@lssm/lib.contracts-spec 17.3.2

package/dist/control-plane/hook-authority-reference-adapter.d.ts

@@ -0,0 +1,13 @@
+import type { HookAuthorityAuthorizationV1, HookAuthorityComposition, HookAuthorityPort, HookAuthorityResult, HookAuthoritySessionCapabilityV1, HookAuthorityTransitionRequestV1 } from './hook-authority.js';
+import { type HookAuthorityReferenceRestartTokenV1 } from './hook-authority-reference-state.js';
+export type { HookAuthorityReferenceRestartTokenV1 } from './hook-authority-reference-state.js';
+export declare class ReferenceHookAuthorityAdapter implements HookAuthorityPort {
+    #private;
+    private readonly dependencies;
+    constructor(dependencies: HookAuthorityComposition);
+    get restartToken(): HookAuthorityReferenceRestartTokenV1;
+    static resume(dependencies: HookAuthorityComposition, token: HookAuthorityReferenceRestartTokenV1): ReferenceHookAuthorityAdapter | undefined;
+    transition(input: HookAuthorityTransitionRequestV1, startDelivery?: HookAuthoritySessionCapabilityV1): Promise<HookAuthorityResult<HookAuthorityAuthorizationV1>>;
+    private authenticateOrReplay;
+    private commit;
+}

package/dist/control-plane/hook-authority-reference-adapter.js

@@ -0,0 +1 @@
+export class ReferenceHookAuthorityAdapter{dependencies;#e;#t;constructor(e){this.dependencies=e;const s=D();this.#e=s.state;this.#t=s.token}get restartToken(){return this.#t}static resume(e,s){const n=L(s);if(!n)return;const r=new ReferenceHookAuthorityAdapter(e);r.#e=n;r.#t=s;return r}async transition(e,s){const n=v(this.dependencies.clock,this.#e);if(n===null)return t("signature_untrusted","Trusted clock failed closed.");const r=K.parse(e,new Date(n));if(!r.ok)return r;const a=r.value,c=b(a,s);if(!c)return t("invalid_request","Caller session capability does not match the signed commitment.");const o=w(a),i=await H(this.#e,()=>this.authenticateOrReplay(a,o));if(!i.ok||i.value)return i;const h=await R(this.dependencies,()=>this.dependencies.verifier.verify(a.decision),(d)=>d===void 0);if(!h.ok)return h;const u=await R(this.dependencies,()=>this.dependencies.liveBindings.resolve(a.decision),B);if(!u.ok)return u;return H(this.#e,()=>this.commit(a,o,u.value,n,c))}authenticateOrReplay(e,s){const n=p(e);if(e.event!=="session-start"&&!z(e,this.#e.sessions))return t("scope_mismatch","Session capability does not authenticate the session.");if(e.event!=="session-start"){const o=this.#e.sessions.get(l(e.sessionRef));if(!o)return t("not_found","Session does not exist.");if(!C(o,e))return t("scope_mismatch","Session decision, tenant, or workspace does not match the request.");if(o.terminalizedAt){const i=this.#e.replays.get(`${p(e)}\x00${e.replayKey}`);if(i?.requestDigest.value===s.value){const{sessionCapability:h,...u}=i;return{ok:!0,value:f({...u,replayed:!0})}}return t("terminalized","Session is terminalized.")}}const r=this.#e.replays.get(`${n}\x00${e.replayKey}`);if(!r){if(e.event!=="session-start"){const o=this.#e.sessions.get(l(e.sessionRef));if(o&&(o.revision!==e.expectedRevision||o.fence!==e.expectedFence))return t("version_conflict","Session revision or fence does not match.")}return{ok:!0,value:void 0}}if(r.requestDigest.value!==s.value)return t("replay_conflict","Replay key was used with a distinct request digest.");const{sessionCapability:a,...c}=r;return{ok:!0,value:f({...c,replayed:!0})}}commit(e,s,n,r,a){const c=v(this.dependencies.clock,this.#e,r);if(c===null||!V(e,n,c))return t("scope_mismatch","Live binding no longer exactly binds this decision.");const o=this.authenticateOrReplay(e,s);if(!o.ok||o.value)return o;const i=e.event==="session-start"?void 0:this.#e.sessions.get(l(e.sessionRef));if(e.event==="session-start"&&this.#e.sessions.has(l(A(e,"",1,"").sessionRef)))return t("replay_conflict","Decision identity already owns a session.");if(!i&&e.event!=="session-start")return t("not_found","Session does not exist.");if(i?.terminalizedAt)return t("terminalized","Session is terminalized.");if(i&&e.event!=="session-start"&&(i.revision!==e.expectedRevision||i.fence!==e.expectedFence))return t("version_conflict","Session revision or fence does not match.");let h;if(e.event==="session-start"){h=_(a,()=>this.dependencies.capabilities.generate());if(!h)return t("signature_untrusted","Capability source failed closed.")}const u=new Date(c).toISOString(),d=i??A(e,u,n.fence,h);if(i&&i.authorityVersion!==n.authorityVersion)return t("version_conflict","Live authority version changed.");const m=T(this.#e,e,d,u);if(!m)return t("scope_mismatch","Stored active leases do not match.");const g=e.event==="session-start"?d:{...d,revision:d.revision+1,fence:n.fence,...e.event==="stop"?{terminalizedAt:u}:{}},y=f(g);this.#e.sessions.set(l(y.sessionRef),y);const k=f(x(e,s,y,u,a.committed?void 0:h,m)),{sessionCapability:O,...S}=k;this.#e.replays.set(`${p(e)}\x00${e.replayKey}`,f(S));return{ok:!0,value:f(k)}}}import{immutableData as f}from"./hook-authority-immutable.js";import{validBinding as V}from"./hook-authority-reference-binding.js";import{committedStartCapability as b,startCapabilityValue as _}from"./hook-authority-reference-capability.js";import{authenticated as z,trustedNow as v}from"./hook-authority-reference-clock.js";import{createSession as A,hookAuthorityRequestDigest as w,replaySessionId as p}from"./hook-authority-reference-helpers.js";import{invoke as R}from"./hook-authority-reference-invoke.js";import{advanceLeases as T}from"./hook-authority-reference-leases.js";import{withSerialLock as H}from"./hook-authority-reference-lock.js";import{authorization as x}from"./hook-authority-reference-result.js";import{refKey as l,sessionMatchesRequest as C}from"./hook-authority-reference-session.js";import{createReferenceState as D,resumedReferenceState as L}from"./hook-authority-reference-state.js";import{fail as t,validLive as B}from"./hook-authority-reference-validation.js";import{HookAuthorityRequestSchema as K}from"./hook-authority-validation.js";

package/dist/control-plane/hook-authority-reference-binding.d.ts

@@ -0,0 +1,2 @@
+import type { HookAuthorityLiveBinding, HookAuthorityTransitionRequestV1 } from './hook-authority.js';
+export declare function validBinding(request: HookAuthorityTransitionRequestV1, live: HookAuthorityLiveBinding, now: number): boolean;

package/dist/control-plane/hook-authority-reference-binding.js

@@ -0,0 +1 @@
+import{validTimestamp as s}from"./hook-authority-validation-primitives.js";export function validBinding(o,e,i){const t=o.decision.body,a=s(e.verifiedAt),r=s(e.validUntil),u=s(e.expiresAt);return n(t.scope.tenantRef,e.tenantRef)&&n(t.scope.workspaceRef,e.workspaceRef)&&n(t.evidence.ownershipRef,e.ownershipRef)&&n(t.evidence.keyStatusRef,e.keyStatusRef)&&n(t.revocationRef,e.revocationRef)&&t.evidence.leaseRefs.length===e.leaseRefs.length&&t.evidence.leaseRefs.every((c,d)=>n(c,e.leaseRefs[d]))&&e.authorityGeneration===t.decisionRef.generation&&e.authorityVersion===t.authorityVersion&&e.revoked===!1&&e.keyStatus==="active"&&e.ownershipStatus==="active"&&e.leaseStatus==="active"&&u!==null&&e.expiresAt===t.expiresAt&&a!==null&&r!==null&&a<=i&&i<r&&i<u&&e.fence===t.authorityFence&&e.fence===(o.event==="session-start"?t.authorityFence:o.expectedFence)}function n(o,e){return o===e||Boolean(o&&e&&o.id===e.id&&o.generation===e.generation&&o.digest.value===e.digest.value)}

