@wildo-ai/saas-backend-lib 1.1.12 → 1.1.13

package/dist/esm/compliance/approval-seals/approval-seal-currency.backend.d.ts

@@ -0,0 +1,32 @@
+/**
+ * # Is an approval still current over its record? (#2914)
+ *
+ * A seal says what a person approved when they approved it. Whether that still describes the record is a different
+ * question, asked later: a month signed off, then a figure changed through a reopen or a write outside the operations.
+ * The seal cannot answer it alone, and the record cannot either; this file compares them.
+ *
+ * What is compared is the SEALED FIELD SET the approval's presentation carries (`subjectRecord`): the fields the tool
+ * declares the approval covers (`FunctionTool.sealedRecordFields`), shown to the person and committed to by the seal.
+ * The comparison itself is `approvalSealSubjectCurrencyOf` (`@wildo-ai/saas-models`), pure, so the operator door here
+ * and the offline verifier (`wildo seal verify --subject-record`) give one answer.
+ *
+ * Read-only, and it reads no person: the answer names the record, the standing and which sealed fields moved, never a
+ * value. So it is not recorded on the trail, unlike the bundle that hands out what the person was shown.
+ */
+import { type ApprovalSeal, type ApprovalSealSubjectCurrencyAssessment } from '@wildo-ai/saas-models';
+/** What a currency check reads: the record the approval is about, as the system, and null when it is gone. */
+export interface ApprovalSealCurrencyReads {
+    readRecord(resourceType: string, resourceId: string): Promise<Readonly<Record<string, unknown>> | null>;
+}
+/**
+ * The currency of one seal's approval over its record: CURRENT, NO_LONGER_CURRENT, SUBJECT_GONE, or NO_SEALED_FIELD_SET
+ * when its presentation carries no record values (the tool declares none, or the presentation is not available).
+ *
+ * `presentationContent` is the seal's presentation as its row holds it, or as read back from its attested file (the
+ * caller reads that file, as the bundle does). A record of another organization than the seal's reads as gone: a seal
+ * answers for its own tenant's record only.
+ *
+ * assurance-control: WILDO.AI.HUMAN_OVERSIGHT, WILDO.AUDIT.EVIDENCE_INTEGRITY — whether a person's approval still describes the record it is about is computed from the values they approved and the record as it is, never assumed.
+ */
+export declare function assessApprovalSealCurrency(seal: Pick<ApprovalSeal, 'organizationId'>, presentationContent: unknown, reads: ApprovalSealCurrencyReads): Promise<ApprovalSealSubjectCurrencyAssessment>;
+//# sourceMappingURL=approval-seal-currency.backend.d.ts.map

package/dist/esm/compliance/approval-seals/approval-seal-currency.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-seal-currency.backend.d.ts","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seal-currency.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,qCAAqC,EAC3C,MAAM,uBAAuB,CAAC;AAE/B,8GAA8G;AAC9G,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CACzG;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAC1C,mBAAmB,EAAE,OAAO,EAC5B,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,qCAAqC,CAAC,CAOhD"}

package/dist/esm/compliance/approval-seals/approval-seal-currency.backend.js

@@ -0,0 +1,36 @@
+/**
+ * # Is an approval still current over its record? (#2914)
+ *
+ * A seal says what a person approved when they approved it. Whether that still describes the record is a different
+ * question, asked later: a month signed off, then a figure changed through a reopen or a write outside the operations.
+ * The seal cannot answer it alone, and the record cannot either; this file compares them.
+ *
+ * What is compared is the SEALED FIELD SET the approval's presentation carries (`subjectRecord`): the fields the tool
+ * declares the approval covers (`FunctionTool.sealedRecordFields`), shown to the person and committed to by the seal.
+ * The comparison itself is `approvalSealSubjectCurrencyOf` (`@wildo-ai/saas-models`), pure, so the operator door here
+ * and the offline verifier (`wildo seal verify --subject-record`) give one answer.
+ *
+ * Read-only, and it reads no person: the answer names the record, the standing and which sealed fields moved, never a
+ * value. So it is not recorded on the trail, unlike the bundle that hands out what the person was shown.
+ */
+import { ApprovalSealSubjectCurrency, approvalSealSubjectCurrencyOf, humanDecisionPresentedRecordOf, } from '@wildo-ai/saas-models';
+/**
+ * The currency of one seal's approval over its record: CURRENT, NO_LONGER_CURRENT, SUBJECT_GONE, or NO_SEALED_FIELD_SET
+ * when its presentation carries no record values (the tool declares none, or the presentation is not available).
+ *
+ * `presentationContent` is the seal's presentation as its row holds it, or as read back from its attested file (the
+ * caller reads that file, as the bundle does). A record of another organization than the seal's reads as gone: a seal
+ * answers for its own tenant's record only.
+ *
+ * assurance-control: WILDO.AI.HUMAN_OVERSIGHT, WILDO.AUDIT.EVIDENCE_INTEGRITY — whether a person's approval still describes the record it is about is computed from the values they approved and the record as it is, never assumed.
+ */
+export async function assessApprovalSealCurrency(seal, presentationContent, reads) {
+    const sealed = humanDecisionPresentedRecordOf(presentationContent);
+    if (!sealed)
+        return { standing: ApprovalSealSubjectCurrency.NO_SEALED_FIELD_SET };
+    const record = await reads.readRecord(sealed.resourceType, sealed.resourceId);
+    const recordOrganizationId = record?.organizationId !== undefined && record?.organizationId !== null ? String(record.organizationId) : undefined;
+    const sameTenant = recordOrganizationId === undefined || recordOrganizationId === (seal.organizationId ?? undefined);
+    return approvalSealSubjectCurrencyOf(presentationContent, record && sameTenant ? record : null);
+}
+//# sourceMappingURL=approval-seal-currency.backend.js.map

