@sentropic/h2a-runtime 0.98.6 → 0.98.7-rc.10

package/dist/gateway-host/live-auth.d.ts

@@ -0,0 +1,62 @@
+/** Live disclosure uses registered host keys, never loopback/session bearers.
+ * All ports are host-owned. This module neither discovers identity nor reads
+ * owner state. Missing trust/declaration/revocation information fails closed.
+ */
+import { type KeyObject } from "node:crypto";
+export declare const LIVE_DISCLOSURE_AUDIENCE = "h2a:live-disclosure:v1";
+export type DisclosureOperation = "grant" | "revoke" | "emit";
+export type DisclosureRefusal = "authority-unavailable" | "unverified-principal" | "wrong-audience" | "capability-expired" | "capability-revoked" | "operation-denied" | "scope-mismatch" | "policy-changed" | "invalid-request" | "read-denied" | "grant-required" | "grant-expired" | "grant-revoked" | "provider-mismatch" | "out-of-scope" | "secret-excluded" | "stale-evidence" | "evidence-unavailable" | "policy-unavailable" | "audit-unavailable" | "transport-failed";
+export type Refused = Readonly<{
+    ok: false;
+    reason: DisclosureRefusal;
+}>;
+export declare const refuse: (reason: DisclosureRefusal) => Refused;
+export interface LiveDisclosureState {
+    readonly principal: string;
+    readonly hostId: string;
+    readonly tenant: string;
+    /** Host-derived opaque clone identity, never a URL or workspace fingerprint. */
+    readonly repositoryId: string;
+    readonly declarationId: string;
+    readonly declarationRevision: number;
+    readonly policyVersion: string;
+    readonly authorizedRoots: readonly string[];
+    /** Latest local state; cached derivatives must still match it at emission. */
+    readonly stateRevision: string;
+}
+export interface LiveDisclosureClaims extends Omit<LiveDisclosureState, "stateRevision"> {
+    readonly id: string;
+    readonly audience: string;
+    readonly keyId: string;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+    readonly operations: readonly DisclosureOperation[];
+}
+export interface LiveDisclosureCapability {
+    readonly claims: LiveDisclosureClaims;
+    readonly signature: string;
+}
+/** Fixed domain and field order: signatures cannot be reused as session proofs. */
+export declare function liveDisclosureSigningBytes(c: LiveDisclosureClaims): Buffer;
+export interface LiveDisclosureAuthOptions {
+    readonly now?: () => number;
+    readonly trust?: (keyId: string) => Readonly<{
+        principal: string;
+        hostId: string;
+        tenant: string;
+        publicKey: KeyObject;
+    }> | undefined;
+    readonly readState?: (repositoryId: string) => LiveDisclosureState | undefined;
+    /** Undefined means revocation status is unavailable, not active. */
+    readonly isRevoked?: (capabilityId: string) => boolean | undefined;
+}
+export type LiveDisclosureAuthorization = Refused | Readonly<{
+    ok: true;
+    claims: LiveDisclosureClaims;
+    state: LiveDisclosureState;
+}>;
+export interface LiveDisclosureAuth {
+    authorize(capability: unknown, operation: DisclosureOperation, repositoryId?: string): LiveDisclosureAuthorization;
+}
+export declare function createLiveDisclosureAuth(options?: LiveDisclosureAuthOptions): LiveDisclosureAuth;
+//# sourceMappingURL=live-auth.d.ts.map

package/dist/gateway-host/live-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-auth.d.ts","sourceRoot":"","sources":["../../src/gateway-host/live-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAErD,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GAAG,sBAAsB,GAAG,gBAAgB,GACnE,oBAAoB,GAAG,oBAAoB,GAAG,kBAAkB,GAChE,gBAAgB,GAAG,gBAAgB,GAAG,iBAAiB,GACvD,aAAa,GACb,gBAAgB,GAAG,eAAe,GAAG,eAAe,GACpD,mBAAmB,GAAG,cAAc,GAAG,iBAAiB,GACxD,gBAAgB,GAAG,sBAAsB,GAAG,oBAAoB,GAChE,mBAAmB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAAC;AACzE,eAAO,MAAM,MAAM,GAAI,QAAQ,iBAAiB,KAAG,OAA+C,CAAC;AAEnG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AACD,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;IACtF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACrD;AACD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,mFAAmF;AACnF,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAK1E;AACD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;KACzE,CAAC,GAAG,SAAS,CAAC;IACf,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,mBAAmB,GAAG,SAAS,CAAC;IAC/E,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAC;CACpE;AACD,MAAM,MAAM,2BAA2B,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC3D,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;CACpE,CAAC,CAAC;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,2BAA2B,CAAC;CACpH;AAaD,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CA4CpG"}

package/dist/gateway-host/live-auth.js

@@ -0,0 +1,87 @@
+/** Live disclosure uses registered host keys, never loopback/session bearers.