package/dist/control-plane/hook-authority-reference-capability.d.ts

@@ -0,0 +1,8 @@
+import type { HookAuthoritySessionCapabilityV1, HookAuthorityTransitionRequestV1 } from './hook-authority.js';
+export declare function committedStartCapability(request: HookAuthorityTransitionRequestV1, delivery: HookAuthoritySessionCapabilityV1 | undefined): {
+    committed: boolean;
+    value?: string;
+} | undefined;
+export declare function startCapabilityValue(committed: {
+    value?: string;
+}, generate: () => string): string | undefined;

package/dist/control-plane/hook-authority-reference-capability.js

@@ -0,0 +1 @@
+import{hookAuthorityDigest as o}from"./hook-authority-digest.js";import{validCapability as n}from"./hook-authority-validation-primitives.js";export function committedStartCapability(e,t){if(e.event!=="session-start")return t===void 0?{committed:!1}:void 0;const i=e.decision.body.sessionCapabilityHash;if(!i)return t===void 0?{committed:!1}:void 0;if(!r(t)||!n(t.sessionCapability))return;return o(t.sessionCapability).value===i.value?{committed:!0,value:t.sessionCapability}:void 0}export function startCapabilityValue(e,t){if(e.value)return e.value;try{const i=t();return n(i)?i:void 0}catch{return}}function r(e){if(!e||Object.getPrototypeOf(e)!==Object.prototype)return!1;if(Object.keys(e).length!==1||Object.getOwnPropertySymbols(e).length)return!1;const t=Object.getOwnPropertyDescriptor(e,"sessionCapability");return Boolean(t&&!t.get&&!t.set&&typeof t.value==="string")}

package/dist/control-plane/hook-authority-reference-clock.d.ts

@@ -0,0 +1,7 @@
+import type { HookAuthorityClockPort, HookAuthorityStoredSessionV1, HookAuthorityTransitionRequestV1 } from './hook-authority.js';
+export declare function authenticated(request: Exclude<HookAuthorityTransitionRequestV1, {
+    event: 'session-start';
+}>, sessions: Map<string, HookAuthorityStoredSessionV1>): boolean;
+export declare function trustedNow(clock: HookAuthorityClockPort, state: {
+    lastNow: number;
+}, floor?: number): number | null;

package/dist/control-plane/hook-authority-reference-clock.js

@@ -0,0 +1 @@
+import{hookAuthorityDigest as r}from"./hook-authority-digest.js";export function authenticated(t,n){const o=n.get(s(t.sessionRef));return Boolean(o&&s(o.sessionRef)===s(t.sessionRef)&&o.capabilityHash.value===r(t.sessionCapability).value)}function s(t){return`${t.id}\x00${t.generation}\x00${t.digest.value}`}export function trustedNow(t,n,o){try{const i=t.now(),e=i instanceof Date?i.getTime():NaN;if(!Number.isFinite(e)||i.toISOString()!==new Date(e).toISOString()||o!==void 0&&e<o||e<n.lastNow)return null;n.lastNow=e;return e}catch{return null}}

package/dist/control-plane/hook-authority-reference-helpers.d.ts

@@ -0,0 +1,5 @@
+import type { HookAuthorityRef, HookAuthorityStoredSessionV1, HookAuthorityTransitionRequestV1 } from './hook-authority.js';
+export declare function hookAuthorityRequestDigest(request: HookAuthorityTransitionRequestV1): import("./hook-authority").HookAuthorityDigest;
+export declare function replaySessionId(request: HookAuthorityTransitionRequestV1): string;
+export declare function createSession(request: HookAuthorityTransitionRequestV1, createdAt: string, fence: number, capability: string): HookAuthorityStoredSessionV1;
+export declare function reference(kind: string, id: string): HookAuthorityRef;

package/dist/control-plane/hook-authority-reference-helpers.js

@@ -0,0 +1 @@
+import{hookAuthorityDigest as i}from"./hook-authority-digest.js";export function hookAuthorityRequestDigest(o){const{sessionCapability:e,...t}=o;return i(t)}export function replaySessionId(o){return o.event==="session-start"?i({kind:"hook-authority-start-replay-scope-v1",decisionRef:o.decision.body.decisionRef,tenantRef:o.tenantRef,workspaceRef:o.workspaceRef}).value:i({kind:"hook-authority-session-replay-scope-v1",sessionRef:o.sessionRef}).value}export function createSession(o,e,t,n){return{sessionRef:reference("session",s({kind:"hook-authority-session-v1",decisionRef:o.decision.body.decisionRef,tenantRef:o.tenantRef,workspaceRef:o.workspaceRef})),tenantRef:o.tenantRef,workspaceRef:o.workspaceRef,actorRef:o.actorRef,currentSha:o.currentSha,workspaceRoot:o.workspaceRoot,capabilityHash:i(n),decisionRef:o.decision.body.decisionRef,decisionBodyDigest:o.decision.bodyDigest,decisionEnvelopeDigest:o.decision.envelopeDigest,leaseRefs:o.decision.body.evidence.leaseRefs,authorityVersion:o.decision.body.authorityVersion,revision:1,fence:t,createdAt:e}}function s(o){return i(o).value.slice(7)}export function reference(o,e){return{id:`${o}.${e}`.slice(0,128),generation:1,digest:i({kind:o,id:e})}}

package/dist/control-plane/hook-authority-reference-invoke.d.ts

@@ -0,0 +1,2 @@
+import type { HookAuthorityComposition, HookAuthorityResult } from './hook-authority.js';
+export declare function invoke<T>(dependencies: HookAuthorityComposition, operation: () => unknown, valid: (value: unknown) => value is T): Promise<HookAuthorityResult<T>>;

package/dist/control-plane/hook-authority-reference-invoke.js

@@ -0,0 +1 @@
+import{immutableData as d}from"./hook-authority-immutable.js";import{fail as i}from"./hook-authority-reference-validation.js";export async function invoke(r,n,o){try{const e=s(await r.deadlines.race(()=>l(n)));if(!e)return u();if(e.ok===!1)return a(e)??u();if(!o(e.value))return u();return{ok:!0,value:e.value}}catch{return i("signature_untrusted","Trusted dependency failed closed.")}}function s(r){const n=d(r);if(!n||typeof n!=="object"||Array.isArray(n))return;const o=Object.getOwnPropertyDescriptors(n),e=Object.keys(o).sort();if(e.length!==2||o.ok?.value===void 0)return;if(o.ok.value===!0&&e[0]==="ok"&&e[1]==="value")return{ok:!0,value:o.value?.value};if(o.ok.value!==!1||e[0]!=="error"||e[1]!=="ok")return;const t=d(o.error?.value);if(!t||Object.keys(t).sort().join(",")!=="code,message")return;if(typeof t.code!=="string"||typeof t.message!=="string")return;return{ok:!1,error:{code:t.code,message:t.message}}}function a(r){if(!["expired","revoked"].includes(r.error.code))return;return i(r.error.code,`Trusted authority denied: ${r.error.code}.`)}function u(){return i("signature_untrusted","Trusted dependency timed out or returned an invalid result.")}function l(r){const n=r();if(!(n instanceof Promise))throw Error("Dependency did not return a native Promise.");return n}

