@tiangong-lca/cli 0.0.28 → 0.0.29

package/dist/src/lib/dataset-maintenance-flow-identity-approval-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-maintenance-flow-identity-approval-claim.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-flow-identity-approval-claim.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAC/B,MAAM,IAAI,GAAG,4EAA4E,CAAC;AAC1F,MAAM,KAAK,GAAG,oBAAoB,CAAC;AACnC,MAAM,UAAU,GAAG;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,0BAA0B;IAC1B,2BAA2B;IAC3B,YAAY;IACZ,aAAa;IACb,aAAa;IACb,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,kBAAkB;IAClB,aAAa;IACb,eAAe;IACf,mBAAmB;IACnB,0BAA0B;IAC1B,mBAAmB;CACX,CAAC;AAsBX,SAAS,IAAI,CAAC,OAAe,EAAE,IAAY,EAAE,OAAiB;IAC5D,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,OAAO,CACZ,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,IAAI,KAAK;QACd,KAA+B,CAAC,IAAI,KAAK,IAAI,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY,EAAE,QAAyB;IACzE,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,cAAc;IACd,OAAO,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc,EAAE,SAAiB;IAChE,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7B,IAAI,CACF,+IAA+I,EAC/I,gDAAgD,EAChD,EAAE,UAAU,EAAE,SAAS,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,gBAAwB;IAC7D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,IAAI,CACF,gEAAgE,EAChE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAA2C,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC9D,IACE,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QACzC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5D,KAAK,CAAC,cAAc,KAAK,+CAA+C;QACxE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS;QAC/C,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9D,KAAK,CAAC,wBAAwB,KAAK,gBAAgB;QACnD,CAAC;YACC,KAAK,CAAC,wBAAwB;YAC9B,KAAK,CAAC,yBAAyB;YAC/B,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,aAAa;SACpB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5B,KAAK,CAAC,WAAW,KAAK,YAAY;QAClC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;QACzB,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;QAC/B,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QAC9B,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5D,KAAK,CAAC,iBAAiB,KAAK,aAAa;QACzC,KAAK,CAAC,gBAAgB,KAAK,gDAAgD;QAC3E,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,eAAe;QACjD,KAAK,CAAC,wBAAwB,KAAK,CAAC;QACpC,KAAK,CAAC,iBAAiB,KAAK,KAAK,EACjC,CAAC;QACD,IAAI,CACF,gEAAgE,EAChE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,KAAkC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,OAIpD;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACtD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QACtD,IAAI,YAAY;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAG7C;IACC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/C,IAAI,CACF,8EAA8E,EAC9E,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAC/B,qBAAqB,EACrB,eAAe,EACf,IAAI,EACJ,GAAG,OAAO,CAAC,sBAAsB,aAAa,CAC/C,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CAAC,OAIzC;IACC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,oCAAoC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1F,sBAAsB,EAAE,OAAO,CAAC,KAAK,CAAC,wBAAwB;KAC/D,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IACnD,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9C,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACC,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,oCAAoC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1F,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;KACvD,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,IACE,CAAC,QAAQ,CAAC,MAAM,EAAE;QAClB,QAAQ,CAAC,cAAc,EAAE;QACzB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAC5D,CAAC;QACD,OAAO,IAAI,CACT,sEAAsE,EACtE,8CAA8C,EAC9C,EAAE,UAAU,EAAE,SAAS,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,sDAAsD,EACtD,8CAA8C,EAC9C,EAAE,UAAU,EAAE,SAAS,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CACT,8DAA8D,EAC9D,8CAA8C,EAC9C,EAAE,UAAU,EAAE,SAAS,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,0BAA0B;IAC1B,OAAO;IACP,uBAAuB;IACvB,aAAa;CACd,CAAC","sourcesContent":["import {\n  closeSync,\n  existsSync,\n  fsyncSync,\n  lstatSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  writeFileSync,\n} from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { stableJsonText } from './dataset-maintenance-contract.js';\nimport { CliError } from './errors.js';\n\nconst HASH = /^[a-f0-9]{64}$/u;\nconst UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;\nconst EMAIL = /^[^\\s@]+@[^\\s@]+$/u;\nconst CLAIM_KEYS = [\n  'schema_version',\n  'claimed_at_utc',\n  'approval_kind',\n  'approval_identity_sha256',\n  'execution_identity_sha256',\n  'request_id',\n  'environment',\n  