@zhin.js/workroom 0.0.0 → 0.0.1

package/lib/workroom-runtime/workroom-data-governance-authority-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-authority-writer.js","sourceRoot":"","sources":["../../src/workroom-runtime/workroom-data-governance-authority-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mDAAmD,EACnD,oCAAoC,EACpC,qCAAqC,GAMtC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,4BAA4B,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AA+BxF,+FAA+F;AAC/F,MAAM,OAAO,qCAAqC;IAE3B;IAArB,YAAqB,OAInB;QAJmB,YAAO,GAAP,OAAO,CAI1B;IAAG,CAAC;IAEN,KAAK,CAAC,OAAO,CACX,KAA2E,EAC3E,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK;eAC1C,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,eAAe;eAC1C,mCAAmC,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACvD,4CAA4C,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,iDAAiD,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,mDAAmD,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,CAAC;eACrC,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC;mBACtD,SAAS,CAAC,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;YACtD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,eAAe;YACf,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,EAAE,MAAM,CAAC,CAAC;QACX,IAAI,CAAC,QAAQ;eACR,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;eAC1C,QAAQ,CAAC,eAAe,KAAK,eAAe;eAC5C,QAAQ,CAAC,sBAAsB,KAAK,OAAO,EAAE,MAAM;eACnD,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;eAClD,QAAQ,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB;eAC5D,CAAC,QAAQ,CAAC,YAAY,KAAK,cAAc,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,SAAS,GAAG,oCAAoC,CAAC;YACrD,GAAG,SAAS;YACZ,kBAAkB,EAAE,eAAe,CAAC,QAAQ,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;CACF;AAED,8FAA8F;AAC9F,MAAM,UAAU,4CAA4C,CAC1D,SAAkD;IAElD,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,2BAA2B,SAAS,CAAC,SAAS,EAAE,CAAC;IAC1E,MAAM,WAAW,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;WACJ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC;WAC/C,CAAC,IAAI;WACL,IAAI,CAAC,OAAO,KAAK,cAAc;WAC/B,IAAI,CAAC,OAAO,KAAK,eAAe;WAChC,IAAI,CAAC,aAAa,KAAK,MAAM;WAC7B,IAAI,CAAC,gBAAgB,KAAK,gBAAgB;WAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;WACtC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC;WACzD,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,gBAAgB,CAAC;WACzF,CAAC,WAAW;WACZ,WAAW,CAAC,QAAQ;WACpB,CAAC,WAAW,CAAC,UAAU;WACvB,WAAW,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IACxG,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iDAAiD,CAC/D,SAAkD;IAElD,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,oBAAoB,CAAC;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,sCAAsC,SAAS,CAAC,SAAS,EAAE,CAAC;IACrF,MAAM,WAAW,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;WACJ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,mBAAmB,CAAC;WACnD,CAAC,IAAI;WACL,IAAI,CAAC,OAAO,KAAK,cAAc;WAC/B,IAAI,CAAC,OAAO,KAAK,mBAAmB;WACpC,IAAI,CAAC,aAAa,KAAK,MAAM;WAC7B,IAAI,CAAC,gBAAgB,KAAK,gBAAgB;WAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,UAAU;WAClC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,mBAAmB,CAAC;WAC7D,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,gBAAgB,CAAC;WACzF,CAAC,WAAW;WACZ,WAAW,CAAC,QAAQ;WACpB,CAAC,WAAW,CAAC,UAAU;WACvB,WAAW,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gDAAgD,CAAC,OAK/D;IACA,OAAO,IAAI,qCAAqC,CAAC;QAC/C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,IAAI,qCAAqC,CACnD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,oCAAoC,CAAC,EAC7D,OAAO,CAAC,UAAU,CACnB;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAkD,EAClD,UAA0E;IAE1E,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,UAAU,CAAC;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,+BAA+B,SAAS,CAAC,SAAS,EAAE,CAAC;IAC9E,MAAM,uBAAuB,GAAG,uCAAuC,SAAS,CAAC,SAAS,EAAE,CAAC;IAC7F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,WAAW,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC3G,MAAM,wBAAwB,GAAG,UAAU,CAAC,mBAAmB,KAAK,SAAS,IAAI,CAC/E,CAAC,WAAW;WACT,WAAW,CAAC,OAAO,KAAK,oBAAoB;WAC5C,WAAW,CAAC,OAAO,KAAK,qBAAqB;WAC7C,WAAW,CAAC,gBAAgB,KAAK,uBAAuB;WACxD,WAAW,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW;WAC1C,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,qBAAqB,CAAC;WACtE,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,aAAa,CAAC;WACzD,iBAAiB,CAAC,IAAI,KAAK,CAAC;WAC5B,iBAAiB,CAAC,MAAM,KAAK,iBAAiB,CAAC,IAAI;WACnD,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAC9E,CAAC;IACF,IAAI,CAAC,IAAI;WACJ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,oBAAoB,CAAC;WACpD,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,qBAAqB,CAAC;WACrD,CAAC,IAAI;WACL,IAAI,CAAC,OAAO,KAAK,qBAAqB;WACtC,IAAI,CAAC,OAAO,KAAK,oBAAoB;WACrC,IAAI,CAAC,gBAAgB,KAAK,gBAAgB;WAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW;WACnC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,oBAAoB,CAAC;WAC9D,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC;WAClD,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}

package/lib/workroom-runtime/workroom-data-governance-bootstrap.d.ts

@@ -0,0 +1,27 @@
+import { type ConfidentialityClass } from '../data-governance/data-governance.js';
+import type { WorkroomDefinition } from '../workroom/catalog-definition.js';
+import type { ProjectDataGovernanceAuthorityCandidate } from './workroom-data-governance-authority-writer.js';
+export interface WorkroomModelProcessingContractInput {
+    readonly providerId: string;
+    readonly endpoint: string;
+    readonly owner?: string;
+    readonly trustDomain?: string;
+    readonly processingRegions: readonly string[];
+    readonly maxConfidentiality: Exclude<ConfidentialityClass, 'unknown'>;
+    readonly external: boolean;
+    readonly noTraining: boolean;
+    readonly loggingMode: 'disabled' | 'metadata_only' | 'full';
+    readonly maximumRetentionSeconds: number;
+    readonly allowsRedisclosure: boolean;
+    readonly supportsDeletion: boolean;
+}
+/** Conservative P12 baseline generated only from an explicit processor contract. */
+export declare function createWorkroomDataGovernanceBootstrapCandidate(input: Readonly<{
+    projectId: string;
+    tenantId: string;
+    definition: WorkroomDefinition;
+    model: WorkroomModelProcessingContractInput;
+    revision: number;
+    previousDigest?: string;
+}>): ProjectDataGovernanceAuthorityCandidate;
+//# sourceMappingURL=workroom-data-governance-bootstrap.d.ts.map

