@absolutejs/vulnerabilities-witness 0.1.0

package/LICENSE

@@ -0,0 +1,80 @@
+# Business Source License 1.1
+
+**Licensor:** Alex Kahn
+
+**Licensed Work:** @absolutejs/vulnerabilities-witness (https://github.com/absolutejs/vulnerabilities-witness)
+
+**Change Date:** July 19, 2030
+
+**Change License:** Apache License, Version 2.0
+
+---
+
+## Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, permitting limited production use.
+
+### Additional Use Grant
+
+You may use the Licensed Work in production, provided your use does not include
+any of the following:
+
+1. **Offering a Competing Service.** You may not offer the Licensed Work, or
+   any derivative or substantial portion of it, to third parties as a hosted or
+   managed vulnerability-management, exposure-management, container-security,
+   cloud-security-posture-management, transparency-witnessing, or
+   attack-surface-management service. This includes any product whose primary
+   value to its users is the functionality the Licensed Work provides.
+
+2. **Resale or Redistribution as a Standalone Product.** You may not sell,
+   license, or distribute the Licensed Work, or any derivative or fork of it,
+   as a standalone commercial product.
+
+3. **Removal of Attribution.** Any derivative work, fork, or redistribution of
+   the Licensed Work must prominently credit AbsoluteJS and include a link to
+   the original project repository
+   (https://github.com/absolutejs/vulnerabilities-witness).
+
+For clarity, the following uses are expressly permitted:
+
+- Using the Licensed Work to witness, verify, audit, or report on vulnerability
+  evidence for your own applications, websites, internal tools, or SaaS
+  products, so long as vulnerability management or transparency witnessing is
+  not the primary product you are selling.
+- Using the Licensed Work as a dependency in commercial software you build and
+  sell, as long as that software is not a competing hosted security service.
+- Providing consulting, development, or professional services to clients using
+  the Licensed Work.
+- Forking and modifying the Licensed Work for your own internal use, provided
+  attribution is maintained.
+
+### Change Date and Change License
+
+On the Change Date specified above, the Licensed Work will be made available
+under the Change License (Apache License, Version 2.0).
+
+### Trademark
+
+This license does not grant rights to use the AbsoluteJS name or trademarks in
+a manner that suggests endorsement of an unaffiliated fork.
+
+### Notices
+
+You must not remove or obscure any licensing, copyright, or other notices
+included in the Licensed Work.
+
+### No Warranty
+
+THE LICENSED WORK IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM, OUT
+OF, OR IN CONNECTION WITH THE LICENSED WORK OR ITS USE.
+
+## Contact
+
+- **Alex Kahn**
+- alexkahndev@gmail.com
+- alexkahndev.github.io

package/README.md

@@ -0,0 +1,69 @@
+# @absolutejs/vulnerabilities-witness
+
+Independent transparency witnessing for AbsoluteJS vulnerability evidence.
+The package verifies the complete signed evidence-key transparency log before
+issuing an Ed25519 checkpoint receipt. Durable stores reject a lower log size
+as rollback and reject two different heads observed for the same authenticated
+subject and log size as equivocation.
+
+The HTTP service has three routes:
+
+- `POST /v1/checkpoints` authenticates a bearer token, verifies the submitted
+  transparency log, and returns `{ checkpoint, registry }`.
+- `GET /v1/keys` publishes the witness key registry and cross-signed rotation
+  chain.
+- `GET /health` returns service liveness.
+
+```ts
+import {
+  EVIDENCE_WITNESS_REQUEST_CONTRACT,
+  createEvidenceWitnessHttpHandler,
+  createEvidenceWitnessService,
+  createEvidenceWitnessSigningState,
+} from "@absolutejs/vulnerabilities-witness";
+import {
+  createPostgresEvidenceWitnessStore,
+  ensurePostgresEvidenceWitnessSchema,
+} from "@absolutejs/vulnerabilities-witness/postgres";
+
+const signingState = createEvidenceWitnessSigningState();
+await ensurePostgresEvidenceWitnessSchema(sql);
+
+const service = createEvidenceWitnessService({
+  loadSigningState,
+  origin: "https://witness.example",
+  signingState,
+  store: createPostgresEvidenceWitnessStore(sql),
+  storeSigningState,
+});
+
+const fetch = createEvidenceWitnessHttpHandler({
+  authenticate: async (token) => subjectsByToken.get(token) ?? null,
+  service,
+});
+
+Bun.serve({ fetch, port: 3000 });
+```
+
+The signing identity contains a private key and belongs in a durable secret
+broker, not PostgreSQL or source control. `service.rotate()` stores the new
+secret state before activating it and publishes the cross-signed transition in
+the registry. In a multi-replica service, the supplied secret-store integration
+must serialize rotations.
+
+## Standalone service
+
+The included `absolute-vulnerability-witness` executable uses PostgreSQL for
+observations and accepts these deployment secrets:
+
+- `DATABASE_URL`
+- `EVIDENCE_WITNESS_ORIGIN`
+- `EVIDENCE_WITNESS_SIGNING_STATE_JSON`
+- `EVIDENCE_WITNESS_TOKENS_JSON`, an object mapping stable subjects to bearer
+  tokens
+- `PORT`, defaulting to `3000`
+
+Run independent instances under different administrative and infrastructure
+boundaries. Clients should pin each genesis witness key through an independent
+channel and require a quorum with
+`verifyEvidenceWitnessQuorum` from `@absolutejs/vulnerabilities`.

package/dist/http.d.ts

@@ -0,0 +1,5 @@
+import { type createEvidenceWitnessService } from "./service";
+export declare const createEvidenceWitnessHttpHandler: (options: {
+    authenticate: (token: string) => Promise<string | null>;
+    service: ReturnType<typeof createEvidenceWitnessService>;
+}) => (request: Request) => Promise<Response>;

