@ifc-lite/flow-nodes 0.8.0 → 0.9.0

package/README.md

@@ -105,3 +105,79 @@ Direct remote failures expose only the safe failure class and valid HTTP status;
 remote response bodies, detail URLs and error causes are discarded. Known local
 preflight diagnostics and gateway refusal/recovery text are retained after
 redacting the actual bearer, without carrying their original error cause.
+
+`review.snapshot` is a volatile `model.read` node over a host-provided native
+Review service. Its optional `after` input sequences the read after an analysis;
+its bounded `snapshot` contains actual facts, coverage and producer provenance.
+Hosts without a native capture service report the missing
+`review` backend capability explicitly. This node does not rerun analysis or
+write models, artifacts, publications or decisions. See
+[the native Review read contract](../../docs/guide/flow.md#reading-captured-native-review).
+
+## Durable native BCF publication
+
+The Node-only `@ifc-lite/flow-nodes/bcf-publication-node` entry exports
+`createNativeBcfWriteGateway({ directory, namespace, secrets })` for
+`FlowHost.bcfWrites`. CLI hosts supply it automatically. An immutable,
+fsynced intent is claimed before a create; a lost response or interrupted host
+blocks the same target and payload across restarts. Bearers are ephemeral;
+a payload containing a known run or write token is refused before persistence.
+Known credentials are checked in values and dynamic keys; fixed public schema
+keys such as `id`, `topicGuid` and `remoteGuid` are protocol names, not credential
+data. Strict record and payload decoders still reject those names in an unknown
+location. Authorization/token keys and credential URL/Bearer syntax remain
+refused, and credential-bearing identifier values remain unsafe.
+Every generated journal record is checked against the current known credentials
+before publication. A credential that cannot be represented without appearing in
+fixed metadata, such as the literal bearer `done`, is refused before the POST.
+Fixed schema keys remain valid: bearers `id` and `intent` can use clean payloads
+and receipt values. A later generated-value collision, such as a receipt timestamp
+matching a known credential, refuses success and leaves the saved intent unresolved
+for explicit checked recovery; it never persists that credential or retries.
+BCF write nodes also redact the actual resolved bearer from successful server
+responses before exposing output ports, including literal and Player tokens.
+
+`list()` inspects one bounded local page. `listPage({cursor, limit})` returns
+`{entries,nextCursor?}`; follow every cursor, including empty progress pages. `check(id, { token, networkGrants })` reads the
+original HTTPS target with fresh capability grants and records matching GUID
+candidates, including trim-equivalent title, description and comment text.
+Server-edited or omitted fields cannot prove absence: unmatched objects make
+the check unavailable. Only a complete empty enumeration with `confirmFullReadAccess: true` proves absence; the operator asserts complete visibility in the same access scope as the original write. Token presence alone is not proof of visibility. Without the assertion an empty enumeration is unavailable, while matching candidates remain available;
+the create protocol supplies no stable client marker for excluding other objects.
+It never retries a write. `reconcile(id, guid)` explicitly selects
+a checked candidate. `confirmAbsent(id)` explicitly releases an intent only
+after the latest complete check proved absence and persisted `fullReadAccessConfirmed: true`. Older markerless absence proofs remain readable but need a fresh asserted check before release. Anonymous genuinely public reads remain supported. No credential or principal identity is persisted. A check alone never
+releases an unresolved create. Preserve the journal when an outcome is unknown.
+
+Storage uses a nonempty `IFCLITE_BCF_OUTBOX_DIR` or defaults to `~/.ifc-lite/bcf-outbox`, isolated
+by namespace. Filesystems without exclusive hard links or directory fsync
+refuse publication. Malformed, oversized or orphaned records also refuse;
+records are bounded to 256 KiB, with 256 generations per digest and 16 checks
+per active immutable epoch. Immutable `v2/<prefix>/<digest>`
+storage retains every receipt; 256 buckets each hold at most 4096 never-deleted
+digest slots. Capacity refusal precedes sending and leaves existing recovery
+readable. Listing streams history and bounds each page to 1000 rows, 5 MiB and
+50,000 bounded record-work units; cursors are weakly consistent during concurrent writes. Old flat
+journals are refused: preserve them and recover using their original build.
+Linux boot/starttime and Windows creation-time queries distinguish process
+instances. Unknown owners require `confirmOwnerStopped: true` on `check`, only
+after operator verification; observed live instances always block recovery. The browser
+continues to use its IndexedDB publication controls and the shared pure
+`@ifc-lite/flow-nodes/bcf-publication` error classifier.
+
+Recovery check epochs retain prior immutable files and locate the latest marker
+with bounded exponential/binary probes over safe integer identities. Validation
+reads the latest epoch and its embedded preceding proof; archived epoch bodies
+are retained as evidence, without rereading their full history. An interrupted
+check resumes the same reserved check ID with a fresh authorized read. A completed
+unavailable check at an epoch boundary permits the next explicit check in a new
+epoch, competing with settlement on the same exclusive transition. An empty new
+epoch marker preserves the preceding proof. These operations never resend a create.
+
+A native process admits at most 64 concurrent or locally completed sends whose
+outcome could not be saved. Completed durable receipts consume no local tracking
+slot. At this bound new creates refuse before any effect; checked reconciliation
+or confirmed absence releases the retained local completion. No completion
+identity is evicted to make room. Reads synchronize the visible receipt or proof's
+directory before acknowledging it; an unresolved directory-sync fault refuses
+recovery and subsequent creates without discarding the existing record.