package/lib/workroom-runtime/workroom-data-governance-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-bootstrap.d.ts","sourceRoot":"","sources":["../../src/workroom-runtime/workroom-data-governance-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,gDAAgD,CAAC;AAE9G,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;IACtE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,UAAU,GAAG,eAAe,GAAG,MAAM,CAAC;IAC5D,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,oFAAoF;AACpF,wBAAgB,8CAA8C,CAAC,KAAK,EAAE,QAAQ,CAAC;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,oCAAoC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC,GAAG,uCAAuC,CAiT3C"}

package/lib/workroom-runtime/workroom-data-governance-bootstrap.js

@@ -0,0 +1,324 @@
+import { createDataCategoryRegistrySnapshot, createDataGovernancePolicySnapshot, createDisclosureRecipientSetSnapshot, createProcessingDestinationContract, } from '../data-governance/data-governance.js';
+/** Conservative P12 baseline generated only from an explicit processor contract. */
+export function createWorkroomDataGovernanceBootstrapCandidate(input) {
+    const conversation = input.definition.conversation;
+    if (!conversation)
+        throw new Error('Workroom disclosure bootstrap requires a Project conversation');
+    if (input.model.external && !input.model.noTraining) {
+        throw new Error('External Workroom model processor must prohibit training');
+    }
+    if (input.model.maxConfidentiality === 'public') {
+        throw new Error('Workroom model processor requires at least project_internal clearance');
+    }
+    const modelRegions = uniqueText(input.model.processingRegions, 'model processingRegions');
+    const allowedRegions = uniqueText(['local', ...modelRegions], 'allowedRegions');
+    const categoryId = 'workroom_content';
+    const modelRecipients = createDisclosureRecipientSetSnapshot({
+        revision: input.revision,
+        recipients: [{
+                principalId: `processor:${input.model.providerId}`,
+                tenantId: input.tenantId,
+                projectId: input.projectId,
+                clearance: input.model.maxConfidentiality,
+            }],
+    });
+    const workroomRecipients = createDisclosureRecipientSetSnapshot({
+        revision: input.revision,
+        recipients: [
+            `room:${input.projectId}`,
+            `service:workroom-kernel:${input.projectId}`,
+            `service:workroom-projection:${input.projectId}`,
+            `service:workroom-acceptance-policy:${input.projectId}`,
+        ].map(principalId => ({
+            principalId,
+            tenantId: input.tenantId,
+            projectId: input.projectId,
+            clearance: 'project_internal',
+        })),
+    });
+    const modelDestination = createProcessingDestinationContract({
+        id: `model-provider:${input.model.providerId}`,
+        owner: input.model.owner ?? input.model.providerId,
+        endpoint: input.model.endpoint,
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        trustDomain: input.model.trustDomain ?? `model-provider:${input.model.providerId}`,
+        processingRegions: modelRegions,
+        maxConfidentiality: input.model.maxConfidentiality,
+        allowedCategories: [categoryId],
+        external: input.model.external,
+        noTraining: input.model.noTraining,
+        loggingMode: input.model.loggingMode,
+        maximumRetentionSeconds: input.model.maximumRetentionSeconds,
+        allowsRedisclosure: input.model.allowsRedisclosure,
+        supportsDeletion: input.model.supportsDeletion,
+        recipientSnapshotRevision: modelRecipients.revision,
+        recipientSnapshotDigest: modelRecipients.digest,
+    });
+    const workroomDestination = createProcessingDestinationContract({
+        id: `workroom-room:${input.projectId}`,
+        owner: `workroom:${input.projectId}`,
+        endpoint: conversationEndpoint(conversation),
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        trustDomain: `workroom:${input.projectId}`,
+        processingRegions: allowedRegions,
+        maxConfidentiality: 'project_internal',
+        allowedCategories: [categoryId],
+        external: false,
+        noTraining: true,
+        loggingMode: 'metadata_only',
+        maximumRetentionSeconds: 86_400,
+        allowsRedisclosure: false,
+        supportsDeletion: true,
+        recipientSnapshotRevision: workroomRecipients.revision,
+        recipientSnapshotDigest: workroomRecipients.digest,
+    });
+    const sponsorRecipients = input.definition.sponsorConversation
+        ? createDisclosureRecipientSetSnapshot({
+            revision: input.revision,
+            recipients: (input.definition.sponsors ?? []).map(principalId => ({
+                principalId,
+                tenantId: input.tenantId,
+                projectId: input.projectId,
+                clearance: 'project_internal',
+            })),
+        })
+        : undefined;
+    const consoleRecipients = input.definition.sponsors?.length
+        ? createDisclosureRecipientSetSnapshot({
+            revision: input.revision,
+            recipients: input.definition.sponsors.map(principalId => ({
+                principalId,
+                tenantId: input.tenantId,
+                projectId: input.projectId,
+                clearance: 'project_internal',
+            })),
+        })
+        : undefined;
+    const sponsorDestination = input.definition.sponsorConversation && sponsorRecipients
+        ? createProcessingDestinationContract({
+            id: `workroom-sponsor-room:${input.projectId}`,
+            owner: `workroom:${input.projectId}`,
+            endpoint: conversationEndpoint(input.definition.sponsorConversation),
+            tenantId: input.tenantId,
+            projectId: input.projectId,
+            trustDomain: `workroom:${input.projectId}`,
+            processingRegions: allowedRegions,
+            maxConfidentiality: 'project_internal',
+            allowedCategories: [categoryId],
+            external: false,
+            noTraining: true,
+            loggingMode: 'metadata_only',
+            maximumRetentionSeconds: 86_400,
+            allowsRedisclosure: false,
+            supportsDeletion: true,
+            recipientSnapshotRevision: sponsorRecipients.revision,
+            recipientSnapshotDigest: sponsorRecipients.digest,
+        })
+        : undefined;
+    const consoleDestination = consoleRecipients
+        ? createProcessingDestinationContract({
+            id: `workroom-console:${input.projectId}`,
+            owner: `workroom:${input.projectId}`,
+            endpoint: `console://workroom/${encodeURIComponent(input.projectId)}`,
+            tenantId: input.tenantId,
+            projectId: input.projectId,
+            trustDomain: `workroom-console:${input.projectId}`,
+            processingRegions: ['local'],
+            maxConfidentiality: 'project_internal',
+            allowedCategories: [categoryId],
+            external: false,
+            noTraining: true,
+            loggingMode: 'metadata_only',
+            maximumRetentionSeconds: 86_400,
+            allowsRedisclosure: false,
+            supportsDeletion: true,
+            recipientSnapshotRevision: consoleRecipients.revision,
+            recipientSnapshotDigest: consoleRecipients.digest,
+        })
+        : undefined;
+    const categoryRegistry = createDataCategoryRegistrySnapshot({
+        id: `workroom:${input.projectId}:categories`,
+        revision: input.revision,