package/dist/esm/compliance/approval-seals/approval-seal-currency.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-seal-currency.backend.js","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seal-currency.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,GAG/B,MAAM,uBAAuB,CAAC;AAO/B;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAA0C,EAC1C,mBAA4B,EAC5B,KAAgC;IAEhC,MAAM,MAAM,GAAG,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,mBAAmB,EAAE,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9E,MAAM,oBAAoB,GAAG,MAAM,EAAE,cAAc,KAAK,SAAS,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjJ,MAAM,UAAU,GAAG,oBAAoB,KAAK,SAAS,IAAI,oBAAoB,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC,CAAC;IACrH,OAAO,6BAA6B,CAAC,mBAAmB,EAAE,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClG,CAAC","sourcesContent":["/**\n * # Is an approval still current over its record? (#2914)\n *\n * A seal says what a person approved when they approved it. Whether that still describes the record is a different\n * question, asked later: a month signed off, then a figure changed through a reopen or a write outside the operations.\n * The seal cannot answer it alone, and the record cannot either; this file compares them.\n *\n * What is compared is the SEALED FIELD SET the approval's presentation carries (`subjectRecord`): the fields the tool\n * declares the approval covers (`FunctionTool.sealedRecordFields`), shown to the person and committed to by the seal.\n * The comparison itself is `approvalSealSubjectCurrencyOf` (`@wildo-ai/saas-models`), pure, so the operator door here\n * and the offline verifier (`wildo seal verify --subject-record`) give one answer.\n *\n * Read-only, and it reads no person: the answer names the record, the standing and which sealed fields moved, never a\n * value. So it is not recorded on the trail, unlike the bundle that hands out what the person was shown.\n */\nimport {\n  ApprovalSealSubjectCurrency,\n  approvalSealSubjectCurrencyOf,\n  humanDecisionPresentedRecordOf,\n  type ApprovalSeal,\n  type ApprovalSealSubjectCurrencyAssessment,\n} from '@wildo-ai/saas-models';\n\n/** What a currency check reads: the record the approval is about, as the system, and null when it is gone. */\nexport interface ApprovalSealCurrencyReads {\n  readRecord(resourceType: string, resourceId: string): Promise<Readonly<Record<string, unknown>> | null>;\n}\n\n/**\n * The currency of one seal's approval over its record: CURRENT, NO_LONGER_CURRENT, SUBJECT_GONE, or NO_SEALED_FIELD_SET\n * when its presentation carries no record values (the tool declares none, or the presentation is not available).\n *\n * `presentationContent` is the seal's presentation as its row holds it, or as read back from its attested file (the\n * caller reads that file, as the bundle does). A record of another organization than the seal's reads as gone: a seal\n * answers for its own tenant's record only.\n *\n * assurance-control: WILDO.AI.HUMAN_OVERSIGHT, WILDO.AUDIT.EVIDENCE_INTEGRITY — whether a person's approval still describes the record it is about is computed from the values they approved and the record as it is, never assumed.\n */\nexport async function assessApprovalSealCurrency(\n  seal: Pick<ApprovalSeal, 'organizationId'>,\n  presentationContent: unknown,\n  reads: ApprovalSealCurrencyReads,\n): Promise<ApprovalSealSubjectCurrencyAssessment> {\n  const sealed = humanDecisionPresentedRecordOf(presentationContent);\n  if (!sealed) return { standing: ApprovalSealSubjectCurrency.NO_SEALED_FIELD_SET };\n  const record = await reads.readRecord(sealed.resourceType, sealed.resourceId);\n  const recordOrganizationId = record?.organizationId !== undefined && record?.organizationId !== null ? String(record.organizationId) : undefined;\n  const sameTenant = recordOrganizationId === undefined || recordOrganizationId === (seal.organizationId ?? undefined);\n  return approvalSealSubjectCurrencyOf(presentationContent, record && sameTenant ? record : null);\n}\n"]}

package/dist/esm/compliance/approval-seals/approval-seal-on-record.backend.d.ts

@@ -0,0 +1,38 @@
+/**
+ * # An approval seal, as the record it approved shows it (#2913)
+ *
+ * The projection behind `GET /approval-seals/:sealId/records/:resourceType/:resourceId/:field`
+ * (`ApprovalSealsOnRecordControllerBackendService`). Pure: the controller reads the seal, its successor, the record's
+ * currency and its manifested copy's standing, and this function decides what a reader of the record is told. The
+ * contract, and why each member is safe to hand that reader, is `approval-seal-on-record.shared.schemas.ts`.
+ */
+import { ApprovalSealOnRecordState, type ApprovalSeal, type ApprovalSealOnRecordView, type ApprovalSealSubjectCurrencyAssessment } from '@wildo-ai/saas-models';
+/** What the controller found, for {@link approvalSealOnRecordViewOf}. */
+export interface ApprovalSealOnRecordFacts {
+    readonly sealId: string;
+    /** The live seal, or null when it is not live (retained after its approver's erasure, or gone). */
+    readonly seal: ApprovalSeal | null;
+    /** The seal exists, retained after its approver's erasure: nothing of it is shown but that. */
+    readonly retained: boolean;
+    /** A later decision's seal that replaced this one. */
+    readonly successor: {
+        readonly sealId?: string;
+        readonly retained?: true;
+    } | null;
+    /** The approval's currency over the record (#2914), when it was asked. */
+    readonly currency?: ApprovalSealSubjectCurrencyAssessment;
+    /** Whether the seal's manifested copy is a file this reader can download now. */
+    readonly manifestedCopyServable: boolean;
+    /** The public check's address without its query (`approvalSealPublicCheckUrlOf`); undefined with no public API URL. */
+    readonly publicCheckUrl?: string;
+}
+/** The approver's printed name, from the approver's disclosure on the row. Undefined once erased, or when none was given. */
+export declare function approvalSealApproverNameOf(seal: Pick<ApprovalSeal, 'disclosures'>): string | undefined;
+/** The state a reader of the record sees. A superseded seal is SUPERSEDED whatever its signing stood at. */
+export declare function approvalSealOnRecordStateOf(facts: Pick<ApprovalSealOnRecordFacts, 'seal' | 'retained' | 'successor'>): ApprovalSealOnRecordState;
+/**
+ * What a reader of the record is told about the seal it stores. Erased approvers keep their seal and lose their name: an
+ * APPROVER_ERASED view carries the seal id and nothing of the row. Currency names the fields that moved, never a value.
+ */
+export declare function approvalSealOnRecordViewOf(facts: ApprovalSealOnRecordFacts): ApprovalSealOnRecordView;
+//# sourceMappingURL=approval-seal-on-record.backend.d.ts.map

package/dist/esm/compliance/approval-seals/approval-seal-on-record.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-seal-on-record.backend.d.ts","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seal-on-record.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,yBAAyB,EAIzB,KAAK,YAAY,EACjB,KAAK,wBAAwB,EAC7B,KAAK,qCAAqC,EAC3C,MAAM,uBAAuB,CAAC;AAG/B,yEAAyE;AACzE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAClF,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,qCAAqC,CAAC;IAC1D,iFAAiF;IACjF,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,uHAAuH;IACvH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,6HAA6H;AAC7H,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,GAAG,SAAS,CAItG;AAED,4GAA4G;AAC5G,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,IAAI,CAAC,yBAAyB,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,yBAAyB,CAkBhJ;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,yBAAyB,GAAG,wBAAwB,CAqCrG"}