package/dist/bcf-publication-capacity.d.ts

@@ -0,0 +1,5 @@
+export declare const DIGEST_SLOTS = 4096;
+export declare function capacityDigest(value: unknown): string;
+/** Monotonic, never-deleted slots. Same-digest racers converge on the same first slot. */
+export declare function reserveDigest(directory: string, digest: string, publish: (directory: string, filename: string, value: unknown) => Promise<void>, read: (directory: string, filename: string) => Promise<unknown>, sync: (directory: string) => Promise<void>): Promise<void>;
+//# sourceMappingURL=bcf-publication-capacity.d.ts.map

package/dist/bcf-publication-capacity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bcf-publication-capacity.d.ts","sourceRoot":"","sources":["../src/bcf-publication-capacity.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,YAAY,OAAQ,CAAC;AAElC,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIrD;AAED,0FAA0F;AAC1F,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EACnE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,EAC/E,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB5H"}

package/dist/bcf-publication-capacity.js

@@ -0,0 +1,44 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+import { record, refuse } from './bcf-publication-codec.js';
+export const DIGEST_SLOTS = 4_096;
+const code = (error) => record(error) ? error.code : undefined;
+export function capacityDigest(value) {
+    if (!record(value) || value.version !== 2 || typeof value.digest !== 'string' || !/^[a-f0-9]{64}$/.test(value.digest)
+        || Object.keys(value).some(k => !['version', 'digest'].includes(k)))
+        refuse('invalid digest capacity record');
+    return value.digest;
+}
+/** Monotonic, never-deleted slots. Same-digest racers converge on the same first slot. */
+export async function reserveDigest(directory, digest, publish, read, sync) {
+    for (let slot = 0; slot < DIGEST_SLOTS; slot += 1) {
+        const filename = `slot-${slot}.json`;
+        try {
+            if (capacityDigest(await read(directory, filename)) === digest) {
+                await sync(directory);
+                return;
+            }
+            continue;
+        }
+        catch (error) {
+            if (code(error) !== 'ENOENT')
+                throw error;
+        }
+        try {
+            await publish(directory, filename, { version: 2, digest });
+        }
+        catch (error) {
+            if (code(error) !== 'EEXIST')
+                throw error;
+            // A competing same-digest claim won this exact first available slot.
+            if (capacityDigest(await read(directory, filename)) !== digest)
+                continue;
+        }
+        // A failed fsync leaves this immutable claim authoritative and reusable, never deleted.
+        await sync(directory);
+        return;
+    }
+    refuse('digest bucket capacity reached before sending; existing receipts remain readable');
+}
+//# sourceMappingURL=bcf-publication-capacity.js.map

package/dist/bcf-publication-capacity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bcf-publication-capacity.js","sourceRoot":"","sources":["../src/bcf-publication-capacity.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAClC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;WAChH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAChH,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAc,EACnE,OAA+E,EAC/E,IAA+D,EAAE,IAA0C;IAC3G,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,QAAQ,IAAI,OAAO,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,cAAc,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAClG,SAAS;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;QAC9D,IAAI,CAAC;YAAC,MAAM,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAAC,CAAC;QACnE,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC1C,qEAAqE;YACrE,IAAI,cAAc,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,MAAM;gBAAE,SAAS;QAC3E,CAAC;QACD,wFAAwF;QACxF,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IACD,MAAM,CAAC,kFAAkF,CAAC,CAAC;AAC7F,CAAC"}

package/dist/bcf-publication-check.d.ts

@@ -0,0 +1,4 @@
+import type { NativeBcfPublicationCheck, NativeBcfPublicationCheckOptions, StoredBcfAttempt } from './bcf-publication-types.js';
+/** Explicit bounded, read-only lookup through the canonical capability-gated transport. */
+export declare function lookupNativeBcfAttempt(attempt: StoredBcfAttempt, options: NativeBcfPublicationCheckOptions, secrets: readonly string[]): Promise<NativeBcfPublicationCheck>;
+//# sourceMappingURL=bcf-publication-check.d.ts.map

package/dist/bcf-publication-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bcf-publication-check.d.ts","sourceRoot":"","sources":["../src/bcf-publication-check.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEhI,2FAA2F;AAC3F,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,gCAAgC,EAC/G,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAwEhE"}