package/dist/control-plane/hook-authority-reference-leases.d.ts

@@ -0,0 +1,6 @@
+import type { HookAuthorityLeaseReleaseV1, HookAuthorityRef, HookAuthorityStoredSessionV1, HookAuthorityTransitionRequestV1 } from './hook-authority.js';
+import type { ReferenceState } from './hook-authority-reference-state.js';
+export declare function createActiveLeases(state: ReferenceState, session: HookAuthorityStoredSessionV1, leases: readonly HookAuthorityRef[]): boolean;
+export declare function activeLeasesMatch(state: ReferenceState, session: HookAuthorityStoredSessionV1, leases: readonly HookAuthorityRef[]): boolean;
+export declare function releaseLeases(state: ReferenceState, session: HookAuthorityStoredSessionV1, leases: readonly HookAuthorityRef[], now: string): readonly Omit<HookAuthorityLeaseReleaseV1, 'receiptRef'>[] | undefined;
+export declare function advanceLeases(state: ReferenceState, request: HookAuthorityTransitionRequestV1, session: HookAuthorityStoredSessionV1, now: string): readonly Omit<HookAuthorityLeaseReleaseV1, 'receiptRef'>[] | undefined;

package/dist/control-plane/hook-authority-reference-leases.js

@@ -0,0 +1 @@
+import{hookAuthorityDigest as a}from"./hook-authority-digest.js";import{reference as u}from"./hook-authority-reference-helpers.js";import{refKey as s}from"./hook-authority-reference-session.js";export function createActiveLeases(o,e,t){if(t.some((n)=>o.leases.has(f(e.sessionRef,n))))return!1;for(const n of t)o.leases.set(f(e.sessionRef,n),{leaseRef:n,sessionRef:e.sessionRef});return!0}export function activeLeasesMatch(o,e,t){return[...o.leases.values()].filter((r)=>s(r.sessionRef)===s(e.sessionRef)).length===t.length&&e.leaseRefs.length===t.length&&e.leaseRefs.every((r,i)=>s(r)===s(t[i]))&&t.every((r)=>{const i=o.leases.get(f(e.sessionRef,r));return Boolean(i&&!i.releasedAt&&s(i.sessionRef)===s(e.sessionRef))})}function f(o,e){return`${s(o)}\x00${s(e)}`}export function releaseLeases(o,e,t,n){if(!activeLeasesMatch(o,e,t))return;return t.map((r)=>{o.leases.get(f(e.sessionRef,r)).releasedAt=n;return{leaseRef:r,releaseRef:u("lease-release",l(e.sessionRef,r)),status:"released",releasedAt:n}})}function l(o,e){return a({kind:"hook-authority-lease-release-v1",sessionRef:o,leaseRef:e}).value.slice(7)}export function advanceLeases(o,e,t,n){const r=e.decision.body.evidence.leaseRefs;if(e.event==="session-start")return createActiveLeases(o,t,r)?[]:void 0;if(!activeLeasesMatch(o,t,r))return;return e.event==="stop"?releaseLeases(o,t,r,n):[]}

package/dist/control-plane/hook-authority-reference-lock.d.ts

@@ -0,0 +1,3 @@
+export declare function withSerialLock<T>(state: {
+    tail: Promise<void>;
+}, operation: () => T): Promise<T>;

package/dist/control-plane/hook-authority-reference-lock.js

@@ -0,0 +1 @@
+export async function withSerialLock(i,o){let e=()=>{return};const r=i.tail;i.tail=new Promise((n)=>{e=n});await r;try{return o()}finally{e()}}

package/dist/control-plane/hook-authority-reference-result.d.ts

@@ -0,0 +1,2 @@
+import type { HookAuthorityAuthorizationV1, HookAuthorityDigest, HookAuthorityLeaseReleaseV1, HookAuthorityStoredSessionV1, HookAuthorityTransitionRequestV1 } from './hook-authority.js';
+export declare function authorization(request: HookAuthorityTransitionRequestV1, digest: HookAuthorityDigest, session: HookAuthorityStoredSessionV1, now: string, issued?: string, releases?: readonly Omit<HookAuthorityLeaseReleaseV1, 'receiptRef'>[]): HookAuthorityAuthorizationV1;

package/dist/control-plane/hook-authority-reference-result.js

@@ -0,0 +1 @@
+import{reference as t}from"./hook-authority-reference-helpers.js";export function authorization(e,i,a,r,s,R=[]){const o=`${a.sessionRef.id}.${e.event}.${i.value.slice(7)}`,n=t("receipt",o);return{requestDigest:i,replayed:!1,receipt:{receiptRef:n,transactionRef:t("transaction",o),commitRef:t("commit",o),requestId:e.requestId,replayKey:e.replayKey,event:e.event,decisionRef:e.decision.body.decisionRef,sessionRef:a.sessionRef,tenantRef:e.tenantRef,workspaceRef:e.workspaceRef,authorityVersion:e.decision.body.authorityVersion,requestDigest:i,issuedAt:r},session:a,outbox:{outboxRef:t("outbox",o),receiptRef:n,event:e.event,requestDigest:i,occurredAt:r,...e.event==="stop"?{terminalLeaseReleaseRefs:e.decision.body.evidence.leaseRefs,terminalLeaseReleases:R.map((c)=>({...c,receiptRef:n}))}:{}},audit:{auditRef:t("audit",o),receiptRef:n,decisionRef:e.decision.body.decisionRef,event:e.event,tenantRef:e.tenantRef,workspaceRef:e.workspaceRef,observedAt:r},...s?{sessionCapability:s}:{}}}

package/dist/control-plane/hook-authority-reference-session.d.ts

@@ -0,0 +1,5 @@
+import type { HookAuthorityRef, HookAuthorityStoredSessionV1, HookAuthorityTransitionRequestV1 } from './hook-authority.js';
+export declare function refKey(ref: HookAuthorityRef): string;
+export declare function sessionMatchesRequest(session: HookAuthorityStoredSessionV1, request: Exclude<HookAuthorityTransitionRequestV1, {
+    event: 'session-start';
+}>): boolean;

package/dist/control-plane/hook-authority-reference-session.js

@@ -0,0 +1 @@
+export function refKey(e){return`${e.id}\x00${e.generation}\x00${e.digest.value}`}export function sessionMatchesRequest(e,o){return refKey(e.decisionRef)===refKey(o.decision.body.decisionRef)&&refKey(e.tenantRef)===refKey(o.tenantRef)&&refKey(e.workspaceRef)===refKey(o.workspaceRef)&&e.decisionBodyDigest.value===o.decision.bodyDigest.value&&e.decisionEnvelopeDigest.value===o.decision.envelopeDigest.value&&e.leaseRefs.length===o.decision.body.evidence.leaseRefs.length&&e.leaseRefs.every((t,i)=>refKey(t)===refKey(o.decision.body.evidence.leaseRefs[i]))&&e.actorRef===o.actorRef&&e.currentSha===o.currentSha&&e.workspaceRoot===o.workspaceRoot}

package/dist/control-plane/hook-authority-reference-state.d.ts

@@ -0,0 +1,24 @@
+import type { HookAuthorityAuthorizationV1, HookAuthorityRef, HookAuthorityStoredSessionV1 } from './hook-authority.js';
+declare const opaqueRestartToken: unique symbol;
+/** Opaque in-memory restart handle. It is only valid in this process. */
+export interface HookAuthorityReferenceRestartTokenV1 {
+    readonly schemaVersion: 1;
+    readonly [opaqueRestartToken]: never;
+}
+export interface ReferenceState {
+    replays: Map<string, HookAuthorityAuthorizationV1>;
+    sessions: Map<string, HookAuthorityStoredSessionV1>;
+    tail: Promise<void>;
+    lastNow: number;
+    leases: Map<string, {
+        leaseRef: HookAuthorityRef;
+        sessionRef: HookAuthorityRef;
+        releasedAt?: string;
+    }>;
+}
+export declare function createReferenceState(): {
+    state: ReferenceState;
+    token: HookAuthorityReferenceRestartTokenV1;
+};
+export declare function resumedReferenceState(token: HookAuthorityReferenceRestartTokenV1): ReferenceState | undefined;
+export {};

