapshots;
+    return {
+        schema_version: 'dataset-alias-derivative-baselines.v1',
+        environment: 'production',
+        project_ref: options.context.project_ref,
+        account: options.account,
+        plan: {
+            plan_sha256: options.plan.plan_sha256,
+            operation_id: options.plan.operation_id,
+        },
+        target_count: 50,
+        flow_count: 23,
+        process_count: 27,
+        derivative_baseline_set_sha256: options.derivativeBaselineSetSha256,
+        derivative_snapshot_set_sha256: sha256Json(snapshots),
+        snapshots,
+    };
+}
+export async function freezeDatasetMaintenanceProtected(options, dependencies = DEFAULT_FREEZE_DEPENDENCIES) {
+    const planPath = requiredToken(options.planPath, 'planPath');
+    const toolchainEvidencePath = requiredToken(options.toolchainEvidencePath, 'toolchainEvidencePath');
+    const outDir = requiredToken(options.outDir, 'outDir');
+    const expectedProjectRef = requiredToken(options.expectedProjectRef, 'expectedProjectRef');
+    assertProtectedProductionProjectRef(expectedProjectRef);
+    const confirm = requiredToken(options.confirm, 'confirm');
+    const cliVersion = requiredToken(options.cliVersion, 'cliVersion');
+    const generatedAtUtc = (options.now ?? new Date()).toISOString();
+    const planArtifact = dependencies.readArtifact({
+        filePath: planPath,
+        label: 'Protected maintenance plan',
+    });
+    const plan = dependencies.parsePlan(planArtifact.value);
+    assertProtectedPreparationPlanSha256(plan.plan_sha256, 'plan.plan_sha256');
+    const planDir = path.dirname(planArtifact.resolved);
+    const aliasPlanRequest = dependencies.buildAliasPlan({ plan, planDir });
+    const toolchainArtifact = dependencies.readArtifact({
+        filePath: toolchainEvidencePath,
+        label: 'Protected toolchain evidence',
+    });
+    const toolchainEvidence = dependencies.parseToolchain(toolchainArtifact.value, {
+        projectRef: expectedProjectRef,
+        cliVersion,
+    });
+    assertCanonicalToolchainArtifact({
+        artifactText: toolchainArtifact.text,
+        evidence: toolchainEvidence,
+    });
+    const context = await dependencies.resolveContext({
+        env: options.env,
+        fetchImpl: options.fetchImpl,
+        timeoutMs: options.timeoutMs,
+        now: options.now,
+    });
+    const account = assertContext({ context, plan, expectedProjectRef, confirm });
+    const current = await dependencies.fetchAccountRows({
+        context,
+        userId: account.user_id,
+        pageSize: options.pageSize,
+    });
+    const derivativeTargets = dependencies.deriveTargets(plan, account);
+    const validation = await dependencies.validateBefore({
+        plan,
+        planDir,
+        actorUserId: account.user_id,
+        currentRows: current.rows,
+        completeness: current.completeness,
+        context,
+        derivativeMode: 'capture',
+        derivativeTargets,
+    });
+    const builtFreeze = dependencies.buildFreeze({
+        plan,
+        planFileSha256: planArtifact.file_sha256,
+        aliasPlanRequest,
+        projectRef: context.project_ref,
+        account,
+        toolchainEvidenceSha256: toolchainArtifact.file_sha256,
+        derivativeSnapshots: validation.derivative_snapshots,
+    });
+    const approvalRequest = dependencies.buildApprovalRequest({
+        freeze: builtFreeze.value,
+        freezeFileSha256: builtFreeze.file_sha256,
+        approvedAtUtc: generatedAtUtc,
+    });
+    const baselineManifest = buildBaselineManifest({
+        context,
+        plan,
+        account,
+        validation,
+        derivativeBaselineSetSha256: builtFreeze.value.sets.derivative_baseline_set_sha256,
+    });
+    const paths = artifactPaths(outDir);
+    const aliasPlanText = `${stableJsonText(aliasPlanRequest)}\n`;