package/dist/bcf-publication-check.js

@@ -0,0 +1,100 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+import { BcfApiClient } from '@ifc-lite/bcf-api';
+import { coreNetworkRequest } from '@ifc-lite/sandbox';
+import { canonical, credentialFree, NATIVE_METADATA, record, refuse, text } from './bcf-publication-codec.js';
+/** Explicit bounded, read-only lookup through the canonical capability-gated transport. */
+export async function lookupNativeBcfAttempt(attempt, options, secrets) {
+    const intent = attempt.intent;
+    const sensitive = [...secrets, ...(options.token ? [options.token] : [])];
+    credentialFree(intent, sensitive);
+    const client = new BcfApiClient({ baseUrl: intent.baseUrl, version: intent.version, getAccessToken: () => options.token,
+        fetchFn: async (url, init) => {
+            if (init?.method && init.method !== 'GET')
+                refuse('recovery only permits reads');
+            const headers = {};
+            new Headers(init?.headers).forEach((value, key) => { headers[key] = value; });
+            const result = await coreNetworkRequest({ url, method: 'GET', headers, timeoutMs: 15_000, maxBytes: 5 * 1024 * 1024,
+                signal: options.signal }, options.networkGrants, options.networkTransport);
+            if (result.truncated)
+                refuse('server check exceeded response bound');
+            return new Response([204, 205, 304].includes(result.status) ? null : result.body, { status: result.status, headers: result.headers });
+        } });
+    const candidates = [];
+    const seen = new Set();
+    let incomparable = false;
+    const now = new Date();
+    function consider(item) {
+        if (!record(item) || !text(item.guid))
+            refuse('invalid server check response');
+        // Servers may trim free text on storage. Such a match still only proposes
+        // a manual candidate: discarding it could falsely release a duplicate write.
+        const remote = item;
+        if (!Object.entries(intent.payload).every(([key, value]) => {
+            const stored = remote[key];
+            if (['title', 'description', 'comment'].includes(key) && typeof stored === 'string' && typeof value === 'string') {
+                return stored.trim() === value.trim();
+            }
+            return canonical(stored ?? null) === canonical(value ?? null);
+        })) {
+            // A server may rewrite or omit mutable fields. Without a client marker
+            // or known remote GUID, a non-match cannot prove this is another effect.
+            incomparable = true;
+            return;
+        }
+        credentialFree({ guid: item.guid }, sensitive);
+        if (!candidates.some(candidate => candidate.guid === item.guid))
+            candidates.push({ guid: item.guid });
+        if (candidates.length > 50)
+            refuse('too many matching recovery candidates');
+    }
+    if (intent.operation === 'createComment') {
+        const comments = await client.getComments(intent.projectId, intent.topicGuid ?? '', { signal: options.signal });
+        if (!Array.isArray(comments) || comments.length > 50_000)
+            refuse('comment check exceeds work bound');
+        for (const comment of comments)
+            consider(comment);
+    }
+    else {
+        let complete = false;
+        // Bound requests as well as entities: a server-capped one-row page must
+        // not turn the former 250-page budget into 50,000 network round trips.
+        for (let skip = 0, pages = 0; skip <= 50_000 && pages <= 250; pages += 1) {
+            const page = await client.getTopics(intent.projectId, { top: 200, skip }, { signal: options.signal });
+            if (!Array.isArray(page) || page.length > 50_000)
+                refuse('invalid topic page');
+            // $top is a maximum: a server may cap it below 200. Only an empty page
+            // proves exhaustion, and advancing by actual length avoids skipping rows.
+            if (page.length === 0) {
+                complete = true;
+                break;
+            }
+            let fresh = 0;
+            for (const topic of page) {
+                if (!record(topic) || !text(topic.guid))
+                    refuse('invalid server topic');
+                if (seen.has(topic.guid))
+                    continue;
+                seen.add(topic.guid);
+                fresh += 1;
+                consider(topic);
+            }
+            if (seen.size > 50_000)
+                refuse('topic check exceeds work bound');
+            if (fresh === 0)
+                refuse('server ignored topic pagination');
+            skip += page.length;
+        }
+        // Partial enumeration cannot claim that an effect is absent.
+        if (!complete)
+            refuse('topic enumeration incomplete');
+    }
+    // An empty visible collection can hide a committed effect under another authority.
+    // Token presence does not prove visibility; only the operator can assert this scope.
+    const absenceConfirmed = !candidates.length && !incomparable && options.confirmFullReadAccess === true;
+    return { at: now.toISOString(), result: candidates.length ? NATIVE_METADATA.check.ambiguous
+            : absenceConfirmed ? NATIVE_METADATA.check.absent : NATIVE_METADATA.check.unavailable, candidates,
+        ...(absenceConfirmed ? { fullReadAccessConfirmed: NATIVE_METADATA.fullReadAccessConfirmed } : {}) };
+}
+//# sourceMappingURL=bcf-publication-check.js.map