package/dist/control-plane/hook-authority-reference-state.js

@@ -0,0 +1 @@
+const o=new WeakMap;export function createReferenceState(){const e={replays:new Map,sessions:new Map,tail:Promise.resolve(),lastNow:Number.NEGATIVE_INFINITY,leases:new Map},t=Object.freeze({schemaVersion:1});o.set(t,e);return{state:e,token:t}}export function resumedReferenceState(e){return o.get(e)}

package/dist/control-plane/hook-authority-reference-validation.d.ts

@@ -0,0 +1,3 @@
+import type { HookAuthorityLiveBinding, HookAuthorityResult } from './hook-authority.js';
+export declare function validLive(value: unknown): value is HookAuthorityLiveBinding;
+export declare function fail(code: 'invalid_request' | 'not_found' | 'replay_conflict' | 'scope_mismatch' | 'terminalized' | 'version_conflict' | 'signature_untrusted' | 'expired' | 'revoked', message: string): HookAuthorityResult<never>;

package/dist/control-plane/hook-authority-reference-validation.js

@@ -0,0 +1 @@
+import{closedObjectWithOptional as o,safeArray as n}from"./hook-authority-validation-objects.js";import{validRef as t,validTimestamp as i}from"./hook-authority-validation-primitives.js";export function validLive(e){return o(e,["authorityVersion","authorityGeneration","expiresAt","fence","keyStatus","keyStatusRef","leaseRefs","leaseStatus","ownershipRef","ownershipStatus","revoked","tenantRef","validUntil","verifiedAt","workspaceRef"],["revocationRef"])&&t(e.ownershipRef)&&t(e.tenantRef)&&t(e.workspaceRef)&&t(e.keyStatusRef)&&(e.revocationRef===void 0||t(e.revocationRef))&&n(e.leaseRefs)&&e.leaseRefs.every(t)&&typeof e.authorityGeneration==="number"&&Number.isSafeInteger(e.authorityGeneration)&&e.authorityGeneration>0&&typeof e.authorityVersion==="number"&&Number.isSafeInteger(e.authorityVersion)&&e.authorityVersion>0&&typeof e.fence==="number"&&Number.isSafeInteger(e.fence)&&e.fence>0&&e.revoked===!1&&e.keyStatus==="active"&&e.ownershipStatus==="active"&&e.leaseStatus==="active"&&i(e.expiresAt)!==null&&i(e.verifiedAt)!==null&&i(e.validUntil)!==null}export function fail(e,r){return{ok:!1,error:{code:e,message:r}}}

package/dist/control-plane/hook-authority-test-body.d.ts

@@ -0,0 +1,7 @@
+import { type HookAuthorityDecisionBodyV1, type HookAuthorityEvent } from './hook-authority.js';
+export declare function ref(id: string): {
+    id: string;
+    generation: number;
+    digest: import("./hook-authority").HookAuthorityDigest;
+};
+export declare function body(_event: HookAuthorityEvent): HookAuthorityDecisionBodyV1;

package/dist/control-plane/hook-authority-test-body.js

@@ -0,0 +1 @@
+import{HOOK_AUTHORITY_EVENTS as o,HOOK_AUTHORITY_V1 as r}from"./hook-authority.js";import{hookAuthorityDigest as t}from"./hook-authority-digest.js";export function ref(e){return{id:e,generation:1,digest:t({id:e})}}export function body(e){return{schemaVersion:r,decisionRef:ref("decision.fixture"),issuedAt:"2030-01-01T00:00:00.000Z",expiresAt:"2030-01-01T00:01:00.000Z",authorityVersion:3,authorityFence:1,scope:{tenantRef:ref("tenant.fixture"),workspaceRef:ref("workspace.fixture"),currentSha:"a".repeat(40),workspaceRoot:"/workspace",actorRef:"actor.fixture",pathPrefixes:["packages/libs/contracts-spec/"],commandDigests:[t("bun test")],events:[...o]},evidence:{evidenceRefs:[ref("evidence.fixture")],keyStatusRef:ref("key-status.fixture"),ownershipRef:ref("ownership.fixture"),leaseRefs:[ref("lease.fixture")]}}}

package/dist/control-plane/hook-authority-test-fixtures.d.ts

@@ -0,0 +1,5 @@
+import { type HookAuthorityEvent, type HookAuthorityTransitionRequestV1 } from './hook-authority.js';
+export { body, ref } from './hook-authority-test-body.js';
+export declare const now: Date;
+export declare const capability: string;
+export declare function request(event: HookAuthorityEvent): HookAuthorityTransitionRequestV1;

package/dist/control-plane/hook-authority-test-fixtures.js

@@ -0,0 +1 @@
+import{HOOK_AUTHORITY_SIGNATURE_DOMAIN as n,HOOK_AUTHORITY_V1 as s}from"./hook-authority.js";import{hookAuthorityBodyDigest as c,hookAuthorityDigest as i,hookAuthorityEnvelopeDigest as f}from"./hook-authority-digest.js";import{body as u,ref as o}from"./hook-authority-test-body.js";export{body,ref}from"./hook-authority-test-body.js";export const now=new Date("2030-01-01T00:00:02.000Z");export const capability="a".repeat(32);export function request(e){const t=u(e),a=c(t),r={schemaVersion:s,domain:n,body:t,bodyDigest:a,signature:{issuerService:"connect",issuerKeyId:"connect-key",algorithm:"ed25519",value:`${"a".repeat(85)}A`}};return{schemaVersion:s,requestId:"request.fixture",replayKey:"replay.fixture",event:e,decision:{...r,envelopeDigest:f(r)},actorRef:"actor.fixture",tenantRef:t.scope.tenantRef,workspaceRef:t.scope.workspaceRef,currentSha:"a".repeat(40),workspaceRoot:"/workspace",paths:e==="before-file-edit"||e==="after-file-edit"||e==="before-merge"?["packages/libs/contracts-spec/src/control-plane/hook-authority.ts"]:[],...e==="before-shell-execution"?{commandDigest:t.scope.commandDigests[0]}:{},...e==="before-handoff"?{checkpointRef:o("checkpoint.fixture"),handoffRef:o("handoff.fixture")}:{},...e==="before-merge"?{merge:{sourceRef:o("source.fixture"),baseRef:o("base.fixture"),headRef:o("head.fixture"),treeDigest:i("tree"),diffDigest:i("diff")}}:{},...e==="session-start"?{}:{sessionCapability:capability,sessionRef:o("session.fixture"),expectedRevision:1,expectedFence:1},requestedAt:"2030-01-01T00:00:01.000Z"}}

package/dist/control-plane/hook-authority-validation-events.d.ts

@@ -0,0 +1,3 @@
+import type { HookAuthorityRequestV1 } from './hook-authority.js';
+export declare function validEventRequestBinding(request: HookAuthorityRequestV1): boolean;
+export declare function validEventFields(input: Record<string, unknown>): boolean;