package/dist/esm/compliance/approval-seals/approval-seal-on-record.backend.js

@@ -0,0 +1,83 @@
+/**
+ * # An approval seal, as the record it approved shows it (#2913)
+ *
+ * The projection behind `GET /approval-seals/:sealId/records/:resourceType/:resourceId/:field`
+ * (`ApprovalSealsOnRecordControllerBackendService`). Pure: the controller reads the seal, its successor, the record's
+ * currency and its manifested copy's standing, and this function decides what a reader of the record is told. The
+ * contract, and why each member is safe to hand that reader, is `approval-seal-on-record.shared.schemas.ts`.
+ */
+import { ApprovalSealOnRecordState, ApprovalSealStatus, ApprovalSealSubjectCurrency, HumanDecision_PresentedFieldCurrency, } from '@wildo-ai/saas-models';
+import { ApprovalSealDisclosureClaim } from '@wildo-ai/platform-config-lib';
+/** The approver's printed name, from the approver's disclosure on the row. Undefined once erased, or when none was given. */
+export function approvalSealApproverNameOf(seal) {
+    const approver = (seal.disclosures ?? []).find((disclosure) => disclosure.claimName === ApprovalSealDisclosureClaim.APPROVER);
+    const name = approver?.value?.name;
+    return typeof name === 'string' && name.trim().length > 0 ? name : undefined;
+}
+/** The state a reader of the record sees. A superseded seal is SUPERSEDED whatever its signing stood at. */
+export function approvalSealOnRecordStateOf(facts) {
+    if (facts.retained)
+        return ApprovalSealOnRecordState.APPROVER_ERASED;
+    const seal = facts.seal;
+    if (!seal)
+        return ApprovalSealOnRecordState.NO_SEAL;
+    if (facts.successor)
+        return ApprovalSealOnRecordState.SUPERSEDED;
+    // A live row whose approver disclosure is gone was scrubbed by an erasure: the name is gone, the decision is not.
+    if (!(seal.disclosures ?? []).some((disclosure) => disclosure.claimName === ApprovalSealDisclosureClaim.APPROVER)) {
+        return ApprovalSealOnRecordState.APPROVER_ERASED;
+    }
+    switch (seal.status) {
+        case ApprovalSealStatus.SEALED:
+            return ApprovalSealOnRecordState.SEALED;
+        case ApprovalSealStatus.DEAD:
+            return ApprovalSealOnRecordState.SEAL_FAILED;
+        case ApprovalSealStatus.PENDING:
+        case ApprovalSealStatus.IN_FLIGHT:
+            return ApprovalSealOnRecordState.PENDING;
+    }
+}
+/**
+ * What a reader of the record is told about the seal it stores. Erased approvers keep their seal and lose their name: an
+ * APPROVER_ERASED view carries the seal id and nothing of the row. Currency names the fields that moved, never a value.
+ */
+export function approvalSealOnRecordViewOf(facts) {
+    const state = approvalSealOnRecordStateOf(facts);
+    const seal = facts.seal;
+    if (!seal || facts.retained)
+        return { sealId: facts.sealId, state };
+    const approverName = approvalSealApproverNameOf(seal);
+    const assessment = facts.currency;
+    const currency = assessment && assessment.standing !== ApprovalSealSubjectCurrency.NO_SEALED_FIELD_SET
+        ? {
+            standing: assessment.standing,
+            movedFields: (assessment.fields ?? []).filter((field) => field.currency !== HumanDecision_PresentedFieldCurrency.CURRENT).map((field) => field.key),
+        }
+        : undefined;
+    const copy = seal.manifestedCopy;
+    const copyNamed = copy !== null && typeof copy === 'object' && typeof copy.fileId === 'string';
+    const signed = seal.status === ApprovalSealStatus.SEALED && typeof seal.jws === 'string' && seal.jws.length > 0;
+    return {
+        sealId: facts.sealId,
+        state,
+        ...(approverName ? { approverName } : {}),
+        decidedAt: new Date(seal.decidedAt).toISOString(),
+        ...(signed && seal.sealedAt ? { sealedAt: new Date(seal.sealedAt).toISOString() } : {}),
+        meaning: seal.meaning,
+        outcome: seal.outcome,
+        ...(facts.successor?.sealId ? { supersededBySealId: facts.successor.sealId } : {}),
+        ...(currency ? { currency } : {}),
+        ...(seal.deliverableFileId
+            ? {
+                deliverable: {
+                    fileId: seal.deliverableFileId,
+                    manifestedCopyAvailable: copyNamed && facts.manifestedCopyServable,
+                    manifestedCopyErased: !copyNamed && seal.manifestedCopyAt !== undefined,
+                },
+            }
+            : {}),
+        ...(signed ? { jws: seal.jws } : {}),
+        ...(signed && facts.publicCheckUrl ? { verificationUrl: `${facts.publicCheckUrl}?jws=${encodeURIComponent(seal.jws)}` } : {}),
+    };
+}
+//# sourceMappingURL=approval-seal-on-record.backend.js.map

