@zhin.js/agent 1.1.13 → 1.1.14

package/lib/plugin-runtime/workroom-assignment-knowledge-composition.d.ts

@@ -0,0 +1,58 @@
+import type { WorkroomCatalog } from '../workroom/catalog.js';
+import { type ProjectKnowledgeSource, type ProjectKnowledgeSourceAuthorityPort } from '../workroom/project-knowledge-registry.js';
+import type { WorkroomEphemeralAssignmentContextPublisher, WorkroomGovernedKnowledgeContentReader, WorkroomAssignmentKnowledgeContextProjector } from '../workroom/workroom-assignment-knowledge-context.js';
+import type { WorkroomDisclosureManifestAuthorityPort } from './workroom-data-governance-runtime.js';
+export interface WorkroomEphemeralAssignmentContext {
+    readonly ref: string;
+    readonly hash: string;
+    readonly assignmentId: string;
+    readonly principalId: string;
+    readonly projectId: string;
+    readonly runId: string;
+    readonly taskKey: string;
+    readonly body: unknown;
+}
+export interface WorkroomEphemeralAssignmentContextPort extends WorkroomEphemeralAssignmentContextPublisher {
+    read(ref: string, hash: string): WorkroomEphemeralAssignmentContext | undefined;
+    releaseTask(input: Readonly<{
+        projectId: string;
+        runId: string;
+        taskKey: string;
+    }>): Readonly<{
+        status: 'released';
+        released: number;
+        receiptRef: string;
+        digest: string;
+    }>;
+    dispose(): void;
+}
+export declare const workroomEphemeralAssignmentContextToken: import("@zhin.js/plugin-runtime").Token<WorkroomEphemeralAssignmentContextPort>;
+export declare const workroomAssignmentKnowledgeContextToken: import("@zhin.js/plugin-runtime").Token<WorkroomAssignmentKnowledgeContextProjector>;
+export interface CatalogProjectKnowledgeSourceAuthority extends ProjectKnowledgeSourceAuthorityPort {
+    issueSponsorDecision(input: Readonly<{
+        operationId: string;
+        projectId: string;
+        principalId: string;
+    }>): Promise<Extract<ProjectKnowledgeSource, {
+        kind: 'sponsor_decision';
+    }>>;
+}
+/** Durable historical Sponsor proof; later Catalog edits cannot rewrite past authority. */
+export declare function createCatalogProjectKnowledgeSourceAuthority(options: Readonly<{
+    catalog: Pick<WorkroomCatalog, 'read'>;
+    directory: string;
+}>): CatalogProjectKnowledgeSourceAuthority;
+/**
+ * P12 adapter. Every read creates and immediately revalidates an exact
+ * Assignment-scoped Disclosure Manifest. Missing sink policy fails closed.
+ */
+export declare function createP12WorkroomKnowledgeContentReader(options: Readonly<{
+    governance: WorkroomDisclosureManifestAuthorityPort;
+    signal: AbortSignal;
+    sinkRuleId?: string;
+}>): WorkroomGovernedKnowledgeContentReader;
+export declare function createGenerationWorkroomEphemeralAssignmentContext(options: Readonly<{
+    generation: number;
+    signal: AbortSignal;
+}>): WorkroomEphemeralAssignmentContextPort;
+//# sourceMappingURL=workroom-assignment-knowledge-composition.d.ts.map

package/lib/plugin-runtime/workroom-assignment-knowledge-composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-assignment-knowledge-composition.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/workroom-assignment-knowledge-composition.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,mCAAmC,EACzC,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EACV,2CAA2C,EAC3C,sCAAsC,EACtC,2CAA2C,EAC5C,MAAM,sDAAsD,CAAC;AAC9D,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAErG,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sCACjB,SAAQ,2CAA2C;IACjD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kCAAkC,GAAG,SAAS,CAAC;IAChF,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,GAAG,QAAQ,CAAC;QACZ,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,eAAO,MAAM,uCAAuC,iFAIjD,CAAC;AAEJ,eAAO,MAAM,uCAAuC,sFAIjD,CAAC;AAEJ,MAAM,WAAW,sCACjB,SAAQ,mCAAmC;IACzC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC;QACnC,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAAC,CAAC;CAC7E;AAED,2FAA2F;AAC3F,wBAAgB,4CAA4C,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC7E,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,GAAG,sCAAsC,CAyE1C;AAED;;;GAGG;AACH,wBAAgB,uCAAuC,CAAC,OAAO,EAAE,QAAQ,CAAC;IACxE,UAAU,EAAE,uCAAuC,CAAC;IACpD,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,GAAG,sCAAsC,CA8C1C;AAED,wBAAgB,kDAAkD,CAAC,OAAO,EAAE,QAAQ,CAAC;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,GAAG,sCAAsC,CA0E1C"}