+        tenantId: input.tenantId,
+        kindFloors: {
+            source_message: 'project_internal',
+            workroom_fact: 'project_internal',
+            context_digest: 'project_internal',
+            task_report: 'project_internal',
+            artifact: 'project_internal',
+            evidence: 'project_internal',
+            execution_trace: 'project_internal',
+            projection_payload: 'project_internal',
+        },
+        categories: { [categoryId]: { confidentialityFloor: 'project_internal' } },
+    });
+    const destinations = {
+        [modelDestination.id]: modelDestination,
+        [workroomDestination.id]: workroomDestination,
+        ...(sponsorDestination ? { [sponsorDestination.id]: sponsorDestination } : {}),
+        ...(consoleDestination ? { [consoleDestination.id]: consoleDestination } : {}),
+    };
+    const policy = createDataGovernancePolicySnapshot({
+        id: `workroom:${input.projectId}:policy`,
+        revision: input.revision,
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        destinations,
+        channelCeilings: {
+            context_view: 'project_internal',
+            evidence_port: 'project_internal',
+            workroom_projection: 'project_internal',
+            sponsor_projection: 'project_internal',
+            console: 'project_internal',
+            model_provider: input.model.maxConfidentiality,
+            a2a: 'project_internal',
+        },
+        transforms: {},
+        externalApprovalFloor: 'confidential',
+    });
+    const operationalRule = Object.freeze({
+        proposedConfidentiality: 'project_internal',
+        categories: [categoryId],
+        allowedPurposes: ['orchestration'],
+        allowedRegions,
+        retentionClass: 'operational',
+        minimumRetentionMs: 0,
+        maximumRetentionMs: 86_400_000,
+    });
+    const projectionRule = Object.freeze({
+        ...operationalRule,
+        allowedPurposes: ['workroom_awareness', 'portfolio_oversight'],
+    });
+    const acceptanceProjectionRule = Object.freeze({
+        ...operationalRule,
+        allowedPurposes: ['acceptance_review'],
+        retentionClass: 'project_record',
+    });
+    const candidate = {
+        version: 1,
+        revision: input.revision,
+        ...(input.previousDigest ? { previousDigest: input.previousDigest } : {}),
+        projectId: input.projectId,
+        tenantId: input.tenantId,
+        categoryRegistry,
+        policy,
+        planning: {
+            destinationId: modelDestination.id,
+            recipients: modelRecipients,
+            principal: {
+                role: 'orchestrator',
+                clearance: input.model.maxConfidentiality,
+                allowedPurposes: ['orchestration'],
+            },
+            source: {
+                ...operationalRule,
+                requestedMode: 'full',
+                linkPrincipalAsSubject: true,
+            },
+        },
+        remote: {},
+        sinks: {
+            'model-provider:planning': {
+                destinationId: modelDestination.id,
+                channel: 'model_provider',
+                purpose: 'orchestration',
+                recipients: modelRecipients,
+                principal: {
+                    role: 'orchestrator',
+                    clearance: input.model.maxConfidentiality,
+                    allowedPurposes: ['orchestration'],
+                },
+                requestedMode: 'full',
+            },
+            'projection:workroom': {
+                destinationId: workroomDestination.id,
+                channel: 'workroom_projection',
+                purpose: 'workroom_awareness',
+                fixedPrincipalId: `service:workroom-projection:${input.projectId}`,
+                recipients: workroomRecipients,
+                principal: {
+                    role: 'projector', clearance: 'project_internal',
+                    allowedPurposes: ['workroom_awareness'],
+                },
+                requestedMode: 'full',
+            },
+            ...(sponsorDestination && sponsorRecipients ? {
+                'projection:sponsor-room': {
+                    destinationId: sponsorDestination.id,
+                    channel: 'sponsor_projection',
+                    purpose: 'portfolio_oversight',
+                    fixedPrincipalId: `service:workroom-sponsor-projection:${input.projectId}`,
+                    recipients: sponsorRecipients,
+                    principal: {
+                        role: 'projector',
+                        clearance: 'project_internal',
+                        allowedPurposes: ['portfolio_oversight'],
+                    },
+                    requestedMode: 'full',
+                },
+            } : {}),
+            ...(consoleDestination && consoleRecipients ? {
+                'console:run-metadata': {
+                    destinationId: consoleDestination.id,
+                    channel: 'console',
+                    purpose: 'portfolio_oversight',
+                    recipients: consoleRecipients,
+                    principal: {
+                        role: 'sponsor',
+                        clearance: 'project_internal',
+                        allowedPurposes: ['portfolio_oversight'],
+                    },
+                    requestedMode: 'metadata_only',
+                },
+            } : {}),
+            'workroom-journal:kernel-replay': {
+                destinationId: workroomDestination.id,
+                channel: 'context_view',
+                purpose: 'orchestration',
+                fixedPrincipalId: `service:workroom-kernel:${input.projectId}`,
+                recipients: workroomRecipients,
+                principal: {
+                    role: 'orchestrator', clearance: 'project_internal',
+                    allowedPurposes: ['orchestration'],
+                },
+                requestedMode: 'full',
+            },
+            'acceptance-projection:acceptance-policy': {
+                destinationId: workroomDestination.id,
+                channel: 'context_view',
+                purpose: 'acceptance_review',
+                fixedPrincipalId: `service:workroom-acceptance-policy:${input.projectId}`,
+                recipients: workroomRecipients,
+                principal: {
+                    role: 'reviewer', clearance: 'project_internal',
+                    allowedPurposes: ['acceptance_review'],
+                },
+                requestedMode: 'full',
+            },
+        },
+        derivedPayloads: {
+            projection: projectionRule,
+            journal: operationalRule,
+            acceptanceProjection: acceptanceProjectionRule,
+        },
+        approvals: [],
+    };
+    return Object.freeze(candidate);
+}
+function conversationEndpoint(conversation) {
+    return `im://${encodeURIComponent(conversation.adapter)}/${encodeURIComponent(conversation.endpoint)}/${encodeURIComponent(conversation.kind)}/${encodeURIComponent(conversation.id)}`;
+}
+function uniqueText(values, label) {
+    const normalized = values.map((value) => {
+        if (!value || value.trim() !== value)
+            throw new Error(`${label} contains an invalid value`);
+        return value;
+    });
+    if (normalized.length === 0 || new Set(normalized).size !== normalized.length) {
+        throw new Error(`${label} must contain unique values`);
+    }
+    return Object.freeze([...normalized].sort());
+}
+//# sourceMappingURL=workroom-data-governance-bootstrap.js.map

