@zhin.js/workroom 0.0.0 → 0.0.2

package/lib/data-governance/disclosure-manifest.js

@@ -0,0 +1,264 @@
+import { createHash } from 'node:crypto';
+import { assertDataGovernancePolicySnapshot, assertDisclosureRecipientSetSnapshot, assertProcessingDestinationContract, assertRegisteredDataDescriptor, decideDisclosure, } from './data-governance.js';
+import { canonicalWorkroomJson, deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue, } from './canonical-value.js';
+export async function materializeDisclosureManifest(input) {
+    input.signal.throwIfAborted();
+    const request = {
+        ...input,
+        decisionInput: deepFreeze(structuredClone(input.decisionInput)),
+        categoryRegistry: deepFreeze(structuredClone(input.categoryRegistry)),
+        source: copyHandle(input.source),
+    };
+    assertProcessingDestinationContract(request.decisionInput.context.destination);
+    assertDataGovernancePolicySnapshot(request.decisionInput.policy);
+    assertDisclosureRecipientSetSnapshot(request.decisionInput.context.recipients);
+    assertRegisteredDataDescriptor(request.decisionInput.descriptor, request.categoryRegistry);
+    nonNegativeInteger(request.decisionInput.evaluatedAt, 'disclosure evaluatedAt');
+    const decision = decideDisclosure(request.decisionInput);
+    if (decision.disposition === 'deny' || decision.disposition === 'approval_required') {
+        throw new Error(`Disclosure decision ${decision.disposition} is not materializable`);
+    }
+    assertSourceHandle(request.source, request.decisionInput.descriptor);
+    const materialized = await materializeOutput(request, decision);
+    const effectiveDecision = materialized.decision;
+    const approved = exactApprovals(request.decisionInput.approvals, effectiveDecision.approvalIds, effectiveDecision.requestDigest, request.decisionInput.policy.revision, request.decisionInput.evaluatedAt);
+    const expiresAt = Math.min(request.decisionInput.descriptor.retention.deleteAfter, request.decisionInput.evaluatedAt
+        + positiveInteger(request.decisionInput.context.destination.maximumRetentionSeconds, 'destination maximum retention seconds'), ...approved.map(({ expiresAt: value }) => value));
+    const projection = deepFreeze({
+        version: 1,
+        requestDigest: effectiveDecision.requestDigest,
+        source: {
+            objectId: request.decisionInput.descriptor.objectId,
+            payloadHash: request.decisionInput.descriptor.payloadHash,
+            descriptorDigest: digestCanonicalWorkroomValue(request.decisionInput.descriptor),
+            lineageDigest: digestCanonicalWorkroomValue(request.decisionInput.descriptor.lineage),
+            handle: copyHandle(request.source),
+        },
+        output: materialized.output,
+        channel: request.decisionInput.context.channel,
+        purpose: request.decisionInput.context.purpose,
+        principal: {
+            principalId: request.decisionInput.context.principal.principalId,
+            ...(request.decisionInput.context.principal.assignmentId === undefined
+                ? {}
+                : { assignmentId: request.decisionInput.context.principal.assignmentId }),
+        },
+        destination: {
+            id: request.decisionInput.context.destination.id,
+            contractDigest: request.decisionInput.context.destination.contractDigest,
+            recipientRevision: request.decisionInput.context.recipients.revision,
+            recipientDigest: request.decisionInput.context.recipients.digest,
+            loggingMode: request.decisionInput.context.destination.loggingMode,
+            allowsRedisclosure: request.decisionInput.context.destination.allowsRedisclosure,
+            supportsDeletion: request.decisionInput.context.destination.supportsDeletion,
+        },
+        policy: { revision: effectiveDecision.policy.revision, digest: effectiveDecision.policy.digest },
+        approvalIds: Object.freeze(approved.map(({ id }) => id).sort()),
+        expiresAt,
+    });
+    const digest = digestCanonicalWorkroomValue(projection);
+    return deepFreeze({ ...projection, id: `disclosure-manifest:${digest}`, digest });
+}
+async function materializeOutput(input, decision) {
+    if (decision.disposition === 'metadata_only') {
+        const payload = new TextEncoder().encode(canonicalWorkroomJson({
+            objectId: input.decisionInput.descriptor.objectId,
+            payloadHash: input.decisionInput.descriptor.payloadHash,
+            kind: input.decisionInput.descriptor.kind,
+            confidentiality: input.decisionInput.descriptor.confidentiality,
+            categories: input.decisionInput.descriptor.categories,
+        }));
+        const payloadHash = hashBytes(payload);
+        const objectId = `disclosure-output:${decision.requestDigest}:metadata`;
