@tiangong-lca/cli 0.0.28 → 0.0.29

package/dist/src/lib/dataset-maintenance-flow-identity-freeze.js

@@ -0,0 +1,342 @@
+import path from 'node:path';
+import { materializePrivateArtifactDirectoryAtomically, readProtectedJsonArtifact, writePrivateImmutableJson, writePrivateImmutableText, } from './dataset-maintenance-protected-artifacts.js';
+import { computeFlowIdentityFreezeSha256, } from './dataset-maintenance-flow-identity-execution-contract.js';
+import { parseFlowIdentityPlan } from './dataset-maintenance-flow-identity-contract.js';
+import { parseProtectedToolchainEvidence } from './dataset-maintenance-protected-toolchain.js';
+import { isJsonObject, sha256Json, sha256Text, stableJsonText, } from './dataset-maintenance-contract.js';
+import { CliError } from './errors.js';
+export const FLOW_IDENTITY_FREEZE_ARTIFACTS = {
+    freeze: 'flow-identity-freeze.json',
+    approval_request: 'flow-identity-execution-approval-request.json',
+    approval_text: 'flow-identity-execution-approval-request.txt',
+    report: 'flow-identity-freeze-report.json',
+};
+const HASH = /^[a-f0-9]{64}$/u;
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+function fail(message, code = 'DATASET_FLOW_IDENTITY_FREEZE_INVALID') {
+    throw new CliError(message, { code, exitCode: 1 });
+}
+function canonicalTimestamp(value, label) {
+    if (!Number.isFinite(Date.parse(value)) || new Date(value).toISOString() !== value) {
+        fail(`${label} must be a canonical RFC3339 UTC timestamp.`);
+    }
+    return value;
+}
+function requestCore(value) {
+    const core = { ...value };
+    delete core.request_sha256;
+    return core;
+}
+export function computeFlowIdentityApprovalRequestSha256(request) {
+    return sha256Json(requestCore(request));
+}
+export function renderFlowIdentityExecutionApprovalText(core, requestSha256) {
+    if (!HASH.test(requestSha256))
+        fail('execution approval request SHA-256 is invalid.');
+    return [
+        'BAFU Step 3 protected owner-draft execution approval request',
+        `schema_version=${core.schema_version}`,
+        `approved_at_utc=${core.approved_at_utc}`,
+        `request_sha256=${requestSha256}`,
+        `environment=${core.environment}`,
+        `project_ref=${core.project_ref}`,
+        `account_email=${core.actor.email}`,
+        `account_user_id=${core.actor.user_id}`,
+        `target_visibility=${core.target_visibility}`,
+        `plan_sha256=${core.plan_sha256}`,
+        `operation_id=${core.operation_id}`,
+        `plan_file_sha256=${core.plan_file_sha256}`,
+        `freeze_file_sha256=${core.freeze_file_sha256}`,
+        `freeze_sha256=${core.freeze_sha256}`,
+        `receipt_id=${core.receipt_id}`,
+        `receipt_proof_sha256=${core.receipt_proof_sha256}`,
+        `capture_request_sha256=${core.capture_request_sha256}`,
+        `source_guard_set_sha256=${core.source_guard_set_sha256}`,
+        `support_guard_set_sha256=${core.support_guard_set_sha256}`,
+        `target_guard_set_sha256=${core.target_guard_set_sha256}`,
+        `mapping_guard_set_sha256=${core.mapping_guard_set_sha256}`,
+        `process_intent_set_sha256=${core.process_intent_set_sha256}`,
+        `receipt_protected_closure_sha256=${core.receipt_protected_closure_sha256}`,
+        `capture_whole_scope_proof_sha256=${core.capture_whole_scope_proof_sha256}`,
+        `capture_artifact_sha256=${core.capture_artifact_sha256}`,
+        `toolchain_evidence_sha256=${core.toolchain_evidence_sha256}`,
+        `policy_approval_text_sha256=${core.policy_approval_text_sha256}`,
+        `semantic_source_count=${core.semantic_source_count}`,
+        `mapping_count=${core.mapping_count}`,
+        `pending_count=${core.pending_count}`,
+        `blocker_count=${core.blocker_count}`,
+        `orphan_count=${core.orphan_count}`,
+        `process_count=${core.process_count}`,
+        `rewrite_count=${core.rewrite_count}`,
+        `state_code_changes=${core.state_code_changes}`,
+        `deletes=${core.deletes}`,
+        `source_mutations=${core.source_mutations}`,
+        `public_target_mutations=${core.public_target_mutations}`,
+        `user_state_claim=${core.user_state_claim}`,
+        `approval_reusable=${String(core.approval_reusable)}`,
+        `maximum_wrapper_invocations=${core.maximum_wrapper_invocations}`,
+        `maximum_cli_apply_spawns=${core.maximum_cli_apply_spawns}`,
+        `maximum_process_posts=${core.maximum_process_posts}`,
+        `maximum_finalize_posts=${core.maximum_finalize_posts}`,
+        `max_process_concurrency=${core.max_process_concurrency}`,
+        `automatic_retry=${String(core.automatic_retry)}`,
+        'Approve only by returning this text byte-for-byte without edits.',
+        '',
+    ].join('\n');
+}
+export function parseFlowIdentityApprovalRequest(value) {
+    if (!isJsonObject(value) || !isJsonObject(value.actor)) {
+        fail('Flow identity execution approval request is invalid.');
+    }
+    const expectedKeys = [
+        'schema_version',
+        'approved_at_utc',
+        'environment',
+        'project_ref',
+        'actor',
+        'target_visibility',
+        'plan_sha256',
+        'operation_id',
+        'plan_file_sha256',
+        'freeze_file_sha256',
+        'freeze_sha256',
+        'receipt_id',
+        'receipt_proof_sha256',
+        'capture_request_sha256',
+        'source_guard_set_sha256',
+        'support_guard_set_sha256',
+        'target_guard_set_sha256',
+        'mapping_guard_set_sha256',
+        'process_intent_set_sha256',
