@mannyc1/ts-release 0.0.7 → 0.2.2

package/dist/publication/authority.js

@@ -0,0 +1,233 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+const CredentialGrantTypeId = Symbol("ts-release/CredentialGrant");
+export class CredentialUnavailable extends Schema.TaggedErrorClass()("CredentialUnavailable", {
+    subject: Schema.String,
+    provider: Schema.String,
+    purpose: Schema.String,
+    reason: Schema.String
+}) {
+}
+export class CredentialAudienceMismatch extends Schema.TaggedErrorClass()("CredentialAudienceMismatch", {
+    subject: Schema.String,
+    expected: Schema.String,
+    observed: Schema.String
+}) {
+}
+export class CredentialPurposeMismatch extends Schema.TaggedErrorClass()("CredentialPurposeMismatch", {
+    subject: Schema.String,
+    required: Schema.String,
+    granted: Schema.Array(Schema.String)
+}) {
+}
+export class CredentialStrategyUnsupported extends Schema.TaggedErrorClass()("CredentialStrategyUnsupported", {
+    subject: Schema.String,
+    provider: Schema.String,
+    strategy: Schema.String,
+    reason: Schema.String
+}) {
+}
+export class CredentialSubjectMismatch extends Schema.TaggedErrorClass()("CredentialSubjectMismatch", {
+    expected: Schema.String,
+    observed: Schema.String
+}) {
+}
+export class PublisherDispatchError extends Schema.TaggedErrorClass()("PublisherDispatchError", {
+    subject: Schema.String,
+    reason: Schema.String
+}) {
+}
+export class CredentialProvider extends Context.Service()("ts-release/CredentialProvider") {
+}
+const grantMetadata = new WeakMap();
+const purposeSet = (purposes) => new Set(purposes);
+const remember = (grant) => {
+    grantMetadata.set(grant, {
+        subject: grant.subject,
+        provider: grant.provider,
+        audience: grant.audience,
+        purposes: new Set(grant.purposes)
+    });
+    return grant;
+};
+class AnonymousAccessGrant {
+    subject;
+    provider;
+    audience;
+    [CredentialGrantTypeId] = "AnonymousAccess";
+    _tag = "AnonymousAccess";
+    purposes = purposeSet(["observe"]);
+    constructor(subject, provider, audience) {
+        this.subject = subject;
+        this.provider = provider;
+        this.audience = audience;
+        Object.freeze(this);
+    }
+}
+class ScopedSecretGrant {
+    subject;
+    provider;
+    audience;
+    ref;
+    [CredentialGrantTypeId] = "ScopedSecret";
+    _tag = "ScopedSecret";
+    purposes;
+    constructor(subject, provider, audience, purposes, ref) {
+        this.subject = subject;
+        this.provider = provider;
+        this.audience = audience;
+        this.ref = ref;
+        this.purposes = purposeSet(purposes);
+        Object.freeze(this);
+    }
+}
+class WorkloadIdentityGrant {
+    subject;
+    provider;
+    audience;
+    strategy;
+    [CredentialGrantTypeId] = "WorkloadIdentity";
+    _tag = "WorkloadIdentity";
+    purposes;
+    names;
+    constructor(subject, provider, audience, purposes, names, strategy) {
+        this.subject = subject;
+        this.provider = provider;
+        this.audience = audience;
+        this.strategy = strategy;
+        this.purposes = purposeSet(purposes);
+        this.names = new Set(names);
+        Object.freeze(this);
+    }
+}
+const unsupported = (request, reason) => new CredentialStrategyUnsupported({
+    subject: request.subject,
+    provider: request.provider,
+    strategy: request.strategy.kind,
+    reason
+});
+const validatePurposes = (request, purposes) => {
+    const unique = new Set(purposes);
+    if (unique.size !== purposes.length) {
+        return Effect.fail(unsupported(request, "The host returned duplicate credential purposes."));
+    }
+    if (!unique.has(request.purpose)) {
+        return Effect.fail(new CredentialPurposeMismatch({
+            subject: request.subject,
+            required: request.purpose,
+            granted: [...unique]
+        }));
+    }
+    return Effect.succeed(unique);
+};