package/dist/bcf-publication-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bcf-publication-check.js","sourceRoot":"","sources":["../src/bcf-publication-check.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D,OAAO,EAAE,YAAY,EAAwC,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAG9G,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAyB,EAAE,OAAyC,EAC/G,OAA0B;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK;QACrH,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;gBAAE,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACjF,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;gBACjH,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,sCAAsC,CAAC,CAAC;YACrE,OAAO,IAAI,QAAQ,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACxI,CAAC,EAAE,CAAC,CAAC;IACP,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,SAAS,QAAQ,CAAC,IAAiC;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC/E,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,IAA0C,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACzD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACjH,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QAChE,CAAC,CAAC,EAAE,CAAC;YACH,uEAAuE;YACvE,yEAAyE;YACzE,YAAY,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QACD,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,CAAC,uCAAuC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM;YAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACrG,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,wEAAwE;QACxE,uEAAuE;QACvE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,GAAG,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACtG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM;gBAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC/E,uEAAuE;YACvE,0EAA0E;YAC1E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YAClD,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBACxE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,KAAK,IAAI,CAAC,CAAC;gBAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM;gBAAE,MAAM,CAAC,gCAAgC,CAAC,CAAC;YACjE,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM,CAAC,iCAAiC,CAAC,CAAC;YAC3D,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC;QACtB,CAAC;QACD,6DAA6D;QAC7D,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC;IACD,mFAAmF;IACnF,qFAAqF;IACrF,MAAM,gBAAgB,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC;IACvG,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS;YACzF,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU;QACjG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,eAAe,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxG,CAAC"}

package/dist/bcf-publication-codec.d.ts

@@ -0,0 +1,53 @@
+import type { BcfWriteIntent } from './bcf-write-gateway.js';
+import type { StoredBcfAttempt, StoredBcfCheck, StoredBcfOutcome } from './bcf-publication-types.js';
+export declare const MAX_RECORD_BYTES: number;
+export declare const MAX_GENERATIONS = 256;
+export declare const MAX_RECORDS: number;
+export declare const MAX_CHECKS = 16;
+/** Shared construction/decoding values; the representability guard must not drift from saved records. */
+export declare const NATIVE_METADATA: {
+    readonly state: {
+        readonly done: "done";
+        readonly failed: "failed";
+        readonly uncertain: "uncertain";
+        readonly sending: "sending";
+    };
+    readonly evidence: {
+        readonly response: "response";
+        readonly reconciled: "reconciled";
+    };
+    readonly check: {
+        readonly absent: "absent";
+        readonly ambiguous: "ambiguous";
+        readonly unavailable: "unavailable";
+    };
+    readonly owner: {
+        readonly alive: "alive";
+        readonly dead: "dead";
+        readonly unknown: "unknown";
+    };
+    readonly fullReadAccessConfirmed: true;
+    readonly assertion: "owner-stopped";
+    readonly confirmedAbsent: "confirmed-absent";
+    readonly failures: string[];
+    readonly message: {
+        readonly refused: "The request was refused without a confirmed effect.";
+        readonly unknown: "The server outcome is unknown; check before sending again.";
+        readonly absent: "Explicitly confirmed absent after a successful server check.";
+    };
+};
+export declare const record: (v: unknown) => v is Record<string, unknown>;
+export declare const text: (v: unknown) => v is string;
+export declare function refuse(message: string): never;
+export declare function hash(value: string): string;
+/** Stable object-key ordering; arrays retain their intentional order. */
+export declare function canonical(value: unknown): string;
+export declare function credentialFree(value: unknown, secrets: readonly string[]): void;
+/** Refuse an unrepresentable bearer before effect, never success followed by unreadable generated metadata. */
+export declare function assertNativeRepresentable(secrets: readonly string[]): void;
+export declare function normalizeIntent(value: unknown, secrets?: readonly string[]): BcfWriteIntent;
+export declare function intentDigest(intent: BcfWriteIntent): string;
+export declare function decodeAttempt(value: unknown, filename: string): StoredBcfAttempt;
+export declare function decodeOutcome(value: unknown, attempt: StoredBcfAttempt, checked?: boolean): StoredBcfOutcome;
+export declare function decodeCheck(value: unknown, attempt: StoredBcfAttempt, filename: string): StoredBcfCheck;
+//# sourceMappingURL=bcf-publication-codec.d.ts.map

package/dist/bcf-publication-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bcf-publication-codec.d.ts","sourceRoot":"","sources":["../src/bcf-publication-codec.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAErG,eAAO,MAAM,gBAAgB,QAAa,CAAC;AAC3C,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,WAAW,QAAsB,CAAC;AAC/C,eAAO,MAAM,UAAU,KAAK,CAAC;AAY7B,yGAAyG;AACzG,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUlB,CAAC;AACX,eAAO,MAAM,MAAM,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAsD,CAAC;AACtH,eAAO,MAAM,IAAI,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAAqE,CAAC;AAE7G,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAA4D;AAC1G,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAA6D;AAExG,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIhD;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAqB/E;AAED,+GAA+G;AAC/G,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAI1E;AAcD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,SAAS,MAAM,EAAO,GAAG,cAAc,CA+B/F;AACD,wBAAgB,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAG3D;AACD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAahF;AACD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,UAAQ,GAAG,gBAAgB,CA2B1G;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAoBvG"}