+ * All ports are host-owned. This module neither discovers identity nor reads
+ * owner state. Missing trust/declaration/revocation information fails closed.
+ */
+import { verify } from "node:crypto";
+export const LIVE_DISCLOSURE_AUDIENCE = "h2a:live-disclosure:v1";
+export const refuse = (reason) => Object.freeze({ ok: false, reason });
+/** Fixed domain and field order: signatures cannot be reused as session proofs. */
+export function liveDisclosureSigningBytes(c) {
+    return Buffer.from(JSON.stringify([LIVE_DISCLOSURE_AUDIENCE, c.id, c.audience,
+        c.keyId, c.principal, c.hostId, c.tenant, c.repositoryId, c.declarationId,
+        c.declarationRevision, c.policyVersion, c.authorizedRoots, c.issuedAt,
+        c.expiresAt, c.operations]));
+}
+const nonempty = (v) => typeof v === "string" && v.length > 0 && !v.includes("\0");
+function validClaims(c) {
+    return [c.id, c.keyId, c.audience, c.principal, c.hostId, c.tenant,
+        c.repositoryId, c.declarationId, c.policyVersion].every(nonempty)
+        && c.tenant.startsWith("local:") && Number.isSafeInteger(c.declarationRevision) && c.declarationRevision > 0
+        && Number.isSafeInteger(c.issuedAt) && Number.isSafeInteger(c.expiresAt)
+        && Array.isArray(c.authorizedRoots) && c.authorizedRoots.length > 0 && c.authorizedRoots.every(nonempty)
+        && Array.isArray(c.operations) && c.operations.length > 0
+        && c.operations.every((op) => ["grant", "revoke", "emit"].includes(op));
+}
+export function createLiveDisclosureAuth(options = {}) {
+    const now = options.now ?? Date.now;
+    return { authorize(input, operation, repositoryId) {
+            if (!options.trust || !options.readState || !options.isRevoked)
+                return refuse("authority-unavailable");
+            let proof;
+            try {
+                // Freeze caller-controlled bytes before consulting any host port.
+                proof = JSON.parse(JSON.stringify(input));
+                if (!proof || !proof.claims || !validClaims(proof.claims) || typeof proof.signature !== "string")
+                    return refuse("unverified-principal");
+            }
+            catch {
+                return refuse("unverified-principal");
+            }
+            try {
+                const c = proof.claims;
+                const trust = options.trust(c.keyId);
+                if (!trust || trust.principal !== c.principal || trust.hostId !== c.hostId || trust.tenant !== c.tenant
+                    || trust.publicKey.asymmetricKeyType !== "ed25519"
+                    || !verify(null, liveDisclosureSigningBytes(c), trust.publicKey, Buffer.from(proof.signature, "base64url"))) {
+                    return refuse("unverified-principal");
+                }
+                if (c.audience !== LIVE_DISCLOSURE_AUDIENCE)
+                    return refuse("wrong-audience");
+                const time = now();
+                if (!Number.isSafeInteger(time))
+                    return refuse("authority-unavailable");
+                if (c.issuedAt > time || c.expiresAt <= time || c.expiresAt <= c.issuedAt)
+                    return refuse("capability-expired");
+                const revoked = options.isRevoked(c.id);
+                if (revoked === true)
+                    return refuse("capability-revoked");
+                if (revoked !== false)
+                    return refuse("authority-unavailable");
+                if (!c.operations.includes(operation))
+                    return refuse("operation-denied");
+                // Revocation authenticates the signed owner/repository, without requiring
+                // the declaration, roots or content policy that it is trying to revoke.