+const mintGrant = Effect.fn("CredentialProvider.mintGrant")(function* (request, descriptor) {
+    yield* validatePurposes(request, descriptor.purposes);
+    switch (descriptor._tag) {
+        case "AnonymousAccess":
+            if (request.strategy.kind !== "anonymous" || request.purpose !== "observe") {
+                return yield* unsupported(request, "Anonymous access is valid only for anonymous observation.");
+            }
+            return remember(new AnonymousAccessGrant(request.subject, request.provider, request.audience));
+        case "ScopedSecret":
+            if (request.strategy.kind !== "token" || descriptor.ref !== request.strategy.credential) {
+                return yield* unsupported(request, "The scoped-secret descriptor does not match the exact token strategy and credential reference.");
+            }
+            return remember(new ScopedSecretGrant(request.subject, request.provider, request.audience, descriptor.purposes, descriptor.ref));
+        case "WorkloadIdentity":
+            if (request.strategy.kind !== "trusted-publishing") {
+                return yield* unsupported(request, "Workload identity requires the prepared trusted-publishing strategy.");
+            }
+            if (new Set(descriptor.names).size !== descriptor.names.length) {
+                return yield* unsupported(request, "The certified workload environment-name set contains duplicates.");
+            }
+            return remember(new WorkloadIdentityGrant(request.subject, request.provider, request.audience, descriptor.purposes, descriptor.names, request.strategy));
+    }
+});
+/** Builds a host-friendly provider without exposing a grant constructor. */
+export const makeCredentialProvider = (host) => {
+    const acquire = Effect.fn("CredentialProvider.acquire")(function* (request) {
+        const descriptor = yield* host.acquire(request);
+        return yield* mintGrant(request, descriptor);
+    });
+    return {
+        acquireForObservation: Effect.fn("CredentialProvider.acquireForObservation")(function* (request) {
+            if (request.purpose !== "observe") {
+                return yield* new CredentialPurposeMismatch({
+                    subject: request.subject,
+                    required: "observe",
+                    granted: [request.purpose]
+                });
+            }
+            return yield* acquire(request);
+        }),
+        acquireForMutation: Effect.fn("CredentialProvider.acquireForMutation")(function* (request, decision) {
+            if (request.purpose === "observe") {
+                return yield* new CredentialPurposeMismatch({
+                    subject: request.subject,
+                    required: "publish-or-correct",
+                    granted: [request.purpose]
+                });
+            }
+            if (decision.subject !== request.subject) {
+                return yield* new CredentialSubjectMismatch({
+                    expected: request.subject,
+                    observed: decision.subject
+                });
+            }
+            const grant = yield* acquire(request);
+            if (grant._tag === "AnonymousAccess") {
+                return yield* unsupported(request, "Anonymous access cannot authorize mutation.");
+            }
+            return grant;
+        })
+    };
+};
+export class PublisherSink extends Context.Service()("ts-release/PublisherSink") {
+}
+/** Shared sink-side recheck. It trusts private issuance metadata, not fields. */
+export const validateGrantForOperation = Effect.fn("validateGrantForOperation")(function* (operation, grant) {
+    const issued = grantMetadata.get(grant);
+    if (issued === undefined) {
+        return yield* new CredentialUnavailable({
+            subject: operation.subject,
+            provider: operation.provider,
+            purpose: operation.purpose,
+            reason: "The supplied grant was not issued by this authority boundary."