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./http";
+export * from "./service";
+export * from "./signing";
+export * from "./store";

package/dist/index.js

@@ -0,0 +1,285 @@
+// @bun
+// src/service.ts
+import {
+  verifyEvidenceKeyTransparencyLog
+} from "@absolutejs/vulnerabilities/evidence-transparency";
+import { createEvidenceWitnessCheckpointForHead } from "@absolutejs/vulnerabilities/evidence-witness";
+
+// src/signing.ts
+import {
+  createEvidenceSigningIdentity,
+  createEvidenceSigningKeyTransition,
+  evidenceVerificationKeyFrom,
+  parseEvidenceSigningIdentity,
+  parseEvidenceVerificationKey,
+  verifyEvidenceSigningKeyTransition
+} from "@absolutejs/vulnerabilities/evidence-bundle";
+var SIGNING_STATE_VERSION = 1;
+var keysMatch = (left, right) => left.keyId === right.keyId && left.fingerprint === right.fingerprint && left.publicKey === right.publicKey;
+var registryKeys = (state) => {
+  const keys = new Map;
+  const add = (key) => keys.set(key.keyId, key);
+  add(evidenceVerificationKeyFrom(state.identity));
+  for (const transition of state.transitions) {
+    add(transition.previousKey);
+    add(transition.nextKey);
+  }
+  return [...keys.values()].sort((left, right) => left.createdAt.localeCompare(right.createdAt));
+};
+var createEvidenceWitnessSigningState = (createdAt = new Date().toISOString()) => ({
+  identity: createEvidenceSigningIdentity({ createdAt }),
+  transitions: [],
+  version: SIGNING_STATE_VERSION
+});
+var parseEvidenceWitnessSigningState = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Evidence witness signing state is invalid");
+  const input = value;
+  if (input.version !== SIGNING_STATE_VERSION || !input.identity || !Array.isArray(input.transitions))
+    throw new Error("Evidence witness signing state is invalid");
+  const identity = parseEvidenceSigningIdentity(input.identity);
+  const transitions = input.transitions.map((transition) => {
+    if (!verifyEvidenceSigningKeyTransition(transition))
+      throw new Error("Evidence witness key transition is invalid");
+    return structuredClone(transition);
+  });
+  const registry = evidenceWitnessKeyRegistryFrom({
+    identity,
+    transitions,
+    version: SIGNING_STATE_VERSION
+  });
+  if (verifyEvidenceWitnessKeyRegistry({
+    registry,
+    trustedKeys: [registry.keys[0]]
+  }).trust !== "trusted")
+    throw new Error("Evidence witness key chain is disconnected");
+  return { identity, transitions, version: SIGNING_STATE_VERSION };
+};
+var encodeEvidenceWitnessSigningState = (state) => JSON.stringify(parseEvidenceWitnessSigningState(state));
+var rotateEvidenceWitnessSigningState = (state, rotatedAt = new Date().toISOString()) => {
+  const current = parseEvidenceWitnessSigningState(state);
+  const identity = createEvidenceSigningIdentity({ createdAt: rotatedAt });
+  const transition = createEvidenceSigningKeyTransition({
+    nextKey: evidenceVerificationKeyFrom(identity),
+    previousIdentity: current.identity,
+    rotatedAt
+  });
+  return {
+    identity,
+    transitions: [...current.transitions, transition],
+    version: SIGNING_STATE_VERSION
+  };
+};
+var evidenceWitnessKeyRegistryFrom = (state) => ({
+  activeKeyId: state.identity.keyId,
+  keys: registryKeys(state),
+  transitions: structuredClone(state.transitions),
+  version: SIGNING_STATE_VERSION
+});
+var verifyEvidenceWitnessKeyRegistry = (input) => {
+  try {
+    if (input.registry.version !== SIGNING_STATE_VERSION)
+      throw new Error("Evidence witness registry version is unsupported");
+    const keys = input.registry.keys.map(parseEvidenceVerificationKey);
+    const transitions = input.registry.transitions.map((transition) => {
+      if (!verifyEvidenceSigningKeyTransition(transition))
+        throw new Error("Evidence witness key transition is invalid");
+      return transition;
+    });
+    let cursor = keys.find(({ keyId }) => keyId === input.registry.activeKeyId);
+    if (!cursor)
+      throw new Error("Evidence witness active key is missing");
+    const visited = new Set;
+    let traversed = 0;
+    while (!input.trustedKeys.some((trusted) => keysMatch(trusted, cursor))) {
+      if (visited.has(cursor.keyId))
+        throw new Error("Evidence witness key chain contains a cycle");
+      visited.add(cursor.keyId);
+      const transition = transitions.find((entry) => keysMatch(entry.nextKey, cursor));
+      if (!transition)
+        return { activeKey: cursor, trust: "untrusted" };
+      cursor = transition.previousKey;
+      traversed += 1;
+    }
+    if (traversed !== transitions.length)
+      throw new Error("Evidence witness key registry contains disconnected history");
+    return {
+      activeKey: keys.find(({ keyId }) => keyId === input.registry.activeKeyId),
+      trust: "trusted"
+    };
+  } catch {
+    return { activeKey: null, trust: "untrusted" };
+  }
+};
+
+// src/service.ts
+var EVIDENCE_WITNESS_REQUEST_CONTRACT = "absolutejs.vulnerability-evidence-witness-request/v1";
+var createEvidenceWitnessService = (options) => {
+  const origin = new URL(options.origin);
+  if (origin.protocol !== "https:")
+    throw new Error("Evidence witness origin must use HTTPS");
+  let state = parseEvidenceWitnessSigningState(options.signingState);
+  let mutationQueue = Promise.resolve();
+  const refresh = async () => {
+    state = parseEvidenceWitnessSigningState(JSON.parse(await options.loadSigningState()));
+    return state;
+  };
+  const registry = async () => {
+    await refresh();
+    return evidenceWitnessKeyRegistryFrom(state);
+  };
+  const checkpoint = async (subject, request) => {
+    if (request.contract !== EVIDENCE_WITNESS_REQUEST_CONTRACT)