package/lib/workroom-runtime/workroom-data-governance-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-bootstrap.js","sourceRoot":"","sources":["../../src/workroom-runtime/workroom-data-governance-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,oCAAoC,EACpC,mCAAmC,GAEpC,MAAM,uCAAuC,CAAC;AAmB/C,oFAAoF;AACpF,MAAM,UAAU,8CAA8C,CAAC,KAO7D;IACA,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;IACnD,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACpG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;IAC1F,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,kBAAkB,CAAC;IACtC,MAAM,eAAe,GAAG,oCAAoC,CAAC;QAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,CAAC;gBACX,WAAW,EAAE,aAAa,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE;gBAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;aAC1C,CAAC;KACH,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;QAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE;YACV,QAAQ,KAAK,CAAC,SAAS,EAAE;YACzB,2BAA2B,KAAK,CAAC,SAAS,EAAE;YAC5C,+BAA+B,KAAK,CAAC,SAAS,EAAE;YAChD,sCAAsC,KAAK,CAAC,SAAS,EAAE;SACxD,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACpB,WAAW;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,kBAA2B;SACvC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;QAC3D,EAAE,EAAE,kBAAkB,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE;QAC9C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU;QAClD,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,IAAI,kBAAkB,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE;QAClF,iBAAiB,EAAE,YAAY;QAC/B,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;QAClD,iBAAiB,EAAE,CAAC,UAAU,CAAC;QAC/B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;QAC9B,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAClC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,uBAAuB,EAAE,KAAK,CAAC,KAAK,CAAC,uBAAuB;QAC5D,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;QAClD,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB;QAC9C,yBAAyB,EAAE,eAAe,CAAC,QAAQ;QACnD,uBAAuB,EAAE,eAAe,CAAC,MAAM;KAChD,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;QAC9D,EAAE,EAAE,iBAAiB,KAAK,CAAC,SAAS,EAAE;QACtC,KAAK,EAAE,YAAY,KAAK,CAAC,SAAS,EAAE;QACpC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,YAAY,KAAK,CAAC,SAAS,EAAE;QAC1C,iBAAiB,EAAE,cAAc;QACjC,kBAAkB,EAAE,kBAAkB;QACtC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QAC/B,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,eAAe;QAC5B,uBAAuB,EAAE,MAAM;QAC/B,kBAAkB,EAAE,KAAK;QACzB,gBAAgB,EAAE,IAAI;QACtB,yBAAyB,EAAE,kBAAkB,CAAC,QAAQ;QACtD,uBAAuB,EAAE,kBAAkB,CAAC,MAAM;KACnD,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,KAAK,CAAC,UAAU,CAAC,mBAAmB;QAC5D,CAAC,CAAC,oCAAoC,CAAC;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAChE,WAAW;gBACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,kBAA2B;aACvC,CAAC,CAAC;SACJ,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,iBAAiB,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM;QACzD,CAAC,CAAC,oCAAoC,CAAC;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACxD,WAAW;gBACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,kBAA2B;aACvC,CAAC,CAAC;SACJ,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,kBAAkB,GAAG,KAAK,CAAC,UAAU,CAAC,mBAAmB,IAAI,iBAAiB;QAClF,CAAC,CAAC,mCAAmC,CAAC;YAClC,EAAE,EAAE,yBAAyB,KAAK,CAAC,SAAS,EAAE;YAC9C,KAAK,EAAE,YAAY,KAAK,CAAC,SAAS,EAAE;YACpC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACpE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,YAAY,KAAK,CAAC,SAAS,EAAE;YAC1C,iBAAiB,EAAE,cAAc;YACjC,kBAAkB,EAAE,kBAAkB;YACtC,iBAAiB,EAAE,CAAC,UAAU,CAAC;YAC/B,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,eAAe;YAC5B,uBAAuB,EAAE,MAAM;YAC/B,kBAAkB,EAAE,KAAK;YACzB,gBAAgB,EAAE,IAAI;YACtB,yBAAyB,EAAE,iBAAiB,CAAC,QAAQ;YACrD,uBAAuB,EAAE,iBAAiB,CAAC,MAAM;SAClD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,kBAAkB,GAAG,iBAAiB;QAC1C,CAAC,CAAC,mCAAmC,CAAC;YAClC,EAAE,EAAE,oBAAoB,KAAK,CAAC,SAAS,EAAE;YACzC,KAAK,EAAE,YAAY,KAAK,CAAC,SAAS,EAAE;YACpC,QAAQ,EAAE,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;YACrE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,oBAAoB,KAAK,CAAC,SAAS,EAAE;YAClD,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,kBAAkB,EAAE,kBAAkB;YACtC,iBAAiB,EAAE,CAAC,UAAU,CAAC;YAC/B,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,eAAe;YAC5B,uBAAuB,EAAE,MAAM;YAC/B,kBAAkB,EAAE,KAAK;YACzB,gBAAgB,EAAE,IAAI;YACtB,yBAAyB,EAAE,iBAAiB,CAAC,QAAQ;YACrD,uBAAuB,EAAE,iBAAiB,CAAC,MAAM;SAClD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;QAC1D,EAAE,EAAE,YAAY,KAAK,CAAC,SAAS,aAAa;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE;YACV,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,kBAAkB;YACjC,cAAc,EAAE,kBAAkB;YAClC,WAAW,EAAE,kBAAkB;YAC/B,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ,EAAE,kBAAkB;YAC5B,eAAe,EAAE,kBAAkB;YACnC,kBAAkB,EAAE,kBAAkB;SACvC;QACD,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,EAAE;KAC3E,CAAC,CAAC;IACH,MAAM,YAAY,GAAG;QACnB,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,gBAAgB;QACvC,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,mBAAmB;QAC7C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;IACF,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,EAAE,EAAE,YAAY,KAAK,CAAC,SAAS,SAAS;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY;QACZ,eAAe,EAAE;YACf,YAAY,EAAE,kBAAkB;YAChC,aAAa,EAAE,kBAAkB;YACjC,mBAAmB,EAAE,kBAAkB;YACvC,kBAAkB,EAAE,kBAAkB;YACtC,OAAO,EAAE,kBAAkB;YAC3B,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;YAC9C,GAAG,EAAE,kBAAkB;SACxB;QACD,UAAU,EAAE,EAAE;QACd,qBAAqB,EAAE,cAAc;KACtC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;QACpC,uBAAuB,EAAE,kBAA2B;QACpD,UAAU,EAAE,CAAC,UAAU,CAAC;QACxB,eAAe,EAAE,CAAC,eAAwB,CAAC;QAC3C,cAAc;QACd,cAAc,EAAE,aAAsB;QACtC,kBAAkB,EAAE,CAAC;QACrB,kBAAkB,EAAE,UAAU;KAC/B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;QACnC,GAAG,eAAe;QAClB,eAAe,EAAE,CAAC,oBAA6B,EAAE,qBAA8B,CAAC;KACjF,CAAC,CAAC;IACH,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7C,GAAG,eAAe;QAClB,eAAe,EAAE,CAAC,mBAA4B,CAAC;QAC/C,cAAc,EAAE,gBAAyB;KAC1C,CAAC,CAAC;IACH,MAAM,SAAS,GAA4C;QACzD,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB;QAChB,MAAM;QACN,QAAQ,EAAE;YACR,aAAa,EAAE,gBAAgB,CAAC,EAAE;YAClC,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE;gBACT,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;gBACzC,eAAe,EAAE,CAAC,eAAe,CAAC;aACnC;YACD,MAAM,EAAE;gBACN,GAAG,eAAe;gBAClB,aAAa,EAAE,MAAM;gBACrB,sBAAsB,EAAE,IAAI;aAC7B;SACF;QACD,MAAM,EAAE,EAAE;QACV,KAAK,EAAE;YACL,yBAAyB,EAAE;gBACzB,aAAa,EAAE,gBAAgB,CAAC,EAAE;gBAClC,OAAO,EAAE,gBAAgB;gBACzB,OAAO,EAAE,eAAe;gBACxB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE;oBACT,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB;oBACzC,eAAe,EAAE,CAAC,eAAe,CAAC;iBACnC;gBACD,aAAa,EAAE,MAAM;aACtB;YACD,qBAAqB,EAAE;gBACrB,aAAa,EAAE,mBAAmB,CAAC,EAAE;gBACrC,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EAAE,oBAAoB;gBAC7B,gBAAgB,EAAE,+BAA+B,KAAK,CAAC,SAAS,EAAE;gBAClE,UAAU,EAAE,kBAAkB;gBAC9B,SAAS,EAAE;oBACT,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB;oBAChD,eAAe,EAAE,CAAC,oBAAoB,CAAC;iBACxC;gBACD,aAAa,EAAE,MAAM;aACtB;YACD,GAAG,CAAC,kBAAkB,IAAI,iBAAiB,CAAC,CAAC,CAAC;gBAC5C,yBAAyB,EAAE;oBACzB,aAAa,EAAE,kBAAkB,CAAC,EAAE;oBACpC,OAAO,EAAE,oBAA6B;oBACtC,OAAO,EAAE,qBAA8B;oBACvC,gBAAgB,EAAE,uCAAuC,KAAK,CAAC,SAAS,EAAE;oBAC1E,UAAU,EAAE,iBAAiB;oBAC7B,SAAS,EAAE;wBACT,IAAI,EAAE,WAAoB;wBAC1B,SAAS,EAAE,kBAA2B;wBACtC,eAAe,EAAE,CAAC,qBAA8B,CAAC;qBAClD;oBACD,aAAa,EAAE,MAAe;iBAC/B;aACF,CAAC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,kBAAkB,IAAI,iBAAiB,CAAC,CAAC,CAAC;gBAC5C,sBAAsB,EAAE;oBACtB,aAAa,EAAE,kBAAkB,CAAC,EAAE;oBACpC,OAAO,EAAE,SAAkB;oBAC3B,OAAO,EAAE,qBAA8B;oBACvC,UAAU,EAAE,iBAAiB;oBAC7B,SAAS,EAAE;wBACT,IAAI,EAAE,SAAkB;wBACxB,SAAS,EAAE,kBAA2B;wBACtC,eAAe,EAAE,CAAC,qBAA8B,CAAC;qBAClD;oBACD,aAAa,EAAE,eAAwB;iBACxC;aACF,CAAC,CAAC,CAAC,EAAE,CAAC;YACP,gCAAgC,EAAE;gBAChC,aAAa,EAAE,mBAAmB,CAAC,EAAE;gBACrC,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,eAAe;gBACxB,gBAAgB,EAAE,2BAA2B,KAAK,CAAC,SAAS,EAAE;gBAC9D,UAAU,EAAE,kBAAkB;gBAC9B,SAAS,EAAE;oBACT,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB;oBACnD,eAAe,EAAE,CAAC,eAAe,CAAC;iBACnC;gBACD,aAAa,EAAE,MAAM;aACtB;YACD,yCAAyC,EAAE;gBACzC,aAAa,EAAE,mBAAmB,CAAC,EAAE;gBACrC,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,mBAAmB;gBAC5B,gBAAgB,EAAE,sCAAsC,KAAK,CAAC,SAAS,EAAE;gBACzE,UAAU,EAAE,kBAAkB;gBAC9B,SAAS,EAAE;oBACT,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB;oBAC/C,eAAe,EAAE,CAAC,mBAAmB,CAAC;iBACvC;gBACD,aAAa,EAAE,MAAM;aACtB;SACF;QACD,eAAe,EAAE;YACf,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,eAAe;YACxB,oBAAoB,EAAE,wBAAwB;SAC/C;QACD,SAAS,EAAE,EAAE;KACd,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,YAA6D;IACzF,OAAO,QAAQ,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;AACzL,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB,EAAE,KAAa;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;QAC5F,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/lib/workroom-runtime/workroom-data-governance-composition.d.ts

