@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/harness/pi-rpc/authorization/permit-store.js

@@ -0,0 +1,310 @@
+import { makeNodeRuntimeError } from "../../../runtime/errors.js";
+import { countPiRpcUnsettledPermits, readActivePiRpcAuthorization, readPiRpcAuthorizationRevision, readPiRpcPermitRow, } from "./database.js";
+import { compactPiRpcTerminalPermits } from "./permit-compaction-store.js";
+import { PI_RPC_MAX_UNSETTLED_PER_AUTHORIZATION, PI_RPC_PERMIT_TTL_MS, plusPiRpcMilliseconds, requirePiRpcDigest, requirePiRpcIdentifier, requirePiRpcRevision, requirePiRpcTimestampMs, } from "./policy.js";
+import { projectPiRpcAuthorization, projectPiRpcPermit } from "./projection.js";
+import { withPiRpcReplay } from "./replay-store.js";
+const UPDATE_AUTHORIZATION_CLEANUP_UNKNOWN_SQL = `UPDATE pi_rpc_authorization_revisions
+  SET state = 'cleanup_unknown',
+      revocation_started_at = COALESCE(revocation_started_at, ?),
+      terminalized_at = NULL,
+      cleanup_unknown_at = ?,
+      updated_at = ?
+  WHERE authorization_revision = ?
+    AND state IN ('active', 'revoking')`;
+const permitMutationResult = (database, context) => ({
+    method: context.method,
+    permit: projectPiRpcPermit(readPermitOrThrow(database, context.permitId)),
+    recordedAt: context.recordedAt,
+});
+const parseRevision = (value) => {
+    if (!/^[1-9][0-9]{0,15}$/u.test(value))
+        throw makeNodeRuntimeError("storage_failed", "The Pi RPC authorization revision is invalid.");
+    const parsed = Number(value);
+    if (Number.isSafeInteger(parsed))
+        return parsed;
+    throw makeNodeRuntimeError("storage_failed", "The Pi RPC authorization revision is invalid.");
+};
+const requirePolicyMatch = (policy, authorization) => {
+    if (requirePiRpcRevision(policy.adapterVersion, "The Pi RPC adapter version") === authorization.adapterVersion &&
+        requirePiRpcRevision(policy.conversationPolicyRevision, "The Pi RPC conversation policy revision") === authorization.conversationPolicyRevision &&
+        requirePiRpcRevision(policy.vouchPolicyRevision, "The Pi RPC vouch policy revision") === authorization.vouchPolicyRevision)
+        return;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC permit policy revision is stale.", true);
+};
+const requireIdentityMatch = (identity, authorization) => {
+    if (requirePiRpcDigest(identity.closureSha256, "The Pi RPC closure digest") ===
+        authorization.closureSha256 &&
+        requirePiRpcDigest(identity.entrySha256, "The Pi RPC entry digest") ===
+            authorization.entrySha256 &&
+        requirePiRpcDigest(identity.interpreterSha256, "The Pi RPC interpreter digest") === authorization.interpreterSha256)
+        return;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC permit artifact identity is stale.", true);
+};
+const requireActiveIdentity = (database, identity) => {
+    const revision = parseRevision(identity.authorizationRevision);
+    const authorization = readActivePiRpcAuthorization(database);
+    if (authorization?.authorizationRevision !== revision)
+        throw makeNodeRuntimeError("storage_conflict", "The Pi RPC authorization revision is not active.", true);
+    projectPiRpcAuthorization(database, authorization);
+    requirePolicyMatch(identity.policy, authorization);
+    requireIdentityMatch(identity, authorization);
+    return authorization;
+};
+const permitIdentity = (permit) => ({
+    authorizationRevision: permit.authorizationRevision.toString(),
+    closureSha256: permit.closureSha256,
+    entrySha256: permit.entrySha256,
+    interpreterSha256: permit.interpreterSha256,
+    policy: {
+        adapterVersion: permit.adapterVersion,
+        conversationPolicyRevision: permit.conversationPolicyRevision,
+        vouchPolicyRevision: permit.vouchPolicyRevision,
+    },
+});
+const requirePermitAuthorization = (database, permit) => {
+    const authorization = readPiRpcAuthorizationRevision(database, permit.authorizationRevision);
+    if (authorization === undefined)
+        throw makeNodeRuntimeError("storage_corrupt", "The Pi RPC permit authorization is missing.");
+    projectPiRpcAuthorization(database, authorization);
+    const identity = permitIdentity(permit);
+    try {
+        requirePolicyMatch(identity.policy, authorization);
+        requireIdentityMatch(identity, authorization);
+    }
+    catch {
+        throw makeNodeRuntimeError("storage_corrupt", "The persisted Pi RPC permit identity is invalid.");
+    }
+    return authorization;
+};
+const readPermitOrThrow = (database, permitId) => {
+    const permit = readPiRpcPermitRow(database, requirePiRpcIdentifier(permitId, "The Pi RPC permit identifier"));
+    if (permit !== undefined) {
+        requirePermitAuthorization(database, permit);
+        return permit;
+    }
+    throw makeNodeRuntimeError("resource_not_found", "The Pi RPC process permit was not found.");
+};
+const issuePermitValues = (context) => {
+    const { authorizationRevision, input, issuedAtMs } = context;
+    return [
+        requirePiRpcIdentifier(input.permitId, "The Pi RPC permit identifier"),
+        authorizationRevision,
+        input.ownerKind,
+        requirePiRpcIdentifier(input.scopeCommandId, "The Pi RPC permit scope"),
+        requirePiRpcIdentifier(input.runtimeSessionId, "The Pi RPC runtime session identifier"),
+        input.interpreterSha256,
+        input.entrySha256,
+        input.closureSha256,
+        input.policy.adapterVersion,
+        input.policy.conversationPolicyRevision,
+        input.policy.vouchPolicyRevision,
+        requirePiRpcIdentifier(input.fenceId, "The Pi RPC permit fence"),
+        input.recordedAt,
+        issuedAtMs,
+        plusPiRpcMilliseconds(input.recordedAt, PI_RPC_PERMIT_TTL_MS),
+        issuedAtMs + PI_RPC_PERMIT_TTL_MS,
+    ];
+};
+const insertIssuedPermit = (database, context) => {
+    database
+        .prepare(`INSERT INTO pi_rpc_authorization_permits(
+        permit_id, integration, authorization_revision, owner_kind,
+        scope_command_id, runtime_session_id, interpreter_sha256,
+        entry_sha256, closure_sha256, adapter_version,
+        conversation_policy_revision, vouch_policy_revision, fence_id, state,
+        issued_at, issued_at_ms, expires_at, expires_at_ms