package/dist/control-plane/hook-authority-validation-events.js

@@ -0,0 +1 @@
+import{equalHookAuthorityDigest as h}from"./hook-authority-digest.js";import{closedObject as l}from"./hook-authority-validation-objects.js";import{inPathScope as r}from"./hook-authority-validation-paths.js";import{validCapability as p,validDigest as a,validRef as i}from"./hook-authority-validation-primitives.js";const c=new Set(["before-file-edit","after-file-edit","before-merge"]);const m=["actorRef","currentSha","decision","event","paths","replayKey","requestId","requestedAt","schemaVersion","tenantRef","workspaceRef","workspaceRoot"];const f=["sessionRef","expectedRevision","expectedFence"];export function validEventRequestBinding(e){if(e.event==="session-start")return e.paths.length===0&&!["sessionCapability","sessionRef","expectedRevision","expectedFence"].some((o)=>(o in e));if(!("sessionCapability"in e)||!p(e.sessionCapability))return!1;if(!i(e.sessionRef)||!Number.isSafeInteger(e.expectedRevision)||e.expectedRevision<1||!Number.isSafeInteger(e.expectedFence)||e.expectedFence<1)return!1;if(e.event==="before-shell-execution")return e.paths.length===0&&a(e.commandDigest)&&e.decision.body.scope.commandDigests.some((o)=>h(o,e.commandDigest));if(e.event==="before-handoff")return e.paths.length===0&&i(e.checkpointRef)&&i(e.handoffRef);if(e.event==="before-merge")return e.paths.length>0&&e.paths.every((o)=>typeof o==="string"&&r(o,e.decision.body.scope.pathPrefixes))&&l(e.merge,["baseRef","diffDigest","headRef","sourceRef","treeDigest"])&&i(e.merge.sourceRef)&&i(e.merge.baseRef)&&i(e.merge.headRef)&&a(e.merge.treeDigest)&&a(e.merge.diffDigest);if(c.has(e.event))return e.paths.length>0&&e.paths.every((o)=>typeof o==="string"&&r(o,e.decision.body.scope.pathPrefixes));return e.paths.length===0}export function validEventFields(e){const o=e.event,d=Object.keys(e),n=(t)=>d.every((s)=>m.includes(s)||f.includes(s)||t.includes(s));if(o==="session-start")return n([])&&!f.some((t)=>Object.hasOwn(e,t));if(!f.every((t)=>Object.hasOwn(e,t)))return!1;if(o==="before-shell-execution")return n(["commandDigest","sessionCapability"])&&Object.hasOwn(e,"commandDigest")&&Object.hasOwn(e,"sessionCapability");if(o==="before-handoff")return n(["sessionCapability","checkpointRef","handoffRef"])&&Object.hasOwn(e,"checkpointRef")&&Object.hasOwn(e,"handoffRef");if(o==="stop")return n(["sessionCapability"]);return c.has(o)&&n(["sessionCapability",...o==="before-merge"?["merge"]:[]])&&(o!=="before-merge"||Object.hasOwn(e,"merge"))}

package/dist/control-plane/hook-authority-validation-objects.d.ts

@@ -0,0 +1,3 @@
+export declare function closedObject(value: unknown, keys: readonly string[]): value is Record<string, unknown>;
+export declare function closedObjectWithOptional(value: unknown, requiredKeys: readonly string[], optionalKeys: readonly string[]): value is Record<string, unknown>;
+export declare function safeArray(value: unknown): value is readonly unknown[];

package/dist/control-plane/hook-authority-validation-objects.js

@@ -0,0 +1 @@
+export function closedObject(e,t){if(!s(e))return!1;if(Reflect.ownKeys(e).some((o)=>typeof o!=="string"||!Object.prototype.propertyIsEnumerable.call(e,o)))return!1;const r=Object.keys(e).sort(),n=[...t].sort();return r.length===n.length&&r.every((o,y)=>o===n[y])}export function closedObjectWithOptional(e,t,r){return s(e)&&!Reflect.ownKeys(e).some((n)=>typeof n!=="string"||!Object.prototype.propertyIsEnumerable.call(e,n))&&t.every((n)=>Object.hasOwn(e,n))&&Object.keys(e).every((n)=>t.includes(n)||r.includes(n))}export function safeArray(e){return Array.isArray(e)&&c(e)&&Reflect.ownKeys(e).every((t)=>t==="length"||typeof t==="string"&&/^0$|^[1-9][0-9]*$/.test(t))&&e.length===Object.keys(e).length&&Object.keys(e).every((t,r)=>t===String(r))}function s(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;return(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null)&&c(e)}function c(e){return Object.values(Object.getOwnPropertyDescriptors(e)).every((t)=>!t.get&&!t.set)}

package/dist/control-plane/hook-authority-validation-paths.d.ts

@@ -0,0 +1,2 @@
+export declare function inPathScope(path: string, prefixes: readonly string[]): boolean;
+export declare function validPrefix(path: string): boolean;

package/dist/control-plane/hook-authority-validation-paths.js

@@ -0,0 +1 @@
+export function inPathScope(n,e){return i(n)&&e.some((o)=>n.startsWith(o))}export function validPrefix(n){return n.endsWith("/")&&i(n.slice(0,-1))}function i(n){return Boolean(n)&&!/[\\\u0000-\u001f\u007f]/.test(n)&&!/^(?:\/|[A-Za-z]:|\\\\)/.test(n)&&!n.includes("%")&&!n.split("/").some((e)=>e===""||e==="."||e==="..")}

package/dist/control-plane/hook-authority-validation-primitives.d.ts

@@ -0,0 +1,8 @@
+export declare function validDigest(value: unknown): boolean;
+export declare function validRef(value: unknown): boolean;
+export declare function validTimestamp(value: unknown): number | null;
+export declare function validCapability(value: unknown): value is string;
+export declare function validSha(value: unknown): value is string;
+export declare function validWorkspaceRoot(value: unknown): value is string;
+export declare function unique(values: readonly unknown[]): boolean;
+export declare function supportedEvent(value: unknown): boolean;

package/dist/control-plane/hook-authority-validation-primitives.js

@@ -0,0 +1 @@
+import{HOOK_AUTHORITY_EVENTS as i}from"./hook-authority.js";import{closedObject as o}from"./hook-authority-validation-objects.js";const r=/^[A-Za-z0-9_-]+$/;const e=/^sha256:[0-9a-f]{64}$/;const s=/^[a-z][a-z0-9._-]{2,127}$/;const f=/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;const p=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;export function validDigest(n){return o(n,["algorithm","canonicalizationVersion","value"])&&n.algorithm==="sha256"&&n.canonicalizationVersion===1&&typeof n.value==="string"&&e.test(n.value)}export function validRef(n){return o(n,["digest","generation","id"])&&typeof n.id==="string"&&s.test(n.id)&&typeof n.generation==="number"&&Number.isSafeInteger(n.generation)&&n.generation>0&&validDigest(n.digest)}export function validTimestamp(n){if(typeof n!=="string"||!p.test(n))return null;const t=Date.parse(n);return Number.isFinite(t)&&new Date(t).toISOString()===n?t:null}export function validCapability(n){return typeof n==="string"&&n.length>=32&&n.length<=512&&r.test(n)}export function validSha(n){return typeof n==="string"&&f.test(n)}export function validWorkspaceRoot(n){if(typeof n!=="string"||n.length<2||!n.startsWith("/"))return!1;return!n.includes("\\")&&!n.includes("//")&&!n.split("/").some((t)=>t==="."||t===".."||t.includes("\x00"))}export function unique(n){return new Set(n.map((t)=>JSON.stringify(t))).size===n.length}export function supportedEvent(n){return typeof n==="string"&&i.includes(n)}

package/dist/control-plane/hook-authority-validation-request.d.ts

@@ -0,0 +1,3 @@
+import type { HookAuthorityRequestV1 } from './hook-authority.js';
+export declare function isClosedRequest(input: unknown): input is HookAuthorityRequestV1;
+export declare function validRequestSemantics(request: HookAuthorityRequestV1): boolean;