@@ -0,0 +1,28 @@
+import type { Scope } from '@zhin.js/plugin-runtime';
+import type { PayloadVaultCryptographyPort } from '../data-governance/encrypted-file-payload-vault.js';
+import type { DataGovernanceAuthorityVerificationPort } from '../data-governance/governance-authority-repository.js';
+import type { GovernedPayloadPublicationVerifierPort, GovernedPayloadWritePurgePort } from '../data-governance/governed-payload-write-saga.js';
+import { type WorkroomDataGovernanceRuntime, type WorkroomDataGovernancePayloadVaultPort, type WorkroomAcceptanceProjectionSourceAuthorityPort, type WorkroomEvidenceSourceAuthorityPort, type WorkroomPayloadLifecycleIndexPort } from './workroom-data-governance-runtime.js';
+export interface InstallWorkroomDataGovernanceResourcesOptions {
+    readonly projectRoot: string;
+    readonly generation: number;
+    readonly signal: AbortSignal;
+    /** Trusted Root option only; never published as a Resource/Feature. */
+    readonly cryptography?: PayloadVaultCryptographyPort;
+    /** Root-private activation latch; never provided as a Resource. */
+    readonly vault?: WorkroomDataGovernancePayloadVaultPort;
+    readonly payloadLifecycleIndex?: WorkroomPayloadLifecycleIndexPort;
+    readonly payloadPurge?: GovernedPayloadWritePurgePort;
+    readonly payloadPublicationVerifier?: GovernedPayloadPublicationVerifierPort;
+    /** Trusted Root Data Steward/Sponsor decision verifier; never published. */
+    readonly governance?: DataGovernanceAuthorityVerificationPort;
+    readonly evidenceSources?: WorkroomEvidenceSourceAuthorityPort;
+    readonly acceptanceProjectionSources?: WorkroomAcceptanceProjectionSourceAuthorityPort;
+    readonly resources: Pick<Scope, 'has' | 'provide'>;
+}
+/**
+ * Standard generation composition. It publishes only governed, narrow ports;
+ * raw Vault, crypto and authority writer objects never enter the Resource Scope.
+ */
+export declare function installWorkroomDataGovernanceResources(options: InstallWorkroomDataGovernanceResourcesOptions): WorkroomDataGovernanceRuntime;
+//# sourceMappingURL=workroom-data-governance-composition.d.ts.map