+      ) VALUES (?, 'pi-rpc', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
+        'issued', ?, ?, ?, ?)`)
+        .run(...issuePermitValues(context));
+};
+const requireIssueTiming = (authorization, recordedAt) => {
+    const issuedAtMs = requirePiRpcTimestampMs(recordedAt, "The Pi RPC permit timestamp");
+    const authorizedAtMs = requirePiRpcTimestampMs(authorization.createdAt, "The Pi RPC authorization timestamp");
+    if (issuedAtMs >= authorizedAtMs)
+        return issuedAtMs;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC permit timestamp precedes its authorization.", true);
+};
+const requireIssueCapacity = (database, authorization) => {
+    if (countPiRpcUnsettledPermits(database, authorization.authorizationRevision) <
+        PI_RPC_MAX_UNSETTLED_PER_AUTHORIZATION)
+        return;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC authorization has reached its unsettled permit limit.", true);
+};
+const requireAuthorizedOwner = (database, authorization, ownerKind) => {
+    if (projectPiRpcAuthorization(database, authorization).ownerKinds.includes(ownerKind))
+        return;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC permit owner is not authorized.", true);
+};
+const issuePermit = (database, input) => {
+    const authorization = requireActiveIdentity(database, input);
+    requireIssueCapacity(database, authorization);
+    requireAuthorizedOwner(database, authorization, input.ownerKind);
+    const issuedAtMs = requireIssueTiming(authorization, input.recordedAt);
+    compactPiRpcTerminalPermits(database, issuedAtMs);
+    insertIssuedPermit(database, {
+        authorizationRevision: authorization.authorizationRevision,
+        input,
+        issuedAtMs,
+    });
+    return permitMutationResult(database, {
+        method: "integration.permit.issue.pi-rpc",
+        permitId: input.permitId,
+        recordedAt: input.recordedAt,
+    });
+};
+export const issuePiRpcIntegrationPermit = (database, input) => withPiRpcReplay(database, { ...input, method: "integration.permit.issue.pi-rpc" }, () => issuePermit(database, input));
+const requirePermitTiming = (permit, recordedAt) => {
+    const recordedAtMs = requirePiRpcTimestampMs(recordedAt, "The Pi RPC permit lifecycle timestamp");
+    if (recordedAtMs >= permit.issuedAtMs && recordedAtMs < permit.expiresAtMs)
+        return recordedAtMs;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC process permit expired or its timestamp is invalid.", true);
+};
+const dispatchPermit = (database, input) => {
+    const permit = readPermitOrThrow(database, input.permitId);
+    if (permit.state !== "issued")
+        throw makeNodeRuntimeError("storage_conflict", "The Pi RPC process permit is not issued.", true);
+    requireActiveIdentity(database, permitIdentity(permit));
+    const recordedAtMs = requirePermitTiming(permit, input.recordedAt);
+    database
+        .prepare(`UPDATE pi_rpc_authorization_permits
+       SET state = 'dispatching', dispatching_at = ?, dispatching_at_ms = ?
+       WHERE permit_id = ?`)
+        .run(input.recordedAt, recordedAtMs, permit.permitId);
+    return permitMutationResult(database, {
+        method: "integration.permit.dispatch.pi-rpc",
+        permitId: permit.permitId,
+        recordedAt: input.recordedAt,
+    });
+};
+export const dispatchPiRpcIntegrationPermit = (database, input) => withPiRpcReplay(database, { ...input, method: "integration.permit.dispatch.pi-rpc" }, () => dispatchPermit(database, input));
+const requireStartAuthorization = (database, permit, identity) => {
+    const active = requireActiveIdentity(database, identity);
+    if (active.authorizationRevision === permit.authorizationRevision)
+        return;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC permit authorization revision is stale.", true);
+};
+const markPermitStarted = (database, permit, input) => {
+    const recordedAtMs = requirePermitTiming(permit, input.recordedAt);
+    database
+        .prepare(`UPDATE pi_rpc_authorization_permits
+       SET state = 'started', started_at = ?, started_at_ms = ?,
+         process_tree_id = ? WHERE permit_id = ?`)
+        .run(input.recordedAt, recordedAtMs, requirePiRpcIdentifier(input.processTreeId, "The Pi RPC process tree"), permit.permitId);
+};
+const startPermit = (database, input) => {
+    const permit = readPermitOrThrow(database, input.permitId);
+    if (permit.state !== "dispatching")
+        throw makeNodeRuntimeError("storage_conflict", "The Pi RPC process permit is not dispatching.", true);
+    requireStartAuthorization(database, permit, input.identity);
+    markPermitStarted(database, permit, input);
+    return permitMutationResult(database, {
+        method: "integration.permit.start.pi-rpc",
+        permitId: permit.permitId,
+        recordedAt: input.recordedAt,
+    });
+};
+export const startPiRpcIntegrationPermit = (database, input) => withPiRpcReplay(database, { ...input, method: "integration.permit.start.pi-rpc" }, () => startPermit(database, input));
+const terminalReasons = new Set([
+    "cleanup_unknown",
+    "completed",
+    "expired",
+    "failed",
+    "revoked_after_start",
+    "revoked_before_start",
+    "stale_policy",
+    "stale_revision",
+]);
+const requireTerminalReason = (reason) => {
+    if (terminalReasons.has(reason))
+        return reason;
+    throw makeNodeRuntimeError("storage_failed", "The Pi RPC permit terminal reason is invalid.");
+};
+const requireSettlementTiming = (permit, recordedAt) => {
+    const recordedAtMs = requirePiRpcTimestampMs(recordedAt, "The Pi RPC permit settlement timestamp");
+    const latestAtMs = permit.startedAtMs ?? permit.dispatchingAtMs ?? permit.issuedAtMs;
+    if (recordedAtMs >= latestAtMs)
+        return recordedAtMs;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC permit settlement timestamp is not monotonic.");
+};
+const markPermitTerminal = (database, permit, input) => {
+    const recordedAtMs = requireSettlementTiming(permit, input.recordedAt);
+    database
+        .prepare(`UPDATE pi_rpc_authorization_permits
+       SET state = 'terminal', terminal_at = ?, terminal_at_ms = ?,
+         terminal_reason = ? WHERE permit_id = ?`)