+    const baselineText = `${stableJsonText(baselineManifest)}\n`;
+    const report = {
+        schema_version: 'dataset-alias-protected-freeze-report.v1',
+        generated_at_utc: generatedAtUtc,
+        status: 'ready_for_human_approval',
+        remote_write_mode: 'read_only',
+        environment: 'production',
+        project_ref: context.project_ref,
+        account,
+        plan_sha256: plan.plan_sha256,
+        operation_id: plan.operation_id,
+        freeze_sha256: builtFreeze.value.freeze_sha256,
+        approval_request_sha256: approvalRequest.value.request_sha256,
+        approval_text_sha256: approvalRequest.value.approval_text_sha256,
+        toolchain_evidence_sha256: toolchainArtifact.file_sha256,
+        derivative_baseline_set_sha256: builtFreeze.value.sets.derivative_baseline_set_sha256,
+        derivative_snapshot_set_sha256: baselineManifest.derivative_snapshot_set_sha256,
+        counts: PROTECTED_EXECUTION_COUNTS,
+        assertions: {
+            account_census_complete: true,
+            strict_before_state: true,
+            projected_reference_closure: true,
+            support_snapshots: 6,
+            derivative_snapshots: 50,
+            preflight_calls: 0,
+            gate_calls: 0,
+            admission_calls: 0,
+            mutation_calls: 0,
+            approval_artifacts: 0,
+        },
+        artifacts: paths,
+        artifact_sha256: {
+            alias_plan_request: sha256Text(aliasPlanText),
+            derivative_baselines: sha256Text(baselineText),
+            freeze: builtFreeze.file_sha256,
+            approval_request: approvalRequest.file_sha256,
+            approval_text: approvalRequest.value.approval_text_sha256,
+            report: null,
+        },
+    };
+    dependencies.materializeArtifacts(outDir, (stagingDirectory) => {
+        const staging = artifactPaths(stagingDirectory);
+        dependencies.writeText(staging.alias_plan_request, aliasPlanText);
+        dependencies.writeText(staging.derivative_baselines, baselineText);
+        dependencies.writeText(staging.freeze, builtFreeze.canonical_file_text);
+        dependencies.writeText(staging.approval_request, approvalRequest.canonical_file_text);
+        dependencies.writeText(staging.approval_text, approvalRequest.value.approval_text);
+        dependencies.writeJson(staging.report, report);
+    });
+    return report;
+}
+export const __testInternals = {
+    artifactPaths,
+    assertCanonicalToolchainArtifact,
+    assertContext,
+    buildBaselineManifest,
+    DEFAULT_FREEZE_DEPENDENCIES,
+    requiredToken,
+};
+//# sourceMappingURL=dataset-maintenance-protected-freeze.js.map

package/dist/src/lib/dataset-maintenance-protected-freeze.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-maintenance-protected-freeze.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-freeze.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,yBAAyB,EACzB,6CAA6C,EAC7C,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,4BAA4B,GAE7B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,cAAc,GAEf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,GAE3B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,oCAAoC,EACpC,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,wCAAwC,GACzC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,GAEhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,GAEhC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,mCAAmC;IACvD,oBAAoB,EAAE,qCAAqC;IAC3D,MAAM,EAAE,iCAAiC;IACzC,gBAAgB,EAAE,iCAAiC;IACnD,aAAa,EAAE,gCAAgC;IAC/C,MAAM,EAAE,8BAA8B;CAC9B,CAAC;AA6FX,MAAM,2BAA2B,GAAgC;IAC/D,YAAY,EAAE,yBAAyB;IACvC,SAAS,EAAE,oBAAoB;IAC/B,cAAc,EAAE,qBAAqB;IACrC,cAAc,EAAE,+BAA+B;IAC/C,gBAAgB,EAAE,2BAA2B;IAC7C,cAAc,EAAE,+BAA+B;IAC/C,aAAa,EAAE,wCAAwC;IACvD,cAAc,EAAE,4BAA4B;IAC5C,WAAW,EAAE,oBAAoB;IACjC,oBAAoB,EAAE,6BAA6B;IACnD,SAAS,EAAE,yBAAyB;IACpC,SAAS,EAAE,yBAAyB;IACpC,oBAAoB,EAAE,6CAA6C;CACpE,CAAC;AAEF,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,wCAAwC,EAAE;YACnE,IAAI,EAAE,oDAAoD;YAC1D,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,OAKtB;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC,IACE,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,kBAAkB;QAC1D,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;QAChD,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK;QAC5C,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,EACjC,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,oGAAoG,EACpG;YACE,IAAI,EAAE,uDAAuD;YAC7D,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE;gBACP,oBAAoB,EAAE,OAAO,CAAC,kBAAkB;gBAChD,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;gBACjD,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAC9C,gBAAgB,EAAE,OAAO,CAAC,OAAO;aAClC;SACF,CACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,gCAAgC,CAAC,OAGzC;IACC,IAAI,OAAO,CAAC,YAAY,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,QAAQ,CAChB,2EAA2E,EAC3E;YACE,IAAI,EAAE,sDAAsD;YAC5D,QAAQ,EAAE,CAAC;SACZ,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QAC9D,GAAG;QACH,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC1B,CAAC,CACqD,CAAC;AAC5D,CAAC;AAED,SAAS,qBAAqB,CAAC,OAM9B;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;IAC1D,OAAO;QACL,cAAc,EAAE,uCAAuC;QACvD,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE;YACJ,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;SACxC;QACD,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,EAAE;QACjB,8BAA8B,EAAE,OAAO,CAAC,2BAA2B;QACnE,8BAA8B,EAAE,UAAU,CAAC,SAAS,CAAC;QACrD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAiD,EACjD,eAA4C,2BAA2B;IAEvE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,aAAa,CACzC,OAAO,CAAC,qBAAqB,EAC7B,uBAAuB,CACxB,CAAC;IACF,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,kBAAkB,GAAG,aAAa,CAAC,OAAO,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC3F,mCAAmC,CAAC,kBAAkB,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjE,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC7C,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACxD,oCAAoC,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAExE,MAAM,iBAAiB,GAAG,YAAY,CAAC,YAAY,CAAC;QAClD,QAAQ,EAAE,qBAAqB;QAC/B,KAAK,EAAE,8BAA8B;KACtC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,YAAY,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE;QAC7E,UAAU,EAAE,kBAAkB;QAC9B,UAAU;KACX,CAAC,CAAC;IACH,gCAAgC,CAAC;QAC/B,YAAY,EAAE,iBAAiB,CAAC,IAAI;QACpC,QAAQ,EAAE,iBAAiB;KAC5B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC;IAE9E,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;QAClD,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,OAAO;QACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;QACnD,IAAI;QACJ,OAAO;QACP,WAAW,EAAE,OAAO,CAAC,OAAO;QAC5B,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO;QACP,cAAc,EAAE,SAAS;QACzB,iBAAiB;KAClB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QAC3C,IAAI;QACJ,cAAc,EAAE,YAAY,CAAC,WAAW;QACxC,gBAAgB;QAChB,UAAU,EAAE,OAAO,CAAC,WAAW;QAC/B,OAAO;QACP,uBAAuB,EAAE,iBAAiB,CAAC,WAAW;QACtD,mBAAmB,EAAE,UAAU,CAAC,oBAAoB;KACrD,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,YAAY,CAAC,oBAAoB,CAAC;QACxD,MAAM,EAAE,WAAW,CAAC,KAAK;QACzB,gBAAgB,EAAE,WAAW,CAAC,WAAW;QACzC,aAAa,EAAE,cAAc;KAC9B,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;QAC7C,OAAO;QACP,IAAI;QACJ,OAAO;QACP,UAAU;QACV,2BAA2B,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B;KACnF,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,GAAG,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC;IAC9D,MAAM,YAAY,GAAG,GAAG,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC;IAC7D,MAAM,MAAM,GAA4C;QACtD,cAAc,EAAE,0CAA0C;QAC1D,gBAAgB,EAAE,cAAc;QAChC,MAAM,EAAE,0BAA0B;QAClC,iBAAiB,EAAE,WAAW;QAC9B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO;QACP,