@absolutejs/vulnerabilities-witness 0.2.0 → 0.3.0

package/dist/index.js

@@ -115,7 +115,7 @@ var verifyEvidenceWitnessKeyRegistry = (input) => {
 // src/service.ts
 var EVIDENCE_WITNESS_REQUEST_CONTRACT = "absolutejs.vulnerability-evidence-witness-request/v1";
 var EVIDENCE_WITNESS_BACKUP_VERIFICATION_CONTRACT = "absolutejs.vulnerability-evidence-witness-backup-verification/v1";
-var EVIDENCE_WITNESS_STATUS_CONTRACT = "absolutejs.vulnerability-evidence-witness-status/v1";
+var EVIDENCE_WITNESS_STATUS_CONTRACT = "absolutejs.vulnerability-evidence-witness-status/v2";
 var timestamp = (value, label) => {
   if (!Number.isFinite(Date.parse(value)))
     throw new Error(`${label} is invalid`);
@@ -155,10 +155,11 @@ var createEvidenceWitnessService = (options) => {
     await refresh();
     return evidenceWitnessKeyRegistryFrom(state);
   };
-  const status = async () => ({
+  const status = async (subject) => ({
     backup: options.loadBackupVerification ? await options.loadBackupVerification().then((value) => value === null ? null : parseEvidenceWitnessBackupVerification(value)) : null,
     checkedAt: new Date().toISOString(),
     contract: EVIDENCE_WITNESS_STATUS_CONTRACT,
+    latestCheckpoint: await options.store.latest(subject).then((observation) => observation?.checkpoint ?? null),
     registry: await registry()
   });
   const checkpoint = async (subject, request) => {
@@ -306,7 +307,7 @@ var createEvidenceWitnessHttpHandler = (options) => async (request) => {
     const subject2 = await options.authenticate(bearer(request));
     if (!subject2)
       return json({ error: "unauthorized" }, 401);
-    return json(await options.service.status());
+    return json(await options.service.status(subject2));
   }
   if (request.method !== "POST" || url.pathname !== "/v1/checkpoints")
     return json({ error: "not_found" }, 404);

package/dist/server.js

@@ -117,7 +117,7 @@ var verifyEvidenceWitnessKeyRegistry = (input) => {
 // src/service.ts
 var EVIDENCE_WITNESS_REQUEST_CONTRACT = "absolutejs.vulnerability-evidence-witness-request/v1";
 var EVIDENCE_WITNESS_BACKUP_VERIFICATION_CONTRACT = "absolutejs.vulnerability-evidence-witness-backup-verification/v1";
-var EVIDENCE_WITNESS_STATUS_CONTRACT = "absolutejs.vulnerability-evidence-witness-status/v1";
+var EVIDENCE_WITNESS_STATUS_CONTRACT = "absolutejs.vulnerability-evidence-witness-status/v2";
 var timestamp = (value, label) => {
   if (!Number.isFinite(Date.parse(value)))
     throw new Error(`${label} is invalid`);
@@ -157,10 +157,11 @@ var createEvidenceWitnessService = (options) => {
     await refresh();
     return evidenceWitnessKeyRegistryFrom(state);
   };
-  const status = async () => ({
+  const status = async (subject) => ({
     backup: options.loadBackupVerification ? await options.loadBackupVerification().then((value) => value === null ? null : parseEvidenceWitnessBackupVerification(value)) : null,
     checkedAt: new Date().toISOString(),
     contract: EVIDENCE_WITNESS_STATUS_CONTRACT,
+    latestCheckpoint: await options.store.latest(subject).then((observation) => observation?.checkpoint ?? null),
     registry: await registry()
   });
   const checkpoint = async (subject, request) => {
@@ -308,7 +309,7 @@ var createEvidenceWitnessHttpHandler = (options) => async (request) => {
     const subject2 = await options.authenticate(bearer(request));
     if (!subject2)
       return json({ error: "unauthorized" }, 401);
-    return json(await options.service.status());
+    return json(await options.service.status(subject2));
   }
   if (request.method !== "POST" || url.pathname !== "/v1/checkpoints")
     return json({ error: "not_found" }, 404);
@@ -439,6 +440,18 @@ var loadOrBootstrap = async (name) => {
   await secrets.put(name, bootstrap);
   return bootstrap;
 };
+var loadOptionalBootstrap = async (name) => {
+  const stored = await secrets.fetch(name);
+  if (stored)
+    return stored;
+  const bootstrap = process.env[name]?.trim();
+  if (!bootstrap)
+    return null;
+  if (!secrets.put)
+    throw new Error("Encrypted secret adapter is read-only");
+  await secrets.put(name, bootstrap);
+  return bootstrap;
+};
 var database = new SQL(required("DATABASE_URL"));
 await ensurePostgresEvidenceWitnessSchema(database);
 var encodedSigningState = await loadOrBootstrap(signingStateName);
@@ -447,7 +460,7 @@ var tokens = JSON.parse(await loadOrBootstrap(tokensName));
 var subjectsByToken = new Map(Object.entries(tokens).map(([subject, token]) => [token, subject]));
 var service2 = createEvidenceWitnessService({
   loadBackupVerification: async () => {
-    const encoded = await secrets.fetch(backupVerificationName);
+    const encoded = await loadOptionalBootstrap(backupVerificationName);
     return encoded ? JSON.parse(encoded) : null;
   },
   loadSigningState: async () => {

package/dist/service.d.ts

@@ -11,7 +11,7 @@ export type EvidenceWitnessResponse = {
     registry: EvidenceWitnessKeyRegistry;
 };
 export declare const EVIDENCE_WITNESS_BACKUP_VERIFICATION_CONTRACT: "absolutejs.vulnerability-evidence-witness-backup-verification/v1";
-export declare const EVIDENCE_WITNESS_STATUS_CONTRACT: "absolutejs.vulnerability-evidence-witness-status/v1";
+export declare const EVIDENCE_WITNESS_STATUS_CONTRACT: "absolutejs.vulnerability-evidence-witness-status/v2";
 export type EvidenceWitnessBackupVerification = {
     contract: typeof EVIDENCE_WITNESS_BACKUP_VERIFICATION_CONTRACT;
     databaseArtifactDigest: `sha256:${string}`;
@@ -24,6 +24,7 @@ export type EvidenceWitnessStatus = {
     backup: EvidenceWitnessBackupVerification | null;
     checkedAt: string;
     contract: typeof EVIDENCE_WITNESS_STATUS_CONTRACT;
+    latestCheckpoint: EvidenceWitnessResponse["checkpoint"] | null;
     registry: EvidenceWitnessKeyRegistry;
 };
 export declare const parseEvidenceWitnessBackupVerification: (value: unknown) => EvidenceWitnessBackupVerification;
@@ -42,5 +43,5 @@ export declare const createEvidenceWitnessService: (options: {
     }) => Promise<EvidenceWitnessKeyRegistry>;
     registry: () => Promise<EvidenceWitnessKeyRegistry>;
     rotate: (rotatedAt?: string) => Promise<EvidenceWitnessKeyRegistry>;
-    status: () => Promise<EvidenceWitnessStatus>;
+    status: (subject: string) => Promise<EvidenceWitnessStatus>;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@absolutejs/vulnerabilities-witness",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Independent durable transparency witness with rollback, equivocation, key-rotation, and HTTP service primitives for AbsoluteJS vulnerability evidence.",
   "type": "module",
   "license": "BSL-1.1",