'project_ref',\n  'actor_user_id',\n  'actor_email',\n  'target_visibility',\n  'user_state_claim',\n  'plan_sha256',\n  'freeze_sha256',\n  'canonical_out_dir',\n  'maximum_cli_apply_spawns',\n  'approval_reusable',\n] as const;\n\nexport type FlowIdentityApprovalClaim = {\n  schema_version: 'dataset-flow-identity-local-approval-claim.v1';\n  claimed_at_utc: string;\n  approval_kind: 'initial' | 'recovery';\n  approval_identity_sha256: string;\n  execution_identity_sha256: string;\n  request_id: string;\n  environment: 'production';\n  project_ref: string;\n  actor_user_id: string;\n  actor_email: string;\n  target_visibility: 'owner_draft';\n  user_state_claim: 'authenticated_actor_state_100_plus_own_state_0';\n  plan_sha256: string;\n  freeze_sha256: string;\n  canonical_out_dir: string;\n  maximum_cli_apply_spawns: 1;\n  approval_reusable: false;\n};\n\nfunction fail(message: string, code: string, details?: unknown): never {\n  throw new CliError(message, { code, exitCode: 1, details });\n}\n\nfunction isErrno(error: unknown, code: string): boolean {\n  return Boolean(\n    error &&\n    typeof error === 'object' &&\n    'code' in error &&\n    (error as NodeJS.ErrnoException).code === code,\n  );\n}\n\nfunction hasPrivateClaimPermissions(mode: number, platform: NodeJS.Platform): boolean {\n  // Windows does not expose its ACLs through POSIX permission bits. The claim\n  // still has to be a non-symlink regular file and is created exclusively below\n  // the current user's state directory; enforce 0600-style bits where they are\n  // meaningful.\n  return platform === 'win32' || (mode & 0o077) === 0;\n}\n\nfunction rethrowClaimCreateError(error: unknown, claimPath: string): never {\n  if (isErrno(error, 'EEXIST')) {\n    fail(\n      'This exact flow identity approval was already claimed by a CLI wrapper. Only read-only status or a newly frozen recovery approval is allowed.',\n      'DATASET_FLOW_IDENTITY_APPROVAL_ALREADY_CLAIMED',\n      { claim_path: claimPath },\n    );\n  }\n  throw error;\n}\n\nfunction validateClaim(value: unknown, expectedIdentity: string): FlowIdentityApprovalClaim {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    fail(\n      'Existing flow identity approval claim is malformed or foreign.',\n      'DATASET_FLOW_IDENTITY_APPROVAL_CLAIM_INVALID',\n    );\n  }\n  const claim = value as Partial<FlowIdentityApprovalClaim>;\n  const actualKeys = Object.keys(claim).sort();\n  const expectedKeys = [...CLAIM_KEYS].sort();\n  const claimedAt = String(claim.claimed_at_utc ?? '');\n  const canonicalOutDir = String(claim.canonical_out_dir ?? '');\n  if (\n    actualKeys.length !== expectedKeys.length ||\n    actualKeys.some((key, index) => key !== expectedKeys[index]) ||\n    claim.schema_version !== 'dataset-flow-identity-local-approval-claim.v1' ||\n    !Number.isFinite(Date.parse(claimedAt)) ||\n    new Date(claimedAt).toISOString() !== claimedAt ||\n    !['initial', 'recovery'].includes(String(claim.approval_kind)) ||\n    claim.approval_identity_sha256 !== expectedIdentity ||\n    ![\n      claim.approval_identity_sha256,\n      claim.execution_identity_sha256,\n      claim.plan_sha256,\n      claim.freeze_sha256,\n    ].every((entry) => typeof entry === 'string' && HASH.test(entry)) ||\n    typeof claim.request_id !== 'string' ||\n    !UUID.test(claim.request_id) ||\n    claim.environment !== 'production' ||\n    typeof claim.project_ref !== 'string' ||\n    !claim.project_ref.trim() ||\n    typeof claim.actor_user_id !== 'string' ||\n    !UUID.test(claim.actor_user_id) ||\n    typeof claim.actor_email !== 'string' ||\n    !EMAIL.test(claim.actor_email) ||\n    claim.actor_email !== claim.actor_email.trim().toLowerCase() ||\n    claim.target_visibility !== 'owner_draft' ||\n    claim.user_state_claim !== 'authenticated_actor_state_100_plus_own_state_0' ||\n    !path.isAbsolute(canonicalOutDir) ||\n    path.resolve(canonicalOutDir) !== canonicalOutDir ||\n    claim.maximum_cli_apply_spawns !== 1 ||\n    claim.approval_reusable !