@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/runtime/process/resource/integration-authorization/plan-integrity.js

@@ -0,0 +1,172 @@
+import { createHash } from "node:crypto";
+import { makeNodeRuntimeError, NodeRuntimeError } from "../../../errors.js";
+import { MAX_IDENTIFIER_BYTES, normalizeOwnerKinds, parseJson, parseOwnerKindsJson, PLAN_MAX_BYTES, requireBoundedIdentifier, requireBoundedPath, requireBoundedRevision, requireHexDigest, } from "./policy.js";
+import { CODEX_INTEGRATION, } from "./types.js";
+const PLAN_KEYS = ["integration", "target"];
+const PLAN_TARGET_KEYS = [
+    "adapter",
+    "adapterVersion",
+    "executableIdentity",
+    "executablePath",
+    "executableSha256",
+    "ownerKinds",
+    "sandboxPolicyRevision",
+    "vouchPolicyRevision",
+];
+const PLAN_IDENTITY_KEYS = ["device", "inode", "sizeBytes"];
+const asObject = (value, label) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw makeNodeRuntimeError("storage_corrupt", `${label} must be an object.`);
+    }
+    return value;
+};
+const assertExactKeys = (record, expected, label) => {
+    const actual = Object.keys(record).toSorted();
+    const expectedSorted = [...expected].toSorted();
+    if (actual.length !== expectedSorted.length ||
+        actual.some((key, index) => key !== expectedSorted[index])) {
+        throw makeNodeRuntimeError("storage_corrupt", `${label} has an unexpected object shape.`);
+    }
+};
+const readString = (record, key, label) => {
+    const value = record[key];
+    if (typeof value !== "string") {
+        throw makeNodeRuntimeError("storage_corrupt", `${label} must contain string field '${key}'.`);
+    }
+    return value;
+};
+const mapStorageFailedToCorrupt = (run, label) => {
+    try {
+        return run();
+    }
+    catch (error) {
+        if (error instanceof NodeRuntimeError && error.code === "storage_failed") {
+            throw makeNodeRuntimeError("storage_corrupt", label);
+        }
+        throw error;
+    }
+};
+const parsePayloadOwnerKinds = (value) => {
+    if (!Array.isArray(value)) {
+        throw makeNodeRuntimeError("storage_corrupt", "The persisted plan payload ownerKinds field must be an array.");
+    }
+    const entries = value.map((entry) => {
+        if (typeof entry !== "string") {
+            throw makeNodeRuntimeError("storage_corrupt", "The persisted plan payload ownerKinds entries must be strings.");
+        }
+        if (Buffer.byteLength(entry, "utf8") > MAX_IDENTIFIER_BYTES) {
+            throw makeNodeRuntimeError("storage_corrupt", "The persisted plan payload ownerKinds entry is oversized.");
+        }
+        return entry;
+    });
+    return mapStorageFailedToCorrupt(() => normalizeOwnerKinds(entries), "The persisted plan payload ownerKinds list is invalid.");
+};
+const parseTargetAdapterVersion = (target) => mapStorageFailedToCorrupt(() => requireBoundedRevision(readString(target, "adapterVersion", "The integration plan target"), "The persisted integration plan adapter version"), "The persisted integration plan adapter version is invalid.");
+const parseFilesystemIdentity = (identity, key) => {
+    const value = readString(identity, key, "The executable identity");
+    if (!/^[0-9]{1,20}$/u.test(value)) {
+        throw makeNodeRuntimeError("storage_corrupt", "The persisted executable identity is invalid.");
+    }
+    return value;
+};
+const parseTargetExecutableIdentity = (target) => {
+    const identity = asObject(target.executableIdentity, "The executable identity");
+    assertExactKeys(identity, PLAN_IDENTITY_KEYS, "The executable identity");
+    return {
+        device: parseFilesystemIdentity(identity, "device"),
+        inode: parseFilesystemIdentity(identity, "inode"),
+        sizeBytes: parseFilesystemIdentity(identity, "sizeBytes"),
+    };
+};
+const parseTargetExecutablePath = (target) => mapStorageFailedToCorrupt(() => requireBoundedPath(readString(target, "executablePath", "The integration plan target"), "The persisted integration plan executable path"), "The persisted integration plan executable path is invalid.");
+const parseTargetExecutableDigest = (target) => mapStorageFailedToCorrupt(() => requireHexDigest(readString(target, "executableSha256", "The integration plan target"), "The persisted integration plan executable digest"), "The persisted integration plan executable digest is invalid.");
+const parseTargetSandboxRevision = (target) => mapStorageFailedToCorrupt(() => requireBoundedRevision(readString(target, "sandboxPolicyRevision", "The integration plan target"), "The persisted integration plan sandbox policy revision"), "The persisted integration plan sandbox policy revision is invalid.");
+const parseTargetVouchRevision = (target) => mapStorageFailedToCorrupt(() => requireBoundedRevision(readString(target, "vouchPolicyRevision", "The integration plan target"), "The persisted integration plan vouch policy revision"), "The persisted integration plan vouch policy revision is invalid.");
+const parsePersistedTarget = (plan) => {
+    const target = asObject(plan.target, "The integration plan target");
+    assertExactKeys(target, PLAN_TARGET_KEYS, "The integration plan target");
+    const adapter = readString(target, "adapter", "The integration plan target");
+    if (adapter !== CODEX_INTEGRATION) {
+        throw makeNodeRuntimeError("storage_corrupt", "The persisted integration plan target adapter is invalid.");
+    }
+    return {
+        adapter,
+        adapterVersion: parseTargetAdapterVersion(target),
+        executableIdentity: parseTargetExecutableIdentity(target),
+        executablePath: parseTargetExecutablePath(target),
+        executableSha256: parseTargetExecutableDigest(target),
+        ownerKinds: parsePayloadOwnerKinds(target.ownerKinds),
+        sandboxPolicyRevision: parseTargetSandboxRevision(target),
+        vouchPolicyRevision: parseTargetVouchRevision(target),
+    };
+};
+export const parsePersistedPlanPayload = (planJson) => {
+    const decoded = parseJson(planJson, "The integration plan payload");
+    const plan = asObject(decoded, "The integration plan payload");
+    assertExactKeys(plan, PLAN_KEYS, "The integration plan payload");
+    const integration = readString(plan, "integration", "The integration plan payload");
+    if (integration !== CODEX_INTEGRATION) {
+        throw makeNodeRuntimeError("storage_corrupt", "The persisted integration plan payload targets an unknown integration.");
+    }
+    return { integration, target: parsePersistedTarget(plan) };
+};
+const validatePlanIdentifier = (row) => {
+    mapStorageFailedToCorrupt(() => requireBoundedIdentifier(row.planId, "The persisted integration plan identifier"), "The persisted integration plan identifier is invalid.");
+};
+const validatePlanExecutableColumns = (row) => {
+    mapStorageFailedToCorrupt(() => requireBoundedPath(row.executablePath, "The persisted integration plan executable path"), "The persisted integration plan executable path is invalid.");
+    mapStorageFailedToCorrupt(() => requireHexDigest(row.executableSha256, "The persisted integration plan executable digest"), "The persisted integration plan executable digest is invalid.");
+};
+const validatePlanPolicyColumns = (row) => {
+    mapStorageFailedToCorrupt(() => requireBoundedRevision(row.adapterVersion, "The persisted integration plan adapter version"), "The persisted integration plan adapter version is invalid.");
+    mapStorageFailedToCorrupt(() => requireBoundedRevision(row.sandboxPolicyRevision, "The persisted integration plan sandbox policy revision"), "The persisted integration plan sandbox policy revision is invalid.");
+    mapStorageFailedToCorrupt(() => requireBoundedRevision(row.vouchPolicyRevision, "The persisted integration plan vouch policy revision"), "The persisted integration plan vouch policy revision is invalid.");
+};
+const validatePlanDigestColumn = (row) => {
+    mapStorageFailedToCorrupt(() => requireHexDigest(row.planDigest, "The persisted integration plan digest"), "The persisted integration plan digest is invalid.");
+};
+const validatePlanColumns = (row) => {
+    validatePlanIdentifier(row);
+    validatePlanExecutableColumns(row);
+    validatePlanPolicyColumns(row);
+    validatePlanDigestColumn(row);
+};
+const assertPlanColumnsMatchPayload = (row, payload) => {
+    if (row.integration !== CODEX_INTEGRATION ||
+        row.targetAdapter !== CODEX_INTEGRATION ||
+        row.targetCount !== 1) {
+        throw makeNodeRuntimeError("storage_corrupt", "The persisted integration plan columns are invalid.");
+    }
+    const ownerKinds = parseOwnerKindsJson(row.ownerKindsJson);
+    if (row.adapterVersion !== payload.target.adapterVersion ||
+        row.executablePath !== payload.target.executablePath ||
+        row.executableSha256 !== payload.target.executableSha256 ||
+        row.sandboxPolicyRevision !== payload.target.sandboxPolicyRevision ||
+        row.vouchPolicyRevision !== payload.target.vouchPolicyRevision ||
+        JSON.stringify(ownerKinds) !== JSON.stringify(payload.target.ownerKinds)) {
+        throw makeNodeRuntimeError("storage_corrupt", "The persisted integration plan duplicated columns do not match plan_json.");
+    }
+};
+const assertCanonicalPayloadConsistency = (row, payload) => {
+    const canonicalJson = JSON.stringify(payload);
+    const canonicalBytes = Buffer.byteLength(canonicalJson, "utf8");
+    const canonicalDigest = createHash("sha256")
+        .update(canonicalJson)
+        .digest("hex");
+    if (row.planJson !== canonicalJson ||
+        row.planBytes !== canonicalBytes ||
+        row.planDigest !== canonicalDigest) {
+        throw makeNodeRuntimeError("storage_corrupt", "The persisted integration plan bytes or digest are inconsistent.");
+    }
+    if (canonicalBytes <= 0 || canonicalBytes > PLAN_MAX_BYTES) {
+        throw makeNodeRuntimeError("storage_corrupt", "The persisted integration plan exceeds the storage byte contract.");
+    }
+};
+export const requirePlanRowIntegrity = (row) => {
+    validatePlanColumns(row);
+    const payload = parsePersistedPlanPayload(row.planJson);
+    assertPlanColumnsMatchPayload(row, payload);
+    assertCanonicalPayloadConsistency(row, payload);
+    return row;
+};
+//# sourceMappingURL=plan-integrity.js.map

