@zhin.js/agent 1.1.31 → 1.1.32

package/lib/plugin-runtime/workroom-data-governance-runtime.js

@@ -1,1356 +0,0 @@
-import { createHash } from 'node:crypto';
-import { classifyDataDescriptor, } from '../data-governance/data-governance.js';
-import { materializeDisclosureManifest, } from '../data-governance/disclosure-manifest.js';
-import { EncryptedFilePayloadVault, PayloadVaultCryptographyUnavailableError, } from '../data-governance/encrypted-file-payload-vault.js';
-import { FileDataGovernanceAuthorityRepository, DataGovernanceAuthorityUnauthorizedError, createGovernedSourceAuthority, } from '../data-governance/governance-authority-repository.js';
-import { FileGovernedPayloadWriteSagaRepository, GovernedPayloadPublicationReconciler, GovernedPayloadWritePurgeConsumer, createGovernedPayloadWriteIntentId, } from '../data-governance/governed-payload-write-saga.js';
-import { join } from 'node:path';
-import { createToken } from '@zhin.js/plugin-runtime';
-import { WorkroomPlanningClarificationError, } from '../workroom/human-ingress-orchestrator.js';
-import { canonicalWorkroomJson, deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue as digest, } from '../workroom/canonical-value.js';
-import { WorkroomGovernedPayloadHeaderCasLostError, WorkroomGovernedPayloadPublicationAbandonedError, } from '../workroom/workroom-task-report-store.js';
-import { createWorkroomJournalPayloadObjectId, } from '../workroom/journal/index.js';
-import { createWorkroomDynamicPlanningGenerationSnapshot, createWorkroomPlanningDisclosure, createWorkroomPlanningDisclosureSourceBinding, } from './workroom-dynamic-planning-provider.js';
-import { createWorkroomGovernedAcceptanceProjection, } from './workroom-acceptance-provider-composition.js';
-export const workroomDisclosureManifestAuthorityToken = createToken('zhin.agent.workroom-disclosure-manifest-authority', 'Authority-owned exact sink-rule Disclosure Manifest materializer');
-/** Trusted Root composition helper; raw repository/Vault are intentionally not returned. */
-export function createFileWorkroomDataGovernanceRuntime(options) {
-    const repository = new FileDataGovernanceAuthorityRepository(join(options.stateRoot, 'workroom-data-governance-authority'), options.governance);
-    const cryptography = options.cryptography ?? Object.freeze({
-        wrap: async () => null,
-        unwrap: async () => null,
-    });
-    const vault = options.vault ?? new EncryptedFilePayloadVault({
-        directory: join(options.stateRoot, 'workroom-payload-vault'),
-        generation: options.generation,
-        cryptography,
-    });
-    const payloadWrites = new FileGovernedPayloadWriteSagaRepository(join(options.stateRoot, 'workroom-payload-write-sagas'));
-    const payloadPurge = options.payloadPurge
-        ? new GovernedPayloadWritePurgeConsumer({
-            generation: options.generation,
-            repository: payloadWrites,
-            provider: options.payloadPurge,
-        })
-        : undefined;
-    return new WorkroomDataGovernanceRuntime({
-        generation: options.generation,
-        repository,
-        vault,
-        payloadWrites,
-        ...(payloadPurge ? { payloadPurge } : {}),
-        ...(options.payloadPublicationVerifier
-            ? { payloadPublicationVerifier: options.payloadPublicationVerifier }
-            : {}),
-        ...(options.payloadLifecycleIndex ? { payloadLifecycleIndex: options.payloadLifecycleIndex } : {}),
-        signal: options.signal,
-        ...(options.evidenceSources ? { evidenceSources: options.evidenceSources } : {}),
-        ...(options.acceptanceProjectionSources
-            ? { acceptanceProjectionSources: options.acceptanceProjectionSources }
-            : {}),
-        ...(options.transforms ? { transforms: options.transforms } : {}),
-        ...(options.now ? { now: options.now } : {}),
-    });
-}
-export const workroomAcceptanceProjectionSourceAuthorityToken = createToken('zhin.agent.workroom-acceptance-projection-source-authority', 'Trusted exact Profile-policy source resolver for governed Acceptance projection payloads');
-/**
- * One immutable Root-generation adapter over persistent policy/source facts.
- * It never falls back to config or request metadata authority.
- */
-export class WorkroomDataGovernanceRuntime {
-    options;
-    generation;
-    planningDisclosure;
-    disclosureManifest;
-    assignmentDisclosure;
-    evidencePayloads;
-    taskReportPayloads;
-    acceptanceProjectionPayloads;
-    journalPayloads;
-    #now;
-    constructor(options) {
-        this.options = options;
-        this.generation = positive(options.generation, 'generation');
-        this.#now = options.now ?? Date.now;
-        this.planningDisclosure = Object.freeze({
-            materialize: async (request, signal) => await this.#materializePlanning(request, signal),
-        });
-        this.disclosureManifest = Object.freeze({
-            materialize: async (request, signal) => await this.#materializeRegistered(request, signal),
-            revalidate: async (input, signal) => await this.#revalidateRegistered(input, signal),
-            prepareProjection: async (input, signal) => await this.#prepareProjection(input, signal),
-        });
-        this.assignmentDisclosure = Object.freeze({
-            materialize: async (request) => await this.#materializeAssignment(request),
-        });
-        this.evidencePayloads = Object.freeze({
-            write: async (input, signal) => await this.#writeEvidence(input, signal),
-        });
-        this.taskReportPayloads = Object.freeze({
-            write: async (input, signal) => await this.#writeTaskReport(input, signal),
-            read: async (input, signal) => await this.#readTaskReport(input, signal),
-        });
-        this.acceptanceProjectionPayloads = Object.freeze({
-            write: async (input, signal) => await this.#writeAcceptanceProjection(input, signal),
-            read: async (input, signal) => await this.#readAcceptanceProjection(input, signal),
-        });
-        this.journalPayloads = Object.freeze({
-            write: async (input) => await this.#writeJournalPayload(input),
-            read: async (input) => await this.#readJournalPayload(input),
-            publish: async (input) => await this.#publishJournalPayloads(input),
-            prepare: async (input) => await this.#prepareJournalPayloads(input),
-            abandon: async (input) => await this.#abandonJournalPayloads(input),
-            reconcile: async (input) => await this.#reconcileJournalPayloads(input),
-        });
-    }
-    /** Trusted generation handoff hook; no raw Vault or receipt body is returned. */
-    async reconcilePayloadPurges(projectIds, signal) {
-        if (!this.options.payloadPurge || !this.options.payloadWrites)
-            return;
-        const publications = new GovernedPayloadPublicationReconciler({
-            repository: this.options.payloadWrites,
-            purge: this.options.payloadPurge,
-            ...(this.options.payloadPublicationVerifier
-                ? { verifier: this.options.payloadPublicationVerifier }
-                : {}),
-        });
-        for (const projectId of [...new Set(projectIds)].sort()) {
-            await publications.drainProject(projectId, signal);
-            await this.options.payloadPurge.drainProject(projectId, signal);
-        }
-    }
-    async #writeJournalPayload(input) {
-        const operationId = `workroom-journal-write:${input.eventId}:${digest(input.fieldPath)}`;
-        await this.#requirePayloadInfrastructure(this.options.signal, {
-            operationId,
-            projectId: input.projectId,
-        });
-        const payload = new TextEncoder().encode(canonicalWorkroomJson(input.value));
-        if (hashBytes(payload) !== input.contentHash) {
-            throw new Error('Governed Workroom Journal payload content hash drift');
-        }
-        const source = deepFreeze({
-            kind: 'command',
-            ref: input.source.ref,
-            digest: input.source.digest,
-            bindingDigest: input.source.bindingDigest,
-            verification: 'verified',
-        });
-        return await this.#writeDerivedPayload({
-            operationId,
-            projectId: input.projectId,
-            kind: 'journal',
-            objectId: createWorkroomJournalPayloadObjectId(input),
-            payload,
-            source,
-            signal: this.options.signal,
-            createdAt: input.occurredAt,
-            publicationScope: input.runId,
-        });
-    }
-    async #publishJournalPayloads(input) {
-        if (!this.options.payloadWrites)
-            return;
-        for (const receipt of input.receipts) {
-            const intentId = journalIntentId(input.projectId, input.runId, receipt);
-            const pending = await this.options.payloadWrites.read(intentId);
-            if (!pending)
-                throw new Error('Governed Workroom Journal payload intent is unavailable');
-            if (pending.state === 'published')
-                continue;
-            if (pending.state !== 'authority_indexed') {
-                throw new Error(`Governed Workroom Journal payload cannot be published from ${pending.state}`);
-            }
-            await this.options.payloadWrites.publish(intentId, input.publicationDigest);