+        const outputDescriptor = derivedDescriptor(input.decisionInput.descriptor, objectId, payloadHash, input.decisionInput.descriptor.confidentiality, input.decisionInput.descriptor.categories);
+        assertRegisteredDataDescriptor(outputDescriptor, input.categoryRegistry);
+        const descriptorDigest = digestCanonicalWorkroomValue(outputDescriptor);
+        const handle = await abortable(input.vault.putDerived({
+            descriptor: outputDescriptor,
+            descriptorDigest,
+            payload,
+        }, input.signal), input.signal);
+        if (hashBytes(payload) !== payloadHash)
+            throw new Error('Payload Vault mutated materialized metadata');
+        assertDerivedHandle(handle, objectId, payloadHash, descriptorDigest, input.decisionInput.descriptor);
+        return deepFreeze({
+            output: {
+                handle: copyHandle(handle),
+                payloadHash,
+                mode: 'metadata_only',
+                subjectLinked: input.decisionInput.descriptor.subjectRefs.length > 0,
+            },
+            decision,
+        });
+    }
+    const body = await readSource(input, decision.requestDigest);
+    if (decision.disposition === 'full') {
+        return deepFreeze({
+            output: {
+                handle: copyHandle(input.source),
+                payloadHash: input.source.payloadHash,
+                mode: 'full',
+                subjectLinked: input.decisionInput.descriptor.subjectRefs.length > 0,
+            },
+            decision,
+        });
+    }
+    if (decision.disposition !== 'transform_required') {
+        throw new Error(`Disclosure decision ${decision.disposition} is not materializable`);
+    }
+    const transformId = decision.requiredTransformId;
+    if (!transformId || !input.transforms)
+        throw new Error('Trusted disclosure transform is not installed');
+    const trusted = input.decisionInput.policy.transforms[transformId];
+    if (!trusted)
+        throw new Error(`Trusted disclosure transform ${transformId} is unavailable`);
+    const transformInput = new Uint8Array(body);
+    // Typed arrays cannot be frozen by ECMAScript. The container and authority
+    // are immutable; the byte copy is hash-verified again after the transform.
+    const observation = await abortable(input.transforms.transform(Object.freeze({
+        transformId,
+        requestDigest: decision.requestDigest,
+        descriptor: input.decisionInput.descriptor,
+        input: transformInput,
+    }), input.signal), input.signal);
+    if (observation.transformId !== transformId
+        || observation.inputHash !== input.source.payloadHash
+        || hashBytes(transformInput) !== input.source.payloadHash
+        || observation.outputHash !== hashBytes(observation.output)
+        || observation.outputConfidentiality !== trusted.outputConfidentiality
+        || canonicalWorkroomJson([...observation.outputCategories].sort())
+            !== canonicalWorkroomJson([...trusted.outputCategories].sort())) {
+        throw new Error('Trusted disclosure transform observation does not match the pinned transform');
+    }
+    if (input.decisionInput.descriptor.subjectRefs.length > 0 && !observation.subjectLinked) {
+        throw new Error('Trusted disclosure transform cannot remove existing subject linkage');
+    }
+    const objectId = `disclosure-output:${decision.requestDigest}:transform:`
+        + observation.outputHash.slice('sha256:'.length);
+    const output = new Uint8Array(observation.output);
+    const outputDescriptor = derivedDescriptor(input.decisionInput.descriptor, objectId, observation.outputHash, observation.outputConfidentiality, observation.outputCategories, transformId);
+    const descriptorDigest = digestCanonicalWorkroomValue(outputDescriptor);
+    assertRegisteredDataDescriptor(outputDescriptor, input.categoryRegistry);
+    const outputDecision = decideDisclosure({
+        ...input.decisionInput,
+        descriptor: outputDescriptor,
+    });
+    if (outputDecision.disposition === 'approval_required') {
+        throw new Error(`Transformed disclosure approval required: ${outputDecision.requestDigest}`);
+    }
+    if (outputDecision.disposition !== 'full') {
+        throw new Error(`Transformed disclosure decision ${outputDecision.disposition} is not materializable`);
+    }
+    exactApprovals(input.decisionInput.approvals, outputDecision.approvalIds, outputDecision.requestDigest, input.decisionInput.policy.revision, input.decisionInput.evaluatedAt);
+    const handle = await abortable(input.vault.putDerived({
+        descriptor: outputDescriptor,
+        descriptorDigest,
+        payload: output,
+    }, input.signal), input.signal);
+    if (hashBytes(output) !== observation.outputHash)