+                const target = repositoryId ?? (operation === "revoke" ? c.repositoryId : undefined);
+                if (c.repositoryId !== target)
+                    return refuse("scope-mismatch");
+                const state = options.readState(target);
+                if (!state || state.repositoryId !== target
+                    || ["principal", "hostId", "tenant"].some((key) => c[key] !== state[key]))
+                    return refuse("scope-mismatch");
+                if (operation !== "revoke" && (["declarationId", "declarationRevision"].some((key) => c[key] !== state[key])
+                    || JSON.stringify(c.authorizedRoots) !== JSON.stringify(state.authorizedRoots)
+                    || !nonempty(state.stateRevision)))
+                    return refuse("scope-mismatch");
+                if (operation !== "revoke" && state.policyVersion !== c.policyVersion)
+                    return refuse("policy-changed");
+                Object.freeze(c.authorizedRoots);
+                Object.freeze(c.operations);
+                return Object.freeze({ ok: true, claims: Object.freeze(c),
+                    state: Object.freeze({ ...state, authorizedRoots: Object.freeze([...state.authorizedRoots]) }) });
+            }
+            catch {
+                return refuse("authority-unavailable");
+            }
+        } };
+}
+//# sourceMappingURL=live-auth.js.map

package/dist/gateway-host/live-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-auth.js","sourceRoot":"","sources":["../../src/gateway-host/live-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAYjE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AA2BnG,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CAAC,CAAuB;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ;QAC3E,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa;QACzE,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ;QACrE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAiBD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACzG,SAAS,WAAW,CAAC,CAAuB;IAC1C,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;WAC9D,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,mBAAmB,GAAG,CAAC;WACzG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;WACrE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;WACrG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;WACtD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,UAAqC,EAAE;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY;YAC/C,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACvG,IAAI,KAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,kEAAkE;gBAClE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAA6B,CAAC;gBACtE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;oBAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC1I,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAAC,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;gBACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;uBAClG,KAAK,CAAC,SAAS,CAAC,iBAAiB,KAAK,SAAS;uBAC/C,CAAC,MAAM,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;oBAC9G,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBACxC,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,KAAK,wBAAwB;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC7E,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;oBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBACxE,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ;oBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC/G,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC1D,IAAI,OAAO,KAAK,KAAK;oBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBAC9D,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAAE,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACzE,0EAA0E;gBAC1E,wEAAwE;gBACxE,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACrF,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM;uBACtC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CACvC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAiC,CAAC,KAAK,KAAK,CAAC,GAAgC,CAAC,CAAC;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAChI,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC,IAAI,CACxE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAiC,CAAC,KAAK,KAAK,CAAC,GAAgC,CAAC,CAAC;uBACzF,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;uBAC3E,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACtE,IAAI,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACvG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;oBACvD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtG,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAAC,CAAC;QACrD,CAAC,EAAE,CAAC;AACN,CAAC"}

package/dist/gateway-host/live-declarations.d.ts

@@ -0,0 +1,58 @@
+import type { CloneIdentityDto, WorkspaceDeclarationDto, WorktreeIdentityDto } from "../vendor/engram-live/contracts.js";
+export declare const LIVE_DECLARATION_KIND = "h2a-live-declaration";
+export declare const LIVE_DECLARATION_SCHEMA_VERSION = 1;
+/**
+ * Typed revision conflict: the durable declaration moved (or vanished)
+ * under a writer holding a stale base revision. The message keeps the
+ * `revision_conflict` marker; the name and the revision fields let callers
+ * branch on it without parsing text.
+ */
+export declare class LiveRevisionConflict extends Error {
+    readonly declarationId: string;
+    readonly expectedDeclarationRevision: number;
+    /** Current durable revision; undefined when the declaration is gone. */
+    readonly actualDeclarationRevision: number | undefined;
+    constructor(declarationId: string, expectedDeclarationRevision: number, actualDeclarationRevision: number | undefined);
+}
+export interface LiveDeclarationRecord {
+    readonly kind: typeof LIVE_DECLARATION_KIND;
+    readonly schemaVersion: typeof LIVE_DECLARATION_SCHEMA_VERSION;
+    /** The exact neutral DTO; validated with validateWorkspaceDeclaration on every write. */
+    readonly declaration: WorkspaceDeclarationDto;
+    /** Full local clone identity (commonDirRealpath stays host-local; only cloneId is shared). */
+    readonly clone: CloneIdentityDto;
+    /** Full local worktree identity. */
+    readonly worktree: WorktreeIdentityDto;
+    readonly createdAt: string;
+    /** Activation timestamp; replay after restart never renews it. */
+    readonly activatedAt: string;
+    readonly updatedAt: string;
+}
+/** Durable declarations live under the injected h2a root, never a worktree. */
+export declare function liveDeclarationsPath(root: string): string;
+export interface LiveDeclarationStore {
+    /** All durable declarations, deterministically ordered. */
+    list(): readonly LiveDeclarationRecord[];
+    get(declarationId: string): LiveDeclarationRecord | undefined;
+    /** First declaration whose authorized root covers `path`. */
+    findByPath(path: string): LiveDeclarationRecord | undefined;
+    insert(record: LiveDeclarationRecord): void;
+    /**
+     * Revision-guarded mutation: re-reads the durable store, refuses a stale
+     * `expectedDeclarationRevision` with `revision_conflict`, verifies the
+     * composed next record (declarationRevision exactly + 1, immutable
+     * identity triangle, binding renewal-or-preserved with first binding
+     * exactly INITIAL_BINDING_REVISION then strictly greater, valid DTOs)
+     * and persists atomically. The callback returns the fully composed next
+     * record; the store owns the guard, never silent arithmetic.