-        }
-    }
-    async #prepareJournalPayloads(input) {
-        if (!this.options.payloadWrites)
-            return;
-        for (const receipt of input.receipts) {
-            const pending = await this.options.payloadWrites.read(journalIntentId(input.projectId, input.runId, receipt));
-            if (!pending || (pending.state !== 'authority_indexed' && pending.state !== 'published')) {
-                throw new Error('Governed Workroom Journal payload is not ready for header publication');
-            }
-        }
-    }
-    async #abandonJournalPayloads(input) {
-        if (!this.options.payloadWrites)
-            return;
-        for (const receipt of input.receipts) {
-            const intentId = journalIntentId(input.projectId, input.runId, receipt);
-            const pending = await this.options.payloadWrites.read(intentId);
-            if (!pending || pending.state === 'published' || pending.state === 'purge_required')
-                continue;
-            await this.options.payloadWrites.requirePurge(intentId, input.reason);
-            await this.#purgeIntent(intentId);
-        }
-    }
-    async #reconcileJournalPayloads(input) {
-        if (!this.options.payloadWrites)
-            return;
-        for (const receipt of input.receipts) {
-            const intentId = journalIntentId(input.projectId, input.runId, receipt);
-            const pending = await this.options.payloadWrites.read(intentId);
-            if (!pending)
-                throw new Error('Governed Workroom Journal payload intent is unavailable');
-            if (pending.state === 'published')
-                continue;
-            if (pending.state !== 'authority_indexed') {
-                throw new Error(`Governed Workroom Journal committed payload is ${pending.state}`);
-            }
-            await this.options.payloadWrites.publish(intentId, input.publicationDigest);
-        }
-    }
-    async #readJournalPayload(input) {
-        await this.#requirePayloadInfrastructure(this.options.signal, {
-            operationId: `workroom-journal-read:${input.eventId}:${digest(input.fieldPath)}`,
-            projectId: input.projectId,
-        });
-        const currentAuthority = await this.options.repository.readProject(input.projectId);
-        const source = await this.options.repository.readSource(input.projectId, input.receipt.descriptor.objectId, input.receipt.descriptor.payloadHash);
-        const authority = source && currentAuthority
-            ? source.projectAuthorityDigest === currentAuthority.digest
-                ? currentAuthority
-                : await this.options.repository.readProjectRevision?.(input.projectId, source.projectAuthorityRevision)
-            : undefined;
-        const sinkRuleId = 'workroom-journal:kernel-replay';
-        const sink = authority?.sinks[sinkRuleId];
-        const destination = sink && authority?.policy.destinations[sink.destinationId];
-        if (!source || !authority || source.projectAuthorityDigest !== authority.digest
-            || source.projectAuthorityRevision !== authority.revision || !sink?.fixedPrincipalId
-            || !destination) {
-            throw new Error('Workroom Journal replay disclosure authority is unavailable');
-        }
-        const manifest = await this.#materialize({
-            operationId: `workroom-journal-read:${input.eventId}:${digest(input.fieldPath)}`,
-            authority,
-            source,
-            context: {
-                channel: sink.channel,
-                purpose: sink.purpose,
-                requestedMode: sink.requestedMode,
-                policyRevision: authority.policy.revision,
-                principal: {
-                    principalId: sink.fixedPrincipalId,
-                    tenantId: authority.tenantId,
-                    projectId: authority.projectId,
-                    ...sink.principal,
-                },
-                destination,
-                recipients: structuredClone(sink.recipients),
-            },
-            signal: this.options.signal,
-        });
-        if (!manifest || manifest.output.mode !== 'full'
-            || manifest.output.handle.vaultObjectId !== input.receipt.descriptor.vaultObjectId
-            || manifest.output.handle.descriptorDigest !== input.receipt.descriptor.descriptorDigest
-            || manifest.output.handle.locationManifestDigest !== input.receipt.descriptor.locationManifestDigest
-            || manifest.output.payloadHash !== input.contentHash) {
-            throw new Error('Workroom Journal replay disclosure is not exact/full');
-        }
-        await this.#requirePayloadInfrastructure(this.options.signal);
-        const payload = await this.options.vault.readExact({
-            handle: manifest.output.handle,
-            requestDigest: manifest.requestDigest,
-            purpose: manifest.purpose,
-            principalId: manifest.principal.principalId,
-            destinationId: manifest.destination.id,
-        }, this.options.signal);
-        if (hashBytes(payload) !== input.contentHash) {
-            throw new Error('Governed Workroom Journal payload content hash mismatch');
-        }
-        try {
-            return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(payload));
-        }
-        catch (error) {
-            throw new Error('Governed Workroom Journal payload is not canonical JSON', { cause: error });
-        }
-    }
-    async #writeEvidence(input, signal) {
-        const operationId = `evidence:${input.attribution.assignmentId}:${input.attribution.attempt}:${input.attribution.fence}`;
-        await this.#requirePayloadInfrastructure(signal, {
-            operationId,
-            projectId: input.attribution.projectId,
-        });
-        const payload = new TextEncoder().encode(input.content);
-        const payloadHash = hashBytes(payload);
-        const trusted = await this.options.evidenceSources?.resolve({
-            claimedSource: structuredClone(input.claimedSource),
-            attribution: structuredClone(input.attribution),
-            payloadHash,
-        }) ?? null;
-        const source = trusted
-            ? validateReceiptSource(trusted)
-            : deepFreeze({
-                kind: input.claimedSource.kind,
-                ref: `quarantine:workroom-evidence:${digest({
-                    attribution: input.attribution,
-                    mediaType: input.mediaType,
-                    payloadHash,
-                })}`,
-                digest: digest({ version: 1, disposition: 'unverified', payloadHash }),
-                bindingDigest: digest({ version: 1, attribution: input.attribution, payloadHash }),
-                verification: 'unverified',
-            });
-        return await this.#writeDerivedPayload({
-            operationId,
-            projectId: input.attribution.projectId,
-            kind: 'evidence',
-            objectId: `workroom-evidence-payload:${digest({
-                attribution: input.attribution,
-                mediaType: input.mediaType,
-                payloadHash,
-            })}`,
-            payload,
-            source,
-            signal,
-            consumer: 'evidence_header',
-            publicationScope: digest({
-                version: 1,
-                attribution: input.attribution,
-                payloadHash,
-            }),
-            publication: input.publication,
-        });
-    }
-    async #writeTaskReport(input, signal) {
-        const operationId = `task-report:${input.report.candidateHash}`;
-        await this.#requirePayloadInfrastructure(signal, {
-            operationId,
-            projectId: input.attribution.projectId,
-        });
-        const payload = new TextEncoder().encode(canonicalWorkroomJson(input.report));
-        const payloadHash = hashBytes(payload);
-        const source = deepFreeze({
-            kind: 'tool',
-            ref: `workroom-task:${encodeURIComponent(input.attribution.projectId)}:`
-                + `${encodeURIComponent(input.attribution.runId)}:${encodeURIComponent(input.attribution.taskKey)}:`
-                + input.attribution.taskRevision,
-            digest: digest({ version: 1, reportRef: input.report.ref, candidateHash: input.report.candidateHash }),
-            bindingDigest: digest({ version: 1, attribution: input.attribution, reportDigest: input.report.digest }),
-            verification: 'verified',
-        });
-        return await this.#writeDerivedPayload({
-            operationId,
-            projectId: input.attribution.projectId,
-            kind: 'taskReport',
-            objectId: `workroom-task-report-payload:${input.report.candidateHash}`,
-            payload,
-            source,
-            signal,
-            consumer: 'task_report_header',
-            publicationScope: input.report.ref,
-            publication: input.publication,
-        });
-    }
-    async #writeAcceptanceProjection(input, signal) {
-        const linked = linkSignals(this.options.signal, signal);
-        try {
-            linked.signal.throwIfAborted();
-            const projection = createWorkroomGovernedAcceptanceProjection(input.projection);
-            if (canonicalWorkroomJson(projection) !== canonicalWorkroomJson(input.projection)
