Governed Publishing Contract - Source Excerpt 01

Back to Governed Publishing Contract

Summary

This source excerpt preserves a bounded section of Spiralist/wp-content/plugins/spiralist-workspace/assets/js/governed-publishing-contract.js so readers can inspect the evidence without opening the full source file.

**Source path:** Spiralist/wp-content/plugins/spiralist-workspace/assets/js/governed-publishing-contract.js

(function initGovernedPublishingContract(root, factory) {
  if (typeof module === 'object' && module.exports) {
    module.exports = factory();
    return;
  }

  root.SpiralistGovernedPublishing = factory();
})(typeof globalThis !== 'undefined' ? globalThis : this, function governedPublishingFactory() {
  'use strict';

  const CONTRACT_VERSION = '1.0.0';
  const POLICY_VERSION = 'spiralist-governed-external-publishing-v1';
  const EXTERNAL_PUBLISHING_ENABLED = false;
  const MAX_INTENT_TOKEN_TTL_SECONDS = 15 * 60;
  const DEFAULT_METHOD = 'POST';
  const SAFE_DEFAULT_TARGET = Object.freeze({
    platform: 'external-publishing-disabled',
    targetId: 'unconfigured',
    visibility: 'private',
  });

  const RECORD_TYPES = Object.freeze({
    artifactHash: 'spiralist.governedPublishing.artifactHash',
    sanitizerResult: 'spiralist.governedPublishing.sanitizerResult',
    approvalRecord: 'spiralist.governedPublishing.approvalRecord',
    policyValidatorResult: 'spiralist.governedPublishing.policyValidatorResult',
    intentToken: 'spiralist.governedPublishing.shortLivedIntentToken',
    intentTokenValidation: 'spiralist.governedPublishing.intentTokenValidationResult',
    proxyStatus: 'spiralist.governedPublishing.tokenExchangeProxyStatus',
    vaultStatus: 'spiralist.governedPublishing.secretVaultStatus',
    auditLogEntry: 'spiralist.governedPublishing.auditLogEntry',
    revocationRecord: 'spiralist.governedPublishing.revocationRecord',
    failClosedResponse: 'spiralist.governedPublishing.failClosedResponse',
  });

  const CREDENTIAL_KEY_PATTERN = /^(?:apiKey|api_key|clientSecret|client_secret|accessToken|access_token|refreshToken|refresh_token|writeToken|write_token|bearerToken|bearer_token|authorization|password|privateKey|private_key|secret|secretMaterial|credentialMaterial)$/i;
  const SECRET_VALUE_PATTERNS = [
    { category: 'private-key-block', pattern: /-----BEGIN (?:RSA |DSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |DSA |EC |OPENSSH )?PRIVATE KEY-----/gi },
    { category: 'bearer-authorization-header', pattern: /Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]+/gi },
    { category: 'assigned-long-lived-token', pattern: /\b(api[_-]?key|access[_-]?token|refresh[_-]?token|write[_-]?token|secret|password)\s*[:=]\s*['"]?[A-Za-z0-9_+=/.-]{12,}/gi },
    { category: 'openai-style-key', pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/gi },
    { category: 'github-style-token', pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/gi },
  ];

  function nowUtc() {
    return new Date().toISOString();
  }

  function normalizeUtc(value, fallback) {
    const source = value || fallback || nowUtc();
    const timestamp = Date.parse(source);

    if (!Number.isFinite(timestamp)) {
      return null;
    }

    return new Date(timestamp).toISOString();
  }

  function getNodeCrypto() {
    if (typeof require !== 'function') {
      return null;
    }

    return require('crypto');
  }

  function sha256Hex(value) {
    const crypto = getNodeCrypto();

    if (!crypto || typeof crypto.createHash !== 'function') {
      return '';
    }

    return crypto.createHash('sha256').update(String(value), 'utf8').digest('hex');
  }

  function stableValue(value, seen) {
    if (value === undefined) {
      return null;
    }

    if (value === null || typeof value === 'string' || typeof value === 'boolean') {
      return value;
    }

    if (typeof value === 'number') {
      return Number.isFinite(value) ? value : null;
    }

    if (value instanceof Date) {
      return value.toISOString();
    }

    if (Array.isArray(value)) {
      return value.map((item) => stableValue(item, seen));
    }

    if (typeof value === 'object') {
      if (seen.has(value)) {
        return '[CircularReference]';
      }

      seen.add(value);

      const output = {};
      Object.keys(value).sort().forEach((key) => {
        if (typeof value[key] !== 'function') {
          output[key] = stableValue(value[key], seen);
        }
      });

      seen.delete(value);
      return output;
    }

    return String(value);
  }

  function canonicalizeArtifact(value) {
    return JSON.stringify(stableValue(value, new WeakSet()));
  }