package/dist/runtime/process/resource/integration-authorization/plan-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-integrity.js","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/plan-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,GAGlB,MAAM,YAAY,CAAC;AAEpB,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAU,CAAC;AACrD,MAAM,gBAAgB,GAAG;IACvB,SAAS;IACT,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,uBAAuB;IACvB,qBAAqB;CACb,CAAC;AACX,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAU,CAAC;AAqBrE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,KAAa,EAAc,EAAE;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,GAAG,KAAK,qBAAqB,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,KAAmB,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CACtB,MAAkB,EAClB,QAA2B,EAC3B,KAAa,EACP,EAAE;IACR,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9C,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChD,IACE,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,EAC1D,CAAC;QACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,GAAG,KAAK,kCAAkC,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,MAAkB,EAAE,GAAW,EAAE,KAAa,EAAU,EAAE;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,GAAG,KAAK,+BAA+B,GAAG,IAAI,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAI,GAAY,EAAE,KAAa,EAAK,EAAE;IACtE,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACzE,MAAM,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAA6B,EAAE;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;YAC5D,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,yBAAyB,CAC9B,GAAG,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAClC,wDAAwD,CACzD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,MAAkB,EAAU,EAAE,CAC/D,yBAAyB,CACvB,GAAG,EAAE,CACH,sBAAsB,CACpB,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,6BAA6B,CAAC,EACnE,gDAAgD,CACjD,EACH,4DAA4D,CAC7D,CAAC;AAEJ,MAAM,uBAAuB,GAAG,CAC9B,QAAoB,EACpB,GAAqC,EAC7B,EAAE;IACV,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACnE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,6BAA6B,GAAG,CACpC,MAAkB,EACgC,EAAE;IACpD,MAAM,QAAQ,GAAG,QAAQ,CACvB,MAAM,CAAC,kBAAkB,EACzB,yBAAyB,CAC1B,CAAC;IACF,eAAe,CAAC,QAAQ,EAAE,kBAAkB,EAAE,yBAAyB,CAAC,CAAC;IACzE,OAAO;QACL,MAAM,EAAE,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACnD,KAAK,EAAE,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC;QACjD,SAAS,EAAE,uBAAuB,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC1D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,MAAkB,EAAU,EAAE,CAC/D,yBAAyB,CACvB,GAAG,EAAE,CACH,kBAAkB,CAChB,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,6BAA6B,CAAC,EACnE,gDAAgD,CACjD,EACH,4DAA4D,CAC7D,CAAC;AAEJ,MAAM,2BAA2B,GAAG,CAAC,MAAkB,EAAU,EAAE,CACjE,yBAAyB,CACvB,GAAG,EAAE,CACH,gBAAgB,CACd,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,6BAA6B,CAAC,EACrE,kDAAkD,CACnD,EACH,8DAA8D,CAC/D,CAAC;AAEJ,MAAM,0BAA0B,GAAG,CAAC,MAAkB,EAAU,EAAE,CAChE,yBAAyB,CACvB,GAAG,EAAE,CACH,sBAAsB,CACpB,UAAU,CACR,MAAM,EACN,uBAAuB,EACvB,6BAA6B,CAC9B,EACD,wDAAwD,CACzD,EACH,oEAAoE,CACrE,CAAC;AAEJ,MAAM,wBAAwB,GAAG,CAAC,MAAkB,EAAU,EAAE,CAC9D,yBAAyB,CACvB,GAAG,EAAE,CACH,sBAAsB,CACpB,UAAU,CACR,MAAM,EACN,qBAAqB,EACrB,6BAA6B,CAC9B,EACD,sDAAsD,CACvD,EACH,kEAAkE,CACnE,CAAC;AAEJ,MAAM,oBAAoB,GAAG,CAAC,IAAgB,EAA8B,EAAE;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACpE,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,6BAA6B,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,6BAA6B,CAAC,CAAC;IAC7E,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO;QACP,cAAc,EAAE,yBAAyB,CAAC,MAAM,CAAC;QACjD,kBAAkB,EAAE,6BAA6B,CAAC,MAAM,CAAC;QACzD,cAAc,EAAE,yBAAyB,CAAC,MAAM,CAAC;QACjD,gBAAgB,EAAE,2BAA2B,CAAC,MAAM,CAAC;QACrD,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC;QACrD,qBAAqB,EAAE,0BAA0B,CAAC,MAAM,CAAC;QACzD,mBAAmB,EAAE,wBAAwB,CAAC,MAAM,CAAC;KACtD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,QAAgB,EACE,EAAE;IACpB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IAC/D,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,UAAU,CAC5B,IAAI,EACJ,aAAa,EACb,8BAA8B,CAC/B,CAAC;IACF,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7D,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,GAAY,EAAQ,EAAE;IACpD,yBAAyB,CACvB,GAAG,EAAE,CACH,wBAAwB,CACtB,GAAG,CAAC,MAAM,EACV,2CAA2C,CAC5C,EACH,uDAAuD,CACxD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,6BAA6B,GAAG,CAAC,GAAY,EAAQ,EAAE;IAC3D,yBAAyB,CACvB,GAAG,EAAE,CACH,kBAAkB,CAChB,GAAG,CAAC,cAAc,EAClB,gDAAgD,CACjD,EACH,4DAA4D,CAC7D,CAAC;IACF,yBAAyB,CACvB,GAAG,EAAE,CACH,gBAAgB,CACd,GAAG,CAAC,gBAAgB,EACpB,kDAAkD,CACnD,EACH,8DAA8D,CAC/D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,GAAY,EAAQ,EAAE;IACvD,yBAAyB,CACvB,GAAG,EAAE,CACH,sBAAsB,CACpB,GAAG,CAAC,cAAc,EAClB,gDAAgD,CACjD,EACH,4DAA4D,CAC7D,CAAC;IACF,yBAAyB,CACvB,GAAG,EAAE,CACH,sBAAsB,CACpB,GAAG,CAAC,qBAAqB,EACzB,wDAAwD,CACzD,EACH,oEAAoE,CACrE,CAAC;IACF,yBAAyB,CACvB,GAAG,EAAE,CACH,sBAAsB,CACpB,GAAG,CAAC,mBAAmB,EACvB,sDAAsD,CACvD,EACH,kEAAkE,CACnE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,GAAY,EAAQ,EAAE;IACtD,yBAAyB,CACvB,GAAG,EAAE,CACH,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,uCAAuC,CAAC,EAC3E,mDAAmD,CACpD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,GAAY,EAAQ,EAAE;IACjD,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5B,6BAA6B,CAAC,GAAG,CAAC,CAAC;IACnC,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC/B,wBAAwB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,6BAA6B,GAAG,CACpC,GAAY,EACZ,OAAyB,EACnB,EAAE;IACR,IACE,GAAG,CAAC,WAAW,KAAK,iBAAiB;QACrC,GAAG,CAAC,aAAa,KAAK,iBAAiB;QACvC,GAAG,CAAC,WAAW,KAAK,CAAC,EACrB,CAAC;QACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IACE,GAAG,CAAC,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,cAAc;QACpD,GAAG,CAAC,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,cAAc;QACpD,GAAG,CAAC,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,gBAAgB;QACxD,GAAG,CAAC,qBAAqB,KAAK,OAAO,CAAC,MAAM,CAAC,qBAAqB;QAClE,GAAG,CAAC,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,mBAAmB;QAC9D,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EACxE,CAAC;QACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iCAAiC,GAAG,CACxC,GAAY,EACZ,OAAyB,EACnB,EAAE;IACR,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;SACzC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,IACE,GAAG,CAAC,QAAQ,KAAK,aAAa;QAC9B,GAAG,CAAC,SAAS,KAAK,cAAc;QAChC,GAAG,CAAC,UAAU,KAAK,eAAe,EAClC,CAAC;QACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,IAAI,CAAC,IAAI,cAAc,GAAG,cAAc,EAAE,CAAC;QAC3D,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAY,EAAW,EAAE;IAC/D,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxD,6BAA6B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,iCAAiC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC"}