package/lib/plugin-runtime/workroom-assignment-knowledge-composition.js

@@ -0,0 +1,218 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createToken } from '@zhin.js/plugin-runtime';
+import { canonicalWorkroomJson, digestCanonicalWorkroomValue as digest, } from '../workroom/canonical-value.js';
+import { DurableFileStore } from '../workroom/durable-file-store.js';
+import { canonicalProjectKnowledgeSource, } from '../workroom/project-knowledge-registry.js';
+export const workroomEphemeralAssignmentContextToken = createToken('zhin.agent.workroom-ephemeral-assignment-context', 'Generation-owned ephemeral Assignment Knowledge Context; bodies are never persisted');
+export const workroomAssignmentKnowledgeContextToken = createToken('zhin.agent.workroom-assignment-knowledge-context', 'Exact Profile/Project Knowledge projection and P12 reauthorization for Assignments');
+/** Durable historical Sponsor proof; later Catalog edits cannot rewrite past authority. */
+export function createCatalogProjectKnowledgeSourceAuthority(options) {
+    const store = new DurableFileStore(options.directory);
+    const target = (sourceId) => join(options.directory, `${createHash('sha256').update(sourceId).digest('hex')}.json`);
+    const read = async (sourceId) => {
+        try {
+            const value = JSON.parse(await readFile(target(sourceId), 'utf8'));
+            const body = {
+                version: 1, source: value.source, principalId: value.principalId,
+                catalogRevision: value.catalogRevision, projectDigest: value.projectDigest,
+            };
+            const canonical = { ...body, digest: digest(body) };
+            if (value.version !== 1 || value.digest !== canonical.digest
+                || canonicalWorkroomJson(value) !== canonicalWorkroomJson(canonical)) {
+                throw new Error('Project Knowledge Sponsor proof digest mismatch');
+            }
+            canonicalProjectKnowledgeSource(value.source);
+            return value;
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+    };
+    const authority = {
+        async issueSponsorDecision(input) {
+            const catalog = await options.catalog.read();
+            const definition = catalog.definitions[input.projectId];
+            if (!definition || definition.enabled === false || !definition.sponsors?.includes(input.principalId)) {
+                throw new Error('Project Knowledge control requires a current Catalog Sponsor');
+            }
+            const source = canonicalProjectKnowledgeSource({
+                kind: 'sponsor_decision', projectId: input.projectId,
+                sourceId: `console-knowledge:${input.operationId}`,
+                digest: digest({
+                    kind: 'sponsor_decision', projectId: input.projectId,
+                    sourceId: `console-knowledge:${input.operationId}`,
+                }),
+            });
+            const body = {
+                version: 1, source, principalId: input.principalId,
+                catalogRevision: catalog.revision, projectDigest: digest(definition),
+            };
+            const proof = Object.freeze({ ...body, digest: digest(body) });
+            await store.ensureDurableLeaf('Project Knowledge Sponsor authority');
+            const result = await store.publishCreateOnly({
+                target: target(source.sourceId), content: canonicalWorkroomJson(proof), createdValue: proof,
+                onConflict: async () => {
+                    const winner = await read(source.sourceId);
+                    if (!winner || canonicalWorkroomJson(winner) !== canonicalWorkroomJson(proof)) {
+                        throw new Error('Project Knowledge Sponsor operation identity drift');
+                    }
+                    return winner;
+                },
+            });
+            await store.syncLeafAndParent();
+            return result.value.source;
+        },
+        async verify(source) {
+            const canonical = canonicalProjectKnowledgeSource(source);
+            if (canonical.kind !== 'sponsor_decision')
+                return false;
+            const proof = await read(canonical.sourceId);
+            return Boolean(proof && canonicalWorkroomJson(proof.source) === canonicalWorkroomJson(canonical));
+        },
+    };
+    return Object.freeze(authority);
+}
+/**
+ * P12 adapter. Every read creates and immediately revalidates an exact
+ * Assignment-scoped Disclosure Manifest. Missing sink policy fails closed.
+ */
+export function createP12WorkroomKnowledgeContentReader(options) {
+    const sinkRuleId = options.sinkRuleId ?? 'assignment-context';
+    const reader = {
+        async read(input) {
+            options.signal.throwIfAborted();
+            const operationId = `assignment-knowledge:${input.assignmentId}:${input.handle.knowledgeId}:${input.projectionDigest}`;
+            const request = Object.freeze({
+                operationId,
+                projectId: input.projectId,
+                sourceRef: input.handle.governedContent.ref,
+                sourceDigest: input.handle.governedContent.digest,
+                sinkRuleId,
+                principalId: input.principalId,
+                assignmentId: input.assignmentId,
+            });
+            const manifest = await options.governance.materialize(request, options.signal);
+            if (!manifest || manifest.output.mode !== 'full'
+                || manifest.source.objectId !== input.handle.governedContent.ref
+                || manifest.source.payloadHash !== input.handle.governedContent.digest
+                || manifest.principal.assignmentId !== input.assignmentId
+                || manifest.principal.principalId !== input.principalId)
+                return undefined;
+            const revalidated = await options.governance.revalidate({ request, manifest }, options.signal);
+            if (revalidated.status !== 'ready')
+                return undefined;
+            const contentDigest = hashBytes(revalidated.body);
+            if (contentDigest !== input.handle.governedContent.digest)
+                return undefined;
+            const bodyText = new TextDecoder('utf-8', { fatal: true }).decode(revalidated.body);
+            let body = bodyText;
+            try {
+                body = JSON.parse(bodyText);
+            }
+            catch {
+                // Governed knowledge may be plain text. It remains ephemeral either way.
+            }
+            return Object.freeze({
+                body,
+                contentDigest,
+                authorizationDigest: digest({
+                    requestDigest: manifest.requestDigest,
+                    manifestDigest: manifest.digest,
+                    projectionDigest: input.projectionDigest,
+                    profileDigest: input.profileDigest,
+                    knowledgeRevision: input.knowledgeRevision,
+                }),
+            });
+        },
+    };
+    return Object.freeze(reader);
+}
+export function createGenerationWorkroomEphemeralAssignmentContext(options) {
+    if (!Number.isSafeInteger(options.generation) || options.generation < 1) {
+        throw new Error('Ephemeral Assignment Context generation is invalid');
+    }
+    const contexts = new Map();
+    let disposed = false;
+    const dispose = () => {
+        if (disposed)
+            return;
+        disposed = true;
+        contexts.clear();
+    };
+    options.signal.addEventListener('abort', dispose, { once: true });
+    const provider = {
+        async publish(input) {
+            if (disposed)
+                throw new Error('Ephemeral Assignment Context generation is retired');
+            options.signal.throwIfAborted();
+            const ref = `assignment-context:${options.generation}:${encodeURIComponent(input.assignmentId)}:${input.expectedHash}`;
+            const previous = contexts.get(ref);
+            if (previous) {
+                if (previous.hash !== input.expectedHash || previous.assignmentId !== input.assignmentId
+                    || previous.principalId !== input.principalId
+                    || previous.projectId !== input.projection.projectId
+                    || previous.runId !== input.projection.runId
+                    || previous.taskKey !== input.projection.taskKey) {
+                    throw new Error('Ephemeral Assignment Context identity drift');
+                }
+                return Object.freeze({ ref, hash: previous.hash });
+            }
+            contexts.set(ref, Object.freeze({
+                ref,
+                hash: input.expectedHash,
+                assignmentId: input.assignmentId,
+                principalId: input.principalId,
+                projectId: input.projection.projectId,
+                runId: input.projection.runId,
+                taskKey: input.projection.taskKey,
+                body: structuredClone({ projection: input.projection, contents: input.contents }),
+            }));
+            return Object.freeze({ ref, hash: input.expectedHash });
+        },
+        read(ref, hash) {
+            if (disposed || options.signal.aborted)
+                return undefined;
+            const value = contexts.get(ref);
+            if (!value || value.hash !== hash)
+                return undefined;
+            return Object.freeze({
+                ref: value.ref,
+                hash: value.hash,
+                assignmentId: value.assignmentId,
+                principalId: value.principalId,
+                projectId: value.projectId,
+                runId: value.runId,
+                taskKey: value.taskKey,
+                body: structuredClone(value.body),
+            });
+        },
+        releaseTask(input) {
+            if (disposed)
+                throw new Error('Ephemeral Assignment Context generation is retired');
+            options.signal.throwIfAborted();
+            const releasedContextRefs = [...contexts.values()]
+                .filter(context => context.projectId === input.projectId
+                && context.runId === input.runId && context.taskKey === input.taskKey)
+                .map(context => context.ref)
+                .sort();
+            for (const ref of releasedContextRefs)
+                contexts.delete(ref);
+            const body = Object.freeze({
+                status: 'released',
+                released: releasedContextRefs.length,
+                receiptRef: `ephemeral-context-release:${options.generation}:${digest({ input, releasedContextRefs })}`,
+            });
+            return Object.freeze({ ...body, digest: digest(body) });
+        },
+        dispose,
+    };
+    return Object.freeze(provider);
+}
+function hashBytes(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+//# sourceMappingURL=workroom-assignment-knowledge-composition.js.map