package/dist/esm/compliance/approval-seals/approval-seal-on-record.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-seal-on-record.backend.js","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seal-on-record.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,2BAA2B,EAC3B,oCAAoC,GAIrC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAmB5E,6HAA6H;AAC7H,MAAM,UAAU,0BAA0B,CAAC,IAAuC;IAChF,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9H,MAAM,IAAI,GAAG,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;IACnC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,2BAA2B,CAAC,KAAyE;IACnH,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,yBAAyB,CAAC,eAAe,CAAC;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,yBAAyB,CAAC,OAAO,CAAC;IACpD,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,yBAAyB,CAAC,UAAU,CAAC;IACjE,kHAAkH;IAClH,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,2BAA2B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClH,OAAO,yBAAyB,CAAC,eAAe,CAAC;IACnD,CAAC;IACD,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,kBAAkB,CAAC,MAAM;YAC5B,OAAO,yBAAyB,CAAC,MAAM,CAAC;QAC1C,KAAK,kBAAkB,CAAC,IAAI;YAC1B,OAAO,yBAAyB,CAAC,WAAW,CAAC;QAC/C,KAAK,kBAAkB,CAAC,OAAO,CAAC;QAChC,KAAK,kBAAkB,CAAC,SAAS;YAC/B,OAAO,yBAAyB,CAAC,OAAO,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAgC;IACzE,MAAM,KAAK,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACpE,MAAM,YAAY,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,IAAI,UAAU,CAAC,QAAQ,KAAK,2BAA2B,CAAC,mBAAmB;QACpG,CAAC,CAAC;YACA,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,oCAAoC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;SACpJ;QACD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,IAAI,GAAG,IAAI,CAAC,cAAyB,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA6B,CAAC,MAAM,KAAK,QAAQ,CAAC;IACzH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAChH,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QACjD,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,iBAAiB;YACxB,CAAC,CAAC;gBACA,WAAW,EAAE;oBACX,MAAM,EAAE,IAAI,CAAC,iBAAiB;oBAC9B,uBAAuB,EAAE,SAAS,IAAI,KAAK,CAAC,sBAAsB;oBAClE,oBAAoB,EAAE,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;iBACxE;aACF;YACD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,cAAc,QAAQ,kBAAkB,CAAC,IAAI,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/H,CAAC;AACJ,CAAC","sourcesContent":["/**\n * # An approval seal, as the record it approved shows it (#2913)\n *\n * The projection behind `GET /approval-seals/:sealId/records/:resourceType/:resourceId/:field`\n * (`ApprovalSealsOnRecordControllerBackendService`). Pure: the controller reads the seal, its successor, the record's\n * currency and its manifested copy's standing, and this function decides what a reader of the record is told. The\n * contract, and why each member is safe to hand that reader, is `approval-seal-on-record.shared.schemas.ts`.\n */\nimport {\n  ApprovalSealOnRecordState,\n  ApprovalSealStatus,\n  ApprovalSealSubjectCurrency,\n  HumanDecision_PresentedFieldCurrency,\n  type ApprovalSeal,\n  type ApprovalSealOnRecordView,\n  type ApprovalSealSubjectCurrencyAssessment,\n} from '@wildo-ai/saas-models';\nimport { ApprovalSealDisclosureClaim } from '@wildo-ai/platform-config-lib';\n\n/** What the controller found, for {@link approvalSealOnRecordViewOf}. */\nexport interface ApprovalSealOnRecordFacts {\n  readonly sealId: string;\n  /** The live seal, or null when it is not live (retained after its approver's erasure, or gone). */\n  readonly seal: ApprovalSeal | null;\n  /** The seal exists, retained after its approver's erasure: nothing of it is shown but that. */\n  readonly retained: boolean;\n  /** A later decision's seal that replaced this one. */\n  readonly successor: { readonly sealId?: string; readonly retained?: true } | null;\n  /** The approval's currency over the record (#2914), when it was asked. */\n  readonly currency?: ApprovalSealSubjectCurrencyAssessment;\n  /** Whether the seal's manifested copy is a file this reader can download now. */\n  readonly manifestedCopyServable: boolean;\n  /** The public check's address without its query (`approvalSealPublicCheckUrlOf`); undefined with no public API URL. */\n  readonly publicCheckUrl?: string;\n}\n\n/** The approver's printed name, from the approver's disclosure on the row. Undefined once erased, or when none was given. */\nexport function approvalSealApproverNameOf(seal: Pick<ApprovalSeal, 'disclosures'>): string | undefined {\n  const approver = (seal.disclosures ?? []).find((disclosure) => disclosure.claimName === ApprovalSealDisclosureClaim.APPROVER);\n  const name = approver?.value?.name;\n  return typeof name === 'string' && name.trim().length > 0 ? name : undefined;\n}\n\n/** The state a reader of the record sees. A superseded seal is SUPERSEDED whatever its signing stood at. */\nexport function approvalSealOnRecordStateOf(facts: Pick<ApprovalSealOnRecordFacts, 'seal' | 'retained' | 'successor'>): ApprovalSealOnRecordState {\n  if (facts.retained) return ApprovalSealOnRecordState.APPROVER_ERASED;\n  const seal = facts.seal;\n  if (!seal) return ApprovalSealOnRecordState.NO_SEAL;\n  if (facts.successor) return ApprovalSealOnRecordState.SUPERSEDED;\n  // A live row whose approver disclosure is gone was scrubbed by an erasure: the name is gone, the decision is not.\n  if (!(seal.disclosures ?? []).some((disclosure) => disclosure.claimName === ApprovalSealDisclosureClaim.APPROVER)) {\n    return ApprovalSealOnRecordState.APPROVER_ERASED;\n  }\n  switch (seal.status) {\n    case ApprovalSealStatus.SEALED:\n      return ApprovalSealOnRecordState.SEALED;\n    case ApprovalSealStatus.DEAD:\n      return ApprovalSealOnRecordState.SEAL_FAILED;\n    case ApprovalSealStatus.PENDING:\n    case ApprovalSealStatus.IN_FLIGHT:\n      return ApprovalSealOnRecordState.PENDING;\n  }\n}\n\n/**\n * What a reader of the record is told about the seal it stores. Erased approvers keep their seal and lose their name: an\n * APPROVER_ERASED view carries the seal id and nothing of the row. Currency names the fields that moved, never a value.\n */\nexport function approvalSealOnRecordViewOf(facts: ApprovalSealOnRecordFacts): ApprovalSealOnRecordView {\n  const state = approvalSealOnRecordStateOf(facts);\n  const seal = facts.seal;\n  if (!seal || facts.retained) return { sealId: facts.sealId, state };\n  const approverName = approvalSealApproverNameOf(seal);\n  const assessment = facts.currency;\n  const currency = assessment && assessment.standing !== ApprovalSealSubjectCurrency.NO_SEALED_FIELD_SET\n    ? {\n      standing: assessment.standing,\n      movedFields: (assessment.fields ?? []).filter((field) => field.currency !== HumanDecision_PresentedFieldCurrency.CURRENT).map((field) => field.key),\n    }\n    : undefined;\n  const copy = seal.manifestedCopy as unknown;\n  const copyNamed = copy !== null && typeof copy === 'object' && typeof (copy as { fileId?: unknown }).fileId === 'string';\n  const signed = seal.status === ApprovalSealStatus.SEALED && typeof seal.jws === 'string' && seal.jws.length > 0;\n  return {\n    sealId: facts.sealId,\n    state,\n    ...(approverName ? { approverName } : {}),\n    decidedAt: new Date(seal.decidedAt).toISOString(),\n    ...(signed && seal.sealedAt ? { sealedAt: new Date(seal.sealedAt).toISOString() } : {}),\n    meaning: seal.meaning,\n    outcome: seal.outcome,\n    ...(facts.successor?.sealId ? { supersededBySealId: facts.successor.sealId } : {}),\n    ...(currency ? { currency } : {}),\n    ...(seal.deliverableFileId\n      ? {\n        deliverable: {\n          fileId: seal.deliverableFileId,\n          manifestedCopyAvailable: copyNamed && facts.manifestedCopyServable,\n          manifestedCopyErased: !copyNamed && seal.manifestedCopyAt !== undefined,\n        },\n      }\n      : {}),\n    ...(signed ? { jws: seal.jws! } : {}),\n    ...(signed && facts.publicCheckUrl ? { verificationUrl: `${facts.publicCheckUrl}?jws=${encodeURIComponent(seal.jws!)}` } : {}),\n  };\n}\n"]}

package/dist/esm/compliance/approval-seals/approval-seal-presentation-read.backend.d.ts