package/dist/control-plane/hook-authority-validation-request.js

@@ -0,0 +1 @@
+import{HOOK_AUTHORITY_SIGNATURE_DOMAIN as R}from"./hook-authority.js";import{validEventFields as v,validEventRequestBinding as p}from"./hook-authority-validation-events.js";import{closedObject as a,closedObjectWithOptional as c,safeArray as s}from"./hook-authority-validation-objects.js";import{validPrefix as u}from"./hook-authority-validation-paths.js";import{supportedEvent as f,unique as t,validDigest as r,validRef as n,validSha as l,validWorkspaceRoot as h}from"./hook-authority-validation-primitives.js";const m=/^[a-z][a-z0-9._-]{2,127}$/;const g=/^[A-Za-z0-9_-]{85}[AQgw]$/;export function isClosedRequest(e){if(!c(e,["actorRef","currentSha","decision","event","paths","replayKey","requestId","requestedAt","schemaVersion","tenantRef","workspaceRef","workspaceRoot"],["commandDigest","sessionCapability","sessionRef","expectedRevision","expectedFence","checkpointRef","handoffRef","merge"]))return!1;if(!a(e.decision,["body","bodyDigest","domain","envelopeDigest","schemaVersion","signature"]))return!1;const i=e.decision.body;if(!c(i,["authorityFence","authorityVersion","decisionRef","evidence","expiresAt","issuedAt","schemaVersion","scope"],["revocationRef","sessionCapabilityHash"]))return!1;if(!v(e))return!1;return a(i.scope,["actorRef","commandDigests","currentSha","events","pathPrefixes","tenantRef","workspaceRef","workspaceRoot"])&&a(i.evidence,["evidenceRefs","keyStatusRef","leaseRefs","ownershipRef"])&&a(e.decision.signature,["algorithm","issuerKeyId","issuerService","value"])&&s(e.paths)&&s(i.scope.pathPrefixes)&&s(i.scope.events)&&s(i.scope.commandDigests)&&s(i.evidence.evidenceRefs)&&s(i.evidence.leaseRefs)&&(i.revocationRef===void 0||n(i.revocationRef))&&(i.sessionCapabilityHash===void 0||r(i.sessionCapabilityHash))}export function validRequestSemantics(e){const{body:i,signature:o}=e.decision;return f(e.event)&&i.scope.events.includes(e.event)&&y(i)&&k(i)&&A(e)&&p(e)&&e.decision.domain===R&&o.algorithm==="ed25519"&&g.test(o.value)}function y(e){return n(e.decisionRef)&&n(e.scope.tenantRef)&&n(e.scope.workspaceRef)&&n(e.evidence.ownershipRef)&&n(e.evidence.keyStatusRef)&&e.evidence.evidenceRefs.length>0&&e.evidence.leaseRefs.length>0&&e.evidence.evidenceRefs.every(n)&&e.evidence.leaseRefs.every(n)}function k(e){const{scope:i}=e;return i.pathPrefixes.length>0&&i.events.length>0&&t(i.pathPrefixes)&&t(i.events)&&t(i.commandDigests)&&t(e.evidence.evidenceRefs)&&t(e.evidence.leaseRefs)&&i.pathPrefixes.every((o)=>typeof o==="string"&&u(o))&&i.events.every(f)&&i.commandDigests.every(r)}function A(e){const{body:i}=e.decision;return e.schemaVersion===1&&i.schemaVersion===1&&e.decision.schemaVersion===1&&Number.isSafeInteger(i.authorityVersion)&&i.authorityVersion>0&&Number.isSafeInteger(i.authorityFence)&&i.authorityFence>0&&[e.requestId,e.replayKey,e.actorRef,i.decisionRef.id,i.scope.actorRef,e.decision.signature.issuerService,e.decision.signature.issuerKeyId].every((o)=>typeof o==="string"&&m.test(o))&&l(e.currentSha)&&e.currentSha===i.scope.currentSha&&h(e.workspaceRoot)&&e.workspaceRoot===i.scope.workspaceRoot&&e.actorRef===i.scope.actorRef&&d(e.tenantRef,i.scope.tenantRef)&&d(e.workspaceRef,i.scope.workspaceRef)&&r(e.decision.bodyDigest)&&r(e.decision.envelopeDigest)}function d(e,i){return e.id===i.id&&e.generation===i.generation&&e.digest.value===i.digest.value}

package/dist/control-plane/hook-authority-validation.d.ts

@@ -0,0 +1,6 @@
+import type { HookAuthorityError, HookAuthorityRequestV1, HookAuthorityResult } from './hook-authority.js';
+/** Fail-closed runtime schema boundary for untrusted host-hook inputs. */
+export declare const HookAuthorityRequestSchema: {
+    parse(input: unknown, now?: Date): HookAuthorityResult<HookAuthorityRequestV1>;
+};
+export declare function hookAuthoritySchemaError(error: HookAuthorityError): string;

package/dist/control-plane/hook-authority-validation.js

@@ -0,0 +1 @@
+import{equalHookAuthorityDigest as f,hookAuthorityBodyDigest as m,hookAuthorityEnvelopeDigest as k}from"./hook-authority-digest.js";import{validTimestamp as c}from"./hook-authority-validation-primitives.js";import{isClosedRequest as A,validRequestSemantics as p}from"./hook-authority-validation-request.js";export const HookAuthorityRequestSchema={parse(e,s=new Date){const n=h(e);if(!n||!A(n))return l("Hook Authority request does not match the closed V1 schema.");const t=n;if(!p(t))return l("Request identity, signed scope, signature, or event binding is invalid.");const{body:o}=t.decision,i=c(o.issuedAt),r=c(t.requestedAt),u=c(o.expiresAt);if(i===null||r===null||u===null)return l("Timestamps must be canonical UTC milliseconds.");if(u<=s.getTime())return{ok:!1,error:{code:"expired",message:"Decision has expired."}};if(i>r||r>s.getTime()||r>=u)return l("Authority time must satisfy issuedAt <= requestedAt <= now < expiresAt.");if(!f(t.decision.bodyDigest,m(o)))return l("Signed body digest does not match the decision body.");const{envelopeDigest:b,...g}=t.decision;if(!f(t.decision.envelopeDigest,k(g)))return l("Envelope digest does not match its immutable projection.");return{ok:!0,value:y(t)}}};function l(e){return{ok:!1,error:{code:"invalid_request",message:e}}}function y(e){if(e&&typeof e==="object"){Object.freeze(e);for(const s of Object.values(e))y(s)}return e}function h(e){if(e===null||typeof e!=="object")return null;if(Array.isArray(e)){const n=Reflect.ownKeys(e);if(n.length!==e.length+1||!n.includes("length"))return null;const t=[];for(let i=0;i<e.length;i+=1){const r=Object.getOwnPropertyDescriptor(e,String(i));if(!r||r.get||r.set||r.enumerable!==!0||r.configurable!==!0||r.writable!==!0)return null;const u=a(r.value);if(u===d)return null;t.push(u)}const o=Object.getOwnPropertyDescriptor(e,"length");if(!o||o.get||o.set||o.value!==e.length||o.enumerable!==!1||o.configurable!==!1||o.writable!==!0)return null;return t}if(Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return null;const s={};for(const n of Reflect.ownKeys(e)){if(typeof n!=="string")return null;const t=Object.getOwnPropertyDescriptor(e,n);if(!t||!t.enumerable||t.get||t.set)return null;const o=a(t.value);if(o===d)return null;s[n]=o}return s}const d=Symbol("invalid");function a(e){if(e===null||typeof e!=="object")return e;return h(e)??d}export function hookAuthoritySchemaError(e){return`${e.code}:${e.message}`}