+      throw new Error("Evidence witness request contract is unsupported");
+    const [genesis] = request.log.entries;
+    if (!genesis || genesis.event.kind !== "key_created")
+      throw new Error("Evidence transparency genesis is missing");
+    const verification = verifyEvidenceKeyTransparencyLog({
+      log: request.log,
+      trustedKeys: [genesis.event.key]
+    });
+    if (verification.trust !== "trusted")
+      throw new Error("Evidence transparency log is invalid");
+    const normalizedSubject = subject.trim();
+    if (!normalizedSubject)
+      throw new Error("Evidence witness subject is required");
+    await refresh();
+    const signed = createEvidenceWitnessCheckpointForHead({
+      identity: state.identity,
+      logHead: request.log.head,
+      logSize: request.log.entries.length,
+      origin: origin.href
+    });
+    const observed = await options.store.observe({
+      checkpoint: signed,
+      history: request.log.entries.map(({ digest }) => digest),
+      subject: normalizedSubject
+    });
+    return {
+      checkpoint: observed.checkpoint,
+      registry: evidenceWitnessKeyRegistryFrom(state)
+    };
+  };
+  const rotate = (rotatedAt = new Date().toISOString()) => {
+    const queued = mutationQueue.then(async () => {
+      await refresh();
+      const next = rotateEvidenceWitnessSigningState(state, rotatedAt);
+      await options.storeSigningState(encodeEvidenceWitnessSigningState(next));
+      state = next;
+      return evidenceWitnessKeyRegistryFrom(state);
+    });
+    mutationQueue = queued.then(() => {
+      return;
+    }, () => {
+      return;
+    });
+    return queued;
+  };
+  return { checkpoint, registry, rotate };
+};
+
+// src/store.ts
+class EvidenceWitnessEquivocationError extends Error {
+}
+
+class EvidenceWitnessRollbackError extends Error {
+}
+var normalizedSubject = (subject) => {
+  const value = subject.trim();
+  if (!value)
+    throw new Error("Evidence witness subject is required");
+  return value;
+};
+var createMemoryEvidenceWitnessStore = () => {
+  const subjects = new Map;
+  const latest = async (subject) => {
+    const values = subjects.get(normalizedSubject(subject));
+    if (!values || values.size === 0)
+      return null;
+    const size = Math.max(...values.keys());
+    return structuredClone(values.get(size));
+  };
+  const observe = async (input) => {
+    const subject = normalizedSubject(input.subject);
+    let values = subjects.get(subject);
+    if (!values) {
+      values = new Map;
+      subjects.set(subject, values);
+    }
+    const existing = values.get(input.checkpoint.logSize);
+    if (existing) {
+      if (existing.checkpoint.logHead !== input.checkpoint.logHead)
+        throw new EvidenceWitnessEquivocationError("Evidence transparency log equivocated at an observed size");
+      return {
+        checkpoint: structuredClone(existing.checkpoint),
+        status: "replay"
+      };
+    }
+    const current = await latest(subject);
+    if (current && current.checkpoint.logSize > input.checkpoint.logSize)
+      throw new EvidenceWitnessRollbackError("Evidence transparency log attempted to roll back");
+    if (current && input.history[current.checkpoint.logSize - 1] !== current.checkpoint.logHead)
+      throw new EvidenceWitnessEquivocationError("Evidence transparency log forked from observed history");
+    const observation = structuredClone({
+      checkpoint: input.checkpoint,
+      subject
+    });
+    values.set(input.checkpoint.logSize, observation);
+    return {
+      checkpoint: structuredClone(input.checkpoint),
+      status: "accepted"
+    };
+  };
+  return { latest, observe };
+};
+
+// src/http.ts
+var json = (value, status = 200) => Response.json(value, {
+  headers: { "cache-control": "no-store" },
+  status
+});
+var bearer = (request) => {
+  const authorization = request.headers.get("authorization") ?? "";
+  return authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length).trim() : "";
+};
+var createEvidenceWitnessHttpHandler = (options) => async (request) => {
+  const url = new URL(request.url);
+  if (request.method === "GET" && url.pathname === "/health")
+    return json({ status: "ok" });
+  if (request.method === "GET" && url.pathname === "/v1/keys")
+    return json(await options.service.registry());
+  if (request.method !== "POST" || url.pathname !== "/v1/checkpoints")
+    return json({ error: "not_found" }, 404);
+  const subject = await options.authenticate(bearer(request));
+  if (!subject)
+    return json({ error: "unauthorized" }, 401);
+  try {
+    const input = await request.json();
+    if (input.contract !== EVIDENCE_WITNESS_REQUEST_CONTRACT)
+      return json({ error: "unsupported_contract" }, 400);
+    return json(await options.service.checkpoint(subject, input));
+  } catch (error) {
+    if (error instanceof EvidenceWitnessEquivocationError)
+      return json({ error: "equivocation", message: error.message }, 409);
+    if (error instanceof EvidenceWitnessRollbackError)
+      return json({ error: "rollback", message: error.message }, 409);
+    return json({
+      error: "invalid_request",
+      message: error instanceof Error ? error.message : "Invalid request"
+    }, 400);
+  }
+};
+export {
+  verifyEvidenceWitnessKeyRegistry,
+  rotateEvidenceWitnessSigningState,
+  parseEvidenceWitnessSigningState,
+  evidenceWitnessKeyRegistryFrom,
+  encodeEvidenceWitnessSigningState,
+  createMemoryEvidenceWitnessStore,
+  createEvidenceWitnessSigningState,
+  createEvidenceWitnessService,
+  createEvidenceWitnessHttpHandler,
+  EvidenceWitnessRollbackError,
+  EvidenceWitnessEquivocationError,
+  EVIDENCE_WITNESS_REQUEST_CONTRACT
+};