@@ -0,0 +1,36 @@
+import type { ApprovalSeal } from '@wildo-ai/saas-models';
+import type { FilesBackendService } from '../../files/services/files.backend.service';
+import type { ExecutionContextCreatorBackendService } from '../../runtime/services/execution-context-creator.backend.service';
+/** What reading a seal's presentation found. */
+export declare enum ApprovalSealPresentationReadOutcome {
+    /** The content, from the row or from a file whose bytes match the recorded hash. */
+    CONTENT = "content",
+    /** The seal holds no presentation (a plane that builds none, or one an erasure removed). */
+    NONE = "none",
+    /** The file's bytes are not the ones the row recorded. */
+    TAMPERED = "tampered",
+    /** The row names a file nothing can read: gone from the files store, no file service bound, or a failed read. */
+    UNREADABLE = "unreadable"
+}
+export type ApprovalSealPresentationRead = {
+    readonly outcome: ApprovalSealPresentationReadOutcome.CONTENT;
+    readonly content: Record<string, unknown>;
+} | {
+    readonly outcome: ApprovalSealPresentationReadOutcome.NONE;
+} | {
+    readonly outcome: ApprovalSealPresentationReadOutcome.TAMPERED;
+    readonly fileId: string;
+} | {
+    readonly outcome: ApprovalSealPresentationReadOutcome.UNREADABLE;
+    readonly fileId: string;
+    readonly reason: string;
+};
+/** What the read needs: the `files` row a presentation names, its bytes, and the system context they are read in. */
+export interface ApprovalSealPresentationReadDependencies {
+    readonly readFileRow: (fileId: string) => Promise<Record<string, unknown> | null>;
+    readonly files?: Pick<FilesBackendService, 'readFileBytes'>;
+    readonly contexts?: Pick<ExecutionContextCreatorBackendService, 'createForInternalSystemOperation'>;
+}
+/** Read one seal's presentation, from its row or its attested file, checking the file against the hash its row recorded. */
+export declare function readApprovalSealPresentation(seal: Pick<ApprovalSeal, 'presentation'>, dependencies: ApprovalSealPresentationReadDependencies): Promise<ApprovalSealPresentationRead>;
+//# sourceMappingURL=approval-seal-presentation-read.backend.d.ts.map

package/dist/esm/compliance/approval-seals/approval-seal-presentation-read.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-seal-presentation-read.backend.d.ts","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seal-presentation-read.backend.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAQ,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,kEAAkE,CAAC;AAG9H,gDAAgD;AAChD,oBAAY,mCAAmC;IAC7C,oFAAoF;IACpF,OAAO,YAAY;IACnB,4FAA4F;IAC5F,IAAI,SAAS;IACb,0DAA0D;IAC1D,QAAQ,aAAa;IACrB,iHAAiH;IACjH,UAAU,eAAe;CAC1B;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC5G;IAAE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,IAAI,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3F;IAAE,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3H,qHAAqH;AACrH,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,qCAAqC,EAAE,kCAAkC,CAAC,CAAC;CACrG;AAED,4HAA4H;AAC5H,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EACxC,YAAY,EAAE,wCAAwC,GACrD,OAAO,CAAC,4BAA4B,CAAC,CAoBvC"}

package/dist/esm/compliance/approval-seals/approval-seal-presentation-read.backend.js

@@ -0,0 +1,51 @@
+/**
+ * # Reading a seal's presentation back (#2903 S6b, #2913)
+ *
+ * A seal's presentation is in its row, or, over the inline ceiling, in a frozen file the relay moved it to. Every reader
+ * that needs the content (the operator's bundle and currency doors, the record's view of its seal) reads it here, so a
+ * file whose bytes are not the ones the row recorded is refused the same way everywhere, never handed out as the
+ * presentation.
+ */
+import { createHash } from 'crypto';
+import { describeCaughtError } from '../../errors/utils/error-log-level-classification.backend.utils.js';
+/** What reading a seal's presentation found. */
+export var ApprovalSealPresentationReadOutcome;
+(function (ApprovalSealPresentationReadOutcome) {
+    /** The content, from the row or from a file whose bytes match the recorded hash. */
+    ApprovalSealPresentationReadOutcome["CONTENT"] = "content";
+    /** The seal holds no presentation (a plane that builds none, or one an erasure removed). */
+    ApprovalSealPresentationReadOutcome["NONE"] = "none";
+    /** The file's bytes are not the ones the row recorded. */
+    ApprovalSealPresentationReadOutcome["TAMPERED"] = "tampered";
+    /** The row names a file nothing can read: gone from the files store, no file service bound, or a failed read. */
+    ApprovalSealPresentationReadOutcome["UNREADABLE"] = "unreadable";
+})(ApprovalSealPresentationReadOutcome || (ApprovalSealPresentationReadOutcome = {}));
+/** Read one seal's presentation, from its row or its attested file, checking the file against the hash its row recorded. */
+export async function readApprovalSealPresentation(seal, dependencies) {
+    const presentation = seal.presentation;
+    if (!presentation)
+        return { outcome: ApprovalSealPresentationReadOutcome.NONE };
+    if (presentation.content)
+        return { outcome: ApprovalSealPresentationReadOutcome.CONTENT, content: presentation.content };
+    if (!presentation.file)
+        return { outcome: ApprovalSealPresentationReadOutcome.NONE };
+    const fileId = presentation.file.fileId;
+    const unreadable = (reason) => ({ outcome: ApprovalSealPresentationReadOutcome.UNREADABLE, fileId, reason });
+    if (!dependencies.files || !dependencies.contexts)
+        return unreadable('no file service is bound');
+    const fileRow = await dependencies.readFileRow(fileId);
+    if (!fileRow)
+        return unreadable('the file row is gone');
+    let bytes;
+    try {
+        bytes = await dependencies.files.readFileBytes(fileRow, await dependencies.contexts.createForInternalSystemOperation());
+    }
+    catch (error) {
+        return unreadable(describeCaughtError(error));
+    }
+    if (createHash('sha256').update(bytes).digest('hex') !== presentation.file.contentSha256) {
+        return { outcome: ApprovalSealPresentationReadOutcome.TAMPERED, fileId };
+    }
+    return { outcome: ApprovalSealPresentationReadOutcome.CONTENT, content: JSON.parse(bytes.toString('utf8')) };
+}
+//# sourceMappingURL=approval-seal-presentation-read.backend.js.map