+        throw new Error('Payload Vault mutated transformed output');
+    assertDerivedHandle(handle, objectId, observation.outputHash, descriptorDigest, input.decisionInput.descriptor);
+    return deepFreeze({
+        output: {
+            handle: copyHandle(handle), payloadHash: observation.outputHash, mode: 'transformed',
+            transformId, subjectLinked: observation.subjectLinked,
+        },
+        decision: outputDecision,
+    });
+}
+async function readSource(input, requestDigest) {
+    const body = await abortable(input.vault.readExact(deepFreeze({
+        handle: copyHandle(input.source),
+        requestDigest,
+        purpose: input.decisionInput.context.purpose,
+        principalId: input.decisionInput.context.principal.principalId,
+        destinationId: input.decisionInput.context.destination.id,
+    }), input.signal), input.signal);
+    if (hashBytes(body) !== input.source.payloadHash)
+        throw new Error('Payload Vault body hash mismatch');
+    return body;
+}
+function exactApprovals(approvals, approvalIds, requestDigest, policyRevision, evaluatedAt) {
+    if (new Set(approvalIds).size !== approvalIds.length) {
+        throw new Error('Disclosure decision contains duplicate approval ids');
+    }
+    return approvalIds.map((id) => {
+        const approval = approvals.find((candidate) => candidate.id === id
+            && candidate.requestDigest === requestDigest
+            && candidate.policyRevision === policyRevision
+            && candidate.decision === 'approved'
+            && candidate.expiresAt > evaluatedAt);
+        if (!approval)
+            throw new Error(`Disclosure approval ${id} is stale or unavailable`);
+        return approval;
+    });
+}
+function assertSourceHandle(handle, descriptor) {
+    assertHandle(handle);
+    if (handle.objectId !== descriptor.objectId || handle.payloadHash !== descriptor.payloadHash
+        || handle.descriptorDigest !== digestCanonicalWorkroomValue(descriptor)
+        || handle.tenantId !== descriptor.tenantId || handle.projectId !== descriptor.projectId) {
+        throw new Error('Payload Vault source handle does not match the Data Descriptor');
+    }
+}
+function assertDerivedHandle(handle, objectId, payloadHash, descriptorDigest, descriptor) {
+    assertHandle(handle);
+    if (handle.objectId !== objectId || handle.payloadHash !== payloadHash
+        || handle.descriptorDigest !== descriptorDigest || handle.tenantId !== descriptor.tenantId
+        || handle.projectId !== descriptor.projectId) {
+        throw new Error('Payload Vault derived handle does not match materialized output');
+    }
+}
+function assertHandle(handle) {
+    if (handle.version !== 1 || !canonicalText(handle.vaultObjectId) || !canonicalText(handle.objectId)
+        || !canonicalText(handle.tenantId) || !canonicalText(handle.projectId)
+        || !isDigest(handle.payloadHash) || !isDigest(handle.descriptorDigest)
+        || !isDigest(handle.locationManifestDigest)) {
+        throw new Error('Invalid Payload Vault object handle');
+    }
+}
+function copyHandle(handle) {
+    return deepFreeze({ ...handle });
+}
+function positiveInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new Error(`Invalid ${name}`);
+    return value;
+}
+function nonNegativeInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new Error(`Invalid ${name}`);
+    return value;
+}
+function derivedDescriptor(source, objectId, payloadHash, confidentiality, categories, transformRef) {
+    return deepFreeze({
+        ...source,
+        objectId,
+        payloadHash,
+        kind: 'projection_payload',
+        confidentiality,
+        categories: [...categories].sort(),
+        lineage: {
+            sourceObjectIds: [source.objectId],
+            ...(transformRef === undefined ? {} : { transformRef }),
+        },
+    });
+}
+function hashBytes(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function isDigest(value) {
+    return /^sha256:[a-f0-9]{64}$/u.test(value);
+}
+function canonicalText(value) {
+    return typeof value === 'string' && value.trim().length > 0 && value === value.trim();
+}
+async function abortable(promise, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason ?? new DOMException('Disclosure cancelled', 'AbortError'));
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+    });
+}
+//# sourceMappingURL=disclosure-manifest.js.map