+        });
+    }
+    if (issued.subject !== operation.subject) {
+        return yield* new CredentialSubjectMismatch({
+            expected: operation.subject,
+            observed: issued.subject
+        });
+    }
+    if (operation.decision.subject !== operation.subject) {
+        return yield* new CredentialSubjectMismatch({
+            expected: operation.subject,
+            observed: operation.decision.subject
+        });
+    }
+    if (issued.provider !== operation.provider || issued.audience !== operation.audience) {
+        return yield* new CredentialAudienceMismatch({
+            subject: operation.subject,
+            expected: `${operation.provider}:${operation.audience}`,
+            observed: `${issued.provider}:${issued.audience}`
+        });
+    }
+    if (!issued.purposes.has(operation.purpose)) {
+        return yield* new CredentialPurposeMismatch({
+            subject: operation.subject,
+            required: operation.purpose,
+            granted: [...issued.purposes]
+        });
+    }
+});
+/** Wraps a host dispatcher so every mutation rechecks opaque authority first. */
+export const makePublisherSink = (host) => ({
+    dispatch: Effect.fn("PublisherSink.dispatch")(function* (operation, grant) {
+        yield* validateGrantForOperation(operation, grant);
+        yield* host.dispatch(operation, grant);
+    })
+});
+//# sourceMappingURL=authority.js.map

package/dist/publication/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../src/publication/authority.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAavC,MAAM,qBAAqB,GAAkB,MAAM,CAAC,4BAA4B,CAAC,CAAA;AA0CjF,MAAM,OAAO,qBACX,SAAQ,MAAM,CAAC,gBAAgB,EAAyB,CAAC,uBAAuB,EAAE;IAChF,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC;CAAG;AAEP,MAAM,OAAO,0BACX,SAAQ,MAAM,CAAC,gBAAgB,EAA8B,CAAC,4BAA4B,EAAE;IAC1F,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM;CACxB,CAAC;CAAG;AAEP,MAAM,OAAO,yBACX,SAAQ,MAAM,CAAC,gBAAgB,EAA6B,CAAC,2BAA2B,EAAE;IACxF,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CACrC,CAAC;CAAG;AAEP,MAAM,OAAO,6BACX,SAAQ,MAAM,CAAC,gBAAgB,EAAiC,CAAC,+BAA+B,EAAE;IAChG,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC;CAAG;AAEP,MAAM,OAAO,yBACX,SAAQ,MAAM,CAAC,gBAAgB,EAA6B,CAAC,2BAA2B,EAAE;IACxF,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM;CACxB,CAAC;CAAG;AAEP,MAAM,OAAO,sBACX,SAAQ,MAAM,CAAC,gBAAgB,EAA0B,CAAC,wBAAwB,EAAE;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC;CAAG;AAyBP,MAAM,OAAO,kBACX,SAAQ,OAAO,CAAC,OAAO,EAA+C,CACpE,+BAA+B,CAChC;CAAG;AASN,MAAM,aAAa,GAAG,IAAI,OAAO,EAAkC,CAAA;AAEnE,MAAM,UAAU,GAAG,CAAC,QAA0B,EAAkC,EAAE,CAChF,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;AAEnB,MAAM,QAAQ,GAAG,CAAgC,KAAY,EAAS,EAAE;IACtE,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE;QACvB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;KAClC,CAAC,CAAA;IACF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,oBAAoB;IAMb;IACA;IACA;IAPF,CAAC,qBAAqB,CAAC,GAAG,iBAA0B,CAAA;IACpD,IAAI,GAAG,iBAA0B,CAAA;IACjC,QAAQ,GAAG,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAE3C,YACW,OAAkB,EAClB,QAAoB,EACpB,QAA2B;QAF3B,YAAO,GAAP,OAAO,CAAW;QAClB,aAAQ,GAAR,QAAQ,CAAY;QACpB,aAAQ,GAAR,QAAQ,CAAmB;QAEpC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC;CACF;AAED,MAAM,iBAAiB;IAMV;IACA;IACA;IAEA;IATF,CAAC,qBAAqB,CAAC,GAAG,cAAuB,CAAA;IACjD,IAAI,GAAG,cAAuB,CAAA;IAC9B,QAAQ,CAAgC;IAEjD,YACW,OAAkB,EAClB,QAAoB,EACpB,QAA2B,EACpC,QAA0B,EACjB,GAAkB;QAJlB,YAAO,GAAP,OAAO,CAAW;QAClB,aAAQ,GAAR,QAAQ,CAAY;QACpB,aAAQ,GAAR,QAAQ,CAAmB;QAE3B,QAAG,GAAH,GAAG,CAAe;QAE3B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC;CACF;AAED,MAAM,qBAAqB;IAOd;IACA;IACA;IAGA;IAXF,CAAC,qBAAqB,CAAC,GAAG,kBAA2B,CAAA;IACrD,IAAI,GAAG,kBAA2B,CAAA;IAClC,QAAQ,CAAgC;IACxC,KAAK,CAA8B;IAE5C,YACW,OAAkB,EAClB,QAAoB,EACpB,QAA2B,EACpC,QAA0B,EAC1B,KAA