@sentropic/h2a-runtime 0.98.7-rc.2 → 0.98.7-rc.3

package/dist/gateway-host/live-auth.d.ts

@@ -0,0 +1,62 @@
+/** Live disclosure uses registered host keys, never loopback/session bearers.
+ * All ports are host-owned. This module neither discovers identity nor reads
+ * owner state. Missing trust/declaration/revocation information fails closed.
+ */
+import { type KeyObject } from "node:crypto";
+export declare const LIVE_DISCLOSURE_AUDIENCE = "h2a:live-disclosure:v1";
+export type DisclosureOperation = "grant" | "revoke" | "emit";
+export type DisclosureRefusal = "authority-unavailable" | "unverified-principal" | "wrong-audience" | "capability-expired" | "capability-revoked" | "operation-denied" | "scope-mismatch" | "policy-changed" | "invalid-request" | "read-denied" | "grant-required" | "grant-expired" | "grant-revoked" | "provider-mismatch" | "out-of-scope" | "secret-excluded" | "stale-evidence" | "evidence-unavailable" | "policy-unavailable" | "audit-unavailable" | "transport-failed";
+export type Refused = Readonly<{
+    ok: false;
+    reason: DisclosureRefusal;
+}>;
+export declare const refuse: (reason: DisclosureRefusal) => Refused;
+export interface LiveDisclosureState {
+    readonly principal: string;
+    readonly hostId: string;
+    readonly tenant: string;
+    /** Host-derived opaque clone identity, never a URL or workspace fingerprint. */
+    readonly repositoryId: string;
+    readonly declarationId: string;
+    readonly declarationRevision: number;
+    readonly policyVersion: string;
+    readonly authorizedRoots: readonly string[];
+    /** Latest local state; cached derivatives must still match it at emission. */
+    readonly stateRevision: string;
+}
+export interface LiveDisclosureClaims extends Omit<LiveDisclosureState, "stateRevision"> {
+    readonly id: string;
+    readonly audience: string;
+    readonly keyId: string;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+    readonly operations: readonly DisclosureOperation[];
+}
+export interface LiveDisclosureCapability {
+    readonly claims: LiveDisclosureClaims;
+    readonly signature: string;
+}
+/** Fixed domain and field order: signatures cannot be reused as session proofs. */
+export declare function liveDisclosureSigningBytes(c: LiveDisclosureClaims): Buffer;
+export interface LiveDisclosureAuthOptions {
+    readonly now?: () => number;
+    readonly trust?: (keyId: string) => Readonly<{
+        principal: string;
+        hostId: string;
+        tenant: string;
+        publicKey: KeyObject;
+    }> | undefined;
+    readonly readState?: (repositoryId: string) => LiveDisclosureState | undefined;
+    /** Undefined means revocation status is unavailable, not active. */
+    readonly isRevoked?: (capabilityId: string) => boolean | undefined;
+}
+export type LiveDisclosureAuthorization = Refused | Readonly<{
+    ok: true;
+    claims: LiveDisclosureClaims;
+    state: LiveDisclosureState;
+}>;
+export interface LiveDisclosureAuth {
+    authorize(capability: unknown, operation: DisclosureOperation, repositoryId?: string): LiveDisclosureAuthorization;
+}
+export declare function createLiveDisclosureAuth(options?: LiveDisclosureAuthOptions): LiveDisclosureAuth;
+//# sourceMappingURL=live-auth.d.ts.map

package/dist/gateway-host/live-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-auth.d.ts","sourceRoot":"","sources":["../../src/gateway-host/live-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAErD,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GAAG,sBAAsB,GAAG,gBAAgB,GACnE,oBAAoB,GAAG,oBAAoB,GAAG,kBAAkB,GAChE,gBAAgB,GAAG,gBAAgB,GAAG,iBAAiB,GACvD,aAAa,GACb,gBAAgB,GAAG,eAAe,GAAG,eAAe,GACpD,mBAAmB,GAAG,cAAc,GAAG,iBAAiB,GACxD,gBAAgB,GAAG,sBAAsB,GAAG,oBAAoB,GAChE,mBAAmB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAAC;AACzE,eAAO,MAAM,MAAM,GAAI,QAAQ,iBAAiB,KAAG,OAA+C,CAAC;AAEnG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AACD,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC;IACtF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACrD;AACD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,mFAAmF;AACnF,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAK1E;AACD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;KACzE,CAAC,GAAG,SAAS,CAAC;IACf,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,mBAAmB,GAAG,SAAS,CAAC;IAC/E,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAC;CACpE;AACD,MAAM,MAAM,2BAA2B,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC3D,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;CACpE,CAAC,CAAC;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,2BAA2B,CAAC;CACpH;AAaD,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CA4CpG"}