+     */
+    update(declarationId: string, expectedDeclarationRevision: number, mutate: (record: LiveDeclarationRecord) => LiveDeclarationRecord): LiveDeclarationRecord;
+    remove(declarationId: string): boolean;
+}
+/**
+ * A store instance is a thin read-through over the durable file: every
+ * operation re-reads, so two instances (or two processes) on the same root
+ * observe each other's committed writes.
+ */
+export declare function createLiveDeclarationStore(root: string): LiveDeclarationStore;
+//# sourceMappingURL=live-declarations.d.ts.map

package/dist/gateway-host/live-declarations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-declarations.d.ts","sourceRoot":"","sources":["../../src/gateway-host/live-declarations.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACpB,MAAM,oCAAoC,CAAC;AAE5C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAC5D,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,yBAAyB,EAAE,MAAM,GAAG,SAAS,CAAC;gBAGrD,aAAa,EAAE,MAAM,EACrB,2BAA2B,EAAE,MAAM,EACnC,yBAAyB,EAAE,MAAM,GAAG,SAAS;CAahD;AAqHD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,OAAO,+BAA+B,CAAC;IAC/D,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;IAC9C,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAkED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AA4CD,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,IAAI,IAAI,SAAS,qBAAqB,EAAE,CAAC;IACzC,GAAG,CAAC,aAAa,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAC;IAC9D,6DAA6D;IAC7D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAC;IAC5D,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C;;;;;;;;OAQG;IACH,MAAM,CACJ,aAAa,EAAE,MAAM,EACrB,2BAA2B,EAAE,MAAM,EACnC,MAAM,EAAE,CAAC,MAAM,EAAE,qBAAqB,KAAK,qBAAqB,GAC/D,qBAAqB,CAAC;IACzB,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAmN7E"}

package/dist/gateway-host/live-declarations.js

@@ -0,0 +1,429 @@
+/**
+ * L6a (H) — durable local store for explicit live workspace declarations.
+ *
+ * DESIGN (LIVE §2, §12):
+ *  - The declaration store is LOCAL h2a state under the injected h2a root
+ *    (<root>/live/declarations.json), outside every observed worktree and
+ *    its git-dir/common-dir. It is authoritative independently of the live
+ *    projection: losing the projection never loses registrations, and the
+ *    store is never a projection-owned surface.
+ *  - Each record wraps the EXACT neutral WorkspaceDeclarationDto (flat
+ *    identity triangle declarationId/cloneId/worktreeId, tenant,
+ *    liveCapability, declarationRevision, flat product binding) plus the
+ *    full local CloneIdentityDto/WorktreeIdentityDto (host-local realpath,
+ *    git-dir and paths needed to operate; only the opaque ids cross to
+ *    sentropic). Every write is validated with the engram validators — the
+ *    runtime keeps no mirror of the contract, it imports the vendored
+ *    neutral contracts entry (../vendor/engram-live, see the
+ *    core live/contracts.ts header).
+ *  - Writes are atomic (0600, tmp+rename) through a token-owned staging
+ *    file; a corrupt store fails EXPLICITLY, it never silently
+ *    restarts empty (that would erase desired live registrations). A
+ *    pre-realignment (nested, `live-git-1`) store file is rejected
+ *    EXPLICITLY as unsupported — never silently migrated, never silently
+ *    read: L6a is not consumed yet, so no migration replay exists and the
+ *    operator removes the file to start fresh.