+        .run(input.recordedAt, recordedAtMs, requireTerminalReason(input.reason), permit.permitId);
+    return recordedAtMs;
+};
+const cleanupFenceBaseline = (authorization) => {
+    if (authorization.state === "active")
+        return authorization.createdAt;
+    if (authorization.state === "revoking") {
+        if (authorization.revocationStartedAt !== null) {
+            return authorization.revocationStartedAt;
+        }
+        throw makeNodeRuntimeError("storage_corrupt", "The revoking Pi RPC authorization has no revocation timestamp.");
+    }
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC authorization is no longer valid for cleanup_unknown fencing.", true);
+};
+const requireCleanupFenceTiming = (baseline, recordedAtMs) => {
+    const baselineMs = requirePiRpcTimestampMs(baseline, "The Pi RPC authorization cleanup fence baseline");
+    if (recordedAtMs >= baselineMs)
+        return;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC authorization cleanup fence timestamp is not monotonic.", true);
+};
+const persistCleanupUnknown = (database, permit, recordedAt) => {
+    const changes = Number(database
+        .prepare(UPDATE_AUTHORIZATION_CLEANUP_UNKNOWN_SQL)
+        .run(recordedAt, recordedAt, recordedAt, permit.authorizationRevision)
+        .changes);
+    if (changes === 1)
+        return;
+    throw makeNodeRuntimeError("storage_corrupt", "The Pi RPC authorization cleanup_unknown fence was not persisted.");
+};
+const cleanupUnknownAuthorization = (context) => {
+    const authorization = readPiRpcAuthorizationRevision(context.database, context.permit.authorizationRevision);
+    if (authorization === undefined) {
+        throw makeNodeRuntimeError("storage_corrupt", "The Pi RPC permit authorization revision no longer exists.");
+    }
+    if (authorization.state === "cleanup_unknown")
+        return;
+    const baseline = cleanupFenceBaseline(authorization);
+    requireCleanupFenceTiming(baseline, context.recordedAtMs);
+    persistCleanupUnknown(context.database, context.permit, context.input.recordedAt);
+};
+const settlePermit = (database, input) => {
+    const permit = readPermitOrThrow(database, input.permitId);
+    if (permit.state === "terminal")
+        throw makeNodeRuntimeError("storage_conflict", "The Pi RPC process permit is already terminal.", true);
+    const recordedAtMs = markPermitTerminal(database, permit, input);
+    if (input.reason === "cleanup_unknown") {
+        cleanupUnknownAuthorization({ database, input, permit, recordedAtMs });
+    }
+    compactPiRpcTerminalPermits(database, recordedAtMs);
+    return permitMutationResult(database, {
+        method: "integration.permit.settle.pi-rpc",
+        permitId: permit.permitId,
+        recordedAt: input.recordedAt,
+    });
+};
+export const settlePiRpcIntegrationPermit = (database, input) => withPiRpcReplay(database, { ...input, method: "integration.permit.settle.pi-rpc" }, () => settlePermit(database, input));
+const boundedUnsettledPermitLimit = (limit) => {
+    if (Number.isSafeInteger(limit) && limit > 0) {
+        return Math.min(limit, PI_RPC_MAX_UNSETTLED_PER_AUTHORIZATION + 1);
+    }
+    throw makeNodeRuntimeError("storage_failed", "The Pi RPC unsettled permit query limit is invalid.");
+};
+export const listPiRpcUnsettledPermits = (database, authorizationRevision, limit = PI_RPC_MAX_UNSETTLED_PER_AUTHORIZATION) => {
+    const revision = parseRevision(authorizationRevision);
+    const boundedLimit = boundedUnsettledPermitLimit(limit);
+    const rows = database
+        .prepare(`SELECT permit_id AS permitId
+       FROM pi_rpc_authorization_permits
+       WHERE authorization_revision = ?
+         AND state IN ('issued', 'dispatching', 'started')
+       ORDER BY sequence LIMIT ?`)
+        .all(revision, boundedLimit);
+    return rows.map((row) => projectPiRpcPermit(readPermitOrThrow(database, row.permitId)));
+};
+//# sourceMappingURL=permit-store.js.map

package/dist/harness/pi-rpc/authorization/permit-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit-store.js","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/permit-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EACL,0BAA0B,EAG1B,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EACL,sCAAsC,EACtC,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AA2CpD,MAAM,wCAAwC,GAAG;;;;;;;wCAOT,CAAC;AAEzC,MAAM,oBAAoB,GAAG,CAC3B,QAAsB,EACtB,OAA4B,EACN,EAAE,CAAC,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,MAAM,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,UAAU,EAAE,OAAO,CAAC,UAAU;CAC/B,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;IAC9C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,+CAA+C,CAChD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAChD,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,+CAA+C,CAChD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,MAAmC,EACnC,aAAoC,EAC9B,EAAE;IACR,IACE,oBAAoB,CAClB,MAAM,CAAC,cAAc,EACrB,4BAA4B,CAC7B,KAAK,aAAa,CAAC,cAAc;QAClC,oBAAoB,CAClB,MAAM,CAAC,0BAA0B,EACjC,yCAAyC,CAC1C,KAAK,aAAa,CAAC,0BAA0B;QAC9C,oBAAoB,CAClB,MAAM,CAAC,mBAAmB,EAC1B,kCAAkC,CACnC,KAAK,aAAa,CAAC,mBAAmB;QAEvC,OAAO;IACT,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,6CAA6C,EAC7C,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,QAAwB,EACxB,aAAoC,EAC9B,EAAE;IACR,IACE,kBAAkB,CAAC,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;QACrE,aAAa,CAAC,aAAa;QAC7B,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;YACjE,aAAa,CAAC,WAAW;QAC3B,kBAAkB,CAChB,QAAQ,CAAC,iBAAiB,EAC1B,+BAA+B,CAChC,KAAK,aAAa,CAAC,iBAAiB;QAErC,OAAO;IACT,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,+CAA+C,EAC/C,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,QAAsB,EACtB,QAAwB,EACD,EAAE;IACzB,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,qBAAqB,KAAK,QAAQ;QACnD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,kDAAkD,EAClD,IAAI,CACL,CAAC;IACJ,yBAAyB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACnD,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACnD,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,MAAsB,EAAkB,EAAE,CAAC,CAAC;IAClE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE;IAC9D,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC,WAAW,EAAE,MAAM,CAAC,WAAW;IAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