package/dist/gateway-host/live-auth.js

@@ -0,0 +1,87 @@
+/** Live disclosure uses registered host keys, never loopback/session bearers.
+ * All ports are host-owned. This module neither discovers identity nor reads
+ * owner state. Missing trust/declaration/revocation information fails closed.
+ */
+import { verify } from "node:crypto";
+export const LIVE_DISCLOSURE_AUDIENCE = "h2a:live-disclosure:v1";
+export const refuse = (reason) => Object.freeze({ ok: false, reason });
+/** Fixed domain and field order: signatures cannot be reused as session proofs. */
+export function liveDisclosureSigningBytes(c) {
+    return Buffer.from(JSON.stringify([LIVE_DISCLOSURE_AUDIENCE, c.id, c.audience,
+        c.keyId, c.principal, c.hostId, c.tenant, c.repositoryId, c.declarationId,
+        c.declarationRevision, c.policyVersion, c.authorizedRoots, c.issuedAt,
+        c.expiresAt, c.operations]));
+}
+const nonempty = (v) => typeof v === "string" && v.length > 0 && !v.includes("\0");
+function validClaims(c) {
+    return [c.id, c.keyId, c.audience, c.principal, c.hostId, c.tenant,
+        c.repositoryId, c.declarationId, c.policyVersion].every(nonempty)
+        && c.tenant.startsWith("local:") && Number.isSafeInteger(c.declarationRevision) && c.declarationRevision > 0
+        && Number.isSafeInteger(c.issuedAt) && Number.isSafeInteger(c.expiresAt)
+        && Array.isArray(c.authorizedRoots) && c.authorizedRoots.length > 0 && c.authorizedRoots.every(nonempty)
+        && Array.isArray(c.operations) && c.operations.length > 0
+        && c.operations.every((op) => ["grant", "revoke", "emit"].includes(op));
+}
+export function createLiveDisclosureAuth(options = {}) {
+    const now = options.now ?? Date.now;
+    return { authorize(input, operation, repositoryId) {
+            if (!options.trust || !options.readState || !options.isRevoked)
+                return refuse("authority-unavailable");
+            let proof;
+            try {
+                // Freeze caller-controlled bytes before consulting any host port.
+                proof = JSON.parse(JSON.stringify(input));
+                if (!proof || !proof.claims || !validClaims(proof.claims) || typeof proof.signature !== "string")
+                    return refuse("unverified-principal");
+            }
+            catch {
+                return refuse("unverified-principal");
+            }
+            try {
+                const c = proof.claims;
+                const trust = options.trust(c.keyId);
+                if (!trust || trust.principal !== c.principal || trust.hostId !== c.hostId || trust.tenant !== c.tenant
+                    || trust.publicKey.asymmetricKeyType !== "ed25519"
+                    || !verify(null, liveDisclosureSigningBytes(c), trust.publicKey, Buffer.from(proof.signature, "base64url"))) {
+                    return refuse("unverified-principal");
+                }
+                if (c.audience !== LIVE_DISCLOSURE_AUDIENCE)
+                    return refuse("wrong-audience");
+                const time = now();
+                if (!Number.isSafeInteger(time))
+                    return refuse("authority-unavailable");
+                if (c.issuedAt > time || c.expiresAt <= time || c.expiresAt <= c.issuedAt)
+                    return refuse("capability-expired");
+                const revoked = options.isRevoked(c.id);
+                if (revoked === true)
+                    return refuse("capability-revoked");
+                if (revoked !== false)
+                    return refuse("authority-unavailable");
+                if (!c.operations.includes(operation))
+                    return refuse("operation-denied");
+                // Revocation authenticates the signed owner/repository, without requiring
+                // the declaration, roots or content policy that it is trying to revoke.
+                const target = repositoryId ?? (operation === "revoke" ? c.repositoryId : undefined);
+                if (c.repositoryId !== target)
+                    return refuse("scope-mismatch");
+                const state = options.readState(target);
+                if (!state || state.repositoryId !== target
+                    || ["principal", "hostId", "tenant"].some((key) => c[key] !== state[key]))
+                    return refuse("scope-mismatch");
+                if (operation !== "revoke" && (["declarationId", "declarationRevision"].some((key) => c[key] !== state[key])
+                    || JSON.stringify(c.authorizedRoots) !== JSON.stringify(state.authorizedRoots)
+                    || !nonempty(state.stateRevision)))
+                    return refuse("scope-mismatch");
+                if (operation !== "revoke" && state.policyVersion !== c.policyVersion)
+                    return refuse("policy-changed");
+                Object.freeze(c.authorizedRoots);
+                Object.freeze(c.operations);
+                return Object.freeze({ ok: true, claims: Object.freeze(c),
+                    state: Object.freeze({ ...state, authorizedRoots: Object.freeze([...state.authorizedRoots]) }) });
+            }
+            catch {
+                return refuse("authority-unavailable");
+            }
+        } };
+}
+//# sourceMappingURL=live-auth.js.map

package/dist/gateway-host/live-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-auth.js","sourceRoot":"","sources":["../../src/gateway-host/live-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAYjE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AA2BnG,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CAAC,CAAuB;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ;QAC3E,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa;QACzE,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ;QACrE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAiBD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACzG,SAAS,WAAW,CAAC,CAAuB;IAC1C,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;WAC9D,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,mBAAmB,GAAG,CAAC;WACzG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;WACrE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;WACrG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;WACtD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,UAAqC,EAAE;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY;YAC/C,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACvG,IAAI,KAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,kEAAkE;gBAClE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAA6B,CAAC;gBACtE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;oBAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC1I,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAAC,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;gBACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;uBAClG,KAAK,CAAC,SAAS,CAAC,iBAAiB,KAAK,SAAS;uBAC/C,CAAC,MAAM,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;oBAC9G,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBACxC,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,KAAK,wBAAwB;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC7E,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;oBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBACxE,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ;oBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC/G,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC1D,IAAI,OAAO,KAAK,KAAK;oBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBAC9D,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAAE,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACzE,0EAA0E;gBAC1E,wEAAwE;gBACxE,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACrF,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM;uBACtC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CACvC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAiC,CAAC,KAAK,KAAK,CAAC,GAAgC,CAAC,CAAC;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAChI,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC,IAAI,CACxE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAiC,CAAC,KAAK,KAAK,CAAC,GAAgC,CAAC,CAAC;uBACzF,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;uBAC3E,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACtE,IAAI,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACvG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;oBACvD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtG,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAAC,CAAC;QACrD,CAAC,EAAE,CAAC;AACN,CAAC"}