+ *  - Update is revision-guarded ATOMICALLY: the caller composes the next
+ *    record through the contract rules (declarationRevision + 1, immutable
+ *    identity triangle, binding renewal-or-preserved); the store verifies
+ *    the guard, the triangle, the binding monotonicity (first binding
+ *    exactly INITIAL_BINDING_REVISION, then strictly greater) and the
+ *    final DTOs, then re-verifies the durable revision and persists under
+ *    ONE exclusive lock. A stale writer is refused with the typed
+ *    LiveRevisionConflict, never clobbering; a declaration removed after
+ *    the read is never resurrected. Insert and remove hold the same lock,
+ *    so every read-check-write (including removals) is serialized.
+ */
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { INITIAL_BINDING_REVISION, validateCloneIdentity, validateWorkspaceDeclaration, validateWorktreeIdentity, } from "../vendor/engram-live/contracts.js";
+export const LIVE_DECLARATION_KIND = "h2a-live-declaration";
+export const LIVE_DECLARATION_SCHEMA_VERSION = 1;
+/**
+ * Typed revision conflict: the durable declaration moved (or vanished)
+ * under a writer holding a stale base revision. The message keeps the
+ * `revision_conflict` marker; the name and the revision fields let callers
+ * branch on it without parsing text.
+ */
+export class LiveRevisionConflict extends Error {
+    declarationId;
+    expectedDeclarationRevision;
+    /** Current durable revision; undefined when the declaration is gone. */
+    actualDeclarationRevision;
+    constructor(declarationId, expectedDeclarationRevision, actualDeclarationRevision) {
+        super(actualDeclarationRevision === undefined
+            ? `revision_conflict: live declaration ${declarationId} was removed; stale writer held declaration revision ${expectedDeclarationRevision}`
+            : `revision_conflict: live declaration ${declarationId} is at declaration revision ` +
+                `${actualDeclarationRevision}, stale writer held ${expectedDeclarationRevision}`);
+        this.name = "LiveRevisionConflict";
+        this.declarationId = declarationId;
+        this.expectedDeclarationRevision = expectedDeclarationRevision;
+        this.actualDeclarationRevision = actualDeclarationRevision;
+    }
+}
+// ---------------------------------------------------------------------------
+// Exclusive store lock (synchronous, no dependency).
+// ---------------------------------------------------------------------------
+//
+// Every mutation (insert/update/remove) holds this lock from its read to
+// its persisted rename, so no stale revision can slip between the guard
+// check and the write — across processes as well as across store
+// instances. The lock is an atomically published nonempty directory; acquisition
+// retries briefly, recovers abandoned locks by age, then fails explicitly
+// (never silently proceeding unlocked). Re-entry by the SAME process only
+// bumps a counter: the pre-persist re-verification inside update() still
+// rejects a same-process interleaving, so re-entrancy never hides a
+// conflict. Each acquisition has a unique token directory: takeover removes
+// that generation, including its staged writes. Even a holder suspended
+// after its final fence check cannot rename a removed source into the store.
+// Reads stay lock-free: the tmp+rename persistence is atomic,
+// so readers always observe one whole committed file.
+const STORE_LOCK_DIRNAME = ".declarations.lock";
+const STORE_LOCK_TIMEOUT_MS = 5_000;
+const STORE_LOCK_STALE_MS = 10_000;
+const STORE_LOCK_POLL_MS = 5;
+/** Re-entry shares the SAME generation, never a successor's token. */
+const storeLocksHeld = new Map();
+const lockDirFor = (root) => join(root, "live", STORE_LOCK_DIRNAME);
+const sleepSync = (ms) => {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+};
+/** Remove only the observed generation; never recursively delete a successor. */
+function removeStoreLockGeneration(dir, token) {
+    rmSync(join(dir, token), { recursive: true, force: true });
+    try {
+        rmdirSync(dir);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT" && code !== "ENOTEMPTY" && code !== "EEXIST")
+            throw error;
+    }
+}
+function acquireStoreLock(root) {
+    const dir = lockDirFor(root);
+    mkdirSync(join(root, "live"), { recursive: true });
+    const held = storeLocksHeld.get(dir);
+    if (held !== undefined) {
+        held.depth += 1;
+        return held;
+    }
+    const deadline = Date.now() + STORE_LOCK_TIMEOUT_MS;
+    for (;;) {
+        const lock = { token: randomUUID(), depth: 1 };
+        const candidate = `${dir}.${lock.token}.candidate`;
+        try {
+            mkdirSync(candidate, { mode: 0o700 });
+            mkdirSync(join(candidate, lock.token), { mode: 0o700 });
+            // One atomic publication, with the generation already inside. An
+            // existing nonempty lock cannot be replaced by rename. A suspended
+            // publisher can never resume by adding its token to a successor.