+        'receipt_protected_closure_sha256',
+        'capture_whole_scope_proof_sha256',
+        'capture_artifact_sha256',
+        'toolchain_evidence_sha256',
+        'policy_approval_text_sha256',
+        'semantic_source_count',
+        'mapping_count',
+        'pending_count',
+        'blocker_count',
+        'orphan_count',
+        'process_count',
+        'rewrite_count',
+        'state_code_changes',
+        'deletes',
+        'source_mutations',
+        'public_target_mutations',
+        'user_state_claim',
+        'approval_reusable',
+        'maximum_wrapper_invocations',
+        'maximum_cli_apply_spawns',
+        'maximum_process_posts',
+        'maximum_finalize_posts',
+        'max_process_concurrency',
+        'automatic_retry',
+        'request_sha256',
+    ];
+    if (Object.keys(value).length !== expectedKeys.length ||
+        expectedKeys.some((key) => !(key in value))) {
+        fail('Flow identity execution approval request keys are not exact.');
+    }
+    const request = value;
+    const counts = [
+        request.mapping_count,
+        request.pending_count,
+        request.blocker_count,
+        request.orphan_count,
+        request.process_count,
+        request.rewrite_count,
+    ];
+    if (request.schema_version !== 'dataset-flow-identity-execution-approval-request.v3' ||
+        request.environment !== 'production' ||
+        request.target_visibility !== 'owner_draft' ||
+        request.semantic_source_count !== 305 ||
+        request.state_code_changes !== 0 ||
+        request.deletes !== 0 ||
+        request.source_mutations !== 0 ||
+        request.public_target_mutations !== 0 ||
+        request.user_state_claim !== 'authenticated_actor_state_100_plus_own_state_0' ||
+        request.approval_reusable !== false ||
+        request.maximum_wrapper_invocations !== 1 ||
+        request.maximum_cli_apply_spawns !== 1 ||
+        request.maximum_process_posts !== request.process_count ||
+        request.maximum_finalize_posts !== 1 ||
+        request.max_process_concurrency !== 1 ||
+        request.automatic_retry !== false ||
+        !counts.every((count) => Number.isSafeInteger(count) && count >= 0) ||
+        request.mapping_count <= 0 ||
+        request.process_count <= 0 ||
+        request.rewrite_count <= 0 ||
+        request.mapping_count + request.pending_count + request.blocker_count + request.orphan_count !==
+            305 ||
+        !canonicalTimestamp(request.approved_at_utc, 'approved_at_utc') ||
+        !UUID.test(request.actor.user_id) ||
+        !UUID.test(request.receipt_id) ||
+        request.actor.email !== request.actor.email.trim().toLowerCase() ||
+        ![
+            request.plan_sha256,
+            request.plan_file_sha256,
+            request.freeze_file_sha256,
+            request.freeze_sha256,
+            request.receipt_proof_sha256,
+            request.capture_request_sha256,
+            request.source_guard_set_sha256,
+            request.support_guard_set_sha256,
+            request.target_guard_set_sha256,
+            request.mapping_guard_set_sha256,
+            request.process_intent_set_sha256,
+            request.receipt_protected_closure_sha256,
+            request.capture_whole_scope_proof_sha256,
+            request.capture_artifact_sha256,
+            request.toolchain_evidence_sha256,
+            request.policy_approval_text_sha256,
+            request.request_sha256,
+        ].every((digest) => HASH.test(digest)) ||
+        request.request_sha256 !== computeFlowIdentityApprovalRequestSha256(request)) {
+        fail('Flow identity execution approval request is inconsistent or tampered.');
+    }
+    return request;
+}
+export function freezeFlowIdentity(options) {
+    const planArtifact = readProtectedJsonArtifact({
+        filePath: options.planPath,
+        label: 'Flow identity plan',
+    });
+    if (planArtifact.text !== `${stableJsonText(planArtifact.value)}\n`) {
+        fail('Flow identity plan must be canonical JSON.');
+    }
+    const plan = parseFlowIdentityPlan(planArtifact.value);
+    if (plan.environment !== 'production' ||
+        plan.project_ref !== options.expectedProjectRef ||
+        plan.account.email !== options.confirm) {
+        fail('Freeze requires the exact production project and account confirmation.');
+    }
+    const toolchain = readProtectedJsonArtifact({
+        filePath: options.toolchainEvidencePath,
+        label: 'Protected toolchain evidence',
+    });
+    const toolchainEvidence = parseProtectedToolchainEvidence(toolchain.value, {
+        projectRef: options.expectedProjectRef,
+        cliVersion: options.cliVersion,
+    });
+    if (toolchain.text !== `${stableJsonText(toolchainEvidence)}\n`) {
+        fail('Protected toolchain evidence must be canonical JSON.');
+    }
+    const generatedAt = (options.now ?? new Date()).toISOString();
+    const approvedAt = canonicalTimestamp(options.approvedAtUtc, 'approvedAtUtc');
+    if (Date.parse(approvedAt) < Date.parse(generatedAt)) {
+        fail('approvedAtUtc must be frozen before the human review and cannot precede the freeze.');
+    }
+    const freeze = {
+        schema_version: 'dataset-flow-identity-freeze.v2',
+        generated_at_utc: generatedAt,
+        environment: 'production',
+        project_ref: plan.project_ref,
+        actor: plan.account,
+        plan_sha256: plan.plan_sha256,
+        operation_id: plan.operation_id,
+        capture_artifact_sha256: plan.capture_artifact_sha256,
+        receipt_id: plan.receipt_id,