-                || projection.projectId !== input.projectId) {
-                throw new Error('Acceptance projection governed payload candidate drift');
-            }
-            const trusted = await this.options.acceptanceProjectionSources?.resolve({
-                projectId: input.projectId,
-                projectionDigest: projection.digest,
-                source: structuredClone(input.source),
-            }, linked.signal);
-            linked.signal.throwIfAborted();
-            if (!trusted || trusted.kind !== 'profile-policy' || trusted.verification !== 'verified'
-                || trusted.ref !== input.source.ref || trusted.digest !== input.source.digest
-                || trusted.issuer !== input.source.issuer || trusted.issuerDigest !== input.source.issuerDigest
-                || trusted.revision !== input.source.revision
-                || trusted.bindingDigest !== input.source.bindingDigest) {
-                throw new Error('Trusted Acceptance projection Profile-policy source is unavailable');
-            }
-            const { digest: _projectionDigest, ...projectionInput } = projection;
-            const payload = new TextEncoder().encode(canonicalWorkroomJson(projectionInput));
-            if (hashBytes(payload) !== projection.digest) {
-                throw new Error('Acceptance projection canonical payload hash drift');
-            }
-            const receipt = await this.#writeDerivedPayload({
-                operationId: input.operationId,
-                projectId: input.projectId,
-                kind: 'acceptanceProjection',
-                objectId: `workroom-acceptance-projection:${projection.digest.slice('sha256:'.length)}`,
-                payload,
-                source: deepFreeze(structuredClone(trusted)),
-                signal: linked.signal,
-            });
-            return deepFreeze({
-                vaultObjectId: receipt.descriptor.vaultObjectId,
-                objectId: receipt.descriptor.objectId,
-                payloadHash: receipt.descriptor.payloadHash,
-                descriptorDigest: receipt.descriptor.descriptorDigest,
-                locationManifestDigest: receipt.descriptor.locationManifestDigest,
-                source: receipt.source,
-                sourceBindingDigest: receipt.source.bindingDigest,
-                bytes: receipt.descriptor.bytes,
-            });
-        }
-        finally {
-            linked.dispose();
-        }
-    }
-    async #readAcceptanceProjection(input, signal) {
-        const linked = linkSignals(this.options.signal, signal);
-        try {
-            linked.signal.throwIfAborted();
-            if (input.purpose !== 'acceptance-policy') {
-                throw new Error('Acceptance projection disclosure purpose is invalid');
-            }
-            assertAcceptanceProjectionReceipt(input.receipt);
-            const trusted = await this.options.acceptanceProjectionSources?.resolve({
-                projectId: input.projectId,
-                projectionDigest: input.receipt.payloadHash,
-                source: {
-                    kind: input.receipt.source.kind,
-                    ref: input.receipt.source.ref,
-                    digest: input.receipt.source.digest,
-                    issuer: input.receipt.source.issuer,
-                    issuerDigest: input.receipt.source.issuerDigest,
-                    revision: input.receipt.source.revision,
-                    bindingDigest: input.receipt.source.bindingDigest,
-                },
-            }, linked.signal);
-            linked.signal.throwIfAborted();
-            if (!trusted || canonicalWorkroomJson(trusted) !== canonicalWorkroomJson(input.receipt.source)) {
-                return undefined;
-            }
-            const sourceAuthority = await this.options.repository.readSource(input.projectId, input.receipt.objectId, input.receipt.payloadHash);
-            if (!sourceAuthority
-                || sourceAuthority.sourceBindingDigest !== input.receipt.source.bindingDigest
-                || sourceAuthority.handle.vaultObjectId !== input.receipt.vaultObjectId
-                || sourceAuthority.handle.descriptorDigest !== input.receipt.descriptorDigest
-                || sourceAuthority.handle.locationManifestDigest !== input.receipt.locationManifestDigest) {
-                return undefined;
-            }
-            const currentAuthority = await this.options.repository.readProject(input.projectId);
-            const authority = currentAuthority?.revision === sourceAuthority.projectAuthorityRevision
-                && currentAuthority.digest === sourceAuthority.projectAuthorityDigest
-                ? currentAuthority
-                : await this.options.repository.readProjectRevision?.(input.projectId, sourceAuthority.projectAuthorityRevision);
-            const sinkRuleId = 'acceptance-projection:acceptance-policy';
-            const sink = authority?.sinks[sinkRuleId];
-            const destination = sink && authority?.policy.destinations[sink.destinationId];
-            if (!authority || authority.digest !== sourceAuthority.projectAuthorityDigest
-                || !sink?.fixedPrincipalId || !destination)
-                return undefined;
-            const manifest = await this.#materialize({
-                operationId: input.operationId,
-                authority,
-                source: sourceAuthority,
-                context: {
-                    channel: sink.channel,
-                    purpose: sink.purpose,
-                    requestedMode: sink.requestedMode,
-                    policyRevision: authority.policy.revision,
-                    principal: {
-                        principalId: sink.fixedPrincipalId,
-                        tenantId: authority.tenantId,
-                        projectId: authority.projectId,
-                        ...sink.principal,
-                    },
-                    destination,
-                    recipients: structuredClone(sink.recipients),
-                },
-                signal: linked.signal,
-            });
-            if (manifest.output.mode !== 'full'
-                || manifest.output.handle.vaultObjectId !== input.receipt.vaultObjectId
-                || manifest.output.handle.descriptorDigest !== input.receipt.descriptorDigest
-                || manifest.output.handle.locationManifestDigest !== input.receipt.locationManifestDigest
-                || manifest.output.payloadHash !== input.receipt.payloadHash)
-                return undefined;
-            await this.#requirePayloadInfrastructure(linked.signal);
-            const payload = await this.options.vault.readExact({
-                handle: manifest.output.handle,
-                requestDigest: manifest.requestDigest,
-                purpose: manifest.purpose,
-                principalId: manifest.principal.principalId,
-                destinationId: manifest.destination.id,
-            }, linked.signal);
-            let candidate;
-            try {
-                candidate = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(payload));
-            }
-            catch (error) {
-                throw new Error('Acceptance projection governed payload is malformed', { cause: error });
-            }
-            if (!isAcceptanceProjectionInput(candidate)) {
-                throw new Error('Acceptance projection governed payload is malformed');
-            }
-            const projection = createWorkroomGovernedAcceptanceProjection(candidate);
-            if (projection.digest !== input.receipt.payloadHash || projection.projectId !== input.projectId) {
-                throw new Error('Acceptance projection governed payload binding drift');
-            }
-            return projection;
-        }
-        finally {
-            linked.dispose();
-        }
-    }
-    async #writeDerivedPayload(input) {
-        const linked = linkSignals(this.options.signal, input.signal);
-        let intentId;
-        let authorityIndexed = false;
-        let publicationStarted = false;
-        let publicationConfirmed = false;
-        try {
-            const infrastructure = await this.#requirePayloadInfrastructure(linked.signal);
-            const authority = await this.options.repository.readProject(input.projectId);
-            if (!authority)
-                throw new Error('Data Governance Project authority is unavailable');
-            const rule = authority.derivedPayloads[input.kind];
-            if (!rule)
-                throw new Error(`Governed ${input.kind} payload authority is unavailable`);
-            const payloadHash = hashBytes(input.payload);
-            const existingSource = await this.options.repository.readSource(input.projectId, input.objectId, payloadHash);
-            if (existingSource && !input.publication
-                && existingSource.sourceBindingDigest === input.source.bindingDigest
-                && existingSource.projectAuthorityRevision === authority.revision
-                && existingSource.projectAuthorityDigest === authority.digest
-                && existingSource.descriptor.objectId === input.objectId
-                && existingSource.descriptor.payloadHash === payloadHash
-                && existingSource.handle.objectId === input.objectId