+            renameSync(candidate, dir);
+            storeLocksHeld.set(dir, lock);
+            return lock;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== "EEXIST" && code !== "ENOENT" && code !== "ENOTEMPTY")
+                throw error;
+        }
+        finally {
+            rmSync(candidate, { recursive: true, force: true });
+        }
+        // Age permits takeover, but does NOT prove the holder stopped. Invalidate
+        // only the generation observed before the age check. A competing cleanup
+        // cannot erase a newly acquired token or its staged write.
+        try {
+            const tokens = readdirSync(dir);
+            if (Date.now() - statSync(dir).mtimeMs > STORE_LOCK_STALE_MS) {
+                for (const token of tokens)
+                    removeStoreLockGeneration(dir, token);
+                if (tokens.length === 0)
+                    rmdirSync(dir);
+            }
+        }
+        catch {
+            // The directory vanished under us; the next iteration retries.
+        }
+        if (Date.now() >= deadline) {
+            throw new Error(`live declarations store busy: cannot acquire lock at ${dir}`);
+        }
+        sleepSync(STORE_LOCK_POLL_MS);
+    }
+}
+function releaseStoreLock(root) {
+    const dir = lockDirFor(root);
+    const held = storeLocksHeld.get(dir);
+    if (held === undefined)
+        return;
+    if (held.depth > 1) {
+        held.depth -= 1;
+        return;
+    }
+    storeLocksHeld.delete(dir);
+    removeStoreLockGeneration(dir, held.token);
+}
+function withStoreLock(root, fn) {
+    const lock = acquireStoreLock(root);
+    try {
+        return fn(lock);
+    }
+    finally {
+        releaseStoreLock(root);
+    }
+}
+/** Structural validation of a record: envelope, triangle consistency, then the engram validators. */
+const validateRecord = (record) => {
+    if (record.kind !== LIVE_DECLARATION_KIND)
+        return "unexpected declaration kind";
+    if (record.schemaVersion !== LIVE_DECLARATION_SCHEMA_VERSION) {
+        return "unsupported declaration schema version";
+    }
+    const declaration = validateWorkspaceDeclaration(record.declaration);
+    if (!declaration.ok)
+        return `invalid declaration: ${declaration.errors.join("; ")}`;
+    if (record.clone.cloneId !== record.declaration.cloneId) {
+        return "clone/worktree attachment mismatch: clone.cloneId differs from declaration.cloneId";
+    }
+    if (record.worktree.cloneId !== record.declaration.cloneId) {
+        return "clone/worktree attachment mismatch: worktree.cloneId differs from declaration.cloneId";
+    }
+    if (record.worktree.worktreeId !== record.declaration.worktreeId) {
+        return "clone/worktree attachment mismatch: worktree.worktreeId differs from declaration.worktreeId";
+    }
+    const clone = validateCloneIdentity(record.clone);
+    if (!clone.ok)
+        return `invalid clone identity: ${clone.errors.join("; ")}`;
+    const worktree = validateWorktreeIdentity(record.worktree);
+    if (!worktree.ok)
+        return `invalid worktree identity: ${worktree.errors.join("; ")}`;
+    for (const field of ["createdAt", "activatedAt", "updatedAt"]) {
+        if (typeof record[field] !== "string" || record[field].length === 0) {
+            return `missing ${field}`;
+        }
+    }
+    return undefined;
+};
+const isRecord = (value) => {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const record = value;
+    if (record.kind !== LIVE_DECLARATION_KIND ||
+        record.schemaVersion !== LIVE_DECLARATION_SCHEMA_VERSION ||
+        typeof record.declaration !== "object" ||
+        record.declaration === null ||
+        typeof record.clone !== "object" ||
+        record.clone === null ||
+        typeof record.worktree !== "object" ||
+        record.worktree === null ||
+        typeof record.declaration.declarationId !== "string") {
+        return false;
+    }
+    return validateRecord(record) === undefined;
+};
+/** Pre-realignment entries (nested shape, top-level hostScope/revision, no neutral DTO) are never read as records. */
+const isLegacyRecord = (value) => {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const record = value;
+    return ("hostScope" in record ||
+        ("declarationId" in record && !("declaration" in record)));
+};
+/** Durable declarations live under the injected h2a root, never a worktree. */
+export function liveDeclarationsPath(root) {
+    return join(root, "live", "declarations.json");
+}
+const readStoreFile = (root) => {
+    const path = liveDeclarationsPath(root);
+    if (!existsSync(path)) {
+        return { kind: "h2a-live-declarations", version: 1, declarations: [] };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        // Explicit failure: a corrupt declaration store must never be treated
+        // as an empty registry (LIVE §12: database loss must not erase live
+        // registrations; silent loss is worse).