package/lib/plugin-runtime/workroom-assignment-knowledge-composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-assignment-knowledge-composition.js","sourceRoot":"","sources":["../../src/plugin-runtime/workroom-assignment-knowledge-composition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,4BAA4B,IAAI,MAAM,GACvC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,+BAA+B,GAGhC,MAAM,2CAA2C,CAAC;AAmCnD,MAAM,CAAC,MAAM,uCAAuC,GAClD,WAAW,CACT,kDAAkD,EAClD,qFAAqF,CACtF,CAAC;AAEJ,MAAM,CAAC,MAAM,uCAAuC,GAClD,WAAW,CACT,kDAAkD,EAClD,oFAAoF,CACrF,CAAC;AAWJ,2FAA2F;AAC3F,MAAM,UAAU,4CAA4C,CAAC,OAG3D;IACA,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAStD,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EACzD,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,KAAK,EAAE,QAAgB,EAA8B,EAAE;QAClE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAU,CAAC;YAC5E,MAAM,IAAI,GAAG;gBACX,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;gBAChE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;aAClE,CAAC;YACX,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;mBACvD,qBAAqB,CAAC,KAAK,CAAC,KAAK,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACvG,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,SAAS,GAA2C;QACxD,KAAK,CAAC,oBAAoB,CAAC,KAAoF;YAC7G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrG,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,MAAM,GAAG,+BAA+B,CAAC;gBAC7C,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;gBACpD,QAAQ,EAAE,qBAAqB,KAAK,CAAC,WAAW,EAAE;gBAClD,MAAM,EAAE,MAAM,CAAC;oBACb,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;oBACpD,QAAQ,EAAE,qBAAqB,KAAK,CAAC,WAAW,EAAE;iBACnD,CAAC;aACH,CAAkE,CAAC;YACpE,MAAM,IAAI,GAAG;gBACX,OAAO,EAAE,CAAU,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC3D,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC;aACrE,CAAC;YACF,MAAM,KAAK,GAAU,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtE,MAAM,KAAK,CAAC,iBAAiB,CAAC,qCAAqC,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC;gBAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK;gBAC3F,UAAU,EAAE,KAAK,IAAI,EAAE;oBACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAC3C,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9E,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;oBACxE,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;aACF,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAA8B;YACzC,MAAM,SAAS,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,SAAS,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO,KAAK,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,OAAO,CAAC,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;QACpG,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uCAAuC,CAAC,OAItD;IACA,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAC;IAC9D,MAAM,MAAM,GAA2C;QACrD,KAAK,CAAC,IAAI,CAAC,KAAoE;YAC7E,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,wBAAwB,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACvH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC5B,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG;gBAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM;gBACjD,UAAU;gBACV,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;mBAC3C,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG;mBAC7D,QAAQ,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM;mBACnE,QAAQ,CAAC,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBACtD,QAAQ,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAAE,OAAO,SAAS,CAAC;YAC5E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/F,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YACrD,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC5E,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpF,IAAI,IAAI,GAAY,QAAQ,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,IAAI;gBACJ,aAAa;gBACb,mBAAmB,EAAE,MAAM,CAAC;oBAC1B,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACrC,cAAc,EAAE,QAAQ,CAAC,MAAM;oBAC/B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;iBAC3C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kDAAkD,CAAC,OAGjE;IACA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAC;IACvE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,QAAQ,GAA2C;QACvD,KAAK,CAAC,OAAO,CAAC,KAA4E;YACxF,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACpF,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,sBAAsB,OAAO,CAAC,UAAU,IAAI,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvH,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;uBACnF,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;uBAC1C,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,CAAC,SAAS;uBACjD,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,UAAU,CAAC,KAAK;uBACzC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;gBAC9B,GAAG;gBACH,IAAI,EAAE,KAAK,CAAC,YAAY;gBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;gBACrC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;gBAC7B,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;gBACjC,IAAI,EAAE,eAAe,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;aAClF,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,GAAW,EAAE,IAAY;YAC5B,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACpD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QACD,WAAW,CAAC,KAA2E;YACrF,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACpF,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChC,MAAM,mBAAmB,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;iBAC/C,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;mBACnD,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;iBACvE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;iBAC3B,IAAI,EAAE,CAAC;YACV,KAAK,MAAM,GAAG,IAAI,mBAAmB;gBAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;gBACzB,MAAM,EAAE,UAAmB;gBAC3B,QAAQ,EAAE,mBAAmB,CAAC,MAAM;gBACpC,UAAU,EAAE,6BAA6B,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;aACxG,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;KACR,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC"}