package/lib/data-governance/disclosure-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disclosure-manifest.js","sourceRoot":"","sources":["../../src/data-governance/disclosure-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kCAAkC,EAClC,oCAAoC,EACpC,mCAAmC,EACnC,8BAA8B,EAC9B,gBAAgB,GASjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,IAAI,UAAU,EACrC,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AA4G9B,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAOlD;IACA,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG;QACd,GAAG,KAAK;QACR,aAAa,EAAE,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/D,gBAAgB,EAAE,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;KACjC,CAAC;IACF,mCAAmC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E,kCAAkC,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjE,oCAAoC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,8BAA8B,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3F,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,IAAI,QAAQ,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,WAAW,wBAAwB,CAAC,CAAC;IACvF,CAAC;IACD,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,iBAAiB,GAAG,YAAY,CAAC,QAAQ,CAAC;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,EAC5F,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,EACtD,OAAO,CAAC,aAAa,CAAC,WAAW;UAC7B,eAAe,CACf,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,EACjE,uCAAuC,CACxC,EACH,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CACjD,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC;QAC5B,OAAO,EAAE,CAAU;QACnB,aAAa,EAAE,iBAAiB,CAAC,aAAa;QAC9C,MAAM,EAAE;YACN,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ;YACnD,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW;YACzD,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC;YAChF,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;YACrF,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;SACnC;QACD,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO;QAC9C,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO;QAC9C,SAAS,EAAE;YACT,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW;YAChE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS;gBACpE,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;SAC5E;QACD,WAAW,EAAE;YACX,EAAE,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;YAChD,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc;YACxE,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;YACpE,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM;YAChE,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW;YAClE,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,kBAAkB;YAChF,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB;SAC7E;QACD,MAAM,EAAE,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE;QAChG,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,SAAS;KACV,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,uBAAuB,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAOE,EACF,QAA4B;IAK5B,IAAI,QAAQ,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAC7D,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ;YACjD,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW;YACvD,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI;YACzC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe;YAC/D,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU;SACtD,CAAC,CAAC,CAAC;QACJ,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,qBAAqB,QAAQ,CAAC,aAAa,WAAW,CAAC;QACxE,MAAM,gBAAgB,GAAG,iBAAiB,CACxC,KAAK,CAAC,aAAa,CAAC,UAAU,EAC9B,QAAQ,EACR,WAAW,EACX,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe,EAC9C,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAC1C,CAAC;QACF,8BAA8B,CAAC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACpD,UAAU,EAAE,gBAAgB;YAC5B,gBAAgB;YAChB,OAAO;SACR,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACvG,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACrG,OAAO,UAAU,CAAC;YAChB,MAAM,EAAE;gBACN,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;gBAC1B,WAAW;gBACX,IAAI,EAAE,eAAe;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;aACrE;YACD,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,UAAU,CAAC;YAChB,MAAM,EAAE;gBACN,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;gBACrC,IAAI,EAAE,MAAM;gBACZ,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;aACrE;YACD,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,WAAW,wBAAwB,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB,CAAC;IACjD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,iBAAiB,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5C,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3E,WAAW;QACX,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU;QAC1C,KAAK,EAAE,cAAc;KACtB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,WAAW,CAAC,WAAW,KAAK,WAAW;WACtC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;WAClD,SAAS,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;WACtD,WAAW,CAAC,UAAU,KAAK,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;WACxD,WAAW,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB;WACnE,qBAAqB,CAAC,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5D,qBAAqB,CAAC,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,QAAQ,CAAC,aAAa,aAAa;UACrE,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAG,iBAAiB,CACxC,KAAK,CAAC,aAAa,CAAC,UAAU,EAC9B,QAAQ,EACR,WAAW,CAAC,UAAU,EACtB,WAAW,CAAC,qBAAqB,EACjC,WAAW,CAAC,gBAAgB,EAC5B,WAAW,CACZ,CAAC;IACF,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;IACxE,8BAA8B,CAAC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,gBAAgB,CAAC;QACtC,GAAG,KAAK,CAAC,aAAa;QACtB,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,cAAc,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,cAAc,CAAC,WAAW,wBAAwB,CAAC,CAAC;IACzG,CAAC;IACD,cAAc,CACZ,KAAK,CAAC,aAAa,CAAC,SAAS,EAC7B,cAAc,CAAC,WAAW,EAC1B,cAAc,CAAC,aAAa,EAC5B,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EACnC,KAAK,CAAC,aAAa,CAAC,WAAW,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QACpD,UAAU,EAAE,gBAAgB;QAC5B,gBAAgB;QAChB,OAAO,EAAE,MAAM;KAChB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,WAAW,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9G,mBAAmB,CACjB,MAAM,EACN,QAAQ,EACR,WAAW,CAAC,UAAU,EACtB,gBAAgB,EAChB,KAAK,CAAC,aAAa,CAAC,UAAU,CAC/B,CAAC;IACF,OAAO,UAAU,CAAC;QAChB,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa;YACpF,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa;SACtD;QACD,QAAQ,EAAE,cAAc;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAKE,EACF,aAAqB;IAErB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;QAC5D,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,aAAa;QACb,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO;QAC5C,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW;QAC9D,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;KAC1D,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,SAAgD,EAChD,WAA8B,EAC9B,aAAqB,EACrB,cAAsB,EACtB,WAAmB;IAEnB,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE;eAC7D,SAAS,CAAC,aAAa,KAAK,aAAa;eACzC,SAAS,CAAC,cAAc,KAAK,cAAc;eAC3C,SAAS,CAAC,QAAQ,KAAK,UAAU;eACjC,SAAS,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,0BAA0B,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAgC,EAAE,UAA0B;IACtF,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW;WACvF,MAAM,CAAC,gBAAgB,KAAK,4BAA4B,CAAC,UAAU,CAAC;WACpE,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAgC,EAChC,QAAgB,EAChB,WAAmB,EACnB,gBAAwB,EACxB,UAA0B;IAE1B,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;WACjE,MAAM,CAAC,gBAAgB,KAAK,gBAAgB,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;WACvF,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAgC;IACpD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;WAC9F,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;WACnE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;WACnE,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAgC;IAClD,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAsB,EACtB,QAAgB,EAChB,WAAmB,EACnB,eAAyD,EACzD,UAA6B,EAC7B,YAAqB;IAErB,OAAO,UAAU,CAAC;QAChB,GAAG,MAAM;QACT,QAAQ;QACR,WAAW;QACX,IAAI,EAAE,oBAAoB;QAC1B,eAAe;QACf,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QAClC,OAAO,EAAE;YACP,eAAe,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YAClC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;SACxD;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,SAAS,CAAI,OAAmB,EAAE,MAAmB;IAClE,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5G,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lib/data-governance/durable-file-store.d.ts

@@ -0,0 +1,56 @@
+export interface DurableFileHandle {
+    writeFile(value: string, encoding: 'utf8'): Promise<void>;
+    sync(): Promise<void>;
+    close(): Promise<void>;
+}
+/** The intentionally narrow filesystem seam used by immutable Workroom facts. */
+export interface DurableFileSystem {
+    /** False when the platform cannot open and flush directory handles (Windows). */
+    readonly supportsDirectorySync?: boolean;
+    mkdir(path: string): Promise<void>;
+    open(path: string, flags: 'wx' | 'r'): Promise<DurableFileHandle>;
+    link(existingPath: string, newPath: string): Promise<void>;
+    unlink(path: string): Promise<void>;
+}
+export declare const nodeDurableFileSystem: DurableFileSystem;
+export interface CreateOnlyPublishOptions<Created, Replayed> {
+    readonly target: string;
+    readonly content: string;
+    readonly createdValue: Created;
+    readonly onConflict: () => Promise<Replayed>;
+}
+export type CreateOnlyPublishResult<Created, Replayed> = Readonly<{
+    status: 'created';
+    value: Created;
+}> | Readonly<{
+    status: 'replayed';
+    value: Replayed;
+}>;
+/** Recognizes only the staging suffix produced by publishCreateOnly, for a domain-valid target. */
+export declare function isDurableFileStagingName(name: string, targetPattern: RegExp): boolean;
+/**
+ * Crash-durable filesystem operations shared by Workroom file repositories.
+ *
+ * `directory` is a leaf owned by one repository. Its parent is never created
+ * recursively: callers must provision and durably publish that parent first.