package/dist/runtime/process/resource/integration-authorization/plan-payload.d.ts

@@ -0,0 +1,31 @@
+import { type CodexOwnerKind } from "./types.js";
+export declare const canonicalPlanPayload: (input: {
+    readonly adapterVersion: string;
+    readonly executableIdentity: {
+        readonly device: string;
+        readonly inode: string;
+        readonly sizeBytes: string;
+    };
+    readonly executablePath: string;
+    readonly executableSha256: string;
+    readonly ownerKinds: readonly CodexOwnerKind[];
+    readonly sandboxPolicyRevision: string;
+    readonly vouchPolicyRevision: string;
+}) => {
+    integration: string;
+    target: {
+        adapter: string;
+        adapterVersion: string;
+        executableIdentity: {
+            readonly device: string;
+            readonly inode: string;
+            readonly sizeBytes: string;
+        };
+        executablePath: string;
+        executableSha256: string;
+        ownerKinds: readonly ("codex-probe" | "codex-session")[];
+        sandboxPolicyRevision: string;
+        vouchPolicyRevision: string;
+    };
+};
+//# sourceMappingURL=plan-payload.d.ts.map

package/dist/runtime/process/resource/integration-authorization/plan-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-payload.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/plan-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpE,eAAO,MAAM,oBAAoB,GAAI,OAAO;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;;;;;;6BAToB,MAAM;4BACP,MAAM;gCACF,MAAM;;;;;;;;CAmB5B,CAAC"}

package/dist/runtime/process/resource/integration-authorization/plan-payload.js

@@ -0,0 +1,15 @@
+import { CODEX_INTEGRATION } from "./types.js";
+export const canonicalPlanPayload = (input) => ({
+    integration: CODEX_INTEGRATION,
+    target: {
+        adapter: CODEX_INTEGRATION,
+        adapterVersion: input.adapterVersion,
+        executableIdentity: input.executableIdentity,
+        executablePath: input.executablePath,
+        executableSha256: input.executableSha256,
+        ownerKinds: input.ownerKinds,
+        sandboxPolicyRevision: input.sandboxPolicyRevision,
+        vouchPolicyRevision: input.vouchPolicyRevision,
+    },
+});
+//# sourceMappingURL=plan-payload.js.map

package/dist/runtime/process/resource/integration-authorization/plan-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-payload.js","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/plan-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAuB,MAAM,YAAY,CAAC;AAEpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAYpC,EAAE,EAAE,CAAC,CAAC;IACL,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE;QACN,OAAO,EAAE,iBAAiB;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C;CACF,CAAC,CAAC"}

package/dist/runtime/process/resource/integration-authorization/plan-store.d.ts

@@ -0,0 +1,11 @@
+import type { DatabaseSync } from "node:sqlite";
+import { type CodexIntegrationPlanRecord, type CodexIntegrationPlanTarget, type CommandInput, type ReplayResult } from "./types.js";
+export declare const createCodexIntegrationPlan: (database: DatabaseSync, input: CommandInput & {
+    readonly planId: string;
+    readonly target: CodexIntegrationPlanTarget;
+}) => ReplayResult<{
+    readonly method: "integration.plan.codex";
+    readonly plan: CodexIntegrationPlanRecord;
+}>;
+export declare const readCodexPlan: (database: DatabaseSync, planId: string) => CodexIntegrationPlanRecord | undefined;
+//# sourceMappingURL=plan-store.d.ts.map

package/dist/runtime/process/resource/integration-authorization/plan-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-store.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/plan-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmBhD,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAE/B,KAAK,YAAY,EAEjB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AAqOpB,eAAO,MAAM,0BAA0B,GACrC,UAAU,YAAY,EACtB,OAAO,YAAY,GAAG;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAC7C,KACA,YAAY,CAAC;IACd,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;CAC3C,CAGE,CAAC;AAEJ,eAAO,MAAM,aAAa,GACxB,UAAU,YAAY,EACtB,QAAQ,MAAM,KACb,0BAA0B,GAAG,SAQ/B,CAAC"}