== false\n  ) {\n    fail(\n      'Existing flow identity approval claim is malformed or foreign.',\n      'DATASET_FLOW_IDENTITY_APPROVAL_CLAIM_INVALID',\n    );\n  }\n  return claim as FlowIdentityApprovalClaim;\n}\n\nexport function resolveFlowIdentityApprovalClaimRoot(options: {\n  env: NodeJS.ProcessEnv;\n  platform?: NodeJS.Platform;\n  homeDir?: string;\n}): string {\n  const platform = options.platform ?? process.platform;\n  const homeDir = options.homeDir ?? os.homedir();\n  const xdg = options.env.XDG_STATE_HOME?.trim();\n  if (xdg) return path.resolve(xdg, 'tiangong-lca-cli');\n  if (platform === 'win32') {\n    const localAppData = options.env.LOCALAPPDATA?.trim();\n    if (localAppData) return path.resolve(localAppData, 'tiangong-lca-cli');\n  }\n  if (homeDir.trim()) {\n    return path.resolve(homeDir, '.local', 'state', 'tiangong-lca-cli');\n  }\n  if (platform === 'darwin') {\n    return path.resolve(os.homedir(), 'Library', 'Application Support', 'tiangong-lca-cli');\n  }\n  return path.resolve('.tiangong-lca-cli-state');\n}\n\nexport function flowIdentityApprovalClaimPath(options: {\n  stateRoot: string;\n  approvalIdentitySha256: string;\n}): string {\n  if (!HASH.test(options.approvalIdentitySha256)) {\n    fail(\n      'Flow identity approval claim requires a lowercase approval identity SHA-256.',\n      'DATASET_FLOW_IDENTITY_APPROVAL_CLAIM_IDENTITY_INVALID',\n    );\n  }\n  return path.join(\n    path.resolve(options.stateRoot),\n    'execution-approvals',\n    'flow-identity',\n    'v3',\n    `${options.approvalIdentitySha256}.claim.json`,\n  );\n}\n\n/** Strict create-only claim. Existing identical bytes are still consumed. */\nexport function claimFlowIdentityApproval(options: {\n  claim: FlowIdentityApprovalClaim;\n  env: NodeJS.ProcessEnv;\n  stateRoot?: string;\n}): string {\n  validateClaim(options.claim, options.claim.approval_identity_sha256);\n  const claimPath = flowIdentityApprovalClaimPath({\n    stateRoot: options.stateRoot ?? resolveFlowIdentityApprovalClaimRoot({ env: options.env }),\n    approvalIdentitySha256: options.claim.approval_identity_sha256,\n  });\n  const directory = path.dirname(claimPath);\n  mkdirSync(directory, { recursive: true, mode: 0o700 });\n  const bytes = `${stableJsonText(options.claim)}\\n`;\n  let descriptor: number | null = null;\n  try {\n    descriptor = openSync(claimPath, 'wx', 0o600);\n    writeFileSync(descriptor, bytes, 'utf8');\n    fsyncSync(descriptor);\n  } catch (error) {\n    rethrowClaimCreateError(error, claimPath);\n  } finally {\n    if (descriptor !== null) closeSync(descriptor);\n  }\n  return claimPath;\n}\n\nexport function readFlowIdentityApprovalClaim(options: {\n  approvalIdentitySha256: string;\n  env: NodeJS.ProcessEnv;\n  stateRoot?: string;\n}): FlowIdentityApprovalClaim | null {\n  const claimPath = flowIdentityApprovalClaimPath({\n    stateRoot: options.stateRoot ?? resolveFlowIdentityApprovalClaimRoot({ env: options.env }),\n    approvalIdentitySha256: options.approvalIdentitySha256,\n  });\n  if (!existsSync(claimPath)) return null;\n  const metadata = lstatSync(claimPath);\n  if (\n    !metadata.isFile() ||\n    metadata.isSymbolicLink() ||\n    !hasPrivateClaimPermissions(metadata.mode, process.platform)\n  ) {\n    return fail(\n      'Existing flow identity approval claim is not a private regular file.',\n      'DATASET_FLOW_IDENTITY_APPROVAL_CLAIM_INVALID',\n      { claim_path: claimPath },\n    );\n  }\n  let text: string;\n  let value: unknown;\n  try {\n    text = readFileSync(claimPath, 'utf8');\n    value = JSON.parse(text);\n  } catch {\n    return fail(\n      'Existing flow identity approval claim is unreadable.',\n      'DATASET_FLOW_IDENTITY_APPROVAL_CLAIM_INVALID',\n      { claim_path: claimPath },\n    );\n  }\n  if (text !== `${stableJsonText(value)}\\n`) {\n    return fail(\n      'Existing flow identity approval claim is not canonical JSON.',\n      'DATASET_FLOW_IDENTITY_APPROVAL_CLAIM_INVALID',\n      { claim_path: claimPath },\n    );\n  }\n  return validateClaim(value, options.approvalIdentitySha256);\n}\n\nexport const __testInternals = {\n  hasPrivateClaimPermissions,\n  isErrno,\n  rethrowClaimCreateError,\n  validateClaim,\n};\n"]}

package/dist/src/lib/dataset-maintenance-flow-identity-capture.js

@@ -0,0 +1,511 @@
+import path from 'node:path';
+import { existsSync } from 'node:fs';
+import { computeFlowIdentityCaptureEvidenceSha256, computeFlowIdentityCaptureSha256, parseFlowIdentityCapture, parseFlowIdentityPolicy, parseFlowIdentityReviewLedger, } from './dataset-maintenance-flow-identity-contract.js';
+import { buildFlowIdentityCaptureRequest, buildFlowIdentitySemantics, flowType, } from './dataset-maintenance-flow-identity-plan.js';
+import { materializePrivateArtifactDirectoryAtomically, readProtectedJsonArtifact, writePrivateImmutableJson, } from './dataset-maintenance-protected-artifacts.js';
+import { parseProtectedToolchainEvidence } from './dataset-maintenance-protected-toolchain.js';
+import { attestMaintenanceFlowIdentityCapture, fetchMaintenanceAccountTableRows, fetchMaintenanceExactRows, isMaintenanceRpcDomainFailure, resolveMaintenanceRemoteContext, } from './dataset-maintenance-remote.js';
+import { isJsonObject, sha256Json, snapshotRemoteRow, stableJsonText, } from './dataset-maintenance-contract.js';