package/dist/gateway-host/live-disclosure.d.ts

@@ -0,0 +1,124 @@
+import { type DisclosureRefusal, type LiveDisclosureAuth, type LiveDisclosureAuthorization, type Refused } from "./live-auth.js";
+export declare const DISCLOSURE_SURFACES: readonly ["prompt", "tool", "mcp", "summary", "symbol", "local-commit", "citation", "context"];
+export type DisclosureSurface = typeof DISCLOSURE_SURFACES[number];
+export interface DisclosureScope {
+    /** Exact repository-relative source paths; no wildcard or implicit descendants. */
+    readonly paths: readonly string[];
+    readonly surfaces: readonly DisclosureSurface[];
+}
+export interface LiveDisclosureEvidence {
+    /** Host provenance ID; multiple fragments may belong to one requested entry. */
+    readonly evidenceId: string;
+    readonly repositoryId: string;
+    readonly declarationId: string;
+    readonly declarationRevision: number;
+    readonly policyVersion: string;
+    readonly stateRevision: string;
+    /** Every source, including previous paths and memory/code composition origins. */
+    readonly originPaths: readonly string[];
+    readonly surface: DisclosureSurface;
+    readonly text: string;
+    /** L4b-2 withheld/protected facts and their derivatives stay excluded. */
+    readonly excluded: boolean;
+}
+export interface DisclosureAuditEvent {
+    readonly eventId: string;
+    readonly at: number;
+    /** An attempt is audited before handoff; it is not a delivery receipt. */
+    readonly action: "grant" | "revoke" | "emit-attempt" | "refuse";
+    /** Only host-minted opaque identifiers enter receipts; never caller text. */
+    readonly grantId?: string;
+    readonly reason?: DisclosureRefusal;
+}
+export interface LiveExternalTransport {
+    /** Actual destination, including routing/fallback; a different provider must reauthorize. */
+    readonly providerId: string;
+    /** Synchronous handoff is the emission boundary. No later unguarded routing. */
+    send(texts: readonly string[]): void | Promise<void>;
+}
+/** One host read transaction, held until synchronous send returns.
+ * Decisions are values, never callbacks into mutable policy/auth state.
+ */
+export interface LiveDisclosureEmissionSnapshot {
+    readonly at: number;
+    readonly authorization: LiveDisclosureAuthorization;
+    readonly issuerAuthorization: LiveDisclosureAuthorization;
+    readonly readAllowed: boolean;
+    readonly policy?: Readonly<{
+        version: string;
+        allowed: readonly boolean[];
+        compositionAllowed: boolean;
+    }>;
+    readonly providerId: string;
+}
+export interface LiveDisclosureEmissionLease {
+    readonly snapshot: LiveDisclosureEmissionSnapshot;
+    /** Bound to snapshot.providerId; synchronous handoff under the same host fence. */
+    send(texts: readonly string[]): void | Promise<void>;
+    release(): void;
+}
+export interface LiveDisclosureOptions {
+    readonly auth: LiveDisclosureAuth;
+    readonly now?: () => number;
+    /** Must durably append synchronously or throw; unavailable audit denies emission. */
+    readonly audit?: (event: DisclosureAuditEvent) => void;
+    readonly loadEvidence: (ids: readonly string[]) => Promise<readonly LiveDisclosureEvidence[]>;
+    /** Separate verified read authority; a disclosure grant cannot create it. */
+    readonly readAccess?: (request: Readonly<{
+        principal: string;
+        repositoryId: string;
+        evidenceIds: readonly string[];
+    }>) => boolean;
+    /** Current host L4b exclusion policy. Absence/incompatibility never falls back. */
+    readonly contentPolicy?: () => Readonly<{
+        version: string;
+        allows(evidence: LiveDisclosureEvidence): boolean;
+    }> | undefined;
+    readonly transport: (providerId: string) => LiveExternalTransport | undefined;
+    /** Mandatory at handoff. Acquire one host-owned read transaction spanning
+     * trust/revocation, declaration/latest-state, clock, read authority, policy
+     * decisions for every fragment AND their concatenation, and actual routing.
+     * All relevant writers (including reentrant audit callbacks) must be fenced
+     * until release. Resolve callbacks/getters BEFORE exposing the snapshot.
+     * No promise, stale independent reads, caller booleans or unlocked fallback.
+     * The current G4 consumer stays closed until its host implements this port.
+     */
+    readonly acquireEmissionSnapshot?: (request: Readonly<{
+        request: EmitDisclosureRequest;
+        issuingCapability: unknown;
+        evidence: readonly LiveDisclosureEvidence[];
+        transport: LiveExternalTransport;
+    }>) => LiveDisclosureEmissionLease | Refused;
+}
+export interface GrantDisclosureRequest {
+    readonly capability: unknown;
+    readonly repositoryId: string;
+    readonly providerId: string;
+    readonly scope: DisclosureScope;
+    /** Absolute exclusive bound in milliseconds, also bounded by the owner proof. */
+    readonly expiresAt: number;
+}
+export interface EmitDisclosureRequest {
+    readonly capability: unknown;
+    readonly grantId?: string;
+    readonly repositoryId: string;
+    readonly providerId: string;
+    readonly evidenceIds: readonly string[];
+}
+export interface LiveDisclosureAuthority {
+    grant(request: GrantDisclosureRequest): Refused | Readonly<{
+        ok: true;
+        grantId: string;
+        expiresAt: number;
+    }>;
+    revoke(capability: unknown, grantId: string): Refused | Readonly<{
+        ok: true;
+    }>;
+    emit(request: EmitDisclosureRequest): Promise<Refused | Readonly<{
+        ok: true;
+    }>>;
+    /** G4's missing L8 policy is a typed, audited refusal before any read. */
+    policyUnavailable(): Refused;
+}
+export declare function createLiveDisclosureAuthority(options: LiveDisclosureOptions): LiveDisclosureAuthority;
+//# sourceMappingURL=live-disclosure.d.ts.map