package/dist/runtime/process/resource/integration-authorization/plan-store.js

@@ -0,0 +1,124 @@
+import { createHash } from "node:crypto";
+import { makeNodeRuntimeError } from "../../../errors.js";
+import { readPlan } from "./database.js";
+import { canonicalPlanPayload } from "./plan-payload.js";
+import { normalizeOwnerKinds, parseNodeClockRecordedAtMs, PLAN_MAX_BYTES, PLAN_TTL_MS, plusMilliseconds, requireBoundedIdentifier, requireBoundedPath, requireBoundedRevision, requireHexDigest, } from "./policy.js";
+import { projectPlan } from "./projection.js";
+import { withReplay } from "./replay-store.js";
+import { CODEX_INTEGRATION, } from "./types.js";
+const requireFilesystemIdentity = (value, label) => {
+    if (!/^[0-9]{1,20}$/u.test(value)) {
+        throw makeNodeRuntimeError("storage_failed", `${label} must be an unsigned decimal filesystem identity.`);
+    }
+    return value;
+};
+const validateTargetIdentity = (target) => ({
+    executableIdentity: {
+        device: requireFilesystemIdentity(target.executableIdentity.device, "The Codex executable device"),
+        inode: requireFilesystemIdentity(target.executableIdentity.inode, "The Codex executable inode"),
+        sizeBytes: requireFilesystemIdentity(target.executableIdentity.sizeBytes, "The Codex executable size"),
+    },
+    executablePath: requireBoundedPath(target.executablePath, "The Codex executable path"),
+    executableSha256: requireHexDigest(target.executableSha256, "The Codex executable digest"),
+    ownerKinds: normalizeOwnerKinds(target.ownerKinds),
+});
+const validateTargetPolicy = (target) => ({
+    adapterVersion: requireBoundedRevision(target.adapterVersion, "The Codex adapter version"),
+    sandboxPolicyRevision: requireBoundedRevision(target.sandboxPolicyRevision, "The Codex sandbox policy revision"),
+    vouchPolicyRevision: requireBoundedRevision(target.vouchPolicyRevision, "The Codex vouch policy revision"),
+});
+const validatePlanTarget = (target) => ({
+    ...validateTargetIdentity(target),
+    ...validateTargetPolicy(target),
+});
+const createPlanDigest = (planJson) => createHash("sha256").update(planJson).digest("hex");
+const assertPlanBytesWithinLimit = (planBytes) => {
+    if (planBytes <= PLAN_MAX_BYTES) {
+        return;
+    }
+    throw makeNodeRuntimeError("storage_failed", "The integration plan exceeds the 8 KiB storage contract.");
+};
+const parsePlanIdentity = (input) => ({
+    createdAtMs: parseNodeClockRecordedAtMs(input.recordedAt, "The integration plan creation timestamp"),
+    planId: requireBoundedIdentifier(input.planId, "The integration plan identifier"),
+});
+const buildPlanInsertCandidate = (input) => {
+    const identity = parsePlanIdentity(input);
+    const target = validatePlanTarget(input.target);
+    const planJson = JSON.stringify(canonicalPlanPayload(target));
+    const planBytes = Buffer.byteLength(planJson, "utf8");
+    assertPlanBytesWithinLimit(planBytes);
+    return {
+        createdAtMs: identity.createdAtMs,
+        expiresAt: plusMilliseconds(input.recordedAt, PLAN_TTL_MS),
+        expiresAtMs: identity.createdAtMs + PLAN_TTL_MS,
+        planBytes,
+        planDigest: createPlanDigest(planJson),
+        planId: identity.planId,
+        planJson,
+        target,
+    };
+};
+const assertExistingPlanCompatible = (existing, candidate) => {
+    if (existing.planDigest === candidate.planDigest &&
+        existing.planJson === candidate.planJson) {
+        return;
+    }
+    throw makeNodeRuntimeError("storage_conflict", "The integration plan identifier already exists with different content.");
+};
+const buildInsertPlanParameters = (recordedAt, candidate) => [
+    candidate.planId,
+    CODEX_INTEGRATION,
+    CODEX_INTEGRATION,
+    candidate.target.executablePath,
+    candidate.target.executableSha256,
+    candidate.target.adapterVersion,
+    JSON.stringify(candidate.target.ownerKinds),
+    candidate.target.sandboxPolicyRevision,
+    candidate.target.vouchPolicyRevision,
+    candidate.planJson,
+    candidate.planDigest,
+    candidate.planBytes,
+    recordedAt,
+    candidate.createdAtMs,
+    candidate.expiresAt,
+    candidate.expiresAtMs,
+];
+const insertPlan = (database, recordedAt, candidate) => {
+    const parameters = buildInsertPlanParameters(recordedAt, candidate);
+    database
+        .prepare(`INSERT INTO integration_authorization_plans(
+          plan_id, integration, target_count, target_adapter, executable_path,
+          executable_sha256, adapter_version, owner_kinds_json,
+          sandbox_policy_revision, vouch_policy_revision, plan_json, plan_digest,
+          plan_bytes, created_at, created_at_ms, expires_at, expires_at_ms
+        ) VALUES (?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(...parameters);
+};
+const loadPlanOrCorrupt = (database, planId) => {
+    const inserted = readPlan(database, planId);
+    if (inserted !== undefined) {
+        return inserted;
+    }