package/dist/manifest.d.ts

@@ -0,0 +1 @@
+export declare const manifest: import("@absolutejs/manifest").PackageManifest<Record<string, never>, never>;

package/dist/manifest.js

@@ -0,0 +1,38 @@
+// @bun
+// src/manifest.ts
+import { defineManifest } from "@absolutejs/manifest";
+import { Type } from "@sinclair/typebox";
+var manifest = defineManifest()({
+  contract: 2,
+  discovery: {
+    audiences: ["platform-operators", "security-teams", "auditors"],
+    intents: [
+      "independently witness vulnerability evidence transparency",
+      "detect transparency rollback and equivocation",
+      "rotate witness signing keys",
+      "serve durable signed witness receipts"
+    ],
+    keywords: [
+      "vulnerabilities",
+      "witness",
+      "key-transparency",
+      "equivocation",
+      "quorum",
+      "PostgreSQL"
+    ],
+    protocols: ["HTTPS", "Ed25519", "PostgreSQL"]
+  },
+  identity: {
+    accent: "#dc2626",
+    category: "operations",
+    description: "Independent durable witness service for signed vulnerability-evidence transparency logs.",
+    docsUrl: "https://github.com/absolutejs/vulnerabilities-witness",
+    name: "@absolutejs/vulnerabilities-witness",
+    tagline: "Make evidence-log rollback and equivocation externally visible."
+  },
+  settings: Type.Object({}),
+  wiring: []
+});
+export {
+  manifest
+};

package/dist/manifest.json

@@ -0,0 +1,42 @@
+{
+	"contract": 2,
+	"discovery": {
+		"audiences": [
+			"platform-operators",
+			"security-teams",
+			"auditors"
+		],
+		"intents": [
+			"independently witness vulnerability evidence transparency",
+			"detect transparency rollback and equivocation",
+			"rotate witness signing keys",
+			"serve durable signed witness receipts"
+		],
+		"keywords": [
+			"vulnerabilities",
+			"witness",
+			"key-transparency",
+			"equivocation",
+			"quorum",
+			"PostgreSQL"
+		],
+		"protocols": [
+			"HTTPS",
+			"Ed25519",
+			"PostgreSQL"
+		]
+	},
+	"identity": {
+		"accent": "#dc2626",
+		"category": "operations",
+		"description": "Independent durable witness service for signed vulnerability-evidence transparency logs.",
+		"docsUrl": "https://github.com/absolutejs/vulnerabilities-witness",
+		"name": "@absolutejs/vulnerabilities-witness",
+		"tagline": "Make evidence-log rollback and equivocation externally visible."
+	},
+	"settings": {
+		"type": "object",
+		"properties": {}
+	},
+	"wiring": []
+}

package/dist/postgres.d.ts

@@ -0,0 +1,4 @@
+import type { SQL } from "bun";
+import { type EvidenceWitnessStore } from "./store";
+export declare const ensurePostgresEvidenceWitnessSchema: (sql: SQL) => Promise<void>;
+export declare const createPostgresEvidenceWitnessStore: (sql: SQL) => EvidenceWitnessStore;

package/dist/postgres.js

@@ -0,0 +1,131 @@
+// @bun
+// src/store.ts
+class EvidenceWitnessEquivocationError extends Error {
+}
+
+class EvidenceWitnessRollbackError extends Error {
+}
+var normalizedSubject = (subject) => {
+  const value = subject.trim();
+  if (!value)
+    throw new Error("Evidence witness subject is required");
+  return value;
+};
+var createMemoryEvidenceWitnessStore = () => {
+  const subjects = new Map;
+  const latest = async (subject) => {
+    const values = subjects.get(normalizedSubject(subject));
+    if (!values || values.size === 0)
+      return null;
+    const size = Math.max(...values.keys());
+    return structuredClone(values.get(size));
+  };
+  const observe = async (input) => {
+    const subject = normalizedSubject(input.subject);
+    let values = subjects.get(subject);
+    if (!values) {
+      values = new Map;
+      subjects.set(subject, values);
+    }
+    const existing = values.get(input.checkpoint.logSize);
+    if (existing) {
+      if (existing.checkpoint.logHead !== input.checkpoint.logHead)
+        throw new EvidenceWitnessEquivocationError("Evidence transparency log equivocated at an observed size");
+      return {
+        checkpoint: structuredClone(existing.checkpoint),
+        status: "replay"
+      };
+    }
+    const current = await latest(subject);
+    if (current && current.checkpoint.logSize > input.checkpoint.logSize)
+      throw new EvidenceWitnessRollbackError("Evidence transparency log attempted to roll back");
+    if (current && input.history[current.checkpoint.logSize - 1] !== current.checkpoint.logHead)
+      throw new EvidenceWitnessEquivocationError("Evidence transparency log forked from observed history");
+    const observation = structuredClone({
+      checkpoint: input.checkpoint,
+      subject
+    });
+    values.set(input.checkpoint.logSize, observation);
+    return {
+      checkpoint: structuredClone(input.checkpoint),
+      status: "accepted"
+    };
+  };
+  return { latest, observe };
+};
+
+// src/postgres.ts
+var LOCK_NAME = "absolutejs:evidence-witness-observation";
+var json = (value) => typeof value === "string" ? JSON.parse(value) : value;
+var ensurePostgresEvidenceWitnessSchema = async (sql) => {
+  await sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS absolute_vulnerability_evidence_witness_observations (
+      subject TEXT NOT NULL,
+      log_size INTEGER NOT NULL CHECK (log_size > 0),
+      log_head VARCHAR(71) NOT NULL,
+      observed_at TIMESTAMPTZ NOT NULL,
+      receipt JSONB NOT NULL,
+      witness_key_id TEXT NOT NULL,
+      PRIMARY KEY (subject, log_size)
+    )
+  `);
+};
+var createPostgresEvidenceWitnessStore = (sql) => {
+  const latest = async (subject) => {
+    const rows = await sql`
+      SELECT receipt
+      FROM absolute_vulnerability_evidence_witness_observations
+      WHERE subject = ${subject}
+      ORDER BY log_size DESC
+      LIMIT 1
+    `;
+    const row = Array.from(rows)[0];
+    return row ? { checkpoint: json(row.receipt), subject } : null;
+  };
+  const observe = (input) => sql.begin(async (transaction) => {
+    await transaction`
+        SELECT pg_advisory_xact_lock(
+          hashtext(${LOCK_NAME}), hashtext(${input.subject})
+        )
+      `;
+    const rows = await transaction`
+        SELECT log_head, log_size, receipt
+        FROM absolute_vulnerability_evidence_witness_observations
+        WHERE subject = ${input.subject}
+        ORDER BY log_size DESC
+        LIMIT 1
+      `;
+    const current = Array.from(rows)[0];
+    if (current?.log_size === input.checkpoint.logSize) {
+      if (current.log_head !== input.checkpoint.logHead)
+        throw new EvidenceWitnessEquivocationError("Evidence transparency log equivocated at an observed size");
+      return {
+        checkpoint: json(current.receipt),
+        status: "replay"
+      };
+    }
+    if (current && current.log_size > input.checkpoint.logSize)
+      throw new EvidenceWitnessRollbackError("Evidence transparency log attempted to roll back");
+    if (current && input.history[current.log_size - 1] !== current.log_head)
+      throw new EvidenceWitnessEquivocationError("Evidence transparency log forked from observed history");
+    await transaction`
+        INSERT INTO absolute_vulnerability_evidence_witness_observations (
+          subject, log_size, log_head, observed_at, receipt, witness_key_id
+        ) VALUES (
+          ${input.subject}, ${input.checkpoint.logSize},
+          ${input.checkpoint.logHead}, ${input.checkpoint.observedAt},
+          ${JSON.stringify(input.checkpoint)}::jsonb,
+          ${input.checkpoint.witness.keyId}
+        )
+      `;
+    return {
+      checkpoint: structuredClone(input.checkpoint),
+      status: "accepted"
+    };
+  });
+  return { latest, observe };
+};
+export {
+  ensurePostgresEvidenceWitnessSchema,
+  createPostgresEvidenceWitnessStore
+};