-                && existingSource.handle.payloadHash === payloadHash
-                && existingSource.handle.descriptorDigest === digest(existingSource.descriptor)) {
-                await infrastructure.payloadLifecycleIndex.register({
-                    operationId: input.operationId,
-                    handle: existingSource.handle,
-                }, linked.signal);
-                return deepFreeze({
-                    descriptor: {
-                        vaultObjectId: existingSource.handle.vaultObjectId,
-                        objectId: existingSource.handle.objectId,
-                        payloadHash: existingSource.handle.payloadHash,
-                        descriptorDigest: existingSource.handle.descriptorDigest,
-                        locationManifestDigest: existingSource.handle.locationManifestDigest,
-                        bytes: input.payload.byteLength,
-                    },
-                    source: structuredClone(input.source),
-                });
-            }
-            const createdAt = input.createdAt ?? this.#now();
-            const classified = classifyDataDescriptor({
-                objectId: input.objectId,
-                payloadHash,
-                tenantId: authority.tenantId,
-                projectId: authority.projectId,
-                kind: input.kind === 'evidence'
-                    ? 'evidence'
-                    : input.kind === 'taskReport'
-                        ? 'task_report'
-                        : input.kind === 'acceptanceProjection' || input.kind === 'journal'
-                            ? 'workroom_fact'
-                            : 'projection_payload',
-                proposedConfidentiality: rule.proposedConfidentiality,
-                categories: rule.categories,
-                allowedPurposes: rule.allowedPurposes,
-                allowedRegions: rule.allowedRegions,
-                subjectRefs: [],
-                retention: {
-                    class: rule.retentionClass,
-                    minimumRetainUntil: safeAdd(createdAt, rule.minimumRetentionMs),
-                    deleteAfter: safeAdd(createdAt, rule.maximumRetentionMs),
-                },
-                lineage: { sourceObjectIds: [input.source.ref] },
-            }, authority.categoryRegistry);
-            if (classified.status === 'quarantined') {
-                await this.#block(input.operationId, input.projectId, 'source_classification_quarantined');
-                throw new Error(`Governed ${input.kind} payload classification is quarantined`);
-            }
-            const descriptor = classified.descriptor;
-            const descriptorDigest = digest(descriptor);
-            let intent = await infrastructure.payloadWrites.begin({
-                operationId: input.operationId,
-                projectId: input.projectId,
-                objectId: descriptor.objectId,
-                payloadHash: descriptor.payloadHash,
-                descriptorDigest,
-                sourceBindingDigest: input.source.bindingDigest,
-                consumer: input.consumer ?? (input.kind === 'journal' ? 'journal_header' : 'authority_source'),
-                ...(input.publicationScope ? { publicationScope: input.publicationScope } : {}),
-            });
-            intentId = intent.intentId;
-            if (intent.state === 'purge_required') {
-                throw new Error('Governed Payload write was abandoned and cannot be republished');
-            }
-            let handle = intent.handle;
-            if (!handle) {
-                handle = await this.options.vault.putSource({
-                    descriptor,
-                    descriptorDigest,
-                    payload: input.payload,
-                    sourceBindingDigest: input.source.bindingDigest,
-                }, linked.signal);
-                intent = await infrastructure.payloadWrites.recordVault(intentId, handle);
-            }
-            if (intent.state === 'vault_written') {
-                const lifecycleIndex = await infrastructure.payloadLifecycleIndex.register({
-                    operationId: input.operationId,
-                    handle,
-                }, linked.signal);
-                const sourceAuthority = createGovernedSourceAuthority({
-                    version: 1,
-                    projectId: authority.projectId,
-                    sourceRef: descriptor.objectId,
-                    sourceDigest: descriptor.payloadHash,
-                    sourceBindingDigest: input.source.bindingDigest,
-                    descriptor,
-                    handle,
-                    projectAuthorityRevision: authority.revision,
-                    projectAuthorityDigest: authority.digest,
-                });
-                const persistedSource = await this.options.repository.appendSource(sourceAuthority);
-                if (canonicalWorkroomJson(persistedSource) !== canonicalWorkroomJson(sourceAuthority)) {
-                    throw new Error('Governed Payload source authority CAS winner drift');
-                }
-                intent = await infrastructure.payloadWrites.recordAuthorityIndex(intentId, digest({
-                    sourceAuthorityDigest: sourceAuthority.digest,
-                    lifecycleIndexDigest: lifecycleIndex.digest,
-                }));
-            }
-            authorityIndexed = intent.state === 'authority_indexed' || intent.state === 'published';
-            const receipt = deepFreeze({
-                descriptor: {
-                    vaultObjectId: handle.vaultObjectId,
-                    objectId: handle.objectId,
-                    payloadHash: handle.payloadHash,
-                    descriptorDigest: handle.descriptorDigest,
-                    locationManifestDigest: handle.locationManifestDigest,
-                    bytes: input.payload.byteLength,
-                },
-                source: structuredClone(input.source),
-            });
-            if (input.publication && intent.state !== 'published') {
-                publicationStarted = true;
-                const publicationReceipt = deepFreeze({
-                    descriptor: receipt.descriptor,
-                    source: validatePublicationReceiptSource(input.source),
-                });
-                const publication = await input.publication.publish(publicationReceipt, linked.signal);
-                publicationConfirmed = true;
-                await infrastructure.payloadWrites.publish(intentId, exactDigest(publication.publicationDigest, 'payload publicationDigest'));
-            }
-            return receipt;
-        }
-        catch (error) {
-            if (intentId) {
-                const snapshot = await this.options.payloadWrites?.read(intentId);
-                const definiteAbandon = !authorityIndexed
-                    || error instanceof WorkroomGovernedPayloadHeaderCasLostError
-                    || error instanceof WorkroomGovernedPayloadPublicationAbandonedError;
-                if (snapshot && snapshot.state !== 'published' && definiteAbandon
-                    && !(publicationStarted && publicationConfirmed)) {
-                    if (snapshot.state !== 'purge_required') {
-                        await this.options.payloadWrites?.requirePurge(intentId, error instanceof WorkroomGovernedPayloadHeaderCasLostError
-                            ? 'cas_lost'
-                            : 'write_failed');
-                    }
-                    await this.#purgeIntent(intentId);
-                }
-            }
-            if (linked.signal.aborted) {
-                throw linked.signal.reason ?? new DOMException('Governed payload write cancelled', 'AbortError');
-            }
-            await this.#block(input.operationId, input.projectId, blockerKind(error));
-            throw error;
-        }
-        finally {
-            linked.dispose();
-        }
-    }
-    async #purgeIntent(intentId) {
-        if (!this.options.payloadPurge)
-            return;
-        await this.options.payloadPurge.processIntent(intentId, this.options.signal);
-    }
-    async #requirePayloadInfrastructure(signal, blocker) {
-        signal.throwIfAborted();
-        const payloadWrites = this.options.payloadWrites;
-        const payloadLifecycleIndex = this.options.payloadLifecycleIndex;
-        const payloadPurge = this.options.payloadPurge;
-        const rejectUnavailable = async (unavailable) => {
-            if (blocker) {
-                await this.#block(blocker.operationId, blocker.projectId, blockerKind(unavailable));
-            }
-            throw unavailable;
-        };
-        if (!payloadWrites) {
-            return await rejectUnavailable(new Error('Governed Payload durable write saga authority is unavailable'));
-        }
-        if (!payloadLifecycleIndex) {
-            return await rejectUnavailable(new Error('Governed Payload Lifecycle index authority is unavailable'));
-        }
-        if (!payloadPurge) {
-            return await rejectUnavailable(new Error('Governed Payload orphan purge authority is unavailable'));
-        }
-        await payloadWrites.assertReady();
-        signal.throwIfAborted();
-        return Object.freeze({
-            payloadWrites,