package/dist/gateway-host/live-disclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-disclosure.d.ts","sourceRoot":"","sources":["../../src/gateway-host/live-disclosure.ts"],"names":[],"mappings":"AAMA,OAAO,EACG,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EACvD,KAAK,2BAA2B,EAA6B,KAAK,OAAO,EAC1E,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,mBAAmB,gGAAiG,CAAC;AAClI,MAAM,MAAM,iBAAiB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACnE,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AACD,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,cAAc,GAAG,QAAQ,CAAC;IAChE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AACD,MAAM,WAAW,qBAAqB;IACpC,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,IAAI,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AACD;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;IAC1D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,OAAO,EAAE,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1G,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AACD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,8BAA8B,CAAC;IAClD,mFAAmF;IACnF,IAAI,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,IAAI,IAAI,CAAC;CACjB;AACD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACvD,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAAC;IAC9F,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;KACzE,CAAC,KAAK,OAAO,CAAC;IACf,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,QAAQ,CAAC;QACtC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC;KACpE,CAAC,GAAG,SAAS,CAAC;IACf,QAAQ,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,qBAAqB,GAAG,SAAS,CAAC;IAC9E;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QACpD,OAAO,EAAE,qBAAqB,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAC;QAC3D,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;QAAC,SAAS,EAAE,qBAAqB,CAAC;KAC/E,CAAC,KAAK,2BAA2B,GAAG,OAAO,CAAC;CAC9C;AACD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AACD,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,GAAG,QAAQ,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7G,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAChF,0EAA0E;IAC1E,iBAAiB,IAAI,OAAO,CAAC;CAC9B;AA2BD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,qBAAqB,GAAG,uBAAuB,CAiMrG"}