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,aAAa;QAC9C,uBAAuB,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc;QAC7D,oBAAoB,EAAE,eAAe,CAAC,KAAK,CAAC,oBAAoB;QAChE,yBAAyB,EAAE,iBAAiB,CAAC,WAAW;QACxD,8BAA8B,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B;QACrF,8BAA8B,EAAE,gBAAgB,CAAC,8BAA8B;QAC/E,MAAM,EAAE,0BAA0B;QAClC,UAAU,EAAE;YACV,uBAAuB,EAAE,IAAI;YAC7B,mBAAmB,EAAE,IAAI;YACzB,2BAA2B,EAAE,IAAI;YACjC,iBAAiB,EAAE,CAAC;YACpB,oBAAoB,EAAE,EAAE;YACxB,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,cAAc,EAAE,CAAC;YACjB,kBAAkB,EAAE,CAAC;SACtB;QACD,SAAS,EAAE,KAAK;QAChB,eAAe,EAAE;YACf,kBAAkB,EAAE,UAAU,CAAC,aAAa,CAAC;YAC7C,oBAAoB,EAAE,UAAU,CAAC,YAAY,CAAC;YAC9C,MAAM,EAAE,WAAW,CAAC,WAAW;YAC/B,gBAAgB,EAAE,eAAe,CAAC,WAAW;YAC7C,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,oBAAoB;YACzD,MAAM,EAAE,IAAI;SACb;KACF,CAAC;IAEF,YAAY,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAChD,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;QAClE,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;QACnE,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC;QACxE,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,eAAe,CAAC,mBAAmB,CAAC,CAAC;QACtF,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnF,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,aAAa;IACb,gCAAgC;IAChC,aAAa;IACb,qBAAqB;IACrB,2BAA2B;IAC3B,aAAa;CACd,CAAC","sourcesContent":["import path from 'node:path';\nimport { buildAliasPlanRequest } from './dataset-maintenance-alias-request.js';\nimport {\n  readProtectedJsonArtifact,\n  materializePrivateArtifactDirectoryAtomically,\n  writePrivateImmutableJson,\n  writePrivateImmutableText,\n} from './dataset-maintenance-protected-artifacts.js';\nimport {\n  validateProtectedBeforeState,\n  type ProtectedBeforeValidationResult,\n} from './dataset-maintenance-protected-before.js';\nimport {\n  parseMaintenancePlan,\n  sha256Json,\n  sha256Text,\n  stableJsonText,\n  type DatasetMaintenancePlan,\n} from './dataset-maintenance-contract.js';\nimport {\n  PROTECTED_EXECUTION_COUNTS,\n  type ProtectedDerivativeSnapshot,\n} from './dataset-maintenance-protected-contract.js';\nimport {\n  assertProtectedPreparationPlanSha256,\n  assertProtectedProductionProjectRef,\n  buildProtectedApprovalRequest,\n  buildProtectedFreeze,\n  deriveProtectedDerivativeSnapshotTargets,\n} from './dataset-maintenance-protected-preparation.js';\nimport {\n  fetchMaintenanceAccountRows,\n  resolveMaintenanceRemoteContext,\n  type DatasetMaintenanceRemoteContext,\n} from './dataset-maintenance-remote.js';\nimport {\n  parseProtectedToolchainEvidence,\n  type DatasetMaintenanceProtectedToolchainEvidence,\n} from './dataset-maintenance-protected-toolchain.js';\nimport { CliError } from './errors.js';\nimport type { FetchLike } from './http.js';\n\nexport const PROTECTED_FREEZE_ARTIFACTS = {\n  alias_plan_request: 'protected-alias-plan-request.json',\n  derivative_baselines: 'protected-derivative-baselines.json',\n  freeze: 'protected-execution-freeze.json',\n  approval_request: 'protected-approval-request.json',\n  approval_text: 'protected-approval-request.txt',\n  report: 'protected-freeze-report.json',\n} as const;\n\nexport type FreezeDatasetMaintenanceProtectedOptions = {\n  planPath: string;\n  toolchainEvidencePath: string;\n  outDir: string;\n  expectedProjectRef: string;\n  confirm: string;\n  cliVersion: string;\n  pageSize?: number;\n  timeoutMs?: number;\n  env: NodeJS.ProcessEnv;\n  fetchImpl: FetchLike;\n  now?: Date;\n};\n\nexport type DatasetMaintenanceProtectedBaselineManifest = {\n  schema_version: 'dataset-alias-derivative-baselines.v1';\n  environment: 'production';\n  project_ref: string;\n  account: { user_id: string; email: string };\n  plan: { plan_sha256: string; operation_id: string };\n  target_count: 50;\n  flow_count: 23;\n  process_count: 27;\n  derivative_baseline_set_sha256: string;\n  