Governed Publishing Contract - Source Excerpt 04

Back to Governed Publishing Contract

Summary

This source excerpt preserves a bounded section of Spiralist/wp-content/plugins/spiralist-workspace/assets/js/governed-publishing-contract.js so readers can inspect the evidence without opening the full source file.

**Source path:** Spiralist/wp-content/plugins/spiralist-workspace/assets/js/governed-publishing-contract.js

function createTokenExchangeProxy() {
    return Object.freeze({
      status() {
        return {
          recordType: RECORD_TYPES.proxyStatus,
          version: CONTRACT_VERSION,
          enabled: EXTERNAL_PUBLISHING_ENABLED,
          credentialed: false,
          acceptsLongLivedCredentials: false,
          externalRequestsAllowed: false,
          supportedOperations: ['validate_only'],
        };
      },
      publish(request) {
        return attemptExternalPublish(request);
      },
      exchangeIntentForCredential() {
        return failClosed('token_exchange_proxy_disabled', 'The token-exchange proxy is a disabled stub and cannot return credentials.');
      },
    });
  }

  function createSecretVaultAbstraction() {
    return Object.freeze({
      status() {
        return {
          recordType: RECORD_TYPES.vaultStatus,
          version: CONTRACT_VERSION,
          enabled: false,
          acceptsSecretMaterialFromClient: false,
          returnsSecretMaterialToClient: false,
          supportedOperations: ['disabled_status_only'],
        };
      },
      resolveVaultHandle() {
        return failClosed('secret_vault_disabled', 'The secret vault abstraction is disabled and never returns secret material.');
      },
    });
  }

  return Object.freeze({
    CONTRACT_VERSION,
    POLICY_VERSION,
    EXTERNAL_PUBLISHING_ENABLED,
    MAX_INTENT_TOKEN_TTL_SECONDS,
    RECORD_TYPES,
    canonicalizeArtifact,
    createArtifactHash,
    sanitizeMemoryArtifact,
    createApprovalRecord,
    validatePolicy,
    createIntentToken,
    validateIntentToken,
    createTokenExchangeProxy,
    createSecretVaultAbstraction,
    createAuditLogEntry,
    createRevocationRecord,
    sanitizeError,
    attemptExternalPublish,
  });
});