package/dist/gateway-host/live-disclosure.js

@@ -0,0 +1,347 @@
+/** Δ-L7a: host-owned disclosure grants, independent of collection/read access.
+ * Evidence comes only from a host port (including cache provenance), never
+ * directly from an MCP caller. No content or old snapshot is retained; grants
+ * and their issuing proofs live only in memory and never resume after restart.
+ */
+import { randomUUID } from "node:crypto";
+import { refuse, } from "./live-auth.js";
+export const DISCLOSURE_SURFACES = ["prompt", "tool", "mcp", "summary", "symbol", "local-commit", "citation", "context"];
+const validPath = (path) => typeof path === "string" && path.length > 0
+    && !/[\\\0:*?\[\]{}]/.test(path) && path.split("/").every((p) => p !== "" && p !== "." && p !== "..");
+const validProvider = (v) => typeof v === "string" && /^[a-z0-9][a-z0-9._:/-]{0,199}$/.test(v);
+// Superset of engram e417c33c content-policy.ts L4b-2. Keep every normative
+// secret rule, basename/prefix/suffix/segment, and secret-bearing path bytes.
+const protectedPath = (p) => containsKnownSecret(p) || p.split("/").some((part) => /^\.env/i.test(part) || /^\.ssh$/i.test(part) || /^(id_(rsa|dsa|ecdsa|ed25519)|credentials)(\.|$)/i.test(part)
+    || /^(secret|secrets|secrets\.json|service-account\.json)$/i.test(part) || /\.(pem|key|p12|pfx)$/i.test(part));
+// Defence in depth; the current L4b policy remains mandatory. This cannot
+// establish the absence of unknown secrets, nor override withheld provenance.
+const containsKnownSecret = (text) => /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16}|sk-[A-Za-z0-9_-]{20,}/.test(text)
+    || /(password|passwd|pwd|secret|api[_-]?key)\s*[:=]\s*\S+/i.test(text)
+    || /:\/\/[^/\s:]+:[^/\s@]+@/.test(text);
+const copy = (value) => JSON.parse(JSON.stringify(value));
+export function createLiveDisclosureAuthority(options) {
+    const readNow = options.now ?? Date.now;
+    const now = () => { try {
+        return readNow();
+    }
+    catch {
+        return NaN;
+    } };
+    const grants = new Map();
+    const record = (action, grantId, reason, snapshotTime) => {
+        try {
+            if (!options.audit)
+                return false;
+            const at = snapshotTime ?? now();
+            if (!Number.isSafeInteger(at))
+                return false;
+            const receipt = options.audit(Object.freeze({ eventId: randomUUID(), at, action,
+                ...(grantId === undefined ? {} : { grantId }), ...(reason === undefined ? {} : { reason }) }));
+            if (receipt !== undefined) {
+                // A void-typed async callback is legal TypeScript but cannot attest a
+                // durable synchronous append. Contain its rejection as well.
+                if (receipt instanceof Promise)
+                    void receipt.catch(() => { });
+                return false;
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const deny = (reason, requestedId) => record("refuse", requestedId !== undefined && grants.has(requestedId) ? requestedId : undefined, reason)
+        ? refuse(reason) : refuse("audit-unavailable");
+    const authorize = (capability, operation, repositoryId) => {
+        try {
+            return options.auth.authorize(capability, operation, repositoryId);
+        }
+        catch {
+            return refuse("authority-unavailable");
+        }
+    };
+    const check = (r) => {
+        const auth = authorize(r.capability, "emit", r.repositoryId);
+        if (!auth.ok)
+            return auth;
+        const g = r.grantId === undefined ? undefined : grants.get(r.grantId);
+        if (!g)
+            return refuse("grant-required");
+        const issuer = authorize(g.issuingCapability, "grant", r.repositoryId);
+        if (!issuer.ok)
+            return issuer;
+        if (g.claims.repositoryId !== r.repositoryId || g.claims.principal !== auth.claims.principal
+            || g.claims.hostId !== auth.claims.hostId || g.claims.tenant !== auth.claims.tenant
+            || g.claims.declarationId !== auth.claims.declarationId || g.claims.declarationRevision !== auth.claims.declarationRevision
+            || JSON.stringify(g.claims.authorizedRoots) !== JSON.stringify(auth.claims.authorizedRoots))
+            return refuse("scope-mismatch");
+        if (g.claims.policyVersion !== auth.claims.policyVersion)
+            return refuse("policy-changed");
+        if (g.revoked)
+            return refuse("grant-revoked");
+        const time = now();
+        if (!Number.isSafeInteger(time))
+            return refuse("authority-unavailable");
+        if (time >= g.expiresAt || time < g.startsAt)
+            return refuse("grant-expired");
+        if (g.providerId !== r.providerId)
+            return refuse("provider-mismatch");
+        try {
+            if (options.readAccess?.(Object.freeze({ principal: auth.claims.principal, repositoryId: r.repositoryId,
+                evidenceIds: Object.freeze([...r.evidenceIds]) })) !== true)
+                return refuse("read-denied");
+        }
+        catch {
+            return refuse("read-denied");
+        }
+        const lateIssuer = authorize(g.issuingCapability, "grant", r.repositoryId);
+        if (!lateIssuer.ok)
+            return lateIssuer;
+        const latest = authorize(r.capability, "emit", r.repositoryId);
+        if (!latest.ok)
+            return latest;
+        if (g.revoked)
+            return refuse("grant-revoked");
+        const finalTime = now();
+        if (!Number.isSafeInteger(finalTime))
+            return refuse("authority-unavailable");
+        if (finalTime >= g.expiresAt || finalTime < g.startsAt)
+            return refuse("grant-expired");
+        return { ok: true, grant: g, claims: latest.claims, stateRevision: latest.state.stateRevision };
+    };
+    return {
+        grant(input) {
+            let r;
+            try {
+                r = copy(input);
+            }
+            catch {
+                return deny("invalid-request");
+            }
+            if (!r || !validProvider(r.providerId) || !Number.isSafeInteger(r.expiresAt)
+                || !r.scope || !Array.isArray(r.scope.paths) || r.scope.paths.length === 0 || !r.scope.paths.every(validPath)
+                || !Array.isArray(r.scope.surfaces) || r.scope.surfaces.length === 0
+                || !r.scope.surfaces.every((s) => DISCLOSURE_SURFACES.includes(s)))
+                return deny("invalid-request");
+            const auth = authorize(r.capability, "grant", r.repositoryId);
+            if (!auth.ok)
+                return deny(auth.reason);
+            const time = now();
+            if (!Number.isSafeInteger(time) || r.expiresAt <= time || r.expiresAt > auth.claims.expiresAt)
+                return deny("invalid-request");
+            const id = randomUUID();
+            const g = { issuingCapability: r.capability, claims: copy(auth.claims), providerId: r.providerId,
+                startsAt: time, expiresAt: r.expiresAt,
+                scope: { paths: Object.freeze([...r.scope.paths]), surfaces: Object.freeze([...r.scope.surfaces]) }, revoked: false };
+            grants.set(id, g);
+            if (!record("grant", id)) {
+                grants.delete(id);
+                return refuse("audit-unavailable");
+            }
+            return Object.freeze({ ok: true, grantId: id, expiresAt: g.expiresAt });
+        },
+        revoke(capability, id) {
+            const auth = authorize(capability, "revoke");
+            if (!auth.ok)
+                return deny(auth.reason, id);
+            const g = grants.get(id);
+            if (!g)
+                return deny("grant-required");
+            if (auth.claims.repositoryId !== g.claims.repositoryId || auth.claims.principal !== g.claims.principal || auth.claims.hostId !== g.claims.hostId
+                || auth.claims.tenant !== g.claims.tenant)
+                return deny("scope-mismatch", id);
+            // Revocation takes effect even if its audit sink has failed.
+            g.revoked = true;
+            return record("revoke", id) ? Object.freeze({ ok: true }) : refuse("audit-unavailable");
+        },
+        async emit(input) {
+            let r;
+            try {
+                r = copy(input);
+            }
+            catch {
+                return deny("invalid-request");
+            }
+            const reject = (reason) => deny(reason, r?.grantId);
+            if (!r || !Array.isArray(r.evidenceIds) || r.evidenceIds.length === 0
+                || r.evidenceIds.some((id) => typeof id !== "string" || id.length === 0))
+                return reject("invalid-request");
+            Object.freeze(r.evidenceIds);
+            Object.freeze(r);
+            const permitted = check(r);
+            if (!permitted.ok)
+                return reject(permitted.reason);
+            let evidence;
+            try {