+import { flowIdentityRestrictedSha256 } from './dataset-maintenance-flow-identity-wire.js';
+import { validateFlowPayload } from './flow-payload-validation.js';
+import { validateProcessPayload } from './process-payload-validation.js';
+import { CliError } from './errors.js';
+const HASH = /^[a-f0-9]{64}$/u;
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const VERSION = /^\d{2}\.\d{2}\.\d{3}$/u;
+const DEFAULT_DEPENDENCIES = {
+    resolveContext: resolveMaintenanceRemoteContext,
+    fetchAccountTableRows: fetchMaintenanceAccountTableRows,
+    fetchExactRows: fetchMaintenanceExactRows,
+    attest: attestMaintenanceFlowIdentityCapture,
+    materialize: materializePrivateArtifactDirectoryAtomically,
+};
+function fail(message, code = 'DATASET_FLOW_IDENTITY_CAPTURE_INVALID') {
+    throw new CliError(message, { code, exitCode: 1 });
+}
+function exactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function readCanonical(filePath, label) {
+    const artifact = readProtectedJsonArtifact({ filePath, label });
+    if (artifact.text !== `${stableJsonText(artifact.value)}\n`) {
+        fail(`${label} must be canonical JSON with one trailing newline.`);
+    }
+    return artifact;
+}
+export function parseFlowIdentityPrerequisites(value) {
+    if (!isJsonObject(value) ||
+        !isJsonObject(value.step2) ||
+        !isJsonObject(value.issue29_target1) ||
+        !isJsonObject(value.issue29_target2) ||
+        !exactKeys(value, ['schema_version', 'step2', 'issue29_target1', 'issue29_target2']) ||
+        !exactKeys(value.step2, ['readback_sha256', 'completed_at_utc', 'status']) ||
+        !exactKeys(value.issue29_target1, ['readback_sha256', 'completed_at_utc', 'status']) ||
+        !exactKeys(value.issue29_target2, ['readback_sha256', 'completed_at_utc', 'status'])) {
+        fail('Flow identity prerequisites are invalid.');
+    }
+    const parsed = value;
+    if (parsed.schema_version !== 'dataset-flow-identity-prerequisites.v2' ||
+        parsed.step2.status !== 'passed' ||
+        parsed.issue29_target1.status !== 'passed' ||
+        parsed.issue29_target2.status !== 'passed' ||
+        !HASH.test(parsed.step2.readback_sha256) ||
+        !HASH.test(parsed.issue29_target1.readback_sha256) ||
+        !HASH.test(parsed.issue29_target2.readback_sha256) ||
+        !Number.isFinite(Date.parse(parsed.step2.completed_at_utc)) ||
+        !Number.isFinite(Date.parse(parsed.issue29_target1.completed_at_utc)) ||
+        !Number.isFinite(Date.parse(parsed.issue29_target2.completed_at_utc))) {
+        fail('Flow identity prerequisites do not prove passed Step 2 and issue #29 readbacks.');
+    }
+    return parsed;
+}
+function snapshot(row) {
+    if (!row.user_id ||
+        row.state_code === null ||
+        !row.modified_at ||
+        !row.json_ordered ||
+        !row.json ||
+        sha256Json(row.json) !== sha256Json(row.json_ordered)) {
+        fail('A capture row is incomplete or its json/json_ordered columns differ.');
+    }
+    return snapshotRemoteRow({
+        table: row.table,
+        id: row.id,
+        version: row.version,
+        user_id: row.user_id,
+        state_code: row.state_code,
+        modified_at: row.modified_at,
+        json_ordered: row.json_ordered,
+        model_id: row.model_id,
+        rule_verification: row.rule_verification,
+    });
+}
+function identity(id, version) {
+    return `${id}\u0000${version}`;
+}
+function referenceIdentity(value) {
+    if (!isJsonObject(value) ||
+        typeof value['@refObjectId'] !== 'string' ||
+        typeof value['@version'] !== 'string' ||
+        !UUID.test(value['@refObjectId']) ||
+        !VERSION.test(value['@version'])) {
+        return null;
+    }
+    return { id: value['@refObjectId'], version: value['@version'] };
+}
+function arrayOfObjects(value) {
+    const values = Array.isArray(value) ? value : isJsonObject(value) ? [value] : [];
+    if (!values.every(isJsonObject))
+        fail('A flow support collection is malformed.');
+    return values;
+}
+function flowPropertyClaim(payload) {
+    const root = isJsonObject(payload.flowDataSet) ? payload.flowDataSet : null;
+    const information = isJsonObject(root?.flowInformation) ? root.flowInformation : null;
+    const quantitative = isJsonObject(information?.quantitativeReference)
+        ? information.quantitativeReference
+        : null;
+    const properties = isJsonObject(root?.flowProperties) ? root.flowProperties : null;
+    const referenceInternalId = quantitative?.referenceToReferenceFlowProperty;
+    const property = arrayOfObjects(properties?.flowProperty).find((entry) => entry['@dataSetInternalID'] === referenceInternalId);
+    const claim = referenceIdentity(property?.referenceToFlowPropertyDataSet);