package/lib/workroom-runtime/workroom-data-governance-composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-composition.d.ts","sourceRoot":"","sources":["../../src/workroom-runtime/workroom-data-governance-composition.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,KAAK,EACV,4BAA4B,EAC7B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EACV,uCAAuC,EACxC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EACV,sCAAsC,EACtC,6BAA6B,EAC9B,MAAM,mDAAmD,CAAC;AAY3D,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,sCAAsC,EAC3C,KAAK,+CAA+C,EACpD,KAAK,mCAAmC,EACxC,KAAK,iCAAiC,EACvC,MAAM,uCAAuC,CAAC;AAE/C,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,4BAA4B,CAAC;IACrD,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,sCAAsC,CAAC;IACxD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,iCAAiC,CAAC;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,6BAA6B,CAAC;IACtD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,sCAAsC,CAAC;IAC7E,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,uCAAuC,CAAC;IAC9D,QAAQ,CAAC,eAAe,CAAC,EAAE,mCAAmC,CAAC;IAC/D,QAAQ,CAAC,2BAA2B,CAAC,EAAE,+CAA+C,CAAC;IACvF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,6CAA6C,GACrD,6BAA6B,CAqC/B"}

package/lib/workroom-runtime/workroom-data-governance-composition.js

@@ -0,0 +1,41 @@
+import { join } from 'node:path';
+import { workroomAssignmentDisclosureManifestAuthorityToken, } from './workroom-assignment-authority-grant-runtime.js';
+import { workroomPlanningDisclosureToken, } from './workroom-dynamic-planning-provider.js';
+import { workroomEvidencePayloadWriterToken, workroomTaskReportPayloadToken, } from './workroom-local-agent-loop.js';
+import { workroomAcceptanceProjectionPayloadToken } from './workroom-acceptance-fact-providers.js';
+import { createFileWorkroomDataGovernanceRuntime, workroomDisclosureManifestAuthorityToken, } from './workroom-data-governance-runtime.js';
+/**
+ * Standard generation composition. It publishes only governed, narrow ports;
+ * raw Vault, crypto and authority writer objects never enter the Resource Scope.
+ */
+export function installWorkroomDataGovernanceResources(options) {
+    const runtime = createFileWorkroomDataGovernanceRuntime({
+        stateRoot: join(options.projectRoot, '.zhin'),
+        generation: options.generation,
+        signal: options.signal,
+        ...(options.cryptography ? { cryptography: options.cryptography } : {}),
+        ...(options.vault ? { vault: options.vault } : {}),
+        ...(options.payloadLifecycleIndex ? { payloadLifecycleIndex: options.payloadLifecycleIndex } : {}),
+        ...(options.payloadPurge ? { payloadPurge: options.payloadPurge } : {}),
+        ...(options.payloadPublicationVerifier
+            ? { payloadPublicationVerifier: options.payloadPublicationVerifier }
+            : {}),
+        ...(options.governance ? { governance: options.governance } : {}),
+        ...(options.evidenceSources ? { evidenceSources: options.evidenceSources } : {}),
+        ...(options.acceptanceProjectionSources
+            ? { acceptanceProjectionSources: options.acceptanceProjectionSources }
+            : {}),
+    });
+    provideIfAbsent(options.resources, workroomPlanningDisclosureToken, runtime.planningDisclosure);
+    provideIfAbsent(options.resources, workroomAssignmentDisclosureManifestAuthorityToken, runtime.assignmentDisclosure);
+    provideIfAbsent(options.resources, workroomEvidencePayloadWriterToken, runtime.evidencePayloads);
+    provideIfAbsent(options.resources, workroomTaskReportPayloadToken, runtime.taskReportPayloads);
+    provideIfAbsent(options.resources, workroomAcceptanceProjectionPayloadToken, runtime.acceptanceProjectionPayloads);
+    provideIfAbsent(options.resources, workroomDisclosureManifestAuthorityToken, runtime.disclosureManifest);
+    return runtime;
+}
+function provideIfAbsent(resources, token, value) {
+    if (!resources.has(token))
+        resources.provide(token, value);
+}
+//# sourceMappingURL=workroom-data-governance-composition.js.map