;IAC3C,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;QAC7D,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD;CACF,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CACjC,QAAsB,EACtB,MAAsB,EACC,EAAE;IACzB,MAAM,aAAa,GAAG,8BAA8B,CAClD,QAAQ,EACR,MAAM,CAAC,qBAAqB,CAC7B,CAAC;IACF,IAAI,aAAa,KAAK,SAAS;QAC7B,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,yBAAyB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnD,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,QAAsB,EACtB,QAAgB,EACA,EAAE;IAClB,MAAM,MAAM,GAAG,kBAAkB,CAC/B,QAAQ,EACR,sBAAsB,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CACjE,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,oBAAoB,CACxB,oBAAoB,EACpB,0CAA0C,CAC3C,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,iBAAiB,GAAG,CACxB,OAAyB,EACK,EAAE;IAChC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC7D,OAAO;QACL,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,8BAA8B,CAAC;QACtE,qBAAqB;QACrB,KAAK,CAAC,SAAS;QACf,sBAAsB,CAAC,KAAK,CAAC,cAAc,EAAE,yBAAyB,CAAC;QACvE,sBAAsB,CACpB,KAAK,CAAC,gBAAgB,EACtB,uCAAuC,CACxC;QACD,KAAK,CAAC,iBAAiB;QACvB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3B,KAAK,CAAC,MAAM,CAAC,0BAA0B;QACvC,KAAK,CAAC,MAAM,CAAC,mBAAmB;QAChC,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC;QAChE,KAAK,CAAC,UAAU;QAChB,UAAU;QACV,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,oBAAoB,CAAC;QAC7D,UAAU,GAAG,oBAAoB;KAClC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,QAAsB,EACtB,OAAyB,EACnB,EAAE;IACR,QAAQ;SACL,OAAO,CACN;;;;;;;8BAOwB,CACzB;SACA,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,aAAoC,EACpC,UAAkB,EACV,EAAE;IACV,MAAM,UAAU,GAAG,uBAAuB,CACxC,UAAU,EACV,6BAA6B,CAC9B,CAAC;IACF,MAAM,cAAc,GAAG,uBAAuB,CAC5C,aAAa,CAAC,SAAS,EACvB,oCAAoC,CACrC,CAAC;IACF,IAAI,UAAU,IAAI,cAAc;QAAE,OAAO,UAAU,CAAC;IACpD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,yDAAyD,EACzD,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,QAAsB,EACtB,aAAoC,EAC9B,EAAE;IACR,IACE,0BAA0B,CAAC,QAAQ,EAAE,aAAa,CAAC,qBAAqB,CAAC;QACzE,sCAAsC;QAEtC,OAAO;IACT,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,kEAAkE,EAClE,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,QAAsB,EACtB,aAAoC,EACpC,SAAyB,EACnB,EAAE;IACR,IACE,yBAAyB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,UAAU,CAAC,QAAQ,CACpE,SAAS,CACV;QAED,OAAO;IACT,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,4CAA4C,EAC5C,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,QAAsB,EACtB,KAAiB,EACK,EAAE;IACxB,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC9C,sBAAsB,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvE,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,kBAAkB,CAAC,QAAQ,EAAE;QAC3B,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;QAC1D,KAAK;QACL,UAAU;KACX,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,iCAAiC;QACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAsB,EACtB,KAAiB,EACwB,EAAE,CAC3C,eAAe,CACb,QAAQ,EACR,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,EACvD,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CACnC,CAAC;AAMJ,MAAM,mBAAmB,GAAG,CAC1B,MAAsB,EACtB,UAAkB,EACV,EAAE;IACV,MAAM,YAAY,GAAG,uBAAuB,CAC1C,UAAU,EACV,uCAAuC,CACxC,CAAC;IACF,IAAI,YAAY,IAAI,MAAM,CAAC,UAAU,IAAI,YAAY,GAAG,MAAM,CAAC,WAAW;QACxE,OAAO,YAAY,CAAC;IACtB,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,gEAAgE,EAChE,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,QAAsB,EACtB,KAAoB,EACE,EAAE;IACxB,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;QAC3B,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,0CAA0C,EAC1C,IAAI,CACL,CAAC;IACJ,qBAAqB,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACnE,QAAQ;SACL,OAAO,CACN;;2BAEqB,CACtB;SACA,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,oBAAoB,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,oCAAoC;QAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAsB,EACtB,KAAoB,EACqB,EAAE,CAC3C,eAAe,CACb,QAAQ,EACR,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,EAC1D,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CACtC,CAAC;AAOJ,MAAM,yBAAyB,GAAG,CAChC,QAAsB,EACtB,MAAsB,EACtB,QAAwB,EAClB,EAAE;IACR,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,CAAC,qBAAqB;QAAE,OAAO;IAC1E,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,oDAAoD,EACpD,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,QAAsB,EACtB,MAAsB,EACtB,KAAiB,EACX,EAAE;IACR,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACnE,QAAQ;SACL,OAAO,CACN;;iDAE2C,CAC5C;SACA,GAAG,CACF,KAAK,CAAC,UAAU,EAChB,YAAY,EACZ,sBAAsB,CAAC,KAAK,CAAC,aAAa,EAAE,yBAAyB,CAAC,EACtE,MAAM,CAAC,QAAQ,CAChB,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,QAAsB,EACtB,KAAiB,EACK,EAAE;IACxB,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;QAChC,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,+CAA+C,EAC/C,IAAI,CACL,CAAC;IACJ,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,OAAO,oBAAoB,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,iCAAiC;QACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAsB,EACtB,KAAiB,EACwB,EAAE,CAC3C,eAAe,CACb,QAAQ,EACR,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,EACvD,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CACnC,CAAC;AAMJ,MAAM,eAAe,GAAG,IAAI,GAAG,CAA4B;IACzD,iBAAiB;IACjB,WAAW;IACX,SAAS;IACT,QAAQ;IACR,qBAAqB;IACrB,sBAAsB;IACtB,cAAc;IACd,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAC5B,MAAiC,EACN,EAAE;IAC7B,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,+CAA+C,CAChD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAC9B,MAAsB,EACtB,UAAkB,EACV,EAAE;IACV,MAAM,YAAY,GAAG,uBAAuB,CAC1C,UAAU,EACV,wCAAwC,CACzC,CAAC;IACF,MAAM,UAAU,GACd,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,UAAU,CAAC;IACpE,IAAI,YAAY,IAAI,UAAU;QAAE,OAAO,YAAY,CAAC;IACpD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,0DAA0D,CAC3D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,QAAsB,EACtB,MAAsB,EACtB,KAAkB,EACV,EAAE;IACV,MAAM,YAAY,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvE,QAAQ;SACL,OAAO,CACN;;iDAE2C,CAC5C;SACA,GAAG,CACF,KAAK,CAAC,UAAU,EAChB,YAAY,EACZ,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,EACnC,MAAM,CAAC,QAAQ,CAChB,CAAC;IACJ,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,aAAoC,EAAU,EAAE;IAC5E,IAAI,aAAa,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,SAAS,CAAC;IACrE,