package/lib/plugin-runtime/workroom-data-governance-authority-writer.d.ts

@@ -0,0 +1,47 @@
+import { type DataGovernanceAuthorityDecision, type DataGovernanceAuthorityRepository, type DataGovernanceAuthorityVerificationPort, type ProjectDataGovernanceAuthority, type ProjectDataGovernanceAuthorityInput } from '../data-governance/governance-authority-repository.js';
+import type { WorkroomCatalog } from '../workroom/catalog.js';
+export type ProjectDataGovernanceAuthorityCandidate = Omit<ProjectDataGovernanceAuthorityInput, 'governanceDecision'>;
+export interface WorkroomDataGovernancePublicationDecision extends DataGovernanceAuthorityDecision {
+    readonly catalogRevision: string;
+    readonly catalogBindingDigest: string;
+}
+export interface WorkroomDataGovernancePublicationDecisionPort {
+    authorize(input: Readonly<{
+        projectId: string;
+        catalogRevision: string;
+        catalogBindingDigest: string;
+        candidateDigest: string;
+        expectedPreviousDigest?: string;
+    }>, signal: AbortSignal): Promise<WorkroomDataGovernancePublicationDecision | null>;
+}
+export interface WorkroomDataGovernanceAuthorityControlPort {
+    publish(input: Readonly<{
+        catalogRevision: string;
+        catalogBindingDigest: string;
+        candidate: ProjectDataGovernanceAuthorityCandidate;
+    }>, signal: AbortSignal): Promise<ProjectDataGovernanceAuthority>;
+}
+/** Trusted control-plane writer. It derives no policy and accepts no caller decision proof. */
+export declare class WorkroomDataGovernanceAuthorityWriter implements WorkroomDataGovernanceAuthorityControlPort {
+    readonly options: Readonly<{
+        catalog: Pick<WorkroomCatalog, 'read'>;
+        repository: Pick<DataGovernanceAuthorityRepository, 'readProject' | 'appendProject'>;
+        decisions: WorkroomDataGovernancePublicationDecisionPort;
+    }>;
+    constructor(options: Readonly<{
+        catalog: Pick<WorkroomCatalog, 'read'>;
+        repository: Pick<DataGovernanceAuthorityRepository, 'readProject' | 'appendProject'>;
+        decisions: WorkroomDataGovernancePublicationDecisionPort;
+    }>);
+    publish(input: Parameters<WorkroomDataGovernanceAuthorityControlPort['publish']>[0], signal: AbortSignal): Promise<ProjectDataGovernanceAuthority>;
+}
+/** Exact policy gate for materializing protected Journal fields into Kernel replay memory. */
+export declare function assertWorkroomJournalDataGovernanceAuthority(candidate: ProjectDataGovernanceAuthorityCandidate): void;
+/** Trusted Root helper; returns only the narrow governed publisher. */
+export declare function createFileWorkroomDataGovernanceAuthorityControl(options: Readonly<{
+    stateRoot: string;
+    catalog: Pick<WorkroomCatalog, 'read'>;
+    governance: DataGovernanceAuthorityVerificationPort;
+    decisions: WorkroomDataGovernancePublicationDecisionPort;
+}>): WorkroomDataGovernanceAuthorityControlPort;
+//# sourceMappingURL=workroom-data-governance-authority-writer.d.ts.map

package/lib/plugin-runtime/workroom-data-governance-authority-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-authority-writer.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/workroom-data-governance-authority-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EACtC,KAAK,uCAAuC,EAC5C,KAAK,8BAA8B,EACnC,KAAK,mCAAmC,EACzC,MAAM,uDAAuD,CAAC;AAE/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,MAAM,MAAM,uCAAuC,GAAG,IAAI,CACxD,mCAAmC,EACnC,oBAAoB,CACrB,CAAC;AAEF,MAAM,WAAW,yCACjB,SAAQ,+BAA+B;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,6CAA6C;IAC5D,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,eAAe,EAAE,MAAM,CAAC;QACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,yCAAyC,GAAG,IAAI,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,0CAA0C;IACzD,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,SAAS,EAAE,uCAAuC,CAAC;KACpD,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;CACnE;AAED,+FAA+F;AAC/F,qBAAa,qCACb,YAAW,0CAA0C;IACvC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;QACrC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACvC,UAAU,EAAE,IAAI,CAAC,iCAAiC,EAAE,aAAa,GAAG,eAAe,CAAC,CAAC;QACrF,SAAS,EAAE,6CAA6C,CAAC;KAC1D,CAAC;gBAJmB,OAAO,EAAE,QAAQ,CAAC;QACrC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACvC,UAAU,EAAE,IAAI,CAAC,iCAAiC,EAAE,aAAa,GAAG,eAAe,CAAC,CAAC;QACrF,SAAS,EAAE,6CAA6C,CAAC;KAC1D,CAAC;IAEI,OAAO,CACX,KAAK,EAAE,UAAU,CAAC,0CAA0C,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3E,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,8BAA8B,CAAC;CAwC3C;AAED,8FAA8F;AAC9F,wBAAgB,4CAA4C,CAC1D,SAAS,EAAE,uCAAuC,GACjD,IAAI,CAqBN;AAED,uEAAuE;AACvE,wBAAgB,gDAAgD,CAAC,OAAO,EAAE,QAAQ,CAAC;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvC,UAAU,EAAE,uCAAuC,CAAC;IACpD,SAAS,EAAE,6CAA6C,CAAC;CAC1D,CAAC,GAAG,0CAA0C,CAS9C"}