derivative_snapshot_set_sha256: string;\n  snapshots: ProtectedDerivativeSnapshot[];\n};\n\nexport type DatasetMaintenanceProtectedFreezeReport = {\n  schema_version: 'dataset-alias-protected-freeze-report.v1';\n  generated_at_utc: string;\n  status: 'ready_for_human_approval';\n  remote_write_mode: 'read_only';\n  environment: 'production';\n  project_ref: string;\n  account: { user_id: string; email: string };\n  plan_sha256: string;\n  operation_id: string;\n  freeze_sha256: string;\n  approval_request_sha256: string;\n  approval_text_sha256: string;\n  toolchain_evidence_sha256: string;\n  derivative_baseline_set_sha256: string;\n  derivative_snapshot_set_sha256: string;\n  counts: typeof PROTECTED_EXECUTION_COUNTS;\n  assertions: {\n    account_census_complete: true;\n    strict_before_state: true;\n    projected_reference_closure: true;\n    support_snapshots: 6;\n    derivative_snapshots: 50;\n    preflight_calls: 0;\n    gate_calls: 0;\n    admission_calls: 0;\n    mutation_calls: 0;\n    approval_artifacts: 0;\n  };\n  artifacts: {\n    alias_plan_request: string;\n    derivative_baselines: string;\n    freeze: string;\n    approval_request: string;\n    approval_text: string;\n    report: string;\n  };\n  artifact_sha256: {\n    alias_plan_request: string;\n    derivative_baselines: string;\n    freeze: string;\n    approval_request: string;\n    approval_text: string;\n    report: null;\n  };\n};\n\ntype FreezeProtectedDependencies = {\n  readArtifact: typeof readProtectedJsonArtifact;\n  parsePlan: typeof parseMaintenancePlan;\n  buildAliasPlan: typeof buildAliasPlanRequest;\n  resolveContext: typeof resolveMaintenanceRemoteContext;\n  fetchAccountRows: typeof fetchMaintenanceAccountRows;\n  parseToolchain: typeof parseProtectedToolchainEvidence;\n  deriveTargets: typeof deriveProtectedDerivativeSnapshotTargets;\n  validateBefore: typeof validateProtectedBeforeState;\n  buildFreeze: typeof buildProtectedFreeze;\n  buildApprovalRequest: typeof buildProtectedApprovalRequest;\n  writeJson: typeof writePrivateImmutableJson;\n  writeText: typeof writePrivateImmutableText;\n  materializeArtifacts: typeof materializePrivateArtifactDirectoryAtomically;\n};\n\nconst DEFAULT_FREEZE_DEPENDENCIES: FreezeProtectedDependencies = {\n  readArtifact: readProtectedJsonArtifact,\n  parsePlan: parseMaintenancePlan,\n  buildAliasPlan: buildAliasPlanRequest,\n  resolveContext: resolveMaintenanceRemoteContext,\n  fetchAccountRows: fetchMaintenanceAccountRows,\n  parseToolchain: parseProtectedToolchainEvidence,\n  deriveTargets: deriveProtectedDerivativeSnapshotTargets,\n  validateBefore: validateProtectedBeforeState,\n  buildFreeze: buildProtectedFreeze,\n  buildApprovalRequest: buildProtectedApprovalRequest,\n  writeJson: writePrivateImmutableJson,\n  writeText: writePrivateImmutableText,\n  materializeArtifacts: materializePrivateArtifactDirectoryAtomically,\n};\n\nfunction requiredToken(value: string, label: string): string {\n  if (!value || value.trim() !== value) {\n    throw new CliError(`${label} must be a non-empty canonical string.`, {\n      code: 'DATASET_MAINTENANCE_PROTECTED_FREEZE_INPUT_INVALID',\n      exitCode: 2,\n    });\n  }\n  return value;\n}\n\nfunction assertContext(options: {\n  context: DatasetMaintenanceRemoteContext;\n  plan: DatasetMaintenancePlan;\n  expectedProjectRef: string;\n  confirm: string;\n}): { user_id: string; email: string } {\n  const account = options.context.account;\n  if (\n    options.context.project_ref !== options.expectedProjectRef ||\n    account.user_id !== options.plan.account.user_id ||\n    account.email !== options.plan.account.email ||\n    account.email !