+                evidence = copy(await options.loadEvidence(Object.freeze([...r.evidenceIds])));
+            }
+            catch {
+                return reject("evidence-unavailable");
+            }
+            // Freeze evidence before any policy/transport callback can mutate it.
+            try {
+                if (!Array.isArray(evidence) || evidence.length === 0)
+                    return reject("evidence-unavailable");
+                for (const e of evidence) {
+                    if (!e || !r.evidenceIds.includes(e.evidenceId) || typeof e.text !== "string" || typeof e.excluded !== "boolean"
+                        || !Array.isArray(e.originPaths) || e.originPaths.length === 0 || !e.originPaths.every(validPath))
+                        return reject("evidence-unavailable");
+                    Object.freeze(e.originPaths);
+                    Object.freeze(e);
+                }
+                if (r.evidenceIds.some(id => !evidence.some(e => e.evidenceId === id)))
+                    return reject("evidence-unavailable");
+                Object.freeze(evidence);
+            }
+            catch {
+                return reject("evidence-unavailable");
+            }
+            const screen = () => {
+                const current = check(r);
+                if (!current.ok)
+                    return current;
+                const g = current.grant;
+                const policy = options.contentPolicy?.();
+                if (!policy || typeof policy.allows !== "function")
+                    return refuse("policy-unavailable");
+                if (policy.version !== g.claims.policyVersion)
+                    return refuse("policy-changed");
+                for (const e of evidence) {
+                    if (e.repositoryId !== r.repositoryId || e.declarationId !== g.claims.declarationId
+                        || e.declarationRevision !== g.claims.declarationRevision)
+                        return refuse("scope-mismatch");
+                    if (e.policyVersion !== g.claims.policyVersion)
+                        return refuse("policy-changed");
+                    if (e.stateRevision !== current.stateRevision)
+                        return refuse("stale-evidence");
+                    if (!g.scope.surfaces.includes(e.surface) || e.originPaths.some((p) => !g.scope.paths.includes(p)))
+                        return refuse("out-of-scope");
+                    if (e.excluded || e.originPaths.some(protectedPath) || containsKnownSecret(e.text) || policy.allows(e) !== true)
+                        return refuse("secret-excluded");
+                }
+                const text = evidence.map((e) => e.text).join("");
+                if (containsKnownSecret(text) || policy.allows(Object.freeze({ ...evidence[0], text,
+                    originPaths: Object.freeze([...new Set(evidence.flatMap(e => e.originPaths))]) })) !== true)
+                    return refuse("secret-excluded");
+                return undefined;
+            };
+            try {
+                const refusal = screen();
+                if (refusal)
+                    return reject(refusal.reason);
+            }
+            catch {
+                return reject("policy-unavailable");
+            }
+            let transport;
+            try {
+                transport = options.transport(r.providerId);
+                if (!transport || transport.providerId !== r.providerId || typeof transport.send !== "function")
+                    return reject("provider-mismatch");
+            }
+            catch {
+                return reject("transport-failed");
+            }
+            // Reordering mutable callbacks cannot make the decision atomic.
+            // Require a host snapshot lease; final validation uses data only.
+            if (!options.acquireEmissionSnapshot)
+                return reject("authority-unavailable");
+            let lease;
+            try {
+                const acquired = options.acquireEmissionSnapshot(Object.freeze({ request: r,
+                    issuingCapability: permitted.grant.issuingCapability, evidence, transport }));
+                if ("ok" in acquired)
+                    return reject(acquired.reason);
+                lease = acquired;
+            }
+            catch {
+                return reject("authority-unavailable");
+            }
+            let pending;
+            let releaseFailed = false;
+            try {
+                // Resolve accessors before validation, while the host fence is held.
+                const send = lease.send.bind(lease);
+                const snapshot = copy(lease.snapshot);
+                const auth = snapshot.authorization;
+                const issuer = snapshot.issuerAuthorization;
+                if (!auth.ok)
+                    return reject(auth.reason);
+                if (!issuer.ok)
+                    return reject(issuer.reason);
+                const g = permitted.grant;
+                if (auth.claims.id !== permitted.claims.id || issuer.claims.id !== g.claims.id)
+                    return reject("scope-mismatch");
+                // Bind both proofs and their states to this grant. No live authority,
+                // read, clock, policy or route callbacks run during this validation.
+                for (const verified of [auth, issuer]) {
+                    for (const key of ["principal", "hostId", "tenant", "repositoryId", "declarationId", "declarationRevision"]) {
+                        if (verified.claims[key] !== g.claims[key] || verified.state[key] !== g.claims[key])
+                            return reject("scope-mismatch");
+                    }
+                    if (JSON.stringify(verified.claims.authorizedRoots) !== JSON.stringify(g.claims.authorizedRoots)
+                        || JSON.stringify(verified.state.authorizedRoots) !== JSON.stringify(g.claims.authorizedRoots))
+                        return reject("scope-mismatch");
+                    if (verified.claims.policyVersion !== g.claims.policyVersion || verified.state.policyVersion !== g.claims.policyVersion)
+                        return reject("policy-changed");
+                    if (snapshot.at < verified.claims.issuedAt || snapshot.at >= verified.claims.expiresAt)
+                        return reject("capability-expired");
+                }
+                if (g.revoked)
+                    return reject("grant-revoked");
+                if (!Number.isSafeInteger(snapshot.at))
+                    return reject("authority-unavailable");
+                if (snapshot.at < g.startsAt || snapshot.at >= g.expiresAt)
+                    return reject("grant-expired");
+                if (snapshot.readAllowed !== true)
+                    return reject("read-denied");
+                if (snapshot.providerId !== r.providerId)
+                    return reject("provider-mismatch");
+                if (evidence.some(e => e.stateRevision !== auth.state.stateRevision || e.stateRevision !== issuer.state.stateRevision))
+                    return reject("stale-evidence");
+                const policy = snapshot.policy;
+                if (!policy)
+                    return reject("policy-unavailable");
+                if (policy.version !== g.claims.policyVersion)
+                    return reject("policy-changed");
+                if (policy.allowed.length !== evidence.length || policy.allowed.some(allowed => allowed !== true)
+                    || policy.compositionAllowed !== true)
+                    return reject("secret-excluded");
+                // All route/policy/state checks precede the receipt. The host fence
+                // covers audit; a reentrant revocation of our local grant still wins.
+                if (!record("emit-attempt", r.grantId, undefined, snapshot.at))
+                    return refuse("audit-unavailable");
+                if (g.revoked)
+                    return reject("grant-revoked");
+                try {
+                    pending = send(Object.freeze(evidence.map(e => e.text)));
+                }
+                catch {
+                    return reject("transport-failed");
+                }
+            }
+            catch {
+                return reject("authority-unavailable");
+            }
+            finally {
+                try {
+                    lease.release();
+                }
+                catch {
+                    releaseFailed = true;
+                }
+            }
+            try {
+                await pending;
+            }
+            catch {
+                return reject("transport-failed");
+            }
+            if (releaseFailed)
+                return reject("authority-unavailable");
+            return Object.freeze({ ok: true });
+        },
+        policyUnavailable: () => deny("policy-unavailable"),
+    };
+}
+//# sourceMappingURL=live-disclosure.js.map