package/lib/plugin-runtime/workroom-data-governance-authority-writer.js

@@ -0,0 +1,115 @@
+import { createProjectDataGovernanceAuthority, FileDataGovernanceAuthorityRepository, } from '../data-governance/governance-authority-repository.js';
+import { join } from 'node:path';
+import { digestCanonicalWorkroomValue as digest } from '../workroom/canonical-value.js';
+import { digestWorkroomCatalogProjectBinding } from './workroom-assignment-authority-provider.js';
+/** Trusted control-plane writer. It derives no policy and accepts no caller decision proof. */
+export class WorkroomDataGovernanceAuthorityWriter {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async publish(input, signal) {
+        signal.throwIfAborted();
+        const catalog = await this.options.catalog.read();
+        const definition = catalog.definitions[input.candidate.projectId];
+        if (!definition || definition.enabled === false
+            || catalog.revision !== input.catalogRevision
+            || digestWorkroomCatalogProjectBinding(definition) !== input.catalogBindingDigest) {
+            throw new Error('Data Governance publication Catalog binding is stale');
+        }
+        assertProjectionAuthority(input.candidate, definition);
+        assertWorkroomJournalDataGovernanceAuthority(input.candidate);
+        const current = await this.options.repository.readProject(input.candidate.projectId);
+        if ((!current && input.candidate.revision !== 1)
+            || (current && (input.candidate.revision !== current.revision + 1
+                || input.candidate.previousDigest !== current.digest))) {
+            throw new Error('Data Governance publication revision/CAS authority is stale');
+        }
+        const candidateDigest = digest(input.candidate);
+        const decision = await this.options.decisions.authorize({
+            projectId: input.candidate.projectId,
+            catalogRevision: input.catalogRevision,
+            catalogBindingDigest: input.catalogBindingDigest,
+            candidateDigest,
+            ...(current ? { expectedPreviousDigest: current.digest } : {}),
+        }, signal);
+        if (!decision
+            || decision.projectId !== input.candidate.projectId
+            || decision.candidateDigest !== candidateDigest
+            || decision.expectedPreviousDigest !== current?.digest
+            || decision.catalogRevision !== input.catalogRevision
+            || decision.catalogBindingDigest !== input.catalogBindingDigest
+            || (decision.authorizedBy !== 'data_steward' && decision.authorizedBy !== 'sponsor')) {
+            throw new Error('Data Governance publication decision is unavailable or forged');
+        }
+        const authority = createProjectDataGovernanceAuthority({
+            ...structuredClone(input.candidate),
+            governanceDecision: structuredClone(decision),
+        });
+        return (await this.options.repository.appendProject(authority, current?.digest)).authority;
+    }
+}
+/** Exact policy gate for materializing protected Journal fields into Kernel replay memory. */
+export function assertWorkroomJournalDataGovernanceAuthority(candidate) {
+    const rule = candidate.derivedPayloads.journal;
+    const sink = candidate.sinks['workroom-journal:kernel-replay'];
+    const servicePrincipal = `service:workroom-kernel:${candidate.projectId}`;
+    const destination = sink && candidate.policy.destinations[sink.destinationId];
+    if (!rule
+        || !rule.allowedPurposes.includes('orchestration')
+        || !sink
+        || sink.channel !== 'context_view'
+        || sink.purpose !== 'orchestration'
+        || sink.requestedMode !== 'full'
+        || sink.fixedPrincipalId !== servicePrincipal
+        || sink.principal.role !== 'orchestrator'
+        || !sink.principal.allowedPurposes.includes('orchestration')
+        || !sink.recipients.recipients.some(recipient => recipient.principalId === servicePrincipal)
+        || !destination
+        || destination.external
+        || !destination.noTraining
+        || destination.loggingMode !== 'metadata_only') {
+        throw new Error('Project Data Governance authority lacks exact Workroom Journal derived/sink policy');
+    }
+}
+/** Trusted Root helper; returns only the narrow governed publisher. */
+export function createFileWorkroomDataGovernanceAuthorityControl(options) {
+    return new WorkroomDataGovernanceAuthorityWriter({
+        catalog: options.catalog,
+        repository: new FileDataGovernanceAuthorityRepository(join(options.stateRoot, 'workroom-data-governance-authority'), options.governance),
+        decisions: options.decisions,
+    });
+}
+function assertProjectionAuthority(candidate, definition) {
+    const rule = candidate.derivedPayloads.projection;
+    const sink = candidate.sinks['projection:workroom'];
+    const sponsorSink = candidate.sinks['projection:sponsor-room'];
+    const servicePrincipal = `service:workroom-projection:${candidate.projectId}`;
+    const sponsorServicePrincipal = `service:workroom-sponsor-projection:${candidate.projectId}`;
+    const sponsorPrincipals = new Set(definition.sponsors ?? []);
+    const sponsorRecipients = sponsorSink?.recipients.recipients.map(recipient => recipient.principalId) ?? [];
+    const sponsorProjectionInvalid = definition.sponsorConversation !== undefined && (!sponsorSink
+        || sponsorSink.channel !== 'sponsor_projection'
+        || sponsorSink.purpose !== 'portfolio_oversight'
+        || sponsorSink.fixedPrincipalId !== sponsorServicePrincipal
+        || sponsorSink.principal.role !== 'projector'
+        || !sponsorSink.principal.allowedPurposes.includes('portfolio_oversight')
+        || !candidate.policy.destinations[sponsorSink.destinationId]
+        || sponsorPrincipals.size === 0
+        || sponsorRecipients.length !== sponsorPrincipals.size
+        || sponsorRecipients.some(principalId => !sponsorPrincipals.has(principalId)));
+    if (!rule
+        || !rule.allowedPurposes.includes('workroom_awareness')
+        || !rule.allowedPurposes.includes('portfolio_oversight')
+        || !sink
+        || sink.channel !== 'workroom_projection'
+        || sink.purpose !== 'workroom_awareness'
+        || sink.fixedPrincipalId !== servicePrincipal
+        || sink.principal.role !== 'projector'
+        || !sink.principal.allowedPurposes.includes('workroom_awareness')
+        || !candidate.policy.destinations[sink.destinationId]
+        || sponsorProjectionInvalid) {
+        throw new Error('Project Data Governance authority lacks exact Projection derived/sink policy');
+    }
+}
+//# sourceMappingURL=workroom-data-governance-authority-writer.js.map