+    throw makeNodeRuntimeError("storage_corrupt", "The integration plan was not persisted.");
+};
+const runCreateCodexIntegrationPlan = (database, input) => {
+    const candidate = buildPlanInsertCandidate(input);
+    const existing = readPlan(database, candidate.planId);
+    if (existing !== undefined) {
+        assertExistingPlanCompatible(existing, candidate);
+        return { method: "integration.plan.codex", plan: projectPlan(existing) };
+    }
+    insertPlan(database, input.recordedAt, candidate);
+    const inserted = loadPlanOrCorrupt(database, candidate.planId);
+    return { method: "integration.plan.codex", plan: projectPlan(inserted) };
+};
+export const createCodexIntegrationPlan = (database, input) => withReplay(database, { ...input, method: "integration.plan.codex" }, () => runCreateCodexIntegrationPlan(database, input));
+export const readCodexPlan = (database, planId) => {
+    const validatedPlanId = requireBoundedIdentifier(planId, "The integration plan identifier");
+    const plan = readPlan(database, validatedPlanId);
+    if (plan === undefined)
+        return undefined;
+    return projectPlan(plan);
+};
+//# sourceMappingURL=plan-store.js.map

package/dist/runtime/process/resource/integration-authorization/plan-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-store.js","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/plan-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,iBAAiB,GAOlB,MAAM,YAAY,CAAC;AAuBpB,MAAM,yBAAyB,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE;IACzE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,GAAG,KAAK,mDAAmD,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,MAAkC,EAIlC,EAAE,CAAC,CAAC;IACJ,kBAAkB,EAAE;QAClB,MAAM,EAAE,yBAAyB,CAC/B,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAChC,6BAA6B,CAC9B;QACD,KAAK,EAAE,yBAAyB,CAC9B,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAC/B,4BAA4B,CAC7B;QACD,SAAS,EAAE,yBAAyB,CAClC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EACnC,2BAA2B,CAC5B;KACF;IACD,cAAc,EAAE,kBAAkB,CAChC,MAAM,CAAC,cAAc,EACrB,2BAA2B,CAC5B;IACD,gBAAgB,EAAE,gBAAgB,CAChC,MAAM,CAAC,gBAAgB,EACvB,6BAA6B,CAC9B;IACD,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAC3B,MAAkC,EAIlC,EAAE,CAAC,CAAC;IACJ,cAAc,EAAE,sBAAsB,CACpC,MAAM,CAAC,cAAc,EACrB,2BAA2B,CAC5B;IACD,qBAAqB,EAAE,sBAAsB,CAC3C,MAAM,CAAC,qBAAqB,EAC5B,mCAAmC,CACpC;IACD,mBAAmB,EAAE,sBAAsB,CACzC,MAAM,CAAC,mBAAmB,EAC1B,iCAAiC,CAClC;CACF,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CACzB,MAAkC,EACb,EAAE,CAAC,CAAC;IACzB,GAAG,sBAAsB,CAAC,MAAM,CAAC;IACjC,GAAG,oBAAoB,CAAC,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACpD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEtD,MAAM,0BAA0B,GAAG,CAAC,SAAiB,EAAQ,EAAE;IAC7D,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,0DAA0D,CAC3D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,KAAiD,EACU,EAAE,CAAC,CAAC;IAC/D,WAAW,EAAE,0BAA0B,CACrC,KAAK,CAAC,UAAU,EAChB,yCAAyC,CAC1C;IACD,MAAM,EAAE,wBAAwB,CAC9B,KAAK,CAAC,MAAM,EACZ,iCAAiC,CAClC;CACF,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAC/B,KAGC,EACoB,EAAE;IACvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC;QAC1D,WAAW,EAAE,QAAQ,CAAC,WAAW,GAAG,WAAW;QAC/C,SAAS;QACT,UAAU,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,CACnC,QAAiB,EACjB,SAA8B,EACxB,EAAE;IACR,IACE,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;QAC5C,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EACxC,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,wEAAwE,CACzE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAChC,UAAkB,EAClB,SAA8B,EAC9B,EAAE,CACF;IACE,SAAS,CAAC,MAAM;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,SAAS,CAAC,MAAM,CAAC,cAAc;IAC/B,SAAS,CAAC,MAAM,CAAC,gBAAgB;IACjC,SAAS,CAAC,MAAM,CAAC,cAAc;IAC/B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;IAC3C,SAAS,CAAC,MAAM,CAAC,qBAAqB;IACtC,SAAS,CAAC,MAAM,CAAC,mBAAmB;IACpC,SAAS,CAAC,QAAQ;IAClB,SAAS,CAAC,UAAU;IACpB,SAAS,CAAC,SAAS;IACnB,UAAU;IACV,SAAS,CAAC,WAAW;IACrB,SAAS,CAAC,SAAS;IACnB,SAAS,CAAC,WAAW;CACb,CAAC;AAEb,MAAM,UAAU,GAAG,CACjB,QAAsB,EACtB,UAAkB,EAClB,SAA8B,EACxB,EAAE;IACR,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACpE,QAAQ;SACL,OAAO,CACN;;;;;qEAK+D,CAChE;SACA,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,QAAsB,EAAE,MAAc,EAAW,EAAE;IAC5E,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,yCAAyC,CAC1C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,6BAA6B,GAAG,CACpC,QAAsB,EACtB,KAGC,EAID,EAAE;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,4BAA4B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3E,CAAC;IACD,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3E,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,QAAsB,EACtB,KAGC,EAIA,EAAE,CACH,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,GAAG,EAAE,CACxE,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAC/C,CAAC;AAEJ,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,QAAsB,EACtB,MAAc,EAC0B,EAAE;IAC1C,MAAM,eAAe,GAAG,wBAAwB,CAC9C,MAAM,EACN,iCAAiC,CAClC,CAAC;IACF,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC"}