package/dist/esm/compliance/approval-seals/approval-seal-presentation-read.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-seal-presentation-read.backend.js","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seal-presentation-read.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAIpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAEnH,gDAAgD;AAChD,MAAM,CAAN,IAAY,mCASX;AATD,WAAY,mCAAmC;IAC7C,oFAAoF;IACpF,0DAAmB,CAAA;IACnB,4FAA4F;IAC5F,oDAAa,CAAA;IACb,0DAA0D;IAC1D,4DAAqB,CAAA;IACrB,iHAAiH;IACjH,gEAAyB,CAAA;AAC3B,CAAC,EATW,mCAAmC,KAAnC,mCAAmC,QAS9C;AAeD,4HAA4H;AAC5H,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAwC,EACxC,YAAsD;IAEtD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,CAAC,IAAI,EAAE,CAAC;IAChF,IAAI,YAAY,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;IACzH,IAAI,CAAC,YAAY,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,CAAC,IAAI,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;IACxC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAgC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,mCAAmC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnJ,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC,0BAA0B,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC,sBAAsB,CAAC,CAAC;IACxD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,gCAAgC,EAAE,CAAC,CAAC;IAClI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,mCAAmC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,EAAE,CAAC;AAC1I,CAAC","sourcesContent":["/**\n * # Reading a seal's presentation back (#2903 S6b, #2913)\n *\n * A seal's presentation is in its row, or, over the inline ceiling, in a frozen file the relay moved it to. Every reader\n * that needs the content (the operator's bundle and currency doors, the record's view of its seal) reads it here, so a\n * file whose bytes are not the ones the row recorded is refused the same way everywhere, never handed out as the\n * presentation.\n */\nimport { createHash } from 'crypto';\nimport type { ApprovalSeal, File } from '@wildo-ai/saas-models';\nimport type { FilesBackendService } from '../../files/services/files.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '../../runtime/services/execution-context-creator.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/** What reading a seal's presentation found. */\nexport enum ApprovalSealPresentationReadOutcome {\n  /** The content, from the row or from a file whose bytes match the recorded hash. */\n  CONTENT = 'content',\n  /** The seal holds no presentation (a plane that builds none, or one an erasure removed). */\n  NONE = 'none',\n  /** The file's bytes are not the ones the row recorded. */\n  TAMPERED = 'tampered',\n  /** The row names a file nothing can read: gone from the files store, no file service bound, or a failed read. */\n  UNREADABLE = 'unreadable',\n}\n\nexport type ApprovalSealPresentationRead =\n  | { readonly outcome: ApprovalSealPresentationReadOutcome.CONTENT; readonly content: Record<string, unknown> }\n  | { readonly outcome: ApprovalSealPresentationReadOutcome.NONE }\n  | { readonly outcome: ApprovalSealPresentationReadOutcome.TAMPERED; readonly fileId: string }\n  | { readonly outcome: ApprovalSealPresentationReadOutcome.UNREADABLE; readonly fileId: string; readonly reason: string };\n\n/** What the read needs: the `files` row a presentation names, its bytes, and the system context they are read in. */\nexport interface ApprovalSealPresentationReadDependencies {\n  readonly readFileRow: (fileId: string) => Promise<Record<string, unknown> | null>;\n  readonly files?: Pick<FilesBackendService, 'readFileBytes'>;\n  readonly contexts?: Pick<ExecutionContextCreatorBackendService, 'createForInternalSystemOperation'>;\n}\n\n/** Read one seal's presentation, from its row or its attested file, checking the file against the hash its row recorded. */\nexport async function readApprovalSealPresentation(\n  seal: Pick<ApprovalSeal, 'presentation'>,\n  dependencies: ApprovalSealPresentationReadDependencies,\n): Promise<ApprovalSealPresentationRead> {\n  const presentation = seal.presentation;\n  if (!presentation) return { outcome: ApprovalSealPresentationReadOutcome.NONE };\n  if (presentation.content) return { outcome: ApprovalSealPresentationReadOutcome.CONTENT, content: presentation.content };\n  if (!presentation.file) return { outcome: ApprovalSealPresentationReadOutcome.NONE };\n  const fileId = presentation.file.fileId;\n  const unreadable = (reason: string): ApprovalSealPresentationRead => ({ outcome: ApprovalSealPresentationReadOutcome.UNREADABLE, fileId, reason });\n  if (!dependencies.files || !dependencies.contexts) return unreadable('no file service is bound');\n  const fileRow = await dependencies.readFileRow(fileId);\n  if (!fileRow) return unreadable('the file row is gone');\n  let bytes: Buffer;\n  try {\n    bytes = await dependencies.files.readFileBytes(fileRow as File, await dependencies.contexts.createForInternalSystemOperation());\n  } catch (error) {\n    return unreadable(describeCaughtError(error));\n  }\n  if (createHash('sha256').update(bytes).digest('hex') !== presentation.file.contentSha256) {\n    return { outcome: ApprovalSealPresentationReadOutcome.TAMPERED, fileId };\n  }\n  return { outcome: ApprovalSealPresentationReadOutcome.CONTENT, content: JSON.parse(bytes.toString('utf8')) as Record<string, unknown> };\n}\n"]}

package/dist/esm/compliance/approval-seals/approval-seal-relay-store.backend.d.ts