package/lib/plugin-runtime/workroom-data-governance-authority-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-authority-writer.js","sourceRoot":"","sources":["../../src/plugin-runtime/workroom-data-governance-authority-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GAMtC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,4BAA4B,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,6CAA6C,CAAC;AA+BlG,+FAA+F;AAC/F,MAAM,OAAO,qCAAqC;IAE3B;IAArB,YAAqB,OAInB;QAJmB,YAAO,GAAP,OAAO,CAI1B;IAAG,CAAC;IAEN,KAAK,CAAC,OAAO,CACX,KAA2E,EAC3E,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK;eAC1C,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,eAAe;eAC1C,mCAAmC,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACvD,4CAA4C,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,KAAK,CAAC,CAAC;eAC3C,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC;mBAC5D,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;YACpC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,eAAe;YACf,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,EAAE,MAAM,CAAC,CAAC;QACX,IAAI,CAAC,QAAQ;eACR,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS;eAChD,QAAQ,CAAC,eAAe,KAAK,eAAe;eAC5C,QAAQ,CAAC,sBAAsB,KAAK,OAAO,EAAE,MAAM;eACnD,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;eAClD,QAAQ,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB;eAC5D,CAAC,QAAQ,CAAC,YAAY,KAAK,cAAc,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,SAAS,GAAG,oCAAoC,CAAC;YACrD,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;YACnC,kBAAkB,EAAE,eAAe,CAAC,QAAQ,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;CACF;AAED,8FAA8F;AAC9F,MAAM,UAAU,4CAA4C,CAC1D,SAAkD;IAElD,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,2BAA2B,SAAS,CAAC,SAAS,EAAE,CAAC;IAC1E,MAAM,WAAW,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;WACJ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC;WAC/C,CAAC,IAAI;WACL,IAAI,CAAC,OAAO,KAAK,cAAc;WAC/B,IAAI,CAAC,OAAO,KAAK,eAAe;WAChC,IAAI,CAAC,aAAa,KAAK,MAAM;WAC7B,IAAI,CAAC,gBAAgB,KAAK,gBAAgB;WAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;WACtC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC;WACzD,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,gBAAgB,CAAC;WACzF,CAAC,WAAW;WACZ,WAAW,CAAC,QAAQ;WACpB,CAAC,WAAW,CAAC,UAAU;WACvB,WAAW,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IACxG,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gDAAgD,CAAC,OAK/D;IACA,OAAO,IAAI,qCAAqC,CAAC;QAC/C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,IAAI,qCAAqC,CACnD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,oCAAoC,CAAC,EAC7D,OAAO,CAAC,UAAU,CACnB;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAkD,EAClD,UAA0E;IAE1E,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,UAAU,CAAC;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,+BAA+B,SAAS,CAAC,SAAS,EAAE,CAAC;IAC9E,MAAM,uBAAuB,GAAG,uCAAuC,SAAS,CAAC,SAAS,EAAE,CAAC;IAC7F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,WAAW,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC3G,MAAM,wBAAwB,GAAG,UAAU,CAAC,mBAAmB,KAAK,SAAS,IAAI,CAC/E,CAAC,WAAW;WACT,WAAW,CAAC,OAAO,KAAK,oBAAoB;WAC5C,WAAW,CAAC,OAAO,KAAK,qBAAqB;WAC7C,WAAW,CAAC,gBAAgB,KAAK,uBAAuB;WACxD,WAAW,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW;WAC1C,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,qBAAqB,CAAC;WACtE,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,aAAa,CAAC;WACzD,iBAAiB,CAAC,IAAI,KAAK,CAAC;WAC5B,iBAAiB,CAAC,MAAM,KAAK,iBAAiB,CAAC,IAAI;WACnD,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAC9E,CAAC;IACF,IAAI,CAAC,IAAI;WACJ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,oBAAoB,CAAC;WACpD,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,qBAAqB,CAAC;WACrD,CAAC,IAAI;WACL,IAAI,CAAC,OAAO,KAAK,qBAAqB;WACtC,IAAI,CAAC,OAAO,KAAK,oBAAoB;WACrC,IAAI,CAAC,gBAAgB,KAAK,gBAAgB;WAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW;WACnC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,oBAAoB,CAAC;WAC9D,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC;WAClD,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}