-            payloadLifecycleIndex,
-            payloadPurge,
-        });
-    }
-    async #readTaskReport(input, signal) {
-        await this.#requirePayloadInfrastructure(signal, {
-            operationId: `accepted-source-read:${input.candidateHash}`,
-            projectId: input.projectId,
-        });
-        const authority = await this.options.repository.readProject(input.projectId);
-        const sinkRuleId = 'task-report:accepted-source-memory-projector';
-        const sink = authority?.sinks[sinkRuleId];
-        if (!authority || !sink?.fixedPrincipalId) {
-            throw new Error('Accepted-source Task Report disclosure authority is unavailable');
-        }
-        const manifest = await this.disclosureManifest.materialize({
-            operationId: `accepted-source-read:${input.candidateHash}`,
-            projectId: input.projectId,
-            sourceRef: input.receipt.descriptor.objectId,
-            sourceDigest: input.receipt.descriptor.payloadHash,
-            sinkRuleId,
-            principalId: sink.fixedPrincipalId,
-        }, signal);
-        if (!manifest || manifest.output.mode !== 'full'
-            || manifest.output.handle.vaultObjectId !== input.receipt.descriptor.vaultObjectId
-            || manifest.output.handle.descriptorDigest !== input.receipt.descriptor.descriptorDigest
-            || manifest.output.payloadHash !== input.receipt.descriptor.payloadHash) {
-            throw new Error('Accepted-source Task Report disclosure is not exact/full');
-        }
-        const payload = await this.options.vault.readExact({
-            handle: manifest.output.handle,
-            requestDigest: manifest.requestDigest,
-            purpose: manifest.purpose,
-            principalId: manifest.principal.principalId,
-            destinationId: manifest.destination.id,
-        }, signal);
-        let report;
-        try {
-            report = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(payload));
-        }
-        catch (error) {
-            throw new Error('Governed Task Report payload is not canonical JSON', { cause: error });
-        }
-        if (!report || typeof report !== 'object'
-            || report.projectId !== input.projectId
-            || report.runId !== input.runId
-            || report.taskKey !== input.taskKey
-            || report.ref !== input.reportRef
-            || report.candidateHash !== input.candidateHash) {
-            throw new Error('Governed Task Report payload escaped accepted-source scope');
-        }
-        return deepFreeze(report);
-    }
-    async #materializePlanning(request, operationSignal) {
-        const linked = linkSignals(this.options.signal, operationSignal);
-        const binding = createWorkroomPlanningDisclosureSourceBinding(request.input.source);
-        try {
-            this.#assertGeneration(request);
-            if (canonicalWorkroomJson(binding) !== canonicalWorkroomJson(request.source)) {
-                throw new Error('Planning disclosure source binding drift');
-            }
-            const authority = await this.options.repository.readProject(request.input.projectId);
-            if (!authority) {
-                await this.#block(request.input.operationId, request.input.projectId, 'project_authority_unavailable', binding.digest);
-                throw new WorkroomPlanningClarificationError('planning_disclosure_unavailable');
-            }
-            const source = await this.#resolvePlanningSource(request, authority, binding.digest, linked.signal);
-            const manifest = await this.#materialize({
-                operationId: request.input.operationId,
-                authority,
-                source,
-                context: {
-                    channel: 'model_provider',
-                    purpose: 'orchestration',
-                    requestedMode: authority.planning.source.requestedMode,
-                    policyRevision: authority.policy.revision,
-                    principal: {
-                        principalId: request.input.principalId,
-                        tenantId: authority.tenantId,
-                        projectId: authority.projectId,
-                        ...authority.planning.principal,
-                    },
-                    destination: authority.policy.destinations[authority.planning.destinationId],
-                    recipients: authority.planning.recipients,
-                },
-                signal: linked.signal,
-            });
-            await this.#requirePayloadInfrastructure(linked.signal);
-            const payload = await this.options.vault.readExact(deepFreeze({
-                handle: structuredClone(manifest.output.handle),
-                requestDigest: manifest.requestDigest,
-                purpose: manifest.purpose,
-                principalId: manifest.principal.principalId,
-                destinationId: manifest.destination.id,
-            }), linked.signal);
-            if (hashBytes(payload) !== manifest.output.payloadHash) {
-                throw new Error('Planning disclosure output body hash mismatch');
-            }
-            let text;
-            try {
-                text = new TextDecoder('utf-8', { fatal: true }).decode(payload);
-            }
-            catch (error) {
-                throw new Error('Planning disclosure output is not valid UTF-8', { cause: error });
-            }
-            return createWorkroomPlanningDisclosure({ source: request.source, manifest, text });
-        }
-        catch (error) {
-            if (error instanceof WorkroomPlanningClarificationError)
-                throw error;
-            const kind = blockerKind(error);
-            await this.#block(request.input.operationId, request.input.projectId, kind, binding.digest);
-            if (linked.signal.aborted) {
-                throw linked.signal.reason ?? new DOMException('Data Governance planning cancelled', 'AbortError');
-            }
-            throw new WorkroomPlanningClarificationError('planning_disclosure_unavailable');
-        }
-        finally {
-            linked.dispose();
-        }
-    }
-    async #resolvePlanningSource(request, authority, sourceBindingDigest, signal) {
-        const infrastructure = await this.#requirePayloadInfrastructure(signal);
-        const existing = await this.options.repository.readSource(request.input.projectId, request.input.source.ref, request.input.source.digest);
-        if (existing) {
-            if (existing.sourceBindingDigest !== sourceBindingDigest
-                || existing.projectAuthorityDigest !== authority.digest
-                || existing.projectAuthorityRevision !== authority.revision) {
-                throw new Error('Governed source authority is stale for current policy');
-            }
-            await infrastructure.payloadLifecycleIndex.register({
-                operationId: request.input.operationId,
-                handle: existing.handle,
-            }, signal);
-            return existing;
-        }
-        const payload = new TextEncoder().encode(request.input.source.text);
-        const payloadHash = hashBytes(payload);
-        const timestamp = nonNegative(request.input.source.event.timestamp, 'source timestamp');
-        const rule = authority.planning.source;
-        const classified = classifyDataDescriptor({
-            objectId: `workroom-source:${request.input.source.digest}`,
-            payloadHash,
-            tenantId: authority.tenantId,
-            projectId: authority.projectId,
-            kind: 'source_message',
-            proposedConfidentiality: rule.proposedConfidentiality,
-            categories: rule.categories,
-            allowedPurposes: rule.allowedPurposes,
-            allowedRegions: rule.allowedRegions,
-            subjectRefs: rule.linkPrincipalAsSubject ? [request.input.principalId] : [],
-            retention: {
-                class: rule.retentionClass,
-                minimumRetainUntil: safeAdd(timestamp, rule.minimumRetentionMs),
-                deleteAfter: safeAdd(timestamp, rule.maximumRetentionMs),
-            },
-            lineage: { sourceObjectIds: [request.input.source.ref] },
-        }, authority.categoryRegistry);
-        if (classified.status === 'quarantined') {
-            throw new Error(`Source classification quarantined: ${classified.reasonCodes.join(',')}`);
-        }
-        const descriptor = classified.descriptor;
-        const handle = await this.options.vault.putSource({
-            descriptor,
-            descriptorDigest: digest(descriptor),
-            payload,
-            sourceBindingDigest,
-        }, signal);
-        await infrastructure.payloadLifecycleIndex.register({
-            operationId: request.input.operationId,
-            handle,
-        }, signal);
-        return await this.options.repository.appendSource(createGovernedSourceAuthority({
-            version: 1,
-            projectId: authority.projectId,
-            sourceRef: request.input.source.ref,
-            sourceDigest: request.input.source.digest,
-            sourceBindingDigest,
-            descriptor,
-            handle,
-            projectAuthorityRevision: authority.revision,
-            projectAuthorityDigest: authority.digest,
-        }));
-    }