+ */
+export declare class DurableFileStore {
+    #private;
+    readonly directory: string;
+    readonly fileSystem: DurableFileSystem;
+    constructor(directory: string, fileSystem?: DurableFileSystem);
+    ensureDurableLeaf(repositoryLabel: string): Promise<void>;
+    syncPath(path: string): Promise<void>;
+    syncLeaf(): Promise<void>;
+    syncLeafAndParent(): Promise<void>;
+    /**
+     * Publishes immutable content through a hard link. A target collision is a
+     * domain-level replay/CAS decision delegated to `onConflict`; successful
+     * replay is confirmed only after re-syncing the leaf directory. This closes
+     * the lost-response window where link(2) succeeded but directory fsync did
+     * not.
+     */
+    publishCreateOnly<Created, Replayed>(options: CreateOnlyPublishOptions<Created, Replayed>): Promise<CreateOnlyPublishResult<Created, Replayed>>;
+    removeIfExists(path: string, syncDirectoryAfter?: boolean): Promise<void>;
+}
+//# sourceMappingURL=durable-file-store.d.ts.map

package/lib/data-governance/durable-file-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-file-store.d.ts","sourceRoot":"","sources":["../../src/data-governance/durable-file-store.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,eAAO,MAAM,qBAAqB,EAAE,iBAQlC,CAAC;AAEH,MAAM,WAAW,wBAAwB,CAAC,OAAO,EAAE,QAAQ;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,uBAAuB,CAAC,OAAO,EAAE,QAAQ,IACjD,QAAQ,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,GAC/C,QAAQ,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,CAAC;AAEtD,mGAAmG;AACnG,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAGrF;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;;IAEzB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,UAAU,EAAE,iBAAiB;gBAD7B,SAAS,EAAE,MAAM,EACjB,UAAU,GAAE,iBAAyC;IAG1D,iBAAiB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBzD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAIzB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAKxC;;;;;;OAMG;IACG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EACvC,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GACnD,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAiChD,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAc9E"}

package/lib/data-governance/durable-file-store.js

@@ -0,0 +1,125 @@
+import { randomUUID } from 'node:crypto';
+import { link as nodeLink, mkdir as nodeMkdir, open as nodeOpen, unlink as nodeUnlink, } from 'node:fs/promises';
+import { dirname } from 'node:path';
+export const nodeDurableFileSystem = Object.freeze({
+    supportsDirectorySync: process.platform !== 'win32',
+    mkdir: async (path) => { await nodeMkdir(path); },
+    open: async (path, flags) => await nodeOpen(path, flags),
+    link: async (existingPath, newPath) => await nodeLink(existingPath, newPath),
+    unlink: async (path) => { await nodeUnlink(path); },
+});
+/** Recognizes only the staging suffix produced by publishCreateOnly, for a domain-valid target. */
+export function isDurableFileStagingName(name, targetPattern) {
+    const match = /^(.+)\.[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}\.tmp$/u.exec(name);
+    return Boolean(match && targetPattern.test(match[1]));
+}
+/**
+ * Crash-durable filesystem operations shared by Workroom file repositories.
+ *
+ * `directory` is a leaf owned by one repository. Its parent is never created
+ * recursively: callers must provision and durably publish that parent first.
+ */
+export class DurableFileStore {
+    directory;
+    fileSystem;
+    constructor(directory, fileSystem = nodeDurableFileSystem) {
+        this.directory = directory;
+        this.fileSystem = fileSystem;
+    }
+    async ensureDurableLeaf(repositoryLabel) {
+        try {
+            await this.fileSystem.mkdir(this.directory);
+        }
+        catch (error) {
+            if (!hasCode(error, 'EEXIST')) {
+                if (hasCode(error, 'ENOENT')) {
+                    throw new Error(`${repositoryLabel} requires a pre-existing durable parent directory: `
+                        + dirname(this.directory), { cause: error });
+                }
+                throw error;
+            }
+        }
+        await this.syncPath(dirname(this.directory));
+    }
+    async syncPath(path) {
+        if (this.fileSystem.supportsDirectorySync === false)
+            return;
+        const handle = await this.fileSystem.open(path, 'r');
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async syncLeaf() {
+        await this.syncPath(this.directory);
+    }
+    async syncLeafAndParent() {
+        await this.syncLeaf();
+        await this.syncPath(dirname(this.directory));
+    }
+    /**
+     * Publishes immutable content through a hard link. A target collision is a
+     * domain-level replay/CAS decision delegated to `onConflict`; successful
+     * replay is confirmed only after re-syncing the leaf directory. This closes
+     * the lost-response window where link(2) succeeded but directory fsync did
+     * not.