+        receipt_proof_sha256: plan.receipt_proof_sha256,
+        capture_request_sha256: plan.capture_request_sha256,
+        source_guard_set_sha256: plan.source_guard_set_sha256,
+        support_guard_set_sha256: plan.support_guard_set_sha256,
+        target_guard_set_sha256: plan.target_guard_set_sha256,
+        mapping_guard_set_sha256: plan.mapping_guard_set_sha256,
+        process_intent_set_sha256: plan.process_intent_set_sha256,
+        receipt_protected_closure_sha256: plan.receipt_protected_closure_sha256,
+        capture_whole_scope_proof_sha256: plan.capture_whole_scope_proof_sha256,
+        source_universe_artifact_sha256: plan.source_universe_artifact_sha256,
+        support_snapshot_artifact_sha256: plan.support_snapshot_artifact_sha256,
+        mapping_artifact_sha256: plan.mapping_artifact_sha256,
+        process_manifest_artifact_sha256: plan.process_manifest_artifact_sha256,
+        protected_closure_artifact_sha256: plan.protected_closure_artifact_sha256,
+        policy_approval_text_sha256: plan.compatibility_policy.approval_text_sha256,
+        toolchain_evidence_sha256: toolchain.file_sha256,
+        freeze_sha256: '',
+    };
+    freeze.freeze_sha256 = computeFlowIdentityFreezeSha256(freeze);
+    const freezeText = `${stableJsonText(freeze)}\n`;
+    const freezeFileSha256 = sha256Text(freezeText);
+    const core = {
+        schema_version: 'dataset-flow-identity-execution-approval-request.v3',
+        approved_at_utc: approvedAt,
+        environment: 'production',
+        project_ref: plan.project_ref,
+        actor: plan.account,
+        target_visibility: 'owner_draft',
+        plan_sha256: plan.plan_sha256,
+        operation_id: plan.operation_id,
+        plan_file_sha256: planArtifact.file_sha256,
+        freeze_file_sha256: freezeFileSha256,
+        freeze_sha256: freeze.freeze_sha256,
+        receipt_id: plan.receipt_id,
+        receipt_proof_sha256: plan.receipt_proof_sha256,
+        capture_request_sha256: plan.capture_request_sha256,
+        source_guard_set_sha256: plan.source_guard_set_sha256,
+        support_guard_set_sha256: plan.support_guard_set_sha256,
+        target_guard_set_sha256: plan.target_guard_set_sha256,
+        mapping_guard_set_sha256: plan.mapping_guard_set_sha256,
+        process_intent_set_sha256: plan.process_intent_set_sha256,
+        receipt_protected_closure_sha256: plan.receipt_protected_closure_sha256,
+        capture_whole_scope_proof_sha256: plan.capture_whole_scope_proof_sha256,
+        capture_artifact_sha256: plan.capture_artifact_sha256,
+        toolchain_evidence_sha256: freeze.toolchain_evidence_sha256,
+        policy_approval_text_sha256: plan.compatibility_policy.approval_text_sha256,
+        semantic_source_count: 305,
+        mapping_count: plan.mappings.length,
+        pending_count: plan.protected_closure.pending.length,
+        blocker_count: plan.protected_closure.blockers.length,
+        orphan_count: plan.protected_closure.orphans.length,
+        process_count: plan.processes.length,
+        rewrite_count: plan.summary.rewrites,
+        state_code_changes: 0,
+        deletes: 0,
+        source_mutations: 0,
+        public_target_mutations: 0,
+        user_state_claim: 'authenticated_actor_state_100_plus_own_state_0',
+        approval_reusable: false,
+        maximum_wrapper_invocations: 1,
+        maximum_cli_apply_spawns: 1,
+        maximum_process_posts: plan.processes.length,
+        maximum_finalize_posts: 1,
+        max_process_concurrency: 1,
+        automatic_retry: false,
+    };
+    const request = parseFlowIdentityApprovalRequest({
+        ...core,
+        request_sha256: sha256Json(core),
+    });
+    const approvalText = renderFlowIdentityExecutionApprovalText(core, request.request_sha256);
+    const approvalTextSha256 = sha256Text(approvalText);
+    const outDir = path.resolve(options.outDir);
+    const artifacts = Object.fromEntries(Object.entries(FLOW_IDENTITY_FREEZE_ARTIFACTS).map(([key, name]) => [
+        key,
+        path.join(outDir, name),
+    ]));
+    const report = {
+        schema_version: 'dataset-flow-identity-freeze-report.v2',
+        generated_at_utc: generatedAt,
+        status: 'frozen',
+        execution_submitted: false,
+        network_calls: 0,
+        database_calls: 0,
+        plan_sha256: plan.plan_sha256,
+        operation_id: plan.operation_id,
+        freeze_sha256: freeze.freeze_sha256,
+        freeze_file_sha256: freezeFileSha256,
+        execution_approval_request_sha256: request.request_sha256,
+        execution_approval_text_sha256: approvalTextSha256,
+        policy_approval_text_sha256: plan.compatibility_policy.approval_text_sha256,
+        artifacts,
+    };
+    materializePrivateArtifactDirectoryAtomically(outDir, (staging) => {
+        writePrivateImmutableText(path.join(staging, FLOW_IDENTITY_FREEZE_ARTIFACTS.freeze), freezeText);
+        writePrivateImmutableJson(path.join(staging, FLOW_IDENTITY_FREEZE_ARTIFACTS.approval_request), request);
+        writePrivateImmutableText(path.join(staging, FLOW_IDENTITY_FREEZE_ARTIFACTS.approval_text), approvalText);
+        writePrivateImmutableJson(path.join(staging, FLOW_IDENTITY_FREEZE_ARTIFACTS.report), report);
+    });
+    return report;
+}
+export const __testInternals = { canonicalTimestamp, requestCore };
+//# sourceMappingURL=dataset-maintenance-flow-identity-freeze.js.map