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+export {};

package/dist/server.js

@@ -0,0 +1,376 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/service.ts
+import {
+  verifyEvidenceKeyTransparencyLog
+} from "@absolutejs/vulnerabilities/evidence-transparency";
+import { createEvidenceWitnessCheckpointForHead } from "@absolutejs/vulnerabilities/evidence-witness";
+
+// src/signing.ts
+import {
+  createEvidenceSigningIdentity,
+  createEvidenceSigningKeyTransition,
+  evidenceVerificationKeyFrom,
+  parseEvidenceSigningIdentity,
+  parseEvidenceVerificationKey,
+  verifyEvidenceSigningKeyTransition
+} from "@absolutejs/vulnerabilities/evidence-bundle";
+var SIGNING_STATE_VERSION = 1;
+var keysMatch = (left, right) => left.keyId === right.keyId && left.fingerprint === right.fingerprint && left.publicKey === right.publicKey;
+var registryKeys = (state) => {
+  const keys = new Map;
+  const add = (key) => keys.set(key.keyId, key);
+  add(evidenceVerificationKeyFrom(state.identity));
+  for (const transition of state.transitions) {
+    add(transition.previousKey);
+    add(transition.nextKey);
+  }
+  return [...keys.values()].sort((left, right) => left.createdAt.localeCompare(right.createdAt));
+};
+var createEvidenceWitnessSigningState = (createdAt = new Date().toISOString()) => ({
+  identity: createEvidenceSigningIdentity({ createdAt }),
+  transitions: [],
+  version: SIGNING_STATE_VERSION
+});
+var parseEvidenceWitnessSigningState = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Evidence witness signing state is invalid");
+  const input = value;
+  if (input.version !== SIGNING_STATE_VERSION || !input.identity || !Array.isArray(input.transitions))
+    throw new Error("Evidence witness signing state is invalid");
+  const identity = parseEvidenceSigningIdentity(input.identity);
+  const transitions = input.transitions.map((transition) => {
+    if (!verifyEvidenceSigningKeyTransition(transition))
+      throw new Error("Evidence witness key transition is invalid");
+    return structuredClone(transition);
+  });
+  const registry = evidenceWitnessKeyRegistryFrom({
+    identity,
+    transitions,
+    version: SIGNING_STATE_VERSION
+  });
+  if (verifyEvidenceWitnessKeyRegistry({
+    registry,
+    trustedKeys: [registry.keys[0]]
+  }).trust !== "trusted")
+    throw new Error("Evidence witness key chain is disconnected");
+  return { identity, transitions, version: SIGNING_STATE_VERSION };
+};
+var encodeEvidenceWitnessSigningState = (state) => JSON.stringify(parseEvidenceWitnessSigningState(state));
+var rotateEvidenceWitnessSigningState = (state, rotatedAt = new Date().toISOString()) => {
+  const current = parseEvidenceWitnessSigningState(state);
+  const identity = createEvidenceSigningIdentity({ createdAt: rotatedAt });
+  const transition = createEvidenceSigningKeyTransition({
+    nextKey: evidenceVerificationKeyFrom(identity),
+    previousIdentity: current.identity,
+    rotatedAt
+  });
+  return {
+    identity,
+    transitions: [...current.transitions, transition],
+    version: SIGNING_STATE_VERSION
+  };
+};
+var evidenceWitnessKeyRegistryFrom = (state) => ({
+  activeKeyId: state.identity.keyId,
+  keys: registryKeys(state),
+  transitions: structuredClone(state.transitions),
+  version: SIGNING_STATE_VERSION
+});
+var verifyEvidenceWitnessKeyRegistry = (input) => {
+  try {
+    if (input.registry.version !== SIGNING_STATE_VERSION)
+      throw new Error("Evidence witness registry version is unsupported");
+    const keys = input.registry.keys.map(parseEvidenceVerificationKey);
+    const transitions = input.registry.transitions.map((transition) => {
+      if (!verifyEvidenceSigningKeyTransition(transition))
+        throw new Error("Evidence witness key transition is invalid");
+      return transition;
+    });
+    let cursor = keys.find(({ keyId }) => keyId === input.registry.activeKeyId);
+    if (!cursor)
+      throw new Error("Evidence witness active key is missing");
+    const visited = new Set;
+    let traversed = 0;
+    while (!input.trustedKeys.some((trusted) => keysMatch(trusted, cursor))) {
+      if (visited.has(cursor.keyId))
+        throw new Error("Evidence witness key chain contains a cycle");
+      visited.add(cursor.keyId);
+      const transition = transitions.find((entry) => keysMatch(entry.nextKey, cursor));
+      if (!transition)
+        return { activeKey: cursor, trust: "untrusted" };
+      cursor = transition.previousKey;
+      traversed += 1;
+    }
+    if (traversed !== transitions.length)
+      throw new Error("Evidence witness key registry contains disconnected history");
+    return {
+      activeKey: keys.find(({ keyId }) => keyId === input.registry.activeKeyId),
+      trust: "trusted"
+    };
+  } catch {
+    return { activeKey: null, trust: "untrusted" };
+  }
+};
+
+// src/service.ts
+var EVIDENCE_WITNESS_REQUEST_CONTRACT = "absolutejs.vulnerability-evidence-witness-request/v1";
+var createEvidenceWitnessService = (options) => {