IAAI,aAAa,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACvC,IAAI,aAAa,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAC/C,OAAO,aAAa,CAAC,mBAAmB,CAAC;QAC3C,CAAC;QACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,0EAA0E,EAC1E,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAChC,QAAgB,EAChB,YAAoB,EACd,EAAE;IACR,MAAM,UAAU,GAAG,uBAAuB,CACxC,QAAQ,EACR,iDAAiD,CAClD,CAAC;IACF,IAAI,YAAY,IAAI,UAAU;QAAE,OAAO;IACvC,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,oEAAoE,EACpE,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,QAAsB,EACtB,MAAsB,EACtB,UAAkB,EACZ,EAAE;IACR,MAAM,OAAO,GAAG,MAAM,CACpB,QAAQ;SACL,OAAO,CAAC,wCAAwC,CAAC;SACjD,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,qBAAqB,CAAC;SACrE,OAAO,CACX,CAAC;IACF,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO;IAC1B,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,mEAAmE,CACpE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC,OAKpC,EAAQ,EAAE;IACT,MAAM,aAAa,GAAG,8BAA8B,CAClD,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CACrC,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO;IACtD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACrD,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,qBAAqB,CACnB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,KAAK,CAAC,UAAU,CACzB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,QAAsB,EACtB,KAAkB,EACI,EAAE;IACxB,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU;QAC7B,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,gDAAgD,EAChD,IAAI,CACL,CAAC;IACJ,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACvC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,2BAA2B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,OAAO,oBAAoB,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,kCAAkC;QAC1C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAsB,EACtB,KAAkB,EACuB,EAAE,CAC3C,eAAe,CACb,QAAQ,EACR,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,EACxD,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CACpC,CAAC;AAEJ,MAAM,2BAA2B,GAAG,CAAC,KAAa,EAAU,EAAE;IAC5D,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,sCAAsC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,qDAAqD,CACtD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,QAAsB,EACtB,qBAA6B,EAC7B,QAAgB,sCAAsC,EACpB,EAAE;IACpC,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ;SAClB,OAAO,CACN;;;;iCAI2B,CAC5B;SACA,GAAG,CAAC,QAAQ,EAAE,YAAY,CAE1B,CAAC;IACJ,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACtB,kBAAkB,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC,CAAC"}

package/dist/harness/pi-rpc/authorization/plan-store.d.ts

@@ -0,0 +1,14 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { PiRpcCommandInput, PiRpcIntegrationPlanRecord, PiRpcIntegrationPlanTarget, PiRpcReplayResult } from "./types.js";
+type CreatePlanInput = PiRpcCommandInput & {
+    readonly planId: string;
+    readonly target: PiRpcIntegrationPlanTarget;
+};
+type CreatePlanResult = {
+    readonly method: "integration.plan.pi-rpc";
+    readonly plan: PiRpcIntegrationPlanRecord;
+};
+export declare const createPiRpcIntegrationPlan: (database: DatabaseSync, input: CreatePlanInput) => PiRpcReplayResult<CreatePlanResult>;
+export declare const readPiRpcIntegrationPlan: (database: DatabaseSync, planId: string) => PiRpcIntegrationPlanRecord | undefined;
+export {};
+//# sourceMappingURL=plan-store.d.ts.map

package/dist/harness/pi-rpc/authorization/plan-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-store.d.ts","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/plan-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAyBhD,OAAO,KAAK,EAEV,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,EAC1B,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAuXpB,KAAK,eAAe,GAAG,iBAAiB,GAAG;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAC7C,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;CAC3C,CAAC;AAUF,eAAO,MAAM,0BAA0B,GACrC,UAAU,YAAY,EACtB,OAAO,eAAe,KACrB,iBAAiB,CAAC,gBAAgB,CAKlC,CAAC;AAEJ,eAAO,MAAM,wBAAwB,GACnC,UAAU,YAAY,EACtB,QAAQ,MAAM,KACb,0BAA0B,GAAG,SAM/B,CAAC"}

package/dist/harness/pi-rpc/authorization/plan-store.js

@@ -0,0 +1,205 @@
+import { createHash } from "node:crypto";
+import { makeNodeRuntimeError } from "../../../runtime/errors.js";
+import { readPiRpcManifestRow, readPiRpcPlanRow, } from "./database.js";
+import { PI_RPC_MAX_PLAN_BYTES, PI_RPC_PLAN_TTL_MS, plusPiRpcMilliseconds, requirePiRpcDigest, requirePiRpcFilesystemIdentity, requirePiRpcIdentifier, requirePiRpcManifest, requirePiRpcOwnerKinds, requirePiRpcPath, requirePiRpcRevision, requirePiRpcTimestampMs, } from "./policy.js";
+import { projectPiRpcPlan } from "./projection.js";
+import { withPiRpcReplay } from "./replay-store.js";
+const validateEntryIdentity = (artifact) => {
+    requirePiRpcPath(artifact.entryPath, "The Pi RPC entry path");
+    requirePiRpcDigest(artifact.entrySha256, "The Pi RPC entry digest");
+    requirePiRpcFilesystemIdentity(artifact.entryIdentity.device, "The Pi RPC entry device");
+    requirePiRpcFilesystemIdentity(artifact.entryIdentity.inode, "The Pi RPC entry inode");
+    requirePiRpcFilesystemIdentity(artifact.entryIdentity.sizeBytes, "The Pi RPC entry size");
+};
+const validateInterpreterIdentity = (artifact) => {
+    requirePiRpcPath(artifact.interpreterPath, "The Pi RPC interpreter path");
+    requirePiRpcDigest(artifact.interpreterSha256, "The Pi RPC interpreter digest");
+    requirePiRpcFilesystemIdentity(artifact.interpreterIdentity.device, "The Pi RPC interpreter device");
+    requirePiRpcFilesystemIdentity(artifact.interpreterIdentity.inode, "The Pi RPC interpreter inode");
+    requirePiRpcFilesystemIdentity(artifact.interpreterIdentity.sizeBytes, "The Pi RPC interpreter size");
+};
+const validateInterpreterKind = (artifact) => {
+    if (artifact.interpreterArchitecture !== "arm64" &&
+        artifact.interpreterArchitecture !== "x64")
+        throw makeNodeRuntimeError("storage_failed", "The Pi RPC interpreter architecture is unsupported.");
+    if (artifact.interpreterVersion !== "24.19.0")
+        throw makeNodeRuntimeError("storage_failed", "The Pi RPC interpreter version is unsupported.");
+};
+const validateArtifactIdentity = (artifact) => {
+    requirePiRpcManifest(artifact);