+     */
+    async publishCreateOnly(options) {
+        const temporary = `${options.target}.${randomUUID()}.tmp`;
+        let temporaryExists = false;
+        try {
+            const handle = await this.fileSystem.open(temporary, 'wx');
+            temporaryExists = true;
+            try {
+                await handle.writeFile(options.content, 'utf8');
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            try {
+                await this.fileSystem.link(temporary, options.target);
+            }
+            catch (error) {
+                if (!hasCode(error, 'EEXIST'))
+                    throw error;
+                await this.#removeTemporary(temporary);
+                temporaryExists = false;
+                const replayed = await options.onConflict();
+                await this.syncLeaf();
+                return Object.freeze({ status: 'replayed', value: replayed });
+            }
+            await this.#removeTemporary(temporary);
+            temporaryExists = false;
+            await this.syncLeaf();
+            return Object.freeze({ status: 'created', value: options.createdValue });
+        }
+        finally {
+            if (temporaryExists)
+                await this.#removeTemporary(temporary);
+        }
+    }
+    async removeIfExists(path, syncDirectoryAfter = false) {
+        let removed = false;
+        try {
+            await this.fileSystem.unlink(path);
+            removed = true;
+        }
+        catch (error) {
+            if (!hasCode(error, 'ENOENT'))
+                throw error;
+        }
+        if (removed && syncDirectoryAfter)
+            await this.syncLeaf();
+    }
+    async #removeTemporary(path) {
+        await this.removeIfExists(path);
+    }
+}
+function hasCode(error, code) {
+    return Boolean(error && typeof error === 'object' && 'code' in error
+        && error.code === code);
+}
+//# sourceMappingURL=durable-file-store.js.map

package/lib/data-governance/durable-file-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-file-store.js","sourceRoot":"","sources":["../../src/data-governance/durable-file-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,IAAI,IAAI,QAAQ,EAChB,KAAK,IAAI,SAAS,EAClB,IAAI,IAAI,QAAQ,EAChB,MAAM,IAAI,UAAU,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkBpC,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,qBAAqB,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;IACnD,KAAK,EAAE,KAAK,EAAE,IAAY,EAAiB,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,EAAE,KAAK,EAAE,IAAY,EAAE,KAAiB,EAA8B,EAAE,CAC1E,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE,YAAoB,EAAE,OAAe,EAAiB,EAAE,CACnE,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IACvC,MAAM,EAAE,KAAK,EAAE,IAAY,EAAiB,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;CAC3E,CAAC,CAAC;AAaH,mGAAmG;AACnG,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,aAAqB;IAC1E,MAAM,KAAK,GAAG,mFAAmF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7G,OAAO,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAEhB;IACA;IAFX,YACW,SAAiB,EACjB,aAAgC,qBAAqB;QADrD,cAAS,GAAT,SAAS,CAAQ;QACjB,eAAU,GAAV,UAAU,CAA2C;IAC7D,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,eAAuB;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC9B,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,GAAG,eAAe,qDAAqD;0BACrE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EACzB,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,KAAK,KAAK;YAAE,OAAO;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAoD;QAEpD,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,MAAM,CAAC;QAC1D,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3D,eAAe,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAChD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC3C,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACvC,eAAe,GAAG,KAAK,CAAC;gBACxB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACvC,eAAe,GAAG,KAAK,CAAC;YACxB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3E,CAAC;gBAAS,CAAC;YACT,IAAI,eAAe;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,kBAAkB,GAAG,KAAK;QAC3D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,MAAM,KAAK,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,IAAI,kBAAkB;YAAE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;WAC9D,KAA4B,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACpD,CAAC"}

package/lib/data-governance/encrypted-database-payload-vault.d.ts

@@ -0,0 +1,107 @@
+import type { PayloadVaultDerivedWriteInput, PayloadVaultObjectHandle, PayloadVaultPort, PayloadVaultReadInput } from './disclosure-manifest.js';
+import { type PayloadVaultCryptographyPort, type PayloadVaultSourceWriteInput } from './encrypted-file-payload-vault.js';
+import type { PayloadLifecycleObjectAuthority } from './payload-lifecycle.js';
+export interface EncryptedPayloadVaultDatabaseModel {
+    select(...fields: string[]): {