== options.confirm\n  ) {\n    throw new CliError(\n      'Authenticated context does not match the explicitly confirmed production project and plan account.',\n      {\n        code: 'DATASET_MAINTENANCE_PROTECTED_FREEZE_CONTEXT_MISMATCH',\n        exitCode: 1,\n        details: {\n          expected_project_ref: options.expectedProjectRef,\n          observed_project_ref: options.context.project_ref,\n          expected_user_id: options.plan.account.user_id,\n          observed_user_id: account.user_id,\n        },\n      },\n    );\n  }\n  return { user_id: account.user_id, email: account.email };\n}\n\nfunction assertCanonicalToolchainArtifact(options: {\n  artifactText: string;\n  evidence: DatasetMaintenanceProtectedToolchainEvidence;\n}): void {\n  if (options.artifactText !== `${stableJsonText(options.evidence)}\\n`) {\n    throw new CliError(\n      'Toolchain evidence must be canonical JSON with exactly one final newline.',\n      {\n        code: 'DATASET_MAINTENANCE_PROTECTED_TOOLCHAIN_NONCANONICAL',\n        exitCode: 2,\n      },\n    );\n  }\n}\n\nfunction artifactPaths(outDir: string): DatasetMaintenanceProtectedFreezeReport['artifacts'] {\n  const resolved = path.resolve(outDir);\n  return Object.fromEntries(\n    Object.entries(PROTECTED_FREEZE_ARTIFACTS).map(([key, name]) => [\n      key,\n      path.join(resolved, name),\n    ]),\n  ) as DatasetMaintenanceProtectedFreezeReport['artifacts'];\n}\n\nfunction buildBaselineManifest(options: {\n  context: DatasetMaintenanceRemoteContext;\n  plan: DatasetMaintenancePlan;\n  account: { user_id: string; email: string };\n  validation: ProtectedBeforeValidationResult;\n  derivativeBaselineSetSha256: string;\n}): DatasetMaintenanceProtectedBaselineManifest {\n  const snapshots = options.validation.derivative_snapshots;\n  return {\n    schema_version: 'dataset-alias-derivative-baselines.v1',\n    environment: 'production',\n    project_ref: options.context.project_ref,\n    account: options.account,\n    plan: {\n      plan_sha256: options.plan.plan_sha256,\n      operation_id: options.plan.operation_id,\n    },\n    target_count: 50,\n    flow_count: 23,\n    process_count: 27,\n    derivative_baseline_set_sha256: options.derivativeBaselineSetSha256,\n    derivative_snapshot_set_sha256: sha256Json(snapshots),\n    snapshots,\n  };\n}\n\nexport async function freezeDatasetMaintenanceProtected(\n  options: FreezeDatasetMaintenanceProtectedOptions,\n  dependencies: FreezeProtectedDependencies = DEFAULT_FREEZE_DEPENDENCIES,\n): Promise<DatasetMaintenanceProtectedFreezeReport> {\n  const planPath = requiredToken(options.planPath, 'planPath');\n  const toolchainEvidencePath = requiredToken(\n    options.toolchainEvidencePath,\n    'toolchainEvidencePath',\n  );\n  const outDir = requiredToken(options.outDir, 'outDir');\n  const expectedProjectRef = requiredToken(options.expectedProjectRef, 'expectedProjectRef');\n  assertProtectedProductionProjectRef(expectedProjectRef);\n  const confirm = requiredToken(options.confirm, 'confirm');\n  const cliVersion = requiredToken(options.cliVersion, 'cliVersion');\n  const generatedAtUtc = (options.now ?? new Date()).toISOString();\n\n  const planArtifact = dependencies.readArtifact({\n    filePath: planPath,\n    label: 'Protected maintenance plan',\n  });\n  const plan = dependencies.parsePlan(planArtifact.value);\n  assertProtectedPreparationPlanSha256(plan.plan_sha256, 'plan.plan_sha256');\n  const planDir = path.dirname(planArtifact.resolved);\n  const aliasPlanRequest = dependencies.buildAliasPlan({ plan, planDir });\n\n  const toolchainArtifact = dependencies.readArtifact({\n    filePath: toolchainEvidencePath,\n    label: 'Protected toolchain evidence',\n  });\n  const toolchainEvidence = dependencies.parseToolchain(toolchainArtifact.value, {\n    projectRef: expectedProjectRef,\n    cliVersion,\n  });\n  assertCanonicalToolchainArtifact({\n    artifactText: toolchainArtifact.text,\n    evidence: toolchainEvidence,\n  });\n\n  const context = await dependencies.resolveContext({\n    env: options.env,\n    fetchImpl: options.fetchImpl,\n    timeoutMs: options.timeoutMs,\n    now: options.now,\n  });\n  const account = assertContext({ context, plan, expectedProjectRef, confirm });\n\n  const current = await dependencies.fetchAccountRows({\n    context,\n    userId: account.user_id,\n    pageSize: options.pageSize,\n  });\n  const derivativeTargets = dependencies.deriveTargets(plan, account);\n  const validation = await dependencies.validateBefore({\n    plan,\n    planDir,\n    actorUserId: account.user_id,\n    currentRows: current.rows,\n    completeness: current.completeness,\n    context,\n    derivativeMode: 'capture',\n    derivativeTargets,\n  });\n  const builtFreeze = dependencies.buildFreeze({\n    plan,\n    planFileSha256: planArtifact.file_sha256,\n    aliasPlanRequest,\n    projectRef: context.project_ref,\n    account,\n    toolchainEvidenceSha256: toolchainArtifact.file_sha256,\n    derivativeSnapshots: validation.derivative_snapshots,\n  });\n  const approvalRequest = dependencies.buildApprovalRequest({\n    freeze: builtFreeze.value,\n    freezeFileSha256: builtFreeze.file_sha256,\n    approvedAtUtc: generatedAtUtc,\n  });\n  const baselineManifest = buildBaselineManifest({\n    context,\n    plan,\n    account,\n    validation,\n    derivativeBaselineSetSha256: builtFreeze.value.sets.derivative_baseline_set_sha256,\n  });\n  const paths = artifactPaths(outDir);\n  const aliasPlanText = `${stableJsonText(aliasPlanRequest)}\\n`;\n  const baselineText = `${stableJsonText(baselineManifest)}\\n`;\n  const report: DatasetMaintenanceProtectedFreezeReport = {\n    schema_version: 'dataset-alias-protected-freeze-report.v1',\n    generated_at_utc: generatedAtUtc,\n    status: 'ready_for_human_approval',\n    remote_write_mode: 'read_only',\n    environment: 'production',\n    project_ref: context.project_ref,\n    account,\n    plan_sha256: plan.plan_sha256,\n    operation_id: plan.operation_id,\n    freeze_sha256: builtFreeze.value.freeze_sha256,\n    approval_request_sha256: approvalRequest.value.request_sha256,\n    approval_text_sha256: approvalRequest.value.approval_text_sha256,\n    toolchain_evidence_sha256: toolchainArtifact.file_sha256,\n    derivative_baseline_set_sha256: builtFreeze.value.sets.derivative_baseline_set_sha256,\n    derivative_snapshot_set_sha256: baselineManifest.derivative_snapshot_set_sha256,\n    counts: PROTECTED_EXECUTION_COUNTS,\n    assertions: {\n      account_census_complete: true,\n      strict_before_state: true,\n      projected_reference_closure: true,\n      support_snapshots: 6,\n      derivative_snapshots: 50,\n      preflight_calls: 0,\n      gate_calls: 0,\n      admission_calls: 0,\n      mutation_calls: 0,\n      approval_artifacts: 0,\n    },\n    artifacts: paths,\n    artifact_sha256: {\n      alias_plan_request: sha256Text(aliasPlanText),\n      derivative_baselines: sha256Text(baselineText),\n      freeze: builtFreeze.file_sha256,\n      approval_request: approvalRequest.file_sha256,\n      approval_text: approvalRequest.value.approval_text_sha256,\n      report: null,\n    },\n  };\n\n  dependencies.materializeArtifacts(outDir, (stagingDirectory) => {\n    const staging = artifactPaths(stagingDirectory);\n    dependencies.writeText(staging.alias_plan_request, aliasPlanText);\n    dependencies.writeText(staging.derivative_baselines, baselineText);\n    dependencies.writeText(staging.freeze, builtFreeze.canonical_file_text);\n    dependencies.writeText(staging.approval_request, approvalRequest.canonical_file_text);\n    dependencies.writeText(staging.approval_text, approvalRequest.value.approval_text);\n    dependencies.writeJson(staging.report, report);\n  });\n  return report;\n}\n\nexport const __testInternals = {\n  artifactPaths,\n  assertCanonicalToolchainArtifact,\n  assertContext,\n  buildBaselineManifest,\n  DEFAULT_FREEZE_DEPENDENCIES,\n  requiredToken,\n};\n"]}