+        throw new Error(`live declarations store unreadable at ${path}: ${error.message}`);
+    }
+    if (typeof parsed !== "object" ||
+        parsed === null ||
+        parsed.kind !== "h2a-live-declarations" ||
+        parsed.version !== 1 ||
+        !Array.isArray(parsed.declarations)) {
+        throw new Error(`live declarations store invalid at ${path}`);
+    }
+    const file = parsed;
+    for (const entry of file.declarations) {
+        if (isLegacyRecord(entry)) {
+            throw new Error(`live declarations store uses the pre-realignment L6a format at ${path}: ` +
+                `remove the file to start fresh (L6a is not consumed yet; no migration replay exists)`);
+        }
+        if (!isRecord(entry)) {
+            throw new Error(`live declarations store contains a malformed declaration at ${path}`);
+        }
+    }
+    return file;
+};
+/**
+ * A store instance is a thin read-through over the durable file: every
+ * operation re-reads, so two instances (or two processes) on the same root
+ * observe each other's committed writes.
+ */
+export function createLiveDeclarationStore(root) {
+    const load = () => readStoreFile(root).declarations;
+    const persist = (lock, expected, declarations, declarationId, expectedRevision) => {
+        const generation = join(lockDirFor(root), lock.token);
+        const tmp = join(generation, `${randomUUID()}.tmp`);
+        const conflict = () => new LiveRevisionConflict(declarationId, expectedRevision, load().find((record) => record.declaration.declarationId === declarationId)
+            ?.declaration.declarationRevision);
+        const file = {
+            kind: "h2a-live-declarations",
+            version: 1,
+            declarations: [...declarations],
+        };
+        try {
+            if (!existsSync(generation))
+                throw conflict();
+            // The source belongs to this unique token and cannot survive takeover.
+            // Never mkdir here: a dispossessed holder must not recreate its source.
+            writeFileSync(tmp, JSON.stringify(file, null, 2) + "\n", { mode: 0o600, flag: "wx" });
+            const fresh = load();
+            if (!existsSync(generation) || JSON.stringify(fresh) !== JSON.stringify(expected)) {
+                throw conflict();
+            }
+            // Atomic rename is the commit point. A suspension AFTER the checks
+            // above is fenced by takeover removing this generation's source file.
+            renameSync(tmp, liveDeclarationsPath(root));
+        }
+        catch (error) {
+            // Cleanup can unlink the source before removing its directory.