+    if (!claim)
+        fail('A mapped flow lacks an exact reference flow-property identity.');
+    return claim;
+}
+function unitGroupClaim(payload) {
+    const root = isJsonObject(payload.flowPropertyDataSet) ? payload.flowPropertyDataSet : null;
+    const information = isJsonObject(root?.flowPropertiesInformation)
+        ? root.flowPropertiesInformation
+        : null;
+    const quantitative = isJsonObject(information?.quantitativeReference)
+        ? information.quantitativeReference
+        : null;
+    const claim = referenceIdentity(quantitative?.referenceToReferenceUnitGroup);
+    if (!claim)
+        fail('A captured flow property lacks an exact unit-group identity.');
+    return claim;
+}
+function processReferencesReviewedSource(row, reviewed) {
+    const root = isJsonObject(row.json_ordered?.processDataSet)
+        ? row.json_ordered.processDataSet
+        : null;
+    const exchanges = isJsonObject(root?.exchanges) ? root.exchanges : null;
+    const values = Array.isArray(exchanges?.exchange)
+        ? exchanges.exchange
+        : isJsonObject(exchanges?.exchange)
+            ? [exchanges.exchange]
+            : [];
+    for (const value of values) {
+        if (!isJsonObject(value))
+            fail('A captured process has a malformed exchange collection.');
+        const reference = referenceIdentity(value.referenceToFlowDataSet);
+        if (!reference)
+            fail('A captured process exchange has a malformed flow reference.');
+        if (reviewed.has(identity(reference.id, reference.version)))
+            return true;
+    }
+    return false;
+}
+async function fetchUniqueRows(options) {
+    const rows = [];
+    for (let offset = 0; offset < options.identities.length; offset += options.concurrency) {
+        const chunk = options.identities.slice(offset, offset + options.concurrency);
+        const fetched = await Promise.all(chunk.map(async (claim) => {
+            const result = await options.dependencies.fetchExactRows({
+                context: options.context,
+                table: claim.table,
+                id: claim.id,
+                version: claim.version,
+                includeJson: true,
+            });
+            const visible = result.rows.filter((row) => options.publicOnly
+                ? row.state_code === 100 && row.user_id !== options.actorUserId
+                : row.state_code === 100 ||
+                    (row.state_code === 0 && row.user_id === options.actorUserId));
+            if (visible.length !== 1) {
+                fail('A capture target/support identity is missing, duplicated, or outside visibility.');
+            }
+            return snapshot(visible[0]);
+        }));
+        rows.push(...fetched);
+    }
+    return rows.sort((left, right) => `${left.table}\u0000${identity(left.id, left.version)}`.localeCompare(`${right.table}\u0000${identity(right.id, right.version)}`));
+}
+function validateInputs(options) {
+    const concurrency = options.readConcurrency ?? 5;
+    if (!UUID.test(options.requestId))
+        fail('capture request ID must be a canonical UUID.');
+    if (!options.operationId.trim() || Buffer.byteLength(options.operationId, 'utf8') > 512) {
+        fail('capture operation ID must be a non-empty token of at most 512 UTF-8 bytes.');
+    }
+    if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > 5) {
+        fail('capture read concurrency must be an integer between 1 and 5.');
+    }
+    if (!options.sdkVersion.trim())
+        fail('capture SDK version is required.');
+    return { concurrency };
+}
+async function executeCapture(options, dependencies) {
+    const { concurrency } = validateInputs(options);
+    if (existsSync(path.resolve(options.outDir))) {
+        fail('Capture output directory already exists; protected capture artifacts are immutable.');
+    }
+    const policyArtifact = readCanonical(options.policyPath, 'Flow identity compatibility policy');
+    const reviewArtifact = readCanonical(options.reviewLedgerPath, 'Flow identity review ledger');
+    const prerequisitesArtifact = readCanonical(options.prerequisitesPath, 'Flow identity prerequisites');
+    const toolchainArtifact = readCanonical(options.toolchainEvidencePath, 'Protected toolchain evidence');
+    const policy = parseFlowIdentityPolicy(policyArtifact.value);
+    const review = parseFlowIdentityReviewLedger(reviewArtifact.value);
+    const prerequisites = parseFlowIdentityPrerequisites(prerequisitesArtifact.value);
+    if (policy.evidence_resolution_sha256 !== review.review_evidence_sha256) {
+        fail('Compatibility policy does not bind the review ledger.');