package/dist/gateway-host/live-disclosure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-disclosure.js","sourceRoot":"","sources":["../../src/gateway-host/live-disclosure.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,MAAM,GAEP,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,CAAU,CAAC;AAkHlI,MAAM,SAAS,GAAG,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;OAC3F,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;AACxG,MAAM,aAAa,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrH,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,aAAa,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACjG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC;OAC3G,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACjH,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAW,EAAE,CACpD,sIAAsI,CAAC,IAAI,CAAC,IAAI,CAAC;OAC9I,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC;OACnE,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,MAAM,IAAI,GAAG,CAAI,KAAQ,EAAK,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC;AAExE,MAAM,UAAU,6BAA6B,CAAC,OAA8B;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACxC,MAAM,GAAG,GAAG,GAAW,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,MAAsC,EAAE,OAAgB,EAAE,MAA0B,EAAE,YAAqB,EAAW,EAAE;QACtI,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACjC,MAAM,EAAE,GAAG,YAAY,IAAI,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9E,MAAM,OAAO,GAAY,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM;gBACtF,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACjG,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,sEAAsE;gBACtE,6DAA6D;gBAC7D,IAAI,OAAO,YAAY,OAAO;oBAAE,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC7D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAE,WAAoB,EAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,EACxF,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC;QACvF,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,UAAmB,EAAE,SAAsC,EAAE,YAAqB,EAA+B,EAAE;QACpI,IAAI,CAAC;YAAC,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAAC,CAAC;QAC3E,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAAC,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,CAAwB,EAA6F,EAAE;QACpI,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS;eACvF,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;eAChF,CAAC,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM,CAAC,mBAAmB,KAAK,IAAI,CAAC,MAAM,CAAC,mBAAmB;eACxH,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/H,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1F,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC5F,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY;gBACrG,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QACzC,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC7E,IAAI,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,GAAG,CAAC,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;IAClG,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK;YACT,IAAI,CAAyB,CAAC;YAC9B,IAAI,CAAC;gBAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAAC,CAAC;YAClE,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;mBACvE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;mBAC1G,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;mBACjE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACrG,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9H,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,CAAC,GAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;gBACrG,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACxH,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAC,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAAC,CAAC;YACpF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,UAAU,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM;mBAC3I,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAC/E,6DAA6D;YAC7D,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;YACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,IAAI,CAAwB,CAAC;YAC7B,IAAI,CAAC;gBAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAAC,CAAC;YAClE,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAChF,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;mBAChE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;gBAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7G,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/E,IAAI,QAA2C,CAAC;YAChD,IAAI,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YACvF,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAAC,CAAC;YAChD,sEAAsE;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBAC7F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS;2BAC3G,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC;wBAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;oBAC3I,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;oBAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;oBAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBAC9G,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAAC,CAAC;YAClD,MAAM,MAAM,GAAG,GAAwB,EAAE;gBACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,EAAE;oBAAE,OAAO,OAAO,CAAC;gBAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;gBACxB,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;gBACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU;oBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACxF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC/E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa;2BAC9E,CAAC,CAAC,mBAAmB,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB;wBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBAC7F,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa;wBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBAChF,IAAI,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;wBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBAC/E,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;wBAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;oBAC1I,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;wBAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACpJ,CAAC;gBACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAE,EAAE,IAAI;oBAClF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAChI,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;gBAAC,IAAI,OAAO;oBAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAAC,CAAC;YAChD,IAAI,SAA4C,CAAC;YACjD,IAAI,CAAC;gBACH,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBAC5C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACtI,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAAC,CAAC;YAC9C,gEAAgE;YAChE,kEAAkE;YAClE,IAAI,CAAC,OAAO,CAAC,uBAAuB;gBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC7E,IAAI,KAAkC,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;oBACzE,iBAAiB,EAAE,SAAS,CAAC,KAAK,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;gBAChF,IAAI,IAAI,IAAI,QAAQ;oBAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrD,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAAC,CAAC;YACnD,IAAI,OAA6B,CAAC;YAClC,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC;gBACH,qEAAqE;gBACrE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC;gBACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,mBAAmB,CAAC;gBAC5C,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,EAAE;oBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;gBAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAChH,sEAAsE;gBACtE,qEAAqE;gBACrE,KAAK,MAAM,QAAQ,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;oBACtC,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,CAAU,EAAE,CAAC;wBACrH,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;4BAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBACvH,CAAC;oBACD,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;2BAC3F,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;wBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBAClI,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa;wBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBACzJ,IAAI,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS;wBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC9H,CAAC;gBACD,IAAI,CAAC,CAAC,OAAO;oBAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBAC/E,IAAI,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS;oBAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC3F,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI;oBAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;gBAChE,IAAI,QAAQ,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;oBAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBAC7E,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACxJ,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC/B,IAAI,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACjD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa;oBAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC/E,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC;uBAC5F,MAAM,CAAC,kBAAkB,KAAK,IAAI;oBAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,oEAAoE;gBACpE,sEAAsE;gBACtE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBACnG,IAAI,CAAC,CAAC,OAAO;oBAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC9C,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACjE,MAAM,CAAC;oBAAC,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAAC,CAAC;oBAC3C,CAAC;gBAAC,IAAI,CAAC;oBAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,aAAa,GAAG,IAAI,CAAC;gBAAC,CAAC;YAAC,CAAC;YACpE,IAAI,CAAC;gBAAC,MAAM,OAAO,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAAC,CAAC;YACnE,IAAI,aAAa;gBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/gateway-host/live-host.d.ts