+    validateEntryIdentity(artifact);
+    validateInterpreterIdentity(artifact);
+    validateInterpreterKind(artifact);
+    return artifact;
+};
+const validateTarget = (target) => ({
+    adapterVersion: requirePiRpcRevision(target.adapterVersion, "The Pi RPC adapter version"),
+    artifact: validateArtifactIdentity(target.artifact),
+    conversationPolicyRevision: requirePiRpcRevision(target.conversationPolicyRevision, "The Pi RPC conversation policy revision"),
+    ownerKinds: requirePiRpcOwnerKinds(target.ownerKinds),
+    vouchPolicyRevision: requirePiRpcRevision(target.vouchPolicyRevision, "The Pi RPC vouch policy revision"),
+});
+const publicArtifact = (artifact) => {
+    const { entries: _entries, ...summary } = artifact;
+    return summary;
+};
+const canonicalPlanPayload = (target) => ({
+    integration: "pi-rpc",
+    target: {
+        adapter: "pi-rpc",
+        adapterVersion: target.adapterVersion,
+        artifact: publicArtifact(target.artifact),
+        conversationPolicyRevision: target.conversationPolicyRevision,
+        ownerKinds: target.ownerKinds,
+        vouchPolicyRevision: target.vouchPolicyRevision,
+    },
+});
+const planCandidate = (input) => {
+    const createdAtMs = requirePiRpcTimestampMs(input.recordedAt, "The Pi RPC plan timestamp");
+    const target = validateTarget(input.target);
+    const planJson = JSON.stringify(canonicalPlanPayload(target));
+    const planBytes = Buffer.byteLength(planJson, "utf8");
+    if (planBytes > PI_RPC_MAX_PLAN_BYTES)
+        throw makeNodeRuntimeError("storage_failed", "The Pi RPC integration plan exceeds its storage bound.");
+    return {
+        createdAtMs,
+        expiresAt: plusPiRpcMilliseconds(input.recordedAt, PI_RPC_PLAN_TTL_MS),
+        expiresAtMs: createdAtMs + PI_RPC_PLAN_TTL_MS,
+        planBytes,
+        planDigest: createHash("sha256").update(planJson).digest("hex"),
+        planId: requirePiRpcIdentifier(input.planId, "The Pi RPC plan identifier"),
+        planJson,
+        target,
+    };
+};
+const manifestMatches = (row, manifest) => row.fileCount === manifest.fileCount &&
+    row.excludedBinEntryCount === manifest.excludedBinEntryCount &&
+    row.manifestBytes === manifest.manifestBytes &&
+    row.packageManifestSha256 === manifest.packageManifestSha256 &&
+    row.packageName === manifest.packageName &&
+    row.packageRootDevice === manifest.packageRootIdentity.device &&
+    row.packageRootInode === manifest.packageRootIdentity.inode &&
+    row.packageRootPath === manifest.packageRootPath &&
+    row.packageVersion === manifest.packageVersion &&
+    row.totalBytes === manifest.totalBytes;
+const persistedEntryCount = (database, manifest) => database
+    .prepare(`SELECT COUNT(*) AS value FROM pi_rpc_artifact_manifest_entries
+         WHERE closure_sha256 = ?`)
+    .get(manifest.closureSha256).value;
+const persistedEntriesMatch = (database, manifest) => persistedEntryCount(database, manifest) === manifest.fileCount &&
+    manifest.entries.every((entry) => {
+        const row = database
+            .prepare(`SELECT byte_count AS byteCount, executable AS executable,
+          relative_path AS relativePath, sha256 AS sha256
+         FROM pi_rpc_artifact_manifest_entries
+         WHERE closure_sha256 = ? AND ordinal = ?`)
+            .get(manifest.closureSha256, entry.ordinal);
+        return (row?.byteCount === entry.byteCount &&
+            row.executable === (entry.executable ? 1 : 0) &&
+            row.relativePath === entry.relativePath &&
+            row.sha256 === entry.sha256);
+    });
+const insertManifestEntries = (database, manifest) => {
+    const statement = database.prepare(`INSERT INTO pi_rpc_artifact_manifest_entries(
+      closure_sha256, ordinal, relative_path, byte_count, sha256, executable
+    ) VALUES (?, ?, ?, ?, ?, ?)`);
+    manifest.entries.forEach((entry) => {
+        statement.run(manifest.closureSha256, entry.ordinal, entry.relativePath, entry.byteCount, entry.sha256, entry.executable ? 1 : 0);
+    });
+};
+const insertManifest = (database, manifest, recordedAt) => {
+    database
+        .prepare(`INSERT INTO pi_rpc_artifact_manifests(
+        closure_sha256, package_root_path, package_root_device,
+        package_root_inode, package_name, package_version,
+        package_manifest_sha256, excluded_bin_entry_count, file_count,
+        total_bytes, manifest_bytes, created_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(manifest.closureSha256, manifest.packageRootPath, manifest.packageRootIdentity.device, manifest.packageRootIdentity.inode, manifest.packageName, manifest.packageVersion, manifest.packageManifestSha256, manifest.excludedBinEntryCount, manifest.fileCount, manifest.totalBytes, manifest.manifestBytes, recordedAt);
+    insertManifestEntries(database, manifest);
+};
+const ensureManifest = (database, manifest, recordedAt) => {
+    const existing = readPiRpcManifestRow(database, manifest.closureSha256);
+    if (existing === undefined) {
+        insertManifest(database, manifest, recordedAt);
+        return;
+    }
+    if (manifestMatches(existing, manifest) &&
+        persistedEntriesMatch(database, manifest))
+        return;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC closure digest is already bound to different artifact content.");
+};
+const planArtifactValues = (artifact) => [
+    artifact.interpreterPath,
+    artifact.interpreterIdentity.device,
+    artifact.interpreterIdentity.inode,
+    artifact.interpreterIdentity.sizeBytes,
+    artifact.interpreterSha256,
+    artifact.interpreterArchitecture,
+    artifact.entryPath,
+    artifact.entryIdentity.device,
+    artifact.entryIdentity.inode,
+    artifact.entryIdentity.sizeBytes,
+    artifact.entrySha256,
+    artifact.packageRootPath,
+    artifact.packageRootIdentity.device,
+    artifact.packageRootIdentity.inode,
+    artifact.closureSha256,
+];
+const planInsertValues = (candidate, recordedAt) => [
+    candidate.planId,
+    ...planArtifactValues(candidate.target.artifact),
+    candidate.target.adapterVersion,
+    JSON.stringify(candidate.target.ownerKinds),
+    candidate.target.conversationPolicyRevision,
+    candidate.target.vouchPolicyRevision,
+    candidate.planJson,
+    candidate.planDigest,