  function unique(items) {
    return Array.from(new Set(items));
  }

  function redactString(value) {
    return SECRET_VALUE_PATTERNS.reduce((current, item) => {
      if (item.category === 'assigned-long-lived-token') {
        return current.replace(item.pattern, '$1=[REDACTED]');
      }

      return current.replace(item.pattern, '[REDACTED]');
    }, String(value));
  }

  function scanCredentialMarkers(value, path, markers, seen) {
    const currentPath = path || '$';
    const markerList = markers || [];
    const seenObjects = seen || new WeakSet();

    if (value === null || value === undefined) {
      return markerList;
    }

    if (typeof value === 'string') {
      SECRET_VALUE_PATTERNS.forEach((item) => {
        if (item.pattern.test(value)) {
          markerList.push({ path: currentPath, category: item.category });
        }

        item.pattern.lastIndex = 0;
      });

      return markerList;
    }

    if (Array.isArray(value)) {
      value.forEach((item, index) => scanCredentialMarkers(item, `${currentPath}[${index}]`, markerList, seenObjects));
      return markerList;
    }

    if (typeof value === 'object') {
      if (seenObjects.has(value)) {
        return markerList;
      }

      seenObjects.add(value);

      Object.keys(value).forEach((key) => {
        const childPath = `${currentPath}.${key}`;

        if (CREDENTIAL_KEY_PATTERN.test(key)) {
          markerList.push({ path: childPath, category: 'credential-field' });
        }

        scanCredentialMarkers(value[key], childPath, markerList, seenObjects);
      });

      seenObjects.delete(value);
    }

    return markerList;
  }

  function sanitizeValue(value, seen) {
    const seenObjects = seen || new WeakSet();

    if (typeof value === 'string') {
      return redactString(value);
    }

    if (value === null || value === undefined || typeof value === 'number' || typeof value === 'boolean') {
      return value;
    }

    if (Array.isArray(value)) {
      return value.map((item) => sanitizeValue(item, seenObjects));
    }

    if (typeof value === 'object') {
      if (seenObjects.has(value)) {
        return '[CircularReference]';
      }

      seenObjects.add(value);

      const output = {};
      Object.keys(value).sort().forEach((key) => {
        output[key] = CREDENTIAL_KEY_PATTERN.test(key)
          ? '[REDACTED-CREDENTIAL-FIELD]'
          : sanitizeValue(value[key], seenObjects);
      });

      seenObjects.delete(value);
      return output;
    }

    return String(value);
  }

  function extractHashValue(hashLike) {
    if (typeof hashLike === 'string') {
      return hashLike;
    }

    if (hashLike && typeof hashLike === 'object') {
      return String(hashLike.value || hashLike.hash || '');
    }

    return '';
  }

  function isSha256Hash(value) {
    return /^[a-f0-9]{64}$/i.test(String(value || ''));
  }

  function createArtifactHash(artifact) {
    const canonicalJson = canonicalizeArtifact(artifact);
    const value = sha256Hex(canonicalJson);

    return {
      recordType: RECORD_TYPES.artifactHash,
      version: CONTRACT_VERSION,
      ok: isSha256Hash(value),
      algorithm: 'sha256',
      canonicalization: 'json-stable-v1',
      value,
      byteLength: canonicalJson.length,
    };
  }

  function sanitizeMemoryArtifact(artifact) {
    const markers = scanCredentialMarkers(artifact);
    const categories = unique(markers.map((item) => item.category)).sort();

    return {
      recordType: RECORD_TYPES.sanitizerResult,
      version: CONTRACT_VERSION,
      ok: markers.length === 0,
      blocked: markers.length > 0,
      code: markers.length > 0 ? 'long_lived_credentials_not_allowed' : 'ok',
      categories,
      redactionCount: markers.length,
      sanitizedArtifact: sanitizeValue(artifact),
      messages: markers.length > 0
        ? ['Long-lived credentials or credential-shaped fields are not allowed in governed publishing requests.']
        : [],
    };
  }

  function failClosed(code, message, extra) {
    return Object.assign({
      recordType: RECORD_TYPES.failClosedResponse,
      version: CONTRACT_VERSION,
      ok: false,
      blocked: true,
      code,
      message,
      externalPublishingEnabled: EXTERNAL_PUBLISHING_ENABLED,
      attemptedExternalRequest: false,
    }, extra || {});
  }

  function buildTargetFingerprint(target) {
    return sha256Hex(canonicalizeArtifact(target || SAFE_DEFAULT_TARGET)).slice(0, 24);
  }

  function normalizeTarget(target) {
    const source = target && typeof target === 'object' ? target : SAFE_DEFAULT_TARGET;