-    async #materializeRegistered(request, operationSignal) {
-        const linked = linkSignals(this.options.signal, operationSignal);
-        try {
-            const authority = await this.options.repository.readProject(request.projectId);
-            if (!authority) {
-                await this.#block(request.operationId, request.projectId, 'project_authority_unavailable');
-                return null;
-            }
-            const source = await this.options.repository.readSource(request.projectId, request.sourceRef, request.sourceDigest);
-            if (!source || source.projectAuthorityDigest !== authority.digest) {
-                await this.#block(request.operationId, request.projectId, 'source_authority_conflict', undefined, authority.digest);
-                return null;
-            }
-            const rule = authority.sinks[request.sinkRuleId];
-            const destination = rule && authority.policy.destinations[rule.destinationId];
-            if (!rule || !destination
-                || (rule.fixedPrincipalId !== undefined && request.principalId !== rule.fixedPrincipalId)) {
-                await this.#block(request.operationId, request.projectId, 'disclosure_denied', source.sourceBindingDigest, authority.digest);
-                return null;
-            }
-            return await this.#materialize({
-                operationId: request.operationId,
-                authority,
-                source,
-                context: {
-                    channel: rule.channel,
-                    purpose: rule.purpose,
-                    requestedMode: rule.requestedMode,
-                    policyRevision: authority.policy.revision,
-                    principal: {
-                        principalId: request.principalId,
-                        ...(request.assignmentId === undefined ? {} : { assignmentId: request.assignmentId }),
-                        tenantId: authority.tenantId,
-                        projectId: authority.projectId,
-                        ...rule.principal,
-                    },
-                    destination,
-                    recipients: structuredClone(rule.recipients),
-                },
-                signal: linked.signal,
-            });
-        }
-        catch (error) {
-            await this.#block(request.operationId, request.projectId, blockerKind(error));
-            if (linked.signal.aborted) {
-                throw linked.signal.reason ?? new DOMException('Data Governance operation cancelled', 'AbortError');
-            }
-            return null;
-        }
-        finally {
-            linked.dispose();
-        }
-    }
-    async #prepareProjection(input, operationSignal) {
-        const linked = linkSignals(this.options.signal, operationSignal);
-        try {
-            const authority = await this.options.repository.readProject(input.projectId);
-            const sink = authority?.sinks[input.sinkRuleId];
-            const expectedChannel = input.sinkRuleId === 'projection:sponsor-room'
-                ? 'sponsor_projection'
-                : 'workroom_projection';
-            if (!authority || !sink || sink.channel !== expectedChannel || !sink.fixedPrincipalId
-                || !authority.derivedPayloads.projection) {
-                const reason = authority ? 'disclosure_denied' : 'project_authority_unavailable';
-                await this.#block(input.operationId, input.projectId, reason, undefined, authority?.digest);
-                return deepFreeze({ status: 'blocked', reason });
-            }
-            if (input.sourceEventIds.length === 0 || input.sourceEventIds.some(value => !value.trim())) {
-                await this.#block(input.operationId, input.projectId, 'source_authority_conflict', undefined, authority.digest);
-                return deepFreeze({ status: 'blocked', reason: 'source_authority_conflict' });
-            }
-            const authorityEpoch = deepFreeze({
-                revision: authority.revision,
-                digest: authority.digest,
-            });
-            const payload = new TextEncoder().encode(input.body);
-            const payloadHash = hashBytes(payload);
-            const source = deepFreeze({
-                kind: 'tool',
-                ref: `workroom-projection-events:${digest({
-                    projectId: input.projectId,
-                    sourceEventIds: input.sourceEventIds,
-                    authorityEpoch,
-                })}`,
-                digest: digest({ version: 1, sourceEventIds: input.sourceEventIds, authorityEpoch }),
-                bindingDigest: digest({
-                    version: 1, projectId: input.projectId, sourceEventIds: input.sourceEventIds, payloadHash,
-                    authorityEpoch,
-                }),
-                verification: 'verified',
-            });
-            const receipt = await this.#writeDerivedPayload({
-                operationId: `${input.operationId}:authority:${authority.revision}:${authority.digest}`,
-                projectId: input.projectId,
-                kind: 'projection',
-                objectId: `workroom-projection-payload:${digest({
-                    projectId: input.projectId, sourceEventIds: input.sourceEventIds, payloadHash, authorityEpoch,
-                })}`,
-                payload,
-                source,
-                signal: linked.signal,
-            });
-            const request = deepFreeze({
-                operationId: input.operationId,
-                projectId: input.projectId,
-                sourceRef: receipt.descriptor.objectId,
-                sourceDigest: receipt.descriptor.payloadHash,
-                sinkRuleId: input.sinkRuleId,
-                principalId: sink.fixedPrincipalId,
-            });
-            const manifest = await this.#materializeRegistered(request, linked.signal);
-            if (!manifest)
-                return deepFreeze({ status: 'blocked', reason: 'disclosure_denied' });
-            return deepFreeze({ status: 'ready', request, manifest });
-        }
-        catch (error) {
-            if (linked.signal.aborted) {
-                throw linked.signal.reason ?? new DOMException('Projection disclosure cancelled', 'AbortError');
-            }
-            const reason = blockerKind(error);
-            await this.#block(input.operationId, input.projectId, reason);
-            return deepFreeze({ status: 'blocked', reason });
-        }
-        finally {
-            linked.dispose();
-        }
-    }
-    async #revalidateRegistered(input, operationSignal) {
-        const linked = linkSignals(this.options.signal, operationSignal);
-        let reason;
-        try {
-            const { request, manifest } = input;
-            const authority = await this.options.repository.readProject(request.projectId);
-            if (!authority)
-                reason = 'project_authority_unavailable';
-            const source = authority
-                ? await this.options.repository.readSource(request.projectId, request.sourceRef, request.sourceDigest)
-                : undefined;
-            const sourceInvalid = !source
-                || source.sourceRef !== request.sourceRef
-                || source.sourceDigest !== request.sourceDigest
-                || source.projectAuthorityDigest !== authority.digest
-                || source.projectAuthorityRevision !== authority.revision
-                || source.descriptor.objectId !== manifest.source.objectId
-                || source.descriptor.payloadHash !== manifest.source.payloadHash
-                || digest(source.descriptor) !== manifest.source.descriptorDigest
-                || digest(source.descriptor.lineage) !== manifest.source.lineageDigest
-                || canonicalWorkroomJson(source.handle) !== canonicalWorkroomJson(manifest.source.handle);
-            const rule = authority?.sinks[request.sinkRuleId];
-            const destination = rule && authority?.policy.destinations[rule.destinationId];
-            if (!reason && (!rule || !destination
-                || (rule.fixedPrincipalId !== undefined && request.principalId !== rule.fixedPrincipalId)
-                || manifest.channel !== rule.channel
-                || manifest.purpose !== rule.purpose
-                || manifest.principal.principalId !== request.principalId
-                || manifest.principal.assignmentId !== request.assignmentId
-                || manifest.destination.id !== rule.destinationId)) {
-                reason = 'disclosure_manifest_stale';
-            }
-            if (!reason && (manifest.destination.recipientRevision !== rule.recipients.revision
-                || manifest.destination.recipientDigest !== rule.recipients.digest
-                || destination.recipientSnapshotRevision !== rule.recipients.revision
-                || destination.recipientSnapshotDigest !== rule.recipients.digest)) {
-                reason = 'disclosure_recipient_revoked';
-            }
-            if (!reason && manifest.destination.contractDigest !== destination.contractDigest) {
-                reason = 'disclosure_manifest_stale';
-            }
-            // Any policy replacement invalidates the persisted decision. A wider
-            // current policy must never silently extend an older Manifest.