+  const origin = new URL(options.origin);
+  if (origin.protocol !== "https:")
+    throw new Error("Evidence witness origin must use HTTPS");
+  let state = parseEvidenceWitnessSigningState(options.signingState);
+  let mutationQueue = Promise.resolve();
+  const refresh = async () => {
+    state = parseEvidenceWitnessSigningState(JSON.parse(await options.loadSigningState()));
+    return state;
+  };
+  const registry = async () => {
+    await refresh();
+    return evidenceWitnessKeyRegistryFrom(state);
+  };
+  const checkpoint = async (subject, request) => {
+    if (request.contract !== EVIDENCE_WITNESS_REQUEST_CONTRACT)
+      throw new Error("Evidence witness request contract is unsupported");
+    const [genesis] = request.log.entries;
+    if (!genesis || genesis.event.kind !== "key_created")
+      throw new Error("Evidence transparency genesis is missing");
+    const verification = verifyEvidenceKeyTransparencyLog({
+      log: request.log,
+      trustedKeys: [genesis.event.key]
+    });
+    if (verification.trust !== "trusted")
+      throw new Error("Evidence transparency log is invalid");
+    const normalizedSubject = subject.trim();
+    if (!normalizedSubject)
+      throw new Error("Evidence witness subject is required");
+    await refresh();
+    const signed = createEvidenceWitnessCheckpointForHead({
+      identity: state.identity,
+      logHead: request.log.head,
+      logSize: request.log.entries.length,
+      origin: origin.href
+    });
+    const observed = await options.store.observe({
+      checkpoint: signed,
+      history: request.log.entries.map(({ digest }) => digest),
+      subject: normalizedSubject
+    });
+    return {
+      checkpoint: observed.checkpoint,
+      registry: evidenceWitnessKeyRegistryFrom(state)
+    };
+  };
+  const rotate = (rotatedAt = new Date().toISOString()) => {
+    const queued = mutationQueue.then(async () => {
+      await refresh();
+      const next = rotateEvidenceWitnessSigningState(state, rotatedAt);
+      await options.storeSigningState(encodeEvidenceWitnessSigningState(next));
+      state = next;
+      return evidenceWitnessKeyRegistryFrom(state);
+    });
+    mutationQueue = queued.then(() => {
+      return;
+    }, () => {
+      return;
+    });
+    return queued;
+  };
+  return { checkpoint, registry, rotate };
+};
+
+// src/store.ts
+class EvidenceWitnessEquivocationError extends Error {
+}
+
+class EvidenceWitnessRollbackError extends Error {
+}
+var normalizedSubject = (subject) => {
+  const value = subject.trim();
+  if (!value)
+    throw new Error("Evidence witness subject is required");
+  return value;
+};
+var createMemoryEvidenceWitnessStore = () => {
+  const subjects = new Map;
+  const latest = async (subject) => {
+    const values = subjects.get(normalizedSubject(subject));
+    if (!values || values.size === 0)
+      return null;
+    const size = Math.max(...values.keys());
+    return structuredClone(values.get(size));
+  };
+  const observe = async (input) => {
+    const subject = normalizedSubject(input.subject);
+    let values = subjects.get(subject);
+    if (!values) {
+      values = new Map;
+      subjects.set(subject, values);
+    }
+    const existing = values.get(input.checkpoint.logSize);
+    if (existing) {
+      if (existing.checkpoint.logHead !== input.checkpoint.logHead)
+        throw new EvidenceWitnessEquivocationError("Evidence transparency log equivocated at an observed size");
+      return {
+        checkpoint: structuredClone(existing.checkpoint),
+        status: "replay"
+      };
+    }
+    const current = await latest(subject);
+    if (current && current.checkpoint.logSize > input.checkpoint.logSize)
+      throw new EvidenceWitnessRollbackError("Evidence transparency log attempted to roll back");
+    if (current && input.history[current.checkpoint.logSize - 1] !== current.checkpoint.logHead)
+      throw new EvidenceWitnessEquivocationError("Evidence transparency log forked from observed history");
+    const observation = structuredClone({
+      checkpoint: input.checkpoint,
+      subject
+    });
+    values.set(input.checkpoint.logSize, observation);
+    return {
+      checkpoint: structuredClone(input.checkpoint),
+      status: "accepted"
+    };
+  };
+  return { latest, observe };
+};
+
+// src/http.ts
+var json = (value, status = 200) => Response.json(value, {
+  headers: { "cache-control": "no-store" },
+  status
+});
+var bearer = (request) => {
+  const authorization = request.headers.get("authorization") ?? "";
+  return authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length).trim() : "";
+};
+var createEvidenceWitnessHttpHandler = (options) => async (request) => {
+  const url = new URL(request.url);
+  if (request.method === "GET" && url.pathname === "/health")
+    return json({ status: "ok" });
+  if (request.method === "GET" && url.pathname === "/v1/keys")
+    return json(await options.service.registry());
+  if (request.method !== "POST" || url.pathname !== "/v1/checkpoints")