package/dist/src/lib/dataset-maintenance-flow-identity-freeze.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-maintenance-flow-identity-freeze.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-flow-identity-freeze.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,6CAA6C,EAC7C,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,+BAA+B,GAEhC,MAAM,2DAA2D,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,EACL,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAqFvC,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,MAAM,EAAE,2BAA2B;IACnC,gBAAgB,EAAE,+CAA+C;IACjE,aAAa,EAAE,8CAA8C;IAC7D,MAAM,EAAE,kCAAkC;CAClC,CAAC;AAEX,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAC/B,MAAM,IAAI,GAAG,4EAA4E,CAAC;AAE1F,SAAS,IAAI,CAAC,OAAe,EAAE,IAAI,GAAG,sCAAsC;IAC1E,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,KAAa;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACnF,IAAI,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAkC;IACrD,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,EAA0C,CAAC;IAClE,OAAO,IAAI,CAAC,cAAc,CAAC;IAC3B,OAAO,IAAgD,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAoC;IAEpC,OAAO,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,IAA8C,EAC9C,aAAqB;IAErB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACtF,OAAO;QACL,8DAA8D;QAC9D,kBAAkB,IAAI,CAAC,cAAc,EAAE;QACvC,mBAAmB,IAAI,CAAC,eAAe,EAAE;QACzC,kBAAkB,aAAa,EAAE;QACjC,eAAe,IAAI,CAAC,WAAW,EAAE;QACjC,eAAe,IAAI,CAAC,WAAW,EAAE;QACjC,iBAAiB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACnC,mBAAmB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;QACvC,qBAAqB,IAAI,CAAC,iBAAiB,EAAE;QAC7C,eAAe,IAAI,CAAC,WAAW,EAAE;QACjC,gBAAgB,IAAI,CAAC,YAAY,EAAE;QACnC,oBAAoB,IAAI,CAAC,gBAAgB,EAAE;QAC3C,sBAAsB,IAAI,CAAC,kBAAkB,EAAE;QAC/C,iBAAiB,IAAI,CAAC,aAAa,EAAE;QACrC,cAAc,IAAI,CAAC,UAAU,EAAE;QAC/B,wBAAwB,IAAI,CAAC,oBAAoB,EAAE;QACnD,0BAA0B,IAAI,CAAC,sBAAsB,EAAE;QACvD,2BAA2B,IAAI,CAAC,uBAAuB,EAAE;QACzD,4BAA4B,IAAI,CAAC,wBAAwB,EAAE;QAC3D,2BAA2B,IAAI,CAAC,uBAAuB,EAAE;QACzD,4BAA4B,IAAI,CAAC,wBAAwB,EAAE;QAC3D,6BAA6B,IAAI,CAAC,yBAAyB,EAAE;QAC7D,oCAAoC,IAAI,CAAC,gCAAgC,EAAE;QAC3E,oCAAoC,IAAI,CAAC,gCAAgC,EAAE;QAC3E,2BAA2B,IAAI,CAAC,uBAAuB,EAAE;QACzD,6BAA6B,IAAI,CAAC,yBAAyB,EAAE;QAC7D,+BAA+B,IAAI,CAAC,2BAA2B,EAAE;QACjE,yBAAyB,IAAI,CAAC,qBAAqB,EAAE;QACrD,iBAAiB,IAAI,CAAC,aAAa,EAAE;QACrC,iBAAiB,IAAI,CAAC,aAAa,EAAE;QACrC,iBAAiB,IAAI,CAAC,aAAa,EAAE;QACrC,gBAAgB,IAAI,CAAC,YAAY,EAAE;QACnC,iBAAiB,IAAI,CAAC,aAAa,EAAE;QACrC,iBAAiB,IAAI,CAAC,aAAa,EAAE;QACrC,sBAAsB,IAAI,CAAC,kBAAkB,EAAE;QAC/C,WAAW,IAAI,CAAC,OAAO,EAAE;QACzB,oBAAoB,IAAI,CAAC,gBAAgB,EAAE;QAC3C,2BAA2B,IAAI,CAAC,uBAAuB,EAAE;QACzD,oBAAoB,IAAI,CAAC,gBAAgB,EAAE;QAC3C,qBAAqB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACrD,+BAA+B,IAAI,CAAC,2BAA2B,EAAE;QACjE,4BAA4B,IAAI,CAAC,wBAAwB,EAAE;QAC3D,yBAAyB,IAAI,CAAC,qBAAqB,EAAE;QACrD,0BAA0B,IAAI,CAAC,sBAAsB,EAAE;QACvD,2BAA2B,IAAI,CAAC,uBAAuB,EAAE;QACzD,mBAAmB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE;QACjD,kEAAkE;QAClE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,YAAY,GAAG;QACnB,gBAAgB;QAChB,iBAAiB;QACjB,aAAa;QACb,aAAa;QACb,OAAO;QACP,mBAAmB;QACnB,aAAa;QACb,cAAc;QACd,kBAAkB;QAClB,oBAAoB;QACpB,eAAe;QACf,YAAY;QACZ,sBAAsB;QACtB,wBAAwB;QACxB,yBAAyB;QACzB,0BAA0B;QAC1B,yBAAyB;QACzB,0BAA0B;QAC1B,2BAA2B;QAC3B,kCAAkC;QAClC,kCAAkC;QAClC,yBAAyB;QACzB,2BAA2B;QAC3B,6BAA6B;QAC7B,uBAAuB;QACvB,eAAe;QACf,eAAe;QACf,eAAe;QACf,cAAc;QACd,eAAe;QACf,eAAe;QACf,oBAAoB;QACpB,SAAS;QACT,kBAAkB;QAClB,yBAAyB;QACzB,kBAAkB;QAClB,mBAAmB;QACnB,6BAA6B;QAC7B,0BAA0B;QAC1B,uBAAuB;QACvB,wBAAwB;QACxB,yBAAyB;QACzB,iBAAiB;QACjB,gBAAgB;KACjB,CAAC;IACF,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QACjD,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,EAC3C,CAAC;QACD,IAAI,CAAC,8DAA8D,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,KAAoC,CAAC;IACrD,MAAM,MAAM,GAAG;QACb,OAAO,CAAC,aAAa;QACrB,OAAO,CAAC,aAAa;QACrB,OAAO,CAAC,aAAa;QACrB,OAAO,CAAC,YAAY;QACpB,OAAO,CAAC,aAAa;QACrB,OAAO,CAAC,aAAa;KACtB,CAAC;IACF,IACE,OAAO,CAAC,cAAc,KAAK,qDAAqD;QAChF,OAAO,CAAC,WAAW,KAAK,YAAY;QACpC,OAAO,CAAC,iBAAiB,KAAK,aAAa;QAC3C,OAAO,CAAC,qBAAqB,KAAK,GAAG;QACrC,OAAO,CAAC,kBAAkB,KAAK,CAAC;QAChC,OAAO,CAAC,OAAO,KAAK,CAAC;QACrB,OAAO,CAAC,gBAAgB,KAAK,CAAC;QAC9B,OAAO,CAAC,uBAAuB,KAAK,CAAC;QACrC,OAAO,CAAC,gBAAgB,KAAK,gDAAgD;QAC7E,OAAO,CAAC,iBAAiB,KAAK,KAAK;QACnC,OAAO,CAAC,2BAA2B,KAAK,CAAC;QACzC,OAAO,CAAC,wBAAwB,KAAK,CAAC;QACtC,OAAO,CAAC,qBAAqB,KAAK,OAAO,CAAC,aAAa;QACvD,OAAO,CAAC,sBAAsB,KAAK,CAAC;QACpC,OAAO,CAAC,uBAAuB,KAAK,CAAC;QACrC,OAAO,CAAC,eAAe,KAAK,KAAK;QACjC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACnE,OAAO,CAAC,aAAa,IAAI,CAAC;QAC1B,OAAO,CAAC,aAAa,IAAI,CAAC;QAC1B,OAAO,CAAC,aAAa,IAAI,CAAC;QAC1B,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY;YAC1F,GAAG;QACL,CAAC,kBAAkB,CAAC,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC/D,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACjC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAChE,CAAC;YACC,OAAO,CAAC,WAAW;YACnB,OAAO,CAAC,gBAAgB;YACxB,OAAO,CAAC,kBAAkB;YAC1B,OAAO,CAAC,aAAa;YACrB,OAAO,CAAC,oBAAoB;YAC5B,OAAO,CAAC,sBAAsB;YAC9B,OAAO,CAAC,uBAAuB;YAC/B,OAAO,CAAC,wBAAwB;YAChC,OAAO,CAAC,uBAAuB;YAC/B,OAAO,CAAC,wBAAwB;YAChC,OAAO,CAAC,yBAAyB;YACjC,OAAO,CAAC,gCAAgC;YACxC,OAAO,CAAC,gCAAgC;YACxC,OAAO,CAAC,uBAAuB;YAC/B,OAAO,CAAC,yBAAyB;YACjC,OAAO,CAAC,2BAA2B;YACnC,OAAO,CAAC,cAAc;SACvB,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,cAAc,KAAK,wCAAwC,CAAC,OAAO,CAAC,EAC5E,CAAC;QACD,IAAI,CAAC,uEAAuE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,YAAY,GAAG,yBAAyB,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,oBAAoB;KAC5B,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,IAAI,KAAK,GAAG,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvD,IACE,IAAI,CAAC,WAAW,KAAK,YAAY;QACjC,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,kBAAkB;QAC/C,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,EACtC,CAAC;QACD,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC1C,QAAQ,EAAE,OAAO,CAAC,qBAAqB;QACvC,KAAK,EAAE,8BAA8B;KACtC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,+BAA+B,CAAC,SAAS,CAAC,KAAK,EAAE;QACzE,UAAU,EAAE,OAAO,CAAC,kBAAkB;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,IAAI,KAAK,GAAG,cAAc,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,qFAAqF,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAuB;QACjC,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,WAAW;QAC7B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,IAAI,CAAC,OAAO;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;QACvD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;QACvD,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,gCAAgC,EAAE,IAAI,CAAC,gCAAgC;QACvE,gCAAgC,EAAE,IAAI,CAAC,gCAAgC;QACvE,+BAA+B,EAAE,IAAI,CAAC,+BAA+B;QACrE,gCAAgC,EAAE,IAAI,CAAC,gCAAgC;QACvE,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,gCAAgC,EAAE,IAAI,CAAC,gCAAgC;QACvE,iCAAiC,EAAE,IAAI,CAAC,iCAAiC;QACzE,2BAA2B,EAAE,IAAI,CAAC,oBAAoB,CAAC,oBAAoB;QAC3E,yBAAyB,EAAE,SAAS,CAAC,WAAW;QAChD,aAAa,EAAE,EAAE;KAClB,CAAC;IACF,MAAM,CAAC,aAAa,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;IACjD,MAAM,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,IAAI,GAA6C;QACrD,cAAc,EAAE,qDAAqD;QACrE,eAAe,EAAE,UAAU;QAC3B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,IAAI,CAAC,OAAO;QACnB,iBAAiB,EAAE,aAAa;QAChC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,YAAY,CAAC,WAAW;QAC1C,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;QACnD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;QACvD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;QACvD,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,gCAAgC,EAAE,IAAI,CAAC,gCAAgC;QACvE,gCAAgC,EAAE,IAAI,CAAC,gCAAgC;QACvE,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,2BAA2B,EAAE,IAAI,CAAC,oBAAoB,CAAC,oBAAoB;QAC3E,qBAAqB,EAAE,GAAG;QAC1B,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QACnC,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM;QACpD,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM;QACrD,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM;QACnD,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;QACpC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;QACpC,kBAAkB,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;QACV,gBAAgB,EAAE,CAAC;QACnB,uBAAuB,EAAE,CAAC;QAC1B,gBAAgB,EAAE,gDAAgD;QAClE,iBAAiB,EAAE,KAAK;QACxB,2BAA2B,EAAE,CAAC;QAC9B,wBAAwB,EAAE,CAAC;QAC3B,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;QAC5C,sBAAsB,EAAE,CAAC;QACzB,uBAAuB,EAAE,CAAC;QAC1B,eAAe,EAAE,KAAK;KACvB,CAAC;IACF,MAAM,OAAO,GAAG,gCAAgC,CAAC;QAC/C,GAAG,IAAI;QACP,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,uCAAuC,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3F,MAAM,kBAAkB,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAClC,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QAClE,GAAG;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;KACxB,CAAC,CACsC,CAAC;IAC3C,MAAM,MAAM,GAA6B;QACvC,cAAc,EAAE,wCAAwC;QACxD,gBAAgB,EAAE,WAAW;QAC7B,MAAM,EAAE,QAAQ;QAChB,mBAAmB,EAAE,KAAK;QAC1B,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,kBAAkB,EAAE,gBAAgB;QACpC,iCAAiC,EAAE,OAAO,CAAC,cAAc;QACzD,8BAA8B,EAAE,kBAAkB;QAClD,2BAA2B,EAAE,IAAI,CAAC,oBAAoB,CAAC,oBAAoB;QAC3E,SAAS;KACV,CAAC;IACF,6CAA6C,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;QAChE,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,MAAM,CAAC,EACzD,UAAU,CACX,CAAC;QACF,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,EACnE,OAAO,CACR,CAAC;QACF,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,aAAa,CAAC,EAChE,YAAY,CACb,CAAC;QACF,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC","sourcesContent":["import path from 'node:path';\nimport {\n  materializePrivateArtifactDirectoryAtomically,\n  readProtectedJsonArtifact,\n  writePrivateImmutableJson,\n  writePrivateImmutableText,\n} from './dataset-maintenance-protected-artifacts.js';\nimport {\n  computeFlowIdentityFreezeSha256,\n  type FlowIdentityFreeze,\n} from './dataset-maintenance-flow-identity-execution-contract.js';\nimport { parseFlowIdentityPlan } from './dataset-maintenance-flow-identity-contract.js';\nimport { parseProtectedToolchainEvidence } from './dataset-maintenance-protected-toolchain.js';\nimport {\n  isJsonObject,\n  sha256Json,\n  sha256Text,\n  stableJsonText,\n} from './dataset-maintenance-contract.js';\nimport { CliError } from './errors.js';\n\nexport type FlowIdentityExecutionApprovalRequestCore = {\n  schema_version: 'dataset-flow-identity-execution-approval-request.v3';\n  approved_at_utc: string;\n  environment: 'production';\n  project_ref: string;\n  actor: { user_id: string; email: string };\n  target_visibility: 'owner_draft';\n  plan_sha256: string;\n  operation_id: string;\n  plan_file_sha256: string;\n  freeze_file_sha256: string;\n  freeze_sha256: string;\n  receipt_id: string;\n  receipt_proof_sha256: string;\n  capture_request_sha256: string;\n  source_guard_set_sha256: string;\n  support_guard_set_sha256: string;\n  target_guard_set_sha256: string;\n  mapping_guard_set_sha256: string;\n  process_intent_set_sha256: string;\n  receipt_protected_closure_sha256: string;\n  capture_whole_scope_proof_sha256: string;\n  capture_artifact_sha256: string;\n  toolchain_evidence_sha256: string;\n  policy_approval_text_sha256: string;\n  semantic_source_count: 305;\n  mapping_count: number;\n  pending_count: number;\n  