package/dist/bcf-publication-codec.js

@@ -0,0 +1,247 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
+import { normalizeBcfBaseUrl } from '@ifc-lite/bcf-api';
+export const MAX_RECORD_BYTES = 256 * 1024;
+export const MAX_GENERATIONS = 256;
+export const MAX_RECORDS = 4 * MAX_GENERATIONS;
+export const MAX_CHECKS = 16;
+const TOPIC_FIELDS = ['title', 'topic_type', 'topic_status', 'priority', 'labels', 'assigned_to', 'stage', 'description', 'due_date'];
+const COMMENT_FIELDS = ['comment', 'viewpoint_guid', 'reply_to_comment_guid'];
+// These are protocol keys, not user credential data. Context-specific decoders
+// still reject a known key appearing in the wrong record/payload location.
+const SCHEMA_KEYS = new Set([...TOPIC_FIELDS, ...COMMENT_FIELDS,
+    'nodeType', 'operation', 'baseUrl', 'version', 'projectId', 'topicGuid', 'payload', 'intent',
+    'id', 'digest', 'generation', 'queuedAt', 'owner', 'pid', 'host', 'boot', 'domain', 'instance',
+    'state', 'receipt', 'remoteGuid', 'at', 'evidence', 'failure', 'code', 'message', 'status',
+    'checkId', 'check', 'result', 'candidates', 'fullReadAccessConfirmed', 'guid', 'candidateGuid', 'settlement', 'outcome', 'proofCheckId',
+    'assertion', 'epoch', 'previous', 'attempt', 'checks', 'checkPending', 'reconciled', 'ownerStatus', 'ownerConfirmed']);
+const FAILURES = ['auth', 'permission', 'rejected', 'no-response', 'server-error', 'conflict-exists', 'interrupted'];
+/** Shared construction/decoding values; the representability guard must not drift from saved records. */
+export const NATIVE_METADATA = {
+    state: { done: 'done', failed: 'failed', uncertain: 'uncertain', sending: 'sending' },
+    evidence: { response: 'response', reconciled: 'reconciled' },
+    check: { absent: 'absent', ambiguous: 'ambiguous', unavailable: 'unavailable' },
+    owner: { alive: 'alive', dead: 'dead', unknown: 'unknown' },
+    fullReadAccessConfirmed: true,
+    assertion: 'owner-stopped', confirmedAbsent: 'confirmed-absent', failures: FAILURES,
+    message: { refused: 'The request was refused without a confirmed effect.',
+        unknown: 'The server outcome is unknown; check before sending again.',
+        absent: 'Explicitly confirmed absent after a successful server check.' },
+};
+export const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+export const text = (v) => typeof v === 'string' && v.length > 0 && v.length <= 20_000;
+const date = (v) => text(v) && Number.isFinite(Date.parse(v));
+export function refuse(message) { throw new Error(`BCF publication refused: ${message}`); }
+export function hash(value) { return createHash('sha256').update(value).digest('hex'); }
+/** Stable object-key ordering; arrays retain their intentional order. */
+export function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (record(value))
+        return `{${Object.keys(value).sort().map(k => `${JSON.stringify(k)}:${canonical(value[k])}`).join(',')}}`;
+    return JSON.stringify(value);
+}
+export function credentialFree(value, secrets) {
+    const serialized = JSON.stringify(value);
+    if (/authorization\s*:\s*bearer\s+|"Bearer (?=[A-Za-z0-9._~+/=-]*[0-9._~+/=-])[A-Za-z0-9._~+/=-]{8,}"|[?&](?:access_token|token|password|secret)=|"(?:authorization|password|access_token|token|secret)"\s*:/i.test(serialized))
+        refuse('credentials must not enter durable state');
+    const sensitive = secrets.filter(secret => secret.length > 0).map(secret => JSON.stringify(secret).slice(1, -1));
+    if (!sensitive.length)
+        return;
+    const reject = (item) => {
+        const encoded = JSON.stringify(item);
+        if (encoded !== undefined && sensitive.some(secret => encoded.includes(secret)))
+            refuse('credentials must not enter durable state');
+    };
+    const pending = [value];
+    while (pending.length) {
+        const item = pending.pop();
+        if (Array.isArray(item)) {
+            for (const field of item)
+                pending.push(field);
+        }
+        else if (record(item)) {
+            for (const [key, field] of Object.entries(item)) {
+                if (!SCHEMA_KEYS.has(key))
+                    reject(key);
+                pending.push(field);
+            }
+        }
+        else
+            reject(item);
+    }
+}
+/** Refuse an unrepresentable bearer before effect, never success followed by unreadable generated metadata. */
+export function assertNativeRepresentable(secrets) {
+    credentialFree([...Object.values(NATIVE_METADATA.state), ...Object.values(NATIVE_METADATA.evidence),
+        ...Object.values(NATIVE_METADATA.check), ...Object.values(NATIVE_METADATA.owner), ...NATIVE_METADATA.failures,
+        NATIVE_METADATA.assertion, NATIVE_METADATA.fullReadAccessConfirmed, NATIVE_METADATA.confirmedAbsent, ...Object.values(NATIVE_METADATA.message)], secrets);
+}
+function validatePayload(value, comment) {
+    if (!record(value))
+        refuse('invalid write payload');
+    const allowed = comment ? COMMENT_FIELDS : TOPIC_FIELDS;
+    if (Object.keys(value).some(k => !allowed.includes(k)) || !text(value[comment ? 'comment' : 'title']))
+        refuse('invalid write payload');
+    for (const [key, item] of Object.entries(value)) {
+        if (item === null || item === undefined)
+            continue;
+        if (key === 'labels') {
+            if (!Array.isArray(item) || item.length > 500 || !item.every(v => typeof v === 'string' && v.length <= 20_000))
+                refuse('invalid labels');
+        }
+        else if (typeof item !== 'string' || item.length > 20_000)
+            refuse('invalid payload field');
+    }
+}
+export function normalizeIntent(value, secrets = []) {
+    if (!record(value) || !text(value.nodeType) || !text(value.baseUrl) || !text(value.version) || !text(value.projectId)
+        || !['createTopic', 'createComment'].includes(String(value.operation)) || !record(value.payload))
+        refuse('invalid intent');
+    const keys = ['nodeType', 'operation', 'baseUrl', 'version', 'projectId', 'topicGuid', 'payload'];
+    if (Object.keys(value).some(k => !keys.includes(k)))
+        refuse('unknown intent fields');
+    let url;
+    try {
+        url = new URL(value.baseUrl);
+    }
+    catch {
+        refuse('invalid server URL');
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash)
+        refuse('server URL must be credential-free HTTPS');
+    if (!/^[A-Za-z0-9.-]{1,32}$/.test(value.version))
+        refuse('invalid API version');
+    const comment = value.operation === 'createComment';
+    if (value.nodeType !== (comment ? 'bcf.addComment' : 'bcf.createTopic'))
+        refuse('node and operation disagree');
+    if (comment ? !text(value.topicGuid) : value.topicGuid !== undefined)
+        refuse('invalid topic target');
+    validatePayload(value.payload, comment);
+    let serialized;
+    try {
+        serialized = JSON.stringify(value.payload);
+    }
+    catch {
+        refuse('invalid write payload');
+    }
+    if (serialized === undefined)
+        refuse('invalid write payload');
+    if (Buffer.byteLength(serialized) > MAX_RECORD_BYTES / 2)
+        refuse('intent exceeds storage bound');
+    let payload;
+    try {