-            if (!reason && (manifest.policy.revision !== authority.policy.revision
-                || manifest.policy.digest !== authority.policy.digest)) {
-                reason = 'disclosure_manifest_stale';
-            }
-            if (!reason && sourceInvalid)
-                reason = 'source_authority_conflict';
-            const now = this.#now();
-            if (!reason && now >= manifest.expiresAt)
-                reason = 'disclosure_manifest_expired';
-            if (!reason && !exactCurrentApprovals(manifest, authority.approvals, now)) {
-                reason = 'disclosure_approval_required';
-            }
-            if (reason) {
-                await this.#block(request.operationId, request.projectId, reason, source?.sourceBindingDigest, authority?.digest);
-                return deepFreeze({ status: 'blocked', reason });
-            }
-            linked.signal.throwIfAborted();
-            await this.#requirePayloadInfrastructure(linked.signal);
-            const body = await this.options.vault.readExact({
-                handle: structuredClone(manifest.output.handle),
-                requestDigest: manifest.requestDigest,
-                purpose: manifest.purpose,
-                principalId: manifest.principal.principalId,
-                destinationId: manifest.destination.id,
-            }, linked.signal);
-            if (hashBytes(body) !== manifest.output.payloadHash) {
-                await this.#block(request.operationId, request.projectId, 'source_authority_conflict', source?.sourceBindingDigest, authority?.digest);
-                return deepFreeze({ status: 'blocked', reason: 'source_authority_conflict' });
-            }
-            return Object.freeze({ status: 'ready', manifest: deepFreeze(structuredClone(manifest)), body });
-        }
-        catch (error) {
-            if (linked.signal.aborted) {
-                throw linked.signal.reason ?? new DOMException('Data Governance dispatch cancelled', 'AbortError');
-            }
-            const blocked = blockerKind(error);
-            await this.#block(input.request.operationId, input.request.projectId, blocked);
-            return deepFreeze({ status: 'blocked', reason: blocked });
-        }
-        finally {
-            linked.dispose();
-        }
-    }
-    async #materializeAssignment(request) {
-        let authority;
-        try {
-            authority = await this.options.repository.readProject(request.preview.projectId);
-        }
-        catch (error) {
-            if (this.options.signal.aborted)
-                throw this.options.signal.reason;
-            await this.#block(request.preview.operationId, request.preview.projectId, blockerKind(error));
-            return null;
-        }
-        const rule = authority?.remote[request.endpointId];
-        if (!authority || !rule || request.preview.generation !== this.generation
-            || rule.principal.role !== request.preview.role) {
-            await this.#block(request.preview.operationId, request.preview.projectId, authority ? 'disclosure_denied' : 'project_authority_unavailable', undefined, authority?.digest);
-            return null;
-        }
-        return await this.disclosureManifest.materialize({
-            operationId: request.preview.operationId,
-            projectId: request.preview.projectId,
-            sourceRef: request.contextView.ref,
-            sourceDigest: request.contextView.hash,
-            sinkRuleId: `remote:${request.endpointId}`,
-            principalId: request.principalId,
-            assignmentId: request.assignmentId,
-        }, this.options.signal);
-    }
-    async #materialize(input) {
-        const decisionInput = deepFreeze({
-            descriptor: structuredClone(input.source.descriptor),
-            policy: structuredClone(input.authority.policy),
-            context: structuredClone(input.context),
-            approvals: structuredClone(input.authority.approvals),
-            evaluatedAt: this.#now(),
-        });
-        return await materializeDisclosureManifest({
-            decisionInput,
-            categoryRegistry: input.authority.categoryRegistry,
-            source: input.source.handle,
-            vault: this.options.vault,
-            ...(this.options.transforms ? { transforms: this.options.transforms } : {}),
-            signal: input.signal,
-        });
-    }
-    #assertGeneration(request) {
-        const expected = createWorkroomDynamicPlanningGenerationSnapshot(this.generation);
-        if (canonicalWorkroomJson(request.generation) !== canonicalWorkroomJson(expected)) {
-            throw new Error('Data Governance request escaped its Root generation');
-        }
-        this.options.signal.throwIfAborted();
-    }
-    async #block(operationId, projectId, kind, sourceBindingDigest, authorityDigest) {
-        await this.options.repository.recordBlocker({
-            version: 1,
-            generation: this.generation,
-            operationId,
-            projectId,
-            kind,
-            ...(authorityDigest ? { authorityDigest } : {}),
-            ...(sourceBindingDigest && /^sha256:[a-f\d]{64}$/u.test(sourceBindingDigest)
-                ? { sourceBindingDigest }
-                : {}),
-            createdAt: this.#now(),
-        });
-    }
-}
-function blockerKind(error) {
-    if (error instanceof DOMException && error.name === 'AbortError')
-        return 'generation_retired';
-    if (error instanceof DataGovernanceAuthorityUnauthorizedError)
-        return 'project_authority_unavailable';
-    if (error instanceof PayloadVaultCryptographyUnavailableError)
-        return 'payload_vault_key_unavailable';
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes('Project authority is unavailable'))
-        return 'project_authority_unavailable';
-    if (message.includes('quarantined'))
-        return 'source_classification_quarantined';
-    if (message.includes('approval'))
-        return 'disclosure_approval_required';
-    if (message.includes('stale') || message.includes('conflict'))
-        return 'source_authority_conflict';
-    if (message.includes('Abort') || message.includes('retired'))
-        return 'generation_retired';
-    return 'disclosure_denied';
-}
-function exactCurrentApprovals(manifest, approvals, now) {
-    if (manifest.approvalIds.length === 0)
-        return true;
-    const byId = new Map(approvals.map(approval => [approval.id, approval]));
-    return manifest.approvalIds.every((id) => {
-        const approval = byId.get(id);
-        return approval?.decision === 'approved'
-            && approval.requestDigest === manifest.requestDigest
-            && approval.policyRevision === manifest.policy.revision
-            && now < approval.expiresAt;
-    });
-}
-function validateReceiptSource(value) {
-    if (!value || !['command', 'file', 'url', 'tool', 'human'].includes(value.kind)
-        || typeof value.ref !== 'string' || !value.ref.trim()
-        || !/^sha256:[a-f\d]{64}$/u.test(value.digest)
