SQLite Web: gitea.db

id

Primary key. INTEGER NOT NULL

package_id

INTEGER NOT NULL

creator_id

INTEGER NOT NULL (default 0

version

TEXT NOT NULL

lower_version

TEXT NOT NULL

created_unix

INTEGER NOT NULL

is_internal

INTEGER NOT NULL (default 0

metadata_json

{"scope":"@juhai","name":"client-scope","description":"Versioned signed Scope snapshots and shared local membership evaluation; no organization authority or grants","license":"UNLICENSED","development_dependencies":{"@juhai/kernel":"0.24.0","@types/node":"22.19.20","typescript":"5.9.3","vitest":"2.1.9"},"peer_dependencies":{"@juhai/kernel":"0.24.0"},"readme":"# @juhai/client-scope\n\nNode.js SDK for signed organization / department / team closure snapshots. Snapshot and bootstrap wire formats remain `pending-dec` candidates until CHG-004 approval. The snapshot HTTP reader/poller is available only through explicit development/test candidate assembly. Owner enrollment, action grants and production activation are separate prerequisites.\n\n`createLocalScopeEvaluator` pins M4 Ed25519 public keys to a tenant and catalog version. Install an authenticated signed snapshot, then evaluate membership with trusted Owner actor/resource bindings. The caller must also obtain an M3 action decision. Never accept `actorOrganizationId` or `resourceOrganizationId` directly from request claims without the Owner binding check.\n\nInstallation validates the signature, digest, canonical IDs, interval bounds and monotonically increasing publication versions. `invalidate(dimension, minimumVersion)` fails closed until a sufficiently new publication is installed. Local reads use the last verified snapshot until TTL expiry; stale self/tenant policies intersect the original range and never expand it. Expired writes deny. High-risk and integrity-rollback evaluations require live review. Known future relation changes bound old rows' lifetime even for stale reads.\n\nThe shared conformance fixture is `runtime/test/fixtures/scope-conformance.json`; M4 and SDK test the same expected memberships. M4 stores verified Owner input and separate staged/published snapshots, without owning the Organization tree. The M4 HTTP reader is bound to an explicitly enrolled tenant/application/subject. A reachable server freeze/erasure denies snapshot reads and clears the remote SDK cache; disconnected SDK instances retain only their existing local policy and original expiry. Owner Fact ingestion and the high-risk live resolver remain pending.\n\n\n`createRemoteScopeClient` fetches `/api/v1/scope/snapshots/:dimension` with Bearer authentication, pinned M4 public keys, a 2 s end-to-end deadline and a 32 MiB body bound. HTTPS is required outside loopback. `start()` polls every 1000 ms by default; `refresh()` is a single coalesced attempt. Identity/key configuration is copied at construction. No token or arbitrary provider error is retained in stats.\n\nAn identical signed publication may be fetched again without renewing its expiry. A lower publication version or a changed payload at the same version clears membership. `invalidate(minimumVersion)` also rejects an older in-flight response. The monotonic high-water mark survives a cache discard within the client instance; process restarts still need trusted current server state/external checkpoints.\n\n`subscribe()` is structurally compatible with the permission SDK invalidation source: new Scope versions and unavailable/invalid responses drop the tenant's cached action decisions. Transport/5xx failures preserve the Scope last-known-good data only under its original local policy. Explicit 4xx denial/missing/integrity responses and invalid signed content discard it. High-risk membership always requires the still-pending live Owner-bound resolver. A Scope membership result alone is never authorization.\n","repository":{"type":"git","url":"git@gitea.g-hi.com:luoanwu/enterprise-platform.git"}}

TEXT

download_count

INTEGER NOT NULL (default 0

Update row 46 in package_version