+        payload = JSON.parse(serialized);
+    }
+    catch {
+        refuse('invalid write payload');
+    }
+    validatePayload(payload, comment);
+    // Custom serialization errors must not expose their message/cause to callers.
+    try {
+        credentialFree(value, secrets);
+    }
+    catch {
+        refuse('credentials must not enter durable state');
+    }
+    // Canonical identity must match the exact JSON schema persisted on disk.
+    // Spreading an own undefined optional key hashes data that JSON omits.
+    const normalized = { nodeType: value.nodeType, operation: comment ? 'createComment' : 'createTopic',
+        baseUrl: normalizeBcfBaseUrl(value.baseUrl), version: value.version, projectId: value.projectId,
+        ...(comment && text(value.topicGuid) ? { topicGuid: value.topicGuid } : {}),
+        payload };
+    credentialFree(normalized, secrets);
+    if (Buffer.byteLength(JSON.stringify(normalized)) > MAX_RECORD_BYTES / 2)
+        refuse('intent exceeds storage bound');
+    return normalized;
+}
+export function intentDigest(intent) {
+    const { nodeType: _nodeType, ...effect } = intent;
+    return hash(canonical(effect));
+}
+export function decodeAttempt(value, filename) {
+    if (!record(value) || value.version !== 1 || !text(value.id) || !text(value.digest) || !Number.isSafeInteger(value.generation)
+        || Number(value.generation) < 1 || !date(value.queuedAt) || !record(value.owner) || !Number.isSafeInteger(value.owner.pid)
+        || Number(value.owner.pid) < 1 || !text(value.owner.host) || !/^[a-f0-9]{64}$/.test(value.owner.host)
+        || Object.keys(value.owner).some(k => !['pid', 'host', 'boot', 'domain', 'instance'].includes(k)))
+        refuse('malformed attempt');
+    const owner = value.owner;
+    if (['boot', 'domain', 'instance'].some(k => owner[k] !== undefined)
+        && !['boot', 'domain', 'instance'].every(k => typeof owner[k] === 'string' && /^[a-f0-9]{64}$/.test(owner[k])))
+        refuse('incomplete owner identity');
+    const intent = normalizeIntent(value.intent);
+    if (canonical(value.intent) !== canonical(intent) || value.digest !== intentDigest(intent)
+        || value.id !== `${value.digest}-${value.generation}` || filename !== `${value.id}.intent.json`)
+        refuse('attempt identity mismatch');
+    if (Object.keys(value).some(k => !['version', 'id', 'digest', 'generation', 'intent', 'queuedAt', 'owner'].includes(k)))
+        refuse('unknown attempt fields');
+    return value;
+}
+export function decodeOutcome(value, attempt, checked = false) {
+    if (!record(value) || value.version !== 1 || value.id !== attempt.id || value.digest !== attempt.digest
+        || !['done', 'failed', 'uncertain'].includes(String(value.state)))
+        refuse('malformed outcome');
+    if (Object.keys(value).some(k => !['version', 'id', 'digest', 'state', 'receipt', 'failure'].includes(k)))
+        refuse('unknown outcome fields');
+    if (value.state === 'done') {
+        const r = value.receipt;
+        if (value.failure !== undefined || !record(r) || !text(r.remoteGuid) || !date(r.at)
+            || !['response', 'reconciled'].includes(String(r.evidence)) || (!checked && r.evidence !== 'response')
+            || Object.keys(r).some(k => !['remoteGuid', 'at', 'evidence'].includes(k)))
+            refuse('invalid receipt');
+    }
+    else {
+        const f = value.failure;
+        if (value.receipt !== undefined || !record(f) || !(FAILURES.includes(String(f.code)) || (checked && f.code === 'confirmed-absent')) || !text(f.message) || !date(f.at)
+            || (f.status !== undefined && (!Number.isInteger(f.status) || Number(f.status) < 0 || Number(f.status) > 599))
+            || Object.keys(f).some(k => !['code', 'message', 'at', 'status'].includes(k)))
+            refuse('invalid failure');
+    }
+    if (value.state === 'failed' && record(value.failure) && !['auth', 'permission', 'rejected', ...(checked ? ['confirmed-absent'] : [])].includes(String(value.failure.code)))
+        refuse('uncertain failure marked definite');
+    if (value.state === 'uncertain' && record(value.failure) && !['no-response', 'server-error', 'conflict-exists', 'interrupted'].includes(String(value.failure.code)))
+        refuse('definite failure marked uncertain');
+    if (record(value.failure)) {
+        const { code, status } = value.failure;
+        if ((code === 'auth' && status !== 401) || (code === 'permission' && status !== undefined && status !== 403)
+            || (code === 'server-error' && (typeof status !== 'number' || status < 500))
+            || (code === 'conflict-exists' && status !== 409)
+            || (code === 'rejected' && (typeof status !== 'number' || status < 400 || status >= 500 || [401, 403, 409].includes(status)))
+            || (['no-response', 'interrupted', 'confirmed-absent'].includes(String(code)) && status !== undefined && status !== 0))
+            refuse('failure status contradicts classification');
+    }
+    credentialFree(value, []);
+    return value;
+}
+export function decodeCheck(value, attempt, filename) {
+    if (!record(value) || value.version !== 1 || value.id !== attempt.id || value.digest !== attempt.digest || !text(value.checkId)
+        || !/^[1-9][0-9]{0,15}$/.test(value.checkId) || !Number.isSafeInteger(Number(value.checkId)) || (filename !== `${attempt.id}.check-${value.checkId}.json` && filename !== `${attempt.id}.checked-${value.checkId}.json`) || !record(value.check))
+        refuse('malformed check');
+    const c = value.check;
+    if (!date(c.at) || !['absent', 'ambiguous', 'unavailable'].includes(String(c.result)) || !Array.isArray(c.candidates)
+        || c.candidates.length > 50 || !c.candidates.every(v => record(v) && text(v.guid) && Object.keys(v).length === 1)
+        || (c.result !== 'ambiguous' && c.candidates.length > 0)
+        || (c.fullReadAccessConfirmed !== undefined && (c.fullReadAccessConfirmed !== true || c.result !== 'absent'))
+        || Object.keys(c).some(k => !['at', 'result', 'candidates', 'fullReadAccessConfirmed'].includes(k))
+        || Object.keys(value).some(k => !['version', 'id', 'digest', 'checkId', 'check', 'settlement'].includes(k)))
+        refuse('invalid checked candidates');
+    if (value.settlement !== undefined) {
+        const settled = value.settlement;
+        if (!record(settled) || !text(settled.proofCheckId) || Object.keys(settled).some(k => !['outcome', 'proofCheckId'].includes(k)))
+            refuse('malformed settlement');
+        const outcome = decodeOutcome(settled.outcome, attempt, true);
+        if (!(outcome.state === 'done' && outcome.receipt?.evidence === 'reconciled')
+            && !(outcome.state === 'failed' && outcome.failure?.code === 'confirmed-absent'))
+            refuse('invalid settlement receipt');
+        if (filename.includes('.checked-'))
+            refuse('check response cannot settle an intent');
+    }
+    else if (filename.includes('.check-') && (c.result !== 'unavailable' || c.candidates.length))
+        refuse('check reservation must be unavailable');
+    credentialFree(value, []);
+    return value;
+}
+//# sourceMappingURL=bcf-publication-codec.js.map