package/dist/control-plane/hook-authority.d.ts

@@ -0,0 +1,180 @@
+/** Additive, runtime-neutral authority contract for Connect-governed host hooks. */
+export declare const HOOK_AUTHORITY_V1: 1;
+export declare const HOOK_AUTHORITY_SIGNATURE_DOMAIN: 'contractspec.hook-authority.decision.v1';
+export declare const HOOK_AUTHORITY_COMPATIBILITY: 'additive_backward_compatible';
+export declare const HOOK_AUTHORITY_EVENTS: readonly ['session-start', 'before-file-edit', 'before-shell-execution', 'after-file-edit', 'before-handoff', 'stop', 'before-merge'];
+export type HookAuthorityEvent = (typeof HOOK_AUTHORITY_EVENTS)[number];
+export type { HookAuthorityAuditRecordV1, HookAuthorityLeaseReleaseV1, HookAuthorityOutboxRecordV1, HookAuthorityReceiptV1, HookAuthorityStoredResultV1, HookAuthorityStoredSessionV1, } from './hook-authority-records.js';
+import type { HookAuthorityStoredResultV1 } from './hook-authority-records.js';
+export type HookAuthorityError = {
+    code: 'invalid_request' | 'not_found' | 'expired' | 'revoked' | 'scope_mismatch' | 'replay_conflict' | 'version_conflict' | 'terminalized' | 'signature_untrusted';
+    message: string;
+};
+export type HookAuthorityResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: HookAuthorityError;
+};
+export interface HookAuthorityDigest {
+    algorithm: 'sha256';
+    canonicalizationVersion: 1;
+    value: `sha256:${string}`;
+}
+export interface HookAuthorityRef {
+    id: string;
+    generation: number;
+    digest: HookAuthorityDigest;
+}
+export interface HookAuthorityScope {
+    tenantRef: HookAuthorityRef;
+    workspaceRef: HookAuthorityRef;
+    currentSha: string;
+    workspaceRoot: string;
+    actorRef: string;
+    pathPrefixes: readonly string[];
+    commandDigests: readonly HookAuthorityDigest[];
+    events: readonly HookAuthorityEvent[];
+}
+/** Evidence records are descriptive only; these bindings are checked live. */
+export interface HookAuthorityEvidence {
+    evidenceRefs: readonly HookAuthorityRef[];
+    ownershipRef: HookAuthorityRef;
+    leaseRefs: readonly HookAuthorityRef[];
+    keyStatusRef: HookAuthorityRef;
+}
+export interface HookAuthorityLiveBinding {
+    tenantRef: HookAuthorityRef;
+    workspaceRef: HookAuthorityRef;
+    authorityVersion: number;
+    ownershipRef: HookAuthorityRef;
+    leaseRefs: readonly HookAuthorityRef[];
+    revocationRef?: HookAuthorityRef;
+    keyStatusRef: HookAuthorityRef;
+    authorityGeneration: number;
+    expiresAt: string;
+    fence: number;
+    revoked: false;
+    keyStatus: 'active';
+    ownershipStatus: 'active';
+    leaseStatus: 'active';
+    verifiedAt: string;
+    validUntil: string;
+}
+export interface HookAuthorityDecisionBodyV1 {
+    schemaVersion: typeof HOOK_AUTHORITY_V1;
+    decisionRef: HookAuthorityRef;
+    issuedAt: string;
+    expiresAt: string;
+    authorityVersion: number;
+    authorityFence: number;
+    scope: HookAuthorityScope;
+    evidence: HookAuthorityEvidence;
+    /** Optional signed commitment used by durable adapters for caller-generated session capabilities. */
+    sessionCapabilityHash?: HookAuthorityDigest;
+    revocationRef?: HookAuthorityRef;
+}
+export interface HookAuthoritySignature {
+    issuerService: string;
+    issuerKeyId: string;
+    algorithm: 'ed25519' /** 64 bytes, canonical unpadded base64url. */;
+    value: string;
+}
+export interface HookAuthorityDecisionEnvelopeV1 {
+    schemaVersion: typeof HOOK_AUTHORITY_V1;
+    domain: typeof HOOK_AUTHORITY_SIGNATURE_DOMAIN;
+    body: HookAuthorityDecisionBodyV1;
+    bodyDigest: HookAuthorityDigest;
+    envelopeDigest: HookAuthorityDigest;
+    signature: HookAuthoritySignature;
+}
+/** Trusted composition dependency. It is never supplied by an operation caller. */
+export interface HookAuthorityDecisionVerifierPort {
+    verify(decision: HookAuthorityDecisionEnvelopeV1): Promise<HookAuthorityResult<void>>;
+}
+export interface HookAuthorityClockPort {
+    now(): Date;
+}
+export interface HookAuthorityCapabilityGeneratorPort {
+    generate(): string;
+}
+/** Adapter-owned deadline authority for verifier and resolver calls. */
+/** The thunk is deliberate: a synchronous expiry must not start provider work. */
+export interface HookAuthorityDeadlinePort {
+    race<T>(operation: () => Promise<T>): Promise<T | undefined>;
+}
+/** Resolves ownership, leases, revocation and issuer-key state at commit time. */
+export interface HookAuthorityLiveBindingResolverPort {
+    resolve(decision: HookAuthorityDecisionEnvelopeV1): Promise<HookAuthorityResult<HookAuthorityLiveBinding>>;
+}
+export interface HookAuthorityComposition {
+    verifier: HookAuthorityDecisionVerifierPort;
+    clock: HookAuthorityClockPort;
+    liveBindings: HookAuthorityLiveBindingResolverPort;
+    capabilities: HookAuthorityCapabilityGeneratorPort;
+    deadlines: HookAuthorityDeadlinePort;
+}
+interface HookAuthorityRequestBase<E extends HookAuthorityEvent> {
+    schemaVersion: typeof HOOK_AUTHORITY_V1;
+    requestId: string;
+    replayKey: string;
+    event: E;
+    decision: HookAuthorityDecisionEnvelopeV1;
+    actorRef: string;
+    tenantRef: HookAuthorityRef;
+    workspaceRef: HookAuthorityRef;
+    currentSha: string;
+    workspaceRoot: string;
+    requestedAt: string;
+}
+export interface HookAuthoritySessionStartRequestV1 extends HookAuthorityRequestBase<'session-start'> {
+    paths: readonly [];
+}
+interface HookAuthoritySessionRequest<E extends Exclude<HookAuthorityEvent, 'session-start'>> extends HookAuthorityRequestBase<E> {
+    sessionRef: HookAuthorityRef;
+    expectedRevision: number;
+    expectedFence: number;
+    sessionCapability: string;
+}
+export interface HookAuthorityPathRequestV1 extends HookAuthoritySessionRequest<'before-file-edit' | 'after-file-edit'> {
+    paths: readonly string[];
+}
+export interface HookAuthorityShellRequestV1 extends HookAuthoritySessionRequest<'before-shell-execution'> {
+    paths: readonly [];
+    commandDigest: HookAuthorityDigest;
+}
+export interface HookAuthorityHandoffRequestV1 extends HookAuthoritySessionRequest<'before-handoff'> {
+    paths: readonly [];
+    checkpointRef: HookAuthorityRef;
+    handoffRef: HookAuthorityRef;
+}
+export interface HookAuthorityStopRequestV1 extends HookAuthoritySessionRequest<'stop'> {
+    paths: readonly [];
+}
+export type HookAuthorityRequestV1 = HookAuthoritySessionStartRequestV1 | HookAuthorityPathRequestV1 | HookAuthorityShellRequestV1 | HookAuthorityHandoffRequestV1 | HookAuthorityStopRequestV1 | HookAuthorityMergeRequestV1;
+export interface HookAuthorityMergeBinding {
+    sourceRef: HookAuthorityRef;
+    baseRef: HookAuthorityRef;
+    headRef: HookAuthorityRef;
+    treeDigest: HookAuthorityDigest;
+    diffDigest: HookAuthorityDigest;
+}
+export interface HookAuthorityMergeRequestV1 extends HookAuthoritySessionRequest<'before-merge'> {
+    paths: readonly string[];
+    merge: HookAuthorityMergeBinding;
+}
+export type HookAuthorityTransitionRequestV1 = HookAuthorityRequestV1;
+export interface HookAuthorityAuthorizationV1 extends HookAuthorityStoredResultV1 {
+    /** Legacy reference adapters may return this only for an uncommitted session start. */
+    sessionCapability?: string;
+}
+/** One-use, non-durable delivery of the caller-generated session bearer. */
+export interface HookAuthoritySessionCapabilityV1 {
+    sessionCapability: string;
+}
+/** One transaction: session, verified active leases, receipt, outbox, audit, replay, and terminal lease release. */
+/** Public adapter boundary: composition is installed at construction, never passed by the caller. */
+export interface HookAuthorityPort {
+    transition(request: HookAuthorityTransitionRequestV1, startCapability?: HookAuthoritySessionCapabilityV1): Promise<HookAuthorityResult<HookAuthorityAuthorizationV1>>;
+}