package/lib/workroom-runtime/workroom-data-governance-composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-composition.js","sourceRoot":"","sources":["../../src/workroom-runtime/workroom-data-governance-composition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,OAAO,EACL,kDAAkD,GACnD,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EACL,uCAAuC,EACvC,wCAAwC,GAMzC,MAAM,uCAAuC,CAAC;AAoB/C;;;GAGG;AACH,MAAM,UAAU,sCAAsC,CACpD,OAAsD;IAEtD,MAAM,OAAO,GAAG,uCAAuC,CAAC;QACtD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,CAAC,0BAA0B;YACpC,CAAC,CAAC,EAAE,0BAA0B,EAAE,OAAO,CAAC,0BAA0B,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,CAAC,2BAA2B;YACrC,CAAC,CAAC,EAAE,2BAA2B,EAAE,OAAO,CAAC,2BAA2B,EAAE;YACtE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,+BAA+B,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChG,eAAe,CACb,OAAO,CAAC,SAAS,EACjB,kDAAkD,EAClD,OAAO,CAAC,oBAAoB,CAC7B,CAAC;IACF,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,kCAAkC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjG,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,8BAA8B,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,eAAe,CACb,OAAO,CAAC,SAAS,EACjB,wCAAwC,EACxC,OAAO,CAAC,4BAA4B,CACrC,CAAC;IACF,eAAe,CACb,OAAO,CAAC,SAAS,EACjB,wCAAwC,EACxC,OAAO,CAAC,kBAAkB,CAC3B,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CACtB,SAAyC,EACzC,KAAiD,EACjD,KAAQ;IAER,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC"}

package/lib/workroom-runtime/workroom-data-governance-root-provider.d.ts

@@ -0,0 +1,51 @@
+import { type PluginId, type Scope } from '@zhin.js/plugin-runtime';
+import type { PayloadVaultCryptographyPort } from '../data-governance/encrypted-file-payload-vault.js';
+import type { DataGovernanceAuthorityVerificationPort } from '../data-governance/governance-authority-repository.js';
+import type { PayloadLifecycleCommandAuthorityPort, PayloadLifecycleKernelClockPort, PayloadLocationDeletionPort, PayloadPurgeReceiptAuthorityPort, PayloadSubjectErasureResolverPort } from '../data-governance/payload-lifecycle.js';
+import type { GovernedPayloadWritePurgePort } from '../data-governance/governed-payload-write-saga.js';
+import type { WorkroomDataLifecycleConsoleAuthorityPort } from './workroom-data-lifecycle-console.js';
+export interface WorkroomDataGovernanceRootProviderRequest {
+    readonly version: 1;
+    readonly generation: number;
+    readonly requester: PluginId;
+    readonly digest: string;
+}
+export interface WorkroomDataLifecycleRootAuthorities {
+    /** Authority-owned identity; never accepted from command bodies or Console metadata. */
+    readonly registrationPrincipalId: string;
+    readonly clock: PayloadLifecycleKernelClockPort;
+    readonly authority: PayloadLifecycleCommandAuthorityPort;
+    readonly subjects: PayloadSubjectErasureResolverPort;
+    readonly deletion: PayloadLocationDeletionPort;
+    readonly receipts: PayloadPurgeReceiptAuthorityPort;
+    readonly orphanPurge: GovernedPayloadWritePurgePort;
+    /** Optional authenticated human role authority; absence disables the Console lifecycle plane. */
+    readonly console?: WorkroomDataLifecycleConsoleAuthorityPort;
+}
+export interface WorkroomDataGovernanceRootProviderResolution {
+    readonly version: 1;
+    readonly generation: number;
+    readonly requestDigest: string;
+    readonly providerId: string;
+    readonly cryptography: PayloadVaultCryptographyPort;
+    readonly governance: DataGovernanceAuthorityVerificationPort;
+    readonly lifecycle?: WorkroomDataLifecycleRootAuthorities;
+}
+export interface WorkroomDataGovernanceRootProviderPort {
+    resolve(request: WorkroomDataGovernanceRootProviderRequest, signal: AbortSignal): Promise<WorkroomDataGovernanceRootProviderResolution | null>;
+}
+/** Root-only: child Plugin scopes and Runtime snapshots cannot observe this token. */
+export declare const workroomDataGovernanceRootProviderToken: import("@zhin.js/plugin-runtime").Token<WorkroomDataGovernanceRootProviderPort>;
+export declare function createWorkroomDataGovernanceRootProviderRequest(input: Readonly<{
+    generation: number;
+    requester: PluginId;
+}>): WorkroomDataGovernanceRootProviderRequest;
+export declare function resolveWorkroomDataGovernanceRootAuthorities(options: Readonly<{
+    resources: Pick<Scope, 'has' | 'use'>;
+    generation: number;
+    requester: PluginId;
+    signal: AbortSignal;
+    fallbackCryptography?: PayloadVaultCryptographyPort;
+    fallbackGovernance?: DataGovernanceAuthorityVerificationPort;
+}>): Promise<WorkroomDataGovernanceRootProviderResolution | undefined>;
+//# sourceMappingURL=workroom-data-governance-root-provider.d.ts.map

package/lib/workroom-runtime/workroom-data-governance-root-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-root-provider.d.ts","sourceRoot":"","sources":["../../src/workroom-runtime/workroom-data-governance-root-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,KAAK,EACX,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AACvG,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,uDAAuD,CAAC;AACrH,OAAO,KAAK,EACV,oCAAoC,EACpC,+BAA+B,EAC/B,2BAA2B,EAC3B,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,sCAAsC,CAAC;AAMtG,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oCAAoC;IACnD,wFAAwF;IACxF,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,oCAAoC,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,iCAAiC,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD,iGAAiG;IACjG,QAAQ,CAAC,OAAO,CAAC,EAAE,yCAAyC,CAAC;CAC9D;AAED,MAAM,WAAW,4CAA4C;IAC3D,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,uCAAuC,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,oCAAoC,CAAC;CAC3D;AAED,MAAM,WAAW,sCAAsC;IACrD,OAAO,CACL,OAAO,EAAE,yCAAyC,EAClD,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;CACjE;AAED,sFAAsF;AACtF,eAAO,MAAM,uCAAuC,iFAIjD,CAAC;AAEJ,wBAAgB,+CAA+C,CAAC,KAAK,EAAE,QAAQ,CAAC;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,CAAC;CACrB,CAAC,GAAG,yCAAyC,CAU7C;AAED,wBAAsB,4CAA4C,CAAC,OAAO,EAAE,QAAQ,CAAC;IACnF,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,oBAAoB,CAAC,EAAE,4BAA4B,CAAC;IACpD,kBAAkB,CAAC,EAAE,uCAAuC,CAAC;CAC9D,CAAC,GAAG,OAAO,CAAC,4CAA4C,GAAG,SAAS,CAAC,CA+CrE"}