package/dist/runtime/process/resource/integration-authorization/policy.d.ts

@@ -0,0 +1,37 @@
+import { type CodexOwnerKind, type CommandInput } from "./types.js";
+export declare const PLAN_TTL_MS: number;
+export declare const PLAN_MAX_BYTES: number;
+export declare const PERMIT_EXPIRY_MS: number;
+export declare const MAX_UNSETTLED_PER_AUTHORIZATION = 8;
+export declare const MAX_TERMINAL_PERMITS = 10000;
+export declare const TERMINAL_RETENTION_MS: number;
+export declare const MAX_IDENTIFIER_BYTES = 128;
+export declare const MAX_EXECUTABLE_PATH_BYTES = 4096;
+export declare const MAX_REQUEST_DIGEST_BYTES = 128;
+export declare const MAX_REVISION_BYTES = 128;
+export declare const requireBoundedIdentifier: (value: string, label: string) => string;
+export declare const requireBoundedPath: (value: string, label: string) => string;
+export declare const requireBoundedRevision: (value: string, label: string) => string;
+export declare const requireBoundedRequestDigest: (value: string) => string;
+export declare const requireHexDigest: (value: string, label: string) => string;
+export declare const parseJson: (value: string, label: string) => unknown;
+export declare const normalizeOwnerKinds: (ownerKinds: readonly string[]) => readonly CodexOwnerKind[];
+export declare const parseOwnerKindsJson: (value: string) => readonly CodexOwnerKind[];
+export declare const requireCommandInput: (input: CommandInput) => void;
+export declare const parseNodeClockRecordedAtMs: (value: string, label: string) => number;
+export declare const plusMilliseconds: (value: string, deltaMs: number) => string;
+export declare const requireMonotonicTimestamp: (recordedAtMs: number, minimumMs: number, label: string) => void;
+export declare const parseAuthorizationRevision: (value: string) => number;
+export declare const integrationAuthorizationStoragePolicy: {
+    readonly maxExecutablePathBytes: 4096;
+    readonly maxIdentifierBytes: 128;
+    readonly maxPlanBytes: number;
+    readonly maxRequestDigestBytes: 128;
+    readonly maxRevisionBytes: 128;
+    readonly maxTerminalPermits: 10000;
+    readonly maxUnsettledPermitsPerAuthorization: 8;
+    readonly permitExpiryMs: number;
+    readonly planTtlMs: number;
+    readonly terminalRetentionMs: number;
+};
+//# sourceMappingURL=policy.d.ts.map

package/dist/runtime/process/resource/integration-authorization/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/policy.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,WAAW,QAAgB,CAAC;AACzC,eAAO,MAAM,cAAc,QAAW,CAAC;AACvC,eAAO,MAAM,gBAAgB,QAAW,CAAC;AACzC,eAAO,MAAM,+BAA+B,IAAI,CAAC;AACjD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,eAAO,MAAM,qBAAqB,QAA2B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAC5C,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAyBtC,eAAO,MAAM,wBAAwB,GACnC,OAAO,MAAM,EACb,OAAO,MAAM,KACZ,MASF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,MAI/D,CAAC;AAkBJ,eAAO,MAAM,sBAAsB,GACjC,OAAO,MAAM,EACb,OAAO,MAAM,KACZ,MASF,CAAC;AAEF,eAAO,MAAM,2BAA2B,GAAI,OAAO,MAAM,KAAG,MAa3D,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,MAQ/D,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,OASxD,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC9B,YAAY,SAAS,MAAM,EAAE,KAC5B,SAAS,cAAc,EACiC,CAAC;AAoD5D,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,SAAS,cAAc,EAIxE,CAAC;AAEJ,eAAO,MAAM,mBAAmB,GAAI,OAAO,YAAY,KAAG,IAUzD,CAAC;AAKF,eAAO,MAAM,0BAA0B,GACrC,OAAO,MAAM,EACb,OAAO,MAAM,KACZ,MAMF,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,KAAG,MAGjD,CAAC;AAElB,eAAO,MAAM,yBAAyB,GACpC,cAAc,MAAM,EACpB,WAAW,MAAM,EACjB,OAAO,MAAM,KACZ,IAQF,CAAC;AAEF,eAAO,MAAM,0BAA0B,GAAI,OAAO,MAAM,KAAG,MAe1D,CAAC;AAEF,eAAO,MAAM,qCAAqC;;;;;;;;;;;CAWxC,CAAC"}