+    candidate.planBytes,
+    recordedAt,
+    candidate.createdAtMs,
+    candidate.expiresAt,
+    candidate.expiresAtMs,
+];
+const insertPlan = (database, candidate, recordedAt) => {
+    database
+        .prepare(`INSERT INTO pi_rpc_authorization_plans(
+        plan_id, integration, target_adapter, interpreter_path,
+        interpreter_device, interpreter_inode, interpreter_size_bytes,
+        interpreter_sha256, interpreter_version, interpreter_architecture,
+        entry_path, entry_device, entry_inode, entry_size_bytes, entry_sha256,
+        package_root_path, package_root_device,
+        package_root_inode, closure_sha256, adapter_version, owner_kinds_json,
+        conversation_policy_revision, vouch_policy_revision, plan_json,
+        plan_digest, plan_bytes, created_at, created_at_ms, expires_at,
+        expires_at_ms
+      ) VALUES (?, 'pi-rpc', 'pi-rpc', ?, ?, ?, ?, ?, '24.19.0', ?, ?, ?, ?,
+        ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(...planInsertValues(candidate, recordedAt));
+};
+const existingPlanMatches = (row, candidate) => row.planDigest === candidate.planDigest &&
+    row.planJson === candidate.planJson;
+const createPlan = (database, candidate, recordedAt) => {
+    ensureManifest(database, candidate.target.artifact, recordedAt);
+    const existing = readPiRpcPlanRow(database, candidate.planId);
+    if (existing !== undefined) {
+        if (existingPlanMatches(existing, candidate))
+            return projectPiRpcPlan(database, existing);
+        throw makeNodeRuntimeError("storage_conflict", "The Pi RPC plan identifier already exists with different content.");
+    }
+    insertPlan(database, candidate, recordedAt);
+    const inserted = readPiRpcPlanRow(database, candidate.planId);
+    if (inserted !== undefined)
+        return projectPiRpcPlan(database, inserted);
+    throw makeNodeRuntimeError("storage_corrupt", "The Pi RPC integration plan was not persisted.");
+};
+const createPlanResult = (database, input) => ({
+    method: "integration.plan.pi-rpc",
+    plan: createPlan(database, planCandidate(input), input.recordedAt),
+});
+export const createPiRpcIntegrationPlan = (database, input) => withPiRpcReplay(database, { ...input, method: "integration.plan.pi-rpc" }, () => createPlanResult(database, input));
+export const readPiRpcIntegrationPlan = (database, planId) => {
+    const row = readPiRpcPlanRow(database, requirePiRpcIdentifier(planId, "The Pi RPC plan identifier"));
+    return row === undefined ? undefined : projectPiRpcPlan(database, row);
+};
+//# sourceMappingURL=plan-store.js.map

package/dist/harness/pi-rpc/authorization/plan-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-store.js","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/plan-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAGL,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,8BAA8B,EAC9B,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAWpD,MAAM,qBAAqB,GAAG,CAC5B,QAAgD,EAC1C,EAAE;IACR,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAC9D,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACpE,8BAA8B,CAC5B,QAAQ,CAAC,aAAa,CAAC,MAAM,EAC7B,yBAAyB,CAC1B,CAAC;IACF,8BAA8B,CAC5B,QAAQ,CAAC,aAAa,CAAC,KAAK,EAC5B,wBAAwB,CACzB,CAAC;IACF,8BAA8B,CAC5B,QAAQ,CAAC,aAAa,CAAC,SAAS,EAChC,uBAAuB,CACxB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAClC,QAAgD,EAC1C,EAAE;IACR,gBAAgB,CAAC,QAAQ,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IAC1E,kBAAkB,CAChB,QAAQ,CAAC,iBAAiB,EAC1B,+BAA+B,CAChC,CAAC;IACF,8BAA8B,CAC5B,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EACnC,+BAA+B,CAChC,CAAC;IACF,8BAA8B,CAC5B,QAAQ,CAAC,mBAAmB,CAAC,KAAK,EAClC,8BAA8B,CAC/B,CAAC;IACF,8BAA8B,CAC5B,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EACtC,6BAA6B,CAC9B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAC9B,QAAgD,EAC1C,EAAE;IACR,IACE,QAAQ,CAAC,uBAAuB,KAAK,OAAO;QAC5C,QAAQ,CAAC,uBAAuB,KAAK,KAAK;QAE1C,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,qDAAqD,CACtD,CAAC;IACJ,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS;QAC3C,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,gDAAgD,CACjD,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAC/B,QAAgD,EACR,EAAE;IAC1C,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,MAAkC,EACjB,EAAE,CAAC,CAAC;IACrB,cAAc,EAAE,oBAAoB,CAClC,MAAM,CAAC,cAAc,EACrB,4BAA4B,CAC7B;IACD,QAAQ,EAAE,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC;IACnD,0BAA0B,EAAE,oBAAoB,CAC9C,MAAM,CAAC,0BAA0B,EACjC,yCAAyC,CAC1C;IACD,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC;IACrD,mBAAmB,EAAE,oBAAoB,CACvC,MAAM,CAAC,mBAAmB,EAC1B,kCAAkC,CACnC;CACF,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CACrB,QAAgD,EACS,EAAE;IAC3D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC;IACnD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,MAAuB,EAAE,EAAE,CAAC,CAAC;IACzD,WAAW,EAAE,QAAiB;IAC9B,MAAM,EAAE;QACN,OAAO,EAAE,QAAiB;QAC1B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;QACzC,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;QAC7D,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;KAChD;CACF,CAAC,CAAC;AAaH,MAAM,aAAa,GAAG,CACpB,KAGC,EACc,EAAE;IACjB,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,CAAC,UAAU,EAChB,2BAA2B,CAC5B,CAAC;IACF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,SAAS,GAAG,qBAAqB;QACnC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,wDAAwD,CACzD,CAAC;IACJ,OAAO;QACL,WAAW;QACX,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,kBAAkB,CAAC;QACtE,WAAW,EAAE,WAAW,GAAG,kBAAkB;QAC7C,SAAS;QACT,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,4BAA4B,CAAC;QAC1E,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CACtB,GAAqB,EACrB,QAA+B,EACtB,EAAE,CACX,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;IACpC,GAAG,CAAC,qBAAqB,KAAK,QAAQ,CAAC,qBAAqB;IAC5D,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;IAC5C,GAAG,CAAC,qBAAqB,KAAK,QAAQ,CAAC,qBAAqB;IAC5D,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;IACxC,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,mBAAmB,CAAC,MAAM;IAC7D,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,mBAAmB,CAAC,KAAK;IAC3D,GAAG,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;IAChD,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;IAC9C,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC;AAEzC,MAAM,mBAAmB,GAAG,CAC1B,QAAsB,EACtB,QAA+B,EACvB,EAAE,CAER,QAAQ;KACL,OAAO,CACN;kCAC0B,CAC3B;KACA,GAAG,CAAC,QAAQ,CAAC,aAAa,CAC9B,CAAC,KAAK,CAAC;AAEV,MAAM,qBAAqB,GAAG,CAC5B,QAAsB,EACtB,QAA+B,EACtB,EAAE,CACX,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,QAAQ,CAAC,SAAS;IAC9D,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,QAAQ;aACjB,OAAO,CACN;;;kDAG0C,CAC3C;aACA,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAOvC,CAAC;QACN,OAAO,CACL,GAAG,EAAE,SAAS,KAAK,KAAK,CAAC,SAAS;YAClC,GAAG,CAAC,UAAU,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;YACvC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,CAC5B,QAAsB,EACtB,QAA+B,EACzB,EAAE;IACR,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAChC;;gCAE4B,CAC7B,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,SAAS,CAAC,GAAG,CACX,QAAQ,CAAC,aAAa,EACtB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,QAAsB,EACtB,QAA+B,EAC/B,UAAkB,EACZ,EAAE;IACR,QAAQ;SACL,OAAO,CACN;;;;;oDAK8C,CAC/C;SACA,GAAG,CACF,QAAQ,CAAC,aAAa,EACtB,QAAQ,CAAC,eAAe,EACxB,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EACnC,QAAQ,CAAC,mBAAmB,CAAC,KAAK,EAClC,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,qBAAqB,EAC9B,QAAQ,CAAC,qBAAqB,EAC9B,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,aAAa,EACtB,UAAU,CACX,CAAC;IACJ,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,QAAsB,EACtB,QAA+B,EAC/B,UAAkB,EACZ,EAAE;IACR,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,IACE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACnC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAEzC,OAAO;IACT,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,2EAA2E,CAC5E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,QAAgD,EAClB,EAAE,CAAC;IACjC,QAAQ,CAAC,eAAe;IACxB,QAAQ,CAAC,mBAAmB,CAAC,MAAM;IACnC,QAAQ,CAAC,mBAAmB,CAAC,KAAK;IAClC,QAAQ,CAAC,mBAAmB,CAAC,SAAS;IACtC,QAAQ,CAAC,iBAAiB;IAC1B,QAAQ,CAAC,uBAAuB;IAChC,QAAQ,CAAC,SAAS;IAClB,QAAQ,CAAC,aAAa,CAAC,MAAM;IAC7B,QAAQ,CAAC,aAAa,CAAC,KAAK;IAC5B,QAAQ,CAAC,aAAa,CAAC,SAAS;IAChC,QAAQ,CAAC,WAAW;IACpB,QAAQ,CAAC,eAAe;IACxB,QAAQ,CAAC,mBAAmB,CAAC,MAAM;IACnC,QAAQ,CAAC,mBAAmB,CAAC,KAAK;IAClC,QAAQ,CAAC,aAAa;CACvB,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,SAAwB,EACxB,UAAkB,EACY,EAAE,CAAC;IACjC,SAAS,CAAC,MAAM;IAChB,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC;IAChD,SAAS,CAAC,MAAM,CAAC,cAAc;IAC/B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;IAC3C,SAAS,CAAC,MAAM,CAAC,0BAA0B;IAC3C,SAAS,CAAC,MAAM,CAAC,mBAAmB;IACpC,SAAS,CAAC,QAAQ;IAClB,SAAS,CAAC,UAAU;IACpB,SAAS,CAAC,SAAS;IACnB,UAAU;IACV,SAAS,CAAC,WAAW;IACrB,SAAS,CAAC,SAAS;IACnB,SAAS,CAAC,WAAW;CACtB,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,QAAsB,EACtB,SAAwB,EACxB,UAAkB,EACZ,EAAE;IACR,QAAQ;SACL,OAAO,CACN;;;;;;;;;;;2DAWqD,CACtD;SACA,GAAG,CAAC,GAAG,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,GAAiB,EACjB,SAAwB,EACf,EAAE,CACX,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;IACvC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CAAC;AAEtC,MAAM,UAAU,GAAG,CACjB,QAAsB,EACtB,SAAwB,EACxB,UAAkB,EACU,EAAE;IAC9B,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC1C,OAAO,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxE,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,gDAAgD,CACjD,CAAC;AACJ,CAAC,CAAC;AAYF,MAAM,gBAAgB,GAAG,CACvB,QAAsB,EACtB,KAAsB,EACJ,EAAE,CAAC,CAAC;IACtB,MAAM,EAAE,yBAAyB;IACjC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;CACnE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,QAAsB,EACtB,KAAsB,EACe,EAAE,CACvC,eAAe,CACb,QAAQ,EACR,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAC/C,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CACxC,CAAC;AAEJ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,QAAsB,EACtB,MAAc,EAC0B,EAAE;IAC1C,MAAM,GAAG,GAAG,gBAAgB,CAC1B,QAAQ,EACR,sBAAsB,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAC7D,CAAC;IACF,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACzE,CAAC,CAAC"}

package/dist/harness/pi-rpc/authorization/policy.d.ts

@@ -0,0 +1,18 @@
+import type { PiRpcArtifactManifest, PiRpcCommandInput, PiRpcOwnerKind } from "./types.js";
+export declare const PI_RPC_PLAN_TTL_MS = 300000;
+export declare const PI_RPC_PERMIT_TTL_MS = 2000;
+export declare const PI_RPC_MAX_PLAN_BYTES = 16384;
+export declare const PI_RPC_MAX_UNSETTLED_PER_AUTHORIZATION = 8;
+export declare const PI_RPC_MAX_TERMINAL_PERMITS = 10000;
+export declare const PI_RPC_TERMINAL_RETENTION_MS: number;
+export declare const requirePiRpcIdentifier: (value: string, label: string) => string;
+export declare const requirePiRpcDigest: (value: string, label: string) => string;
+export declare const requirePiRpcRevision: (value: string, label: string) => string;
+export declare const requirePiRpcPath: (value: string, label: string) => string;
+export declare const requirePiRpcFilesystemIdentity: (value: number, label: string) => number;
+export declare const requirePiRpcTimestampMs: (value: string, label: string) => number;
+export declare const plusPiRpcMilliseconds: (value: string, milliseconds: number) => string;
+export declare const requirePiRpcCommandInput: (input: PiRpcCommandInput) => void;
+export declare const requirePiRpcOwnerKinds: (value: readonly PiRpcOwnerKind[]) => readonly PiRpcOwnerKind[];
+export declare const requirePiRpcManifest: (manifest: PiRpcArtifactManifest) => PiRpcArtifactManifest;
+//# sourceMappingURL=policy.d.ts.map

package/dist/harness/pi-rpc/authorization/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,sCAAsC,IAAI,CAAC;AACxD,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAClD,eAAO,MAAM,4BAA4B,QAA2B,CAAC;AAMrE,eAAO,MAAM,sBAAsB,GACjC,OAAO,MAAM,EACb,OAAO,MAAM,KACZ,MAGF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,MAGjE,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,MAGnE,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,MAS/D,CAAC;AAEF,eAAO,MAAM,8BAA8B,GACzC,OAAO,MAAM,EACb,OAAO,MAAM,KACZ,MAGF,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAClC,OAAO,MAAM,EACb,OAAO,MAAM,KACZ,MAKF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,OAAO,MAAM,EACb,cAAc,MAAM,KACnB,MAGc,CAAC;AAElB,eAAO,MAAM,wBAAwB,GAAI,OAAO,iBAAiB,KAAG,IAInE,CAAC;AAEF,eAAO,MAAM,sBAAsB,GACjC,OAAO,SAAS,cAAc,EAAE,KAC/B,SAAS,cAAc,EAazB,CAAC;AA+GF,eAAO,MAAM,oBAAoB,GAC/B,UAAU,qBAAqB,KAC9B,qBAmBF,CAAC"}