package/lib/plugin-runtime/workroom-data-governance-composition.d.ts

@@ -0,0 +1,28 @@
+import type { Scope } from '@zhin.js/plugin-runtime';
+import type { PayloadVaultCryptographyPort } from '../data-governance/encrypted-file-payload-vault.js';
+import type { DataGovernanceAuthorityVerificationPort } from '../data-governance/governance-authority-repository.js';
+import type { GovernedPayloadPublicationVerifierPort, GovernedPayloadWritePurgePort } from '../data-governance/governed-payload-write-saga.js';
+import { type WorkroomDataGovernanceRuntime, type WorkroomDataGovernancePayloadVaultPort, type WorkroomAcceptanceProjectionSourceAuthorityPort, type WorkroomEvidenceSourceAuthorityPort, type WorkroomPayloadLifecycleIndexPort } from './workroom-data-governance-runtime.js';
+export interface InstallWorkroomDataGovernanceResourcesOptions {
+    readonly projectRoot: string;
+    readonly generation: number;
+    readonly signal: AbortSignal;
+    /** Trusted Root option only; never published as a Resource/Feature. */
+    readonly cryptography?: PayloadVaultCryptographyPort;
+    /** Root-private activation latch; never provided as a Resource. */
+    readonly vault?: WorkroomDataGovernancePayloadVaultPort;
+    readonly payloadLifecycleIndex?: WorkroomPayloadLifecycleIndexPort;
+    readonly payloadPurge?: GovernedPayloadWritePurgePort;
+    readonly payloadPublicationVerifier?: GovernedPayloadPublicationVerifierPort;
+    /** Trusted Root Data Steward/Sponsor decision verifier; never published. */
+    readonly governance?: DataGovernanceAuthorityVerificationPort;
+    readonly evidenceSources?: WorkroomEvidenceSourceAuthorityPort;
+    readonly acceptanceProjectionSources?: WorkroomAcceptanceProjectionSourceAuthorityPort;
+    readonly resources: Pick<Scope, 'has' | 'provide'>;
+}
+/**
+ * Standard generation composition. It publishes only governed, narrow ports;
+ * raw Vault, crypto and authority writer objects never enter the Resource Scope.
+ */
+export declare function installWorkroomDataGovernanceResources(options: InstallWorkroomDataGovernanceResourcesOptions): WorkroomDataGovernanceRuntime;
+//# sourceMappingURL=workroom-data-governance-composition.d.ts.map

package/lib/plugin-runtime/workroom-data-governance-composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-composition.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/workroom-data-governance-composition.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,KAAK,EACV,4BAA4B,EAC7B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EACV,uCAAuC,EACxC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EACV,sCAAsC,EACtC,6BAA6B,EAC9B,MAAM,mDAAmD,CAAC;AAY3D,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,sCAAsC,EAC3C,KAAK,+CAA+C,EACpD,KAAK,mCAAmC,EACxC,KAAK,iCAAiC,EACvC,MAAM,uCAAuC,CAAC;AAE/C,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,4BAA4B,CAAC;IACrD,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,sCAAsC,CAAC;IACxD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,iCAAiC,CAAC;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,6BAA6B,CAAC;IACtD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,sCAAsC,CAAC;IAC7E,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,uCAAuC,CAAC;IAC9D,QAAQ,CAAC,eAAe,CAAC,EAAE,mCAAmC,CAAC;IAC/D,QAAQ,CAAC,2BAA2B,CAAC,EAAE,+CAA+C,CAAC;IACvF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,6CAA6C,GACrD,6BAA6B,CAqC/B"}

package/lib/plugin-runtime/workroom-data-governance-composition.js

@@ -0,0 +1,41 @@
+import { join } from 'node:path';
+import { workroomAssignmentDisclosureManifestAuthorityToken, } from './workroom-assignment-authority-grant-runtime.js';
+import { workroomPlanningDisclosureToken, } from './workroom-dynamic-planning-provider.js';
+import { workroomEvidencePayloadWriterToken, workroomTaskReportPayloadToken, } from './workroom-local-agent-loop.js';
+import { workroomAcceptanceProjectionPayloadToken } from './workroom-acceptance-fact-providers.js';
+import { createFileWorkroomDataGovernanceRuntime, workroomDisclosureManifestAuthorityToken, } from './workroom-data-governance-runtime.js';
+/**
+ * Standard generation composition. It publishes only governed, narrow ports;
+ * raw Vault, crypto and authority writer objects never enter the Resource Scope.
+ */
+export function installWorkroomDataGovernanceResources(options) {
+    const runtime = createFileWorkroomDataGovernanceRuntime({
+        stateRoot: join(options.projectRoot, '.zhin'),
+        generation: options.generation,
+        signal: options.signal,
+        ...(options.cryptography ? { cryptography: options.cryptography } : {}),
+        ...(options.vault ? { vault: options.vault } : {}),
+        ...(options.payloadLifecycleIndex ? { payloadLifecycleIndex: options.payloadLifecycleIndex } : {}),
+        ...(options.payloadPurge ? { payloadPurge: options.payloadPurge } : {}),
+        ...(options.payloadPublicationVerifier
+            ? { payloadPublicationVerifier: options.payloadPublicationVerifier }
+            : {}),
+        ...(options.governance ? { governance: options.governance } : {}),
+        ...(options.evidenceSources ? { evidenceSources: options.evidenceSources } : {}),
+        ...(options.acceptanceProjectionSources
+            ? { acceptanceProjectionSources: options.acceptanceProjectionSources }
+            : {}),
+    });
+    provideIfAbsent(options.resources, workroomPlanningDisclosureToken, runtime.planningDisclosure);
+    provideIfAbsent(options.resources, workroomAssignmentDisclosureManifestAuthorityToken, runtime.assignmentDisclosure);
+    provideIfAbsent(options.resources, workroomEvidencePayloadWriterToken, runtime.evidencePayloads);
+    provideIfAbsent(options.resources, workroomTaskReportPayloadToken, runtime.taskReportPayloads);
+    provideIfAbsent(options.resources, workroomAcceptanceProjectionPayloadToken, runtime.acceptanceProjectionPayloads);
+    provideIfAbsent(options.resources, workroomDisclosureManifestAuthorityToken, runtime.disclosureManifest);
+    return runtime;
+}
+function provideIfAbsent(resources, token, value) {
+    if (!resources.has(token))
+        resources.provide(token, value);
+}
+//# sourceMappingURL=workroom-data-governance-composition.js.map