package/dist/runtime/process/resource/integration-authorization/policy.js

@@ -0,0 +1,141 @@
+import { isAbsolute, normalize } from "node:path";
+import { makeNodeRuntimeError } from "../../../errors.js";
+import { CODEX_OWNER_KINDS, } from "./types.js";
+export const PLAN_TTL_MS = 5 * 60 * 1000;
+export const PLAN_MAX_BYTES = 8 * 1024;
+export const PERMIT_EXPIRY_MS = 2 * 1000;
+export const MAX_UNSETTLED_PER_AUTHORIZATION = 8;
+export const MAX_TERMINAL_PERMITS = 10_000;
+export const TERMINAL_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
+export const MAX_IDENTIFIER_BYTES = 128;
+export const MAX_EXECUTABLE_PATH_BYTES = 4096;
+export const MAX_REQUEST_DIGEST_BYTES = 128;
+export const MAX_REVISION_BYTES = 128;
+const HEX_64_PATTERN = /^[0-9a-f]{64}$/u;
+const SAFE_IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u;
+const SAFE_DIGEST_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u;
+const utf8Bytes = (value) => Buffer.byteLength(value, "utf8");
+const boundedText = (value, maximumBytes) => value.length > 0 && utf8Bytes(value) <= maximumBytes && !value.includes("\0");
+const requireBoundedText = (value, label, maximumBytes) => {
+    if (!boundedText(value, maximumBytes)) {
+        throw makeNodeRuntimeError("storage_failed", `${label} must be non-empty UTF-8 text <= ${String(maximumBytes)} bytes.`);
+    }
+    return value;
+};
+export const requireBoundedIdentifier = (value, label) => {
+    requireBoundedText(value, label, MAX_IDENTIFIER_BYTES);
+    if (!SAFE_IDENTIFIER_PATTERN.test(value)) {
+        throw makeNodeRuntimeError("storage_failed", `${label} has invalid characters.`);
+    }
+    return value;
+};
+export const requireBoundedPath = (value, label) => requireCanonicalAbsolutePath(requireBoundedText(value, label, MAX_EXECUTABLE_PATH_BYTES), label);
+const requireCanonicalAbsolutePath = (value, label) => {
+    if (!isAbsolute(value) || !value.startsWith("/")) {
+        throw makeNodeRuntimeError("storage_failed", `${label} must be an absolute canonical path.`);
+    }
+    if (normalize(value) !== value) {
+        throw makeNodeRuntimeError("storage_failed", `${label} must be normalized without dot segments.`);
+    }
+    return value;
+};
+export const requireBoundedRevision = (value, label) => {
+    requireBoundedText(value, label, MAX_REVISION_BYTES);
+    if (!SAFE_IDENTIFIER_PATTERN.test(value)) {
+        throw makeNodeRuntimeError("storage_failed", `${label} has invalid characters.`);
+    }
+    return value;
+};
+export const requireBoundedRequestDigest = (value) => {
+    requireBoundedText(value, "The integration command request digest", MAX_REQUEST_DIGEST_BYTES);
+    if (!SAFE_DIGEST_PATTERN.test(value)) {
+        throw makeNodeRuntimeError("storage_failed", "The integration command request digest has invalid characters.");
+    }
+    return value;
+};
+export const requireHexDigest = (value, label) => {
+    if (!HEX_64_PATTERN.test(value)) {
+        throw makeNodeRuntimeError("storage_failed", `${label} must be a lowercase SHA-256 hex digest.`);
+    }
+    return value;
+};
+export const parseJson = (value, label) => {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        throw makeNodeRuntimeError("storage_corrupt", `${label} is not valid JSON.`);
+    }
+};
+export const normalizeOwnerKinds = (ownerKinds) => normalizeOwnerKindsWithCode(ownerKinds, "storage_failed");
+const normalizeOwnerKindsWithCode = (ownerKinds, code) => {
+    const normalized = [...new Set(ownerKinds)].sort();
+    if (normalized.length !== ownerKinds.length) {
+        throw makeNodeRuntimeError(code, "The Codex target owner-kind allowlist contains duplicates.");
+    }
+    if (normalized.length === 0 ||
+        normalized.length > CODEX_OWNER_KINDS.length ||
+        normalized.some((entry) => !CODEX_OWNER_KINDS.includes(entry))) {
+        throw makeNodeRuntimeError(code, "The Codex target owner-kind allowlist is invalid.");
+    }
+    return normalized;
+};
+const parseOwnerKindsArray = (value) => {
+    if (!Array.isArray(value)) {
+        throw makeNodeRuntimeError("storage_corrupt", "The owner kinds JSON must decode to an array.");
+    }
+    return value.map((entry) => {
+        if (typeof entry !== "string") {
+            throw makeNodeRuntimeError("storage_corrupt", "The owner kinds JSON array must contain strings only.");
+        }
+        if (!boundedText(entry, MAX_IDENTIFIER_BYTES)) {
+            throw makeNodeRuntimeError("storage_corrupt", "The owner kinds JSON contains an invalid entry.");
+        }
+        return entry;
+    });
+};
+export const parseOwnerKindsJson = (value) => normalizeOwnerKindsWithCode(parseOwnerKindsArray(parseJson(value, "The owner kinds JSON")), "storage_corrupt");
+export const requireCommandInput = (input) => {
+    requireBoundedIdentifier(input.commandId, "The integration command identifier");
+    requireBoundedRequestDigest(input.requestDigest);
+    parseNodeClockRecordedAtMs(input.recordedAt, "The integration command timestamp");
+};
+// recordedAt values are node-clock timestamps captured by the private node
+// application service boundary. This storage layer treats them as trusted node
+// clock input and rejects any backward lifecycle transitions.
+export const parseNodeClockRecordedAtMs = (value, label) => {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed)) {
+        throw makeNodeRuntimeError("storage_failed", `${label} must be ISO-8601.`);
+    }
+    return Math.trunc(parsed);
+};
+export const plusMilliseconds = (value, deltaMs) => new Date(parseNodeClockRecordedAtMs(value, "The recorded timestamp") + deltaMs).toISOString();
+export const requireMonotonicTimestamp = (recordedAtMs, minimumMs, label) => {
+    if (recordedAtMs < minimumMs) {
+        throw makeNodeRuntimeError("storage_conflict", `${label} cannot move backward in time.`, true);
+    }
+};
+export const parseAuthorizationRevision = (value) => {
+    if (!/^[1-9][0-9]*$/u.test(value)) {
+        throw makeNodeRuntimeError("storage_failed", "The authorization revision is invalid.");
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        throw makeNodeRuntimeError("storage_failed", "The authorization revision is invalid.");
+    }
+    return parsed;
+};
+export const integrationAuthorizationStoragePolicy = {
+    maxExecutablePathBytes: MAX_EXECUTABLE_PATH_BYTES,
+    maxIdentifierBytes: MAX_IDENTIFIER_BYTES,
+    maxPlanBytes: PLAN_MAX_BYTES,
+    maxRequestDigestBytes: MAX_REQUEST_DIGEST_BYTES,
+    maxRevisionBytes: MAX_REVISION_BYTES,
+    maxTerminalPermits: MAX_TERMINAL_PERMITS,
+    maxUnsettledPermitsPerAuthorization: MAX_UNSETTLED_PER_AUTHORIZATION,
+    permitExpiryMs: PERMIT_EXPIRY_MS,
+    planTtlMs: PLAN_TTL_MS,
+    terminalRetentionMs: TERMINAL_RETENTION_MS,
+};
+//# sourceMappingURL=policy.js.map