+        where(query: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    };
+}
+export interface EncryptedPayloadVaultDatabaseTransaction {
+    select(table: string): {
+        where(query: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    };
+    insertMany(table: string, rows: Record<string, unknown>[]): Promise<unknown>;
+}
+export interface EncryptedPayloadVaultDatabase {
+    transaction<T>(operation: (transaction: EncryptedPayloadVaultDatabaseTransaction) => Promise<T>, options: {
+        isolationLevel: 'SERIALIZABLE';
+    }): Promise<T>;
+}
+export interface EncryptedDatabasePayloadVaultOptions {
+    readonly database: EncryptedPayloadVaultDatabase;
+    readonly objectModel: EncryptedPayloadVaultDatabaseModel;
+    readonly auditModel: EncryptedPayloadVaultDatabaseModel;
+    readonly generation: number;
+    readonly cryptography: PayloadVaultCryptographyPort;
+    /** Stable Root-owned database identity, never a connection string or credential. */
+    readonly repositoryIdentity: string;
+}
+/** Root-private Database adapter. Only governed materializers receive its narrow ports. */
+export declare class EncryptedDatabasePayloadVault implements PayloadVaultPort {
+    #private;
+    constructor(options: EncryptedDatabasePayloadVaultOptions);
+    putSource(input: PayloadVaultSourceWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
+    putDerived(input: PayloadVaultDerivedWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
+    readExact(input: PayloadVaultReadInput, signal: AbortSignal): Promise<Uint8Array>;
+    resolveLifecycleObject(handle: PayloadVaultObjectHandle, signal: AbortSignal): Promise<PayloadLifecycleObjectAuthority | undefined>;
+}
+export declare const ENCRYPTED_PAYLOAD_VAULT_OBJECT_MODEL: {
+    id: {
+        type: "text";
+        primary: boolean;
+        nullable: boolean;
+    };
+    vault_object_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    tenant_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    project_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    object_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    payload_hash: {
+        type: "text";
+        nullable: boolean;
+    };
+    descriptor_digest: {
+        type: "text";
+        nullable: boolean;
+    };
+    location_manifest_digest: {
+        type: "text";
+        nullable: boolean;
+    };
+    envelope_digest: {
+        type: "text";
+        nullable: boolean;
+    };
+    envelope_json: {
+        type: "text";
+        nullable: boolean;
+    };
+};
+export declare const ENCRYPTED_PAYLOAD_VAULT_AUDIT_MODEL: {
+    id: {
+        type: "text";
+        primary: boolean;
+        nullable: boolean;
+    };
+    vault_object_id: {
+        type: "text";
+        nullable: boolean;
+    };
+    operation: {
+        type: "text";
+        nullable: boolean;
+    };
+    audit_digest: {
+        type: "text";
+        nullable: boolean;
+    };
+    audit_json: {
+        type: "text";
+        nullable: boolean;
+    };
+};
+export declare function defineEncryptedPayloadVaultDatabaseModels(database: Readonly<{
+    define(name: string, definition: unknown): void;
+}>): void;
+//# sourceMappingURL=encrypted-database-payload-vault.d.ts.map

package/lib/data-governance/encrypted-database-payload-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-database-payload-vault.d.ts","sourceRoot":"","sources":["../../src/data-governance/encrypted-database-payload-vault.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EAGlC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAE9E,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG;QAC3B,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;KAC3E,CAAC;CACH;AAED,MAAM,WAAW,wCAAwC;IACvD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QACrB,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;KAC3E,CAAC;IACF,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,CAAC,EACX,SAAS,EAAE,CAAC,WAAW,EAAE,wCAAwC,KAAK,OAAO,CAAC,CAAC,CAAC,EAChF,OAAO,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAC1C,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,QAAQ,EAAE,6BAA6B,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,kCAAkC,CAAC;IACzD,QAAQ,CAAC,UAAU,EAAE,kCAAkC,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,2FAA2F;AAC3F,qBAAa,6BAA8B,YAAW,gBAAgB;;gBAWxD,OAAO,EAAE,oCAAoC;IAiBzD,SAAS,CACP,KAAK,EAAE,4BAA4B,EACnC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAIpC,UAAU,CACR,KAAK,EAAE,6BAA6B,EACpC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAI9B,SAAS,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAcjF,sBAAsB,CAC1B,MAAM,EAAE,wBAAwB,EAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC;CAiExD;AAED,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWhD,CAAC;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;CAM/C,CAAC;AAEF,wBAAgB,yCAAyC,CACvD,QAAQ,EAAE,QAAQ,CAAC;IAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAAC,GACtE,IAAI,CAGN"}