+B,EACtB,QAA+C;QAL/C,YAAO,GAAP,OAAO,CAAW;QAClB,aAAQ,GAAR,QAAQ,CAAY;QACpB,aAAQ,GAAR,QAAQ,CAAmB;QAG3B,aAAQ,GAAR,QAAQ,CAAuC;QAExD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC;CACF;AAED,MAAM,WAAW,GAAG,CAAC,OAA0B,EAAE,MAAc,EAAE,EAAE,CACjE,IAAI,6BAA6B,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC,OAAO;IACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;IAC/B,MAAM;CACP,CAAC,CAAA;AAEJ,MAAM,gBAAgB,GAAG,CACvB,OAA0B,EAC1B,QAA0B,EACgF,EAAE;IAC5G,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,kDAAkD,CAAC,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC;YAC/C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC;SACrB,CAAC,CAAC,CAAA;IACL,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC,QAAQ,CAAC,EACnE,OAA0B,EAC1B,UAAqC;IAErC,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IACrD,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,iBAAiB;YACpB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,2DAA2D,CAAC,CAAA;YACjG,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChG,KAAK,cAAc;YACjB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACxF,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,gGAAgG,CAAC,CAAA;YACtI,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,iBAAiB,CACnC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,EAChB,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,GAAG,CACf,CAAC,CAAA;QACJ,KAAK,kBAAkB;YACrB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,sEAAsE,CAAC,CAAA;YAC5G,CAAC;YACD,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,kEAAkE,CAAC,CAAA;YACxG,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,qBAAqB,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,EAChB,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,KAAK,EAChB,OAAO,CAAC,QAAQ,CACjB,CAAC,CAAA;IACN,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAA6B,EAA2B,EAAE;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EAAC,OAA0B;QAC1F,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC/C,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,qBAAqB,EAAE,MAAM,CAAC,EAAE,CAAC,0CAA0C,CAAC,CAAC,QAAQ,CAAC,EAAC,OAAO;YAC5F,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;oBAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;iBAC3B,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAChC,CAAC,CAAC;QACF,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CAAC,QAAQ,CAAC,EAAC,OAAO,EAAE,QAAQ;YAChG,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;oBAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,oBAAoB;oBAC9B,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;iBAC3B,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;oBAC1C,QAAQ,EAAE,OAAO,CAAC,OAAO;oBACzB,QAAQ,EAAE,QAAQ,CAAC,OAAO;iBAC3B,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,6CAA6C,CAAC,CAAA;YACnF,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC;KACH,CAAA;AACH,CAAC,CAAA;AA+BD,MAAM,OAAO,aACX,SAAQ,OAAO,CAAC,OAAO,EAAqC,CAC1D,0BAA0B,CAC3B;CAAG;AAEN,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EACvF,SAA6B,EAC7B,KAA8B;IAE9B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC;YACtC,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,+DAA+D;SACxE,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,SAAS,CAAC,OAAO;YAC3B,QAAQ,EAAE,MAAM,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,SAAS,CAAC,OAAO;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO;SACrC,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;YAC3C,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,QAAQ,EAAE,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,EAAE;YACvD,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE;SAClD,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,QAAQ,EAAE,SAAS,CAAC,OAAO;YAC3B,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;SAC9B,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AASF,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAyB,EAAsB,EAAE,CAAC,CAAC;IACnF,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAAC,SAAS,EAAE,KAAK;QACtE,KAAK,CAAC,CAAC,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAClD,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACxC,CAAC,CAAC;CACH,CAAC,CAAA"}