@@ -0,0 +1,20 @@
+/** G4 composition deliberately remains closed: the pinned dependencies have no
+ * L8 publication policy contract. Wiring a caller-supplied boolean here would
+ * manufacture authority. The collector and session gateway stay independent.
+ */
+import { type LiveDisclosureOptions } from "./live-disclosure.js";
+export declare function createLiveDisclosureHost(options: LiveDisclosureOptions): Readonly<{
+    grant: (request: import("./live-disclosure.js").GrantDisclosureRequest) => import("./live-auth.js").Refused | Readonly<{
+        ok: true;
+        grantId: string;
+        expiresAt: number;
+    }>;
+    revoke: (capability: unknown, grantId: string) => import("./live-auth.js").Refused | Readonly<{
+        ok: true;
+    }>;
+    emit: (_request: unknown) => Promise<Readonly<{
+        ok: false;
+        reason: import("./live-auth.js").DisclosureRefusal;
+    }>>;
+}>;
+//# sourceMappingURL=live-host.d.ts.map

package/dist/gateway-host/live-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-host.d.ts","sourceRoot":"","sources":["../../src/gateway-host/live-host.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAiC,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEjG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,qBAAqB;;;;;;;;;qBAK5C,OAAO;;;;GAEjC"}

package/dist/gateway-host/live-host.js

@@ -0,0 +1,14 @@
+/** G4 composition deliberately remains closed: the pinned dependencies have no
+ * L8 publication policy contract. Wiring a caller-supplied boolean here would
+ * manufacture authority. The collector and session gateway stay independent.
+ */
+import { createLiveDisclosureAuthority } from "./live-disclosure.js";
+export function createLiveDisclosureHost(options) {
+    const authority = createLiveDisclosureAuthority(options);
+    return Object.freeze({
+        grant: authority.grant,
+        revoke: authority.revoke,
+        emit: async (_request) => authority.policyUnavailable(),
+    });
+}
+//# sourceMappingURL=live-host.js.map

package/dist/gateway-host/live-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-host.js","sourceRoot":"","sources":["../../src/gateway-host/live-host.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,6BAA6B,EAA8B,MAAM,sBAAsB,CAAC;AAEjG,MAAM,UAAU,wBAAwB,CAAC,OAA8B;IACrE,MAAM,SAAS,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,IAAI,EAAE,KAAK,EAAE,QAAiB,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE;KACjE,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentropic/h2a-runtime",
-  "version": "0.98.7-rc.2",
+  "version": "0.98.7-rc.3",
   "type": "module",
   "exports": {
     ".": {