blocker_count: number;\n  orphan_count: number;\n  process_count: number;\n  rewrite_count: number;\n  state_code_changes: 0;\n  deletes: 0;\n  source_mutations: 0;\n  public_target_mutations: 0;\n  user_state_claim: 'authenticated_actor_state_100_plus_own_state_0';\n  approval_reusable: false;\n  maximum_wrapper_invocations: 1;\n  maximum_cli_apply_spawns: 1;\n  maximum_process_posts: number;\n  maximum_finalize_posts: 1;\n  max_process_concurrency: 1;\n  automatic_retry: false;\n};\n\nexport type FlowIdentityApprovalRequest = FlowIdentityExecutionApprovalRequestCore & {\n  request_sha256: string;\n};\n\nexport type FreezeFlowIdentityOptions = {\n  planPath: string;\n  toolchainEvidencePath: string;\n  expectedProjectRef: string;\n  confirm: string;\n  approvedAtUtc: string;\n  cliVersion: string;\n  outDir: string;\n  now?: Date;\n};\n\nexport type FlowIdentityFreezeReport = {\n  schema_version: 'dataset-flow-identity-freeze-report.v2';\n  generated_at_utc: string;\n  status: 'frozen';\n  execution_submitted: false;\n  network_calls: 0;\n  database_calls: 0;\n  plan_sha256: string;\n  operation_id: string;\n  freeze_sha256: string;\n  freeze_file_sha256: string;\n  execution_approval_request_sha256: string;\n  execution_approval_text_sha256: string;\n  policy_approval_text_sha256: string;\n  artifacts: {\n    freeze: string;\n    approval_request: string;\n    approval_text: string;\n    report: string;\n  };\n};\n\nexport const FLOW_IDENTITY_FREEZE_ARTIFACTS = {\n  freeze: 'flow-identity-freeze.json',\n  approval_request: 'flow-identity-execution-approval-request.json',\n  approval_text: 'flow-identity-execution-approval-request.txt',\n  report: 'flow-identity-freeze-report.json',\n} as const;\n\nconst HASH = /^[a-f0-9]{64}$/u;\nconst UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;\n\nfunction fail(message: string, code = 'DATASET_FLOW_IDENTITY_FREEZE_INVALID'): never {\n  throw new CliError(message, { code, exitCode: 1 });\n}\n\nfunction canonicalTimestamp(value: string, label: string): string {\n  if (!Number.isFinite(Date.parse(value)) || new Date(value).toISOString() !== value) {\n    fail(`${label} must be a canonical RFC3339 UTC timestamp.`);\n  }\n  return value;\n}\n\nfunction requestCore(value: FlowIdentityApprovalRequest): FlowIdentityExecutionApprovalRequestCore {\n  const core = { ...value } as Partial<FlowIdentityApprovalRequest>;\n  delete core.request_sha256;\n  return core as FlowIdentityExecutionApprovalRequestCore;\n}\n\nexport function computeFlowIdentityApprovalRequestSha256(\n  request: FlowIdentityApprovalRequest,\n): string {\n  return sha256Json(requestCore(request));\n}\n\nexport function renderFlowIdentityExecutionApprovalText(\n  core: FlowIdentityExecutionApprovalRequestCore,\n  requestSha256: string,\n): string {\n  if (!HASH.test(requestSha256)) fail('execution approval request SHA-256 is invalid.');\n  return [\n    'BAFU Step 3 protected owner-draft execution approval request',\n    `schema_version=${core.schema_version}`,\n    `approved_at_utc=${core.approved_at_utc}`,\n    `request_sha256=${requestSha256}`,\n    `environment=${core.environment}`,\n    `project_ref=${core.project_ref}`,\n    `account_email=${core.actor.email}`,\n    `account_user_id=${core.actor.user_id}`,\n    `target_visibility=${core.target_visibility}`,\n    `plan_sha256=${core.plan_sha256}`,\n    `operation_id=${core.operation_id}`,\n    `plan_file_sha256=${core.plan_file_sha256}`,\n    `freeze_file_sha256=${core.freeze_file_sha256}`,\n    `freeze_sha256=${core.freeze_sha256}`,\n    `receipt_id=${core.receipt_id}`,\n    `receipt_proof_sha256=${core.receipt_proof_sha256}`,\n    `capture_request_sha256=${core.capture_request_sha256}`,\n    `source_guard_set_sha256=${core.source_guard_set_sha256}`,\n    `support_guard_set_sha256=${core.support_guard_set_sha256}`,\n    `target_guard_set_sha256=${core.target_guard_set_sha256}`,\n    `mapping_guard_set_sha256=${core.mapping_guard_set_sha256}`,\n    `process_intent_set_sha256=${core.process_intent_set_sha256}`,\n    `receipt_protected_closure_sha256=${core.receipt_protected_closure_sha256}`,\n    `capture_whole_scope_proof_sha256=${core.capture_whole_scope_proof_sha256}`,\n    `capture_artifact_sha256=${core.capture_artifact_sha256}`,\n    `toolchain_evidence_sha256=${core.toolchain_evidence_sha256}`,\n    `policy_approval_text_sha256=${core.policy_approval_text_sha256}`,\n    `semantic_source_count=${core.semantic_source_count}`,\n    `mapping_count=${core.mapping_count}`,\n    `pending_count=${core.pending_count}`,\n    `blocker_count=${core.blocker_count}`,\n    `orphan_count=${core.orphan_count}`,\n    `process_count=${core.process_count}`,\n    `rewrite_count=${core.rewrite_count}`,\n    `state_code_changes=${core.state_code_changes}`,\n    `deletes=${core.deletes}`,\n    `source_mutations=${core.source_mutations}`,\n    `public_target_mutations=${core.public_target_mutations}`,\n    `user_state_claim=${core.user_state_claim}`,\n    `approval_reusable=${String(core.approval_reusable)}`,\n    `maximum_wrapper_invocations=${core.maximum_wrapper_invocations}`,\n    `maximum_cli_apply_spawns=${core.maximum_cli_apply_spawns}`,\n    `maximum_process_posts=${core.maximum_process_posts}`,\n    `maximum_finalize_posts=${core.maximum_finalize_posts}`,\n    `max_process_concurrency=${core.max_process_concurrency}`,\n    `automatic_retry=${String(core.automatic_retry)}`,\n    'Approve only by returning this text byte-for-byte without edits.',\n    '',\n  ].join('\\n');\n}\n\nexport function parseFlowIdentityApprovalRequest(value: unknown): FlowIdentityApprovalRequest {\n  if (!isJsonObject(value) || !isJsonObject(value.actor)) {\n    fail('Flow identity execution approval request is invalid.');\n  }\n  const expectedKeys = [\n    'schema_version',\n    'approved_at_utc',\n    'environment',\n    'project_ref',\n    'actor',\n    'target_visibility',\n    'plan_sha256',\n    'operation_id',\n    'plan_file_sha256',\n    'freeze_file_sha256',\n    'freeze_sha256',\n    'receipt_id',\n    'receipt_proof_sha256',\n    'capture_request_sha256',\n    'source_guard_set_sha256',\n    'support_guard_set_sha256',\n    'target_guard_set_sha256',\n    'mapping_guard_set_sha256',\n    'process_intent_set_sha256',\n    'receipt_protected_closure_sha256',\n    'capture_whole_scope_proof_sha256',\n    'capture_artifact_sha256',\n    'toolchain_evidence_sha256',\n    'policy_approval_text_sha256',\n    'semantic_source_count',\n    'mapping_count',\n    'pending_count',\n    'blocker_count',\n    'orphan_count',\n    'process_count',\n    'rewrite_count',\n    'state_code_changes',\n    'deletes',\n    'source_mutations',\n    'public_target_mutations',\n    'user_state_claim',\n    'approval_reusable',\n    'maximum_wrapper_invocations',\n    'maximum_cli_apply_spawns',\n    'maximum_process_posts',\n    'maximum_finalize_posts',\n    'max_process_concurrency',\n    'automatic_retry',\n    'request_sha256',\n  ];\n  if (\n    Object.keys(value).length !== expectedKeys.length ||\n    expectedKeys.some((key) => !(key in value))\n  ) {\n    fail('Flow identity execution approval request keys are not exact.');\n  }\n  const request = value as FlowIdentityApprovalRequest;\n  const counts = [\n    request.mapping_count,\n    request.pending_count,\n    request.blocker_count,\n    request.orphan_count,\n    request.process_count,\n    request.rewrite_count,\n  ];\n  if (\n    request.schema_version !== 'dataset-flow-identity-execution-approval-request.v3' ||\n    request.environment !== 'production' ||\n    request.target_visibility !== 'owner_draft' ||\n    request.semantic_source_count !== 305 ||\n    request.state_code_changes !== 0 ||\n    request.deletes !== 0 ||\n    request.source_mutations !== 0 ||\n    request.public_target_mutations !== 0 ||\n    request.user_state_claim !== 'authenticated_actor_state_100_plus_own_state_0' ||\n    request.approval_reusable !== false ||\n    request.maximum_wrapper_invocations !== 1 ||\n    request.maximum_cli_apply_spawns !== 1 ||\n    request.maximum_process_posts !== request.process_count ||\n    request.maximum_finalize_posts !== 1 ||\n    request.max_process_concurrency !== 1 ||\n    request.automatic_retry !== false ||\n    !counts.every((count) => Number.isSafeInteger(count) && count >= 0) ||\n    request.mapping_count <= 0 ||\n    request.process_count <= 0 ||\n    request.rewrite_count <= 0 ||\n    request.mapping_count + request.pending_count + request.blocker_count + request.orphan_count !==\n      305 ||\n    !canonicalTimestamp(request.approved_at_utc, 'approved_at_utc') ||\n    !UUID.test(request.actor.user_id) ||\n    !UUID.test(request.receipt_id) ||\n    request.actor.email !== request.actor.email.trim().toLowerCase() ||\n    ![\n      request.plan_sha256,\n      request.plan_file_sha256,\n      request.freeze_file_sha256,\n      request.freeze_sha256,\n      request.receipt_proof_sha256,\n      request.capture_request_sha256,\n      request.source_guard_set_sha256,\n      request.support_guard_set_sha256,\n      request.target_guard_set_sha256,\n      request.mapping_guard_set_sha256,\n      request.process_intent_set_sha256,\n      request.receipt_protected_closure_sha256,\n      request.capture_whole_scope_proof_sha256,\n      request.capture_artifact_sha256,\n      request.toolchain_evidence_sha256,\n      request.policy_approval_text_sha256,\n      request.request_sha256,\n    ].every((digest) => HASH.test(digest)) ||\n    request.request_sha256 !== computeFlowIdentityApprovalRequestSha256(request)\n  ) {\n    fail('Flow identity execution approval request is inconsistent or tampered.');\n  }\n  return request;\n}\n\nexport function freezeFlowIdentity(options: FreezeFlowIdentityOptions): FlowIdentityFreezeReport {\n  const planArtifact = readProtectedJsonArtifact({\n    filePath: options.planPath,\n    label: 'Flow identity plan',\n  });\n  if (planArtifact.text !== `${stableJsonText(planArtifact.value)}\\n`) {\n    fail('Flow identity plan must be canonical JSON.');\n  }\n  const plan = parseFlowIdentityPlan(planArtifact.value);\n  if (\n    plan.environment !== 'production' ||\n    plan.project_ref !== options.expectedProjectRef ||\n    plan.account.email !== options.confirm\n  ) {\n    fail('Freeze requires the exact production project and account confirmation.');\n  }\n  const toolchain = readProtectedJsonArtifact({\n    filePath: options.toolchainEvidencePath,\n    label: 'Protected toolchain evidence',\n  });\n  const toolchainEvidence = parseProtectedToolchainEvidence(toolchain.value, {\n    projectRef: options.expectedProjectRef,\n    cliVersion: options.cliVersion,\n  });\n  if (toolchain.text !