package/dist/publication/catalog-git.d.ts

@@ -0,0 +1,37 @@
+import { SubjectId } from "../model/authority.js";
+import type { PreparedCatalogPublication } from "../release/prepared.js";
+import type { PreparedBundle } from "../release/prepared-store.js";
+import { type ReleaseSubject } from "./coordinator.js";
+import type { AuthorizedMutationHttpShape, HttpAuthorizerShape } from "./http.js";
+export declare const catalogRecoveryCapabilityProfile: {
+    readonly observation: "exact" | "none" | "conditional";
+    readonly authoritativeAbsence: "proved" | "provider-specific" | "unavailable";
+    readonly createAuthorization: "none" | "authenticated-namespace-and-unique-coordinate";
+    readonly replay: "conditional" | "coordinate-unique" | "idempotency-key" | "unsafe";
+    readonly identifierReuse: "reusable" | "consumed-after-delete" | "not-applicable";
+    readonly correction: readonly ("deprecate" | "amend-release-metadata" | "forward-catalog-state" | "yank-file")[];
+    readonly exposure: "retractable" | "persistent-to-consumers" | "append-only";
+    readonly historyRequirement: "optional-evidence" | "durable-cas-required";
+    readonly readConvergence: {
+        readonly contract: import("./recovery.js").DocumentedReadConvergenceContract | import("./recovery.js").AssumedReadConvergenceContract | import("./recovery.js").UnknownReadConvergenceContract;
+        readonly observationRetry: {
+            readonly maxAttempts: number;
+            readonly backoff: import("./recovery.js").ObservationRetryBackoff;
+            readonly totalBudgetMs: number;
+        };
+        readonly retryEligible: "VisibilityPending | Inconclusive";
+        readonly exhaustion: "UncertainSubject with full trace";
+    };
+};
+export interface CatalogSubjectPair {
+    readonly id?: SubjectId;
+    readonly purpose?: "publish" | "correct";
+    readonly target: Uint8Array;
+    readonly state: Uint8Array;
+    /** Exact old pair that authorizes one forward correction. */
+    readonly baselineTarget?: Uint8Array;
+    readonly baselineState?: Uint8Array;
+}
+export declare const makeCatalogSubject: (publication: PreparedCatalogPublication, http: HttpAuthorizerShape, mutationHttp: AuthorizedMutationHttpShape, pair: CatalogSubjectPair) => ReleaseSubject;
+export declare const makeCatalogPublicationSubject: (bundle: PreparedBundle, publication: PreparedCatalogPublication, http: HttpAuthorizerShape, mutationHttp: AuthorizedMutationHttpShape) => ReleaseSubject;
+//# sourceMappingURL=catalog-git.d.ts.map

package/dist/publication/catalog-git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-git.d.ts","sourceRoot":"","sources":["../../src/publication/catalog-git.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgD,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAQ/F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAA;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAElE,OAAO,EAAuD,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAC3G,OAAO,KAAK,EAAE,2BAA2B,EAAE,mBAAmB,EAAqC,MAAM,WAAW,CAAA;AAoCpH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAsB3C,CAAA;AAmCF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAA;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,CAAA;CACpC;AA8RD,eAAO,MAAM,kBAAkB,GAC7B,aAAa,0BAA0B,EACvC,MAAM,mBAAmB,EACzB,cAAc,2BAA2B,EACzC,MAAM,kBAAkB,KACvB,cAiKF,CAAA;AAED,eAAO,MAAM,6BAA6B,GACxC,QAAQ,cAAc,EACtB,aAAa,0BAA0B,EACvC,MAAM,mBAAmB,EACzB,cAAc,2BAA2B,KACxC,cA2BF,CAAA"}