@@ -100,6 +100,8 @@ export declare function signedFactsOfJws(jws: string): {
     readonly claimsDigest?: string;
 };
 /** See the file's header. */
+/** How many seals of one file the file's view reads to find the one its record stores (#2913). */
+export declare const ATTESTING_SEAL_SCAN_LIMIT = 10;
 export declare class ApprovalSealRelayStore {
     private readonly repositoriesRegistry;
     private readonly clock;
@@ -113,6 +115,50 @@ export declare class ApprovalSealRelayStore {
      * finish a seal's signing and hand no field of it to anyone; an export reads through {@link read} and the reveal.
      */
     readIncludingRetained(sealId: string): Promise<ApprovalSealRelayRow | null>;
+    /**
+     * The record a seal its approver's erasure RETAINED is about, and nothing else of it (#2913): what a record's view of
+     * its seal needs to say "approver erased" only to a reader of that very record. No field of the retained row but its
+     * subject leaves this method, which is what keeps the record's view outside the reasons the completion door is
+     * unaudited (`retained-completion-door-callers.guard.test.ts`).
+     */
+    retainedSubjectOf(sealId: string): Promise<{
+        readonly resourceType: string;
+        readonly resourceId: string;
+    } | null>;
+    /**
+     * The seal that superseded one (#2913): a later decision on the same record whose seal names it in `supersedesSealId`.
+     * The id of a live successor; `retained: true` without an id for one its own approver's erasure retained, so nothing of
+     * a retained row leaves but the fact that it exists. Null when nothing superseded it. Asked within the seal's own record
+     * (the indexed subject fields): what a record shows is whether IT was approved again, and a successor about another
+     * record (a reopened decision whose answer named another row) is not that record's supersession.
+     */
+    successorOf(sealId: string, subject: {
+        readonly resourceType: string;
+        readonly resourceId: string;
+    }): Promise<{
+        readonly sealId?: string;
+        readonly retained?: true;
+    } | null>;
+    /**
+     * The live seals that attest a file as their deliverable (#2913, `deliverableFileId`, indexed), latest decision first:
+     * what a file's view of its seal chooses from. Bounded: a file is attested by a handful of decisions at most.
+     */
+    attestingFile(fileId: string, limit?: number): Promise<ApprovalSeal[]>;
+    /**
+     * The seals its approver's erasure RETAINED that attest a file, as their ids and subjects only (#2913): enough for a
+     * file's view to say "approver erased" to a reader of the file's record, after checking the seal's own record stores it.
+     * No other field of a retained row leaves this method.
+     */
+    retainedAttestingFile(fileId: string, limit?: number): Promise<Array<{
+        readonly sealId: string;
+        readonly resourceType: string;
+        readonly resourceId: string;
+    }>>;
+    /**
+     * The latest live seal of one decision whose approver is `approverUserId` (#2913): the decider's own view of the seal of
+     * their act. Another person's seal of the same decision is never returned.
+     */
+    latestOfDecisionBy(decisionRef: string, approverUserId: string): Promise<ApprovalSeal | null>;
     /**
      * Seals a relay should handle now, oldest due first: PENDING seals whose next attempt is due, and IN_FLIGHT seals whose
      * lease expired. Two simple queries, each bounded and ordered by its due instant then `_id`. A due row this version

package/dist/esm/compliance/approval-seals/approval-seal-relay-store.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-seal-relay-store.backend.d.ts","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seal-relay-store.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAEL,kBAAkB,IAAI,MAAM,EAI5B,KAAK,YAAY,EACjB,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAEhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,wFAAwF,CAAC;AAKxJ,4HAA4H;AAC5H,eAAO,MAAM,sBAAsB,QAAa,CAAC;AACjD,oDAAoD;AACpD,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAClD,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,QAAc,CAAC;AAEtD,yHAAyH;AACzH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAIrE;AAED,sCAAsC;AACtC,oBAAY,wBAAwB;IAClC,6EAA6E;IAC7E,MAAM,WAAW;IACjB,0CAA0C;IAC1C,IAAI,SAAS;IACb,yHAAyH;IACzH,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAA;CAAE,CAAC;AAE3D,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,KAAK,QAAQ,GAAG,IAAI,CAClB,yCAAyC,EACzC,2BAA2B,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,4CAA4C,GAAG,sCAAsC,CACpK,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAU/E,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,+GAA+G;AAC/G,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,yGAAyG;IACzG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAWD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAerJ;AAED,6BAA6B;AAC7B,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,oBAAoB,EAAE,QAAQ,EAC9B,KAAK,GAAE,MAAM,IAAuB;IAGvD,8DAA8D;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAIvE,6HAA6H;IACvH,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAKxD;;;OAGG;IACG,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAOjF;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,EAAE,CAAA;KAAE,CAAC;IA4BjI;;;;OAIG;IACG,uBAAuB,IAAI,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAU1D;;;;OAIG;IACG,4BAA4B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAkBvF;;;;OAIG;IACG,uBAAuB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAmBxF,0FAA0F;IAC1F,yFAAyF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAc9D,+GAA+G;IACzG,KAAK,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkBxE;;;;;OAKG;IACG,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAYrI;;;OAGG;IACH,UAAU,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAc7K;;;;;OAKG;IACH,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAQ/I,uGAAuG;IACvG,SAAS,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,GAAG,IAAI,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAQzH,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,GAAG,IAAI,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAOxH;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAKxE,OAAO,CAAC,MAAM;IAQd,oHAAoH;YACtG,YAAY;CAU3B"}
+{"version":3,"file":"approval-seal-relay-store.backend.d.ts","sourceRoot":"","sources":["../../../../src/compliance/approval-seals/approval-seal-relay-store.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAEL,kBAAkB,IAAI,MAAM,EAI5B,KAAK,YAAY,EACjB,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAEhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,wFAAwF,CAAC;AAKxJ,4HAA4H;AAC5H,eAAO,MAAM,sBAAsB,QAAa,CAAC;AACjD,oDAAoD;AACpD,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAClD,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,QAAc,CAAC;AAEtD,yHAAyH;AACzH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAIrE;AAED,sCAAsC;AACtC,oBAAY,wBAAwB;IAClC,6EAA6E;IAC7E,MAAM,WAAW;IACjB,0CAA0C;IAC1C,IAAI,SAAS;IACb,yHAAyH;IACzH,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAA;CAAE,CAAC;AAE3D,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,KAAK,QAAQ,GAAG,IAAI,CAClB,yCAAyC,EACzC,2BAA2B,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,4CAA4C,GAAG,sCAAsC,CACpK,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAU/E,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,+GAA+G;AAC/G,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,yGAAyG;IACzG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAWD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAerJ;AAED,6BAA6B;AAC7B,kGAAkG;AAClG,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,oBAAoB,EAAE,QAAQ,EAC9B,KAAK,GAAE,MAAM,IAAuB;IAGvD,8DAA8D;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAIvE,6HAA6H;IACvH,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAKxD;;;OAGG;IACG,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAOjF;;;;;OAKG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAMvH;;;;;;OAMG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GACtE,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAQzE;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAA4B,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAU/F;;;;OAIG;IACG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IASvL;;;OAGG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IASnG;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,EAAE,CAAA;KAAE,CAAC;IA4BjI;;;;OAIG;IACG,uBAAuB,IAAI,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAU1D;;;;OAIG;IACG,4BAA4B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAkBvF;;;;OAIG;IACG,uBAAuB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAmBxF,0FAA0F;IAC1F,yFAAyF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAc9D,+GAA+G;IACzG,KAAK,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkBxE;;;;;OAKG;IACG,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAYrI;;;OAGG;IACH,UAAU,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAc7K;;;;;OAKG;IACH,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAQ/I,uGAAuG;IACvG,SAAS,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,GAAG,IAAI,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAQzH,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,GAAG,IAAI,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAOxH;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAKxE,OAAO,CAAC,MAAM;IAQd,oHAAoH;YACtG,YAAY;CAU3B"}