package/dist/bcf-publication-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bcf-publication-codec.js","sourceRoot":"","sources":["../src/bcf-publication-codec.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAIxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,eAAe,CAAC;AAC/C,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAC7B,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;AACtI,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc;IAC7D,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ;IAC5F,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;IAC9F,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ;IAC1F,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc;IACvI,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACzH,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;AACrH,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE;IACrF,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE;IAC5D,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE;IAC/E,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;IAC3D,uBAAuB,EAAE,IAAI;IAC7B,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ;IACnF,OAAO,EAAE,EAAE,OAAO,EAAE,qDAAqD;QACvE,OAAO,EAAE,4DAA4D;QACrE,MAAM,EAAE,8DAA8D,EAAE;CAClE,CAAC;AACX,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACtH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;AAC7G,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,MAAM,UAAU,MAAM,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1G,MAAM,UAAU,IAAI,CAAC,KAAa,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAExG,yEAAyE;AACzE,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7H,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,OAA0B;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,0MAA0M,CAAC,IAAI,CAAC,UAAU,CAAC;QAC7N,MAAM,CAAC,0CAA0C,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO;IAC9B,MAAM,MAAM,GAAG,CAAC,IAAa,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,CAAC,0CAA0C,CAAC,CAAC;IACtI,CAAC,CAAC;IACF,MAAM,OAAO,GAAc,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,KAAK,MAAM,KAAK,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;aACtE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;;YAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,yBAAyB,CAAC,OAA0B;IAClE,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC;QACjG,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,eAAe,CAAC,QAAQ;QAC7G,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,uBAAuB,EAAE,eAAe,CAAC,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9J,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,OAAgB;IACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvI,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QAClD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;gBAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC3I,CAAC;aAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM;YAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,UAA6B,EAAE;IAC7E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;WAChH,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACrF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAAC,CAAC;IAC7E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAC5I,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,eAAe,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAAE,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACrG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAAC,CAAC;IAC9F,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC;QAAE,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACjG,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAAC,CAAC;IACpF,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClC,8EAA8E;IAC9E,IAAI,CAAC;QAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAAC,CAAC;IACrG,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,UAAU,GAAmB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa;QACjH,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC/F,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,gBAAgB,GAAG,CAAC;QAAE,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACjH,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,MAAsB;IACjD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC;IAClD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,QAAgB;IAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;WACzH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;WACvH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;WAClG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACjI,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;WAC/D,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACtJ,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;WACrF,KAAK,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,QAAQ,KAAK,GAAG,KAAK,CAAC,EAAE,cAAc;QAAE,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACvI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC1J,OAAO,KAAoC,CAAC;AAC9C,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAyB,EAAE,OAAO,GAAG,KAAK;IACtF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;WAClG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC5I,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;eAC9E,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;eACnG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1G,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;eACjK,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;eAC3G,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,CAAC,mCAAmC,CAAC,CAAC;IACzN,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,CAAC,mCAAmC,CAAC,CAAC;IACjN,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACvC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG,CAAC;eACvG,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC;eACzE,CAAC,IAAI,KAAK,iBAAiB,IAAI,MAAM,KAAK,GAAG,CAAC;eAC9C,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;eAC1H,CAAC,CAAC,aAAa,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,CAAC,CAAC;YAAE,MAAM,CAAC,2CAA2C,CAAC,CAAC;IAChL,CAAC;IACD,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,KAAoC,CAAC;AAC9C,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,OAAyB,EAAE,QAAgB;IACrF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WAC1H,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,OAAO,CAAC,EAAE,UAAU,KAAK,CAAC,OAAO,OAAO,IAAI,QAAQ,KAAK,GAAG,OAAO,CAAC,EAAE,YAAY,KAAK,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC9Q,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IACtB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;WAChH,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;WAC9G,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;WACrD,CAAC,CAAC,CAAC,uBAAuB,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,uBAAuB,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;WAC1G,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAChG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACpJ,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAChK,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,YAAY,CAAC;eACxE,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,kBAAkB,CAAC;YAAE,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACzH,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,wCAAwC,CAAC,CAAC;IACvF,CAAC;SAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,uCAAuC,CAAC,CAAC;IAChJ,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,KAAkC,CAAC;AAC5C,CAAC"}