== `${stableJsonText(toolchainEvidence)}\\n`) {\n    fail('Protected toolchain evidence must be canonical JSON.');\n  }\n  const generatedAt = (options.now ?? new Date()).toISOString();\n  const approvedAt = canonicalTimestamp(options.approvedAtUtc, 'approvedAtUtc');\n  if (Date.parse(approvedAt) < Date.parse(generatedAt)) {\n    fail('approvedAtUtc must be frozen before the human review and cannot precede the freeze.');\n  }\n  const freeze: FlowIdentityFreeze = {\n    schema_version: 'dataset-flow-identity-freeze.v2',\n    generated_at_utc: generatedAt,\n    environment: 'production',\n    project_ref: plan.project_ref,\n    actor: plan.account,\n    plan_sha256: plan.plan_sha256,\n    operation_id: plan.operation_id,\n    capture_artifact_sha256: plan.capture_artifact_sha256,\n    receipt_id: plan.receipt_id,\n    receipt_proof_sha256: plan.receipt_proof_sha256,\n    capture_request_sha256: plan.capture_request_sha256,\n    source_guard_set_sha256: plan.source_guard_set_sha256,\n    support_guard_set_sha256: plan.support_guard_set_sha256,\n    target_guard_set_sha256: plan.target_guard_set_sha256,\n    mapping_guard_set_sha256: plan.mapping_guard_set_sha256,\n    process_intent_set_sha256: plan.process_intent_set_sha256,\n    receipt_protected_closure_sha256: plan.receipt_protected_closure_sha256,\n    capture_whole_scope_proof_sha256: plan.capture_whole_scope_proof_sha256,\n    source_universe_artifact_sha256: plan.source_universe_artifact_sha256,\n    support_snapshot_artifact_sha256: plan.support_snapshot_artifact_sha256,\n    mapping_artifact_sha256: plan.mapping_artifact_sha256,\n    process_manifest_artifact_sha256: plan.process_manifest_artifact_sha256,\n    protected_closure_artifact_sha256: plan.protected_closure_artifact_sha256,\n    policy_approval_text_sha256: plan.compatibility_policy.approval_text_sha256,\n    toolchain_evidence_sha256: toolchain.file_sha256,\n    freeze_sha256: '',\n  };\n  freeze.freeze_sha256 = computeFlowIdentityFreezeSha256(freeze);\n  const freezeText = `${stableJsonText(freeze)}\\n`;\n  const freezeFileSha256 = sha256Text(freezeText);\n  const core: FlowIdentityExecutionApprovalRequestCore = {\n    schema_version: 'dataset-flow-identity-execution-approval-request.v3',\n    approved_at_utc: approvedAt,\n    environment: 'production',\n    project_ref: plan.project_ref,\n    actor: plan.account,\n    target_visibility: 'owner_draft',\n    plan_sha256: plan.plan_sha256,\n    operation_id: plan.operation_id,\n    plan_file_sha256: planArtifact.file_sha256,\n    freeze_file_sha256: freezeFileSha256,\n    freeze_sha256: freeze.freeze_sha256,\n    receipt_id: plan.receipt_id,\n    receipt_proof_sha256: plan.receipt_proof_sha256,\n    capture_request_sha256: plan.capture_request_sha256,\n    source_guard_set_sha256: plan.source_guard_set_sha256,\n    support_guard_set_sha256: plan.support_guard_set_sha256,\n    target_guard_set_sha256: plan.target_guard_set_sha256,\n    mapping_guard_set_sha256: plan.mapping_guard_set_sha256,\n    process_intent_set_sha256: plan.process_intent_set_sha256,\n    receipt_protected_closure_sha256: plan.receipt_protected_closure_sha256,\n    capture_whole_scope_proof_sha256: plan.capture_whole_scope_proof_sha256,\n    capture_artifact_sha256: plan.capture_artifact_sha256,\n    toolchain_evidence_sha256: freeze.toolchain_evidence_sha256,\n    policy_approval_text_sha256: plan.compatibility_policy.approval_text_sha256,\n    semantic_source_count: 305,\n    mapping_count: plan.mappings.length,\n    pending_count: plan.protected_closure.pending.length,\n    blocker_count: plan.protected_closure.blockers.length,\n    orphan_count: plan.protected_closure.orphans.length,\n    process_count: plan.processes.length,\n    rewrite_count: plan.summary.rewrites,\n    state_code_changes: 0,\n    deletes: 0,\n    source_mutations: 0,\n    public_target_mutations: 0,\n    user_state_claim: 'authenticated_actor_state_100_plus_own_state_0',\n    approval_reusable: false,\n    maximum_wrapper_invocations: 1,\n    maximum_cli_apply_spawns: 1,\n    maximum_process_posts: plan.processes.length,\n    maximum_finalize_posts: 1,\n    max_process_concurrency: 1,\n    automatic_retry: false,\n  };\n  const request = parseFlowIdentityApprovalRequest({\n    ...core,\n    request_sha256: sha256Json(core),\n  });\n  const approvalText = renderFlowIdentityExecutionApprovalText(core, request.request_sha256);\n  const approvalTextSha256 = sha256Text(approvalText);\n  const outDir = path.resolve(options.outDir);\n  const artifacts = Object.fromEntries(\n    Object.entries(FLOW_IDENTITY_FREEZE_ARTIFACTS).map(([key, name]) => [\n      key,\n      path.join(outDir, name),\n    ]),\n  ) as FlowIdentityFreezeReport['artifacts'];\n  const report: FlowIdentityFreezeReport = {\n    schema_version: 'dataset-flow-identity-freeze-report.v2',\n    generated_at_utc: generatedAt,\n    status: 'frozen',\n    execution_submitted: false,\n    network_calls: 0,\n    database_calls: 0,\n    plan_sha256: plan.plan_sha256,\n    operation_id: plan.operation_id,\n    freeze_sha256: freeze.freeze_sha256,\n    freeze_file_sha256: freezeFileSha256,\n    execution_approval_request_sha256: request.request_sha256,\n    execution_approval_text_sha256: approvalTextSha256,\n    policy_approval_text_sha256: plan.compatibility_policy.approval_text_sha256,\n    artifacts,\n  };\n  materializePrivateArtifactDirectoryAtomically(outDir, (staging) => {\n    writePrivateImmutableText(\n      path.join(staging, FLOW_IDENTITY_FREEZE_ARTIFACTS.freeze),\n      freezeText,\n    );\n    writePrivateImmutableJson(\n      path.join(staging, FLOW_IDENTITY_FREEZE_ARTIFACTS.approval_request),\n      request,\n    );\n    writePrivateImmutableText(\n      path.join(staging, FLOW_IDENTITY_FREEZE_ARTIFACTS.approval_text),\n      approvalText,\n    );\n    writePrivateImmutableJson(path.join(staging, FLOW_IDENTITY_FREEZE_ARTIFACTS.report), report);\n  });\n  return report;\n}\n\nexport const __testInternals = { canonicalTimestamp, requestCore };\n"]}