package/dist/esm/compliance/approval-seals/approval-seal-relay-store.backend.js

@@ -93,6 +93,8 @@ export function signedFactsOfJws(jws) {
     };
 }
 /** See the file's header. */
+/** How many seals of one file the file's view reads to find the one its record stores (#2913). */
+export const ATTESTING_SEAL_SCAN_LIMIT = 10;
 export class ApprovalSealRelayStore {
     repositoriesRegistry;
     clock;
@@ -120,6 +122,72 @@ export class ApprovalSealRelayStore {
         const [retained] = await this.repositoriesRegistry.findRetainedForCompletionForInfrastructure(SEALS, { _id: sealId });
         return retained ? parseSeal(retained, true) : null;
     }
+    /**
+     * The record a seal its approver's erasure RETAINED is about, and nothing else of it (#2913): what a record's view of
+     * its seal needs to say "approver erased" only to a reader of that very record. No field of the retained row but its
+     * subject leaves this method, which is what keeps the record's view outside the reasons the completion door is
+     * unaudited (`retained-completion-door-callers.guard.test.ts`).
+     */
+    async retainedSubjectOf(sealId) {
+        const [retained] = await this.repositoriesRegistry.findRetainedForCompletionForInfrastructure(SEALS, { _id: sealId }, undefined, undefined, { sort: [{ field: '_id', order: SortOrder.ASC }], limit: 1 });
+        if (!retained || typeof retained.linkedResourceType !== 'string' || typeof retained.linkedResourceId !== 'string')
+            return null;
+        return { resourceType: retained.linkedResourceType, resourceId: retained.linkedResourceId };
+    }
+    /**
+     * The seal that superseded one (#2913): a later decision on the same record whose seal names it in `supersedesSealId`.
+     * The id of a live successor; `retained: true` without an id for one its own approver's erasure retained, so nothing of
+     * a retained row leaves but the fact that it exists. Null when nothing superseded it. Asked within the seal's own record
+     * (the indexed subject fields): what a record shows is whether IT was approved again, and a successor about another
+     * record (a reopened decision whose answer named another row) is not that record's supersession.
+     */
+    async successorOf(sealId, subject) {
+        const filter = { linkedResourceType: subject.resourceType, linkedResourceId: subject.resourceId, supersedesSealId: sealId };
+        const [live] = await this.repositoriesRegistry.findManyForInfrastructure(SEALS, filter, undefined, undefined, { sort: [{ field: 'decidedAt', order: SortOrder.DESC }], limit: 1 });
+        if (live)
+            return { sealId: String(live._id) };
+        const [retained] = await this.repositoriesRegistry.findRetainedForCompletionForInfrastructure(SEALS, filter, undefined, undefined, { sort: [{ field: 'decidedAt', order: SortOrder.DESC }], limit: 1 });
+        return retained ? { retained: true } : null;
+    }
+    /**
+     * The live seals that attest a file as their deliverable (#2913, `deliverableFileId`, indexed), latest decision first:
+     * what a file's view of its seal chooses from. Bounded: a file is attested by a handful of decisions at most.
+     */
+    async attestingFile(fileId, limit = ATTESTING_SEAL_SCAN_LIMIT) {
+        const rows = await this.repositoriesRegistry.findManyForInfrastructure(SEALS, { deliverableFileId: fileId }, undefined, undefined, {
+            sort: [{ field: 'decidedAt', order: SortOrder.DESC }, { field: 'sequence', order: SortOrder.DESC }], limit,
+        });
+        return rows.flatMap((row) => {
+            const parsed = ApprovalSealSchema.safeParse(row);
+            return parsed.success ? [parsed.data] : [];
+        });
+    }
+    /**
+     * The seals its approver's erasure RETAINED that attest a file, as their ids and subjects only (#2913): enough for a
+     * file's view to say "approver erased" to a reader of the file's record, after checking the seal's own record stores it.
+     * No other field of a retained row leaves this method.
+     */
+    async retainedAttestingFile(fileId, limit = ATTESTING_SEAL_SCAN_LIMIT) {
+        const rows = await this.repositoriesRegistry.findRetainedForCompletionForInfrastructure(SEALS, { deliverableFileId: fileId }, undefined, undefined, {
+            sort: [{ field: 'decidedAt', order: SortOrder.DESC }], limit,
+        });
+        return rows.flatMap((row) => typeof row.linkedResourceType === 'string' && typeof row.linkedResourceId === 'string'
+            ? [{ sealId: String(row._id), resourceType: row.linkedResourceType, resourceId: row.linkedResourceId }]
+            : []);
+    }
+    /**
+     * The latest live seal of one decision whose approver is `approverUserId` (#2913): the decider's own view of the seal of
+     * their act. Another person's seal of the same decision is never returned.
+     */
+    async latestOfDecisionBy(decisionRef, approverUserId) {
+        const [row] = await this.repositoriesRegistry.findManyForInfrastructure(SEALS, { decisionRef, approverUserId }, undefined, undefined, {
+            sort: [{ field: 'sequence', order: SortOrder.DESC }, { field: 'decidedAt', order: SortOrder.DESC }], limit: 1,
+        });
+        if (!row)
+            return null;
+        const parsed = ApprovalSealSchema.safeParse(row);
+        return parsed.success ? parsed.data : null;
+    }
     /**
      * Seals a relay should handle now, oldest due first: PENDING seals whose next attempt is due, and IN_FLIGHT seals whose
      * lease expired. Two simple queries, each bounded and ordered by its due instant then `_id`. A due row this version