+    return json({ error: "not_found" }, 404);
+  const subject = await options.authenticate(bearer(request));
+  if (!subject)
+    return json({ error: "unauthorized" }, 401);
+  try {
+    const input = await request.json();
+    if (input.contract !== EVIDENCE_WITNESS_REQUEST_CONTRACT)
+      return json({ error: "unsupported_contract" }, 400);
+    return json(await options.service.checkpoint(subject, input));
+  } catch (error) {
+    if (error instanceof EvidenceWitnessEquivocationError)
+      return json({ error: "equivocation", message: error.message }, 409);
+    if (error instanceof EvidenceWitnessRollbackError)
+      return json({ error: "rollback", message: error.message }, 409);
+    return json({
+      error: "invalid_request",
+      message: error instanceof Error ? error.message : "Invalid request"
+    }, 400);
+  }
+};
+// src/postgres.ts
+var LOCK_NAME = "absolutejs:evidence-witness-observation";
+var json2 = (value) => typeof value === "string" ? JSON.parse(value) : value;
+var ensurePostgresEvidenceWitnessSchema = async (sql) => {
+  await sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS absolute_vulnerability_evidence_witness_observations (
+      subject TEXT NOT NULL,
+      log_size INTEGER NOT NULL CHECK (log_size > 0),
+      log_head VARCHAR(71) NOT NULL,
+      observed_at TIMESTAMPTZ NOT NULL,
+      receipt JSONB NOT NULL,
+      witness_key_id TEXT NOT NULL,
+      PRIMARY KEY (subject, log_size)
+    )
+  `);
+};
+var createPostgresEvidenceWitnessStore = (sql) => {
+  const latest = async (subject) => {
+    const rows = await sql`
+      SELECT receipt
+      FROM absolute_vulnerability_evidence_witness_observations
+      WHERE subject = ${subject}
+      ORDER BY log_size DESC
+      LIMIT 1
+    `;
+    const row = Array.from(rows)[0];
+    return row ? { checkpoint: json2(row.receipt), subject } : null;
+  };
+  const observe = (input) => sql.begin(async (transaction) => {
+    await transaction`
+        SELECT pg_advisory_xact_lock(
+          hashtext(${LOCK_NAME}), hashtext(${input.subject})
+        )
+      `;
+    const rows = await transaction`
+        SELECT log_head, log_size, receipt
+        FROM absolute_vulnerability_evidence_witness_observations
+        WHERE subject = ${input.subject}
+        ORDER BY log_size DESC
+        LIMIT 1
+      `;
+    const current = Array.from(rows)[0];
+    if (current?.log_size === input.checkpoint.logSize) {
+      if (current.log_head !== input.checkpoint.logHead)
+        throw new EvidenceWitnessEquivocationError("Evidence transparency log equivocated at an observed size");
+      return {
+        checkpoint: json2(current.receipt),
+        status: "replay"
+      };
+    }
+    if (current && current.log_size > input.checkpoint.logSize)
+      throw new EvidenceWitnessRollbackError("Evidence transparency log attempted to roll back");
+    if (current && input.history[current.log_size - 1] !== current.log_head)
+      throw new EvidenceWitnessEquivocationError("Evidence transparency log forked from observed history");
+    await transaction`
+        INSERT INTO absolute_vulnerability_evidence_witness_observations (
+          subject, log_size, log_head, observed_at, receipt, witness_key_id
+        ) VALUES (
+          ${input.subject}, ${input.checkpoint.logSize},
+          ${input.checkpoint.logHead}, ${input.checkpoint.observedAt},
+          ${JSON.stringify(input.checkpoint)}::jsonb,
+          ${input.checkpoint.witness.keyId}
+        )
+      `;
+    return {
+      checkpoint: structuredClone(input.checkpoint),
+      status: "accepted"
+    };
+  });
+  return { latest, observe };
+};
+
+// src/server.ts
+var {SQL } = globalThis.Bun;
+var required = (name) => {
+  const value = process.env[name]?.trim();
+  if (!value)
+    throw new Error(`Missing required environment: ${name}`);
+  return value;
+};
+var database = new SQL(required("DATABASE_URL"));
+await ensurePostgresEvidenceWitnessSchema(database);
+var encodedSigningState = required("EVIDENCE_WITNESS_SIGNING_STATE_JSON");
+var signingState = parseEvidenceWitnessSigningState(JSON.parse(encodedSigningState));
+var tokens = JSON.parse(required("EVIDENCE_WITNESS_TOKENS_JSON"));
+var subjectsByToken = new Map(Object.entries(tokens).map(([subject, token]) => [token, subject]));
+var service2 = createEvidenceWitnessService({
+  loadSigningState: async () => encodedSigningState,
+  origin: required("EVIDENCE_WITNESS_ORIGIN"),
+  signingState,
+  store: createPostgresEvidenceWitnessStore(database),
+  storeSigningState: async () => {
+    throw new Error("Server-managed key rotation requires a durable secret-store integration");
+  }
+});
+var handler = createEvidenceWitnessHttpHandler({
+  authenticate: async (token) => subjectsByToken.get(token) ?? null,
+  service: service2
+});
+var port = Number(process.env.PORT ?? "3000");
+if (!Number.isSafeInteger(port) || port < 1 || port > 65535)
+  throw new Error("PORT must be a valid TCP port");
+Bun.serve({ fetch: handler, port });