+    }
+    parseProtectedToolchainEvidence(toolchainArtifact.value, {
+        projectRef: options.expectedProjectRef,
+        cliVersion: options.cliVersion,
+    });
+    const capturedAt = options.now ?? new Date();
+    if (Date.parse(prerequisites.step2.completed_at_utc) > capturedAt.getTime() ||
+        Date.parse(prerequisites.issue29_target1.completed_at_utc) > capturedAt.getTime() ||
+        Date.parse(prerequisites.issue29_target2.completed_at_utc) > capturedAt.getTime()) {
+        fail('Capture time precedes a required passed prerequisite.');
+    }
+    const context = await dependencies.resolveContext({
+        env: options.env,
+        fetchImpl: options.fetchImpl,
+        timeoutMs: options.timeoutMs,
+        now: options.now,
+    });
+    if (context.project_ref !== options.expectedProjectRef ||
+        context.account.email.trim().toLowerCase() !== options.confirm.trim().toLowerCase()) {
+        fail('Authenticated production project/account does not match capture confirmation.');
+    }
+    const [flowCensus, processCensus] = await Promise.all([
+        dependencies.fetchAccountTableRows({
+            context,
+            userId: context.account.user_id,
+            table: 'flows',
+            stateCode: 0,
+            includeJson: true,
+            pageSize: options.pageSize,
+        }),
+        dependencies.fetchAccountTableRows({
+            context,
+            userId: context.account.user_id,
+            table: 'processes',
+            stateCode: 0,
+            includeJson: true,
+            pageSize: options.pageSize,
+        }),
+    ]);
+    const reviewed = new Set(review.entries.map((entry) => identity(entry.source.id, entry.source.version)));
+    const elementary = flowCensus.rows.filter((row) => row.json_ordered && flowType(row.json_ordered) === 'Elementary flow');
+    const observed = new Set(elementary.map((row) => identity(row.id, row.version)));
+    if (elementary.length !== 305 ||
+        observed.size !== 305 ||
+        [...reviewed].some((key) => !observed.has(key)) ||
+        [...observed].some((key) => !reviewed.has(key))) {
+        fail('Authenticated owner-draft Elementary-flow census is not the exact 305-row review universe.');
+    }
+    const sourceRows = elementary
+        .map(snapshot)
+        .sort((left, right) => identity(left.id, left.version).localeCompare(identity(right.id, right.version)));
+    const fullProcessRows = processCensus.rows
+        .map(snapshot)
+        .sort((left, right) => identity(left.id, left.version).localeCompare(identity(right.id, right.version)));
+    const processRows = fullProcessRows.filter((row) => processReferencesReviewedSource(row, reviewed));
+    const processScanProof = {
+        ...processCensus.completeness,
+        row_identity_set_sha256: sha256Json(fullProcessRows.map((row) => ({ id: row.id, version: row.version }))),
+        row_snapshot_set_sha256: sha256Json(fullProcessRows.map((row) => ({
+            id: row.id,
+            version: row.version,
+            row_sha256: row.row_sha256,
+        }))),
+    };
+    const targetClaims = [
+        ...new Map(review.entries
+            .filter((entry) => entry.disposition === 'map_public')
+            .map((entry) => [
+            identity(entry.target.id, entry.target.version),
+            {
+                table: 'flows',
+                id: entry.target.id,
+                version: entry.target.version,
+            },
+        ])).values(),
+    ];
+    const targetRows = await fetchUniqueRows({
+        identities: targetClaims,
+        context,
+        actorUserId: context.account.user_id,
+        publicOnly: true,
+        concurrency,
+        dependencies,
+    });
+    const fpClaims = [
+        ...new Map([
+            ...sourceRows.filter((row) => review.entries.some((entry) => entry.disposition === 'map_public' &&
+                entry.source.id === row.id &&
+                entry.source.version === row.version)),
+            ...targetRows,
+        ].map((row) => {
+            const claim = flowPropertyClaim(row.json_ordered);
+            return [
+                identity(claim.id, claim.version),
+                {
+                    table: 'flowproperties',
+                    ...claim,
+                },
+            ];
+        })).values(),
+    ];
+    const flowPropertyRows = await fetchUniqueRows({
+        identities: fpClaims,
+        context,
+        actorUserId: context.account.user_id,
+        publicOnly: false,
+        concurrency,
+        dependencies,
+    });
+    const unitGroupClaims = [
+        ...new Map(flowPropertyRows.map((row) => {
+            const claim = unitGroupClaim(row.json_ordered);