+            if (error.code === "ENOENT" || !existsSync(generation)) {
+                throw conflict();
+            }
+            throw error;
+        }
+        finally {
+            rmSync(tmp, { force: true });
+        }
+    };
+    return {
+        list() {
+            return [...load()].sort((a, b) => a.declaration.declarationId < b.declaration.declarationId
+                ? -1
+                : a.declaration.declarationId > b.declaration.declarationId
+                    ? 1
+                    : 0);
+        },
+        get(declarationId) {
+            return load().find((record) => record.declaration.declarationId === declarationId);
+        },
+        findByPath(path) {
+            return load().find((record) => record.declaration.authorizedRoots.includes(path));
+        },
+        insert(record) {
+            const problem = validateRecord(record);
+            if (problem !== undefined) {
+                throw new Error(`invalid live declaration record: ${problem}`);
+            }
+            withStoreLock(root, (lock) => {
+                const declarations = load();
+                if (declarations.some((existing) => existing.declaration.declarationId === record.declaration.declarationId)) {
+                    throw new Error(`live declaration already exists: ${record.declaration.declarationId}`);
+                }
+                persist(lock, declarations, [...declarations, record], record.declaration.declarationId, record.declaration.declarationRevision);
+            });
+        },
+        update(declarationId, expectedDeclarationRevision, mutate) {
+            return withStoreLock(root, (lock) => {
+                const declarations = load();
+                const index = declarations.findIndex((record) => record.declaration.declarationId === declarationId);
+                if (index === -1) {
+                    throw new Error(`unknown live declaration: ${declarationId}`);
+                }
+                const current = declarations[index];
+                if (current.declaration.declarationRevision !== expectedDeclarationRevision) {
+                    throw new LiveRevisionConflict(declarationId, expectedDeclarationRevision, current.declaration.declarationRevision);
+                }
+                const next = mutate(current);
+                if (next.declaration.declarationId !== declarationId) {
+                    throw new Error(`update must not change declarationId: ${declarationId}`);
+                }
+                if (next.declaration.declarationRevision !== expectedDeclarationRevision + 1) {
+                    throw new Error(`update must advance declarationRevision by exactly one: held ${expectedDeclarationRevision}`);
+                }
+                for (const field of [
+                    "tenant",
+                    "principal",
+                    "hostFingerprint",
+                    "cloneId",
+                    "worktreeId",
+                    "liveCapability",
+                ]) {
+                    if (next.declaration[field] !== current.declaration[field]) {
+                        throw new Error(`update must not change declaration identity field "${field}": ${declarationId}`);
+                    }
+                }
+                // Binding renewal-or-preserved: a workspace/issuer/revision change
+                // renews the binding (complete triplet, first binding exactly
+                // INITIAL_BINDING_REVISION, then strictly greater); any other
+                // mutation preserves it.
+                const previous = current.declaration;
+                const candidate = next.declaration;
+                const workspaceChanged = candidate.serverWorkspaceId !== previous.serverWorkspaceId;
+                const issuerChanged = candidate.serverIssuer !== previous.serverIssuer;
+                const revisionTouched = candidate.bindingRevision !== previous.bindingRevision;
+                if (workspaceChanged || issuerChanged || revisionTouched) {
+                    if (candidate.serverWorkspaceId === undefined ||
+                        candidate.serverIssuer === undefined ||
+                        candidate.bindingRevision === undefined) {
+                        throw new Error(`update must carry the complete serverWorkspaceId + serverIssuer + bindingRevision triplet when the binding changes: ${declarationId}`);
+                    }
+                    if (previous.bindingRevision === undefined) {
+                        if (candidate.bindingRevision !== INITIAL_BINDING_REVISION) {
+                            throw new Error(`update must carry bindingRevision ${INITIAL_BINDING_REVISION} for the first product binding: ${declarationId}`);
+                        }
+                    }
+                    else if (candidate.bindingRevision <= previous.bindingRevision) {
+                        throw new Error(`update must carry a strictly increasing bindingRevision: ${declarationId}`);
+                    }
+                }
+                const problem = validateRecord(next);
+                if (problem !== undefined) {
+                    throw new Error(`invalid updated live declaration record: ${problem}`);
+                }
+                // Atomic compare-and-write under the same lock: re-read the durable
+                // file and refuse when the declaration moved (a concurrent writer
+                // committed inside mutate()) or vanished (an interleaved removal).
+                // The merge applies onto the FRESH list, so unrelated concurrent
+                // records are never dropped; a stale write never clobbers and a
+                // removed declaration never resurrects.
+                const fresh = load();
+                const refetch = fresh.find((record) => record.declaration.declarationId === declarationId);
+                if (refetch === undefined) {
+                    throw new LiveRevisionConflict(declarationId, expectedDeclarationRevision, undefined);
+                }
+                if (refetch.declaration.declarationRevision !== expectedDeclarationRevision) {
+                    throw new LiveRevisionConflict(declarationId, expectedDeclarationRevision, refetch.declaration.declarationRevision);
+                }
+                persist(lock, fresh, fresh.map((record) => record.declaration.declarationId === declarationId ? next : record), declarationId, expectedDeclarationRevision);
+                return next;
+            });
+        },
+        remove(declarationId) {
+            return withStoreLock(root, (lock) => {
+                const declarations = load();
+                const remaining = declarations.filter((record) => record.declaration.declarationId !== declarationId);
+                if (remaining.length === declarations.length)
+                    return false;
+                persist(lock, declarations, remaining, declarationId, declarations.find((record) => record.declaration.declarationId === declarationId)
+                    .declaration.declarationRevision);
+                return true;
+            });
+        },
+    };
+}
+//# sourceMappingURL=live-declarations.js.map