package/dist/service.d.ts

@@ -0,0 +1,23 @@
+import { type EvidenceKeyTransparencyLog } from "@absolutejs/vulnerabilities/evidence-transparency";
+import { type EvidenceWitnessKeyRegistry, type EvidenceWitnessSigningState } from "./signing";
+import type { EvidenceWitnessStore } from "./store";
+export declare const EVIDENCE_WITNESS_REQUEST_CONTRACT: "absolutejs.vulnerability-evidence-witness-request/v1";
+export type EvidenceWitnessRequest = {
+    contract: typeof EVIDENCE_WITNESS_REQUEST_CONTRACT;
+    log: EvidenceKeyTransparencyLog;
+};
+export type EvidenceWitnessResponse = {
+    checkpoint: Awaited<ReturnType<EvidenceWitnessStore["observe"]>>["checkpoint"];
+    registry: EvidenceWitnessKeyRegistry;
+};
+export declare const createEvidenceWitnessService: (options: {
+    loadSigningState: () => Promise<string>;
+    origin: string;
+    signingState: EvidenceWitnessSigningState;
+    store: EvidenceWitnessStore;
+    storeSigningState: (encoded: string) => Promise<void>;
+}) => {
+    checkpoint: (subject: string, request: EvidenceWitnessRequest) => Promise<EvidenceWitnessResponse>;
+    registry: () => Promise<EvidenceWitnessKeyRegistry>;
+    rotate: (rotatedAt?: string) => Promise<EvidenceWitnessKeyRegistry>;
+};

package/dist/signing.d.ts

@@ -0,0 +1,32 @@
+import { type EvidenceSigningIdentity, type EvidenceSigningKeyTransition, type EvidenceVerificationKey } from "@absolutejs/vulnerabilities/evidence-bundle";
+declare const SIGNING_STATE_VERSION = 1;
+export type EvidenceWitnessSigningState = {
+    identity: EvidenceSigningIdentity;
+    transitions: EvidenceSigningKeyTransition[];
+    version: typeof SIGNING_STATE_VERSION;
+};
+export type EvidenceWitnessKeyRegistry = {
+    activeKeyId: string;
+    keys: EvidenceVerificationKey[];
+    transitions: EvidenceSigningKeyTransition[];
+    version: typeof SIGNING_STATE_VERSION;
+};
+export declare const createEvidenceWitnessSigningState: (createdAt?: string) => EvidenceWitnessSigningState;
+export declare const parseEvidenceWitnessSigningState: (value: unknown) => EvidenceWitnessSigningState;
+export declare const encodeEvidenceWitnessSigningState: (state: EvidenceWitnessSigningState) => string;
+export declare const rotateEvidenceWitnessSigningState: (state: EvidenceWitnessSigningState, rotatedAt?: string) => EvidenceWitnessSigningState;
+export declare const evidenceWitnessKeyRegistryFrom: (state: EvidenceWitnessSigningState) => EvidenceWitnessKeyRegistry;
+export declare const verifyEvidenceWitnessKeyRegistry: (input: {
+    registry: EvidenceWitnessKeyRegistry;
+    trustedKeys: readonly EvidenceVerificationKey[];
+}) => {
+    activeKey: EvidenceVerificationKey;
+    trust: "untrusted";
+} | {
+    activeKey: EvidenceVerificationKey;
+    trust: "trusted";
+} | {
+    activeKey: null;
+    trust: "untrusted";
+};
+export {};

package/dist/store.d.ts

@@ -0,0 +1,21 @@
+import type { SignedEvidenceWitnessCheckpoint } from "@absolutejs/vulnerabilities/evidence-witness";
+export type EvidenceWitnessObservation = {
+    checkpoint: SignedEvidenceWitnessCheckpoint;
+    subject: string;
+};
+export type EvidenceWitnessObservationInput = EvidenceWitnessObservation & {
+    history: readonly `sha256:${string}`[];
+};
+export type EvidenceWitnessObservationResult = {
+    checkpoint: SignedEvidenceWitnessCheckpoint;
+    status: "accepted" | "replay";
+};
+export interface EvidenceWitnessStore {
+    latest(subject: string): Promise<EvidenceWitnessObservation | null>;
+    observe(observation: EvidenceWitnessObservationInput): Promise<EvidenceWitnessObservationResult>;
+}
+export declare class EvidenceWitnessEquivocationError extends Error {
+}
+export declare class EvidenceWitnessRollbackError extends Error {
+}
+export declare const createMemoryEvidenceWitnessStore: () => EvidenceWitnessStore;

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@absolutejs/vulnerabilities-witness",
+  "version": "0.1.0",
+  "description": "Independent durable transparency witness with rollback, equivocation, key-rotation, and HTTP service primitives for AbsoluteJS vulnerability evidence.",
+  "type": "module",
+  "license": "BSL-1.1",
+  "author": "Alex Kahn",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/absolutejs/vulnerabilities-witness.git"
+  },
+  "homepage": "https://github.com/absolutejs/vulnerabilities-witness",
+  "bugs": {
+    "url": "https://github.com/absolutejs/vulnerabilities-witness/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "absolute-vulnerability-witness": "./dist/server.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "absolutejs": {
+    "manifestContract": 2
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./postgres": {
+      "types": "./dist/postgres.d.ts",
+      "import": "./dist/postgres.js"
+    },
+    "./manifest": {
+      "types": "./dist/manifest.d.ts",
+      "import": "./dist/manifest.js"
+    },
+    "./manifest.json": "./dist/manifest.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "format": "prettier --write \"./**/*.{ts,json,md}\"",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test",
+    "build": "rm -rf dist && bun build --root src src/index.ts src/postgres.ts src/server.ts src/manifest.ts --outdir dist --target=bun --external @absolutejs/manifest --external @absolutejs/vulnerabilities --external @sinclair/typebox && tsc -p tsconfig.build.json && absolute-manifest emit",
+    "check:package": "bun run format && bun run typecheck && bun run test && bun run build"
+  },
+  "keywords": [
+    "absolutejs",
+    "equivocation",
+    "key-transparency",
+    "security",
+    "vulnerability-management",
+    "witness"
+  ],
+  "dependencies": {
+    "@absolutejs/manifest": "0.3.0",
+    "@absolutejs/vulnerabilities": "0.13.0",
+    "@sinclair/typebox": "0.34.52"
+  },
+  "devDependencies": {
+    "@types/bun": "1.3.14",
+    "prettier": "3.8.1",
+    "typescript": "5.9.3"
+  }
+}