+            return [identity(claim.id, claim.version), { table: 'unitgroups', ...claim }];
+        })).values(),
+    ];
+    const unitGroupRows = await fetchUniqueRows({
+        identities: unitGroupClaims,
+        context,
+        actorUserId: context.account.user_id,
+        publicOnly: false,
+        concurrency,
+        dependencies,
+    });
+    const supportRows = [...flowPropertyRows, ...unitGroupRows].sort((left, right) => `${left.table}\u0000${identity(left.id, left.version)}`.localeCompare(`${right.table}\u0000${identity(right.id, right.version)}`));
+    const capture = {
+        schema_version: 'dataset-flow-identity-live-capture.v2',
+        captured_at_utc: capturedAt.toISOString(),
+        environment: 'production',
+        project_ref: context.project_ref,
+        account: {
+            user_id: context.account.user_id,
+            email: context.account.email.trim().toLowerCase(),
+        },
+        prerequisites: {
+            step2_readback_sha256: prerequisites.step2.readback_sha256,
+            step2_completed_at_utc: prerequisites.step2.completed_at_utc,
+            issue29_target1_readback_sha256: prerequisites.issue29_target1.readback_sha256,
+            issue29_target1_completed_at_utc: prerequisites.issue29_target1.completed_at_utc,
+            issue29_target2_readback_sha256: prerequisites.issue29_target2.readback_sha256,
+            issue29_target2_completed_at_utc: prerequisites.issue29_target2.completed_at_utc,
+        },
+        sdk: { package: '@tiangong-lca/tidas-sdk', version: options.sdkVersion.trim() },
+        artifact_evidence: {
+            review_ledger_sha256: review.ledger_sha256,
+            live_capture_artifact_sha256: '',
+            toolchain_evidence_sha256: toolchainArtifact.file_sha256,
+        },
+        completeness: {
+            schema_version: 'dataset-flow-identity-capture-completeness.v2',
+            source_count: 305,
+            target_count: targetRows.length,
+            support_count: supportRows.length,
+            owner_draft_process_count: fullProcessRows.length,
+            owner_draft_process_scan: processScanProof,
+        },
+        source_rows: sourceRows,
+        target_rows: targetRows,
+        support_rows: supportRows,
+        process_rows: processRows,
+        capture_request: {},
+        attestation: {},
+        capture_artifact_sha256: '',
+    };
+    capture.artifact_evidence.live_capture_artifact_sha256 =
+        computeFlowIdentityCaptureEvidenceSha256(capture);
+    const validation = {
+        validateFlow: options.validation?.validateFlow ?? validateFlowPayload,
+        validateProcess: options.validation?.validateProcess ?? validateProcessPayload,
+    };
+    const semantics = buildFlowIdentitySemantics({ policy, review, capture, validation });
+    capture.capture_request = buildFlowIdentityCaptureRequest({
+        requestId: options.requestId,
+        operationId: options.operationId,
+        policy,
+        capture,
+        mappings: semantics.mappings,
+        processTemplates: semantics.processTemplates,
+        protectedClosure: semantics.protectedClosure,
+    });
+    const requestSha256 = flowIdentityRestrictedSha256(capture.capture_request);
+    const materializeIndeterminate = (error, rawResponse) => {
+        const preferred = path.resolve(options.outDir);
+        const recoveryDir = existsSync(preferred)
+            ? `${preferred}.indeterminate-${options.requestId}`
+            : preferred;
+        dependencies.materialize(recoveryDir, (staging) => {
+            writePrivateImmutableJson(path.join(staging, 'flow-identity-capture-request.json'), capture.capture_request);
+            if (rawResponse) {
+                writePrivateImmutableJson(path.join(staging, 'flow-identity-capture-raw-response.json'), rawResponse);
+            }
+            writePrivateImmutableJson(path.join(staging, 'flow-identity-capture-indeterminate.json'), {
+                schema_version: 'dataset-flow-identity-capture-indeterminate.v2',
+                status: 'indeterminate',
+                request_id: options.requestId,
+                capture_request_sha256: requestSha256,
+                post_attempt_count: 1,
+                automatic_retry: false,
+                normal_capture_rerun_allowed: false,
+                recovery: 'operator_exact_request_status_or_replay_required',
+                error: String(error),
+            });
+        });
+    };
+    const materializeRejected = (rawResponse) => {
+        dependencies.materialize(path.resolve(options.outDir), (staging) => {