package/lib/plugin-runtime/workroom-data-governance-composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-composition.js","sourceRoot":"","sources":["../../src/plugin-runtime/workroom-data-governance-composition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,OAAO,EACL,kDAAkD,GACnD,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EACL,uCAAuC,EACvC,wCAAwC,GAMzC,MAAM,uCAAuC,CAAC;AAoB/C;;;GAGG;AACH,MAAM,UAAU,sCAAsC,CACpD,OAAsD;IAEtD,MAAM,OAAO,GAAG,uCAAuC,CAAC;QACtD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,CAAC,0BAA0B;YACpC,CAAC,CAAC,EAAE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,CAAC,2BAA2B;YACrC,CAAC,CAAC,EAAE,2BAA2B,EAAE,OAAO,CAAC,2BAA2B,EAAE;YACtE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,+BAA+B,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChG,eAAe,CACb,OAAO,CAAC,SAAS,EACjB,kDAAkD,EAClD,OAAO,CAAC,oBAAoB,CAC7B,CAAC;IACF,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,kCAAkC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjG,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,8BAA8B,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,eAAe,CACb,OAAO,CAAC,SAAS,EACjB,wCAAwC,EACxC,OAAO,CAAC,4BAA4B,CACrC,CAAC;IACF,eAAe,CACb,OAAO,CAAC,SAAS,EACjB,wCAAwC,EACxC,OAAO,CAAC,kBAAkB,CAC3B,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CACtB,SAAyC,EACzC,KAAiD,EACjD,KAAQ;IAER,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC"}

package/lib/plugin-runtime/workroom-data-governance-root-provider.d.ts

@@ -0,0 +1,51 @@
+import { type PluginId, type Scope } from '@zhin.js/plugin-runtime';
+import type { PayloadVaultCryptographyPort } from '../data-governance/encrypted-file-payload-vault.js';
+import type { DataGovernanceAuthorityVerificationPort } from '../data-governance/governance-authority-repository.js';
+import type { PayloadLifecycleCommandAuthorityPort, PayloadLifecycleKernelClockPort, PayloadLocationDeletionPort, PayloadPurgeReceiptAuthorityPort, PayloadSubjectErasureResolverPort } from '../data-governance/payload-lifecycle.js';
+import type { GovernedPayloadWritePurgePort } from '../data-governance/governed-payload-write-saga.js';
+import type { WorkroomDataLifecycleConsoleAuthorityPort } from './workroom-data-lifecycle-console.js';
+export interface WorkroomDataGovernanceRootProviderRequest {
+    readonly version: 1;
+    readonly generation: number;
+    readonly requester: PluginId;
+    readonly digest: string;
+}
+export interface WorkroomDataLifecycleRootAuthorities {
+    /** Authority-owned identity; never accepted from command bodies or Console metadata. */
+    readonly registrationPrincipalId: string;
+    readonly clock: PayloadLifecycleKernelClockPort;
+    readonly authority: PayloadLifecycleCommandAuthorityPort;
+    readonly subjects: PayloadSubjectErasureResolverPort;
+    readonly deletion: PayloadLocationDeletionPort;
+    readonly receipts: PayloadPurgeReceiptAuthorityPort;
+    readonly orphanPurge: GovernedPayloadWritePurgePort;
+    /** Optional authenticated human role authority; absence disables the Console lifecycle plane. */
+    readonly console?: WorkroomDataLifecycleConsoleAuthorityPort;
+}
+export interface WorkroomDataGovernanceRootProviderResolution {
+    readonly version: 1;
+    readonly generation: number;
+    readonly requestDigest: string;
+    readonly providerId: string;
+    readonly cryptography: PayloadVaultCryptographyPort;
+    readonly governance: DataGovernanceAuthorityVerificationPort;
+    readonly lifecycle?: WorkroomDataLifecycleRootAuthorities;
+}
+export interface WorkroomDataGovernanceRootProviderPort {
+    resolve(request: WorkroomDataGovernanceRootProviderRequest, signal: AbortSignal): Promise<WorkroomDataGovernanceRootProviderResolution | null>;
+}
+/** Root-only: child Plugin scopes and Runtime snapshots cannot observe this token. */
+export declare const workroomDataGovernanceRootProviderToken: import("@zhin.js/plugin-runtime").Token<WorkroomDataGovernanceRootProviderPort>;
+export declare function createWorkroomDataGovernanceRootProviderRequest(input: Readonly<{
+    generation: number;
+    requester: PluginId;
+}>): WorkroomDataGovernanceRootProviderRequest;
+export declare function resolveWorkroomDataGovernanceRootAuthorities(options: Readonly<{
+    resources: Pick<Scope, 'has' | 'use'>;
+    generation: number;
+    requester: PluginId;
+    signal: AbortSignal;
+    fallbackCryptography?: PayloadVaultCryptographyPort;
+    fallbackGovernance?: DataGovernanceAuthorityVerificationPort;
+}>): Promise<WorkroomDataGovernanceRootProviderResolution | undefined>;
+//# sourceMappingURL=workroom-data-governance-root-provider.d.ts.map

package/lib/plugin-runtime/workroom-data-governance-root-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-root-provider.d.ts","sourceRoot":"","sources":["../../src/plugin-runtime/workroom-data-governance-root-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,KAAK,EACX,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AACvG,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,uDAAuD,CAAC;AACrH,OAAO,KAAK,EACV,oCAAoC,EACpC,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,sCAAsC,CAAC;AAMtG,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oCAAoC;IACnD,wFAAwF;IACxF,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,oCAAoC,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,iCAAiC,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD,iGAAiG;IACjG,QAAQ,CAAC,OAAO,CAAC,EAAE,yCAAyC,CAAC;CAC9D;AAED,MAAM,WAAW,4CAA4C;IAC3D,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,uCAAuC,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,oCAAoC,CAAC;CAC3D;AAED,MAAM,WAAW,sCAAsC;IACrD,OAAO,CACL,OAAO,EAAE,yCAAyC,EAClD,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;CACjE;AAED,sFAAsF;AACtF,eAAO,MAAM,uCAAuC,iFAIjD,CAAC;AAEJ,wBAAgB,+CAA+C,CAAC,KAAK,EAAE,QAAQ,CAAC;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,CAAC;CACrB,CAAC,GAAG,yCAAyC,CAU7C;AAED,wBAAsB,4CAA4C,CAAC,OAAO,EAAE,QAAQ,CAAC;IACnF,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,oBAAoB,CAAC,EAAE,4BAA4B,CAAC;IACpD,kBAAkB,CAAC,EAAE,uCAAuC,CAAC;CAC9D,CAAC,GAAG,OAAO,CAAC,4CAA4C,GAAG,SAAS,CAAC,CA+CrE"}