package/dist/control-plane/hook-authority.js

@@ -0,0 +1 @@
+export const HOOK_AUTHORITY_V1=1;export const HOOK_AUTHORITY_SIGNATURE_DOMAIN="contractspec.hook-authority.decision.v1";export const HOOK_AUTHORITY_COMPATIBILITY="additive_backward_compatible";export const HOOK_AUTHORITY_EVENTS=["session-start","before-file-edit","before-shell-execution","after-file-edit","before-handoff","stop","before-merge"];

package/dist/control-plane/index.d.ts

@@ -0,0 +1,15 @@
+export * from './approval-kernel.js';
+export * from './capabilities/index.js';
+export * from './commands/index.js';
+export * from './connect-materialization.js';
+export * from './constants.js';
+export * from './contracts.js';
+export * from './control-plane.feature.js';
+export * from './events/index.js';
+export * from './hook-authority.js';
+export * from './hook-authority-digest.js';
+export * from './hook-authority-reference-adapter.js';
+export * from './hook-authority-validation.js';
+export * from './policies/index.js';
+export * from './queries/index.js';
+export * from './repository-authority-bootstrap.js';

package/dist/control-plane/index.js

@@ -0,0 +1 @@
+export*from"./approval-kernel.js";export*from"./capabilities/index.js";export*from"./commands/index.js";export*from"./connect-materialization.js";export*from"./constants.js";export*from"./contracts.js";export*from"./control-plane.feature.js";export*from"./events/index.js";export*from"./hook-authority.js";export*from"./hook-authority-digest.js";export*from"./hook-authority-reference-adapter.js";export*from"./hook-authority-validation.js";export*from"./policies/index.js";export*from"./queries/index.js";export*from"./repository-authority-bootstrap.js";

package/dist/control-plane/policies/controlPlaneMessaging.policy.d.ts

@@ -0,0 +1 @@
+export declare const ControlPlaneMessagingPolicy: import("../..").PolicySpec;

package/dist/control-plane/policies/controlPlaneMessaging.policy.js

@@ -0,0 +1 @@
+import{definePolicy as e}from"../../policy/index.js";import{CONTROL_PLANE_DOMAIN as n,CONTROL_PLANE_OWNERS as o,CONTROL_PLANE_STABILITY as t,CONTROL_PLANE_TAGS as s}from"../constants.js";export const ControlPlaneMessagingPolicy=e({meta:{key:"channel.messaging-policy",version:"2.0.0",title:"Deterministic Messaging Safety Policy",description:"Applies contract-backed blocked, assist, and autonomous routing for inbound messaging events.",domain:n,scope:"operation",owners:o,tags:[...s,"policy","messaging"],stability:t},rules:[{effect:"deny",actions:["channel.reply"],resource:{type:"control-plane.message"},conditions:[{expression:"context.blockedSignalDetected === true"}],reason:"blocked_signal_detected"},{effect:"allow",actions:["channel.reply"],resource:{type:"control-plane.message"},conditions:[{expression:"context.highRiskDetected === true"}],escalate:"human_review",reason:"high_risk_topic_detected"},{effect:"allow",actions:["channel.reply"],resource:{type:"control-plane.message"},conditions:[{expression:"context.mediumRiskDetected === true && context.confidence >= context.assistMinConfidence"}],escalate:"human_review",reason:"needs_human_review"},{effect:"allow",actions:["channel.reply"],resource:{type:"control-plane.message"},conditions:[{expression:"context.riskTier === 'low' && context.confidence >= context.autoResolveMinConfidence"}],reason:"low_risk_high_confidence"},{effect:"allow",actions:["channel.reply"],resource:{type:"control-plane.message"},conditions:[{expression:"context.confidence >= context.assistMinConfidence && context.blockedSignalDetected !== true"}],escalate:"human_review",reason:"needs_human_review"},{effect:"deny",actions:["channel.reply"],resource:{type:"control-plane.message"},conditions:[{expression:"context.confidence < context.assistMinConfidence"}],reason:"low_confidence"}]});

package/dist/control-plane/policies/index.d.ts

@@ -0,0 +1 @@
+export * from './controlPlaneMessaging.policy.js';

package/dist/control-plane/policies/index.js

@@ -0,0 +1 @@
+export*from"./controlPlaneMessaging.policy.js";

package/dist/control-plane/queries/controlPlaneExecutionGet.query.d.ts

@@ -0,0 +1,82 @@
+import { SchemaModel } from '@lssm/lib.schema';
+export declare const ControlPlaneExecutionGetQuery: import("../..").OperationSpec<SchemaModel<{
+    executionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, SchemaModel<{
+    execution: {
+        type: SchemaModel<{
+            executionId: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            intentId: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: true;
+            };
+            planId: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: true;
+            };
+            runId: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: true;
+            };
+            status: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            riskTier: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: true;
+            };
+            requiresApproval: {
+                type: import("@lssm/lib.schema").FieldType<boolean, boolean>;
+                isOptional: true;
+            };
+            lane: {
+                type: SchemaModel<{
+                    laneKey: {
+                        type: import("@lssm/lib.schema").FieldType<string, string>;
+                        isOptional: true;
+                    };
+                    laneStatus: {
+                        type: import("@lssm/lib.schema").FieldType<string, string>;
+                        isOptional: true;
+                    };
+                    lanePhase: {
+                        type: import("@lssm/lib.schema").FieldType<string, string>;
+                        isOptional: true;
+                    };
+                    ownerRole: {
+                        type: import("@lssm/lib.schema").FieldType<string, string>;
+                        isOptional: true;
+                    };
+                    evidenceBundleCount: {
+                        type: import("@lssm/lib.schema").FieldType<number, number>;
+                        isOptional: true;
+                    };
+                    pendingApprovalCount: {
+                        type: import("@lssm/lib.schema").FieldType<number, number>;
+                        isOptional: true;
+                    };
+                    recommendedNextLane: {
+                        type: import("@lssm/lib.schema").FieldType<string, string>;
+                        isOptional: true;
+                    };
+                }>;
+                isOptional: true;
+            };
+            createdAt: {
+                type: import("@lssm/lib.schema").FieldType<Date, string>;
+                isOptional: false;
+            };
+            updatedAt: {
+                type: import("@lssm/lib.schema").FieldType<Date, string>;
+                isOptional: false;
+            };
+        }>;
+        isOptional: false;
+    };
+}>, undefined>;

package/dist/control-plane/queries/controlPlaneExecutionGet.query.js

@@ -0,0 +1 @@
+import{ScalarTypeEnum as e,SchemaModel as t}from"@lssm/lib.schema";import{defineQuery as n}from"../../operations/index.js";import{CONTROL_PLANE_DOMAIN as o,CONTROL_PLANE_OWNERS as i,CONTROL_PLANE_STABILITY as a,CONTROL_PLANE_TAGS as l}from"../constants.js";import{ControlPlaneExecutionLaneStateModel as r}from"./controlPlaneExecutionLane.models.js";const p=new t({name:"ControlPlaneExecutionRecord",fields:{executionId:{type:e.ID(),isOptional:!1},intentId:{type:e.ID(),isOptional:!0},planId:{type:e.ID(),isOptional:!0},runId:{type:e.ID(),isOptional:!0},status:{type:e.String_unsecure(),isOptional:!1},riskTier:{type:e.String_unsecure(),isOptional:!0},requiresApproval:{type:e.Boolean(),isOptional:!0},lane:{type:r,isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}});const s=new t({name:"ControlPlaneExecutionGetInput",fields:{executionId:{type:e.ID(),isOptional:!1}}});const u=new t({name:"ControlPlaneExecutionGetOutput",fields:{execution:{type:p,isOptional:!1}}});export const ControlPlaneExecutionGetQuery=n({meta:{key:"controlPlane.execution.get",title:"Get Execution",version:"1.0.0",description:"Fetch the latest state for one execution.",goal:"Provide operators and channels a deterministic execution view.",context:"Used by dashboards, CLI, and channel adapters to inspect one execution.",domain:o,owners:i,tags:[...l,"execution"],stability:a},capability:{key:"control-plane.core",version:"1.0.0"},io:{input:s,output:u},policy:{auth:"admin",pii:[]}});