+            writePrivateImmutableJson(path.join(staging, 'flow-identity-capture-request.json'), capture.capture_request);
+            writePrivateImmutableJson(path.join(staging, 'flow-identity-capture-domain-rejection.json'), {
+                schema_version: 'dataset-flow-identity-capture-domain-rejection.v1',
+                status: 'rejected',
+                request_id: options.requestId,
+                capture_request_sha256: requestSha256,
+                post_attempt_count: 1,
+                automatic_retry: false,
+                same_request_replay_allowed: false,
+                recovery: 'new_request_and_output_directory_required',
+                response: rawResponse,
+            });
+        });
+    };
+    let rawAttestation;
+    try {
+        rawAttestation = await dependencies.attest({
+            context,
+            request: capture.capture_request,
+        });
+    }
+    catch (error) {
+        materializeIndeterminate(error);
+        throw error;
+    }
+    if (isMaintenanceRpcDomainFailure(rawAttestation)) {
+        materializeRejected(rawAttestation);
+        throw new CliError(typeof rawAttestation.message === 'string'
+            ? rawAttestation.message
+            : 'Flow identity capture was rejected by the database.', {
+            code: rawAttestation.code,
+            exitCode: 1,
+            details: rawAttestation,
+        });
+    }
+    try {
+        capture.attestation = rawAttestation;
+        capture.capture_artifact_sha256 = computeFlowIdentityCaptureSha256(capture);
+        const parsed = parseFlowIdentityCapture(capture);
+        const generatedAt = options.now ?? new Date();
+        const artifactPaths = {
+            request: path.join(path.resolve(options.outDir), 'flow-identity-capture-request.json'),
+            attestation: path.join(path.resolve(options.outDir), 'flow-identity-capture-attestation.json'),
+            live_capture: path.join(path.resolve(options.outDir), 'flow-identity-live-capture.json'),
+            report: path.join(path.resolve(options.outDir), 'flow-identity-capture-report.json'),
+        };
+        const report = {
+            schema_version: 'dataset-flow-identity-capture-report.v2',
+            generated_at_utc: generatedAt.toISOString(),
+            status: 'captured',
+            environment: 'production',
+            project_ref: parsed.project_ref,
+            actor: parsed.account,
+            operation_id: parsed.attestation.operation_id,
+            request_id: parsed.capture_request.request_id,
+            receipt_id: parsed.attestation.receipt_id,
+            receipt_proof_sha256: parsed.attestation.receipt_proof_sha256,
+            capture_request_sha256: parsed.attestation.capture_request_sha256,
+            live_capture_evidence_core_sha256: parsed.artifact_evidence.live_capture_artifact_sha256,
+            capture_artifact_sha256: parsed.capture_artifact_sha256,
+            counts: {
+                sources: 305,
+                targets: parsed.target_rows.length,
+                supports: parsed.support_rows.length,
+                owner_draft_processes: parsed.completeness.owner_draft_process_count,
+                mappings: semantics.mappings.length,
+                affected_processes: semantics.processTemplates.length,
+                rewrites: semantics.processTemplates.reduce((sum, template) => sum + template.process.rewrite_count, 0),
+            },
+            calls: {
+                capture_attest: 1,
+                scope_preflight: 0,
+                process_rewrite: 0,
+                scope_finalize: 0,
+                automatic_retry: false,
+            },
+            artifacts: artifactPaths,
+        };
+        dependencies.materialize(options.outDir, (staging) => {
+            writePrivateImmutableJson(path.join(staging, path.basename(artifactPaths.request)), parsed.capture_request);
+            writePrivateImmutableJson(path.join(staging, path.basename(artifactPaths.attestation)), parsed.attestation);
+            writePrivateImmutableJson(path.join(staging, path.basename(artifactPaths.live_capture)), parsed);
+            writePrivateImmutableJson(path.join(staging, path.basename(artifactPaths.report)), report);
+        });
+        return report;
+    }
+    catch (error) {
+        materializeIndeterminate(error, rawAttestation);
+        throw error;
+    }
+}
+export async function captureFlowIdentity(options) {
+    return executeCapture(options, DEFAULT_DEPENDENCIES);
+}
+export const __testInternals = {
+    executeCapture,
+    flowPropertyClaim,
+    parseFlowIdentityPrerequisites,
+    snapshot,
+    unitGroupClaim,
+};
+//# sourceMappingURL=dataset-maintenance-flow-identity-capture.js.map