-        || !/^sha256:[a-f\d]{64}$/u.test(value.bindingDigest)
-        || (value.verification !== 'verified' && value.verification !== 'unverified')) {
-        throw new Error('Trusted Evidence source resolver returned invalid canonical authority');
-    }
-    return deepFreeze(structuredClone(value));
-}
-function validatePublicationReceiptSource(value) {
-    const kind = (() => {
-        switch (value.kind) {
-            case 'command': return 'command';
-            case 'file': return 'file';
-            case 'url': return 'url';
-            case 'tool': return 'tool';
-            case 'human': return 'human';
-            default: throw new Error('Governed Payload header publication source kind is invalid');
-        }
-    })();
-    return validateReceiptSource(deepFreeze({
-        kind,
-        ref: value.ref,
-        digest: value.digest,
-        bindingDigest: value.bindingDigest,
-        verification: value.verification,
-    }));
-}
-function exactDigest(value, label) {
-    if (!/^sha256:[a-f\d]{64}$/u.test(value)) {
-        throw new Error(`${label} is invalid`);
-    }
-    return value;
-}
-function assertAcceptanceProjectionReceipt(receipt) {
-    if (!receipt.vaultObjectId.trim() || !receipt.objectId.trim()
-        || !/^sha256:[a-f\d]{64}$/u.test(receipt.payloadHash)
-        || !/^sha256:[a-f\d]{64}$/u.test(receipt.descriptorDigest)
-        || !/^sha256:[a-f\d]{64}$/u.test(receipt.locationManifestDigest)
-        || !/^sha256:[a-f\d]{64}$/u.test(receipt.sourceBindingDigest)
-        || receipt.source.kind !== 'profile-policy'
-        || !receipt.source.ref.trim()
-        || !/^sha256:[a-f\d]{64}$/u.test(receipt.source.digest)
-        || !receipt.source.issuer.trim()
-        || !/^sha256:[a-f\d]{64}$/u.test(receipt.source.issuerDigest)
-        || !Number.isSafeInteger(receipt.source.revision) || receipt.source.revision < 1
-        || !/^sha256:[a-f\d]{64}$/u.test(receipt.source.bindingDigest)
-        || receipt.source.bindingDigest !== receipt.sourceBindingDigest
-        || receipt.source.verification !== 'verified'
-        || !Number.isSafeInteger(receipt.bytes) || receipt.bytes < 1) {
-        throw new Error('Acceptance projection governed payload receipt is malformed');
-    }
-}
-function isAcceptanceProjectionInput(value) {
-    if (!isRecord(value)
-        || value.version !== 1
-        || typeof value.projectId !== 'string'
-        || typeof value.profileRevisionId !== 'string'
-        || typeof value.profileDigest !== 'string'
-        || typeof value.revision !== 'number'
-        || typeof value.issuer !== 'string'
-        || !Array.isArray(value.tasks)
-        || !value.tasks.every(isAcceptanceTaskPolicy)
-        || !isRecord(value.memorySchema)
-        || typeof value.memorySchema.revision !== 'number'
-        || !Array.isArray(value.memorySchema.claimRules)
-        || !value.memorySchema.claimRules.every(isMemoryClaimRule)) {
-        return false;
-    }
-    return Object.keys(value).every(key => [
-        'version', 'projectId', 'profileRevisionId', 'profileDigest', 'revision', 'issuer', 'tasks', 'memorySchema',
-    ].includes(key));
-}
-function isAcceptanceTaskPolicy(value) {
-    if (!isRecord(value)
-        || typeof value.taskKey !== 'string'
-        || !['task_result', 'integration_candidate', 'effect_intent'].includes(String(value.kind))
-        || !Array.isArray(value.criteria)
-        || !value.criteria.every(isAcceptanceCriterion)
-        || !Array.isArray(value.requiredEvidence)
-        || !value.requiredEvidence.every(item => typeof item === 'string')
-        || !['baseline', 'reviewer_required', 'sponsor_required', 'reviewer_then_sponsor']
-            .includes(String(value.minimumRoute))
-        || typeof value.reviewerPrincipalId !== 'string'
-        || typeof value.sponsorPrincipalId !== 'string'
-        || typeof value.reviewerTimeoutMs !== 'number'
-        || typeof value.sponsorTimeoutMs !== 'number') {
-        return false;
-    }
-    return Object.keys(value).every(key => [
-        'taskKey', 'kind', 'criteria', 'requiredEvidence', 'minimumRoute', 'reviewerPrincipalId',
-        'sponsorPrincipalId', 'reviewerTimeoutMs', 'sponsorTimeoutMs',
-    ].includes(key));
-}
-function isAcceptanceCriterion(value) {
-    return isRecord(value)
-        && typeof value.id === 'string'
-        && ['deterministic', 'judgment'].includes(String(value.kind))
-        && typeof value.description === 'string'
-        && Object.keys(value).every(key => ['id', 'kind', 'description'].includes(key));
-}
-function isMemoryClaimRule(value) {
-    return isRecord(value)
-        && typeof value.key === 'string'
-        && value.valueType === 'string'
-        && Array.isArray(value.allowedStatuses)
-        && value.allowedStatuses.every(status => status === 'verified' || status === 'assumed')
-        && typeof value.allowSupersedes === 'boolean'
-        && Object.keys(value).every(key => [
-            'key', 'valueType', 'allowedStatuses', 'allowSupersedes',
-        ].includes(key));
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function linkSignals(generation, operation) {
-    const controller = new AbortController();
-    const abortGeneration = () => controller.abort(generation.reason);
-    const abortOperation = () => controller.abort(operation.reason);
-    generation.addEventListener('abort', abortGeneration, { once: true });
-    operation.addEventListener('abort', abortOperation, { once: true });
-    if (generation.aborted)
-        abortGeneration();
-    else if (operation.aborted)
-        abortOperation();
-    return {
-        signal: controller.signal,
-        dispose: () => {
-            generation.removeEventListener('abort', abortGeneration);
-            operation.removeEventListener('abort', abortOperation);
-        },
-    };
-}
-function journalIntentId(projectId, runId, receipt) {
-    return createGovernedPayloadWriteIntentId({
-        operationId: `journal-publication:${runId}`,
-        projectId,
-        objectId: receipt.descriptor.objectId,
-        payloadHash: receipt.descriptor.payloadHash,
-        descriptorDigest: receipt.descriptor.descriptorDigest,
-        sourceBindingDigest: receipt.source.bindingDigest,
-        consumer: 'journal_header',
-        publicationScope: runId,
-    });
-}
-function hashBytes(value) {
-    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
-}
-function positive(value, label) {
-    if (!Number.isSafeInteger(value) || Number(value) < 1)
-        throw new Error(`Data Governance ${label} is invalid`);
-    return Number(value);
-}
-function nonNegative(value, label) {
-    if (!Number.isSafeInteger(value) || Number(value) < 0)
-        throw new Error(`Data Governance ${label} is invalid`);
-    return Number(value);
-}
-function safeAdd(left, right) {
-    const value = left + right;
-    if (!Number.isSafeInteger(value) || value < 0)
-        throw new Error('Data Governance retention overflow');
-    return value;
-}
-//# sourceMappingURL=workroom-data-governance-runtime.js.map