package/dist/runtime/process/resource/integration-authorization/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EACL,iBAAiB,GAGlB,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC;AACzC,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,uBAAuB,GAAG,gCAAgC,CAAC;AACjE,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAE7D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAE9E,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,YAAoB,EAAW,EAAE,CACnE,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,YAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEhF,MAAM,kBAAkB,GAAG,CACzB,KAAa,EACb,KAAa,EACb,YAAoB,EACZ,EAAE;IACV,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QACtC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,GAAG,KAAK,oCAAoC,MAAM,CAAC,YAAY,CAAC,SAAS,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,KAAa,EACb,KAAa,EACL,EAAE;IACV,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACvD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,GAAG,KAAK,0BAA0B,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CACzE,4BAA4B,CAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,yBAAyB,CAAC,EAC3D,KAAK,CACN,CAAC;AAEJ,MAAM,4BAA4B,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE;IAC5E,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,GAAG,KAAK,sCAAsC,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,GAAG,KAAK,2CAA2C,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAAa,EACb,KAAa,EACL,EAAE;IACV,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACrD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,GAAG,KAAK,0BAA0B,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,KAAa,EAAU,EAAE;IACnE,kBAAkB,CAChB,KAAK,EACL,wCAAwC,EACxC,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE;IACvE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,GAAG,KAAK,0CAA0C,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa,EAAW,EAAE;IACjE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,GAAG,KAAK,qBAAqB,CAC9B,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,UAA6B,EACF,EAAE,CAC7B,2BAA2B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;AAE5D,MAAM,2BAA2B,GAAG,CAClC,UAA6B,EAC7B,IAA0C,EACf,EAAE;IAC7B,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,oBAAoB,CACxB,IAAI,EACJ,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,MAAM,GAAG,iBAAiB,CAAC,MAAM;QAC5C,UAAU,CAAC,IAAI,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAuB,CAAC,CAChE,EACD,CAAC;QACD,MAAM,oBAAoB,CACxB,IAAI,EACJ,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,UAAuC,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAqB,EAAE;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;YAC9C,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAA6B,EAAE,CAC9E,2BAA2B,CACzB,oBAAoB,CAAC,SAAS,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC,EAC9D,iBAAiB,CAClB,CAAC;AAEJ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAmB,EAAQ,EAAE;IAC/D,wBAAwB,CACtB,KAAK,CAAC,SAAS,EACf,oCAAoC,CACrC,CAAC;IACF,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,0BAA0B,CACxB,KAAK,CAAC,UAAU,EAChB,mCAAmC,CACpC,CAAC;AACJ,CAAC,CAAC;AAEF,2EAA2E;AAC3E,+EAA+E;AAC/E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,KAAa,EACb,KAAa,EACL,EAAE;IACV,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,oBAAoB,CAAC,gBAAgB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,OAAe,EAAU,EAAE,CACzE,IAAI,IAAI,CACN,0BAA0B,CAAC,KAAK,EAAE,wBAAwB,CAAC,GAAG,OAAO,CACtE,CAAC,WAAW,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,YAAoB,EACpB,SAAiB,EACjB,KAAa,EACP,EAAE;IACR,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;QAC7B,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,GAAG,KAAK,gCAAgC,EACxC,IAAI,CACL,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,KAAa,EAAU,EAAE;IAClE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,oBAAoB,CACxB,gBAAgB,EAChB,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,sBAAsB,EAAE,yBAAyB;IACjD,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,wBAAwB;IAC/C,gBAAgB,EAAE,kBAAkB;IACpC,kBAAkB,EAAE,oBAAoB;IACxC,mCAAmC,EAAE,+BAA+B;IACpE,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,mBAAmB,EAAE,qBAAqB;CAClC,CAAC"}

package/dist/runtime/process/resource/integration-authorization/projection.d.ts

@@ -0,0 +1,5 @@
+import type { AuthorizationProjection, AuthorizationRow, CodexIntegrationPlanRecord, PermitProjection, PermitRow, PlanRow } from "./types.js";
+export declare const projectAuthorization: (row: AuthorizationRow) => AuthorizationProjection;
+export declare const projectPermit: (permit: PermitRow) => PermitProjection;
+export declare const projectPlan: (plan: PlanRow) => CodexIntegrationPlanRecord;
+//# sourceMappingURL=projection.d.ts.map

package/dist/runtime/process/resource/integration-authorization/projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/process/resource/integration-authorization/projection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,EAChB,SAAS,EACT,OAAO,EACR,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,oBAAoB,GAC/B,KAAK,gBAAgB,KACpB,uBAWD,CAAC;AAEH,eAAO,MAAM,aAAa,GAAI,QAAQ,SAAS,KAAG,gBAqBhD,CAAC;AAEH,eAAO,MAAM,WAAW,GAAI,MAAM,OAAO,KAAG,0BAkB1C,CAAC"}