package/dist/bcf-publication-epochs.d.ts

@@ -0,0 +1,17 @@
+import type { StoredBcfAttempt, StoredBcfCheck } from './bcf-publication-types.js';
+export interface BcfCheckEpoch {
+    version: 1;
+    id: string;
+    digest: string;
+    epoch: number;
+    previous?: StoredBcfCheck;
+}
+export declare function epochOf(checkId: string): number;
+/** Contiguous immutable markers permit bounded lookup; archived epoch bodies are never walked. */
+export declare function loadCheckEpoch(attempt: StoredBcfAttempt, read: (epoch: number, filename: string) => Promise<unknown>): Promise<{
+    checks: StoredBcfCheck[];
+    pending: boolean;
+}>;
+/** Existing marker must contain the same immutable predecessor proof. */
+export declare function verifyCheckEpoch(value: unknown, expected: BcfCheckEpoch, attempt: StoredBcfAttempt): void;
+//# sourceMappingURL=bcf-publication-epochs.d.ts.map

package/dist/bcf-publication-epochs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bcf-publication-epochs.d.ts","sourceRoot":"","sources":["../src/bcf-publication-epochs.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAInF,MAAM,WAAW,aAAa;IAAG,OAAO,EAAE,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE;AACnH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAM/C;AAcD,kGAAkG;AAClG,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAC5D,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAwCtH;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAEzG"}