package/lib/workroom-runtime/workroom-data-governance-root-provider.js

@@ -0,0 +1,66 @@
+import { createRootPrivateToken, } from '@zhin.js/plugin-runtime';
+import { deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue as digest, } from '../workroom/canonical-value.js';
+/** Root-only: child Plugin scopes and Runtime snapshots cannot observe this token. */
+export const workroomDataGovernanceRootProviderToken = createRootPrivateToken('zhin.agent.workroom-data-governance-root-provider', 'Generation-bound private KMS and governance authority provider');
+export function createWorkroomDataGovernanceRootProviderRequest(input) {
+    if (!Number.isSafeInteger(input.generation) || input.generation < 1) {
+        throw new Error('Workroom Data Governance Root provider generation is invalid');
+    }
+    const body = deepFreeze({
+        version: 1,
+        generation: input.generation,
+        requester: input.requester,
+    });
+    return deepFreeze({ ...body, digest: digest(body) });
+}
+export async function resolveWorkroomDataGovernanceRootAuthorities(options) {
+    options.signal.throwIfAborted();
+    const request = createWorkroomDataGovernanceRootProviderRequest(options);
+    if (!options.resources.has(workroomDataGovernanceRootProviderToken)) {
+        if (!options.fallbackCryptography || !options.fallbackGovernance)
+            return undefined;
+        return Object.freeze({
+            version: 1,
+            generation: options.generation,
+            requestDigest: request.digest,
+            providerId: 'trusted-root-option:fallback',
+            cryptography: options.fallbackCryptography,
+            governance: options.fallbackGovernance,
+        });
+    }
+    const resolved = await options.resources.use(workroomDataGovernanceRootProviderToken)
+        .resolve(request, options.signal);
+    options.signal.throwIfAborted();
+    if (!resolved)
+        return undefined;
+    if (resolved.version !== 1 || resolved.generation !== request.generation) {
+        throw new Error('Workroom Data Governance Root provider generation binding drift');
+    }
+    if (resolved.requestDigest !== request.digest) {
+        throw new Error('Workroom Data Governance Root provider request binding drift');
+    }
+    if (!resolved.providerId || resolved.providerId.trim() !== resolved.providerId
+        || typeof resolved.cryptography?.wrap !== 'function'
+        || typeof resolved.cryptography?.unwrap !== 'function'
+        || typeof resolved.governance?.verify !== 'function') {
+        throw new Error('Workroom Data Governance Root provider capability is invalid');
+    }
+    if (resolved.lifecycle && (!resolved.lifecycle.registrationPrincipalId
+        || resolved.lifecycle.registrationPrincipalId.trim() !== resolved.lifecycle.registrationPrincipalId
+        || typeof resolved.lifecycle.clock?.read !== 'function'
+        || typeof resolved.lifecycle.authority?.authorize !== 'function'
+        || typeof resolved.lifecycle.authority?.verify !== 'function'
+        || typeof resolved.lifecycle.subjects?.resolve !== 'function'
+        || typeof resolved.lifecycle.deletion?.purge !== 'function'
+        || typeof resolved.lifecycle.receipts?.verify !== 'function'
+        || typeof resolved.lifecycle.orphanPurge?.purge !== 'function'
+        || typeof resolved.lifecycle.orphanPurge?.reconcile !== 'function'
+        || resolved.lifecycle.console !== undefined
+            && (typeof resolved.lifecycle.console.authorize !== 'function'
+                || resolved.lifecycle.console.persistSubjectExportAudit !== undefined
+                    && typeof resolved.lifecycle.console.persistSubjectExportAudit !== 'function'))) {
+        throw new Error('Workroom Data Governance Root lifecycle capability is invalid');
+    }
+    return Object.freeze(resolved);
+}
+//# sourceMappingURL=workroom-data-governance-root-provider.js.map

package/lib/workroom-runtime/workroom-data-governance-root-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-data-governance-root-provider.js","sourceRoot":"","sources":["../../src/workroom-runtime/workroom-data-governance-root-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,GAGvB,MAAM,yBAAyB,CAAC;AAYjC,OAAO,EACL,uBAAuB,IAAI,UAAU,EACrC,4BAA4B,IAAI,MAAM,GACvC,MAAM,gCAAgC,CAAC;AAuCxC,sFAAsF;AACtF,MAAM,CAAC,MAAM,uCAAuC,GAClD,sBAAsB,CACpB,mDAAmD,EACnD,gEAAgE,CACjE,CAAC;AAEJ,MAAM,UAAU,+CAA+C,CAAC,KAG9D;IACA,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,OAAO,EAAE,CAAU;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,OAOjE;IACA,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,+CAA+C,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,uCAAuC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,kBAAkB;YAAE,OAAO,SAAS,CAAC;QACnF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,UAAU,EAAE,8BAA8B;YAC1C,YAAY,EAAE,OAAO,CAAC,oBAAoB;YAC1C,UAAU,EAAE,OAAO,CAAC,kBAAkB;SACvC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,uCAAuC,CAAC;SAClF,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,UAAU;WACzE,OAAO,QAAQ,CAAC,YAAY,EAAE,IAAI,KAAK,UAAU;WACjD,OAAO,QAAQ,CAAC,YAAY,EAAE,MAAM,KAAK,UAAU;WACnD,OAAO,QAAQ,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,uBAAuB;WACjE,QAAQ,CAAC,SAAS,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,SAAS,CAAC,uBAAuB;WAChG,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU;WACpD,OAAO,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,KAAK,UAAU;WAC7D,OAAO,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,KAAK,UAAU;WAC1D,OAAO,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,KAAK,UAAU;WAC1D,OAAO,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,KAAK,UAAU;WACxD,OAAO,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU;WACzD,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,UAAU;WAC3D,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,KAAK,UAAU;WAC/D,QAAQ,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS;eACtC,CAAC,OAAO,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,KAAK,UAAU;mBACzD,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,yBAAyB,KAAK,SAAS;uBAChE,OAAO,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,yBAAyB,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC"}